@bywaretech/bysentinel-core 0.1.0

package/dist/redaction/redactor.d.ts

@@ -0,0 +1,19 @@
+import type { RedactionOptions } from "../types/config.js";
+import { KEY_RULES, VALUE_PATTERNS } from "./patterns.js";
+/**
+ * Redact sensitive substrings inside a single string value.
+ *
+ * `applyHighEntropyFallback` (default true) controls the generic opaque-token
+ * guess. Named secret/PII patterns always run. Callers pass `false` for known
+ * structured-metadata fields (see `LOW_ENTROPY_METADATA_KEYS`).
+ */
+export declare function redactString(input: string, options?: RedactionOptions, applyHighEntropyFallback?: boolean): string;
+/**
+ * Deep-redact an arbitrary value (object/array/scalar). Keys matching a
+ * `KeyRule` have their whole value replaced; remaining strings are scanned for
+ * embedded secrets/PII. Handles cycles and depth/size limits.
+ */
+export declare function redact<T>(value: T, options?: RedactionOptions): T;
+/** Convenience re-exports for consumers building custom flows. */
+export { KEY_RULES, VALUE_PATTERNS };
+//# sourceMappingURL=redactor.d.ts.map

package/dist/redaction/redactor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redactor.d.ts","sourceRoot":"","sources":["../../src/redaction/redactor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,EACL,SAAS,EACT,cAAc,EAIf,MAAM,eAAe,CAAC;AA4CvB;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,gBAAqB,EAC9B,wBAAwB,UAAO,GAC9B,MAAM,CAmBR;AASD;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,GAAE,gBAAqB,GAAG,CAAC,CAIrE;AA6CD,kEAAkE;AAClE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC"}

package/dist/redaction/redactor.js

@@ -0,0 +1,120 @@
+import { looksHighEntropy } from "./entropy.js";
+import { KEY_RULES, VALUE_PATTERNS, keyRuleFor, } from "./patterns.js";
+const DEFAULTS = {
+    redactPII: true,
+    redactSecrets: true,
+    redactPaymentData: true,
+    redactEmails: true,
+    redactPhones: true,
+    maxDepth: 12,
+    maxStringLength: 20_000,
+};
+/**
+ * Structured deploy metadata: repository URLs, commit hashes, versions. Named
+ * secret/PII patterns still run on these; only the generic high-entropy
+ * fallback is skipped, so a plain `https://github.com/org/repo` or a 40-char
+ * commit SHA is not mistaken for an opaque token and wiped out.
+ */
+const LOW_ENTROPY_METADATA_KEYS = new Set([
+    "repositoryUrl",
+    "commitSha",
+    "branch",
+    "version",
+    "release",
+    "buildTimestamp",
+    "requestId",
+    "functionName",
+]);
+function categoryEnabled(cat, opts) {
+    switch (cat) {
+        case "pii":
+            return opts.redactPII;
+        case "secret":
+            return opts.redactSecrets;
+        case "payment":
+            return opts.redactPaymentData;
+        case "email":
+            return opts.redactEmails;
+        case "phone":
+            return opts.redactPhones;
+    }
+}
+/**
+ * Redact sensitive substrings inside a single string value.
+ *
+ * `applyHighEntropyFallback` (default true) controls the generic opaque-token
+ * guess. Named secret/PII patterns always run. Callers pass `false` for known
+ * structured-metadata fields (see `LOW_ENTROPY_METADATA_KEYS`).
+ */
+export function redactString(input, options = {}, applyHighEntropyFallback = true) {
+    const opts = { ...DEFAULTS, ...options };
+    let value = input.length > opts.maxStringLength ? input.slice(0, opts.maxStringLength) : input;
+    for (const pattern of VALUE_PATTERNS) {
+        if (!categoryEnabled(pattern.category, opts))
+            continue;
+        value = applyPattern(value, pattern);
+    }
+    // Generic high-entropy fallback for opaque secrets that no named rule caught.
+    if (opts.redactSecrets && applyHighEntropyFallback) {
+        value = value.replace(/[A-Za-z0-9+/_=.-]{24,}/g, (token) => token.startsWith("[REDACTED") || !looksHighEntropy(token)
+            ? token
+            : "[REDACTED_HIGH_ENTROPY]");
+    }
+    return value;
+}
+function applyPattern(value, pattern) {
+    pattern.regex.lastIndex = 0;
+    return value.replace(pattern.regex, (match) => pattern.validate && !pattern.validate(match) ? match : pattern.replacement);
+}
+/**
+ * Deep-redact an arbitrary value (object/array/scalar). Keys matching a
+ * `KeyRule` have their whole value replaced; remaining strings are scanned for
+ * embedded secrets/PII. Handles cycles and depth/size limits.
+ */
+export function redact(value, options = {}) {
+    const opts = { ...DEFAULTS, ...options };
+    const seen = new WeakSet();
+    return walk(value, opts, seen, 0);
+}
+function walk(value, opts, seen, depth) {
+    if (value == null)
+        return value;
+    if (typeof value === "string")
+        return redactString(value, opts);
+    if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+        return value;
+    }
+    if (depth >= opts.maxDepth)
+        return "[REDACTED_MAX_DEPTH]";
+    if (Array.isArray(value)) {
+        if (seen.has(value))
+            return "[REDACTED_CIRCULAR]";
+        seen.add(value);
+        return value.map((item) => walk(item, opts, seen, depth + 1));
+    }
+    if (typeof value === "object") {
+        if (seen.has(value))
+            return "[REDACTED_CIRCULAR]";
+        seen.add(value);
+        const out = {};
+        for (const [key, child] of Object.entries(value)) {
+            const rule = keyRuleFor(key);
+            if (rule && categoryEnabled(rule.category, opts)) {
+                out[key] = rule.replacement;
+            }
+            else if (typeof child === "string" && LOW_ENTROPY_METADATA_KEYS.has(key)) {
+                // Structured metadata: keep named-pattern redaction, skip the entropy guess.
+                out[key] = redactString(child, opts, false);
+            }
+            else {
+                out[key] = walk(child, opts, seen, depth + 1);
+            }
+        }
+        return out;
+    }
+    // functions, symbols, etc. are dropped.
+    return "[REDACTED_UNSUPPORTED]";
+}
+/** Convenience re-exports for consumers building custom flows. */
+export { KEY_RULES, VALUE_PATTERNS };
+//# sourceMappingURL=redactor.js.map

package/dist/redaction/redactor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redactor.js","sourceRoot":"","sources":["../../src/redaction/redactor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,SAAS,EACT,cAAc,EACd,UAAU,GAGX,MAAM,eAAe,CAAC;AAEvB,MAAM,QAAQ,GAA+B;IAC3C,SAAS,EAAE,IAAI;IACf,aAAa,EAAE,IAAI;IACnB,iBAAiB,EAAE,IAAI;IACvB,YAAY,EAAE,IAAI;IAClB,YAAY,EAAE,IAAI;IAClB,QAAQ,EAAE,EAAE;IACZ,eAAe,EAAE,MAAM;CACxB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,eAAe;IACf,WAAW;IACX,QAAQ;IACR,SAAS;IACT,SAAS;IACT,gBAAgB;IAChB,WAAW;IACX,cAAc;CACf,CAAC,CAAC;AAEH,SAAS,eAAe,CAAC,GAAsB,EAAE,IAAgC;IAC/E,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,KAAK;YACR,OAAO,IAAI,CAAC,SAAS,CAAC;QACxB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,aAAa,CAAC;QAC5B,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC,iBAAiB,CAAC;QAChC,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,YAAY,CAAC;IAC7B,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAa,EACb,UAA4B,EAAE,EAC9B,wBAAwB,GAAG,IAAI;IAE/B,MAAM,IAAI,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;IACzC,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAE/F,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;YAAE,SAAS;QACvD,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,8EAA8E;IAC9E,IAAI,IAAI,CAAC,aAAa,IAAI,wBAAwB,EAAE,CAAC;QACnD,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC,KAAK,EAAE,EAAE,CACzD,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;YACvD,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,yBAAyB,CAC9B,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,OAAqB;IACxD,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5C,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAC3E,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAI,KAAQ,EAAE,UAA4B,EAAE;IAChE,MAAM,IAAI,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,OAAO,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAM,CAAC;AACzC,CAAC;AAED,SAAS,IAAI,CACX,KAAc,EACd,IAAgC,EAChC,IAAqB,EACrB,KAAa;IAEb,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IAEhC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACzF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,sBAAsB,CAAC;IAE1D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,qBAAqB,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,qBAAqB,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;gBACjD,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;YAC9B,CAAC;iBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3E,6EAA6E;gBAC7E,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,wCAAwC;IACxC,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAED,kEAAkE;AAClE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC"}

package/dist/security/signals.d.ts

@@ -0,0 +1,12 @@
+import type { RequestInfo, ErrorInfo, SecuritySignal } from "../types/event.js";
+interface DetectInput {
+    request?: RequestInfo;
+    error?: ErrorInfo;
+}
+/**
+ * Scan (pre-redaction) request/error data for attack indicators and accidental
+ * secret exposure. Returns signals with descriptions only — never raw values.
+ */
+export declare function detectSecuritySignals(input: DetectInput): SecuritySignal[];
+export {};
+//# sourceMappingURL=signals.d.ts.map

package/dist/security/signals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signals.d.ts","sourceRoot":"","sources":["../../src/security/signals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGhF,UAAU,WAAW;IACnB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AA2BD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,WAAW,GAAG,cAAc,EAAE,CA6F1E"}

package/dist/security/signals.js

@@ -0,0 +1,123 @@
+import { VALUE_PATTERNS } from "../redaction/patterns.js";
+const SUSPICIOUS_UA = /\b(sqlmap|nikto|nmap|masscan|acunetix|nessus|dirbuster|gobuster|wpscan|havij|hydra)\b/i;
+const SQL_ERROR = /\b(sql syntax|syntax error at or near|unclosed quotation mark|ora-\d{5}|pg_query|mysqli?_|sqlstate|unterminated quoted string|column .* does not exist)\b/i;
+const COMMAND_INJECTION = /(;|\||&&|`|\$\(|\|\||>\s*\/|<\s*\/)\s*(cat|ls|rm|curl|wget|bash|sh|nc|whoami|id)\b/i;
+const PATH_TRAVERSAL = /(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e\/|\/etc\/passwd|\/proc\/self)/i;
+// Private ranges + AWS/GCP metadata endpoints commonly hit by SSRF.
+const SSRF_URL = /https?:\/\/(?:127\.0\.0\.1|localhost|0\.0\.0\.0|169\.254\.169\.254|metadata\.google\.internal|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3})/i;
+const SECRET_PATTERNS = VALUE_PATTERNS.filter((p) => p.category === "secret");
+function flatten(value, out, depth = 0) {
+    if (depth > 8 || value == null)
+        return;
+    if (typeof value === "string")
+        out.push(value);
+    else if (Array.isArray(value))
+        value.forEach((v) => flatten(v, out, depth + 1));
+    else if (typeof value === "object") {
+        for (const v of Object.values(value))
+            flatten(v, out, depth + 1);
+    }
+}
+/**
+ * Scan (pre-redaction) request/error data for attack indicators and accidental
+ * secret exposure. Returns signals with descriptions only — never raw values.
+ */
+export function detectSecuritySignals(input) {
+    const signals = [];
+    const { request, error } = input;
+    const bodyStrings = [];
+    flatten(request?.body, bodyStrings);
+    flatten(request?.query, bodyStrings);
+    const headerStrings = [];
+    flatten(request?.headers, headerStrings);
+    const allInput = [...bodyStrings, ...headerStrings];
+    // Accidental secret in body/headers.
+    for (const pattern of SECRET_PATTERNS) {
+        if (bodyStrings.some((s) => testOnce(pattern.regex, s))) {
+            signals.push({
+                type: "sensitive-data-in-body",
+                severity: "high",
+                message: `Possible ${pattern.name} present in request body`,
+                location: "request.body",
+            });
+            break;
+        }
+    }
+    for (const pattern of SECRET_PATTERNS) {
+        if (headerStrings.some((s) => testOnce(pattern.regex, s)) &&
+            pattern.name !== "bearer-token" &&
+            pattern.name !== "basic-auth") {
+            signals.push({
+                type: "secret-in-log",
+                severity: "high",
+                message: `Possible ${pattern.name} present in request headers`,
+                location: "request.headers",
+            });
+            break;
+        }
+    }
+    const ua = getHeader(request?.headers, "user-agent");
+    if (ua && SUSPICIOUS_UA.test(ua)) {
+        signals.push({
+            type: "suspicious-user-agent",
+            severity: "medium",
+            message: "Request user-agent matches a known scanning tool",
+            location: "request.headers.user-agent",
+        });
+    }
+    if (request?.path && /\/(admin|internal|_debug|actuator)\b/i.test(request.path)) {
+        signals.push({
+            type: "admin-route-access",
+            severity: "medium",
+            message: "Access to an administrative/internal route",
+            location: "request.path",
+        });
+    }
+    if (error?.message && SQL_ERROR.test(error.message)) {
+        signals.push({
+            type: "sql-error-leakage",
+            severity: "high",
+            message: "Database error text leaked in the error message",
+            location: "error.message",
+        });
+    }
+    if (allInput.some((s) => COMMAND_INJECTION.test(s))) {
+        signals.push({
+            type: "command-injection",
+            severity: "critical",
+            message: "Input contains shell command-injection patterns",
+            location: "request",
+        });
+    }
+    if (allInput.some((s) => PATH_TRAVERSAL.test(s))) {
+        signals.push({
+            type: "path-traversal",
+            severity: "high",
+            message: "Input contains path-traversal sequences",
+            location: "request",
+        });
+    }
+    if (allInput.some((s) => SSRF_URL.test(s))) {
+        signals.push({
+            type: "ssrf-like-url",
+            severity: "high",
+            message: "Input references an internal/metadata URL (possible SSRF)",
+            location: "request",
+        });
+    }
+    return signals;
+}
+function testOnce(regex, value) {
+    regex.lastIndex = 0;
+    return regex.test(value);
+}
+function getHeader(headers, name) {
+    if (!headers)
+        return undefined;
+    for (const [k, v] of Object.entries(headers)) {
+        if (k.toLowerCase() === name && typeof v === "string")
+            return v;
+    }
+    return undefined;
+}
+//# sourceMappingURL=signals.js.map

package/dist/security/signals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signals.js","sourceRoot":"","sources":["../../src/security/signals.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAO1D,MAAM,aAAa,GACjB,wFAAwF,CAAC;AAE3F,MAAM,SAAS,GACb,4JAA4J,CAAC;AAE/J,MAAM,iBAAiB,GAAG,qFAAqF,CAAC;AAEhH,MAAM,cAAc,GAAG,gEAAgE,CAAC;AAExF,oEAAoE;AACpE,MAAM,QAAQ,GACZ,sMAAsM,CAAC;AAEzM,MAAM,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;AAE9E,SAAS,OAAO,CAAC,KAAc,EAAE,GAAa,EAAE,KAAK,GAAG,CAAC;IACvD,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;SAC3E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC;YAAE,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAkB;IACtD,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAEjC,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IACpC,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IACrC,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,aAAa,CAAC,CAAC;IAEpD,qCAAqC;IACrC,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,wBAAwB;gBAC9B,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,YAAY,OAAO,CAAC,IAAI,0BAA0B;gBAC3D,QAAQ,EAAE,cAAc;aACzB,CAAC,CAAC;YACH,MAAM;QACR,CAAC;IACH,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,IACE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACrD,OAAO,CAAC,IAAI,KAAK,cAAc;YAC/B,OAAO,CAAC,IAAI,KAAK,YAAY,EAC7B,CAAC;YACD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,eAAe;gBACrB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,YAAY,OAAO,CAAC,IAAI,6BAA6B;gBAC9D,QAAQ,EAAE,iBAAiB;aAC5B,CAAC,CAAC;YACH,MAAM;QACR,CAAC;IACH,CAAC;IAED,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IACrD,IAAI,EAAE,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,uBAAuB;YAC7B,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,kDAAkD;YAC3D,QAAQ,EAAE,4BAA4B;SACvC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,EAAE,IAAI,IAAI,uCAAuC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,4CAA4C;YACrD,QAAQ,EAAE,cAAc;SACzB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,EAAE,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,mBAAmB;YACzB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,iDAAiD;YAC1D,QAAQ,EAAE,eAAe;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,mBAAmB;YACzB,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,iDAAiD;YAC1D,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,yCAAyC;YAClD,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,eAAe;YACrB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,2DAA2D;YACpE,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,KAAa;IAC5C,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;IACpB,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,SAAS,CAAC,OAA4C,EAAE,IAAY;IAC3E,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/timeline/timeline.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Execution timeline: a lightweight sequential span recorder.
+ *
+ * `step(name)` closes the previous running step and opens a new one, so the
+ * duration of a step is the wall-clock time until the next `step()`/`finish()`.
+ * This matches the roadmap's dashboard model (per-step ms + a single bottleneck)
+ * and, because each step carries an absolute timestamp, it doubles as the
+ * chronological "incident timeline".
+ */
+export type TimelineStepStatus = "completed" | "running" | "failed";
+export interface TimelineStep {
+    name: string;
+    /** Absolute ISO time the step started. */
+    startedAt: string;
+    /** Milliseconds from the timeline start to this step's start. */
+    startOffsetMs: number;
+    /** Filled once the step is closed. */
+    durationMs?: number;
+    status: TimelineStepStatus;
+    meta?: Record<string, unknown>;
+}
+export interface TimelineBottleneck {
+    name: string;
+    durationMs: number;
+    /** Share of the total timeline duration, 0..100. */
+    percentOfTotal: number;
+}
+export interface ExecutionTimeline {
+    startedAt: string;
+    totalMs: number;
+    steps: TimelineStep[];
+    bottleneck?: TimelineBottleneck;
+    /** True when the timeline was finalized abnormally (error/timeout). */
+    aborted: boolean;
+}
+export interface TimelineOptions {
+    /** Injectable monotonic-ish clock for tests. Defaults to `Date.now`. */
+    clock?: () => number;
+}
+export declare class Timeline {
+    private readonly clock;
+    private readonly startMs;
+    private readonly startedAtIso;
+    private readonly steps;
+    private finalized;
+    constructor(options?: TimelineOptions);
+    /** Open a new step, closing any currently running one. */
+    step(name: string, meta?: Record<string, unknown>): this;
+    /** Attach metadata to the currently running step. */
+    annotate(meta: Record<string, unknown>): this;
+    /** Mark the running step as failed (used on exception/timeout). */
+    fail(meta?: Record<string, unknown>): this;
+    /** Close the timeline and return the immutable snapshot. Idempotent. */
+    finish(status?: "completed" | "failed"): ExecutionTimeline;
+    /** Snapshot without finalizing (for capturing mid-flight, e.g. on error). */
+    toJSON(aborted?: boolean): ExecutionTimeline;
+    get hasSteps(): boolean;
+    private closeRunning;
+    private snapshot;
+}
+//# sourceMappingURL=timeline.d.ts.map

package/dist/timeline/timeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timeline.d.ts","sourceRoot":"","sources":["../../src/timeline/timeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEpE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,aAAa,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,uEAAuE;IACvE,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB;AAED,qBAAa,QAAQ;IACnB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,SAAS,CAAS;gBAEd,OAAO,GAAE,eAAoB;IAMzC,0DAA0D;IAC1D,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAaxD,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAQ7C,mEAAmE;IACnE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAO1C,wEAAwE;IACxE,MAAM,CAAC,MAAM,GAAE,WAAW,GAAG,QAAsB,GAAG,iBAAiB;IAOvE,6EAA6E;IAC7E,MAAM,CAAC,OAAO,UAAQ,GAAG,iBAAiB;IAK1C,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,QAAQ;CAkBjB"}

package/dist/timeline/timeline.js

@@ -0,0 +1,90 @@
+/**
+ * Execution timeline: a lightweight sequential span recorder.
+ *
+ * `step(name)` closes the previous running step and opens a new one, so the
+ * duration of a step is the wall-clock time until the next `step()`/`finish()`.
+ * This matches the roadmap's dashboard model (per-step ms + a single bottleneck)
+ * and, because each step carries an absolute timestamp, it doubles as the
+ * chronological "incident timeline".
+ */
+export class Timeline {
+    clock;
+    startMs;
+    startedAtIso;
+    steps = [];
+    finalized = false;
+    constructor(options = {}) {
+        this.clock = options.clock ?? Date.now;
+        this.startMs = this.clock();
+        this.startedAtIso = new Date(this.startMs).toISOString();
+    }
+    /** Open a new step, closing any currently running one. */
+    step(name, meta) {
+        const at = this.clock();
+        this.closeRunning(at, "completed");
+        this.steps.push({
+            name,
+            startedAt: new Date(at).toISOString(),
+            startOffsetMs: at - this.startMs,
+            status: "running",
+            meta,
+        });
+        return this;
+    }
+    /** Attach metadata to the currently running step. */
+    annotate(meta) {
+        const current = this.steps.at(-1);
+        if (current && current.status === "running") {
+            current.meta = { ...current.meta, ...meta };
+        }
+        return this;
+    }
+    /** Mark the running step as failed (used on exception/timeout). */
+    fail(meta) {
+        const at = this.clock();
+        if (meta)
+            this.annotate(meta);
+        this.closeRunning(at, "failed");
+        return this;
+    }
+    /** Close the timeline and return the immutable snapshot. Idempotent. */
+    finish(status = "completed") {
+        const at = this.clock();
+        this.closeRunning(at, status === "failed" ? "failed" : "completed");
+        this.finalized = true;
+        return this.snapshot(at, status === "failed");
+    }
+    /** Snapshot without finalizing (for capturing mid-flight, e.g. on error). */
+    toJSON(aborted = false) {
+        const at = this.clock();
+        return this.snapshot(at, aborted || !this.finalized);
+    }
+    get hasSteps() {
+        return this.steps.length > 0;
+    }
+    closeRunning(at, status) {
+        const current = this.steps.at(-1);
+        if (current && current.status === "running") {
+            current.durationMs = at - (this.startMs + current.startOffsetMs);
+            current.status = status;
+        }
+    }
+    snapshot(at, aborted) {
+        const totalMs = at - this.startMs;
+        const steps = this.steps.map((s) => ({ ...s }));
+        let bottleneck;
+        for (const s of steps) {
+            if (s.durationMs == null)
+                continue;
+            if (!bottleneck || s.durationMs > bottleneck.durationMs) {
+                bottleneck = {
+                    name: s.name,
+                    durationMs: s.durationMs,
+                    percentOfTotal: totalMs > 0 ? Math.round((s.durationMs / totalMs) * 1000) / 10 : 0,
+                };
+            }
+        }
+        return { startedAt: this.startedAtIso, totalMs, steps, bottleneck, aborted };
+    }
+}
+//# sourceMappingURL=timeline.js.map

package/dist/timeline/timeline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timeline.js","sourceRoot":"","sources":["../../src/timeline/timeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAqCH,MAAM,OAAO,QAAQ;IACF,KAAK,CAAe;IACpB,OAAO,CAAS;IAChB,YAAY,CAAS;IACrB,KAAK,GAAmB,EAAE,CAAC;IACpC,SAAS,GAAG,KAAK,CAAC;IAE1B,YAAY,UAA2B,EAAE;QACvC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,YAAY,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,CAAC;IAED,0DAA0D;IAC1D,IAAI,CAAC,IAAY,EAAE,IAA8B;QAC/C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YACd,IAAI;YACJ,SAAS,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;YACrC,aAAa,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO;YAChC,MAAM,EAAE,SAAS;YACjB,IAAI;SACL,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qDAAqD;IACrD,QAAQ,CAAC,IAA6B;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO,CAAC,IAAI,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;QAC9C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mEAAmE;IACnE,IAAI,CAAC,IAA8B;QACjC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,IAAI;YAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wEAAwE;IACxE,MAAM,CAAC,SAAiC,WAAW;QACjD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACpE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED,6EAA6E;IAC7E,MAAM,CAAC,OAAO,GAAG,KAAK;QACpB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/B,CAAC;IAEO,YAAY,CAAC,EAAU,EAAE,MAA0B;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO,CAAC,UAAU,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;YACjE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;QAC1B,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,EAAU,EAAE,OAAgB;QAC3C,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAEhD,IAAI,UAA0C,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI;gBAAE,SAAS;YACnC,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,EAAE,CAAC;gBACxD,UAAU,GAAG;oBACX,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,UAAU,EAAE,CAAC,CAAC,UAAU;oBACxB,cAAc,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;iBACnF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAC/E,CAAC;CACF"}

package/dist/types/analysis.d.ts

@@ -0,0 +1,46 @@
+/** Structured result the AI analyzer must return. Validated before storage. */
+export type AISeverity = "low" | "medium" | "high" | "critical";
+export type AICategory = "bug" | "performance" | "security" | "dependency" | "configuration" | "external-service" | "unknown";
+export interface AIAffectedArea {
+    file?: string;
+    functionName?: string;
+    line?: number;
+}
+export interface AISecurityImpact {
+    hasSensitiveDataRisk: boolean;
+    description?: string;
+    recommendedAction?: string;
+}
+/** One link in the upstream causal chain (roadmap #6). */
+export interface AICausalLink {
+    /** What happened at this stage, e.g. "API returned HTTP 429". */
+    cause: string;
+    /** Optional evidence from the incident that supports this link. */
+    evidence?: string;
+}
+/** Bottleneck attribution derived from the execution timeline (roadmap #2). */
+export interface AIBottleneck {
+    step: string;
+    durationMs?: number;
+    percentOfTotal?: number;
+    description?: string;
+}
+export interface AIAnalysisResult {
+    summary: string;
+    likelyCause: string;
+    severity: AISeverity;
+    category: AICategory;
+    affectedArea?: AIAffectedArea;
+    suggestedFix: string;
+    examplePatch?: string;
+    securityImpact?: AISecurityImpact;
+    /** Ordered upstream causes, root cause first (roadmap #6). */
+    causalChain?: AICausalLink[];
+    /** Slowest step attribution when a timeline is present (roadmap #2). */
+    bottleneck?: AIBottleneck;
+    /** 0..1 */
+    confidence: number;
+    /** Human explanation of the confidence score (roadmap #11). */
+    confidenceReason?: string;
+}
+//# sourceMappingURL=analysis.d.ts.map

package/dist/types/analysis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis.d.ts","sourceRoot":"","sources":["../../src/types/analysis.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAE/E,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAEhE,MAAM,MAAM,UAAU,GAClB,KAAK,GACL,aAAa,GACb,UAAU,GACV,YAAY,GACZ,eAAe,GACf,kBAAkB,GAClB,SAAS,CAAC;AAEd,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,0DAA0D;AAC1D,MAAM,WAAW,YAAY;IAC3B,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,CAAC;IACrB,QAAQ,EAAE,UAAU,CAAC;IACrB,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,8DAA8D;IAC9D,WAAW,CAAC,EAAE,YAAY,EAAE,CAAC;IAC7B,wEAAwE;IACxE,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,WAAW;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B"}

package/dist/types/analysis.js

@@ -0,0 +1,3 @@
+/** Structured result the AI analyzer must return. Validated before storage. */
+export {};
+//# sourceMappingURL=analysis.js.map

package/dist/types/analysis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis.js","sourceRoot":"","sources":["../../src/types/analysis.ts"],"names":[],"mappings":"AAAA,+EAA+E"}

package/dist/types/config.d.ts

@@ -0,0 +1,54 @@
+/** Configuration shared between the SDK and the collector's second-stage sanitizer. */
+export interface CaptureOptions {
+    /** Include the request body in the event. Default: false (security-first). */
+    requestBody?: boolean;
+    /** Include request headers. Default: false. */
+    headers?: boolean;
+    /** Include the query string. Default: true. */
+    query?: boolean;
+    /** Include the error stack trace. Default: true. */
+    stackTrace?: boolean;
+    /** Collect performance metadata (duration, memory, timeout risk). Default: true. */
+    performance?: boolean;
+}
+export interface SecurityOptions {
+    /** Master switch for the redaction engine. Default: true. */
+    sanitize?: boolean;
+    /** Redact PII (CPF, CNPJ, RG, passport, bank data, ...). Default: true. */
+    redactPII?: boolean;
+    /** Redact detected secrets/tokens/keys. Default: true. */
+    redactSecrets?: boolean;
+    /** Redact card numbers, CVV, Pix keys and payment tokens. Default: true. */
+    redactPaymentData?: boolean;
+    /** Redact email addresses. Default: true. */
+    redactEmails?: boolean;
+    /** Redact phone numbers. Default: true. */
+    redactPhones?: boolean;
+    /**
+     * Strict mode: never let request bodies/headers leave the process even if
+     * `capture.requestBody`/`capture.headers` are true. Default: false.
+     */
+    strictMode?: boolean;
+}
+export type AIMode = "disabled" | "local-only" | "self-hosted" | "cloud";
+export interface AIOptions {
+    enabled?: boolean;
+    mode?: AIMode;
+    provider?: string;
+    model?: string;
+    /** When false, request bodies are stripped before reaching the provider. */
+    sendBodyToAI?: boolean;
+    /** When false, request headers are stripped before reaching the provider. */
+    sendHeadersToAI?: boolean;
+    /** Refuse any external provider when true (paired with local-only mode). */
+    allowExternalProvider?: boolean;
+}
+export interface RedactionOptions extends Pick<SecurityOptions, "redactPII" | "redactSecrets" | "redactPaymentData" | "redactEmails" | "redactPhones"> {
+    /** Placeholder used when a whole value is redacted by key match. */
+    maxDepth?: number;
+    /** Strings longer than this are truncated before scanning (DoS guard). */
+    maxStringLength?: number;
+}
+export declare const DEFAULT_SECURITY_OPTIONS: Required<SecurityOptions>;
+export declare const DEFAULT_CAPTURE_OPTIONS: Required<CaptureOptions>;
+//# sourceMappingURL=config.d.ts.map

package/dist/types/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/types/config.ts"],"names":[],"mappings":"AAAA,uFAAuF;AAEvF,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,+CAA+C;IAC/C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oDAAoD;IACpD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oFAAoF;IACpF,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,0DAA0D;IAC1D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,4EAA4E;IAC5E,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,6CAA6C;IAC7C,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,2CAA2C;IAC3C,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,MAAM,MAAM,GAAG,UAAU,GAAG,YAAY,GAAG,aAAa,GAAG,OAAO,CAAC;AAEzE,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,6EAA6E;IAC7E,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,4EAA4E;IAC5E,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,gBACf,SAAQ,IAAI,CACV,eAAe,EACf,WAAW,GAAG,eAAe,GAAG,mBAAmB,GAAG,cAAc,GAAG,cAAc,CACtF;IACD,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,eAAO,MAAM,wBAAwB,EAAE,QAAQ,CAAC,eAAe,CAQ9D,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,cAAc,CAM5D,CAAC"}

package/dist/types/config.js

@@ -0,0 +1,18 @@
+/** Configuration shared between the SDK and the collector's second-stage sanitizer. */
+export const DEFAULT_SECURITY_OPTIONS = {
+    sanitize: true,
+    redactPII: true,
+    redactSecrets: true,
+    redactPaymentData: true,
+    redactEmails: true,
+    redactPhones: true,
+    strictMode: false,
+};
+export const DEFAULT_CAPTURE_OPTIONS = {
+    requestBody: false,
+    headers: false,
+    query: true,
+    stackTrace: true,
+    performance: true,
+};
+//# sourceMappingURL=config.js.map

package/dist/types/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/types/config.ts"],"names":[],"mappings":"AAAA,uFAAuF;AA6DvF,MAAM,CAAC,MAAM,wBAAwB,GAA8B;IACjE,QAAQ,EAAE,IAAI;IACd,SAAS,EAAE,IAAI;IACf,aAAa,EAAE,IAAI;IACnB,iBAAiB,EAAE,IAAI;IACvB,YAAY,EAAE,IAAI;IAClB,YAAY,EAAE,IAAI;IAClB,UAAU,EAAE,KAAK;CAClB,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAA6B;IAC/D,WAAW,EAAE,KAAK;IAClB,OAAO,EAAE,KAAK;IACd,KAAK,EAAE,IAAI;IACX,UAAU,EAAE,IAAI;IAChB,WAAW,EAAE,IAAI;CAClB,CAAC"}