@superblocksteam/telemetry 2.0.0-SNAPSHOT.329be19cb7ca892b

package/dist/browser/metrics.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Browser Metrics Bootstrap
+ *
+ * Initializes a MeterProvider for browser contexts using OTLP HTTP export.
+ */
+import { type Meter } from "@opentelemetry/api";
+import type { Resource } from "@opentelemetry/resources";
+export interface BrowserMetricsInstance {
+    getMeter: (name?: string) => Meter;
+    shutdown: () => Promise<void>;
+}
+export interface BrowserMetricsConfig {
+    /** Full URL for metrics endpoint (e.g. "http://localhost:4318/v1/metrics") */
+    otlpUrl: string;
+    serviceName: string;
+    /** Resource with service.name / deployment.environment.name for Datadog env tags. */
+    resource?: Resource;
+}
+/**
+ * Initialize browser metrics with a MeterProvider that exports via OTLP HTTP.
+ *
+ * Uses DELTA aggregation temporality so each export stands on its own and
+ * Datadog does not see counter-reset artifacts from short-lived sessions.
+ *
+ * @param config - Browser metrics configuration
+ * @returns Browser metrics instance with getMeter and shutdown
+ */
+export declare function initBrowserMetrics(config: BrowserMetricsConfig): BrowserMetricsInstance;
+//# sourceMappingURL=metrics.d.ts.map

package/dist/browser/metrics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../src/browser/metrics.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAW,KAAK,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAOzD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK,KAAK,CAAC;IACnC,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAYD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,oBAAoB,GAC3B,sBAAsB,CAsBxB"}

package/dist/browser/metrics.js

@@ -0,0 +1,49 @@
+"use strict";
+/**
+ * Browser Metrics Bootstrap
+ *
+ * Initializes a MeterProvider for browser contexts using OTLP HTTP export.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initBrowserMetrics = initBrowserMetrics;
+const api_1 = require("@opentelemetry/api");
+const exporter_metrics_otlp_http_1 = require("@opentelemetry/exporter-metrics-otlp-http");
+const sdk_metrics_1 = require("@opentelemetry/sdk-metrics");
+/**
+ * Browser metrics export interval.
+ *
+ * The OTel default is 60 s, but browser sessions are typically short-lived.
+ * A page closed before the first export fires silently loses all recorded
+ * metrics (there is no flush-on-unload in PeriodicExportingMetricReader).
+ * 10 s keeps the window small enough that most sessions export at least once.
+ */
+const BROWSER_EXPORT_INTERVAL_MS = 10_000;
+/**
+ * Initialize browser metrics with a MeterProvider that exports via OTLP HTTP.
+ *
+ * Uses DELTA aggregation temporality so each export stands on its own and
+ * Datadog does not see counter-reset artifacts from short-lived sessions.
+ *
+ * @param config - Browser metrics configuration
+ * @returns Browser metrics instance with getMeter and shutdown
+ */
+function initBrowserMetrics(config) {
+    const exporter = new exporter_metrics_otlp_http_1.OTLPMetricExporter({
+        url: config.otlpUrl,
+        temporalityPreference: sdk_metrics_1.AggregationTemporality.DELTA,
+    });
+    const reader = new sdk_metrics_1.PeriodicExportingMetricReader({
+        exporter,
+        exportIntervalMillis: BROWSER_EXPORT_INTERVAL_MS,
+    });
+    const provider = new sdk_metrics_1.MeterProvider({
+        resource: config.resource,
+        readers: [reader],
+    });
+    api_1.metrics.setGlobalMeterProvider(provider);
+    return {
+        getMeter: (name) => provider.getMeter(name ?? config.serviceName),
+        shutdown: () => provider.shutdown(),
+    };
+}
+//# sourceMappingURL=metrics.js.map

package/dist/browser/metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../../src/browser/metrics.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AA2CH,gDAwBC;AAjED,4CAAyD;AACzD,0FAA+E;AAE/E,4DAIoC;AAepC;;;;;;;GAOG;AACH,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAE1C;;;;;;;;GAQG;AACH,SAAgB,kBAAkB,CAChC,MAA4B;IAE5B,MAAM,QAAQ,GAAG,IAAI,+CAAkB,CAAC;QACtC,GAAG,EAAE,MAAM,CAAC,OAAO;QACnB,qBAAqB,EAAE,oCAAsB,CAAC,KAAK;KACpD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,2CAA6B,CAAC;QAC/C,QAAQ;QACR,oBAAoB,EAAE,0BAA0B;KACjD,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,2BAAa,CAAC;QACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,CAAC,MAAM,CAAC;KAClB,CAAC,CAAC;IAEH,aAAO,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAEzC,OAAO;QACL,QAAQ,EAAE,CAAC,IAAa,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,MAAM,CAAC,WAAW,CAAC;QAC1E,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE;KACpC,CAAC;AACJ,CAAC"}

package/dist/browser/resilient-exporter.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Browser Resilient Exporter
+ *
+ * Simplified resilient exporter for browser environments.
+ * Ensures export failures don't affect the main thread.
+ */
+import { ExportResult } from "@opentelemetry/core";
+import type { SpanExporter, ReadableSpan } from "@opentelemetry/sdk-trace-base";
+/**
+ * Configuration for the browser resilient exporter.
+ */
+export interface BrowserResilientExporterConfig {
+    /** Underlying exporter to wrap */
+    delegate: SpanExporter;
+    /** Max items to buffer before dropping (default: 512, lower than Node for memory) */
+    maxQueueSize?: number;
+    /** Export timeout in ms (default: 10000, shorter for browser) */
+    exportTimeoutMs?: number;
+    /** Callback when items are dropped */
+    onDrop?: (count: number, reason: "queue_full" | "export_failed" | "timeout") => void;
+}
+/**
+ * Browser-compatible resilient exporter.
+ *
+ * CRITICAL: Export failures must never block or affect the main thread.
+ * This wrapper catches all errors and timeouts.
+ */
+export declare class BrowserResilientExporter implements SpanExporter {
+    private readonly delegate;
+    private readonly maxQueueSize;
+    private readonly exportTimeoutMs;
+    private readonly onDrop;
+    private queuedCount;
+    private shuttingDown;
+    constructor(config: BrowserResilientExporterConfig);
+    /**
+     * Export spans with resilient error handling.
+     */
+    export(spans: ReadableSpan[], resultCallback: (result: ExportResult) => void): void;
+    shutdown(): Promise<void>;
+    forceFlush(): Promise<void>;
+}
+//# sourceMappingURL=resilient-exporter.d.ts.map

package/dist/browser/resilient-exporter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resilient-exporter.d.ts","sourceRoot":"","sources":["../../src/browser/resilient-exporter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAoB,MAAM,qBAAqB,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,kCAAkC;IAClC,QAAQ,EAAE,YAAY,CAAC;IACvB,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sCAAsC;IACtC,MAAM,CAAC,EAAE,CACP,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,YAAY,GAAG,eAAe,GAAG,SAAS,KAC/C,IAAI,CAAC;CACX;AAED;;;;;GAKG;AACH,qBAAa,wBAAyB,YAAW,YAAY;IAC3D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAGb;IAEV,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,YAAY,CAAS;gBAEjB,MAAM,EAAE,8BAA8B;IAOlD;;OAEG;IACH,MAAM,CACJ,KAAK,EAAE,YAAY,EAAE,EACrB,cAAc,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,GAC7C,IAAI;IAiDD,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAKzB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CAGlC"}

package/dist/browser/resilient-exporter.js

@@ -0,0 +1,88 @@
+"use strict";
+/**
+ * Browser Resilient Exporter
+ *
+ * Simplified resilient exporter for browser environments.
+ * Ensures export failures don't affect the main thread.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BrowserResilientExporter = void 0;
+const core_1 = require("@opentelemetry/core");
+/**
+ * Browser-compatible resilient exporter.
+ *
+ * CRITICAL: Export failures must never block or affect the main thread.
+ * This wrapper catches all errors and timeouts.
+ */
+class BrowserResilientExporter {
+    delegate;
+    maxQueueSize;
+    exportTimeoutMs;
+    onDrop;
+    queuedCount = 0;
+    shuttingDown = false;
+    constructor(config) {
+        this.delegate = config.delegate;
+        this.maxQueueSize = config.maxQueueSize ?? 512;
+        this.exportTimeoutMs = config.exportTimeoutMs ?? 10000;
+        this.onDrop = config.onDrop ?? (() => { });
+    }
+    /**
+     * Export spans with resilient error handling.
+     */
+    export(spans, resultCallback) {
+        // Reject during shutdown
+        if (this.shuttingDown) {
+            resultCallback({ code: core_1.ExportResultCode.SUCCESS });
+            return;
+        }
+        // Check backpressure
+        if (this.queuedCount + spans.length > this.maxQueueSize) {
+            this.onDrop(spans.length, "queue_full");
+            resultCallback({ code: core_1.ExportResultCode.SUCCESS });
+            return;
+        }
+        this.queuedCount += spans.length;
+        let completed = false;
+        // Timeout handler
+        const timeoutId = setTimeout(() => {
+            if (completed)
+                return;
+            completed = true;
+            this.queuedCount -= spans.length;
+            this.onDrop(spans.length, "timeout");
+            resultCallback({ code: core_1.ExportResultCode.SUCCESS });
+        }, this.exportTimeoutMs);
+        try {
+            this.delegate.export(spans, (result) => {
+                if (completed)
+                    return;
+                completed = true;
+                clearTimeout(timeoutId);
+                this.queuedCount -= spans.length;
+                if (result.code !== core_1.ExportResultCode.SUCCESS) {
+                    this.onDrop(spans.length, "export_failed");
+                }
+                resultCallback({ code: core_1.ExportResultCode.SUCCESS });
+            });
+        }
+        catch {
+            if (completed)
+                return;
+            completed = true;
+            clearTimeout(timeoutId);
+            this.queuedCount -= spans.length;
+            this.onDrop(spans.length, "export_failed");
+            resultCallback({ code: core_1.ExportResultCode.SUCCESS });
+        }
+    }
+    async shutdown() {
+        this.shuttingDown = true;
+        return this.delegate.shutdown();
+    }
+    async forceFlush() {
+        return this.delegate.forceFlush?.() ?? Promise.resolve();
+    }
+}
+exports.BrowserResilientExporter = BrowserResilientExporter;
+//# sourceMappingURL=resilient-exporter.js.map

package/dist/browser/resilient-exporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resilient-exporter.js","sourceRoot":"","sources":["../../src/browser/resilient-exporter.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,8CAAqE;AAoBrE;;;;;GAKG;AACH,MAAa,wBAAwB;IAClB,QAAQ,CAAe;IACvB,YAAY,CAAS;IACrB,eAAe,CAAS;IACxB,MAAM,CAGb;IAEF,WAAW,GAAG,CAAC,CAAC;IAChB,YAAY,GAAG,KAAK,CAAC;IAE7B,YAAY,MAAsC;QAChD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,GAAG,CAAC;QAC/C,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,KAAK,CAAC;QACvD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,KAAqB,EACrB,cAA8C;QAE9C,yBAAyB;QACzB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,cAAc,CAAC,EAAE,IAAI,EAAE,uBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,qBAAqB;QACrB,IAAI,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACxD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACxC,cAAc,CAAC,EAAE,IAAI,EAAE,uBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;QACjC,IAAI,SAAS,GAAG,KAAK,CAAC;QAEtB,kBAAkB;QAClB,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAChC,IAAI,SAAS;gBAAE,OAAO;YACtB,SAAS,GAAG,IAAI,CAAC;YACjB,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACrC,cAAc,CAAC,EAAE,IAAI,EAAE,uBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QAEzB,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;gBACrC,IAAI,SAAS;oBAAE,OAAO;gBACtB,SAAS,GAAG,IAAI,CAAC;gBACjB,YAAY,CAAC,SAAS,CAAC,CAAC;gBACxB,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;gBAEjC,IAAI,MAAM,CAAC,IAAI,KAAK,uBAAgB,CAAC,OAAO,EAAE,CAAC;oBAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;gBAC7C,CAAC;gBAED,cAAc,CAAC,EAAE,IAAI,EAAE,uBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;YACrD,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,SAAS;gBAAE,OAAO;YACtB,SAAS,GAAG,IAAI,CAAC;YACjB,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YAC3C,cAAc,CAAC,EAAE,IAAI,EAAE,uBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3D,CAAC;CACF;AAlFD,4DAkFC"}

package/dist/browser/sanitizer.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Browser PII Sanitizing Processors
+ *
+ * Span and log processors that redact PII before export from the browser.
+ * Browser telemetry always runs in untrusted context, so aggressive sanitization
+ * is applied unconditionally.
+ *
+ * - SanitizingSpanProcessor: redacts sensitive span attributes and strips
+ *   sensitive query params from URL attributes.
+ * - SanitizingLogProcessor: redacts sensitive log record attributes and
+ *   replaces email-like patterns in log body text.
+ */
+import type { LogRecordProcessor } from "@opentelemetry/sdk-logs";
+import type { SpanProcessor } from "@opentelemetry/sdk-trace-base";
+export interface SanitizingConfig {
+    /** Additional attribute key patterns to redact */
+    additionalKeyPatterns?: RegExp[];
+    /** Additional URL param names to strip */
+    additionalSensitiveParams?: string[];
+}
+/**
+ * Create a SpanProcessor that redacts PII from span attributes before export.
+ *
+ * @param config - Optional configuration for additional key patterns / URL params
+ * @returns A SpanProcessor suitable for use in a browser WebTracerProvider
+ */
+export declare function createSanitizingSpanProcessor(config?: SanitizingConfig): SpanProcessor;
+/**
+ * Create a LogRecordProcessor that redacts PII from log records before export.
+ *
+ * @param config - Optional configuration for additional key patterns
+ * @returns A LogRecordProcessor suitable for use in a browser log provider
+ */
+export declare function createSanitizingLogProcessor(config?: SanitizingConfig): LogRecordProcessor;
+//# sourceMappingURL=sanitizer.d.ts.map

package/dist/browser/sanitizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizer.d.ts","sourceRoot":"","sources":["../../src/browser/sanitizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAEV,kBAAkB,EACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAGV,aAAa,EACd,MAAM,+BAA+B,CAAC;AAwDvC,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,0CAA0C;IAC1C,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAC;CACtC;AAsKD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,CAAC,EAAE,gBAAgB,GACxB,aAAa,CAEf;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,CAAC,EAAE,gBAAgB,GACxB,kBAAkB,CAEpB"}

package/dist/browser/sanitizer.js

@@ -0,0 +1,211 @@
+"use strict";
+/**
+ * Browser PII Sanitizing Processors
+ *
+ * Span and log processors that redact PII before export from the browser.
+ * Browser telemetry always runs in untrusted context, so aggressive sanitization
+ * is applied unconditionally.
+ *
+ * - SanitizingSpanProcessor: redacts sensitive span attributes and strips
+ *   sensitive query params from URL attributes.
+ * - SanitizingLogProcessor: redacts sensitive log record attributes and
+ *   replaces email-like patterns in log body text.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSanitizingSpanProcessor = createSanitizingSpanProcessor;
+exports.createSanitizingLogProcessor = createSanitizingLogProcessor;
+// ============================================================================
+// Constants
+// ============================================================================
+const REDACTED = "[REDACTED]";
+const REDACTED_EMAIL = "[REDACTED_EMAIL]";
+/**
+ * Attribute key substrings that indicate sensitive values.
+ * Case-insensitive matching is applied.
+ */
+const SENSITIVE_KEY_SUBSTRINGS = [
+    "email",
+    "token",
+    "secret",
+    "password",
+    "authorization",
+    "cookie",
+    "credential",
+];
+/**
+ * Attribute key patterns (regex) for additional well-known sensitive keys
+ * not covered by simple substring matching (e.g. api_key, x-api-key).
+ */
+const SENSITIVE_KEY_PATTERNS = [
+    /api[_\-.]?key/i,
+    /x[_\-.]?api[_\-.]?key/i,
+];
+/**
+ * URL query parameter names that should be stripped.
+ * Exact (case-insensitive) match against param name.
+ */
+const SENSITIVE_URL_PARAMS = [
+    "token",
+    "key",
+    "secret",
+    "password",
+    "code",
+    "state",
+    "auth",
+];
+/** URL attribute keys that receive query-param sanitization. */
+const URL_ATTRIBUTE_KEYS = new Set(["http.url", "url.full"]);
+/** Regex matching email-like patterns in log body text. */
+const EMAIL_PATTERN = /[\w.+-]+@[\w.-]+(\.\w+)?/g;
+// ============================================================================
+// Helpers
+// ============================================================================
+/**
+ * Returns true if the attribute key is sensitive and its value should be
+ * replaced with [REDACTED].
+ */
+function isSensitiveKey(key, additionalPatterns) {
+    const lower = key.toLowerCase();
+    for (const substr of SENSITIVE_KEY_SUBSTRINGS) {
+        if (lower.includes(substr)) {
+            return true;
+        }
+    }
+    for (const pattern of SENSITIVE_KEY_PATTERNS) {
+        pattern.lastIndex = 0;
+        if (pattern.test(key)) {
+            return true;
+        }
+    }
+    for (const pattern of additionalPatterns) {
+        pattern.lastIndex = 0;
+        if (pattern.test(key)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Strips sensitive query parameters from a URL string.
+ * Sensitive param values are replaced with [REDACTED] (key is preserved).
+ */
+function sanitizeUrl(url, additionalParams) {
+    const qIdx = url.indexOf("?");
+    if (qIdx === -1) {
+        return url;
+    }
+    const base = url.slice(0, qIdx);
+    const query = url.slice(qIdx + 1);
+    const sensitiveSet = new Set([
+        ...SENSITIVE_URL_PARAMS.map((p) => p.toLowerCase()),
+        ...additionalParams.map((p) => p.toLowerCase()),
+    ]);
+    const sanitizedParts = query.split("&").map((part) => {
+        const eqIdx = part.indexOf("=");
+        if (eqIdx === -1) {
+            return part;
+        }
+        const rawParamName = part.slice(0, eqIdx);
+        let paramName;
+        try {
+            paramName = decodeURIComponent(rawParamName).toLowerCase();
+        }
+        catch {
+            paramName = rawParamName.toLowerCase();
+        }
+        if (sensitiveSet.has(paramName)) {
+            return `${part.slice(0, eqIdx)}=${REDACTED}`;
+        }
+        return part;
+    });
+    return `${base}?${sanitizedParts.join("&")}`;
+}
+/**
+ * Sanitizes span/log attributes in-place. Sensitive keys get value [REDACTED];
+ * URL attributes get query-param sanitization.
+ */
+function sanitizeAttributes(attributes, additionalKeyPatterns, additionalSensitiveParams) {
+    for (const key of Object.keys(attributes)) {
+        if (URL_ATTRIBUTE_KEYS.has(key)) {
+            const val = attributes[key];
+            if (typeof val === "string") {
+                attributes[key] = sanitizeUrl(val, additionalSensitiveParams);
+            }
+            // URL attributes are handled; skip further key-based check
+            continue;
+        }
+        if (isSensitiveKey(key, additionalKeyPatterns)) {
+            attributes[key] = REDACTED;
+        }
+    }
+}
+// ============================================================================
+// SanitizingSpanProcessor
+// ============================================================================
+class SanitizingSpanProcessor {
+    additionalKeyPatterns;
+    additionalSensitiveParams;
+    constructor(config = {}) {
+        this.additionalKeyPatterns = config.additionalKeyPatterns ?? [];
+        this.additionalSensitiveParams = config.additionalSensitiveParams ?? [];
+    }
+    onStart(_span, _parentContext) {
+        // Nothing to do at start; sanitization occurs at end when attributes are final.
+    }
+    onEnd(span) {
+        // ReadableSpan.attributes is typed as Attributes (readonly in API), but
+        // in practice the SDK implementation uses a mutable object. We cast to
+        // allow in-place mutation, which avoids allocating a new span wrapper.
+        const attrs = span.attributes;
+        sanitizeAttributes(attrs, this.additionalKeyPatterns, this.additionalSensitiveParams);
+    }
+    async shutdown() { }
+    async forceFlush() { }
+}
+// ============================================================================
+// SanitizingLogProcessor
+// ============================================================================
+class BrowserSanitizingLogProcessor {
+    additionalKeyPatterns;
+    constructor(config = {}) {
+        this.additionalKeyPatterns = config.additionalKeyPatterns ?? [];
+    }
+    onEmit(record, _context) {
+        // Sanitize attributes in-place
+        const attrs = record.attributes;
+        for (const key of Object.keys(attrs)) {
+            if (isSensitiveKey(key, this.additionalKeyPatterns)) {
+                attrs[key] = REDACTED;
+            }
+        }
+        // Redact email-like patterns in string body
+        if (typeof record.body === "string") {
+            EMAIL_PATTERN.lastIndex = 0;
+            record.body = record.body.replace(EMAIL_PATTERN, REDACTED_EMAIL);
+        }
+    }
+    async shutdown() { }
+    async forceFlush() { }
+}
+// ============================================================================
+// Factory functions
+// ============================================================================
+/**
+ * Create a SpanProcessor that redacts PII from span attributes before export.
+ *
+ * @param config - Optional configuration for additional key patterns / URL params
+ * @returns A SpanProcessor suitable for use in a browser WebTracerProvider
+ */
+function createSanitizingSpanProcessor(config) {
+    return new SanitizingSpanProcessor(config);
+}
+/**
+ * Create a LogRecordProcessor that redacts PII from log records before export.
+ *
+ * @param config - Optional configuration for additional key patterns
+ * @returns A LogRecordProcessor suitable for use in a browser log provider
+ */
+function createSanitizingLogProcessor(config) {
+    return new BrowserSanitizingLogProcessor(config);
+}
+//# sourceMappingURL=sanitizer.js.map

package/dist/browser/sanitizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizer.js","sourceRoot":"","sources":["../../src/browser/sanitizer.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAoPH,sEAIC;AAQD,oEAIC;AAvPD,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,MAAM,QAAQ,GAAG,YAAY,CAAC;AAC9B,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAE1C;;;GAGG;AACH,MAAM,wBAAwB,GAAG;IAC/B,OAAO;IACP,OAAO;IACP,QAAQ;IACR,UAAU;IACV,eAAe;IACf,QAAQ;IACR,YAAY;CACb,CAAC;AAEF;;;GAGG;AACH,MAAM,sBAAsB,GAAa;IACvC,gBAAgB;IAChB,wBAAwB;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,oBAAoB,GAAG;IAC3B,OAAO;IACP,KAAK;IACL,QAAQ;IACR,UAAU;IACV,MAAM;IACN,OAAO;IACP,MAAM;CACP,CAAC;AAEF,gEAAgE;AAChE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAE7D,2DAA2D;AAC3D,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAalD,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E;;;GAGG;AACH,SAAS,cAAc,CAAC,GAAW,EAAE,kBAA4B;IAC/D,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;QAC9C,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC7C,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,GAAW,EAAE,gBAA0B;IAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QAChB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAElC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;QAC3B,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;KAChD,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACzB,UAAmC,EACnC,qBAA+B,EAC/B,yBAAmC;IAEnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,UAAU,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;YAChE,CAAC;YACD,2DAA2D;YAC3D,SAAS;QACX,CAAC;QACD,IAAI,cAAc,CAAC,GAAG,EAAE,qBAAqB,CAAC,EAAE,CAAC;YAC/C,UAAU,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;QAC7B,CAAC;IACH,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E,MAAM,uBAAuB;IACV,qBAAqB,CAAW;IAChC,yBAAyB,CAAW;IAErD,YAAY,SAA2B,EAAE;QACvC,IAAI,CAAC,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,IAAI,EAAE,CAAC;QAChE,IAAI,CAAC,yBAAyB,GAAG,MAAM,CAAC,yBAAyB,IAAI,EAAE,CAAC;IAC1E,CAAC;IAED,OAAO,CAAC,KAAW,EAAE,cAAuB;QAC1C,gFAAgF;IAClF,CAAC;IAED,KAAK,CAAC,IAAkB;QACtB,wEAAwE;QACxE,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAqC,CAAC;QACzD,kBAAkB,CAChB,KAAK,EACL,IAAI,CAAC,qBAAqB,EAC1B,IAAI,CAAC,yBAAyB,CAC/B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,KAAmB,CAAC;IAClC,KAAK,CAAC,UAAU,KAAmB,CAAC;CACrC;AAED,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E,MAAM,6BAA6B;IAChB,qBAAqB,CAAW;IAEjD,YAAY,SAA2B,EAAE;QACvC,IAAI,CAAC,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,IAAI,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,CAAC,MAAyB,EAAE,QAAiB;QACjD,+BAA+B;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,UAAqC,CAAC;QAC3D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBACpD,KAAK,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;YACxB,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpC,aAAa,CAAC,SAAS,GAAG,CAAC,CAAC;YAC3B,MAA4B,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CACtD,aAAa,EACb,cAAc,CACf,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,KAAmB,CAAC;IAClC,KAAK,CAAC,UAAU,KAAmB,CAAC;CACrC;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;;;;GAKG;AACH,SAAgB,6BAA6B,CAC3C,MAAyB;IAEzB,OAAO,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,SAAgB,4BAA4B,CAC1C,MAAyB;IAEzB,OAAO,IAAI,6BAA6B,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC"}

package/dist/browser/traced-socket.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Browser-side TracedSocket for WebSocket tracing.
+ *
+ * Wraps a WebSocket client (or any WebSocket-like object) and adds
+ * OpenTelemetry tracing. Designed to speak the same envelope protocol as the
+ * server-side TracedSocket so that distributed traces link correctly across
+ * the browser–server boundary.
+ *
+ * Envelope format (matches @superblocksteam/shared SocketRequest):
+ *   outbound: { request: { method, id, traceparent?, tracestate?, ... } }
+ *   inbound:  { request: { method, id, traceparent?, tracestate?, ... } }
+ *             { response: { id, ... } }
+ *
+ * Propagation uses the W3C Trace Context propagator registered globally by
+ * initBrowserTelemetry() (see browser/init.ts). The carrier is the
+ * `request` object itself — the same convention as the server side.
+ */
+import { type Tracer } from "@opentelemetry/api";
+import type { SocketMessageEnvelope } from "../common/traced-socket-types.js";
+/** Minimal browser WebSocket surface needed by BrowserTracedSocket. */
+export interface WebSocketLike {
+    readonly readyState: number;
+    close(code?: number, reason?: string): void;
+    send(data: string | ArrayBuffer): void;
+    addEventListener(type: string, listener: (event: unknown) => void): void;
+    removeEventListener(type: string, listener: (event: unknown) => void): void;
+}
+/** Configuration for BrowserTracedSocket. */
+export interface BrowserTracedSocketConfig {
+    /**
+     * Tracer instance. When omitted the global tracer named
+     * "superblocks-ws" is used (requires initBrowserTelemetry() first).
+     */
+    tracer?: Tracer;
+}
+/**
+ * BrowserTracedSocket wraps a WebSocket and provides:
+ *
+ * 1. `decorateOutbound(msg)` — call this before sending any message.
+ *    Injects traceparent/tracestate into msg.request so the server can
+ *    extract the browser's active context.
+ *
+ * 2. `traceOutboundCall(method)` — wraps a client-initiated RPC call in a
+ *    CLIENT span.  Returns the span's end function.
+ *
+ * 3. `handleInbound(msg)` — call this when a message arrives from the server.
+ *    Extracts the server's trace context and creates a SERVER span so that
+ *    server-initiated pushes appear in the browser's trace.
+ *
+ * 4. `recordReconnect({ attempt })` — call this from the reconnect loop to
+ *    create a ws.reconnect span.
+ *
+ * Lifecycle spans (ws.connect, ws.disconnect) are attached automatically via
+ * WebSocket open/close event listeners.
+ */
+export declare class BrowserTracedSocket {
+    private readonly ws;
+    private readonly tracer;
+    private connectStartTime;
+    constructor(ws: WebSocketLike, config: BrowserTracedSocketConfig);
+    private readonly onOpen;
+    private readonly onClose;
+    /**
+     * Records a ws.reconnect span.  Call this from the reconnect loop just
+     * before opening a new WebSocket, passing the attempt counter so it shows
+     * up as a span attribute.
+     */
+    recordReconnect({ attempt }: {
+        attempt: number;
+    }): void;
+    /**
+     * Injects W3C trace context into the message's request envelope.
+     * Call this on every outbound message before handing it to the transport.
+     *
+     * Mirrors the server-side TracedSocket.decorateToSend() behaviour so that
+     * the server can extract the browser's active context via propagation.extract.
+     */
+    decorateOutbound(message: SocketMessageEnvelope): SocketMessageEnvelope;
+    /**
+     * Creates a CLIENT span for a browser-initiated RPC call.
+     * Returns the span so the caller can end it after the response resolves.
+     *
+     * Usage:
+     * ```typescript
+     * const span = socket.traceOutboundCall("editor.runApi");
+     * const result = await socket.request("editor.runApi", params);
+     * span.end();
+     * ```
+     */
+    traceOutboundCall(method: string): import("@opentelemetry/api").Span;
+    /**
+     * Handles an inbound message from the server.
+     * - Extracts the server's trace context from the request envelope.
+     * - Creates a SERVER span as a child of the server's trace so that
+     *   server-initiated pushes appear in the browser's distributed trace.
+     * - Response-only messages (no request field) are ignored.
+     */
+    handleInbound(message: SocketMessageEnvelope): void;
+    /** Remove lifecycle listeners. Call when tearing down the socket. */
+    dispose(): void;
+}
+//# sourceMappingURL=traced-socket.d.ts.map

package/dist/browser/traced-socket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"traced-socket.d.ts","sourceRoot":"","sources":["../../src/browser/traced-socket.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAML,KAAK,MAAM,EACZ,MAAM,oBAAoB,CAAC;AAM5B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAE9E,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAAC;IACvC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GAAG,IAAI,CAAC;IACzE,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GAAG,IAAI,CAAC;CAC7E;AAED,6CAA6C;AAC7C,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAOD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,mBAAmB;IAK5B,OAAO,CAAC,QAAQ,CAAC,EAAE;IAJrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,gBAAgB,CAAqB;gBAG1B,EAAE,EAAE,aAAa,EAClC,MAAM,EAAE,yBAAyB;IAoBnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAwBrB;IAEF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAuBtB;IAEF;;;;OAIG;IACI,eAAe,CAAC,EAAE,OAAO,EAAE,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAoB9D;;;;;;OAMG;IACI,gBAAgB,CACrB,OAAO,EAAE,qBAAqB,GAC7B,qBAAqB;IAexB;;;;;;;;;;OAUG;IACI,iBAAiB,CAAC,MAAM,EAAE,MAAM;IAkBvC;;;;;;OAMG;IACI,aAAa,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI;IAgC1D,qEAAqE;IAC9D,OAAO,IAAI,IAAI;CAIvB"}