Data processors

type DataProcessor = (data: Record<string, any>) => Record<string, any>

const config: TelemetryConfig = {
  // ...
  dataProcessors: [
    addEnv,
    redactPII,
    hashUserId,
  ],
}

const addEnv = (data: Record<string, any>) => ({
  ...data,
  'deployment.env': process.env.DEPLOY_ENV ?? 'dev',
  'deployment.region': process.env.AWS_REGION ?? 'local',
})

const SENSITIVE_KEYS = new Set(['mcp.request.argument.api_key', 'mcp.request.argument.password'])

const redactKeys = (data: Record<string, any>) => {
  const out: Record<string, any> = {}
  for (const [k, v] of Object.entries(data)) {
    out[k] = SENSITIVE_KEYS.has(k) ? '[REDACTED]' : v
  }
  return out
}

import { createHash } from 'node:crypto'

const hashUserIds = (data: Record<string, any>) => {
  const out = { ...data }
  for (const k of Object.keys(out)) {
    if (k.endsWith('user.id') && typeof out[k] === 'string') {
      out[k] = createHash('sha256').update(out[k]).digest('hex').slice(0, 16)
    }
  }
  return out
}

const dropDebug = (data: Record<string, any>) => {
  const out: Record<string, any> = {}
  for (const [k, v] of Object.entries(data)) {
    if (!k.startsWith('debug.')) out[k] = v
  }
  return out
}

const cleaned = telemetry.processTelemetryAttributes({
  'user.email': 'jane@acme.com',
})
// → { 'mcp.session.id': '...', 'user.email': '[REDACTED:email]' }

dataProcessors: [
  redactPII,   // 1. scrub anything sensitive that came from user input
  addEnv,      // 2. add deployment metadata
  enrichTrace, // 3. enrich with computed signals
]

const redactIfNeeded = (data: Record<string, any>) => {
  let cloned: Record<string, any> | null = null
  for (const k of Object.keys(data)) {
    const v = data[k]
    if (typeof v === 'string' && PII_RE.test(v)) {
      cloned ??= { ...data }
      cloned[k] = v.replace(PII_RE, '[REDACTED]')
    }
  }
  return cloned ?? data // unchanged → return same reference
}