@ttt-productions/monitoring-core 0.12.0 → 0.13.1

package/dist/index.d.ts

@@ -2,4 +2,8 @@ export type { MonitoringInitOptions, MonitoringUser, MonitoringProvider, ScopeLi
 export type { MonitoringAdapter } from "./adapter.js";
 export { initMonitoring, getMonitoringAdapter, setMonitoringAdapter, resetMonitoringAdapter } from "./init.js";
 export { captureException, captureMessage, setUser, setTag, withScope, addBreadcrumb } from "./api.js";
+export type { ForbiddenPattern, RedactStringOptions, ScrubbableEvent, TelemetryScrubberOptions, BeforeSendHook, } from "./scrubber.js";
+export { REDACTION_PLACEHOLDER, DEFAULT_FORBIDDEN_PATTERNS, redactString, redactEvent, createTelemetryScrubber, } from "./scrubber.js";
+export type { DefaultSafeEventKey, SafeEvent, BuildSafeEventOptions, } from "./safe-event.js";
+export { DEFAULT_SAFE_EVENT_KEYS, buildSafeEvent } from "./safe-event.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,qBAAqB,EAAE,cAAc,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvG,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAC/G,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,qBAAqB,EAAE,cAAc,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvG,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAC/G,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEvG,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,wBAAwB,EACxB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,YAAY,EACZ,WAAW,EACX,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAEvB,YAAY,EACV,mBAAmB,EACnB,SAAS,EACT,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -1,3 +1,5 @@
 export { initMonitoring, getMonitoringAdapter, setMonitoringAdapter, resetMonitoringAdapter } from "./init.js";
 export { captureException, captureMessage, setUser, setTag, withScope, addBreadcrumb } from "./api.js";
+export { REDACTION_PLACEHOLDER, DEFAULT_FORBIDDEN_PATTERNS, redactString, redactEvent, createTelemetryScrubber, } from "./scrubber.js";
+export { DEFAULT_SAFE_EVENT_KEYS, buildSafeEvent } from "./safe-event.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAC/G,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAC/G,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AASvG,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,YAAY,EACZ,WAAW,EACX,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAOvB,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/safe-event.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Safe-event allowlist helper — the safety-scoped telemetry layer.
+ *
+ * Safety-domain code (the app's `functions/src/safety/` + `functions/src/ncii/`)
+ * must emit telemetry that carries ONLY a fixed allowlist of structurally-safe
+ * fields — never content, evidence URLs, IPs, detector hashes, or credentials.
+ * This helper takes an arbitrary object and returns a NEW object containing only
+ * the allowlisted keys; every other key is dropped. `undefined`-valued
+ * allowlisted keys are also dropped so the emitted payload stays minimal.
+ *
+ * This is the complement to the global {@link ./scrubber} redactor: the scrubber
+ * is defense-in-depth against leaks from anywhere; the safe-event allowlist is
+ * the positive contract for code that deliberately touches safety data — nothing
+ * escapes unless it is on the list.
+ *
+ * GENERIC: the default allowlist (`caseId`, `phase`, `safeCode`, `traceId`) is
+ * the safe field set named in the CSAM design doc, but the key set is
+ * configurable so the app can extend/replace it without a package change.
+ */
+/** The safe field set every safety telemetry event may carry. */
+export declare const DEFAULT_SAFE_EVENT_KEYS: readonly ["caseId", "phase", "safeCode", "traceId"];
+export type DefaultSafeEventKey = (typeof DEFAULT_SAFE_EVENT_KEYS)[number];
+/** The allowlisted-only shape produced from an arbitrary input. */
+export type SafeEvent = {
+    caseId?: string;
+    phase?: string;
+    safeCode?: string;
+    traceId?: string;
+    [key: string]: unknown;
+};
+export type BuildSafeEventOptions = {
+    /**
+     * Allowed keys. Defaults to {@link DEFAULT_SAFE_EVENT_KEYS}. Supply a custom
+     * list (a superset or a different set) to extend the contract app-side without
+     * changing this package.
+     */
+    allowedKeys?: readonly string[];
+    /**
+     * Keep allowlisted keys whose value is `undefined`. Defaults to false (drop
+     * them) so the payload never carries empty slots.
+     */
+    keepUndefined?: boolean;
+};
+/**
+ * Project an arbitrary object down to its allowlisted keys. Any key not on the
+ * allowlist is dropped entirely — the returned object is a fresh copy, never the
+ * input. Non-object input yields an empty object.
+ *
+ * @example
+ * const evt = buildSafeEvent({
+ *   caseId: 'case_123',
+ *   phase: 'quarantine',
+ *   safeCode: 'CS-DENY',
+ *   traceId: 't-abc',
+ *   // everything below is DROPPED:
+ *   evidenceUrl: 'https://…/ncii-evidence/x',
+ *   reporterIp: '203.0.113.7',
+ *   detectorHash: 'ab12…',
+ * });
+ * // → { caseId, phase, safeCode, traceId }
+ * captureMessage(JSON.stringify(evt)); // or attach as safe context
+ */
+export declare function buildSafeEvent(input: unknown, options?: BuildSafeEventOptions): SafeEvent;
+//# sourceMappingURL=safe-event.d.ts.map

package/dist/safe-event.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-event.d.ts","sourceRoot":"","sources":["../src/safe-event.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,iEAAiE;AACjE,eAAO,MAAM,uBAAuB,qDAAsD,CAAC;AAE3F,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E,mEAAmE;AACnE,MAAM,MAAM,SAAS,GAAG;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC;;;;OAIG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,qBAA0B,GAClC,SAAS,CAkBX"}

package/dist/safe-event.js

@@ -0,0 +1,59 @@
+/**
+ * Safe-event allowlist helper — the safety-scoped telemetry layer.
+ *
+ * Safety-domain code (the app's `functions/src/safety/` + `functions/src/ncii/`)
+ * must emit telemetry that carries ONLY a fixed allowlist of structurally-safe
+ * fields — never content, evidence URLs, IPs, detector hashes, or credentials.
+ * This helper takes an arbitrary object and returns a NEW object containing only
+ * the allowlisted keys; every other key is dropped. `undefined`-valued
+ * allowlisted keys are also dropped so the emitted payload stays minimal.
+ *
+ * This is the complement to the global {@link ./scrubber} redactor: the scrubber
+ * is defense-in-depth against leaks from anywhere; the safe-event allowlist is
+ * the positive contract for code that deliberately touches safety data — nothing
+ * escapes unless it is on the list.
+ *
+ * GENERIC: the default allowlist (`caseId`, `phase`, `safeCode`, `traceId`) is
+ * the safe field set named in the CSAM design doc, but the key set is
+ * configurable so the app can extend/replace it without a package change.
+ */
+/** The safe field set every safety telemetry event may carry. */
+export const DEFAULT_SAFE_EVENT_KEYS = ["caseId", "phase", "safeCode", "traceId"];
+/**
+ * Project an arbitrary object down to its allowlisted keys. Any key not on the
+ * allowlist is dropped entirely — the returned object is a fresh copy, never the
+ * input. Non-object input yields an empty object.
+ *
+ * @example
+ * const evt = buildSafeEvent({
+ *   caseId: 'case_123',
+ *   phase: 'quarantine',
+ *   safeCode: 'CS-DENY',
+ *   traceId: 't-abc',
+ *   // everything below is DROPPED:
+ *   evidenceUrl: 'https://…/ncii-evidence/x',
+ *   reporterIp: '203.0.113.7',
+ *   detectorHash: 'ab12…',
+ * });
+ * // → { caseId, phase, safeCode, traceId }
+ * captureMessage(JSON.stringify(evt)); // or attach as safe context
+ */
+export function buildSafeEvent(input, options = {}) {
+    const allowed = options.allowedKeys ?? DEFAULT_SAFE_EVENT_KEYS;
+    const keepUndefined = options.keepUndefined ?? false;
+    const out = {};
+    if (input === null || typeof input !== "object") {
+        return out;
+    }
+    const record = input;
+    for (const key of allowed) {
+        if (!Object.prototype.hasOwnProperty.call(record, key))
+            continue;
+        const value = record[key];
+        if (value === undefined && !keepUndefined)
+            continue;
+        out[key] = value;
+    }
+    return out;
+}
+//# sourceMappingURL=safe-event.js.map

package/dist/safe-event.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-event.js","sourceRoot":"","sources":["../src/safe-event.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,iEAAiE;AACjE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,CAAU,CAAC;AA2B3F;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAc,EACd,UAAiC,EAAE;IAEnC,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,IAAI,uBAAuB,CAAC;IAC/D,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC;IACrD,MAAM,GAAG,GAAc,EAAE,CAAC;IAE1B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAEhD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;YAAE,SAAS;QACjE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,aAAa;YAAE,SAAS;QACpD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/scrubber.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Telemetry scrubber — generic Sentry-event redaction.
+ *
+ * A defense-in-depth `beforeSend`-style hook that walks an ENTIRE Sentry event
+ * (message, exception values + stacktrace frame vars, breadcrumbs, extra,
+ * contexts, tags, request data, user) and replaces any substring matching a
+ * forbidden pattern with a fixed placeholder.
+ *
+ * This package is GENERIC — it ships only obvious, domain-neutral defaults
+ * (full IPv4/IPv6 addresses, bearer/authorization tokens, generic credential
+ * assignments). Product-specific patterns (evidence-bucket URL prefixes,
+ * detector-hash shapes, NCMEC credential markers) are INJECTED by the consuming
+ * app via {@link createTelemetryScrubber}'s `patterns` option. No app-data-package
+ * import, no app-specific literals.
+ */
+/** The fixed replacement written over any matched forbidden substring. */
+export declare const REDACTION_PLACEHOLDER = "[REDACTED]";
+/**
+ * A forbidden pattern. Either a `RegExp` (matched globally against every string
+ * in the event) or a literal `string` (every occurrence replaced). Strings are
+ * treated as literals, not regex source, so callers do not have to escape them.
+ */
+export type ForbiddenPattern = RegExp | string;
+export type RedactStringOptions = {
+    /** Patterns to strip. Defaults to {@link DEFAULT_FORBIDDEN_PATTERNS}. */
+    patterns?: ForbiddenPattern[];
+    /** Replacement text. Defaults to {@link REDACTION_PLACEHOLDER}. */
+    placeholder?: string;
+};
+/**
+ * Generic, domain-neutral built-in patterns. These are intentionally
+ * conservative (specific → low collateral on ordinary errors) but catch the
+ * obvious secrets that must never reach telemetry regardless of app.
+ */
+export declare const DEFAULT_FORBIDDEN_PATTERNS: RegExp[];
+/**
+ * Redact every forbidden-pattern hit inside a single string. Pure and safe on
+ * any input. Empty when nothing matches → returns the original reference.
+ */
+export declare function redactString(value: string, options?: RedactStringOptions): string;
+/**
+ * Minimal structural shape of a Sentry event we walk. Deliberately loose — we
+ * do not depend on `@sentry/*` types (this package's Sentry deps are optional
+ * peers, and the scrubber is provider-agnostic). Unknown fields are left alone
+ * except that we deep-redact the free-form containers below.
+ */
+export type ScrubbableEvent = {
+    message?: unknown;
+    exception?: {
+        values?: Array<Record<string, unknown>>;
+    } | unknown;
+    breadcrumbs?: unknown;
+    extra?: unknown;
+    contexts?: unknown;
+    tags?: unknown;
+    request?: unknown;
+    user?: unknown;
+    [key: string]: unknown;
+};
+export type TelemetryScrubberOptions = {
+    /**
+     * App-injected forbidden patterns (evidence-bucket URL prefixes, detector-hash
+     * shapes, NCMEC credential markers, …). Merged AFTER the generic defaults
+     * unless {@link includeDefaults} is false.
+     */
+    patterns?: ForbiddenPattern[];
+    /** Include {@link DEFAULT_FORBIDDEN_PATTERNS}. Defaults to true. */
+    includeDefaults?: boolean;
+    /** Replacement text. Defaults to {@link REDACTION_PLACEHOLDER}. */
+    placeholder?: string;
+};
+/**
+ * Redact a whole Sentry event in place and return it. Exported so the backend
+ * `withScope` / manual-capture path can benefit even where a `beforeSend`
+ * pipeline is not wired.
+ */
+export declare function redactEvent<T extends ScrubbableEvent>(event: T, options?: TelemetryScrubberOptions): T;
+/**
+ * A Sentry `beforeSend`-style hook: `(event, hint?) => event | null`. Drop-in
+ * for `Sentry.init({ beforeSend })` in both the browser and Node SDKs.
+ */
+export type BeforeSendHook = (event: ScrubbableEvent, hint?: unknown) => ScrubbableEvent | null;
+/**
+ * Build a `beforeSend` hook that scrubs every outgoing event. The app supplies
+ * its product-specific `patterns`; generic defaults are included unless disabled.
+ *
+ * @example
+ * Sentry.init({
+ *   dsn,
+ *   beforeSend: createTelemetryScrubber({
+ *     patterns: [
+ *       'https://storage.googleapis.com/example-ncii-evidence/',
+ *       /\bncmec-[a-z0-9]{16,}\b/gi,
+ *       /\b[a-f0-9]{64}\b/g, // detector hash shape
+ *     ],
+ *   }),
+ * });
+ */
+export declare function createTelemetryScrubber(options?: TelemetryScrubberOptions): BeforeSendHook;
+//# sourceMappingURL=scrubber.d.ts.map

package/dist/scrubber.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrubber.d.ts","sourceRoot":"","sources":["../src/scrubber.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,0EAA0E;AAC1E,eAAO,MAAM,qBAAqB,eAAe,CAAC;AAElD;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,CAAC;AAE/C,MAAM,MAAM,mBAAmB,GAAG;IAChC,yEAAyE;IACzE,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC9B,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAE,MAAM,EAY9C,CAAC;AAwBF;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB,GAAG,MAAM,CASrF;AAwCD;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC9B,oEAAoE;IACpE,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,eAAe,EACnD,KAAK,EAAE,CAAC,EACR,OAAO,GAAE,wBAA6B,GACrC,CAAC,CAmCH;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,eAAe,GAAG,IAAI,CAAC;AAEhG;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,wBAA6B,GAAG,cAAc,CAK9F"}

package/dist/scrubber.js

@@ -0,0 +1,158 @@
+/**
+ * Telemetry scrubber — generic Sentry-event redaction.
+ *
+ * A defense-in-depth `beforeSend`-style hook that walks an ENTIRE Sentry event
+ * (message, exception values + stacktrace frame vars, breadcrumbs, extra,
+ * contexts, tags, request data, user) and replaces any substring matching a
+ * forbidden pattern with a fixed placeholder.
+ *
+ * This package is GENERIC — it ships only obvious, domain-neutral defaults
+ * (full IPv4/IPv6 addresses, bearer/authorization tokens, generic credential
+ * assignments). Product-specific patterns (evidence-bucket URL prefixes,
+ * detector-hash shapes, NCMEC credential markers) are INJECTED by the consuming
+ * app via {@link createTelemetryScrubber}'s `patterns` option. No app-data-package
+ * import, no app-specific literals.
+ */
+/** The fixed replacement written over any matched forbidden substring. */
+export const REDACTION_PLACEHOLDER = "[REDACTED]";
+/**
+ * Generic, domain-neutral built-in patterns. These are intentionally
+ * conservative (specific → low collateral on ordinary errors) but catch the
+ * obvious secrets that must never reach telemetry regardless of app.
+ */
+export const DEFAULT_FORBIDDEN_PATTERNS = [
+    // Full IPv4 address (four dotted octets, each 0–255).
+    /\b(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\b/g,
+    // Full (uncompressed) IPv6 address — eight hextet groups.
+    /\b(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\b/g,
+    // Compressed IPv6 with a "::" run (e.g. 2001:db8::1, ::1, fe80::abcd).
+    /\b(?:[0-9a-fA-F]{1,4}:){1,7}:(?:[0-9a-fA-F]{1,4}:?){0,6}(?:[0-9a-fA-F]{1,4})?\b|::(?:[0-9a-fA-F]{1,4}:){0,6}[0-9a-fA-F]{1,4}\b/g,
+    // Authorization / bearer token: "Bearer xyz", "Authorization: Basic xyz".
+    /\b(?:Bearer|Basic)\s+[A-Za-z0-9._~+/-]{8,}={0,2}/gi,
+    // Generic credential assignment: password=..., api_key: "...", secret=...,
+    // token=..., apiKey=..., access_token=... (value up to whitespace/quote).
+    /\b(?:password|passwd|pwd|secret|api[_-]?key|apikey|access[_-]?token|refresh[_-]?token|token|client[_-]?secret|authorization)\b\s*[:=]\s*["']?[^\s"',}{]{4,}/gi,
+];
+function escapeRegExp(input) {
+    return input.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function compilePatterns(patterns) {
+    return patterns.map((p) => {
+        if (typeof p === "string") {
+            return {
+                regex: new RegExp(escapeRegExp(p), "g"),
+                isLiteral: true,
+                literal: p,
+            };
+        }
+        // Ensure the flag set is global so `String.replace` strips every hit; clone
+        // so we never mutate a caller-owned RegExp's lastIndex across calls.
+        const flags = p.flags.includes("g") ? p.flags : p.flags + "g";
+        return { regex: new RegExp(p.source, flags), isLiteral: false };
+    });
+}
+/**
+ * Redact every forbidden-pattern hit inside a single string. Pure and safe on
+ * any input. Empty when nothing matches → returns the original reference.
+ */
+export function redactString(value, options = {}) {
+    const placeholder = options.placeholder ?? REDACTION_PLACEHOLDER;
+    const compiled = compilePatterns(options.patterns ?? DEFAULT_FORBIDDEN_PATTERNS);
+    let out = value;
+    for (const { regex } of compiled) {
+        regex.lastIndex = 0;
+        out = out.replace(regex, placeholder);
+    }
+    return out;
+}
+/**
+ * Recursively redact every string reachable inside an arbitrary value (objects,
+ * arrays, nested combinations). Non-string primitives pass through untouched.
+ * Object keys are NOT rewritten (a forbidden value hiding in a key is
+ * pathological and rewriting keys would corrupt the event shape); only values
+ * are scrubbed. Guards against cycles.
+ */
+function deepRedact(value, options, seen) {
+    if (typeof value === "string") {
+        return redactString(value, options);
+    }
+    if (value === null || typeof value !== "object") {
+        return value;
+    }
+    if (seen.has(value)) {
+        return value;
+    }
+    seen.add(value);
+    if (Array.isArray(value)) {
+        for (let i = 0; i < value.length; i++) {
+            value[i] = deepRedact(value[i], options, seen);
+        }
+        return value;
+    }
+    const record = value;
+    for (const key of Object.keys(record)) {
+        record[key] = deepRedact(record[key], options, seen);
+    }
+    return record;
+}
+/**
+ * Redact a whole Sentry event in place and return it. Exported so the backend
+ * `withScope` / manual-capture path can benefit even where a `beforeSend`
+ * pipeline is not wired.
+ */
+export function redactEvent(event, options = {}) {
+    if (event === null || typeof event !== "object")
+        return event;
+    const includeDefaults = options.includeDefaults ?? true;
+    const patterns = [
+        ...(includeDefaults ? DEFAULT_FORBIDDEN_PATTERNS : []),
+        ...(options.patterns ?? []),
+    ];
+    const deepOptions = {
+        patterns,
+        placeholder: options.placeholder ?? REDACTION_PLACEHOLDER,
+    };
+    const seen = new WeakSet();
+    // Top-level message (string or {message,params} structured form).
+    if (event.message !== undefined) {
+        event.message = deepRedact(event.message, deepOptions, seen);
+    }
+    // Exception values: type/value strings plus stacktrace frame vars/filenames.
+    const exception = event.exception;
+    if (exception && Array.isArray(exception.values)) {
+        for (const val of exception.values) {
+            deepRedact(val, deepOptions, seen);
+        }
+    }
+    // Free-form containers — walked wholesale.
+    for (const container of ["breadcrumbs", "extra", "contexts", "tags", "request", "user"]) {
+        if (event[container] !== undefined) {
+            event[container] = deepRedact(event[container], deepOptions, seen);
+        }
+    }
+    return event;
+}
+/**
+ * Build a `beforeSend` hook that scrubs every outgoing event. The app supplies
+ * its product-specific `patterns`; generic defaults are included unless disabled.
+ *
+ * @example
+ * Sentry.init({
+ *   dsn,
+ *   beforeSend: createTelemetryScrubber({
+ *     patterns: [
+ *       'https://storage.googleapis.com/example-ncii-evidence/',
+ *       /\bncmec-[a-z0-9]{16,}\b/gi,
+ *       /\b[a-f0-9]{64}\b/g, // detector hash shape
+ *     ],
+ *   }),
+ * });
+ */
+export function createTelemetryScrubber(options = {}) {
+    return (event, _hint) => {
+        if (event === null || typeof event !== "object")
+            return event;
+        return redactEvent(event, options);
+    };
+}
+//# sourceMappingURL=scrubber.js.map

package/dist/scrubber.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrubber.js","sourceRoot":"","sources":["../src/scrubber.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAgBlD;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAa;IAClD,sDAAsD;IACtD,sFAAsF;IACtF,0DAA0D;IAC1D,+CAA+C;IAC/C,uEAAuE;IACvE,iIAAiI;IACjI,0EAA0E;IAC1E,oDAAoD;IACpD,2EAA2E;IAC3E,0EAA0E;IAC1E,+JAA+J;CAChK,CAAC;AAIF,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,eAAe,CAAC,QAA4B;IACnD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACxB,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO;gBACL,KAAK,EAAE,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;gBACvC,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,CAAC;aACX,CAAC;QACJ,CAAC;QACD,4EAA4E;QAC5E,qEAAqE;QACrE,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC;QAC9D,OAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,UAA+B,EAAE;IAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACjE,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,IAAI,0BAA0B,CAAC,CAAC;IACjF,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;QACjC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QACpB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAOD;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,KAAc,EAAE,OAA0B,EAAE,IAAqB;IACnF,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC,CAAC;IAE1B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,KAAK,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAiCD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,KAAQ,EACR,UAAoC,EAAE;IAEtC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE9D,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,IAAI,CAAC;IACxD,MAAM,QAAQ,GAAuB;QACnC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;KAC5B,CAAC;IACF,MAAM,WAAW,GAAsB;QACrC,QAAQ;QACR,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,qBAAqB;KAC1D,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IAEnC,kEAAkE;IAClE,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,KAAK,CAAC,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IAC/D,CAAC;IAED,6EAA6E;IAC7E,MAAM,SAAS,GAAG,KAAK,CAAC,SAAoE,CAAC;IAC7F,IAAI,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACnC,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,KAAK,MAAM,SAAS,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAU,EAAE,CAAC;QACjG,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;YACnC,KAAK,CAAC,SAAS,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAQD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAoC,EAAE;IAC5E,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACtB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9D,OAAO,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -9,8 +9,8 @@ export type MonitoringInitOptions = {
      *  Omit to use the provider default. */
     tracesSampleRate?: number;
     /** Provider integrations passed through to the SDK init — e.g. `[]` to disable the
-     *  default auto-integrations and keep init lightweight (the TTT Cloud Functions
-     *  bootstrap does this). Typed loosely: it is a provider-specific pass-through. */
+     *  default auto-integrations and keep init lightweight (the consuming app's Cloud
+     *  Functions bootstrap does this). Typed loosely: it is a provider-specific pass-through. */
     integrations?: unknown[];
 };
 export type MonitoringUser = {

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,aAAa,GAAG,MAAM,CAAC;AAEnE,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;4CACwC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;uFAEmF;IACnF,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7C,OAAO,EAAE,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,KAAK,IAAI,CAAC;IAC/C,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAChD,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACrE,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,aAAa,GAAG,MAAM,CAAC;AAEnE,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;4CACwC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;iGAE6F;IAC7F,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7C,OAAO,EAAE,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,KAAK,IAAI,CAAC;IAC/C,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAChD,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACrE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@ttt-productions/monitoring-core",
-    "version": "0.12.0",
+    "version": "0.13.1",
     "repository": {
         "type": "git",
         "url": "git+https://github.com/ttt-productions/ttt-packages.git",