@equipe-tech/observability 0.2.1 → 0.3.5

package/dist/policy/DefectEnvelope.d.ts

@@ -0,0 +1,25 @@
+import { Option, Schema } from "effect";
+import { CorrelationContext } from "../Correlation.js";
+import type { AttributeValue } from "../contract/TelemetryEvent.js";
+import type { DataPolicy } from "./DataPolicy.js";
+import { type PolicyDecision } from "./PolicyTransform.js";
+export declare const DefectEnvelope: Schema.Struct<{
+    readonly errorType: Schema.Literal<"UnexpectedDefect">;
+    readonly errorMessage: Schema.String;
+    readonly stack: Schema.Option<Schema.String>;
+    readonly fingerprint: Schema.$Array<Schema.String>;
+    readonly tags: Schema.$ReadonlyMap<Schema.String, Schema.String>;
+    readonly context: Schema.$ReadonlyMap<Schema.String, Schema.Union<readonly [Schema.String, Schema.Number, Schema.Boolean]>>;
+    readonly correlation: typeof CorrelationContext;
+}>;
+export type DefectEnvelope = typeof DefectEnvelope.Type;
+export type UnexpectedDefectInput = {
+    readonly error: Error;
+    readonly code: string;
+    readonly fingerprint?: ReadonlyArray<string>;
+    readonly tags?: ReadonlyMap<string, string>;
+    readonly context?: ReadonlyMap<string, AttributeValue>;
+    readonly correlation?: CorrelationContext;
+};
+export declare const unexpectedDefect: (input: UnexpectedDefectInput) => DefectEnvelope;
+export declare const sanitizeDefectEnvelope: (policy: DataPolicy, envelope: DefectEnvelope) => PolicyDecision<Option.Option<DefectEnvelope>>;

package/dist/policy/DefectEnvelope.js

@@ -0,0 +1,52 @@
+import { Option, Schema } from "effect";
+import { CorrelationContext } from "../Correlation.js";
+import { sanitizeText, transformSignalFields } from "./PolicyTransform.js";
+export const DefectEnvelope = Schema.Struct({
+    errorType: Schema.Literal("UnexpectedDefect"),
+    errorMessage: Schema.String,
+    stack: Schema.Option(Schema.String),
+    fingerprint: Schema.Array(Schema.String),
+    tags: Schema.ReadonlyMap(Schema.String, Schema.String),
+    context: Schema.ReadonlyMap(Schema.String, Schema.Union([Schema.String, Schema.Number, Schema.Boolean])),
+    correlation: CorrelationContext,
+});
+export const unexpectedDefect = (input) => ({
+    errorType: "UnexpectedDefect",
+    errorMessage: input.error.message,
+    stack: Option.fromNullishOr(input.error.stack),
+    fingerprint: input.fingerprint ?? [input.code, input.error.name],
+    tags: input.tags ?? new Map(),
+    context: input.context ?? new Map(),
+    correlation: input.correlation ?? new CorrelationContext({}),
+});
+export const sanitizeDefectEnvelope = (policy, envelope) => {
+    const contextInput = {};
+    for (const [key, value] of envelope.context)
+        contextInput[key] = value;
+    const contextDecision = transformSignalFields(policy, "defect", contextInput);
+    const context = new Map();
+    for (const [key, value] of Object.entries(contextDecision.value))
+        context.set(key, value);
+    const tagsInput = {};
+    for (const [key, value] of envelope.tags)
+        tagsInput[key] = value;
+    const tagsDecision = transformSignalFields(policy, "defect", tagsInput);
+    const tags = new Map();
+    for (const [key, value] of Object.entries(tagsDecision.value))
+        tags.set(key, String(value));
+    const redactions = [...contextDecision.redactions, ...tagsDecision.redactions];
+    const dropped = contextDecision.dropped + tagsDecision.dropped;
+    if (redactions.some((redaction) => redaction.rule === "classification" && redaction.action === "dropped")) {
+        return { value: Option.none(), redactions, dropped };
+    }
+    const value = {
+        ...envelope,
+        errorType: envelope.errorType,
+        errorMessage: sanitizeText(policy, envelope.errorMessage, "defect"),
+        stack: Option.map(envelope.stack, (stack) => sanitizeText(policy, stack, "defect")),
+        fingerprint: envelope.fingerprint.map((part) => sanitizeText(policy, part, "defect")),
+        tags,
+        context,
+    };
+    return { value: Option.some(value), redactions, dropped };
+};

package/dist/policy/MetricLabelPolicy.d.ts

@@ -0,0 +1,5 @@
+import type { MetricAttributeValue } from "../Metrics.js";
+import type { DataPolicy } from "./DataPolicy.js";
+export declare const isForbiddenMetricAttributeName: (key: string) => boolean;
+export type MetricLabelRejection = "attribute-name" | "classification" | "identifier-shape" | "string-bound" | "blocked-value";
+export declare const metricLabelRejection: (policy: DataPolicy, key: string, value: MetricAttributeValue) => MetricLabelRejection | undefined;

package/dist/policy/MetricLabelPolicy.js

@@ -0,0 +1,65 @@
+import { Predicate } from "effect";
+import { isValidAttributeName } from "../contract/EventName.js";
+import { replaceStructuredAssignments } from "./BrowserFieldPolicy.js";
+import { isSensitiveFieldKey, replaceEmailCandidates } from "./PolicyVocabulary.js";
+const maximumMetricLabelTextLength = 64;
+const labelValuePattern = /^[A-Za-z0-9/][A-Za-z0-9._:/-]{0,63}$/;
+const uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const tracePattern = /^[0-9a-f]{32}$/;
+const spanPattern = /^[0-9a-f]{16}$/;
+const ulidPattern = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/;
+const numericIdentifierPattern = /^\d{7,}$/;
+const reserved = new Set([
+    "service.instance.id",
+    "trace.id",
+    "span.id",
+    "user.id",
+    "session.id",
+    "unit",
+    "time_unit",
+]);
+export const isForbiddenMetricAttributeName = (key) => !isValidAttributeName(key) || reserved.has(key) || isSensitiveFieldKey(key);
+export const metricLabelRejection = (policy, key, value) => {
+    if (isForbiddenMetricAttributeName(key)) {
+        return "attribute-name";
+    }
+    const definition = policy.attributes.get(key);
+    const classification = policy.classify(key);
+    if (definition !== undefined &&
+        (!definition.metricLabel ||
+            definition.classification === "sensitive" ||
+            definition.classification === "forbidden")) {
+        return "classification";
+    }
+    if (classification === "sensitive" || classification === "forbidden") {
+        return "classification";
+    }
+    if (Predicate.isNumber(value)) {
+        return Number.isInteger(value) && numericIdentifierPattern.test(String(Math.abs(value)))
+            ? "identifier-shape"
+            : undefined;
+    }
+    if (Predicate.isBoolean(value))
+        return undefined;
+    if (value.length > maximumMetricLabelTextLength)
+        return "string-bound";
+    if (replaceEmailCandidates(value) !== value)
+        return "blocked-value";
+    for (const pattern of policy.blockedValuePatterns) {
+        pattern.lastIndex = 0;
+        if (pattern.test(value))
+            return "blocked-value";
+    }
+    if (replaceStructuredAssignments(value) !== value)
+        return "blocked-value";
+    if (!labelValuePattern.test(value))
+        return "string-bound";
+    if (uuidPattern.test(value) ||
+        tracePattern.test(value) ||
+        spanPattern.test(value) ||
+        ulidPattern.test(value) ||
+        numericIdentifierPattern.test(value)) {
+        return "identifier-shape";
+    }
+    return undefined;
+};

package/dist/policy/PolicyTransform.d.ts

@@ -0,0 +1,16 @@
+import type { EventAttributes } from "../contract/TelemetryEvent.js";
+import type { DataPolicy, PolicySurface } from "./DataPolicy.js";
+export type PolicyAction = "masked" | "truncated" | "dropped";
+export type PolicyRule = "attribute-name" | "blocked-key" | "blocked-value" | "classification" | "bounds";
+export type PolicyRedaction = {
+    readonly rule: PolicyRule;
+    readonly action: PolicyAction;
+    readonly surface: PolicySurface;
+};
+export type PolicyDecision<A> = {
+    readonly value: A;
+    readonly redactions: ReadonlyArray<PolicyRedaction>;
+    readonly dropped: number;
+};
+export declare const transformSignalFields: (policy: DataPolicy, surface: Exclude<PolicySurface, "metric">, fields: EventAttributes) => PolicyDecision<EventAttributes>;
+export declare const sanitizeText: (policy: DataPolicy, value: string, surface?: Exclude<PolicySurface, "browser-ingest" | "metric" | "resource">) => string;

package/dist/policy/PolicyTransform.js

@@ -0,0 +1,136 @@
+import { Predicate } from "effect";
+import { maxFieldKeyLength } from "../BrowserEvents.js";
+import { isValidAttributeName } from "../contract/EventName.js";
+import { maxOriginalStringLength, replaceStructuredText, sanitizeBrowserFields, } from "./BrowserFieldPolicy.js";
+import { replaceEmailCandidates, sensitiveFieldReplacement, sensitiveTextReplacement, } from "./PolicyVocabulary.js";
+const serverBounds = {
+    audit: { maximumFields: 64, maximumTextLength: 4_096 },
+    event: { maximumFields: 128, maximumTextLength: 16_384 },
+    log: { maximumFields: 128, maximumTextLength: 32_768 },
+    span: { maximumFields: 128, maximumTextLength: 32_768 },
+    defect: { maximumFields: 128, maximumTextLength: 65_536 },
+    resource: { maximumFields: 128, maximumTextLength: 8_192 },
+};
+const reservedPrefixes = ["event.", "browser."];
+const replaceBlockedValues = (policy, value) => {
+    let output = value;
+    for (const pattern of policy.blockedValuePatterns) {
+        pattern.lastIndex = 0;
+        output = output.replace(pattern, sensitiveTextReplacement);
+    }
+    return replaceStructuredText(replaceEmailCandidates(output));
+};
+const sanitizeBoundedText = (policy, surface, value) => {
+    const maximum = serverBounds[surface].maximumTextLength;
+    const bounded = value.slice(0, maximum);
+    const sanitized = replaceBlockedValues(policy, bounded);
+    return {
+        value: sanitized.slice(0, maximum),
+        blocked: sanitized !== bounded,
+        truncated: value.length > maximum || sanitized.length > maximum,
+    };
+};
+const transformBrowserFields = (policy, fields) => {
+    const admitted = {};
+    const redactions = [];
+    for (const [key, value] of Object.entries(fields)) {
+        if (!isValidAttributeName(key.slice(0, maxFieldKeyLength)) ||
+            reservedPrefixes.some((prefix) => key.startsWith(prefix))) {
+            redactions.push({ rule: "attribute-name", action: "dropped", surface: "browser-ingest" });
+            continue;
+        }
+        const classification = policy.classify(key);
+        if (classification === "forbidden") {
+            redactions.push({ rule: "classification", action: "dropped", surface: "browser-ingest" });
+            continue;
+        }
+        if (classification === "sensitive") {
+            admitted[key] = sensitiveFieldReplacement;
+            redactions.push({
+                rule: policy.attributes.has(key) ? "classification" : "blocked-key",
+                action: "masked",
+                surface: "browser-ingest",
+            });
+            continue;
+        }
+        if (Predicate.isString(value)) {
+            const bounded = value.slice(0, maxOriginalStringLength);
+            const sanitized = replaceBlockedValues(policy, bounded);
+            admitted[key] = value.length > maxOriginalStringLength ? sensitiveTextReplacement : sanitized;
+            if (sanitized !== bounded) {
+                redactions.push({ rule: "blocked-value", action: "masked", surface: "browser-ingest" });
+            }
+        }
+        else {
+            admitted[key] = value;
+        }
+    }
+    const value = sanitizeBrowserFields(admitted);
+    const dropped = Object.keys(fields).length - Object.keys(value).length;
+    const boundedDrops = dropped - redactions.filter((entry) => entry.action === "dropped").length;
+    for (let index = 0; index < boundedDrops; index += 1) {
+        redactions.push({ rule: "bounds", action: "dropped", surface: "browser-ingest" });
+    }
+    for (const [key, original] of Object.entries(admitted)) {
+        const boundedKey = key.slice(0, maxFieldKeyLength);
+        const sanitized = value[boundedKey];
+        if (boundedKey !== key && sanitized !== undefined) {
+            redactions.push({ rule: "bounds", action: "truncated", surface: "browser-ingest" });
+        }
+        if (Predicate.isString(original) &&
+            Predicate.isString(sanitized) &&
+            sanitized.length < original.length) {
+            redactions.push({ rule: "bounds", action: "truncated", surface: "browser-ingest" });
+        }
+    }
+    return { value, redactions, dropped };
+};
+export const transformSignalFields = (policy, surface, fields) => {
+    if (surface === "browser-ingest")
+        return transformBrowserFields(policy, fields);
+    const admitted = {};
+    const redactions = [];
+    const maximumFields = serverBounds[surface].maximumFields;
+    let dropped = 0;
+    for (const [key, value] of Object.entries(fields)) {
+        if (!isValidAttributeName(key)) {
+            dropped += 1;
+            redactions.push({ rule: "attribute-name", action: "dropped", surface });
+            continue;
+        }
+        if (Object.keys(admitted).length >= maximumFields) {
+            dropped += 1;
+            redactions.push({ rule: "bounds", action: "dropped", surface });
+            continue;
+        }
+        const classification = policy.classify(key);
+        if (classification === "forbidden") {
+            dropped += 1;
+            redactions.push({ rule: "classification", action: "dropped", surface });
+            continue;
+        }
+        if (classification === "sensitive") {
+            admitted[key] = sensitiveFieldReplacement;
+            redactions.push({
+                rule: policy.attributes.has(key) || value === sensitiveFieldReplacement
+                    ? "classification"
+                    : "blocked-key",
+                action: "masked",
+                surface,
+            });
+            continue;
+        }
+        if (!Predicate.isString(value)) {
+            admitted[key] = value;
+            continue;
+        }
+        const sanitized = sanitizeBoundedText(policy, surface, value);
+        admitted[key] = sanitized.value;
+        if (sanitized.blocked)
+            redactions.push({ rule: "blocked-value", action: "masked", surface });
+        if (sanitized.truncated)
+            redactions.push({ rule: "bounds", action: "truncated", surface });
+    }
+    return { value: admitted, redactions, dropped };
+};
+export const sanitizeText = (policy, value, surface = "log") => sanitizeBoundedText(policy, surface, value).value;

package/dist/policy/PolicyVocabulary.d.ts

@@ -0,0 +1,10 @@
+export declare const sensitiveFieldReplacement = "****";
+export declare const sensitiveTextReplacement = "[REDACTED]";
+export declare const effectDroppedAttributesKey = "effect.dropped_attributes_count";
+export declare const baseBlockedKeys: string[];
+export declare const collectorBlockedKeyPattern: string;
+export declare const collectorBlockedValuePatterns: string[];
+export declare const baseBlockedValuePatterns: RegExp[];
+export declare const baseBlockedKeyPatternSource: string;
+export declare const isSensitiveFieldKey: (key: string) => boolean;
+export declare const replaceEmailCandidates: (value: string) => string;

package/dist/policy/PolicyVocabulary.js

@@ -0,0 +1,84 @@
+export const sensitiveFieldReplacement = "****";
+export const sensitiveTextReplacement = "[REDACTED]";
+export const effectDroppedAttributesKey = "effect.dropped_attributes_count";
+export const baseBlockedKeys = [
+    "authorization",
+    "proxy[._-]?authorization",
+    "cookie",
+    "set[._-]?cookie",
+    "password",
+    "passwd",
+    "secret",
+    "token",
+    "api[._-]?key",
+    "apikey",
+    "access[._-]?key",
+    "client[._-]?secret",
+    "private[._-]?key",
+    "email",
+    "phone",
+    "cpf",
+    "cnpj",
+    "document",
+];
+export const collectorBlockedKeyPattern = `(?i:${baseBlockedKeys.join("|")})(?:\\]|\\[|\\x22|\\x27|\\x60|[._-]|[A-Z0-9]|$)`;
+const collectorWhitespace = "[[:space:]   -   　\\\\x{2028}\\\\x{2029}\\\\x{feff}]";
+export const collectorBlockedValuePatterns = [
+    `(?i)https?://[^/@${collectorWhitespace.slice(1, -1)}]+@`,
+    `(?i)Bearer${collectorWhitespace}+[A-Za-z0-9._~+/=-]+`,
+    "(?:sk|rk)[_-][A-Za-z0-9_*.-]{3,}",
+    "eyJ[A-Za-z0-9_-]+[.]eyJ[A-Za-z0-9_-]+[.][A-Za-z0-9_-]+",
+    "(?i)[A-Z0-9._%+-]+@[A-Z0-9.-]+[.][A-Z]{2,}",
+    "(?s)-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----.*?-----END (?:RSA |EC |OPENSSH )?PRIVATE KEY-----",
+];
+export const baseBlockedValuePatterns = [
+    /https?:\/\/[^/@\s]+@/gi,
+    /Bearer\s+[A-Za-z0-9._~+/=-]+/gi,
+    /(?:sk|rk)[_-][A-Za-z0-9_*.-]{3,}/g,
+    /eyJ[A-Za-z0-9_-]+[.]eyJ[A-Za-z0-9_-]+[.][A-Za-z0-9_-]+/g,
+    /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g,
+];
+const asciiCaseInsensitive = (source) => source.replace(/[A-Za-z]/g, (letter) => `[${letter.toLowerCase()}${letter.toUpperCase()}]`);
+const sensitiveTerms = baseBlockedKeys.map(asciiCaseInsensitive).join("|");
+export const baseBlockedKeyPatternSource = `(?:${sensitiveTerms})(?=[\\]\\["'\x60]|[._-]|[A-Z0-9]|$)`;
+const sensitiveKeyPattern = new RegExp(baseBlockedKeyPatternSource);
+export const isSensitiveFieldKey = (key) => sensitiveKeyPattern.test(key);
+const isEmailLocalCharacter = (character) => /[A-Za-z0-9._%+-]/.test(character);
+const isEmailDomainCharacter = (character) => /[A-Za-z0-9.-]/.test(character);
+const isAsciiLetter = (character) => /[A-Za-z]/.test(character);
+export const replaceEmailCandidates = (value) => {
+    let output = "";
+    let offset = 0;
+    let index = 0;
+    while (index < value.length) {
+        if (!isEmailLocalCharacter(value[index] ?? "")) {
+            index += 1;
+            continue;
+        }
+        const start = index;
+        while (index < value.length && isEmailLocalCharacter(value[index] ?? ""))
+            index += 1;
+        if (value[index] !== "@")
+            continue;
+        index += 1;
+        const domainStart = index;
+        let lastDot = -1;
+        while (index < value.length && isEmailDomainCharacter(value[index] ?? "")) {
+            if (value[index] === ".")
+                lastDot = index;
+            index += 1;
+        }
+        let suffixIsLetters = lastDot >= domainStart && index - lastDot >= 3;
+        if (suffixIsLetters) {
+            for (let suffixIndex = lastDot + 1; suffixIndex < index; suffixIndex += 1) {
+                if (!isAsciiLetter(value[suffixIndex] ?? ""))
+                    suffixIsLetters = false;
+            }
+        }
+        if (domainStart === index || !suffixIsLetters)
+            continue;
+        output += value.slice(offset, start) + sensitiveTextReplacement;
+        offset = index;
+    }
+    return output + value.slice(offset);
+};

package/dist/policy/ResourceAttributePolicy.d.ts

@@ -0,0 +1,9 @@
+import { Effect } from "effect";
+import type { ResourceAttributes } from "../ResourceIdentity.js";
+import type { DataPolicy } from "./DataPolicy.js";
+import { InvalidDataPolicy } from "./DataPolicyError.js";
+export type ResourceAttribute = {
+    readonly key: string;
+    readonly value: string;
+};
+export declare const parseResourceAttributes: (policy: DataPolicy, canonical: ResourceAttributes, additions: readonly ResourceAttribute[]) => Effect.Effect<ReadonlyMap<string, string>, InvalidDataPolicy, never>;

package/dist/policy/ResourceAttributePolicy.js

@@ -0,0 +1,33 @@
+import { Effect, Predicate } from "effect";
+import { isValidAttributeName } from "../contract/EventName.js";
+import { InvalidDataPolicy } from "./DataPolicyError.js";
+import { transformSignalFields } from "./PolicyTransform.js";
+export const parseResourceAttributes = Effect.fn("parseResourceAttributes")(function* (policy, canonical, additions) {
+    const input = { ...canonical };
+    for (const attribute of additions) {
+        if (!isValidAttributeName(attribute.key) ||
+            !Predicate.isString(attribute.value) ||
+            Object.hasOwn(input, attribute.key) ||
+            policy.classify(attribute.key) === "forbidden") {
+            return yield* new InvalidDataPolicy({
+                code: "OBS_POLICY_INVALID",
+                message: "Data policy compilation failed with 1 issue(s). Fix every reported rule and compile again.",
+                issues: [
+                    {
+                        code: "OBS_POLICY_DUPLICATE_RESOURCE_ATTRIBUTE",
+                        message: "A resource attribute is invalid, duplicated, reserved, forbidden, or non-scalar.",
+                        rule: "unique-resource-attribute",
+                    },
+                ],
+            });
+        }
+        input[attribute.key] = attribute.value;
+    }
+    const decision = transformSignalFields(policy, "resource", input);
+    const parsed = new Map();
+    for (const [key, value] of Object.entries(decision.value)) {
+        if (Predicate.isString(value))
+            parsed.set(key, value);
+    }
+    return parsed;
+});

package/dist/policy/entrypoint.d.ts

@@ -0,0 +1,2 @@
+export * from "./index.js";
+export { CorrelationContext, RequestId, RunId, SpanId, TraceId, TraceLinkage, parseRequestId, parseRunId, parseSpanId, parseTraceId, } from "../Correlation.js";

package/dist/policy/entrypoint.js

@@ -0,0 +1,2 @@
+export * from "./index.js";
+export { CorrelationContext, RequestId, RunId, SpanId, TraceId, TraceLinkage, parseRequestId, parseRunId, parseSpanId, parseTraceId, } from "../Correlation.js";

package/dist/policy/index.d.ts

@@ -0,0 +1,17 @@
+export { baseDataPolicy, CurrentDataPolicy, definePolicy, parseDataPolicy } from "./DataPolicy.js";
+export type { DataPolicy, DataPolicyInput, PolicySurface } from "./DataPolicy.js";
+export { InvalidDataPolicy, PolicyIssueCode } from "./DataPolicyError.js";
+export type { PolicyIssue } from "./DataPolicyError.js";
+export { DefectEnvelope, sanitizeDefectEnvelope, unexpectedDefect } from "./DefectEnvelope.js";
+export { defectDeduplicator } from "./Deduplication.js";
+export type { DedupeDecision, DefectDeduplicator } from "./Deduplication.js";
+export type { UnexpectedDefectInput } from "./DefectEnvelope.js";
+export { metricLabelRejection } from "./MetricLabelPolicy.js";
+export type { MetricLabelRejection } from "./MetricLabelPolicy.js";
+export { sanitizeText, transformSignalFields } from "./PolicyTransform.js";
+export type { PolicyAction, PolicyDecision, PolicyRedaction, PolicyRule, } from "./PolicyTransform.js";
+export { parseResourceAttributes } from "./ResourceAttributePolicy.js";
+export type { ResourceAttribute } from "./ResourceAttributePolicy.js";
+export { ResourceIdentity, parseResourceIdentity } from "../ResourceIdentity.js";
+export type { ResourceIdentityInput } from "../ResourceIdentity.js";
+export { baseBlockedKeys, collectorBlockedKeyPattern, collectorBlockedValuePatterns, isSensitiveFieldKey, sensitiveFieldReplacement, sensitiveTextReplacement, } from "./PolicyVocabulary.js";

package/dist/policy/index.js

@@ -0,0 +1,9 @@
+export { baseDataPolicy, CurrentDataPolicy, definePolicy, parseDataPolicy } from "./DataPolicy.js";
+export { InvalidDataPolicy, PolicyIssueCode } from "./DataPolicyError.js";
+export { DefectEnvelope, sanitizeDefectEnvelope, unexpectedDefect } from "./DefectEnvelope.js";
+export { defectDeduplicator } from "./Deduplication.js";
+export { metricLabelRejection } from "./MetricLabelPolicy.js";
+export { sanitizeText, transformSignalFields } from "./PolicyTransform.js";
+export { parseResourceAttributes } from "./ResourceAttributePolicy.js";
+export { ResourceIdentity, parseResourceIdentity } from "../ResourceIdentity.js";
+export { baseBlockedKeys, collectorBlockedKeyPattern, collectorBlockedValuePatterns, isSensitiveFieldKey, sensitiveFieldReplacement, sensitiveTextReplacement, } from "./PolicyVocabulary.js";

package/dist/profile/DataPolicy.d.ts

@@ -0,0 +1,2 @@
+export { parseDataPolicy } from "../policy/DataPolicy.js";
+export type { DataPolicy, DataPolicyInput } from "../policy/DataPolicy.js";

package/dist/profile/DataPolicy.js

@@ -0,0 +1 @@
+export { parseDataPolicy } from "../policy/DataPolicy.js";

package/dist/profile/EnvironmentPolicy.d.ts

@@ -0,0 +1,22 @@
+import { Effect } from "effect";
+import type { EnvironmentVariables } from "../TelemetryConfig.js";
+import { DuplicateReleaseVariable } from "./ObservabilityConfigError.js";
+export type DeploymentScope = "local" | "remote";
+type EnvironmentPolicyResolution = {
+    readonly kind: "resolved";
+    readonly endpoint: URL;
+    readonly deployment: DeploymentScope;
+    readonly serviceVersion: string;
+    readonly environment: string;
+} | {
+    readonly kind: "missing-remote-identity";
+    readonly missing: "service-version" | "environment" | "service-version-and-environment";
+};
+export declare const deploymentScopeFromEndpoint: (endpoint: URL) => DeploymentScope;
+export declare const resolveEnvironmentPolicy: (input: {
+    readonly endpoint?: URL | undefined;
+    readonly serviceVersion?: string | undefined;
+    readonly environment?: string | undefined;
+}) => EnvironmentPolicyResolution;
+export declare const rejectSecondReleaseVariables: (env: EnvironmentVariables) => Effect.Effect<void, DuplicateReleaseVariable>;
+export {};

package/dist/profile/EnvironmentPolicy.js

@@ -0,0 +1,41 @@
+import { Effect } from "effect";
+import { DuplicateReleaseVariable, secondReleaseVariables } from "./ObservabilityConfigError.js";
+const defaultOtlpEndpoint = "http://localhost:4318";
+export const deploymentScopeFromEndpoint = (endpoint) => {
+    const hostname = endpoint.hostname;
+    return hostname === "localhost" ||
+        hostname === "localhost." ||
+        hostname === "[::1]" ||
+        /^127(?:\.\d{1,3}){3}$/.test(hostname) ||
+        /^\[::ffff:7f[0-9a-f]{2}:[0-9a-f]{1,4}\]$/.test(hostname)
+        ? "local"
+        : "remote";
+};
+export const resolveEnvironmentPolicy = (input) => {
+    const endpoint = input.endpoint ?? new URL(defaultOtlpEndpoint);
+    const deployment = deploymentScopeFromEndpoint(endpoint);
+    const serviceVersion = input.serviceVersion ?? (deployment === "local" ? "0.0.0" : undefined);
+    const environment = input.environment ?? (deployment === "local" ? "development" : undefined);
+    if (serviceVersion !== undefined && environment !== undefined) {
+        return { kind: "resolved", endpoint, deployment, serviceVersion, environment };
+    }
+    const missing = serviceVersion === undefined && environment === undefined
+        ? "service-version-and-environment"
+        : serviceVersion === undefined
+            ? "service-version"
+            : "environment";
+    return { kind: "missing-remote-identity", missing };
+};
+export const rejectSecondReleaseVariables = (env) => {
+    for (const variable of secondReleaseVariables) {
+        const value = env[variable];
+        if (value !== undefined && value !== "") {
+            return Effect.fail(new DuplicateReleaseVariable({
+                code: "OBS_TELEMETRY_DUPLICATE_RELEASE_VARIABLE",
+                variable,
+                message: `${variable} defines a second release identity. Remove it and set OTEL_SERVICE_VERSION.`,
+            }));
+        }
+    }
+    return Effect.void;
+};

package/dist/profile/LifecycleRegistry.d.ts

@@ -0,0 +1,24 @@
+import { Cause, Effect, Schema } from "effect";
+import type { OtlpExporter } from "effect/unstable/observability";
+import { type AdapterRegistration, type LifecycleReport, type StartedAdapter } from "./ObservabilityAdapter.js";
+import { InvalidObservabilityConfig } from "./ObservabilityConfigError.js";
+import { type NodeObservabilityProfile, type ObservabilityProfile } from "./ObservabilityProfile.js";
+declare const ObservabilityLifecycleError_base: Schema.Class<ObservabilityLifecycleError, Schema.TaggedStruct<"ObservabilityLifecycleError", {
+    readonly code: Schema.Literals<readonly ["OBS_OBSERVABILITY_STARTUP_FAILED", "OBS_OBSERVABILITY_CLOSED"]>;
+    readonly message: Schema.String;
+    readonly adapter: Schema.Option<Schema.brand<Schema.String, "AdapterName">>;
+    readonly cause: Schema.Defect;
+}>, Cause.YieldableError>;
+export declare class ObservabilityLifecycleError extends ObservabilityLifecycleError_base {
+}
+type AdapterValidationOptions = {
+    readonly allowTesting: boolean;
+};
+export declare const validateAdapterRegistrationKinds: (registrations: ReadonlyArray<AdapterRegistration>, options: AdapterValidationOptions) => Effect.Effect<void, InvalidObservabilityConfig>;
+export declare const validateAdapterRegistrations: (profile: ObservabilityProfile, environment: string, registrations: readonly AdapterRegistration[], options: AdapterValidationOptions) => Effect.Effect<void, InvalidObservabilityConfig, never>;
+export type LifecycleRegistry = {
+    readonly run: (operation: "flush" | "close") => Effect.Effect<LifecycleReport>;
+};
+export declare const createLifecycleRegistry: (profile: NodeObservabilityProfile, started: ReadonlyArray<StartedAdapter>, flusher: OtlpExporter.Flusher["Service"], disposeRuntime: Effect.Effect<void>) => LifecycleRegistry;
+export declare const rollbackStartedAdapters: (started: readonly StartedAdapter[]) => Effect.Effect<void, never, never>;
+export {};