@ory/argus 0.14.0 → 1.0.0

package/dist/event-reporter.js

@@ -0,0 +1,776 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AgentSecurityEventReporter = exports.SERVER_ACTIVITY_EVENTS = void 0;
+exports.projectActivityEntry = projectActivityEntry;
+exports.eventOutboxProjectScope = eventOutboxProjectScope;
+exports.eventPrincipalKey = eventPrincipalKey;
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+exports.SERVER_ACTIVITY_EVENTS = new Set([
+    "session.start", "session.end", "session.verify",
+    "tool.invoke", "tool.complete", "tool.block", "tool.fail",
+    "subagent.start", "subagent.stop",
+    "user.auth", "agent.auth", "agent.session.retire", "agent.retired.drain",
+    "oauth2.login", "oauth2.refresh", "oauth2.introspect",
+    "permission.mode_resolve", "permission.observe_deny", "permission.block_observed",
+    "bash.parser_unavailable", "user.interaction",
+]);
+const STRING_ATTRIBUTES = new Set([
+    "blockReason", "composerMode", "harness", "kind", "mcpServer", "mcpTool",
+    "mode", "model", "permissionMode", "source", "stage", "status",
+    "subAgentType", "toolName", "trigger", "alertKind", "severity",
+    "blockedPrincipalLevel", "failureType", "namespace", "relation", "reasonCode",
+    "scope", "postureSource", "object", "revoke", "delegation", "delegationKind",
+]);
+const HASH_ATTRIBUTES = new Set([
+    "bashCommandHash", "inputHash", "outputHash", "filePathHash", "urlHostHash",
+    "errorHash", "reasonHash", "blockedPrincipalHash", "subjectHash",
+]);
+const NUMBER_ATTRIBUTES = new Set([
+    "bashCommandBytes", "bashExitCode", "bashStderrBytes", "bashStdoutBytes", "count",
+    "durationMs", "inputBytes", "outputBytes", "responseLen", "shellCommandCount", "summaryLen",
+    "filePathBytes", "errorBytes", "reasonBytes", "executionTimeMs",
+    "blockedPrincipalBytes", "subjectBytes", "retired", "keep", "queued", "revoked",
+    "expiresAt", "warningsCount",
+]);
+const BOOL_ATTRIBUTES = new Set([
+    "active", "allowed", "hasOutput", "observed", "securityConnected", "shellTooComplex",
+    "alert", "blocked", "checkRejected", "hasError", "success",
+    "enforceGranted", "proceed", "interactive",
+]);
+const ARRAY_ATTRIBUTES = new Set(["shellWords", "shellDeniedWords", "warningsHashes"]);
+const SAFE_STRING = /^[A-Za-z0-9][A-Za-z0-9._:/@-]{0,254}$/;
+const HASH = /^[a-f0-9]{16}$/;
+const MAX_EVENT_AGE_MS = 24 * 60 * 60 * 1_000;
+const MAX_FUTURE_SKEW_MS = 5 * 60 * 1_000;
+const MAX_NUMBER = 1e12;
+const DEFAULT_QUEUE_SIZE = 1_000;
+const DEFAULT_REQUEST_TIMEOUT_MS = 10_000;
+const DEFAULT_RETRY_BASE_MS = 250;
+const DEFAULT_RETRY_MAX_MS = 30_000;
+const LOCK_HEARTBEAT_MS = 15_000;
+const LOCK_STALE_MS = 60_000;
+const EVENT_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const ACTIVITY_STATUSES = new Set(["ok", "error", "denied", "skipped"]);
+/** Best-effort delivery of privacy-safe client activity to Agent Security. */
+class AgentSecurityEventReporter {
+    options;
+    queue = [];
+    fetcher;
+    maxQueueSize;
+    requestTimeoutMs;
+    now;
+    eventId;
+    delivery;
+    scheduled = false;
+    activeRequest;
+    flushDeadline;
+    suppressRetry = false;
+    retryTimer;
+    retryAttempt = 0;
+    retryBaseMs;
+    retryMaxMs;
+    random;
+    constructor(options) {
+        this.options = options;
+        this.fetcher = options.fetch ?? globalThis.fetch;
+        this.maxQueueSize = Math.max(1, Math.floor(options.maxQueueSize ?? DEFAULT_QUEUE_SIZE));
+        this.requestTimeoutMs = Math.max(1, options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS);
+        this.now = options.now ?? Date.now;
+        this.eventId = options.eventId ?? node_crypto_1.randomUUID;
+        this.retryBaseMs = Math.max(1, options.retryBaseMs ?? DEFAULT_RETRY_BASE_MS);
+        this.retryMaxMs = Math.max(this.retryBaseMs, options.retryMaxMs ?? DEFAULT_RETRY_MAX_MS);
+        this.random = options.random ?? Math.random;
+        this.syncOutbox();
+    }
+    get pending() {
+        return this.queue.length;
+    }
+    get pendingScopes() {
+        const scopes = new Map();
+        for (const pending of this.queue) {
+            const scope = pendingScope(pending);
+            scopes.set(scopeKey(scope), scope);
+        }
+        return [...scopes.values()];
+    }
+    enqueue(entry, principalKey) {
+        try {
+            const event = projectActivityEntry(entry, this.eventId);
+            if (!event)
+                return;
+            const occurredAt = Date.parse(event.occurred_at);
+            if (!Number.isFinite(occurredAt) || occurredAt > this.now() + MAX_FUTURE_SKEW_MS)
+                return;
+            this.prune();
+            const pending = {
+                event,
+                ...(principalKey ? { principalKey } : {}),
+            };
+            const file = this.persist(pending);
+            this.queue.push({ ...pending, file });
+            this.enforceBounds();
+            if (this.retryTimer) {
+                clearTimeout(this.retryTimer);
+                this.retryTimer = undefined;
+            }
+            this.schedule();
+        }
+        catch (error) {
+            this.diagnostic("events.enqueue_failed", error);
+        }
+    }
+    /** Attempt all currently deliverable batches, bounded by the caller's deadline. */
+    async flush(timeoutMs = DEFAULT_REQUEST_TIMEOUT_MS) {
+        if (timeoutMs <= 0)
+            return;
+        const deadline = Date.now() + timeoutMs;
+        this.flushDeadline = this.flushDeadline === undefined
+            ? deadline
+            : Math.min(this.flushDeadline, deadline);
+        if (this.retryTimer) {
+            clearTimeout(this.retryTimer);
+            this.retryTimer = undefined;
+        }
+        const work = this.delivery ?? this.startDelivery();
+        let timer;
+        await Promise.race([
+            work,
+            new Promise((resolve) => {
+                timer = setTimeout(() => {
+                    this.suppressRetry = true;
+                    this.activeRequest?.abort();
+                    resolve();
+                }, timeoutMs);
+                timer.unref?.();
+            }),
+        ]);
+        if (timer)
+            clearTimeout(timer);
+        if (this.flushDeadline === deadline)
+            this.flushDeadline = undefined;
+    }
+    schedule() {
+        if (this.scheduled || this.delivery)
+            return;
+        this.scheduled = true;
+        queueMicrotask(() => {
+            this.scheduled = false;
+            if (!this.delivery)
+                this.startDelivery();
+        });
+    }
+    startDelivery() {
+        let shouldRetry = false;
+        const work = this.drain().then((retry) => {
+            shouldRetry = retry;
+        }).catch((error) => {
+            shouldRetry = true;
+            this.diagnostic("events.delivery_failed", error);
+        });
+        this.delivery = work;
+        void work.finally(() => {
+            if (this.delivery === work)
+                this.delivery = undefined;
+            this.suppressRetry = false;
+            if (this.queue.length === 0)
+                this.retryAttempt = 0;
+            else if (shouldRetry)
+                this.scheduleRetry();
+        }).catch(() => undefined);
+        return work;
+    }
+    scheduleRetry() {
+        if (this.retryTimer || this.delivery || this.queue.length === 0)
+            return;
+        const ceiling = Math.min(this.retryMaxMs, this.retryBaseMs * 2 ** this.retryAttempt++);
+        const delay = Math.max(1, Math.floor(ceiling * (0.5 + this.random() * 0.5)));
+        this.retryTimer = setTimeout(() => {
+            this.retryTimer = undefined;
+            if (!this.delivery)
+                this.startDelivery();
+        }, delay);
+        this.retryTimer.unref?.();
+    }
+    async drain() {
+        const releaseDelivery = this.acquireOutboxLock("delivery");
+        if (this.options.outboxDir && !releaseDelivery)
+            return true;
+        let shouldRetry = false;
+        try {
+            this.prune();
+            const retainedScopes = new Set();
+            while (this.queue.length > 0) {
+                const first = this.queue.find((pending) => !retainedScopes.has(scopeKey(pendingScope(pending))));
+                if (!first)
+                    return shouldRetry;
+                const scope = pendingScope(first);
+                const key = scopeKey(scope);
+                const batch = this.queue
+                    .filter((pending) => scopeKey(pendingScope(pending)) === key)
+                    .slice(0, 100);
+                const result = await this.deliver(batch.map(({ event }) => event), scope);
+                shouldRetry ||= result.retry;
+                if (result.remove.size === 0) {
+                    retainedScopes.add(key);
+                    continue;
+                }
+                for (const pending of batch) {
+                    if (result.remove.has(pending.event.event_id))
+                        this.removeFile(pending.file);
+                }
+                for (let index = this.queue.length - 1; index >= 0; index--) {
+                    if (result.remove.has(this.queue[index].event.event_id))
+                        this.queue.splice(index, 1);
+                }
+                if (result.remove.size < batch.length)
+                    retainedScopes.add(key);
+            }
+            return shouldRetry;
+        }
+        finally {
+            releaseDelivery?.();
+        }
+    }
+    async deliver(batch, scope) {
+        try {
+            const result = await this.request(batch, scope);
+            if (result === "accepted") {
+                return { remove: new Set(batch.map((event) => event.event_id)), retry: false };
+            }
+            if (result === "reject" && batch.length === 1) {
+                return { remove: new Set([batch[0].event_id]), retry: false };
+            }
+            if (result === "reject") {
+                const remove = new Set();
+                let retry = false;
+                for (const event of batch) {
+                    const isolated = await this.deliver([event], scope);
+                    for (const eventId of isolated.remove)
+                        remove.add(eventId);
+                    retry ||= isolated.retry;
+                }
+                return { remove, retry };
+            }
+            return { remove: new Set(), retry: result === "retain" || result === "retry" };
+        }
+        catch (error) {
+            this.diagnostic("events.delivery_failed", error);
+            return { remove: new Set(), retry: true };
+        }
+    }
+    async request(batch, scope) {
+        const token = this.options.token?.(scope.sessionId, scope.principalKey);
+        const authenticatedRequest = this.options.request;
+        if (!token && !authenticatedRequest)
+            return "retain";
+        const controller = new AbortController();
+        this.activeRequest = controller;
+        const remaining = this.flushDeadline === undefined
+            ? this.requestTimeoutMs
+            : Math.max(1, Math.min(this.requestTimeoutMs, this.flushDeadline - Date.now()));
+        const timeout = setTimeout(() => controller.abort(), remaining);
+        timeout.unref?.();
+        try {
+            const url = `${this.options.agentSecurityUrl.replace(/\/+$/, "")}/agent-security/v1/events:record`;
+            const init = {
+                method: "POST",
+                headers: {
+                    "content-type": "application/json",
+                    ...(token ? { authorization: `Bearer ${token}` } : {}),
+                },
+                body: JSON.stringify({ project_url: this.options.projectUrl, events: batch }),
+                signal: controller.signal,
+            };
+            const authenticatedResponse = authenticatedRequest?.(url, init, scope.sessionId, scope.principalKey);
+            const response = authenticatedResponse
+                ? await authenticatedResponse
+                : token
+                    ? await this.fetcher(url, init)
+                    : undefined;
+            if (!response)
+                return "retain";
+            if (response.status === 400 || response.status === 409 || response.status === 415) {
+                this.diagnostic("events.batch_rejected", new Error(`HTTP ${response.status}`));
+                return "reject";
+            }
+            if (response.status === 401) {
+                try {
+                    if (token)
+                        this.options.onUnauthorized?.(scope.sessionId, scope.principalKey, token);
+                }
+                catch (error) {
+                    this.diagnostic("events.credential_invalidation_failed", error);
+                }
+                return "retain";
+            }
+            if (response.status === 429 || (response.status >= 500 && response.status <= 599)) {
+                return "retry";
+            }
+            if (response.status !== 202) {
+                this.diagnostic("events.delivery_failed", new Error(`HTTP ${response.status}`));
+                return "retain";
+            }
+            let body;
+            try {
+                body = await abortable(response.json(), controller.signal);
+            }
+            catch {
+                return "retain";
+            }
+            const ids = body?.event_ids;
+            if (!Array.isArray(ids)
+                || ids.length !== batch.length
+                || ids.some((id, index) => id !== batch[index].event_id)) {
+                this.diagnostic("events.invalid_response", new Error("response event IDs did not match request order"));
+                return "retain";
+            }
+            return "accepted";
+        }
+        finally {
+            clearTimeout(timeout);
+            if (this.activeRequest === controller)
+                this.activeRequest = undefined;
+        }
+    }
+    persist(pending) {
+        const dir = this.options.outboxDir;
+        if (!dir || !EVENT_ID.test(pending.event.event_id))
+            return undefined;
+        const file = path.join(dir, `${pending.event.event_id}.json`);
+        const temporary = path.join(dir, `.${pending.event.event_id}.${process.pid}.${(0, node_crypto_1.randomUUID)()}.tmp`);
+        let descriptor;
+        try {
+            fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+            descriptor = fs.openSync(temporary, "wx", 0o600);
+            fs.writeFileSync(descriptor, JSON.stringify({
+                event: pending.event,
+                ...(pending.principalKey ? { principal_key: pending.principalKey } : {}),
+            }), "utf8");
+            fs.fsyncSync(descriptor);
+            fs.closeSync(descriptor);
+            descriptor = undefined;
+            fs.renameSync(temporary, file);
+            fsyncDirectory(dir);
+            return file;
+        }
+        catch (error) {
+            if (descriptor !== undefined) {
+                try {
+                    fs.closeSync(descriptor);
+                }
+                catch { /* best effort */ }
+            }
+            this.removeFile(temporary);
+            this.diagnostic("events.outbox_write_failed", error);
+            return undefined;
+        }
+    }
+    syncOutbox() {
+        const dir = this.options.outboxDir;
+        if (!dir)
+            return;
+        const releaseMaintenance = this.acquireOutboxLock("maintenance");
+        if (!releaseMaintenance)
+            return;
+        try {
+            let names;
+            try {
+                names = fs.readdirSync(dir);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT") {
+                    this.diagnostic("events.outbox_read_failed", error);
+                }
+                return;
+            }
+            const cutoff = this.now() - MAX_EVENT_AGE_MS;
+            const loaded = [];
+            for (const name of names) {
+                const file = path.join(dir, name);
+                if (name.endsWith(".tmp")) {
+                    try {
+                        if (fs.statSync(file).mtimeMs < cutoff)
+                            this.removeFile(file);
+                    }
+                    catch {
+                        // A concurrent writer may have renamed its temporary file already.
+                    }
+                    continue;
+                }
+                if (!name.endsWith(".json"))
+                    continue;
+                try {
+                    const stored = JSON.parse(fs.readFileSync(file, "utf8"));
+                    const pending = parsePendingEvent(stored);
+                    if (!pending || name !== `${pending.event.event_id}.json`) {
+                        this.removeFile(file);
+                        continue;
+                    }
+                    const timestamp = Date.parse(pending.event.occurred_at);
+                    if (!Number.isFinite(timestamp)
+                        || timestamp < cutoff
+                        || timestamp > this.now() + MAX_FUTURE_SKEW_MS) {
+                        this.removeFile(file);
+                        continue;
+                    }
+                    loaded.push({ ...pending, file });
+                }
+                catch {
+                    this.removeFile(file);
+                }
+            }
+            loaded.sort(comparePending);
+            for (const pending of loaded.splice(0, Math.max(0, loaded.length - this.maxQueueSize))) {
+                this.removeFile(pending.file);
+            }
+            const files = new Set(loaded.map(({ file }) => file));
+            for (let index = this.queue.length - 1; index >= 0; index--) {
+                const file = this.queue[index].file;
+                if (file && !files.has(file))
+                    this.queue.splice(index, 1);
+            }
+            const ids = new Set(this.queue.map(({ event }) => event.event_id));
+            for (const pending of loaded) {
+                if (!ids.has(pending.event.event_id))
+                    this.queue.push(pending);
+            }
+            this.queue.sort(comparePending);
+        }
+        finally {
+            releaseMaintenance();
+        }
+    }
+    acquireOutboxLock(name) {
+        const dir = this.options.outboxDir;
+        if (!dir)
+            return () => undefined;
+        const lock = path.join(dir, `.${name}.lock`);
+        try {
+            fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+            this.cleanRenamedLocks(lock);
+            for (let attempt = 0; attempt < 2; attempt++) {
+                const token = (0, node_crypto_1.randomUUID)();
+                try {
+                    fs.mkdirSync(lock, { mode: 0o700 });
+                    const owner = path.join(lock, "owner");
+                    let descriptor;
+                    try {
+                        descriptor = fs.openSync(owner, "wx+", 0o600);
+                        fs.writeFileSync(descriptor, token, "utf8");
+                        fs.fsyncSync(descriptor);
+                    }
+                    catch (error) {
+                        if (descriptor !== undefined)
+                            fs.closeSync(descriptor);
+                        fs.rmSync(lock, { recursive: true, force: true });
+                        throw error;
+                    }
+                    const ownerDescriptor = descriptor;
+                    const heartbeat = setInterval(() => {
+                        try {
+                            if (ownsLockPath(ownerDescriptor, owner, token)) {
+                                const now = new Date();
+                                fs.futimesSync(ownerDescriptor, now, now);
+                            }
+                        }
+                        catch { /* best effort */ }
+                    }, LOCK_HEARTBEAT_MS);
+                    heartbeat.unref?.();
+                    return () => {
+                        clearInterval(heartbeat);
+                        try {
+                            if (ownsLockPath(ownerDescriptor, owner, token)) {
+                                fs.unlinkSync(owner);
+                                fs.rmdirSync(lock);
+                            }
+                        }
+                        catch { /* best effort */ }
+                        try {
+                            fs.closeSync(ownerDescriptor);
+                        }
+                        catch { /* best effort */ }
+                        this.cleanRenamedLocks(lock);
+                    };
+                }
+                catch (error) {
+                    if (error.code !== "EEXIST")
+                        throw error;
+                    try {
+                        const owner = path.join(lock, "owner");
+                        let modified;
+                        try {
+                            modified = fs.statSync(owner).mtimeMs;
+                        }
+                        catch {
+                            modified = fs.statSync(lock).mtimeMs;
+                        }
+                        if (this.now() - modified <= LOCK_STALE_MS)
+                            return undefined;
+                        const stale = `${lock}.stale.${(0, node_crypto_1.randomUUID)()}`;
+                        fs.renameSync(lock, stale);
+                        fs.rmSync(stale, { recursive: true, force: true });
+                    }
+                    catch (takeoverError) {
+                        if (takeoverError.code !== "ENOENT")
+                            return undefined;
+                    }
+                }
+            }
+        }
+        catch (error) {
+            this.diagnostic("events.outbox_lock_failed", error);
+        }
+        return undefined;
+    }
+    cleanRenamedLocks(lock) {
+        const prefix = `${path.basename(lock)}.stale.`;
+        try {
+            for (const name of fs.readdirSync(path.dirname(lock))) {
+                if (name.startsWith(prefix)) {
+                    fs.rmSync(path.join(path.dirname(lock), name), { recursive: true, force: true });
+                }
+            }
+        }
+        catch { /* best effort */ }
+    }
+    enforceBounds() {
+        this.syncOutbox();
+        this.queue.sort(comparePending);
+        while (this.queue.length > this.maxQueueSize) {
+            const removed = this.queue.shift();
+            this.removeFile(removed?.file);
+        }
+    }
+    removeFile(file) {
+        if (!file)
+            return;
+        try {
+            fs.unlinkSync(file);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT") {
+                this.diagnostic("events.outbox_delete_failed", error);
+            }
+        }
+    }
+    prune() {
+        this.syncOutbox();
+        const cutoff = this.now() - MAX_EVENT_AGE_MS;
+        for (let index = this.queue.length - 1; index >= 0; index--) {
+            const timestamp = Date.parse(this.queue[index].event.occurred_at);
+            if (!Number.isFinite(timestamp) || timestamp < cutoff) {
+                this.removeFile(this.queue[index].file);
+                this.queue.splice(index, 1);
+            }
+        }
+    }
+    diagnostic(event, error) {
+        this.options.logger?.debug(event, {
+            message: error instanceof Error ? error.message : String(error),
+            pending: this.queue.length,
+        });
+    }
+}
+exports.AgentSecurityEventReporter = AgentSecurityEventReporter;
+function ownsLockPath(descriptor, owner, token) {
+    const opened = fs.fstatSync(descriptor);
+    const current = fs.statSync(owner);
+    if (opened.dev !== current.dev || opened.ino !== current.ino)
+        return false;
+    const buffer = Buffer.alloc(Buffer.byteLength(token));
+    return fs.readSync(descriptor, buffer, 0, buffer.length, 0) === buffer.length
+        && buffer.toString("utf8") === token;
+}
+function fsyncDirectory(directory) {
+    let descriptor;
+    try {
+        descriptor = fs.openSync(directory, "r");
+        fs.fsyncSync(descriptor);
+    }
+    catch {
+        // Some platforms do not permit opening or syncing a directory.
+    }
+    finally {
+        if (descriptor !== undefined)
+            fs.closeSync(descriptor);
+    }
+}
+function comparePending(left, right) {
+    return Date.parse(left.event.occurred_at) - Date.parse(right.event.occurred_at)
+        || left.event.event_id.localeCompare(right.event.event_id);
+}
+function pendingScope(pending) {
+    return {
+        ...(pending.event.session_id ? { sessionId: pending.event.session_id } : {}),
+        ...(pending.principalKey ? { principalKey: pending.principalKey } : {}),
+    };
+}
+function scopeKey(scope) {
+    return `${scope.sessionId ?? ""}\u0000${scope.principalKey ?? ""}`;
+}
+function parsePendingEvent(value) {
+    // Accept the original event-only format so an upgrade can drain an existing outbox.
+    if (isServerActivityEvent(value))
+        return { event: value };
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const stored = value;
+    if (Object.keys(stored).some((key) => !["event", "principal_key"].includes(key))) {
+        return undefined;
+    }
+    if (!isServerActivityEvent(stored.event))
+        return undefined;
+    if (stored.principal_key !== undefined
+        && (typeof stored.principal_key !== "string" || !/^[a-f0-9]{32}$/.test(stored.principal_key))) {
+        return undefined;
+    }
+    return {
+        event: stored.event,
+        ...(stored.principal_key ? { principalKey: stored.principal_key } : {}),
+    };
+}
+function isServerActivityEvent(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const event = value;
+    if (Object.keys(event).some((key) => ![
+        "event_id", "name", "status", "occurred_at", "session_id", "attributes",
+    ].includes(key)))
+        return false;
+    if (typeof event.event_id !== "string" || !EVENT_ID.test(event.event_id)
+        || typeof event.name !== "string" || !exports.SERVER_ACTIVITY_EVENTS.has(event.name)
+        || typeof event.status !== "string" || !ACTIVITY_STATUSES.has(event.status)
+        || typeof event.occurred_at !== "string"
+        || (event.session_id !== undefined
+            && (typeof event.session_id !== "string" || event.session_id.length > 512)))
+        return false;
+    if (event.attributes === undefined)
+        return true;
+    if (!event.attributes || typeof event.attributes !== "object" || Array.isArray(event.attributes)) {
+        return false;
+    }
+    const attributes = event.attributes;
+    const projected = projectAttributes(attributes);
+    return Object.keys(projected).length === Object.keys(attributes).length
+        && Object.entries(projected).every(([key, item]) => attributes[key] === item);
+}
+function abortable(promise, signal) {
+    if (signal.aborted)
+        return Promise.reject(signal.reason);
+    return new Promise((resolve, reject) => {
+        const abort = () => reject(signal.reason);
+        signal.addEventListener("abort", abort, { once: true });
+        promise.then((value) => {
+            signal.removeEventListener("abort", abort);
+            resolve(value);
+        }, (error) => {
+            signal.removeEventListener("abort", abort);
+            reject(error);
+        });
+    });
+}
+function projectActivityEntry(entry, createEventId = node_crypto_1.randomUUID) {
+    if (!exports.SERVER_ACTIVITY_EVENTS.has(entry.event))
+        return undefined;
+    const suppliedDuration = entry.attributes?.durationMs;
+    const durationMs = entry.durationMs > 0
+        ? entry.durationMs
+        : typeof suppliedDuration === "number"
+            ? suppliedDuration
+            : entry.durationMs;
+    const attributes = projectAttributes({
+        ...entry.attributes,
+        harness: entry.harness,
+        durationMs,
+    });
+    const timestamp = Date.parse(entry.timestamp);
+    const occurredAt = entry.durationMs === 0
+        && durationMs > 0
+        && Number.isFinite(timestamp)
+        ? new Date(timestamp - durationMs).toISOString()
+        : entry.timestamp;
+    return {
+        event_id: createEventId(),
+        name: entry.event,
+        status: entry.status,
+        occurred_at: occurredAt,
+        ...(entry.sessionId !== undefined && entry.sessionId.length <= 512
+            ? { session_id: entry.sessionId }
+            : {}),
+        ...(Object.keys(attributes).length > 0 ? { attributes } : {}),
+    };
+}
+/** Stable, non-identifying directory name that prevents cross-project replay. */
+function eventOutboxProjectScope(projectUrl) {
+    return (0, node_crypto_1.createHash)("sha256").update(projectUrl).digest("hex").slice(0, 16);
+}
+/** Stable local selector for a bearer without persisting its identifying subject. */
+function eventPrincipalKey(subject) {
+    return (0, node_crypto_1.createHash)("sha256").update(subject).digest("hex").slice(0, 32);
+}
+function projectAttributes(input) {
+    const output = {};
+    for (const [name, value] of Object.entries(input)) {
+        if (name === "checkRejected" && typeof value === "string" && SAFE_STRING.test(value)) {
+            output.checkRejected = true;
+            if (!("reasonCode" in input))
+                output.reasonCode = value;
+        }
+        else if (STRING_ATTRIBUTES.has(name) && typeof value === "string" && SAFE_STRING.test(value)) {
+            output[name] = value;
+        }
+        else if (HASH_ATTRIBUTES.has(name) && typeof value === "string" && HASH.test(value)) {
+            output[name] = value;
+        }
+        else if (NUMBER_ATTRIBUTES.has(name) && typeof value === "number" && Number.isFinite(value)) {
+            const maximum = name === "durationMs" ? MAX_EVENT_AGE_MS : MAX_NUMBER;
+            if (value >= 0 && value <= maximum)
+                output[name] = value;
+        }
+        else if (BOOL_ATTRIBUTES.has(name) && typeof value === "boolean") {
+            output[name] = value;
+        }
+        else if (ARRAY_ATTRIBUTES.has(name)
+            && Array.isArray(value)
+            && value.length <= 100
+            && value.every((item) => typeof item === "string" && SAFE_STRING.test(item))) {
+            output[name] = value;
+        }
+    }
+    return output;
+}