@superblocksteam/telemetry 2.0.171 → 2.0.173-next.0

package/dist-esm/common/log-sanitizer.d.ts

@@ -1,163 +0,0 @@
-/**
- * Log Sanitizer for Application-Level Secret Protection
- *
- * Sanitizes secrets from log messages while preserving debugging information.
- * This operates at the APPLICATION layer and removes values that should NEVER
- * appear in any log, anywhere.
- *
- * ARCHITECTURE:
- * - Application layer (this file): secret sanitization only (unconditional, all deployments)
- * - Policy layer (DEFAULT_SENSITIVE_PATTERNS / export path): PII redaction (deployment-specific;
- *   cloud-prem redacts emails, cloud does not)
- * - Pipeline layer (OTel Collector): Tier-based filtering for export
- *
- * Stack traces and file paths are preserved for debugging. The pipeline layer
- * handles additional tier-based redaction for exported logs.
- *
- * @see https://github.com/superblocksteam/engineering/blob/main/projects/o11y-refactor/epics/epic-c4-logging-strategy.md
- */
-/**
- * Patterns that indicate tokens, keys, and secrets in log messages.
- * These use capture groups to preserve prefixes while redacting values.
- * Exported as DEFAULT_SECRET_PATTERNS for use in LoggingPolicyConfig (e.g. cloud-prem).
- */
-export declare const DEFAULT_SECRET_PATTERNS: SensitivePattern[];
-/**
- * Fields that contain secrets and should be stripped from log objects.
- * Only includes actual secret field names - NOT debugging info.
- *
- * Pipeline-layer concerns (AI content, stack traces, PII) are NOT included here.
- * Those are handled by the OTel Collector for tier-based export filtering.
- */
-export declare const SECRET_FIELDS: Set<string>;
-/**
- * Patterns for compound field names that contain secrets.
- * Uses word boundary matching to avoid false positives.
- * Exported for use in LoggingPolicyConfig (e.g. cloud-prem).
- */
-export declare const SECRET_FIELD_PATTERNS: RegExp[];
-/**
- * Check if a field name contains secrets using word boundary matching.
- */
-export declare function isSecretField(fieldName: string): boolean;
-export declare function isSecretFieldFromPolicy(fieldName: string, secretFieldNames: Set<string>, secretFieldPatterns: RegExp[]): boolean;
-/**
- * Placeholder string used when redacting forbidden or secret fields in logs.
- * Use this constant so all packages (server, telemetry) share one value.
- */
-export declare const REDACTED_PLACEHOLDER = "[REDACTED]";
-/**
- * Field names that must never be included in exported logs (stack, prompt, code, etc.).
- * Used as the base for both cloud and cloud-prem.
- */
-export declare const BASE_EXPORT_FORBIDDEN_FIELDS: Set<string>;
-/** Export-forbidden fields for cloud (base only; email keys allowed). */
-export declare const EXPORT_FORBIDDEN_FIELDS_CLOUD: Set<string>;
-/** Export-forbidden fields for cloud-prem (base + email keys). */
-export declare const EXPORT_FORBIDDEN_FIELDS_CLOUD_PREM: Set<string>;
-export declare function isStackAttributeKey(key: string): boolean;
-export declare function containsStackTrace(text: string): boolean;
-/** Placeholder for stack trace redaction in exported logs. Exported for use in log-processor. */
-export declare const STACK_TRACE_REDACTED_PLACEHOLDER = "[STACK TRACE REDACTED - Tier 1 only]";
-/**
- * Apply redact patterns to a string with a single replacement (resets lastIndex on each pattern).
- */
-export declare function applyRedactPatterns(str: string, patterns: RegExp[], replacement?: string): string;
-/**
- * A pattern and its replacement for sensitive value redaction (e.g. path, email).
- * Configured in logging policy alongside forbiddenFields and redactPatterns.
- */
-export interface SensitivePattern {
-    pattern: RegExp;
-    replacement: string;
-}
-/** Sensitive patterns for cloud: path only (emails are not redacted in cloud). */
-export declare const SENSITIVE_PATTERNS_CLOUD: SensitivePattern[];
-/** Default sensitive patterns (path, email) for cloud-prem and when export is strict. */
-export declare const DEFAULT_SENSITIVE_PATTERNS: SensitivePattern[];
-/**
- * Regex patterns for cloud-prem log export: matched content is replaced with [REDACTED].
- * Used as redactPatterns in LoggingPolicyConfig when deploymentType is CLOUD_PREM.
- */
-export declare const CLOUD_PREM_REDACT_PATTERNS: RegExp[];
-/**
- * Apply sensitive patterns (pattern + replacement) to text.
- * Used with policy.sensitivePatterns whenever redacting values for export.
- */
-export declare function redactSensitivePatterns(text: string, patterns: SensitivePattern[]): string;
-/**
- * Redact stack trace for export: keep first line (error message) after sanitizing
- * it with sensitive patterns, replace the rest with a placeholder.
- * Use when exporting logs so stack traces never leave the environment.
- *
- * @param messageSecretPatterns - When non-empty, applied to first line before sensitivePatterns (policy-driven). When empty, uses sanitizeLogMessage for first line.
- */
-export declare function redactStackTraceForExport(text: string, sensitivePatterns?: SensitivePattern[], messageSecretPatterns?: SensitivePattern[]): string;
-/**
- * Sanitize a log message string for export: sensitive patterns, then policy redact patterns, then
- * stack trace redaction. Use for the message argument in log calls (e.g. safe logger stdout path).
- */
-export declare function sanitizeLogMessageForExport(message: string, redactPatterns: RegExp[], sensitivePatterns: SensitivePattern[]): string;
-/**
- * @deprecated Use SECRET_FIELDS instead. This export is kept for backward
- * compatibility but now only contains secret fields, not Tier 1 content fields.
- */
-export declare const TIER1_FORBIDDEN_LOG_FIELDS: Set<string>;
-/**
- * Sanitizes secrets from a log message string.
- * Preserves debugging info (emails, file paths, stack traces, etc.) for troubleshooting.
- * Email redaction is deployment-specific and handled via DEFAULT_SENSITIVE_PATTERNS
- * on the export path (cloud-prem only).
- *
- * @param message - The log message to sanitize
- * @returns Message with secrets redacted
- */
-export declare function sanitizeLogMessage(message: string): string;
-/**
- * Sanitizes secrets within a stack trace while preserving the full trace.
- * Stack traces are essential for debugging - only redact secrets within them.
- *
- * @param stack - The stack trace string
- * @returns Stack trace with secrets redacted but structure preserved
- */
-export declare function redactStackTrace(stack: string): string;
-/**
- * Recursively sanitizes secrets and high-risk PII from an object.
- * Strips secret fields entirely, sanitizes string values.
- * Preserves low-risk debugging info (stack traces, file paths).
- *
- * @param obj - The object to sanitize
- * @param depth - Current recursion depth (default: 0)
- * @returns Object with secrets removed
- */
-export declare function sanitizeLogObject<T>(obj: T, depth?: number): T;
-/**
- * Sanitize an object for export: exclude forbidden keys (omitted), redact secret keys (key kept, value [REDACTED]),
- * and apply sensitive patterns to string values. Used by PolicyAwareLogProcessor when exporting log body objects.
- */
-export declare function sanitizeLogObjectForExport(obj: unknown, forbiddenFields: Set<string>, depth?: number, sensitivePatterns?: SensitivePattern[]): unknown;
-/**
- * Sanitize a log record for export with both key-based and value-based redaction.
- * Applies sensitivePatterns and redactPatterns to every string value.
- * Use for the server stdout path (safe logger and RemoteLogger redactRecord) so exported logs match OTLP behavior.
- */
-export declare function sanitizeLogRecordForExport(obj: unknown, forbiddenFields: Set<string>, redactPatterns: RegExp[], sensitivePatterns: SensitivePattern[], depth?: number): unknown;
-/**
- * Sanitizes secrets from an error object.
- * Preserves full stack traces for debugging.
- *
- * @param error - The error to sanitize
- * @returns Error object with secrets redacted
- */
-export declare function sanitizeLogError(error: unknown): unknown;
-/**
- * Safe JSON stringify with secret sanitization.
- * Handles circular references and non-serializable types.
- * Preserves debugging info (stack traces, file paths, emails).
- *
- * @param obj - Object to stringify
- * @param space - Indentation (optional)
- * @returns JSON string with secrets redacted
- */
-export declare function safeJsonStringify(obj: unknown, space?: string | number): string;
-//# sourceMappingURL=log-sanitizer.d.ts.map

package/dist-esm/common/log-sanitizer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"log-sanitizer.d.ts","sourceRoot":"","sources":["../../src/common/log-sanitizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,gBAAgB,EAmErD,CAAC;AAmBF;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,aAqBxB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,EAuBzC,CAAC;AAEF;;GAEG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAMxD;AAED,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,EAC7B,mBAAmB,EAAE,MAAM,EAAE,GAC5B,OAAO,CAST;AAED;;;GAGG;AACH,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAEjD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,aAQvC,CAAC;AAQH,yEAAyE;AACzE,eAAO,MAAM,6BAA6B,aAEzC,CAAC;AAEF,kEAAkE;AAClE,eAAO,MAAM,kCAAkC,aAG7C,CAAC;AAYH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAExD;AAgFD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQxD;AAED,iGAAiG;AACjG,eAAO,MAAM,gCAAgC,yCACL,CAAC;AAEzC;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAAE,EAClB,WAAW,GAAE,MAA6B,GACzC,MAAM,CAQR;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAkCD,kFAAkF;AAClF,eAAO,MAAM,wBAAwB,EAAE,gBAAgB,EAWtD,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,0BAA0B,EAAE,gBAAgB,EAGxD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,0BAA0B,EAAE,MAAM,EAO9C,CAAC;AAEF;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,gBAAgB,EAAE,GAC3B,MAAM,CAQR;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,iBAAiB,GAAE,gBAAgB,EAAO,EAC1C,qBAAqB,GAAE,gBAAgB,EAAO,GAC7C,MAAM,CAkBR;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,MAAM,EAAE,EACxB,iBAAiB,EAAE,gBAAgB,EAAE,GACpC,MAAM,CAQR;AAmBD;;;GAGG;AACH,eAAO,MAAM,0BAA0B,aAAgB,CAAC;AAExD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAgB1D;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOtD;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,SAAI,GAAG,CAAC,CAyCzD;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,OAAO,EACZ,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,EAC5B,KAAK,SAAI,EACT,iBAAiB,GAAE,gBAAgB,EAAO,GACzC,OAAO,CAwDT;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,OAAO,EACZ,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,EAC5B,cAAc,EAAE,MAAM,EAAE,EACxB,iBAAiB,EAAE,gBAAgB,EAAE,EACrC,KAAK,SAAI,GACR,OAAO,CA2ET;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAsCxD;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,OAAO,EACZ,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GACtB,MAAM,CAuGR"}