@armoriq/sdk-dev 0.6.10 → 0.8.0

package/dist/observability/otel-runtime.js

@@ -0,0 +1,680 @@
+"use strict";
+/** SDK-owned OpenTelemetry runtime. It never registers a global provider. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ArmorIQTelemetryRuntime = void 0;
+const sdk_trace_base_1 = require("@opentelemetry/sdk-trace-base");
+const sdk_trace_node_1 = require("@opentelemetry/sdk-trace-node");
+const resources_1 = require("@opentelemetry/resources");
+const otlp_exporter_base_1 = require("@opentelemetry/otlp-exporter-base");
+const node_http_1 = require("@opentelemetry/otlp-exporter-base/node-http");
+const otlp_transformer_1 = require("@opentelemetry/otlp-transformer");
+const otel_config_1 = require("./otel-config");
+const policy_lease_1 = require("./policy-lease");
+const content_capture_1 = require("./content-capture");
+const otel_shutdown_1 = require("./otel-shutdown");
+const otel_export_ceiling_1 = require("./otel-export-ceiling");
+const SENSITIVE_KEY = /(?:api[_-]?key|auth(?:orization)?|bearer|cookie|credential|password|passphrase|secret|private[_-]?key|ssn|card(?:_number)?)/i;
+const SECRET_TOKEN_KEY = /(?:^|[_.-])token(?:$|[_.-])/i;
+const USAGE_TOKEN_KEY = /^gen_ai\.usage\.(?:input|output|cache_read|cache_write)_tokens$/;
+const EXTERNAL_SAFE_NUMBER_ATTRIBUTES = new Set([
+    'armoriq.intent_plan_item_count',
+    'armoriq.intent_plan_item_ordinal',
+    'armoriq.duration_ms',
+    'armoriq.command.exit_code',
+    'armoriq.execution.retry_count',
+    'armoriq.execution.timeout',
+    'armoriq.output.stdout_bytes',
+    'armoriq.output.stderr_bytes',
+    'armoriq.approval.wait_ms',
+    'gen_ai.usage.cost_usd',
+    'armoriq.timing.provenance',
+    'armoriq.cost.provenance',
+]);
+// Finish reasons are low-cardinality metadata. Keep at most 16 values and
+// inspect no more than 64 candidates so one adapter value cannot become a
+// large telemetry payload or an unbounded sanitization loop.
+const MAX_FINISH_REASONS = 16;
+const MAX_FINISH_REASON_CANDIDATES = 64;
+const SENSITIVE_VALUE = /(?:\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b|\b(?:ak|sk|pk|rk|ghp|github_pat)_[A-Za-z0-9_-]{12,}\b|-----BEGIN [A-Z0-9 ]+-----)/i;
+const EMAIL = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i;
+const CONTENT_KEY = /^(?:armoriq\.(?:content\.|observability\.error\.summary$)|gen_ai\.(?:prompt|completion|input\.messages|output\.messages|tool\.(?:args|arguments|result|call\.(?:arguments|result))))$/;
+const EXTERNAL_METADATA_ATTRIBUTES = new Set([
+    'gen_ai.request.model',
+    'gen_ai.response.model',
+    'gen_ai.system',
+    'gen_ai.operation.name',
+    'gen_ai.agent.name',
+    'gen_ai.response.finish_reasons',
+    'gen_ai.tool.name',
+    'gen_ai.tool.call.id',
+    'gen_ai.usage.input_tokens',
+    'gen_ai.usage.output_tokens',
+    'gen_ai.usage.cache_read_tokens',
+    'gen_ai.usage.cache_write_tokens',
+    'gen_ai.usage.cost_usd',
+    'armoriq.timing.provenance',
+    'armoriq.cost.provenance',
+    'gen_ai.task.outcome',
+    'error.type',
+    'armoriq.intent_plan_item_count',
+    'armoriq.intent_plan_item_ordinal',
+    'armoriq.duration_ms',
+    'armoriq.tool.name',
+    'armoriq.tool.type',
+    'armoriq.tool.call_id',
+    'armoriq.tool.outcome',
+    'armoriq.operation.category',
+    'armoriq.mcp.server',
+    'armoriq.intent_plan_id',
+    'armoriq.intent_plan_item_id',
+    'process.executable.name',
+    'armoriq.command.exit_code',
+    'armoriq.execution.retry_count',
+    'armoriq.execution.timeout',
+    'armoriq.execution.killed',
+    'armoriq.output.stdout_bytes',
+    'armoriq.output.stderr_bytes',
+    'armoriq.output.truncated',
+    'armoriq.delegation.id',
+    'armoriq.delegation.outcome',
+    'armoriq.approval.outcome',
+    'armoriq.approval.wait_ms',
+    'armoriq.observability.capture.mode',
+    'armoriq.observability.policy.revision',
+    'armoriq.observability.content.input.state',
+    'armoriq.observability.content.input.reason_code',
+    'armoriq.observability.content.output.state',
+    'armoriq.observability.content.output.reason_code',
+    'armoriq.observability.content.tool_arguments.state',
+    'armoriq.observability.content.tool_arguments.reason_code',
+    'armoriq.observability.content.tool_result.state',
+    'armoriq.observability.content.tool_result.reason_code',
+    'armoriq.observability.error.summary',
+    'armoriq.observability.error.summary.state',
+    'armoriq.observability.error.summary.reason_code',
+    'armoriq.observability.content.reason_code',
+    'armoriq.observability.redaction.applied',
+    'armoriq.observability.content.truncated',
+]);
+const GEN_AI_OPERATION_NAMES = new Set([
+    'chat',
+    'generate_content',
+    'text_completion',
+    'embeddings',
+    'create_agent',
+    'invoke_agent',
+    'invoke_workflow',
+    'plan',
+    'execute_tool',
+]);
+const EXTERNAL_POLICY_METADATA_ATTRIBUTES = new Set([
+    'armoriq.policy.name', 'armoriq.policy.decision', 'armoriq.policy.source',
+    'armoriq.policy.reason_code', 'armoriq.policy.default_action',
+]);
+const EXTERNAL_POLICY_ENHANCED_ATTRIBUTES = new Set(['armoriq.policy.version']);
+const EXTERNAL_POLICY_DEBUG_ATTRIBUTES = new Set(['armoriq.policy.id', 'armoriq.policy.rule_id']);
+const EXTERNAL_CONTENT_ATTRIBUTES = new Set([
+    'gen_ai.input.messages', 'gen_ai.output.messages',
+    'gen_ai.tool.call.arguments', 'gen_ai.tool.call.result',
+]);
+const CLOSE_DEADLINE_MS = 1_500;
+const FIRST_EXTERNAL_AUTHORITY_WAIT_MS = 1_400;
+function bounded(promise, timeoutMillis = CLOSE_DEADLINE_MS) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => resolve(undefined), timeoutMillis);
+        promise.then((value) => {
+            clearTimeout(timer);
+            resolve(value);
+        }, (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+    });
+}
+function cleanString(value, length = 256) {
+    if (SENSITIVE_VALUE.test(value))
+        return '[REDACTED:CREDENTIAL]';
+    if (EMAIL.test(value))
+        return '[REDACTED:EMAIL]';
+    return value.slice(0, length);
+}
+function safeValue(key, value, external) {
+    if (SENSITIVE_KEY.test(key) || (SECRET_TOKEN_KEY.test(key) && !USAGE_TOKEN_KEY.test(key))) {
+        return '[REDACTED:SENSITIVE_KEY]';
+    }
+    if (key === 'gen_ai.response.finish_reasons') {
+        if (!Array.isArray(value))
+            return undefined;
+        const reasons = [];
+        for (const reason of value.slice(0, MAX_FINISH_REASON_CANDIDATES)) {
+            if (typeof reason !== 'string')
+                continue;
+            const sanitized = external ? (0, otel_config_1.sanitizeExternalTelemetryValue)(reason, 256) : cleanString(reason);
+            if (sanitized !== undefined)
+                reasons.push(sanitized);
+            if (reasons.length === MAX_FINISH_REASONS)
+                break;
+        }
+        return reasons;
+    }
+    if (typeof value === 'string') {
+        if (external && key === 'armoriq.intent_plan_id' && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value))
+            return value;
+        if (external)
+            return (0, otel_config_1.sanitizeExternalTelemetryValue)(value, CONTENT_KEY.test(key) ? 8 * 1024 : 256);
+        return cleanString(value, CONTENT_KEY.test(key) ? 4096 : 256);
+    }
+    if (typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number' && Number.isFinite(value)) {
+        // External numeric attributes are limited to semantic token counters.
+        // Other numeric values may be customer identifiers with no useful key hint.
+        if (external &&
+            !USAGE_TOKEN_KEY.test(key) &&
+            !EXTERNAL_SAFE_NUMBER_ATTRIBUTES.has(key))
+            return undefined;
+        return value;
+    }
+    return undefined;
+}
+function validExternalId(value) {
+    return /^[A-Za-z0-9][A-Za-z0-9._:/@+-]{0,127}$/.test(value) && (0, otel_config_1.sanitizeExternalTelemetryValue)(value, 128) !== undefined;
+}
+function hasOwn(value, key) {
+    return Object.prototype.hasOwnProperty.call(value, key);
+}
+/**
+ * Manages one private exporter, or borrows a caller-owned provider. A runtime
+ * is request/session scoped and `close()` is idempotent and fail-open.
+ */
+class ArmorIQTelemetryRuntime {
+    config;
+    backendEndpoint;
+    apiKey;
+    sdkVersion;
+    leaseFetcher;
+    lease = null;
+    refreshing = null;
+    firstExternalAuthorityAwaited = false;
+    externalAuthorityUnavailable = false;
+    nextRefreshAt = 0;
+    provider = null;
+    policyLeaseAbort = null;
+    ownedAgents = new Set();
+    closed = false;
+    constructor(options) {
+        this.config = (0, otel_config_1.resolveOtelConfig)(options.options);
+        this.backendEndpoint = options.backendEndpoint.replace(/\/$/, '');
+        this.apiKey = options.apiKey;
+        this.sdkVersion = options.sdkVersion;
+        this.leaseFetcher = options.leaseFetcher;
+        if (this.config.enabled && this.config.exporter !== 'provider') {
+            (0, otel_shutdown_1.registerOwnedTelemetryRuntime)(this);
+        }
+    }
+    async policySnapshot(options = {}) {
+        if (!this.config.enabled || this.closed)
+            return Object.freeze({ ...(0, policy_lease_1.fallbackPolicyLease)(), captureMode: 'off' });
+        if (this.externalAuthorityUnavailable && this.config.exporter === 'external') {
+            return Object.freeze({ ...(0, policy_lease_1.fallbackPolicyLease)(), captureMode: 'off' });
+        }
+        if (!options.awaitFresh && this.lease?.authoritative && (0, policy_lease_1.isLeaseCurrent)(this.lease))
+            return this.applyCeiling(this.lease);
+        const refresh = this.refreshInBackground(options.awaitFresh === true);
+        const mustAwaitExternalAuthority = this.config.exporter === 'external' && !this.firstExternalAuthorityAwaited;
+        if (mustAwaitExternalAuthority)
+            this.firstExternalAuthorityAwaited = true;
+        if ((options.awaitFresh || mustAwaitExternalAuthority) && refresh) {
+            const fresh = await bounded(refresh, mustAwaitExternalAuthority ? FIRST_EXTERNAL_AUTHORITY_WAIT_MS : CLOSE_DEADLINE_MS);
+            if (fresh) {
+                this.lease = fresh;
+                if (mustAwaitExternalAuthority && !fresh.authoritative) {
+                    this.externalAuthorityUnavailable = true;
+                    return Object.freeze({ ...fresh, captureMode: 'off' });
+                }
+                return this.applyCeiling(this.lease);
+            }
+            if (mustAwaitExternalAuthority) {
+                this.externalAuthorityUnavailable = true;
+                this.policyLeaseAbort?.abort();
+            }
+            return this.applyCeiling((0, policy_lease_1.fallbackPolicyLease)());
+        }
+        return this.applyCeiling(this.lease && (0, policy_lease_1.isLeaseCurrent)(this.lease) ? this.lease : (0, policy_lease_1.fallbackPolicyLease)());
+    }
+    /** Start at most one control-plane request; request callers never await it. */
+    refreshInBackground(force = false) {
+        if (this.refreshing)
+            return this.refreshing;
+        if (!force && Date.now() < this.nextRefreshAt)
+            return null;
+        this.nextRefreshAt = Date.now() + 1_000;
+        this.refreshing = this.fetchPolicyLease()
+            .then((lease) => {
+            this.lease = lease;
+            return lease;
+        })
+            .finally(() => {
+            this.refreshing = null;
+        });
+        return this.refreshing;
+    }
+    applyCeiling(lease) {
+        let captureMode = (0, otel_config_1.lowerCaptureMode)(lease.captureMode, this.config.captureMode);
+        // No destination — including the first-party ArmorIQ exporter — may
+        // create or export a span until current organization authority permits
+        // it. `fallbackPolicyLease()` is a guess, not an answer: creating a span
+        // under it and only finding out afterward that the organization's real
+        // (in-flight) answer is `off` would export telemetry the org disabled,
+        // with no way to retroactively un-create it. Fail closed instead;
+        // `policySnapshot()`'s background refresh means this self-corrects on
+        // the next call once a real answer arrives, without ever blocking here.
+        if (!lease.authoritative) {
+            captureMode = 'off';
+        }
+        const debugExpired = captureMode === 'debug' && (!lease.debugExpiresAt || lease.debugExpiresAt.getTime() <= Date.now());
+        if (debugExpired)
+            captureMode = 'enhanced';
+        if (this.config.exporter === 'provider') {
+            // Provider mode hands spans to a TracerProvider the caller owns and
+            // configured. The export-time ceiling wrappers below are attached only
+            // to the pipeline this SDK builds for itself, so they never see spans
+            // once they are queued inside the caller's own BatchSpanProcessor --
+            // mutating a caller-owned provider to attach them would break the
+            // ownership contract. Rather than promise a revocation guarantee this
+            // SDK cannot enforce on a pipeline it does not own, provider mode is
+            // capped at `metadata` here, at the one place that decides capture
+            // mode for every destination: governed content is then never captured
+            // in the first place, so none can ever be sitting in that queue when a
+            // lease flips.
+            captureMode = (0, otel_config_1.lowerCaptureMode)(captureMode, 'metadata');
+        }
+        const externalContentAllowed = lease.authoritative
+            && (captureMode === 'enhanced' || captureMode === 'debug')
+            && lease.contentCaptureAllowed
+            && lease.externalContentCaptureAllowed
+            && !debugExpired;
+        const contentReasonCode = captureMode === 'off'
+            ? 'capture_mode_off'
+            : captureMode === 'metadata'
+                ? 'capture_mode_metadata'
+                : debugExpired ? 'policy_expired'
+                    : !lease.contentCaptureAllowed ? 'organization_content_disabled'
+                        : !lease.externalContentCaptureAllowed ? 'external_content_disabled'
+                            : lease.authoritative ? 'captured' : 'policy_unavailable';
+        return Object.freeze({ ...lease, captureMode, externalContentAllowed, contentReasonCode });
+    }
+    /**
+     * The ceiling-applied lease this runtime already knows about, computed
+     * synchronously from whatever is cached. Never performs network I/O and
+     * never blocks: a batching span processor flushes on its own timer, from
+     * whatever thread that is, and must get an immediate answer. When nothing
+     * current is cached, this fails closed to the same `authoritative: false`
+     * fallback `policySnapshot()` uses, which `applyCeiling` maps to `off`.
+     *
+     * This is the true export-time gate's policy read: `CeilingReapplyingSpanExporter`
+     * and `CeilingReapplyingSpanProcessor` (otel-export-ceiling.ts) call it
+     * immediately before a buffered span is allowed to leave the process, so a
+     * span queued under a since-revoked lease is re-governed against whatever
+     * is authoritative right now -- not whatever was authoritative when the
+     * span was created or ended.
+     */
+    currentCeilingSnapshot() {
+        if (!this.config.enabled) {
+            return this.applyCeiling(Object.freeze({ ...(0, policy_lease_1.fallbackPolicyLease)(), captureMode: 'off' }));
+        }
+        if (this.lease && (0, policy_lease_1.isLeaseCurrent)(this.lease))
+            return this.applyCeiling(this.lease);
+        if (this.closed) {
+            return this.applyCeiling(Object.freeze({ ...(0, policy_lease_1.fallbackPolicyLease)(), captureMode: 'off' }));
+        }
+        // Cache is missing or stale. Kick a background refresh for the *next*
+        // export to see, but this call itself must never block on it.
+        this.refreshInBackground(false);
+        return this.applyCeiling((0, policy_lease_1.fallbackPolicyLease)());
+    }
+    /**
+     * Re-govern a span's already-baked attributes under a (possibly new)
+     * policy snapshot. Shares `contentAuthority` -- the exact function that
+     * decides content authority at span-creation time -- with
+     * `safeAttributesWithAuthority`, so there is exactly one place that
+     * defines "is content allowed right now." When it is, every content-bearing
+     * key present is re-bounded against the current mode's limits (via
+     * `reboundCapturedJson`): a session whose lease never changes and whose
+     * mode never changes must export exactly what it would have exported
+     * before this method existed, but content captured under debug's looser
+     * limits cannot keep those limits once the ceiling has downgraded to
+     * enhanced. When capture is not allowed at all, every key in
+     * `CONTENT_ATTRIBUTE_KEYS` present on the span is replaced with the same
+     * withheld-content markers `projectTelemetryContent` produces at creation
+     * time for a disallowed capture mode.
+     */
+    reapplyContentCeiling(snapshot, attributes) {
+        const external = this.config.exporter === 'external' || this.config.exporter === 'provider';
+        const authority = this.contentAuthority(snapshot, external);
+        const canCapture = authority.contentAllowed && (authority.mode === 'enhanced' || authority.mode === 'debug');
+        if (canCapture) {
+            const next = { ...attributes };
+            // A public span attribute can be forged by any framework adapter or
+            // caller, so the two capture-diagnostic flags are never trusted here.
+            // Drop whatever the span carries and re-derive the facts from actually
+            // re-binding the captured content under this ceiling. The trusted facts
+            // recorded by a prior governance pass are restored separately from the
+            // private per-span record (see reapplyCeiling in otel-export-ceiling.ts).
+            delete next[content_capture_1.ATTR_REDACTION_APPLIED];
+            delete next[content_capture_1.ATTR_CONTENT_TRUNCATED];
+            let truncated = false;
+            let redacted = false;
+            for (const key of [
+                'gen_ai.input.messages', 'gen_ai.output.messages',
+                'gen_ai.tool.call.arguments', 'gen_ai.tool.call.result',
+                'armoriq.content.input', 'armoriq.content.output',
+                'armoriq.observability.error.summary',
+            ]) {
+                const value = next[key];
+                if (typeof value !== 'string')
+                    continue;
+                const rebound = (0, content_capture_1.reboundCapturedJson)(value, authority.mode);
+                next[key] = rebound.value;
+                truncated ||= rebound.truncated;
+                redacted ||= rebound.redacted;
+            }
+            if (redacted)
+                next[content_capture_1.ATTR_REDACTION_APPLIED] = true;
+            if (truncated)
+                next[content_capture_1.ATTR_CONTENT_TRUNCATED] = true;
+            return next;
+        }
+        const hasInput = hasOwn(attributes, 'gen_ai.input.messages') || hasOwn(attributes, 'armoriq.content.input');
+        const hasOutput = hasOwn(attributes, 'gen_ai.output.messages') || hasOwn(attributes, 'armoriq.content.output');
+        const hasToolArguments = hasOwn(attributes, 'gen_ai.tool.call.arguments');
+        const hasToolResult = hasOwn(attributes, 'gen_ai.tool.call.result');
+        // A span whose only governed field is an error summary (e.g. a
+        // zero-argument tool/policy check that later errors) still needs
+        // purging: `armoriq.observability.error.summary` is real, only
+        // lightly-redacted error-message text, and its presence is itself proof
+        // the span was captured under an enhanced/debug lease.
+        const hasErrorSummary = hasOwn(attributes, 'armoriq.observability.error.summary');
+        if (!hasInput && !hasOutput && !hasToolArguments && !hasToolResult && !hasErrorSummary) {
+            // Nothing governed is present on this span to purge (it was already
+            // metadata-only, or off, when it was created).
+            return { ...attributes };
+        }
+        const presence = {};
+        if (hasInput)
+            presence.input = undefined;
+        if (hasOutput)
+            presence.output = undefined;
+        if (hasToolArguments)
+            presence.toolArguments = undefined;
+        if (hasToolResult)
+            presence.toolResult = undefined;
+        if (hasErrorSummary)
+            presence.errorSummary = undefined;
+        const projected = (0, content_capture_1.projectTelemetryContent)(presence, authority);
+        const next = { ...attributes };
+        for (const key of content_capture_1.CONTENT_ATTRIBUTE_KEYS)
+            delete next[key];
+        Object.assign(next, projected.attributes);
+        next['armoriq.observability.capture.mode'] = snapshot.captureMode;
+        next['armoriq.observability.policy.revision'] = snapshot.revision;
+        return next;
+    }
+    async fetchPolicyLease() {
+        const controller = new AbortController();
+        this.policyLeaseAbort = controller;
+        const timeout = setTimeout(() => controller.abort(), 5_000);
+        try {
+            if (this.leaseFetcher)
+                return await this.leaseFetcher(controller.signal);
+            const response = await fetch(`${this.backendEndpoint}/observability/policy/lease`, {
+                headers: { 'X-API-Key': this.apiKey },
+                signal: controller.signal,
+            });
+            if (!response.ok)
+                throw new Error(`policy lease rejected (${response.status})`);
+            return (0, policy_lease_1.parsePolicyLease)(await response.json());
+        }
+        catch {
+            // Never alter the application result because telemetry is unavailable.
+            return (0, policy_lease_1.fallbackPolicyLease)();
+        }
+        finally {
+            clearTimeout(timeout);
+            if (this.policyLeaseAbort === controller)
+                this.policyLeaseAbort = null;
+        }
+    }
+    tracer(snapshot) {
+        if (this.closed || !this.config.enabled || snapshot.captureMode === 'off' || !(0, policy_lease_1.isLeaseCurrent)(snapshot))
+            return null;
+        try {
+            if (this.config.exporter === 'provider') {
+                return this.config.tracerProvider?.getTracer('armoriq-sdk', this.sdkVersion) ?? null;
+            }
+            return this.privateProvider()?.getTracer('armoriq-sdk', this.sdkVersion) ?? null;
+        }
+        catch {
+            return null;
+        }
+    }
+    privateProvider() {
+        if (this.provider || this.closed || !this.config.enabled)
+            return this.provider;
+        const isExternal = this.config.exporter === 'external';
+        const url = isExternal ? this.config.endpoint : `${this.backendEndpoint}/v1/traces`;
+        if (!url)
+            return null;
+        try {
+            const exporter = this.createExporter(url, isExternal ? this.config.headers : { 'x-api-key': this.apiKey });
+            this.provider = new sdk_trace_node_1.NodeTracerProvider({
+                resource: (0, resources_1.resourceFromAttributes)({
+                    'service.name': this.config.serviceName,
+                    'service.version': this.sdkVersion,
+                    ...this.config.resourceAttributes,
+                }),
+                // A span queued under a permissive lease may still be sitting in
+                // BatchSpanProcessor's in-memory buffer when the lease becomes
+                // stricter (or is revoked). Wrap both the exporter -- the true
+                // export-time gate: it runs right before spans leave the process,
+                // however long they were queued -- and the processor -- closing the
+                // narrower window between an attribute being set and `span.end()`
+                // being called -- so whatever policy is authoritative right now,
+                // not whatever was authoritative at creation time, governs what
+                // actually ships.
+                spanProcessors: [
+                    new otel_export_ceiling_1.CeilingReapplyingSpanProcessor(new sdk_trace_base_1.BatchSpanProcessor(new otel_export_ceiling_1.CeilingReapplyingSpanExporter(exporter, this), { exportTimeoutMillis: Math.min(this.config.timeoutMillis, CLOSE_DEADLINE_MS) }), this),
+                ],
+            });
+            return this.provider;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Construct the OTLP delegate from explicit values. The convenience
+     * exporter reads process.env while merging defaults, which could leak a
+     * caller's external headers into an ArmorIQ-only exporter.
+     */
+    createExporter(url, headers) {
+        const agentFactory = async (protocol) => {
+            const { Agent } = protocol === 'http:' ? await import('node:http') : await import('node:https');
+            const agent = new Agent({ keepAlive: false });
+            this.ownedAgents.add(agent);
+            return agent;
+        };
+        return new otlp_exporter_base_1.OTLPExporterBase((0, node_http_1.createOtlpHttpExportDelegate)({
+            url,
+            // The wire serializer is protobuf. Content type is SDK-owned and must
+            // be set after arbitrary caller headers.
+            headers: () => ({ ...headers, 'content-type': 'application/x-protobuf' }),
+            timeoutMillis: Math.min(this.config.timeoutMillis, CLOSE_DEADLINE_MS),
+            concurrencyLimit: 1,
+            compression: 'none',
+            agentFactory,
+        }, otlp_transformer_1.ProtobufTraceSerializer));
+    }
+    safeAttributes(snapshot, attributes, context) {
+        return this.safeAttributesWithAuthority(snapshot, attributes, context, false);
+    }
+    /** Final tool boundary: retain safe lifecycle facts and content-state markers even when capture is now off. */
+    finalToolAttributes(snapshot, attributes, context) {
+        return this.safeAttributesWithAuthority(snapshot, attributes, context, true);
+    }
+    safeAttributesWithAuthority(snapshot, attributes, context, allowOffMarkers) {
+        if (this.closed || !this.config.enabled || !(0, policy_lease_1.isLeaseCurrent)(snapshot))
+            return {};
+        if (snapshot.captureMode === 'off' && !allowOffMarkers)
+            return {};
+        const external = this.config.exporter === 'external' || this.config.exporter === 'provider';
+        const result = {};
+        const content = this.extractContent(attributes);
+        for (const [key, value] of Object.entries(attributes)) {
+            if (CONTENT_KEY.test(key))
+                continue;
+            if (key === 'gen_ai.operation.name' &&
+                (typeof value !== 'string' || !GEN_AI_OPERATION_NAMES.has(value))) {
+                continue;
+            }
+            if (external && !this.externalAttributeAllowed(key, snapshot.captureMode))
+                continue;
+            const sanitized = safeValue(key, value, external);
+            if (sanitized !== undefined)
+                result[key] = sanitized;
+        }
+        const authority = this.contentAuthority(snapshot, external);
+        const projected = (0, content_capture_1.projectTelemetryContent)(content, authority);
+        for (const [key, value] of Object.entries(projected.attributes)) {
+            if (!external || EXTERNAL_METADATA_ATTRIBUTES.has(key) || EXTERNAL_CONTENT_ATTRIBUTES.has(key)) {
+                const sanitized = safeValue(key, value, external);
+                if (sanitized !== undefined)
+                    result[key] = sanitized;
+            }
+        }
+        // The durable ArmorIQ ingest contract predates GenAI semantic attributes.
+        // Preserve the standard attributes above, and mirror only its canonical
+        // content keys for internal normalized reads. These aliases are never
+        // allowed through a third-party exporter.
+        if (!external) {
+            const input = projected.attributes['gen_ai.input.messages'];
+            const output = projected.attributes['gen_ai.output.messages'];
+            if (typeof input === 'string')
+                result['armoriq.content.input'] = input;
+            if (typeof output === 'string')
+                result['armoriq.content.output'] = output;
+        }
+        result['armoriq.observability.capture.mode'] = snapshot.captureMode;
+        result['armoriq.observability.policy.revision'] = snapshot.revision;
+        if (external) {
+            const sessionId = (0, otel_config_1.sanitizeExternalTelemetryValue)(context.sessionId, 128);
+            if (sessionId)
+                result['session.id'] = sessionId;
+            if (context.userId && validExternalId(context.userId))
+                result['user.id'] = context.userId;
+        }
+        return result;
+    }
+    externalAttributeAllowed(key, mode) {
+        if (EXTERNAL_METADATA_ATTRIBUTES.has(key) || EXTERNAL_POLICY_METADATA_ATTRIBUTES.has(key))
+            return true;
+        if ((mode === 'enhanced' || mode === 'debug') && EXTERNAL_POLICY_ENHANCED_ATTRIBUTES.has(key))
+            return true;
+        return mode === 'debug' && EXTERNAL_POLICY_DEBUG_ATTRIBUTES.has(key);
+    }
+    /** Shared by span-creation attribute assembly and export-time re-governance. */
+    contentAuthority(snapshot, external) {
+        const authorityCurrent = snapshot.authoritative && (0, policy_lease_1.isLeaseCurrent)(snapshot);
+        const contentAllowed = authorityCurrent
+            && snapshot.contentCaptureAllowed
+            && (snapshot.captureMode === 'enhanced' || snapshot.captureMode === 'debug')
+            && (!external || snapshot.externalContentAllowed);
+        let reasonCode = snapshot.contentReasonCode;
+        if (!authorityCurrent)
+            reasonCode = 'policy_unavailable';
+        else if (snapshot.captureMode === 'off')
+            reasonCode = 'capture_mode_off';
+        else if (snapshot.captureMode === 'metadata')
+            reasonCode = 'capture_mode_metadata';
+        else if (snapshot.contentReasonCode === 'policy_expired')
+            reasonCode = 'policy_expired';
+        else if (!snapshot.contentCaptureAllowed)
+            reasonCode = 'organization_content_disabled';
+        else if (external && !snapshot.externalContentAllowed)
+            reasonCode = 'external_content_disabled';
+        return { mode: snapshot.captureMode, external, contentAllowed, reasonCode };
+    }
+    extractContent(attributes) {
+        const result = {};
+        if (Object.prototype.hasOwnProperty.call(attributes, 'gen_ai.input.messages'))
+            result.input = attributes['gen_ai.input.messages'];
+        else if (Object.prototype.hasOwnProperty.call(attributes, 'gen_ai.prompt'))
+            result.input = attributes['gen_ai.prompt'];
+        else if (Object.prototype.hasOwnProperty.call(attributes, 'armoriq.content.input'))
+            result.input = attributes['armoriq.content.input'];
+        if (Object.prototype.hasOwnProperty.call(attributes, 'gen_ai.output.messages'))
+            result.output = attributes['gen_ai.output.messages'];
+        else if (Object.prototype.hasOwnProperty.call(attributes, 'gen_ai.completion'))
+            result.output = attributes['gen_ai.completion'];
+        else if (Object.prototype.hasOwnProperty.call(attributes, 'armoriq.content.output'))
+            result.output = attributes['armoriq.content.output'];
+        if (Object.prototype.hasOwnProperty.call(attributes, 'gen_ai.tool.call.arguments'))
+            result.toolArguments = attributes['gen_ai.tool.call.arguments'];
+        else if (Object.prototype.hasOwnProperty.call(attributes, 'gen_ai.tool.arguments'))
+            result.toolArguments = attributes['gen_ai.tool.arguments'];
+        if (Object.prototype.hasOwnProperty.call(attributes, 'gen_ai.tool.call.result'))
+            result.toolResult = attributes['gen_ai.tool.call.result'];
+        else if (Object.prototype.hasOwnProperty.call(attributes, 'gen_ai.tool.result'))
+            result.toolResult = attributes['gen_ai.tool.result'];
+        if (Object.prototype.hasOwnProperty.call(attributes, 'armoriq.observability.error.summary'))
+            result.errorSummary = attributes['armoriq.observability.error.summary'];
+        return result;
+    }
+    /** Stable, externally safe root span names prevent identifier leakage. */
+    externalTraceName(value) {
+        if (this.config.exporter !== 'external' && this.config.exporter !== 'provider')
+            return value;
+        return (0, otel_config_1.sanitizeExternalTelemetryValue)(value, 128) ?? 'armoriq.agent.run';
+    }
+    async forceFlush() {
+        if (this.config.exporter === 'provider')
+            return;
+        try {
+            await bounded(this.provider?.forceFlush() ?? Promise.resolve());
+        }
+        catch {
+            // Export failure is intentionally fail-open.
+        }
+    }
+    async close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        (0, otel_shutdown_1.unregisterOwnedTelemetryRuntime)(this);
+        this.policyLeaseAbort?.abort();
+        this.policyLeaseAbort = null;
+        if (this.config.exporter === 'provider')
+            return;
+        const provider = this.provider;
+        this.provider = null;
+        try {
+            await bounded(provider?.shutdown() ?? Promise.resolve());
+        }
+        catch {
+            // Export failure is intentionally fail-open.
+        }
+        finally {
+            for (const agent of this.ownedAgents) {
+                try {
+                    agent.destroy();
+                }
+                catch {
+                    // Agents are SDK-owned and are best-effort only.
+                }
+            }
+            this.ownedAgents.clear();
+        }
+    }
+}
+exports.ArmorIQTelemetryRuntime = ArmorIQTelemetryRuntime;
+//# sourceMappingURL=otel-runtime.js.map