@bli-cockpit/telemetry-core 0.1.3 → 0.1.5

package/dist/agent-artifacts.d.ts

@@ -0,0 +1,224 @@
+import { z } from "zod";
+export declare const AGENT_IMAGE_ARTIFACT_MAX_FILE_BYTES: number;
+export declare const AGENT_IMAGE_ARTIFACT_MAX_REPORT_ITEMS = 100;
+export declare const AgentArtifactSourceSchema: z.ZodEnum<{
+    codex: "codex";
+    claude_code: "claude_code";
+}>;
+export type AgentArtifactSource = z.infer<typeof AgentArtifactSourceSchema>;
+export declare const AgentArtifactKindSchema: z.ZodEnum<{
+    screenshot: "screenshot";
+    image_attachment: "image_attachment";
+}>;
+export type AgentArtifactKind = z.infer<typeof AgentArtifactKindSchema>;
+export declare const AgentArtifactCaptureOriginSchema: z.ZodEnum<{
+    agent_session_attachment: "agent_session_attachment";
+}>;
+export type AgentArtifactCaptureOrigin = z.infer<typeof AgentArtifactCaptureOriginSchema>;
+export declare const AgentArtifactRedactionStatusSchema: z.ZodEnum<{
+    not_started: "not_started";
+    pending: "pending";
+    redacted: "redacted";
+    safe_for_metadata: "safe_for_metadata";
+    blocked: "blocked";
+}>;
+export type AgentArtifactRedactionStatus = z.infer<typeof AgentArtifactRedactionStatusSchema>;
+export declare const AgentArtifactOcrStatusSchema: z.ZodEnum<{
+    not_started: "not_started";
+    pending: "pending";
+    completed: "completed";
+    failed: "failed";
+    skipped: "skipped";
+}>;
+export type AgentArtifactOcrStatus = z.infer<typeof AgentArtifactOcrStatusSchema>;
+export declare const AgentImageArtifactMediaTypeSchema: z.ZodEnum<{
+    "image/png": "image/png";
+    "image/jpeg": "image/jpeg";
+}>;
+export type AgentImageArtifactMediaType = z.infer<typeof AgentImageArtifactMediaTypeSchema>;
+export declare const AgentImageArtifactStorageBucketSchema: z.ZodLiteral<"ambient-raw-evidence">;
+export type AgentImageArtifactStorageBucket = z.infer<typeof AgentImageArtifactStorageBucketSchema>;
+export declare const AgentImageArtifactStorageMetadataSchema: z.ZodObject<{
+    storage_bucket: z.ZodLiteral<"ambient-raw-evidence">;
+    object_key: z.ZodString;
+    content_hash_sha256: z.ZodString;
+    byte_size: z.ZodNumber;
+    media_type: z.ZodEnum<{
+        "image/png": "image/png";
+        "image/jpeg": "image/jpeg";
+    }>;
+    width: z.ZodOptional<z.ZodNumber>;
+    height: z.ZodOptional<z.ZodNumber>;
+    perceptual_hash: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type AgentImageArtifactStorageMetadata = z.infer<typeof AgentImageArtifactStorageMetadataSchema>;
+export declare const AgentImageArtifactBindingSchema: z.ZodObject<{
+    operator_user_id: z.ZodOptional<z.ZodString>;
+    team_id: z.ZodOptional<z.ZodString>;
+    work_session_id: z.ZodOptional<z.ZodString>;
+    task_id: z.ZodOptional<z.ZodString>;
+    ticket_id: z.ZodOptional<z.ZodString>;
+    repo_fingerprint: z.ZodOptional<z.ZodString>;
+    worktree_fingerprint: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type AgentImageArtifactBinding = z.infer<typeof AgentImageArtifactBindingSchema>;
+export declare const AgentImageArtifactSchema: z.ZodObject<{
+    storage_bucket: z.ZodLiteral<"ambient-raw-evidence">;
+    object_key: z.ZodString;
+    content_hash_sha256: z.ZodString;
+    byte_size: z.ZodNumber;
+    media_type: z.ZodEnum<{
+        "image/png": "image/png";
+        "image/jpeg": "image/jpeg";
+    }>;
+    width: z.ZodOptional<z.ZodNumber>;
+    height: z.ZodOptional<z.ZodNumber>;
+    perceptual_hash: z.ZodOptional<z.ZodString>;
+    operator_user_id: z.ZodOptional<z.ZodString>;
+    team_id: z.ZodOptional<z.ZodString>;
+    work_session_id: z.ZodOptional<z.ZodString>;
+    task_id: z.ZodOptional<z.ZodString>;
+    ticket_id: z.ZodOptional<z.ZodString>;
+    repo_fingerprint: z.ZodOptional<z.ZodString>;
+    worktree_fingerprint: z.ZodOptional<z.ZodString>;
+    artifact_id: z.ZodOptional<z.ZodString>;
+    raw_evidence_pointer_id: z.ZodString;
+    agent_source: z.ZodEnum<{
+        codex: "codex";
+        claude_code: "claude_code";
+    }>;
+    source_session_id: z.ZodString;
+    source_message_id: z.ZodOptional<z.ZodString>;
+    turn_index: z.ZodOptional<z.ZodNumber>;
+    occurred_at: z.ZodString;
+    artifact_kind: z.ZodDefault<z.ZodEnum<{
+        screenshot: "screenshot";
+        image_attachment: "image_attachment";
+    }>>;
+    capture_origin: z.ZodDefault<z.ZodEnum<{
+        agent_session_attachment: "agent_session_attachment";
+    }>>;
+    redaction_status: z.ZodDefault<z.ZodEnum<{
+        not_started: "not_started";
+        pending: "pending";
+        redacted: "redacted";
+        safe_for_metadata: "safe_for_metadata";
+        blocked: "blocked";
+    }>>;
+    ocr_status: z.ZodDefault<z.ZodEnum<{
+        not_started: "not_started";
+        pending: "pending";
+        completed: "completed";
+        failed: "failed";
+        skipped: "skipped";
+    }>>;
+    ocr_text_redacted: z.ZodOptional<z.ZodString>;
+    labels: z.ZodDefault<z.ZodObject<{
+        attachment_role: z.ZodOptional<z.ZodString>;
+        collector_upload_state: z.ZodOptional<z.ZodEnum<{
+            uploaded: "uploaded";
+            reused_existing: "reused_existing";
+        }>>;
+        source_sidecar_id: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type AgentImageArtifact = z.infer<typeof AgentImageArtifactSchema>;
+export declare const AgentImageArtifactReportRequestSchema: z.ZodObject<{
+    schema_version: z.ZodLiteral<"ambient-agent-image-artifacts.v1">;
+    generated_at: z.ZodString;
+    provenance: z.ZodObject<{
+        capture_source: z.ZodEnum<{
+            unknown: "unknown";
+            codex_jsonl: "codex_jsonl";
+            codex_otel: "codex_otel";
+            car_state: "car_state";
+            git_state: "git_state";
+            github_state: "github_state";
+            linear_state: "linear_state";
+            mcp_local: "mcp_local";
+            claude_jsonl: "claude_jsonl";
+            claude_hooks: "claude_hooks";
+            manual_event: "manual_event";
+            collector_runtime: "collector_runtime";
+        }>;
+        capture_adapter_version: z.ZodString;
+        collector_version: z.ZodString;
+        repo: z.ZodString;
+        branch: z.ZodString;
+        repo_label: z.ZodOptional<z.ZodString>;
+        repo_fingerprint: z.ZodOptional<z.ZodString>;
+        repo_origin_url: z.ZodOptional<z.ZodString>;
+        worktree_label: z.ZodOptional<z.ZodString>;
+        worktree_fingerprint: z.ZodOptional<z.ZodString>;
+        worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
+        operator_id: z.ZodString;
+        session_id: z.ZodString;
+        work_context_id: z.ZodString;
+    }, z.core.$strict>;
+    artifacts: z.ZodArray<z.ZodObject<{
+        storage_bucket: z.ZodLiteral<"ambient-raw-evidence">;
+        object_key: z.ZodString;
+        content_hash_sha256: z.ZodString;
+        byte_size: z.ZodNumber;
+        media_type: z.ZodEnum<{
+            "image/png": "image/png";
+            "image/jpeg": "image/jpeg";
+        }>;
+        width: z.ZodOptional<z.ZodNumber>;
+        height: z.ZodOptional<z.ZodNumber>;
+        perceptual_hash: z.ZodOptional<z.ZodString>;
+        operator_user_id: z.ZodOptional<z.ZodString>;
+        team_id: z.ZodOptional<z.ZodString>;
+        work_session_id: z.ZodOptional<z.ZodString>;
+        task_id: z.ZodOptional<z.ZodString>;
+        ticket_id: z.ZodOptional<z.ZodString>;
+        repo_fingerprint: z.ZodOptional<z.ZodString>;
+        worktree_fingerprint: z.ZodOptional<z.ZodString>;
+        artifact_id: z.ZodOptional<z.ZodString>;
+        raw_evidence_pointer_id: z.ZodString;
+        agent_source: z.ZodEnum<{
+            codex: "codex";
+            claude_code: "claude_code";
+        }>;
+        source_session_id: z.ZodString;
+        source_message_id: z.ZodOptional<z.ZodString>;
+        turn_index: z.ZodOptional<z.ZodNumber>;
+        occurred_at: z.ZodString;
+        artifact_kind: z.ZodDefault<z.ZodEnum<{
+            screenshot: "screenshot";
+            image_attachment: "image_attachment";
+        }>>;
+        capture_origin: z.ZodDefault<z.ZodEnum<{
+            agent_session_attachment: "agent_session_attachment";
+        }>>;
+        redaction_status: z.ZodDefault<z.ZodEnum<{
+            not_started: "not_started";
+            pending: "pending";
+            redacted: "redacted";
+            safe_for_metadata: "safe_for_metadata";
+            blocked: "blocked";
+        }>>;
+        ocr_status: z.ZodDefault<z.ZodEnum<{
+            not_started: "not_started";
+            pending: "pending";
+            completed: "completed";
+            failed: "failed";
+            skipped: "skipped";
+        }>>;
+        ocr_text_redacted: z.ZodOptional<z.ZodString>;
+        labels: z.ZodDefault<z.ZodObject<{
+            attachment_role: z.ZodOptional<z.ZodString>;
+            collector_upload_state: z.ZodOptional<z.ZodEnum<{
+                uploaded: "uploaded";
+                reused_existing: "reused_existing";
+            }>>;
+            source_sidecar_id: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type AgentImageArtifactReportRequest = z.infer<typeof AgentImageArtifactReportRequestSchema>;
+export declare const AgentImageArtifactReportResponseSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    recorded_count: z.ZodNumber;
+}, z.core.$strict>;
+export type AgentImageArtifactReportResponse = z.infer<typeof AgentImageArtifactReportResponseSchema>;

package/dist/agent-artifacts.js

@@ -0,0 +1,141 @@
+import { z } from "zod";
+import { CaptureProvenanceSchema, IsoDateTimeSchema, NonEmptyStringSchema, Sha256Schema, } from "./common.js";
+export const AGENT_IMAGE_ARTIFACT_MAX_FILE_BYTES = 10 * 1024 * 1024;
+export const AGENT_IMAGE_ARTIFACT_MAX_REPORT_ITEMS = 100;
+const UuidSchema = z.string().uuid();
+export const AgentArtifactSourceSchema = z.enum(["codex", "claude_code"]);
+export const AgentArtifactKindSchema = z.enum([
+    "screenshot",
+    "image_attachment",
+]);
+export const AgentArtifactCaptureOriginSchema = z.enum([
+    "agent_session_attachment",
+]);
+export const AgentArtifactRedactionStatusSchema = z.enum([
+    "not_started",
+    "pending",
+    "redacted",
+    "safe_for_metadata",
+    "blocked",
+]);
+export const AgentArtifactOcrStatusSchema = z.enum([
+    "not_started",
+    "pending",
+    "completed",
+    "failed",
+    "skipped",
+]);
+export const AgentImageArtifactMediaTypeSchema = z.enum([
+    "image/png",
+    "image/jpeg",
+]);
+export const AgentImageArtifactStorageBucketSchema = z.literal("ambient-raw-evidence");
+const AgentImageArtifactLabelsSchema = z
+    .object({
+    attachment_role: NonEmptyStringSchema.max(160).optional(),
+    collector_upload_state: z
+        .enum(["uploaded", "reused_existing"])
+        .optional(),
+    source_sidecar_id: NonEmptyStringSchema.max(160).optional(),
+})
+    .strict();
+const AgentImageArtifactStorageMetadataShape = {
+    storage_bucket: AgentImageArtifactStorageBucketSchema,
+    object_key: NonEmptyStringSchema,
+    content_hash_sha256: Sha256Schema,
+    byte_size: z
+        .number()
+        .int()
+        .positive()
+        .max(AGENT_IMAGE_ARTIFACT_MAX_FILE_BYTES),
+    media_type: AgentImageArtifactMediaTypeSchema,
+    width: z.number().int().positive().optional(),
+    height: z.number().int().positive().optional(),
+    perceptual_hash: NonEmptyStringSchema.optional(),
+};
+export const AgentImageArtifactStorageMetadataSchema = z
+    .object(AgentImageArtifactStorageMetadataShape)
+    .strict()
+    .superRefine((metadata, context) => {
+    if ((metadata.width === undefined && metadata.height !== undefined) ||
+        (metadata.width !== undefined && metadata.height === undefined)) {
+        context.addIssue({
+            code: "custom",
+            message: "image dimensions must include both width and height",
+            path: metadata.width === undefined ? ["width"] : ["height"],
+        });
+    }
+});
+const AgentImageArtifactBindingShape = {
+    operator_user_id: UuidSchema.optional(),
+    team_id: UuidSchema.optional(),
+    work_session_id: UuidSchema.optional(),
+    task_id: UuidSchema.optional(),
+    ticket_id: NonEmptyStringSchema.max(80).optional(),
+    repo_fingerprint: NonEmptyStringSchema.max(160).optional(),
+    worktree_fingerprint: NonEmptyStringSchema.max(160).optional(),
+};
+export const AgentImageArtifactBindingSchema = z
+    .object(AgentImageArtifactBindingShape)
+    .strict();
+export const AgentImageArtifactSchema = z
+    .object({
+    artifact_id: UuidSchema.optional(),
+    raw_evidence_pointer_id: NonEmptyStringSchema,
+    agent_source: AgentArtifactSourceSchema,
+    source_session_id: NonEmptyStringSchema.max(160),
+    source_message_id: NonEmptyStringSchema.max(240).optional(),
+    turn_index: z.number().int().nonnegative().optional(),
+    occurred_at: IsoDateTimeSchema,
+    artifact_kind: AgentArtifactKindSchema.default("image_attachment"),
+    capture_origin: AgentArtifactCaptureOriginSchema.default("agent_session_attachment"),
+    redaction_status: AgentArtifactRedactionStatusSchema.default("not_started"),
+    ocr_status: AgentArtifactOcrStatusSchema.default("not_started"),
+    ocr_text_redacted: z.string().trim().min(1).max(50000).optional(),
+    labels: AgentImageArtifactLabelsSchema.default({}),
+    ...AgentImageArtifactBindingShape,
+    ...AgentImageArtifactStorageMetadataShape,
+})
+    .strict()
+    .superRefine((artifact, context) => {
+    if ((artifact.width === undefined && artifact.height !== undefined) ||
+        (artifact.width !== undefined && artifact.height === undefined)) {
+        context.addIssue({
+            code: "custom",
+            message: "image dimensions must include both width and height",
+            path: artifact.width === undefined ? ["width"] : ["height"],
+        });
+    }
+    if (artifact.ocr_text_redacted && artifact.ocr_status !== "completed") {
+        context.addIssue({
+            code: "custom",
+            message: "redacted OCR text requires completed OCR status",
+            path: ["ocr_status"],
+        });
+    }
+    if (artifact.ocr_text_redacted &&
+        !["redacted", "safe_for_metadata"].includes(artifact.redaction_status)) {
+        context.addIssue({
+            code: "custom",
+            message: "redacted OCR text requires redacted metadata status",
+            path: ["redaction_status"],
+        });
+    }
+});
+export const AgentImageArtifactReportRequestSchema = z
+    .object({
+    schema_version: z.literal("ambient-agent-image-artifacts.v1"),
+    generated_at: IsoDateTimeSchema,
+    provenance: CaptureProvenanceSchema,
+    artifacts: z
+        .array(AgentImageArtifactSchema)
+        .min(1)
+        .max(AGENT_IMAGE_ARTIFACT_MAX_REPORT_ITEMS),
+})
+    .strict();
+export const AgentImageArtifactReportResponseSchema = z
+    .object({
+    ok: z.literal(true),
+    recorded_count: z.number().int().nonnegative(),
+})
+    .strict();

package/dist/common.d.ts

@@ -15,6 +15,7 @@ export declare const CaptureSourceSchema: z.ZodEnum<{
     github_state: "github_state";
     linear_state: "linear_state";
     mcp_local: "mcp_local";
+    claude_jsonl: "claude_jsonl";
     claude_hooks: "claude_hooks";
     manual_event: "manual_event";
     collector_runtime: "collector_runtime";
@@ -30,6 +31,7 @@ export declare const CaptureProvenanceSchema: z.ZodObject<{
         github_state: "github_state";
         linear_state: "linear_state";
         mcp_local: "mcp_local";
+        claude_jsonl: "claude_jsonl";
         claude_hooks: "claude_hooks";
         manual_event: "manual_event";
         collector_runtime: "collector_runtime";

package/dist/common.js

@@ -22,6 +22,7 @@ export const CaptureSourceSchema = z.enum([
     "github_state",
     "linear_state",
     "mcp_local",
+    "claude_jsonl",
     "claude_hooks",
     "manual_event",
     "collector_runtime",

package/dist/evidence-upload.d.ts

@@ -64,6 +64,7 @@ export declare const RawEvidenceUploadBeginRequestSchema: z.ZodObject<{
             github_state: "github_state";
             linear_state: "linear_state";
             mcp_local: "mcp_local";
+            claude_jsonl: "claude_jsonl";
             claude_hooks: "claude_hooks";
             manual_event: "manual_event";
             collector_runtime: "collector_runtime";
@@ -172,6 +173,7 @@ export declare const RawEvidenceUploadChunkRequestSchema: z.ZodObject<{
             github_state: "github_state";
             linear_state: "linear_state";
             mcp_local: "mcp_local";
+            claude_jsonl: "claude_jsonl";
             claude_hooks: "claude_hooks";
             manual_event: "manual_event";
             collector_runtime: "collector_runtime";
@@ -218,6 +220,7 @@ export declare const RawEvidenceUploadCommitRequestSchema: z.ZodObject<{
             github_state: "github_state";
             linear_state: "linear_state";
             mcp_local: "mcp_local";
+            claude_jsonl: "claude_jsonl";
             claude_hooks: "claude_hooks";
             manual_event: "manual_event";
             collector_runtime: "collector_runtime";
@@ -262,10 +265,10 @@ export type RawEvidenceUploadCommitResponse = z.infer<typeof RawEvidenceUploadCo
  * pack or silently dropped. No content-bearing fields are allowed.
  */
 export declare const CodexSessionAttributionStateSchema: z.ZodEnum<{
+    skipped: "skipped";
     attributed: "attributed";
     ambiguous: "ambiguous";
     unattributed: "unattributed";
-    skipped: "skipped";
 }>;
 export type CodexSessionAttributionState = z.infer<typeof CodexSessionAttributionStateSchema>;
 export declare const CodexSessionUploadStateSchema: z.ZodEnum<{
@@ -275,14 +278,29 @@ export declare const CodexSessionUploadStateSchema: z.ZodEnum<{
     not_uploaded: "not_uploaded";
 }>;
 export type CodexSessionUploadState = z.infer<typeof CodexSessionUploadStateSchema>;
+/**
+ * The agent that produced a session transcript. `codex_session_id` keeps its
+ * historical name across sources; `source` disambiguates. Defaulting to
+ * `"codex"` keeps already-published CLI versions (which never send the field)
+ * working unchanged after this schema lands.
+ */
+export declare const AgentSessionSourceSchema: z.ZodDefault<z.ZodEnum<{
+    codex: "codex";
+    claude_code: "claude_code";
+}>>;
+export type AgentSessionSource = z.infer<typeof AgentSessionSourceSchema>;
 export declare const CodexSessionAttributionSchema: z.ZodObject<{
     codex_session_id: z.ZodString;
+    source: z.ZodDefault<z.ZodEnum<{
+        codex: "codex";
+        claude_code: "claude_code";
+    }>>;
     observed_at: z.ZodString;
     attribution_state: z.ZodEnum<{
+        skipped: "skipped";
         attributed: "attributed";
         ambiguous: "ambiguous";
         unattributed: "unattributed";
-        skipped: "skipped";
     }>;
     attribution_reason: z.ZodString;
     attribution_score: z.ZodOptional<z.ZodNumber>;
@@ -319,6 +337,7 @@ export declare const CodexSessionAttributionReportRequestSchema: z.ZodObject<{
             github_state: "github_state";
             linear_state: "linear_state";
             mcp_local: "mcp_local";
+            claude_jsonl: "claude_jsonl";
             claude_hooks: "claude_hooks";
             manual_event: "manual_event";
             collector_runtime: "collector_runtime";
@@ -339,12 +358,16 @@ export declare const CodexSessionAttributionReportRequestSchema: z.ZodObject<{
     }, z.core.$strict>;
     sessions: z.ZodArray<z.ZodObject<{
         codex_session_id: z.ZodString;
+        source: z.ZodDefault<z.ZodEnum<{
+            codex: "codex";
+            claude_code: "claude_code";
+        }>>;
         observed_at: z.ZodString;
         attribution_state: z.ZodEnum<{
+            skipped: "skipped";
             attributed: "attributed";
             ambiguous: "ambiguous";
             unattributed: "unattributed";
-            skipped: "skipped";
         }>;
         attribution_reason: z.ZodString;
         attribution_score: z.ZodOptional<z.ZodNumber>;

package/dist/evidence-upload.js

@@ -140,9 +140,19 @@ export const CodexSessionUploadStateSchema = z.enum([
     "upload_failed",
     "not_uploaded",
 ]);
+/**
+ * The agent that produced a session transcript. `codex_session_id` keeps its
+ * historical name across sources; `source` disambiguates. Defaulting to
+ * `"codex"` keeps already-published CLI versions (which never send the field)
+ * working unchanged after this schema lands.
+ */
+export const AgentSessionSourceSchema = z
+    .enum(["codex", "claude_code"])
+    .default("codex");
 export const CodexSessionAttributionSchema = z
     .object({
     codex_session_id: NonEmptyStringSchema.max(120),
+    source: AgentSessionSourceSchema,
     observed_at: IsoDateTimeSchema,
     attribution_state: CodexSessionAttributionStateSchema,
     attribution_reason: SafeLabelSchema,

package/dist/index.d.ts

@@ -1,3 +1,4 @@
+export * from "./agent-artifacts.js";
 export * from "./common.js";
 export * from "./evidence-upload.js";
 export * from "./ingest-dto.js";

package/dist/index.js

@@ -1,3 +1,4 @@
+export * from "./agent-artifacts.js";
 export * from "./common.js";
 export * from "./evidence-upload.js";
 export * from "./ingest-dto.js";

package/dist/ingest-dto.d.ts

@@ -39,6 +39,7 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
             github_state: "github_state";
             linear_state: "linear_state";
             mcp_local: "mcp_local";
+            claude_jsonl: "claude_jsonl";
             claude_hooks: "claude_hooks";
             manual_event: "manual_event";
             collector_runtime: "collector_runtime";
@@ -73,8 +74,8 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
             remote_durable_raw_evidence: "remote_durable_raw_evidence";
         }>;
         redaction_status: z.ZodEnum<{
-            metadata_only: "metadata_only";
             redacted: "redacted";
+            metadata_only: "metadata_only";
             raw_local_only: "raw_local_only";
             raw_remote_short_retention: "raw_remote_short_retention";
             raw_remote_durable: "raw_remote_durable";
@@ -154,6 +155,7 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
                 github_state: "github_state";
                 linear_state: "linear_state";
                 mcp_local: "mcp_local";
+                claude_jsonl: "claude_jsonl";
                 claude_hooks: "claude_hooks";
                 manual_event: "manual_event";
                 collector_runtime: "collector_runtime";
@@ -314,6 +316,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
                 github_state: "github_state";
                 linear_state: "linear_state";
                 mcp_local: "mcp_local";
+                claude_jsonl: "claude_jsonl";
                 claude_hooks: "claude_hooks";
                 manual_event: "manual_event";
                 collector_runtime: "collector_runtime";
@@ -359,6 +362,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
                 github_state: "github_state";
                 linear_state: "linear_state";
                 mcp_local: "mcp_local";
+                claude_jsonl: "claude_jsonl";
                 claude_hooks: "claude_hooks";
                 manual_event: "manual_event";
                 collector_runtime: "collector_runtime";
@@ -393,8 +397,8 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
                 remote_durable_raw_evidence: "remote_durable_raw_evidence";
             }>;
             redaction_status: z.ZodEnum<{
-                metadata_only: "metadata_only";
                 redacted: "redacted";
+                metadata_only: "metadata_only";
                 raw_local_only: "raw_local_only";
                 raw_remote_short_retention: "raw_remote_short_retention";
                 raw_remote_durable: "raw_remote_durable";
@@ -474,6 +478,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
                     github_state: "github_state";
                     linear_state: "linear_state";
                     mcp_local: "mcp_local";
+                    claude_jsonl: "claude_jsonl";
                     claude_hooks: "claude_hooks";
                     manual_event: "manual_event";
                     collector_runtime: "collector_runtime";
@@ -575,6 +580,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
                 github_state: "github_state";
                 linear_state: "linear_state";
                 mcp_local: "mcp_local";
+                claude_jsonl: "claude_jsonl";
                 claude_hooks: "claude_hooks";
                 manual_event: "manual_event";
                 collector_runtime: "collector_runtime";
@@ -584,10 +590,10 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
         }, z.core.$strict>;
         work_context_id: z.ZodOptional<z.ZodString>;
         status: z.ZodEnum<{
-            ok: "ok";
+            failed: "failed";
             skipped: "skipped";
+            ok: "ok";
             partial: "partial";
-            failed: "failed";
         }>;
         started_at: z.ZodString;
         finished_at: z.ZodOptional<z.ZodString>;
@@ -605,8 +611,8 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
                     remote_durable_raw_evidence: "remote_durable_raw_evidence";
                 }>;
                 redaction_status: z.ZodEnum<{
-                    metadata_only: "metadata_only";
                     redacted: "redacted";
+                    metadata_only: "metadata_only";
                     raw_local_only: "raw_local_only";
                     raw_remote_short_retention: "raw_remote_short_retention";
                     raw_remote_durable: "raw_remote_durable";
@@ -717,6 +723,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
                     github_state: "github_state";
                     linear_state: "linear_state";
                     mcp_local: "mcp_local";
+                    claude_jsonl: "claude_jsonl";
                     claude_hooks: "claude_hooks";
                     manual_event: "manual_event";
                     collector_runtime: "collector_runtime";

package/dist/local-config.d.ts

@@ -14,6 +14,7 @@ export declare const LocalCollectorConfigSchema: z.ZodObject<{
         remote_short_retention_opt_in: "remote_short_retention_opt_in";
         remote_durable_opt_in: "remote_durable_opt_in";
     }>>;
+    collect_claude_jsonl: z.ZodDefault<z.ZodBoolean>;
     session_file_path: z.ZodOptional<z.ZodString>;
     state_dir_path: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;

package/dist/local-config.js

@@ -18,6 +18,10 @@ export const LocalCollectorConfigSchema = z
         "remote_durable_opt_in",
     ])
         .default("remote_durable_opt_in"),
+    // Per-machine escape hatch (D31): promoting the CLI to `latest` enables
+    // Claude transcript harvesting fleet-wide, so an operator can opt a single
+    // machine out without a version pin. Defaults on.
+    collect_claude_jsonl: z.boolean().default(true),
     session_file_path: NonEmptyStringSchema.optional(),
     state_dir_path: NonEmptyStringSchema.optional(),
 })

package/dist/privacy.d.ts

@@ -77,8 +77,8 @@ export declare const RedactionMetadataSchema: z.ZodObject<{
         remote_durable_raw_evidence: "remote_durable_raw_evidence";
     }>;
     redaction_status: z.ZodEnum<{
-        metadata_only: "metadata_only";
         redacted: "redacted";
+        metadata_only: "metadata_only";
         raw_local_only: "raw_local_only";
         raw_remote_short_retention: "raw_remote_short_retention";
         raw_remote_durable: "raw_remote_durable";

package/dist/risk-flags.d.ts

@@ -86,6 +86,7 @@ export declare const RiskFlagSchema: z.ZodObject<{
             github_state: "github_state";
             linear_state: "linear_state";
             mcp_local: "mcp_local";
+            claude_jsonl: "claude_jsonl";
             claude_hooks: "claude_hooks";
             manual_event: "manual_event";
             collector_runtime: "collector_runtime";

package/dist/secret-guards.d.ts

@@ -1 +1,26 @@
+/**
+ * Secret-like content + file-name guards shared by the local collector
+ * (attribution, collection) and the dashboard commit-time guard. Keeping a
+ * single home means the client and server agree on exactly which transcripts
+ * are skipped.
+ *
+ * D13 precision: prose-shaped credential NAMES (SERVICE_ROLE, SUPABASE_ANON_KEY,
+ * LANGFUSE_*_KEY, api_key, ...) only trip the content guard when they carry an
+ * assignment + a value. A bare keyword in source code, a SQL grant, a migration
+ * comment, or a runbook is not a leak — and flagging it would skip every session
+ * that merely READ a cockpit source file, which is differential censoring
+ * correlated with repo and task type (the cockpit-development sessions the
+ * harvest cares most about). Value-shaped tokens (JWT, sk-, ghp_, PEM blocks,
+ * AWS key ids, Slack/Linear/Langfuse tokens) are self-identifying and stay
+ * blocked regardless of surrounding context.
+ */
+/**
+ * File-path / file-name segments that must never be read at all. This is a
+ * NAME matcher (it never reads file content), so it stays broad: a file called
+ * `service-role.json` or a dotenv file is skipped on its name alone. The
+ * collector imports this instead of re-declaring it, so attribution,
+ * collection, and the path walk share one definition.
+ */
+export declare const SECRET_FILE_SEGMENT_PATTERN: RegExp;
+export declare function isSecretLikePathSegment(value: string): boolean;
 export declare function containsSecretLikeContent(value: string): boolean;

package/dist/secret-guards.js

@@ -1,9 +1,58 @@
-const PRIVILEGED_SUPABASE_KEY_NAME_PATTERN = new RegExp(`\\b${["SUPABASE", "SERVICE", "ROLE", "KEY"].join("_")}\\b`, "i");
-const SECRET_LIKE_CONTENT_PATTERNS = [
-    /\b(?:NEXT_PUBLIC_)?SUPABASE_ANON_KEY\b/i,
-    PRIVILEGED_SUPABASE_KEY_NAME_PATTERN,
-    /\bSERVICE[_\s-]?ROLE\b/i,
-    /\b(?:api[_-]?key|access[_-]?token|refresh[_-]?token|private[_-]?key|client[_-]?secret|secret[_-]?access[_-]?key)\s*[:=]\s*["']?[A-Za-z0-9_./+=-]{12,}/i,
+/**
+ * Secret-like content + file-name guards shared by the local collector
+ * (attribution, collection) and the dashboard commit-time guard. Keeping a
+ * single home means the client and server agree on exactly which transcripts
+ * are skipped.
+ *
+ * D13 precision: prose-shaped credential NAMES (SERVICE_ROLE, SUPABASE_ANON_KEY,
+ * LANGFUSE_*_KEY, api_key, ...) only trip the content guard when they carry an
+ * assignment + a value. A bare keyword in source code, a SQL grant, a migration
+ * comment, or a runbook is not a leak — and flagging it would skip every session
+ * that merely READ a cockpit source file, which is differential censoring
+ * correlated with repo and task type (the cockpit-development sessions the
+ * harvest cares most about). Value-shaped tokens (JWT, sk-, ghp_, PEM blocks,
+ * AWS key ids, Slack/Linear/Langfuse tokens) are self-identifying and stay
+ * blocked regardless of surrounding context.
+ */
+/**
+ * File-path / file-name segments that must never be read at all. This is a
+ * NAME matcher (it never reads file content), so it stays broad: a file called
+ * `service-role.json` or a dotenv file is skipped on its name alone. The
+ * collector imports this instead of re-declaring it, so attribution,
+ * collection, and the path walk share one definition.
+ */
+export const SECRET_FILE_SEGMENT_PATTERN = /(^|[/\\])(?:\.env(?:\..*)?|.*(?:secret|credential|private[_-]?key|service[_-]?role).*)$/i;
+export function isSecretLikePathSegment(value) {
+    return SECRET_FILE_SEGMENT_PATTERN.test(value);
+}
+// Constructed from parts so the literal privileged key name never appears in
+// this source file (the public-package pack scanner bans it as a content
+// pattern, just as the original guard did).
+const PRIVILEGED_SUPABASE_KEY_NAME = ["SUPABASE", "SERVICE", "ROLE", "KEY"].join("_");
+/**
+ * Credential names that are only a leak when assigned a value (D13). The value
+ * shape mirrors the long-standing generic pattern: an assignment operator
+ * followed by a 12+ char opaque value. A bare env var reference (name only) and
+ * `GRANT ... TO service_role` (no assignment) do not match; the same name with
+ * an assigned value does.
+ */
+const SECRET_NAME_WITH_VALUE_PATTERN = new RegExp(`\\b(?:${[
+    "(?:NEXT_PUBLIC_)?SUPABASE_ANON_KEY",
+    PRIVILEGED_SUPABASE_KEY_NAME,
+    "SERVICE[_\\s-]?ROLE(?:[_\\s-]?KEY)?",
+    "LANGFUSE_(?:PUBLIC|SECRET)_KEY",
+    "api[_-]?key",
+    "access[_-]?token",
+    "refresh[_-]?token",
+    "private[_-]?key",
+    "client[_-]?secret",
+    "secret[_-]?access[_-]?key",
+].join("|")})\\b\\s*[:=]\\s*["']?[A-Za-z0-9_./+=-]{12,}`, "i");
+/**
+ * Self-identifying secret values — blocked regardless of context because the
+ * token shape itself is the credential, with no benign reading.
+ */
+const SECRET_VALUE_PATTERNS = [
     /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
     /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/,
     /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/,
@@ -15,9 +64,12 @@ const SECRET_LIKE_CONTENT_PATTERNS = [
     /\bsb_secret_[A-Za-z0-9_]{16,}/,
     /\bxox[baprs]-[A-Za-z0-9-]{16,}/,
     /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
-    /\bLANGFUSE_(?:PUBLIC|SECRET)_KEY\b/i,
     /\b(?:pk|sk)-lf-[A-Za-z0-9_-]{16,}\b/i,
 ];
+const SECRET_LIKE_CONTENT_PATTERNS = [
+    SECRET_NAME_WITH_VALUE_PATTERN,
+    ...SECRET_VALUE_PATTERNS,
+];
 export function containsSecretLikeContent(value) {
     return SECRET_LIKE_CONTENT_PATTERNS.some((pattern) => pattern.test(value));
 }

package/dist/source-adapter.d.ts

@@ -9,6 +9,7 @@ export declare const SourceAdapterIdentitySchema: z.ZodObject<{
         github_state: "github_state";
         linear_state: "linear_state";
         mcp_local: "mcp_local";
+        claude_jsonl: "claude_jsonl";
         claude_hooks: "claude_hooks";
         manual_event: "manual_event";
         collector_runtime: "collector_runtime";
@@ -30,8 +31,8 @@ export declare const SourceScanEventSummarySchema: z.ZodObject<{
             remote_durable_raw_evidence: "remote_durable_raw_evidence";
         }>;
         redaction_status: z.ZodEnum<{
-            metadata_only: "metadata_only";
             redacted: "redacted";
+            metadata_only: "metadata_only";
             raw_local_only: "raw_local_only";
             raw_remote_short_retention: "raw_remote_short_retention";
             raw_remote_durable: "raw_remote_durable";
@@ -87,6 +88,7 @@ export declare const SourceScanResultSchema: z.ZodObject<{
             github_state: "github_state";
             linear_state: "linear_state";
             mcp_local: "mcp_local";
+            claude_jsonl: "claude_jsonl";
             claude_hooks: "claude_hooks";
             manual_event: "manual_event";
             collector_runtime: "collector_runtime";
@@ -96,10 +98,10 @@ export declare const SourceScanResultSchema: z.ZodObject<{
     }, z.core.$strict>;
     work_context_id: z.ZodOptional<z.ZodString>;
     status: z.ZodEnum<{
-        ok: "ok";
+        failed: "failed";
         skipped: "skipped";
+        ok: "ok";
         partial: "partial";
-        failed: "failed";
     }>;
     started_at: z.ZodString;
     finished_at: z.ZodOptional<z.ZodString>;
@@ -117,8 +119,8 @@ export declare const SourceScanResultSchema: z.ZodObject<{
                 remote_durable_raw_evidence: "remote_durable_raw_evidence";
             }>;
             redaction_status: z.ZodEnum<{
-                metadata_only: "metadata_only";
                 redacted: "redacted";
+                metadata_only: "metadata_only";
                 raw_local_only: "raw_local_only";
                 raw_remote_short_retention: "raw_remote_short_retention";
                 raw_remote_durable: "raw_remote_durable";
@@ -229,6 +231,7 @@ export declare const SourceScanResultSchema: z.ZodObject<{
                 github_state: "github_state";
                 linear_state: "linear_state";
                 mcp_local: "mcp_local";
+                claude_jsonl: "claude_jsonl";
                 claude_hooks: "claude_hooks";
                 manual_event: "manual_event";
                 collector_runtime: "collector_runtime";

package/dist/work-context.d.ts

@@ -67,6 +67,7 @@ export declare const LocalWorkContextSchema: z.ZodObject<{
             github_state: "github_state";
             linear_state: "linear_state";
             mcp_local: "mcp_local";
+            claude_jsonl: "claude_jsonl";
             claude_hooks: "claude_hooks";
             manual_event: "manual_event";
             collector_runtime: "collector_runtime";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/telemetry-core",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",