@equipe-tech/observability 0.2.0 → 0.3.5

package/dist/policy/BrowserFieldPolicy.js

@@ -0,0 +1,298 @@
+import { Option, Predicate, Schema } from "effect";
+import { maxEventNameLength, maxFieldKeyLength, maxFieldsPerEvent, maxFieldValueLength, } from "../BrowserEvents.js";
+import { baseBlockedKeys, baseBlockedValuePatterns, isSensitiveFieldKey, replaceEmailCandidates, sensitiveFieldReplacement, sensitiveTextReplacement, } from "./PolicyVocabulary.js";
+const maxOriginalFieldKeyLength = 2_048;
+export const maxOriginalStringLength = 16_384;
+const maxJsonDepth = 32;
+const maxJsonValues = 1_024;
+const SensitiveScalar = Schema.Union([
+    Schema.String,
+    Schema.Number.check(Schema.isFinite()),
+    Schema.Boolean,
+]);
+const decodeSensitiveScalar = Schema.decodeUnknownOption(SensitiveScalar);
+const decodeJsonText = Schema.decodeOption(Schema.fromJsonString(Schema.Json));
+const decodeJsonObject = Schema.decodeUnknownOption(Schema.JsonObject);
+const asciiCaseInsensitive = (source) => source.replace(/[A-Za-z]/g, (letter) => `[${letter.toLowerCase()}${letter.toUpperCase()}]`);
+const sensitiveTerms = baseBlockedKeys.map(asciiCaseInsensitive).join("|");
+const sensitiveTextTermPattern = new RegExp(`(?:${sensitiveTerms})(?=[._-]|[A-Z0-9]|[^A-Za-z0-9._-]|$)`);
+const maximumAssignmentKeyLength = 256;
+const isAssignmentKeyCharacter = (character) => /[A-Za-z0-9_.\-[\]"'`\\]/.test(character);
+const assignmentCandidateAt = (value, start) => {
+    if (!isAssignmentKeyCharacter(value[start] ?? ""))
+        return undefined;
+    let index = start;
+    while (index < value.length &&
+        index - start <= maximumAssignmentKeyLength &&
+        isAssignmentKeyCharacter(value[index] ?? "")) {
+        index += 1;
+    }
+    if (index - start > maximumAssignmentKeyLength)
+        return undefined;
+    const keyEnd = index;
+    const first = value[start];
+    const escapedFirst = first === "\\" ? value[start + 1] : first;
+    const closingKeyQuote = escapedFirst === '"' || escapedFirst === "'" || escapedFirst === "`";
+    if (closingKeyQuote) {
+        const closingLength = first === "\\" ? 2 : 1;
+        const closingStart = keyEnd - closingLength;
+        if (value.slice(closingStart, keyEnd) !== value.slice(start, start + closingLength)) {
+            return undefined;
+        }
+    }
+    while (index < value.length && /\s/.test(value[index] ?? ""))
+        index += 1;
+    if (value[index] !== ":" && value[index] !== "=")
+        return undefined;
+    if (value[index] === "=" && value[index + 1] === ">")
+        index += 1;
+    index += 1;
+    while (index < value.length && /\s/.test(value[index] ?? ""))
+        index += 1;
+    return { key: value.slice(start, keyEnd), start, valueStart: index };
+};
+const closingDelimiterIndex = (value, start, quote, escapedQuote) => {
+    let escaped = false;
+    for (let index = start; index < value.length; index += 1) {
+        const character = value[index];
+        if (escapedQuote && character === "\\" && value[index + 1] === quote)
+            return index;
+        if (escaped) {
+            escaped = false;
+        }
+        else if (character === "\\") {
+            escaped = true;
+        }
+        else if (character === quote) {
+            return index;
+        }
+    }
+    return -1;
+};
+const safeValueEnd = (value, start) => {
+    for (let index = start; index < value.length; index += 1) {
+        const character = value[index];
+        if (character !== "&" && character !== "#")
+            continue;
+        let candidateStart = index + 1;
+        while (candidateStart < value.length && /\s/.test(value[candidateStart] ?? "")) {
+            candidateStart += 1;
+        }
+        if (assignmentCandidateAt(value, candidateStart) !== undefined)
+            return index;
+    }
+    return value.length;
+};
+const replaceCoreValues = (value) => {
+    let sanitized = value;
+    for (const pattern of baseBlockedValuePatterns) {
+        pattern.lastIndex = 0;
+        sanitized = sanitized.replace(pattern, sensitiveTextReplacement);
+    }
+    return replaceEmailCandidates(sanitized);
+};
+const containsCoreValue = (value) => {
+    if (replaceEmailCandidates(value) !== value)
+        return true;
+    for (const pattern of baseBlockedValuePatterns) {
+        pattern.lastIndex = 0;
+        if (pattern.test(value)) {
+            pattern.lastIndex = 0;
+            return true;
+        }
+    }
+    return false;
+};
+export const replaceStructuredAssignments = (value) => {
+    let sanitized = "";
+    let offset = 0;
+    let index = 0;
+    while (index < value.length) {
+        const previous = value[index - 1];
+        if (previous !== undefined && /[A-Za-z0-9_.-]/.test(previous)) {
+            index += 1;
+            continue;
+        }
+        const candidate = assignmentCandidateAt(value, index);
+        if (candidate === undefined || !isSensitiveFieldKey(candidate.key)) {
+            index += 1;
+            continue;
+        }
+        const explicitQuote = value[candidate.valueStart];
+        const escapedQuote = explicitQuote === "\\" &&
+            (value[candidate.valueStart + 1] === '"' ||
+                value[candidate.valueStart + 1] === "'" ||
+                value[candidate.valueStart + 1] === "`");
+        const quote = escapedQuote ? value[candidate.valueStart + 1] : explicitQuote;
+        const hasExplicitQuote = quote === '"' || quote === "'" || quote === "`";
+        const enclosingQuote = value[candidate.start - 1];
+        const activeQuote = hasExplicitQuote
+            ? quote
+            : enclosingQuote === '"' || enclosingQuote === "'" || enclosingQuote === "`"
+                ? enclosingQuote
+                : undefined;
+        const openingLength = escapedQuote ? 2 : hasExplicitQuote ? 1 : 0;
+        const contentStart = candidate.valueStart + openingLength;
+        const closingIndex = activeQuote === undefined
+            ? -1
+            : closingDelimiterIndex(value, contentStart, activeQuote, escapedQuote);
+        sanitized += value.slice(offset, candidate.valueStart + openingLength);
+        sanitized += sensitiveTextReplacement;
+        if (closingIndex >= 0 && activeQuote !== undefined) {
+            const closingLength = escapedQuote ? 2 : 1;
+            sanitized += value.slice(closingIndex, closingIndex + closingLength);
+            offset = closingIndex + closingLength;
+        }
+        else {
+            offset = safeValueEnd(value, candidate.valueStart);
+        }
+        index = offset;
+    }
+    return sanitized + value.slice(offset);
+};
+const containsStructuredAssignment = (value) => replaceStructuredAssignments(value) !== value;
+const sanitizeJson = (source) => {
+    const root = { value: null };
+    const stack = [
+        {
+            source,
+            depth: 0,
+            sensitive: false,
+            assign: (value) => {
+                root.value = value;
+            },
+        },
+    ];
+    let visited = 0;
+    while (stack.length > 0) {
+        const current = stack.pop();
+        if (!Predicate.isNotUndefined(current)) {
+            continue;
+        }
+        visited += 1;
+        if (visited > maxJsonValues || current.depth > maxJsonDepth) {
+            return Option.none();
+        }
+        if (current.sensitive) {
+            current.assign(sensitiveTextReplacement);
+            continue;
+        }
+        if (current.source === null ||
+            Predicate.isNumber(current.source) ||
+            Predicate.isBoolean(current.source)) {
+            current.assign(current.source);
+            continue;
+        }
+        if (Predicate.isString(current.source)) {
+            current.assign(replaceStructuredAssignments(replaceCoreValues(current.source)));
+            continue;
+        }
+        if (Array.isArray(current.source)) {
+            const output = current.source.map(() => null);
+            current.assign(output);
+            for (let index = current.source.length - 1; index >= 0; index -= 1) {
+                const child = current.source[index];
+                if (!Predicate.isNotUndefined(child)) {
+                    continue;
+                }
+                stack.push({
+                    source: child,
+                    depth: current.depth + 1,
+                    sensitive: false,
+                    assign: (value) => {
+                        output[index] = value;
+                    },
+                });
+            }
+            continue;
+        }
+        const sourceObject = decodeJsonObject(current.source);
+        if (Option.isNone(sourceObject)) {
+            return Option.none();
+        }
+        const output = Object.create(null);
+        const outputKeys = new Set();
+        current.assign(output);
+        const keys = Object.keys(sourceObject.value);
+        for (const key of keys) {
+            if (key.length > maxOriginalFieldKeyLength ||
+                containsCoreValue(key) ||
+                containsStructuredAssignment(key)) {
+                continue;
+            }
+            output[key] = null;
+            outputKeys.add(key);
+        }
+        for (let index = keys.length - 1; index >= 0; index -= 1) {
+            const key = keys[index];
+            if (!Predicate.isString(key) || !outputKeys.has(key)) {
+                continue;
+            }
+            const child = sourceObject.value[key];
+            if (!Predicate.isNotUndefined(child)) {
+                continue;
+            }
+            stack.push({
+                source: child,
+                depth: current.depth + 1,
+                sensitive: isSensitiveFieldKey(key),
+                assign: (value) => {
+                    output[key] = value;
+                },
+            });
+        }
+    }
+    return Option.some(JSON.stringify(root.value));
+};
+export const replaceStructuredText = (value) => {
+    const trimmed = value.trimStart();
+    if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+        const parsed = decodeJsonText(value);
+        if (Option.isSome(parsed)) {
+            return Option.getOrElse(sanitizeJson(parsed.value), () => sensitiveTextReplacement);
+        }
+        if (sensitiveTextTermPattern.test(value))
+            return sensitiveTextReplacement;
+    }
+    return replaceStructuredAssignments(value);
+};
+const sanitizeString = (value, outputLimit) => {
+    if (value.length > maxOriginalStringLength) {
+        return sensitiveTextReplacement;
+    }
+    const sanitized = replaceStructuredText(replaceCoreValues(value));
+    const trimmed = value.trimStart();
+    if ((trimmed.startsWith("{") || trimmed.startsWith("[")) && sanitized.length > outputLimit) {
+        return sensitiveTextReplacement;
+    }
+    return sanitized;
+};
+const shouldDropKey = (key) => key.length > maxOriginalFieldKeyLength ||
+    containsCoreValue(key) ||
+    containsStructuredAssignment(key);
+export const sanitizeBrowserFields = (fields) => {
+    const sanitized = [];
+    const boundedKeys = new Set();
+    for (const [key, runtimeValue] of Object.entries(fields)) {
+        const decoded = decodeSensitiveScalar(runtimeValue);
+        if (Option.isNone(decoded) || key === "" || shouldDropKey(key)) {
+            continue;
+        }
+        const boundedKey = key.slice(0, maxFieldKeyLength);
+        if (boundedKeys.has(boundedKey)) {
+            continue;
+        }
+        const value = isSensitiveFieldKey(key)
+            ? sensitiveFieldReplacement
+            : Predicate.isString(decoded.value)
+                ? sanitizeString(decoded.value, maxFieldValueLength).slice(0, maxFieldValueLength)
+                : decoded.value;
+        sanitized.push([boundedKey, value]);
+        boundedKeys.add(boundedKey);
+        if (boundedKeys.size >= maxFieldsPerEvent) {
+            break;
+        }
+    }
+    return Object.fromEntries(sanitized);
+};
+export const sanitizeEventName = (name) => sanitizeString(name, maxEventNameLength).slice(0, maxEventNameLength);

package/dist/policy/DataPolicy.d.ts

@@ -0,0 +1,19 @@
+import { Context, Effect } from "effect";
+import type { AttributeClassification, AttributeDefinition, AttributeDefinitionsInput } from "../contract/TelemetryContract.js";
+import { InvalidDataPolicy } from "./DataPolicyError.js";
+export type PolicySurface = "audit" | "event" | "log" | "span" | "metric" | "browser-ingest" | "defect" | "resource";
+export type DataPolicyInput = {
+    readonly attributes: AttributeDefinitionsInput;
+    readonly blockedKeys: ReadonlyArray<string>;
+    readonly blockedValuePatterns: ReadonlyArray<string>;
+};
+export interface DataPolicy {
+    readonly attributes: ReadonlyMap<string, AttributeDefinition>;
+    readonly blockedKeys: ReadonlyArray<RegExp>;
+    readonly blockedValuePatterns: ReadonlyArray<RegExp>;
+    readonly classify: (key: string) => AttributeClassification;
+}
+export declare const definePolicy: <const Policy extends DataPolicyInput>(policy: Policy) => Policy;
+export declare const parseDataPolicy: (input: DataPolicyInput, contractAttributes?: AttributeDefinitionsInput | undefined) => Effect.Effect<DataPolicy, InvalidDataPolicy, never>;
+export declare const baseDataPolicy: DataPolicy;
+export declare const CurrentDataPolicy: Context.Reference<DataPolicy>;

package/dist/policy/DataPolicy.js

@@ -0,0 +1,254 @@
+import { Context, Effect, Schema } from "effect";
+import { isValidAttributeName } from "../contract/EventName.js";
+import { baseBlockedKeyPatternSource, baseBlockedValuePatterns, isSensitiveFieldKey, } from "./PolicyVocabulary.js";
+import { InvalidDataPolicy } from "./DataPolicyError.js";
+const AttributeDocument = Schema.Struct({
+    classification: Schema.String,
+    required: Schema.Boolean,
+    metricLabel: Schema.Boolean,
+});
+const PolicyDocument = Schema.Struct({
+    attributes: Schema.Record(Schema.String, AttributeDocument),
+    blockedKeys: Schema.Array(Schema.String.check(Schema.isMaxLength(128))).check(Schema.isMaxLength(256)),
+    blockedValuePatterns: Schema.Array(Schema.String).check(Schema.isMaxLength(64)),
+});
+const decodePolicy = Schema.decodeUnknownEffect(PolicyDocument);
+const classifications = new Set(["public", "internal", "sensitive", "forbidden"]);
+const reservedNames = new Set(["event.name", "event.kind", "event.type", "event.severity"]);
+const maximumRegexRepetition = 64;
+const maximumRegexSourceLength = 256;
+const maximumRegexFixedWidth = 128;
+const issue = (code, message, attributeName, rule) => {
+    const value = {
+        code,
+        message,
+    };
+    if (attributeName !== undefined)
+        value.attributeName = attributeName;
+    if (rule !== undefined)
+        value.rule = rule;
+    return value;
+};
+const invalid = (issues) => new InvalidDataPolicy({
+    code: "OBS_POLICY_INVALID",
+    message: `Data policy compilation failed with ${issues.length} issue(s). Fix every reported rule and compile again.`,
+    issues,
+});
+const isAcceptedRegex = (source) => {
+    if (source.length === 0 || source.length > maximumRegexSourceLength)
+        return false;
+    let index = 0;
+    let canQuantify = false;
+    let variableQuantifiers = 0;
+    let fixedWidth = 0;
+    while (index < source.length) {
+        const character = source.charAt(index);
+        if (character === "^" && index === 0) {
+            canQuantify = false;
+            index += 1;
+            continue;
+        }
+        if (character === "$" && index === source.length - 1) {
+            canQuantify = false;
+            index += 1;
+            continue;
+        }
+        if (character === "\\") {
+            const escaped = source[index + 1];
+            if (escaped === undefined || /[A-Za-z0-9]/.test(escaped))
+                return false;
+            canQuantify = true;
+            index += 2;
+            continue;
+        }
+        if (character === "[") {
+            let classIndex = index + 1;
+            if (source[classIndex] === "^")
+                classIndex += 1;
+            let classValues = 0;
+            let closed = false;
+            while (classIndex < source.length) {
+                const classCharacter = source[classIndex];
+                if (classCharacter === "\\") {
+                    if (source[classIndex + 1] === undefined)
+                        return false;
+                    classValues += 1;
+                    classIndex += 2;
+                    continue;
+                }
+                if (classCharacter === "]") {
+                    closed = true;
+                    classIndex += 1;
+                    break;
+                }
+                if (classCharacter === "[")
+                    return false;
+                classValues += 1;
+                classIndex += 1;
+            }
+            if (!closed || classValues === 0)
+                return false;
+            canQuantify = true;
+            index = classIndex;
+            continue;
+        }
+        if (character === "?" || character === "+" || character === "*") {
+            if (!canQuantify)
+                return false;
+            variableQuantifiers += 1;
+            if (variableQuantifiers > 1)
+                return false;
+            canQuantify = false;
+            index += 1;
+            continue;
+        }
+        if (character === "{") {
+            if (!canQuantify)
+                return false;
+            const quantifier = source.slice(index).match(/^\{\d+(?:,\d*)?\}/);
+            if (quantifier === null)
+                return false;
+            const repetition = quantifier[0];
+            const separator = repetition.indexOf(",");
+            const minimum = Number(repetition.slice(1, separator === -1 ? -1 : separator));
+            const maximumText = separator === -1 ? undefined : repetition.slice(separator + 1, -1);
+            const maximum = maximumText === undefined || maximumText === "" ? undefined : Number(maximumText);
+            if (minimum > maximumRegexRepetition ||
+                (maximum !== undefined && maximum > maximumRegexRepetition)) {
+                return false;
+            }
+            if (maximum !== undefined && minimum > maximum)
+                return false;
+            if (separator !== -1) {
+                variableQuantifiers += 1;
+            }
+            else {
+                fixedWidth += minimum;
+            }
+            if (variableQuantifiers > 1 || fixedWidth > maximumRegexFixedWidth)
+                return false;
+            canQuantify = false;
+            index += repetition.length;
+            continue;
+        }
+        if ("()|.^$}]".includes(character))
+            return false;
+        canQuantify = true;
+        index += 1;
+    }
+    return true;
+};
+const hasMalformedEscapeOrClass = (source) => {
+    let escaped = false;
+    let inCharacterClass = false;
+    for (const character of source) {
+        if (escaped) {
+            escaped = false;
+        }
+        else if (character === "\\") {
+            escaped = true;
+        }
+        else if (character === "[") {
+            if (inCharacterClass)
+                return true;
+            inCharacterClass = true;
+        }
+        else if (character === "]") {
+            if (!inCharacterClass)
+                return true;
+            inCharacterClass = false;
+        }
+    }
+    return escaped || inCharacterClass;
+};
+const compilePatterns = (sources, code, unsafeCode, global, issues) => {
+    const patterns = [];
+    for (const source of sources) {
+        if (!isAcceptedRegex(source)) {
+            const malformed = hasMalformedEscapeOrClass(source);
+            issues.push(issue(malformed ? code : unsafeCode, malformed
+                ? "A policy regular expression is malformed. Use a complete escaped literal or character class."
+                : "A policy regular expression uses unsupported syntax. Use literals, escaped literals, character classes, anchors, and direct quantifiers only."));
+            continue;
+        }
+        try {
+            patterns.push(new RegExp(source, global ? "gi" : "i"));
+        }
+        catch {
+            issues.push(issue(code, code === "OBS_POLICY_INVALID_BLOCKED_KEY"
+                ? "A blocked key rule is invalid. Use a bounded regular expression fragment."
+                : "A blocked value rule is invalid. Use a bounded regular expression."));
+        }
+    }
+    return patterns;
+};
+const rank = (classification) => {
+    switch (classification) {
+        case "public":
+            return 0;
+        case "internal":
+            return 1;
+        case "sensitive":
+            return 2;
+        case "forbidden":
+            return 3;
+    }
+};
+export const definePolicy = (policy) => policy;
+export const parseDataPolicy = Effect.fn("parseDataPolicy")(function* (input, contractAttributes = {}) {
+    const parsed = yield* decodePolicy(input).pipe(Effect.mapError(() => invalid([
+        issue("OBS_POLICY_INVALID_DOCUMENT", "Data policy document is malformed. Provide attributes, blockedKeys, and blockedValuePatterns."),
+    ])));
+    const issues = [];
+    const attributes = new Map();
+    if (Object.keys(parsed.attributes).length > 512) {
+        issues.push(issue("OBS_POLICY_LIMIT_EXCEEDED", "Data policy exceeds the 512-attribute limit."));
+    }
+    for (const [name, definition] of Object.entries(parsed.attributes)) {
+        if (!isValidAttributeName(name)) {
+            issues.push(issue("OBS_POLICY_INVALID_ATTRIBUTE_NAME", "A policy attribute name is invalid. Use a dotted lowercase name no longer than 128 characters.", undefined, "dotted-name"));
+            continue;
+        }
+        if (reservedNames.has(name)) {
+            issues.push(issue("OBS_POLICY_RESERVED_ATTRIBUTE_NAME", "A policy attribute collides with a canonical signal field. Rename the application attribute.", name, "reserved-name"));
+            continue;
+        }
+        if (!classifications.has(definition.classification) ||
+            ((definition.classification === "sensitive" || definition.classification === "forbidden") &&
+                (definition.required || definition.metricLabel))) {
+            issues.push(issue("OBS_POLICY_INVALID_CLASSIFICATION", "A policy attribute has an invalid classification or incompatible flags.", name, "classification"));
+            continue;
+        }
+        const classification = Schema.decodeUnknownSync(Schema.Literals(["public", "internal", "sensitive", "forbidden"]))(definition.classification);
+        const contractClassification = contractAttributes[name]?.classification;
+        if (contractClassification !== undefined &&
+            rank(classification) < rank(contractClassification)) {
+            issues.push(issue("OBS_POLICY_CONTRACT_CONFLICT", "A policy attribute is less restrictive than its telemetry contract declaration.", name, "classification"));
+            continue;
+        }
+        attributes.set(name, { ...definition, classification });
+    }
+    const applicationKeyPatterns = compilePatterns(parsed.blockedKeys, "OBS_POLICY_INVALID_BLOCKED_KEY", "OBS_POLICY_UNSAFE_BLOCKED_KEY_PATTERN", false, issues);
+    const applicationValuePatterns = compilePatterns(parsed.blockedValuePatterns, "OBS_POLICY_INVALID_BLOCKED_VALUE_PATTERN", "OBS_POLICY_UNSAFE_BLOCKED_VALUE_PATTERN", true, issues);
+    if (issues.length > 0)
+        return yield* invalid(issues);
+    const blockedKeys = [new RegExp(baseBlockedKeyPatternSource), ...applicationKeyPatterns];
+    const blockedValuePatterns = [
+        ...baseBlockedValuePatterns.map((pattern) => new RegExp(pattern.source, pattern.flags)),
+        ...applicationValuePatterns,
+    ];
+    return Object.freeze({
+        attributes,
+        blockedKeys,
+        blockedValuePatterns,
+        classify: (key) => {
+            const declared = attributes.get(key)?.classification ?? "internal";
+            if (isSensitiveFieldKey(key) || blockedKeys.some((pattern) => pattern.test(key))) {
+                return rank(declared) >= rank("sensitive") ? declared : "sensitive";
+            }
+            return declared;
+        },
+    });
+});
+export const baseDataPolicy = Effect.runSync(parseDataPolicy({ attributes: {}, blockedKeys: [], blockedValuePatterns: [] }));
+export const CurrentDataPolicy = Context.Reference("@equipe-tech/observability/CurrentDataPolicy", { defaultValue: () => baseDataPolicy });

package/dist/policy/DataPolicyError.d.ts

@@ -0,0 +1,22 @@
+import { Schema } from "effect";
+export declare const PolicyIssueCode: Schema.Literals<readonly ["OBS_POLICY_INVALID_DOCUMENT", "OBS_POLICY_INVALID_ATTRIBUTE_NAME", "OBS_POLICY_RESERVED_ATTRIBUTE_NAME", "OBS_POLICY_INVALID_CLASSIFICATION", "OBS_POLICY_INVALID_BLOCKED_KEY", "OBS_POLICY_INVALID_BLOCKED_VALUE_PATTERN", "OBS_POLICY_UNSAFE_BLOCKED_KEY_PATTERN", "OBS_POLICY_UNSAFE_BLOCKED_VALUE_PATTERN", "OBS_POLICY_CONTRACT_CONFLICT", "OBS_POLICY_LIMIT_EXCEEDED", "OBS_POLICY_DUPLICATE_RESOURCE_ATTRIBUTE"]>;
+export type PolicyIssueCode = typeof PolicyIssueCode.Type;
+export type PolicyIssue = {
+    readonly code: PolicyIssueCode;
+    readonly message: string;
+    readonly attributeName?: string;
+    readonly rule?: string;
+};
+declare const InvalidDataPolicy_base: Schema.Class<InvalidDataPolicy, Schema.TaggedStruct<"InvalidDataPolicy", {
+    readonly code: Schema.Literal<"OBS_POLICY_INVALID">;
+    readonly message: Schema.String;
+    readonly issues: Schema.$Array<Schema.Struct<{
+        readonly code: Schema.Literals<readonly ["OBS_POLICY_INVALID_DOCUMENT", "OBS_POLICY_INVALID_ATTRIBUTE_NAME", "OBS_POLICY_RESERVED_ATTRIBUTE_NAME", "OBS_POLICY_INVALID_CLASSIFICATION", "OBS_POLICY_INVALID_BLOCKED_KEY", "OBS_POLICY_INVALID_BLOCKED_VALUE_PATTERN", "OBS_POLICY_UNSAFE_BLOCKED_KEY_PATTERN", "OBS_POLICY_UNSAFE_BLOCKED_VALUE_PATTERN", "OBS_POLICY_CONTRACT_CONFLICT", "OBS_POLICY_LIMIT_EXCEEDED", "OBS_POLICY_DUPLICATE_RESOURCE_ATTRIBUTE"]>;
+        readonly message: Schema.String;
+        readonly attributeName: Schema.optionalKey<Schema.String>;
+        readonly rule: Schema.optionalKey<Schema.String>;
+    }>>;
+}>, import("effect/Cause").YieldableError>;
+export declare class InvalidDataPolicy extends InvalidDataPolicy_base {
+}
+export {};

package/dist/policy/DataPolicyError.js

@@ -0,0 +1,25 @@
+import { Schema } from "effect";
+export const PolicyIssueCode = Schema.Literals([
+    "OBS_POLICY_INVALID_DOCUMENT",
+    "OBS_POLICY_INVALID_ATTRIBUTE_NAME",
+    "OBS_POLICY_RESERVED_ATTRIBUTE_NAME",
+    "OBS_POLICY_INVALID_CLASSIFICATION",
+    "OBS_POLICY_INVALID_BLOCKED_KEY",
+    "OBS_POLICY_INVALID_BLOCKED_VALUE_PATTERN",
+    "OBS_POLICY_UNSAFE_BLOCKED_KEY_PATTERN",
+    "OBS_POLICY_UNSAFE_BLOCKED_VALUE_PATTERN",
+    "OBS_POLICY_CONTRACT_CONFLICT",
+    "OBS_POLICY_LIMIT_EXCEEDED",
+    "OBS_POLICY_DUPLICATE_RESOURCE_ATTRIBUTE",
+]);
+export class InvalidDataPolicy extends Schema.TaggedError()("InvalidDataPolicy", {
+    code: Schema.Literal("OBS_POLICY_INVALID"),
+    message: Schema.String,
+    issues: Schema.Array(Schema.Struct({
+        code: PolicyIssueCode,
+        message: Schema.String,
+        attributeName: Schema.String.pipe(Schema.optionalKey),
+        rule: Schema.String.pipe(Schema.optionalKey),
+    })),
+}) {
+}

package/dist/policy/Deduplication.d.ts

@@ -0,0 +1,13 @@
+import type { DefectEnvelope } from "./DefectEnvelope.js";
+export type DedupeDecision = {
+    readonly kind: "admitted";
+} | {
+    readonly kind: "deduplicated";
+    readonly reason: "identity" | "fingerprint";
+};
+export type DefectDeduplicator = {
+    readonly admit: (eventId: string, envelope: DefectEnvelope, now: number) => DedupeDecision;
+    readonly rollback: (eventId: string) => void;
+    readonly release: (eventId: string) => void;
+};
+export declare const defectDeduplicator: (windowMillis: number, capacity: number) => DefectDeduplicator;

package/dist/policy/Deduplication.js

@@ -0,0 +1,44 @@
+const normalizedFingerprint = (envelope) => JSON.stringify(envelope.fingerprint.map((part) => part
+    .toLowerCase()
+    .replaceAll(/[?#].*$/g, "")
+    .replaceAll(/\b[0-9a-f]{8,}\b/g, "<hash>")
+    .replaceAll(/\d{4,}/g, "<number>")));
+export const defectDeduplicator = (windowMillis, capacity) => {
+    const identities = new WeakSet();
+    const fingerprints = new Map();
+    const reservations = new Map();
+    return {
+        admit: (eventId, envelope, now) => {
+            if (identities.has(envelope))
+                return { kind: "deduplicated", reason: "identity" };
+            const fingerprint = normalizedFingerprint(envelope);
+            const previous = fingerprints.get(fingerprint);
+            if (previous !== undefined && now - previous.admittedAt <= windowMillis) {
+                return { kind: "deduplicated", reason: "fingerprint" };
+            }
+            identities.add(envelope);
+            fingerprints.delete(fingerprint);
+            fingerprints.set(fingerprint, { eventId, admittedAt: now });
+            reservations.set(eventId, { envelope, fingerprint });
+            while (fingerprints.size > capacity) {
+                const oldest = fingerprints.keys().next().value;
+                if (oldest !== undefined)
+                    fingerprints.delete(oldest);
+            }
+            return { kind: "admitted" };
+        },
+        rollback: (eventId) => {
+            const reservation = reservations.get(eventId);
+            if (reservation === undefined)
+                return;
+            reservations.delete(eventId);
+            identities.delete(reservation.envelope);
+            if (fingerprints.get(reservation.fingerprint)?.eventId === eventId) {
+                fingerprints.delete(reservation.fingerprint);
+            }
+        },
+        release: (eventId) => {
+            reservations.delete(eventId);
+        },
+    };
+};