@bli-cockpit/telemetry-core 0.1.0 → 0.1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/common.d.ts +6 -0
- package/dist/common.js +6 -0
- package/dist/evidence-upload.d.ts +376 -0
- package/dist/evidence-upload.js +184 -0
- package/dist/index.d.ts +2 -0
- package/dist/index.js +2 -0
- package/dist/ingest-dto.d.ts +66 -1
- package/dist/local-config.d.ts +1 -0
- package/dist/local-config.js +6 -2
- package/dist/privacy.d.ts +11 -0
- package/dist/privacy.js +34 -0
- package/dist/risk-flags.d.ts +6 -0
- package/dist/secret-guards.d.ts +1 -0
- package/dist/secret-guards.js +23 -0
- package/dist/source-adapter.d.ts +19 -1
- package/dist/trace-sink.d.ts +1 -0
- package/dist/work-context.d.ts +13 -0
- package/dist/work-context.js +7 -0
- package/package.json +1 -1
package/dist/common.d.ts
CHANGED
|
@@ -38,6 +38,12 @@ export declare const CaptureProvenanceSchema: z.ZodObject<{
|
|
|
38
38
|
collector_version: z.ZodString;
|
|
39
39
|
repo: z.ZodString;
|
|
40
40
|
branch: z.ZodString;
|
|
41
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
42
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
43
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
44
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
45
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
46
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
41
47
|
operator_id: z.ZodString;
|
|
42
48
|
session_id: z.ZodString;
|
|
43
49
|
work_context_id: z.ZodString;
|
package/dist/common.js
CHANGED
|
@@ -34,6 +34,12 @@ export const CaptureProvenanceSchema = z
|
|
|
34
34
|
collector_version: VersionStringSchema,
|
|
35
35
|
repo: NonEmptyStringSchema,
|
|
36
36
|
branch: NonEmptyStringSchema,
|
|
37
|
+
repo_label: NonEmptyStringSchema.optional(),
|
|
38
|
+
repo_fingerprint: NonEmptyStringSchema.optional(),
|
|
39
|
+
repo_origin_url: NonEmptyStringSchema.optional(),
|
|
40
|
+
worktree_label: NonEmptyStringSchema.optional(),
|
|
41
|
+
worktree_fingerprint: NonEmptyStringSchema.optional(),
|
|
42
|
+
worktree_is_primary: z.boolean().optional(),
|
|
37
43
|
operator_id: NonEmptyStringSchema,
|
|
38
44
|
session_id: NonEmptyStringSchema,
|
|
39
45
|
work_context_id: NonEmptyStringSchema,
|
|
@@ -0,0 +1,376 @@
|
|
|
1
|
+
import { z } from "zod";
|
|
2
|
+
/**
|
|
3
|
+
* Chunked raw-evidence upload wire contract.
|
|
4
|
+
*
|
|
5
|
+
* Raw evidence bytes move in chunks small enough to clear serverless
|
|
6
|
+
* request-body limits (Vercel rejects bodies around 4.5MB). The server keeps a
|
|
7
|
+
* durable per-object ledger so interrupted uploads resume instead of
|
|
8
|
+
* re-sending bytes, and identical content is acknowledged without re-upload.
|
|
9
|
+
*/
|
|
10
|
+
export declare const RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES: number;
|
|
11
|
+
export declare const RAW_EVIDENCE_UPLOAD_MAX_CHUNK_BYTES: number;
|
|
12
|
+
export declare const RAW_EVIDENCE_UPLOAD_DEFAULT_CHUNK_BYTES: number;
|
|
13
|
+
export declare const RAW_EVIDENCE_UPLOAD_MAX_CHUNK_COUNT = 64;
|
|
14
|
+
export declare const RAW_EVIDENCE_UPLOAD_MAX_OBJECTS_PER_BEGIN = 25;
|
|
15
|
+
export declare const CODEX_SESSION_REPORT_MAX_SESSIONS = 200;
|
|
16
|
+
export declare const RawEvidenceUploadBeginObjectSchema: z.ZodObject<{
|
|
17
|
+
pointer: z.ZodObject<{
|
|
18
|
+
raw_evidence_pointer_id: z.ZodString;
|
|
19
|
+
privacy_classification: z.ZodEnum<{
|
|
20
|
+
local_only_raw_evidence: "local_only_raw_evidence";
|
|
21
|
+
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
22
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
23
|
+
}>;
|
|
24
|
+
retention_policy: z.ZodObject<{
|
|
25
|
+
mode: z.ZodEnum<{
|
|
26
|
+
local_only: "local_only";
|
|
27
|
+
remote_short_retention: "remote_short_retention";
|
|
28
|
+
remote_durable: "remote_durable";
|
|
29
|
+
}>;
|
|
30
|
+
privacy_classification: z.ZodEnum<{
|
|
31
|
+
local_only_raw_evidence: "local_only_raw_evidence";
|
|
32
|
+
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
33
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
34
|
+
}>;
|
|
35
|
+
remote_retention_days: z.ZodOptional<z.ZodNumber>;
|
|
36
|
+
expires_at: z.ZodOptional<z.ZodString>;
|
|
37
|
+
}, z.core.$strict>;
|
|
38
|
+
storage_scope: z.ZodEnum<{
|
|
39
|
+
local_file: "local_file";
|
|
40
|
+
remote_object: "remote_object";
|
|
41
|
+
}>;
|
|
42
|
+
storage_bucket: z.ZodOptional<z.ZodString>;
|
|
43
|
+
local_path: z.ZodOptional<z.ZodString>;
|
|
44
|
+
object_key: z.ZodOptional<z.ZodString>;
|
|
45
|
+
content_hash_sha256: z.ZodOptional<z.ZodString>;
|
|
46
|
+
byte_size: z.ZodOptional<z.ZodNumber>;
|
|
47
|
+
media_type: z.ZodOptional<z.ZodString>;
|
|
48
|
+
redacted_summary: z.ZodOptional<z.ZodString>;
|
|
49
|
+
}, z.core.$strict>;
|
|
50
|
+
chunk_size_bytes: z.ZodNumber;
|
|
51
|
+
chunk_count: z.ZodNumber;
|
|
52
|
+
}, z.core.$strict>;
|
|
53
|
+
export type RawEvidenceUploadBeginObject = z.infer<typeof RawEvidenceUploadBeginObjectSchema>;
|
|
54
|
+
export declare const RawEvidenceUploadBeginRequestSchema: z.ZodObject<{
|
|
55
|
+
schema_version: z.ZodLiteral<"ambient-raw-evidence-upload-begin.v1">;
|
|
56
|
+
generated_at: z.ZodString;
|
|
57
|
+
provenance: z.ZodObject<{
|
|
58
|
+
capture_source: z.ZodEnum<{
|
|
59
|
+
unknown: "unknown";
|
|
60
|
+
codex_jsonl: "codex_jsonl";
|
|
61
|
+
codex_otel: "codex_otel";
|
|
62
|
+
car_state: "car_state";
|
|
63
|
+
git_state: "git_state";
|
|
64
|
+
github_state: "github_state";
|
|
65
|
+
linear_state: "linear_state";
|
|
66
|
+
mcp_local: "mcp_local";
|
|
67
|
+
claude_hooks: "claude_hooks";
|
|
68
|
+
manual_event: "manual_event";
|
|
69
|
+
collector_runtime: "collector_runtime";
|
|
70
|
+
}>;
|
|
71
|
+
capture_adapter_version: z.ZodString;
|
|
72
|
+
collector_version: z.ZodString;
|
|
73
|
+
repo: z.ZodString;
|
|
74
|
+
branch: z.ZodString;
|
|
75
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
76
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
77
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
78
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
79
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
80
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
81
|
+
operator_id: z.ZodString;
|
|
82
|
+
session_id: z.ZodString;
|
|
83
|
+
work_context_id: z.ZodString;
|
|
84
|
+
}, z.core.$strict>;
|
|
85
|
+
objects: z.ZodArray<z.ZodObject<{
|
|
86
|
+
pointer: z.ZodObject<{
|
|
87
|
+
raw_evidence_pointer_id: z.ZodString;
|
|
88
|
+
privacy_classification: z.ZodEnum<{
|
|
89
|
+
local_only_raw_evidence: "local_only_raw_evidence";
|
|
90
|
+
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
91
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
92
|
+
}>;
|
|
93
|
+
retention_policy: z.ZodObject<{
|
|
94
|
+
mode: z.ZodEnum<{
|
|
95
|
+
local_only: "local_only";
|
|
96
|
+
remote_short_retention: "remote_short_retention";
|
|
97
|
+
remote_durable: "remote_durable";
|
|
98
|
+
}>;
|
|
99
|
+
privacy_classification: z.ZodEnum<{
|
|
100
|
+
local_only_raw_evidence: "local_only_raw_evidence";
|
|
101
|
+
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
102
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
103
|
+
}>;
|
|
104
|
+
remote_retention_days: z.ZodOptional<z.ZodNumber>;
|
|
105
|
+
expires_at: z.ZodOptional<z.ZodString>;
|
|
106
|
+
}, z.core.$strict>;
|
|
107
|
+
storage_scope: z.ZodEnum<{
|
|
108
|
+
local_file: "local_file";
|
|
109
|
+
remote_object: "remote_object";
|
|
110
|
+
}>;
|
|
111
|
+
storage_bucket: z.ZodOptional<z.ZodString>;
|
|
112
|
+
local_path: z.ZodOptional<z.ZodString>;
|
|
113
|
+
object_key: z.ZodOptional<z.ZodString>;
|
|
114
|
+
content_hash_sha256: z.ZodOptional<z.ZodString>;
|
|
115
|
+
byte_size: z.ZodOptional<z.ZodNumber>;
|
|
116
|
+
media_type: z.ZodOptional<z.ZodString>;
|
|
117
|
+
redacted_summary: z.ZodOptional<z.ZodString>;
|
|
118
|
+
}, z.core.$strict>;
|
|
119
|
+
chunk_size_bytes: z.ZodNumber;
|
|
120
|
+
chunk_count: z.ZodNumber;
|
|
121
|
+
}, z.core.$strict>>;
|
|
122
|
+
}, z.core.$strict>;
|
|
123
|
+
export type RawEvidenceUploadBeginRequest = z.infer<typeof RawEvidenceUploadBeginRequestSchema>;
|
|
124
|
+
export declare const RawEvidenceUploadDispositionSchema: z.ZodEnum<{
|
|
125
|
+
new: "new";
|
|
126
|
+
resume: "resume";
|
|
127
|
+
already_committed: "already_committed";
|
|
128
|
+
conflict: "conflict";
|
|
129
|
+
}>;
|
|
130
|
+
export type RawEvidenceUploadDisposition = z.infer<typeof RawEvidenceUploadDispositionSchema>;
|
|
131
|
+
export declare const RawEvidenceUploadBeginResponseObjectSchema: z.ZodObject<{
|
|
132
|
+
object_key: z.ZodString;
|
|
133
|
+
raw_evidence_pointer_id: z.ZodString;
|
|
134
|
+
disposition: z.ZodEnum<{
|
|
135
|
+
new: "new";
|
|
136
|
+
resume: "resume";
|
|
137
|
+
already_committed: "already_committed";
|
|
138
|
+
conflict: "conflict";
|
|
139
|
+
}>;
|
|
140
|
+
upload_id: z.ZodOptional<z.ZodString>;
|
|
141
|
+
received_chunk_indexes: z.ZodDefault<z.ZodArray<z.ZodNumber>>;
|
|
142
|
+
reason: z.ZodOptional<z.ZodString>;
|
|
143
|
+
}, z.core.$strict>;
|
|
144
|
+
export type RawEvidenceUploadBeginResponseObject = z.infer<typeof RawEvidenceUploadBeginResponseObjectSchema>;
|
|
145
|
+
export declare const RawEvidenceUploadBeginResponseSchema: z.ZodObject<{
|
|
146
|
+
ok: z.ZodLiteral<true>;
|
|
147
|
+
objects: z.ZodArray<z.ZodObject<{
|
|
148
|
+
object_key: z.ZodString;
|
|
149
|
+
raw_evidence_pointer_id: z.ZodString;
|
|
150
|
+
disposition: z.ZodEnum<{
|
|
151
|
+
new: "new";
|
|
152
|
+
resume: "resume";
|
|
153
|
+
already_committed: "already_committed";
|
|
154
|
+
conflict: "conflict";
|
|
155
|
+
}>;
|
|
156
|
+
upload_id: z.ZodOptional<z.ZodString>;
|
|
157
|
+
received_chunk_indexes: z.ZodDefault<z.ZodArray<z.ZodNumber>>;
|
|
158
|
+
reason: z.ZodOptional<z.ZodString>;
|
|
159
|
+
}, z.core.$strict>>;
|
|
160
|
+
}, z.core.$strict>;
|
|
161
|
+
export type RawEvidenceUploadBeginResponse = z.infer<typeof RawEvidenceUploadBeginResponseSchema>;
|
|
162
|
+
export declare const RawEvidenceUploadChunkRequestSchema: z.ZodObject<{
|
|
163
|
+
schema_version: z.ZodLiteral<"ambient-raw-evidence-upload-chunk.v1">;
|
|
164
|
+
generated_at: z.ZodString;
|
|
165
|
+
provenance: z.ZodObject<{
|
|
166
|
+
capture_source: z.ZodEnum<{
|
|
167
|
+
unknown: "unknown";
|
|
168
|
+
codex_jsonl: "codex_jsonl";
|
|
169
|
+
codex_otel: "codex_otel";
|
|
170
|
+
car_state: "car_state";
|
|
171
|
+
git_state: "git_state";
|
|
172
|
+
github_state: "github_state";
|
|
173
|
+
linear_state: "linear_state";
|
|
174
|
+
mcp_local: "mcp_local";
|
|
175
|
+
claude_hooks: "claude_hooks";
|
|
176
|
+
manual_event: "manual_event";
|
|
177
|
+
collector_runtime: "collector_runtime";
|
|
178
|
+
}>;
|
|
179
|
+
capture_adapter_version: z.ZodString;
|
|
180
|
+
collector_version: z.ZodString;
|
|
181
|
+
repo: z.ZodString;
|
|
182
|
+
branch: z.ZodString;
|
|
183
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
184
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
185
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
186
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
187
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
188
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
189
|
+
operator_id: z.ZodString;
|
|
190
|
+
session_id: z.ZodString;
|
|
191
|
+
work_context_id: z.ZodString;
|
|
192
|
+
}, z.core.$strict>;
|
|
193
|
+
upload_id: z.ZodString;
|
|
194
|
+
object_key: z.ZodString;
|
|
195
|
+
chunk_index: z.ZodNumber;
|
|
196
|
+
chunk_count: z.ZodNumber;
|
|
197
|
+
chunk_hash_sha256: z.ZodString;
|
|
198
|
+
content_base64: z.ZodString;
|
|
199
|
+
}, z.core.$strict>;
|
|
200
|
+
export type RawEvidenceUploadChunkRequest = z.infer<typeof RawEvidenceUploadChunkRequestSchema>;
|
|
201
|
+
export declare const RawEvidenceUploadChunkResponseSchema: z.ZodObject<{
|
|
202
|
+
ok: z.ZodLiteral<true>;
|
|
203
|
+
upload_id: z.ZodString;
|
|
204
|
+
chunk_index: z.ZodNumber;
|
|
205
|
+
received_chunk_count: z.ZodNumber;
|
|
206
|
+
}, z.core.$strict>;
|
|
207
|
+
export type RawEvidenceUploadChunkResponse = z.infer<typeof RawEvidenceUploadChunkResponseSchema>;
|
|
208
|
+
export declare const RawEvidenceUploadCommitRequestSchema: z.ZodObject<{
|
|
209
|
+
schema_version: z.ZodLiteral<"ambient-raw-evidence-upload-commit.v1">;
|
|
210
|
+
generated_at: z.ZodString;
|
|
211
|
+
provenance: z.ZodObject<{
|
|
212
|
+
capture_source: z.ZodEnum<{
|
|
213
|
+
unknown: "unknown";
|
|
214
|
+
codex_jsonl: "codex_jsonl";
|
|
215
|
+
codex_otel: "codex_otel";
|
|
216
|
+
car_state: "car_state";
|
|
217
|
+
git_state: "git_state";
|
|
218
|
+
github_state: "github_state";
|
|
219
|
+
linear_state: "linear_state";
|
|
220
|
+
mcp_local: "mcp_local";
|
|
221
|
+
claude_hooks: "claude_hooks";
|
|
222
|
+
manual_event: "manual_event";
|
|
223
|
+
collector_runtime: "collector_runtime";
|
|
224
|
+
}>;
|
|
225
|
+
capture_adapter_version: z.ZodString;
|
|
226
|
+
collector_version: z.ZodString;
|
|
227
|
+
repo: z.ZodString;
|
|
228
|
+
branch: z.ZodString;
|
|
229
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
230
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
231
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
232
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
233
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
234
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
235
|
+
operator_id: z.ZodString;
|
|
236
|
+
session_id: z.ZodString;
|
|
237
|
+
work_context_id: z.ZodString;
|
|
238
|
+
}, z.core.$strict>;
|
|
239
|
+
upload_id: z.ZodString;
|
|
240
|
+
object_key: z.ZodString;
|
|
241
|
+
}, z.core.$strict>;
|
|
242
|
+
export type RawEvidenceUploadCommitRequest = z.infer<typeof RawEvidenceUploadCommitRequestSchema>;
|
|
243
|
+
export declare const RawEvidenceUploadCommitResponseSchema: z.ZodObject<{
|
|
244
|
+
ok: z.ZodLiteral<true>;
|
|
245
|
+
status: z.ZodEnum<{
|
|
246
|
+
already_committed: "already_committed";
|
|
247
|
+
committed: "committed";
|
|
248
|
+
}>;
|
|
249
|
+
object_key: z.ZodString;
|
|
250
|
+
content_hash_sha256: z.ZodString;
|
|
251
|
+
byte_size: z.ZodNumber;
|
|
252
|
+
chunk_count: z.ZodNumber;
|
|
253
|
+
}, z.core.$strict>;
|
|
254
|
+
export type RawEvidenceUploadCommitResponse = z.infer<typeof RawEvidenceUploadCommitResponseSchema>;
|
|
255
|
+
/**
|
|
256
|
+
* Codex session attribution report.
|
|
257
|
+
*
|
|
258
|
+
* The collector attributes Codex session JSONL files to repos/worktrees with
|
|
259
|
+
* deterministic metadata signals. Sessions that cannot be attributed are
|
|
260
|
+
* reported here with reason labels and safe pointers (session id, file hash,
|
|
261
|
+
* cwd basename/hash) instead of being duplicated into every repo's evidence
|
|
262
|
+
* pack or silently dropped. No content-bearing fields are allowed.
|
|
263
|
+
*/
|
|
264
|
+
export declare const CodexSessionAttributionStateSchema: z.ZodEnum<{
|
|
265
|
+
attributed: "attributed";
|
|
266
|
+
ambiguous: "ambiguous";
|
|
267
|
+
unattributed: "unattributed";
|
|
268
|
+
skipped: "skipped";
|
|
269
|
+
}>;
|
|
270
|
+
export type CodexSessionAttributionState = z.infer<typeof CodexSessionAttributionStateSchema>;
|
|
271
|
+
export declare const CodexSessionUploadStateSchema: z.ZodEnum<{
|
|
272
|
+
uploaded: "uploaded";
|
|
273
|
+
reused_existing: "reused_existing";
|
|
274
|
+
upload_failed: "upload_failed";
|
|
275
|
+
not_uploaded: "not_uploaded";
|
|
276
|
+
}>;
|
|
277
|
+
export type CodexSessionUploadState = z.infer<typeof CodexSessionUploadStateSchema>;
|
|
278
|
+
export declare const CodexSessionAttributionSchema: z.ZodObject<{
|
|
279
|
+
codex_session_id: z.ZodString;
|
|
280
|
+
observed_at: z.ZodString;
|
|
281
|
+
attribution_state: z.ZodEnum<{
|
|
282
|
+
attributed: "attributed";
|
|
283
|
+
ambiguous: "ambiguous";
|
|
284
|
+
unattributed: "unattributed";
|
|
285
|
+
skipped: "skipped";
|
|
286
|
+
}>;
|
|
287
|
+
attribution_reason: z.ZodString;
|
|
288
|
+
attribution_score: z.ZodOptional<z.ZodNumber>;
|
|
289
|
+
path_score: z.ZodOptional<z.ZodNumber>;
|
|
290
|
+
signals: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
291
|
+
session_file_hash_sha256: z.ZodOptional<z.ZodString>;
|
|
292
|
+
session_file_byte_size: z.ZodOptional<z.ZodNumber>;
|
|
293
|
+
session_file_mtime: z.ZodOptional<z.ZodString>;
|
|
294
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
295
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
296
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
297
|
+
branch: z.ZodOptional<z.ZodString>;
|
|
298
|
+
cwd_basename: z.ZodOptional<z.ZodString>;
|
|
299
|
+
cwd_hash: z.ZodOptional<z.ZodString>;
|
|
300
|
+
raw_evidence_pointer_id: z.ZodOptional<z.ZodString>;
|
|
301
|
+
upload_state: z.ZodOptional<z.ZodEnum<{
|
|
302
|
+
uploaded: "uploaded";
|
|
303
|
+
reused_existing: "reused_existing";
|
|
304
|
+
upload_failed: "upload_failed";
|
|
305
|
+
not_uploaded: "not_uploaded";
|
|
306
|
+
}>>;
|
|
307
|
+
}, z.core.$strict>;
|
|
308
|
+
export type CodexSessionAttribution = z.infer<typeof CodexSessionAttributionSchema>;
|
|
309
|
+
export declare const CodexSessionAttributionReportRequestSchema: z.ZodObject<{
|
|
310
|
+
schema_version: z.ZodLiteral<"ambient-codex-session-attributions.v1">;
|
|
311
|
+
generated_at: z.ZodString;
|
|
312
|
+
provenance: z.ZodObject<{
|
|
313
|
+
capture_source: z.ZodEnum<{
|
|
314
|
+
unknown: "unknown";
|
|
315
|
+
codex_jsonl: "codex_jsonl";
|
|
316
|
+
codex_otel: "codex_otel";
|
|
317
|
+
car_state: "car_state";
|
|
318
|
+
git_state: "git_state";
|
|
319
|
+
github_state: "github_state";
|
|
320
|
+
linear_state: "linear_state";
|
|
321
|
+
mcp_local: "mcp_local";
|
|
322
|
+
claude_hooks: "claude_hooks";
|
|
323
|
+
manual_event: "manual_event";
|
|
324
|
+
collector_runtime: "collector_runtime";
|
|
325
|
+
}>;
|
|
326
|
+
capture_adapter_version: z.ZodString;
|
|
327
|
+
collector_version: z.ZodString;
|
|
328
|
+
repo: z.ZodString;
|
|
329
|
+
branch: z.ZodString;
|
|
330
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
331
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
332
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
333
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
334
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
335
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
336
|
+
operator_id: z.ZodString;
|
|
337
|
+
session_id: z.ZodString;
|
|
338
|
+
work_context_id: z.ZodString;
|
|
339
|
+
}, z.core.$strict>;
|
|
340
|
+
sessions: z.ZodArray<z.ZodObject<{
|
|
341
|
+
codex_session_id: z.ZodString;
|
|
342
|
+
observed_at: z.ZodString;
|
|
343
|
+
attribution_state: z.ZodEnum<{
|
|
344
|
+
attributed: "attributed";
|
|
345
|
+
ambiguous: "ambiguous";
|
|
346
|
+
unattributed: "unattributed";
|
|
347
|
+
skipped: "skipped";
|
|
348
|
+
}>;
|
|
349
|
+
attribution_reason: z.ZodString;
|
|
350
|
+
attribution_score: z.ZodOptional<z.ZodNumber>;
|
|
351
|
+
path_score: z.ZodOptional<z.ZodNumber>;
|
|
352
|
+
signals: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
353
|
+
session_file_hash_sha256: z.ZodOptional<z.ZodString>;
|
|
354
|
+
session_file_byte_size: z.ZodOptional<z.ZodNumber>;
|
|
355
|
+
session_file_mtime: z.ZodOptional<z.ZodString>;
|
|
356
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
357
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
358
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
359
|
+
branch: z.ZodOptional<z.ZodString>;
|
|
360
|
+
cwd_basename: z.ZodOptional<z.ZodString>;
|
|
361
|
+
cwd_hash: z.ZodOptional<z.ZodString>;
|
|
362
|
+
raw_evidence_pointer_id: z.ZodOptional<z.ZodString>;
|
|
363
|
+
upload_state: z.ZodOptional<z.ZodEnum<{
|
|
364
|
+
uploaded: "uploaded";
|
|
365
|
+
reused_existing: "reused_existing";
|
|
366
|
+
upload_failed: "upload_failed";
|
|
367
|
+
not_uploaded: "not_uploaded";
|
|
368
|
+
}>>;
|
|
369
|
+
}, z.core.$strict>>;
|
|
370
|
+
}, z.core.$strict>;
|
|
371
|
+
export type CodexSessionAttributionReportRequest = z.infer<typeof CodexSessionAttributionReportRequestSchema>;
|
|
372
|
+
export declare const CodexSessionAttributionReportResponseSchema: z.ZodObject<{
|
|
373
|
+
ok: z.ZodLiteral<true>;
|
|
374
|
+
recorded_count: z.ZodNumber;
|
|
375
|
+
}, z.core.$strict>;
|
|
376
|
+
export type CodexSessionAttributionReportResponse = z.infer<typeof CodexSessionAttributionReportResponseSchema>;
|
|
@@ -0,0 +1,184 @@
|
|
|
1
|
+
import { z } from "zod";
|
|
2
|
+
import { CaptureProvenanceSchema, IsoDateTimeSchema, NonEmptyStringSchema, Sha256Schema, } from "./common.js";
|
|
3
|
+
import { RawEvidencePointerSchema } from "./privacy.js";
|
|
4
|
+
/**
|
|
5
|
+
* Chunked raw-evidence upload wire contract.
|
|
6
|
+
*
|
|
7
|
+
* Raw evidence bytes move in chunks small enough to clear serverless
|
|
8
|
+
* request-body limits (Vercel rejects bodies around 4.5MB). The server keeps a
|
|
9
|
+
* durable per-object ledger so interrupted uploads resume instead of
|
|
10
|
+
* re-sending bytes, and identical content is acknowledged without re-upload.
|
|
11
|
+
*/
|
|
12
|
+
export const RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES = 10 * 1024 * 1024;
|
|
13
|
+
export const RAW_EVIDENCE_UPLOAD_MAX_CHUNK_BYTES = 3 * 1024 * 1024;
|
|
14
|
+
export const RAW_EVIDENCE_UPLOAD_DEFAULT_CHUNK_BYTES = 2 * 1024 * 1024;
|
|
15
|
+
export const RAW_EVIDENCE_UPLOAD_MAX_CHUNK_COUNT = 64;
|
|
16
|
+
export const RAW_EVIDENCE_UPLOAD_MAX_OBJECTS_PER_BEGIN = 25;
|
|
17
|
+
export const CODEX_SESSION_REPORT_MAX_SESSIONS = 200;
|
|
18
|
+
const SafeLabelSchema = z
|
|
19
|
+
.string()
|
|
20
|
+
.trim()
|
|
21
|
+
.min(1)
|
|
22
|
+
.max(120)
|
|
23
|
+
.regex(/^[a-z0-9_:.-]+$/i);
|
|
24
|
+
const BasenameSchema = z
|
|
25
|
+
.string()
|
|
26
|
+
.trim()
|
|
27
|
+
.min(1)
|
|
28
|
+
.max(160)
|
|
29
|
+
.regex(/^[^/\\]+$/);
|
|
30
|
+
export const RawEvidenceUploadBeginObjectSchema = z
|
|
31
|
+
.object({
|
|
32
|
+
pointer: RawEvidencePointerSchema,
|
|
33
|
+
chunk_size_bytes: z
|
|
34
|
+
.number()
|
|
35
|
+
.int()
|
|
36
|
+
.positive()
|
|
37
|
+
.max(RAW_EVIDENCE_UPLOAD_MAX_CHUNK_BYTES),
|
|
38
|
+
chunk_count: z
|
|
39
|
+
.number()
|
|
40
|
+
.int()
|
|
41
|
+
.positive()
|
|
42
|
+
.max(RAW_EVIDENCE_UPLOAD_MAX_CHUNK_COUNT),
|
|
43
|
+
})
|
|
44
|
+
.strict();
|
|
45
|
+
export const RawEvidenceUploadBeginRequestSchema = z
|
|
46
|
+
.object({
|
|
47
|
+
schema_version: z.literal("ambient-raw-evidence-upload-begin.v1"),
|
|
48
|
+
generated_at: IsoDateTimeSchema,
|
|
49
|
+
provenance: CaptureProvenanceSchema,
|
|
50
|
+
objects: z
|
|
51
|
+
.array(RawEvidenceUploadBeginObjectSchema)
|
|
52
|
+
.min(1)
|
|
53
|
+
.max(RAW_EVIDENCE_UPLOAD_MAX_OBJECTS_PER_BEGIN),
|
|
54
|
+
})
|
|
55
|
+
.strict();
|
|
56
|
+
export const RawEvidenceUploadDispositionSchema = z.enum([
|
|
57
|
+
"new",
|
|
58
|
+
"resume",
|
|
59
|
+
"already_committed",
|
|
60
|
+
"conflict",
|
|
61
|
+
]);
|
|
62
|
+
export const RawEvidenceUploadBeginResponseObjectSchema = z
|
|
63
|
+
.object({
|
|
64
|
+
object_key: NonEmptyStringSchema,
|
|
65
|
+
raw_evidence_pointer_id: NonEmptyStringSchema,
|
|
66
|
+
disposition: RawEvidenceUploadDispositionSchema,
|
|
67
|
+
upload_id: NonEmptyStringSchema.optional(),
|
|
68
|
+
received_chunk_indexes: z.array(z.number().int().nonnegative()).default([]),
|
|
69
|
+
reason: SafeLabelSchema.optional(),
|
|
70
|
+
})
|
|
71
|
+
.strict();
|
|
72
|
+
export const RawEvidenceUploadBeginResponseSchema = z
|
|
73
|
+
.object({
|
|
74
|
+
ok: z.literal(true),
|
|
75
|
+
objects: z.array(RawEvidenceUploadBeginResponseObjectSchema),
|
|
76
|
+
})
|
|
77
|
+
.strict();
|
|
78
|
+
export const RawEvidenceUploadChunkRequestSchema = z
|
|
79
|
+
.object({
|
|
80
|
+
schema_version: z.literal("ambient-raw-evidence-upload-chunk.v1"),
|
|
81
|
+
generated_at: IsoDateTimeSchema,
|
|
82
|
+
provenance: CaptureProvenanceSchema,
|
|
83
|
+
upload_id: NonEmptyStringSchema,
|
|
84
|
+
object_key: NonEmptyStringSchema,
|
|
85
|
+
chunk_index: z.number().int().nonnegative(),
|
|
86
|
+
chunk_count: z
|
|
87
|
+
.number()
|
|
88
|
+
.int()
|
|
89
|
+
.positive()
|
|
90
|
+
.max(RAW_EVIDENCE_UPLOAD_MAX_CHUNK_COUNT),
|
|
91
|
+
chunk_hash_sha256: Sha256Schema,
|
|
92
|
+
content_base64: z.string().min(1),
|
|
93
|
+
})
|
|
94
|
+
.strict();
|
|
95
|
+
export const RawEvidenceUploadChunkResponseSchema = z
|
|
96
|
+
.object({
|
|
97
|
+
ok: z.literal(true),
|
|
98
|
+
upload_id: NonEmptyStringSchema,
|
|
99
|
+
chunk_index: z.number().int().nonnegative(),
|
|
100
|
+
received_chunk_count: z.number().int().nonnegative(),
|
|
101
|
+
})
|
|
102
|
+
.strict();
|
|
103
|
+
export const RawEvidenceUploadCommitRequestSchema = z
|
|
104
|
+
.object({
|
|
105
|
+
schema_version: z.literal("ambient-raw-evidence-upload-commit.v1"),
|
|
106
|
+
generated_at: IsoDateTimeSchema,
|
|
107
|
+
provenance: CaptureProvenanceSchema,
|
|
108
|
+
upload_id: NonEmptyStringSchema,
|
|
109
|
+
object_key: NonEmptyStringSchema,
|
|
110
|
+
})
|
|
111
|
+
.strict();
|
|
112
|
+
export const RawEvidenceUploadCommitResponseSchema = z
|
|
113
|
+
.object({
|
|
114
|
+
ok: z.literal(true),
|
|
115
|
+
status: z.enum(["committed", "already_committed"]),
|
|
116
|
+
object_key: NonEmptyStringSchema,
|
|
117
|
+
content_hash_sha256: Sha256Schema,
|
|
118
|
+
byte_size: z.number().int().nonnegative(),
|
|
119
|
+
chunk_count: z.number().int().nonnegative(),
|
|
120
|
+
})
|
|
121
|
+
.strict();
|
|
122
|
+
/**
|
|
123
|
+
* Codex session attribution report.
|
|
124
|
+
*
|
|
125
|
+
* The collector attributes Codex session JSONL files to repos/worktrees with
|
|
126
|
+
* deterministic metadata signals. Sessions that cannot be attributed are
|
|
127
|
+
* reported here with reason labels and safe pointers (session id, file hash,
|
|
128
|
+
* cwd basename/hash) instead of being duplicated into every repo's evidence
|
|
129
|
+
* pack or silently dropped. No content-bearing fields are allowed.
|
|
130
|
+
*/
|
|
131
|
+
export const CodexSessionAttributionStateSchema = z.enum([
|
|
132
|
+
"attributed",
|
|
133
|
+
"ambiguous",
|
|
134
|
+
"unattributed",
|
|
135
|
+
"skipped",
|
|
136
|
+
]);
|
|
137
|
+
export const CodexSessionUploadStateSchema = z.enum([
|
|
138
|
+
"uploaded",
|
|
139
|
+
"reused_existing",
|
|
140
|
+
"upload_failed",
|
|
141
|
+
"not_uploaded",
|
|
142
|
+
]);
|
|
143
|
+
export const CodexSessionAttributionSchema = z
|
|
144
|
+
.object({
|
|
145
|
+
codex_session_id: NonEmptyStringSchema.max(120),
|
|
146
|
+
observed_at: IsoDateTimeSchema,
|
|
147
|
+
attribution_state: CodexSessionAttributionStateSchema,
|
|
148
|
+
attribution_reason: SafeLabelSchema,
|
|
149
|
+
attribution_score: z.number().min(0).max(1).optional(),
|
|
150
|
+
path_score: z.number().min(0).max(1).optional(),
|
|
151
|
+
signals: z.array(SafeLabelSchema).max(20).default([]),
|
|
152
|
+
session_file_hash_sha256: Sha256Schema.optional(),
|
|
153
|
+
session_file_byte_size: z.number().int().nonnegative().optional(),
|
|
154
|
+
session_file_mtime: IsoDateTimeSchema.optional(),
|
|
155
|
+
repo_fingerprint: SafeLabelSchema.optional(),
|
|
156
|
+
worktree_fingerprint: SafeLabelSchema.optional(),
|
|
157
|
+
repo_label: BasenameSchema.optional(),
|
|
158
|
+
branch: z.string().trim().min(1).max(200).optional(),
|
|
159
|
+
cwd_basename: BasenameSchema.optional(),
|
|
160
|
+
cwd_hash: z
|
|
161
|
+
.string()
|
|
162
|
+
.regex(/^[a-f0-9]{16,64}$/)
|
|
163
|
+
.optional(),
|
|
164
|
+
raw_evidence_pointer_id: NonEmptyStringSchema.optional(),
|
|
165
|
+
upload_state: CodexSessionUploadStateSchema.optional(),
|
|
166
|
+
})
|
|
167
|
+
.strict();
|
|
168
|
+
export const CodexSessionAttributionReportRequestSchema = z
|
|
169
|
+
.object({
|
|
170
|
+
schema_version: z.literal("ambient-codex-session-attributions.v1"),
|
|
171
|
+
generated_at: IsoDateTimeSchema,
|
|
172
|
+
provenance: CaptureProvenanceSchema,
|
|
173
|
+
sessions: z
|
|
174
|
+
.array(CodexSessionAttributionSchema)
|
|
175
|
+
.min(1)
|
|
176
|
+
.max(CODEX_SESSION_REPORT_MAX_SESSIONS),
|
|
177
|
+
})
|
|
178
|
+
.strict();
|
|
179
|
+
export const CodexSessionAttributionReportResponseSchema = z
|
|
180
|
+
.object({
|
|
181
|
+
ok: z.literal(true),
|
|
182
|
+
recorded_count: z.number().int().nonnegative(),
|
|
183
|
+
})
|
|
184
|
+
.strict();
|
package/dist/index.d.ts
CHANGED
|
@@ -1,9 +1,11 @@
|
|
|
1
1
|
export * from "./common.js";
|
|
2
|
+
export * from "./evidence-upload.js";
|
|
2
3
|
export * from "./ingest-dto.js";
|
|
3
4
|
export * from "./local-config.js";
|
|
4
5
|
export * from "./paths.js";
|
|
5
6
|
export * from "./privacy.js";
|
|
6
7
|
export * from "./risk-flags.js";
|
|
8
|
+
export * from "./secret-guards.js";
|
|
7
9
|
export * from "./source-adapter.js";
|
|
8
10
|
export * from "./trace-sink.js";
|
|
9
11
|
export * from "./work-context.js";
|
package/dist/index.js
CHANGED
|
@@ -1,9 +1,11 @@
|
|
|
1
1
|
export * from "./common.js";
|
|
2
|
+
export * from "./evidence-upload.js";
|
|
2
3
|
export * from "./ingest-dto.js";
|
|
3
4
|
export * from "./local-config.js";
|
|
4
5
|
export * from "./paths.js";
|
|
5
6
|
export * from "./privacy.js";
|
|
6
7
|
export * from "./risk-flags.js";
|
|
8
|
+
export * from "./secret-guards.js";
|
|
7
9
|
export * from "./source-adapter.js";
|
|
8
10
|
export * from "./trace-sink.js";
|
|
9
11
|
export * from "./work-context.js";
|
package/dist/ingest-dto.d.ts
CHANGED
|
@@ -47,6 +47,12 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
|
|
|
47
47
|
collector_version: z.ZodString;
|
|
48
48
|
repo: z.ZodString;
|
|
49
49
|
branch: z.ZodString;
|
|
50
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
51
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
52
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
53
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
54
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
55
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
50
56
|
operator_id: z.ZodString;
|
|
51
57
|
session_id: z.ZodString;
|
|
52
58
|
work_context_id: z.ZodString;
|
|
@@ -56,6 +62,7 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
|
|
|
56
62
|
redacted_summary: "redacted_summary";
|
|
57
63
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
58
64
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
65
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
59
66
|
}>;
|
|
60
67
|
redaction: z.ZodObject<{
|
|
61
68
|
privacy_classification: z.ZodEnum<{
|
|
@@ -63,12 +70,14 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
|
|
|
63
70
|
redacted_summary: "redacted_summary";
|
|
64
71
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
65
72
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
73
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
66
74
|
}>;
|
|
67
75
|
redaction_status: z.ZodEnum<{
|
|
68
76
|
metadata_only: "metadata_only";
|
|
69
77
|
redacted: "redacted";
|
|
70
78
|
raw_local_only: "raw_local_only";
|
|
71
79
|
raw_remote_short_retention: "raw_remote_short_retention";
|
|
80
|
+
raw_remote_durable: "raw_remote_durable";
|
|
72
81
|
}>;
|
|
73
82
|
redacted_fields: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
74
83
|
raw_evidence_pointer_ids: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
@@ -153,6 +162,12 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
|
|
|
153
162
|
collector_version: z.ZodString;
|
|
154
163
|
repo: z.ZodString;
|
|
155
164
|
branch: z.ZodString;
|
|
165
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
166
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
167
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
168
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
169
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
170
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
156
171
|
operator_id: z.ZodString;
|
|
157
172
|
session_id: z.ZodString;
|
|
158
173
|
work_context_id: z.ZodString;
|
|
@@ -163,15 +178,18 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
|
|
|
163
178
|
privacy_classification: z.ZodEnum<{
|
|
164
179
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
165
180
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
181
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
166
182
|
}>;
|
|
167
183
|
retention_policy: z.ZodObject<{
|
|
168
184
|
mode: z.ZodEnum<{
|
|
169
185
|
local_only: "local_only";
|
|
170
186
|
remote_short_retention: "remote_short_retention";
|
|
187
|
+
remote_durable: "remote_durable";
|
|
171
188
|
}>;
|
|
172
189
|
privacy_classification: z.ZodEnum<{
|
|
173
190
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
174
191
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
192
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
175
193
|
}>;
|
|
176
194
|
remote_retention_days: z.ZodOptional<z.ZodNumber>;
|
|
177
195
|
expires_at: z.ZodOptional<z.ZodString>;
|
|
@@ -180,6 +198,7 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
|
|
|
180
198
|
local_file: "local_file";
|
|
181
199
|
remote_object: "remote_object";
|
|
182
200
|
}>;
|
|
201
|
+
storage_bucket: z.ZodOptional<z.ZodString>;
|
|
183
202
|
local_path: z.ZodOptional<z.ZodString>;
|
|
184
203
|
object_key: z.ZodOptional<z.ZodString>;
|
|
185
204
|
content_hash_sha256: z.ZodOptional<z.ZodString>;
|
|
@@ -221,6 +240,7 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
|
|
|
221
240
|
redacted_summary: "redacted_summary";
|
|
222
241
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
223
242
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
243
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
224
244
|
}>>;
|
|
225
245
|
}, z.core.$strict>>;
|
|
226
246
|
}, z.core.$strict>;
|
|
@@ -256,6 +276,13 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
256
276
|
work_context_id: z.ZodString;
|
|
257
277
|
repo: z.ZodString;
|
|
258
278
|
branch: z.ZodString;
|
|
279
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
280
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
281
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
282
|
+
head_sha: z.ZodOptional<z.ZodString>;
|
|
283
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
284
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
285
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
259
286
|
operator_id: z.ZodString;
|
|
260
287
|
session_id: z.ZodString;
|
|
261
288
|
started_at: z.ZodString;
|
|
@@ -295,6 +322,12 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
295
322
|
collector_version: z.ZodString;
|
|
296
323
|
repo: z.ZodString;
|
|
297
324
|
branch: z.ZodString;
|
|
325
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
326
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
327
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
328
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
329
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
330
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
298
331
|
operator_id: z.ZodString;
|
|
299
332
|
session_id: z.ZodString;
|
|
300
333
|
work_context_id: z.ZodString;
|
|
@@ -334,6 +367,12 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
334
367
|
collector_version: z.ZodString;
|
|
335
368
|
repo: z.ZodString;
|
|
336
369
|
branch: z.ZodString;
|
|
370
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
371
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
372
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
373
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
374
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
375
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
337
376
|
operator_id: z.ZodString;
|
|
338
377
|
session_id: z.ZodString;
|
|
339
378
|
work_context_id: z.ZodString;
|
|
@@ -343,6 +382,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
343
382
|
redacted_summary: "redacted_summary";
|
|
344
383
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
345
384
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
385
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
346
386
|
}>;
|
|
347
387
|
redaction: z.ZodObject<{
|
|
348
388
|
privacy_classification: z.ZodEnum<{
|
|
@@ -350,12 +390,14 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
350
390
|
redacted_summary: "redacted_summary";
|
|
351
391
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
352
392
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
393
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
353
394
|
}>;
|
|
354
395
|
redaction_status: z.ZodEnum<{
|
|
355
396
|
metadata_only: "metadata_only";
|
|
356
397
|
redacted: "redacted";
|
|
357
398
|
raw_local_only: "raw_local_only";
|
|
358
399
|
raw_remote_short_retention: "raw_remote_short_retention";
|
|
400
|
+
raw_remote_durable: "raw_remote_durable";
|
|
359
401
|
}>;
|
|
360
402
|
redacted_fields: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
361
403
|
raw_evidence_pointer_ids: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
@@ -440,6 +482,12 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
440
482
|
collector_version: z.ZodString;
|
|
441
483
|
repo: z.ZodString;
|
|
442
484
|
branch: z.ZodString;
|
|
485
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
486
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
487
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
488
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
489
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
490
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
443
491
|
operator_id: z.ZodString;
|
|
444
492
|
session_id: z.ZodString;
|
|
445
493
|
work_context_id: z.ZodString;
|
|
@@ -450,15 +498,18 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
450
498
|
privacy_classification: z.ZodEnum<{
|
|
451
499
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
452
500
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
501
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
453
502
|
}>;
|
|
454
503
|
retention_policy: z.ZodObject<{
|
|
455
504
|
mode: z.ZodEnum<{
|
|
456
505
|
local_only: "local_only";
|
|
457
506
|
remote_short_retention: "remote_short_retention";
|
|
507
|
+
remote_durable: "remote_durable";
|
|
458
508
|
}>;
|
|
459
509
|
privacy_classification: z.ZodEnum<{
|
|
460
510
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
461
511
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
512
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
462
513
|
}>;
|
|
463
514
|
remote_retention_days: z.ZodOptional<z.ZodNumber>;
|
|
464
515
|
expires_at: z.ZodOptional<z.ZodString>;
|
|
@@ -467,6 +518,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
467
518
|
local_file: "local_file";
|
|
468
519
|
remote_object: "remote_object";
|
|
469
520
|
}>;
|
|
521
|
+
storage_bucket: z.ZodOptional<z.ZodString>;
|
|
470
522
|
local_path: z.ZodOptional<z.ZodString>;
|
|
471
523
|
object_key: z.ZodOptional<z.ZodString>;
|
|
472
524
|
content_hash_sha256: z.ZodOptional<z.ZodString>;
|
|
@@ -508,6 +560,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
508
560
|
redacted_summary: "redacted_summary";
|
|
509
561
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
510
562
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
563
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
511
564
|
}>>;
|
|
512
565
|
}, z.core.$strict>>;
|
|
513
566
|
}, z.core.$strict>>;
|
|
@@ -532,8 +585,8 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
532
585
|
work_context_id: z.ZodOptional<z.ZodString>;
|
|
533
586
|
status: z.ZodEnum<{
|
|
534
587
|
ok: "ok";
|
|
535
|
-
partial: "partial";
|
|
536
588
|
skipped: "skipped";
|
|
589
|
+
partial: "partial";
|
|
537
590
|
failed: "failed";
|
|
538
591
|
}>;
|
|
539
592
|
started_at: z.ZodString;
|
|
@@ -549,12 +602,14 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
549
602
|
redacted_summary: "redacted_summary";
|
|
550
603
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
551
604
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
605
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
552
606
|
}>;
|
|
553
607
|
redaction_status: z.ZodEnum<{
|
|
554
608
|
metadata_only: "metadata_only";
|
|
555
609
|
redacted: "redacted";
|
|
556
610
|
raw_local_only: "raw_local_only";
|
|
557
611
|
raw_remote_short_retention: "raw_remote_short_retention";
|
|
612
|
+
raw_remote_durable: "raw_remote_durable";
|
|
558
613
|
}>;
|
|
559
614
|
redacted_fields: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
560
615
|
raw_evidence_pointer_ids: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
@@ -566,15 +621,18 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
566
621
|
privacy_classification: z.ZodEnum<{
|
|
567
622
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
568
623
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
624
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
569
625
|
}>;
|
|
570
626
|
retention_policy: z.ZodObject<{
|
|
571
627
|
mode: z.ZodEnum<{
|
|
572
628
|
local_only: "local_only";
|
|
573
629
|
remote_short_retention: "remote_short_retention";
|
|
630
|
+
remote_durable: "remote_durable";
|
|
574
631
|
}>;
|
|
575
632
|
privacy_classification: z.ZodEnum<{
|
|
576
633
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
577
634
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
635
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
578
636
|
}>;
|
|
579
637
|
remote_retention_days: z.ZodOptional<z.ZodNumber>;
|
|
580
638
|
expires_at: z.ZodOptional<z.ZodString>;
|
|
@@ -583,6 +641,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
583
641
|
local_file: "local_file";
|
|
584
642
|
remote_object: "remote_object";
|
|
585
643
|
}>;
|
|
644
|
+
storage_bucket: z.ZodOptional<z.ZodString>;
|
|
586
645
|
local_path: z.ZodOptional<z.ZodString>;
|
|
587
646
|
object_key: z.ZodOptional<z.ZodString>;
|
|
588
647
|
content_hash_sha256: z.ZodOptional<z.ZodString>;
|
|
@@ -666,6 +725,12 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
666
725
|
collector_version: z.ZodString;
|
|
667
726
|
repo: z.ZodString;
|
|
668
727
|
branch: z.ZodString;
|
|
728
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
729
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
730
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
731
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
732
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
733
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
669
734
|
operator_id: z.ZodString;
|
|
670
735
|
session_id: z.ZodString;
|
|
671
736
|
work_context_id: z.ZodString;
|
package/dist/local-config.d.ts
CHANGED
|
@@ -12,6 +12,7 @@ export declare const LocalCollectorConfigSchema: z.ZodObject<{
|
|
|
12
12
|
raw_evidence_upload: z.ZodDefault<z.ZodEnum<{
|
|
13
13
|
disabled: "disabled";
|
|
14
14
|
remote_short_retention_opt_in: "remote_short_retention_opt_in";
|
|
15
|
+
remote_durable_opt_in: "remote_durable_opt_in";
|
|
15
16
|
}>>;
|
|
16
17
|
session_file_path: z.ZodOptional<z.ZodString>;
|
|
17
18
|
state_dir_path: z.ZodOptional<z.ZodString>;
|
package/dist/local-config.js
CHANGED
|
@@ -12,8 +12,12 @@ export const LocalCollectorConfigSchema = z
|
|
|
12
12
|
operator_id: NonEmptyStringSchema.optional(),
|
|
13
13
|
default_repo_paths: z.array(NonEmptyStringSchema).default([]),
|
|
14
14
|
raw_evidence_upload: z
|
|
15
|
-
.enum([
|
|
16
|
-
|
|
15
|
+
.enum([
|
|
16
|
+
"disabled",
|
|
17
|
+
"remote_short_retention_opt_in",
|
|
18
|
+
"remote_durable_opt_in",
|
|
19
|
+
])
|
|
20
|
+
.default("remote_durable_opt_in"),
|
|
17
21
|
session_file_path: NonEmptyStringSchema.optional(),
|
|
18
22
|
state_dir_path: NonEmptyStringSchema.optional(),
|
|
19
23
|
})
|
package/dist/privacy.d.ts
CHANGED
|
@@ -4,26 +4,31 @@ export declare const PrivacyClassificationSchema: z.ZodEnum<{
|
|
|
4
4
|
redacted_summary: "redacted_summary";
|
|
5
5
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
6
6
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
7
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
7
8
|
}>;
|
|
8
9
|
export type PrivacyClassification = z.infer<typeof PrivacyClassificationSchema>;
|
|
9
10
|
export declare const RawEvidencePrivacyClassificationSchema: z.ZodEnum<{
|
|
10
11
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
11
12
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
13
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
12
14
|
}>;
|
|
13
15
|
export type RawEvidencePrivacyClassification = z.infer<typeof RawEvidencePrivacyClassificationSchema>;
|
|
14
16
|
export declare const RawEvidenceRetentionModeSchema: z.ZodEnum<{
|
|
15
17
|
local_only: "local_only";
|
|
16
18
|
remote_short_retention: "remote_short_retention";
|
|
19
|
+
remote_durable: "remote_durable";
|
|
17
20
|
}>;
|
|
18
21
|
export type RawEvidenceRetentionMode = z.infer<typeof RawEvidenceRetentionModeSchema>;
|
|
19
22
|
export declare const RawEvidenceRetentionPolicySchema: z.ZodObject<{
|
|
20
23
|
mode: z.ZodEnum<{
|
|
21
24
|
local_only: "local_only";
|
|
22
25
|
remote_short_retention: "remote_short_retention";
|
|
26
|
+
remote_durable: "remote_durable";
|
|
23
27
|
}>;
|
|
24
28
|
privacy_classification: z.ZodEnum<{
|
|
25
29
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
26
30
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
31
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
27
32
|
}>;
|
|
28
33
|
remote_retention_days: z.ZodOptional<z.ZodNumber>;
|
|
29
34
|
expires_at: z.ZodOptional<z.ZodString>;
|
|
@@ -34,15 +39,18 @@ export declare const RawEvidencePointerSchema: z.ZodObject<{
|
|
|
34
39
|
privacy_classification: z.ZodEnum<{
|
|
35
40
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
36
41
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
42
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
37
43
|
}>;
|
|
38
44
|
retention_policy: z.ZodObject<{
|
|
39
45
|
mode: z.ZodEnum<{
|
|
40
46
|
local_only: "local_only";
|
|
41
47
|
remote_short_retention: "remote_short_retention";
|
|
48
|
+
remote_durable: "remote_durable";
|
|
42
49
|
}>;
|
|
43
50
|
privacy_classification: z.ZodEnum<{
|
|
44
51
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
45
52
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
53
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
46
54
|
}>;
|
|
47
55
|
remote_retention_days: z.ZodOptional<z.ZodNumber>;
|
|
48
56
|
expires_at: z.ZodOptional<z.ZodString>;
|
|
@@ -51,6 +59,7 @@ export declare const RawEvidencePointerSchema: z.ZodObject<{
|
|
|
51
59
|
local_file: "local_file";
|
|
52
60
|
remote_object: "remote_object";
|
|
53
61
|
}>;
|
|
62
|
+
storage_bucket: z.ZodOptional<z.ZodString>;
|
|
54
63
|
local_path: z.ZodOptional<z.ZodString>;
|
|
55
64
|
object_key: z.ZodOptional<z.ZodString>;
|
|
56
65
|
content_hash_sha256: z.ZodOptional<z.ZodString>;
|
|
@@ -65,12 +74,14 @@ export declare const RedactionMetadataSchema: z.ZodObject<{
|
|
|
65
74
|
redacted_summary: "redacted_summary";
|
|
66
75
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
67
76
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
77
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
68
78
|
}>;
|
|
69
79
|
redaction_status: z.ZodEnum<{
|
|
70
80
|
metadata_only: "metadata_only";
|
|
71
81
|
redacted: "redacted";
|
|
72
82
|
raw_local_only: "raw_local_only";
|
|
73
83
|
raw_remote_short_retention: "raw_remote_short_retention";
|
|
84
|
+
raw_remote_durable: "raw_remote_durable";
|
|
74
85
|
}>;
|
|
75
86
|
redacted_fields: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
76
87
|
raw_evidence_pointer_ids: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
package/dist/privacy.js
CHANGED
|
@@ -5,14 +5,17 @@ export const PrivacyClassificationSchema = z.enum([
|
|
|
5
5
|
"redacted_summary",
|
|
6
6
|
"local_only_raw_evidence",
|
|
7
7
|
"remote_short_retention_raw_evidence",
|
|
8
|
+
"remote_durable_raw_evidence",
|
|
8
9
|
]);
|
|
9
10
|
export const RawEvidencePrivacyClassificationSchema = z.enum([
|
|
10
11
|
"local_only_raw_evidence",
|
|
11
12
|
"remote_short_retention_raw_evidence",
|
|
13
|
+
"remote_durable_raw_evidence",
|
|
12
14
|
]);
|
|
13
15
|
export const RawEvidenceRetentionModeSchema = z.enum([
|
|
14
16
|
"local_only",
|
|
15
17
|
"remote_short_retention",
|
|
18
|
+
"remote_durable",
|
|
16
19
|
]);
|
|
17
20
|
export const RawEvidenceRetentionPolicySchema = z
|
|
18
21
|
.object({
|
|
@@ -39,6 +42,14 @@ export const RawEvidenceRetentionPolicySchema = z
|
|
|
39
42
|
path: ["privacy_classification"],
|
|
40
43
|
});
|
|
41
44
|
}
|
|
45
|
+
if (policy.mode === "remote_durable" &&
|
|
46
|
+
policy.privacy_classification !== "remote_durable_raw_evidence") {
|
|
47
|
+
context.addIssue({
|
|
48
|
+
code: "custom",
|
|
49
|
+
message: "remote_durable must use remote_durable_raw_evidence",
|
|
50
|
+
path: ["privacy_classification"],
|
|
51
|
+
});
|
|
52
|
+
}
|
|
42
53
|
if (policy.mode === "local_only" && policy.remote_retention_days) {
|
|
43
54
|
context.addIssue({
|
|
44
55
|
code: "custom",
|
|
@@ -46,6 +57,20 @@ export const RawEvidenceRetentionPolicySchema = z
|
|
|
46
57
|
path: ["remote_retention_days"],
|
|
47
58
|
});
|
|
48
59
|
}
|
|
60
|
+
if (policy.mode === "remote_durable" && policy.remote_retention_days) {
|
|
61
|
+
context.addIssue({
|
|
62
|
+
code: "custom",
|
|
63
|
+
message: "durable remote evidence cannot set remote_retention_days",
|
|
64
|
+
path: ["remote_retention_days"],
|
|
65
|
+
});
|
|
66
|
+
}
|
|
67
|
+
if (policy.mode === "remote_durable" && policy.expires_at) {
|
|
68
|
+
context.addIssue({
|
|
69
|
+
code: "custom",
|
|
70
|
+
message: "durable remote evidence cannot set expires_at",
|
|
71
|
+
path: ["expires_at"],
|
|
72
|
+
});
|
|
73
|
+
}
|
|
49
74
|
if (policy.mode === "remote_short_retention" &&
|
|
50
75
|
!policy.remote_retention_days) {
|
|
51
76
|
context.addIssue({
|
|
@@ -61,6 +86,7 @@ export const RawEvidencePointerSchema = z
|
|
|
61
86
|
privacy_classification: RawEvidencePrivacyClassificationSchema,
|
|
62
87
|
retention_policy: RawEvidenceRetentionPolicySchema,
|
|
63
88
|
storage_scope: z.enum(["local_file", "remote_object"]),
|
|
89
|
+
storage_bucket: NonEmptyStringSchema.optional(),
|
|
64
90
|
local_path: NonEmptyStringSchema.optional(),
|
|
65
91
|
object_key: NonEmptyStringSchema.optional(),
|
|
66
92
|
content_hash_sha256: Sha256Schema.optional(),
|
|
@@ -92,6 +118,13 @@ export const RawEvidencePointerSchema = z
|
|
|
92
118
|
path: ["object_key"],
|
|
93
119
|
});
|
|
94
120
|
}
|
|
121
|
+
if (pointer.storage_scope === "remote_object" && !pointer.storage_bucket) {
|
|
122
|
+
context.addIssue({
|
|
123
|
+
code: "custom",
|
|
124
|
+
message: "remote evidence pointers require storage_bucket",
|
|
125
|
+
path: ["storage_bucket"],
|
|
126
|
+
});
|
|
127
|
+
}
|
|
95
128
|
});
|
|
96
129
|
export const RedactionMetadataSchema = z
|
|
97
130
|
.object({
|
|
@@ -101,6 +134,7 @@ export const RedactionMetadataSchema = z
|
|
|
101
134
|
"redacted",
|
|
102
135
|
"raw_local_only",
|
|
103
136
|
"raw_remote_short_retention",
|
|
137
|
+
"raw_remote_durable",
|
|
104
138
|
]),
|
|
105
139
|
redacted_fields: z.array(NonEmptyStringSchema).default([]),
|
|
106
140
|
raw_evidence_pointer_ids: z.array(NonEmptyStringSchema).default([]),
|
package/dist/risk-flags.d.ts
CHANGED
|
@@ -94,6 +94,12 @@ export declare const RiskFlagSchema: z.ZodObject<{
|
|
|
94
94
|
collector_version: z.ZodString;
|
|
95
95
|
repo: z.ZodString;
|
|
96
96
|
branch: z.ZodString;
|
|
97
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
98
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
99
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
100
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
101
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
102
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
97
103
|
operator_id: z.ZodString;
|
|
98
104
|
session_id: z.ZodString;
|
|
99
105
|
work_context_id: z.ZodString;
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
export declare function containsSecretLikeContent(value: string): boolean;
|
|
@@ -0,0 +1,23 @@
|
|
|
1
|
+
const PRIVILEGED_SUPABASE_KEY_NAME_PATTERN = new RegExp(`\\b${["SUPABASE", "SERVICE", "ROLE", "KEY"].join("_")}\\b`, "i");
|
|
2
|
+
const SECRET_LIKE_CONTENT_PATTERNS = [
|
|
3
|
+
/\b(?:NEXT_PUBLIC_)?SUPABASE_ANON_KEY\b/i,
|
|
4
|
+
PRIVILEGED_SUPABASE_KEY_NAME_PATTERN,
|
|
5
|
+
/\bSERVICE[_\s-]?ROLE\b/i,
|
|
6
|
+
/\b(?:api[_-]?key|access[_-]?token|refresh[_-]?token|private[_-]?key|client[_-]?secret|secret[_-]?access[_-]?key)\s*[:=]\s*["']?[A-Za-z0-9_./+=-]{12,}/i,
|
|
7
|
+
/-----BEGIN [A-Z ]*PRIVATE KEY-----/,
|
|
8
|
+
/\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/,
|
|
9
|
+
/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/,
|
|
10
|
+
/\b(?:sk|pk)_(?:live|test)_[A-Za-z0-9]{16,}/,
|
|
11
|
+
/\bsk-[A-Za-z0-9_-]{16,}/,
|
|
12
|
+
/\bgh[pousr]_[A-Za-z0-9_]{16,}/,
|
|
13
|
+
/\bgithub_pat_[A-Za-z0-9_]{20,}/,
|
|
14
|
+
/\blin_api_[A-Za-z0-9]{16,}/,
|
|
15
|
+
/\bsb_secret_[A-Za-z0-9_]{16,}/,
|
|
16
|
+
/\bxox[baprs]-[A-Za-z0-9-]{16,}/,
|
|
17
|
+
/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
|
|
18
|
+
/\bLANGFUSE_(?:PUBLIC|SECRET)_KEY\b/i,
|
|
19
|
+
/\b(?:pk|sk)-lf-[A-Za-z0-9_-]{16,}\b/i,
|
|
20
|
+
];
|
|
21
|
+
export function containsSecretLikeContent(value) {
|
|
22
|
+
return SECRET_LIKE_CONTENT_PATTERNS.some((pattern) => pattern.test(value));
|
|
23
|
+
}
|
package/dist/source-adapter.d.ts
CHANGED
|
@@ -27,12 +27,14 @@ export declare const SourceScanEventSummarySchema: z.ZodObject<{
|
|
|
27
27
|
redacted_summary: "redacted_summary";
|
|
28
28
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
29
29
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
30
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
30
31
|
}>;
|
|
31
32
|
redaction_status: z.ZodEnum<{
|
|
32
33
|
metadata_only: "metadata_only";
|
|
33
34
|
redacted: "redacted";
|
|
34
35
|
raw_local_only: "raw_local_only";
|
|
35
36
|
raw_remote_short_retention: "raw_remote_short_retention";
|
|
37
|
+
raw_remote_durable: "raw_remote_durable";
|
|
36
38
|
}>;
|
|
37
39
|
redacted_fields: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
38
40
|
raw_evidence_pointer_ids: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
@@ -44,15 +46,18 @@ export declare const SourceScanEventSummarySchema: z.ZodObject<{
|
|
|
44
46
|
privacy_classification: z.ZodEnum<{
|
|
45
47
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
46
48
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
49
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
47
50
|
}>;
|
|
48
51
|
retention_policy: z.ZodObject<{
|
|
49
52
|
mode: z.ZodEnum<{
|
|
50
53
|
local_only: "local_only";
|
|
51
54
|
remote_short_retention: "remote_short_retention";
|
|
55
|
+
remote_durable: "remote_durable";
|
|
52
56
|
}>;
|
|
53
57
|
privacy_classification: z.ZodEnum<{
|
|
54
58
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
55
59
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
60
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
56
61
|
}>;
|
|
57
62
|
remote_retention_days: z.ZodOptional<z.ZodNumber>;
|
|
58
63
|
expires_at: z.ZodOptional<z.ZodString>;
|
|
@@ -61,6 +66,7 @@ export declare const SourceScanEventSummarySchema: z.ZodObject<{
|
|
|
61
66
|
local_file: "local_file";
|
|
62
67
|
remote_object: "remote_object";
|
|
63
68
|
}>;
|
|
69
|
+
storage_bucket: z.ZodOptional<z.ZodString>;
|
|
64
70
|
local_path: z.ZodOptional<z.ZodString>;
|
|
65
71
|
object_key: z.ZodOptional<z.ZodString>;
|
|
66
72
|
content_hash_sha256: z.ZodOptional<z.ZodString>;
|
|
@@ -91,8 +97,8 @@ export declare const SourceScanResultSchema: z.ZodObject<{
|
|
|
91
97
|
work_context_id: z.ZodOptional<z.ZodString>;
|
|
92
98
|
status: z.ZodEnum<{
|
|
93
99
|
ok: "ok";
|
|
94
|
-
partial: "partial";
|
|
95
100
|
skipped: "skipped";
|
|
101
|
+
partial: "partial";
|
|
96
102
|
failed: "failed";
|
|
97
103
|
}>;
|
|
98
104
|
started_at: z.ZodString;
|
|
@@ -108,12 +114,14 @@ export declare const SourceScanResultSchema: z.ZodObject<{
|
|
|
108
114
|
redacted_summary: "redacted_summary";
|
|
109
115
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
110
116
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
117
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
111
118
|
}>;
|
|
112
119
|
redaction_status: z.ZodEnum<{
|
|
113
120
|
metadata_only: "metadata_only";
|
|
114
121
|
redacted: "redacted";
|
|
115
122
|
raw_local_only: "raw_local_only";
|
|
116
123
|
raw_remote_short_retention: "raw_remote_short_retention";
|
|
124
|
+
raw_remote_durable: "raw_remote_durable";
|
|
117
125
|
}>;
|
|
118
126
|
redacted_fields: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
119
127
|
raw_evidence_pointer_ids: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
@@ -125,15 +133,18 @@ export declare const SourceScanResultSchema: z.ZodObject<{
|
|
|
125
133
|
privacy_classification: z.ZodEnum<{
|
|
126
134
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
127
135
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
136
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
128
137
|
}>;
|
|
129
138
|
retention_policy: z.ZodObject<{
|
|
130
139
|
mode: z.ZodEnum<{
|
|
131
140
|
local_only: "local_only";
|
|
132
141
|
remote_short_retention: "remote_short_retention";
|
|
142
|
+
remote_durable: "remote_durable";
|
|
133
143
|
}>;
|
|
134
144
|
privacy_classification: z.ZodEnum<{
|
|
135
145
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
136
146
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
147
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
137
148
|
}>;
|
|
138
149
|
remote_retention_days: z.ZodOptional<z.ZodNumber>;
|
|
139
150
|
expires_at: z.ZodOptional<z.ZodString>;
|
|
@@ -142,6 +153,7 @@ export declare const SourceScanResultSchema: z.ZodObject<{
|
|
|
142
153
|
local_file: "local_file";
|
|
143
154
|
remote_object: "remote_object";
|
|
144
155
|
}>;
|
|
156
|
+
storage_bucket: z.ZodOptional<z.ZodString>;
|
|
145
157
|
local_path: z.ZodOptional<z.ZodString>;
|
|
146
158
|
object_key: z.ZodOptional<z.ZodString>;
|
|
147
159
|
content_hash_sha256: z.ZodOptional<z.ZodString>;
|
|
@@ -225,6 +237,12 @@ export declare const SourceScanResultSchema: z.ZodObject<{
|
|
|
225
237
|
collector_version: z.ZodString;
|
|
226
238
|
repo: z.ZodString;
|
|
227
239
|
branch: z.ZodString;
|
|
240
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
241
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
242
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
243
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
244
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
245
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
228
246
|
operator_id: z.ZodString;
|
|
229
247
|
session_id: z.ZodString;
|
|
230
248
|
work_context_id: z.ZodString;
|
package/dist/trace-sink.d.ts
CHANGED
|
@@ -44,6 +44,7 @@ export declare const ExternalTraceSinkPointerSchema: z.ZodObject<{
|
|
|
44
44
|
redacted_summary: "redacted_summary";
|
|
45
45
|
local_only_raw_evidence: "local_only_raw_evidence";
|
|
46
46
|
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
47
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
47
48
|
}>>;
|
|
48
49
|
}, z.core.$strict>;
|
|
49
50
|
export type ExternalTraceSinkPointer = z.infer<typeof ExternalTraceSinkPointerSchema>;
|
package/dist/work-context.d.ts
CHANGED
|
@@ -29,6 +29,13 @@ export declare const LocalWorkContextSchema: z.ZodObject<{
|
|
|
29
29
|
work_context_id: z.ZodString;
|
|
30
30
|
repo: z.ZodString;
|
|
31
31
|
branch: z.ZodString;
|
|
32
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
33
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
34
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
35
|
+
head_sha: z.ZodOptional<z.ZodString>;
|
|
36
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
37
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
38
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
32
39
|
operator_id: z.ZodString;
|
|
33
40
|
session_id: z.ZodString;
|
|
34
41
|
started_at: z.ZodString;
|
|
@@ -68,6 +75,12 @@ export declare const LocalWorkContextSchema: z.ZodObject<{
|
|
|
68
75
|
collector_version: z.ZodString;
|
|
69
76
|
repo: z.ZodString;
|
|
70
77
|
branch: z.ZodString;
|
|
78
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
79
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
80
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
81
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
82
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
83
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
71
84
|
operator_id: z.ZodString;
|
|
72
85
|
session_id: z.ZodString;
|
|
73
86
|
work_context_id: z.ZodString;
|
package/dist/work-context.js
CHANGED
|
@@ -23,6 +23,13 @@ export const LocalWorkContextSchema = z
|
|
|
23
23
|
work_context_id: NonEmptyStringSchema,
|
|
24
24
|
repo: NonEmptyStringSchema,
|
|
25
25
|
branch: NonEmptyStringSchema,
|
|
26
|
+
repo_label: NonEmptyStringSchema.optional(),
|
|
27
|
+
repo_fingerprint: NonEmptyStringSchema.optional(),
|
|
28
|
+
repo_origin_url: NonEmptyStringSchema.optional(),
|
|
29
|
+
head_sha: NonEmptyStringSchema.optional(),
|
|
30
|
+
worktree_label: NonEmptyStringSchema.optional(),
|
|
31
|
+
worktree_fingerprint: NonEmptyStringSchema.optional(),
|
|
32
|
+
worktree_is_primary: z.boolean().optional(),
|
|
26
33
|
operator_id: NonEmptyStringSchema,
|
|
27
34
|
session_id: NonEmptyStringSchema,
|
|
28
35
|
started_at: IsoDateTimeSchema,
|