@armoriq/sdk-dev 0.6.10 → 0.8.0

package/dist/observability/otel-config.js

@@ -0,0 +1,268 @@
+"use strict";
+/**
+ * Immutable, fail-safe OpenTelemetry configuration.
+ *
+ * The public contract intentionally follows standard OTLP environment
+ * variables. It never identifies or configures a specific external vendor.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CAPTURE_RANK = void 0;
+exports.sanitizeExternalTelemetryValue = sanitizeExternalTelemetryValue;
+exports.resolveOtelConfig = resolveOtelConfig;
+exports.lowerCaptureMode = lowerCaptureMode;
+const CAPTURE_MODES = new Set(['off', 'metadata', 'enhanced', 'debug']);
+const EXPORTERS = new Set(['armoriq', 'external', 'provider']);
+const SAFE_RESOURCE_KEYS = new Set([
+    'service.version',
+    'service.namespace',
+    'service.instance.id',
+    'deployment.environment.name',
+    'telemetry.sdk.name',
+    'telemetry.sdk.version',
+]);
+const HEADER_NAME = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+const RESERVED_TRANSPORT_HEADERS = new Set([
+    'connection', 'content-length', 'content-type', 'host', 'keep-alive',
+    'proxy-authenticate', 'proxy-authorization', 'te', 'trailer',
+    'transfer-encoding', 'upgrade',
+]);
+const SENSITIVE_VALUE = /(?:\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b|\b(?:ak|sk|pk|rk|ghp|github_pat)_[A-Za-z0-9_-]{12,}\b|-----BEGIN [A-Z0-9 ]+-----)/i;
+const EMAIL = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i;
+const DEFAULT_TIMEOUT_MS = 10_000;
+/**
+ * Numeric personal identifiers are unsafe even when their attribute name is
+ * harmless. Match phone-length runs, the SSN shape, and payment-card-length
+ * runs rather than relying on caller-provided field names.
+ */
+function hasNumericPersonalIdentifier(value) {
+    if (/(?:^|\D)\d{3}[- ]?\d{2}[- ]?\d{4}(?:$|\D)/.test(value))
+        return true;
+    const candidates = value.match(/\+?\d(?:[ .()-]*\d){8,18}/g) ?? [];
+    return candidates.some((candidate) => {
+        const digits = candidate.replace(/\D/g, '');
+        return digits.length >= 10 && digits.length <= 15
+            || (digits.length >= 13 && digits.length <= 19 && passesLuhn(digits));
+    });
+}
+function passesLuhn(digits) {
+    let sum = 0;
+    let alternate = false;
+    for (let index = digits.length - 1; index >= 0; index -= 1) {
+        let digit = Number(digits[index]);
+        if (alternate && (digit *= 2) > 9)
+            digit -= 9;
+        sum += digit;
+        alternate = !alternate;
+    }
+    return sum % 10 === 0;
+}
+/** Returns an externally safe value, or no value when it could identify a person. */
+function sanitizeExternalTelemetryValue(value, maxLength = 256) {
+    const trimmed = value.trim();
+    if (!trimmed || /[\r\n\0]/.test(trimmed) || SENSITIVE_VALUE.test(trimmed) || EMAIL.test(trimmed) || hasNumericPersonalIdentifier(trimmed))
+        return undefined;
+    return trimmed.slice(0, maxLength);
+}
+function env(name) {
+    const value = process.env[name]?.trim();
+    return value || undefined;
+}
+function isDisabledByEnvironment() {
+    return ['0', 'false', 'off', 'no', 'disabled'].includes((env('ARMORIQ_OBSERVABILITY') ?? '').toLowerCase())
+        || (env('OTEL_SDK_DISABLED') ?? '').toLowerCase() === 'true'
+        || (env('OTEL_TRACES_EXPORTER') ?? '').toLowerCase() === 'none';
+}
+function captureMode(value, fallback) {
+    const normalized = String(value ?? '').trim().toLowerCase();
+    return CAPTURE_MODES.has(normalized) ? normalized : fallback;
+}
+function endpointConfigured(options) {
+    return Boolean(options.endpoint?.trim() || options.baseEndpoint?.trim() || env('OTEL_EXPORTER_OTLP_TRACES_ENDPOINT') || env('OTEL_EXPORTER_OTLP_ENDPOINT') || env('ARMORIQ_OTEL_ENDPOINT'));
+}
+function exporter(options) {
+    if (options.exporter)
+        return EXPORTERS.has(options.exporter) ? options.exporter : 'armoriq';
+    const configured = env('ARMORIQ_OTEL_EXPORTER')?.toLowerCase();
+    if (configured && EXPORTERS.has(configured))
+        return configured;
+    return endpointConfigured(options) ? 'external' : 'armoriq';
+}
+/**
+ * `http:` carries configured authorization headers and lease-authorized
+ * enhanced/debug content in plaintext, so it is only safe for a collector
+ * running on the same machine — never an arbitrary remote host. Remote
+ * endpoints must use `https:`.
+ */
+function isLoopbackHostname(hostname) {
+    const normalized = hostname.replace(/^\[|\]$/g, '').toLowerCase();
+    return normalized === 'localhost' || normalized === '127.0.0.1' || normalized === '::1';
+}
+function validateUrl(value) {
+    try {
+        const url = new URL(value);
+        if ((url.protocol !== 'https:' && url.protocol !== 'http:') || url.username || url.password || url.search || url.hash)
+            return undefined;
+        if (url.protocol === 'http:' && !isLoopbackHostname(url.hostname))
+            return undefined;
+        return url.toString().replace(/\/$/, '');
+    }
+    catch {
+        return undefined;
+    }
+}
+function appendTracePath(value) {
+    const endpoint = validateUrl(value);
+    if (!endpoint)
+        return undefined;
+    const url = new URL(endpoint);
+    const pathname = url.pathname.replace(/\/+$/, '');
+    url.pathname = pathname.endsWith('/v1/traces') ? pathname : `${pathname}/v1/traces`;
+    return url.toString().replace(/\/$/, '');
+}
+function resolveEndpoint(options) {
+    if (options.endpoint?.trim())
+        return validateUrl(options.endpoint.trim());
+    if (options.baseEndpoint?.trim())
+        return appendTracePath(options.baseEndpoint.trim());
+    const tracesEndpoint = env('OTEL_EXPORTER_OTLP_TRACES_ENDPOINT');
+    if (tracesEndpoint)
+        return validateUrl(tracesEndpoint);
+    const baseEndpoint = env('OTEL_EXPORTER_OTLP_ENDPOINT');
+    if (baseEndpoint)
+        return appendTracePath(baseEndpoint);
+    const convenienceEndpoint = env('ARMORIQ_OTEL_ENDPOINT');
+    return convenienceEndpoint ? validateUrl(convenienceEndpoint) : undefined;
+}
+function decodeHeaderValue(value) {
+    try {
+        const decoded = decodeURIComponent(value.trim());
+        return decoded && !/[\r\n\0]/.test(decoded) ? decoded : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function parseHeaderString(value) {
+    if (!value)
+        return {};
+    const parsed = {};
+    for (const pair of value.split(',')) {
+        const separator = pair.indexOf('=');
+        if (separator <= 0)
+            return undefined;
+        const key = pair.slice(0, separator).trim();
+        const decoded = decodeHeaderValue(pair.slice(separator + 1));
+        if (!HEADER_NAME.test(key) || decoded === undefined)
+            return undefined;
+        if (!RESERVED_TRANSPORT_HEADERS.has(key.toLowerCase()))
+            parsed[key.toLowerCase()] = decoded;
+    }
+    return parsed;
+}
+function parseHeaderObject(value) {
+    if (!value)
+        return {};
+    const parsed = {};
+    for (const [key, raw] of Object.entries(value)) {
+        if (!HEADER_NAME.test(key) || typeof raw !== 'string' || !raw || /[\r\n\0]/.test(raw))
+            return undefined;
+        if (!RESERVED_TRANSPORT_HEADERS.has(key.toLowerCase()))
+            parsed[key.toLowerCase()] = raw;
+    }
+    return parsed;
+}
+function resolveHeaders(options) {
+    const general = parseHeaderString(env('OTEL_EXPORTER_OTLP_HEADERS'));
+    const traces = parseHeaderString(env('OTEL_EXPORTER_OTLP_TRACES_HEADERS'));
+    const explicit = parseHeaderObject(options.headers);
+    if (!general || !traces || !explicit)
+        return undefined;
+    return Object.freeze({ ...general, ...traces, ...explicit });
+}
+function resolveProtocol(options) {
+    const value = options.protocol ?? env('OTEL_EXPORTER_OTLP_TRACES_PROTOCOL') ?? env('OTEL_EXPORTER_OTLP_PROTOCOL') ?? 'http/protobuf';
+    return String(value).trim().toLowerCase() === 'http/protobuf' ? 'http/protobuf' : undefined;
+}
+function parseTimeout(value) {
+    if (value === undefined || value === null || value === '')
+        return DEFAULT_TIMEOUT_MS;
+    const parsed = typeof value === 'number' ? value : Number(String(value).trim());
+    return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : undefined;
+}
+function resolveTimeout(options) {
+    return parseTimeout(options.timeoutMillis ?? env('OTEL_EXPORTER_OTLP_TRACES_TIMEOUT') ?? env('OTEL_EXPORTER_OTLP_TIMEOUT'));
+}
+function safeServiceName(value) {
+    const trimmed = value?.trim() ?? '';
+    return /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/.test(trimmed) && sanitizeExternalTelemetryValue(trimmed, 128)
+        ? trimmed
+        : 'armoriq-sdk';
+}
+function parseResources(value) {
+    if (!value)
+        return {};
+    const entries = typeof value === 'string'
+        ? value.split(',').map((pair) => {
+            const separator = pair.indexOf('=');
+            return separator <= 0 ? undefined : [pair.slice(0, separator).trim(), pair.slice(separator + 1).trim()];
+        })
+        : Object.entries(value);
+    const parsed = {};
+    for (const entry of entries) {
+        if (!entry)
+            continue;
+        const [key, raw] = entry;
+        const value = typeof raw === 'string' ? sanitizeExternalTelemetryValue(raw) : undefined;
+        if (!SAFE_RESOURCE_KEYS.has(key) || !value)
+            continue;
+        parsed[key] = value;
+    }
+    return parsed;
+}
+function resolveResources(options) {
+    const environmental = parseResources(env('OTEL_RESOURCE_ATTRIBUTES'));
+    const explicit = parseResources(options.resourceAttributes);
+    return Object.freeze(environmental && explicit ? { ...environmental, ...explicit } : {});
+}
+/** Resolve without network I/O. No returned object is mutable by a caller. */
+function resolveOtelConfig(options = {}) {
+    const resolvedExporter = exporter(options);
+    const endpoint = resolvedExporter === 'external' ? resolveEndpoint(options) : undefined;
+    const headers = resolveHeaders(options);
+    const protocol = resolveProtocol(options);
+    const timeoutMillis = resolveTimeout(options);
+    const serviceName = safeServiceName(options.serviceName ?? env('OTEL_SERVICE_NAME'));
+    const base = {
+        enabled: options.enabled !== false && !isDisabledByEnvironment(),
+        exporter: resolvedExporter,
+        endpoint,
+        headers: headers ?? Object.freeze({}),
+        protocol: protocol ?? 'http/protobuf',
+        timeoutMillis: timeoutMillis ?? DEFAULT_TIMEOUT_MS,
+        resourceAttributes: resolveResources(options),
+        tracerProvider: options.tracerProvider,
+        captureMode: captureMode(options.captureMode ?? env('ARMORIQ_OTEL_CAPTURE_MODE') ?? 'debug', 'debug'),
+        serviceName,
+    };
+    if (resolvedExporter === 'external' && !endpoint)
+        return Object.freeze({ ...base, enabled: false, disabledReason: 'external endpoint is required' });
+    if (resolvedExporter === 'external' && !headers)
+        return Object.freeze({ ...base, enabled: false, disabledReason: 'invalid OTLP headers' });
+    if (resolvedExporter === 'external' && !protocol)
+        return Object.freeze({ ...base, enabled: false, disabledReason: 'only http/protobuf OTLP is supported' });
+    if (resolvedExporter === 'external' && !timeoutMillis)
+        return Object.freeze({ ...base, enabled: false, disabledReason: 'invalid OTLP timeout' });
+    if (resolvedExporter === 'provider' && !options.tracerProvider)
+        return Object.freeze({ ...base, enabled: false, disabledReason: 'tracerProvider is required' });
+    return Object.freeze(base);
+}
+exports.CAPTURE_RANK = Object.freeze({
+    off: 0,
+    metadata: 1,
+    enhanced: 2,
+    debug: 3,
+});
+function lowerCaptureMode(left, right) {
+    return exports.CAPTURE_RANK[left] <= exports.CAPTURE_RANK[right] ? left : right;
+}
+//# sourceMappingURL=otel-config.js.map

package/dist/observability/otel-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otel-config.js","sourceRoot":"","sources":["../../src/observability/otel-config.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAwFH,wEAIC;AAgKD,8CAyBC;AASD,4CAEC;AAxPD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAc,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AACrF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAmB,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AACjF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,iBAAiB;IACjB,mBAAmB;IACnB,qBAAqB;IACrB,6BAA6B;IAC7B,oBAAoB;IACpB,uBAAuB;CACxB,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,+BAA+B,CAAC;AACpD,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY;IACpE,oBAAoB,EAAE,qBAAqB,EAAE,IAAI,EAAE,SAAS;IAC5D,mBAAmB,EAAE,SAAS;CAC/B,CAAC,CAAC;AACH,MAAM,eAAe,GAAG,gJAAgJ,CAAC;AACzK,MAAM,KAAK,GAAG,4CAA4C,CAAC;AAC3D,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;GAIG;AACH,SAAS,4BAA4B,CAAC,KAAa;IACjD,IAAI,2CAA2C,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,4BAA4B,CAAC,IAAI,EAAE,CAAC;IACnE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QACnC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE;eAC5C,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAClC,IAAI,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;QAC9C,GAAG,IAAI,KAAK,CAAC;QACb,SAAS,GAAG,CAAC,SAAS,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,qFAAqF;AACrF,SAAgB,8BAA8B,CAAC,KAAa,EAAE,YAAoB,GAAG;IACnF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,4BAA4B,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5J,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IACxC,OAAO,KAAK,IAAI,SAAS,CAAC;AAC5B,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;WACtG,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM;WACzD,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;AACpE,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,QAAqB;IACxD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAiB,CAAC;IAC3E,OAAO,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/D,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA6B;IACvD,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,oCAAoC,CAAC,IAAI,GAAG,CAAC,6BAA6B,CAAC,IAAI,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;AAC9L,CAAC;AAED,SAAS,QAAQ,CAAC,OAA6B;IAC7C,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,UAAU,GAAG,GAAG,CAAC,uBAAuB,CAAC,EAAE,WAAW,EAAkC,CAAC;IAC/F,IAAI,UAAU,IAAI,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAC/D,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAClE,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,KAAK,CAAC;AAC1F,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QACxI,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC;QACpF,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,YAAY,CAAC;IACpF,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,eAAe,CAAC,OAA6B;IACpD,IAAI,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE;QAAE,OAAO,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE;QAAE,OAAO,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IACtF,MAAM,cAAc,GAAG,GAAG,CAAC,oCAAoC,CAAC,CAAC;IACjE,IAAI,cAAc;QAAE,OAAO,WAAW,CAAC,cAAc,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACxD,IAAI,YAAY;QAAE,OAAO,eAAe,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,mBAAmB,GAAG,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACzD,OAAO,mBAAmB,CAAC,CAAC,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5E,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACjD,OAAO,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACtE,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC;IAC9F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAmD;IAC5E,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACxG,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,GAAG,CAAC;IAC1F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,OAA6B;IACnD,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,eAAe,CAAC,OAA6B;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,oCAAoC,CAAC,IAAI,GAAG,CAAC,6BAA6B,CAAC,IAAI,eAAe,CAAC;IACrI,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9F,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,kBAAkB,CAAC;IACrF,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAChF,OAAO,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC;AAED,SAAS,cAAc,CAAC,OAA6B;IACnD,OAAO,YAAY,CAAC,OAAO,CAAC,aAAa,IAAI,GAAG,CAAC,mCAAmC,CAAC,IAAI,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC;AAC9H,CAAC;AAED,SAAS,eAAe,CAAC,KAAyB;IAChD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACpC,OAAO,sCAAsC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,8BAA8B,CAAC,OAAO,EAAE,GAAG,CAAC;QACzG,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,aAAa,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,KAA4D;IAClF,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ;QACvC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACpC,OAAO,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAU,CAAC;QACnH,CAAC,CAAC;QACF,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;QACzB,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAA6B;IACrD,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,MAAM,CAAC,aAAa,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,8EAA8E;AAC9E,SAAgB,iBAAiB,CAAC,UAAgC,EAAE;IAClE,MAAM,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,gBAAgB,KAAK,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACrF,MAAM,IAAI,GAAuB;QAC/B,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,uBAAuB,EAAE;QAChE,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ;QACR,OAAO,EAAE,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,QAAQ,EAAE,QAAQ,IAAI,eAAe;QACrC,aAAa,EAAE,aAAa,IAAI,kBAAkB;QAClD,kBAAkB,EAAE,gBAAgB,CAAC,OAAO,CAAC;QAC7C,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,WAAW,EAAE,WAAW,CAAC,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC,2BAA2B,CAAC,IAAI,OAAO,EAAE,OAAO,CAAC;QACrG,WAAW;KACZ,CAAC;IACF,IAAI,gBAAgB,KAAK,UAAU,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,+BAA+B,EAAE,CAAC,CAAC;IACrJ,IAAI,gBAAgB,KAAK,UAAU,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAC3I,IAAI,gBAAgB,KAAK,UAAU,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,sCAAsC,EAAE,CAAC,CAAC;IAC5J,IAAI,gBAAgB,KAAK,UAAU,IAAI,CAAC,aAAa;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACjJ,IAAI,gBAAgB,KAAK,UAAU,IAAI,CAAC,OAAO,CAAC,cAAc;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAChK,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAEY,QAAA,YAAY,GAA0C,MAAM,CAAC,MAAM,CAAC;IAC/E,GAAG,EAAE,CAAC;IACN,QAAQ,EAAE,CAAC;IACX,QAAQ,EAAE,CAAC;IACX,KAAK,EAAE,CAAC;CACT,CAAC,CAAC;AAEH,SAAgB,gBAAgB,CAAC,IAAiB,EAAE,KAAkB;IACpE,OAAO,oBAAY,CAAC,IAAI,CAAC,IAAI,oBAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAClE,CAAC"}

package/dist/observability/otel-export-ceiling.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Export-time capture-mode ceiling re-application for buffered spans.
+ *
+ * `ArmorIQTelemetryRuntime.safeAttributes` (otel-runtime.ts) already governs
+ * what a span is *allowed to receive* at the moment its attributes are set,
+ * using whatever policy lease was current at that instant. That is not
+ * enough on its own: `BatchSpanProcessor` buffers ended spans in memory and
+ * ships them later, on a timer or when the queue fills. A span populated
+ * with rich content under an `enhanced`/`debug` lease can still be sitting
+ * in that buffer, un-exported, when the organization's lease becomes
+ * stricter -- because the policy changed, or because a refresh came back
+ * lower after the previous lease expired. Without a check at the moment
+ * spans actually leave the process, the stale, too-permissive attributes
+ * baked onto the span at creation time would still ship, even though the
+ * CURRENT lease no longer authorizes them.
+ *
+ * This module closes that gap at two points, both delegating to the exact
+ * same governance the runtime uses at span-creation time
+ * (`ArmorIQTelemetryRuntime.currentCeilingSnapshot` /
+ * `reapplyContentCeiling`, which in turn shares `contentAuthority` with
+ * `safeAttributesWithAuthority`), so there is exactly one place that defines
+ * "what counts as content" and "what survives a given capture mode":
+ *
+ * - `CeilingReapplyingSpanExporter` wraps the real span exporter. Its
+ *   `export` re-reads the current policy snapshot immediately before
+ *   handing spans to the wrapped exporter -- this runs whenever the
+ *   batching processor actually flushes, so it catches a span regardless of
+ *   how long it sat queued.
+ * - `CeilingReapplyingSpanProcessor` wraps the real span processor. Its
+ *   `onEnd` performs the same re-check at the moment a span is handed off
+ *   for export, closing the narrower window between when a long-running
+ *   operation's attributes were set and when `span.end()` is finally
+ *   called.
+ *
+ * Both are no-ops when the current snapshot still authorizes everything
+ * already on the span, so a session whose lease never changes exports
+ * exactly what it would have exported before this module existed.
+ *
+ * This is a privacy boundary, so re-governance fails CLOSED in two tiers
+ * rather than fail-open. A policy-lookup or re-governance failure used to
+ * leave a span exactly as it was, after which it would export with content
+ * the current lease may have revoked. Instead:
+ *
+ * 1. Replace the attributes with the same withheld-content markers
+ *    `projectTelemetryContent` produces for a disallowed capture mode. This
+ *    keeps the span itself -- name, timing, status, parent/child structure
+ *    -- which is the point of the telemetry, while guaranteeing no governed
+ *    content ships.
+ * 2. Only if even that replacement cannot be written is the span dropped
+ *    outright: the exporter filters it out and the processor never queues
+ *    it. A batch left empty by privacy drops reports `SUCCESS`, not
+ *    `FAILED` -- the drop is a deliberate, permanent verdict, and `FAILED`
+ *    would have `BatchSpanProcessor` treat it as a retryable transport
+ *    problem.
+ */
+import type { Context } from '@opentelemetry/api';
+import type { ExportResult } from '@opentelemetry/core';
+import type { ReadableSpan, Span, SpanExporter, SpanProcessor } from '@opentelemetry/sdk-trace-base';
+import type { ArmorIQTelemetryRuntime } from './otel-runtime';
+/**
+ * Re-govern span attributes against the CURRENT lease before shipping.
+ *
+ * This is the true export-time gate: `export` runs whenever the wrapped
+ * batching processor actually flushes its buffer, so a span that has been
+ * queued for any length of time is re-evaluated against the lease that is
+ * authoritative right now, not the one that was authoritative when it was
+ * created or ended.
+ */
+export declare class CeilingReapplyingSpanExporter implements SpanExporter {
+    private readonly exporter;
+    private readonly runtime;
+    constructor(exporter: SpanExporter, runtime: ArmorIQTelemetryRuntime);
+    export(spans: ReadableSpan[], resultCallback: (result: ExportResult) => void): void;
+    shutdown(): Promise<void>;
+    forceFlush(): Promise<void>;
+}
+/**
+ * Re-govern span attributes at the `onEnd` hand-off boundary.
+ *
+ * Complements `CeilingReapplyingSpanExporter`: this closes the window
+ * between when a span's attributes were last set (which can be well before
+ * a long-running operation actually calls `span.end()`) and when it is
+ * handed to the wrapped processor for batching. `shutdown`/`forceFlush`
+ * delegate to the wrapped processor unchanged -- this class only adds a
+ * re-governance step, it does not change close/flush lifecycle semantics.
+ */
+export declare class CeilingReapplyingSpanProcessor implements SpanProcessor {
+    private readonly processor;
+    private readonly runtime;
+    constructor(processor: SpanProcessor, runtime: ArmorIQTelemetryRuntime);
+    onStart(span: Span, parentContext: Context): void;
+    onEnd(span: ReadableSpan): void;
+    shutdown(): Promise<void>;
+    forceFlush(): Promise<void>;
+}
+//# sourceMappingURL=otel-export-ceiling.d.ts.map

package/dist/observability/otel-export-ceiling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"otel-export-ceiling.d.ts","sourceRoot":"","sources":["../../src/observability/otel-export-ceiling.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAErG,OAAO,KAAK,EAAE,uBAAuB,EAA2B,MAAM,gBAAgB,CAAC;AAiIvF;;;;;;;;GAQG;AACH,qBAAa,6BAA8B,YAAW,YAAY;IAE9D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,uBAAuB;IAGnD,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,cAAc,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,GAAG,IAAI;IAcnF,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAIzB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CAG5B;AAED;;;;;;;;;GASG;AACH,qBAAa,8BAA+B,YAAW,aAAa;IAEhE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,uBAAuB;IAGnD,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,GAAG,IAAI;IAIjD,KAAK,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAU/B,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAIzB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CAG5B"}

package/dist/observability/otel-export-ceiling.js

@@ -0,0 +1,271 @@
+"use strict";
+/**
+ * Export-time capture-mode ceiling re-application for buffered spans.
+ *
+ * `ArmorIQTelemetryRuntime.safeAttributes` (otel-runtime.ts) already governs
+ * what a span is *allowed to receive* at the moment its attributes are set,
+ * using whatever policy lease was current at that instant. That is not
+ * enough on its own: `BatchSpanProcessor` buffers ended spans in memory and
+ * ships them later, on a timer or when the queue fills. A span populated
+ * with rich content under an `enhanced`/`debug` lease can still be sitting
+ * in that buffer, un-exported, when the organization's lease becomes
+ * stricter -- because the policy changed, or because a refresh came back
+ * lower after the previous lease expired. Without a check at the moment
+ * spans actually leave the process, the stale, too-permissive attributes
+ * baked onto the span at creation time would still ship, even though the
+ * CURRENT lease no longer authorizes them.
+ *
+ * This module closes that gap at two points, both delegating to the exact
+ * same governance the runtime uses at span-creation time
+ * (`ArmorIQTelemetryRuntime.currentCeilingSnapshot` /
+ * `reapplyContentCeiling`, which in turn shares `contentAuthority` with
+ * `safeAttributesWithAuthority`), so there is exactly one place that defines
+ * "what counts as content" and "what survives a given capture mode":
+ *
+ * - `CeilingReapplyingSpanExporter` wraps the real span exporter. Its
+ *   `export` re-reads the current policy snapshot immediately before
+ *   handing spans to the wrapped exporter -- this runs whenever the
+ *   batching processor actually flushes, so it catches a span regardless of
+ *   how long it sat queued.
+ * - `CeilingReapplyingSpanProcessor` wraps the real span processor. Its
+ *   `onEnd` performs the same re-check at the moment a span is handed off
+ *   for export, closing the narrower window between when a long-running
+ *   operation's attributes were set and when `span.end()` is finally
+ *   called.
+ *
+ * Both are no-ops when the current snapshot still authorizes everything
+ * already on the span, so a session whose lease never changes exports
+ * exactly what it would have exported before this module existed.
+ *
+ * This is a privacy boundary, so re-governance fails CLOSED in two tiers
+ * rather than fail-open. A policy-lookup or re-governance failure used to
+ * leave a span exactly as it was, after which it would export with content
+ * the current lease may have revoked. Instead:
+ *
+ * 1. Replace the attributes with the same withheld-content markers
+ *    `projectTelemetryContent` produces for a disallowed capture mode. This
+ *    keeps the span itself -- name, timing, status, parent/child structure
+ *    -- which is the point of the telemetry, while guaranteeing no governed
+ *    content ships.
+ * 2. Only if even that replacement cannot be written is the span dropped
+ *    outright: the exporter filters it out and the processor never queues
+ *    it. A batch left empty by privacy drops reports `SUCCESS`, not
+ *    `FAILED` -- the drop is a deliberate, permanent verdict, and `FAILED`
+ *    would have `BatchSpanProcessor` treat it as a retryable transport
+ *    problem.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CeilingReapplyingSpanProcessor = exports.CeilingReapplyingSpanExporter = void 0;
+const core_1 = require("@opentelemetry/core");
+const content_capture_1 = require("./content-capture");
+/** The reason recorded when even the ceiling itself could not be resolved. */
+const POLICY_UNAVAILABLE_AUTHORITY = {
+    mode: 'off',
+    external: false,
+    contentAllowed: false,
+    reasonCode: 'policy_unavailable',
+};
+function hasOwn(value, key) {
+    return Object.prototype.hasOwnProperty.call(value, key);
+}
+/**
+ * Overwrite an already-ended span's attribute mapping in place.
+ *
+ * Unlike OpenTelemetry Python's `BoundedAttributes` (which freezes on
+ * `span.end()` and requires an unsupported private-field thaw), the Node SDK
+ * keeps a completed span's `attributes` as a plain, ordinarily-mutable
+ * object -- there is no supported *setter*, but replacing its contents does
+ * not require fighting an immutability flag. A test that wants to prove the
+ * mutation-failure tier freezes that object (`Object.freeze(span.attributes)`),
+ * which makes the `delete`/assign below throw, exactly like a real
+ * environment where some other guard made the object non-writable.
+ *
+ * Returns true when the span now carries exactly `attributes`.
+ */
+function writeAttributes(span, attributes) {
+    try {
+        const target = span;
+        if (typeof target.attributes !== 'object' || target.attributes === null)
+            return false;
+        for (const key of Object.keys(target.attributes))
+            delete target.attributes[key];
+        Object.assign(target.attributes, attributes);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function attributesEqual(a, b) {
+    const aKeys = Object.keys(a);
+    if (aKeys.length !== Object.keys(b).length)
+        return false;
+    return aKeys.every((key) => hasOwn(b, key) && Object.is(a[key], b[key]));
+}
+/**
+ * Replace a span's attributes with the known-safe withheld marker set.
+ *
+ * Used when the ceiling itself could not be computed or applied: a policy
+ * lookup or re-governance failure must never leave the stale, possibly
+ * unauthorized attributes in place. Nothing the lease might no longer
+ * authorize survives -- every content-scoped key is replaced with the exact
+ * placeholders `projectTelemetryContent` writes for a disallowed capture
+ * mode, reported under `policy_unavailable` since the real reason could not
+ * be determined. Non-content attributes (tool name, durations, ids, ...)
+ * are untouched: they are not content, so a failure to re-govern content
+ * does not require rewriting them.
+ *
+ * Returns true when the span is safe to export, false when it must be
+ * dropped because even this replacement could not be written.
+ */
+function withholdContent(span, currentAttributes) {
+    try {
+        const hasInput = hasOwn(currentAttributes, 'gen_ai.input.messages') || hasOwn(currentAttributes, 'armoriq.content.input');
+        const hasOutput = hasOwn(currentAttributes, 'gen_ai.output.messages') || hasOwn(currentAttributes, 'armoriq.content.output');
+        const hasToolArguments = hasOwn(currentAttributes, 'gen_ai.tool.call.arguments');
+        const hasToolResult = hasOwn(currentAttributes, 'gen_ai.tool.call.result');
+        const hasErrorSummary = hasOwn(currentAttributes, 'armoriq.observability.error.summary');
+        const presence = {};
+        if (hasInput)
+            presence.input = undefined;
+        if (hasOutput)
+            presence.output = undefined;
+        if (hasToolArguments)
+            presence.toolArguments = undefined;
+        if (hasToolResult)
+            presence.toolResult = undefined;
+        if (hasErrorSummary)
+            presence.errorSummary = undefined;
+        const projected = (0, content_capture_1.projectTelemetryContent)(presence, POLICY_UNAVAILABLE_AUTHORITY);
+        const next = { ...currentAttributes };
+        // Unconditional: every content-scoped key is cleared regardless of which
+        // fields were present, so an error-summary-only span (no input/output/
+        // tool-call keys at all) is still fully purged.
+        for (const key of content_capture_1.CONTENT_ATTRIBUTE_KEYS)
+            delete next[key];
+        Object.assign(next, projected.attributes);
+        return writeAttributes(span, next);
+    }
+    catch {
+        // Even reading which content keys are present failed. Nothing on this
+        // span can be inspected, so nothing on it can be cleared selectively;
+        // strip it to the empty attribute set.
+        return writeAttributes(span, {});
+    }
+}
+/**
+ * Recompute one span's attributes under the policy current right now.
+ *
+ * Returns true when the span may be exported, false when it must be
+ * dropped.
+ */
+function reapplyCeiling(runtime, span) {
+    let currentAttributes;
+    try {
+        currentAttributes = { ...(span.attributes ?? {}) };
+    }
+    catch {
+        // The span's own attribute mapping is unreadable. Nothing on it can be
+        // inspected, so nothing on it can be cleared selectively.
+        return writeAttributes(span, {});
+    }
+    let governed;
+    try {
+        const snapshot = runtime.currentCeilingSnapshot();
+        governed = runtime.reapplyContentCeiling(snapshot, currentAttributes);
+        // A public span attribute can be forged, so `reapplyContentCeiling` drops
+        // the capture-diagnostic flags and re-derives only what re-binding proves.
+        // Restore the trusted facts a prior governance pass recorded privately for
+        // this span (kept only while content survives), then record the merged
+        // result so the next export-time pass carries it forward too.
+        Object.assign(governed, (0, content_capture_1.spanContentDiagnostics)(span, governed));
+        (0, content_capture_1.rememberSpanContentDiagnostics)(span, governed);
+    }
+    catch {
+        // Policy lookup or re-governance failed. Fail closed rather than ship
+        // the span exactly as it was.
+        return withholdContent(span, currentAttributes);
+    }
+    if (attributesEqual(governed, currentAttributes))
+        return true;
+    if (writeAttributes(span, governed))
+        return true;
+    // The rewrite that just failed is the only way to purge the stale
+    // attributes, so re-governing is impossible; drop rather than ship them.
+    return false;
+}
+/**
+ * Re-govern span attributes against the CURRENT lease before shipping.
+ *
+ * This is the true export-time gate: `export` runs whenever the wrapped
+ * batching processor actually flushes its buffer, so a span that has been
+ * queued for any length of time is re-evaluated against the lease that is
+ * authoritative right now, not the one that was authoritative when it was
+ * created or ended.
+ */
+class CeilingReapplyingSpanExporter {
+    exporter;
+    runtime;
+    constructor(exporter, runtime) {
+        this.exporter = exporter;
+        this.runtime = runtime;
+    }
+    export(spans, resultCallback) {
+        const exportable = spans.filter((span) => reapplyCeiling(this.runtime, span));
+        if (exportable.length === 0) {
+            // Every span was dropped for privacy. Report SUCCESS, not FAILED:
+            // FAILED tells BatchSpanProcessor the batch did not ship, which it
+            // treats as a retryable transport problem. A ceiling drop is a
+            // deliberate, permanent decision -- the span must never ship -- so a
+            // retry would be pointless work over the same verdict.
+            resultCallback({ code: core_1.ExportResultCode.SUCCESS });
+            return;
+        }
+        this.exporter.export(exportable, resultCallback);
+    }
+    shutdown() {
+        return this.exporter.shutdown();
+    }
+    forceFlush() {
+        return this.exporter.forceFlush ? this.exporter.forceFlush() : Promise.resolve();
+    }
+}
+exports.CeilingReapplyingSpanExporter = CeilingReapplyingSpanExporter;
+/**
+ * Re-govern span attributes at the `onEnd` hand-off boundary.
+ *
+ * Complements `CeilingReapplyingSpanExporter`: this closes the window
+ * between when a span's attributes were last set (which can be well before
+ * a long-running operation actually calls `span.end()`) and when it is
+ * handed to the wrapped processor for batching. `shutdown`/`forceFlush`
+ * delegate to the wrapped processor unchanged -- this class only adds a
+ * re-governance step, it does not change close/flush lifecycle semantics.
+ */
+class CeilingReapplyingSpanProcessor {
+    processor;
+    runtime;
+    constructor(processor, runtime) {
+        this.processor = processor;
+        this.runtime = runtime;
+    }
+    onStart(span, parentContext) {
+        this.processor.onStart(span, parentContext);
+    }
+    onEnd(span) {
+        if (!reapplyCeiling(this.runtime, span)) {
+            // Undeliverable: the span could not be re-governed and could not be
+            // stripped either. Never queue it -- once it is inside the wrapped
+            // processor's buffer this module cannot reach it again.
+            return;
+        }
+        this.processor.onEnd(span);
+    }
+    shutdown() {
+        return this.processor.shutdown();
+    }
+    forceFlush() {
+        return this.processor.forceFlush();
+    }
+}
+exports.CeilingReapplyingSpanProcessor = CeilingReapplyingSpanProcessor;
+//# sourceMappingURL=otel-export-ceiling.js.map