apitally 1.0.0-beta.4 → 1.0.0-beta.5

package/README.md

@@ -33,7 +33,7 @@ The SDK is an [OpenTelemetry](https://opentelemetry.io) distribution and works a
 Learn more about Apitally on our 🌎 [website](https://apitally.io) or check out the 📚 [documentation](https://docs.apitally.io).
 
 > [!IMPORTANT]
-> **Upgrading from 0.x?** Version 1.0 is a full rewrite with a new setup API. See the [migration guide](MIGRATION.md) for a full 0.x to 1.x mapping.
+> **Upgrading from 0.x?** Version 1.0 is a full rewrite with a new setup API. See the [migration guide](MIGRATION.md) for how to upgrade.
 
 ## Key features
 
@@ -62,13 +62,13 @@ The SDK supports **Node.js** `>= 20.6` and **Bun** `>= 1.2.0`.
 
 \* For Hono on Cloudflare Workers use our [Serverless SDK](https://github.com/apitally/apitally-js-serverless) instead.
 
-Apitally also supports many other web frameworks in [Python](https://github.com/apitally/apitally-py), [Go](https://github.com/apitally/apitally-go), [.NET](https://github.com/apitally/apitally-dotnet) and [Java](https://github.com/apitally/apitally-java) via our other SDKs.
+Apitally also supports many other web frameworks in [Python](https://github.com/apitally/apitally-py), [Go](https://github.com/apitally/apitally-go) and [.NET](https://github.com/apitally/apitally-dotnet) via our other SDKs.
 
 ## Getting started
 
 If you don't have an Apitally account yet, first [sign up here](https://app.apitally.io/?signup). Then create an app in the Apitally dashboard. You'll see detailed setup instructions with code snippets you can copy and paste. These also include your write token.
 
-To install the SDK as a dependency in your project run:
+Install the SDK in your project:
 
 ```bash
 npm install apitally
@@ -78,35 +78,32 @@ See the [SDK reference](https://docs.apitally.io/sdk-reference/javascript/v1/con
 
 ### AdonisJS
 
-Run the Ace add command from your application directory:
+Run the Ace `add` command from your application directory:
 
 ```bash
 node ace add apitally
 ```
 
-The command installs and configures Apitally. It creates `config/apitally.ts`, adds the required environment declarations, registers the service provider and server middleware, and updates the conventional exception handler to capture validation and server errors.
-
-If needed, you can change settings in `config/apitally.ts`.
+The command installs Apitally, asks for your write token and environment, and sets up the provider, middleware, and exception handling. To change settings later, edit `config/apitally.ts`.
 
 For further instructions, see our [setup guide for AdonisJS](https://docs.apitally.io/sdk-reference/javascript/v1/setup-guides/adonisjs).
 
 ### Elysia
 
-Register `apitallyPlugin()` immediately after creating the app, before routes or plugins that add routes:
+Register `apitallyPlugin()` immediately after creating the app, before registering plugins and routes:
 
 ```javascript
 import { Elysia } from "elysia";
 import { apitallyPlugin } from "apitally/elysia";
 
-const app = new Elysia()
-  .use(
-    apitallyPlugin({
-      writeToken: "your-write-token", // or set APITALLY_WRITE_TOKEN
-      env: "dev", // optional, defaults to "dev"
-    }),
-  )
-  // register plugins and routes below this point
-  .get("/items/:id", ({ params }) => ({ id: params.id }));
+const app = new Elysia().use(
+  apitallyPlugin({
+    writeToken: "your-write-token",
+    env: "dev",
+  }),
+);
+
+// register plugins and routes below this point
 ```
 
 For further instructions, see our [setup guide for Elysia](https://docs.apitally.io/sdk-reference/javascript/v1/setup-guides/elysia).
@@ -124,8 +121,8 @@ import { useApitally } from "apitally";
 const app = express();
 
 useApitally(app, {
-  writeToken: "your-write-token", // or set APITALLY_WRITE_TOKEN
-  env: "dev", // or "prod" etc.
+  writeToken: "your-write-token",
+  env: "dev",
 });
 ```
 
@@ -142,8 +139,8 @@ import { useApitally } from "apitally";
 const app = Fastify();
 
 useApitally(app, {
-  writeToken: "your-write-token", // or set APITALLY_WRITE_TOKEN
-  env: "dev", // or "prod" etc.
+  writeToken: "your-write-token",
+  env: "dev",
 });
 
 // register plugins and routes below this point
@@ -151,30 +148,9 @@ useApitally(app, {
 
 For further instructions, see our [setup guide for Fastify](https://docs.apitally.io/sdk-reference/javascript/v1/setup-guides/fastify).
 
-### NestJS
-
-Call `useApitally(app)` immediately after creating the Nest application, before `app.init()` or `app.listen()`:
-
-```javascript
-import { NestFactory } from "@nestjs/core";
-import { useApitally } from "apitally/nestjs";
-import { AppModule } from "./app.module.js";
-
-const app = await NestFactory.create(AppModule);
-
-useApitally(app, {
-  writeToken: "your-write-token", // or set APITALLY_WRITE_TOKEN
-  env: "dev", // or "prod" etc.
-});
-
-await app.listen(3000);
-```
-
-For further instructions, see our [setup guide for NestJS](https://docs.apitally.io/sdk-reference/javascript/v1/setup-guides/nestjs).
-
 ### H3
 
-Add `apitallyPlugin()` when constructing the root H3 app:
+Add `apitallyPlugin()` to the `plugins` of your root H3 app:
 
 ```javascript
 import { H3 } from "h3";
@@ -183,8 +159,8 @@ import { apitallyPlugin } from "apitally/h3";
 const app = new H3({
   plugins: [
     apitallyPlugin({
-      writeToken: "your-write-token", // or set APITALLY_WRITE_TOKEN
-      env: "dev", // or "prod" etc.
+      writeToken: "your-write-token",
+      env: "dev",
     }),
   ],
 });
@@ -194,7 +170,7 @@ For further instructions, see our [setup guide for H3](https://docs.apitally.io/
 
 ### Hapi
 
-Register `apitallyPlugin()` before calling `server.initialize()` or `server.start()`:
+Register `apitallyPlugin()` immediately after creating the server, before registering other plugins and routes:
 
 ```javascript
 import Hapi from "@hapi/hapi";
@@ -204,12 +180,12 @@ const server = Hapi.server({ port: 3000 });
 
 await server.register(
   apitallyPlugin({
-    writeToken: "your-write-token", // or set APITALLY_WRITE_TOKEN
-    env: "dev", // or "prod" etc.
+    writeToken: "your-write-token",
+    env: "dev",
   }),
 );
 
-// register application plugins and routes below this point
+// register other plugins and routes below this point
 await server.start();
 ```
 
@@ -226,8 +202,8 @@ import { useApitally } from "apitally";
 const app = new Hono();
 
 useApitally(app, {
-  writeToken: "your-write-token", // or set APITALLY_WRITE_TOKEN
-  env: "dev", // or "prod" etc.
+  writeToken: "your-write-token",
+  env: "dev",
 });
 
 // register middleware and routes below this point
@@ -240,14 +216,14 @@ For further instructions, see our [setup guide for Hono](https://docs.apitally.i
 Call `useApitally(app)` immediately after creating the app, before registering middleware and routes:
 
 ```javascript
-const Koa = require("koa");
-const { useApitally } = require("apitally");
+import Koa from "koa";
+import { useApitally } from "apitally";
 
 const app = new Koa();
 
 useApitally(app, {
-  writeToken: "your-write-token", // or set APITALLY_WRITE_TOKEN
-  env: "dev", // or "prod" etc.
+  writeToken: "your-write-token",
+  env: "dev",
 });
 
 // register middleware and routes below this point
@@ -255,11 +231,42 @@ useApitally(app, {
 
 For further instructions, see our [setup guide for Koa](https://docs.apitally.io/sdk-reference/javascript/v1/setup-guides/koa).
 
+### NestJS
+
+Call `useApitally(app)` immediately after creating the app, before calling `app.init()` or `app.listen()`:
+
+```javascript
+import { NestFactory } from "@nestjs/core";
+import { useApitally } from "apitally/nestjs";
+import { AppModule } from "./app.module.js";
+
+const app = await NestFactory.create(AppModule);
+
+useApitally(app, {
+  writeToken: "your-write-token",
+  env: "dev",
+});
+
+await app.listen(3000);
+```
+
+For further instructions, see our [setup guide for NestJS](https://docs.apitally.io/sdk-reference/javascript/v1/setup-guides/nestjs).
+
 ## Configuration
 
-The write token and environment can also be provided via the `APITALLY_WRITE_TOKEN` and `APITALLY_ENV` environment variables instead of the `writeToken` and `env` options. The environment defaults to `dev`.
+Pass configuration options to `useApitally()`, or to `apitallyPlugin()` for Elysia, H3, and Hapi. For AdonisJS, set them in `config/apitally.ts`. See the [SDK reference](https://docs.apitally.io/sdk-reference/javascript/v1/configuration) for all available options.
+
+### Environment variables
 
-By default, Apitally captures response headers but not request headers or request and response bodies. You can opt in with options:
+To keep configuration out of your code, set these environment variables instead of passing the matching options:
+
+- `APITALLY_WRITE_TOKEN`: the write token (`writeToken`)
+- `APITALLY_ENV`: the environment name (`env`), defaults to `dev`
+- `APITALLY_DISABLED`: set to `true` to disable Apitally (`disabled`)
+
+### Request and response data
+
+Apitally captures response headers by default. To also capture request headers and request and response bodies, pass these options:
 
 ```javascript
 useApitally(app, {
@@ -271,45 +278,72 @@ useApitally(app, {
 });
 ```
 
-Sensitive values in query parameters, headers, and body fields are masked automatically based on built-in patterns, and you can add your own via the `maskQueryParams`, `maskHeaders`, and `maskBodyFields` options.
+Apitally automatically masks common sensitive values, such as `password` fields and the `Authorization` header. To mask additional values, pass regular expressions to `maskQueryParams`, `maskHeaders`, and `maskBodyFields`. See our [documentation on masking](https://docs.apitally.io/sdk-reference/javascript/v1/masking) for details.
+
+### Exclusions and sampling
+
+Apitally automatically excludes common health checks and static assets, such as `/healthz` and `/robots.txt`, from logs and traces. To exclude additional paths, pass regular expressions to `excludePaths`.
+
+To capture logs and traces for only a fraction of the remaining requests, set `sampleRate`, for example to `0.1` for 10%. To decide for each request individually, pass a callback to `sampleOnRequest` or `sampleOnResponse`.
 
-On high-traffic applications you can capture logs and traces for only a fraction of requests by setting `sampleRate` (e.g. `0.1` for 10%), or decide per request with the `sampleOnRequest` and `sampleOnResponse` callbacks. Metrics always count every request, regardless of sampling.
+Metrics always include all requests. See our [documentation on sampling](https://docs.apitally.io/sdk-reference/javascript/v1/sampling) for details.
 
-Application logs written via `console` and other supported loggers are captured and correlated with requests by default. Use `maskLogRecord` to transform or drop Apitally's captured copy, or opt out with `captureLogs: false`.
+### Application logs
 
-See the [SDK reference](https://docs.apitally.io/sdk-reference/javascript/v1/configuration) for all configuration options.
+Apitally captures logs written with these loggers and correlates them with the requests they belong to:
 
-## Identifying consumers and more
+- `console`
+- Pino
+- Winston
+- NestJS `Logger`
+- Hapi `request.log()`
 
-The top-level `apitally` package provides functions you can call from anywhere in your request handling code:
+To mask or drop individual log records, pass a callback to `maskLogRecord`. To turn off log capture, set `captureLogs: false`.
+
+See our [documentation on masking](https://docs.apitally.io/sdk-reference/javascript/v1/masking#log-record-masking-callback) for details.
+
+## Adding context to requests
+
+The following functions add context to the current request. Call them while handling a request, for example in a route handler, middleware, or authentication code.
+
+To associate the request with the API consumer making it, call `setConsumer`. Only `identifier` is required. You can also pass it as a string, for example `setConsumer(user.identifier)`.
 
 ```javascript
-import { setConsumer, setRequestAttribute, captureException } from "apitally";
+import { setConsumer } from "apitally";
 
-// Associate the current request with an API consumer, with custom attributes
 setConsumer({
   identifier: user.identifier,
   name: user.name,
   group: user.group,
   attributes: { plan: user.plan },
 });
+```
 
-// Attach a custom attribute to the current request
-setRequestAttribute("tenant", tenantId);
+To attach custom data to the request's trace, call `setRequestAttribute`. Sampling and masking callbacks can also read these attributes.
 
-// Capture a handled exception for the current request
-captureException(error);
+```javascript
+import { setRequestAttribute } from "apitally";
+
+setRequestAttribute("tenant.id", tenantId);
 ```
 
-`setConsumer()` also accepts an identifier string, for example `setConsumer(user.identifier)`.
+To capture an exception that your code handles itself, call `captureException`. Unhandled exceptions are captured automatically.
 
-For further details, check out our [documentation](https://docs.apitally.io).
+```javascript
+import { captureException } from "apitally";
 
-## Existing OpenTelemetry setup
+try {
+  processOrder();
+} catch (error) {
+  captureException(error);
+}
+```
 
-If your app doesn't already use OpenTelemetry, you don't need to know it's there. The Apitally SDK configures OpenTelemetry automatically.
+See our documentation on [custom attributes](https://docs.apitally.io/sdk-reference/javascript/v1/attributes#set-custom-attributes) and [handled exceptions](https://docs.apitally.io/sdk-reference/javascript/v1/tracing#capture-handled-exceptions) for details.
 
-If your app already registers its own tracer provider (e.g. via `NodeSDK`), Apitally does not replace it. Instead, you need to add the `ApitallySpanProcessor` to your provider's span processors:
+## Existing OpenTelemetry setup
+
+If your app already registers its own tracer provider, for example with `NodeSDK`, add `ApitallySpanProcessor` to its span processors. Apitally then uses your tracer provider instead of registering its own, and keeps your existing exporters.
 
 ```javascript
 import { NodeSDK } from "@opentelemetry/sdk-node";
@@ -321,40 +355,29 @@ const sdk = new NodeSDK({
 });
 ```
 
-Your tracer provider's sampling settings also affect Apitally. Requests excluded by the sampler will not have request logs or traces in Apitally. Metrics still include all requests, regardless of sampling.
-
-### Elysia's OpenTelemetry plugin
-
-When using Elysia's `@elysia/opentelemetry` plugin, register Apitally first so it adopts the OpenTelemetry SERVER span:
-
-```javascript
-import { opentelemetry } from "@elysia/opentelemetry";
-import { Elysia } from "elysia";
-import { apitallyPlugin } from "apitally/elysia";
-
-const app = new Elysia()
-  .use(apitallyPlugin(options))
-  .use(opentelemetry());
-```
-
-## Trusted proxies
+If you use versions 8 to 10 of the Sentry SDK, which register their own tracer provider, add `ApitallySpanProcessor` to the `openTelemetrySpanProcessors` option in `Sentry.init()` and enable Sentry tracing.
 
-If your application runs behind a reverse proxy or load balancer, configure trusted proxies in your framework so Apitally can record the real client IP for GeoIP. Apitally uses the client IP reported by your framework. It does not read forwarding headers itself to determine the client IP.
+Your tracer provider's sampler also applies to Apitally. Requests it drops have no request logs or traces in Apitally, but still count in metrics.
 
 ## Graceful shutdown
 
-Apitally sends telemetry in batches and automatically attempts a final export during normal process shutdown.
-
-If your code calls `process.exit()`, await `shutdown()` first to give Apitally time to send buffered telemetry. Close your server and let any remaining requests finish before doing this:
+If your code calls `process.exit()`, await `shutdown()` before it so Apitally can send any remaining telemetry:
 
 ```javascript
 import { shutdown } from "apitally";
 
-// After the server has closed and requests have finished:
-await shutdown();
-process.exit(0);
+process.on("SIGTERM", () => {
+  server.close(async () => {
+    await shutdown();
+    process.exit(0);
+  });
+});
 ```
 
+## Trusted proxies
+
+If your app runs behind a reverse proxy or load balancer, configure trusted proxies in your framework, for example with Express's `trust proxy` setting or Fastify's `trustProxy` option. Apitally records the client IP your framework reports and uses it for GeoIP.
+
 ## Getting help
 
 If you need help please [create a new discussion](https://github.com/orgs/apitally/discussions/categories/q-a) on GitHub or email us at [support@apitally.io](mailto:support@apitally.io). We'll get back to you as soon as possible.

package/dist/activation.cjs

@@ -7,11 +7,11 @@ const require_logCapture = require("./logCapture.cjs");
 const require_logRecordExporter = require("./logRecordExporter.cjs");
 const require_logRecordProcessor = require("./logRecordProcessor.cjs");
 const require_metrics = require("./metrics.cjs");
+const require_spanProcessor = require("./spanProcessor.cjs");
 const require_providers = require("./providers.cjs");
 const require_redaction = require("./redaction.cjs");
 const require_sentry = require("./sentry.cjs");
 const require_serverErrors = require("./serverErrors.cjs");
-const require_spanProcessor = require("./spanProcessor.cjs");
 const require_spanExporter = require("./spanExporter.cjs");
 const require_spool = require("./spool.cjs");
 const require_startup = require("./startup.cjs");

package/dist/activation.js

@@ -6,11 +6,11 @@ import { installConsoleCapture, installNestLoggerCapture, installPinoCapture, in
 import { ApitallyLogRecordExporter } from "./logRecordExporter.js";
 import { ApitallyLogRecordProcessor } from "./logRecordProcessor.js";
 import { MetricsPipeline } from "./metrics.js";
+import { SpanPipeline, isApitallySpanProcessorDeclared, setActiveSpanPipeline, setServerSpanActivationCallback } from "./spanProcessor.js";
 import { createLoggerProvider, resolveEnvAndCreateResource, setupTracerProvider } from "./providers.js";
 import { Redaction } from "./redaction.js";
 import { installSentryEventIdRecording } from "./sentry.js";
 import { SERVER_ERROR_EVENT_NAME, drainServerErrors, resetServerErrors } from "./serverErrors.js";
-import { SpanPipeline, isApitallySpanProcessorDeclared, setActiveSpanPipeline, setServerSpanActivationCallback } from "./spanProcessor.js";
 import { ApitallySpanExporter } from "./spanExporter.js";
 import { Spool } from "./spool.js";
 import { emitStartupEvent } from "./startup.js";

package/dist/config.cjs

@@ -26,6 +26,8 @@ const DEFAULT_MASK_BODY_FIELDS = [
 	"auth",
 	"card[-_ ]?number",
 	"ccv",
+	"cvv",
+	"cvc",
 	"ssn"
 ];
 const DEFAULT_EXCLUDE_PATHS = [
@@ -77,10 +79,11 @@ function isValidWriteToken(value) {
 	return WRITE_TOKEN_FORMAT.test(value);
 }
 function matchesAny(patterns, value) {
-	return patterns.some((pattern) => {
+	for (const pattern of patterns) {
 		pattern.lastIndex = 0;
-		return pattern.test(value);
-	});
+		if (pattern.test(value)) return true;
+	}
+	return false;
 }
 function compilePatterns(defaults, userPatterns = []) {
 	return [...defaults.map((pattern) => new RegExp(pattern, "i")), ...userPatterns.map((pattern) => new RegExp(pattern))];

package/dist/config.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"config.cjs","names":[],"sources":["../src/config.ts"],"sourcesContent":["import type { ReadWriteLogRecord } from \"@opentelemetry/sdk-logs\";\nimport type { ReadableSpan } from \"@opentelemetry/sdk-trace-base\";\nimport { logError, logWarning } from \"./logger.js\";\n\nexport type BodyMaskingCallback = (body: Buffer, span: ReadableSpan) => Buffer | null;\nexport type LogRecordMaskingCallback = (\n  logRecord: ReadWriteLogRecord,\n) => ReadWriteLogRecord | null | undefined;\nexport type SamplingCallback = (span: ReadableSpan) => number | boolean | undefined;\n\nexport interface ApitallyOptions {\n  writeToken?: string;\n  env?: string;\n  appVersion?: string;\n  disabled?: boolean;\n  captureLogs?: boolean;\n  captureRequestHeaders?: boolean;\n  captureRequestBody?: boolean;\n  captureResponseHeaders?: boolean;\n  captureResponseBody?: boolean;\n  maskQueryParams?: RegExp[];\n  maskHeaders?: RegExp[];\n  maskBodyFields?: RegExp[];\n  maskRequestBody?: BodyMaskingCallback;\n  maskResponseBody?: BodyMaskingCallback;\n  maskLogRecord?: LogRecordMaskingCallback;\n  excludePaths?: RegExp[];\n  sampleRate?: number;\n  sampleOnRequest?: SamplingCallback;\n  sampleOnResponse?: SamplingCallback;\n}\n\ntype OptionalConfigKeys =\n  | \"appVersion\"\n  | \"maskRequestBody\"\n  | \"maskResponseBody\"\n  | \"maskLogRecord\"\n  | \"sampleOnRequest\"\n  | \"sampleOnResponse\";\n\nexport type ApitallyConfig = Required<Omit<ApitallyOptions, OptionalConfigKeys>> &\n  Pick<ApitallyOptions, OptionalConfigKeys> & { otlpEndpoint: string };\n\nconst DEFAULT_OTLP_ENDPOINT = \"https://otlp.apitally.io\";\nexport const DEFAULT_ENV = \"dev\";\n\n// User-supplied patterns extend these defaults, never replace them.\nexport const DEFAULT_MASK_QUERY_PARAMS = [\n  \"auth\",\n  \"api[-_]?key\",\n  \"secret\",\n  \"token\",\n  \"password\",\n  \"pwd\",\n];\nexport const DEFAULT_MASK_HEADERS = [\"auth\", \"api[-_]?key\", \"secret\", \"token\", \"cookie\"];\nexport const DEFAULT_MASK_BODY_FIELDS = [\n  \"password\",\n  \"pwd\",\n  \"token\",\n  \"secret\",\n  \"auth\",\n  \"card[-_ ]?number\",\n  \"ccv\",\n  \"ssn\",\n];\nexport const DEFAULT_EXCLUDE_PATHS = [\n  \"/_?healthz?/?$\",\n  \"/_?health[-_]?checks?/?$\",\n  \"/_?heart[-_]?beats?/?$\",\n  \"/ping/?$\",\n  \"/ready/?$\",\n  \"/live/?$\",\n  \"/favicon(?:-[\\\\w-]+)?\\\\.(ico|png|svg)$\",\n  \"/apple-touch-icon(?:-[\\\\w-]+)?\\\\.png$\",\n  \"/robots\\\\.txt$\",\n  \"/sitemap\\\\.xml$\",\n  \"/manifest\\\\.json$\",\n  \"/site\\\\.webmanifest$\",\n  \"/service-worker\\\\.js$\",\n  \"/sw\\\\.js$\",\n  \"/\\\\.well-known/\",\n];\nexport const EXCLUDE_USER_AGENTS = [\n  \"health[-_ ]?check\",\n  \"microsoft-azure-application-lb\",\n  \"googlehc\",\n  \"kube-probe\",\n];\n\nconst WRITE_TOKEN_FORMAT = /^apt_[a-zA-Z0-9]{24}$/;\nconst TRUE_VALUES = new Set([\"1\", \"true\", \"yes\"]);\n\n// The ESM and CJS builds can load together, so a Symbol.for key gives both\n// copies the same configuration.\nconst GLOBAL_CONFIG_KEY = Symbol.for(\"apitally.config\");\nconst configHolder = globalThis as Record<symbol, ApitallyConfig | undefined>;\n\nexport function setConfig(options: ApitallyOptions = {}): ApitallyConfig {\n  const { config, error } = resolveConfig(options);\n  const currentConfig = configHolder[GLOBAL_CONFIG_KEY];\n  if (currentConfig) {\n    if (!isSameConfig(config, currentConfig)) {\n      logWarning(\n        \"useApitally() was called again with different options; the first call's configuration stays in effect\",\n      );\n    }\n    return currentConfig;\n  }\n  if (error) {\n    logError(error);\n  }\n  configHolder[GLOBAL_CONFIG_KEY] = config;\n  return config;\n}\n\nexport function getConfig(): ApitallyConfig {\n  return configHolder[GLOBAL_CONFIG_KEY] ?? resolveConfig({}).config;\n}\n\nexport function isValidWriteToken(value: string): boolean {\n  return WRITE_TOKEN_FORMAT.test(value);\n}\n\nexport function matchesAny(patterns: RegExp[], value: string): boolean {\n  return patterns.some((pattern) => {\n    pattern.lastIndex = 0;\n    return pattern.test(value);\n  });\n}\n\nexport function compilePatterns(defaults: string[], userPatterns: RegExp[] = []): RegExp[] {\n  return [\n    ...defaults.map((pattern) => new RegExp(pattern, \"i\")),\n    ...userPatterns.map((pattern) => new RegExp(pattern)),\n  ];\n}\n\nfunction resolveConfig(options: ApitallyOptions): {\n  config: ApitallyConfig;\n  error?: string;\n} {\n  const config: ApitallyConfig = {\n    writeToken: options.writeToken ?? nonEmptyEnvVar(\"APITALLY_WRITE_TOKEN\") ?? \"\",\n    env: options.env ?? nonEmptyEnvVar(\"APITALLY_ENV\") ?? DEFAULT_ENV,\n    appVersion: options.appVersion,\n    disabled:\n      options.disabled === true ||\n      isTruthyEnvValue(process.env.APITALLY_DISABLED) ||\n      isTruthyEnvValue(process.env.OTEL_SDK_DISABLED),\n    captureLogs: options.captureLogs ?? true,\n    captureRequestHeaders: options.captureRequestHeaders ?? false,\n    captureRequestBody: options.captureRequestBody ?? false,\n    captureResponseHeaders: options.captureResponseHeaders ?? true,\n    captureResponseBody: options.captureResponseBody ?? false,\n    maskQueryParams: dropNonRegExpPatterns(\"maskQueryParams\", options.maskQueryParams),\n    maskHeaders: dropNonRegExpPatterns(\"maskHeaders\", options.maskHeaders),\n    maskBodyFields: dropNonRegExpPatterns(\"maskBodyFields\", options.maskBodyFields),\n    maskRequestBody: options.maskRequestBody,\n    maskResponseBody: options.maskResponseBody,\n    maskLogRecord: options.maskLogRecord,\n    excludePaths: dropNonRegExpPatterns(\"excludePaths\", options.excludePaths),\n    // An invalid sampleRate resolves to capturing everything: no data is lost, so no warning.\n    sampleRate:\n      typeof options.sampleRate === \"number\" && options.sampleRate >= 0 && options.sampleRate <= 1\n        ? options.sampleRate\n        : 1,\n    sampleOnRequest: options.sampleOnRequest,\n    sampleOnResponse: options.sampleOnResponse,\n    otlpEndpoint: nonEmptyEnvVar(\"APITALLY_OTLP_ENDPOINT\") ?? DEFAULT_OTLP_ENDPOINT,\n  };\n  if (config.disabled) {\n    return { config };\n  }\n  if (!config.writeToken) {\n    config.disabled = true;\n    return {\n      config,\n      error:\n        \"Apitally write token is missing (set the writeToken option or the APITALLY_WRITE_TOKEN environment variable)\",\n    };\n  }\n  if (!isValidWriteToken(config.writeToken)) {\n    config.disabled = true;\n    // The write token is a credential and must never appear unmasked in logs.\n    return {\n      config,\n      error: `Apitally write token has an invalid format: ${config.writeToken.slice(0, 8)}...`,\n    };\n  }\n  if (!isHttpUrl(config.otlpEndpoint)) {\n    config.disabled = true;\n    return {\n      config,\n      error: `Apitally OTLP endpoint is not a valid HTTP or HTTPS URL: ${config.otlpEndpoint}`,\n    };\n  }\n  return { config };\n}\n\nfunction isHttpUrl(value: string): boolean {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    return false;\n  }\n  return url.protocol === \"http:\" || url.protocol === \"https:\";\n}\n\n// Invalid pattern values could leave data unredacted, so they are logged and omitted.\nfunction dropNonRegExpPatterns(optionName: string, patterns: RegExp[] = []): RegExp[] {\n  return patterns.filter((pattern) => {\n    if (pattern instanceof RegExp) {\n      return true;\n    }\n    logError(`Pattern in ${optionName} ignored because it is not a RegExp: ${String(pattern)}`);\n    return false;\n  });\n}\n\nfunction isSameConfig(a: ApitallyConfig, b: ApitallyConfig): boolean {\n  return (Object.keys(a) as (keyof ApitallyConfig)[]).every((key) => {\n    const left = a[key];\n    const right = b[key];\n    if (Array.isArray(left) && Array.isArray(right)) {\n      return (\n        left.length === right.length &&\n        left.every((item, index) => {\n          const other = right[index];\n          return (\n            item instanceof RegExp &&\n            other instanceof RegExp &&\n            item.source === other.source &&\n            item.flags === other.flags\n          );\n        })\n      );\n    }\n    // Callback identity says nothing about sameness; app factories create them inline.\n    if (typeof left === \"function\" && typeof right === \"function\") {\n      return true;\n    }\n    return left === right;\n  });\n}\n\nfunction isTruthyEnvValue(value: string | undefined): boolean {\n  return value !== undefined && TRUE_VALUES.has(value.trim().toLowerCase());\n}\n\nfunction nonEmptyEnvVar(name: string): string | undefined {\n  return process.env[name]?.trim() || undefined;\n}\n"],"mappings":";;;AA2CA,MAAM,wBAAwB;AAC9B,MAAa,cAAc;AAG3B,MAAa,4BAA4B;CACvC;CACA;CACA;CACA;CACA;CACA;AACF;AACA,MAAa,uBAAuB;CAAC;CAAQ;CAAe;CAAU;CAAS;AAAQ;AACvF,MAAa,2BAA2B;CACtC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AACA,MAAa,wBAAwB;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AACA,MAAa,sBAAsB;CACjC;CACA;CACA;CACA;AACF;AAEA,MAAM,qBAAqB;AAC3B,MAAM,8BAAc,IAAI,IAAI;CAAC;CAAK;CAAQ;AAAK,CAAC;AAIhD,MAAM,oBAAoB,OAAO,IAAI,iBAAiB;AACtD,MAAM,eAAe;AAErB,SAAgB,UAAU,UAA2B,CAAC,GAAmB;CACvE,MAAM,EAAE,QAAQ,UAAU,cAAc,OAAO;CAC/C,MAAM,gBAAgB,aAAa;CACnC,IAAI,eAAe;EACjB,IAAI,CAAC,aAAa,QAAQ,aAAa,GACrC,eAAA,WACE,uGACF;EAEF,OAAO;CACT;CACA,IAAI,OACF,eAAA,SAAS,KAAK;CAEhB,aAAa,qBAAqB;CAClC,OAAO;AACT;AAEA,SAAgB,YAA4B;CAC1C,OAAO,aAAa,sBAAsB,cAAc,CAAC,CAAC,CAAC,CAAC;AAC9D;AAEA,SAAgB,kBAAkB,OAAwB;CACxD,OAAO,mBAAmB,KAAK,KAAK;AACtC;AAEA,SAAgB,WAAW,UAAoB,OAAwB;CACrE,OAAO,SAAS,MAAM,YAAY;EAChC,QAAQ,YAAY;EACpB,OAAO,QAAQ,KAAK,KAAK;CAC3B,CAAC;AACH;AAEA,SAAgB,gBAAgB,UAAoB,eAAyB,CAAC,GAAa;CACzF,OAAO,CACL,GAAG,SAAS,KAAK,YAAY,IAAI,OAAO,SAAS,GAAG,CAAC,GACrD,GAAG,aAAa,KAAK,YAAY,IAAI,OAAO,OAAO,CAAC,CACtD;AACF;AAEA,SAAS,cAAc,SAGrB;CACA,MAAM,SAAyB;EAC7B,YAAY,QAAQ,cAAc,eAAe,sBAAsB,KAAK;EAC5E,KAAK,QAAQ,OAAO,eAAe,cAAc,KAAA;EACjD,YAAY,QAAQ;EACpB,UACE,QAAQ,aAAa,QACrB,iBAAiB,QAAQ,IAAI,iBAAiB,KAC9C,iBAAiB,QAAQ,IAAI,iBAAiB;EAChD,aAAa,QAAQ,eAAe;EACpC,uBAAuB,QAAQ,yBAAyB;EACxD,oBAAoB,QAAQ,sBAAsB;EAClD,wBAAwB,QAAQ,0BAA0B;EAC1D,qBAAqB,QAAQ,uBAAuB;EACpD,iBAAiB,sBAAsB,mBAAmB,QAAQ,eAAe;EACjF,aAAa,sBAAsB,eAAe,QAAQ,WAAW;EACrE,gBAAgB,sBAAsB,kBAAkB,QAAQ,cAAc;EAC9E,iBAAiB,QAAQ;EACzB,kBAAkB,QAAQ;EAC1B,eAAe,QAAQ;EACvB,cAAc,sBAAsB,gBAAgB,QAAQ,YAAY;EAExE,YACE,OAAO,QAAQ,eAAe,YAAY,QAAQ,cAAc,KAAK,QAAQ,cAAc,IACvF,QAAQ,aACR;EACN,iBAAiB,QAAQ;EACzB,kBAAkB,QAAQ;EAC1B,cAAc,eAAe,wBAAwB,KAAK;CAC5D;CACA,IAAI,OAAO,UACT,OAAO,EAAE,OAAO;CAElB,IAAI,CAAC,OAAO,YAAY;EACtB,OAAO,WAAW;EAClB,OAAO;GACL;GACA,OACE;EACJ;CACF;CACA,IAAI,CAAC,kBAAkB,OAAO,UAAU,GAAG;EACzC,OAAO,WAAW;EAElB,OAAO;GACL;GACA,OAAO,+CAA+C,OAAO,WAAW,MAAM,GAAG,CAAC,EAAE;EACtF;CACF;CACA,IAAI,CAAC,UAAU,OAAO,YAAY,GAAG;EACnC,OAAO,WAAW;EAClB,OAAO;GACL;GACA,OAAO,4DAA4D,OAAO;EAC5E;CACF;CACA,OAAO,EAAE,OAAO;AAClB;AAEA,SAAS,UAAU,OAAwB;CACzC,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,KAAK;CACrB,QAAQ;EACN,OAAO;CACT;CACA,OAAO,IAAI,aAAa,WAAW,IAAI,aAAa;AACtD;AAGA,SAAS,sBAAsB,YAAoB,WAAqB,CAAC,GAAa;CACpF,OAAO,SAAS,QAAQ,YAAY;EAClC,IAAI,mBAAmB,QACrB,OAAO;EAET,eAAA,SAAS,cAAc,WAAW,uCAAuC,OAAO,OAAO,GAAG;EAC1F,OAAO;CACT,CAAC;AACH;AAEA,SAAS,aAAa,GAAmB,GAA4B;CACnE,OAAQ,OAAO,KAAK,CAAC,CAAC,CAA8B,OAAO,QAAQ;EACjE,MAAM,OAAO,EAAE;EACf,MAAM,QAAQ,EAAE;EAChB,IAAI,MAAM,QAAQ,IAAI,KAAK,MAAM,QAAQ,KAAK,GAC5C,OACE,KAAK,WAAW,MAAM,UACtB,KAAK,OAAO,MAAM,UAAU;GAC1B,MAAM,QAAQ,MAAM;GACpB,OACE,gBAAgB,UAChB,iBAAiB,UACjB,KAAK,WAAW,MAAM,UACtB,KAAK,UAAU,MAAM;EAEzB,CAAC;EAIL,IAAI,OAAO,SAAS,cAAc,OAAO,UAAU,YACjD,OAAO;EAET,OAAO,SAAS;CAClB,CAAC;AACH;AAEA,SAAS,iBAAiB,OAAoC;CAC5D,OAAO,UAAU,KAAA,KAAa,YAAY,IAAI,MAAM,KAAK,CAAC,CAAC,YAAY,CAAC;AAC1E;AAEA,SAAS,eAAe,MAAkC;CACxD,OAAO,QAAQ,IAAI,KAAK,EAAE,KAAK,KAAK,KAAA;AACtC"}
+{"version":3,"file":"config.cjs","names":[],"sources":["../src/config.ts"],"sourcesContent":["import type { ReadWriteLogRecord } from \"@opentelemetry/sdk-logs\";\nimport type { ReadableSpan } from \"@opentelemetry/sdk-trace-base\";\nimport { logError, logWarning } from \"./logger.js\";\n\nexport type BodyMaskingCallback = (body: Buffer, span: ReadableSpan) => Buffer | null;\nexport type LogRecordMaskingCallback = (\n  logRecord: ReadWriteLogRecord,\n) => ReadWriteLogRecord | null | undefined;\nexport type SamplingCallback = (span: ReadableSpan) => number | boolean | undefined;\n\nexport interface ApitallyOptions {\n  writeToken?: string;\n  env?: string;\n  appVersion?: string;\n  disabled?: boolean;\n  captureLogs?: boolean;\n  captureRequestHeaders?: boolean;\n  captureRequestBody?: boolean;\n  captureResponseHeaders?: boolean;\n  captureResponseBody?: boolean;\n  maskQueryParams?: RegExp[];\n  maskHeaders?: RegExp[];\n  maskBodyFields?: RegExp[];\n  maskRequestBody?: BodyMaskingCallback;\n  maskResponseBody?: BodyMaskingCallback;\n  maskLogRecord?: LogRecordMaskingCallback;\n  excludePaths?: RegExp[];\n  sampleRate?: number;\n  sampleOnRequest?: SamplingCallback;\n  sampleOnResponse?: SamplingCallback;\n}\n\ntype OptionalConfigKeys =\n  | \"appVersion\"\n  | \"maskRequestBody\"\n  | \"maskResponseBody\"\n  | \"maskLogRecord\"\n  | \"sampleOnRequest\"\n  | \"sampleOnResponse\";\n\nexport type ApitallyConfig = Required<Omit<ApitallyOptions, OptionalConfigKeys>> &\n  Pick<ApitallyOptions, OptionalConfigKeys> & { otlpEndpoint: string };\n\nconst DEFAULT_OTLP_ENDPOINT = \"https://otlp.apitally.io\";\nexport const DEFAULT_ENV = \"dev\";\n\n// User-supplied patterns extend these defaults, never replace them.\nexport const DEFAULT_MASK_QUERY_PARAMS = [\n  \"auth\",\n  \"api[-_]?key\",\n  \"secret\",\n  \"token\",\n  \"password\",\n  \"pwd\",\n];\nexport const DEFAULT_MASK_HEADERS = [\"auth\", \"api[-_]?key\", \"secret\", \"token\", \"cookie\"];\nexport const DEFAULT_MASK_BODY_FIELDS = [\n  \"password\",\n  \"pwd\",\n  \"token\",\n  \"secret\",\n  \"auth\",\n  \"card[-_ ]?number\",\n  \"ccv\",\n  \"cvv\",\n  \"cvc\",\n  \"ssn\",\n];\nexport const DEFAULT_EXCLUDE_PATHS = [\n  \"/_?healthz?/?$\",\n  \"/_?health[-_]?checks?/?$\",\n  \"/_?heart[-_]?beats?/?$\",\n  \"/ping/?$\",\n  \"/ready/?$\",\n  \"/live/?$\",\n  \"/favicon(?:-[\\\\w-]+)?\\\\.(ico|png|svg)$\",\n  \"/apple-touch-icon(?:-[\\\\w-]+)?\\\\.png$\",\n  \"/robots\\\\.txt$\",\n  \"/sitemap\\\\.xml$\",\n  \"/manifest\\\\.json$\",\n  \"/site\\\\.webmanifest$\",\n  \"/service-worker\\\\.js$\",\n  \"/sw\\\\.js$\",\n  \"/\\\\.well-known/\",\n];\nexport const EXCLUDE_USER_AGENTS = [\n  \"health[-_ ]?check\",\n  \"microsoft-azure-application-lb\",\n  \"googlehc\",\n  \"kube-probe\",\n];\n\nconst WRITE_TOKEN_FORMAT = /^apt_[a-zA-Z0-9]{24}$/;\nconst TRUE_VALUES = new Set([\"1\", \"true\", \"yes\"]);\n\n// The ESM and CJS builds can load together, so a Symbol.for key gives both\n// copies the same configuration.\nconst GLOBAL_CONFIG_KEY = Symbol.for(\"apitally.config\");\nconst configHolder = globalThis as Record<symbol, ApitallyConfig | undefined>;\n\nexport function setConfig(options: ApitallyOptions = {}): ApitallyConfig {\n  const { config, error } = resolveConfig(options);\n  const currentConfig = configHolder[GLOBAL_CONFIG_KEY];\n  if (currentConfig) {\n    if (!isSameConfig(config, currentConfig)) {\n      logWarning(\n        \"useApitally() was called again with different options; the first call's configuration stays in effect\",\n      );\n    }\n    return currentConfig;\n  }\n  if (error) {\n    logError(error);\n  }\n  configHolder[GLOBAL_CONFIG_KEY] = config;\n  return config;\n}\n\nexport function getConfig(): ApitallyConfig {\n  return configHolder[GLOBAL_CONFIG_KEY] ?? resolveConfig({}).config;\n}\n\nexport function isValidWriteToken(value: string): boolean {\n  return WRITE_TOKEN_FORMAT.test(value);\n}\n\nexport function matchesAny(patterns: RegExp[], value: string): boolean {\n  for (const pattern of patterns) {\n    pattern.lastIndex = 0;\n    if (pattern.test(value)) {\n      return true;\n    }\n  }\n  return false;\n}\n\nexport function compilePatterns(defaults: string[], userPatterns: RegExp[] = []): RegExp[] {\n  return [\n    ...defaults.map((pattern) => new RegExp(pattern, \"i\")),\n    ...userPatterns.map((pattern) => new RegExp(pattern)),\n  ];\n}\n\nfunction resolveConfig(options: ApitallyOptions): {\n  config: ApitallyConfig;\n  error?: string;\n} {\n  const config: ApitallyConfig = {\n    writeToken: options.writeToken ?? nonEmptyEnvVar(\"APITALLY_WRITE_TOKEN\") ?? \"\",\n    env: options.env ?? nonEmptyEnvVar(\"APITALLY_ENV\") ?? DEFAULT_ENV,\n    appVersion: options.appVersion,\n    disabled:\n      options.disabled === true ||\n      isTruthyEnvValue(process.env.APITALLY_DISABLED) ||\n      isTruthyEnvValue(process.env.OTEL_SDK_DISABLED),\n    captureLogs: options.captureLogs ?? true,\n    captureRequestHeaders: options.captureRequestHeaders ?? false,\n    captureRequestBody: options.captureRequestBody ?? false,\n    captureResponseHeaders: options.captureResponseHeaders ?? true,\n    captureResponseBody: options.captureResponseBody ?? false,\n    maskQueryParams: dropNonRegExpPatterns(\"maskQueryParams\", options.maskQueryParams),\n    maskHeaders: dropNonRegExpPatterns(\"maskHeaders\", options.maskHeaders),\n    maskBodyFields: dropNonRegExpPatterns(\"maskBodyFields\", options.maskBodyFields),\n    maskRequestBody: options.maskRequestBody,\n    maskResponseBody: options.maskResponseBody,\n    maskLogRecord: options.maskLogRecord,\n    excludePaths: dropNonRegExpPatterns(\"excludePaths\", options.excludePaths),\n    // An invalid sampleRate resolves to capturing everything: no data is lost, so no warning.\n    sampleRate:\n      typeof options.sampleRate === \"number\" && options.sampleRate >= 0 && options.sampleRate <= 1\n        ? options.sampleRate\n        : 1,\n    sampleOnRequest: options.sampleOnRequest,\n    sampleOnResponse: options.sampleOnResponse,\n    otlpEndpoint: nonEmptyEnvVar(\"APITALLY_OTLP_ENDPOINT\") ?? DEFAULT_OTLP_ENDPOINT,\n  };\n  if (config.disabled) {\n    return { config };\n  }\n  if (!config.writeToken) {\n    config.disabled = true;\n    return {\n      config,\n      error:\n        \"Apitally write token is missing (set the writeToken option or the APITALLY_WRITE_TOKEN environment variable)\",\n    };\n  }\n  if (!isValidWriteToken(config.writeToken)) {\n    config.disabled = true;\n    // The write token is a credential and must never appear unmasked in logs.\n    return {\n      config,\n      error: `Apitally write token has an invalid format: ${config.writeToken.slice(0, 8)}...`,\n    };\n  }\n  if (!isHttpUrl(config.otlpEndpoint)) {\n    config.disabled = true;\n    return {\n      config,\n      error: `Apitally OTLP endpoint is not a valid HTTP or HTTPS URL: ${config.otlpEndpoint}`,\n    };\n  }\n  return { config };\n}\n\nfunction isHttpUrl(value: string): boolean {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    return false;\n  }\n  return url.protocol === \"http:\" || url.protocol === \"https:\";\n}\n\n// Invalid pattern values could leave data unredacted, so they are logged and omitted.\nfunction dropNonRegExpPatterns(optionName: string, patterns: RegExp[] = []): RegExp[] {\n  return patterns.filter((pattern) => {\n    if (pattern instanceof RegExp) {\n      return true;\n    }\n    logError(`Pattern in ${optionName} ignored because it is not a RegExp: ${String(pattern)}`);\n    return false;\n  });\n}\n\nfunction isSameConfig(a: ApitallyConfig, b: ApitallyConfig): boolean {\n  return (Object.keys(a) as (keyof ApitallyConfig)[]).every((key) => {\n    const left = a[key];\n    const right = b[key];\n    if (Array.isArray(left) && Array.isArray(right)) {\n      return (\n        left.length === right.length &&\n        left.every((item, index) => {\n          const other = right[index];\n          return (\n            item instanceof RegExp &&\n            other instanceof RegExp &&\n            item.source === other.source &&\n            item.flags === other.flags\n          );\n        })\n      );\n    }\n    // Callback identity says nothing about sameness; app factories create them inline.\n    if (typeof left === \"function\" && typeof right === \"function\") {\n      return true;\n    }\n    return left === right;\n  });\n}\n\nfunction isTruthyEnvValue(value: string | undefined): boolean {\n  return value !== undefined && TRUE_VALUES.has(value.trim().toLowerCase());\n}\n\nfunction nonEmptyEnvVar(name: string): string | undefined {\n  return process.env[name]?.trim() || undefined;\n}\n"],"mappings":";;;AA2CA,MAAM,wBAAwB;AAC9B,MAAa,cAAc;AAG3B,MAAa,4BAA4B;CACvC;CACA;CACA;CACA;CACA;CACA;AACF;AACA,MAAa,uBAAuB;CAAC;CAAQ;CAAe;CAAU;CAAS;AAAQ;AACvF,MAAa,2BAA2B;CACtC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AACA,MAAa,wBAAwB;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AACA,MAAa,sBAAsB;CACjC;CACA;CACA;CACA;AACF;AAEA,MAAM,qBAAqB;AAC3B,MAAM,8BAAc,IAAI,IAAI;CAAC;CAAK;CAAQ;AAAK,CAAC;AAIhD,MAAM,oBAAoB,OAAO,IAAI,iBAAiB;AACtD,MAAM,eAAe;AAErB,SAAgB,UAAU,UAA2B,CAAC,GAAmB;CACvE,MAAM,EAAE,QAAQ,UAAU,cAAc,OAAO;CAC/C,MAAM,gBAAgB,aAAa;CACnC,IAAI,eAAe;EACjB,IAAI,CAAC,aAAa,QAAQ,aAAa,GACrC,eAAA,WACE,uGACF;EAEF,OAAO;CACT;CACA,IAAI,OACF,eAAA,SAAS,KAAK;CAEhB,aAAa,qBAAqB;CAClC,OAAO;AACT;AAEA,SAAgB,YAA4B;CAC1C,OAAO,aAAa,sBAAsB,cAAc,CAAC,CAAC,CAAC,CAAC;AAC9D;AAEA,SAAgB,kBAAkB,OAAwB;CACxD,OAAO,mBAAmB,KAAK,KAAK;AACtC;AAEA,SAAgB,WAAW,UAAoB,OAAwB;CACrE,KAAK,MAAM,WAAW,UAAU;EAC9B,QAAQ,YAAY;EACpB,IAAI,QAAQ,KAAK,KAAK,GACpB,OAAO;CAEX;CACA,OAAO;AACT;AAEA,SAAgB,gBAAgB,UAAoB,eAAyB,CAAC,GAAa;CACzF,OAAO,CACL,GAAG,SAAS,KAAK,YAAY,IAAI,OAAO,SAAS,GAAG,CAAC,GACrD,GAAG,aAAa,KAAK,YAAY,IAAI,OAAO,OAAO,CAAC,CACtD;AACF;AAEA,SAAS,cAAc,SAGrB;CACA,MAAM,SAAyB;EAC7B,YAAY,QAAQ,cAAc,eAAe,sBAAsB,KAAK;EAC5E,KAAK,QAAQ,OAAO,eAAe,cAAc,KAAA;EACjD,YAAY,QAAQ;EACpB,UACE,QAAQ,aAAa,QACrB,iBAAiB,QAAQ,IAAI,iBAAiB,KAC9C,iBAAiB,QAAQ,IAAI,iBAAiB;EAChD,aAAa,QAAQ,eAAe;EACpC,uBAAuB,QAAQ,yBAAyB;EACxD,oBAAoB,QAAQ,sBAAsB;EAClD,wBAAwB,QAAQ,0BAA0B;EAC1D,qBAAqB,QAAQ,uBAAuB;EACpD,iBAAiB,sBAAsB,mBAAmB,QAAQ,eAAe;EACjF,aAAa,sBAAsB,eAAe,QAAQ,WAAW;EACrE,gBAAgB,sBAAsB,kBAAkB,QAAQ,cAAc;EAC9E,iBAAiB,QAAQ;EACzB,kBAAkB,QAAQ;EAC1B,eAAe,QAAQ;EACvB,cAAc,sBAAsB,gBAAgB,QAAQ,YAAY;EAExE,YACE,OAAO,QAAQ,eAAe,YAAY,QAAQ,cAAc,KAAK,QAAQ,cAAc,IACvF,QAAQ,aACR;EACN,iBAAiB,QAAQ;EACzB,kBAAkB,QAAQ;EAC1B,cAAc,eAAe,wBAAwB,KAAK;CAC5D;CACA,IAAI,OAAO,UACT,OAAO,EAAE,OAAO;CAElB,IAAI,CAAC,OAAO,YAAY;EACtB,OAAO,WAAW;EAClB,OAAO;GACL;GACA,OACE;EACJ;CACF;CACA,IAAI,CAAC,kBAAkB,OAAO,UAAU,GAAG;EACzC,OAAO,WAAW;EAElB,OAAO;GACL;GACA,OAAO,+CAA+C,OAAO,WAAW,MAAM,GAAG,CAAC,EAAE;EACtF;CACF;CACA,IAAI,CAAC,UAAU,OAAO,YAAY,GAAG;EACnC,OAAO,WAAW;EAClB,OAAO;GACL;GACA,OAAO,4DAA4D,OAAO;EAC5E;CACF;CACA,OAAO,EAAE,OAAO;AAClB;AAEA,SAAS,UAAU,OAAwB;CACzC,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,KAAK;CACrB,QAAQ;EACN,OAAO;CACT;CACA,OAAO,IAAI,aAAa,WAAW,IAAI,aAAa;AACtD;AAGA,SAAS,sBAAsB,YAAoB,WAAqB,CAAC,GAAa;CACpF,OAAO,SAAS,QAAQ,YAAY;EAClC,IAAI,mBAAmB,QACrB,OAAO;EAET,eAAA,SAAS,cAAc,WAAW,uCAAuC,OAAO,OAAO,GAAG;EAC1F,OAAO;CACT,CAAC;AACH;AAEA,SAAS,aAAa,GAAmB,GAA4B;CACnE,OAAQ,OAAO,KAAK,CAAC,CAAC,CAA8B,OAAO,QAAQ;EACjE,MAAM,OAAO,EAAE;EACf,MAAM,QAAQ,EAAE;EAChB,IAAI,MAAM,QAAQ,IAAI,KAAK,MAAM,QAAQ,KAAK,GAC5C,OACE,KAAK,WAAW,MAAM,UACtB,KAAK,OAAO,MAAM,UAAU;GAC1B,MAAM,QAAQ,MAAM;GACpB,OACE,gBAAgB,UAChB,iBAAiB,UACjB,KAAK,WAAW,MAAM,UACtB,KAAK,UAAU,MAAM;EAEzB,CAAC;EAIL,IAAI,OAAO,SAAS,cAAc,OAAO,UAAU,YACjD,OAAO;EAET,OAAO,SAAS;CAClB,CAAC;AACH;AAEA,SAAS,iBAAiB,OAAoC;CAC5D,OAAO,UAAU,KAAA,KAAa,YAAY,IAAI,MAAM,KAAK,CAAC,CAAC,YAAY,CAAC;AAC1E;AAEA,SAAS,eAAe,MAAkC;CACxD,OAAO,QAAQ,IAAI,KAAK,EAAE,KAAK,KAAK,KAAA;AACtC"}

package/dist/config.js

@@ -25,6 +25,8 @@ const DEFAULT_MASK_BODY_FIELDS = [
 	"auth",
 	"card[-_ ]?number",
 	"ccv",
+	"cvv",
+	"cvc",
 	"ssn"
 ];
 const DEFAULT_EXCLUDE_PATHS = [
@@ -76,10 +78,11 @@ function isValidWriteToken(value) {
 	return WRITE_TOKEN_FORMAT.test(value);
 }
 function matchesAny(patterns, value) {
-	return patterns.some((pattern) => {
+	for (const pattern of patterns) {
 		pattern.lastIndex = 0;
-		return pattern.test(value);
-	});
+		if (pattern.test(value)) return true;
+	}
+	return false;
 }
 function compilePatterns(defaults, userPatterns = []) {
 	return [...defaults.map((pattern) => new RegExp(pattern, "i")), ...userPatterns.map((pattern) => new RegExp(pattern))];

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","names":[],"sources":["../src/config.ts"],"sourcesContent":["import type { ReadWriteLogRecord } from \"@opentelemetry/sdk-logs\";\nimport type { ReadableSpan } from \"@opentelemetry/sdk-trace-base\";\nimport { logError, logWarning } from \"./logger.js\";\n\nexport type BodyMaskingCallback = (body: Buffer, span: ReadableSpan) => Buffer | null;\nexport type LogRecordMaskingCallback = (\n  logRecord: ReadWriteLogRecord,\n) => ReadWriteLogRecord | null | undefined;\nexport type SamplingCallback = (span: ReadableSpan) => number | boolean | undefined;\n\nexport interface ApitallyOptions {\n  writeToken?: string;\n  env?: string;\n  appVersion?: string;\n  disabled?: boolean;\n  captureLogs?: boolean;\n  captureRequestHeaders?: boolean;\n  captureRequestBody?: boolean;\n  captureResponseHeaders?: boolean;\n  captureResponseBody?: boolean;\n  maskQueryParams?: RegExp[];\n  maskHeaders?: RegExp[];\n  maskBodyFields?: RegExp[];\n  maskRequestBody?: BodyMaskingCallback;\n  maskResponseBody?: BodyMaskingCallback;\n  maskLogRecord?: LogRecordMaskingCallback;\n  excludePaths?: RegExp[];\n  sampleRate?: number;\n  sampleOnRequest?: SamplingCallback;\n  sampleOnResponse?: SamplingCallback;\n}\n\ntype OptionalConfigKeys =\n  | \"appVersion\"\n  | \"maskRequestBody\"\n  | \"maskResponseBody\"\n  | \"maskLogRecord\"\n  | \"sampleOnRequest\"\n  | \"sampleOnResponse\";\n\nexport type ApitallyConfig = Required<Omit<ApitallyOptions, OptionalConfigKeys>> &\n  Pick<ApitallyOptions, OptionalConfigKeys> & { otlpEndpoint: string };\n\nconst DEFAULT_OTLP_ENDPOINT = \"https://otlp.apitally.io\";\nexport const DEFAULT_ENV = \"dev\";\n\n// User-supplied patterns extend these defaults, never replace them.\nexport const DEFAULT_MASK_QUERY_PARAMS = [\n  \"auth\",\n  \"api[-_]?key\",\n  \"secret\",\n  \"token\",\n  \"password\",\n  \"pwd\",\n];\nexport const DEFAULT_MASK_HEADERS = [\"auth\", \"api[-_]?key\", \"secret\", \"token\", \"cookie\"];\nexport const DEFAULT_MASK_BODY_FIELDS = [\n  \"password\",\n  \"pwd\",\n  \"token\",\n  \"secret\",\n  \"auth\",\n  \"card[-_ ]?number\",\n  \"ccv\",\n  \"ssn\",\n];\nexport const DEFAULT_EXCLUDE_PATHS = [\n  \"/_?healthz?/?$\",\n  \"/_?health[-_]?checks?/?$\",\n  \"/_?heart[-_]?beats?/?$\",\n  \"/ping/?$\",\n  \"/ready/?$\",\n  \"/live/?$\",\n  \"/favicon(?:-[\\\\w-]+)?\\\\.(ico|png|svg)$\",\n  \"/apple-touch-icon(?:-[\\\\w-]+)?\\\\.png$\",\n  \"/robots\\\\.txt$\",\n  \"/sitemap\\\\.xml$\",\n  \"/manifest\\\\.json$\",\n  \"/site\\\\.webmanifest$\",\n  \"/service-worker\\\\.js$\",\n  \"/sw\\\\.js$\",\n  \"/\\\\.well-known/\",\n];\nexport const EXCLUDE_USER_AGENTS = [\n  \"health[-_ ]?check\",\n  \"microsoft-azure-application-lb\",\n  \"googlehc\",\n  \"kube-probe\",\n];\n\nconst WRITE_TOKEN_FORMAT = /^apt_[a-zA-Z0-9]{24}$/;\nconst TRUE_VALUES = new Set([\"1\", \"true\", \"yes\"]);\n\n// The ESM and CJS builds can load together, so a Symbol.for key gives both\n// copies the same configuration.\nconst GLOBAL_CONFIG_KEY = Symbol.for(\"apitally.config\");\nconst configHolder = globalThis as Record<symbol, ApitallyConfig | undefined>;\n\nexport function setConfig(options: ApitallyOptions = {}): ApitallyConfig {\n  const { config, error } = resolveConfig(options);\n  const currentConfig = configHolder[GLOBAL_CONFIG_KEY];\n  if (currentConfig) {\n    if (!isSameConfig(config, currentConfig)) {\n      logWarning(\n        \"useApitally() was called again with different options; the first call's configuration stays in effect\",\n      );\n    }\n    return currentConfig;\n  }\n  if (error) {\n    logError(error);\n  }\n  configHolder[GLOBAL_CONFIG_KEY] = config;\n  return config;\n}\n\nexport function getConfig(): ApitallyConfig {\n  return configHolder[GLOBAL_CONFIG_KEY] ?? resolveConfig({}).config;\n}\n\nexport function isValidWriteToken(value: string): boolean {\n  return WRITE_TOKEN_FORMAT.test(value);\n}\n\nexport function matchesAny(patterns: RegExp[], value: string): boolean {\n  return patterns.some((pattern) => {\n    pattern.lastIndex = 0;\n    return pattern.test(value);\n  });\n}\n\nexport function compilePatterns(defaults: string[], userPatterns: RegExp[] = []): RegExp[] {\n  return [\n    ...defaults.map((pattern) => new RegExp(pattern, \"i\")),\n    ...userPatterns.map((pattern) => new RegExp(pattern)),\n  ];\n}\n\nfunction resolveConfig(options: ApitallyOptions): {\n  config: ApitallyConfig;\n  error?: string;\n} {\n  const config: ApitallyConfig = {\n    writeToken: options.writeToken ?? nonEmptyEnvVar(\"APITALLY_WRITE_TOKEN\") ?? \"\",\n    env: options.env ?? nonEmptyEnvVar(\"APITALLY_ENV\") ?? DEFAULT_ENV,\n    appVersion: options.appVersion,\n    disabled:\n      options.disabled === true ||\n      isTruthyEnvValue(process.env.APITALLY_DISABLED) ||\n      isTruthyEnvValue(process.env.OTEL_SDK_DISABLED),\n    captureLogs: options.captureLogs ?? true,\n    captureRequestHeaders: options.captureRequestHeaders ?? false,\n    captureRequestBody: options.captureRequestBody ?? false,\n    captureResponseHeaders: options.captureResponseHeaders ?? true,\n    captureResponseBody: options.captureResponseBody ?? false,\n    maskQueryParams: dropNonRegExpPatterns(\"maskQueryParams\", options.maskQueryParams),\n    maskHeaders: dropNonRegExpPatterns(\"maskHeaders\", options.maskHeaders),\n    maskBodyFields: dropNonRegExpPatterns(\"maskBodyFields\", options.maskBodyFields),\n    maskRequestBody: options.maskRequestBody,\n    maskResponseBody: options.maskResponseBody,\n    maskLogRecord: options.maskLogRecord,\n    excludePaths: dropNonRegExpPatterns(\"excludePaths\", options.excludePaths),\n    // An invalid sampleRate resolves to capturing everything: no data is lost, so no warning.\n    sampleRate:\n      typeof options.sampleRate === \"number\" && options.sampleRate >= 0 && options.sampleRate <= 1\n        ? options.sampleRate\n        : 1,\n    sampleOnRequest: options.sampleOnRequest,\n    sampleOnResponse: options.sampleOnResponse,\n    otlpEndpoint: nonEmptyEnvVar(\"APITALLY_OTLP_ENDPOINT\") ?? DEFAULT_OTLP_ENDPOINT,\n  };\n  if (config.disabled) {\n    return { config };\n  }\n  if (!config.writeToken) {\n    config.disabled = true;\n    return {\n      config,\n      error:\n        \"Apitally write token is missing (set the writeToken option or the APITALLY_WRITE_TOKEN environment variable)\",\n    };\n  }\n  if (!isValidWriteToken(config.writeToken)) {\n    config.disabled = true;\n    // The write token is a credential and must never appear unmasked in logs.\n    return {\n      config,\n      error: `Apitally write token has an invalid format: ${config.writeToken.slice(0, 8)}...`,\n    };\n  }\n  if (!isHttpUrl(config.otlpEndpoint)) {\n    config.disabled = true;\n    return {\n      config,\n      error: `Apitally OTLP endpoint is not a valid HTTP or HTTPS URL: ${config.otlpEndpoint}`,\n    };\n  }\n  return { config };\n}\n\nfunction isHttpUrl(value: string): boolean {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    return false;\n  }\n  return url.protocol === \"http:\" || url.protocol === \"https:\";\n}\n\n// Invalid pattern values could leave data unredacted, so they are logged and omitted.\nfunction dropNonRegExpPatterns(optionName: string, patterns: RegExp[] = []): RegExp[] {\n  return patterns.filter((pattern) => {\n    if (pattern instanceof RegExp) {\n      return true;\n    }\n    logError(`Pattern in ${optionName} ignored because it is not a RegExp: ${String(pattern)}`);\n    return false;\n  });\n}\n\nfunction isSameConfig(a: ApitallyConfig, b: ApitallyConfig): boolean {\n  return (Object.keys(a) as (keyof ApitallyConfig)[]).every((key) => {\n    const left = a[key];\n    const right = b[key];\n    if (Array.isArray(left) && Array.isArray(right)) {\n      return (\n        left.length === right.length &&\n        left.every((item, index) => {\n          const other = right[index];\n          return (\n            item instanceof RegExp &&\n            other instanceof RegExp &&\n            item.source === other.source &&\n            item.flags === other.flags\n          );\n        })\n      );\n    }\n    // Callback identity says nothing about sameness; app factories create them inline.\n    if (typeof left === \"function\" && typeof right === \"function\") {\n      return true;\n    }\n    return left === right;\n  });\n}\n\nfunction isTruthyEnvValue(value: string | undefined): boolean {\n  return value !== undefined && TRUE_VALUES.has(value.trim().toLowerCase());\n}\n\nfunction nonEmptyEnvVar(name: string): string | undefined {\n  return process.env[name]?.trim() || undefined;\n}\n"],"mappings":";;AA2CA,MAAM,wBAAwB;AAC9B,MAAa,cAAc;AAG3B,MAAa,4BAA4B;CACvC;CACA;CACA;CACA;CACA;CACA;AACF;AACA,MAAa,uBAAuB;CAAC;CAAQ;CAAe;CAAU;CAAS;AAAQ;AACvF,MAAa,2BAA2B;CACtC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AACA,MAAa,wBAAwB;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AACA,MAAa,sBAAsB;CACjC;CACA;CACA;CACA;AACF;AAEA,MAAM,qBAAqB;AAC3B,MAAM,8BAAc,IAAI,IAAI;CAAC;CAAK;CAAQ;AAAK,CAAC;AAIhD,MAAM,oBAAoB,OAAO,IAAI,iBAAiB;AACtD,MAAM,eAAe;AAErB,SAAgB,UAAU,UAA2B,CAAC,GAAmB;CACvE,MAAM,EAAE,QAAQ,UAAU,cAAc,OAAO;CAC/C,MAAM,gBAAgB,aAAa;CACnC,IAAI,eAAe;EACjB,IAAI,CAAC,aAAa,QAAQ,aAAa,GACrC,WACE,uGACF;EAEF,OAAO;CACT;CACA,IAAI,OACF,SAAS,KAAK;CAEhB,aAAa,qBAAqB;CAClC,OAAO;AACT;AAEA,SAAgB,YAA4B;CAC1C,OAAO,aAAa,sBAAsB,cAAc,CAAC,CAAC,CAAC,CAAC;AAC9D;AAEA,SAAgB,kBAAkB,OAAwB;CACxD,OAAO,mBAAmB,KAAK,KAAK;AACtC;AAEA,SAAgB,WAAW,UAAoB,OAAwB;CACrE,OAAO,SAAS,MAAM,YAAY;EAChC,QAAQ,YAAY;EACpB,OAAO,QAAQ,KAAK,KAAK;CAC3B,CAAC;AACH;AAEA,SAAgB,gBAAgB,UAAoB,eAAyB,CAAC,GAAa;CACzF,OAAO,CACL,GAAG,SAAS,KAAK,YAAY,IAAI,OAAO,SAAS,GAAG,CAAC,GACrD,GAAG,aAAa,KAAK,YAAY,IAAI,OAAO,OAAO,CAAC,CACtD;AACF;AAEA,SAAS,cAAc,SAGrB;CACA,MAAM,SAAyB;EAC7B,YAAY,QAAQ,cAAc,eAAe,sBAAsB,KAAK;EAC5E,KAAK,QAAQ,OAAO,eAAe,cAAc,KAAA;EACjD,YAAY,QAAQ;EACpB,UACE,QAAQ,aAAa,QACrB,iBAAiB,QAAQ,IAAI,iBAAiB,KAC9C,iBAAiB,QAAQ,IAAI,iBAAiB;EAChD,aAAa,QAAQ,eAAe;EACpC,uBAAuB,QAAQ,yBAAyB;EACxD,oBAAoB,QAAQ,sBAAsB;EAClD,wBAAwB,QAAQ,0BAA0B;EAC1D,qBAAqB,QAAQ,uBAAuB;EACpD,iBAAiB,sBAAsB,mBAAmB,QAAQ,eAAe;EACjF,aAAa,sBAAsB,eAAe,QAAQ,WAAW;EACrE,gBAAgB,sBAAsB,kBAAkB,QAAQ,cAAc;EAC9E,iBAAiB,QAAQ;EACzB,kBAAkB,QAAQ;EAC1B,eAAe,QAAQ;EACvB,cAAc,sBAAsB,gBAAgB,QAAQ,YAAY;EAExE,YACE,OAAO,QAAQ,eAAe,YAAY,QAAQ,cAAc,KAAK,QAAQ,cAAc,IACvF,QAAQ,aACR;EACN,iBAAiB,QAAQ;EACzB,kBAAkB,QAAQ;EAC1B,cAAc,eAAe,wBAAwB,KAAK;CAC5D;CACA,IAAI,OAAO,UACT,OAAO,EAAE,OAAO;CAElB,IAAI,CAAC,OAAO,YAAY;EACtB,OAAO,WAAW;EAClB,OAAO;GACL;GACA,OACE;EACJ;CACF;CACA,IAAI,CAAC,kBAAkB,OAAO,UAAU,GAAG;EACzC,OAAO,WAAW;EAElB,OAAO;GACL;GACA,OAAO,+CAA+C,OAAO,WAAW,MAAM,GAAG,CAAC,EAAE;EACtF;CACF;CACA,IAAI,CAAC,UAAU,OAAO,YAAY,GAAG;EACnC,OAAO,WAAW;EAClB,OAAO;GACL;GACA,OAAO,4DAA4D,OAAO;EAC5E;CACF;CACA,OAAO,EAAE,OAAO;AAClB;AAEA,SAAS,UAAU,OAAwB;CACzC,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,KAAK;CACrB,QAAQ;EACN,OAAO;CACT;CACA,OAAO,IAAI,aAAa,WAAW,IAAI,aAAa;AACtD;AAGA,SAAS,sBAAsB,YAAoB,WAAqB,CAAC,GAAa;CACpF,OAAO,SAAS,QAAQ,YAAY;EAClC,IAAI,mBAAmB,QACrB,OAAO;EAET,SAAS,cAAc,WAAW,uCAAuC,OAAO,OAAO,GAAG;EAC1F,OAAO;CACT,CAAC;AACH;AAEA,SAAS,aAAa,GAAmB,GAA4B;CACnE,OAAQ,OAAO,KAAK,CAAC,CAAC,CAA8B,OAAO,QAAQ;EACjE,MAAM,OAAO,EAAE;EACf,MAAM,QAAQ,EAAE;EAChB,IAAI,MAAM,QAAQ,IAAI,KAAK,MAAM,QAAQ,KAAK,GAC5C,OACE,KAAK,WAAW,MAAM,UACtB,KAAK,OAAO,MAAM,UAAU;GAC1B,MAAM,QAAQ,MAAM;GACpB,OACE,gBAAgB,UAChB,iBAAiB,UACjB,KAAK,WAAW,MAAM,UACtB,KAAK,UAAU,MAAM;EAEzB,CAAC;EAIL,IAAI,OAAO,SAAS,cAAc,OAAO,UAAU,YACjD,OAAO;EAET,OAAO,SAAS;CAClB,CAAC;AACH;AAEA,SAAS,iBAAiB,OAAoC;CAC5D,OAAO,UAAU,KAAA,KAAa,YAAY,IAAI,MAAM,KAAK,CAAC,CAAC,YAAY,CAAC;AAC1E;AAEA,SAAS,eAAe,MAAkC;CACxD,OAAO,QAAQ,IAAI,KAAK,EAAE,KAAK,KAAK,KAAA;AACtC"}
+{"version":3,"file":"config.js","names":[],"sources":["../src/config.ts"],"sourcesContent":["import type { ReadWriteLogRecord } from \"@opentelemetry/sdk-logs\";\nimport type { ReadableSpan } from \"@opentelemetry/sdk-trace-base\";\nimport { logError, logWarning } from \"./logger.js\";\n\nexport type BodyMaskingCallback = (body: Buffer, span: ReadableSpan) => Buffer | null;\nexport type LogRecordMaskingCallback = (\n  logRecord: ReadWriteLogRecord,\n) => ReadWriteLogRecord | null | undefined;\nexport type SamplingCallback = (span: ReadableSpan) => number | boolean | undefined;\n\nexport interface ApitallyOptions {\n  writeToken?: string;\n  env?: string;\n  appVersion?: string;\n  disabled?: boolean;\n  captureLogs?: boolean;\n  captureRequestHeaders?: boolean;\n  captureRequestBody?: boolean;\n  captureResponseHeaders?: boolean;\n  captureResponseBody?: boolean;\n  maskQueryParams?: RegExp[];\n  maskHeaders?: RegExp[];\n  maskBodyFields?: RegExp[];\n  maskRequestBody?: BodyMaskingCallback;\n  maskResponseBody?: BodyMaskingCallback;\n  maskLogRecord?: LogRecordMaskingCallback;\n  excludePaths?: RegExp[];\n  sampleRate?: number;\n  sampleOnRequest?: SamplingCallback;\n  sampleOnResponse?: SamplingCallback;\n}\n\ntype OptionalConfigKeys =\n  | \"appVersion\"\n  | \"maskRequestBody\"\n  | \"maskResponseBody\"\n  | \"maskLogRecord\"\n  | \"sampleOnRequest\"\n  | \"sampleOnResponse\";\n\nexport type ApitallyConfig = Required<Omit<ApitallyOptions, OptionalConfigKeys>> &\n  Pick<ApitallyOptions, OptionalConfigKeys> & { otlpEndpoint: string };\n\nconst DEFAULT_OTLP_ENDPOINT = \"https://otlp.apitally.io\";\nexport const DEFAULT_ENV = \"dev\";\n\n// User-supplied patterns extend these defaults, never replace them.\nexport const DEFAULT_MASK_QUERY_PARAMS = [\n  \"auth\",\n  \"api[-_]?key\",\n  \"secret\",\n  \"token\",\n  \"password\",\n  \"pwd\",\n];\nexport const DEFAULT_MASK_HEADERS = [\"auth\", \"api[-_]?key\", \"secret\", \"token\", \"cookie\"];\nexport const DEFAULT_MASK_BODY_FIELDS = [\n  \"password\",\n  \"pwd\",\n  \"token\",\n  \"secret\",\n  \"auth\",\n  \"card[-_ ]?number\",\n  \"ccv\",\n  \"cvv\",\n  \"cvc\",\n  \"ssn\",\n];\nexport const DEFAULT_EXCLUDE_PATHS = [\n  \"/_?healthz?/?$\",\n  \"/_?health[-_]?checks?/?$\",\n  \"/_?heart[-_]?beats?/?$\",\n  \"/ping/?$\",\n  \"/ready/?$\",\n  \"/live/?$\",\n  \"/favicon(?:-[\\\\w-]+)?\\\\.(ico|png|svg)$\",\n  \"/apple-touch-icon(?:-[\\\\w-]+)?\\\\.png$\",\n  \"/robots\\\\.txt$\",\n  \"/sitemap\\\\.xml$\",\n  \"/manifest\\\\.json$\",\n  \"/site\\\\.webmanifest$\",\n  \"/service-worker\\\\.js$\",\n  \"/sw\\\\.js$\",\n  \"/\\\\.well-known/\",\n];\nexport const EXCLUDE_USER_AGENTS = [\n  \"health[-_ ]?check\",\n  \"microsoft-azure-application-lb\",\n  \"googlehc\",\n  \"kube-probe\",\n];\n\nconst WRITE_TOKEN_FORMAT = /^apt_[a-zA-Z0-9]{24}$/;\nconst TRUE_VALUES = new Set([\"1\", \"true\", \"yes\"]);\n\n// The ESM and CJS builds can load together, so a Symbol.for key gives both\n// copies the same configuration.\nconst GLOBAL_CONFIG_KEY = Symbol.for(\"apitally.config\");\nconst configHolder = globalThis as Record<symbol, ApitallyConfig | undefined>;\n\nexport function setConfig(options: ApitallyOptions = {}): ApitallyConfig {\n  const { config, error } = resolveConfig(options);\n  const currentConfig = configHolder[GLOBAL_CONFIG_KEY];\n  if (currentConfig) {\n    if (!isSameConfig(config, currentConfig)) {\n      logWarning(\n        \"useApitally() was called again with different options; the first call's configuration stays in effect\",\n      );\n    }\n    return currentConfig;\n  }\n  if (error) {\n    logError(error);\n  }\n  configHolder[GLOBAL_CONFIG_KEY] = config;\n  return config;\n}\n\nexport function getConfig(): ApitallyConfig {\n  return configHolder[GLOBAL_CONFIG_KEY] ?? resolveConfig({}).config;\n}\n\nexport function isValidWriteToken(value: string): boolean {\n  return WRITE_TOKEN_FORMAT.test(value);\n}\n\nexport function matchesAny(patterns: RegExp[], value: string): boolean {\n  for (const pattern of patterns) {\n    pattern.lastIndex = 0;\n    if (pattern.test(value)) {\n      return true;\n    }\n  }\n  return false;\n}\n\nexport function compilePatterns(defaults: string[], userPatterns: RegExp[] = []): RegExp[] {\n  return [\n    ...defaults.map((pattern) => new RegExp(pattern, \"i\")),\n    ...userPatterns.map((pattern) => new RegExp(pattern)),\n  ];\n}\n\nfunction resolveConfig(options: ApitallyOptions): {\n  config: ApitallyConfig;\n  error?: string;\n} {\n  const config: ApitallyConfig = {\n    writeToken: options.writeToken ?? nonEmptyEnvVar(\"APITALLY_WRITE_TOKEN\") ?? \"\",\n    env: options.env ?? nonEmptyEnvVar(\"APITALLY_ENV\") ?? DEFAULT_ENV,\n    appVersion: options.appVersion,\n    disabled:\n      options.disabled === true ||\n      isTruthyEnvValue(process.env.APITALLY_DISABLED) ||\n      isTruthyEnvValue(process.env.OTEL_SDK_DISABLED),\n    captureLogs: options.captureLogs ?? true,\n    captureRequestHeaders: options.captureRequestHeaders ?? false,\n    captureRequestBody: options.captureRequestBody ?? false,\n    captureResponseHeaders: options.captureResponseHeaders ?? true,\n    captureResponseBody: options.captureResponseBody ?? false,\n    maskQueryParams: dropNonRegExpPatterns(\"maskQueryParams\", options.maskQueryParams),\n    maskHeaders: dropNonRegExpPatterns(\"maskHeaders\", options.maskHeaders),\n    maskBodyFields: dropNonRegExpPatterns(\"maskBodyFields\", options.maskBodyFields),\n    maskRequestBody: options.maskRequestBody,\n    maskResponseBody: options.maskResponseBody,\n    maskLogRecord: options.maskLogRecord,\n    excludePaths: dropNonRegExpPatterns(\"excludePaths\", options.excludePaths),\n    // An invalid sampleRate resolves to capturing everything: no data is lost, so no warning.\n    sampleRate:\n      typeof options.sampleRate === \"number\" && options.sampleRate >= 0 && options.sampleRate <= 1\n        ? options.sampleRate\n        : 1,\n    sampleOnRequest: options.sampleOnRequest,\n    sampleOnResponse: options.sampleOnResponse,\n    otlpEndpoint: nonEmptyEnvVar(\"APITALLY_OTLP_ENDPOINT\") ?? DEFAULT_OTLP_ENDPOINT,\n  };\n  if (config.disabled) {\n    return { config };\n  }\n  if (!config.writeToken) {\n    config.disabled = true;\n    return {\n      config,\n      error:\n        \"Apitally write token is missing (set the writeToken option or the APITALLY_WRITE_TOKEN environment variable)\",\n    };\n  }\n  if (!isValidWriteToken(config.writeToken)) {\n    config.disabled = true;\n    // The write token is a credential and must never appear unmasked in logs.\n    return {\n      config,\n      error: `Apitally write token has an invalid format: ${config.writeToken.slice(0, 8)}...`,\n    };\n  }\n  if (!isHttpUrl(config.otlpEndpoint)) {\n    config.disabled = true;\n    return {\n      config,\n      error: `Apitally OTLP endpoint is not a valid HTTP or HTTPS URL: ${config.otlpEndpoint}`,\n    };\n  }\n  return { config };\n}\n\nfunction isHttpUrl(value: string): boolean {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    return false;\n  }\n  return url.protocol === \"http:\" || url.protocol === \"https:\";\n}\n\n// Invalid pattern values could leave data unredacted, so they are logged and omitted.\nfunction dropNonRegExpPatterns(optionName: string, patterns: RegExp[] = []): RegExp[] {\n  return patterns.filter((pattern) => {\n    if (pattern instanceof RegExp) {\n      return true;\n    }\n    logError(`Pattern in ${optionName} ignored because it is not a RegExp: ${String(pattern)}`);\n    return false;\n  });\n}\n\nfunction isSameConfig(a: ApitallyConfig, b: ApitallyConfig): boolean {\n  return (Object.keys(a) as (keyof ApitallyConfig)[]).every((key) => {\n    const left = a[key];\n    const right = b[key];\n    if (Array.isArray(left) && Array.isArray(right)) {\n      return (\n        left.length === right.length &&\n        left.every((item, index) => {\n          const other = right[index];\n          return (\n            item instanceof RegExp &&\n            other instanceof RegExp &&\n            item.source === other.source &&\n            item.flags === other.flags\n          );\n        })\n      );\n    }\n    // Callback identity says nothing about sameness; app factories create them inline.\n    if (typeof left === \"function\" && typeof right === \"function\") {\n      return true;\n    }\n    return left === right;\n  });\n}\n\nfunction isTruthyEnvValue(value: string | undefined): boolean {\n  return value !== undefined && TRUE_VALUES.has(value.trim().toLowerCase());\n}\n\nfunction nonEmptyEnvVar(name: string): string | undefined {\n  return process.env[name]?.trim() || undefined;\n}\n"],"mappings":";;AA2CA,MAAM,wBAAwB;AAC9B,MAAa,cAAc;AAG3B,MAAa,4BAA4B;CACvC;CACA;CACA;CACA;CACA;CACA;AACF;AACA,MAAa,uBAAuB;CAAC;CAAQ;CAAe;CAAU;CAAS;AAAQ;AACvF,MAAa,2BAA2B;CACtC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AACA,MAAa,wBAAwB;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AACA,MAAa,sBAAsB;CACjC;CACA;CACA;CACA;AACF;AAEA,MAAM,qBAAqB;AAC3B,MAAM,8BAAc,IAAI,IAAI;CAAC;CAAK;CAAQ;AAAK,CAAC;AAIhD,MAAM,oBAAoB,OAAO,IAAI,iBAAiB;AACtD,MAAM,eAAe;AAErB,SAAgB,UAAU,UAA2B,CAAC,GAAmB;CACvE,MAAM,EAAE,QAAQ,UAAU,cAAc,OAAO;CAC/C,MAAM,gBAAgB,aAAa;CACnC,IAAI,eAAe;EACjB,IAAI,CAAC,aAAa,QAAQ,aAAa,GACrC,WACE,uGACF;EAEF,OAAO;CACT;CACA,IAAI,OACF,SAAS,KAAK;CAEhB,aAAa,qBAAqB;CAClC,OAAO;AACT;AAEA,SAAgB,YAA4B;CAC1C,OAAO,aAAa,sBAAsB,cAAc,CAAC,CAAC,CAAC,CAAC;AAC9D;AAEA,SAAgB,kBAAkB,OAAwB;CACxD,OAAO,mBAAmB,KAAK,KAAK;AACtC;AAEA,SAAgB,WAAW,UAAoB,OAAwB;CACrE,KAAK,MAAM,WAAW,UAAU;EAC9B,QAAQ,YAAY;EACpB,IAAI,QAAQ,KAAK,KAAK,GACpB,OAAO;CAEX;CACA,OAAO;AACT;AAEA,SAAgB,gBAAgB,UAAoB,eAAyB,CAAC,GAAa;CACzF,OAAO,CACL,GAAG,SAAS,KAAK,YAAY,IAAI,OAAO,SAAS,GAAG,CAAC,GACrD,GAAG,aAAa,KAAK,YAAY,IAAI,OAAO,OAAO,CAAC,CACtD;AACF;AAEA,SAAS,cAAc,SAGrB;CACA,MAAM,SAAyB;EAC7B,YAAY,QAAQ,cAAc,eAAe,sBAAsB,KAAK;EAC5E,KAAK,QAAQ,OAAO,eAAe,cAAc,KAAA;EACjD,YAAY,QAAQ;EACpB,UACE,QAAQ,aAAa,QACrB,iBAAiB,QAAQ,IAAI,iBAAiB,KAC9C,iBAAiB,QAAQ,IAAI,iBAAiB;EAChD,aAAa,QAAQ,eAAe;EACpC,uBAAuB,QAAQ,yBAAyB;EACxD,oBAAoB,QAAQ,sBAAsB;EAClD,wBAAwB,QAAQ,0BAA0B;EAC1D,qBAAqB,QAAQ,uBAAuB;EACpD,iBAAiB,sBAAsB,mBAAmB,QAAQ,eAAe;EACjF,aAAa,sBAAsB,eAAe,QAAQ,WAAW;EACrE,gBAAgB,sBAAsB,kBAAkB,QAAQ,cAAc;EAC9E,iBAAiB,QAAQ;EACzB,kBAAkB,QAAQ;EAC1B,eAAe,QAAQ;EACvB,cAAc,sBAAsB,gBAAgB,QAAQ,YAAY;EAExE,YACE,OAAO,QAAQ,eAAe,YAAY,QAAQ,cAAc,KAAK,QAAQ,cAAc,IACvF,QAAQ,aACR;EACN,iBAAiB,QAAQ;EACzB,kBAAkB,QAAQ;EAC1B,cAAc,eAAe,wBAAwB,KAAK;CAC5D;CACA,IAAI,OAAO,UACT,OAAO,EAAE,OAAO;CAElB,IAAI,CAAC,OAAO,YAAY;EACtB,OAAO,WAAW;EAClB,OAAO;GACL;GACA,OACE;EACJ;CACF;CACA,IAAI,CAAC,kBAAkB,OAAO,UAAU,GAAG;EACzC,OAAO,WAAW;EAElB,OAAO;GACL;GACA,OAAO,+CAA+C,OAAO,WAAW,MAAM,GAAG,CAAC,EAAE;EACtF;CACF;CACA,IAAI,CAAC,UAAU,OAAO,YAAY,GAAG;EACnC,OAAO,WAAW;EAClB,OAAO;GACL;GACA,OAAO,4DAA4D,OAAO;EAC5E;CACF;CACA,OAAO,EAAE,OAAO;AAClB;AAEA,SAAS,UAAU,OAAwB;CACzC,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,KAAK;CACrB,QAAQ;EACN,OAAO;CACT;CACA,OAAO,IAAI,aAAa,WAAW,IAAI,aAAa;AACtD;AAGA,SAAS,sBAAsB,YAAoB,WAAqB,CAAC,GAAa;CACpF,OAAO,SAAS,QAAQ,YAAY;EAClC,IAAI,mBAAmB,QACrB,OAAO;EAET,SAAS,cAAc,WAAW,uCAAuC,OAAO,OAAO,GAAG;EAC1F,OAAO;CACT,CAAC;AACH;AAEA,SAAS,aAAa,GAAmB,GAA4B;CACnE,OAAQ,OAAO,KAAK,CAAC,CAAC,CAA8B,OAAO,QAAQ;EACjE,MAAM,OAAO,EAAE;EACf,MAAM,QAAQ,EAAE;EAChB,IAAI,MAAM,QAAQ,IAAI,KAAK,MAAM,QAAQ,KAAK,GAC5C,OACE,KAAK,WAAW,MAAM,UACtB,KAAK,OAAO,MAAM,UAAU;GAC1B,MAAM,QAAQ,MAAM;GACpB,OACE,gBAAgB,UAChB,iBAAiB,UACjB,KAAK,WAAW,MAAM,UACtB,KAAK,UAAU,MAAM;EAEzB,CAAC;EAIL,IAAI,OAAO,SAAS,cAAc,OAAO,UAAU,YACjD,OAAO;EAET,OAAO,SAAS;CAClB,CAAC;AACH;AAEA,SAAS,iBAAiB,OAAoC;CAC5D,OAAO,UAAU,KAAA,KAAa,YAAY,IAAI,MAAM,KAAK,CAAC,CAAC,YAAY,CAAC;AAC1E;AAEA,SAAS,eAAe,MAAkC;CACxD,OAAO,QAAQ,IAAI,KAAK,EAAE,KAAK,KAAK,KAAA;AACtC"}

package/dist/index.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_spanProcessor = require("./spanProcessor.cjs");
 const require_requestAttributes = require("./requestAttributes.cjs");
 const require_exceptions = require("./exceptions.cjs");
-const require_spanProcessor = require("./spanProcessor.cjs");
 const require_activation = require("./activation.cjs");
 const require_consumers = require("./consumers.cjs");
 const require_adonisjs_configure = require("./adonisjs/configure.cjs");

package/dist/index.js

@@ -1,6 +1,6 @@
+import { ApitallySpanProcessor } from "./spanProcessor.js";
 import { setRequestAttribute } from "./requestAttributes.js";
 import { captureException } from "./exceptions.js";
-import { ApitallySpanProcessor } from "./spanProcessor.js";
 import { shutdown } from "./activation.js";
 import { setConsumer } from "./consumers.js";
 import { configure as configure$1 } from "./adonisjs/configure.js";

package/dist/metrics.cjs

@@ -43,7 +43,6 @@ var MetricsPipeline = class {
 		if (record.dropReason === "method" || record.dropReason === "scheme") return;
 		const source = record.attributes;
 		const method = source["http.request.method"] ?? source["http.method"];
-		const scheme = source["url.scheme"] ?? source["http.scheme"];
 		const route = source["http.route"];
 		if (typeof route !== "string" || route === "") return;
 		const attributes = { "http.route": route };
@@ -52,8 +51,6 @@ var MetricsPipeline = class {
 		if (statusCode !== void 0) attributes["http.response.status_code"] = statusCode;
 		const consumer = source["apitally.consumer.identifier"];
 		if (consumer !== void 0) attributes["apitally.consumer.identifier"] = consumer;
-		if (scheme !== void 0) attributes["url.scheme"] = scheme;
-		if (typeof statusCode === "number" && statusCode >= 500) attributes["error.type"] = String(statusCode);
 		const key = JSON.stringify(attributes);
 		let histograms = this.combinations.get(key);
 		if (histograms === void 0) {