@bli-cockpit/telemetry-core 0.1.0 → 0.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/common.d.ts CHANGED
@@ -38,6 +38,12 @@ export declare const CaptureProvenanceSchema: z.ZodObject<{
38
38
  collector_version: z.ZodString;
39
39
  repo: z.ZodString;
40
40
  branch: z.ZodString;
41
+ repo_label: z.ZodOptional<z.ZodString>;
42
+ repo_fingerprint: z.ZodOptional<z.ZodString>;
43
+ repo_origin_url: z.ZodOptional<z.ZodString>;
44
+ worktree_label: z.ZodOptional<z.ZodString>;
45
+ worktree_fingerprint: z.ZodOptional<z.ZodString>;
46
+ worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
41
47
  operator_id: z.ZodString;
42
48
  session_id: z.ZodString;
43
49
  work_context_id: z.ZodString;
package/dist/common.js CHANGED
@@ -34,6 +34,12 @@ export const CaptureProvenanceSchema = z
34
34
  collector_version: VersionStringSchema,
35
35
  repo: NonEmptyStringSchema,
36
36
  branch: NonEmptyStringSchema,
37
+ repo_label: NonEmptyStringSchema.optional(),
38
+ repo_fingerprint: NonEmptyStringSchema.optional(),
39
+ repo_origin_url: NonEmptyStringSchema.optional(),
40
+ worktree_label: NonEmptyStringSchema.optional(),
41
+ worktree_fingerprint: NonEmptyStringSchema.optional(),
42
+ worktree_is_primary: z.boolean().optional(),
37
43
  operator_id: NonEmptyStringSchema,
38
44
  session_id: NonEmptyStringSchema,
39
45
  work_context_id: NonEmptyStringSchema,
@@ -0,0 +1,376 @@
1
+ import { z } from "zod";
2
+ /**
3
+ * Chunked raw-evidence upload wire contract.
4
+ *
5
+ * Raw evidence bytes move in chunks small enough to clear serverless
6
+ * request-body limits (Vercel rejects bodies around 4.5MB). The server keeps a
7
+ * durable per-object ledger so interrupted uploads resume instead of
8
+ * re-sending bytes, and identical content is acknowledged without re-upload.
9
+ */
10
+ export declare const RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES: number;
11
+ export declare const RAW_EVIDENCE_UPLOAD_MAX_CHUNK_BYTES: number;
12
+ export declare const RAW_EVIDENCE_UPLOAD_DEFAULT_CHUNK_BYTES: number;
13
+ export declare const RAW_EVIDENCE_UPLOAD_MAX_CHUNK_COUNT = 64;
14
+ export declare const RAW_EVIDENCE_UPLOAD_MAX_OBJECTS_PER_BEGIN = 25;
15
+ export declare const CODEX_SESSION_REPORT_MAX_SESSIONS = 200;
16
+ export declare const RawEvidenceUploadBeginObjectSchema: z.ZodObject<{
17
+ pointer: z.ZodObject<{
18
+ raw_evidence_pointer_id: z.ZodString;
19
+ privacy_classification: z.ZodEnum<{
20
+ local_only_raw_evidence: "local_only_raw_evidence";
21
+ remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
22
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
23
+ }>;
24
+ retention_policy: z.ZodObject<{
25
+ mode: z.ZodEnum<{
26
+ local_only: "local_only";
27
+ remote_short_retention: "remote_short_retention";
28
+ remote_durable: "remote_durable";
29
+ }>;
30
+ privacy_classification: z.ZodEnum<{
31
+ local_only_raw_evidence: "local_only_raw_evidence";
32
+ remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
33
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
34
+ }>;
35
+ remote_retention_days: z.ZodOptional<z.ZodNumber>;
36
+ expires_at: z.ZodOptional<z.ZodString>;
37
+ }, z.core.$strict>;
38
+ storage_scope: z.ZodEnum<{
39
+ local_file: "local_file";
40
+ remote_object: "remote_object";
41
+ }>;
42
+ storage_bucket: z.ZodOptional<z.ZodString>;
43
+ local_path: z.ZodOptional<z.ZodString>;
44
+ object_key: z.ZodOptional<z.ZodString>;
45
+ content_hash_sha256: z.ZodOptional<z.ZodString>;
46
+ byte_size: z.ZodOptional<z.ZodNumber>;
47
+ media_type: z.ZodOptional<z.ZodString>;
48
+ redacted_summary: z.ZodOptional<z.ZodString>;
49
+ }, z.core.$strict>;
50
+ chunk_size_bytes: z.ZodNumber;
51
+ chunk_count: z.ZodNumber;
52
+ }, z.core.$strict>;
53
+ export type RawEvidenceUploadBeginObject = z.infer<typeof RawEvidenceUploadBeginObjectSchema>;
54
+ export declare const RawEvidenceUploadBeginRequestSchema: z.ZodObject<{
55
+ schema_version: z.ZodLiteral<"ambient-raw-evidence-upload-begin.v1">;
56
+ generated_at: z.ZodString;
57
+ provenance: z.ZodObject<{
58
+ capture_source: z.ZodEnum<{
59
+ unknown: "unknown";
60
+ codex_jsonl: "codex_jsonl";
61
+ codex_otel: "codex_otel";
62
+ car_state: "car_state";
63
+ git_state: "git_state";
64
+ github_state: "github_state";
65
+ linear_state: "linear_state";
66
+ mcp_local: "mcp_local";
67
+ claude_hooks: "claude_hooks";
68
+ manual_event: "manual_event";
69
+ collector_runtime: "collector_runtime";
70
+ }>;
71
+ capture_adapter_version: z.ZodString;
72
+ collector_version: z.ZodString;
73
+ repo: z.ZodString;
74
+ branch: z.ZodString;
75
+ repo_label: z.ZodOptional<z.ZodString>;
76
+ repo_fingerprint: z.ZodOptional<z.ZodString>;
77
+ repo_origin_url: z.ZodOptional<z.ZodString>;
78
+ worktree_label: z.ZodOptional<z.ZodString>;
79
+ worktree_fingerprint: z.ZodOptional<z.ZodString>;
80
+ worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
81
+ operator_id: z.ZodString;
82
+ session_id: z.ZodString;
83
+ work_context_id: z.ZodString;
84
+ }, z.core.$strict>;
85
+ objects: z.ZodArray<z.ZodObject<{
86
+ pointer: z.ZodObject<{
87
+ raw_evidence_pointer_id: z.ZodString;
88
+ privacy_classification: z.ZodEnum<{
89
+ local_only_raw_evidence: "local_only_raw_evidence";
90
+ remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
91
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
92
+ }>;
93
+ retention_policy: z.ZodObject<{
94
+ mode: z.ZodEnum<{
95
+ local_only: "local_only";
96
+ remote_short_retention: "remote_short_retention";
97
+ remote_durable: "remote_durable";
98
+ }>;
99
+ privacy_classification: z.ZodEnum<{
100
+ local_only_raw_evidence: "local_only_raw_evidence";
101
+ remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
102
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
103
+ }>;
104
+ remote_retention_days: z.ZodOptional<z.ZodNumber>;
105
+ expires_at: z.ZodOptional<z.ZodString>;
106
+ }, z.core.$strict>;
107
+ storage_scope: z.ZodEnum<{
108
+ local_file: "local_file";
109
+ remote_object: "remote_object";
110
+ }>;
111
+ storage_bucket: z.ZodOptional<z.ZodString>;
112
+ local_path: z.ZodOptional<z.ZodString>;
113
+ object_key: z.ZodOptional<z.ZodString>;
114
+ content_hash_sha256: z.ZodOptional<z.ZodString>;
115
+ byte_size: z.ZodOptional<z.ZodNumber>;
116
+ media_type: z.ZodOptional<z.ZodString>;
117
+ redacted_summary: z.ZodOptional<z.ZodString>;
118
+ }, z.core.$strict>;
119
+ chunk_size_bytes: z.ZodNumber;
120
+ chunk_count: z.ZodNumber;
121
+ }, z.core.$strict>>;
122
+ }, z.core.$strict>;
123
+ export type RawEvidenceUploadBeginRequest = z.infer<typeof RawEvidenceUploadBeginRequestSchema>;
124
+ export declare const RawEvidenceUploadDispositionSchema: z.ZodEnum<{
125
+ new: "new";
126
+ resume: "resume";
127
+ already_committed: "already_committed";
128
+ conflict: "conflict";
129
+ }>;
130
+ export type RawEvidenceUploadDisposition = z.infer<typeof RawEvidenceUploadDispositionSchema>;
131
+ export declare const RawEvidenceUploadBeginResponseObjectSchema: z.ZodObject<{
132
+ object_key: z.ZodString;
133
+ raw_evidence_pointer_id: z.ZodString;
134
+ disposition: z.ZodEnum<{
135
+ new: "new";
136
+ resume: "resume";
137
+ already_committed: "already_committed";
138
+ conflict: "conflict";
139
+ }>;
140
+ upload_id: z.ZodOptional<z.ZodString>;
141
+ received_chunk_indexes: z.ZodDefault<z.ZodArray<z.ZodNumber>>;
142
+ reason: z.ZodOptional<z.ZodString>;
143
+ }, z.core.$strict>;
144
+ export type RawEvidenceUploadBeginResponseObject = z.infer<typeof RawEvidenceUploadBeginResponseObjectSchema>;
145
+ export declare const RawEvidenceUploadBeginResponseSchema: z.ZodObject<{
146
+ ok: z.ZodLiteral<true>;
147
+ objects: z.ZodArray<z.ZodObject<{
148
+ object_key: z.ZodString;
149
+ raw_evidence_pointer_id: z.ZodString;
150
+ disposition: z.ZodEnum<{
151
+ new: "new";
152
+ resume: "resume";
153
+ already_committed: "already_committed";
154
+ conflict: "conflict";
155
+ }>;
156
+ upload_id: z.ZodOptional<z.ZodString>;
157
+ received_chunk_indexes: z.ZodDefault<z.ZodArray<z.ZodNumber>>;
158
+ reason: z.ZodOptional<z.ZodString>;
159
+ }, z.core.$strict>>;
160
+ }, z.core.$strict>;
161
+ export type RawEvidenceUploadBeginResponse = z.infer<typeof RawEvidenceUploadBeginResponseSchema>;
162
+ export declare const RawEvidenceUploadChunkRequestSchema: z.ZodObject<{
163
+ schema_version: z.ZodLiteral<"ambient-raw-evidence-upload-chunk.v1">;
164
+ generated_at: z.ZodString;
165
+ provenance: z.ZodObject<{
166
+ capture_source: z.ZodEnum<{
167
+ unknown: "unknown";
168
+ codex_jsonl: "codex_jsonl";
169
+ codex_otel: "codex_otel";
170
+ car_state: "car_state";
171
+ git_state: "git_state";
172
+ github_state: "github_state";
173
+ linear_state: "linear_state";
174
+ mcp_local: "mcp_local";
175
+ claude_hooks: "claude_hooks";
176
+ manual_event: "manual_event";
177
+ collector_runtime: "collector_runtime";
178
+ }>;
179
+ capture_adapter_version: z.ZodString;
180
+ collector_version: z.ZodString;
181
+ repo: z.ZodString;
182
+ branch: z.ZodString;
183
+ repo_label: z.ZodOptional<z.ZodString>;
184
+ repo_fingerprint: z.ZodOptional<z.ZodString>;
185
+ repo_origin_url: z.ZodOptional<z.ZodString>;
186
+ worktree_label: z.ZodOptional<z.ZodString>;
187
+ worktree_fingerprint: z.ZodOptional<z.ZodString>;
188
+ worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
189
+ operator_id: z.ZodString;
190
+ session_id: z.ZodString;
191
+ work_context_id: z.ZodString;
192
+ }, z.core.$strict>;
193
+ upload_id: z.ZodString;
194
+ object_key: z.ZodString;
195
+ chunk_index: z.ZodNumber;
196
+ chunk_count: z.ZodNumber;
197
+ chunk_hash_sha256: z.ZodString;
198
+ content_base64: z.ZodString;
199
+ }, z.core.$strict>;
200
+ export type RawEvidenceUploadChunkRequest = z.infer<typeof RawEvidenceUploadChunkRequestSchema>;
201
+ export declare const RawEvidenceUploadChunkResponseSchema: z.ZodObject<{
202
+ ok: z.ZodLiteral<true>;
203
+ upload_id: z.ZodString;
204
+ chunk_index: z.ZodNumber;
205
+ received_chunk_count: z.ZodNumber;
206
+ }, z.core.$strict>;
207
+ export type RawEvidenceUploadChunkResponse = z.infer<typeof RawEvidenceUploadChunkResponseSchema>;
208
+ export declare const RawEvidenceUploadCommitRequestSchema: z.ZodObject<{
209
+ schema_version: z.ZodLiteral<"ambient-raw-evidence-upload-commit.v1">;
210
+ generated_at: z.ZodString;
211
+ provenance: z.ZodObject<{
212
+ capture_source: z.ZodEnum<{
213
+ unknown: "unknown";
214
+ codex_jsonl: "codex_jsonl";
215
+ codex_otel: "codex_otel";
216
+ car_state: "car_state";
217
+ git_state: "git_state";
218
+ github_state: "github_state";
219
+ linear_state: "linear_state";
220
+ mcp_local: "mcp_local";
221
+ claude_hooks: "claude_hooks";
222
+ manual_event: "manual_event";
223
+ collector_runtime: "collector_runtime";
224
+ }>;
225
+ capture_adapter_version: z.ZodString;
226
+ collector_version: z.ZodString;
227
+ repo: z.ZodString;
228
+ branch: z.ZodString;
229
+ repo_label: z.ZodOptional<z.ZodString>;
230
+ repo_fingerprint: z.ZodOptional<z.ZodString>;
231
+ repo_origin_url: z.ZodOptional<z.ZodString>;
232
+ worktree_label: z.ZodOptional<z.ZodString>;
233
+ worktree_fingerprint: z.ZodOptional<z.ZodString>;
234
+ worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
235
+ operator_id: z.ZodString;
236
+ session_id: z.ZodString;
237
+ work_context_id: z.ZodString;
238
+ }, z.core.$strict>;
239
+ upload_id: z.ZodString;
240
+ object_key: z.ZodString;
241
+ }, z.core.$strict>;
242
+ export type RawEvidenceUploadCommitRequest = z.infer<typeof RawEvidenceUploadCommitRequestSchema>;
243
+ export declare const RawEvidenceUploadCommitResponseSchema: z.ZodObject<{
244
+ ok: z.ZodLiteral<true>;
245
+ status: z.ZodEnum<{
246
+ already_committed: "already_committed";
247
+ committed: "committed";
248
+ }>;
249
+ object_key: z.ZodString;
250
+ content_hash_sha256: z.ZodString;
251
+ byte_size: z.ZodNumber;
252
+ chunk_count: z.ZodNumber;
253
+ }, z.core.$strict>;
254
+ export type RawEvidenceUploadCommitResponse = z.infer<typeof RawEvidenceUploadCommitResponseSchema>;
255
+ /**
256
+ * Codex session attribution report.
257
+ *
258
+ * The collector attributes Codex session JSONL files to repos/worktrees with
259
+ * deterministic metadata signals. Sessions that cannot be attributed are
260
+ * reported here with reason labels and safe pointers (session id, file hash,
261
+ * cwd basename/hash) instead of being duplicated into every repo's evidence
262
+ * pack or silently dropped. No content-bearing fields are allowed.
263
+ */
264
+ export declare const CodexSessionAttributionStateSchema: z.ZodEnum<{
265
+ attributed: "attributed";
266
+ ambiguous: "ambiguous";
267
+ unattributed: "unattributed";
268
+ skipped: "skipped";
269
+ }>;
270
+ export type CodexSessionAttributionState = z.infer<typeof CodexSessionAttributionStateSchema>;
271
+ export declare const CodexSessionUploadStateSchema: z.ZodEnum<{
272
+ uploaded: "uploaded";
273
+ reused_existing: "reused_existing";
274
+ upload_failed: "upload_failed";
275
+ not_uploaded: "not_uploaded";
276
+ }>;
277
+ export type CodexSessionUploadState = z.infer<typeof CodexSessionUploadStateSchema>;
278
+ export declare const CodexSessionAttributionSchema: z.ZodObject<{
279
+ codex_session_id: z.ZodString;
280
+ observed_at: z.ZodString;
281
+ attribution_state: z.ZodEnum<{
282
+ attributed: "attributed";
283
+ ambiguous: "ambiguous";
284
+ unattributed: "unattributed";
285
+ skipped: "skipped";
286
+ }>;
287
+ attribution_reason: z.ZodString;
288
+ attribution_score: z.ZodOptional<z.ZodNumber>;
289
+ path_score: z.ZodOptional<z.ZodNumber>;
290
+ signals: z.ZodDefault<z.ZodArray<z.ZodString>>;
291
+ session_file_hash_sha256: z.ZodOptional<z.ZodString>;
292
+ session_file_byte_size: z.ZodOptional<z.ZodNumber>;
293
+ session_file_mtime: z.ZodOptional<z.ZodString>;
294
+ repo_fingerprint: z.ZodOptional<z.ZodString>;
295
+ worktree_fingerprint: z.ZodOptional<z.ZodString>;
296
+ repo_label: z.ZodOptional<z.ZodString>;
297
+ branch: z.ZodOptional<z.ZodString>;
298
+ cwd_basename: z.ZodOptional<z.ZodString>;
299
+ cwd_hash: z.ZodOptional<z.ZodString>;
300
+ raw_evidence_pointer_id: z.ZodOptional<z.ZodString>;
301
+ upload_state: z.ZodOptional<z.ZodEnum<{
302
+ uploaded: "uploaded";
303
+ reused_existing: "reused_existing";
304
+ upload_failed: "upload_failed";
305
+ not_uploaded: "not_uploaded";
306
+ }>>;
307
+ }, z.core.$strict>;
308
+ export type CodexSessionAttribution = z.infer<typeof CodexSessionAttributionSchema>;
309
+ export declare const CodexSessionAttributionReportRequestSchema: z.ZodObject<{
310
+ schema_version: z.ZodLiteral<"ambient-codex-session-attributions.v1">;
311
+ generated_at: z.ZodString;
312
+ provenance: z.ZodObject<{
313
+ capture_source: z.ZodEnum<{
314
+ unknown: "unknown";
315
+ codex_jsonl: "codex_jsonl";
316
+ codex_otel: "codex_otel";
317
+ car_state: "car_state";
318
+ git_state: "git_state";
319
+ github_state: "github_state";
320
+ linear_state: "linear_state";
321
+ mcp_local: "mcp_local";
322
+ claude_hooks: "claude_hooks";
323
+ manual_event: "manual_event";
324
+ collector_runtime: "collector_runtime";
325
+ }>;
326
+ capture_adapter_version: z.ZodString;
327
+ collector_version: z.ZodString;
328
+ repo: z.ZodString;
329
+ branch: z.ZodString;
330
+ repo_label: z.ZodOptional<z.ZodString>;
331
+ repo_fingerprint: z.ZodOptional<z.ZodString>;
332
+ repo_origin_url: z.ZodOptional<z.ZodString>;
333
+ worktree_label: z.ZodOptional<z.ZodString>;
334
+ worktree_fingerprint: z.ZodOptional<z.ZodString>;
335
+ worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
336
+ operator_id: z.ZodString;
337
+ session_id: z.ZodString;
338
+ work_context_id: z.ZodString;
339
+ }, z.core.$strict>;
340
+ sessions: z.ZodArray<z.ZodObject<{
341
+ codex_session_id: z.ZodString;
342
+ observed_at: z.ZodString;
343
+ attribution_state: z.ZodEnum<{
344
+ attributed: "attributed";
345
+ ambiguous: "ambiguous";
346
+ unattributed: "unattributed";
347
+ skipped: "skipped";
348
+ }>;
349
+ attribution_reason: z.ZodString;
350
+ attribution_score: z.ZodOptional<z.ZodNumber>;
351
+ path_score: z.ZodOptional<z.ZodNumber>;
352
+ signals: z.ZodDefault<z.ZodArray<z.ZodString>>;
353
+ session_file_hash_sha256: z.ZodOptional<z.ZodString>;
354
+ session_file_byte_size: z.ZodOptional<z.ZodNumber>;
355
+ session_file_mtime: z.ZodOptional<z.ZodString>;
356
+ repo_fingerprint: z.ZodOptional<z.ZodString>;
357
+ worktree_fingerprint: z.ZodOptional<z.ZodString>;
358
+ repo_label: z.ZodOptional<z.ZodString>;
359
+ branch: z.ZodOptional<z.ZodString>;
360
+ cwd_basename: z.ZodOptional<z.ZodString>;
361
+ cwd_hash: z.ZodOptional<z.ZodString>;
362
+ raw_evidence_pointer_id: z.ZodOptional<z.ZodString>;
363
+ upload_state: z.ZodOptional<z.ZodEnum<{
364
+ uploaded: "uploaded";
365
+ reused_existing: "reused_existing";
366
+ upload_failed: "upload_failed";
367
+ not_uploaded: "not_uploaded";
368
+ }>>;
369
+ }, z.core.$strict>>;
370
+ }, z.core.$strict>;
371
+ export type CodexSessionAttributionReportRequest = z.infer<typeof CodexSessionAttributionReportRequestSchema>;
372
+ export declare const CodexSessionAttributionReportResponseSchema: z.ZodObject<{
373
+ ok: z.ZodLiteral<true>;
374
+ recorded_count: z.ZodNumber;
375
+ }, z.core.$strict>;
376
+ export type CodexSessionAttributionReportResponse = z.infer<typeof CodexSessionAttributionReportResponseSchema>;
@@ -0,0 +1,184 @@
1
+ import { z } from "zod";
2
+ import { CaptureProvenanceSchema, IsoDateTimeSchema, NonEmptyStringSchema, Sha256Schema, } from "./common.js";
3
+ import { RawEvidencePointerSchema } from "./privacy.js";
4
+ /**
5
+ * Chunked raw-evidence upload wire contract.
6
+ *
7
+ * Raw evidence bytes move in chunks small enough to clear serverless
8
+ * request-body limits (Vercel rejects bodies around 4.5MB). The server keeps a
9
+ * durable per-object ledger so interrupted uploads resume instead of
10
+ * re-sending bytes, and identical content is acknowledged without re-upload.
11
+ */
12
+ export const RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES = 10 * 1024 * 1024;
13
+ export const RAW_EVIDENCE_UPLOAD_MAX_CHUNK_BYTES = 3 * 1024 * 1024;
14
+ export const RAW_EVIDENCE_UPLOAD_DEFAULT_CHUNK_BYTES = 2 * 1024 * 1024;
15
+ export const RAW_EVIDENCE_UPLOAD_MAX_CHUNK_COUNT = 64;
16
+ export const RAW_EVIDENCE_UPLOAD_MAX_OBJECTS_PER_BEGIN = 25;
17
+ export const CODEX_SESSION_REPORT_MAX_SESSIONS = 200;
18
+ const SafeLabelSchema = z
19
+ .string()
20
+ .trim()
21
+ .min(1)
22
+ .max(120)
23
+ .regex(/^[a-z0-9_:.-]+$/i);
24
+ const BasenameSchema = z
25
+ .string()
26
+ .trim()
27
+ .min(1)
28
+ .max(160)
29
+ .regex(/^[^/\\]+$/);
30
+ export const RawEvidenceUploadBeginObjectSchema = z
31
+ .object({
32
+ pointer: RawEvidencePointerSchema,
33
+ chunk_size_bytes: z
34
+ .number()
35
+ .int()
36
+ .positive()
37
+ .max(RAW_EVIDENCE_UPLOAD_MAX_CHUNK_BYTES),
38
+ chunk_count: z
39
+ .number()
40
+ .int()
41
+ .positive()
42
+ .max(RAW_EVIDENCE_UPLOAD_MAX_CHUNK_COUNT),
43
+ })
44
+ .strict();
45
+ export const RawEvidenceUploadBeginRequestSchema = z
46
+ .object({
47
+ schema_version: z.literal("ambient-raw-evidence-upload-begin.v1"),
48
+ generated_at: IsoDateTimeSchema,
49
+ provenance: CaptureProvenanceSchema,
50
+ objects: z
51
+ .array(RawEvidenceUploadBeginObjectSchema)
52
+ .min(1)
53
+ .max(RAW_EVIDENCE_UPLOAD_MAX_OBJECTS_PER_BEGIN),
54
+ })
55
+ .strict();
56
+ export const RawEvidenceUploadDispositionSchema = z.enum([
57
+ "new",
58
+ "resume",
59
+ "already_committed",
60
+ "conflict",
61
+ ]);
62
+ export const RawEvidenceUploadBeginResponseObjectSchema = z
63
+ .object({
64
+ object_key: NonEmptyStringSchema,
65
+ raw_evidence_pointer_id: NonEmptyStringSchema,
66
+ disposition: RawEvidenceUploadDispositionSchema,
67
+ upload_id: NonEmptyStringSchema.optional(),
68
+ received_chunk_indexes: z.array(z.number().int().nonnegative()).default([]),
69
+ reason: SafeLabelSchema.optional(),
70
+ })
71
+ .strict();
72
+ export const RawEvidenceUploadBeginResponseSchema = z
73
+ .object({
74
+ ok: z.literal(true),
75
+ objects: z.array(RawEvidenceUploadBeginResponseObjectSchema),
76
+ })
77
+ .strict();
78
+ export const RawEvidenceUploadChunkRequestSchema = z
79
+ .object({
80
+ schema_version: z.literal("ambient-raw-evidence-upload-chunk.v1"),
81
+ generated_at: IsoDateTimeSchema,
82
+ provenance: CaptureProvenanceSchema,
83
+ upload_id: NonEmptyStringSchema,
84
+ object_key: NonEmptyStringSchema,
85
+ chunk_index: z.number().int().nonnegative(),
86
+ chunk_count: z
87
+ .number()
88
+ .int()
89
+ .positive()
90
+ .max(RAW_EVIDENCE_UPLOAD_MAX_CHUNK_COUNT),
91
+ chunk_hash_sha256: Sha256Schema,
92
+ content_base64: z.string().min(1),
93
+ })
94
+ .strict();
95
+ export const RawEvidenceUploadChunkResponseSchema = z
96
+ .object({
97
+ ok: z.literal(true),
98
+ upload_id: NonEmptyStringSchema,
99
+ chunk_index: z.number().int().nonnegative(),
100
+ received_chunk_count: z.number().int().nonnegative(),
101
+ })
102
+ .strict();
103
+ export const RawEvidenceUploadCommitRequestSchema = z
104
+ .object({
105
+ schema_version: z.literal("ambient-raw-evidence-upload-commit.v1"),
106
+ generated_at: IsoDateTimeSchema,
107
+ provenance: CaptureProvenanceSchema,
108
+ upload_id: NonEmptyStringSchema,
109
+ object_key: NonEmptyStringSchema,
110
+ })
111
+ .strict();
112
+ export const RawEvidenceUploadCommitResponseSchema = z
113
+ .object({
114
+ ok: z.literal(true),
115
+ status: z.enum(["committed", "already_committed"]),
116
+ object_key: NonEmptyStringSchema,
117
+ content_hash_sha256: Sha256Schema,
118
+ byte_size: z.number().int().nonnegative(),
119
+ chunk_count: z.number().int().nonnegative(),
120
+ })
121
+ .strict();
122
+ /**
123
+ * Codex session attribution report.
124
+ *
125
+ * The collector attributes Codex session JSONL files to repos/worktrees with
126
+ * deterministic metadata signals. Sessions that cannot be attributed are
127
+ * reported here with reason labels and safe pointers (session id, file hash,
128
+ * cwd basename/hash) instead of being duplicated into every repo's evidence
129
+ * pack or silently dropped. No content-bearing fields are allowed.
130
+ */
131
+ export const CodexSessionAttributionStateSchema = z.enum([
132
+ "attributed",
133
+ "ambiguous",
134
+ "unattributed",
135
+ "skipped",
136
+ ]);
137
+ export const CodexSessionUploadStateSchema = z.enum([
138
+ "uploaded",
139
+ "reused_existing",
140
+ "upload_failed",
141
+ "not_uploaded",
142
+ ]);
143
+ export const CodexSessionAttributionSchema = z
144
+ .object({
145
+ codex_session_id: NonEmptyStringSchema.max(120),
146
+ observed_at: IsoDateTimeSchema,
147
+ attribution_state: CodexSessionAttributionStateSchema,
148
+ attribution_reason: SafeLabelSchema,
149
+ attribution_score: z.number().min(0).max(1).optional(),
150
+ path_score: z.number().min(0).max(1).optional(),
151
+ signals: z.array(SafeLabelSchema).max(20).default([]),
152
+ session_file_hash_sha256: Sha256Schema.optional(),
153
+ session_file_byte_size: z.number().int().nonnegative().optional(),
154
+ session_file_mtime: IsoDateTimeSchema.optional(),
155
+ repo_fingerprint: SafeLabelSchema.optional(),
156
+ worktree_fingerprint: SafeLabelSchema.optional(),
157
+ repo_label: BasenameSchema.optional(),
158
+ branch: z.string().trim().min(1).max(200).optional(),
159
+ cwd_basename: BasenameSchema.optional(),
160
+ cwd_hash: z
161
+ .string()
162
+ .regex(/^[a-f0-9]{16,64}$/)
163
+ .optional(),
164
+ raw_evidence_pointer_id: NonEmptyStringSchema.optional(),
165
+ upload_state: CodexSessionUploadStateSchema.optional(),
166
+ })
167
+ .strict();
168
+ export const CodexSessionAttributionReportRequestSchema = z
169
+ .object({
170
+ schema_version: z.literal("ambient-codex-session-attributions.v1"),
171
+ generated_at: IsoDateTimeSchema,
172
+ provenance: CaptureProvenanceSchema,
173
+ sessions: z
174
+ .array(CodexSessionAttributionSchema)
175
+ .min(1)
176
+ .max(CODEX_SESSION_REPORT_MAX_SESSIONS),
177
+ })
178
+ .strict();
179
+ export const CodexSessionAttributionReportResponseSchema = z
180
+ .object({
181
+ ok: z.literal(true),
182
+ recorded_count: z.number().int().nonnegative(),
183
+ })
184
+ .strict();
package/dist/index.d.ts CHANGED
@@ -1,9 +1,11 @@
1
1
  export * from "./common.js";
2
+ export * from "./evidence-upload.js";
2
3
  export * from "./ingest-dto.js";
3
4
  export * from "./local-config.js";
4
5
  export * from "./paths.js";
5
6
  export * from "./privacy.js";
6
7
  export * from "./risk-flags.js";
8
+ export * from "./secret-guards.js";
7
9
  export * from "./source-adapter.js";
8
10
  export * from "./trace-sink.js";
9
11
  export * from "./work-context.js";
package/dist/index.js CHANGED
@@ -1,9 +1,11 @@
1
1
  export * from "./common.js";
2
+ export * from "./evidence-upload.js";
2
3
  export * from "./ingest-dto.js";
3
4
  export * from "./local-config.js";
4
5
  export * from "./paths.js";
5
6
  export * from "./privacy.js";
6
7
  export * from "./risk-flags.js";
8
+ export * from "./secret-guards.js";
7
9
  export * from "./source-adapter.js";
8
10
  export * from "./trace-sink.js";
9
11
  export * from "./work-context.js";
@@ -47,6 +47,12 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
47
47
  collector_version: z.ZodString;
48
48
  repo: z.ZodString;
49
49
  branch: z.ZodString;
50
+ repo_label: z.ZodOptional<z.ZodString>;
51
+ repo_fingerprint: z.ZodOptional<z.ZodString>;
52
+ repo_origin_url: z.ZodOptional<z.ZodString>;
53
+ worktree_label: z.ZodOptional<z.ZodString>;
54
+ worktree_fingerprint: z.ZodOptional<z.ZodString>;
55
+ worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
50
56
  operator_id: z.ZodString;
51
57
  session_id: z.ZodString;
52
58
  work_context_id: z.ZodString;
@@ -56,6 +62,7 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
56
62
  redacted_summary: "redacted_summary";
57
63
  local_only_raw_evidence: "local_only_raw_evidence";
58
64
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
65
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
59
66
  }>;
60
67
  redaction: z.ZodObject<{
61
68
  privacy_classification: z.ZodEnum<{
@@ -63,12 +70,14 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
63
70
  redacted_summary: "redacted_summary";
64
71
  local_only_raw_evidence: "local_only_raw_evidence";
65
72
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
73
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
66
74
  }>;
67
75
  redaction_status: z.ZodEnum<{
68
76
  metadata_only: "metadata_only";
69
77
  redacted: "redacted";
70
78
  raw_local_only: "raw_local_only";
71
79
  raw_remote_short_retention: "raw_remote_short_retention";
80
+ raw_remote_durable: "raw_remote_durable";
72
81
  }>;
73
82
  redacted_fields: z.ZodDefault<z.ZodArray<z.ZodString>>;
74
83
  raw_evidence_pointer_ids: z.ZodDefault<z.ZodArray<z.ZodString>>;
@@ -153,6 +162,12 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
153
162
  collector_version: z.ZodString;
154
163
  repo: z.ZodString;
155
164
  branch: z.ZodString;
165
+ repo_label: z.ZodOptional<z.ZodString>;
166
+ repo_fingerprint: z.ZodOptional<z.ZodString>;
167
+ repo_origin_url: z.ZodOptional<z.ZodString>;
168
+ worktree_label: z.ZodOptional<z.ZodString>;
169
+ worktree_fingerprint: z.ZodOptional<z.ZodString>;
170
+ worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
156
171
  operator_id: z.ZodString;
157
172
  session_id: z.ZodString;
158
173
  work_context_id: z.ZodString;
@@ -163,15 +178,18 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
163
178
  privacy_classification: z.ZodEnum<{
164
179
  local_only_raw_evidence: "local_only_raw_evidence";
165
180
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
181
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
166
182
  }>;
167
183
  retention_policy: z.ZodObject<{
168
184
  mode: z.ZodEnum<{
169
185
  local_only: "local_only";
170
186
  remote_short_retention: "remote_short_retention";
187
+ remote_durable: "remote_durable";
171
188
  }>;
172
189
  privacy_classification: z.ZodEnum<{
173
190
  local_only_raw_evidence: "local_only_raw_evidence";
174
191
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
192
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
175
193
  }>;
176
194
  remote_retention_days: z.ZodOptional<z.ZodNumber>;
177
195
  expires_at: z.ZodOptional<z.ZodString>;
@@ -180,6 +198,7 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
180
198
  local_file: "local_file";
181
199
  remote_object: "remote_object";
182
200
  }>;
201
+ storage_bucket: z.ZodOptional<z.ZodString>;
183
202
  local_path: z.ZodOptional<z.ZodString>;
184
203
  object_key: z.ZodOptional<z.ZodString>;
185
204
  content_hash_sha256: z.ZodOptional<z.ZodString>;
@@ -221,6 +240,7 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
221
240
  redacted_summary: "redacted_summary";
222
241
  local_only_raw_evidence: "local_only_raw_evidence";
223
242
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
243
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
224
244
  }>>;
225
245
  }, z.core.$strict>>;
226
246
  }, z.core.$strict>;
@@ -256,6 +276,13 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
256
276
  work_context_id: z.ZodString;
257
277
  repo: z.ZodString;
258
278
  branch: z.ZodString;
279
+ repo_label: z.ZodOptional<z.ZodString>;
280
+ repo_fingerprint: z.ZodOptional<z.ZodString>;
281
+ repo_origin_url: z.ZodOptional<z.ZodString>;
282
+ head_sha: z.ZodOptional<z.ZodString>;
283
+ worktree_label: z.ZodOptional<z.ZodString>;
284
+ worktree_fingerprint: z.ZodOptional<z.ZodString>;
285
+ worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
259
286
  operator_id: z.ZodString;
260
287
  session_id: z.ZodString;
261
288
  started_at: z.ZodString;
@@ -295,6 +322,12 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
295
322
  collector_version: z.ZodString;
296
323
  repo: z.ZodString;
297
324
  branch: z.ZodString;
325
+ repo_label: z.ZodOptional<z.ZodString>;
326
+ repo_fingerprint: z.ZodOptional<z.ZodString>;
327
+ repo_origin_url: z.ZodOptional<z.ZodString>;
328
+ worktree_label: z.ZodOptional<z.ZodString>;
329
+ worktree_fingerprint: z.ZodOptional<z.ZodString>;
330
+ worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
298
331
  operator_id: z.ZodString;
299
332
  session_id: z.ZodString;
300
333
  work_context_id: z.ZodString;
@@ -334,6 +367,12 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
334
367
  collector_version: z.ZodString;
335
368
  repo: z.ZodString;
336
369
  branch: z.ZodString;
370
+ repo_label: z.ZodOptional<z.ZodString>;
371
+ repo_fingerprint: z.ZodOptional<z.ZodString>;
372
+ repo_origin_url: z.ZodOptional<z.ZodString>;
373
+ worktree_label: z.ZodOptional<z.ZodString>;
374
+ worktree_fingerprint: z.ZodOptional<z.ZodString>;
375
+ worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
337
376
  operator_id: z.ZodString;
338
377
  session_id: z.ZodString;
339
378
  work_context_id: z.ZodString;
@@ -343,6 +382,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
343
382
  redacted_summary: "redacted_summary";
344
383
  local_only_raw_evidence: "local_only_raw_evidence";
345
384
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
385
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
346
386
  }>;
347
387
  redaction: z.ZodObject<{
348
388
  privacy_classification: z.ZodEnum<{
@@ -350,12 +390,14 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
350
390
  redacted_summary: "redacted_summary";
351
391
  local_only_raw_evidence: "local_only_raw_evidence";
352
392
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
393
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
353
394
  }>;
354
395
  redaction_status: z.ZodEnum<{
355
396
  metadata_only: "metadata_only";
356
397
  redacted: "redacted";
357
398
  raw_local_only: "raw_local_only";
358
399
  raw_remote_short_retention: "raw_remote_short_retention";
400
+ raw_remote_durable: "raw_remote_durable";
359
401
  }>;
360
402
  redacted_fields: z.ZodDefault<z.ZodArray<z.ZodString>>;
361
403
  raw_evidence_pointer_ids: z.ZodDefault<z.ZodArray<z.ZodString>>;
@@ -440,6 +482,12 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
440
482
  collector_version: z.ZodString;
441
483
  repo: z.ZodString;
442
484
  branch: z.ZodString;
485
+ repo_label: z.ZodOptional<z.ZodString>;
486
+ repo_fingerprint: z.ZodOptional<z.ZodString>;
487
+ repo_origin_url: z.ZodOptional<z.ZodString>;
488
+ worktree_label: z.ZodOptional<z.ZodString>;
489
+ worktree_fingerprint: z.ZodOptional<z.ZodString>;
490
+ worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
443
491
  operator_id: z.ZodString;
444
492
  session_id: z.ZodString;
445
493
  work_context_id: z.ZodString;
@@ -450,15 +498,18 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
450
498
  privacy_classification: z.ZodEnum<{
451
499
  local_only_raw_evidence: "local_only_raw_evidence";
452
500
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
501
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
453
502
  }>;
454
503
  retention_policy: z.ZodObject<{
455
504
  mode: z.ZodEnum<{
456
505
  local_only: "local_only";
457
506
  remote_short_retention: "remote_short_retention";
507
+ remote_durable: "remote_durable";
458
508
  }>;
459
509
  privacy_classification: z.ZodEnum<{
460
510
  local_only_raw_evidence: "local_only_raw_evidence";
461
511
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
512
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
462
513
  }>;
463
514
  remote_retention_days: z.ZodOptional<z.ZodNumber>;
464
515
  expires_at: z.ZodOptional<z.ZodString>;
@@ -467,6 +518,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
467
518
  local_file: "local_file";
468
519
  remote_object: "remote_object";
469
520
  }>;
521
+ storage_bucket: z.ZodOptional<z.ZodString>;
470
522
  local_path: z.ZodOptional<z.ZodString>;
471
523
  object_key: z.ZodOptional<z.ZodString>;
472
524
  content_hash_sha256: z.ZodOptional<z.ZodString>;
@@ -508,6 +560,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
508
560
  redacted_summary: "redacted_summary";
509
561
  local_only_raw_evidence: "local_only_raw_evidence";
510
562
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
563
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
511
564
  }>>;
512
565
  }, z.core.$strict>>;
513
566
  }, z.core.$strict>>;
@@ -532,8 +585,8 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
532
585
  work_context_id: z.ZodOptional<z.ZodString>;
533
586
  status: z.ZodEnum<{
534
587
  ok: "ok";
535
- partial: "partial";
536
588
  skipped: "skipped";
589
+ partial: "partial";
537
590
  failed: "failed";
538
591
  }>;
539
592
  started_at: z.ZodString;
@@ -549,12 +602,14 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
549
602
  redacted_summary: "redacted_summary";
550
603
  local_only_raw_evidence: "local_only_raw_evidence";
551
604
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
605
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
552
606
  }>;
553
607
  redaction_status: z.ZodEnum<{
554
608
  metadata_only: "metadata_only";
555
609
  redacted: "redacted";
556
610
  raw_local_only: "raw_local_only";
557
611
  raw_remote_short_retention: "raw_remote_short_retention";
612
+ raw_remote_durable: "raw_remote_durable";
558
613
  }>;
559
614
  redacted_fields: z.ZodDefault<z.ZodArray<z.ZodString>>;
560
615
  raw_evidence_pointer_ids: z.ZodDefault<z.ZodArray<z.ZodString>>;
@@ -566,15 +621,18 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
566
621
  privacy_classification: z.ZodEnum<{
567
622
  local_only_raw_evidence: "local_only_raw_evidence";
568
623
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
624
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
569
625
  }>;
570
626
  retention_policy: z.ZodObject<{
571
627
  mode: z.ZodEnum<{
572
628
  local_only: "local_only";
573
629
  remote_short_retention: "remote_short_retention";
630
+ remote_durable: "remote_durable";
574
631
  }>;
575
632
  privacy_classification: z.ZodEnum<{
576
633
  local_only_raw_evidence: "local_only_raw_evidence";
577
634
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
635
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
578
636
  }>;
579
637
  remote_retention_days: z.ZodOptional<z.ZodNumber>;
580
638
  expires_at: z.ZodOptional<z.ZodString>;
@@ -583,6 +641,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
583
641
  local_file: "local_file";
584
642
  remote_object: "remote_object";
585
643
  }>;
644
+ storage_bucket: z.ZodOptional<z.ZodString>;
586
645
  local_path: z.ZodOptional<z.ZodString>;
587
646
  object_key: z.ZodOptional<z.ZodString>;
588
647
  content_hash_sha256: z.ZodOptional<z.ZodString>;
@@ -666,6 +725,12 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
666
725
  collector_version: z.ZodString;
667
726
  repo: z.ZodString;
668
727
  branch: z.ZodString;
728
+ repo_label: z.ZodOptional<z.ZodString>;
729
+ repo_fingerprint: z.ZodOptional<z.ZodString>;
730
+ repo_origin_url: z.ZodOptional<z.ZodString>;
731
+ worktree_label: z.ZodOptional<z.ZodString>;
732
+ worktree_fingerprint: z.ZodOptional<z.ZodString>;
733
+ worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
669
734
  operator_id: z.ZodString;
670
735
  session_id: z.ZodString;
671
736
  work_context_id: z.ZodString;
@@ -12,6 +12,7 @@ export declare const LocalCollectorConfigSchema: z.ZodObject<{
12
12
  raw_evidence_upload: z.ZodDefault<z.ZodEnum<{
13
13
  disabled: "disabled";
14
14
  remote_short_retention_opt_in: "remote_short_retention_opt_in";
15
+ remote_durable_opt_in: "remote_durable_opt_in";
15
16
  }>>;
16
17
  session_file_path: z.ZodOptional<z.ZodString>;
17
18
  state_dir_path: z.ZodOptional<z.ZodString>;
@@ -12,8 +12,12 @@ export const LocalCollectorConfigSchema = z
12
12
  operator_id: NonEmptyStringSchema.optional(),
13
13
  default_repo_paths: z.array(NonEmptyStringSchema).default([]),
14
14
  raw_evidence_upload: z
15
- .enum(["disabled", "remote_short_retention_opt_in"])
16
- .default("disabled"),
15
+ .enum([
16
+ "disabled",
17
+ "remote_short_retention_opt_in",
18
+ "remote_durable_opt_in",
19
+ ])
20
+ .default("remote_durable_opt_in"),
17
21
  session_file_path: NonEmptyStringSchema.optional(),
18
22
  state_dir_path: NonEmptyStringSchema.optional(),
19
23
  })
package/dist/privacy.d.ts CHANGED
@@ -4,26 +4,31 @@ export declare const PrivacyClassificationSchema: z.ZodEnum<{
4
4
  redacted_summary: "redacted_summary";
5
5
  local_only_raw_evidence: "local_only_raw_evidence";
6
6
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
7
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
7
8
  }>;
8
9
  export type PrivacyClassification = z.infer<typeof PrivacyClassificationSchema>;
9
10
  export declare const RawEvidencePrivacyClassificationSchema: z.ZodEnum<{
10
11
  local_only_raw_evidence: "local_only_raw_evidence";
11
12
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
13
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
12
14
  }>;
13
15
  export type RawEvidencePrivacyClassification = z.infer<typeof RawEvidencePrivacyClassificationSchema>;
14
16
  export declare const RawEvidenceRetentionModeSchema: z.ZodEnum<{
15
17
  local_only: "local_only";
16
18
  remote_short_retention: "remote_short_retention";
19
+ remote_durable: "remote_durable";
17
20
  }>;
18
21
  export type RawEvidenceRetentionMode = z.infer<typeof RawEvidenceRetentionModeSchema>;
19
22
  export declare const RawEvidenceRetentionPolicySchema: z.ZodObject<{
20
23
  mode: z.ZodEnum<{
21
24
  local_only: "local_only";
22
25
  remote_short_retention: "remote_short_retention";
26
+ remote_durable: "remote_durable";
23
27
  }>;
24
28
  privacy_classification: z.ZodEnum<{
25
29
  local_only_raw_evidence: "local_only_raw_evidence";
26
30
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
31
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
27
32
  }>;
28
33
  remote_retention_days: z.ZodOptional<z.ZodNumber>;
29
34
  expires_at: z.ZodOptional<z.ZodString>;
@@ -34,15 +39,18 @@ export declare const RawEvidencePointerSchema: z.ZodObject<{
34
39
  privacy_classification: z.ZodEnum<{
35
40
  local_only_raw_evidence: "local_only_raw_evidence";
36
41
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
42
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
37
43
  }>;
38
44
  retention_policy: z.ZodObject<{
39
45
  mode: z.ZodEnum<{
40
46
  local_only: "local_only";
41
47
  remote_short_retention: "remote_short_retention";
48
+ remote_durable: "remote_durable";
42
49
  }>;
43
50
  privacy_classification: z.ZodEnum<{
44
51
  local_only_raw_evidence: "local_only_raw_evidence";
45
52
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
53
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
46
54
  }>;
47
55
  remote_retention_days: z.ZodOptional<z.ZodNumber>;
48
56
  expires_at: z.ZodOptional<z.ZodString>;
@@ -51,6 +59,7 @@ export declare const RawEvidencePointerSchema: z.ZodObject<{
51
59
  local_file: "local_file";
52
60
  remote_object: "remote_object";
53
61
  }>;
62
+ storage_bucket: z.ZodOptional<z.ZodString>;
54
63
  local_path: z.ZodOptional<z.ZodString>;
55
64
  object_key: z.ZodOptional<z.ZodString>;
56
65
  content_hash_sha256: z.ZodOptional<z.ZodString>;
@@ -65,12 +74,14 @@ export declare const RedactionMetadataSchema: z.ZodObject<{
65
74
  redacted_summary: "redacted_summary";
66
75
  local_only_raw_evidence: "local_only_raw_evidence";
67
76
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
77
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
68
78
  }>;
69
79
  redaction_status: z.ZodEnum<{
70
80
  metadata_only: "metadata_only";
71
81
  redacted: "redacted";
72
82
  raw_local_only: "raw_local_only";
73
83
  raw_remote_short_retention: "raw_remote_short_retention";
84
+ raw_remote_durable: "raw_remote_durable";
74
85
  }>;
75
86
  redacted_fields: z.ZodDefault<z.ZodArray<z.ZodString>>;
76
87
  raw_evidence_pointer_ids: z.ZodDefault<z.ZodArray<z.ZodString>>;
package/dist/privacy.js CHANGED
@@ -5,14 +5,17 @@ export const PrivacyClassificationSchema = z.enum([
5
5
  "redacted_summary",
6
6
  "local_only_raw_evidence",
7
7
  "remote_short_retention_raw_evidence",
8
+ "remote_durable_raw_evidence",
8
9
  ]);
9
10
  export const RawEvidencePrivacyClassificationSchema = z.enum([
10
11
  "local_only_raw_evidence",
11
12
  "remote_short_retention_raw_evidence",
13
+ "remote_durable_raw_evidence",
12
14
  ]);
13
15
  export const RawEvidenceRetentionModeSchema = z.enum([
14
16
  "local_only",
15
17
  "remote_short_retention",
18
+ "remote_durable",
16
19
  ]);
17
20
  export const RawEvidenceRetentionPolicySchema = z
18
21
  .object({
@@ -39,6 +42,14 @@ export const RawEvidenceRetentionPolicySchema = z
39
42
  path: ["privacy_classification"],
40
43
  });
41
44
  }
45
+ if (policy.mode === "remote_durable" &&
46
+ policy.privacy_classification !== "remote_durable_raw_evidence") {
47
+ context.addIssue({
48
+ code: "custom",
49
+ message: "remote_durable must use remote_durable_raw_evidence",
50
+ path: ["privacy_classification"],
51
+ });
52
+ }
42
53
  if (policy.mode === "local_only" && policy.remote_retention_days) {
43
54
  context.addIssue({
44
55
  code: "custom",
@@ -46,6 +57,20 @@ export const RawEvidenceRetentionPolicySchema = z
46
57
  path: ["remote_retention_days"],
47
58
  });
48
59
  }
60
+ if (policy.mode === "remote_durable" && policy.remote_retention_days) {
61
+ context.addIssue({
62
+ code: "custom",
63
+ message: "durable remote evidence cannot set remote_retention_days",
64
+ path: ["remote_retention_days"],
65
+ });
66
+ }
67
+ if (policy.mode === "remote_durable" && policy.expires_at) {
68
+ context.addIssue({
69
+ code: "custom",
70
+ message: "durable remote evidence cannot set expires_at",
71
+ path: ["expires_at"],
72
+ });
73
+ }
49
74
  if (policy.mode === "remote_short_retention" &&
50
75
  !policy.remote_retention_days) {
51
76
  context.addIssue({
@@ -61,6 +86,7 @@ export const RawEvidencePointerSchema = z
61
86
  privacy_classification: RawEvidencePrivacyClassificationSchema,
62
87
  retention_policy: RawEvidenceRetentionPolicySchema,
63
88
  storage_scope: z.enum(["local_file", "remote_object"]),
89
+ storage_bucket: NonEmptyStringSchema.optional(),
64
90
  local_path: NonEmptyStringSchema.optional(),
65
91
  object_key: NonEmptyStringSchema.optional(),
66
92
  content_hash_sha256: Sha256Schema.optional(),
@@ -92,6 +118,13 @@ export const RawEvidencePointerSchema = z
92
118
  path: ["object_key"],
93
119
  });
94
120
  }
121
+ if (pointer.storage_scope === "remote_object" && !pointer.storage_bucket) {
122
+ context.addIssue({
123
+ code: "custom",
124
+ message: "remote evidence pointers require storage_bucket",
125
+ path: ["storage_bucket"],
126
+ });
127
+ }
95
128
  });
96
129
  export const RedactionMetadataSchema = z
97
130
  .object({
@@ -101,6 +134,7 @@ export const RedactionMetadataSchema = z
101
134
  "redacted",
102
135
  "raw_local_only",
103
136
  "raw_remote_short_retention",
137
+ "raw_remote_durable",
104
138
  ]),
105
139
  redacted_fields: z.array(NonEmptyStringSchema).default([]),
106
140
  raw_evidence_pointer_ids: z.array(NonEmptyStringSchema).default([]),
@@ -94,6 +94,12 @@ export declare const RiskFlagSchema: z.ZodObject<{
94
94
  collector_version: z.ZodString;
95
95
  repo: z.ZodString;
96
96
  branch: z.ZodString;
97
+ repo_label: z.ZodOptional<z.ZodString>;
98
+ repo_fingerprint: z.ZodOptional<z.ZodString>;
99
+ repo_origin_url: z.ZodOptional<z.ZodString>;
100
+ worktree_label: z.ZodOptional<z.ZodString>;
101
+ worktree_fingerprint: z.ZodOptional<z.ZodString>;
102
+ worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
97
103
  operator_id: z.ZodString;
98
104
  session_id: z.ZodString;
99
105
  work_context_id: z.ZodString;
@@ -0,0 +1 @@
1
+ export declare function containsSecretLikeContent(value: string): boolean;
@@ -0,0 +1,23 @@
1
+ const PRIVILEGED_SUPABASE_KEY_NAME_PATTERN = new RegExp(`\\b${["SUPABASE", "SERVICE", "ROLE", "KEY"].join("_")}\\b`, "i");
2
+ const SECRET_LIKE_CONTENT_PATTERNS = [
3
+ /\b(?:NEXT_PUBLIC_)?SUPABASE_ANON_KEY\b/i,
4
+ PRIVILEGED_SUPABASE_KEY_NAME_PATTERN,
5
+ /\bSERVICE[_\s-]?ROLE\b/i,
6
+ /\b(?:api[_-]?key|access[_-]?token|refresh[_-]?token|private[_-]?key|client[_-]?secret|secret[_-]?access[_-]?key)\s*[:=]\s*["']?[A-Za-z0-9_./+=-]{12,}/i,
7
+ /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
8
+ /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/,
9
+ /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/,
10
+ /\b(?:sk|pk)_(?:live|test)_[A-Za-z0-9]{16,}/,
11
+ /\bsk-[A-Za-z0-9_-]{16,}/,
12
+ /\bgh[pousr]_[A-Za-z0-9_]{16,}/,
13
+ /\bgithub_pat_[A-Za-z0-9_]{20,}/,
14
+ /\blin_api_[A-Za-z0-9]{16,}/,
15
+ /\bsb_secret_[A-Za-z0-9_]{16,}/,
16
+ /\bxox[baprs]-[A-Za-z0-9-]{16,}/,
17
+ /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
18
+ /\bLANGFUSE_(?:PUBLIC|SECRET)_KEY\b/i,
19
+ /\b(?:pk|sk)-lf-[A-Za-z0-9_-]{16,}\b/i,
20
+ ];
21
+ export function containsSecretLikeContent(value) {
22
+ return SECRET_LIKE_CONTENT_PATTERNS.some((pattern) => pattern.test(value));
23
+ }
@@ -27,12 +27,14 @@ export declare const SourceScanEventSummarySchema: z.ZodObject<{
27
27
  redacted_summary: "redacted_summary";
28
28
  local_only_raw_evidence: "local_only_raw_evidence";
29
29
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
30
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
30
31
  }>;
31
32
  redaction_status: z.ZodEnum<{
32
33
  metadata_only: "metadata_only";
33
34
  redacted: "redacted";
34
35
  raw_local_only: "raw_local_only";
35
36
  raw_remote_short_retention: "raw_remote_short_retention";
37
+ raw_remote_durable: "raw_remote_durable";
36
38
  }>;
37
39
  redacted_fields: z.ZodDefault<z.ZodArray<z.ZodString>>;
38
40
  raw_evidence_pointer_ids: z.ZodDefault<z.ZodArray<z.ZodString>>;
@@ -44,15 +46,18 @@ export declare const SourceScanEventSummarySchema: z.ZodObject<{
44
46
  privacy_classification: z.ZodEnum<{
45
47
  local_only_raw_evidence: "local_only_raw_evidence";
46
48
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
49
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
47
50
  }>;
48
51
  retention_policy: z.ZodObject<{
49
52
  mode: z.ZodEnum<{
50
53
  local_only: "local_only";
51
54
  remote_short_retention: "remote_short_retention";
55
+ remote_durable: "remote_durable";
52
56
  }>;
53
57
  privacy_classification: z.ZodEnum<{
54
58
  local_only_raw_evidence: "local_only_raw_evidence";
55
59
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
60
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
56
61
  }>;
57
62
  remote_retention_days: z.ZodOptional<z.ZodNumber>;
58
63
  expires_at: z.ZodOptional<z.ZodString>;
@@ -61,6 +66,7 @@ export declare const SourceScanEventSummarySchema: z.ZodObject<{
61
66
  local_file: "local_file";
62
67
  remote_object: "remote_object";
63
68
  }>;
69
+ storage_bucket: z.ZodOptional<z.ZodString>;
64
70
  local_path: z.ZodOptional<z.ZodString>;
65
71
  object_key: z.ZodOptional<z.ZodString>;
66
72
  content_hash_sha256: z.ZodOptional<z.ZodString>;
@@ -91,8 +97,8 @@ export declare const SourceScanResultSchema: z.ZodObject<{
91
97
  work_context_id: z.ZodOptional<z.ZodString>;
92
98
  status: z.ZodEnum<{
93
99
  ok: "ok";
94
- partial: "partial";
95
100
  skipped: "skipped";
101
+ partial: "partial";
96
102
  failed: "failed";
97
103
  }>;
98
104
  started_at: z.ZodString;
@@ -108,12 +114,14 @@ export declare const SourceScanResultSchema: z.ZodObject<{
108
114
  redacted_summary: "redacted_summary";
109
115
  local_only_raw_evidence: "local_only_raw_evidence";
110
116
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
117
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
111
118
  }>;
112
119
  redaction_status: z.ZodEnum<{
113
120
  metadata_only: "metadata_only";
114
121
  redacted: "redacted";
115
122
  raw_local_only: "raw_local_only";
116
123
  raw_remote_short_retention: "raw_remote_short_retention";
124
+ raw_remote_durable: "raw_remote_durable";
117
125
  }>;
118
126
  redacted_fields: z.ZodDefault<z.ZodArray<z.ZodString>>;
119
127
  raw_evidence_pointer_ids: z.ZodDefault<z.ZodArray<z.ZodString>>;
@@ -125,15 +133,18 @@ export declare const SourceScanResultSchema: z.ZodObject<{
125
133
  privacy_classification: z.ZodEnum<{
126
134
  local_only_raw_evidence: "local_only_raw_evidence";
127
135
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
136
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
128
137
  }>;
129
138
  retention_policy: z.ZodObject<{
130
139
  mode: z.ZodEnum<{
131
140
  local_only: "local_only";
132
141
  remote_short_retention: "remote_short_retention";
142
+ remote_durable: "remote_durable";
133
143
  }>;
134
144
  privacy_classification: z.ZodEnum<{
135
145
  local_only_raw_evidence: "local_only_raw_evidence";
136
146
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
147
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
137
148
  }>;
138
149
  remote_retention_days: z.ZodOptional<z.ZodNumber>;
139
150
  expires_at: z.ZodOptional<z.ZodString>;
@@ -142,6 +153,7 @@ export declare const SourceScanResultSchema: z.ZodObject<{
142
153
  local_file: "local_file";
143
154
  remote_object: "remote_object";
144
155
  }>;
156
+ storage_bucket: z.ZodOptional<z.ZodString>;
145
157
  local_path: z.ZodOptional<z.ZodString>;
146
158
  object_key: z.ZodOptional<z.ZodString>;
147
159
  content_hash_sha256: z.ZodOptional<z.ZodString>;
@@ -225,6 +237,12 @@ export declare const SourceScanResultSchema: z.ZodObject<{
225
237
  collector_version: z.ZodString;
226
238
  repo: z.ZodString;
227
239
  branch: z.ZodString;
240
+ repo_label: z.ZodOptional<z.ZodString>;
241
+ repo_fingerprint: z.ZodOptional<z.ZodString>;
242
+ repo_origin_url: z.ZodOptional<z.ZodString>;
243
+ worktree_label: z.ZodOptional<z.ZodString>;
244
+ worktree_fingerprint: z.ZodOptional<z.ZodString>;
245
+ worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
228
246
  operator_id: z.ZodString;
229
247
  session_id: z.ZodString;
230
248
  work_context_id: z.ZodString;
@@ -44,6 +44,7 @@ export declare const ExternalTraceSinkPointerSchema: z.ZodObject<{
44
44
  redacted_summary: "redacted_summary";
45
45
  local_only_raw_evidence: "local_only_raw_evidence";
46
46
  remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
47
+ remote_durable_raw_evidence: "remote_durable_raw_evidence";
47
48
  }>>;
48
49
  }, z.core.$strict>;
49
50
  export type ExternalTraceSinkPointer = z.infer<typeof ExternalTraceSinkPointerSchema>;
@@ -29,6 +29,13 @@ export declare const LocalWorkContextSchema: z.ZodObject<{
29
29
  work_context_id: z.ZodString;
30
30
  repo: z.ZodString;
31
31
  branch: z.ZodString;
32
+ repo_label: z.ZodOptional<z.ZodString>;
33
+ repo_fingerprint: z.ZodOptional<z.ZodString>;
34
+ repo_origin_url: z.ZodOptional<z.ZodString>;
35
+ head_sha: z.ZodOptional<z.ZodString>;
36
+ worktree_label: z.ZodOptional<z.ZodString>;
37
+ worktree_fingerprint: z.ZodOptional<z.ZodString>;
38
+ worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
32
39
  operator_id: z.ZodString;
33
40
  session_id: z.ZodString;
34
41
  started_at: z.ZodString;
@@ -68,6 +75,12 @@ export declare const LocalWorkContextSchema: z.ZodObject<{
68
75
  collector_version: z.ZodString;
69
76
  repo: z.ZodString;
70
77
  branch: z.ZodString;
78
+ repo_label: z.ZodOptional<z.ZodString>;
79
+ repo_fingerprint: z.ZodOptional<z.ZodString>;
80
+ repo_origin_url: z.ZodOptional<z.ZodString>;
81
+ worktree_label: z.ZodOptional<z.ZodString>;
82
+ worktree_fingerprint: z.ZodOptional<z.ZodString>;
83
+ worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
71
84
  operator_id: z.ZodString;
72
85
  session_id: z.ZodString;
73
86
  work_context_id: z.ZodString;
@@ -23,6 +23,13 @@ export const LocalWorkContextSchema = z
23
23
  work_context_id: NonEmptyStringSchema,
24
24
  repo: NonEmptyStringSchema,
25
25
  branch: NonEmptyStringSchema,
26
+ repo_label: NonEmptyStringSchema.optional(),
27
+ repo_fingerprint: NonEmptyStringSchema.optional(),
28
+ repo_origin_url: NonEmptyStringSchema.optional(),
29
+ head_sha: NonEmptyStringSchema.optional(),
30
+ worktree_label: NonEmptyStringSchema.optional(),
31
+ worktree_fingerprint: NonEmptyStringSchema.optional(),
32
+ worktree_is_primary: z.boolean().optional(),
26
33
  operator_id: NonEmptyStringSchema,
27
34
  session_id: NonEmptyStringSchema,
28
35
  started_at: IsoDateTimeSchema,
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@bli-cockpit/telemetry-core",
3
- "version": "0.1.0",
3
+ "version": "0.1.3",
4
4
  "private": false,
5
5
  "type": "module",
6
6
  "main": "./dist/index.js",