@vmz/vmz 0.0.3 → 0.1.0

package/dist/production-observability.d.ts

@@ -0,0 +1,286 @@
+/**
+ * A5: Production observability — trace facets, redaction, CSP/security,
+ * performance budgets, health/readiness, capability closure.
+ */
+export declare const PRODUCTION_OBSERVABILITY_SCHEMA = "vmz.production.observability.v0";
+export declare const PRODUCTION_TRACE_SCHEMA = "vmz.production.trace.v0";
+/** Facets that production traces must be able to carry (08 A5). */
+export declare const REQUIRED_TRACE_FACETS: readonly string[];
+/**
+ * Default Browser Production Profile observability contract.
+ * @param {Record<string, unknown>} [overrides]
+ */
+export declare function browserProductionObservability(overrides?: {}): {
+    schema: string;
+    id: any;
+    trace: {
+        schema: string;
+        requiredFacets: any;
+        retainOnFailure: any;
+    };
+    redaction: {
+        mode: string;
+        replaceWith: any;
+        allowPublicProvenance: boolean;
+        sensitiveKeyPattern: string;
+    };
+    security: {
+        csp: any;
+        requireIntegrityForRemote: boolean;
+        originIsolation: boolean;
+        requireNonceForInline: boolean;
+        cookieNamespace: any;
+        sessionNamespace: any;
+    };
+    capability: {
+        allowlistRequired: boolean;
+        inputOutputSchemaRequired: boolean;
+        timeoutMsDefault: number;
+        cancelSupported: boolean;
+        serverSecretClosure: boolean;
+    };
+    budgets: {
+        irrelevantBindingWork: number;
+        irrelevantRouteRegionRebuild: number;
+        wholeTreeRerender: number;
+        maxArtifactBytes: number;
+        maxHtmlBytes: number;
+        maxClientJsBytes: number;
+        maxPatchCountPerTransition: number;
+    };
+    health: {
+        livePath: any;
+        readyPath: any;
+        gracefulShutdown: {
+            stopAccepting: boolean;
+            drainInFlight: boolean;
+            timeoutMs: number;
+        };
+    };
+    sampling: {
+        diagnosticSampleRate: number;
+        rollbackOnErrorRate: number;
+        latencyBudgetMs: {
+            p95: number;
+            p99: number;
+        };
+    };
+};
+/**
+ * @param {unknown} raw
+ */
+export declare function normalizeObservability(raw: any): {
+    schema: string;
+    id: any;
+    trace: {
+        schema: string;
+        requiredFacets: any;
+        retainOnFailure: any;
+    };
+    redaction: {
+        mode: string;
+        replaceWith: any;
+        allowPublicProvenance: boolean;
+        sensitiveKeyPattern: string;
+    };
+    security: {
+        csp: any;
+        requireIntegrityForRemote: boolean;
+        originIsolation: boolean;
+        requireNonceForInline: boolean;
+        cookieNamespace: any;
+        sessionNamespace: any;
+    };
+    capability: {
+        allowlistRequired: boolean;
+        inputOutputSchemaRequired: boolean;
+        timeoutMsDefault: number;
+        cancelSupported: boolean;
+        serverSecretClosure: boolean;
+    };
+    budgets: {
+        irrelevantBindingWork: number;
+        irrelevantRouteRegionRebuild: number;
+        wholeTreeRerender: number;
+        maxArtifactBytes: number;
+        maxHtmlBytes: number;
+        maxClientJsBytes: number;
+        maxPatchCountPerTransition: number;
+    };
+    health: {
+        livePath: any;
+        readyPath: any;
+        gracefulShutdown: {
+            stopAccepting: boolean;
+            drainInFlight: boolean;
+            timeoutMs: number;
+        };
+    };
+    sampling: {
+        diagnosticSampleRate: number;
+        rollbackOnErrorRate: number;
+        latencyBudgetMs: {
+            p95: number;
+            p99: number;
+        };
+    };
+};
+/**
+ * Redact sensitive keys recursively. Never returns secrets for public provenance.
+ * @param {unknown} value
+ * @param {Record<string, any>} [policy]
+ * @param {{ privilege?: 'public' | 'operator' }} [opts]
+ */
+export declare function redactSensitive(value: any, policy?: {}, opts?: {}): any;
+/**
+ * Validate a production trace carries required facets (as event.facet or mapped kind).
+ * @param {unknown} raw
+ * @param {string[]} [requiredFacets]
+ */
+export declare function validateProductionTrace(raw: any, requiredFacets?: readonly string[]): {
+    ok: boolean;
+    covered: unknown[];
+    errors: any[];
+};
+/**
+ * Build a minimal valid production trace covering all required facets (for CI assembly).
+ * @param {Record<string, unknown>} [meta]
+ */
+export declare function buildCoveringProductionTrace(meta?: {}): {
+    schema: string;
+    status: string;
+    applicationId: any;
+    artifactDigest: any;
+    events: {
+        facet: string;
+        kind: string;
+        stableId: {
+            kind: string;
+            id: string;
+        };
+        generation: number;
+        redacted: boolean;
+        payload: any;
+    }[];
+};
+/**
+ * @param {Record<string, any>} measured
+ * @param {Record<string, any>} budgets
+ */
+export declare function checkProductionBudgets(measured: any, budgets: any): {
+    ok: boolean;
+    violations: any[];
+};
+/**
+ * Validate capability production closure (allowlist + schema + timeout + secret).
+ * @param {Record<string, any>} cap
+ * @param {Record<string, any>} policy
+ */
+export declare function checkCapabilityClosure(cap: any, policy: any): {
+    ok: boolean;
+    errors: any[];
+};
+/**
+ * Merge CSP / security headers into a CDN policy headers list (HTML matches).
+ * @param {Record<string, any>} cdnPolicy
+ * @param {Record<string, any>} security
+ */
+export declare function applySecurityHeadersToCdnPolicy(cdnPolicy: any, security: any): any;
+/**
+ * Measure dist sizes for budget gates.
+ * @param {string} distDir
+ */
+export declare function measureDistBudgets(distDir: any): {
+    artifactBytes: number;
+    htmlBytes: number;
+    clientJsBytes: number;
+    irrelevantBindingWork: number;
+    irrelevantRouteRegionRebuild: number;
+    wholeTreeRerender: number;
+    patchCount: number;
+};
+/**
+ * Write observability contract (+ covering trace sample) under dist/_vmz.
+ * @param {string} distDir
+ * @param {Record<string, unknown>} [overrides]
+ * @param {{ applicationId?: string, artifactDigest?: string }} [meta]
+ */
+export declare function emitProductionObservability(distDir: any, overrides?: {}, meta?: {}): {
+    contract: {
+        schema: string;
+        id: any;
+        trace: {
+            schema: string;
+            requiredFacets: any;
+            retainOnFailure: any;
+        };
+        redaction: {
+            mode: string;
+            replaceWith: any;
+            allowPublicProvenance: boolean;
+            sensitiveKeyPattern: string;
+        };
+        security: {
+            csp: any;
+            requireIntegrityForRemote: boolean;
+            originIsolation: boolean;
+            requireNonceForInline: boolean;
+            cookieNamespace: any;
+            sessionNamespace: any;
+        };
+        capability: {
+            allowlistRequired: boolean;
+            inputOutputSchemaRequired: boolean;
+            timeoutMsDefault: number;
+            cancelSupported: boolean;
+            serverSecretClosure: boolean;
+        };
+        budgets: {
+            irrelevantBindingWork: number;
+            irrelevantRouteRegionRebuild: number;
+            wholeTreeRerender: number;
+            maxArtifactBytes: number;
+            maxHtmlBytes: number;
+            maxClientJsBytes: number;
+            maxPatchCountPerTransition: number;
+        };
+        health: {
+            livePath: any;
+            readyPath: any;
+            gracefulShutdown: {
+                stopAccepting: boolean;
+                drainInFlight: boolean;
+                timeoutMs: number;
+            };
+        };
+        sampling: {
+            diagnosticSampleRate: number;
+            rollbackOnErrorRate: number;
+            latencyBudgetMs: {
+                p95: number;
+                p99: number;
+            };
+        };
+    };
+    trace: {
+        schema: string;
+        status: string;
+        applicationId: any;
+        artifactDigest: any;
+        events: {
+            facet: string;
+            kind: string;
+            stableId: {
+                kind: string;
+                id: string;
+            };
+            generation: number;
+            redacted: boolean;
+            payload: any;
+        }[];
+    };
+    contractPath: string;
+    tracePath: string;
+};
+export declare function observabilityDigest(contract: any): any;
+export declare function sha256Text(text: any): string;