@jinn-network/client 0.1.2 → 0.1.3-canary.24b69ea4

package/dist/trajectory/harness-bundle.js

@@ -0,0 +1,128 @@
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import * as path from 'node:path';
+import { getRule } from './harness-bundle-rules/types.js';
+// Side-effect imports register each rule into the central registry.
+import './harness-bundle-rules/claude-code.js';
+import './harness-bundle-rules/codex.js';
+import './harness-bundle-rules/gemini-cli.js';
+import './harness-bundle-rules/cursor.js';
+import './harness-bundle-rules/aider.js';
+import './harness-bundle-rules/continue.js';
+import { EMPTY_BUNDLE_SHA256 } from './schema.js';
+function sha256Hex(buf) {
+    return createHash('sha256').update(buf).digest('hex');
+}
+/**
+ * Returns true if `candidate` lies inside (or equals) any of the supplied
+ * allowed roots. Path comparison is exact-match-or-prefix-with-separator.
+ */
+function isUnderAllowedRoot(candidate, roots) {
+    return roots.some((root) => candidate === root || candidate.startsWith(root + path.sep));
+}
+/**
+ * Canonicalise file content for stable hashing across platforms:
+ * normalise CRLF and lone CR to LF. This means a Windows-checked-out
+ * file and a Unix-checked-out file with the same logical content
+ * produce the same sha256 — and therefore the same bundle hash.
+ */
+function canonicaliseContent(raw) {
+    const text = raw.toString('utf-8');
+    const normalised = text.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
+    return Buffer.from(normalised, 'utf-8');
+}
+/**
+ * Assemble the harness bundle for one capture.
+ *
+ * The bundle is the operator's resolved harness configuration at session
+ * capture time. Its deterministic sha256 becomes `executor.codeDigest` on
+ * the capture envelope, making the capture replayable: a third party can
+ * fetch the bundle, reconstitute the harness, and reproduce the result.
+ *
+ * Determinism contract (per spec §3.1, §3.2):
+ *   - Files canonicalised (CRLF→LF) before hashing.
+ *   - Per-file shas computed from canonical bytes.
+ *   - manifest.files sorted by relPath (locale-sensitive but locale-agnostic
+ *     for ASCII paths, which is what we expect).
+ *   - bundleSha256 = sha256(JSON.stringify(manifest with bundleSha256='')).
+ *     Two-pass: hash the zeroed manifest, then write the result back.
+ *
+ * Opt-out and empty-bundle semantics:
+ *   - enabled=false → included=false, bundleSha256=EMPTY_BUNDLE_SHA256.
+ *   - enabled=true but no candidates pass the allowedDirectories filter or
+ *     all candidates are missing on disk → included=false,
+ *     bundleSha256=EMPTY_BUNDLE_SHA256, manifest=null. The capture envelope
+ *     signals opt-out by ABSENCE of the harness-bundle artifact, not by
+ *     publishing an empty manifest.
+ */
+export async function assembleBundle(input) {
+    if (!input.enabled) {
+        return {
+            included: false,
+            bundleSha256: EMPTY_BUNDLE_SHA256,
+            manifest: null,
+            files: [],
+        };
+    }
+    const rule = getRule(input.tool);
+    const candidates = await rule.candidatePaths({
+        home: input.home,
+        repoRoot: input.repoRoot,
+    });
+    // Apply allowedDirectories filter.
+    const allowed = candidates.filter((p) => isUnderAllowedRoot(p, input.allowedDirectories));
+    // Read each allowed file; silently skip missing ones.
+    const files = [];
+    for (const abs of allowed) {
+        let raw;
+        try {
+            raw = await readFile(abs);
+        }
+        catch {
+            continue;
+        }
+        const canonical = canonicaliseContent(raw);
+        const sha = sha256Hex(canonical);
+        const relPath = path.relative(input.home, abs);
+        files.push({
+            absolutePath: abs,
+            relPath,
+            content: canonical,
+            sha256: sha,
+            bytes: canonical.length,
+        });
+    }
+    // Deterministic order for stable bundle hashing.
+    files.sort((a, b) => a.relPath.localeCompare(b.relPath));
+    if (files.length === 0) {
+        return {
+            included: false,
+            bundleSha256: EMPTY_BUNDLE_SHA256,
+            manifest: null,
+            files: [],
+        };
+    }
+    // Two-pass hashing: build manifest with bundleSha256='', hash the
+    // canonical-JSON of that, then assign the result back.
+    const manifest = {
+        schemaVersion: 'harness-bundle.v1',
+        bundleSha256: '',
+        capturePath: input.capturePath,
+        tool: { name: input.tool, version: input.toolVersion },
+        files: files.map((f) => ({
+            path: f.relPath,
+            sha256: f.sha256,
+            bytes: f.bytes,
+        })),
+    };
+    const canonicalJson = JSON.stringify({ ...manifest, bundleSha256: '' });
+    const bundleSha = sha256Hex(Buffer.from(canonicalJson, 'utf-8'));
+    manifest.bundleSha256 = bundleSha;
+    return {
+        included: true,
+        bundleSha256: bundleSha,
+        manifest,
+        files,
+    };
+}
+//# sourceMappingURL=harness-bundle.js.map

package/dist/trajectory/harness-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-bundle.js","sourceRoot":"","sources":["../../src/trajectory/harness-bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,OAAO,EAAqB,MAAM,iCAAiC,CAAC;AAC7E,oEAAoE;AACpE,OAAO,uCAAuC,CAAC;AAC/C,OAAO,iCAAiC,CAAC;AACzC,OAAO,sCAAsC,CAAC;AAC9C,OAAO,kCAAkC,CAAC;AAC1C,OAAO,iCAAiC,CAAC;AACzC,OAAO,oCAAoC,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AA8ClD,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,SAAiB,EAAE,KAAe;IAC5D,OAAO,KAAK,CAAC,IAAI,CACf,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CACtE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACtC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAoB;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,mBAAmB;YACjC,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,EAAE;SACV,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;QAC3C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IAEH,mCAAmC;IACnC,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACtC,kBAAkB,CAAC,CAAC,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAChD,CAAC;IAEF,sDAAsD;IACtD,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC;YACT,YAAY,EAAE,GAAG;YACjB,OAAO;YACP,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,SAAS,CAAC,MAAM;SACxB,CAAC,CAAC;IACL,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,mBAAmB;YACjC,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,EAAE;SACV,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,uDAAuD;IACvD,MAAM,QAAQ,GAA0B;QACtC,aAAa,EAAE,mBAAmB;QAClC,YAAY,EAAE,EAAE;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE;QACtD,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvB,IAAI,EAAE,CAAC,CAAC,OAAO;YACf,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAC;KACJ,CAAC;IAEF,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;IACjE,QAAQ,CAAC,YAAY,GAAG,SAAS,CAAC;IAElC,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,SAAS;QACvB,QAAQ;QACR,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/trajectory/hash-chain.d.ts

@@ -0,0 +1,18 @@
+/**
+ * In-run per-span hash chain.
+ *
+ * Scope: §3.1 trajectory-signing-granularity row — "each span carries
+ * jinn.prevSpanHash linking to the previous span's hash; first span
+ * links to a run-start genesis value derived from envelope task CID."
+ *
+ * Motivation: a crashed run that failed to upload the signed trajectory
+ * blob still produces a verifiable-as-prefix trace if spans are recovered
+ * elsewhere (enclave memory dump, challenger capture). Partial authenticity
+ * is not zero.
+ */
+import { type Hex } from 'viem';
+import type { Span } from './schema.js';
+/** Genesis value for the chain — keccak256(JCS({runStart: taskCid})). */
+export declare function computeGenesisHash(taskCid: string): Hex;
+/** Hash of a finalized span, to be set as jinn.prevSpanHash on the next one. */
+export declare function computePrevSpanHash(span: Span): Hex;

package/dist/trajectory/hash-chain.js

@@ -0,0 +1,23 @@
+/**
+ * In-run per-span hash chain.
+ *
+ * Scope: §3.1 trajectory-signing-granularity row — "each span carries
+ * jinn.prevSpanHash linking to the previous span's hash; first span
+ * links to a run-start genesis value derived from envelope task CID."
+ *
+ * Motivation: a crashed run that failed to upload the signed trajectory
+ * blob still produces a verifiable-as-prefix trace if spans are recovered
+ * elsewhere (enclave memory dump, challenger capture). Partial authenticity
+ * is not zero.
+ */
+import { keccak256, toBytes } from 'viem';
+import { canonicalJson } from '../harnesses/engine/canonical-json.js';
+/** Genesis value for the chain — keccak256(JCS({runStart: taskCid})). */
+export function computeGenesisHash(taskCid) {
+    return keccak256(toBytes(canonicalJson({ runStart: taskCid })));
+}
+/** Hash of a finalized span, to be set as jinn.prevSpanHash on the next one. */
+export function computePrevSpanHash(span) {
+    return keccak256(toBytes(canonicalJson(span)));
+}
+//# sourceMappingURL=hash-chain.js.map

package/dist/trajectory/hash-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash-chain.js","sourceRoot":"","sources":["../../src/trajectory/hash-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAY,MAAM,MAAM,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAGtE,yEAAyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,mBAAmB,CAAC,IAAU;IAC5C,OAAO,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC"}

package/dist/trajectory/index.d.ts

@@ -0,0 +1,28 @@
+/**
+ * trajectory/index.ts — re-exports for consumers.
+ *
+ * Import path: '../../trajectory/index.js' (or '../trajectory/index.js' etc.)
+ * from any file within client/src/.
+ */
+export { TrajectoryCollector } from './collector.js';
+export type { CollectorInit, SpanInput } from './collector.js';
+export { emitTrajectory } from './emit.js';
+export type { EmitTrajectoryParams, EmitTrajectoryResult } from './emit.js';
+export { computeGenesisHash, computePrevSpanHash } from './hash-chain.js';
+export { JinnSpanKindSchema, SpanSchema, RedactionManifestSchema, JinnTrajectoryV1Schema, UnsignedTrajectorySchema, CaptureManifestSchema, EMPTY_BUNDLE_SHA256, } from './schema.js';
+export type { JinnSpanKind, Span, RedactionManifest, JinnTrajectoryV1, UnsignedTrajectory, CaptureManifest, } from './schema.js';
+export { HarnessBundleManifestSchema, HARNESS_BUNDLE_ARTIFACT_TYPE, } from './harness-bundle-schema.js';
+export type { HarnessBundleManifest } from './harness-bundle-schema.js';
+export { SECRET_NAME_PATTERNS, isSecretKey, scrubAttributes, scrubMcpArgs, } from './secret-scrub.js';
+export { SPAN_PROFILE, validateSpanProfile, findFirstProfileViolation, } from './span-profile.js';
+export type { SpanProfileResult } from './span-profile.js';
+export { tracedHttpCall } from './wrappers/http.js';
+export type { HttpRequestLike, HttpResponseLike, GenAiAttrs, TracedHttpCallParams, } from './wrappers/http.js';
+export { tracedMcpCall } from './wrappers/mcp.js';
+export type { TracedMcpCallParams } from './wrappers/mcp.js';
+export { tracedSpawn } from './wrappers/subprocess.js';
+export type { TracedSpawnParams, TracedSpawnResult } from './wrappers/subprocess.js';
+export { createLlmProxyApp, startLlmProxyServer } from './llm-proxy.js';
+export type { LlmProxyConfig, LlmProxyServer } from './llm-proxy.js';
+export { exchangeToSpanAttributes, emitLlmProxyExchange } from './llm-proxy-spans.js';
+export type { LlmProxyExchange, LlmProxyProvider } from './llm-proxy-spans.js';

package/dist/trajectory/index.js

@@ -0,0 +1,28 @@
+/**
+ * trajectory/index.ts — re-exports for consumers.
+ *
+ * Import path: '../../trajectory/index.js' (or '../trajectory/index.js' etc.)
+ * from any file within client/src/.
+ */
+// Collector + input type
+export { TrajectoryCollector } from './collector.js';
+// Emitter
+export { emitTrajectory } from './emit.js';
+// Hash chain helpers
+export { computeGenesisHash, computePrevSpanHash } from './hash-chain.js';
+// Schema types + validators
+export { JinnSpanKindSchema, SpanSchema, RedactionManifestSchema, JinnTrajectoryV1Schema, UnsignedTrajectorySchema, CaptureManifestSchema, EMPTY_BUNDLE_SHA256, } from './schema.js';
+// Harness bundle manifest (artifact-type harness-bundle.v1)
+export { HarnessBundleManifestSchema, HARNESS_BUNDLE_ARTIFACT_TYPE, } from './harness-bundle-schema.js';
+// Secret scrub helpers
+export { SECRET_NAME_PATTERNS, isSecretKey, scrubAttributes, scrubMcpArgs, } from './secret-scrub.js';
+// Span profile checker
+export { SPAN_PROFILE, validateSpanProfile, findFirstProfileViolation, } from './span-profile.js';
+// Traced I/O wrappers
+export { tracedHttpCall } from './wrappers/http.js';
+export { tracedMcpCall } from './wrappers/mcp.js';
+export { tracedSpawn } from './wrappers/subprocess.js';
+// Path C LLM API proxy
+export { createLlmProxyApp, startLlmProxyServer } from './llm-proxy.js';
+export { exchangeToSpanAttributes, emitLlmProxyExchange } from './llm-proxy-spans.js';
+//# sourceMappingURL=index.js.map

package/dist/trajectory/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/trajectory/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,yBAAyB;AACzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAGrD,UAAU;AACV,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAG3C,qBAAqB;AACrB,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE1E,4BAA4B;AAC5B,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,uBAAuB,EACvB,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAUrB,4DAA4D;AAC5D,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,4BAA4B,CAAC;AAGpC,uBAAuB;AACvB,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,YAAY,GACb,MAAM,mBAAmB,CAAC;AAE3B,uBAAuB;AACvB,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAG3B,sBAAsB;AACtB,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAQpD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGlD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,uBAAuB;AACvB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAExE,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/trajectory/llm-proxy-spans.d.ts

@@ -0,0 +1,14 @@
+import type { Tracer } from '@opentelemetry/api';
+export type LlmProxyProvider = 'anthropic' | 'openai';
+export interface LlmProxyExchange {
+    provider: LlmProxyProvider;
+    sessionId: string;
+    method: string;
+    path: string;
+    status: number;
+    durationMs: number;
+    requestBody: string;
+    responseBody: string;
+}
+export declare function exchangeToSpanAttributes(exchange: LlmProxyExchange): Record<string, unknown>;
+export declare function emitLlmProxyExchange(tracer: Tracer, exchange: LlmProxyExchange): void;

package/dist/trajectory/llm-proxy-spans.js

@@ -0,0 +1,51 @@
+import { SpanKind } from '@opentelemetry/api';
+function parseJsonBody(body) {
+    try {
+        const parsed = JSON.parse(body);
+        return typeof parsed === 'object' && parsed !== null
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function exchangeToSpanAttributes(exchange) {
+    const request = parseJsonBody(exchange.requestBody);
+    const response = parseJsonBody(exchange.responseBody);
+    const model = typeof request?.['model'] === 'string'
+        ? request['model']
+        : typeof response?.['model'] === 'string'
+            ? response['model']
+            : undefined;
+    return {
+        'jinn.session.id': exchange.sessionId,
+        'jinn.capture.path': 'C',
+        'jinn.span.kind': 'jinn.llm_call',
+        'llm.proxy.provider': exchange.provider,
+        'http.request.method': exchange.method,
+        'url.path': exchange.path,
+        'http.response.status_code': exchange.status,
+        'duration.ms': exchange.durationMs,
+        'gen_ai.system': exchange.provider,
+        ...(model ? { 'gen_ai.request.model': model } : {}),
+        'llm.request.body': exchange.requestBody,
+        'llm.response.body': exchange.responseBody,
+    };
+}
+export function emitLlmProxyExchange(tracer, exchange) {
+    const span = tracer.startSpan('llm-proxy.request', { kind: SpanKind.CLIENT });
+    const attrs = exchangeToSpanAttributes(exchange);
+    for (const [key, value] of Object.entries(attrs)) {
+        if (typeof value === 'string' ||
+            typeof value === 'number' ||
+            typeof value === 'boolean') {
+            span.setAttribute(key, value);
+        }
+    }
+    if (exchange.status >= 400) {
+        span.setStatus({ code: 2, message: `HTTP ${exchange.status}` });
+    }
+    span.end();
+}
+//# sourceMappingURL=llm-proxy-spans.js.map

package/dist/trajectory/llm-proxy-spans.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-proxy-spans.js","sourceRoot":"","sources":["../../src/trajectory/llm-proxy-spans.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAe9C,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAA0B;IACjE,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACtD,MAAM,KAAK,GACT,OAAO,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ;QACpC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAClB,CAAC,CAAC,OAAO,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ;YACvC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACnB,CAAC,CAAC,SAAS,CAAC;IAElB,OAAO;QACL,iBAAiB,EAAE,QAAQ,CAAC,SAAS;QACrC,mBAAmB,EAAE,GAAG;QACxB,gBAAgB,EAAE,eAAe;QACjC,oBAAoB,EAAE,QAAQ,CAAC,QAAQ;QACvC,qBAAqB,EAAE,QAAQ,CAAC,MAAM;QACtC,UAAU,EAAE,QAAQ,CAAC,IAAI;QACzB,2BAA2B,EAAE,QAAQ,CAAC,MAAM;QAC5C,aAAa,EAAE,QAAQ,CAAC,UAAU;QAClC,eAAe,EAAE,QAAQ,CAAC,QAAQ;QAClC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,kBAAkB,EAAE,QAAQ,CAAC,WAAW;QACxC,mBAAmB,EAAE,QAAQ,CAAC,YAAY;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,QAA0B;IAC7E,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,OAAO,KAAK,KAAK,QAAQ;YACzB,OAAO,KAAK,KAAK,SAAS,EAC1B,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;AACb,CAAC"}

package/dist/trajectory/llm-proxy.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Path C LLM API proxy.
+ *
+ * The proxy is intentionally boring: it forwards request bytes to an upstream
+ * Anthropic/OpenAI-compatible endpoint, returns upstream response bytes
+ * unchanged, and records one exchange for the capture pipeline.
+ */
+import type { Server as HttpServer } from 'node:http';
+import { Hono } from 'hono';
+import type { Tracer } from '@opentelemetry/api';
+import { type LlmProxyExchange, type LlmProxyProvider } from './llm-proxy-spans.js';
+export interface LlmProxyConfig {
+    provider: LlmProxyProvider;
+    upstreamBaseUrl: string;
+    /**
+     * Optional tracer. When supplied, each forwarded request emits a
+     * `llm-proxy.request` span with GenAI-ish attributes.
+     */
+    tracer?: Tracer;
+    /** Test/daemon hook for observing normalized exchanges. */
+    onExchange?: (exchange: LlmProxyExchange) => void;
+}
+export interface LlmProxyServer {
+    port: number;
+    close(): Promise<void>;
+    server: HttpServer;
+}
+export declare function createLlmProxyApp(config: LlmProxyConfig): Hono;
+export declare function startLlmProxyServer(config: LlmProxyConfig & {
+    port: number;
+    bindHost?: string;
+}): Promise<LlmProxyServer>;

package/dist/trajectory/llm-proxy.js

@@ -0,0 +1,97 @@
+/**
+ * Path C LLM API proxy.
+ *
+ * The proxy is intentionally boring: it forwards request bytes to an upstream
+ * Anthropic/OpenAI-compatible endpoint, returns upstream response bytes
+ * unchanged, and records one exchange for the capture pipeline.
+ */
+import { randomUUID } from 'node:crypto';
+import { Hono } from 'hono';
+import { serve } from '@hono/node-server';
+import { emitLlmProxyExchange, } from './llm-proxy-spans.js';
+function proxyHeaders(headers) {
+    const out = new Headers();
+    for (const [key, value] of headers.entries()) {
+        const lower = key.toLowerCase();
+        if (lower === 'host' ||
+            lower === 'content-length' ||
+            lower === 'connection' ||
+            lower === 'keep-alive' ||
+            lower === 'transfer-encoding') {
+            continue;
+        }
+        out.set(key, value);
+    }
+    return out;
+}
+function responseHeaders(headers) {
+    const out = new Headers();
+    for (const [key, value] of headers.entries()) {
+        const lower = key.toLowerCase();
+        if (lower === 'transfer-encoding' || lower === 'connection')
+            continue;
+        out.set(key, value);
+    }
+    return out;
+}
+function upstreamUrl(baseUrl, path, query) {
+    const base = baseUrl.endsWith('/') ? baseUrl.slice(0, -1) : baseUrl;
+    return `${base}${path}${query}`;
+}
+export function createLlmProxyApp(config) {
+    const app = new Hono();
+    app.all('*', async (c) => {
+        const requestUrl = new URL(c.req.url);
+        const requestBody = c.req.method === 'GET' || c.req.method === 'HEAD'
+            ? ''
+            : await c.req.text();
+        const sessionId = c.req.header('x-jinn-session-id') ?? randomUUID();
+        const startedAt = Date.now();
+        const upstream = await fetch(upstreamUrl(config.upstreamBaseUrl, requestUrl.pathname, requestUrl.search), {
+            method: c.req.method,
+            headers: proxyHeaders(c.req.raw.headers),
+            body: requestBody === '' ? undefined : requestBody,
+        });
+        const responseBytes = await upstream.arrayBuffer();
+        const responseBody = Buffer.from(responseBytes).toString('utf-8');
+        const exchange = {
+            provider: config.provider,
+            sessionId,
+            method: c.req.method,
+            path: requestUrl.pathname,
+            status: upstream.status,
+            durationMs: Date.now() - startedAt,
+            requestBody,
+            responseBody,
+        };
+        config.onExchange?.(exchange);
+        if (config.tracer)
+            emitLlmProxyExchange(config.tracer, exchange);
+        return new Response(responseBytes, {
+            status: upstream.status,
+            statusText: upstream.statusText,
+            headers: responseHeaders(upstream.headers),
+        });
+    });
+    return app;
+}
+export async function startLlmProxyServer(config) {
+    const app = createLlmProxyApp(config);
+    return new Promise((resolve, reject) => {
+        const server = serve({
+            fetch: app.fetch,
+            port: config.port,
+            hostname: config.bindHost ?? '127.0.0.1',
+        }, () => {
+            const addr = server.address();
+            const actualPort = typeof addr === 'object' && addr ? addr.port : config.port;
+            resolve({
+                port: actualPort,
+                server: server,
+                close: () => new Promise((res) => server.close(() => res())),
+            });
+        });
+        server.on('error', reject);
+    });
+}
+//# sourceMappingURL=llm-proxy.js.map

package/dist/trajectory/llm-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-proxy.js","sourceRoot":"","sources":["../../src/trajectory/llm-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAE1C,OAAO,EACL,oBAAoB,GAGrB,MAAM,sBAAsB,CAAC;AAoB9B,SAAS,YAAY,CAAC,OAAgB;IACpC,MAAM,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAChC,IACE,KAAK,KAAK,MAAM;YAChB,KAAK,KAAK,gBAAgB;YAC1B,KAAK,KAAK,YAAY;YACtB,KAAK,KAAK,YAAY;YACtB,KAAK,KAAK,mBAAmB,EAC7B,CAAC;YACD,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,OAAgB;IACvC,MAAM,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,KAAK,KAAK,mBAAmB,IAAI,KAAK,KAAK,YAAY;YAAE,SAAS;QACtE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,IAAY,EAAE,KAAa;IAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACpE,OAAO,GAAG,IAAI,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAsB;IACtD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM;YACnE,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,UAAU,EAAE,CAAC;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,WAAW,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,EAC3E;YACE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;YACpB,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC;YACxC,IAAI,EAAE,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;SACnD,CACF,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAElE,MAAM,QAAQ,GAAqB;YACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS;YACT,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;YACpB,IAAI,EAAE,UAAU,CAAC,QAAQ;YACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAClC,WAAW;YACX,YAAY;SACb,CAAC;QACF,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,MAAM;YAAE,oBAAoB,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjE,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC;SAC3C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAA4D;IAE5D,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC;YACnB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,WAAW;SACzC,EAAE,GAAG,EAAE;YACN,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;YAC9E,OAAO,CAAC;gBACN,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,MAAoB;gBAC5B,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;aACnE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/trajectory/processors/credential-scrub.d.ts

@@ -0,0 +1,11 @@
+import { ReadableSpan, SpanProcessor } from '@opentelemetry/sdk-trace-base';
+export declare const CREDENTIAL_SCRUB_VERSION = "1.0.0";
+export declare const CREDENTIAL_REDACTED = "<REDACTED>";
+export declare function normalizeCredentialKey(key: string): string;
+export declare function isSensitiveCredentialKey(key: string): boolean;
+export declare class CredentialScrubProcessor implements SpanProcessor {
+    forceFlush(): Promise<void>;
+    shutdown(): Promise<void>;
+    onStart(): void;
+    onEnd(span: ReadableSpan): void;
+}

package/dist/trajectory/processors/credential-scrub.js

@@ -0,0 +1,40 @@
+export const CREDENTIAL_SCRUB_VERSION = '1.0.0';
+// Patterns are matched against a normalized form of the attribute key
+// (lowercased, with non-alphanumerics stripped) so compound keys like
+// "X-Api-Key", "auth.token", and "http.request.header.authorization" all
+// match the same set of substrings as their bare-word counterparts.
+const SENSITIVE_KEY_PATTERNS = [
+    /authorization/,
+    /apikey/,
+    /bearer/,
+    /password/,
+    /secret/,
+    /token/,
+    /privatekey/,
+];
+export const CREDENTIAL_REDACTED = '<REDACTED>';
+export function normalizeCredentialKey(key) {
+    return key.toLowerCase().replace(/[^a-z0-9]/g, '');
+}
+export function isSensitiveCredentialKey(key) {
+    const normalized = normalizeCredentialKey(key);
+    return SENSITIVE_KEY_PATTERNS.some((p) => p.test(normalized));
+}
+export class CredentialScrubProcessor {
+    forceFlush() {
+        return Promise.resolve();
+    }
+    shutdown() {
+        return Promise.resolve();
+    }
+    onStart() { }
+    onEnd(span) {
+        const attrs = span.attributes;
+        for (const key of Object.keys(attrs)) {
+            if (isSensitiveCredentialKey(key)) {
+                attrs[key] = CREDENTIAL_REDACTED;
+            }
+        }
+    }
+}
+//# sourceMappingURL=credential-scrub.js.map

package/dist/trajectory/processors/credential-scrub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-scrub.js","sourceRoot":"","sources":["../../../src/trajectory/processors/credential-scrub.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAEhD,sEAAsE;AACtE,sEAAsE;AACtE,yEAAyE;AACzE,oEAAoE;AACpE,MAAM,sBAAsB,GAAG;IAC7B,eAAe;IACf,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,OAAO;IACP,YAAY;CACb,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAEhD,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC/C,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,OAAO,wBAAwB;IACnC,UAAU;QACR,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,QAAQ;QACN,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,OAAO,KAAI,CAAC;IAEZ,KAAK,CAAC,IAAkB;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAqC,CAAC;QACzD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,KAAK,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/trajectory/processors/identity-scrub.d.ts

@@ -0,0 +1,18 @@
+import { ReadableSpan, SpanProcessor } from '@opentelemetry/sdk-trace-base';
+export declare const IDENTITY_SCRUB_VERSION = "1.0.0";
+export interface IdentityScrubConfig {
+    username?: string;
+    hostname?: string;
+    machineId?: string;
+    gitAuthorName?: string;
+    gitAuthorEmail?: string;
+}
+export declare function scrubIdentityString(s: string, cfg: IdentityScrubConfig): string;
+export declare class IdentityScrubProcessor implements SpanProcessor {
+    private readonly cfg;
+    constructor(cfg: IdentityScrubConfig);
+    forceFlush(): Promise<void>;
+    shutdown(): Promise<void>;
+    onStart(): void;
+    onEnd(span: ReadableSpan): void;
+}

package/dist/trajectory/processors/identity-scrub.js

@@ -0,0 +1,43 @@
+export const IDENTITY_SCRUB_VERSION = '1.0.0';
+// Octet-bounded so version strings like "22.1.0.0" don't trigger false positives
+// — each segment must be a valid 0-255 octet.
+const IPV4_PATTERN = /\b(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]\d|\d)\b/g;
+export function scrubIdentityString(s, cfg) {
+    // Order matters: email and full git-author name resolve first as
+    // composite identifiers. Email-before-username avoids mangling addresses
+    // whose local-part matches a username; gitAuthorName-before-hostname/
+    // machineId avoids the symmetric trap where a name fragment is masked
+    // by an earlier scrub.
+    let out = s;
+    if (cfg.gitAuthorEmail)
+        out = out.split(cfg.gitAuthorEmail).join('<EMAIL>');
+    if (cfg.gitAuthorName)
+        out = out.split(cfg.gitAuthorName).join('<AUTHOR>');
+    if (cfg.username)
+        out = out.split(cfg.username).join('<USER>');
+    if (cfg.hostname)
+        out = out.split(cfg.hostname).join('<HOST>');
+    if (cfg.machineId)
+        out = out.split(cfg.machineId).join('<MACHINE>');
+    out = out.replace(IPV4_PATTERN, '<IPV4>');
+    return out;
+}
+export class IdentityScrubProcessor {
+    cfg;
+    constructor(cfg) {
+        this.cfg = cfg;
+    }
+    forceFlush() { return Promise.resolve(); }
+    shutdown() { return Promise.resolve(); }
+    onStart() { }
+    onEnd(span) {
+        const attrs = span.attributes;
+        for (const key of Object.keys(attrs)) {
+            const v = attrs[key];
+            if (typeof v === 'string') {
+                attrs[key] = scrubIdentityString(v, this.cfg);
+            }
+        }
+    }
+}
+//# sourceMappingURL=identity-scrub.js.map

package/dist/trajectory/processors/identity-scrub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-scrub.js","sourceRoot":"","sources":["../../../src/trajectory/processors/identity-scrub.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAU9C,iFAAiF;AACjF,8CAA8C;AAC9C,MAAM,YAAY,GAChB,0FAA0F,CAAC;AAE7F,MAAM,UAAU,mBAAmB,CAAC,CAAS,EAAE,GAAwB;IACrE,iEAAiE;IACjE,yEAAyE;IACzE,sEAAsE;IACtE,sEAAsE;IACtE,uBAAuB;IACvB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,GAAG,CAAC,cAAc;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5E,IAAI,GAAG,CAAC,aAAa;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3E,IAAI,GAAG,CAAC,QAAQ;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,GAAG,CAAC,QAAQ;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,GAAG,CAAC,SAAS;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC1C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,sBAAsB;IACJ;IAA7B,YAA6B,GAAwB;QAAxB,QAAG,GAAH,GAAG,CAAqB;IAAG,CAAC;IAEzD,UAAU,KAAK,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC1C,QAAQ,KAAK,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACxC,OAAO,KAAI,CAAC;IAEZ,KAAK,CAAC,IAAkB;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAqC,CAAC;QACzD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;YACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC1B,KAAK,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/trajectory/processors/manifest-builder.d.ts

@@ -0,0 +1,18 @@
+import { ReadableSpan, SpanProcessor } from '@opentelemetry/sdk-trace-base';
+export declare const MANIFEST_BUILDER_VERSION = "1.0.0";
+export interface SpanRedactionRecord {
+    spanId: string;
+    redactedKeys: string[];
+}
+export interface RedactionManifest {
+    spans: SpanRedactionRecord[];
+}
+export declare class ManifestBuilderProcessor implements SpanProcessor {
+    private readonly records;
+    forceFlush(): Promise<void>;
+    shutdown(): Promise<void>;
+    onStart(): void;
+    onEnd(span: ReadableSpan): void;
+    /** Drain accumulated records into a manifest and reset internal state. */
+    flushManifest(): RedactionManifest;
+}

package/dist/trajectory/processors/manifest-builder.js

@@ -0,0 +1,26 @@
+import { SENTINEL_PATTERN } from './sentinel.js';
+export const MANIFEST_BUILDER_VERSION = '1.0.0';
+export class ManifestBuilderProcessor {
+    records = [];
+    forceFlush() { return Promise.resolve(); }
+    shutdown() { return Promise.resolve(); }
+    onStart() { }
+    onEnd(span) {
+        const redactedKeys = [];
+        for (const [k, v] of Object.entries(span.attributes)) {
+            if (typeof v === 'string' && SENTINEL_PATTERN.test(v)) {
+                redactedKeys.push(k);
+            }
+        }
+        if (redactedKeys.length > 0) {
+            this.records.push({ spanId: span.spanContext().spanId, redactedKeys });
+        }
+    }
+    /** Drain accumulated records into a manifest and reset internal state. */
+    flushManifest() {
+        const out = { spans: this.records.slice() };
+        this.records.length = 0;
+        return out;
+    }
+}
+//# sourceMappingURL=manifest-builder.js.map

package/dist/trajectory/processors/manifest-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-builder.js","sourceRoot":"","sources":["../../../src/trajectory/processors/manifest-builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAWhD,MAAM,OAAO,wBAAwB;IAClB,OAAO,GAA0B,EAAE,CAAC;IAErD,UAAU,KAAK,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC1C,QAAQ,KAAK,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACxC,OAAO,KAAI,CAAC;IAEZ,KAAK,CAAC,IAAkB;QACtB,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACrD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtD,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,aAAa;QACX,MAAM,GAAG,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACxB,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}