@superblocksteam/telemetry 2.0.93 → 2.0.94-next.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (159) hide show
  1. package/README.md +59 -44
  2. package/dist/browser/index.d.ts +2 -2
  3. package/dist/browser/resilient-exporter.d.ts.map +1 -1
  4. package/dist/browser/resilient-exporter.js.map +1 -1
  5. package/dist/common/contracts/tier2-traces.d.ts +62 -50
  6. package/dist/common/contracts/tier2-traces.d.ts.map +1 -1
  7. package/dist/common/contracts/tier2-traces.js +484 -138
  8. package/dist/common/contracts/tier2-traces.js.map +1 -1
  9. package/dist/common/guardrails.d.ts +2 -2
  10. package/dist/common/guardrails.d.ts.map +1 -1
  11. package/dist/common/guardrails.js +7 -7
  12. package/dist/common/guardrails.js.map +1 -1
  13. package/dist/common/log-sanitizer.d.ts +88 -0
  14. package/dist/common/log-sanitizer.d.ts.map +1 -1
  15. package/dist/common/log-sanitizer.js +304 -6
  16. package/dist/common/log-sanitizer.js.map +1 -1
  17. package/dist/common/resource.d.ts +4 -1
  18. package/dist/common/resource.d.ts.map +1 -1
  19. package/dist/common/resource.js +4 -2
  20. package/dist/common/resource.js.map +1 -1
  21. package/dist/common/trace-sanitizer.d.ts +82 -0
  22. package/dist/common/trace-sanitizer.d.ts.map +1 -0
  23. package/dist/common/trace-sanitizer.js +230 -0
  24. package/dist/common/trace-sanitizer.js.map +1 -0
  25. package/dist/index.d.ts +2 -1
  26. package/dist/index.d.ts.map +1 -1
  27. package/dist/index.js +16 -8
  28. package/dist/index.js.map +1 -1
  29. package/dist/lint/forbidden-attributes.d.ts +2 -2
  30. package/dist/lint/forbidden-attributes.d.ts.map +1 -1
  31. package/dist/lint/forbidden-attributes.js +41 -40
  32. package/dist/lint/forbidden-attributes.js.map +1 -1
  33. package/dist/lint/index.d.ts +1 -1
  34. package/dist/llmobs/index.d.ts +2 -2
  35. package/dist/llmobs/tier1-exporter.d.ts +2 -2
  36. package/dist/llmobs/tier1-exporter.d.ts.map +1 -1
  37. package/dist/llmobs/tier1-exporter.js +17 -14
  38. package/dist/llmobs/tier1-exporter.js.map +1 -1
  39. package/dist/llmobs/tier2-summarizer.d.ts.map +1 -1
  40. package/dist/llmobs/tier2-summarizer.js +10 -4
  41. package/dist/llmobs/tier2-summarizer.js.map +1 -1
  42. package/dist/node/exporters/resilient-exporter.d.ts +14 -0
  43. package/dist/node/exporters/resilient-exporter.d.ts.map +1 -1
  44. package/dist/node/exporters/resilient-exporter.js +8 -1
  45. package/dist/node/exporters/resilient-exporter.js.map +1 -1
  46. package/dist/node/index.d.ts +2 -1
  47. package/dist/node/index.d.ts.map +1 -1
  48. package/dist/node/index.js +7 -2
  49. package/dist/node/index.js.map +1 -1
  50. package/dist/node/init.d.ts.map +1 -1
  51. package/dist/node/init.js +61 -12
  52. package/dist/node/init.js.map +1 -1
  53. package/dist/node/log-processor.d.ts +41 -6
  54. package/dist/node/log-processor.d.ts.map +1 -1
  55. package/dist/node/log-processor.js +152 -61
  56. package/dist/node/log-processor.js.map +1 -1
  57. package/dist/node/metrics-client.d.ts.map +1 -1
  58. package/dist/node/metrics-client.js.map +1 -1
  59. package/dist/node/safe-logger.d.ts +55 -0
  60. package/dist/node/safe-logger.d.ts.map +1 -0
  61. package/dist/node/safe-logger.js +158 -0
  62. package/dist/node/safe-logger.js.map +1 -0
  63. package/dist/node/sanitizing-processor.d.ts +56 -0
  64. package/dist/node/sanitizing-processor.d.ts.map +1 -0
  65. package/dist/node/sanitizing-processor.js +124 -0
  66. package/dist/node/sanitizing-processor.js.map +1 -0
  67. package/dist/node/traced-socket.d.ts +47 -3
  68. package/dist/node/traced-socket.d.ts.map +1 -1
  69. package/dist/node/traced-socket.js +96 -19
  70. package/dist/node/traced-socket.js.map +1 -1
  71. package/dist/testing/in-memory-exporter.d.ts +3 -3
  72. package/dist/testing/in-memory-exporter.d.ts.map +1 -1
  73. package/dist/testing/in-memory-exporter.js +3 -1
  74. package/dist/testing/in-memory-exporter.js.map +1 -1
  75. package/dist/testing/index.d.ts +2 -2
  76. package/dist/types/index.d.ts +28 -1
  77. package/dist/types/index.d.ts.map +1 -1
  78. package/dist-esm/browser/index.d.ts +2 -2
  79. package/dist-esm/browser/index.js +2 -2
  80. package/dist-esm/browser/resilient-exporter.d.ts.map +1 -1
  81. package/dist-esm/browser/resilient-exporter.js.map +1 -1
  82. package/dist-esm/common/contracts/tier2-traces.d.ts +62 -50
  83. package/dist-esm/common/contracts/tier2-traces.d.ts.map +1 -1
  84. package/dist-esm/common/contracts/tier2-traces.js +480 -137
  85. package/dist-esm/common/contracts/tier2-traces.js.map +1 -1
  86. package/dist-esm/common/guardrails.d.ts +2 -2
  87. package/dist-esm/common/guardrails.d.ts.map +1 -1
  88. package/dist-esm/common/guardrails.js +9 -9
  89. package/dist-esm/common/guardrails.js.map +1 -1
  90. package/dist-esm/common/log-sanitizer.d.ts +88 -0
  91. package/dist-esm/common/log-sanitizer.d.ts.map +1 -1
  92. package/dist-esm/common/log-sanitizer.js +294 -5
  93. package/dist-esm/common/log-sanitizer.js.map +1 -1
  94. package/dist-esm/common/resource.d.ts +4 -1
  95. package/dist-esm/common/resource.d.ts.map +1 -1
  96. package/dist-esm/common/resource.js +3 -1
  97. package/dist-esm/common/resource.js.map +1 -1
  98. package/dist-esm/common/trace-sanitizer.d.ts +82 -0
  99. package/dist-esm/common/trace-sanitizer.d.ts.map +1 -0
  100. package/dist-esm/common/trace-sanitizer.js +226 -0
  101. package/dist-esm/common/trace-sanitizer.js.map +1 -0
  102. package/dist-esm/index.d.ts +2 -1
  103. package/dist-esm/index.d.ts.map +1 -1
  104. package/dist-esm/index.js +2 -1
  105. package/dist-esm/index.js.map +1 -1
  106. package/dist-esm/lint/forbidden-attributes.d.ts +2 -2
  107. package/dist-esm/lint/forbidden-attributes.d.ts.map +1 -1
  108. package/dist-esm/lint/forbidden-attributes.js +43 -42
  109. package/dist-esm/lint/forbidden-attributes.js.map +1 -1
  110. package/dist-esm/lint/index.d.ts +1 -1
  111. package/dist-esm/lint/index.js +1 -1
  112. package/dist-esm/llmobs/index.d.ts +2 -2
  113. package/dist-esm/llmobs/index.js +2 -2
  114. package/dist-esm/llmobs/tier1-exporter.d.ts +2 -2
  115. package/dist-esm/llmobs/tier1-exporter.d.ts.map +1 -1
  116. package/dist-esm/llmobs/tier1-exporter.js +18 -15
  117. package/dist-esm/llmobs/tier1-exporter.js.map +1 -1
  118. package/dist-esm/llmobs/tier2-summarizer.d.ts.map +1 -1
  119. package/dist-esm/llmobs/tier2-summarizer.js +10 -4
  120. package/dist-esm/llmobs/tier2-summarizer.js.map +1 -1
  121. package/dist-esm/node/exporters/resilient-exporter.d.ts +14 -0
  122. package/dist-esm/node/exporters/resilient-exporter.d.ts.map +1 -1
  123. package/dist-esm/node/exporters/resilient-exporter.js +8 -1
  124. package/dist-esm/node/exporters/resilient-exporter.js.map +1 -1
  125. package/dist-esm/node/index.d.ts +2 -1
  126. package/dist-esm/node/index.d.ts.map +1 -1
  127. package/dist-esm/node/index.js +2 -1
  128. package/dist-esm/node/index.js.map +1 -1
  129. package/dist-esm/node/init.d.ts.map +1 -1
  130. package/dist-esm/node/init.js +61 -12
  131. package/dist-esm/node/init.js.map +1 -1
  132. package/dist-esm/node/log-processor.d.ts +41 -6
  133. package/dist-esm/node/log-processor.d.ts.map +1 -1
  134. package/dist-esm/node/log-processor.js +151 -62
  135. package/dist-esm/node/log-processor.js.map +1 -1
  136. package/dist-esm/node/metrics-client.d.ts.map +1 -1
  137. package/dist-esm/node/metrics-client.js.map +1 -1
  138. package/dist-esm/node/safe-logger.d.ts +55 -0
  139. package/dist-esm/node/safe-logger.d.ts.map +1 -0
  140. package/dist-esm/node/safe-logger.js +154 -0
  141. package/dist-esm/node/safe-logger.js.map +1 -0
  142. package/dist-esm/node/sanitizing-processor.d.ts +56 -0
  143. package/dist-esm/node/sanitizing-processor.d.ts.map +1 -0
  144. package/dist-esm/node/sanitizing-processor.js +120 -0
  145. package/dist-esm/node/sanitizing-processor.js.map +1 -0
  146. package/dist-esm/node/traced-socket.d.ts +47 -3
  147. package/dist-esm/node/traced-socket.d.ts.map +1 -1
  148. package/dist-esm/node/traced-socket.js +96 -19
  149. package/dist-esm/node/traced-socket.js.map +1 -1
  150. package/dist-esm/testing/in-memory-exporter.d.ts +3 -3
  151. package/dist-esm/testing/in-memory-exporter.d.ts.map +1 -1
  152. package/dist-esm/testing/in-memory-exporter.js +4 -2
  153. package/dist-esm/testing/in-memory-exporter.js.map +1 -1
  154. package/dist-esm/testing/index.d.ts +2 -2
  155. package/dist-esm/testing/index.js +2 -2
  156. package/dist-esm/types/index.d.ts +28 -1
  157. package/dist-esm/types/index.d.ts.map +1 -1
  158. package/dist-esm/types/index.js +1 -1
  159. package/package.json +17 -18
@@ -1 +1 @@
1
- {"version":3,"file":"tier2-traces.js","sourceRoot":"","sources":["../../../src/common/contracts/tier2-traces.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IAChD,iBAAiB;IACjB,cAAc;IACd,eAAe;IACf,QAAQ;IACR,MAAM;IACN,YAAY;IACZ,aAAa;IAEb,eAAe;IACf,WAAW;IACX,cAAc;IAEd,mBAAmB;IACnB,cAAc;IACd,eAAe;IACf,eAAe;IAEf,uBAAuB;IACvB,mBAAmB;IACnB,oBAAoB;IACpB,UAAU;IACV,WAAW;IACX,UAAU;IACV,aAAa;IAEb,qDAAqD;IACrD,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,UAAU;IACV,aAAa;IACb,aAAa;IACb,eAAe;IACf,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,QAAQ;IACR,WAAW;IACX,WAAW;IACX,YAAY;IACZ,YAAY;IAEZ,eAAe;IACf,aAAa;IACb,sBAAsB;IAEtB,eAAe;IACf,YAAY;IACZ,SAAS;IACT,eAAe;IACf,QAAQ;IACR,WAAW;CACZ,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IAC7C,sCAAsC;IACtC,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,eAAe;IAEf,sDAAsD;IACtD,iBAAiB;IACjB,iBAAiB;IAEjB,oDAAoD;IACpD,gBAAgB;IAChB,gBAAgB;IAEhB,2BAA2B;IAC3B,YAAY;IACZ,YAAY;CACb,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IAC9C,gBAAgB;IAChB,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,cAAc;IACd,cAAc;CACf,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IACzC,aAAa;CACd,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,kCAAkC;IAClC,sEAAsE;IACtE,2DAA2D;IAC3D,8DAA8D;IAE9D,0DAA0D;IAC1D,8BAA8B;IAE9B,qCAAqC;IACrC,8BAA8B;IAE9B,kCAAkC;IAClC,mDAAmD;IAEnD,qBAAqB;IACrB,sBAAsB;IAEtB,gBAAgB;IAChB,4CAA4C;IAE5C,2EAA2E;IAC3E,oFAAoF;CACrF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,OAAO,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC"}
1
+ {"version":3,"file":"tier2-traces.js","sourceRoot":"","sources":["../../../src/common/contracts/tier2-traces.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAsB7D,MAAM,UAAU,gBAAgB,CAAC,IAAsB;IACrD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAqB;IACrD;QACE,IAAI,EAAE,YAAY;QAClB,iBAAiB,EAAE;YACjB,aAAa;YACb,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,EAAE;YAC3C,kBAAkB;YAClB,8BAA8B;YAC9B,EAAE,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE;SACrE;KACF;IACD;QACE,IAAI,EAAE,aAAa;QACnB,iBAAiB,EAAE;YACjB,aAAa;YACb,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,EAAE;YAC3C,kBAAkB;YAClB,8BAA8B;YAC9B,6BAA6B;YAC7B,EAAE,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE;SACrE;KACF;IACD;QACE,IAAI,EAAE,YAAY;QAClB,iBAAiB,EAAE;YACjB,aAAa;YACb,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,EAAE;YAC3C,kBAAkB;YAClB,8BAA8B;YAC9B,6BAA6B;SAC9B;KACF;IACD;QACE,IAAI,EAAE,eAAe;QACrB,iBAAiB,EAAE;YACjB,aAAa;YACb,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,EAAE;YAC3C,kBAAkB;YAClB,8BAA8B;SAC/B;KACF;IACD;QACE,IAAI,EAAE,cAAc;QACpB,iBAAiB,EAAE;YACjB,aAAa;YACb,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,EAAE;YAC3C,kBAAkB;YAClB,8BAA8B;YAC9B,6BAA6B;SAC9B;KACF;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,iBAAiB,EAAE;YACjB,aAAa;YACb,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,EAAE;YAC3C,kBAAkB;YAClB,8BAA8B;YAC9B,6BAA6B;YAC7B,EAAE,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE;YACpE,eAAe;SAChB;KACF;IACD;QACE,IAAI,EAAE,aAAa;QACnB,iBAAiB,EAAE;YACjB,EAAE,IAAI,EAAE,kBAAkB,EAAE,aAAa,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE;YAChE,EAAE,IAAI,EAAE,4BAA4B,EAAE,aAAa,EAAE,CAAC,WAAW,CAAC,EAAE;YACpE,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,EAAE,EAAE;SAC3C;KACF;IACD;QACE,IAAI,EAAE,aAAa;QACnB,iBAAiB,EAAE;YACjB,EAAE,IAAI,EAAE,kBAAkB,EAAE,aAAa,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE;SACjE;KACF;IACD;QACE,IAAI,EAAE,cAAc;QACpB,iBAAiB,EAAE;YACjB,EAAE,IAAI,EAAE,kBAAkB,EAAE,aAAa,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE;YAChE,EAAE,IAAI,EAAE,4BAA4B,EAAE,aAAa,EAAE,CAAC,WAAW,CAAC,EAAE;SACrE;KACF;IACD;QACE,IAAI,EAAE,aAAa;QACnB,YAAY,EAAE,IAAI;QAClB,iBAAiB,EAAE;YACjB,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE;YACrE;gBACE,IAAI,EAAE,YAAY;gBAClB,aAAa,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC;aAC5D;YACD,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,eAAe,CAAC,EAAE;YACzE,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1C,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3C,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;YACpD,kBAAkB;YAClB,yBAAyB;SAC1B;KACF;IACD;QACE,IAAI,EAAE,UAAU;QAChB,iBAAiB,EAAE;YACjB,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,EAAE;YACzC,EAAE,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE;YAC5D,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5C,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5C,kBAAkB;SACnB;KACF;IACD;QACE,IAAI,EAAE,aAAa;QACnB,iBAAiB,EAAE;YACjB,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,EAAE,EAAE;YAC1C,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE;SAC9D;KACF;IACD;QACE,IAAI,EAAE,UAAU;QAChB,iBAAiB,EAAE;YACjB,EAAE,IAAI,EAAE,aAAa,EAAE,cAAc,EAAE,EAAE,EAAE;YAC3C;gBACE,IAAI,EAAE,cAAc;gBACpB,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC;aAC7D;YACD,EAAE,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE;YACjE,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC9C,kBAAkB;SACnB;KACF;IACD;QACE,IAAI,EAAE,MAAM;QACZ,iBAAiB,EAAE;YACjB;gBACE,IAAI,EAAE,WAAW;gBACjB,aAAa,EAAE;oBACb,YAAY;oBACZ,OAAO;oBACP,OAAO;oBACP,SAAS;oBACT,OAAO;oBACP,WAAW;oBACX,UAAU;oBACV,YAAY;oBACZ,UAAU;oBACV,QAAQ;iBACT;aACF;YACD;gBACE,IAAI,EAAE,cAAc;gBACpB,aAAa,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC;aACjE;YACD,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE;YACvC,kBAAkB;SACnB;KACF;IACD;QACE,IAAI,EAAE,aAAa;QACnB,iBAAiB,EAAE;YACjB;gBACE,IAAI,EAAE,uBAAuB;gBAC7B,aAAa,EAAE;oBACb,MAAM;oBACN,iBAAiB;oBACjB,YAAY;oBACZ,cAAc;oBACd,cAAc;oBACd,kBAAkB;iBACnB;aACF;YACD;gBACE,IAAI,EAAE,eAAe;gBACrB,aAAa,EAAE;oBACb,QAAQ;oBACR,WAAW;oBACX,aAAa;oBACb,iBAAiB;oBACjB,oBAAoB;oBACpB,YAAY;oBACZ,eAAe;oBACf,QAAQ;oBACR,YAAY;oBACZ,UAAU;oBACV,MAAM;iBACP;aACF;YACD;gBACE,IAAI,EAAE,sBAAsB;gBAC5B,aAAa,EAAE;oBACb,QAAQ;oBACR,WAAW;oBACX,aAAa;oBACb,iBAAiB;oBACjB,oBAAoB;oBACpB,YAAY;oBACZ,eAAe;oBACf,QAAQ;oBACR,YAAY;oBACZ,UAAU;oBACV,MAAM;iBACP;aACF;YACD,EAAE,IAAI,EAAE,sBAAsB,EAAE,cAAc,EAAE,EAAE,EAAE;YACpD,EAAE,IAAI,EAAE,uBAAuB,EAAE,cAAc,EAAE,EAAE,EAAE;YACrD,cAAc;YACd,WAAW;YACX,YAAY;YACZ;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,aAAa,EAAE;oBACb,MAAM;oBACN,YAAY;oBACZ,gBAAgB;oBAChB,gBAAgB;oBAChB,OAAO;oBACP,SAAS;oBACT,SAAS;oBACT,YAAY;oBACZ,WAAW;oBACX,kBAAkB;oBAClB,SAAS;oBACT,SAAS;iBACV;aACF;YACD,iBAAiB;YACjB,2BAA2B;YAC3B,4BAA4B;YAC5B,kBAAkB;YAClB,mBAAmB;YACnB,kBAAkB;YAClB,sBAAsB;YACtB,mBAAmB;YACnB,cAAc;YACd,EAAE,IAAI,EAAE,mCAAmC,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC7D,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,QAAQ,EAAE;YACtD,gCAAgC;YAChC,mBAAmB;YACnB,kBAAkB;SACnB;KACF;IACD;QACE,IAAI,EAAE,eAAe;QACrB,iBAAiB,EAAE;YACjB,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,EAAE;YACzC,EAAE,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE;YAC5D;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,aAAa,EAAE;oBACb,MAAM;oBACN,SAAS;oBACT,iBAAiB;oBACjB,kBAAkB;oBAClB,mBAAmB;oBACnB,WAAW;oBACX,SAAS;iBACV;aACF;YACD,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5C,kBAAkB;SACnB;KACF;IACD;QACE,IAAI,EAAE,eAAe;QACrB,iBAAiB,EAAE;YACjB,cAAc;YACd,WAAW;YACX,kBAAkB;YAClB,gBAAgB;SACjB;KACF;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,iBAAiB,EAAE;YACjB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE;YACvC;gBACE,IAAI,EAAE,WAAW;gBACjB,aAAa,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC;aAC9D;SACF;KACF;IACD;QACE,IAAI,EAAE,eAAe;QACrB,iBAAiB,EAAE;YACjB,qBAAqB;YACrB,oBAAoB;YACpB,wBAAwB;YACxB,yBAAyB;YACzB,sBAAsB;YACtB;gBACE,IAAI,EAAE,iBAAiB;gBACvB,aAAa,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC;aAC/C;SACF;KACF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,iBAAiB,EAAE;YACjB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1C;gBACE,IAAI,EAAE,aAAa;gBACnB,aAAa,EAAE,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,OAAO,CAAC;aACjE;YACD,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC7C;KACF;IACD;QACE,IAAI,EAAE,QAAQ;QACd,iBAAiB,EAAE;YACjB,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,MAAM,CAAC,EAAE;YAC/C,EAAE,IAAI,EAAE,aAAa,EAAE,cAAc,EAAE,EAAE,EAAE;YAC3C,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,EAAE;YAC3C,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE;SACjD;KACF;IACD;QACE,IAAI,EAAE,SAAS;QACf,iBAAiB,EAAE;YACjB,EAAE,IAAI,EAAE,kBAAkB,EAAE,aAAa,EAAE,CAAC,OAAO,CAAC,EAAE;YACtD,EAAE,IAAI,EAAE,uBAAuB,EAAE,cAAc,EAAE,EAAE,EAAE;YACrD;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,aAAa,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;aACjD;SACF;KACF;IACD;QACE,IAAI,EAAE,SAAS;QACf,iBAAiB,EAAE;YACjB,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,OAAO,CAAC,EAAE;YAC/C,EAAE,IAAI,EAAE,cAAc,EAAE,cAAc,EAAE,EAAE,EAAE;SAC7C;KACF;IACD;QACE,IAAI,EAAE,OAAO;QACb,iBAAiB,EAAE;YACjB,aAAa;YACb,kBAAkB;YAClB,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,GAAG,EAAE;SAC3C;KACF;IACD;QACE,IAAI,EAAE,YAAY;QAClB,iBAAiB,EAAE;YACjB;gBACE,IAAI,EAAE,eAAe;gBACrB,aAAa,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC;aAChD;YACD;gBACE,IAAI,EAAE,iBAAiB;gBACvB,aAAa,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC;aAC/C;SACF;KACF;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAqB;IACpD,EAAE,IAAI,EAAE,GAAG,EAAE,iBAAiB,EAAE,EAAE,EAAE;CACrC,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,cAAkC;IAElC,QAAQ,cAAc,EAAE,CAAC;QACvB,KAAK,kBAAkB,CAAC,KAAK;YAC3B,OAAO,oBAAoB,CAAC;QAC9B,KAAK,kBAAkB,CAAC,UAAU,CAAC;QACnC;YACE,OAAO,qBAAqB,CAAC;IACjC,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,6DAA6D;AAC7D,8EAA8E;AAE9E,8FAA8F;AAC9F,MAAM,CAAC,MAAM,gCAAgC,GAAa;IACxD,cAAc;IACd,eAAe;IACf,QAAQ;IACR,MAAM;IACN,YAAY;IACZ,aAAa;IACb,WAAW;IACX,cAAc;IACd,cAAc;IACd,eAAe;IACf,eAAe;IACf,mBAAmB;IACnB,oBAAoB;IACpB,UAAU;IACV,WAAW;IACX,UAAU;IACV,aAAa;IACb,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,eAAe;IACf,UAAU;IACV,UAAU;IACV,eAAe;IACf,eAAe;IACf,aAAa;IACb,QAAQ;IACR,aAAa;IACb,sBAAsB;IACtB,YAAY;IACZ,SAAS;IACT,eAAe;IACf,QAAQ;IACR,WAAW;CACZ,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,6BAA6B,GAAa,EAAE,CAAC;AAE1D,iFAAiF;AACjF,MAAM,CAAC,MAAM,mCAAmC,GAAa,CAAC,cAAc,CAAC,CAAC;AAE9E,8EAA8E;AAC9E,uDAAuD;AACvD,8EAA8E;AAE9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAC/C,gCAAgC,CACjC,CAAC;AACF,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,6BAA6B,CAAC,CAAC;AAC9E,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAC7C,mCAAmC,CACpC,CAAC;AAEF,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAE9E,iFAAiF;AACjF,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;AAgB9C;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,cAAkC;IAElC,MAAM,eAAe,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IACzD,MAAM,6BAA6B,GAAG,IAAI,CAAC;IAC3C,QAAQ,cAAc,EAAE,CAAC;QACvB,KAAK,kBAAkB,CAAC,KAAK;YAC3B,OAAO;gBACL,mBAAmB,EAAE,mBAAmB;gBACxC,iBAAiB,EAAE,mBAAmB;gBACtC,gBAAgB,EAAE,mBAAmB;gBACrC,eAAe;gBACf,6BAA6B;aAC9B,CAAC;QACJ,KAAK,kBAAkB,CAAC,UAAU,CAAC;QACnC;YACE,OAAO;gBACL,mBAAmB,EAAE,0BAA0B;gBAC/C,iBAAiB,EAAE,wBAAwB;gBAC3C,gBAAgB,EAAE,uBAAuB;gBACzC,eAAe;gBACf,6BAA6B;aAC9B,CAAC;IACN,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAE9E,0FAA0F;AAC1F,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;AAE5D;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,8DAA8D;IAC9D,8BAA8B;IAC9B,8BAA8B;IAC9B,mDAAmD;IACnD,sBAAsB;IACtB,4CAA4C;IAC5C,oFAAoF;CACrF,CAAC;AAEF,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,OAAO,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC"}
@@ -11,7 +11,7 @@
11
11
  *
12
12
  * See obs/otel-collector/config-tiered.yaml for runtime enforcement.
13
13
  */
14
- import type { Attributes } from '@opentelemetry/api';
14
+ import type { Attributes } from "@opentelemetry/api";
15
15
  /**
16
16
  * Guardrail violation types.
17
17
  */
@@ -36,7 +36,7 @@ export interface GuardrailViolation {
36
36
  /** Human-readable message */
37
37
  message: string;
38
38
  /** Severity level */
39
- severity: 'error' | 'warning';
39
+ severity: "error" | "warning";
40
40
  }
41
41
  /**
42
42
  * Mode for guardrail reporting.
@@ -1 +1 @@
1
- {"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../../src/common/guardrails.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AASrD;;GAEG;AACH,oBAAY,aAAa;IACvB,uCAAuC;IACvC,mBAAmB,wBAAwB;IAC3C,mEAAmE;IACnE,aAAa,kBAAkB;IAC/B,4DAA4D;IAC5D,eAAe,oBAAoB;IACnC,+CAA+C;IAC/C,gBAAgB,qBAAqB;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,wBAAwB;IACxB,IAAI,EAAE,aAAa,CAAC;IACpB,kCAAkC;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;CAC/B;AAED;;;;;GAKG;AACH,oBAAY,aAAa;IACvB,+CAA+C;IAC/C,IAAI,SAAS;IACb,2CAA2C;IAC3C,MAAM,WAAW;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qBAAqB;IACrB,IAAI,EAAE,aAAa,CAAC;IACpB,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,oDAAoD;IACpD,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAQD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,UAAU,EACtB,OAAO,GAAE,OAAO,CAAC,gBAAgB,CAAM,GACtC,kBAAkB,EAAE,CAqDtB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,EACjD,OAAO,GAAE,OAAO,CAAC,gBAAgB,CAAM,GACtC,kBAAkB,EAAE,CAGtB;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,UAAU,EACtB,OAAO,GAAE,OAAO,CAAC,gBAAgB,CAAM,GACtC,IAAI,CAuBN;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMnD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED;;GAEG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,EAAE,CAEjD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAE9C"}
1
+ {"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../../src/common/guardrails.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AASrD;;GAEG;AACH,oBAAY,aAAa;IACvB,uCAAuC;IACvC,mBAAmB,wBAAwB;IAC3C,mEAAmE;IACnE,aAAa,kBAAkB;IAC/B,4DAA4D;IAC5D,eAAe,oBAAoB;IACnC,+CAA+C;IAC/C,gBAAgB,qBAAqB;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,wBAAwB;IACxB,IAAI,EAAE,aAAa,CAAC;IACpB,kCAAkC;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;CAC/B;AAED;;;;;GAKG;AACH,oBAAY,aAAa;IACvB,+CAA+C;IAC/C,IAAI,SAAS;IACb,2CAA2C;IAC3C,MAAM,WAAW;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qBAAqB;IACrB,IAAI,EAAE,aAAa,CAAC;IACpB,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,oDAAoD;IACpD,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAQD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,UAAU,EACtB,OAAO,GAAE,OAAO,CAAC,gBAAgB,CAAM,GACtC,kBAAkB,EAAE,CAyDtB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,EACjD,OAAO,GAAE,OAAO,CAAC,gBAAgB,CAAM,GACtC,kBAAkB,EAAE,CAGtB;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,UAAU,EACtB,OAAO,GAAE,OAAO,CAAC,gBAAgB,CAAM,GACtC,IAAI,CAuBN;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMnD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED;;GAEG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,EAAE,CAEjD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAE9C"}
@@ -11,8 +11,8 @@
11
11
  *
12
12
  * See obs/otel-collector/config-tiered.yaml for runtime enforcement.
13
13
  */
14
- import { TIER2_FORBIDDEN_ATTRIBUTES, TIER2_HASHED_ATTRIBUTES, TIER2_DROPPED_ATTRIBUTES, containsForbiddenPattern, } from './contracts/tier2-traces.js';
15
- import { RESOURCE_ONLY_ATTRIBUTES } from './resource.js';
14
+ import { TIER2_FORBIDDEN_ATTRIBUTES, TIER2_HASHED_ATTRIBUTES, TIER2_DROPPED_ATTRIBUTES, containsForbiddenPattern, } from "./contracts/tier2-traces.js";
15
+ import { RESOURCE_ONLY_ATTRIBUTES } from "./resource.js";
16
16
  /**
17
17
  * Guardrail violation types.
18
18
  */
@@ -65,7 +65,7 @@ export function validateSpanAttributes(attributes, options = {}) {
65
65
  attributeKey: key,
66
66
  message: `Attribute '${key}' is forbidden in Tier 2 telemetry. ` +
67
67
  `Collector will filter this at runtime.`,
68
- severity: 'warning',
68
+ severity: "warning",
69
69
  });
70
70
  }
71
71
  // Check for resource-only attributes
@@ -75,7 +75,7 @@ export function validateSpanAttributes(attributes, options = {}) {
75
75
  attributeKey: key,
76
76
  message: `Attribute '${key}' should be a RESOURCE attribute, not a span attribute. ` +
77
77
  `Set it in initNodeTelemetry() config, not per-span.`,
78
- severity: 'warning',
78
+ severity: "warning",
79
79
  });
80
80
  }
81
81
  // Check for forbidden value patterns
@@ -85,18 +85,18 @@ export function validateSpanAttributes(attributes, options = {}) {
85
85
  attributeKey: key,
86
86
  message: `Attribute '${key}' contains a forbidden pattern (JWT, API key, etc.). ` +
87
87
  `Collector will filter this at runtime.`,
88
- severity: 'warning',
88
+ severity: "warning",
89
89
  });
90
90
  }
91
91
  // Check for high cardinality
92
- if (opts.checkCardinality && typeof value === 'string') {
92
+ if (opts.checkCardinality && typeof value === "string") {
93
93
  if (value.length > opts.maxCardinalityLength) {
94
94
  violations.push({
95
95
  type: ViolationType.HIGH_CARDINALITY,
96
96
  attributeKey: key,
97
97
  message: `Attribute '${key}' has a very long value (${value.length} chars). ` +
98
98
  `This may cause high cardinality. Consider using a shorter, normalized value.`,
99
- severity: 'warning',
99
+ severity: "warning",
100
100
  });
101
101
  }
102
102
  }
@@ -133,10 +133,10 @@ export function reportViolations(attributes, options = {}) {
133
133
  switch (opts.mode) {
134
134
  case GuardrailMode.STRICT: {
135
135
  throw new Error(`Guardrail violations found:\n` +
136
- violations.map(v => ` - ${v.message}`).join('\n'));
136
+ violations.map((v) => ` - ${v.message}`).join("\n"));
137
137
  }
138
138
  case GuardrailMode.WARN: {
139
- violations.forEach(v => {
139
+ violations.forEach((v) => {
140
140
  console.warn(`[Guardrail] ${v.message}`);
141
141
  });
142
142
  break;
@@ -1 +1 @@
1
- {"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../../src/common/guardrails.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAEzD;;GAEG;AACH,MAAM,CAAN,IAAY,aASX;AATD,WAAY,aAAa;IACvB,uCAAuC;IACvC,4DAA2C,CAAA;IAC3C,mEAAmE;IACnE,gDAA+B,CAAA;IAC/B,4DAA4D;IAC5D,oDAAmC,CAAA;IACnC,+CAA+C;IAC/C,sDAAqC,CAAA;AACvC,CAAC,EATW,aAAa,KAAb,aAAa,QASxB;AAgBD;;;;;GAKG;AACH,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,+CAA+C;IAC/C,8BAAa,CAAA;IACb,2CAA2C;IAC3C,kCAAiB,CAAA;AACnB,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AAcD,MAAM,eAAe,GAAqB;IACxC,IAAI,EAAE,aAAa,CAAC,IAAI;IACxB,gBAAgB,EAAE,IAAI;IACtB,oBAAoB,EAAE,GAAG;CAC1B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAsB,EACtB,UAAqC,EAAE;IAEvC,MAAM,IAAI,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,EAAE,CAAC;IAChD,MAAM,UAAU,GAAyB,EAAE,CAAC;IAE5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,iCAAiC;QACjC,IAAI,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,aAAa,CAAC,mBAAmB;gBACvC,YAAY,EAAE,GAAG;gBACjB,OAAO,EAAE,cAAc,GAAG,sCAAsC;oBAC9D,wCAAwC;gBAC1C,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC;QACL,CAAC;QAED,qCAAqC;QACrC,IAAI,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,YAAY,EAAE,GAAG;gBACjB,OAAO,EAAE,cAAc,GAAG,0DAA0D;oBAClF,qDAAqD;gBACvD,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC;QACL,CAAC;QAED,qCAAqC;QACrC,IAAI,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,aAAa,CAAC,eAAe;gBACnC,YAAY,EAAE,GAAG;gBACjB,OAAO,EAAE,cAAc,GAAG,uDAAuD;oBAC/E,wCAAwC;gBAC1C,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC;QACL,CAAC;QAED,6BAA6B;QAC7B,IAAI,IAAI,CAAC,gBAAgB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvD,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,oBAAqB,EAAE,CAAC;gBAC9C,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,aAAa,CAAC,gBAAgB;oBACpC,YAAY,EAAE,GAAG;oBACjB,OAAO,EAAE,cAAc,GAAG,4BAA4B,KAAK,CAAC,MAAM,WAAW;wBAC3E,8EAA8E;oBAChF,QAAQ,EAAE,SAAS;iBACpB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAiD,EACjD,UAAqC,EAAE;IAEvC,sDAAsD;IACtD,OAAO,sBAAsB,CAAC,MAAoB,EAAE,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAsB,EACtB,UAAqC,EAAE;IAEvC,MAAM,IAAI,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,EAAE,CAAC;IAChD,MAAM,UAAU,GAAG,sBAAsB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAE5D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,+BAA+B;gBAC/B,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACnD,CAAC;QACJ,CAAC;QAED,KAAK,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;YACxB,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;gBACrB,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC;YACH,MAAM;QACR,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,CACL,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC;QACpC,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC;QAClC,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CACnC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,CAAC,GAAG,0BAA0B,CAAC,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,CAAC,GAAG,uBAAuB,CAAC,CAAC;AACtC,CAAC"}
1
+ {"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../../src/common/guardrails.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAEzD;;GAEG;AACH,MAAM,CAAN,IAAY,aASX;AATD,WAAY,aAAa;IACvB,uCAAuC;IACvC,4DAA2C,CAAA;IAC3C,mEAAmE;IACnE,gDAA+B,CAAA;IAC/B,4DAA4D;IAC5D,oDAAmC,CAAA;IACnC,+CAA+C;IAC/C,sDAAqC,CAAA;AACvC,CAAC,EATW,aAAa,KAAb,aAAa,QASxB;AAgBD;;;;;GAKG;AACH,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,+CAA+C;IAC/C,8BAAa,CAAA;IACb,2CAA2C;IAC3C,kCAAiB,CAAA;AACnB,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AAcD,MAAM,eAAe,GAAqB;IACxC,IAAI,EAAE,aAAa,CAAC,IAAI;IACxB,gBAAgB,EAAE,IAAI;IACtB,oBAAoB,EAAE,GAAG;CAC1B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAsB,EACtB,UAAqC,EAAE;IAEvC,MAAM,IAAI,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,EAAE,CAAC;IAChD,MAAM,UAAU,GAAyB,EAAE,CAAC;IAE5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,iCAAiC;QACjC,IAAI,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,aAAa,CAAC,mBAAmB;gBACvC,YAAY,EAAE,GAAG;gBACjB,OAAO,EACL,cAAc,GAAG,sCAAsC;oBACvD,wCAAwC;gBAC1C,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC;QACL,CAAC;QAED,qCAAqC;QACrC,IAAI,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,YAAY,EAAE,GAAG;gBACjB,OAAO,EACL,cAAc,GAAG,0DAA0D;oBAC3E,qDAAqD;gBACvD,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC;QACL,CAAC;QAED,qCAAqC;QACrC,IAAI,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,aAAa,CAAC,eAAe;gBACnC,YAAY,EAAE,GAAG;gBACjB,OAAO,EACL,cAAc,GAAG,uDAAuD;oBACxE,wCAAwC;gBAC1C,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC;QACL,CAAC;QAED,6BAA6B;QAC7B,IAAI,IAAI,CAAC,gBAAgB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvD,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,oBAAqB,EAAE,CAAC;gBAC9C,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,aAAa,CAAC,gBAAgB;oBACpC,YAAY,EAAE,GAAG;oBACjB,OAAO,EACL,cAAc,GAAG,4BAA4B,KAAK,CAAC,MAAM,WAAW;wBACpE,8EAA8E;oBAChF,QAAQ,EAAE,SAAS;iBACpB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAiD,EACjD,UAAqC,EAAE;IAEvC,sDAAsD;IACtD,OAAO,sBAAsB,CAAC,MAAoB,EAAE,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAsB,EACtB,UAAqC,EAAE;IAEvC,MAAM,IAAI,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,EAAE,CAAC;IAChD,MAAM,UAAU,GAAG,sBAAsB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAE5D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,+BAA+B;gBAC7B,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACvD,CAAC;QACJ,CAAC;QAED,KAAK,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;YACxB,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;gBACvB,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC;YACH,MAAM;QACR,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,CACL,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC;QACpC,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC;QAClC,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CACnC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,CAAC,GAAG,0BAA0B,CAAC,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,CAAC,GAAG,uBAAuB,CAAC,CAAC;AACtC,CAAC"}
@@ -14,6 +14,12 @@
14
14
  *
15
15
  * @see https://github.com/superblocksteam/engineering/blob/main/projects/o11y-refactor/epics/epic-c4-logging-strategy.md
16
16
  */
17
+ /**
18
+ * Patterns that indicate tokens, keys, and secrets in log messages.
19
+ * These use capture groups to preserve prefixes while redacting values.
20
+ * Exported as DEFAULT_SECRET_PATTERNS for use in LoggingPolicyConfig (e.g. cloud-prem).
21
+ */
22
+ export declare const DEFAULT_SECRET_PATTERNS: SensitivePattern[];
17
23
  /**
18
24
  * Fields that contain secrets and should be stripped from log objects.
19
25
  * Only includes actual secret field names - NOT debugging info.
@@ -22,10 +28,81 @@
22
28
  * Those are handled by the OTel Collector for tier-based export filtering.
23
29
  */
24
30
  export declare const SECRET_FIELDS: Set<string>;
31
+ /**
32
+ * Patterns for compound field names that contain secrets.
33
+ * Uses word boundary matching to avoid false positives.
34
+ * Exported for use in LoggingPolicyConfig (e.g. cloud-prem).
35
+ */
36
+ export declare const SECRET_FIELD_PATTERNS: RegExp[];
25
37
  /**
26
38
  * Check if a field name contains secrets using word boundary matching.
27
39
  */
28
40
  export declare function isSecretField(fieldName: string): boolean;
41
+ /**
42
+ * Policy-driven secret field check. When names and patterns are empty, returns false.
43
+ * Used by PolicyAwareLogProcessor so cloud can pass empty set/array for no redaction.
44
+ */
45
+ export declare function isSecretFieldFromPolicy(fieldName: string, secretFieldNames: Set<string>, secretFieldPatterns: RegExp[]): boolean;
46
+ /**
47
+ * Placeholder string used when redacting forbidden or secret fields in logs.
48
+ * Use this constant so all packages (server, telemetry) share one value.
49
+ */
50
+ export declare const REDACTED_PLACEHOLDER = "[REDACTED]";
51
+ /**
52
+ * Field names that must never be included in exported logs (stack, prompt, code, etc.).
53
+ * Used as the base for both cloud and cloud-prem.
54
+ */
55
+ export declare const BASE_EXPORT_FORBIDDEN_FIELDS: Set<string>;
56
+ /** Export-forbidden fields for cloud (base only; email keys allowed). */
57
+ export declare const EXPORT_FORBIDDEN_FIELDS_CLOUD: Set<string>;
58
+ /** Export-forbidden fields for cloud-prem (base + email keys). */
59
+ export declare const EXPORT_FORBIDDEN_FIELDS_CLOUD_PREM: Set<string>;
60
+ export declare function isStackAttributeKey(key: string): boolean;
61
+ /**
62
+ * Check if a string contains a stack trace (for export redaction).
63
+ */
64
+ export declare function containsStackTrace(text: string): boolean;
65
+ /** Placeholder for stack trace redaction in exported logs. Exported for use in log-processor. */
66
+ export declare const STACK_TRACE_REDACTED_PLACEHOLDER = "[STACK TRACE REDACTED - Tier 1 only]";
67
+ /**
68
+ * Apply redact patterns to a string with a single replacement (resets lastIndex on each pattern).
69
+ */
70
+ export declare function applyRedactPatterns(str: string, patterns: RegExp[], replacement?: string): string;
71
+ /**
72
+ * A pattern and its replacement for sensitive value redaction (e.g. path, email).
73
+ * Configured in logging policy alongside forbiddenFields and redactPatterns.
74
+ */
75
+ export interface SensitivePattern {
76
+ pattern: RegExp;
77
+ replacement: string;
78
+ }
79
+ /** Sensitive patterns for cloud: path only (emails are not redacted in cloud). */
80
+ export declare const SENSITIVE_PATTERNS_CLOUD: SensitivePattern[];
81
+ /** Default sensitive patterns (path, email) for cloud-prem and when export is strict. */
82
+ export declare const DEFAULT_SENSITIVE_PATTERNS: SensitivePattern[];
83
+ /**
84
+ * Regex patterns for cloud-prem log export: matched content is replaced with [REDACTED].
85
+ * Used as redactPatterns in LoggingPolicyConfig when deploymentType is CLOUD_PREM.
86
+ */
87
+ export declare const CLOUD_PREM_REDACT_PATTERNS: RegExp[];
88
+ /**
89
+ * Apply sensitive patterns (pattern + replacement) to text.
90
+ * Used with policy.sensitivePatterns whenever redacting values for export.
91
+ */
92
+ export declare function redactSensitivePatterns(text: string, patterns: SensitivePattern[]): string;
93
+ /**
94
+ * Redact stack trace for export: keep first line (error message) after sanitizing
95
+ * it with sensitive patterns, replace the rest with a placeholder.
96
+ * Use when exporting logs so stack traces never leave the environment.
97
+ *
98
+ * @param messageSecretPatterns - When non-empty, applied to first line before sensitivePatterns (policy-driven). When empty, uses sanitizeLogMessage for first line.
99
+ */
100
+ export declare function redactStackTraceForExport(text: string, sensitivePatterns?: SensitivePattern[], messageSecretPatterns?: SensitivePattern[]): string;
101
+ /**
102
+ * Sanitize a log message string for export: sensitive patterns, then policy redact patterns, then
103
+ * stack trace redaction. Use for the message argument in log calls (e.g. safe logger stdout path).
104
+ */
105
+ export declare function sanitizeLogMessageForExport(message: string, redactPatterns: RegExp[], sensitivePatterns: SensitivePattern[]): string;
29
106
  /**
30
107
  * @deprecated Use SECRET_FIELDS instead. This export is kept for backward
31
108
  * compatibility but now only contains secret fields, not Tier 1 content fields.
@@ -57,6 +134,17 @@ export declare function redactStackTrace(stack: string): string;
57
134
  * @returns Object with secrets removed
58
135
  */
59
136
  export declare function sanitizeLogObject<T>(obj: T, depth?: number): T;
137
+ /**
138
+ * Sanitize an object for export: exclude forbidden keys (omitted), redact secret keys (key kept, value [REDACTED]),
139
+ * and apply sensitive patterns to string values. Used by PolicyAwareLogProcessor when exporting log body objects.
140
+ */
141
+ export declare function sanitizeLogObjectForExport(obj: unknown, forbiddenFields: Set<string>, depth?: number, sensitivePatterns?: SensitivePattern[]): unknown;
142
+ /**
143
+ * Sanitize a log record for export with both key-based and value-based redaction.
144
+ * Applies sensitivePatterns and redactPatterns to every string value.
145
+ * Use for the server stdout path (safe logger and RemoteLogger redactRecord) so exported logs match OTLP behavior.
146
+ */
147
+ export declare function sanitizeLogRecordForExport(obj: unknown, forbiddenFields: Set<string>, redactPatterns: RegExp[], sensitivePatterns: SensitivePattern[], depth?: number): unknown;
60
148
  /**
61
149
  * Sanitizes secrets from an error object.
62
150
  * Preserves full stack traces for debugging.
@@ -1 +1 @@
1
- {"version":3,"file":"log-sanitizer.d.ts","sourceRoot":"","sources":["../../src/common/log-sanitizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAmFH;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,aAqBxB,CAAC;AA+BH;;GAEG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAMxD;AAMD;;;GAGG;AACH,eAAO,MAAM,0BAA0B,aAAgB,CAAC;AAMxD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAc1D;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOtD;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,SAAI,GAAG,CAAC,CAyCzD;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAsCxD;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,OAAO,EACZ,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GACtB,MAAM,CA6DR"}
1
+ {"version":3,"file":"log-sanitizer.d.ts","sourceRoot":"","sources":["../../src/common/log-sanitizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,gBAAgB,EAmErD,CAAC;AAMF;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,aAqBxB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,EAuBzC,CAAC;AAEF;;GAEG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAMxD;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,EAC7B,mBAAmB,EAAE,MAAM,EAAE,GAC5B,OAAO,CAST;AAMD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAEjD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,aAQvC,CAAC;AAQH,yEAAyE;AACzE,eAAO,MAAM,6BAA6B,aAEzC,CAAC;AAEF,kEAAkE;AAClE,eAAO,MAAM,kCAAkC,aAG7C,CAAC;AAYH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOxD;AAED,iGAAiG;AACjG,eAAO,MAAM,gCAAgC,yCACL,CAAC;AAEzC;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAAE,EAClB,WAAW,GAAE,MAA6B,GACzC,MAAM,CAQR;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,kFAAkF;AAClF,eAAO,MAAM,wBAAwB,EAAE,gBAAgB,EAKtD,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,0BAA0B,EAAE,gBAAgB,EAIxD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,0BAA0B,EAAE,MAAM,EAO9C,CAAC;AAEF;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,gBAAgB,EAAE,GAC3B,MAAM,CAQR;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,iBAAiB,GAAE,gBAAgB,EAAO,EAC1C,qBAAqB,GAAE,gBAAgB,EAAO,GAC7C,MAAM,CAWR;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,MAAM,EAAE,EACxB,iBAAiB,EAAE,gBAAgB,EAAE,GACpC,MAAM,CAcR;AAmCD;;;GAGG;AACH,eAAO,MAAM,0BAA0B,aAAgB,CAAC;AAMxD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAc1D;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOtD;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,SAAI,GAAG,CAAC,CAyCzD;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,OAAO,EACZ,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,EAC5B,KAAK,SAAI,EACT,iBAAiB,GAAE,gBAAgB,EAAO,GACzC,OAAO,CAoET;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,OAAO,EACZ,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,EAC5B,cAAc,EAAE,MAAM,EAAE,EACxB,iBAAiB,EAAE,gBAAgB,EAAE,EACrC,KAAK,SAAI,GACR,OAAO,CA2ET;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAsCxD;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,OAAO,EACZ,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GACtB,MAAM,CA6DR"}
@@ -20,8 +20,9 @@
20
20
  /**
21
21
  * Patterns that indicate tokens, keys, and secrets in log messages.
22
22
  * These use capture groups to preserve prefixes while redacting values.
23
+ * Exported as DEFAULT_SECRET_PATTERNS for use in LoggingPolicyConfig (e.g. cloud-prem).
23
24
  */
24
- const SECRET_PATTERNS = [
25
+ export const DEFAULT_SECRET_PATTERNS = [
25
26
  // Tokens and keys with prefixes
26
27
  {
27
28
  pattern: /(\bbearer\s+)[a-zA-Z0-9\-._~+/]+=*/gi,
@@ -115,8 +116,9 @@ export const SECRET_FIELDS = new Set([
115
116
  /**
116
117
  * Patterns for compound field names that contain secrets.
117
118
  * Uses word boundary matching to avoid false positives.
119
+ * Exported for use in LoggingPolicyConfig (e.g. cloud-prem).
118
120
  */
119
- const SECRET_FIELD_PATTERNS = [
121
+ export const SECRET_FIELD_PATTERNS = [
120
122
  // Password patterns
121
123
  /(?:^|[._-])password(?:[._-]|$)/i,
122
124
  /(?:^|[._-])passwd(?:[._-]|$)/i,
@@ -139,11 +141,188 @@ const SECRET_FIELD_PATTERNS = [
139
141
  * Check if a field name contains secrets using word boundary matching.
140
142
  */
141
143
  export function isSecretField(fieldName) {
144
+ return isSecretFieldFromPolicy(fieldName, SECRET_FIELDS, SECRET_FIELD_PATTERNS);
145
+ }
146
+ /**
147
+ * Policy-driven secret field check. When names and patterns are empty, returns false.
148
+ * Used by PolicyAwareLogProcessor so cloud can pass empty set/array for no redaction.
149
+ */
150
+ export function isSecretFieldFromPolicy(fieldName, secretFieldNames, secretFieldPatterns) {
151
+ if (secretFieldNames.size === 0 && secretFieldPatterns.length === 0) {
152
+ return false;
153
+ }
142
154
  const lowerKey = fieldName.toLowerCase();
143
- if (SECRET_FIELDS.has(lowerKey)) {
155
+ if (secretFieldNames.has(lowerKey)) {
156
+ return true;
157
+ }
158
+ return secretFieldPatterns.some((pattern) => pattern.test(lowerKey));
159
+ }
160
+ // ============================================================================
161
+ // Export-forbidden fields (Tier 1 content - must not appear in exported logs)
162
+ // ============================================================================
163
+ /**
164
+ * Placeholder string used when redacting forbidden or secret fields in logs.
165
+ * Use this constant so all packages (server, telemetry) share one value.
166
+ */
167
+ export const REDACTED_PLACEHOLDER = "[REDACTED]";
168
+ /**
169
+ * Field names that must never be included in exported logs (stack, prompt, code, etc.).
170
+ * Used as the base for both cloud and cloud-prem.
171
+ */
172
+ export const BASE_EXPORT_FORBIDDEN_FIELDS = new Set([
173
+ "code",
174
+ "error.stack",
175
+ "exception.stacktrace",
176
+ "filecontent",
177
+ "filepath",
178
+ "prompt",
179
+ "stack",
180
+ ]);
181
+ /** Email-related keys forbidden in cloud-prem export only (allowed in cloud). */
182
+ const EXPORT_FORBIDDEN_EMAIL_KEYS = new Set([
183
+ "user.email",
184
+ "user-email", // server req.logTags key (OBS_TAG_USER_EMAIL) for child logger bindings
185
+ ]);
186
+ /** Export-forbidden fields for cloud (base only; email keys allowed). */
187
+ export const EXPORT_FORBIDDEN_FIELDS_CLOUD = new Set(BASE_EXPORT_FORBIDDEN_FIELDS);
188
+ /** Export-forbidden fields for cloud-prem (base + email keys). */
189
+ export const EXPORT_FORBIDDEN_FIELDS_CLOUD_PREM = new Set([
190
+ ...BASE_EXPORT_FORBIDDEN_FIELDS,
191
+ ...EXPORT_FORBIDDEN_EMAIL_KEYS,
192
+ ]);
193
+ /**
194
+ * Attribute keys that conventionally hold stack traces (epic C4). Value-based
195
+ * sanitization (containsStackTrace) redacts stack content in any key.
196
+ */
197
+ const STACK_ATTRIBUTE_KEYS = new Set([
198
+ "error.stack",
199
+ "exception.stacktrace",
200
+ "stack",
201
+ ]);
202
+ export function isStackAttributeKey(key) {
203
+ return STACK_ATTRIBUTE_KEYS.has(key.toLowerCase());
204
+ }
205
+ /**
206
+ * Check if a string contains a stack trace (for export redaction).
207
+ */
208
+ export function containsStackTrace(text) {
209
+ if (!text || typeof text !== "string")
210
+ return false;
211
+ if (/at .+\(.+:\d+:\d+\)/.test(text))
212
+ return true;
213
+ if (/goroutine \d+ \[.+\]:/.test(text))
144
214
  return true;
215
+ if (/File ".+", line \d+/.test(text))
216
+ return true;
217
+ if (/at \w+\.\w+\(.+\.java:\d+\)/.test(text))
218
+ return true;
219
+ return false;
220
+ }
221
+ /** Placeholder for stack trace redaction in exported logs. Exported for use in log-processor. */
222
+ export const STACK_TRACE_REDACTED_PLACEHOLDER = "[STACK TRACE REDACTED - Tier 1 only]";
223
+ /**
224
+ * Apply redact patterns to a string with a single replacement (resets lastIndex on each pattern).
225
+ */
226
+ export function applyRedactPatterns(str, patterns, replacement = REDACTED_PLACEHOLDER) {
227
+ if (!str || typeof str !== "string")
228
+ return str;
229
+ let out = str;
230
+ for (const pattern of patterns) {
231
+ pattern.lastIndex = 0;
232
+ out = out.replace(pattern, replacement);
233
+ }
234
+ return out;
235
+ }
236
+ /** Sensitive patterns for cloud: path only (emails are not redacted in cloud). */
237
+ export const SENSITIVE_PATTERNS_CLOUD = [
238
+ {
239
+ pattern: /\/[\w\-./]+\.(ts|js|go|py|java|sql)/gi,
240
+ replacement: "[PATH REDACTED]",
241
+ },
242
+ ];
243
+ /** Default sensitive patterns (path, email) for cloud-prem and when export is strict. */
244
+ export const DEFAULT_SENSITIVE_PATTERNS = [
245
+ ...SENSITIVE_PATTERNS_CLOUD,
246
+ // Match email-like strings with or without TLD (e.g. user@domain.com and fake_user@fake_email)
247
+ { pattern: /[\w.+-]+@[\w.-]+(\.\w+)?/g, replacement: "[EMAIL REDACTED]" },
248
+ ];
249
+ /**
250
+ * Regex patterns for cloud-prem log export: matched content is replaced with [REDACTED].
251
+ * Used as redactPatterns in LoggingPolicyConfig when deploymentType is CLOUD_PREM.
252
+ */
253
+ export const CLOUD_PREM_REDACT_PATTERNS = [
254
+ // JWT pattern (base64.base64.base64) - standalone tokens
255
+ /\b[A-Za-z0-9-_]{20,}\.[A-Za-z0-9-_]{20,}\.[A-Za-z0-9-_]{20,}\b/g,
256
+ // Bearer tokens
257
+ /\bbearer\s+[a-zA-Z0-9\-._~+/]+=*/gi,
258
+ // API keys
259
+ /\bapi[_\s]?key[:\s=]+[a-zA-Z0-9\-._~+/]+=*/gi,
260
+ ];
261
+ /**
262
+ * Apply sensitive patterns (pattern + replacement) to text.
263
+ * Used with policy.sensitivePatterns whenever redacting values for export.
264
+ */
265
+ export function redactSensitivePatterns(text, patterns) {
266
+ if (!text || typeof text !== "string")
267
+ return text;
268
+ let out = text;
269
+ for (const { pattern, replacement } of patterns) {
270
+ pattern.lastIndex = 0;
271
+ out = out.replace(pattern, replacement);
272
+ }
273
+ return out;
274
+ }
275
+ /**
276
+ * Redact stack trace for export: keep first line (error message) after sanitizing
277
+ * it with sensitive patterns, replace the rest with a placeholder.
278
+ * Use when exporting logs so stack traces never leave the environment.
279
+ *
280
+ * @param messageSecretPatterns - When non-empty, applied to first line before sensitivePatterns (policy-driven). When empty, uses sanitizeLogMessage for first line.
281
+ */
282
+ export function redactStackTraceForExport(text, sensitivePatterns = [], messageSecretPatterns = []) {
283
+ if (!text || typeof text !== "string")
284
+ return text;
285
+ if (!containsStackTrace(text))
286
+ return text;
287
+ const lines = text.split("\n");
288
+ if (lines.length <= 1)
289
+ return text;
290
+ const firstLineRaw = messageSecretPatterns.length > 0
291
+ ? redactSensitivePatterns(lines[0], messageSecretPatterns)
292
+ : sanitizeLogMessage(lines[0]);
293
+ const firstLine = redactSensitivePatterns(firstLineRaw, sensitivePatterns);
294
+ return firstLine + "\n" + STACK_TRACE_REDACTED_PLACEHOLDER;
295
+ }
296
+ /**
297
+ * Sanitize a log message string for export: sensitive patterns, then policy redact patterns, then
298
+ * stack trace redaction. Use for the message argument in log calls (e.g. safe logger stdout path).
299
+ */
300
+ export function sanitizeLogMessageForExport(message, redactPatterns, sensitivePatterns) {
301
+ if (!message || typeof message !== "string")
302
+ return message;
303
+ let out = redactSensitivePatterns(sanitizeLogMessage(message), sensitivePatterns);
304
+ out = applyRedactPatterns(out, redactPatterns);
305
+ if (containsStackTrace(out)) {
306
+ return redactStackTraceForExport(sanitizeLogMessage(out), sensitivePatterns);
145
307
  }
146
- return SECRET_FIELD_PATTERNS.some((pattern) => pattern.test(lowerKey));
308
+ return out;
309
+ }
310
+ /**
311
+ * Apply value-based sanitization to a string (sensitive patterns, policy redact patterns, then stack).
312
+ * Used by sanitizeLogRecordForExport for string values.
313
+ */
314
+ function sanitizeStringValueForExport(value, key, redactPatterns, sensitivePatterns) {
315
+ let out = redactSensitivePatterns(sanitizeLogMessage(value), sensitivePatterns);
316
+ out = applyRedactPatterns(out, redactPatterns);
317
+ if (isStackAttributeKey(key)) {
318
+ return containsStackTrace(out)
319
+ ? redactStackTraceForExport(sanitizeLogMessage(out), sensitivePatterns)
320
+ : STACK_TRACE_REDACTED_PLACEHOLDER;
321
+ }
322
+ if (containsStackTrace(out)) {
323
+ return redactStackTraceForExport(sanitizeLogMessage(out), sensitivePatterns);
324
+ }
325
+ return out;
147
326
  }
148
327
  // ============================================================================
149
328
  // Legacy exports for backward compatibility
@@ -169,7 +348,7 @@ export function sanitizeLogMessage(message) {
169
348
  }
170
349
  let sanitized = message;
171
350
  // Only apply secret patterns - preserve debugging info
172
- for (const { pattern, replacement } of SECRET_PATTERNS) {
351
+ for (const { pattern, replacement } of DEFAULT_SECRET_PATTERNS) {
173
352
  pattern.lastIndex = 0; // Reset regex state for global patterns
174
353
  sanitized = sanitized.replace(pattern, replacement);
175
354
  }
@@ -229,6 +408,116 @@ export function sanitizeLogObject(obj, depth = 0) {
229
408
  }
230
409
  return sanitized;
231
410
  }
411
+ /**
412
+ * Sanitize an object for export: exclude forbidden keys (omitted), redact secret keys (key kept, value [REDACTED]),
413
+ * and apply sensitive patterns to string values. Used by PolicyAwareLogProcessor when exporting log body objects.
414
+ */
415
+ export function sanitizeLogObjectForExport(obj, forbiddenFields, depth = 0, sensitivePatterns = []) {
416
+ if (depth > 10) {
417
+ return "[MAX_DEPTH_REACHED]";
418
+ }
419
+ if (obj === null || obj === undefined) {
420
+ return obj;
421
+ }
422
+ if (typeof obj === "string") {
423
+ return redactSensitivePatterns(sanitizeLogMessage(obj), sensitivePatterns);
424
+ }
425
+ if (typeof obj === "number" || typeof obj === "boolean") {
426
+ return obj;
427
+ }
428
+ if (typeof obj !== "object") {
429
+ return obj;
430
+ }
431
+ if (Array.isArray(obj)) {
432
+ return obj.map((item) => sanitizeLogObjectForExport(item, forbiddenFields, depth + 1, sensitivePatterns));
433
+ }
434
+ const result = {};
435
+ for (const [key, value] of Object.entries(obj)) {
436
+ const lowerKey = key.toLowerCase();
437
+ // Secret fields: keep key, redact value (consistent with sanitizeAttributes)
438
+ if (isSecretField(key)) {
439
+ result[key] = REDACTED_PLACEHOLDER;
440
+ continue;
441
+ }
442
+ // Forbidden fields (e.g. prompt, code, stack): exclude from export (omit key and value).
443
+ if (forbiddenFields.has(lowerKey)) {
444
+ continue;
445
+ }
446
+ // String values: redact stack traces by key or content, then sensitive patterns
447
+ if (typeof value === "string") {
448
+ if (isStackAttributeKey(key)) {
449
+ result[key] = containsStackTrace(value)
450
+ ? redactStackTraceForExport(sanitizeLogMessage(value), sensitivePatterns)
451
+ : STACK_TRACE_REDACTED_PLACEHOLDER;
452
+ }
453
+ else if (containsStackTrace(value)) {
454
+ result[key] = redactStackTraceForExport(sanitizeLogMessage(value), sensitivePatterns);
455
+ }
456
+ else {
457
+ result[key] = redactSensitivePatterns(sanitizeLogMessage(value), sensitivePatterns);
458
+ }
459
+ continue;
460
+ }
461
+ result[key] = sanitizeLogObjectForExport(value, forbiddenFields, depth + 1, sensitivePatterns);
462
+ }
463
+ return result;
464
+ }
465
+ /**
466
+ * Sanitize a log record for export with both key-based and value-based redaction.
467
+ * Applies sensitivePatterns and redactPatterns to every string value.
468
+ * Use for the server stdout path (safe logger and RemoteLogger redactRecord) so exported logs match OTLP behavior.
469
+ */
470
+ export function sanitizeLogRecordForExport(obj, forbiddenFields, redactPatterns, sensitivePatterns, depth = 0) {
471
+ if (depth > 10) {
472
+ return "[MAX_DEPTH_REACHED]";
473
+ }
474
+ if (obj === null || obj === undefined) {
475
+ return obj;
476
+ }
477
+ if (typeof obj === "string") {
478
+ return sanitizeLogMessageForExport(obj, redactPatterns, sensitivePatterns);
479
+ }
480
+ if (typeof obj === "number" || typeof obj === "boolean") {
481
+ return obj;
482
+ }
483
+ if (typeof obj !== "object") {
484
+ return obj;
485
+ }
486
+ // Error instances have non-enumerable message/name/stack; convert so we can redact them.
487
+ if (obj instanceof Error) {
488
+ const plain = {
489
+ message: obj.message,
490
+ name: obj.name,
491
+ stack: obj.stack,
492
+ };
493
+ for (const key of Object.keys(obj)) {
494
+ if (!Object.prototype.hasOwnProperty.call(plain, key)) {
495
+ plain[key] = obj[key];
496
+ }
497
+ }
498
+ return sanitizeLogRecordForExport(plain, forbiddenFields, redactPatterns, sensitivePatterns, depth);
499
+ }
500
+ if (Array.isArray(obj)) {
501
+ return obj.map((item) => sanitizeLogRecordForExport(item, forbiddenFields, redactPatterns, sensitivePatterns, depth + 1));
502
+ }
503
+ const result = {};
504
+ for (const [key, value] of Object.entries(obj)) {
505
+ const lowerKey = key.toLowerCase();
506
+ if (isSecretField(key)) {
507
+ result[key] = REDACTED_PLACEHOLDER;
508
+ continue;
509
+ }
510
+ if (forbiddenFields.has(lowerKey)) {
511
+ continue;
512
+ }
513
+ if (typeof value === "string") {
514
+ result[key] = sanitizeStringValueForExport(value, key, redactPatterns, sensitivePatterns);
515
+ continue;
516
+ }
517
+ result[key] = sanitizeLogRecordForExport(value, forbiddenFields, redactPatterns, sensitivePatterns, depth + 1);
518
+ }
519
+ return result;
520
+ }
232
521
  /**
233
522
  * Sanitizes secrets from an error object.
234
523
  * Preserves full stack traces for debugging.