@superblocksteam/telemetry 2.0.83-next.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (227) hide show
  1. package/LICENSE.txt +87 -0
  2. package/README.md +155 -0
  3. package/dist/browser/index.d.ts +8 -0
  4. package/dist/browser/index.d.ts.map +1 -0
  5. package/dist/browser/index.js +19 -0
  6. package/dist/browser/index.js.map +1 -0
  7. package/dist/browser/init.d.ts +75 -0
  8. package/dist/browser/init.d.ts.map +1 -0
  9. package/dist/browser/init.js +169 -0
  10. package/dist/browser/init.js.map +1 -0
  11. package/dist/browser/resilient-exporter.d.ts +43 -0
  12. package/dist/browser/resilient-exporter.d.ts.map +1 -0
  13. package/dist/browser/resilient-exporter.js +88 -0
  14. package/dist/browser/resilient-exporter.js.map +1 -0
  15. package/dist/common/contracts/tier2-traces.d.ts +75 -0
  16. package/dist/common/contracts/tier2-traces.d.ts.map +1 -0
  17. package/dist/common/contracts/tier2-traces.js +186 -0
  18. package/dist/common/contracts/tier2-traces.js.map +1 -0
  19. package/dist/common/deployment-type.d.ts +18 -0
  20. package/dist/common/deployment-type.d.ts.map +1 -0
  21. package/dist/common/deployment-type.js +30 -0
  22. package/dist/common/deployment-type.js.map +1 -0
  23. package/dist/common/guardrails.d.ts +116 -0
  24. package/dist/common/guardrails.d.ts.map +1 -0
  25. package/dist/common/guardrails.js +189 -0
  26. package/dist/common/guardrails.js.map +1 -0
  27. package/dist/common/index.d.ts +16 -0
  28. package/dist/common/index.d.ts.map +1 -0
  29. package/dist/common/index.js +32 -0
  30. package/dist/common/index.js.map +1 -0
  31. package/dist/common/log-sanitizer.d.ts +78 -0
  32. package/dist/common/log-sanitizer.d.ts.map +1 -0
  33. package/dist/common/log-sanitizer.js +340 -0
  34. package/dist/common/log-sanitizer.js.map +1 -0
  35. package/dist/common/policy-evaluator.d.ts +103 -0
  36. package/dist/common/policy-evaluator.d.ts.map +1 -0
  37. package/dist/common/policy-evaluator.js +200 -0
  38. package/dist/common/policy-evaluator.js.map +1 -0
  39. package/dist/common/resource.d.ts +62 -0
  40. package/dist/common/resource.d.ts.map +1 -0
  41. package/dist/common/resource.js +106 -0
  42. package/dist/common/resource.js.map +1 -0
  43. package/dist/common/tier-hints.d.ts +182 -0
  44. package/dist/common/tier-hints.d.ts.map +1 -0
  45. package/dist/common/tier-hints.js +209 -0
  46. package/dist/common/tier-hints.js.map +1 -0
  47. package/dist/index.d.ts +43 -0
  48. package/dist/index.d.ts.map +1 -0
  49. package/dist/index.js +76 -0
  50. package/dist/index.js.map +1 -0
  51. package/dist/lint/forbidden-attributes.d.ts +149 -0
  52. package/dist/lint/forbidden-attributes.d.ts.map +1 -0
  53. package/dist/lint/forbidden-attributes.js +214 -0
  54. package/dist/lint/forbidden-attributes.js.map +1 -0
  55. package/dist/lint/index.d.ts +9 -0
  56. package/dist/lint/index.d.ts.map +1 -0
  57. package/dist/lint/index.js +16 -0
  58. package/dist/lint/index.js.map +1 -0
  59. package/dist/llmobs/index.d.ts +22 -0
  60. package/dist/llmobs/index.d.ts.map +1 -0
  61. package/dist/llmobs/index.js +29 -0
  62. package/dist/llmobs/index.js.map +1 -0
  63. package/dist/llmobs/tier1-exporter.d.ts +146 -0
  64. package/dist/llmobs/tier1-exporter.d.ts.map +1 -0
  65. package/dist/llmobs/tier1-exporter.js +196 -0
  66. package/dist/llmobs/tier1-exporter.js.map +1 -0
  67. package/dist/llmobs/tier2-summarizer.d.ts +268 -0
  68. package/dist/llmobs/tier2-summarizer.d.ts.map +1 -0
  69. package/dist/llmobs/tier2-summarizer.js +650 -0
  70. package/dist/llmobs/tier2-summarizer.js.map +1 -0
  71. package/dist/node/exporters/resilient-exporter.d.ts +77 -0
  72. package/dist/node/exporters/resilient-exporter.d.ts.map +1 -0
  73. package/dist/node/exporters/resilient-exporter.js +129 -0
  74. package/dist/node/exporters/resilient-exporter.js.map +1 -0
  75. package/dist/node/index.d.ts +11 -0
  76. package/dist/node/index.d.ts.map +1 -0
  77. package/dist/node/index.js +24 -0
  78. package/dist/node/index.js.map +1 -0
  79. package/dist/node/init.d.ts +75 -0
  80. package/dist/node/init.d.ts.map +1 -0
  81. package/dist/node/init.js +245 -0
  82. package/dist/node/init.js.map +1 -0
  83. package/dist/node/log-processor.d.ts +83 -0
  84. package/dist/node/log-processor.d.ts.map +1 -0
  85. package/dist/node/log-processor.js +266 -0
  86. package/dist/node/log-processor.js.map +1 -0
  87. package/dist/node/metrics-client.d.ts +66 -0
  88. package/dist/node/metrics-client.d.ts.map +1 -0
  89. package/dist/node/metrics-client.js +193 -0
  90. package/dist/node/metrics-client.js.map +1 -0
  91. package/dist/node/traced-socket.d.ts +76 -0
  92. package/dist/node/traced-socket.d.ts.map +1 -0
  93. package/dist/node/traced-socket.js +261 -0
  94. package/dist/node/traced-socket.js.map +1 -0
  95. package/dist/testing/in-memory-exporter.d.ts +179 -0
  96. package/dist/testing/in-memory-exporter.d.ts.map +1 -0
  97. package/dist/testing/in-memory-exporter.js +254 -0
  98. package/dist/testing/in-memory-exporter.js.map +1 -0
  99. package/dist/testing/index.d.ts +8 -0
  100. package/dist/testing/index.d.ts.map +1 -0
  101. package/dist/testing/index.js +19 -0
  102. package/dist/testing/index.js.map +1 -0
  103. package/dist/testing/test-init.d.ts +80 -0
  104. package/dist/testing/test-init.d.ts.map +1 -0
  105. package/dist/testing/test-init.js +144 -0
  106. package/dist/testing/test-init.js.map +1 -0
  107. package/dist/types/index.d.ts +40 -0
  108. package/dist/types/index.d.ts.map +1 -0
  109. package/dist/types/index.js +23 -0
  110. package/dist/types/index.js.map +1 -0
  111. package/dist/types/policy.d.ts +92 -0
  112. package/dist/types/policy.d.ts.map +1 -0
  113. package/dist/types/policy.js +125 -0
  114. package/dist/types/policy.js.map +1 -0
  115. package/dist-esm/browser/index.d.ts +8 -0
  116. package/dist-esm/browser/index.d.ts.map +1 -0
  117. package/dist-esm/browser/index.js +9 -0
  118. package/dist-esm/browser/index.js.map +1 -0
  119. package/dist-esm/browser/init.d.ts +75 -0
  120. package/dist-esm/browser/init.d.ts.map +1 -0
  121. package/dist-esm/browser/init.js +162 -0
  122. package/dist-esm/browser/init.js.map +1 -0
  123. package/dist-esm/browser/resilient-exporter.d.ts +43 -0
  124. package/dist-esm/browser/resilient-exporter.d.ts.map +1 -0
  125. package/dist-esm/browser/resilient-exporter.js +84 -0
  126. package/dist-esm/browser/resilient-exporter.js.map +1 -0
  127. package/dist-esm/common/contracts/tier2-traces.d.ts +75 -0
  128. package/dist-esm/common/contracts/tier2-traces.d.ts.map +1 -0
  129. package/dist-esm/common/contracts/tier2-traces.js +178 -0
  130. package/dist-esm/common/contracts/tier2-traces.js.map +1 -0
  131. package/dist-esm/common/deployment-type.d.ts +18 -0
  132. package/dist-esm/common/deployment-type.d.ts.map +1 -0
  133. package/dist-esm/common/deployment-type.js +27 -0
  134. package/dist-esm/common/deployment-type.js.map +1 -0
  135. package/dist-esm/common/guardrails.d.ts +116 -0
  136. package/dist-esm/common/guardrails.d.ts.map +1 -0
  137. package/dist-esm/common/guardrails.js +179 -0
  138. package/dist-esm/common/guardrails.js.map +1 -0
  139. package/dist-esm/common/index.d.ts +16 -0
  140. package/dist-esm/common/index.d.ts.map +1 -0
  141. package/dist-esm/common/index.js +16 -0
  142. package/dist-esm/common/index.js.map +1 -0
  143. package/dist-esm/common/log-sanitizer.d.ts +78 -0
  144. package/dist-esm/common/log-sanitizer.d.ts.map +1 -0
  145. package/dist-esm/common/log-sanitizer.js +331 -0
  146. package/dist-esm/common/log-sanitizer.js.map +1 -0
  147. package/dist-esm/common/policy-evaluator.d.ts +103 -0
  148. package/dist-esm/common/policy-evaluator.d.ts.map +1 -0
  149. package/dist-esm/common/policy-evaluator.js +196 -0
  150. package/dist-esm/common/policy-evaluator.js.map +1 -0
  151. package/dist-esm/common/resource.d.ts +62 -0
  152. package/dist-esm/common/resource.d.ts.map +1 -0
  153. package/dist-esm/common/resource.js +100 -0
  154. package/dist-esm/common/resource.js.map +1 -0
  155. package/dist-esm/common/tier-hints.d.ts +182 -0
  156. package/dist-esm/common/tier-hints.d.ts.map +1 -0
  157. package/dist-esm/common/tier-hints.js +199 -0
  158. package/dist-esm/common/tier-hints.js.map +1 -0
  159. package/dist-esm/index.d.ts +43 -0
  160. package/dist-esm/index.d.ts.map +1 -0
  161. package/dist-esm/index.js +53 -0
  162. package/dist-esm/index.js.map +1 -0
  163. package/dist-esm/lint/forbidden-attributes.d.ts +149 -0
  164. package/dist-esm/lint/forbidden-attributes.d.ts.map +1 -0
  165. package/dist-esm/lint/forbidden-attributes.js +209 -0
  166. package/dist-esm/lint/forbidden-attributes.js.map +1 -0
  167. package/dist-esm/lint/index.d.ts +9 -0
  168. package/dist-esm/lint/index.d.ts.map +1 -0
  169. package/dist-esm/lint/index.js +9 -0
  170. package/dist-esm/lint/index.js.map +1 -0
  171. package/dist-esm/llmobs/index.d.ts +22 -0
  172. package/dist-esm/llmobs/index.d.ts.map +1 -0
  173. package/dist-esm/llmobs/index.js +22 -0
  174. package/dist-esm/llmobs/index.js.map +1 -0
  175. package/dist-esm/llmobs/tier1-exporter.d.ts +146 -0
  176. package/dist-esm/llmobs/tier1-exporter.d.ts.map +1 -0
  177. package/dist-esm/llmobs/tier1-exporter.js +190 -0
  178. package/dist-esm/llmobs/tier1-exporter.js.map +1 -0
  179. package/dist-esm/llmobs/tier2-summarizer.d.ts +268 -0
  180. package/dist-esm/llmobs/tier2-summarizer.d.ts.map +1 -0
  181. package/dist-esm/llmobs/tier2-summarizer.js +646 -0
  182. package/dist-esm/llmobs/tier2-summarizer.js.map +1 -0
  183. package/dist-esm/node/exporters/resilient-exporter.d.ts +77 -0
  184. package/dist-esm/node/exporters/resilient-exporter.d.ts.map +1 -0
  185. package/dist-esm/node/exporters/resilient-exporter.js +125 -0
  186. package/dist-esm/node/exporters/resilient-exporter.js.map +1 -0
  187. package/dist-esm/node/index.d.ts +11 -0
  188. package/dist-esm/node/index.d.ts.map +1 -0
  189. package/dist-esm/node/index.js +11 -0
  190. package/dist-esm/node/index.js.map +1 -0
  191. package/dist-esm/node/init.d.ts +75 -0
  192. package/dist-esm/node/init.d.ts.map +1 -0
  193. package/dist-esm/node/init.js +239 -0
  194. package/dist-esm/node/init.js.map +1 -0
  195. package/dist-esm/node/log-processor.d.ts +83 -0
  196. package/dist-esm/node/log-processor.d.ts.map +1 -0
  197. package/dist-esm/node/log-processor.js +261 -0
  198. package/dist-esm/node/log-processor.js.map +1 -0
  199. package/dist-esm/node/metrics-client.d.ts +66 -0
  200. package/dist-esm/node/metrics-client.d.ts.map +1 -0
  201. package/dist-esm/node/metrics-client.js +189 -0
  202. package/dist-esm/node/metrics-client.js.map +1 -0
  203. package/dist-esm/node/traced-socket.d.ts +76 -0
  204. package/dist-esm/node/traced-socket.d.ts.map +1 -0
  205. package/dist-esm/node/traced-socket.js +257 -0
  206. package/dist-esm/node/traced-socket.js.map +1 -0
  207. package/dist-esm/testing/in-memory-exporter.d.ts +179 -0
  208. package/dist-esm/testing/in-memory-exporter.d.ts.map +1 -0
  209. package/dist-esm/testing/in-memory-exporter.js +248 -0
  210. package/dist-esm/testing/in-memory-exporter.js.map +1 -0
  211. package/dist-esm/testing/index.d.ts +8 -0
  212. package/dist-esm/testing/index.d.ts.map +1 -0
  213. package/dist-esm/testing/index.js +8 -0
  214. package/dist-esm/testing/index.js.map +1 -0
  215. package/dist-esm/testing/test-init.d.ts +80 -0
  216. package/dist-esm/testing/test-init.d.ts.map +1 -0
  217. package/dist-esm/testing/test-init.js +137 -0
  218. package/dist-esm/testing/test-init.js.map +1 -0
  219. package/dist-esm/types/index.d.ts +40 -0
  220. package/dist-esm/types/index.d.ts.map +1 -0
  221. package/dist-esm/types/index.js +7 -0
  222. package/dist-esm/types/index.js.map +1 -0
  223. package/dist-esm/types/policy.d.ts +92 -0
  224. package/dist-esm/types/policy.d.ts.map +1 -0
  225. package/dist-esm/types/policy.js +122 -0
  226. package/dist-esm/types/policy.js.map +1 -0
  227. package/package.json +101 -0
@@ -0,0 +1 @@
1
+ {"version":3,"file":"resilient-exporter.js","sourceRoot":"","sources":["../../src/browser/resilient-exporter.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAGH,8CAAqE;AAgBrE;;;;;GAKG;AACH,MAAa,wBAAwB;IAClB,QAAQ,CAAe;IACvB,YAAY,CAAS;IACrB,eAAe,CAAS;IACxB,MAAM,CAGb;IAEF,WAAW,GAAG,CAAC,CAAC;IAChB,YAAY,GAAG,KAAK,CAAC;IAE7B,YAAY,MAAsC;QAChD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,GAAG,CAAC;QAC/C,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,KAAK,CAAC;QACvD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,KAAqB,EACrB,cAA8C;QAE9C,yBAAyB;QACzB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,cAAc,CAAC,EAAE,IAAI,EAAE,uBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,qBAAqB;QACrB,IAAI,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACxD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACxC,cAAc,CAAC,EAAE,IAAI,EAAE,uBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;QACjC,IAAI,SAAS,GAAG,KAAK,CAAC;QAEtB,kBAAkB;QAClB,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAChC,IAAI,SAAS;gBAAE,OAAO;YACtB,SAAS,GAAG,IAAI,CAAC;YACjB,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACrC,cAAc,CAAC,EAAE,IAAI,EAAE,uBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QAEzB,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;gBACrC,IAAI,SAAS;oBAAE,OAAO;gBACtB,SAAS,GAAG,IAAI,CAAC;gBACjB,YAAY,CAAC,SAAS,CAAC,CAAC;gBACxB,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;gBAEjC,IAAI,MAAM,CAAC,IAAI,KAAK,uBAAgB,CAAC,OAAO,EAAE,CAAC;oBAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;gBAC7C,CAAC;gBAED,cAAc,CAAC,EAAE,IAAI,EAAE,uBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;YACrD,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,SAAS;gBAAE,OAAO;YACtB,SAAS,GAAG,IAAI,CAAC;YACjB,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YAC3C,cAAc,CAAC,EAAE,IAAI,EAAE,uBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3D,CAAC;CACF;AAlFD,4DAkFC"}
@@ -0,0 +1,75 @@
1
+ /**
2
+ * Tier 2 Traces Contract
3
+ *
4
+ * This file defines the Tier 2 telemetry contract:
5
+ * - Forbidden attributes (removed by Collector)
6
+ * - Hashed attributes (pseudonymized by Collector)
7
+ * - Dropped attributes (removed by Collector)
8
+ * - Forbidden value patterns (for lint-time detection)
9
+ *
10
+ * ENFORCEMENT: The OTEL Collector handles runtime enforcement.
11
+ * These definitions are used for:
12
+ * - ESLint rules (static analysis at CI time)
13
+ * - Development warnings (guardrails.ts)
14
+ * - Collector config generation
15
+ *
16
+ * See: obs/otel-collector/config-tiered.yaml
17
+ * Source of truth: engineering/projects/o11y-refactor/contracts/tier2-traces.v0.3.0.json
18
+ */
19
+ /**
20
+ * Attributes that are FORBIDDEN in Tier 2 telemetry.
21
+ * These contain sensitive data that should never leave the customer's environment.
22
+ * The Collector strips these entirely (not hashed, not present in Tier 2).
23
+ */
24
+ export declare const TIER2_FORBIDDEN_ATTRIBUTES: Set<string>;
25
+ /**
26
+ * Attributes that should be HASHED (pseudonymized) in Tier 2 telemetry.
27
+ * The Collector replaces these with SHA256 hashes for privacy.
28
+ * Hashes enable aggregate analysis without exposing plaintext identifiers.
29
+ *
30
+ * Mapping:
31
+ * user-email, user.email, etc. → user.hash
32
+ * organization-id, organization_id → organization.hash
33
+ * application-id, application_id → application.hash
34
+ * session.id → session.hash
35
+ * enduser.id → enduser.pseudo.id
36
+ */
37
+ export declare const TIER2_HASHED_ATTRIBUTES: Set<string>;
38
+ /**
39
+ * Attributes that should be DROPPED entirely in Tier 2.
40
+ * These are correlation IDs that don't provide operational value.
41
+ */
42
+ export declare const TIER2_DROPPED_ATTRIBUTES: Set<string>;
43
+ /**
44
+ * Spans that should ALWAYS be sampled (never dropped by rate limiting).
45
+ */
46
+ export declare const ALWAYS_SAMPLE_SPANS: Set<string>;
47
+ /**
48
+ * Patterns that indicate forbidden content in attribute values.
49
+ * Used for secondary filtering when attribute names aren't explicit.
50
+ *
51
+ * IMPORTANT: Patterns should NOT use ^ and $ anchors so they match
52
+ * secrets embedded anywhere in a string (e.g., in query params, headers).
53
+ */
54
+ export declare const FORBIDDEN_VALUE_PATTERNS: RegExp[];
55
+ /**
56
+ * Check if an attribute name is forbidden in Tier 2.
57
+ */
58
+ export declare function isForbiddenAttribute(name: string): boolean;
59
+ /**
60
+ * Check if an attribute should be hashed in Tier 2.
61
+ */
62
+ export declare function isHashedAttribute(name: string): boolean;
63
+ /**
64
+ * Check if an attribute should be dropped in Tier 2.
65
+ */
66
+ export declare function isDroppedAttribute(name: string): boolean;
67
+ /**
68
+ * Check if a value contains forbidden patterns (like tokens, keys).
69
+ */
70
+ export declare function containsForbiddenPattern(value: unknown): boolean;
71
+ /**
72
+ * Check if a span should always be sampled.
73
+ */
74
+ export declare function shouldAlwaysSample(spanName: string): boolean;
75
+ //# sourceMappingURL=tier2-traces.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"tier2-traces.d.ts","sourceRoot":"","sources":["../../../src/common/contracts/tier2-traces.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,aAsDrC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,aAmBlC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,wBAAwB,aAQnC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,mBAAmB,aAE9B,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,UAuBpC,CAAC;AAEF;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGhE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE5D"}
@@ -0,0 +1,186 @@
1
+ "use strict";
2
+ /**
3
+ * Tier 2 Traces Contract
4
+ *
5
+ * This file defines the Tier 2 telemetry contract:
6
+ * - Forbidden attributes (removed by Collector)
7
+ * - Hashed attributes (pseudonymized by Collector)
8
+ * - Dropped attributes (removed by Collector)
9
+ * - Forbidden value patterns (for lint-time detection)
10
+ *
11
+ * ENFORCEMENT: The OTEL Collector handles runtime enforcement.
12
+ * These definitions are used for:
13
+ * - ESLint rules (static analysis at CI time)
14
+ * - Development warnings (guardrails.ts)
15
+ * - Collector config generation
16
+ *
17
+ * See: obs/otel-collector/config-tiered.yaml
18
+ * Source of truth: engineering/projects/o11y-refactor/contracts/tier2-traces.v0.3.0.json
19
+ */
20
+ Object.defineProperty(exports, "__esModule", { value: true });
21
+ exports.FORBIDDEN_VALUE_PATTERNS = exports.ALWAYS_SAMPLE_SPANS = exports.TIER2_DROPPED_ATTRIBUTES = exports.TIER2_HASHED_ATTRIBUTES = exports.TIER2_FORBIDDEN_ATTRIBUTES = void 0;
22
+ exports.isForbiddenAttribute = isForbiddenAttribute;
23
+ exports.isHashedAttribute = isHashedAttribute;
24
+ exports.isDroppedAttribute = isDroppedAttribute;
25
+ exports.containsForbiddenPattern = containsForbiddenPattern;
26
+ exports.shouldAlwaysSample = shouldAlwaysSample;
27
+ /**
28
+ * Attributes that are FORBIDDEN in Tier 2 telemetry.
29
+ * These contain sensitive data that should never leave the customer's environment.
30
+ * The Collector strips these entirely (not hashed, not present in Tier 2).
31
+ */
32
+ exports.TIER2_FORBIDDEN_ATTRIBUTES = new Set([
33
+ // LLM/AI content
34
+ 'llmobs.input',
35
+ 'llmobs.output',
36
+ 'prompt',
37
+ 'code',
38
+ 'tool_input',
39
+ 'tool_output',
40
+ // File content
41
+ 'file_path',
42
+ 'file_content',
43
+ // Database content
44
+ 'db.statement',
45
+ 'db.query_text',
46
+ 'db.query.text',
47
+ // HTTP bodies and URLs
48
+ 'http.request.body',
49
+ 'http.response.body',
50
+ 'url.full',
51
+ 'url.query',
52
+ 'http.url',
53
+ 'http.target',
54
+ // Resource identifiers (names are customer-specific)
55
+ 'api-id',
56
+ 'api_id',
57
+ 'api-name',
58
+ 'api_name',
59
+ 'resource-id',
60
+ 'resource_id',
61
+ 'resource-name',
62
+ 'resource_name',
63
+ 'integration-id',
64
+ 'integration_id',
65
+ 'widget-type',
66
+ 'branch',
67
+ 'commit-id',
68
+ 'commit_id',
69
+ 'profile-id',
70
+ 'profile_id',
71
+ // Stack traces
72
+ 'error.stack',
73
+ 'exception.stacktrace',
74
+ // Auth/secrets
75
+ 'auth_token',
76
+ 'api_key',
77
+ 'authorization',
78
+ 'cookie',
79
+ 'x-api-key',
80
+ ]);
81
+ /**
82
+ * Attributes that should be HASHED (pseudonymized) in Tier 2 telemetry.
83
+ * The Collector replaces these with SHA256 hashes for privacy.
84
+ * Hashes enable aggregate analysis without exposing plaintext identifiers.
85
+ *
86
+ * Mapping:
87
+ * user-email, user.email, etc. → user.hash
88
+ * organization-id, organization_id → organization.hash
89
+ * application-id, application_id → application.hash
90
+ * session.id → session.hash
91
+ * enduser.id → enduser.pseudo.id
92
+ */
93
+ exports.TIER2_HASHED_ATTRIBUTES = new Set([
94
+ // User identity (hashed to user.hash)
95
+ 'user-email',
96
+ 'user.email',
97
+ 'user_email',
98
+ 'user.id',
99
+ 'enduser.email',
100
+ // Organization identity (hashed to organization.hash)
101
+ 'organization-id',
102
+ 'organization_id',
103
+ // Application identity (hashed to application.hash)
104
+ 'application-id',
105
+ 'application_id',
106
+ // Session/enduser identity
107
+ 'session.id',
108
+ 'enduser.id',
109
+ ]);
110
+ /**
111
+ * Attributes that should be DROPPED entirely in Tier 2.
112
+ * These are correlation IDs that don't provide operational value.
113
+ */
114
+ exports.TIER2_DROPPED_ATTRIBUTES = new Set([
115
+ 'correlation-id',
116
+ 'correlation_id',
117
+ 'request-id',
118
+ 'request_id',
119
+ 'trace-id',
120
+ 'execution_id',
121
+ 'binding_keys',
122
+ ]);
123
+ /**
124
+ * Spans that should ALWAYS be sampled (never dropped by rate limiting).
125
+ */
126
+ exports.ALWAYS_SAMPLE_SPANS = new Set([
127
+ 'api.execute',
128
+ ]);
129
+ /**
130
+ * Patterns that indicate forbidden content in attribute values.
131
+ * Used for secondary filtering when attribute names aren't explicit.
132
+ *
133
+ * IMPORTANT: Patterns should NOT use ^ and $ anchors so they match
134
+ * secrets embedded anywhere in a string (e.g., in query params, headers).
135
+ */
136
+ exports.FORBIDDEN_VALUE_PATTERNS = [
137
+ // JWT tokens (anywhere in string)
138
+ // Header (eyJ...) and payload (eyJ...) must be base64url encoded JSON
139
+ // Signature can be any length (even short for test tokens)
140
+ /eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]+/,
141
+ // API keys (sk-/pk- prefix patterns with word boundaries)
142
+ /\b(sk|pk)-[a-zA-Z0-9]{32,}\b/,
143
+ // Bearer tokens (anywhere in string)
144
+ /Bearer\s+[A-Za-z0-9._-]{20,}/,
145
+ // PEM blocks (anywhere in string)
146
+ /-----BEGIN\s+(RSA\s+)?(PRIVATE|PUBLIC)\s+KEY-----/,
147
+ // AWS access key IDs
148
+ /\bAKIA[A-Z0-9]{16}\b/,
149
+ // GitHub tokens
150
+ /\b(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/,
151
+ // Generic API key patterns (key=value or key:value with long alphanumeric)
152
+ /\b(api[_-]?key|apikey|secret[_-]?key|access[_-]?token)[=:]\s*[A-Za-z0-9_-]{20,}\b/i,
153
+ ];
154
+ /**
155
+ * Check if an attribute name is forbidden in Tier 2.
156
+ */
157
+ function isForbiddenAttribute(name) {
158
+ return exports.TIER2_FORBIDDEN_ATTRIBUTES.has(name);
159
+ }
160
+ /**
161
+ * Check if an attribute should be hashed in Tier 2.
162
+ */
163
+ function isHashedAttribute(name) {
164
+ return exports.TIER2_HASHED_ATTRIBUTES.has(name);
165
+ }
166
+ /**
167
+ * Check if an attribute should be dropped in Tier 2.
168
+ */
169
+ function isDroppedAttribute(name) {
170
+ return exports.TIER2_DROPPED_ATTRIBUTES.has(name);
171
+ }
172
+ /**
173
+ * Check if a value contains forbidden patterns (like tokens, keys).
174
+ */
175
+ function containsForbiddenPattern(value) {
176
+ if (typeof value !== 'string')
177
+ return false;
178
+ return exports.FORBIDDEN_VALUE_PATTERNS.some(pattern => pattern.test(value));
179
+ }
180
+ /**
181
+ * Check if a span should always be sampled.
182
+ */
183
+ function shouldAlwaysSample(spanName) {
184
+ return exports.ALWAYS_SAMPLE_SPANS.has(spanName);
185
+ }
186
+ //# sourceMappingURL=tier2-traces.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"tier2-traces.js","sourceRoot":"","sources":["../../../src/common/contracts/tier2-traces.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;AAwJH,oDAEC;AAKD,8CAEC;AAKD,gDAEC;AAKD,4DAGC;AAKD,gDAEC;AArLD;;;;GAIG;AACU,QAAA,0BAA0B,GAAG,IAAI,GAAG,CAAC;IAChD,iBAAiB;IACjB,cAAc;IACd,eAAe;IACf,QAAQ;IACR,MAAM;IACN,YAAY;IACZ,aAAa;IAEb,eAAe;IACf,WAAW;IACX,cAAc;IAEd,mBAAmB;IACnB,cAAc;IACd,eAAe;IACf,eAAe;IAEf,uBAAuB;IACvB,mBAAmB;IACnB,oBAAoB;IACpB,UAAU;IACV,WAAW;IACX,UAAU;IACV,aAAa;IAEb,qDAAqD;IACrD,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,UAAU;IACV,aAAa;IACb,aAAa;IACb,eAAe;IACf,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,QAAQ;IACR,WAAW;IACX,WAAW;IACX,YAAY;IACZ,YAAY;IAEZ,eAAe;IACf,aAAa;IACb,sBAAsB;IAEtB,eAAe;IACf,YAAY;IACZ,SAAS;IACT,eAAe;IACf,QAAQ;IACR,WAAW;CACZ,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACU,QAAA,uBAAuB,GAAG,IAAI,GAAG,CAAC;IAC7C,sCAAsC;IACtC,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,eAAe;IAEf,sDAAsD;IACtD,iBAAiB;IACjB,iBAAiB;IAEjB,oDAAoD;IACpD,gBAAgB;IAChB,gBAAgB;IAEhB,2BAA2B;IAC3B,YAAY;IACZ,YAAY;CACb,CAAC,CAAC;AAEH;;;GAGG;AACU,QAAA,wBAAwB,GAAG,IAAI,GAAG,CAAC;IAC9C,gBAAgB;IAChB,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,cAAc;IACd,cAAc;CACf,CAAC,CAAC;AAEH;;GAEG;AACU,QAAA,mBAAmB,GAAG,IAAI,GAAG,CAAC;IACzC,aAAa;CACd,CAAC,CAAC;AAEH;;;;;;GAMG;AACU,QAAA,wBAAwB,GAAG;IACtC,kCAAkC;IAClC,sEAAsE;IACtE,2DAA2D;IAC3D,8DAA8D;IAE9D,0DAA0D;IAC1D,8BAA8B;IAE9B,qCAAqC;IACrC,8BAA8B;IAE9B,kCAAkC;IAClC,mDAAmD;IAEnD,qBAAqB;IACrB,sBAAsB;IAEtB,gBAAgB;IAChB,4CAA4C;IAE5C,2EAA2E;IAC3E,oFAAoF;CACrF,CAAC;AAEF;;GAEG;AACH,SAAgB,oBAAoB,CAAC,IAAY;IAC/C,OAAO,kCAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAAC,IAAY;IAC5C,OAAO,+BAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,OAAO,gCAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,SAAgB,wBAAwB,CAAC,KAAc;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,gCAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAAC,QAAgB;IACjD,OAAO,2BAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC"}
@@ -0,0 +1,18 @@
1
+ /**
2
+ * Deployment Type Parsing
3
+ *
4
+ * Shared utility for validating and parsing deployment type values.
5
+ * Used by both the server and CLI telemetry initialization.
6
+ */
7
+ import { DeploymentTypeEnum } from "@superblocksteam/shared";
8
+ /**
9
+ * Parse and validate a deployment type string.
10
+ *
11
+ * Returns CLOUD if not specified. Throws if an invalid value is provided.
12
+ *
13
+ * @param value - Raw deployment type string (typically from env var)
14
+ * @returns Valid DeploymentTypeEnum value
15
+ * @throws Error if value is not a valid DeploymentTypeEnum
16
+ */
17
+ export declare function parseDeploymentType(value: string | undefined): DeploymentTypeEnum;
18
+ //# sourceMappingURL=deployment-type.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"deployment-type.d.ts","sourceRoot":"","sources":["../../src/common/deployment-type.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,kBAAkB,CAapB"}
@@ -0,0 +1,30 @@
1
+ "use strict";
2
+ /**
3
+ * Deployment Type Parsing
4
+ *
5
+ * Shared utility for validating and parsing deployment type values.
6
+ * Used by both the server and CLI telemetry initialization.
7
+ */
8
+ Object.defineProperty(exports, "__esModule", { value: true });
9
+ exports.parseDeploymentType = parseDeploymentType;
10
+ const shared_1 = require("@superblocksteam/shared");
11
+ /**
12
+ * Parse and validate a deployment type string.
13
+ *
14
+ * Returns CLOUD if not specified. Throws if an invalid value is provided.
15
+ *
16
+ * @param value - Raw deployment type string (typically from env var)
17
+ * @returns Valid DeploymentTypeEnum value
18
+ * @throws Error if value is not a valid DeploymentTypeEnum
19
+ */
20
+ function parseDeploymentType(value) {
21
+ if (!value || value === "") {
22
+ return shared_1.DeploymentTypeEnum.CLOUD;
23
+ }
24
+ if (!Object.values(shared_1.DeploymentTypeEnum).includes(value)) {
25
+ throw new Error(`Invalid SUPERBLOCKS_DEPLOYMENT_TYPE: "${value}". ` +
26
+ `Valid values are: ${Object.values(shared_1.DeploymentTypeEnum).join(", ")}.`);
27
+ }
28
+ return value;
29
+ }
30
+ //# sourceMappingURL=deployment-type.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"deployment-type.js","sourceRoot":"","sources":["../../src/common/deployment-type.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAaH,kDAeC;AA1BD,oDAA6D;AAE7D;;;;;;;;GAQG;AACH,SAAgB,mBAAmB,CACjC,KAAyB;IAEzB,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC3B,OAAO,2BAAkB,CAAC,KAAK,CAAC;IAClC,CAAC;IACD,IACE,CAAC,MAAM,CAAC,MAAM,CAAC,2BAAkB,CAAC,CAAC,QAAQ,CAAC,KAA2B,CAAC,EACxE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,yCAAyC,KAAK,KAAK;YACjD,qBAAqB,MAAM,CAAC,MAAM,CAAC,2BAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,KAA2B,CAAC;AACrC,CAAC"}
@@ -0,0 +1,116 @@
1
+ /**
2
+ * Telemetry Guardrails
3
+ *
4
+ * Lint-time guardrails to detect forbidden or high-cardinality attributes.
5
+ *
6
+ * NOTE: In the tiered telemetry architecture, the OTEL Collector handles
7
+ * runtime filtering and sanitization. These guardrails are for:
8
+ * - ESLint rules (static analysis)
9
+ * - Development warnings (not enforcement)
10
+ * - CI validation
11
+ *
12
+ * See obs/otel-collector/config-tiered.yaml for runtime enforcement.
13
+ */
14
+ import type { Attributes } from '@opentelemetry/api';
15
+ /**
16
+ * Guardrail violation types.
17
+ */
18
+ export declare enum ViolationType {
19
+ /** Attribute is forbidden in Tier 2 */
20
+ FORBIDDEN_ATTRIBUTE = "forbidden_attribute",
21
+ /** Attribute should be a resource attribute, not span attribute */
22
+ RESOURCE_ONLY = "resource_only",
23
+ /** Value contains forbidden pattern (JWT, API key, etc.) */
24
+ FORBIDDEN_VALUE = "forbidden_value",
25
+ /** Attribute value has too high cardinality */
26
+ HIGH_CARDINALITY = "high_cardinality"
27
+ }
28
+ /**
29
+ * Guardrail violation record.
30
+ */
31
+ export interface GuardrailViolation {
32
+ /** Type of violation */
33
+ type: ViolationType;
34
+ /** Attribute key that violated */
35
+ attributeKey: string;
36
+ /** Human-readable message */
37
+ message: string;
38
+ /** Severity level */
39
+ severity: 'error' | 'warning';
40
+ }
41
+ /**
42
+ * Mode for guardrail reporting.
43
+ *
44
+ * NOTE: Runtime filtering is handled by the OTEL Collector.
45
+ * These modes are for lint-time/development feedback only.
46
+ */
47
+ export declare enum GuardrailMode {
48
+ /** Log violations as warnings (development) */
49
+ WARN = "warn",
50
+ /** Throw on violations (CI/strict mode) */
51
+ STRICT = "strict"
52
+ }
53
+ /**
54
+ * Options for guardrail validation.
55
+ */
56
+ export interface GuardrailOptions {
57
+ /** Reporting mode */
58
+ mode: GuardrailMode;
59
+ /** Whether to check for high-cardinality values */
60
+ checkCardinality?: boolean;
61
+ /** Maximum allowed cardinality for string values */
62
+ maxCardinalityLength?: number;
63
+ }
64
+ /**
65
+ * Validate span attributes against Tier 2 guardrails.
66
+ *
67
+ * This is for lint-time validation. Runtime filtering is handled by Collector.
68
+ *
69
+ * @param attributes - Attributes to validate
70
+ * @param options - Guardrail options
71
+ * @returns Array of violations found
72
+ */
73
+ export declare function validateSpanAttributes(attributes: Attributes, options?: Partial<GuardrailOptions>): GuardrailViolation[];
74
+ /**
75
+ * Validate metric labels against Tier 2 guardrails.
76
+ *
77
+ * @param labels - Metric labels to validate
78
+ * @param options - Guardrail options
79
+ * @returns Array of violations found
80
+ */
81
+ export declare function validateMetricLabels(labels: Record<string, string | number | boolean>, options?: Partial<GuardrailOptions>): GuardrailViolation[];
82
+ /**
83
+ * Report guardrail violations.
84
+ *
85
+ * NOTE: This is for development feedback only. Runtime filtering
86
+ * is handled by the OTEL Collector.
87
+ *
88
+ * @param attributes - Attributes to check
89
+ * @param options - Guardrail options
90
+ * @throws Error in STRICT mode if violations found
91
+ */
92
+ export declare function reportViolations(attributes: Attributes, options?: Partial<GuardrailOptions>): void;
93
+ /**
94
+ * Check if an attribute key is allowed in Tier 2.
95
+ * Convenience function for quick checks.
96
+ *
97
+ * @param key - Attribute key
98
+ * @returns true if allowed
99
+ */
100
+ export declare function isTier2Allowed(key: string): boolean;
101
+ /**
102
+ * Check if an attribute should be hashed (by Collector).
103
+ *
104
+ * @param key - Attribute key
105
+ * @returns true if should be hashed
106
+ */
107
+ export declare function shouldHash(key: string): boolean;
108
+ /**
109
+ * Get all forbidden attribute names (for documentation/linting).
110
+ */
111
+ export declare function getForbiddenAttributes(): string[];
112
+ /**
113
+ * Get all hashed attribute names (for documentation/linting).
114
+ */
115
+ export declare function getHashedAttributes(): string[];
116
+ //# sourceMappingURL=guardrails.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../../src/common/guardrails.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AASrD;;GAEG;AACH,oBAAY,aAAa;IACvB,uCAAuC;IACvC,mBAAmB,wBAAwB;IAC3C,mEAAmE;IACnE,aAAa,kBAAkB;IAC/B,4DAA4D;IAC5D,eAAe,oBAAoB;IACnC,+CAA+C;IAC/C,gBAAgB,qBAAqB;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,wBAAwB;IACxB,IAAI,EAAE,aAAa,CAAC;IACpB,kCAAkC;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;CAC/B;AAED;;;;;GAKG;AACH,oBAAY,aAAa;IACvB,+CAA+C;IAC/C,IAAI,SAAS;IACb,2CAA2C;IAC3C,MAAM,WAAW;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qBAAqB;IACrB,IAAI,EAAE,aAAa,CAAC;IACpB,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,oDAAoD;IACpD,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAQD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,UAAU,EACtB,OAAO,GAAE,OAAO,CAAC,gBAAgB,CAAM,GACtC,kBAAkB,EAAE,CAqDtB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,EACjD,OAAO,GAAE,OAAO,CAAC,gBAAgB,CAAM,GACtC,kBAAkB,EAAE,CAGtB;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,UAAU,EACtB,OAAO,GAAE,OAAO,CAAC,gBAAgB,CAAM,GACtC,IAAI,CAuBN;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMnD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED;;GAEG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,EAAE,CAEjD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAE9C"}
@@ -0,0 +1,189 @@
1
+ "use strict";
2
+ /**
3
+ * Telemetry Guardrails
4
+ *
5
+ * Lint-time guardrails to detect forbidden or high-cardinality attributes.
6
+ *
7
+ * NOTE: In the tiered telemetry architecture, the OTEL Collector handles
8
+ * runtime filtering and sanitization. These guardrails are for:
9
+ * - ESLint rules (static analysis)
10
+ * - Development warnings (not enforcement)
11
+ * - CI validation
12
+ *
13
+ * See obs/otel-collector/config-tiered.yaml for runtime enforcement.
14
+ */
15
+ Object.defineProperty(exports, "__esModule", { value: true });
16
+ exports.GuardrailMode = exports.ViolationType = void 0;
17
+ exports.validateSpanAttributes = validateSpanAttributes;
18
+ exports.validateMetricLabels = validateMetricLabels;
19
+ exports.reportViolations = reportViolations;
20
+ exports.isTier2Allowed = isTier2Allowed;
21
+ exports.shouldHash = shouldHash;
22
+ exports.getForbiddenAttributes = getForbiddenAttributes;
23
+ exports.getHashedAttributes = getHashedAttributes;
24
+ const tier2_traces_js_1 = require("./contracts/tier2-traces.js");
25
+ const resource_js_1 = require("./resource.js");
26
+ /**
27
+ * Guardrail violation types.
28
+ */
29
+ var ViolationType;
30
+ (function (ViolationType) {
31
+ /** Attribute is forbidden in Tier 2 */
32
+ ViolationType["FORBIDDEN_ATTRIBUTE"] = "forbidden_attribute";
33
+ /** Attribute should be a resource attribute, not span attribute */
34
+ ViolationType["RESOURCE_ONLY"] = "resource_only";
35
+ /** Value contains forbidden pattern (JWT, API key, etc.) */
36
+ ViolationType["FORBIDDEN_VALUE"] = "forbidden_value";
37
+ /** Attribute value has too high cardinality */
38
+ ViolationType["HIGH_CARDINALITY"] = "high_cardinality";
39
+ })(ViolationType || (exports.ViolationType = ViolationType = {}));
40
+ /**
41
+ * Mode for guardrail reporting.
42
+ *
43
+ * NOTE: Runtime filtering is handled by the OTEL Collector.
44
+ * These modes are for lint-time/development feedback only.
45
+ */
46
+ var GuardrailMode;
47
+ (function (GuardrailMode) {
48
+ /** Log violations as warnings (development) */
49
+ GuardrailMode["WARN"] = "warn";
50
+ /** Throw on violations (CI/strict mode) */
51
+ GuardrailMode["STRICT"] = "strict";
52
+ })(GuardrailMode || (exports.GuardrailMode = GuardrailMode = {}));
53
+ const DEFAULT_OPTIONS = {
54
+ mode: GuardrailMode.WARN,
55
+ checkCardinality: true,
56
+ maxCardinalityLength: 200,
57
+ };
58
+ /**
59
+ * Validate span attributes against Tier 2 guardrails.
60
+ *
61
+ * This is for lint-time validation. Runtime filtering is handled by Collector.
62
+ *
63
+ * @param attributes - Attributes to validate
64
+ * @param options - Guardrail options
65
+ * @returns Array of violations found
66
+ */
67
+ function validateSpanAttributes(attributes, options = {}) {
68
+ const opts = { ...DEFAULT_OPTIONS, ...options };
69
+ const violations = [];
70
+ for (const [key, value] of Object.entries(attributes)) {
71
+ // Check for forbidden attributes
72
+ if (tier2_traces_js_1.TIER2_FORBIDDEN_ATTRIBUTES.has(key)) {
73
+ violations.push({
74
+ type: ViolationType.FORBIDDEN_ATTRIBUTE,
75
+ attributeKey: key,
76
+ message: `Attribute '${key}' is forbidden in Tier 2 telemetry. ` +
77
+ `Collector will filter this at runtime.`,
78
+ severity: 'warning',
79
+ });
80
+ }
81
+ // Check for resource-only attributes
82
+ if (resource_js_1.RESOURCE_ONLY_ATTRIBUTES.has(key)) {
83
+ violations.push({
84
+ type: ViolationType.RESOURCE_ONLY,
85
+ attributeKey: key,
86
+ message: `Attribute '${key}' should be a RESOURCE attribute, not a span attribute. ` +
87
+ `Set it in initNodeTelemetry() config, not per-span.`,
88
+ severity: 'warning',
89
+ });
90
+ }
91
+ // Check for forbidden value patterns
92
+ if ((0, tier2_traces_js_1.containsForbiddenPattern)(value)) {
93
+ violations.push({
94
+ type: ViolationType.FORBIDDEN_VALUE,
95
+ attributeKey: key,
96
+ message: `Attribute '${key}' contains a forbidden pattern (JWT, API key, etc.). ` +
97
+ `Collector will filter this at runtime.`,
98
+ severity: 'warning',
99
+ });
100
+ }
101
+ // Check for high cardinality
102
+ if (opts.checkCardinality && typeof value === 'string') {
103
+ if (value.length > opts.maxCardinalityLength) {
104
+ violations.push({
105
+ type: ViolationType.HIGH_CARDINALITY,
106
+ attributeKey: key,
107
+ message: `Attribute '${key}' has a very long value (${value.length} chars). ` +
108
+ `This may cause high cardinality. Consider using a shorter, normalized value.`,
109
+ severity: 'warning',
110
+ });
111
+ }
112
+ }
113
+ }
114
+ return violations;
115
+ }
116
+ /**
117
+ * Validate metric labels against Tier 2 guardrails.
118
+ *
119
+ * @param labels - Metric labels to validate
120
+ * @param options - Guardrail options
121
+ * @returns Array of violations found
122
+ */
123
+ function validateMetricLabels(labels, options = {}) {
124
+ // Metric labels use the same rules as span attributes
125
+ return validateSpanAttributes(labels, options);
126
+ }
127
+ /**
128
+ * Report guardrail violations.
129
+ *
130
+ * NOTE: This is for development feedback only. Runtime filtering
131
+ * is handled by the OTEL Collector.
132
+ *
133
+ * @param attributes - Attributes to check
134
+ * @param options - Guardrail options
135
+ * @throws Error in STRICT mode if violations found
136
+ */
137
+ function reportViolations(attributes, options = {}) {
138
+ const opts = { ...DEFAULT_OPTIONS, ...options };
139
+ const violations = validateSpanAttributes(attributes, opts);
140
+ if (violations.length === 0) {
141
+ return;
142
+ }
143
+ switch (opts.mode) {
144
+ case GuardrailMode.STRICT: {
145
+ throw new Error(`Guardrail violations found:\n` +
146
+ violations.map(v => ` - ${v.message}`).join('\n'));
147
+ }
148
+ case GuardrailMode.WARN: {
149
+ violations.forEach(v => {
150
+ console.warn(`[Guardrail] ${v.message}`);
151
+ });
152
+ break;
153
+ }
154
+ }
155
+ }
156
+ /**
157
+ * Check if an attribute key is allowed in Tier 2.
158
+ * Convenience function for quick checks.
159
+ *
160
+ * @param key - Attribute key
161
+ * @returns true if allowed
162
+ */
163
+ function isTier2Allowed(key) {
164
+ return (!tier2_traces_js_1.TIER2_FORBIDDEN_ATTRIBUTES.has(key) &&
165
+ !tier2_traces_js_1.TIER2_DROPPED_ATTRIBUTES.has(key) &&
166
+ !resource_js_1.RESOURCE_ONLY_ATTRIBUTES.has(key));
167
+ }
168
+ /**
169
+ * Check if an attribute should be hashed (by Collector).
170
+ *
171
+ * @param key - Attribute key
172
+ * @returns true if should be hashed
173
+ */
174
+ function shouldHash(key) {
175
+ return tier2_traces_js_1.TIER2_HASHED_ATTRIBUTES.has(key);
176
+ }
177
+ /**
178
+ * Get all forbidden attribute names (for documentation/linting).
179
+ */
180
+ function getForbiddenAttributes() {
181
+ return [...tier2_traces_js_1.TIER2_FORBIDDEN_ATTRIBUTES];
182
+ }
183
+ /**
184
+ * Get all hashed attribute names (for documentation/linting).
185
+ */
186
+ function getHashedAttributes() {
187
+ return [...tier2_traces_js_1.TIER2_HASHED_ATTRIBUTES];
188
+ }
189
+ //# sourceMappingURL=guardrails.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../../src/common/guardrails.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AA+EH,wDAwDC;AASD,oDAMC;AAYD,4CA0BC;AASD,wCAMC;AAQD,gCAEC;AAKD,wDAEC;AAKD,kDAEC;AAhOD,iEAKqC;AACrC,+CAAyD;AAEzD;;GAEG;AACH,IAAY,aASX;AATD,WAAY,aAAa;IACvB,uCAAuC;IACvC,4DAA2C,CAAA;IAC3C,mEAAmE;IACnE,gDAA+B,CAAA;IAC/B,4DAA4D;IAC5D,oDAAmC,CAAA;IACnC,+CAA+C;IAC/C,sDAAqC,CAAA;AACvC,CAAC,EATW,aAAa,6BAAb,aAAa,QASxB;AAgBD;;;;;GAKG;AACH,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,+CAA+C;IAC/C,8BAAa,CAAA;IACb,2CAA2C;IAC3C,kCAAiB,CAAA;AACnB,CAAC,EALW,aAAa,6BAAb,aAAa,QAKxB;AAcD,MAAM,eAAe,GAAqB;IACxC,IAAI,EAAE,aAAa,CAAC,IAAI;IACxB,gBAAgB,EAAE,IAAI;IACtB,oBAAoB,EAAE,GAAG;CAC1B,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAgB,sBAAsB,CACpC,UAAsB,EACtB,UAAqC,EAAE;IAEvC,MAAM,IAAI,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,EAAE,CAAC;IAChD,MAAM,UAAU,GAAyB,EAAE,CAAC;IAE5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,iCAAiC;QACjC,IAAI,4CAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,aAAa,CAAC,mBAAmB;gBACvC,YAAY,EAAE,GAAG;gBACjB,OAAO,EAAE,cAAc,GAAG,sCAAsC;oBAC9D,wCAAwC;gBAC1C,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC;QACL,CAAC;QAED,qCAAqC;QACrC,IAAI,sCAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,YAAY,EAAE,GAAG;gBACjB,OAAO,EAAE,cAAc,GAAG,0DAA0D;oBAClF,qDAAqD;gBACvD,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC;QACL,CAAC;QAED,qCAAqC;QACrC,IAAI,IAAA,0CAAwB,EAAC,KAAK,CAAC,EAAE,CAAC;YACpC,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,aAAa,CAAC,eAAe;gBACnC,YAAY,EAAE,GAAG;gBACjB,OAAO,EAAE,cAAc,GAAG,uDAAuD;oBAC/E,wCAAwC;gBAC1C,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC;QACL,CAAC;QAED,6BAA6B;QAC7B,IAAI,IAAI,CAAC,gBAAgB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvD,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,oBAAqB,EAAE,CAAC;gBAC9C,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,aAAa,CAAC,gBAAgB;oBACpC,YAAY,EAAE,GAAG;oBACjB,OAAO,EAAE,cAAc,GAAG,4BAA4B,KAAK,CAAC,MAAM,WAAW;wBAC3E,8EAA8E;oBAChF,QAAQ,EAAE,SAAS;iBACpB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAClC,MAAiD,EACjD,UAAqC,EAAE;IAEvC,sDAAsD;IACtD,OAAO,sBAAsB,CAAC,MAAoB,EAAE,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,gBAAgB,CAC9B,UAAsB,EACtB,UAAqC,EAAE;IAEvC,MAAM,IAAI,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,EAAE,CAAC;IAChD,MAAM,UAAU,GAAG,sBAAsB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAE5D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,+BAA+B;gBAC/B,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACnD,CAAC;QACJ,CAAC;QAED,KAAK,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;YACxB,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;gBACrB,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC;YACH,MAAM;QACR,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAAC,GAAW;IACxC,OAAO,CACL,CAAC,4CAA0B,CAAC,GAAG,CAAC,GAAG,CAAC;QACpC,CAAC,0CAAwB,CAAC,GAAG,CAAC,GAAG,CAAC;QAClC,CAAC,sCAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CACnC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,UAAU,CAAC,GAAW;IACpC,OAAO,yCAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,SAAgB,sBAAsB;IACpC,OAAO,CAAC,GAAG,4CAA0B,CAAC,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB;IACjC,OAAO,CAAC,GAAG,yCAAuB,CAAC,CAAC;AACtC,CAAC"}
@@ -0,0 +1,16 @@
1
+ /**
2
+ * Common Telemetry Utilities
3
+ *
4
+ * Shared utilities for resource building and policy evaluation.
5
+ *
6
+ * NOTE: Sanitization and routing are handled by the OTEL Collector
7
+ * in the tiered telemetry architecture. See obs/otel-collector/config-tiered.yaml.
8
+ */
9
+ export * from "./deployment-type.js";
10
+ export * from "./resource.js";
11
+ export * from "./policy-evaluator.js";
12
+ export * from "./guardrails.js";
13
+ export * from "./contracts/tier2-traces.js";
14
+ export * from "./log-sanitizer.js";
15
+ export * from "./tier-hints.js";
16
+ //# sourceMappingURL=index.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/common/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,cAAc,sBAAsB,CAAC;AACrC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC"}