autotel-eventcatalog 10.0.0 → 11.0.1

package/CHANGELOG.md

@@ -1,5 +1,66 @@
 # Changelog
 
+## 11.0.1
+
+### Patch Changes
+
+- 4b7ad78: chore: routine dependency updates
+
+  Refresh runtime and peer dependency ranges across published packages (`ncu`, 3-day release-age cooldown).
+
+  The core `autotel` package moves to the latest OpenTelemetry libraries (stable `2.9.x`, experimental `0.220.x`, semantic-conventions `1.42.x`). This required adapting to a breaking change in `@opentelemetry/sdk-logs`: `BatchLogRecordProcessor` and `SimpleLogRecordProcessor` now take a `{ exporter }` options object instead of a positional exporter argument.
+
+  Notable peer range bumps for consumers: `autotel-aws` (AWS SDK `3.1081`), `autotel-cloudflare` (`@cloudflare/workers-types` v5), `autotel-pact` (`@pact-foundation/pact` v17), `autotel-terminal` (`ai` v7).
+  - autotel-subscribers@41.0.4
+
+## 11.0.0
+
+### Patch Changes
+
+- ec47ec8: Google Secure AI Agents observability plus MCP protocol-boundary security observability — additive defense-in-depth across planning, tool use, MCP traffic, triage, and UI surfaces.
+
+  **autotel-mcp-instrumentation**
+  - Annotation hints captured as `mcp.tool.*` span attributes (`readOnlyHint`, `destructiveHint`, `idempotentHint`, `openWorldHint`, `untrustedContentHint`) to surface malicious-manifest vectors and tool trust profiles.
+  - Payload-size signals (`mcp.tool.arguments.size` / `mcp.tool.result.size`) for token-exhaustion and contaminated-output detection without logging content.
+  - Output character budgets (`outputCharBudget` + `MCP_CHAR_BUDGETS`) that emit `mcp.security.budget_exceeded` signals and can bridge to unified `security.*` events.
+  - Pluggable injection classifier (`securityClassifier`) scanning arguments and results on both client and server, recording `mcp.security.injection.*` signals and bridging suspicious verdicts to `security.*` events without breaking traced calls.
+  - `heuristicInjectionClassifier()` as a dependency-free first-pass detector.
+  - `spotlight()` to delimit/base64 untrusted content across Node and edge runtimes.
+  - `validateToolBudget()` for WebMCP-style text-surface limits.
+  - Guard bridge via `guard` config so MCP tool calls count against an `autotel-genai` guard.
+  - `applyManifestAssessment()` bridges suspicious manifest verdicts to unified `security.*` events when `bridgeSecurityEvents` is enabled.
+  - New `mcp.security.events` counter and `autotel-mcp-instrumentation/security` subpath export.
+
+  **autotel-cli**
+  - Add `autotel security mcp` to aggregate MCP security signals: injection verdicts, output-budget breaches, and untrusted-content tool calls.
+
+  **autotel-genai/agent**
+  - `AgentPlanClassifier` + `runAgentPlanClassifier()` / `recordPlanRiskAssessment()` with `agent.plan.risk.*` attrs and optional `llm.plan.risk.elevated` security event.
+  - `heuristicPlanRiskClassifier()` as a dependency-free first-pass plan-risk tripwire.
+  - Export `agentContextFromSpan()` from the agent subpath.
+
+  **autotel-audit**
+  - Passive action-chain processor emits `llm.action_chain.suspicious` and stamps unified `security.*` attributes on the destructive span.
+  - `llm.manifest.suspicious` and `llm.plan.risk.elevated` added to the suggested security event catalogue.
+
+  **autotel-cloudflare/agents**
+  - `tool:approval` events use `recordHumanApproval()` (optional `autotel-genai` peer dependency).
+
+  **autotel-devtools**
+  - Agent timeline surfaces consent, policy, injection, guard, security-event, and plan-step badges from the new agent security attributes.
+
+  **autotel-schema**
+  - Agent security contract snapshot extended with `agent.plan.risk.*` attributes.
+
+  **autotel**
+  - Core `security-schema` remains the shared sink for unified `security.*` events consumed by the agent and MCP observability layers.
+
+  **Packaging**
+  - Drop the duplicated `src/` directory from published tarballs across all packages. The shipped `.js.map` sourcemaps already embed original source via `sourcesContent`, so source-level debugging is unchanged while install footprint shrinks ~20–30%.
+
+- Updated dependencies [ec47ec8]
+  - autotel-subscribers@41.0.0
+
 ## 10.0.0
 
 ### Patch Changes

package/dist/cli.cjs

@@ -1,5 +1,5 @@
 
-const require_generate = require('./generate-DCSrdzQI.cjs');
+const require_generate = require('./generate-CHjGIFJe.cjs');
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");
 let node_url = require("node:url");

package/dist/cli.js

@@ -1,5 +1,5 @@
 
-import { A as countDriftEntries, F as readCatalogState, I as loadSnapshot, M as diffCatalogAgainstSnapshot, O as compareDriftReports, d as evaluatePolicy, g as registerRenderer, h as listRendererNames, j as countDriftReport, l as buildStampSummary, m as getRenderer, n as buildGenerateSummary, r as generateCatalogFromSnapshot, u as stampCatalog } from "./generate-dFbInSKR.js";
+import { A as countDriftEntries, F as readCatalogState, I as loadSnapshot, M as diffCatalogAgainstSnapshot, O as compareDriftReports, d as evaluatePolicy, g as registerRenderer, h as listRendererNames, j as countDriftReport, l as buildStampSummary, m as getRenderer, n as buildGenerateSummary, r as generateCatalogFromSnapshot, u as stampCatalog } from "./generate-r5KccyNS.js";
 import { mkdir, writeFile } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
 import { pathToFileURL } from "node:url";

package/dist/{generate-DCSrdzQI.cjs → generate-CHjGIFJe.cjs}

@@ -1241,23 +1241,25 @@ ${producerLine}${channelLine}${traceLine}${sourceLine}
 }
 function buildServiceMarkdown(serviceId, snapshot) {
 	const sends = Object.entries(snapshot.events).filter(([, obs]) => obs.producer === serviceId).map(([name]) => `- \`${name}\``).join("\n");
+	const sendsBlock = sends ? `### Sends\n${sends}\n` : "";
 	return `${GENERATED_PREAMBLE}
 
 ## ${serviceId}
 
 *Generated from autotel snapshot. Add a human description and ownership.*
 
-${sends ? `### Sends\n${sends}\n` : ""}`;
+${sendsBlock}`;
 }
 function buildChannelMarkdown(channelId, snapshot) {
 	const messages = Object.entries(snapshot.events).filter(([, obs]) => obs.channel === channelId).map(([name]) => `- \`${name}\``).join("\n");
+	const messagesBlock = messages ? `### Carries\n${messages}\n` : "";
 	return `${GENERATED_PREAMBLE}
 
 ## ${channelId}
 
 *Generated from autotel snapshot. Add transport details, retention, schema registry, etc.*
 
-${messages ? `### Carries\n${messages}\n` : ""}`;
+${messagesBlock}`;
 }
 function toCatalogEventId(snapshotEventName) {
 	return snapshotEventName.split(/[._\-\s]+/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
@@ -1483,4 +1485,4 @@ Object.defineProperty(exports, 'toSnapshotDiffFromReport', {
     return toSnapshotDiffFromReport;
   }
 });
-//# sourceMappingURL=generate-DCSrdzQI.cjs.map
+//# sourceMappingURL=generate-CHjGIFJe.cjs.map