@armoriq/sdk-dev 0.6.8 → 0.7.0

package/dist/observability/otel-export-ceiling.js

@@ -0,0 +1,264 @@
+"use strict";
+/**
+ * Export-time capture-mode ceiling re-application for buffered spans.
+ *
+ * `ArmorIQTelemetryRuntime.safeAttributes` (otel-runtime.ts) already governs
+ * what a span is *allowed to receive* at the moment its attributes are set,
+ * using whatever policy lease was current at that instant. That is not
+ * enough on its own: `BatchSpanProcessor` buffers ended spans in memory and
+ * ships them later, on a timer or when the queue fills. A span populated
+ * with rich content under an `enhanced`/`debug` lease can still be sitting
+ * in that buffer, un-exported, when the organization's lease becomes
+ * stricter -- because the policy changed, or because a refresh came back
+ * lower after the previous lease expired. Without a check at the moment
+ * spans actually leave the process, the stale, too-permissive attributes
+ * baked onto the span at creation time would still ship, even though the
+ * CURRENT lease no longer authorizes them.
+ *
+ * This module closes that gap at two points, both delegating to the exact
+ * same governance the runtime uses at span-creation time
+ * (`ArmorIQTelemetryRuntime.currentCeilingSnapshot` /
+ * `reapplyContentCeiling`, which in turn shares `contentAuthority` with
+ * `safeAttributesWithAuthority`), so there is exactly one place that defines
+ * "what counts as content" and "what survives a given capture mode":
+ *
+ * - `CeilingReapplyingSpanExporter` wraps the real span exporter. Its
+ *   `export` re-reads the current policy snapshot immediately before
+ *   handing spans to the wrapped exporter -- this runs whenever the
+ *   batching processor actually flushes, so it catches a span regardless of
+ *   how long it sat queued.
+ * - `CeilingReapplyingSpanProcessor` wraps the real span processor. Its
+ *   `onEnd` performs the same re-check at the moment a span is handed off
+ *   for export, closing the narrower window between when a long-running
+ *   operation's attributes were set and when `span.end()` is finally
+ *   called.
+ *
+ * Both are no-ops when the current snapshot still authorizes everything
+ * already on the span, so a session whose lease never changes exports
+ * exactly what it would have exported before this module existed.
+ *
+ * This is a privacy boundary, so re-governance fails CLOSED in two tiers
+ * rather than fail-open. A policy-lookup or re-governance failure used to
+ * leave a span exactly as it was, after which it would export with content
+ * the current lease may have revoked. Instead:
+ *
+ * 1. Replace the attributes with the same withheld-content markers
+ *    `projectTelemetryContent` produces for a disallowed capture mode. This
+ *    keeps the span itself -- name, timing, status, parent/child structure
+ *    -- which is the point of the telemetry, while guaranteeing no governed
+ *    content ships.
+ * 2. Only if even that replacement cannot be written is the span dropped
+ *    outright: the exporter filters it out and the processor never queues
+ *    it. A batch left empty by privacy drops reports `SUCCESS`, not
+ *    `FAILED` -- the drop is a deliberate, permanent verdict, and `FAILED`
+ *    would have `BatchSpanProcessor` treat it as a retryable transport
+ *    problem.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CeilingReapplyingSpanProcessor = exports.CeilingReapplyingSpanExporter = void 0;
+const core_1 = require("@opentelemetry/core");
+const content_capture_1 = require("./content-capture");
+/** The reason recorded when even the ceiling itself could not be resolved. */
+const POLICY_UNAVAILABLE_AUTHORITY = {
+    mode: 'off',
+    external: false,
+    contentAllowed: false,
+    reasonCode: 'policy_unavailable',
+};
+function hasOwn(value, key) {
+    return Object.prototype.hasOwnProperty.call(value, key);
+}
+/**
+ * Overwrite an already-ended span's attribute mapping in place.
+ *
+ * Unlike OpenTelemetry Python's `BoundedAttributes` (which freezes on
+ * `span.end()` and requires an unsupported private-field thaw), the Node SDK
+ * keeps a completed span's `attributes` as a plain, ordinarily-mutable
+ * object -- there is no supported *setter*, but replacing its contents does
+ * not require fighting an immutability flag. A test that wants to prove the
+ * mutation-failure tier freezes that object (`Object.freeze(span.attributes)`),
+ * which makes the `delete`/assign below throw, exactly like a real
+ * environment where some other guard made the object non-writable.
+ *
+ * Returns true when the span now carries exactly `attributes`.
+ */
+function writeAttributes(span, attributes) {
+    try {
+        const target = span;
+        if (typeof target.attributes !== 'object' || target.attributes === null)
+            return false;
+        for (const key of Object.keys(target.attributes))
+            delete target.attributes[key];
+        Object.assign(target.attributes, attributes);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function attributesEqual(a, b) {
+    const aKeys = Object.keys(a);
+    if (aKeys.length !== Object.keys(b).length)
+        return false;
+    return aKeys.every((key) => hasOwn(b, key) && Object.is(a[key], b[key]));
+}
+/**
+ * Replace a span's attributes with the known-safe withheld marker set.
+ *
+ * Used when the ceiling itself could not be computed or applied: a policy
+ * lookup or re-governance failure must never leave the stale, possibly
+ * unauthorized attributes in place. Nothing the lease might no longer
+ * authorize survives -- every content-scoped key is replaced with the exact
+ * placeholders `projectTelemetryContent` writes for a disallowed capture
+ * mode, reported under `policy_unavailable` since the real reason could not
+ * be determined. Non-content attributes (tool name, durations, ids, ...)
+ * are untouched: they are not content, so a failure to re-govern content
+ * does not require rewriting them.
+ *
+ * Returns true when the span is safe to export, false when it must be
+ * dropped because even this replacement could not be written.
+ */
+function withholdContent(span, currentAttributes) {
+    try {
+        const hasInput = hasOwn(currentAttributes, 'gen_ai.input.messages') || hasOwn(currentAttributes, 'armoriq.content.input');
+        const hasOutput = hasOwn(currentAttributes, 'gen_ai.output.messages') || hasOwn(currentAttributes, 'armoriq.content.output');
+        const hasToolArguments = hasOwn(currentAttributes, 'gen_ai.tool.call.arguments');
+        const hasToolResult = hasOwn(currentAttributes, 'gen_ai.tool.call.result');
+        const hasErrorSummary = hasOwn(currentAttributes, 'armoriq.observability.error.summary');
+        const presence = {};
+        if (hasInput)
+            presence.input = undefined;
+        if (hasOutput)
+            presence.output = undefined;
+        if (hasToolArguments)
+            presence.toolArguments = undefined;
+        if (hasToolResult)
+            presence.toolResult = undefined;
+        if (hasErrorSummary)
+            presence.errorSummary = undefined;
+        const projected = (0, content_capture_1.projectTelemetryContent)(presence, POLICY_UNAVAILABLE_AUTHORITY);
+        const next = { ...currentAttributes };
+        // Unconditional: every content-scoped key is cleared regardless of which
+        // fields were present, so an error-summary-only span (no input/output/
+        // tool-call keys at all) is still fully purged.
+        for (const key of content_capture_1.CONTENT_ATTRIBUTE_KEYS)
+            delete next[key];
+        Object.assign(next, projected.attributes);
+        return writeAttributes(span, next);
+    }
+    catch {
+        // Even reading which content keys are present failed. Nothing on this
+        // span can be inspected, so nothing on it can be cleared selectively;
+        // strip it to the empty attribute set.
+        return writeAttributes(span, {});
+    }
+}
+/**
+ * Recompute one span's attributes under the policy current right now.
+ *
+ * Returns true when the span may be exported, false when it must be
+ * dropped.
+ */
+function reapplyCeiling(runtime, span) {
+    let currentAttributes;
+    try {
+        currentAttributes = { ...(span.attributes ?? {}) };
+    }
+    catch {
+        // The span's own attribute mapping is unreadable. Nothing on it can be
+        // inspected, so nothing on it can be cleared selectively.
+        return writeAttributes(span, {});
+    }
+    let governed;
+    try {
+        const snapshot = runtime.currentCeilingSnapshot();
+        governed = runtime.reapplyContentCeiling(snapshot, currentAttributes);
+    }
+    catch {
+        // Policy lookup or re-governance failed. Fail closed rather than ship
+        // the span exactly as it was.
+        return withholdContent(span, currentAttributes);
+    }
+    if (attributesEqual(governed, currentAttributes))
+        return true;
+    if (writeAttributes(span, governed))
+        return true;
+    // The rewrite that just failed is the only way to purge the stale
+    // attributes, so re-governing is impossible; drop rather than ship them.
+    return false;
+}
+/**
+ * Re-govern span attributes against the CURRENT lease before shipping.
+ *
+ * This is the true export-time gate: `export` runs whenever the wrapped
+ * batching processor actually flushes its buffer, so a span that has been
+ * queued for any length of time is re-evaluated against the lease that is
+ * authoritative right now, not the one that was authoritative when it was
+ * created or ended.
+ */
+class CeilingReapplyingSpanExporter {
+    exporter;
+    runtime;
+    constructor(exporter, runtime) {
+        this.exporter = exporter;
+        this.runtime = runtime;
+    }
+    export(spans, resultCallback) {
+        const exportable = spans.filter((span) => reapplyCeiling(this.runtime, span));
+        if (exportable.length === 0) {
+            // Every span was dropped for privacy. Report SUCCESS, not FAILED:
+            // FAILED tells BatchSpanProcessor the batch did not ship, which it
+            // treats as a retryable transport problem. A ceiling drop is a
+            // deliberate, permanent decision -- the span must never ship -- so a
+            // retry would be pointless work over the same verdict.
+            resultCallback({ code: core_1.ExportResultCode.SUCCESS });
+            return;
+        }
+        this.exporter.export(exportable, resultCallback);
+    }
+    shutdown() {
+        return this.exporter.shutdown();
+    }
+    forceFlush() {
+        return this.exporter.forceFlush ? this.exporter.forceFlush() : Promise.resolve();
+    }
+}
+exports.CeilingReapplyingSpanExporter = CeilingReapplyingSpanExporter;
+/**
+ * Re-govern span attributes at the `onEnd` hand-off boundary.
+ *
+ * Complements `CeilingReapplyingSpanExporter`: this closes the window
+ * between when a span's attributes were last set (which can be well before
+ * a long-running operation actually calls `span.end()`) and when it is
+ * handed to the wrapped processor for batching. `shutdown`/`forceFlush`
+ * delegate to the wrapped processor unchanged -- this class only adds a
+ * re-governance step, it does not change close/flush lifecycle semantics.
+ */
+class CeilingReapplyingSpanProcessor {
+    processor;
+    runtime;
+    constructor(processor, runtime) {
+        this.processor = processor;
+        this.runtime = runtime;
+    }
+    onStart(span, parentContext) {
+        this.processor.onStart(span, parentContext);
+    }
+    onEnd(span) {
+        if (!reapplyCeiling(this.runtime, span)) {
+            // Undeliverable: the span could not be re-governed and could not be
+            // stripped either. Never queue it -- once it is inside the wrapped
+            // processor's buffer this module cannot reach it again.
+            return;
+        }
+        this.processor.onEnd(span);
+    }
+    shutdown() {
+        return this.processor.shutdown();
+    }
+    forceFlush() {
+        return this.processor.forceFlush();
+    }
+}
+exports.CeilingReapplyingSpanProcessor = CeilingReapplyingSpanProcessor;
+//# sourceMappingURL=otel-export-ceiling.js.map

package/dist/observability/otel-export-ceiling.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otel-export-ceiling.js","sourceRoot":"","sources":["../../src/observability/otel-export-ceiling.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;;;AAIH,8CAAuD;AAEvD,uDAAyI;AAGzI,8EAA8E;AAC9E,MAAM,4BAA4B,GAA4B;IAC5D,IAAI,EAAE,KAAK;IACX,QAAQ,EAAE,KAAK;IACf,cAAc,EAAE,KAAK;IACrB,UAAU,EAAE,oBAAoB;CACjC,CAAC;AAEF,SAAS,MAAM,CAAC,KAAwC,EAAE,GAAW;IACnE,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,eAAe,CAAC,IAAkB,EAAE,UAAmD;IAC9F,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAA0D,CAAC;QAC1E,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACtF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAChF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,CAAoC,EAAE,CAAoC;IACjG,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,eAAe,CAAC,IAAkB,EAAE,iBAAoD;IAC/F,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,IAAI,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;QAC1H,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,IAAI,MAAM,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;QAC7H,MAAM,gBAAgB,GAAG,MAAM,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;QACjF,MAAM,aAAa,GAAG,MAAM,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;QAC3E,MAAM,eAAe,GAAG,MAAM,CAAC,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;QACzF,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,IAAI,QAAQ;YAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAC;QACzC,IAAI,SAAS;YAAE,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC;QAC3C,IAAI,gBAAgB;YAAE,QAAQ,CAAC,aAAa,GAAG,SAAS,CAAC;QACzD,IAAI,aAAa;YAAE,QAAQ,CAAC,UAAU,GAAG,SAAS,CAAC;QACnD,IAAI,eAAe;YAAE,QAAQ,CAAC,YAAY,GAAG,SAAS,CAAC;QACvD,MAAM,SAAS,GAAG,IAAA,yCAAuB,EAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC;QAClF,MAAM,IAAI,GAA4B,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/D,yEAAyE;QACzE,uEAAuE;QACvE,gDAAgD;QAChD,KAAK,MAAM,GAAG,IAAI,wCAAsB;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;QAC1C,OAAO,eAAe,CAAC,IAAI,EAAE,IAA+C,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,sEAAsE;QACtE,uCAAuC;QACvC,OAAO,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,OAAgC,EAAE,IAAkB;IAC1E,IAAI,iBAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,iBAAiB,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,0DAA0D;QAC1D,OAAO,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,QAAiD,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC;QAClD,QAAQ,GAAG,OAAO,CAAC,qBAAqB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,8BAA8B;QAC9B,OAAO,eAAe,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,eAAe,CAAC,QAAQ,EAAE,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,IAAI,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,kEAAkE;IAClE,yEAAyE;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAa,6BAA6B;IAErB;IACA;IAFnB,YACmB,QAAsB,EACtB,OAAgC;QADhC,aAAQ,GAAR,QAAQ,CAAc;QACtB,YAAO,GAAP,OAAO,CAAyB;IAChD,CAAC;IAEJ,MAAM,CAAC,KAAqB,EAAE,cAA8C;QAC1E,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,kEAAkE;YAClE,mEAAmE;YACnE,+DAA+D;YAC/D,qEAAqE;YACrE,uDAAuD;YACvD,cAAc,CAAC,EAAE,IAAI,EAAE,uBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACnD,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAClC,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACnF,CAAC;CACF;AA3BD,sEA2BC;AAED;;;;;;;;;GASG;AACH,MAAa,8BAA8B;IAEtB;IACA;IAFnB,YACmB,SAAwB,EACxB,OAAgC;QADhC,cAAS,GAAT,SAAS,CAAe;QACxB,YAAO,GAAP,OAAO,CAAyB;IAChD,CAAC;IAEJ,OAAO,CAAC,IAAU,EAAE,aAAsB;QACxC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,IAAkB;QACtB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YACxC,oEAAoE;YACpE,mEAAmE;YACnE,wDAAwD;YACxD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;IACnC,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;IACrC,CAAC;CACF;AA3BD,wEA2BC"}

package/dist/observability/otel-runtime.d.ts

@@ -0,0 +1,103 @@
+/** SDK-owned OpenTelemetry runtime. It never registers a global provider. */
+import type { Tracer } from '@opentelemetry/api';
+import { type ObservabilityOptions, type ResolvedOtelConfig } from './otel-config';
+import { type PolicyLease } from './policy-lease';
+import { type ContentCaptureAuthority } from './content-capture';
+export type TelemetryAttributeValue = string | number | boolean | string[];
+export type TelemetryAttributes = Readonly<Record<string, unknown>>;
+export interface AttributeContext {
+    traceName: string;
+    sessionId: string;
+    /** Caller must provide this deliberately. It is sanitized before export. */
+    userId?: string | null;
+}
+export interface TelemetryRuntimeOptions {
+    backendEndpoint: string;
+    apiKey: string;
+    sdkVersion: string;
+    options?: ObservabilityOptions;
+    /** Test/host hook; production defaults to the policy-lease HTTP endpoint. */
+    leaseFetcher?: (signal?: AbortSignal) => Promise<PolicyLease>;
+}
+/**
+ * Manages one private exporter, or borrows a caller-owned provider. A runtime
+ * is request/session scoped and `close()` is idempotent and fail-open.
+ */
+export declare class ArmorIQTelemetryRuntime {
+    readonly config: ResolvedOtelConfig;
+    private readonly backendEndpoint;
+    private readonly apiKey;
+    private readonly sdkVersion;
+    private readonly leaseFetcher?;
+    private lease;
+    private refreshing;
+    private firstExternalAuthorityAwaited;
+    private externalAuthorityUnavailable;
+    private nextRefreshAt;
+    private provider;
+    private policyLeaseAbort;
+    private readonly ownedAgents;
+    private closed;
+    constructor(options: TelemetryRuntimeOptions);
+    policySnapshot(options?: {
+        awaitFresh?: boolean;
+    }): Promise<PolicyLease>;
+    /** Start at most one control-plane request; request callers never await it. */
+    private refreshInBackground;
+    private applyCeiling;
+    /**
+     * The ceiling-applied lease this runtime already knows about, computed
+     * synchronously from whatever is cached. Never performs network I/O and
+     * never blocks: a batching span processor flushes on its own timer, from
+     * whatever thread that is, and must get an immediate answer. When nothing
+     * current is cached, this fails closed to the same `authoritative: false`
+     * fallback `policySnapshot()` uses, which `applyCeiling` maps to `off`.
+     *
+     * This is the true export-time gate's policy read: `CeilingReapplyingSpanExporter`
+     * and `CeilingReapplyingSpanProcessor` (otel-export-ceiling.ts) call it
+     * immediately before a buffered span is allowed to leave the process, so a
+     * span queued under a since-revoked lease is re-governed against whatever
+     * is authoritative right now -- not whatever was authoritative when the
+     * span was created or ended.
+     */
+    currentCeilingSnapshot(): PolicyLease;
+    /**
+     * Re-govern a span's already-baked attributes under a (possibly new)
+     * policy snapshot. Shares `contentAuthority` -- the exact function that
+     * decides content authority at span-creation time -- with
+     * `safeAttributesWithAuthority`, so there is exactly one place that
+     * defines "is content allowed right now." When it is, every content-bearing
+     * key present is re-bounded against the current mode's limits (via
+     * `reboundCapturedJson`): a session whose lease never changes and whose
+     * mode never changes must export exactly what it would have exported
+     * before this method existed, but content captured under debug's looser
+     * limits cannot keep those limits once the ceiling has downgraded to
+     * enhanced. When capture is not allowed at all, every key in
+     * `CONTENT_ATTRIBUTE_KEYS` present on the span is replaced with the same
+     * withheld-content markers `projectTelemetryContent` produces at creation
+     * time for a disallowed capture mode.
+     */
+    reapplyContentCeiling(snapshot: PolicyLease, attributes: TelemetryAttributes): Record<string, TelemetryAttributeValue>;
+    private fetchPolicyLease;
+    tracer(snapshot: PolicyLease): Tracer | null;
+    private privateProvider;
+    /**
+     * Construct the OTLP delegate from explicit values. The convenience
+     * exporter reads process.env while merging defaults, which could leak a
+     * caller's external headers into an ArmorIQ-only exporter.
+     */
+    private createExporter;
+    safeAttributes(snapshot: PolicyLease, attributes: TelemetryAttributes, context: AttributeContext): Record<string, TelemetryAttributeValue>;
+    /** Final tool boundary: retain safe lifecycle facts and content-state markers even when capture is now off. */
+    finalToolAttributes(snapshot: PolicyLease, attributes: TelemetryAttributes, context: AttributeContext): Record<string, TelemetryAttributeValue>;
+    private safeAttributesWithAuthority;
+    private externalAttributeAllowed;
+    /** Shared by span-creation attribute assembly and export-time re-governance. */
+    contentAuthority(snapshot: PolicyLease, external: boolean): ContentCaptureAuthority;
+    private extractContent;
+    /** Stable, externally safe root span names prevent identifier leakage. */
+    externalTraceName(value: string): string;
+    forceFlush(): Promise<void>;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=otel-runtime.d.ts.map

package/dist/observability/otel-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"otel-runtime.d.ts","sourceRoot":"","sources":["../../src/observability/otel-runtime.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAE7E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAOjD,OAAO,EAIL,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AACvB,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAIL,KAAK,uBAAuB,EAG7B,MAAM,mBAAmB,CAAC;AAI3B,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC;AAC3E,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,6EAA6E;IAC7E,YAAY,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CAC/D;AAkLD;;;GAGG;AACH,qBAAa,uBAAuB;IAClC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAiD;IAC/E,OAAO,CAAC,KAAK,CAA4B;IACzC,OAAO,CAAC,UAAU,CAAqC;IACvD,OAAO,CAAC,6BAA6B,CAAS;IAC9C,OAAO,CAAC,4BAA4B,CAAS;IAC7C,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,QAAQ,CAAmC;IACnD,OAAO,CAAC,gBAAgB,CAAgC;IACxD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAyB;IACrD,OAAO,CAAC,MAAM,CAAS;gBAEX,OAAO,EAAE,uBAAuB;IAWtC,cAAc,CAAC,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IA4BlF,+EAA+E;IAC/E,OAAO,CAAC,mBAAmB;IAe3B,OAAO,CAAC,YAAY;IA6CpB;;;;;;;;;;;;;;OAcG;IACH,sBAAsB,IAAI,WAAW;IAcrC;;;;;;;;;;;;;;;OAeG;IACH,qBAAqB,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC;YAoDxG,gBAAgB;IAqB9B,MAAM,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI;IAY5C,OAAO,CAAC,eAAe;IAsCvB;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAmBtB,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,mBAAmB,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC;IAI1I,+GAA+G;IAC/G,mBAAmB,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,mBAAmB,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC;IAI/I,OAAO,CAAC,2BAA2B;IAmDnC,OAAO,CAAC,wBAAwB;IAMhC,gFAAgF;IAChF,gBAAgB,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,GAAG,uBAAuB;IAgBnF,OAAO,CAAC,cAAc;IAkBtB,0EAA0E;IAC1E,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAKlC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAS3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAwB7B"}