@superblocksteam/telemetry 2.0.83-next.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE.txt +87 -0
- package/README.md +155 -0
- package/dist/browser/index.d.ts +8 -0
- package/dist/browser/index.d.ts.map +1 -0
- package/dist/browser/index.js +19 -0
- package/dist/browser/index.js.map +1 -0
- package/dist/browser/init.d.ts +75 -0
- package/dist/browser/init.d.ts.map +1 -0
- package/dist/browser/init.js +169 -0
- package/dist/browser/init.js.map +1 -0
- package/dist/browser/resilient-exporter.d.ts +43 -0
- package/dist/browser/resilient-exporter.d.ts.map +1 -0
- package/dist/browser/resilient-exporter.js +88 -0
- package/dist/browser/resilient-exporter.js.map +1 -0
- package/dist/common/contracts/tier2-traces.d.ts +75 -0
- package/dist/common/contracts/tier2-traces.d.ts.map +1 -0
- package/dist/common/contracts/tier2-traces.js +186 -0
- package/dist/common/contracts/tier2-traces.js.map +1 -0
- package/dist/common/deployment-type.d.ts +18 -0
- package/dist/common/deployment-type.d.ts.map +1 -0
- package/dist/common/deployment-type.js +30 -0
- package/dist/common/deployment-type.js.map +1 -0
- package/dist/common/guardrails.d.ts +116 -0
- package/dist/common/guardrails.d.ts.map +1 -0
- package/dist/common/guardrails.js +189 -0
- package/dist/common/guardrails.js.map +1 -0
- package/dist/common/index.d.ts +16 -0
- package/dist/common/index.d.ts.map +1 -0
- package/dist/common/index.js +32 -0
- package/dist/common/index.js.map +1 -0
- package/dist/common/log-sanitizer.d.ts +78 -0
- package/dist/common/log-sanitizer.d.ts.map +1 -0
- package/dist/common/log-sanitizer.js +340 -0
- package/dist/common/log-sanitizer.js.map +1 -0
- package/dist/common/policy-evaluator.d.ts +103 -0
- package/dist/common/policy-evaluator.d.ts.map +1 -0
- package/dist/common/policy-evaluator.js +200 -0
- package/dist/common/policy-evaluator.js.map +1 -0
- package/dist/common/resource.d.ts +62 -0
- package/dist/common/resource.d.ts.map +1 -0
- package/dist/common/resource.js +106 -0
- package/dist/common/resource.js.map +1 -0
- package/dist/common/tier-hints.d.ts +182 -0
- package/dist/common/tier-hints.d.ts.map +1 -0
- package/dist/common/tier-hints.js +209 -0
- package/dist/common/tier-hints.js.map +1 -0
- package/dist/index.d.ts +43 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +76 -0
- package/dist/index.js.map +1 -0
- package/dist/lint/forbidden-attributes.d.ts +149 -0
- package/dist/lint/forbidden-attributes.d.ts.map +1 -0
- package/dist/lint/forbidden-attributes.js +214 -0
- package/dist/lint/forbidden-attributes.js.map +1 -0
- package/dist/lint/index.d.ts +9 -0
- package/dist/lint/index.d.ts.map +1 -0
- package/dist/lint/index.js +16 -0
- package/dist/lint/index.js.map +1 -0
- package/dist/llmobs/index.d.ts +22 -0
- package/dist/llmobs/index.d.ts.map +1 -0
- package/dist/llmobs/index.js +29 -0
- package/dist/llmobs/index.js.map +1 -0
- package/dist/llmobs/tier1-exporter.d.ts +146 -0
- package/dist/llmobs/tier1-exporter.d.ts.map +1 -0
- package/dist/llmobs/tier1-exporter.js +196 -0
- package/dist/llmobs/tier1-exporter.js.map +1 -0
- package/dist/llmobs/tier2-summarizer.d.ts +268 -0
- package/dist/llmobs/tier2-summarizer.d.ts.map +1 -0
- package/dist/llmobs/tier2-summarizer.js +650 -0
- package/dist/llmobs/tier2-summarizer.js.map +1 -0
- package/dist/node/exporters/resilient-exporter.d.ts +77 -0
- package/dist/node/exporters/resilient-exporter.d.ts.map +1 -0
- package/dist/node/exporters/resilient-exporter.js +129 -0
- package/dist/node/exporters/resilient-exporter.js.map +1 -0
- package/dist/node/index.d.ts +11 -0
- package/dist/node/index.d.ts.map +1 -0
- package/dist/node/index.js +24 -0
- package/dist/node/index.js.map +1 -0
- package/dist/node/init.d.ts +75 -0
- package/dist/node/init.d.ts.map +1 -0
- package/dist/node/init.js +245 -0
- package/dist/node/init.js.map +1 -0
- package/dist/node/log-processor.d.ts +83 -0
- package/dist/node/log-processor.d.ts.map +1 -0
- package/dist/node/log-processor.js +266 -0
- package/dist/node/log-processor.js.map +1 -0
- package/dist/node/metrics-client.d.ts +66 -0
- package/dist/node/metrics-client.d.ts.map +1 -0
- package/dist/node/metrics-client.js +193 -0
- package/dist/node/metrics-client.js.map +1 -0
- package/dist/node/traced-socket.d.ts +76 -0
- package/dist/node/traced-socket.d.ts.map +1 -0
- package/dist/node/traced-socket.js +261 -0
- package/dist/node/traced-socket.js.map +1 -0
- package/dist/testing/in-memory-exporter.d.ts +179 -0
- package/dist/testing/in-memory-exporter.d.ts.map +1 -0
- package/dist/testing/in-memory-exporter.js +254 -0
- package/dist/testing/in-memory-exporter.js.map +1 -0
- package/dist/testing/index.d.ts +8 -0
- package/dist/testing/index.d.ts.map +1 -0
- package/dist/testing/index.js +19 -0
- package/dist/testing/index.js.map +1 -0
- package/dist/testing/test-init.d.ts +80 -0
- package/dist/testing/test-init.d.ts.map +1 -0
- package/dist/testing/test-init.js +144 -0
- package/dist/testing/test-init.js.map +1 -0
- package/dist/types/index.d.ts +40 -0
- package/dist/types/index.d.ts.map +1 -0
- package/dist/types/index.js +23 -0
- package/dist/types/index.js.map +1 -0
- package/dist/types/policy.d.ts +92 -0
- package/dist/types/policy.d.ts.map +1 -0
- package/dist/types/policy.js +125 -0
- package/dist/types/policy.js.map +1 -0
- package/dist-esm/browser/index.d.ts +8 -0
- package/dist-esm/browser/index.d.ts.map +1 -0
- package/dist-esm/browser/index.js +9 -0
- package/dist-esm/browser/index.js.map +1 -0
- package/dist-esm/browser/init.d.ts +75 -0
- package/dist-esm/browser/init.d.ts.map +1 -0
- package/dist-esm/browser/init.js +162 -0
- package/dist-esm/browser/init.js.map +1 -0
- package/dist-esm/browser/resilient-exporter.d.ts +43 -0
- package/dist-esm/browser/resilient-exporter.d.ts.map +1 -0
- package/dist-esm/browser/resilient-exporter.js +84 -0
- package/dist-esm/browser/resilient-exporter.js.map +1 -0
- package/dist-esm/common/contracts/tier2-traces.d.ts +75 -0
- package/dist-esm/common/contracts/tier2-traces.d.ts.map +1 -0
- package/dist-esm/common/contracts/tier2-traces.js +178 -0
- package/dist-esm/common/contracts/tier2-traces.js.map +1 -0
- package/dist-esm/common/deployment-type.d.ts +18 -0
- package/dist-esm/common/deployment-type.d.ts.map +1 -0
- package/dist-esm/common/deployment-type.js +27 -0
- package/dist-esm/common/deployment-type.js.map +1 -0
- package/dist-esm/common/guardrails.d.ts +116 -0
- package/dist-esm/common/guardrails.d.ts.map +1 -0
- package/dist-esm/common/guardrails.js +179 -0
- package/dist-esm/common/guardrails.js.map +1 -0
- package/dist-esm/common/index.d.ts +16 -0
- package/dist-esm/common/index.d.ts.map +1 -0
- package/dist-esm/common/index.js +16 -0
- package/dist-esm/common/index.js.map +1 -0
- package/dist-esm/common/log-sanitizer.d.ts +78 -0
- package/dist-esm/common/log-sanitizer.d.ts.map +1 -0
- package/dist-esm/common/log-sanitizer.js +331 -0
- package/dist-esm/common/log-sanitizer.js.map +1 -0
- package/dist-esm/common/policy-evaluator.d.ts +103 -0
- package/dist-esm/common/policy-evaluator.d.ts.map +1 -0
- package/dist-esm/common/policy-evaluator.js +196 -0
- package/dist-esm/common/policy-evaluator.js.map +1 -0
- package/dist-esm/common/resource.d.ts +62 -0
- package/dist-esm/common/resource.d.ts.map +1 -0
- package/dist-esm/common/resource.js +100 -0
- package/dist-esm/common/resource.js.map +1 -0
- package/dist-esm/common/tier-hints.d.ts +182 -0
- package/dist-esm/common/tier-hints.d.ts.map +1 -0
- package/dist-esm/common/tier-hints.js +199 -0
- package/dist-esm/common/tier-hints.js.map +1 -0
- package/dist-esm/index.d.ts +43 -0
- package/dist-esm/index.d.ts.map +1 -0
- package/dist-esm/index.js +53 -0
- package/dist-esm/index.js.map +1 -0
- package/dist-esm/lint/forbidden-attributes.d.ts +149 -0
- package/dist-esm/lint/forbidden-attributes.d.ts.map +1 -0
- package/dist-esm/lint/forbidden-attributes.js +209 -0
- package/dist-esm/lint/forbidden-attributes.js.map +1 -0
- package/dist-esm/lint/index.d.ts +9 -0
- package/dist-esm/lint/index.d.ts.map +1 -0
- package/dist-esm/lint/index.js +9 -0
- package/dist-esm/lint/index.js.map +1 -0
- package/dist-esm/llmobs/index.d.ts +22 -0
- package/dist-esm/llmobs/index.d.ts.map +1 -0
- package/dist-esm/llmobs/index.js +22 -0
- package/dist-esm/llmobs/index.js.map +1 -0
- package/dist-esm/llmobs/tier1-exporter.d.ts +146 -0
- package/dist-esm/llmobs/tier1-exporter.d.ts.map +1 -0
- package/dist-esm/llmobs/tier1-exporter.js +190 -0
- package/dist-esm/llmobs/tier1-exporter.js.map +1 -0
- package/dist-esm/llmobs/tier2-summarizer.d.ts +268 -0
- package/dist-esm/llmobs/tier2-summarizer.d.ts.map +1 -0
- package/dist-esm/llmobs/tier2-summarizer.js +646 -0
- package/dist-esm/llmobs/tier2-summarizer.js.map +1 -0
- package/dist-esm/node/exporters/resilient-exporter.d.ts +77 -0
- package/dist-esm/node/exporters/resilient-exporter.d.ts.map +1 -0
- package/dist-esm/node/exporters/resilient-exporter.js +125 -0
- package/dist-esm/node/exporters/resilient-exporter.js.map +1 -0
- package/dist-esm/node/index.d.ts +11 -0
- package/dist-esm/node/index.d.ts.map +1 -0
- package/dist-esm/node/index.js +11 -0
- package/dist-esm/node/index.js.map +1 -0
- package/dist-esm/node/init.d.ts +75 -0
- package/dist-esm/node/init.d.ts.map +1 -0
- package/dist-esm/node/init.js +239 -0
- package/dist-esm/node/init.js.map +1 -0
- package/dist-esm/node/log-processor.d.ts +83 -0
- package/dist-esm/node/log-processor.d.ts.map +1 -0
- package/dist-esm/node/log-processor.js +261 -0
- package/dist-esm/node/log-processor.js.map +1 -0
- package/dist-esm/node/metrics-client.d.ts +66 -0
- package/dist-esm/node/metrics-client.d.ts.map +1 -0
- package/dist-esm/node/metrics-client.js +189 -0
- package/dist-esm/node/metrics-client.js.map +1 -0
- package/dist-esm/node/traced-socket.d.ts +76 -0
- package/dist-esm/node/traced-socket.d.ts.map +1 -0
- package/dist-esm/node/traced-socket.js +257 -0
- package/dist-esm/node/traced-socket.js.map +1 -0
- package/dist-esm/testing/in-memory-exporter.d.ts +179 -0
- package/dist-esm/testing/in-memory-exporter.d.ts.map +1 -0
- package/dist-esm/testing/in-memory-exporter.js +248 -0
- package/dist-esm/testing/in-memory-exporter.js.map +1 -0
- package/dist-esm/testing/index.d.ts +8 -0
- package/dist-esm/testing/index.d.ts.map +1 -0
- package/dist-esm/testing/index.js +8 -0
- package/dist-esm/testing/index.js.map +1 -0
- package/dist-esm/testing/test-init.d.ts +80 -0
- package/dist-esm/testing/test-init.d.ts.map +1 -0
- package/dist-esm/testing/test-init.js +137 -0
- package/dist-esm/testing/test-init.js.map +1 -0
- package/dist-esm/types/index.d.ts +40 -0
- package/dist-esm/types/index.d.ts.map +1 -0
- package/dist-esm/types/index.js +7 -0
- package/dist-esm/types/index.js.map +1 -0
- package/dist-esm/types/policy.d.ts +92 -0
- package/dist-esm/types/policy.d.ts.map +1 -0
- package/dist-esm/types/policy.js +122 -0
- package/dist-esm/types/policy.js.map +1 -0
- package/package.json +101 -0
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"resilient-exporter.js","sourceRoot":"","sources":["../../src/browser/resilient-exporter.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAGH,8CAAqE;AAgBrE;;;;;GAKG;AACH,MAAa,wBAAwB;IAClB,QAAQ,CAAe;IACvB,YAAY,CAAS;IACrB,eAAe,CAAS;IACxB,MAAM,CAGb;IAEF,WAAW,GAAG,CAAC,CAAC;IAChB,YAAY,GAAG,KAAK,CAAC;IAE7B,YAAY,MAAsC;QAChD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,GAAG,CAAC;QAC/C,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,KAAK,CAAC;QACvD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,KAAqB,EACrB,cAA8C;QAE9C,yBAAyB;QACzB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,cAAc,CAAC,EAAE,IAAI,EAAE,uBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,qBAAqB;QACrB,IAAI,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACxD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACxC,cAAc,CAAC,EAAE,IAAI,EAAE,uBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;QACjC,IAAI,SAAS,GAAG,KAAK,CAAC;QAEtB,kBAAkB;QAClB,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAChC,IAAI,SAAS;gBAAE,OAAO;YACtB,SAAS,GAAG,IAAI,CAAC;YACjB,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACrC,cAAc,CAAC,EAAE,IAAI,EAAE,uBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QAEzB,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;gBACrC,IAAI,SAAS;oBAAE,OAAO;gBACtB,SAAS,GAAG,IAAI,CAAC;gBACjB,YAAY,CAAC,SAAS,CAAC,CAAC;gBACxB,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;gBAEjC,IAAI,MAAM,CAAC,IAAI,KAAK,uBAAgB,CAAC,OAAO,EAAE,CAAC;oBAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;gBAC7C,CAAC;gBAED,cAAc,CAAC,EAAE,IAAI,EAAE,uBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;YACrD,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,SAAS;gBAAE,OAAO;YACtB,SAAS,GAAG,IAAI,CAAC;YACjB,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YAC3C,cAAc,CAAC,EAAE,IAAI,EAAE,uBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3D,CAAC;CACF;AAlFD,4DAkFC"}
|
|
@@ -0,0 +1,75 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Tier 2 Traces Contract
|
|
3
|
+
*
|
|
4
|
+
* This file defines the Tier 2 telemetry contract:
|
|
5
|
+
* - Forbidden attributes (removed by Collector)
|
|
6
|
+
* - Hashed attributes (pseudonymized by Collector)
|
|
7
|
+
* - Dropped attributes (removed by Collector)
|
|
8
|
+
* - Forbidden value patterns (for lint-time detection)
|
|
9
|
+
*
|
|
10
|
+
* ENFORCEMENT: The OTEL Collector handles runtime enforcement.
|
|
11
|
+
* These definitions are used for:
|
|
12
|
+
* - ESLint rules (static analysis at CI time)
|
|
13
|
+
* - Development warnings (guardrails.ts)
|
|
14
|
+
* - Collector config generation
|
|
15
|
+
*
|
|
16
|
+
* See: obs/otel-collector/config-tiered.yaml
|
|
17
|
+
* Source of truth: engineering/projects/o11y-refactor/contracts/tier2-traces.v0.3.0.json
|
|
18
|
+
*/
|
|
19
|
+
/**
|
|
20
|
+
* Attributes that are FORBIDDEN in Tier 2 telemetry.
|
|
21
|
+
* These contain sensitive data that should never leave the customer's environment.
|
|
22
|
+
* The Collector strips these entirely (not hashed, not present in Tier 2).
|
|
23
|
+
*/
|
|
24
|
+
export declare const TIER2_FORBIDDEN_ATTRIBUTES: Set<string>;
|
|
25
|
+
/**
|
|
26
|
+
* Attributes that should be HASHED (pseudonymized) in Tier 2 telemetry.
|
|
27
|
+
* The Collector replaces these with SHA256 hashes for privacy.
|
|
28
|
+
* Hashes enable aggregate analysis without exposing plaintext identifiers.
|
|
29
|
+
*
|
|
30
|
+
* Mapping:
|
|
31
|
+
* user-email, user.email, etc. → user.hash
|
|
32
|
+
* organization-id, organization_id → organization.hash
|
|
33
|
+
* application-id, application_id → application.hash
|
|
34
|
+
* session.id → session.hash
|
|
35
|
+
* enduser.id → enduser.pseudo.id
|
|
36
|
+
*/
|
|
37
|
+
export declare const TIER2_HASHED_ATTRIBUTES: Set<string>;
|
|
38
|
+
/**
|
|
39
|
+
* Attributes that should be DROPPED entirely in Tier 2.
|
|
40
|
+
* These are correlation IDs that don't provide operational value.
|
|
41
|
+
*/
|
|
42
|
+
export declare const TIER2_DROPPED_ATTRIBUTES: Set<string>;
|
|
43
|
+
/**
|
|
44
|
+
* Spans that should ALWAYS be sampled (never dropped by rate limiting).
|
|
45
|
+
*/
|
|
46
|
+
export declare const ALWAYS_SAMPLE_SPANS: Set<string>;
|
|
47
|
+
/**
|
|
48
|
+
* Patterns that indicate forbidden content in attribute values.
|
|
49
|
+
* Used for secondary filtering when attribute names aren't explicit.
|
|
50
|
+
*
|
|
51
|
+
* IMPORTANT: Patterns should NOT use ^ and $ anchors so they match
|
|
52
|
+
* secrets embedded anywhere in a string (e.g., in query params, headers).
|
|
53
|
+
*/
|
|
54
|
+
export declare const FORBIDDEN_VALUE_PATTERNS: RegExp[];
|
|
55
|
+
/**
|
|
56
|
+
* Check if an attribute name is forbidden in Tier 2.
|
|
57
|
+
*/
|
|
58
|
+
export declare function isForbiddenAttribute(name: string): boolean;
|
|
59
|
+
/**
|
|
60
|
+
* Check if an attribute should be hashed in Tier 2.
|
|
61
|
+
*/
|
|
62
|
+
export declare function isHashedAttribute(name: string): boolean;
|
|
63
|
+
/**
|
|
64
|
+
* Check if an attribute should be dropped in Tier 2.
|
|
65
|
+
*/
|
|
66
|
+
export declare function isDroppedAttribute(name: string): boolean;
|
|
67
|
+
/**
|
|
68
|
+
* Check if a value contains forbidden patterns (like tokens, keys).
|
|
69
|
+
*/
|
|
70
|
+
export declare function containsForbiddenPattern(value: unknown): boolean;
|
|
71
|
+
/**
|
|
72
|
+
* Check if a span should always be sampled.
|
|
73
|
+
*/
|
|
74
|
+
export declare function shouldAlwaysSample(spanName: string): boolean;
|
|
75
|
+
//# sourceMappingURL=tier2-traces.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"tier2-traces.d.ts","sourceRoot":"","sources":["../../../src/common/contracts/tier2-traces.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,aAsDrC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,aAmBlC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,wBAAwB,aAQnC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,mBAAmB,aAE9B,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,UAuBpC,CAAC;AAEF;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGhE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE5D"}
|
|
@@ -0,0 +1,186 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
/**
|
|
3
|
+
* Tier 2 Traces Contract
|
|
4
|
+
*
|
|
5
|
+
* This file defines the Tier 2 telemetry contract:
|
|
6
|
+
* - Forbidden attributes (removed by Collector)
|
|
7
|
+
* - Hashed attributes (pseudonymized by Collector)
|
|
8
|
+
* - Dropped attributes (removed by Collector)
|
|
9
|
+
* - Forbidden value patterns (for lint-time detection)
|
|
10
|
+
*
|
|
11
|
+
* ENFORCEMENT: The OTEL Collector handles runtime enforcement.
|
|
12
|
+
* These definitions are used for:
|
|
13
|
+
* - ESLint rules (static analysis at CI time)
|
|
14
|
+
* - Development warnings (guardrails.ts)
|
|
15
|
+
* - Collector config generation
|
|
16
|
+
*
|
|
17
|
+
* See: obs/otel-collector/config-tiered.yaml
|
|
18
|
+
* Source of truth: engineering/projects/o11y-refactor/contracts/tier2-traces.v0.3.0.json
|
|
19
|
+
*/
|
|
20
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
21
|
+
exports.FORBIDDEN_VALUE_PATTERNS = exports.ALWAYS_SAMPLE_SPANS = exports.TIER2_DROPPED_ATTRIBUTES = exports.TIER2_HASHED_ATTRIBUTES = exports.TIER2_FORBIDDEN_ATTRIBUTES = void 0;
|
|
22
|
+
exports.isForbiddenAttribute = isForbiddenAttribute;
|
|
23
|
+
exports.isHashedAttribute = isHashedAttribute;
|
|
24
|
+
exports.isDroppedAttribute = isDroppedAttribute;
|
|
25
|
+
exports.containsForbiddenPattern = containsForbiddenPattern;
|
|
26
|
+
exports.shouldAlwaysSample = shouldAlwaysSample;
|
|
27
|
+
/**
|
|
28
|
+
* Attributes that are FORBIDDEN in Tier 2 telemetry.
|
|
29
|
+
* These contain sensitive data that should never leave the customer's environment.
|
|
30
|
+
* The Collector strips these entirely (not hashed, not present in Tier 2).
|
|
31
|
+
*/
|
|
32
|
+
exports.TIER2_FORBIDDEN_ATTRIBUTES = new Set([
|
|
33
|
+
// LLM/AI content
|
|
34
|
+
'llmobs.input',
|
|
35
|
+
'llmobs.output',
|
|
36
|
+
'prompt',
|
|
37
|
+
'code',
|
|
38
|
+
'tool_input',
|
|
39
|
+
'tool_output',
|
|
40
|
+
// File content
|
|
41
|
+
'file_path',
|
|
42
|
+
'file_content',
|
|
43
|
+
// Database content
|
|
44
|
+
'db.statement',
|
|
45
|
+
'db.query_text',
|
|
46
|
+
'db.query.text',
|
|
47
|
+
// HTTP bodies and URLs
|
|
48
|
+
'http.request.body',
|
|
49
|
+
'http.response.body',
|
|
50
|
+
'url.full',
|
|
51
|
+
'url.query',
|
|
52
|
+
'http.url',
|
|
53
|
+
'http.target',
|
|
54
|
+
// Resource identifiers (names are customer-specific)
|
|
55
|
+
'api-id',
|
|
56
|
+
'api_id',
|
|
57
|
+
'api-name',
|
|
58
|
+
'api_name',
|
|
59
|
+
'resource-id',
|
|
60
|
+
'resource_id',
|
|
61
|
+
'resource-name',
|
|
62
|
+
'resource_name',
|
|
63
|
+
'integration-id',
|
|
64
|
+
'integration_id',
|
|
65
|
+
'widget-type',
|
|
66
|
+
'branch',
|
|
67
|
+
'commit-id',
|
|
68
|
+
'commit_id',
|
|
69
|
+
'profile-id',
|
|
70
|
+
'profile_id',
|
|
71
|
+
// Stack traces
|
|
72
|
+
'error.stack',
|
|
73
|
+
'exception.stacktrace',
|
|
74
|
+
// Auth/secrets
|
|
75
|
+
'auth_token',
|
|
76
|
+
'api_key',
|
|
77
|
+
'authorization',
|
|
78
|
+
'cookie',
|
|
79
|
+
'x-api-key',
|
|
80
|
+
]);
|
|
81
|
+
/**
|
|
82
|
+
* Attributes that should be HASHED (pseudonymized) in Tier 2 telemetry.
|
|
83
|
+
* The Collector replaces these with SHA256 hashes for privacy.
|
|
84
|
+
* Hashes enable aggregate analysis without exposing plaintext identifiers.
|
|
85
|
+
*
|
|
86
|
+
* Mapping:
|
|
87
|
+
* user-email, user.email, etc. → user.hash
|
|
88
|
+
* organization-id, organization_id → organization.hash
|
|
89
|
+
* application-id, application_id → application.hash
|
|
90
|
+
* session.id → session.hash
|
|
91
|
+
* enduser.id → enduser.pseudo.id
|
|
92
|
+
*/
|
|
93
|
+
exports.TIER2_HASHED_ATTRIBUTES = new Set([
|
|
94
|
+
// User identity (hashed to user.hash)
|
|
95
|
+
'user-email',
|
|
96
|
+
'user.email',
|
|
97
|
+
'user_email',
|
|
98
|
+
'user.id',
|
|
99
|
+
'enduser.email',
|
|
100
|
+
// Organization identity (hashed to organization.hash)
|
|
101
|
+
'organization-id',
|
|
102
|
+
'organization_id',
|
|
103
|
+
// Application identity (hashed to application.hash)
|
|
104
|
+
'application-id',
|
|
105
|
+
'application_id',
|
|
106
|
+
// Session/enduser identity
|
|
107
|
+
'session.id',
|
|
108
|
+
'enduser.id',
|
|
109
|
+
]);
|
|
110
|
+
/**
|
|
111
|
+
* Attributes that should be DROPPED entirely in Tier 2.
|
|
112
|
+
* These are correlation IDs that don't provide operational value.
|
|
113
|
+
*/
|
|
114
|
+
exports.TIER2_DROPPED_ATTRIBUTES = new Set([
|
|
115
|
+
'correlation-id',
|
|
116
|
+
'correlation_id',
|
|
117
|
+
'request-id',
|
|
118
|
+
'request_id',
|
|
119
|
+
'trace-id',
|
|
120
|
+
'execution_id',
|
|
121
|
+
'binding_keys',
|
|
122
|
+
]);
|
|
123
|
+
/**
|
|
124
|
+
* Spans that should ALWAYS be sampled (never dropped by rate limiting).
|
|
125
|
+
*/
|
|
126
|
+
exports.ALWAYS_SAMPLE_SPANS = new Set([
|
|
127
|
+
'api.execute',
|
|
128
|
+
]);
|
|
129
|
+
/**
|
|
130
|
+
* Patterns that indicate forbidden content in attribute values.
|
|
131
|
+
* Used for secondary filtering when attribute names aren't explicit.
|
|
132
|
+
*
|
|
133
|
+
* IMPORTANT: Patterns should NOT use ^ and $ anchors so they match
|
|
134
|
+
* secrets embedded anywhere in a string (e.g., in query params, headers).
|
|
135
|
+
*/
|
|
136
|
+
exports.FORBIDDEN_VALUE_PATTERNS = [
|
|
137
|
+
// JWT tokens (anywhere in string)
|
|
138
|
+
// Header (eyJ...) and payload (eyJ...) must be base64url encoded JSON
|
|
139
|
+
// Signature can be any length (even short for test tokens)
|
|
140
|
+
/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]+/,
|
|
141
|
+
// API keys (sk-/pk- prefix patterns with word boundaries)
|
|
142
|
+
/\b(sk|pk)-[a-zA-Z0-9]{32,}\b/,
|
|
143
|
+
// Bearer tokens (anywhere in string)
|
|
144
|
+
/Bearer\s+[A-Za-z0-9._-]{20,}/,
|
|
145
|
+
// PEM blocks (anywhere in string)
|
|
146
|
+
/-----BEGIN\s+(RSA\s+)?(PRIVATE|PUBLIC)\s+KEY-----/,
|
|
147
|
+
// AWS access key IDs
|
|
148
|
+
/\bAKIA[A-Z0-9]{16}\b/,
|
|
149
|
+
// GitHub tokens
|
|
150
|
+
/\b(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/,
|
|
151
|
+
// Generic API key patterns (key=value or key:value with long alphanumeric)
|
|
152
|
+
/\b(api[_-]?key|apikey|secret[_-]?key|access[_-]?token)[=:]\s*[A-Za-z0-9_-]{20,}\b/i,
|
|
153
|
+
];
|
|
154
|
+
/**
|
|
155
|
+
* Check if an attribute name is forbidden in Tier 2.
|
|
156
|
+
*/
|
|
157
|
+
function isForbiddenAttribute(name) {
|
|
158
|
+
return exports.TIER2_FORBIDDEN_ATTRIBUTES.has(name);
|
|
159
|
+
}
|
|
160
|
+
/**
|
|
161
|
+
* Check if an attribute should be hashed in Tier 2.
|
|
162
|
+
*/
|
|
163
|
+
function isHashedAttribute(name) {
|
|
164
|
+
return exports.TIER2_HASHED_ATTRIBUTES.has(name);
|
|
165
|
+
}
|
|
166
|
+
/**
|
|
167
|
+
* Check if an attribute should be dropped in Tier 2.
|
|
168
|
+
*/
|
|
169
|
+
function isDroppedAttribute(name) {
|
|
170
|
+
return exports.TIER2_DROPPED_ATTRIBUTES.has(name);
|
|
171
|
+
}
|
|
172
|
+
/**
|
|
173
|
+
* Check if a value contains forbidden patterns (like tokens, keys).
|
|
174
|
+
*/
|
|
175
|
+
function containsForbiddenPattern(value) {
|
|
176
|
+
if (typeof value !== 'string')
|
|
177
|
+
return false;
|
|
178
|
+
return exports.FORBIDDEN_VALUE_PATTERNS.some(pattern => pattern.test(value));
|
|
179
|
+
}
|
|
180
|
+
/**
|
|
181
|
+
* Check if a span should always be sampled.
|
|
182
|
+
*/
|
|
183
|
+
function shouldAlwaysSample(spanName) {
|
|
184
|
+
return exports.ALWAYS_SAMPLE_SPANS.has(spanName);
|
|
185
|
+
}
|
|
186
|
+
//# sourceMappingURL=tier2-traces.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"tier2-traces.js","sourceRoot":"","sources":["../../../src/common/contracts/tier2-traces.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;AAwJH,oDAEC;AAKD,8CAEC;AAKD,gDAEC;AAKD,4DAGC;AAKD,gDAEC;AArLD;;;;GAIG;AACU,QAAA,0BAA0B,GAAG,IAAI,GAAG,CAAC;IAChD,iBAAiB;IACjB,cAAc;IACd,eAAe;IACf,QAAQ;IACR,MAAM;IACN,YAAY;IACZ,aAAa;IAEb,eAAe;IACf,WAAW;IACX,cAAc;IAEd,mBAAmB;IACnB,cAAc;IACd,eAAe;IACf,eAAe;IAEf,uBAAuB;IACvB,mBAAmB;IACnB,oBAAoB;IACpB,UAAU;IACV,WAAW;IACX,UAAU;IACV,aAAa;IAEb,qDAAqD;IACrD,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,UAAU;IACV,aAAa;IACb,aAAa;IACb,eAAe;IACf,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,QAAQ;IACR,WAAW;IACX,WAAW;IACX,YAAY;IACZ,YAAY;IAEZ,eAAe;IACf,aAAa;IACb,sBAAsB;IAEtB,eAAe;IACf,YAAY;IACZ,SAAS;IACT,eAAe;IACf,QAAQ;IACR,WAAW;CACZ,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACU,QAAA,uBAAuB,GAAG,IAAI,GAAG,CAAC;IAC7C,sCAAsC;IACtC,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,eAAe;IAEf,sDAAsD;IACtD,iBAAiB;IACjB,iBAAiB;IAEjB,oDAAoD;IACpD,gBAAgB;IAChB,gBAAgB;IAEhB,2BAA2B;IAC3B,YAAY;IACZ,YAAY;CACb,CAAC,CAAC;AAEH;;;GAGG;AACU,QAAA,wBAAwB,GAAG,IAAI,GAAG,CAAC;IAC9C,gBAAgB;IAChB,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,cAAc;IACd,cAAc;CACf,CAAC,CAAC;AAEH;;GAEG;AACU,QAAA,mBAAmB,GAAG,IAAI,GAAG,CAAC;IACzC,aAAa;CACd,CAAC,CAAC;AAEH;;;;;;GAMG;AACU,QAAA,wBAAwB,GAAG;IACtC,kCAAkC;IAClC,sEAAsE;IACtE,2DAA2D;IAC3D,8DAA8D;IAE9D,0DAA0D;IAC1D,8BAA8B;IAE9B,qCAAqC;IACrC,8BAA8B;IAE9B,kCAAkC;IAClC,mDAAmD;IAEnD,qBAAqB;IACrB,sBAAsB;IAEtB,gBAAgB;IAChB,4CAA4C;IAE5C,2EAA2E;IAC3E,oFAAoF;CACrF,CAAC;AAEF;;GAEG;AACH,SAAgB,oBAAoB,CAAC,IAAY;IAC/C,OAAO,kCAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAAC,IAAY;IAC5C,OAAO,+BAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,OAAO,gCAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,SAAgB,wBAAwB,CAAC,KAAc;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,gCAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAAC,QAAgB;IACjD,OAAO,2BAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC"}
|
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Deployment Type Parsing
|
|
3
|
+
*
|
|
4
|
+
* Shared utility for validating and parsing deployment type values.
|
|
5
|
+
* Used by both the server and CLI telemetry initialization.
|
|
6
|
+
*/
|
|
7
|
+
import { DeploymentTypeEnum } from "@superblocksteam/shared";
|
|
8
|
+
/**
|
|
9
|
+
* Parse and validate a deployment type string.
|
|
10
|
+
*
|
|
11
|
+
* Returns CLOUD if not specified. Throws if an invalid value is provided.
|
|
12
|
+
*
|
|
13
|
+
* @param value - Raw deployment type string (typically from env var)
|
|
14
|
+
* @returns Valid DeploymentTypeEnum value
|
|
15
|
+
* @throws Error if value is not a valid DeploymentTypeEnum
|
|
16
|
+
*/
|
|
17
|
+
export declare function parseDeploymentType(value: string | undefined): DeploymentTypeEnum;
|
|
18
|
+
//# sourceMappingURL=deployment-type.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"deployment-type.d.ts","sourceRoot":"","sources":["../../src/common/deployment-type.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,kBAAkB,CAapB"}
|
|
@@ -0,0 +1,30 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
/**
|
|
3
|
+
* Deployment Type Parsing
|
|
4
|
+
*
|
|
5
|
+
* Shared utility for validating and parsing deployment type values.
|
|
6
|
+
* Used by both the server and CLI telemetry initialization.
|
|
7
|
+
*/
|
|
8
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
9
|
+
exports.parseDeploymentType = parseDeploymentType;
|
|
10
|
+
const shared_1 = require("@superblocksteam/shared");
|
|
11
|
+
/**
|
|
12
|
+
* Parse and validate a deployment type string.
|
|
13
|
+
*
|
|
14
|
+
* Returns CLOUD if not specified. Throws if an invalid value is provided.
|
|
15
|
+
*
|
|
16
|
+
* @param value - Raw deployment type string (typically from env var)
|
|
17
|
+
* @returns Valid DeploymentTypeEnum value
|
|
18
|
+
* @throws Error if value is not a valid DeploymentTypeEnum
|
|
19
|
+
*/
|
|
20
|
+
function parseDeploymentType(value) {
|
|
21
|
+
if (!value || value === "") {
|
|
22
|
+
return shared_1.DeploymentTypeEnum.CLOUD;
|
|
23
|
+
}
|
|
24
|
+
if (!Object.values(shared_1.DeploymentTypeEnum).includes(value)) {
|
|
25
|
+
throw new Error(`Invalid SUPERBLOCKS_DEPLOYMENT_TYPE: "${value}". ` +
|
|
26
|
+
`Valid values are: ${Object.values(shared_1.DeploymentTypeEnum).join(", ")}.`);
|
|
27
|
+
}
|
|
28
|
+
return value;
|
|
29
|
+
}
|
|
30
|
+
//# sourceMappingURL=deployment-type.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"deployment-type.js","sourceRoot":"","sources":["../../src/common/deployment-type.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAaH,kDAeC;AA1BD,oDAA6D;AAE7D;;;;;;;;GAQG;AACH,SAAgB,mBAAmB,CACjC,KAAyB;IAEzB,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC3B,OAAO,2BAAkB,CAAC,KAAK,CAAC;IAClC,CAAC;IACD,IACE,CAAC,MAAM,CAAC,MAAM,CAAC,2BAAkB,CAAC,CAAC,QAAQ,CAAC,KAA2B,CAAC,EACxE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,yCAAyC,KAAK,KAAK;YACjD,qBAAqB,MAAM,CAAC,MAAM,CAAC,2BAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,KAA2B,CAAC;AACrC,CAAC"}
|
|
@@ -0,0 +1,116 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Telemetry Guardrails
|
|
3
|
+
*
|
|
4
|
+
* Lint-time guardrails to detect forbidden or high-cardinality attributes.
|
|
5
|
+
*
|
|
6
|
+
* NOTE: In the tiered telemetry architecture, the OTEL Collector handles
|
|
7
|
+
* runtime filtering and sanitization. These guardrails are for:
|
|
8
|
+
* - ESLint rules (static analysis)
|
|
9
|
+
* - Development warnings (not enforcement)
|
|
10
|
+
* - CI validation
|
|
11
|
+
*
|
|
12
|
+
* See obs/otel-collector/config-tiered.yaml for runtime enforcement.
|
|
13
|
+
*/
|
|
14
|
+
import type { Attributes } from '@opentelemetry/api';
|
|
15
|
+
/**
|
|
16
|
+
* Guardrail violation types.
|
|
17
|
+
*/
|
|
18
|
+
export declare enum ViolationType {
|
|
19
|
+
/** Attribute is forbidden in Tier 2 */
|
|
20
|
+
FORBIDDEN_ATTRIBUTE = "forbidden_attribute",
|
|
21
|
+
/** Attribute should be a resource attribute, not span attribute */
|
|
22
|
+
RESOURCE_ONLY = "resource_only",
|
|
23
|
+
/** Value contains forbidden pattern (JWT, API key, etc.) */
|
|
24
|
+
FORBIDDEN_VALUE = "forbidden_value",
|
|
25
|
+
/** Attribute value has too high cardinality */
|
|
26
|
+
HIGH_CARDINALITY = "high_cardinality"
|
|
27
|
+
}
|
|
28
|
+
/**
|
|
29
|
+
* Guardrail violation record.
|
|
30
|
+
*/
|
|
31
|
+
export interface GuardrailViolation {
|
|
32
|
+
/** Type of violation */
|
|
33
|
+
type: ViolationType;
|
|
34
|
+
/** Attribute key that violated */
|
|
35
|
+
attributeKey: string;
|
|
36
|
+
/** Human-readable message */
|
|
37
|
+
message: string;
|
|
38
|
+
/** Severity level */
|
|
39
|
+
severity: 'error' | 'warning';
|
|
40
|
+
}
|
|
41
|
+
/**
|
|
42
|
+
* Mode for guardrail reporting.
|
|
43
|
+
*
|
|
44
|
+
* NOTE: Runtime filtering is handled by the OTEL Collector.
|
|
45
|
+
* These modes are for lint-time/development feedback only.
|
|
46
|
+
*/
|
|
47
|
+
export declare enum GuardrailMode {
|
|
48
|
+
/** Log violations as warnings (development) */
|
|
49
|
+
WARN = "warn",
|
|
50
|
+
/** Throw on violations (CI/strict mode) */
|
|
51
|
+
STRICT = "strict"
|
|
52
|
+
}
|
|
53
|
+
/**
|
|
54
|
+
* Options for guardrail validation.
|
|
55
|
+
*/
|
|
56
|
+
export interface GuardrailOptions {
|
|
57
|
+
/** Reporting mode */
|
|
58
|
+
mode: GuardrailMode;
|
|
59
|
+
/** Whether to check for high-cardinality values */
|
|
60
|
+
checkCardinality?: boolean;
|
|
61
|
+
/** Maximum allowed cardinality for string values */
|
|
62
|
+
maxCardinalityLength?: number;
|
|
63
|
+
}
|
|
64
|
+
/**
|
|
65
|
+
* Validate span attributes against Tier 2 guardrails.
|
|
66
|
+
*
|
|
67
|
+
* This is for lint-time validation. Runtime filtering is handled by Collector.
|
|
68
|
+
*
|
|
69
|
+
* @param attributes - Attributes to validate
|
|
70
|
+
* @param options - Guardrail options
|
|
71
|
+
* @returns Array of violations found
|
|
72
|
+
*/
|
|
73
|
+
export declare function validateSpanAttributes(attributes: Attributes, options?: Partial<GuardrailOptions>): GuardrailViolation[];
|
|
74
|
+
/**
|
|
75
|
+
* Validate metric labels against Tier 2 guardrails.
|
|
76
|
+
*
|
|
77
|
+
* @param labels - Metric labels to validate
|
|
78
|
+
* @param options - Guardrail options
|
|
79
|
+
* @returns Array of violations found
|
|
80
|
+
*/
|
|
81
|
+
export declare function validateMetricLabels(labels: Record<string, string | number | boolean>, options?: Partial<GuardrailOptions>): GuardrailViolation[];
|
|
82
|
+
/**
|
|
83
|
+
* Report guardrail violations.
|
|
84
|
+
*
|
|
85
|
+
* NOTE: This is for development feedback only. Runtime filtering
|
|
86
|
+
* is handled by the OTEL Collector.
|
|
87
|
+
*
|
|
88
|
+
* @param attributes - Attributes to check
|
|
89
|
+
* @param options - Guardrail options
|
|
90
|
+
* @throws Error in STRICT mode if violations found
|
|
91
|
+
*/
|
|
92
|
+
export declare function reportViolations(attributes: Attributes, options?: Partial<GuardrailOptions>): void;
|
|
93
|
+
/**
|
|
94
|
+
* Check if an attribute key is allowed in Tier 2.
|
|
95
|
+
* Convenience function for quick checks.
|
|
96
|
+
*
|
|
97
|
+
* @param key - Attribute key
|
|
98
|
+
* @returns true if allowed
|
|
99
|
+
*/
|
|
100
|
+
export declare function isTier2Allowed(key: string): boolean;
|
|
101
|
+
/**
|
|
102
|
+
* Check if an attribute should be hashed (by Collector).
|
|
103
|
+
*
|
|
104
|
+
* @param key - Attribute key
|
|
105
|
+
* @returns true if should be hashed
|
|
106
|
+
*/
|
|
107
|
+
export declare function shouldHash(key: string): boolean;
|
|
108
|
+
/**
|
|
109
|
+
* Get all forbidden attribute names (for documentation/linting).
|
|
110
|
+
*/
|
|
111
|
+
export declare function getForbiddenAttributes(): string[];
|
|
112
|
+
/**
|
|
113
|
+
* Get all hashed attribute names (for documentation/linting).
|
|
114
|
+
*/
|
|
115
|
+
export declare function getHashedAttributes(): string[];
|
|
116
|
+
//# sourceMappingURL=guardrails.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../../src/common/guardrails.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AASrD;;GAEG;AACH,oBAAY,aAAa;IACvB,uCAAuC;IACvC,mBAAmB,wBAAwB;IAC3C,mEAAmE;IACnE,aAAa,kBAAkB;IAC/B,4DAA4D;IAC5D,eAAe,oBAAoB;IACnC,+CAA+C;IAC/C,gBAAgB,qBAAqB;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,wBAAwB;IACxB,IAAI,EAAE,aAAa,CAAC;IACpB,kCAAkC;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;CAC/B;AAED;;;;;GAKG;AACH,oBAAY,aAAa;IACvB,+CAA+C;IAC/C,IAAI,SAAS;IACb,2CAA2C;IAC3C,MAAM,WAAW;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qBAAqB;IACrB,IAAI,EAAE,aAAa,CAAC;IACpB,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,oDAAoD;IACpD,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAQD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,UAAU,EACtB,OAAO,GAAE,OAAO,CAAC,gBAAgB,CAAM,GACtC,kBAAkB,EAAE,CAqDtB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,EACjD,OAAO,GAAE,OAAO,CAAC,gBAAgB,CAAM,GACtC,kBAAkB,EAAE,CAGtB;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,UAAU,EACtB,OAAO,GAAE,OAAO,CAAC,gBAAgB,CAAM,GACtC,IAAI,CAuBN;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMnD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED;;GAEG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,EAAE,CAEjD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAE9C"}
|
|
@@ -0,0 +1,189 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
/**
|
|
3
|
+
* Telemetry Guardrails
|
|
4
|
+
*
|
|
5
|
+
* Lint-time guardrails to detect forbidden or high-cardinality attributes.
|
|
6
|
+
*
|
|
7
|
+
* NOTE: In the tiered telemetry architecture, the OTEL Collector handles
|
|
8
|
+
* runtime filtering and sanitization. These guardrails are for:
|
|
9
|
+
* - ESLint rules (static analysis)
|
|
10
|
+
* - Development warnings (not enforcement)
|
|
11
|
+
* - CI validation
|
|
12
|
+
*
|
|
13
|
+
* See obs/otel-collector/config-tiered.yaml for runtime enforcement.
|
|
14
|
+
*/
|
|
15
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
16
|
+
exports.GuardrailMode = exports.ViolationType = void 0;
|
|
17
|
+
exports.validateSpanAttributes = validateSpanAttributes;
|
|
18
|
+
exports.validateMetricLabels = validateMetricLabels;
|
|
19
|
+
exports.reportViolations = reportViolations;
|
|
20
|
+
exports.isTier2Allowed = isTier2Allowed;
|
|
21
|
+
exports.shouldHash = shouldHash;
|
|
22
|
+
exports.getForbiddenAttributes = getForbiddenAttributes;
|
|
23
|
+
exports.getHashedAttributes = getHashedAttributes;
|
|
24
|
+
const tier2_traces_js_1 = require("./contracts/tier2-traces.js");
|
|
25
|
+
const resource_js_1 = require("./resource.js");
|
|
26
|
+
/**
|
|
27
|
+
* Guardrail violation types.
|
|
28
|
+
*/
|
|
29
|
+
var ViolationType;
|
|
30
|
+
(function (ViolationType) {
|
|
31
|
+
/** Attribute is forbidden in Tier 2 */
|
|
32
|
+
ViolationType["FORBIDDEN_ATTRIBUTE"] = "forbidden_attribute";
|
|
33
|
+
/** Attribute should be a resource attribute, not span attribute */
|
|
34
|
+
ViolationType["RESOURCE_ONLY"] = "resource_only";
|
|
35
|
+
/** Value contains forbidden pattern (JWT, API key, etc.) */
|
|
36
|
+
ViolationType["FORBIDDEN_VALUE"] = "forbidden_value";
|
|
37
|
+
/** Attribute value has too high cardinality */
|
|
38
|
+
ViolationType["HIGH_CARDINALITY"] = "high_cardinality";
|
|
39
|
+
})(ViolationType || (exports.ViolationType = ViolationType = {}));
|
|
40
|
+
/**
|
|
41
|
+
* Mode for guardrail reporting.
|
|
42
|
+
*
|
|
43
|
+
* NOTE: Runtime filtering is handled by the OTEL Collector.
|
|
44
|
+
* These modes are for lint-time/development feedback only.
|
|
45
|
+
*/
|
|
46
|
+
var GuardrailMode;
|
|
47
|
+
(function (GuardrailMode) {
|
|
48
|
+
/** Log violations as warnings (development) */
|
|
49
|
+
GuardrailMode["WARN"] = "warn";
|
|
50
|
+
/** Throw on violations (CI/strict mode) */
|
|
51
|
+
GuardrailMode["STRICT"] = "strict";
|
|
52
|
+
})(GuardrailMode || (exports.GuardrailMode = GuardrailMode = {}));
|
|
53
|
+
const DEFAULT_OPTIONS = {
|
|
54
|
+
mode: GuardrailMode.WARN,
|
|
55
|
+
checkCardinality: true,
|
|
56
|
+
maxCardinalityLength: 200,
|
|
57
|
+
};
|
|
58
|
+
/**
|
|
59
|
+
* Validate span attributes against Tier 2 guardrails.
|
|
60
|
+
*
|
|
61
|
+
* This is for lint-time validation. Runtime filtering is handled by Collector.
|
|
62
|
+
*
|
|
63
|
+
* @param attributes - Attributes to validate
|
|
64
|
+
* @param options - Guardrail options
|
|
65
|
+
* @returns Array of violations found
|
|
66
|
+
*/
|
|
67
|
+
function validateSpanAttributes(attributes, options = {}) {
|
|
68
|
+
const opts = { ...DEFAULT_OPTIONS, ...options };
|
|
69
|
+
const violations = [];
|
|
70
|
+
for (const [key, value] of Object.entries(attributes)) {
|
|
71
|
+
// Check for forbidden attributes
|
|
72
|
+
if (tier2_traces_js_1.TIER2_FORBIDDEN_ATTRIBUTES.has(key)) {
|
|
73
|
+
violations.push({
|
|
74
|
+
type: ViolationType.FORBIDDEN_ATTRIBUTE,
|
|
75
|
+
attributeKey: key,
|
|
76
|
+
message: `Attribute '${key}' is forbidden in Tier 2 telemetry. ` +
|
|
77
|
+
`Collector will filter this at runtime.`,
|
|
78
|
+
severity: 'warning',
|
|
79
|
+
});
|
|
80
|
+
}
|
|
81
|
+
// Check for resource-only attributes
|
|
82
|
+
if (resource_js_1.RESOURCE_ONLY_ATTRIBUTES.has(key)) {
|
|
83
|
+
violations.push({
|
|
84
|
+
type: ViolationType.RESOURCE_ONLY,
|
|
85
|
+
attributeKey: key,
|
|
86
|
+
message: `Attribute '${key}' should be a RESOURCE attribute, not a span attribute. ` +
|
|
87
|
+
`Set it in initNodeTelemetry() config, not per-span.`,
|
|
88
|
+
severity: 'warning',
|
|
89
|
+
});
|
|
90
|
+
}
|
|
91
|
+
// Check for forbidden value patterns
|
|
92
|
+
if ((0, tier2_traces_js_1.containsForbiddenPattern)(value)) {
|
|
93
|
+
violations.push({
|
|
94
|
+
type: ViolationType.FORBIDDEN_VALUE,
|
|
95
|
+
attributeKey: key,
|
|
96
|
+
message: `Attribute '${key}' contains a forbidden pattern (JWT, API key, etc.). ` +
|
|
97
|
+
`Collector will filter this at runtime.`,
|
|
98
|
+
severity: 'warning',
|
|
99
|
+
});
|
|
100
|
+
}
|
|
101
|
+
// Check for high cardinality
|
|
102
|
+
if (opts.checkCardinality && typeof value === 'string') {
|
|
103
|
+
if (value.length > opts.maxCardinalityLength) {
|
|
104
|
+
violations.push({
|
|
105
|
+
type: ViolationType.HIGH_CARDINALITY,
|
|
106
|
+
attributeKey: key,
|
|
107
|
+
message: `Attribute '${key}' has a very long value (${value.length} chars). ` +
|
|
108
|
+
`This may cause high cardinality. Consider using a shorter, normalized value.`,
|
|
109
|
+
severity: 'warning',
|
|
110
|
+
});
|
|
111
|
+
}
|
|
112
|
+
}
|
|
113
|
+
}
|
|
114
|
+
return violations;
|
|
115
|
+
}
|
|
116
|
+
/**
|
|
117
|
+
* Validate metric labels against Tier 2 guardrails.
|
|
118
|
+
*
|
|
119
|
+
* @param labels - Metric labels to validate
|
|
120
|
+
* @param options - Guardrail options
|
|
121
|
+
* @returns Array of violations found
|
|
122
|
+
*/
|
|
123
|
+
function validateMetricLabels(labels, options = {}) {
|
|
124
|
+
// Metric labels use the same rules as span attributes
|
|
125
|
+
return validateSpanAttributes(labels, options);
|
|
126
|
+
}
|
|
127
|
+
/**
|
|
128
|
+
* Report guardrail violations.
|
|
129
|
+
*
|
|
130
|
+
* NOTE: This is for development feedback only. Runtime filtering
|
|
131
|
+
* is handled by the OTEL Collector.
|
|
132
|
+
*
|
|
133
|
+
* @param attributes - Attributes to check
|
|
134
|
+
* @param options - Guardrail options
|
|
135
|
+
* @throws Error in STRICT mode if violations found
|
|
136
|
+
*/
|
|
137
|
+
function reportViolations(attributes, options = {}) {
|
|
138
|
+
const opts = { ...DEFAULT_OPTIONS, ...options };
|
|
139
|
+
const violations = validateSpanAttributes(attributes, opts);
|
|
140
|
+
if (violations.length === 0) {
|
|
141
|
+
return;
|
|
142
|
+
}
|
|
143
|
+
switch (opts.mode) {
|
|
144
|
+
case GuardrailMode.STRICT: {
|
|
145
|
+
throw new Error(`Guardrail violations found:\n` +
|
|
146
|
+
violations.map(v => ` - ${v.message}`).join('\n'));
|
|
147
|
+
}
|
|
148
|
+
case GuardrailMode.WARN: {
|
|
149
|
+
violations.forEach(v => {
|
|
150
|
+
console.warn(`[Guardrail] ${v.message}`);
|
|
151
|
+
});
|
|
152
|
+
break;
|
|
153
|
+
}
|
|
154
|
+
}
|
|
155
|
+
}
|
|
156
|
+
/**
|
|
157
|
+
* Check if an attribute key is allowed in Tier 2.
|
|
158
|
+
* Convenience function for quick checks.
|
|
159
|
+
*
|
|
160
|
+
* @param key - Attribute key
|
|
161
|
+
* @returns true if allowed
|
|
162
|
+
*/
|
|
163
|
+
function isTier2Allowed(key) {
|
|
164
|
+
return (!tier2_traces_js_1.TIER2_FORBIDDEN_ATTRIBUTES.has(key) &&
|
|
165
|
+
!tier2_traces_js_1.TIER2_DROPPED_ATTRIBUTES.has(key) &&
|
|
166
|
+
!resource_js_1.RESOURCE_ONLY_ATTRIBUTES.has(key));
|
|
167
|
+
}
|
|
168
|
+
/**
|
|
169
|
+
* Check if an attribute should be hashed (by Collector).
|
|
170
|
+
*
|
|
171
|
+
* @param key - Attribute key
|
|
172
|
+
* @returns true if should be hashed
|
|
173
|
+
*/
|
|
174
|
+
function shouldHash(key) {
|
|
175
|
+
return tier2_traces_js_1.TIER2_HASHED_ATTRIBUTES.has(key);
|
|
176
|
+
}
|
|
177
|
+
/**
|
|
178
|
+
* Get all forbidden attribute names (for documentation/linting).
|
|
179
|
+
*/
|
|
180
|
+
function getForbiddenAttributes() {
|
|
181
|
+
return [...tier2_traces_js_1.TIER2_FORBIDDEN_ATTRIBUTES];
|
|
182
|
+
}
|
|
183
|
+
/**
|
|
184
|
+
* Get all hashed attribute names (for documentation/linting).
|
|
185
|
+
*/
|
|
186
|
+
function getHashedAttributes() {
|
|
187
|
+
return [...tier2_traces_js_1.TIER2_HASHED_ATTRIBUTES];
|
|
188
|
+
}
|
|
189
|
+
//# sourceMappingURL=guardrails.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../../src/common/guardrails.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AA+EH,wDAwDC;AASD,oDAMC;AAYD,4CA0BC;AASD,wCAMC;AAQD,gCAEC;AAKD,wDAEC;AAKD,kDAEC;AAhOD,iEAKqC;AACrC,+CAAyD;AAEzD;;GAEG;AACH,IAAY,aASX;AATD,WAAY,aAAa;IACvB,uCAAuC;IACvC,4DAA2C,CAAA;IAC3C,mEAAmE;IACnE,gDAA+B,CAAA;IAC/B,4DAA4D;IAC5D,oDAAmC,CAAA;IACnC,+CAA+C;IAC/C,sDAAqC,CAAA;AACvC,CAAC,EATW,aAAa,6BAAb,aAAa,QASxB;AAgBD;;;;;GAKG;AACH,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,+CAA+C;IAC/C,8BAAa,CAAA;IACb,2CAA2C;IAC3C,kCAAiB,CAAA;AACnB,CAAC,EALW,aAAa,6BAAb,aAAa,QAKxB;AAcD,MAAM,eAAe,GAAqB;IACxC,IAAI,EAAE,aAAa,CAAC,IAAI;IACxB,gBAAgB,EAAE,IAAI;IACtB,oBAAoB,EAAE,GAAG;CAC1B,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAgB,sBAAsB,CACpC,UAAsB,EACtB,UAAqC,EAAE;IAEvC,MAAM,IAAI,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,EAAE,CAAC;IAChD,MAAM,UAAU,GAAyB,EAAE,CAAC;IAE5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,iCAAiC;QACjC,IAAI,4CAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,aAAa,CAAC,mBAAmB;gBACvC,YAAY,EAAE,GAAG;gBACjB,OAAO,EAAE,cAAc,GAAG,sCAAsC;oBAC9D,wCAAwC;gBAC1C,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC;QACL,CAAC;QAED,qCAAqC;QACrC,IAAI,sCAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,YAAY,EAAE,GAAG;gBACjB,OAAO,EAAE,cAAc,GAAG,0DAA0D;oBAClF,qDAAqD;gBACvD,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC;QACL,CAAC;QAED,qCAAqC;QACrC,IAAI,IAAA,0CAAwB,EAAC,KAAK,CAAC,EAAE,CAAC;YACpC,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,aAAa,CAAC,eAAe;gBACnC,YAAY,EAAE,GAAG;gBACjB,OAAO,EAAE,cAAc,GAAG,uDAAuD;oBAC/E,wCAAwC;gBAC1C,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC;QACL,CAAC;QAED,6BAA6B;QAC7B,IAAI,IAAI,CAAC,gBAAgB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvD,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,oBAAqB,EAAE,CAAC;gBAC9C,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,aAAa,CAAC,gBAAgB;oBACpC,YAAY,EAAE,GAAG;oBACjB,OAAO,EAAE,cAAc,GAAG,4BAA4B,KAAK,CAAC,MAAM,WAAW;wBAC3E,8EAA8E;oBAChF,QAAQ,EAAE,SAAS;iBACpB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAClC,MAAiD,EACjD,UAAqC,EAAE;IAEvC,sDAAsD;IACtD,OAAO,sBAAsB,CAAC,MAAoB,EAAE,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,gBAAgB,CAC9B,UAAsB,EACtB,UAAqC,EAAE;IAEvC,MAAM,IAAI,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,EAAE,CAAC;IAChD,MAAM,UAAU,GAAG,sBAAsB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAE5D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,+BAA+B;gBAC/B,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACnD,CAAC;QACJ,CAAC;QAED,KAAK,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;YACxB,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;gBACrB,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC;YACH,MAAM;QACR,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAAC,GAAW;IACxC,OAAO,CACL,CAAC,4CAA0B,CAAC,GAAG,CAAC,GAAG,CAAC;QACpC,CAAC,0CAAwB,CAAC,GAAG,CAAC,GAAG,CAAC;QAClC,CAAC,sCAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CACnC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,UAAU,CAAC,GAAW;IACpC,OAAO,yCAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,SAAgB,sBAAsB;IACpC,OAAO,CAAC,GAAG,4CAA0B,CAAC,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB;IACjC,OAAO,CAAC,GAAG,yCAAuB,CAAC,CAAC;AACtC,CAAC"}
|
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Common Telemetry Utilities
|
|
3
|
+
*
|
|
4
|
+
* Shared utilities for resource building and policy evaluation.
|
|
5
|
+
*
|
|
6
|
+
* NOTE: Sanitization and routing are handled by the OTEL Collector
|
|
7
|
+
* in the tiered telemetry architecture. See obs/otel-collector/config-tiered.yaml.
|
|
8
|
+
*/
|
|
9
|
+
export * from "./deployment-type.js";
|
|
10
|
+
export * from "./resource.js";
|
|
11
|
+
export * from "./policy-evaluator.js";
|
|
12
|
+
export * from "./guardrails.js";
|
|
13
|
+
export * from "./contracts/tier2-traces.js";
|
|
14
|
+
export * from "./log-sanitizer.js";
|
|
15
|
+
export * from "./tier-hints.js";
|
|
16
|
+
//# sourceMappingURL=index.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/common/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,cAAc,sBAAsB,CAAC;AACrC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC"}
|