@runtime-digital-twin/sdk 1.0.0 → 1.0.3

package/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2025-2026 Wraith On-Call Engineer Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

package/README.md

@@ -91,6 +91,8 @@ await fastify.register(fastifyTracing, {
   headerAllowlist: [],         // Optional: Headers to capture
   maxBodySize: 10 * 1024 * 1024, // Optional: Max body size to capture (default: 10MB)
   enabled: true,              // Optional: Enable/disable tracing (default: true)
+  traceSampleRate: 1,         // Optional: 0–1; 1 = always, 0.1 = 10% of requests (default: 1)
+  alwaysTraceErrors: true,     // Optional: always capture trace for requests that error (default: true)
   // Upload options (optional)
   uploadUrl: process.env.WRAITH_API_URL + '/api/traces/ingest',
   apiKey: process.env.WRAITH_API_KEY,
@@ -136,6 +138,15 @@ WRAITH_API_KEY=your-api-key-here
 
 Traces are uploaded asynchronously after each request completes, so they don't slow down your application.
 
+### Sampling and errors
+
+- **traceSampleRate** (0–1): When set below 1, only that fraction of requests are traced (e.g. 0.1 = 10%). Reduces volume and cost while keeping a representative sample.
+- **alwaysTraceErrors**: When true (default), any request that ends in an error (Fastify `onError`) is traced and uploaded even if it was not sampled. Ensures failures are never missed.
+
+### Rate limits and 429
+
+If the ingest endpoint returns **429 Too Many Requests**, the uploader retries with exponential backoff (same as for 5xx). Use the **Retry-After** response header when present; the SDK respects backoff between attempts. To avoid hitting limits, reduce volume with **traceSampleRate** or increase **TRACE_INGEST_RATE_LIMIT_REQUESTS_PER_MIN** on the server.
+
 ## Modes
 
 ### Record Mode
@@ -209,6 +220,21 @@ import {
 
 See the [Quickstart Guide](../../QUICKSTART.md) for complete examples.
 
+## Changelog
+
+### v1.1.0
+- Enhanced trace upload with automatic retry
+- Improved CORS support for browser-based services
+- Better error handling and logging
+- Support for demo mode autofix integration
+
+### v1.0.0
+- Initial release
+- Fastify tracing plugin
+- Database query capture
+- HTTP client wrapping
+- Trace bundle writing
+
 ## License
 
 MIT

package/dist/fastify-plugin.d.ts

@@ -8,6 +8,10 @@ export interface FastifyTracingOptions {
     headerAllowlist?: string[];
     maxBodySize?: number;
     enabled?: boolean;
+    /** Sample rate 0–1. 1 = always trace, 0 = never, 0.1 = 10% of requests. Default 1. */
+    traceSampleRate?: number;
+    /** When true, always capture a trace for requests that end in error (onError), even if not sampled. Default true. */
+    alwaysTraceErrors?: boolean;
     uploadUrl?: string;
     apiKey?: string;
     uploadOnComplete?: boolean;

package/dist/fastify-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fastify-plugin.d.ts","sourceRoot":"","sources":["../src/fastify-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAgC,MAAM,SAAS,CAAC;AAE3E,OAAO,EAKL,WAAW,EACZ,MAAM,uBAAuB,CAAC;AAY/B,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,WAAW,CAAC,EAAE,WAAW,CAAC;QAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACtC;CACF;AAID;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,kBAAkB,CAAC,qBAAqB,CAsRpE,CAAC;;AAGF,wBAGG"}
+{"version":3,"file":"fastify-plugin.d.ts","sourceRoot":"","sources":["../src/fastify-plugin.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAgC,MAAM,SAAS,CAAC;AAE3E,OAAO,EAKL,WAAW,EACZ,MAAM,uBAAuB,CAAC;AAY/B,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,sFAAsF;IACtF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qHAAqH;IACrH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,WAAW,CAAC,EAAE,WAAW,CAAC;QAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACtC;CACF;AAID;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,kBAAkB,CAAC,qBAAqB,CAyVpE,CAAC;;AAGF,wBAGG"}

package/dist/fastify-plugin.js

@@ -4,6 +4,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.fastifyTracing = void 0;
+const promises_1 = require("fs/promises");
+const path_1 = require("path");
 const fastify_plugin_1 = __importDefault(require("fastify-plugin"));
 const trace_bundle_writer_1 = require("./trace-bundle-writer");
 const http_wrapper_1 = require("./http-wrapper");
@@ -15,7 +17,7 @@ const DEFAULT_MAX_BODY_SIZE = 10 * 1024 * 1024; // 10MB
  * Fastify plugin for capturing HTTP request/response traces
  */
 const fastifyTracing = async (fastify, options) => {
-    const { serviceName, serviceVersion, environment, traceDir, headerAllowlist, maxBodySize = DEFAULT_MAX_BODY_SIZE, enabled = true, uploadUrl, apiKey, uploadOnComplete = true, } = options;
+    const { serviceName, serviceVersion, environment, traceDir, headerAllowlist, maxBodySize = DEFAULT_MAX_BODY_SIZE, enabled = true, traceSampleRate = 1, alwaysTraceErrors = true, uploadUrl, apiKey, uploadOnComplete = true, } = options;
     if (!enabled) {
         fastify.log.info("[SDK] Tracing is disabled");
         return;
@@ -27,30 +29,36 @@ const fastifyTracing = async (fastify, options) => {
     // Hook: onRequest - initialize trace but don't write request event yet (body not available)
     fastify.addHook("onRequest", async (request, reply) => {
         try {
+            const sampledIn = traceSampleRate >= 1 || (traceSampleRate > 0 && Math.random() < traceSampleRate);
+            request.traceSampledIn = sampledIn;
+            if (!sampledIn) {
+                request.traceBundle = null;
+                request.traceSpanId = null;
+                request.traceStartTime = null;
+                request.traceRequestBodyHash = null;
+                request.traceIncomingParentSpanId = null;
+                return;
+            }
             // Check for trace context propagation headers
             const incomingTraceId = request.headers['x-wraith-trace-id'];
             const incomingParentSpanId = request.headers['x-wraith-parent-span-id'];
             // Create trace bundle for this request
-            // Use incoming traceId if present (cross-service propagation), otherwise generate new one
             const traceBundle = await (0, trace_bundle_writer_1.createTrace)({
                 serviceName,
                 serviceVersion,
                 environment,
                 traceDir,
-                traceId: incomingTraceId, // Will be undefined if header not present, triggering new traceId generation
+                traceId: incomingTraceId,
             });
             const spanId = (0, trace_bundle_writer_1.generateSpanId)();
             const startTime = Date.now();
-            // Store on request for later use
             request.traceBundle = traceBundle;
             request.traceSpanId = spanId;
             request.traceStartTime = startTime;
-            request.traceRequestBodyHash = null; // Will be set in preHandler
-            // Store incoming parent span ID for use in preHandler
+            request.traceRequestBodyHash = null;
             request.traceIncomingParentSpanId = incomingParentSpanId || null;
         }
         catch (error) {
-            // Fail-open: log error but don't crash
             fastify.log.error(`[SDK] Failed to initialize trace: ${error}`);
         }
     });
@@ -179,8 +187,8 @@ const fastifyTracing = async (fastify, options) => {
             });
             // Auto-upload trace if configured
             if (uploadUrl && apiKey && uploadOnComplete !== false) {
-                // Upload asynchronously (don't block response)
                 const actualTraceDir = traceDir || './traces';
+                const tracePath = (0, path_1.join)(actualTraceDir, traceBundle.traceId);
                 (0, trace_uploader_1.uploadTrace)({
                     uploadUrl,
                     apiKey,
@@ -189,15 +197,22 @@ const fastifyTracing = async (fastify, options) => {
                     serviceName,
                     serviceVersion,
                     environment,
-                }).then(result => {
+                }).then(async (result) => {
                     if (result.success) {
-                        fastify.log.info(`[SDK] Trace uploaded: ${result.traceId}`);
+                        fastify.log.info({ traceId: result.traceId }, '[SDK] Trace uploaded');
+                        // Delete local trace dir after successful upload to avoid re-upload and unbounded disk growth
+                        try {
+                            await (0, promises_1.rm)(tracePath, { recursive: true, force: true });
+                        }
+                        catch (err) {
+                            fastify.log.debug({ traceId: traceBundle.traceId, err: err?.message }, '[SDK] Could not delete trace dir after upload');
+                        }
                     }
                     else {
-                        fastify.log.warn(`[SDK] Trace upload failed: ${result.error}`);
+                        fastify.log.warn({ traceId: traceBundle.traceId, error: result.error }, '[SDK] Trace upload failed');
                     }
                 }).catch(error => {
-                    fastify.log.error(`[SDK] Trace upload error: ${error}`);
+                    fastify.log.error({ traceId: traceBundle.traceId, error: error?.message }, '[SDK] Trace upload error');
                 });
             }
             // Clear trace context
@@ -210,13 +225,67 @@ const fastifyTracing = async (fastify, options) => {
             (0, http_wrapper_1.setTraceContext)(null, null);
         }
     });
-    // Hook: onError - capture errors
+    // Hook: onError - capture errors (always capture if alwaysTraceErrors and no bundle yet)
     fastify.addHook("onError", async (request, reply, error) => {
-        const traceBundle = request.traceBundle;
-        const spanId = request.traceSpanId;
-        if (!traceBundle || !spanId) {
+        let traceBundle = request.traceBundle;
+        let spanId = request.traceSpanId;
+        const wasSampledOut = !request.traceSampledIn;
+        if (wasSampledOut && alwaysTraceErrors) {
+            try {
+                const bundle = await (0, trace_bundle_writer_1.createTrace)({
+                    serviceName,
+                    serviceVersion,
+                    environment,
+                    traceDir,
+                });
+                const sid = (0, trace_bundle_writer_1.generateSpanId)();
+                traceBundle = bundle;
+                spanId = sid;
+                await bundle.writeEvent({
+                    type: "error",
+                    timestamp: Date.now(),
+                    spanId: sid,
+                    parentSpanId: null,
+                    error: {
+                        name: error.name || "Error",
+                        message: error.message || String(error),
+                        stack: error.stack || undefined,
+                    },
+                });
+                await bundle.complete({
+                    method: 'ERROR',
+                    path: '/error',
+                    headers: {},
+                });
+                if (uploadUrl && apiKey) {
+                    const actualTraceDir = traceDir || './traces';
+                    const tracePath = (0, path_1.join)(actualTraceDir, bundle.traceId);
+                    (0, trace_uploader_1.uploadTrace)({
+                        uploadUrl,
+                        apiKey,
+                        traceDir: actualTraceDir,
+                        traceId: bundle.traceId,
+                        serviceName,
+                        serviceVersion,
+                        environment,
+                    }).then(async (result) => {
+                        if (result.success) {
+                            try {
+                                // Delete local trace dir after successful upload to prevent re-upload and unbounded disk growth
+                                await (0, promises_1.rm)(tracePath, { recursive: true, force: true });
+                            }
+                            catch (_) { }
+                        }
+                    }).catch(() => { });
+                }
+            }
+            catch (err) {
+                fastify.log.error(`[SDK] Failed to capture error trace: ${err}`);
+            }
             return;
         }
+        if (!traceBundle || !spanId)
+            return;
         try {
             await traceBundle.writeEvent({
                 type: "error",

package/dist/http-wrapper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-wrapper.d.ts","sourceRoot":"","sources":["../src/http-wrapper.ts"],"names":[],"mappings":"AAwBA;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,GAAG,IAAI,EACvI,MAAM,EAAE,MAAM,GAAG,IAAI,QAQtB;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI;IACjC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;IACxI,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAMA;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,aAAa,EAAE,OAAO,KAAK,GAAG,OAAO,KAAK,CA2dnE"}
+{"version":3,"file":"http-wrapper.d.ts","sourceRoot":"","sources":["../src/http-wrapper.ts"],"names":[],"mappings":"AAwBA;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,GAAG,IAAI,EACvI,MAAM,EAAE,MAAM,GAAG,IAAI,QAQtB;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI;IACjC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;IACxI,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAMA;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,aAAa,EAAE,OAAO,KAAK,GAAG,OAAO,KAAK,CA0gBnE"}

package/dist/http-wrapper.js

@@ -64,10 +64,53 @@ function wrapFetch(originalFetch) {
                     // - If peerService is null → route to mock server (stub)
                     if (peerService) {
                         if (subgraphServices.includes(peerService)) {
-                            // Call is to a service in subgraph - should route to actual service
-                            // TODO: Implement actual service routing (requires service discovery/URL mapping)
-                            // For now, route to mock server as fallback
-                            shouldRouteToMock = true;
+                            // Call is to a service in subgraph - route to actual service
+                            // Check for service URL mapping via environment variables
+                            const serviceUrlEnv = process.env[`${peerService.toUpperCase().replace(/-/g, '_')}_URL`];
+                            const serviceUrls = process.env.SERVICE_URLS || '';
+                            // Parse SERVICE_URLS: "service-a:http://localhost:3001,service-b:http://localhost:3002"
+                            // Note: Split on first ':' only to handle URLs with colons
+                            const urlMap = new Map();
+                            if (serviceUrls) {
+                                for (const mapping of serviceUrls.split(',')) {
+                                    const colonIndex = mapping.indexOf(':');
+                                    if (colonIndex > 0) {
+                                        const service = mapping.substring(0, colonIndex).trim();
+                                        const url = mapping.substring(colonIndex + 1).trim();
+                                        if (service && url) {
+                                            urlMap.set(service, url);
+                                        }
+                                    }
+                                }
+                            }
+                            const serviceUrl = serviceUrlEnv || urlMap.get(peerService);
+                            if (serviceUrl) {
+                                // Route to actual service
+                                try {
+                                    const path = urlObj.pathname + urlObj.search;
+                                    const fullUrl = new URL(path, serviceUrl).toString();
+                                    // Get trace context for propagation
+                                    const { bundle, spanId } = getTraceContext();
+                                    // Make request to actual service with trace headers
+                                    const enhancedInit = {
+                                        ...init,
+                                        headers: {
+                                            ...(init?.headers || {}),
+                                            ...(bundle?.traceId ? { 'x-trace-id': bundle.traceId } : {}),
+                                            ...(spanId ? { 'x-span-id': spanId } : {}),
+                                        },
+                                    };
+                                    return await originalFetch(fullUrl, enhancedInit);
+                                }
+                                catch (error) {
+                                    console.warn(`[SDK] Failed to route to ${peerService}: ${error}`);
+                                    shouldRouteToMock = true;
+                                }
+                            }
+                            else {
+                                // No service URL configured, route to mock
+                                shouldRouteToMock = true;
+                            }
                         }
                         else if (stubServices.includes(peerService)) {
                             // Call is to a stubbed service - route to mock server

package/dist/redaction.d.ts

@@ -55,6 +55,7 @@ export declare function createRedactedValue(originalValue: string, includeHash?:
 export declare function loadRedactionConfig(configPath?: string): RedactionConfig;
 /**
  * Set global redaction config
+ * SECURITY: Redaction cannot be disabled - any attempt to set enabled: false will throw an error
  */
 export declare function setRedactionConfig(config: Partial<RedactionConfig>): void;
 /**
@@ -63,38 +64,47 @@ export declare function setRedactionConfig(config: Partial<RedactionConfig>): vo
 export declare function getRedactionConfig(): RedactionConfig;
 /**
  * Reset redaction config to defaults
+ * SECURITY: Always ensures enabled = true
  */
 export declare function resetRedactionConfig(): void;
 /**
  * Check if a header name should be redacted
+ * SECURITY: Redaction is always enabled - enabled check removed for enforcement
  */
 export declare function shouldRedactHeader(headerName: string): boolean;
 /**
  * Check if a query param should be redacted
+ * SECURITY: Redaction is always enabled - enabled check removed for enforcement
  */
 export declare function shouldRedactQueryParam(paramName: string): boolean;
 /**
  * Redact headers in a headers object
+ * SECURITY: Redaction is always enforced - enabled check removed
  */
 export declare function redactHeaders(headers: Record<string, string | string[] | undefined>): Record<string, string | string[] | undefined>;
 /**
  * Redact query parameters
+ * SECURITY: Redaction is always enforced - enabled check removed
  */
 export declare function redactQueryParams(query: Record<string, any>): Record<string, any>;
 /**
  * Redact sensitive fields from a body object (recursive)
+ * SECURITY: Redaction is always enforced - enabled check removed
  */
 export declare function redactBodyObject(body: any): any;
 /**
  * Redact patterns from a body string
+ * SECURITY: Redaction is always enforced - enabled check removed
  */
 export declare function redactBodyPatterns(body: string): string;
 /**
  * Redact a body (handles both string and object)
+ * SECURITY: Redaction is always enforced - enabled check removed
  */
 export declare function redactBody(body: string | object | null | undefined): string | object | null | undefined;
 /**
  * Redact a URL (query params)
+ * SECURITY: Redaction is always enforced - enabled check removed
  */
 export declare function redactUrl(url: string): string;
 /**

package/dist/redaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH;;GAEG;AACH,MAAM,MAAM,iBAAiB,GACzB,QAAQ,GACR,YAAY,GACZ,cAAc,GACd,aAAa,CAAC;AAElB;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,iBAAiB,CAAC;IACxB,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,OAAO,EAAE,OAAO,CAAC;IACjB,sCAAsC;IACtC,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,sCAAsC;IACtC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAkJD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,MAAoC,GACzC,MAAM,CAMR;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,aAAa,EAAE,MAAM,EACrB,WAAW,GAAE,OAAc,EAC3B,IAAI,CAAC,EAAE,MAAM,GACZ,MAAM,CAMR;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,eAAe,CAwCxE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAQzE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,eAAe,CAEpD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAiB9D;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiBjE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACrD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAwB/C;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACzB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAsBrB;AAsBD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,GAAG,GAAG,GAAG,CAkC/C;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAwBvD;AAED;;GAEG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CA6BpC;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CA6B7C;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAYhE;AAED;;GAEG;AACH,eAAO,MAAM,iBAAiB,UAA4B,CAAC;AAC3D,eAAO,MAAM,sBAAsB,UAAiC,CAAC;AACrE,eAAO,MAAM,qBAAqB,UAAgC,CAAC"}
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH;;GAEG;AACH,MAAM,MAAM,iBAAiB,GACzB,QAAQ,GACR,YAAY,GACZ,cAAc,GACd,aAAa,CAAC;AAElB;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,iBAAiB,CAAC;IACxB,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,OAAO,EAAE,OAAO,CAAC;IACjB,sCAAsC;IACtC,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,sCAAsC;IACtC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAoOD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,MAAoC,GACzC,MAAM,CAMR;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,aAAa,EAAE,MAAM,EACrB,WAAW,GAAE,OAAc,EAC3B,IAAI,CAAC,EAAE,MAAM,GACZ,MAAM,CAMR;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,eAAe,CAiDxE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAiBzE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,eAAe,CAEpD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAM3C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAkB9D;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAkBjE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACrD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAyB/C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACzB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAuBrB;AAsBD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,GAAG,GAAG,GAAG,CAmC/C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAyBvD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CA8BpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CA8B7C;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAYhE;AAED;;GAEG;AACH,eAAO,MAAM,iBAAiB,UAA4B,CAAC;AAC3D,eAAO,MAAM,sBAAsB,UAAiC,CAAC;AACrE,eAAO,MAAM,qBAAqB,UAAgC,CAAC"}

package/dist/redaction.js

@@ -66,8 +66,10 @@ const DEFAULT_SENSITIVE_QUERY_PARAMS = [
 ];
 /**
  * Default sensitive body field names (case-insensitive)
+ * Includes PII (Personally Identifiable Information) fields for GDPR/compliance
  */
 const DEFAULT_SENSITIVE_BODY_FIELDS = [
+    // Authentication & Secrets
     "password",
     "passwd",
     "pwd",
@@ -84,20 +86,86 @@ const DEFAULT_SENSITIVE_BODY_FIELDS = [
     "secretKey",
     "client_secret",
     "clientSecret",
-    "ssn",
-    "social_security",
+    "pin",
+    // Financial Information
     "credit_card",
     "creditCard",
     "card_number",
     "cardNumber",
     "cvv",
     "cvc",
-    "pin",
+    "bank_account",
+    "bankAccount",
+    "routing_number",
+    "routingNumber",
+    // PII - Personal Identifiers
+    "ssn",
+    "social_security",
+    "social_security_number",
+    "tax_id",
+    "taxId",
+    "driver_license",
+    "driverLicense",
+    "passport",
+    "national_id",
+    "nationalId",
+    // PII - Contact Information
+    "email",
+    "email_address",
+    "emailAddress",
+    "phone",
+    "phone_number",
+    "phoneNumber",
+    "mobile",
+    "mobile_number",
+    "mobileNumber",
+    "telephone",
+    "address",
+    "street_address",
+    "streetAddress",
+    "home_address",
+    "homeAddress",
+    "billing_address",
+    "billingAddress",
+    "shipping_address",
+    "shippingAddress",
+    // PII - Personal Details
+    "first_name",
+    "firstName",
+    "last_name",
+    "lastName",
+    "full_name",
+    "fullName",
+    "name",
+    "date_of_birth",
+    "dateOfBirth",
+    "dob",
+    "birth_date",
+    "birthDate",
+    "age",
+    "gender",
+    "race",
+    "ethnicity",
+    // PII - Location
+    "city",
+    "state",
+    "province",
+    "zip",
+    "zip_code",
+    "zipCode",
+    "postal_code",
+    "postalCode",
+    "country",
+    "latitude",
+    "longitude",
+    "coordinates",
 ];
 /**
  * Default body patterns to redact (regex)
+ * Includes PII pattern detection for comprehensive data protection
  */
 const DEFAULT_SENSITIVE_BODY_PATTERNS = [
+    // Authentication tokens
     // Bearer tokens
     /Bearer\s+[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]*/g,
     // JWT tokens
@@ -106,8 +174,21 @@ const DEFAULT_SENSITIVE_BODY_PATTERNS = [
     /(?:api[_-]?key|apikey)[=:]["']?[A-Za-z0-9\-_]{20,}["']?/gi,
     // AWS access keys
     /AKIA[0-9A-Z]{16}/g,
+    // Financial Information
     // Credit card numbers (basic pattern)
     /\b(?:\d{4}[- ]?){3}\d{4}\b/g,
+    // PII - Email addresses (pattern-based detection)
+    /\b[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}\b/g,
+    // PII - Phone numbers (US and international formats)
+    /\b\+?[\d\s\-()]{10,}\b/g,
+    // PII - Social Security Numbers (US format)
+    /\b\d{3}-\d{2}-\d{4}\b/g,
+    /\b\d{9}\b/g, // 9 consecutive digits (potential SSN)
+    // PII - Dates that might be DOB (MM/DD/YYYY, YYYY-MM-DD, etc.)
+    /\b(0[1-9]|1[0-2])[\/\-](0[1-9]|[12]\d|3[01])[\/\-]\d{4}\b/g,
+    /\b\d{4}[\/\-](0[1-9]|1[0-2])[\/\-](0[1-9]|[12]\d|3[01])\b/g,
+    // PII - IP addresses (may contain sensitive location data)
+    /\b(?:\d{1,3}\.){3}\d{1,3}\b/g,
 ];
 /**
  * Build default redaction rules
@@ -150,11 +231,12 @@ function buildDefaultRules() {
 }
 /**
  * Default redaction configuration
+ * SECURITY: Redaction is ALWAYS enabled and cannot be disabled for compliance
  */
 const DEFAULT_CONFIG = {
-    enabled: true,
+    enabled: true, // Always true - cannot be changed
     rules: buildDefaultRules(),
-    hashSalt: "rdt-redaction-salt-v1",
+    hashSalt: process.env.REDACTION_SALT || process.env.REDACTION_HASH_SALT || "rdt-redaction-salt-v1",
 };
 /**
  * Global redaction config (can be overridden)
@@ -201,14 +283,20 @@ function loadRedactionConfig(configPath) {
                 if (config.redaction) {
                     const userConfig = config.redaction;
                     // Merge with defaults
+                    // SECURITY: Always enforce enabled = true, ignore user attempts to disable
                     const mergedConfig = {
-                        enabled: userConfig.enabled ?? true,
+                        enabled: true, // Always true - cannot be disabled
                         rules: userConfig.overrideDefaults
                             ? userConfig.rules || []
                             : [...buildDefaultRules(), ...(userConfig.rules || [])],
                         overrideDefaults: userConfig.overrideDefaults,
                         hashSalt: userConfig.hashSalt || DEFAULT_CONFIG.hashSalt,
                     };
+                    // Warn if user tried to disable redaction
+                    if (userConfig.enabled === false) {
+                        console.warn('[Redaction] Attempted to disable redaction in config file. ' +
+                            'Redaction is always enabled for security compliance. Ignoring enabled: false.');
+                    }
                     return mergedConfig;
                 }
             }
@@ -221,11 +309,18 @@ function loadRedactionConfig(configPath) {
 }
 /**
  * Set global redaction config
+ * SECURITY: Redaction cannot be disabled - any attempt to set enabled: false will throw an error
  */
 function setRedactionConfig(config) {
+    // SECURITY: Prevent disabling redaction for compliance
+    if (config.enabled === false) {
+        throw new Error('Redaction cannot be disabled for security and compliance requirements. ' +
+            'All sensitive data must be redacted before storage.');
+    }
     globalConfig = {
         ...DEFAULT_CONFIG,
         ...config,
+        enabled: true, // Always enforce enabled = true
         rules: config.overrideDefaults
             ? config.rules || []
             : [...buildDefaultRules(), ...(config.rules || [])],
@@ -239,16 +334,22 @@ function getRedactionConfig() {
 }
 /**
  * Reset redaction config to defaults
+ * SECURITY: Always ensures enabled = true
  */
 function resetRedactionConfig() {
-    globalConfig = { ...DEFAULT_CONFIG, rules: buildDefaultRules() };
+    globalConfig = {
+        ...DEFAULT_CONFIG,
+        enabled: true, // Always enforce enabled
+        rules: buildDefaultRules()
+    };
 }
 /**
  * Check if a header name should be redacted
+ * SECURITY: Redaction is always enabled - enabled check removed for enforcement
  */
 function shouldRedactHeader(headerName) {
-    if (!globalConfig.enabled)
-        return false;
+    // SECURITY: Redaction is always enabled - removed bypass check
+    // if (!globalConfig.enabled) return false; // REMOVED - cannot bypass
     const lowerName = headerName.toLowerCase();
     for (const rule of globalConfig.rules) {
         if (rule.type !== "header")
@@ -267,10 +368,11 @@ function shouldRedactHeader(headerName) {
 }
 /**
  * Check if a query param should be redacted
+ * SECURITY: Redaction is always enabled - enabled check removed for enforcement
  */
 function shouldRedactQueryParam(paramName) {
-    if (!globalConfig.enabled)
-        return false;
+    // SECURITY: Redaction is always enabled - removed bypass check
+    // if (!globalConfig.enabled) return false; // REMOVED - cannot bypass
     const lowerName = paramName.toLowerCase();
     for (const rule of globalConfig.rules) {
         if (rule.type !== "query_param")
@@ -289,10 +391,11 @@ function shouldRedactQueryParam(paramName) {
 }
 /**
  * Redact headers in a headers object
+ * SECURITY: Redaction is always enforced - enabled check removed
  */
 function redactHeaders(headers) {
-    if (!globalConfig.enabled)
-        return headers;
+    // SECURITY: Redaction is always enabled - removed bypass check
+    // if (!globalConfig.enabled) return headers; // REMOVED - cannot bypass
     const redacted = {};
     for (const [key, value] of Object.entries(headers)) {
         if (value === undefined) {
@@ -311,10 +414,11 @@ function redactHeaders(headers) {
 }
 /**
  * Redact query parameters
+ * SECURITY: Redaction is always enforced - enabled check removed
  */
 function redactQueryParams(query) {
-    if (!globalConfig.enabled)
-        return query;
+    // SECURITY: Redaction is always enabled - removed bypass check
+    // if (!globalConfig.enabled) return query; // REMOVED - cannot bypass
     const redacted = {};
     for (const [key, value] of Object.entries(query)) {
         if (shouldRedactQueryParam(key)) {
@@ -352,10 +456,11 @@ function shouldRedactBodyField(fieldName) {
 }
 /**
  * Redact sensitive fields from a body object (recursive)
+ * SECURITY: Redaction is always enforced - enabled check removed
  */
 function redactBodyObject(body) {
-    if (!globalConfig.enabled)
-        return body;
+    // SECURITY: Redaction is always enabled - removed bypass check
+    // if (!globalConfig.enabled) return body; // REMOVED - cannot bypass
     if (body === null || body === undefined) {
         return body;
     }
@@ -382,10 +487,11 @@ function redactBodyObject(body) {
 }
 /**
  * Redact patterns from a body string
+ * SECURITY: Redaction is always enforced - enabled check removed
  */
 function redactBodyPatterns(body) {
-    if (!globalConfig.enabled)
-        return body;
+    // SECURITY: Redaction is always enabled - removed bypass check
+    // if (!globalConfig.enabled) return body; // REMOVED - cannot bypass
     let result = body;
     for (const rule of globalConfig.rules) {
         if (rule.type !== "body_pattern" || !rule.pattern)
@@ -405,10 +511,11 @@ function redactBodyPatterns(body) {
 }
 /**
  * Redact a body (handles both string and object)
+ * SECURITY: Redaction is always enforced - enabled check removed
  */
 function redactBody(body) {
-    if (!globalConfig.enabled)
-        return body;
+    // SECURITY: Redaction is always enabled - removed bypass check
+    // if (!globalConfig.enabled) return body; // REMOVED - cannot bypass
     if (body === null || body === undefined) {
         return body;
     }
@@ -436,10 +543,11 @@ function redactBody(body) {
 }
 /**
  * Redact a URL (query params)
+ * SECURITY: Redaction is always enforced - enabled check removed
  */
 function redactUrl(url) {
-    if (!globalConfig.enabled)
-        return url;
+    // SECURITY: Redaction is always enabled - removed bypass check
+    // if (!globalConfig.enabled) return url; // REMOVED - cannot bypass
     try {
         const urlObj = new URL(url, "http://placeholder");
         const redactedParams = new URLSearchParams();

package/dist/trace-bundle-writer.d.ts

@@ -32,19 +32,17 @@ export declare function createTrace(options: CreateTraceOptions): Promise<TraceB
  * Helper to process body content and store as blob
  * Applies redaction to sensitive fields before storing
  * NOTE: Always stores bodies as blobs so they can be retrieved during replay
+ * SECURITY: Redaction is ALWAYS enforced - skipRedaction option removed
  */
-export declare function processBody(body: string | Buffer | object | null | undefined, writeBlobFn: (content: string | object) => Promise<string>, options?: {
-    skipRedaction?: boolean;
-}): Promise<{
+export declare function processBody(body: string | Buffer | object | null | undefined, writeBlobFn: (content: string | object) => Promise<string>): Promise<{
     bodyHash: string | null;
     bodyBlob: string | null;
 }>;
 /**
  * Filter headers based on allowlist and apply redaction
+ * SECURITY: Redaction is ALWAYS enforced - skipRedaction option removed
  */
-export declare function filterHeaders(headers: Record<string, string | string[] | undefined>, allowlist?: string[], options?: {
-    skipRedaction?: boolean;
-}): Record<string, string>;
+export declare function filterHeaders(headers: Record<string, string | string[] | undefined>, allowlist?: string[]): Record<string, string>;
 /**
  * Generate span ID (exported for use in middleware)
  */

package/dist/trace-bundle-writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trace-bundle-writer.d.ts","sourceRoot":"","sources":["../src/trace-bundle-writer.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzD,QAAQ,EAAE,CAAC,cAAc,CAAC,EAAE;QAC1B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrB;AAED,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AAM3D,OAAO,EAAE,4BAA4B,EAAE,CAAC;AAWxC;;GAEG;AACH,iBAAS,cAAc,IAAI,MAAM,CAEhC;AAgBD;;GAEG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,WAAW,CAAC,CAkLtB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,EACjD,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,EAC1D,OAAO,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,GACpC,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAiC7D;AAEH;;GAEG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EACtD,SAAS,CAAC,EAAE,MAAM,EAAE,EACpB,OAAO,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,GACpC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAyCxB;AAED;;GAEG;AACH,OAAO,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"trace-bundle-writer.d.ts","sourceRoot":"","sources":["../src/trace-bundle-writer.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzD,QAAQ,EAAE,CAAC,cAAc,CAAC,EAAE;QAC1B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrB;AAED,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AAM3D,OAAO,EAAE,4BAA4B,EAAE,CAAC;AAWxC;;GAEG;AACH,iBAAS,cAAc,IAAI,MAAM,CAEhC;AAgBD;;GAEG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,WAAW,CAAC,CAkLtB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,EACjD,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAEzD,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CA+B7D;AAEH;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EACtD,SAAS,CAAC,EAAE,MAAM,EAAE,GAEnB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAqCxB;AAED;;GAEG;AACH,OAAO,EAAE,cAAc,EAAE,CAAC"}

package/dist/trace-bundle-writer.js

@@ -190,8 +190,11 @@ async function createTrace(options) {
  * Helper to process body content and store as blob
  * Applies redaction to sensitive fields before storing
  * NOTE: Always stores bodies as blobs so they can be retrieved during replay
+ * SECURITY: Redaction is ALWAYS enforced - skipRedaction option removed
  */
-function processBody(body, writeBlobFn, options) {
+function processBody(body, writeBlobFn
+// SECURITY: Removed skipRedaction option - redaction is always enforced
+) {
     if (!body) {
         return Promise.resolve({ bodyHash: null, bodyBlob: null });
     }
@@ -205,15 +208,13 @@ function processBody(body, writeBlobFn, options) {
     else {
         bodyStr = String(body);
     }
-    // Apply redaction unless explicitly skipped
-    if (!options?.skipRedaction) {
-        const redacted = (0, redaction_1.redactBody)(bodyStr);
-        if (typeof redacted === "string") {
-            bodyStr = redacted;
-        }
-        else if (redacted !== null && redacted !== undefined) {
-            bodyStr = JSON.stringify(redacted);
-        }
+    // SECURITY: Redaction is ALWAYS applied - no bypass option
+    const redacted = (0, redaction_1.redactBody)(bodyStr);
+    if (typeof redacted === "string") {
+        bodyStr = redacted;
+    }
+    else if (redacted !== null && redacted !== undefined) {
+        bodyStr = JSON.stringify(redacted);
     }
     const hash = computeHash(bodyStr);
     const hashFormatted = formatHash(hash);
@@ -226,8 +227,11 @@ function processBody(body, writeBlobFn, options) {
 }
 /**
  * Filter headers based on allowlist and apply redaction
+ * SECURITY: Redaction is ALWAYS enforced - skipRedaction option removed
  */
-function filterHeaders(headers, allowlist, options) {
+function filterHeaders(headers, allowlist
+// SECURITY: Removed skipRedaction option - redaction is always enforced
+) {
     if (!allowlist || allowlist.length === 0) {
         // Default allowlist: common headers that are safe to capture
         const defaultAllowlist = [
@@ -241,7 +245,7 @@ function filterHeaders(headers, allowlist, options) {
             "x-request-id",
             "x-correlation-id",
         ];
-        return filterHeaders(headers, defaultAllowlist, options);
+        return filterHeaders(headers, defaultAllowlist);
     }
     const filtered = {};
     const lowerAllowlist = allowlist.map((h) => h.toLowerCase());
@@ -252,16 +256,13 @@ function filterHeaders(headers, allowlist, options) {
             filtered[key] = Array.isArray(value) ? value.join(", ") : String(value);
         }
     }
-    // Apply redaction unless explicitly skipped
-    if (!options?.skipRedaction) {
-        const redacted = (0, redaction_1.redactHeaders)(filtered);
-        const result = {};
-        for (const [key, value] of Object.entries(redacted)) {
-            if (value !== undefined) {
-                result[key] = Array.isArray(value) ? value.join(", ") : String(value);
-            }
+    // SECURITY: Redaction is ALWAYS applied - no bypass option
+    const redacted = (0, redaction_1.redactHeaders)(filtered);
+    const result = {};
+    for (const [key, value] of Object.entries(redacted)) {
+        if (value !== undefined) {
+            result[key] = Array.isArray(value) ? value.join(", ") : String(value);
         }
-        return result;
     }
-    return filtered;
+    return result;
 }

package/dist/trace-uploader.d.ts

@@ -19,7 +19,8 @@ export interface TraceUploadResult {
     error?: string;
 }
 /**
- * Upload trace to ingestion endpoint
+ * Upload trace to ingestion endpoint with retries (5xx, 429, network errors).
+ * Exponential backoff: 1s, 2s, 4s (capped at 8s).
  */
 export declare function uploadTrace(options: TraceUploadOptions): Promise<TraceUploadResult>;
 //# sourceMappingURL=trace-uploader.d.ts.map

package/dist/trace-uploader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trace-uploader.d.ts","sourceRoot":"","sources":["../src/trace-uploader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA+CD;;GAEG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAiF5B"}
+{"version":3,"file":"trace-uploader.d.ts","sourceRoot":"","sources":["../src/trace-uploader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAmED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAwI5B"}

package/dist/trace-uploader.js

@@ -53,8 +53,26 @@ async function readTraceMeta(metaPath) {
         throw new Error(`Failed to read meta.json: ${error.message}`);
     }
 }
+const MAX_UPLOAD_ATTEMPTS = 3;
+const INITIAL_BACKOFF_MS = 1000;
+const MAX_BACKOFF_MS = 8000;
+function isRetryableStatus(status) {
+    return status >= 500 || status === 429;
+}
+function sleep(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+function logUpload(event) {
+    try {
+        console.warn('[SDK]', JSON.stringify({ event: 'trace_upload', ...event }));
+    }
+    catch {
+        console.warn('[SDK] trace_upload', event);
+    }
+}
 /**
- * Upload trace to ingestion endpoint
+ * Upload trace to ingestion endpoint with retries (5xx, 429, network errors).
+ * Exponential backoff: 1s, 2s, 4s (capped at 8s).
  */
 async function uploadTrace(options) {
     const { uploadUrl, apiKey, traceDir, traceId, serviceName, serviceVersion, environment } = options;
@@ -89,7 +107,6 @@ async function uploadTrace(options) {
                 correlationIds: meta.correlationIds || [],
             },
             events: events.map(event => {
-                // Ensure all events have required base envelope fields
                 return {
                     ...event,
                     traceId: event.traceId || traceId,
@@ -98,31 +115,77 @@ async function uploadTrace(options) {
                 };
             }),
         };
-        // Upload to ingestion endpoint
-        const response = await fetch(uploadUrl, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'Authorization': `Bearer ${apiKey}`,
-            },
-            body: JSON.stringify(batch),
-        });
-        if (!response.ok) {
-            const errorText = await response.text();
-            return {
-                success: false,
-                traceId,
-                error: `Upload failed: ${response.status} ${response.statusText} - ${errorText}`,
-            };
+        let lastError;
+        let lastStatus;
+        for (let attempt = 1; attempt <= MAX_UPLOAD_ATTEMPTS; attempt++) {
+            logUpload({ traceId, attempt });
+            try {
+                const response = await fetch(uploadUrl, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                        'Authorization': `Bearer ${apiKey}`,
+                    },
+                    body: JSON.stringify(batch),
+                });
+                lastStatus = response.status;
+                logUpload({ traceId, attempt, statusCode: response.status });
+                if (response.ok) {
+                    const result = await response.json();
+                    logUpload({ traceId, attempt, statusCode: response.status, success: true });
+                    return {
+                        success: true,
+                        traceId: result.traceId || traceId,
+                        blobRoot: result.blobRoot,
+                    };
+                }
+                const errorText = await response.text();
+                lastError = `${response.status} ${response.statusText} - ${errorText.substring(0, 200)}`;
+                if (!isRetryableStatus(response.status) || attempt === MAX_UPLOAD_ATTEMPTS) {
+                    logUpload({ traceId, attempt, statusCode: response.status, success: false, error: lastError?.substring(0, 200) });
+                    return {
+                        success: false,
+                        traceId,
+                        error: lastError,
+                    };
+                }
+                let backoffMs = Math.min(INITIAL_BACKOFF_MS * Math.pow(2, attempt - 1), MAX_BACKOFF_MS);
+                if (response.status === 429) {
+                    const retryAfter = response.headers.get('Retry-After');
+                    if (retryAfter != null) {
+                        const retryAfterMs = /^\d+$/.test(retryAfter.trim())
+                            ? parseInt(retryAfter.trim(), 10) * 1000
+                            : 0;
+                        if (retryAfterMs > 0) {
+                            backoffMs = Math.min(backoffMs, retryAfterMs);
+                        }
+                    }
+                }
+                await sleep(backoffMs);
+            }
+            catch (networkError) {
+                lastError = networkError.message || String(networkError);
+                logUpload({ traceId, attempt, success: false, error: lastError?.substring(0, 200) });
+                if (attempt === MAX_UPLOAD_ATTEMPTS) {
+                    return {
+                        success: false,
+                        traceId,
+                        error: lastError,
+                    };
+                }
+                const backoffMs = Math.min(INITIAL_BACKOFF_MS * Math.pow(2, attempt - 1), MAX_BACKOFF_MS);
+                await sleep(backoffMs);
+            }
         }
-        const result = await response.json();
+        logUpload({ traceId, attempt: MAX_UPLOAD_ATTEMPTS, statusCode: lastStatus, success: false, error: lastError?.substring(0, 200) });
         return {
-            success: true,
-            traceId: result.traceId || traceId,
-            blobRoot: result.blobRoot,
+            success: false,
+            traceId,
+            error: lastError || 'Upload failed after retries',
         };
     }
     catch (error) {
+        logUpload({ traceId, success: false, error: error.message?.substring(0, 200) });
         return {
             success: false,
             traceId,

package/package.json

@@ -1,35 +1,28 @@
 {
   "name": "@runtime-digital-twin/sdk",
-  "version": "1.0.0",
-  "description": "SDK for capturing runtime behavior - automatic incident response and debugging",
+  "version": "1.0.3",
+  "description": "SDK for capturing runtime behavior - automatic incident response and debugging with enhanced autofix support",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
+      "default": "./src/index.ts"
     },
     "./src/*": "./src/*",
     "./dist/*": "./dist/*"
   },
-  "scripts": {
-    "build": "tsc",
-    "dev": "tsc --watch",
-    "test": "jest",
-    "test:watch": "jest --watch",
-    "prepublishOnly": "pnpm build"
-  },
   "dependencies": {
-    "@runtime-digital-twin/core": "^1.0.0",
     "fastify": "^4.24.0",
-    "fastify-plugin": "^4.5.0"
+    "fastify-plugin": "^4.5.0",
+    "@runtime-digital-twin/core": "1.0.1"
   },
   "devDependencies": {
-    "@jest/globals": "^29.7.0",
-    "@types/jest": "^29.5.0",
+    "@jest/globals": "^30.2.0",
+    "@types/jest": "^30.0.0",
     "@types/node": "^20.0.0",
-    "jest": "^29.7.0",
-    "ts-jest": "^29.1.0",
+    "jest": "^30.2.0",
+    "ts-jest": "^29.4.6",
     "typescript": "^5.0.0"
   },
   "license": "MIT",
@@ -38,7 +31,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/your-org/WraithOnCallEngineer.git",
+    "url": "git+https://github.com/usewraith/wraith.git",
     "directory": "packages/sdk"
   },
   "keywords": [
@@ -58,6 +51,11 @@
     "dist",
     "README.md",
     "LICENSE"
-  ]
-}
-
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "test": "jest",
+    "test:watch": "jest --watch"
+  }
+}