repro-nest 0.0.214 → 0.0.216

package/dist/index.d.ts

@@ -42,23 +42,35 @@ type TracerApi = {
     setFunctionLogsEnabled?: (enabled: boolean) => void;
 };
 type TraceEventPhase = 'enter' | 'exit';
-export type TraceRulePattern = string | RegExp | Array<string | RegExp>;
+export type TraceRulePattern = string | number | RegExp | Array<string | number | RegExp>;
 export type TraceEventForFilter = {
     type: TraceEventPhase;
     eventType: TraceEventPhase;
     functionType?: string | null;
     fn?: string;
+    wrapperClass?: string | null;
     file?: string | null;
+    line?: number | null;
     depth?: number;
     library?: string | null;
 };
 export type HeaderRule = string | RegExp;
 export type HeaderCaptureOptions = {
-    /** When true, sensitive headers such as Authorization are kept; default redacts them. */
+    /** When true, sensitive headers such as Authorization are kept unmasked; default masks them. */
     allowSensitiveHeaders?: boolean;
-    /** Additional header names (string or RegExp) to drop from captures. */
+    /**
+     * Header names (string or RegExp) to mask.
+     * `dropHeaders` is kept for backward-compatibility and treated as an alias for `maskHeaders`.
+     */
+    maskHeaders?: HeaderRule | HeaderRule[];
+    /** @deprecated Alias for {@link maskHeaders}. */
     dropHeaders?: HeaderRule | HeaderRule[];
-    /** Explicit allowlist that overrides defaults and drop rules. */
+    /**
+     * Header names (string or RegExp) to keep unmasked, overriding defaults and `maskHeaders`.
+     * `keepHeaders` is kept for backward-compatibility and treated as an alias for `unmaskHeaders`.
+     */
+    unmaskHeaders?: HeaderRule | HeaderRule[];
+    /** @deprecated Alias for {@link unmaskHeaders}. */
     keepHeaders?: HeaderRule | HeaderRule[];
 };
 /** Lightweight helper to disable every trace emitted from specific files. */
@@ -78,8 +90,21 @@ export type DisableFunctionTraceRule = {
     fn?: TraceRulePattern;
     /** Function name (e.g. `"findOne"`, `/^UserService\./`). */
     functionName?: TraceRulePattern;
-    /** Absolute file path where the function was defined. */
+    /** Shortcut for {@link wrapperClass}. */
+    wrapper?: TraceRulePattern;
+    /**
+     * Wrapper/owner name derived from {@link functionName} (e.g. `"UserService"` in `"UserService.create"`).
+     * Useful when multiple functions share the same method name.
+     */
+    wrapperClass?: TraceRulePattern;
+    /** Alias for {@link wrapperClass}. */
+    className?: TraceRulePattern;
+    /** Alias for {@link wrapperClass}. */
+    owner?: TraceRulePattern;
+    /** Source filename reported by the trace event. */
     file?: TraceRulePattern;
+    /** Line number reported by the trace event. */
+    line?: TraceRulePattern;
     /** Shortcut for {@link library}. */
     lib?: TraceRulePattern;
     /** Library/package name inferred from the file path (e.g. `"mongoose"`). */
@@ -95,6 +120,33 @@ export type DisableFunctionTraceRule = {
 };
 export type DisableFunctionTracePredicate = (event: TraceEventForFilter) => boolean;
 export type DisableFunctionTraceConfig = DisableFunctionTraceRule | DisableFunctionTracePredicate;
+export type ReproMaskTarget = 'request.headers' | 'request.body' | 'request.params' | 'request.query' | 'response.body' | 'trace.args' | 'trace.returnValue' | 'trace.error';
+export type ReproMaskWhen = DisableFunctionTraceRule & {
+    /** Match HTTP method (e.g. `"GET"`, `/^post$/i`). */
+    method?: TraceRulePattern;
+    /** Match request path without query string (e.g. `"/api/auth/login"`). */
+    path?: TraceRulePattern;
+    /** Match normalized endpoint key (e.g. `"POST /api/auth/login"`). */
+    key?: TraceRulePattern;
+};
+export type ReproMaskRule = {
+    when?: ReproMaskWhen;
+    target: ReproMaskTarget | ReproMaskTarget[];
+    /**
+     * Dot/bracket paths to mask (supports `*`, `[0]`, `[*]`).
+     * Examples: `"password"`, `"user.token"`, `"items[*].serial"`, `"0.password"` (for trace args arrays).
+     */
+    paths?: string | string[];
+    /** Key name patterns to mask anywhere in the payload. */
+    keys?: TraceRulePattern;
+    /** Override replacement value for this rule (defaults to config replacement / `"[REDACTED]"`). */
+    replacement?: any;
+};
+export type ReproMaskingConfig = {
+    /** Default replacement value (defaults to `"[REDACTED]"`). */
+    replacement?: any;
+    rules?: ReproMaskRule[] | null;
+};
 export declare function setDisabledFunctionTraces(rules?: DisableFunctionTraceConfig[] | null): void;
 export declare function setDisabledFunctionTypes(patterns?: TraceRulePattern | null): void;
 export declare function setDisabledTraceFiles(config?: DisableTraceFileConfig | DisableTraceFileConfig[] | null): void;
@@ -146,8 +198,10 @@ export type ReproMiddlewareConfig = {
     tenantId: string;
     appSecret: string;
     apiBase: string;
-    /** Configure header capture/redaction. Defaults to capturing with sensitive headers removed. */
+    /** Configure header capture/masking. Defaults to capturing with sensitive headers masked. */
     captureHeaders?: boolean | HeaderCaptureOptions;
+    /** Optional masking rules for request/response payloads and function traces. */
+    masking?: ReproMaskingConfig;
 };
 export declare function reproMiddleware(cfg: ReproMiddlewareConfig): (req: Request, res: Response, next: NextFunction) => void;
 export declare function reproMongoosePlugin(cfg: {

package/dist/index.js

@@ -298,12 +298,35 @@ function inferLibraryNameFromFile(file) {
     }
     return segments[0] || null;
 }
+function inferWrapperClassFromFn(fn) {
+    if (!fn)
+        return null;
+    const raw = String(fn);
+    if (!raw)
+        return null;
+    const hashIdx = raw.indexOf('#');
+    if (hashIdx > 0) {
+        const left = raw.slice(0, hashIdx).trim();
+        return left || null;
+    }
+    const dotIdx = raw.lastIndexOf('.');
+    if (dotIdx > 0) {
+        const left = raw.slice(0, dotIdx).trim();
+        return left || null;
+    }
+    return null;
+}
 function matchesRule(rule, event) {
     const namePattern = rule.fn ?? rule.functionName;
     if (!matchesPattern(event.fn, namePattern))
         return false;
+    const wrapperPattern = rule.wrapper ?? rule.wrapperClass ?? rule.className ?? rule.owner;
+    if (!matchesPattern(event.wrapperClass, wrapperPattern))
+        return false;
     if (!matchesPattern(event.file, rule.file))
         return false;
+    if (!matchesPattern(event.line == null ? null : String(event.line), rule.line))
+        return false;
     const libPattern = rule.lib ?? rule.library;
     if (!matchesPattern(event.library, libPattern))
         return false;
@@ -364,7 +387,7 @@ function flattenTraceFilePatterns(config) {
     if (Array.isArray(config)) {
         return config.flatMap(entry => flattenTraceFilePatterns(entry));
     }
-    if (config instanceof RegExp || typeof config === 'string') {
+    if (config instanceof RegExp || typeof config === 'string' || typeof config === 'number') {
         return [config];
     }
     if (typeof config === 'object' && 'file' in config) {
@@ -1197,6 +1220,7 @@ const DEFAULT_SENSITIVE_HEADERS = [
     'cookie',
     'set-cookie',
 ];
+const DEFAULT_MASK_REPLACEMENT = '[REDACTED]';
 function normalizeHeaderRules(rules) {
     return normalizePatternArray(rules || []);
 }
@@ -1218,14 +1242,14 @@ function matchesHeaderRule(name, rules) {
 }
 function normalizeHeaderCaptureConfig(raw) {
     if (raw === false) {
-        return { enabled: false, allowSensitive: false, drop: [], keep: [] };
+        return { enabled: false, allowSensitive: false, mask: [], unmask: [] };
     }
     const opts = raw && raw !== true ? raw : {};
     return {
         enabled: true,
         allowSensitive: opts.allowSensitiveHeaders === true,
-        drop: normalizeHeaderRules(opts.dropHeaders),
-        keep: normalizeHeaderRules(opts.keepHeaders),
+        mask: [...normalizeHeaderRules(opts.maskHeaders), ...normalizeHeaderRules(opts.dropHeaders)],
+        unmask: [...normalizeHeaderRules(opts.unmaskHeaders), ...normalizeHeaderRules(opts.keepHeaders)],
     };
 }
 function sanitizeHeaderValue(value) {
@@ -1248,24 +1272,209 @@ function sanitizeHeaders(headers, rawCfg) {
     const cfg = normalizeHeaderCaptureConfig(rawCfg);
     if (!cfg.enabled)
         return {};
-    const dropList = cfg.allowSensitive ? cfg.drop : [...DEFAULT_SENSITIVE_HEADERS, ...cfg.drop];
     const out = {};
     for (const [rawKey, rawVal] of Object.entries(headers || {})) {
         const key = String(rawKey || '').toLowerCase();
         if (!key)
             continue;
-        const shouldDrop = matchesHeaderRule(key, dropList);
-        const keep = matchesHeaderRule(key, cfg.keep);
-        if (shouldDrop && !keep)
-            continue;
         const sanitizedValue = sanitizeHeaderValue(rawVal);
         if (sanitizedValue !== undefined) {
             out[key] = sanitizedValue;
         }
     }
+    const maskList = cfg.allowSensitive ? cfg.mask : [...DEFAULT_SENSITIVE_HEADERS, ...cfg.mask];
+    Object.keys(out).forEach((key) => {
+        if (!matchesHeaderRule(key, maskList))
+            return;
+        if (matchesHeaderRule(key, cfg.unmask))
+            return;
+        const current = out[key];
+        if (Array.isArray(current)) {
+            out[key] = current.map(() => DEFAULT_MASK_REPLACEMENT);
+            return;
+        }
+        out[key] = DEFAULT_MASK_REPLACEMENT;
+    });
     return out;
 }
+function normalizeMaskTargets(target) {
+    const out = Array.isArray(target) ? target : [target];
+    return out.filter((t) => typeof t === 'string' && t.length > 0);
+}
+function parseMaskPath(raw) {
+    if (!raw)
+        return [];
+    let path = String(raw).trim();
+    if (!path)
+        return [];
+    if (path.startsWith('$.'))
+        path = path.slice(2);
+    if (path.startsWith('.'))
+        path = path.slice(1);
+    path = path.replace(/\[(\d+|\*)\]/g, '.$1');
+    return path.split('.').map(s => s.trim()).filter(Boolean);
+}
+function normalizeMaskPaths(paths) {
+    if (!paths)
+        return [];
+    const list = Array.isArray(paths) ? paths : [paths];
+    return list
+        .map(p => parseMaskPath(p))
+        .filter(parts => parts.length > 0);
+}
+function normalizeMaskingConfig(raw) {
+    const rules = raw?.rules;
+    if (!Array.isArray(rules) || rules.length === 0)
+        return null;
+    const replacement = raw?.replacement ?? DEFAULT_MASK_REPLACEMENT;
+    const normalized = [];
+    for (const rule of rules) {
+        if (!rule)
+            continue;
+        const targets = normalizeMaskTargets(rule.target);
+        if (!targets.length)
+            continue;
+        const paths = normalizeMaskPaths(rule.paths);
+        const keys = rule.keys ?? undefined;
+        if (!paths.length && !keys)
+            continue;
+        normalized.push({
+            when: rule.when,
+            targets,
+            paths,
+            keys,
+            replacement: rule.replacement ?? replacement,
+        });
+    }
+    return normalized.length ? { replacement, rules: normalized } : null;
+}
+function maskWhenRequiresTrace(when) {
+    return Boolean(when.fn ||
+        when.functionName ||
+        when.wrapper ||
+        when.wrapperClass ||
+        when.className ||
+        when.owner ||
+        when.file ||
+        when.lib ||
+        when.library ||
+        when.type ||
+        when.functionType ||
+        when.event ||
+        when.eventType);
+}
+function matchesMaskWhen(when, req, trace) {
+    if (!when)
+        return true;
+    if (!matchesPattern(req.method, when.method))
+        return false;
+    if (!matchesPattern(req.path, when.path))
+        return false;
+    if (!matchesPattern(req.key, when.key))
+        return false;
+    if (maskWhenRequiresTrace(when)) {
+        if (!trace)
+            return false;
+        if (!matchesRule(when, trace))
+            return false;
+    }
+    return true;
+}
+function maskKeysInPlace(node, keys, replacement) {
+    if (!node)
+        return;
+    if (Array.isArray(node)) {
+        node.forEach(item => maskKeysInPlace(item, keys, replacement));
+        return;
+    }
+    if (typeof node !== 'object')
+        return;
+    Object.keys(node).forEach((key) => {
+        if (matchesPattern(key, keys, false)) {
+            try {
+                node[key] = replacement;
+            }
+            catch { }
+            return;
+        }
+        maskKeysInPlace(node[key], keys, replacement);
+    });
+}
+function maskPathInPlace(node, pathParts, replacement, depth = 0) {
+    if (!node)
+        return;
+    if (depth >= pathParts.length)
+        return;
+    const part = pathParts[depth];
+    const isLast = depth === pathParts.length - 1;
+    const applyAt = (container, key) => {
+        if (!container)
+            return;
+        try {
+            container[key] = replacement;
+        }
+        catch { }
+    };
+    if (part === '*') {
+        if (Array.isArray(node)) {
+            for (let i = 0; i < node.length; i++) {
+                if (isLast)
+                    applyAt(node, i);
+                else
+                    maskPathInPlace(node[i], pathParts, replacement, depth + 1);
+            }
+        }
+        else if (typeof node === 'object') {
+            for (const key of Object.keys(node)) {
+                if (isLast)
+                    applyAt(node, key);
+                else
+                    maskPathInPlace(node[key], pathParts, replacement, depth + 1);
+            }
+        }
+        return;
+    }
+    const index = Number(part);
+    const isIndex = Number.isInteger(index) && String(index) === part;
+    if (Array.isArray(node) && isIndex) {
+        if (index < 0 || index >= node.length)
+            return;
+        if (isLast)
+            applyAt(node, index);
+        else
+            maskPathInPlace(node[index], pathParts, replacement, depth + 1);
+        return;
+    }
+    if (typeof node !== 'object')
+        return;
+    if (!Object.prototype.hasOwnProperty.call(node, part))
+        return;
+    if (isLast)
+        applyAt(node, part);
+    else
+        maskPathInPlace(node[part], pathParts, replacement, depth + 1);
+}
+function applyMasking(target, value, req, trace, masking) {
+    if (!masking || !masking.rules.length)
+        return value;
+    if (value === undefined)
+        return value;
+    for (const rule of masking.rules) {
+        if (!rule.targets.includes(target))
+            continue;
+        if (!matchesMaskWhen(rule.when, req, trace))
+            continue;
+        const replacement = rule.replacement ?? masking.replacement ?? DEFAULT_MASK_REPLACEMENT;
+        if (rule.keys)
+            maskKeysInPlace(value, rule.keys, replacement);
+        if (rule.paths.length) {
+            rule.paths.forEach(parts => maskPathInPlace(value, parts, replacement, 0));
+        }
+    }
+    return value;
+}
 function reproMiddleware(cfg) {
+    const masking = normalizeMaskingConfig(cfg.masking);
     return function (req, res, next) {
         const sid = req.headers['x-bug-session-id'] || '';
         const aid = req.headers['x-bug-action-id'] || '';
@@ -1278,8 +1487,10 @@ function reproMiddleware(cfg) {
         const rid = nextRequestId(requestEpochMs);
         const t0 = requestStartRaw;
         const url = req.originalUrl || req.url || '/';
+        const urlPathOnly = (url || '/').split('?')[0] || '/';
         const path = url; // back-compat
         const key = normalizeRouteKey(req.method, url);
+        const maskReq = { method: String(req.method || 'GET').toUpperCase(), path: urlPathOnly, key };
         const requestHeaders = sanitizeHeaders(req.headers, cfg.captureHeaders);
         beginSessionRequest(sid);
         // ---- response body capture (unchanged) ----
@@ -1426,6 +1637,9 @@ function reproMiddleware(cfg) {
                         unsubscribe = __TRACER__.tracer.on((ev) => {
                             if (!ev || ev.traceId !== tidNow)
                                 return;
+                            const sourceFileForLibrary = typeof ev.sourceFile === 'string' && ev.sourceFile
+                                ? String(ev.sourceFile)
+                                : null;
                             const evt = {
                                 t: alignTimestamp(ev.t),
                                 type: ev.type,
@@ -1439,14 +1653,25 @@ function reproMiddleware(cfg) {
                             if (ev.functionType !== undefined) {
                                 evt.functionType = ev.functionType;
                             }
+                            const candidate = {
+                                type: evt.type,
+                                eventType: evt.type,
+                                functionType: evt.functionType ?? null,
+                                fn: evt.fn,
+                                wrapperClass: inferWrapperClassFromFn(evt.fn),
+                                file: evt.file ?? null,
+                                line: evt.line ?? null,
+                                depth: evt.depth,
+                                library: inferLibraryNameFromFile(sourceFileForLibrary ?? evt.file),
+                            };
                             if (ev.args !== undefined) {
-                                evt.args = sanitizeTraceArgs(ev.args);
+                                evt.args = applyMasking('trace.args', sanitizeTraceArgs(ev.args), maskReq, candidate, masking);
                             }
                             if (ev.returnValue !== undefined) {
-                                evt.returnValue = sanitizeTraceValue(ev.returnValue);
+                                evt.returnValue = applyMasking('trace.returnValue', sanitizeTraceValue(ev.returnValue), maskReq, candidate, masking);
                             }
                             if (ev.error !== undefined) {
-                                evt.error = sanitizeTraceValue(ev.error);
+                                evt.error = applyMasking('trace.error', sanitizeTraceValue(ev.error), maskReq, candidate, masking);
                             }
                             if (ev.threw !== undefined) {
                                 evt.threw = Boolean(ev.threw);
@@ -1454,15 +1679,6 @@ function reproMiddleware(cfg) {
                             if (ev.unawaited !== undefined) {
                                 evt.unawaited = ev.unawaited === true;
                             }
-                            const candidate = {
-                                type: evt.type,
-                                eventType: evt.type,
-                                functionType: evt.functionType ?? null,
-                                fn: evt.fn,
-                                file: evt.file ?? null,
-                                depth: evt.depth,
-                                library: inferLibraryNameFromFile(evt.file),
-                            };
                             const dropEvent = shouldDropTraceEvent(candidate);
                             const spanKey = normalizeSpanId(evt.spanId);
                             if (evt.type === 'enter') {
@@ -1546,9 +1762,25 @@ function reproMiddleware(cfg) {
                             ?? firstAppTrace
                             ?? { fn: null, file: null, line: null, functionType: null };
                         const traceBatches = chunkArray(orderedEvents, TRACE_BATCH_SIZE);
-                        const requestBody = sanitizeRequestSnapshot(req.body);
-                        const requestParams = sanitizeRequestSnapshot(req.params);
-                        const requestQuery = sanitizeRequestSnapshot(req.query);
+                        const endpointTraceCtx = (() => {
+                            if (!chosenEndpoint?.fn && !chosenEndpoint?.file)
+                                return null;
+                            return {
+                                type: 'enter',
+                                eventType: 'enter',
+                                fn: chosenEndpoint.fn ?? undefined,
+                                wrapperClass: inferWrapperClassFromFn(chosenEndpoint.fn),
+                                file: chosenEndpoint.file ?? null,
+                                line: chosenEndpoint.line ?? null,
+                                functionType: chosenEndpoint.functionType ?? null,
+                                library: inferLibraryNameFromFile(chosenEndpoint.file),
+                            };
+                        })();
+                        const requestBody = applyMasking('request.body', sanitizeRequestSnapshot(req.body), maskReq, endpointTraceCtx, masking);
+                        const requestParams = applyMasking('request.params', sanitizeRequestSnapshot(req.params), maskReq, endpointTraceCtx, masking);
+                        const requestQuery = applyMasking('request.query', sanitizeRequestSnapshot(req.query), maskReq, endpointTraceCtx, masking);
+                        const maskedHeaders = applyMasking('request.headers', requestHeaders, maskReq, endpointTraceCtx, masking);
+                        const responseBody = applyMasking('response.body', capturedBody === undefined ? undefined : sanitizeRequestSnapshot(capturedBody), maskReq, endpointTraceCtx, masking);
                         const requestPayload = {
                             rid,
                             method: req.method,
@@ -1556,9 +1788,9 @@ function reproMiddleware(cfg) {
                             path,
                             status: res.statusCode,
                             durMs: Date.now() - t0,
-                            headers: requestHeaders,
+                            headers: maskedHeaders,
                             key,
-                            respBody: capturedBody,
+                            respBody: responseBody,
                             trace: traceBatches.length ? undefined : '[]',
                         };
                         if (requestBody !== undefined)

package/docs/tracing.md

@@ -30,7 +30,7 @@ or getters. Provide a string, regular expression, or array of them and every
 matching trace event will be ignored, regardless of library or filename.
 
 ```ts
-import { setDisabledFunctionTypes } from '@repro/sdk';
+import { setDisabledFunctionTypes } from 'repro-nest';
 
 setDisabledFunctionTypes(['constructor']);
 ```
@@ -50,7 +50,9 @@ captured in the session payload.
 | Property        | Description                                                                                       |
 | --------------- | ------------------------------------------------------------------------------------------------- |
 | `fn`/`functionName` | Match against the instrumented function name (substring or RegExp).                                |
-| `file`          | Match the absolute source filename, useful for filtering entire modules.                           |
+| `wrapper`/`wrapperClass`/`className`/`owner` | Match the wrapper/owner inferred from the function name (e.g. `"UserService"` in `"UserService.create"`). |
+| `file`          | Match the filename reported by the trace event (callsite for wrapped calls; definition file for body-traced app functions). |
+| `line`          | Match the line number reported by the trace event.                                                  |
 | `lib`/`library` | Match the npm package inferred from the file path (e.g. `"mongoose"`).                              |
 | `type`/`functionType` | Match the detected function kind (e.g. `"constructor"`, `"method"`, `"arrow"`).                |
 | `event`/`eventType` | Match the trace phase (`"enter"` or `"exit"`) to suppress only specific edges of a call.          |
@@ -64,7 +66,7 @@ Provide a function that receives the raw trace event and returns `true` when it
 should be discarded. Use this form for complex, stateful, or cross-field logic.
 
 ```ts
-import { setDisabledFunctionTraces } from '@repro/sdk';
+import { setDisabledFunctionTraces } from 'repro-nest';
 
 setDisabledFunctionTraces([
   (event) => event.library === 'mongoose' && event.functionType === 'constructor',
@@ -74,6 +76,71 @@ setDisabledFunctionTraces([
 Pass `null` or an empty array to `initReproTracing` or `setDisabledFunctionTraces`
 to remove previously configured rules.
 
+## Payload masking (`reproMiddleware`)
+
+`reproMiddleware` can mask request/response payloads, request headers, and traced
+function inputs/outputs before they are persisted.
+
+### Targets
+
+- `request.headers`
+- `request.body`
+- `request.params`
+- `request.query`
+- `response.body`
+- `trace.args`
+- `trace.returnValue`
+- `trace.error`
+
+### Rules
+
+- `when.method` / `when.path` / `when.key` scope rules by endpoint (`key` is `"METHOD /path"` without query string).
+- For function-specific rules, `when` supports the same fields as `disableFunctionTraces` (`fn`, `wrapperClass`, `file`, `line`, etc). This is useful when multiple functions share the same name.
+- `paths` uses dot/bracket syntax and supports `*`, `[0]`, `[*]` (example: `"items[*].token"` or `"0.password"` for trace args arrays).
+- `keys` masks matching key names anywhere in the payload (string/RegExp/array).
+- `replacement` overrides the default replacement value (defaults to `"[REDACTED]"`).
+
+```ts
+import { reproMiddleware } from 'repro-nest';
+
+app.use(reproMiddleware({
+  appId,
+  tenantId,
+  appSecret,
+  apiBase,
+  masking: {
+    rules: [
+      {
+        when: { key: 'POST /api/auth/login' },
+        target: 'request.body',
+        paths: ['password'],
+      },
+      {
+        when: { wrapperClass: 'AuthService', functionName: 'login', file: '/app/src/auth/auth.service.ts' },
+        target: ['trace.args', 'trace.returnValue', 'trace.error'],
+        keys: [/token/i],
+      },
+      {
+        target: 'request.headers',
+        keys: [/authorization/i, /cookie/i],
+      },
+    ],
+  },
+}));
+```
+
+### Header capture/masking (`captureHeaders`)
+
+Headers are captured by default with sensitive values masked. Configure `captureHeaders`
+to change the behavior:
+
+- `captureHeaders: false` disables header capture entirely.
+- `captureHeaders: true` (or omitted) captures headers and masks sensitive ones.
+- `captureHeaders.allowSensitiveHeaders: true` keeps default sensitive headers unmasked (use with care).
+- `captureHeaders.maskHeaders` adds additional header names to mask.
+- `captureHeaders.unmaskHeaders` keeps specific header names unmasked (overrides defaults and `maskHeaders`).
+- `captureHeaders.dropHeaders` / `captureHeaders.keepHeaders` are legacy aliases for `maskHeaders` / `unmaskHeaders`.
+
 ## `logFunctionCalls`
 
 Set to `true` to enable verbose console logging of function entry/exit events at
@@ -81,7 +148,7 @@ runtime, or to `false` to silence them. The value is forwarded to
 `setReproTraceLogsEnabled`, so you can also toggle logging later in the process:
 
 ```ts
-import { enableReproTraceLogs, disableReproTraceLogs } from '@repro/sdk';
+import { enableReproTraceLogs, disableReproTraceLogs } from 'repro-nest';
 
 enableReproTraceLogs();
 // ...

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "repro-nest",
-  "version": "0.0.214",
+  "version": "0.0.216",
   "description": "Repro Nest SDK",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/index.ts

@@ -229,14 +229,16 @@ let __TRACER__: TracerApi | null = null;
 let __TRACER_READY = false;
 
 type TraceEventPhase = 'enter' | 'exit';
-export type TraceRulePattern = string | RegExp | Array<string | RegExp>;
+export type TraceRulePattern = string | number | RegExp | Array<string | number | RegExp>;
 
 export type TraceEventForFilter = {
     type: TraceEventPhase; // legacy alias for eventType
     eventType: TraceEventPhase;
     functionType?: string | null;
     fn?: string;
+    wrapperClass?: string | null;
     file?: string | null;
+    line?: number | null;
     depth?: number;
     library?: string | null;
 };
@@ -267,19 +269,29 @@ type EndpointTraceInfo = {
 
 export type HeaderRule = string | RegExp;
 export type HeaderCaptureOptions = {
-    /** When true, sensitive headers such as Authorization are kept; default redacts them. */
+    /** When true, sensitive headers such as Authorization are kept unmasked; default masks them. */
     allowSensitiveHeaders?: boolean;
-    /** Additional header names (string or RegExp) to drop from captures. */
+    /**
+     * Header names (string or RegExp) to mask.
+     * `dropHeaders` is kept for backward-compatibility and treated as an alias for `maskHeaders`.
+     */
+    maskHeaders?: HeaderRule | HeaderRule[];
+    /** @deprecated Alias for {@link maskHeaders}. */
     dropHeaders?: HeaderRule | HeaderRule[];
-    /** Explicit allowlist that overrides defaults and drop rules. */
+    /**
+     * Header names (string or RegExp) to keep unmasked, overriding defaults and `maskHeaders`.
+     * `keepHeaders` is kept for backward-compatibility and treated as an alias for `unmaskHeaders`.
+     */
+    unmaskHeaders?: HeaderRule | HeaderRule[];
+    /** @deprecated Alias for {@link unmaskHeaders}. */
     keepHeaders?: HeaderRule | HeaderRule[];
 };
 
 type NormalizedHeaderCapture = {
     enabled: boolean;
     allowSensitive: boolean;
-    drop: HeaderRule[];
-    keep: HeaderRule[];
+    mask: HeaderRule[];
+    unmask: HeaderRule[];
 };
 
 /** Lightweight helper to disable every trace emitted from specific files. */
@@ -301,8 +313,21 @@ export type DisableFunctionTraceRule = {
     fn?: TraceRulePattern;
     /** Function name (e.g. `"findOne"`, `/^UserService\./`). */
     functionName?: TraceRulePattern;
-    /** Absolute file path where the function was defined. */
+    /** Shortcut for {@link wrapperClass}. */
+    wrapper?: TraceRulePattern;
+    /**
+     * Wrapper/owner name derived from {@link functionName} (e.g. `"UserService"` in `"UserService.create"`).
+     * Useful when multiple functions share the same method name.
+     */
+    wrapperClass?: TraceRulePattern;
+    /** Alias for {@link wrapperClass}. */
+    className?: TraceRulePattern;
+    /** Alias for {@link wrapperClass}. */
+    owner?: TraceRulePattern;
+    /** Source filename reported by the trace event. */
     file?: TraceRulePattern;
+    /** Line number reported by the trace event. */
+    line?: TraceRulePattern;
     /** Shortcut for {@link library}. */
     lib?: TraceRulePattern;
     /** Library/package name inferred from the file path (e.g. `"mongoose"`). */
@@ -323,6 +348,45 @@ export type DisableFunctionTraceConfig =
     | DisableFunctionTraceRule
     | DisableFunctionTracePredicate;
 
+export type ReproMaskTarget =
+    | 'request.headers'
+    | 'request.body'
+    | 'request.params'
+    | 'request.query'
+    | 'response.body'
+    | 'trace.args'
+    | 'trace.returnValue'
+    | 'trace.error';
+
+export type ReproMaskWhen = DisableFunctionTraceRule & {
+    /** Match HTTP method (e.g. `"GET"`, `/^post$/i`). */
+    method?: TraceRulePattern;
+    /** Match request path without query string (e.g. `"/api/auth/login"`). */
+    path?: TraceRulePattern;
+    /** Match normalized endpoint key (e.g. `"POST /api/auth/login"`). */
+    key?: TraceRulePattern;
+};
+
+export type ReproMaskRule = {
+    when?: ReproMaskWhen;
+    target: ReproMaskTarget | ReproMaskTarget[];
+    /**
+     * Dot/bracket paths to mask (supports `*`, `[0]`, `[*]`).
+     * Examples: `"password"`, `"user.token"`, `"items[*].serial"`, `"0.password"` (for trace args arrays).
+     */
+    paths?: string | string[];
+    /** Key name patterns to mask anywhere in the payload. */
+    keys?: TraceRulePattern;
+    /** Override replacement value for this rule (defaults to config replacement / `"[REDACTED]"`). */
+    replacement?: any;
+};
+
+export type ReproMaskingConfig = {
+    /** Default replacement value (defaults to `"[REDACTED]"`). */
+    replacement?: any;
+    rules?: ReproMaskRule[] | null;
+};
+
 const DEFAULT_INTERCEPTOR_TRACE_RULES: DisableFunctionTraceConfig[] = [
     { fn: /switchToHttp$/i },
     { fn: /intercept$/i },
@@ -348,8 +412,8 @@ function refreshDisabledFunctionTraceRules() {
 }
 
 let disabledFunctionTraceRules: DisableFunctionTraceConfig[] = computeDisabledFunctionTraceRules();
-let disabledFunctionTypePatterns: Array<string | RegExp> = [];
-let disabledTraceFilePatterns: Array<string | RegExp> = [];
+let disabledFunctionTypePatterns: Array<string | number | RegExp> = [];
+let disabledTraceFilePatterns: Array<string | number | RegExp> = [];
 let __TRACE_LOG_PREF: boolean | null = null;
 
 function setInterceptorTracingEnabled(enabled: boolean) {
@@ -403,11 +467,32 @@ function inferLibraryNameFromFile(file?: string | null): string | null {
     return segments[0] || null;
 }
 
+function inferWrapperClassFromFn(fn?: string | null): string | null {
+    if (!fn) return null;
+    const raw = String(fn);
+    if (!raw) return null;
+    const hashIdx = raw.indexOf('#');
+    if (hashIdx > 0) {
+        const left = raw.slice(0, hashIdx).trim();
+        return left || null;
+    }
+    const dotIdx = raw.lastIndexOf('.');
+    if (dotIdx > 0) {
+        const left = raw.slice(0, dotIdx).trim();
+        return left || null;
+    }
+    return null;
+}
+
 function matchesRule(rule: DisableFunctionTraceRule, event: TraceEventForFilter): boolean {
     const namePattern = rule.fn ?? rule.functionName;
     if (!matchesPattern(event.fn, namePattern)) return false;
 
+    const wrapperPattern = rule.wrapper ?? rule.wrapperClass ?? rule.className ?? rule.owner;
+    if (!matchesPattern(event.wrapperClass, wrapperPattern)) return false;
+
     if (!matchesPattern(event.file, rule.file)) return false;
+    if (!matchesPattern(event.line == null ? null : String(event.line), rule.line)) return false;
 
     const libPattern = rule.lib ?? rule.library;
     if (!matchesPattern(event.library, libPattern)) return false;
@@ -460,12 +545,12 @@ export function setDisabledFunctionTypes(patterns?: TraceRulePattern | null) {
     disabledFunctionTypePatterns = normalizePatternArray(patterns);
 }
 
-function flattenTraceFilePatterns(config: DisableTraceFileConfig): Array<string | RegExp> {
+function flattenTraceFilePatterns(config: DisableTraceFileConfig): Array<string | number | RegExp> {
     if (config === null || config === undefined) return [];
     if (Array.isArray(config)) {
         return config.flatMap(entry => flattenTraceFilePatterns(entry));
     }
-    if (config instanceof RegExp || typeof config === 'string') {
+    if (config instanceof RegExp || typeof config === 'string' || typeof config === 'number') {
         return [config];
     }
     if (typeof config === 'object' && 'file' in config) {
@@ -1421,6 +1506,8 @@ const DEFAULT_SENSITIVE_HEADERS: Array<string | RegExp> = [
     'set-cookie',
 ];
 
+const DEFAULT_MASK_REPLACEMENT = '[REDACTED]';
+
 function normalizeHeaderRules(rules?: HeaderRule | HeaderRule[] | null): HeaderRule[] {
     return normalizePatternArray<HeaderRule>(rules || []);
 }
@@ -1438,14 +1525,14 @@ function matchesHeaderRule(name: string, rules: HeaderRule[]): boolean {
 
 function normalizeHeaderCaptureConfig(raw?: boolean | HeaderCaptureOptions): NormalizedHeaderCapture {
     if (raw === false) {
-        return { enabled: false, allowSensitive: false, drop: [], keep: [] };
+        return { enabled: false, allowSensitive: false, mask: [], unmask: [] };
     }
     const opts: HeaderCaptureOptions = raw && raw !== true ? raw : {};
     return {
         enabled: true,
         allowSensitive: opts.allowSensitiveHeaders === true,
-        drop: normalizeHeaderRules(opts.dropHeaders),
-        keep: normalizeHeaderRules(opts.keepHeaders),
+        mask: [...normalizeHeaderRules(opts.maskHeaders), ...normalizeHeaderRules(opts.dropHeaders)],
+        unmask: [...normalizeHeaderRules(opts.unmaskHeaders), ...normalizeHeaderRules(opts.keepHeaders)],
     };
 }
 
@@ -1466,24 +1553,210 @@ function sanitizeHeaders(headers: any, rawCfg?: boolean | HeaderCaptureOptions)
     const cfg = normalizeHeaderCaptureConfig(rawCfg);
     if (!cfg.enabled) return {};
 
-    const dropList = cfg.allowSensitive ? cfg.drop : [...DEFAULT_SENSITIVE_HEADERS, ...cfg.drop];
     const out: Record<string, any> = {};
 
     for (const [rawKey, rawVal] of Object.entries(headers || {})) {
         const key = String(rawKey || '').toLowerCase();
         if (!key) continue;
-        const shouldDrop = matchesHeaderRule(key, dropList);
-        const keep = matchesHeaderRule(key, cfg.keep);
-        if (shouldDrop && !keep) continue;
-
         const sanitizedValue = sanitizeHeaderValue(rawVal);
         if (sanitizedValue !== undefined) {
             out[key] = sanitizedValue;
         }
     }
+
+    const maskList = cfg.allowSensitive ? cfg.mask : [...DEFAULT_SENSITIVE_HEADERS, ...cfg.mask];
+    Object.keys(out).forEach((key) => {
+        if (!matchesHeaderRule(key, maskList)) return;
+        if (matchesHeaderRule(key, cfg.unmask)) return;
+        const current = out[key];
+        if (Array.isArray(current)) {
+            out[key] = current.map(() => DEFAULT_MASK_REPLACEMENT);
+            return;
+        }
+        out[key] = DEFAULT_MASK_REPLACEMENT;
+    });
+
     return out;
 }
 
+// ===================================================================
+// Masking (request/response payloads + trace args/returns/errors)
+// ===================================================================
+type NormalizedMaskRule = {
+    when?: ReproMaskWhen;
+    targets: ReproMaskTarget[];
+    paths: string[][];
+    keys?: TraceRulePattern;
+    replacement: any;
+};
+
+type NormalizedMaskingConfig = {
+    replacement: any;
+    rules: NormalizedMaskRule[];
+};
+
+type MaskRequestContext = {
+    method: string;
+    path: string;
+    key: string;
+};
+
+function normalizeMaskTargets(target: ReproMaskTarget | ReproMaskTarget[]): ReproMaskTarget[] {
+    const out = Array.isArray(target) ? target : [target];
+    return out.filter((t): t is ReproMaskTarget => typeof t === 'string' && t.length > 0);
+}
+
+function parseMaskPath(raw: string): string[] {
+    if (!raw) return [];
+    let path = String(raw).trim();
+    if (!path) return [];
+    if (path.startsWith('$.')) path = path.slice(2);
+    if (path.startsWith('.')) path = path.slice(1);
+    path = path.replace(/\[(\d+|\*)\]/g, '.$1');
+    return path.split('.').map(s => s.trim()).filter(Boolean);
+}
+
+function normalizeMaskPaths(paths?: string | string[]): string[][] {
+    if (!paths) return [];
+    const list = Array.isArray(paths) ? paths : [paths];
+    return list
+        .map(p => parseMaskPath(p))
+        .filter(parts => parts.length > 0);
+}
+
+function normalizeMaskingConfig(raw?: ReproMaskingConfig): NormalizedMaskingConfig | null {
+    const rules = raw?.rules;
+    if (!Array.isArray(rules) || rules.length === 0) return null;
+    const replacement = raw?.replacement ?? DEFAULT_MASK_REPLACEMENT;
+    const normalized: NormalizedMaskRule[] = [];
+    for (const rule of rules) {
+        if (!rule) continue;
+        const targets = normalizeMaskTargets(rule.target);
+        if (!targets.length) continue;
+        const paths = normalizeMaskPaths(rule.paths);
+        const keys = rule.keys ?? undefined;
+        if (!paths.length && !keys) continue;
+        normalized.push({
+            when: rule.when,
+            targets,
+            paths,
+            keys,
+            replacement: rule.replacement ?? replacement,
+        });
+    }
+    return normalized.length ? { replacement, rules: normalized } : null;
+}
+
+function maskWhenRequiresTrace(when: ReproMaskWhen): boolean {
+    return Boolean(
+        when.fn ||
+        when.functionName ||
+        when.wrapper ||
+        when.wrapperClass ||
+        when.className ||
+        when.owner ||
+        when.file ||
+        when.lib ||
+        when.library ||
+        when.type ||
+        when.functionType ||
+        when.event ||
+        when.eventType
+    );
+}
+
+function matchesMaskWhen(when: ReproMaskWhen | undefined, req: MaskRequestContext, trace: TraceEventForFilter | null): boolean {
+    if (!when) return true;
+    if (!matchesPattern(req.method, when.method)) return false;
+    if (!matchesPattern(req.path, when.path)) return false;
+    if (!matchesPattern(req.key, when.key)) return false;
+
+    if (maskWhenRequiresTrace(when)) {
+        if (!trace) return false;
+        if (!matchesRule(when, trace)) return false;
+    }
+
+    return true;
+}
+
+function maskKeysInPlace(node: any, keys: TraceRulePattern, replacement: any) {
+    if (!node) return;
+    if (Array.isArray(node)) {
+        node.forEach(item => maskKeysInPlace(item, keys, replacement));
+        return;
+    }
+    if (typeof node !== 'object') return;
+    Object.keys(node).forEach((key) => {
+        if (matchesPattern(key, keys, false)) {
+            try { node[key] = replacement; } catch {}
+            return;
+        }
+        maskKeysInPlace(node[key], keys, replacement);
+    });
+}
+
+function maskPathInPlace(node: any, pathParts: string[], replacement: any, depth: number = 0) {
+    if (!node) return;
+    if (depth >= pathParts.length) return;
+    const part = pathParts[depth];
+    const isLast = depth === pathParts.length - 1;
+
+    const applyAt = (container: any, key: string | number) => {
+        if (!container) return;
+        try { container[key] = replacement; } catch {}
+    };
+
+    if (part === '*') {
+        if (Array.isArray(node)) {
+            for (let i = 0; i < node.length; i++) {
+                if (isLast) applyAt(node, i);
+                else maskPathInPlace(node[i], pathParts, replacement, depth + 1);
+            }
+        } else if (typeof node === 'object') {
+            for (const key of Object.keys(node)) {
+                if (isLast) applyAt(node, key);
+                else maskPathInPlace(node[key], pathParts, replacement, depth + 1);
+            }
+        }
+        return;
+    }
+
+    const index = Number(part);
+    const isIndex = Number.isInteger(index) && String(index) === part;
+    if (Array.isArray(node) && isIndex) {
+        if (index < 0 || index >= node.length) return;
+        if (isLast) applyAt(node, index);
+        else maskPathInPlace(node[index], pathParts, replacement, depth + 1);
+        return;
+    }
+
+    if (typeof node !== 'object') return;
+    if (!Object.prototype.hasOwnProperty.call(node, part)) return;
+    if (isLast) applyAt(node, part);
+    else maskPathInPlace(node[part], pathParts, replacement, depth + 1);
+}
+
+function applyMasking(
+    target: ReproMaskTarget,
+    value: any,
+    req: MaskRequestContext,
+    trace: TraceEventForFilter | null,
+    masking: NormalizedMaskingConfig | null
+) {
+    if (!masking || !masking.rules.length) return value;
+    if (value === undefined) return value;
+    for (const rule of masking.rules) {
+        if (!rule.targets.includes(target)) continue;
+        if (!matchesMaskWhen(rule.when, req, trace)) continue;
+        const replacement = rule.replacement ?? masking.replacement ?? DEFAULT_MASK_REPLACEMENT;
+        if (rule.keys) maskKeysInPlace(value, rule.keys, replacement);
+        if (rule.paths.length) {
+            rule.paths.forEach(parts => maskPathInPlace(value, parts, replacement, 0));
+        }
+    }
+    return value;
+}
+
 // ===================================================================
 // reproMiddleware — unchanged behavior + passive per-request trace
 // ===================================================================
@@ -1492,11 +1765,14 @@ export type ReproMiddlewareConfig = {
     tenantId: string;
     appSecret: string;
     apiBase: string;
-    /** Configure header capture/redaction. Defaults to capturing with sensitive headers removed. */
+    /** Configure header capture/masking. Defaults to capturing with sensitive headers masked. */
     captureHeaders?: boolean | HeaderCaptureOptions;
+    /** Optional masking rules for request/response payloads and function traces. */
+    masking?: ReproMaskingConfig;
 };
 
 export function reproMiddleware(cfg: ReproMiddlewareConfig) {
+    const masking = normalizeMaskingConfig(cfg.masking);
     return function (req: Request, res: Response, next: NextFunction) {
         const sid = (req.headers['x-bug-session-id'] as string) || '';
         const aid = (req.headers['x-bug-action-id'] as string) || '';
@@ -1509,8 +1785,10 @@ export function reproMiddleware(cfg: ReproMiddlewareConfig) {
         const rid = nextRequestId(requestEpochMs);
         const t0 = requestStartRaw;
         const url = (req as any).originalUrl || req.url || '/';
+        const urlPathOnly = (url || '/').split('?')[0] || '/';
         const path = url; // back-compat
         const key = normalizeRouteKey(req.method, url);
+        const maskReq: MaskRequestContext = { method: String(req.method || 'GET').toUpperCase(), path: urlPathOnly, key };
         const requestHeaders = sanitizeHeaders(req.headers, cfg.captureHeaders);
         beginSessionRequest(sid);
 
@@ -1636,6 +1914,10 @@ export function reproMiddleware(cfg: ReproMiddlewareConfig) {
                         unsubscribe = __TRACER__.tracer.on((ev: any) => {
                             if (!ev || ev.traceId !== tidNow) return;
 
+                            const sourceFileForLibrary = typeof ev.sourceFile === 'string' && ev.sourceFile
+                                ? String(ev.sourceFile)
+                                : null;
+
                             const evt: TraceEventRecord = {
                                 t: alignTimestamp(ev.t),
                                 type: ev.type,
@@ -1651,14 +1933,44 @@ export function reproMiddleware(cfg: ReproMiddlewareConfig) {
                                 evt.functionType = ev.functionType;
                             }
 
+                            const candidate: TraceEventForFilter = {
+                                type: evt.type,
+                                eventType: evt.type,
+                                functionType: evt.functionType ?? null,
+                                fn: evt.fn,
+                                wrapperClass: inferWrapperClassFromFn(evt.fn),
+                                file: evt.file ?? null,
+                                line: evt.line ?? null,
+                                depth: evt.depth,
+                                library: inferLibraryNameFromFile(sourceFileForLibrary ?? evt.file),
+                            };
+
                             if (ev.args !== undefined) {
-                                evt.args = sanitizeTraceArgs(ev.args);
+                                evt.args = applyMasking(
+                                    'trace.args',
+                                    sanitizeTraceArgs(ev.args),
+                                    maskReq,
+                                    candidate,
+                                    masking
+                                );
                             }
                             if (ev.returnValue !== undefined) {
-                                evt.returnValue = sanitizeTraceValue(ev.returnValue);
+                                evt.returnValue = applyMasking(
+                                    'trace.returnValue',
+                                    sanitizeTraceValue(ev.returnValue),
+                                    maskReq,
+                                    candidate,
+                                    masking
+                                );
                             }
                             if (ev.error !== undefined) {
-                                evt.error = sanitizeTraceValue(ev.error);
+                                evt.error = applyMasking(
+                                    'trace.error',
+                                    sanitizeTraceValue(ev.error),
+                                    maskReq,
+                                    candidate,
+                                    masking
+                                );
                             }
                             if (ev.threw !== undefined) {
                                 evt.threw = Boolean(ev.threw);
@@ -1667,16 +1979,6 @@ export function reproMiddleware(cfg: ReproMiddlewareConfig) {
                                 evt.unawaited = ev.unawaited === true;
                             }
 
-                            const candidate: TraceEventForFilter = {
-                                type: evt.type,
-                                eventType: evt.type,
-                                functionType: evt.functionType ?? null,
-                                fn: evt.fn,
-                                file: evt.file ?? null,
-                                depth: evt.depth,
-                                library: inferLibraryNameFromFile(evt.file),
-                            };
-
                             const dropEvent = shouldDropTraceEvent(candidate);
                             const spanKey = normalizeSpanId(evt.spanId);
                             if (evt.type === 'enter') {
@@ -1759,9 +2061,55 @@ export function reproMiddleware(cfg: ReproMiddlewareConfig) {
                             ?? firstAppTrace
                             ?? { fn: null, file: null, line: null, functionType: null };
                         const traceBatches = chunkArray(orderedEvents, TRACE_BATCH_SIZE);
-                        const requestBody = sanitizeRequestSnapshot((req as any).body);
-                        const requestParams = sanitizeRequestSnapshot((req as any).params);
-                        const requestQuery = sanitizeRequestSnapshot((req as any).query);
+                        const endpointTraceCtx: TraceEventForFilter | null = (() => {
+                            if (!chosenEndpoint?.fn && !chosenEndpoint?.file) return null;
+                            return {
+                                type: 'enter',
+                                eventType: 'enter',
+                                fn: chosenEndpoint.fn ?? undefined,
+                                wrapperClass: inferWrapperClassFromFn(chosenEndpoint.fn),
+                                file: chosenEndpoint.file ?? null,
+                                line: chosenEndpoint.line ?? null,
+                                functionType: chosenEndpoint.functionType ?? null,
+                                library: inferLibraryNameFromFile(chosenEndpoint.file),
+                            };
+                        })();
+
+                        const requestBody = applyMasking(
+                            'request.body',
+                            sanitizeRequestSnapshot((req as any).body),
+                            maskReq,
+                            endpointTraceCtx,
+                            masking
+                        );
+                        const requestParams = applyMasking(
+                            'request.params',
+                            sanitizeRequestSnapshot((req as any).params),
+                            maskReq,
+                            endpointTraceCtx,
+                            masking
+                        );
+                        const requestQuery = applyMasking(
+                            'request.query',
+                            sanitizeRequestSnapshot((req as any).query),
+                            maskReq,
+                            endpointTraceCtx,
+                            masking
+                        );
+                        const maskedHeaders = applyMasking(
+                            'request.headers',
+                            requestHeaders,
+                            maskReq,
+                            endpointTraceCtx,
+                            masking
+                        );
+                        const responseBody = applyMasking(
+                            'response.body',
+                            capturedBody === undefined ? undefined : sanitizeRequestSnapshot(capturedBody),
+                            maskReq,
+                            endpointTraceCtx,
+                            masking
+                        );
 
                         const requestPayload: Record<string, any> = {
                             rid,
@@ -1770,9 +2118,9 @@ export function reproMiddleware(cfg: ReproMiddlewareConfig) {
                             path,
                             status: res.statusCode,
                             durMs: Date.now() - t0,
-                            headers: requestHeaders,
+                            headers: maskedHeaders,
                             key,
-                            respBody: capturedBody,
+                            respBody: responseBody,
                             trace: traceBatches.length ? undefined : '[]',
                         };
                         if (requestBody !== undefined) requestPayload.body = requestBody;

package/tracer/runtime.js

@@ -128,6 +128,7 @@ const trace = {
             fn,
             file: meta?.file,
             line: meta?.line,
+            sourceFile: meta?.sourceFile || null,
             functionType: meta?.functionType || null,
             traceId: ctx.traceId,
             depth: ctx.depth,
@@ -144,6 +145,7 @@ const trace = {
             fn: meta?.fn,
             file: meta?.file,
             line: meta?.line,
+            sourceFile: meta?.sourceFile || null,
             functionType: meta?.functionType || null
         };
         const frameStack = ctx.__repro_frame_unawaited;
@@ -190,6 +192,7 @@ const trace = {
                 fn: baseMeta.fn,
                 file: baseMeta.file,
                 line: baseMeta.line,
+                sourceFile: baseMeta.sourceFile,
                 functionType: baseMeta.functionType || null,
                 traceId: traceIdAtExit,
                 depth: spanInfo.depth ?? depthAtExit,
@@ -601,10 +604,14 @@ if (!global.__repro_call) {
                     const name = (label && label.length) || fn.name
                         ? (label && label.length ? label : fn.name)
                         : '(anonymous)';
-                    const sourceFile = fn[SYM_SRC_FILE];
+                    const definitionFile = fn[SYM_SRC_FILE];
+                    const normalizedCallFile = callFile ? String(callFile).trim() : '';
+                    const callsiteFile = normalizedCallFile ? normalizedCallFile : null;
+                    const callsiteLine = Number.isFinite(Number(callLine)) && Number(callLine) > 0 ? Number(callLine) : null;
                     const meta = {
-                        file: sourceFile || callFile || null,
-                        line: sourceFile ? null : (callLine || null),
+                        file: callsiteFile || definitionFile || null,
+                        line: callsiteLine,
+                        sourceFile: definitionFile || null,
                         parentSpanId: forcedParentSpanId
                     };
 
@@ -638,7 +645,7 @@ if (!global.__repro_call) {
                         })();
 
                         const runExit = (detail) => {
-                            const runner = () => trace.exit({ fn: name, file: meta.file, line: meta.line }, detail);
+                            const runner = () => trace.exit({ fn: name, file: meta.file, line: meta.line, sourceFile: meta.sourceFile }, detail);
                             if (exitStore) return als.run(exitStore, runner);
                             return runner();
                         };
@@ -685,7 +692,7 @@ if (!global.__repro_call) {
                         runExit(exitDetailBase);
                         return out;
                     } catch (e) {
-                        trace.exit({ fn: name, file: meta.file, line: meta.line }, { threw: true, error: e, args });
+                        trace.exit({ fn: name, file: meta.file, line: meta.line, sourceFile: meta.sourceFile }, { threw: true, error: e, args });
                         throw e;
                     } finally {
                         if (pendingMarker) {