@bli-cockpit/telemetry-core 0.1.23 → 0.1.25

package/dist/evidence-upload.d.ts

@@ -54,6 +54,7 @@ export declare const RawEvidenceLegacyUploadResponseSchema: z.ZodObject<{
             sanitized_content_hash_sha256: z.ZodOptional<z.ZodString>;
             original_byte_size: z.ZodOptional<z.ZodNumber>;
             sanitized_byte_size: z.ZodOptional<z.ZodNumber>;
+            applied_at: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
@@ -119,6 +120,7 @@ export declare const RawEvidenceUploadBeginObjectSchema: z.ZodObject<{
             sanitized_content_hash_sha256: z.ZodOptional<z.ZodString>;
             original_byte_size: z.ZodOptional<z.ZodNumber>;
             sanitized_byte_size: z.ZodOptional<z.ZodNumber>;
+            applied_at: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
     }, z.core.$strict>;
     chunk_size_bytes: z.ZodNumber;
@@ -218,6 +220,7 @@ export declare const RawEvidenceUploadBeginRequestSchema: z.ZodObject<{
                 sanitized_content_hash_sha256: z.ZodOptional<z.ZodString>;
                 original_byte_size: z.ZodOptional<z.ZodNumber>;
                 sanitized_byte_size: z.ZodOptional<z.ZodNumber>;
+                applied_at: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>>;
         }, z.core.$strict>;
         chunk_size_bytes: z.ZodNumber;
@@ -386,6 +389,7 @@ export declare const RawEvidenceUploadCommitResponseSchema: z.ZodObject<{
         sanitized_content_hash_sha256: z.ZodOptional<z.ZodString>;
         original_byte_size: z.ZodOptional<z.ZodNumber>;
         sanitized_byte_size: z.ZodOptional<z.ZodNumber>;
+        applied_at: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export type RawEvidenceUploadCommitResponse = z.infer<typeof RawEvidenceUploadCommitResponseSchema>;

package/dist/ingest-dto.d.ts

@@ -316,6 +316,7 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
             sanitized_content_hash_sha256: z.ZodOptional<z.ZodString>;
             original_byte_size: z.ZodOptional<z.ZodNumber>;
             sanitized_byte_size: z.ZodOptional<z.ZodNumber>;
+            applied_at: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
     }, z.core.$strict>>>;
     otel: z.ZodOptional<z.ZodObject<{
@@ -792,6 +793,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
                 sanitized_content_hash_sha256: z.ZodOptional<z.ZodString>;
                 original_byte_size: z.ZodOptional<z.ZodNumber>;
                 sanitized_byte_size: z.ZodOptional<z.ZodNumber>;
+                applied_at: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>>;
         }, z.core.$strict>>>;
         otel: z.ZodOptional<z.ZodObject<{
@@ -945,6 +947,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
                     sanitized_content_hash_sha256: z.ZodOptional<z.ZodString>;
                     original_byte_size: z.ZodOptional<z.ZodNumber>;
                     sanitized_byte_size: z.ZodOptional<z.ZodNumber>;
+                    applied_at: z.ZodOptional<z.ZodString>;
                 }, z.core.$strict>>;
             }, z.core.$strict>>>;
         }, z.core.$strict>>>;

package/dist/privacy.d.ts

@@ -94,6 +94,7 @@ export declare const RawEvidencePointerSchema: z.ZodObject<{
         sanitized_content_hash_sha256: z.ZodOptional<z.ZodString>;
         original_byte_size: z.ZodOptional<z.ZodNumber>;
         sanitized_byte_size: z.ZodOptional<z.ZodNumber>;
+        applied_at: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export type RawEvidencePointer = z.infer<typeof RawEvidencePointerSchema>;

package/dist/secret-guards.d.ts

@@ -86,8 +86,35 @@ export declare const RawEvidenceRedactionMetadataSchema: z.ZodObject<{
     sanitized_content_hash_sha256: z.ZodOptional<z.ZodString>;
     original_byte_size: z.ZodOptional<z.ZodNumber>;
     sanitized_byte_size: z.ZodOptional<z.ZodNumber>;
+    applied_at: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type RawEvidenceRedactionMetadata = z.infer<typeof RawEvidenceRedactionMetadataSchema>;
+/**
+ * The receipt for a file the scan cleared (BLI-3277, moved here by BLI-3280).
+ *
+ * Same schema, same `mode` — the deterministic ruleset is what ran — with the
+ * verdict `scanned_clean` and zero of everything else. The content fields are
+ * the point: an evidence ref is only readable downstream when its redaction
+ * record hashes the bytes that are actually in the bucket, and for a clean file
+ * those are the original bytes, so both halves carry the same digest and size.
+ *
+ * It lives in telemetry-core rather than in the collector because two callers
+ * now build this exact record and they must never drift: the collector writes
+ * it at upload time, and the BLI-3280 operator backfill writes it onto refs
+ * that were stored before the receipt existed. Both must satisfy the same
+ * `sanitized_content_hash_sha256 === content_hash_sha256` /
+ * `sanitized_byte_size === byte_size` equality the digest reader checks, and a
+ * second copy of this function is a second chance to get that wrong.
+ *
+ * `appliedBy` is who ran the scan, and it is not decoration: a backfill passes
+ * `legacy_upload` so a reader can tell "the collector scanned this before it
+ * uploaded" apart from "an operator scanned the stored bytes afterwards".
+ */
+export declare function scannedCleanRedactionMetadata(bytes: Uint8Array, options?: {
+    appliedBy?: RawEvidenceRedactionSource;
+    /** ISO-8601 with offset. Omitted entirely when absent (BLI-3290). */
+    appliedAt?: string;
+}): RawEvidenceRedactionMetadata;
 export interface SecretRedactionResult {
     redacted: boolean;
     text: string;

package/dist/secret-guards.js

@@ -1,4 +1,6 @@
+import { createHash } from "node:crypto";
 import { z } from "zod";
+import { IsoDateTimeSchema } from "./common.js";
 /**
  * Secret-like content + file-name guards shared by the local collector
  * (attribution, collection) and the dashboard commit-time guard. Keeping a
@@ -181,6 +183,17 @@ export const RawEvidenceRedactionMetadataSchema = z
     sanitized_content_hash_sha256: z.string().regex(/^[a-f0-9]{64}$/).optional(),
     original_byte_size: z.number().int().nonnegative().optional(),
     sanitized_byte_size: z.number().int().nonnegative().optional(),
+    /**
+     * When the scan ran, ISO-8601 with an offset (BLI-3290).
+     *
+     * Optional, and it stays optional: every receipt written before this field
+     * existed is still valid, and the collector does not stamp it — at upload
+     * time the ref's own `received_at` already answers "when". It exists for
+     * receipts written over bytes that were stored long ago, where the ref's
+     * timestamps describe the ORIGINAL upload and nothing in the record would
+     * otherwise say when an operator re-scanned or re-masked the object.
+     */
+    applied_at: IsoDateTimeSchema.optional(),
 })
     .strict()
     // The per-status invariants the old `z.literal("sanitized")` + `.min(1)` +
@@ -253,6 +266,45 @@ export const RawEvidenceRedactionMetadataSchema = z
         });
     }
 });
+/**
+ * The receipt for a file the scan cleared (BLI-3277, moved here by BLI-3280).
+ *
+ * Same schema, same `mode` — the deterministic ruleset is what ran — with the
+ * verdict `scanned_clean` and zero of everything else. The content fields are
+ * the point: an evidence ref is only readable downstream when its redaction
+ * record hashes the bytes that are actually in the bucket, and for a clean file
+ * those are the original bytes, so both halves carry the same digest and size.
+ *
+ * It lives in telemetry-core rather than in the collector because two callers
+ * now build this exact record and they must never drift: the collector writes
+ * it at upload time, and the BLI-3280 operator backfill writes it onto refs
+ * that were stored before the receipt existed. Both must satisfy the same
+ * `sanitized_content_hash_sha256 === content_hash_sha256` /
+ * `sanitized_byte_size === byte_size` equality the digest reader checks, and a
+ * second copy of this function is a second chance to get that wrong.
+ *
+ * `appliedBy` is who ran the scan, and it is not decoration: a backfill passes
+ * `legacy_upload` so a reader can tell "the collector scanned this before it
+ * uploaded" apart from "an operator scanned the stored bytes afterwards".
+ */
+export function scannedCleanRedactionMetadata(bytes, options = {}) {
+    const digest = createHash("sha256").update(bytes).digest("hex");
+    return {
+        schema_version: "raw-evidence-redaction.v1",
+        status: "scanned_clean",
+        mode: "deterministic_text_replacement",
+        applied_by: [options.appliedBy ?? "local_collector"],
+        rule_counts: [],
+        secret_like_match_count: 0,
+        redacted_fields: [],
+        redacted_ranges: [],
+        original_content_hash_sha256: digest,
+        sanitized_content_hash_sha256: digest,
+        original_byte_size: bytes.byteLength,
+        sanitized_byte_size: bytes.byteLength,
+        ...(options.appliedAt === undefined ? {} : { applied_at: options.appliedAt }),
+    };
+}
 // Same fence as the detector (BLI-3116) — the two must agree or a prefixed
 // name would be detected and then left unredacted, which costs whole sessions
 // (see findSecretRedactionMatches).

package/dist/source-adapter.d.ts

@@ -102,6 +102,7 @@ export declare const SourceScanEventSummarySchema: z.ZodObject<{
             sanitized_content_hash_sha256: z.ZodOptional<z.ZodString>;
             original_byte_size: z.ZodOptional<z.ZodNumber>;
             sanitized_byte_size: z.ZodOptional<z.ZodNumber>;
+            applied_at: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
     }, z.core.$strict>>>;
 }, z.core.$strict>;
@@ -219,6 +220,7 @@ export declare const SourceScanResultSchema: z.ZodObject<{
                 sanitized_content_hash_sha256: z.ZodOptional<z.ZodString>;
                 original_byte_size: z.ZodOptional<z.ZodNumber>;
                 sanitized_byte_size: z.ZodOptional<z.ZodNumber>;
+                applied_at: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>>;
         }, z.core.$strict>>>;
     }, z.core.$strict>>>;

package/dist/upload-failure-class.js

@@ -149,6 +149,17 @@ const UPLOAD_FAILURE_CLASSES = {
     // The file itself is the problem, and it will be the same size and the same
     // shape on the next pass. Retrying is a promise nobody can keep.
     file_too_large: "deterministic",
+    // A declared image above IMAGE_EVIDENCE_MAX_VALIDATION_BYTES (BLI-3067). The
+    // commit route deliberately KEEPS the staged chunks for these so that raising
+    // the bound turns the identical row into a commit that works — and
+    // `docs/runbooks/cockpit-stuck-evidence-uploads.md` has always documented it
+    // as deterministic. The entry was missing here, so it classified `unknown`,
+    // `isPermanentUploadFailure` answered false, and `begin`'s terminal-failure
+    // guard fell through to the reset that deletes those very chunk receipts —
+    // destroying the retained staging on the next sync and re-uploading the same
+    // oversized image forever. That is the BLI-2528 loop reappearing inside the
+    // code written to end it (BLI-3408).
+    image_too_large_to_validate: "deterministic",
     // Storage looked at the finished object and said no. The bytes are already
     // final and content-addressed, so the next attempt presents the identical
     // object to the identical rule (BLI-2528). Retrying these is what let 76

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/telemetry-core",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",