@armoriq/sdk-dev 0.6.10 → 0.8.0

package/dist/observability/otel-export-ceiling.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otel-export-ceiling.js","sourceRoot":"","sources":["../../src/observability/otel-export-ceiling.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;;;AAIH,8CAAuD;AAEvD,uDAAiM;AAGjM,8EAA8E;AAC9E,MAAM,4BAA4B,GAA4B;IAC5D,IAAI,EAAE,KAAK;IACX,QAAQ,EAAE,KAAK;IACf,cAAc,EAAE,KAAK;IACrB,UAAU,EAAE,oBAAoB;CACjC,CAAC;AAEF,SAAS,MAAM,CAAC,KAAwC,EAAE,GAAW;IACnE,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,eAAe,CAAC,IAAkB,EAAE,UAAmD;IAC9F,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAA0D,CAAC;QAC1E,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACtF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAChF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,CAAoC,EAAE,CAAoC;IACjG,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,eAAe,CAAC,IAAkB,EAAE,iBAAoD;IAC/F,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,IAAI,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;QAC1H,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,IAAI,MAAM,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;QAC7H,MAAM,gBAAgB,GAAG,MAAM,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;QACjF,MAAM,aAAa,GAAG,MAAM,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;QAC3E,MAAM,eAAe,GAAG,MAAM,CAAC,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;QACzF,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,IAAI,QAAQ;YAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAC;QACzC,IAAI,SAAS;YAAE,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC;QAC3C,IAAI,gBAAgB;YAAE,QAAQ,CAAC,aAAa,GAAG,SAAS,CAAC;QACzD,IAAI,aAAa;YAAE,QAAQ,CAAC,UAAU,GAAG,SAAS,CAAC;QACnD,IAAI,eAAe;YAAE,QAAQ,CAAC,YAAY,GAAG,SAAS,CAAC;QACvD,MAAM,SAAS,GAAG,IAAA,yCAAuB,EAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC;QAClF,MAAM,IAAI,GAA4B,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/D,yEAAyE;QACzE,uEAAuE;QACvE,gDAAgD;QAChD,KAAK,MAAM,GAAG,IAAI,wCAAsB;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;QAC1C,OAAO,eAAe,CAAC,IAAI,EAAE,IAA+C,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,sEAAsE;QACtE,uCAAuC;QACvC,OAAO,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,OAAgC,EAAE,IAAkB;IAC1E,IAAI,iBAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,iBAAiB,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,0DAA0D;QAC1D,OAAO,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,QAAiD,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC;QAClD,QAAQ,GAAG,OAAO,CAAC,qBAAqB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACtE,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,uEAAuE;QACvE,8DAA8D;QAC9D,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAA,wCAAsB,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChE,IAAA,gDAA8B,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,8BAA8B;QAC9B,OAAO,eAAe,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,eAAe,CAAC,QAAQ,EAAE,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,IAAI,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,kEAAkE;IAClE,yEAAyE;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAa,6BAA6B;IAErB;IACA;IAFnB,YACmB,QAAsB,EACtB,OAAgC;QADhC,aAAQ,GAAR,QAAQ,CAAc;QACtB,YAAO,GAAP,OAAO,CAAyB;IAChD,CAAC;IAEJ,MAAM,CAAC,KAAqB,EAAE,cAA8C;QAC1E,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,kEAAkE;YAClE,mEAAmE;YACnE,+DAA+D;YAC/D,qEAAqE;YACrE,uDAAuD;YACvD,cAAc,CAAC,EAAE,IAAI,EAAE,uBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACnD,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAClC,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACnF,CAAC;CACF;AA3BD,sEA2BC;AAED;;;;;;;;;GASG;AACH,MAAa,8BAA8B;IAEtB;IACA;IAFnB,YACmB,SAAwB,EACxB,OAAgC;QADhC,cAAS,GAAT,SAAS,CAAe;QACxB,YAAO,GAAP,OAAO,CAAyB;IAChD,CAAC;IAEJ,OAAO,CAAC,IAAU,EAAE,aAAsB;QACxC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,IAAkB;QACtB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YACxC,oEAAoE;YACpE,mEAAmE;YACnE,wDAAwD;YACxD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;IACnC,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;IACrC,CAAC;CACF;AA3BD,wEA2BC"}

package/dist/observability/otel-runtime.d.ts

@@ -0,0 +1,103 @@
+/** SDK-owned OpenTelemetry runtime. It never registers a global provider. */
+import type { Tracer } from '@opentelemetry/api';
+import { type ObservabilityOptions, type ResolvedOtelConfig } from './otel-config';
+import { type PolicyLease } from './policy-lease';
+import { type ContentCaptureAuthority } from './content-capture';
+export type TelemetryAttributeValue = string | number | boolean | string[];
+export type TelemetryAttributes = Readonly<Record<string, unknown>>;
+export interface AttributeContext {
+    traceName: string;
+    sessionId: string;
+    /** Caller must provide this deliberately. It is sanitized before export. */
+    userId?: string | null;
+}
+export interface TelemetryRuntimeOptions {
+    backendEndpoint: string;
+    apiKey: string;
+    sdkVersion: string;
+    options?: ObservabilityOptions;
+    /** Test/host hook; production defaults to the policy-lease HTTP endpoint. */
+    leaseFetcher?: (signal?: AbortSignal) => Promise<PolicyLease>;
+}
+/**
+ * Manages one private exporter, or borrows a caller-owned provider. A runtime
+ * is request/session scoped and `close()` is idempotent and fail-open.
+ */
+export declare class ArmorIQTelemetryRuntime {
+    readonly config: ResolvedOtelConfig;
+    private readonly backendEndpoint;
+    private readonly apiKey;
+    private readonly sdkVersion;
+    private readonly leaseFetcher?;
+    private lease;
+    private refreshing;
+    private firstExternalAuthorityAwaited;
+    private externalAuthorityUnavailable;
+    private nextRefreshAt;
+    private provider;
+    private policyLeaseAbort;
+    private readonly ownedAgents;
+    private closed;
+    constructor(options: TelemetryRuntimeOptions);
+    policySnapshot(options?: {
+        awaitFresh?: boolean;
+    }): Promise<PolicyLease>;
+    /** Start at most one control-plane request; request callers never await it. */
+    private refreshInBackground;
+    private applyCeiling;
+    /**
+     * The ceiling-applied lease this runtime already knows about, computed
+     * synchronously from whatever is cached. Never performs network I/O and
+     * never blocks: a batching span processor flushes on its own timer, from
+     * whatever thread that is, and must get an immediate answer. When nothing
+     * current is cached, this fails closed to the same `authoritative: false`
+     * fallback `policySnapshot()` uses, which `applyCeiling` maps to `off`.
+     *
+     * This is the true export-time gate's policy read: `CeilingReapplyingSpanExporter`
+     * and `CeilingReapplyingSpanProcessor` (otel-export-ceiling.ts) call it
+     * immediately before a buffered span is allowed to leave the process, so a
+     * span queued under a since-revoked lease is re-governed against whatever
+     * is authoritative right now -- not whatever was authoritative when the
+     * span was created or ended.
+     */
+    currentCeilingSnapshot(): PolicyLease;
+    /**
+     * Re-govern a span's already-baked attributes under a (possibly new)
+     * policy snapshot. Shares `contentAuthority` -- the exact function that
+     * decides content authority at span-creation time -- with
+     * `safeAttributesWithAuthority`, so there is exactly one place that
+     * defines "is content allowed right now." When it is, every content-bearing
+     * key present is re-bounded against the current mode's limits (via
+     * `reboundCapturedJson`): a session whose lease never changes and whose
+     * mode never changes must export exactly what it would have exported
+     * before this method existed, but content captured under debug's looser
+     * limits cannot keep those limits once the ceiling has downgraded to
+     * enhanced. When capture is not allowed at all, every key in
+     * `CONTENT_ATTRIBUTE_KEYS` present on the span is replaced with the same
+     * withheld-content markers `projectTelemetryContent` produces at creation
+     * time for a disallowed capture mode.
+     */
+    reapplyContentCeiling(snapshot: PolicyLease, attributes: TelemetryAttributes): Record<string, TelemetryAttributeValue>;
+    private fetchPolicyLease;
+    tracer(snapshot: PolicyLease): Tracer | null;
+    private privateProvider;
+    /**
+     * Construct the OTLP delegate from explicit values. The convenience
+     * exporter reads process.env while merging defaults, which could leak a
+     * caller's external headers into an ArmorIQ-only exporter.
+     */
+    private createExporter;
+    safeAttributes(snapshot: PolicyLease, attributes: TelemetryAttributes, context: AttributeContext): Record<string, TelemetryAttributeValue>;
+    /** Final tool boundary: retain safe lifecycle facts and content-state markers even when capture is now off. */
+    finalToolAttributes(snapshot: PolicyLease, attributes: TelemetryAttributes, context: AttributeContext): Record<string, TelemetryAttributeValue>;
+    private safeAttributesWithAuthority;
+    private externalAttributeAllowed;
+    /** Shared by span-creation attribute assembly and export-time re-governance. */
+    contentAuthority(snapshot: PolicyLease, external: boolean): ContentCaptureAuthority;
+    private extractContent;
+    /** Stable, externally safe root span names prevent identifier leakage. */
+    externalTraceName(value: string): string;
+    forceFlush(): Promise<void>;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=otel-runtime.d.ts.map

package/dist/observability/otel-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"otel-runtime.d.ts","sourceRoot":"","sources":["../../src/observability/otel-runtime.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAE7E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAOjD,OAAO,EAIL,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AACvB,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAML,KAAK,uBAAuB,EAG7B,MAAM,mBAAmB,CAAC;AAI3B,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC;AAC3E,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,6EAA6E;IAC7E,YAAY,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CAC/D;AAkLD;;;GAGG;AACH,qBAAa,uBAAuB;IAClC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAiD;IAC/E,OAAO,CAAC,KAAK,CAA4B;IACzC,OAAO,CAAC,UAAU,CAAqC;IACvD,OAAO,CAAC,6BAA6B,CAAS;IAC9C,OAAO,CAAC,4BAA4B,CAAS;IAC7C,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,QAAQ,CAAmC;IACnD,OAAO,CAAC,gBAAgB,CAAgC;IACxD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAyB;IACrD,OAAO,CAAC,MAAM,CAAS;gBAEX,OAAO,EAAE,uBAAuB;IAWtC,cAAc,CAAC,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IA4BlF,+EAA+E;IAC/E,OAAO,CAAC,mBAAmB;IAe3B,OAAO,CAAC,YAAY;IA6CpB;;;;;;;;;;;;;;OAcG;IACH,sBAAsB,IAAI,WAAW;IAcrC;;;;;;;;;;;;;;;OAeG;IACH,qBAAqB,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC;YA+DxG,gBAAgB;IAqB9B,MAAM,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI;IAY5C,OAAO,CAAC,eAAe;IAsCvB;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAmBtB,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,mBAAmB,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC;IAI1I,+GAA+G;IAC/G,mBAAmB,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,mBAAmB,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC;IAI/I,OAAO,CAAC,2BAA2B;IAmDnC,OAAO,CAAC,wBAAwB;IAMhC,gFAAgF;IAChF,gBAAgB,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,GAAG,uBAAuB;IAgBnF,OAAO,CAAC,cAAc;IAkBtB,0EAA0E;IAC1E,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAKlC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAS3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAwB7B"}