@bli-cockpit/telemetry-core 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.ts +1 -0
- package/dist/index.js +1 -0
- package/dist/ingest-dto.d.ts +22 -0
- package/dist/local-config.d.ts +1 -0
- package/dist/local-config.js +6 -2
- package/dist/privacy.d.ts +11 -0
- package/dist/privacy.js +34 -0
- package/dist/secret-guards.d.ts +1 -0
- package/dist/secret-guards.js +23 -0
- package/dist/source-adapter.d.ts +12 -0
- package/dist/trace-sink.d.ts +1 -0
- package/package.json +1 -1
package/dist/index.d.ts
CHANGED
|
@@ -4,6 +4,7 @@ export * from "./local-config.js";
|
|
|
4
4
|
export * from "./paths.js";
|
|
5
5
|
export * from "./privacy.js";
|
|
6
6
|
export * from "./risk-flags.js";
|
|
7
|
+
export * from "./secret-guards.js";
|
|
7
8
|
export * from "./source-adapter.js";
|
|
8
9
|
export * from "./trace-sink.js";
|
|
9
10
|
export * from "./work-context.js";
|
package/dist/index.js
CHANGED
|
@@ -4,6 +4,7 @@ export * from "./local-config.js";
|
|
|
4
4
|
export * from "./paths.js";
|
|
5
5
|
export * from "./privacy.js";
|
|
6
6
|
export * from "./risk-flags.js";
|
|
7
|
+
export * from "./secret-guards.js";
|
|
7
8
|
export * from "./source-adapter.js";
|
|
8
9
|
export * from "./trace-sink.js";
|
|
9
10
|
export * from "./work-context.js";
|
package/dist/ingest-dto.d.ts
CHANGED
|
@@ -56,6 +56,7 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
|
|
|
56
56
|
redacted_summary: "redacted_summary";
|
|
57
57
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
58
58
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
59
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
59
60
|
}>;
|
|
60
61
|
redaction: z.ZodObject<{
|
|
61
62
|
privacy_classification: z.ZodEnum<{
|
|
@@ -63,12 +64,14 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
|
|
|
63
64
|
redacted_summary: "redacted_summary";
|
|
64
65
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
65
66
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
67
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
66
68
|
}>;
|
|
67
69
|
redaction_status: z.ZodEnum<{
|
|
68
70
|
metadata_only: "metadata_only";
|
|
69
71
|
redacted: "redacted";
|
|
70
72
|
raw_local_only: "raw_local_only";
|
|
71
73
|
raw_remote_short_retention: "raw_remote_short_retention";
|
|
74
|
+
raw_remote_durable: "raw_remote_durable";
|
|
72
75
|
}>;
|
|
73
76
|
redacted_fields: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
74
77
|
raw_evidence_pointer_ids: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
@@ -163,15 +166,18 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
|
|
|
163
166
|
privacy_classification: z.ZodEnum<{
|
|
164
167
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
165
168
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
169
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
166
170
|
}>;
|
|
167
171
|
retention_policy: z.ZodObject<{
|
|
168
172
|
mode: z.ZodEnum<{
|
|
169
173
|
local_only: "local_only";
|
|
170
174
|
remote_short_retention: "remote_short_retention";
|
|
175
|
+
remote_durable: "remote_durable";
|
|
171
176
|
}>;
|
|
172
177
|
privacy_classification: z.ZodEnum<{
|
|
173
178
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
174
179
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
180
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
175
181
|
}>;
|
|
176
182
|
remote_retention_days: z.ZodOptional<z.ZodNumber>;
|
|
177
183
|
expires_at: z.ZodOptional<z.ZodString>;
|
|
@@ -180,6 +186,7 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
|
|
|
180
186
|
local_file: "local_file";
|
|
181
187
|
remote_object: "remote_object";
|
|
182
188
|
}>;
|
|
189
|
+
storage_bucket: z.ZodOptional<z.ZodString>;
|
|
183
190
|
local_path: z.ZodOptional<z.ZodString>;
|
|
184
191
|
object_key: z.ZodOptional<z.ZodString>;
|
|
185
192
|
content_hash_sha256: z.ZodOptional<z.ZodString>;
|
|
@@ -221,6 +228,7 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
|
|
|
221
228
|
redacted_summary: "redacted_summary";
|
|
222
229
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
223
230
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
231
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
224
232
|
}>>;
|
|
225
233
|
}, z.core.$strict>>;
|
|
226
234
|
}, z.core.$strict>;
|
|
@@ -343,6 +351,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
343
351
|
redacted_summary: "redacted_summary";
|
|
344
352
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
345
353
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
354
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
346
355
|
}>;
|
|
347
356
|
redaction: z.ZodObject<{
|
|
348
357
|
privacy_classification: z.ZodEnum<{
|
|
@@ -350,12 +359,14 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
350
359
|
redacted_summary: "redacted_summary";
|
|
351
360
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
352
361
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
362
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
353
363
|
}>;
|
|
354
364
|
redaction_status: z.ZodEnum<{
|
|
355
365
|
metadata_only: "metadata_only";
|
|
356
366
|
redacted: "redacted";
|
|
357
367
|
raw_local_only: "raw_local_only";
|
|
358
368
|
raw_remote_short_retention: "raw_remote_short_retention";
|
|
369
|
+
raw_remote_durable: "raw_remote_durable";
|
|
359
370
|
}>;
|
|
360
371
|
redacted_fields: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
361
372
|
raw_evidence_pointer_ids: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
@@ -450,15 +461,18 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
450
461
|
privacy_classification: z.ZodEnum<{
|
|
451
462
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
452
463
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
464
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
453
465
|
}>;
|
|
454
466
|
retention_policy: z.ZodObject<{
|
|
455
467
|
mode: z.ZodEnum<{
|
|
456
468
|
local_only: "local_only";
|
|
457
469
|
remote_short_retention: "remote_short_retention";
|
|
470
|
+
remote_durable: "remote_durable";
|
|
458
471
|
}>;
|
|
459
472
|
privacy_classification: z.ZodEnum<{
|
|
460
473
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
461
474
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
475
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
462
476
|
}>;
|
|
463
477
|
remote_retention_days: z.ZodOptional<z.ZodNumber>;
|
|
464
478
|
expires_at: z.ZodOptional<z.ZodString>;
|
|
@@ -467,6 +481,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
467
481
|
local_file: "local_file";
|
|
468
482
|
remote_object: "remote_object";
|
|
469
483
|
}>;
|
|
484
|
+
storage_bucket: z.ZodOptional<z.ZodString>;
|
|
470
485
|
local_path: z.ZodOptional<z.ZodString>;
|
|
471
486
|
object_key: z.ZodOptional<z.ZodString>;
|
|
472
487
|
content_hash_sha256: z.ZodOptional<z.ZodString>;
|
|
@@ -508,6 +523,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
508
523
|
redacted_summary: "redacted_summary";
|
|
509
524
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
510
525
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
526
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
511
527
|
}>>;
|
|
512
528
|
}, z.core.$strict>>;
|
|
513
529
|
}, z.core.$strict>>;
|
|
@@ -549,12 +565,14 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
549
565
|
redacted_summary: "redacted_summary";
|
|
550
566
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
551
567
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
568
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
552
569
|
}>;
|
|
553
570
|
redaction_status: z.ZodEnum<{
|
|
554
571
|
metadata_only: "metadata_only";
|
|
555
572
|
redacted: "redacted";
|
|
556
573
|
raw_local_only: "raw_local_only";
|
|
557
574
|
raw_remote_short_retention: "raw_remote_short_retention";
|
|
575
|
+
raw_remote_durable: "raw_remote_durable";
|
|
558
576
|
}>;
|
|
559
577
|
redacted_fields: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
560
578
|
raw_evidence_pointer_ids: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
@@ -566,15 +584,18 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
566
584
|
privacy_classification: z.ZodEnum<{
|
|
567
585
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
568
586
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
587
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
569
588
|
}>;
|
|
570
589
|
retention_policy: z.ZodObject<{
|
|
571
590
|
mode: z.ZodEnum<{
|
|
572
591
|
local_only: "local_only";
|
|
573
592
|
remote_short_retention: "remote_short_retention";
|
|
593
|
+
remote_durable: "remote_durable";
|
|
574
594
|
}>;
|
|
575
595
|
privacy_classification: z.ZodEnum<{
|
|
576
596
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
577
597
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
598
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
578
599
|
}>;
|
|
579
600
|
remote_retention_days: z.ZodOptional<z.ZodNumber>;
|
|
580
601
|
expires_at: z.ZodOptional<z.ZodString>;
|
|
@@ -583,6 +604,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
583
604
|
local_file: "local_file";
|
|
584
605
|
remote_object: "remote_object";
|
|
585
606
|
}>;
|
|
607
|
+
storage_bucket: z.ZodOptional<z.ZodString>;
|
|
586
608
|
local_path: z.ZodOptional<z.ZodString>;
|
|
587
609
|
object_key: z.ZodOptional<z.ZodString>;
|
|
588
610
|
content_hash_sha256: z.ZodOptional<z.ZodString>;
|
package/dist/local-config.d.ts
CHANGED
|
@@ -12,6 +12,7 @@ export declare const LocalCollectorConfigSchema: z.ZodObject<{
|
|
|
12
12
|
raw_evidence_upload: z.ZodDefault<z.ZodEnum<{
|
|
13
13
|
disabled: "disabled";
|
|
14
14
|
remote_short_retention_opt_in: "remote_short_retention_opt_in";
|
|
15
|
+
remote_durable_opt_in: "remote_durable_opt_in";
|
|
15
16
|
}>>;
|
|
16
17
|
session_file_path: z.ZodOptional<z.ZodString>;
|
|
17
18
|
state_dir_path: z.ZodOptional<z.ZodString>;
|
package/dist/local-config.js
CHANGED
|
@@ -12,8 +12,12 @@ export const LocalCollectorConfigSchema = z
|
|
|
12
12
|
operator_id: NonEmptyStringSchema.optional(),
|
|
13
13
|
default_repo_paths: z.array(NonEmptyStringSchema).default([]),
|
|
14
14
|
raw_evidence_upload: z
|
|
15
|
-
.enum([
|
|
16
|
-
|
|
15
|
+
.enum([
|
|
16
|
+
"disabled",
|
|
17
|
+
"remote_short_retention_opt_in",
|
|
18
|
+
"remote_durable_opt_in",
|
|
19
|
+
])
|
|
20
|
+
.default("remote_durable_opt_in"),
|
|
17
21
|
session_file_path: NonEmptyStringSchema.optional(),
|
|
18
22
|
state_dir_path: NonEmptyStringSchema.optional(),
|
|
19
23
|
})
|
package/dist/privacy.d.ts
CHANGED
|
@@ -4,26 +4,31 @@ export declare const PrivacyClassificationSchema: z.ZodEnum<{
|
|
|
4
4
|
redacted_summary: "redacted_summary";
|
|
5
5
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
6
6
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
7
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
7
8
|
}>;
|
|
8
9
|
export type PrivacyClassification = z.infer<typeof PrivacyClassificationSchema>;
|
|
9
10
|
export declare const RawEvidencePrivacyClassificationSchema: z.ZodEnum<{
|
|
10
11
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
11
12
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
13
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
12
14
|
}>;
|
|
13
15
|
export type RawEvidencePrivacyClassification = z.infer<typeof RawEvidencePrivacyClassificationSchema>;
|
|
14
16
|
export declare const RawEvidenceRetentionModeSchema: z.ZodEnum<{
|
|
15
17
|
local_only: "local_only";
|
|
16
18
|
remote_short_retention: "remote_short_retention";
|
|
19
|
+
remote_durable: "remote_durable";
|
|
17
20
|
}>;
|
|
18
21
|
export type RawEvidenceRetentionMode = z.infer<typeof RawEvidenceRetentionModeSchema>;
|
|
19
22
|
export declare const RawEvidenceRetentionPolicySchema: z.ZodObject<{
|
|
20
23
|
mode: z.ZodEnum<{
|
|
21
24
|
local_only: "local_only";
|
|
22
25
|
remote_short_retention: "remote_short_retention";
|
|
26
|
+
remote_durable: "remote_durable";
|
|
23
27
|
}>;
|
|
24
28
|
privacy_classification: z.ZodEnum<{
|
|
25
29
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
26
30
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
31
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
27
32
|
}>;
|
|
28
33
|
remote_retention_days: z.ZodOptional<z.ZodNumber>;
|
|
29
34
|
expires_at: z.ZodOptional<z.ZodString>;
|
|
@@ -34,15 +39,18 @@ export declare const RawEvidencePointerSchema: z.ZodObject<{
|
|
|
34
39
|
privacy_classification: z.ZodEnum<{
|
|
35
40
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
36
41
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
42
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
37
43
|
}>;
|
|
38
44
|
retention_policy: z.ZodObject<{
|
|
39
45
|
mode: z.ZodEnum<{
|
|
40
46
|
local_only: "local_only";
|
|
41
47
|
remote_short_retention: "remote_short_retention";
|
|
48
|
+
remote_durable: "remote_durable";
|
|
42
49
|
}>;
|
|
43
50
|
privacy_classification: z.ZodEnum<{
|
|
44
51
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
45
52
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
53
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
46
54
|
}>;
|
|
47
55
|
remote_retention_days: z.ZodOptional<z.ZodNumber>;
|
|
48
56
|
expires_at: z.ZodOptional<z.ZodString>;
|
|
@@ -51,6 +59,7 @@ export declare const RawEvidencePointerSchema: z.ZodObject<{
|
|
|
51
59
|
local_file: "local_file";
|
|
52
60
|
remote_object: "remote_object";
|
|
53
61
|
}>;
|
|
62
|
+
storage_bucket: z.ZodOptional<z.ZodString>;
|
|
54
63
|
local_path: z.ZodOptional<z.ZodString>;
|
|
55
64
|
object_key: z.ZodOptional<z.ZodString>;
|
|
56
65
|
content_hash_sha256: z.ZodOptional<z.ZodString>;
|
|
@@ -65,12 +74,14 @@ export declare const RedactionMetadataSchema: z.ZodObject<{
|
|
|
65
74
|
redacted_summary: "redacted_summary";
|
|
66
75
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
67
76
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
77
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
68
78
|
}>;
|
|
69
79
|
redaction_status: z.ZodEnum<{
|
|
70
80
|
metadata_only: "metadata_only";
|
|
71
81
|
redacted: "redacted";
|
|
72
82
|
raw_local_only: "raw_local_only";
|
|
73
83
|
raw_remote_short_retention: "raw_remote_short_retention";
|
|
84
|
+
raw_remote_durable: "raw_remote_durable";
|
|
74
85
|
}>;
|
|
75
86
|
redacted_fields: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
76
87
|
raw_evidence_pointer_ids: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
package/dist/privacy.js
CHANGED
|
@@ -5,14 +5,17 @@ export const PrivacyClassificationSchema = z.enum([
|
|
|
5
5
|
"redacted_summary",
|
|
6
6
|
"local_only_raw_evidence",
|
|
7
7
|
"remote_short_retention_raw_evidence",
|
|
8
|
+
"remote_durable_raw_evidence",
|
|
8
9
|
]);
|
|
9
10
|
export const RawEvidencePrivacyClassificationSchema = z.enum([
|
|
10
11
|
"local_only_raw_evidence",
|
|
11
12
|
"remote_short_retention_raw_evidence",
|
|
13
|
+
"remote_durable_raw_evidence",
|
|
12
14
|
]);
|
|
13
15
|
export const RawEvidenceRetentionModeSchema = z.enum([
|
|
14
16
|
"local_only",
|
|
15
17
|
"remote_short_retention",
|
|
18
|
+
"remote_durable",
|
|
16
19
|
]);
|
|
17
20
|
export const RawEvidenceRetentionPolicySchema = z
|
|
18
21
|
.object({
|
|
@@ -39,6 +42,14 @@ export const RawEvidenceRetentionPolicySchema = z
|
|
|
39
42
|
path: ["privacy_classification"],
|
|
40
43
|
});
|
|
41
44
|
}
|
|
45
|
+
if (policy.mode === "remote_durable" &&
|
|
46
|
+
policy.privacy_classification !== "remote_durable_raw_evidence") {
|
|
47
|
+
context.addIssue({
|
|
48
|
+
code: "custom",
|
|
49
|
+
message: "remote_durable must use remote_durable_raw_evidence",
|
|
50
|
+
path: ["privacy_classification"],
|
|
51
|
+
});
|
|
52
|
+
}
|
|
42
53
|
if (policy.mode === "local_only" && policy.remote_retention_days) {
|
|
43
54
|
context.addIssue({
|
|
44
55
|
code: "custom",
|
|
@@ -46,6 +57,20 @@ export const RawEvidenceRetentionPolicySchema = z
|
|
|
46
57
|
path: ["remote_retention_days"],
|
|
47
58
|
});
|
|
48
59
|
}
|
|
60
|
+
if (policy.mode === "remote_durable" && policy.remote_retention_days) {
|
|
61
|
+
context.addIssue({
|
|
62
|
+
code: "custom",
|
|
63
|
+
message: "durable remote evidence cannot set remote_retention_days",
|
|
64
|
+
path: ["remote_retention_days"],
|
|
65
|
+
});
|
|
66
|
+
}
|
|
67
|
+
if (policy.mode === "remote_durable" && policy.expires_at) {
|
|
68
|
+
context.addIssue({
|
|
69
|
+
code: "custom",
|
|
70
|
+
message: "durable remote evidence cannot set expires_at",
|
|
71
|
+
path: ["expires_at"],
|
|
72
|
+
});
|
|
73
|
+
}
|
|
49
74
|
if (policy.mode === "remote_short_retention" &&
|
|
50
75
|
!policy.remote_retention_days) {
|
|
51
76
|
context.addIssue({
|
|
@@ -61,6 +86,7 @@ export const RawEvidencePointerSchema = z
|
|
|
61
86
|
privacy_classification: RawEvidencePrivacyClassificationSchema,
|
|
62
87
|
retention_policy: RawEvidenceRetentionPolicySchema,
|
|
63
88
|
storage_scope: z.enum(["local_file", "remote_object"]),
|
|
89
|
+
storage_bucket: NonEmptyStringSchema.optional(),
|
|
64
90
|
local_path: NonEmptyStringSchema.optional(),
|
|
65
91
|
object_key: NonEmptyStringSchema.optional(),
|
|
66
92
|
content_hash_sha256: Sha256Schema.optional(),
|
|
@@ -92,6 +118,13 @@ export const RawEvidencePointerSchema = z
|
|
|
92
118
|
path: ["object_key"],
|
|
93
119
|
});
|
|
94
120
|
}
|
|
121
|
+
if (pointer.storage_scope === "remote_object" && !pointer.storage_bucket) {
|
|
122
|
+
context.addIssue({
|
|
123
|
+
code: "custom",
|
|
124
|
+
message: "remote evidence pointers require storage_bucket",
|
|
125
|
+
path: ["storage_bucket"],
|
|
126
|
+
});
|
|
127
|
+
}
|
|
95
128
|
});
|
|
96
129
|
export const RedactionMetadataSchema = z
|
|
97
130
|
.object({
|
|
@@ -101,6 +134,7 @@ export const RedactionMetadataSchema = z
|
|
|
101
134
|
"redacted",
|
|
102
135
|
"raw_local_only",
|
|
103
136
|
"raw_remote_short_retention",
|
|
137
|
+
"raw_remote_durable",
|
|
104
138
|
]),
|
|
105
139
|
redacted_fields: z.array(NonEmptyStringSchema).default([]),
|
|
106
140
|
raw_evidence_pointer_ids: z.array(NonEmptyStringSchema).default([]),
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
export declare function containsSecretLikeContent(value: string): boolean;
|
|
@@ -0,0 +1,23 @@
|
|
|
1
|
+
const PRIVILEGED_SUPABASE_KEY_NAME_PATTERN = new RegExp(`\\b${["SUPABASE", "SERVICE", "ROLE", "KEY"].join("_")}\\b`, "i");
|
|
2
|
+
const SECRET_LIKE_CONTENT_PATTERNS = [
|
|
3
|
+
/\b(?:NEXT_PUBLIC_)?SUPABASE_ANON_KEY\b/i,
|
|
4
|
+
PRIVILEGED_SUPABASE_KEY_NAME_PATTERN,
|
|
5
|
+
/\bSERVICE[_\s-]?ROLE\b/i,
|
|
6
|
+
/\b(?:api[_-]?key|access[_-]?token|refresh[_-]?token|private[_-]?key|client[_-]?secret|secret[_-]?access[_-]?key)\s*[:=]\s*["']?[A-Za-z0-9_./+=-]{12,}/i,
|
|
7
|
+
/-----BEGIN [A-Z ]*PRIVATE KEY-----/,
|
|
8
|
+
/\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/,
|
|
9
|
+
/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/,
|
|
10
|
+
/\b(?:sk|pk)_(?:live|test)_[A-Za-z0-9]{16,}/,
|
|
11
|
+
/\bsk-[A-Za-z0-9_-]{16,}/,
|
|
12
|
+
/\bgh[pousr]_[A-Za-z0-9_]{16,}/,
|
|
13
|
+
/\bgithub_pat_[A-Za-z0-9_]{20,}/,
|
|
14
|
+
/\blin_api_[A-Za-z0-9]{16,}/,
|
|
15
|
+
/\bsb_secret_[A-Za-z0-9_]{16,}/,
|
|
16
|
+
/\bxox[baprs]-[A-Za-z0-9-]{16,}/,
|
|
17
|
+
/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
|
|
18
|
+
/\bLANGFUSE_(?:PUBLIC|SECRET)_KEY\b/i,
|
|
19
|
+
/\b(?:pk|sk)-lf-[A-Za-z0-9_-]{16,}\b/i,
|
|
20
|
+
];
|
|
21
|
+
export function containsSecretLikeContent(value) {
|
|
22
|
+
return SECRET_LIKE_CONTENT_PATTERNS.some((pattern) => pattern.test(value));
|
|
23
|
+
}
|
package/dist/source-adapter.d.ts
CHANGED
|
@@ -27,12 +27,14 @@ export declare const SourceScanEventSummarySchema: z.ZodObject<{
|
|
|
27
27
|
redacted_summary: "redacted_summary";
|
|
28
28
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
29
29
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
30
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
30
31
|
}>;
|
|
31
32
|
redaction_status: z.ZodEnum<{
|
|
32
33
|
metadata_only: "metadata_only";
|
|
33
34
|
redacted: "redacted";
|
|
34
35
|
raw_local_only: "raw_local_only";
|
|
35
36
|
raw_remote_short_retention: "raw_remote_short_retention";
|
|
37
|
+
raw_remote_durable: "raw_remote_durable";
|
|
36
38
|
}>;
|
|
37
39
|
redacted_fields: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
38
40
|
raw_evidence_pointer_ids: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
@@ -44,15 +46,18 @@ export declare const SourceScanEventSummarySchema: z.ZodObject<{
|
|
|
44
46
|
privacy_classification: z.ZodEnum<{
|
|
45
47
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
46
48
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
49
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
47
50
|
}>;
|
|
48
51
|
retention_policy: z.ZodObject<{
|
|
49
52
|
mode: z.ZodEnum<{
|
|
50
53
|
local_only: "local_only";
|
|
51
54
|
remote_short_retention: "remote_short_retention";
|
|
55
|
+
remote_durable: "remote_durable";
|
|
52
56
|
}>;
|
|
53
57
|
privacy_classification: z.ZodEnum<{
|
|
54
58
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
55
59
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
60
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
56
61
|
}>;
|
|
57
62
|
remote_retention_days: z.ZodOptional<z.ZodNumber>;
|
|
58
63
|
expires_at: z.ZodOptional<z.ZodString>;
|
|
@@ -61,6 +66,7 @@ export declare const SourceScanEventSummarySchema: z.ZodObject<{
|
|
|
61
66
|
local_file: "local_file";
|
|
62
67
|
remote_object: "remote_object";
|
|
63
68
|
}>;
|
|
69
|
+
storage_bucket: z.ZodOptional<z.ZodString>;
|
|
64
70
|
local_path: z.ZodOptional<z.ZodString>;
|
|
65
71
|
object_key: z.ZodOptional<z.ZodString>;
|
|
66
72
|
content_hash_sha256: z.ZodOptional<z.ZodString>;
|
|
@@ -108,12 +114,14 @@ export declare const SourceScanResultSchema: z.ZodObject<{
|
|
|
108
114
|
redacted_summary: "redacted_summary";
|
|
109
115
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
110
116
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
117
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
111
118
|
}>;
|
|
112
119
|
redaction_status: z.ZodEnum<{
|
|
113
120
|
metadata_only: "metadata_only";
|
|
114
121
|
redacted: "redacted";
|
|
115
122
|
raw_local_only: "raw_local_only";
|
|
116
123
|
raw_remote_short_retention: "raw_remote_short_retention";
|
|
124
|
+
raw_remote_durable: "raw_remote_durable";
|
|
117
125
|
}>;
|
|
118
126
|
redacted_fields: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
119
127
|
raw_evidence_pointer_ids: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
@@ -125,15 +133,18 @@ export declare const SourceScanResultSchema: z.ZodObject<{
|
|
|
125
133
|
privacy_classification: z.ZodEnum<{
|
|
126
134
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
127
135
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
136
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
128
137
|
}>;
|
|
129
138
|
retention_policy: z.ZodObject<{
|
|
130
139
|
mode: z.ZodEnum<{
|
|
131
140
|
local_only: "local_only";
|
|
132
141
|
remote_short_retention: "remote_short_retention";
|
|
142
|
+
remote_durable: "remote_durable";
|
|
133
143
|
}>;
|
|
134
144
|
privacy_classification: z.ZodEnum<{
|
|
135
145
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
136
146
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
147
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
137
148
|
}>;
|
|
138
149
|
remote_retention_days: z.ZodOptional<z.ZodNumber>;
|
|
139
150
|
expires_at: z.ZodOptional<z.ZodString>;
|
|
@@ -142,6 +153,7 @@ export declare const SourceScanResultSchema: z.ZodObject<{
|
|
|
142
153
|
local_file: "local_file";
|
|
143
154
|
remote_object: "remote_object";
|
|
144
155
|
}>;
|
|
156
|
+
storage_bucket: z.ZodOptional<z.ZodString>;
|
|
145
157
|
local_path: z.ZodOptional<z.ZodString>;
|
|
146
158
|
object_key: z.ZodOptional<z.ZodString>;
|
|
147
159
|
content_hash_sha256: z.ZodOptional<z.ZodString>;
|
package/dist/trace-sink.d.ts
CHANGED
|
@@ -44,6 +44,7 @@ export declare const ExternalTraceSinkPointerSchema: z.ZodObject<{
|
|
|
44
44
|
redacted_summary: "redacted_summary";
|
|
45
45
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
46
46
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
47
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
47
48
|
}>>;
|
|
48
49
|
}, z.core.$strict>;
|
|
49
50
|
export type ExternalTraceSinkPointer = z.infer<typeof ExternalTraceSinkPointerSchema>;
|