autotel-schema 1.0.0 → 2.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.cjs +139 -0
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.cts +8 -1
- package/dist/index.d.cts.map +1 -1
- package/dist/index.d.ts +8 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +139 -1
- package/dist/index.js.map +1 -1
- package/package.json +3 -3
- package/snapshots/agent-security.snapshot.json +238 -0
- package/src/attrs.ts +0 -23
- package/src/cli.ts +0 -117
- package/src/contract.test.ts +0 -67
- package/src/contract.ts +0 -231
- package/src/diff.ts +0 -282
- package/src/index.ts +0 -88
- package/src/processor.test.ts +0 -74
- package/src/processor.ts +0 -152
- package/src/redaction.ts +0 -64
- package/src/snapshot.test.ts +0 -88
- package/src/snapshot.ts +0 -119
- package/src/validate.test.ts +0 -100
- package/src/validate.ts +0 -237
package/dist/index.cjs
CHANGED
|
@@ -40,6 +40,145 @@ function isHighCardinalityKey(contract, key) {
|
|
|
40
40
|
}
|
|
41
41
|
|
|
42
42
|
//#endregion
|
|
43
|
+
//#region src/contracts/agent-security.ts
|
|
44
|
+
const stringAttr = { type: "string" };
|
|
45
|
+
const boolAttr = { type: "boolean" };
|
|
46
|
+
const numberAttr = { type: "number" };
|
|
47
|
+
const stringArrayAttr = { type: "string[]" };
|
|
48
|
+
/**
|
|
49
|
+
* Published telemetry contract for Google SAIF-aligned agent security observability.
|
|
50
|
+
* Span names are illustrative — attributes are the stable surface under validation.
|
|
51
|
+
*/
|
|
52
|
+
const AGENT_SECURITY_TELEMETRY_CONTRACT = require_processor.defineContract({
|
|
53
|
+
service: "autotel-agent-security",
|
|
54
|
+
version: "1.0.0",
|
|
55
|
+
commonAttributes: {
|
|
56
|
+
"autotel.agent": {
|
|
57
|
+
...boolAttr,
|
|
58
|
+
required: false,
|
|
59
|
+
description: "Agent audit marker"
|
|
60
|
+
},
|
|
61
|
+
"agent.controller.id": {
|
|
62
|
+
...stringAttr,
|
|
63
|
+
highCardinality: true,
|
|
64
|
+
description: "Hashed controlling human user id"
|
|
65
|
+
},
|
|
66
|
+
"agent.input.provenance": {
|
|
67
|
+
...stringAttr,
|
|
68
|
+
enum: [
|
|
69
|
+
"user_direct",
|
|
70
|
+
"user_voice",
|
|
71
|
+
"rag",
|
|
72
|
+
"memory",
|
|
73
|
+
"tool_result",
|
|
74
|
+
"external_untrusted"
|
|
75
|
+
]
|
|
76
|
+
},
|
|
77
|
+
"agent.action.risk_class": {
|
|
78
|
+
...stringAttr,
|
|
79
|
+
enum: [
|
|
80
|
+
"read",
|
|
81
|
+
"write",
|
|
82
|
+
"destructive",
|
|
83
|
+
"financial",
|
|
84
|
+
"exfiltration_capable"
|
|
85
|
+
]
|
|
86
|
+
},
|
|
87
|
+
"agent.consent.required": { ...boolAttr },
|
|
88
|
+
"agent.consent.outcome": {
|
|
89
|
+
...stringAttr,
|
|
90
|
+
enum: [
|
|
91
|
+
"approved",
|
|
92
|
+
"denied",
|
|
93
|
+
"timeout",
|
|
94
|
+
"revoked"
|
|
95
|
+
]
|
|
96
|
+
},
|
|
97
|
+
"agent.scope.active": { ...stringArrayAttr },
|
|
98
|
+
"agent.memory.operation": {
|
|
99
|
+
...stringAttr,
|
|
100
|
+
enum: [
|
|
101
|
+
"read",
|
|
102
|
+
"write",
|
|
103
|
+
"delete",
|
|
104
|
+
"search"
|
|
105
|
+
]
|
|
106
|
+
},
|
|
107
|
+
"agent.memory.isolation_key": {
|
|
108
|
+
...stringAttr,
|
|
109
|
+
highCardinality: true
|
|
110
|
+
},
|
|
111
|
+
"agent.plan.step_index": { ...numberAttr },
|
|
112
|
+
"agent.plan.tool_intents": { ...stringArrayAttr },
|
|
113
|
+
"agent.plan.risk.verdict": {
|
|
114
|
+
...stringAttr,
|
|
115
|
+
enum: [
|
|
116
|
+
"low",
|
|
117
|
+
"medium",
|
|
118
|
+
"high",
|
|
119
|
+
"critical"
|
|
120
|
+
]
|
|
121
|
+
},
|
|
122
|
+
"agent.plan.risk.score": { ...numberAttr },
|
|
123
|
+
"agent.plan.risk.categories": { ...stringArrayAttr },
|
|
124
|
+
"policy.decision": {
|
|
125
|
+
...stringAttr,
|
|
126
|
+
enum: [
|
|
127
|
+
"permit",
|
|
128
|
+
"deny",
|
|
129
|
+
"challenge",
|
|
130
|
+
"observe",
|
|
131
|
+
"error"
|
|
132
|
+
]
|
|
133
|
+
},
|
|
134
|
+
"tool.input_hash": { ...stringAttr },
|
|
135
|
+
"tool.output_hash": { ...stringAttr },
|
|
136
|
+
"mcp.tool.destructive": { ...boolAttr },
|
|
137
|
+
"mcp.tool.untrusted_content": { ...boolAttr },
|
|
138
|
+
"mcp.security.injection.verdict": {
|
|
139
|
+
...stringAttr,
|
|
140
|
+
enum: [
|
|
141
|
+
"clean",
|
|
142
|
+
"suspicious",
|
|
143
|
+
"malicious"
|
|
144
|
+
]
|
|
145
|
+
},
|
|
146
|
+
"security.event": { ...stringAttr },
|
|
147
|
+
"security.category": { ...stringAttr },
|
|
148
|
+
"security.outcome": { ...stringAttr },
|
|
149
|
+
"security.severity": {
|
|
150
|
+
...stringAttr,
|
|
151
|
+
enum: [
|
|
152
|
+
"info",
|
|
153
|
+
"warning",
|
|
154
|
+
"error",
|
|
155
|
+
"critical"
|
|
156
|
+
]
|
|
157
|
+
}
|
|
158
|
+
},
|
|
159
|
+
spans: {
|
|
160
|
+
"agent.action": {
|
|
161
|
+
description: "Scoped agent action or tool call with audit metadata",
|
|
162
|
+
attributes: {
|
|
163
|
+
"agent.id": {
|
|
164
|
+
...stringAttr,
|
|
165
|
+
required: true
|
|
166
|
+
},
|
|
167
|
+
"tool.name": { ...stringAttr }
|
|
168
|
+
}
|
|
169
|
+
},
|
|
170
|
+
"tools/call": {
|
|
171
|
+
description: "MCP tool invocation with boundary security signals",
|
|
172
|
+
attributes: { "mcp.tool.name": {
|
|
173
|
+
...stringAttr,
|
|
174
|
+
required: true
|
|
175
|
+
} }
|
|
176
|
+
}
|
|
177
|
+
}
|
|
178
|
+
});
|
|
179
|
+
|
|
180
|
+
//#endregion
|
|
181
|
+
exports.AGENT_SECURITY_TELEMETRY_CONTRACT = AGENT_SECURITY_TELEMETRY_CONTRACT;
|
|
43
182
|
exports.ATTRIBUTE_TYPES = require_processor.ATTRIBUTE_TYPES;
|
|
44
183
|
exports.SCHEMA_ATTRS = require_snapshot.SCHEMA_ATTRS;
|
|
45
184
|
exports.SNAPSHOT_SPEC = require_snapshot.SNAPSHOT_SPEC;
|
package/dist/index.cjs.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.cjs","names":[],"sources":["../src/redaction.ts"],"sourcesContent":["/**\n * Cardinality posture helpers.\n *\n * The old cardinality rule — \"keep unique-value counts down\" — was a constraint\n * invented because dashboards have pixels and a graph with 10k series is\n * unreadable to a human. An agent does not look at the graph; it reads the\n * spans. A high-cardinality field (the user id, the sender domain, the request\n * id) is then the single most useful attribute on a trace when the agent is\n * chasing one specific failure.\n *\n * So the contract lets you mark attributes `highCardinality: true` as a\n * deliberate signal, and this module turns that into a *protect list*: the keys\n * a redactor or span-name normalizer must NOT strip, even when an aggressive\n * default would otherwise drop them.\n */\n\nimport type { TelemetryContract } from './contract.js';\n\n/**\n * Every attribute key in the contract flagged `highCardinality: true`, across\n * both common and per-span attributes. Feed this into a redaction/normalization\n * allow-list so the fields most useful to an agent reader survive.\n *\n * @example\n * ```ts\n * import { init } from 'autotel';\n * import { highCardinalityKeys } from 'autotel-schema';\n * import { contract } from './telemetry.contract';\n *\n * init({\n * service: 'checkout',\n * // keep user.id / request.id intact even under the strict redactor\n * attributeRedactor: { allowKeys: highCardinalityKeys(contract), preset: 'strict' },\n * });\n * ```\n */\nexport function highCardinalityKeys(contract: TelemetryContract): string[] {\n const keys = new Set<string>();\n for (const [key, spec] of Object.entries(contract.commonAttributes ?? {})) {\n if (spec.highCardinality) keys.add(key);\n }\n for (const spanSpec of Object.values(contract.spans)) {\n for (const [key, spec] of Object.entries(spanSpec.attributes ?? {})) {\n if (spec.highCardinality) keys.add(key);\n }\n }\n return [...keys].toSorted();\n}\n\n/**\n * Predicate form of {@link highCardinalityKeys} — `true` when `key` is declared\n * high-cardinality anywhere in the contract. Useful inside a custom\n * `spanNameNormalizer` or redactor callback.\n */\nexport function isHighCardinalityKey(\n contract: TelemetryContract,\n key: string,\n): boolean {\n if (contract.commonAttributes?.[key]?.highCardinality) return true;\n for (const spanSpec of Object.values(contract.spans)) {\n if (spanSpec.attributes?.[key]?.highCardinality) return true;\n }\n return false;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAoCA,SAAgB,oBAAoB,UAAuC;CACzE,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,SAAS,oBAAoB,CAAC,CAAC,GACtE,IAAI,KAAK,iBAAiB,KAAK,IAAI,GAAG;CAExC,KAAK,MAAM,YAAY,OAAO,OAAO,SAAS,KAAK,GACjD,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,SAAS,cAAc,CAAC,CAAC,GAChE,IAAI,KAAK,iBAAiB,KAAK,IAAI,GAAG;CAG1C,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,SAAS;AAC5B;;;;;;AAOA,SAAgB,qBACd,UACA,KACS;CACT,IAAI,SAAS,mBAAmB,IAAI,EAAE,iBAAiB,OAAO;CAC9D,KAAK,MAAM,YAAY,OAAO,OAAO,SAAS,KAAK,GACjD,IAAI,SAAS,aAAa,IAAI,EAAE,iBAAiB,OAAO;CAE1D,OAAO;AACT"}
|
|
1
|
+
{"version":3,"file":"index.cjs","names":["defineContract"],"sources":["../src/redaction.ts","../src/contracts/agent-security.ts"],"sourcesContent":["/**\n * Cardinality posture helpers.\n *\n * The old cardinality rule — \"keep unique-value counts down\" — was a constraint\n * invented because dashboards have pixels and a graph with 10k series is\n * unreadable to a human. An agent does not look at the graph; it reads the\n * spans. A high-cardinality field (the user id, the sender domain, the request\n * id) is then the single most useful attribute on a trace when the agent is\n * chasing one specific failure.\n *\n * So the contract lets you mark attributes `highCardinality: true` as a\n * deliberate signal, and this module turns that into a *protect list*: the keys\n * a redactor or span-name normalizer must NOT strip, even when an aggressive\n * default would otherwise drop them.\n */\n\nimport type { TelemetryContract } from './contract.js';\n\n/**\n * Every attribute key in the contract flagged `highCardinality: true`, across\n * both common and per-span attributes. Feed this into a redaction/normalization\n * allow-list so the fields most useful to an agent reader survive.\n *\n * @example\n * ```ts\n * import { init } from 'autotel';\n * import { highCardinalityKeys } from 'autotel-schema';\n * import { contract } from './telemetry.contract';\n *\n * init({\n * service: 'checkout',\n * // keep user.id / request.id intact even under the strict redactor\n * attributeRedactor: { allowKeys: highCardinalityKeys(contract), preset: 'strict' },\n * });\n * ```\n */\nexport function highCardinalityKeys(contract: TelemetryContract): string[] {\n const keys = new Set<string>();\n for (const [key, spec] of Object.entries(contract.commonAttributes ?? {})) {\n if (spec.highCardinality) keys.add(key);\n }\n for (const spanSpec of Object.values(contract.spans)) {\n for (const [key, spec] of Object.entries(spanSpec.attributes ?? {})) {\n if (spec.highCardinality) keys.add(key);\n }\n }\n return [...keys].toSorted();\n}\n\n/**\n * Predicate form of {@link highCardinalityKeys} — `true` when `key` is declared\n * high-cardinality anywhere in the contract. Useful inside a custom\n * `spanNameNormalizer` or redactor callback.\n */\nexport function isHighCardinalityKey(\n contract: TelemetryContract,\n key: string,\n): boolean {\n if (contract.commonAttributes?.[key]?.highCardinality) return true;\n for (const spanSpec of Object.values(contract.spans)) {\n if (spanSpec.attributes?.[key]?.highCardinality) return true;\n }\n return false;\n}\n","import { defineContract } from '../contract.js';\n\nconst stringAttr = { type: 'string' as const };\nconst boolAttr = { type: 'boolean' as const };\nconst numberAttr = { type: 'number' as const };\nconst stringArrayAttr = { type: 'string[]' as const };\n\n/**\n * Published telemetry contract for Google SAIF-aligned agent security observability.\n * Span names are illustrative — attributes are the stable surface under validation.\n */\nexport const AGENT_SECURITY_TELEMETRY_CONTRACT = defineContract({\n service: 'autotel-agent-security',\n version: '1.0.0',\n commonAttributes: {\n 'autotel.agent': { ...boolAttr, required: false, description: 'Agent audit marker' },\n 'agent.controller.id': {\n ...stringAttr,\n highCardinality: true,\n description: 'Hashed controlling human user id',\n },\n 'agent.input.provenance': {\n ...stringAttr,\n enum: [\n 'user_direct',\n 'user_voice',\n 'rag',\n 'memory',\n 'tool_result',\n 'external_untrusted',\n ],\n },\n 'agent.action.risk_class': {\n ...stringAttr,\n enum: ['read', 'write', 'destructive', 'financial', 'exfiltration_capable'],\n },\n 'agent.consent.required': { ...boolAttr },\n 'agent.consent.outcome': {\n ...stringAttr,\n enum: ['approved', 'denied', 'timeout', 'revoked'],\n },\n 'agent.scope.active': { ...stringArrayAttr },\n 'agent.memory.operation': {\n ...stringAttr,\n enum: ['read', 'write', 'delete', 'search'],\n },\n 'agent.memory.isolation_key': { ...stringAttr, highCardinality: true },\n 'agent.plan.step_index': { ...numberAttr },\n 'agent.plan.tool_intents': { ...stringArrayAttr },\n 'agent.plan.risk.verdict': {\n ...stringAttr,\n enum: ['low', 'medium', 'high', 'critical'],\n },\n 'agent.plan.risk.score': { ...numberAttr },\n 'agent.plan.risk.categories': { ...stringArrayAttr },\n 'policy.decision': {\n ...stringAttr,\n enum: ['permit', 'deny', 'challenge', 'observe', 'error'],\n },\n 'tool.input_hash': { ...stringAttr },\n 'tool.output_hash': { ...stringAttr },\n 'mcp.tool.destructive': { ...boolAttr },\n 'mcp.tool.untrusted_content': { ...boolAttr },\n 'mcp.security.injection.verdict': {\n ...stringAttr,\n enum: ['clean', 'suspicious', 'malicious'],\n },\n 'security.event': { ...stringAttr },\n 'security.category': { ...stringAttr },\n 'security.outcome': { ...stringAttr },\n 'security.severity': {\n ...stringAttr,\n enum: ['info', 'warning', 'error', 'critical'],\n },\n },\n spans: {\n 'agent.action': {\n description: 'Scoped agent action or tool call with audit metadata',\n attributes: {\n 'agent.id': { ...stringAttr, required: true },\n 'tool.name': { ...stringAttr },\n },\n },\n 'tools/call': {\n description: 'MCP tool invocation with boundary security signals',\n attributes: {\n 'mcp.tool.name': { ...stringAttr, required: true },\n },\n },\n },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAoCA,SAAgB,oBAAoB,UAAuC;CACzE,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,SAAS,oBAAoB,CAAC,CAAC,GACtE,IAAI,KAAK,iBAAiB,KAAK,IAAI,GAAG;CAExC,KAAK,MAAM,YAAY,OAAO,OAAO,SAAS,KAAK,GACjD,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,SAAS,cAAc,CAAC,CAAC,GAChE,IAAI,KAAK,iBAAiB,KAAK,IAAI,GAAG;CAG1C,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,SAAS;AAC5B;;;;;;AAOA,SAAgB,qBACd,UACA,KACS;CACT,IAAI,SAAS,mBAAmB,IAAI,EAAE,iBAAiB,OAAO;CAC9D,KAAK,MAAM,YAAY,OAAO,OAAO,SAAS,KAAK,GACjD,IAAI,SAAS,aAAa,IAAI,EAAE,iBAAiB,OAAO;CAE1D,OAAO;AACT;;;;AC7DA,MAAM,aAAa,EAAE,MAAM,SAAkB;AAC7C,MAAM,WAAW,EAAE,MAAM,UAAmB;AAC5C,MAAM,aAAa,EAAE,MAAM,SAAkB;AAC7C,MAAM,kBAAkB,EAAE,MAAM,WAAoB;;;;;AAMpD,MAAa,oCAAoCA,iCAAe;CAC9D,SAAS;CACT,SAAS;CACT,kBAAkB;EAChB,iBAAiB;GAAE,GAAG;GAAU,UAAU;GAAO,aAAa;EAAqB;EACnF,uBAAuB;GACrB,GAAG;GACH,iBAAiB;GACjB,aAAa;EACf;EACA,0BAA0B;GACxB,GAAG;GACH,MAAM;IACJ;IACA;IACA;IACA;IACA;IACA;GACF;EACF;EACA,2BAA2B;GACzB,GAAG;GACH,MAAM;IAAC;IAAQ;IAAS;IAAe;IAAa;GAAsB;EAC5E;EACA,0BAA0B,EAAE,GAAG,SAAS;EACxC,yBAAyB;GACvB,GAAG;GACH,MAAM;IAAC;IAAY;IAAU;IAAW;GAAS;EACnD;EACA,sBAAsB,EAAE,GAAG,gBAAgB;EAC3C,0BAA0B;GACxB,GAAG;GACH,MAAM;IAAC;IAAQ;IAAS;IAAU;GAAQ;EAC5C;EACA,8BAA8B;GAAE,GAAG;GAAY,iBAAiB;EAAK;EACrE,yBAAyB,EAAE,GAAG,WAAW;EACzC,2BAA2B,EAAE,GAAG,gBAAgB;EAChD,2BAA2B;GACzB,GAAG;GACH,MAAM;IAAC;IAAO;IAAU;IAAQ;GAAU;EAC5C;EACA,yBAAyB,EAAE,GAAG,WAAW;EACzC,8BAA8B,EAAE,GAAG,gBAAgB;EACnD,mBAAmB;GACjB,GAAG;GACH,MAAM;IAAC;IAAU;IAAQ;IAAa;IAAW;GAAO;EAC1D;EACA,mBAAmB,EAAE,GAAG,WAAW;EACnC,oBAAoB,EAAE,GAAG,WAAW;EACpC,wBAAwB,EAAE,GAAG,SAAS;EACtC,8BAA8B,EAAE,GAAG,SAAS;EAC5C,kCAAkC;GAChC,GAAG;GACH,MAAM;IAAC;IAAS;IAAc;GAAW;EAC3C;EACA,kBAAkB,EAAE,GAAG,WAAW;EAClC,qBAAqB,EAAE,GAAG,WAAW;EACrC,oBAAoB,EAAE,GAAG,WAAW;EACpC,qBAAqB;GACnB,GAAG;GACH,MAAM;IAAC;IAAQ;IAAW;IAAS;GAAU;EAC/C;CACF;CACA,OAAO;EACL,gBAAgB;GACd,aAAa;GACb,YAAY;IACV,YAAY;KAAE,GAAG;KAAY,UAAU;IAAK;IAC5C,aAAa,EAAE,GAAG,WAAW;GAC/B;EACF;EACA,cAAc;GACZ,aAAa;GACb,YAAY,EACV,iBAAiB;IAAE,GAAG;IAAY,UAAU;GAAK,EACnD;EACF;CACF;AACF,CAAC"}
|
package/dist/index.d.cts
CHANGED
|
@@ -29,5 +29,12 @@ declare function highCardinalityKeys(contract: TelemetryContract): string[];
|
|
|
29
29
|
*/
|
|
30
30
|
declare function isHighCardinalityKey(contract: TelemetryContract, key: string): boolean;
|
|
31
31
|
//#endregion
|
|
32
|
-
|
|
32
|
+
//#region src/contracts/agent-security.d.ts
|
|
33
|
+
/**
|
|
34
|
+
* Published telemetry contract for Google SAIF-aligned agent security observability.
|
|
35
|
+
* Span names are illustrative — attributes are the stable surface under validation.
|
|
36
|
+
*/
|
|
37
|
+
declare const AGENT_SECURITY_TELEMETRY_CONTRACT: TelemetryContract;
|
|
38
|
+
//#endregion
|
|
39
|
+
export { AGENT_SECURITY_TELEMETRY_CONTRACT, ATTRIBUTE_TYPES, type AttributeSpec, type AttributeType, type ChangeKind, type ChangeType, type ContractSnapshot, type OtelContext, type ReadableSpanLike, SCHEMA_ATTRS, SNAPSHOT_SPEC, STABILITIES, type SchemaAttributeKey, type SchemaProcessorMode, type SchemaValidationProcessorOptions, SchemaValidationSpanProcessor, type SchemaViolation, type SnapshotAttribute, type SnapshotChange, type SnapshotDiff, type SnapshotSpan, type SpanLike, type SpanProcessorLike, type SpanShape, type SpanSpec, type Stability, type TelemetryContract, type ValidateOptions, type ViolationCode, type ViolationSeverity, allowsAdditionalAttributes, contractToSnapshot, createSchemaValidationProcessor, defineContract, diffSnapshots, formatDiff, formatViolation, hasBreakingChanges, hasErrors, highCardinalityKeys, isHighCardinalityKey, parseSnapshot, resolveAttributeSpec, serializeSnapshot, validateSpan };
|
|
33
40
|
//# sourceMappingURL=index.d.cts.map
|
package/dist/index.d.cts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.cts","names":[],"sources":["../src/redaction.ts"],"mappings":";;;;;;;AAwDa
|
|
1
|
+
{"version":3,"file":"index.d.cts","names":[],"sources":["../src/redaction.ts","../src/contracts/agent-security.ts"],"mappings":";;;;;;;AAwDa;;;;AC7Cb;;;;AA+EE;;;;;;;;iBDtDc,mBAAA,CAAoB,QAA2B,EAAjB,iBAAiB;;;;;;iBAkB/C,oBAAA,CACd,QAAA,EAAU,iBAAiB,EAC3B,GAAA;;;;;;;cC7CW,iCAAA,EA+EX,iBAAA"}
|
package/dist/index.d.ts
CHANGED
|
@@ -29,5 +29,12 @@ declare function highCardinalityKeys(contract: TelemetryContract): string[];
|
|
|
29
29
|
*/
|
|
30
30
|
declare function isHighCardinalityKey(contract: TelemetryContract, key: string): boolean;
|
|
31
31
|
//#endregion
|
|
32
|
-
|
|
32
|
+
//#region src/contracts/agent-security.d.ts
|
|
33
|
+
/**
|
|
34
|
+
* Published telemetry contract for Google SAIF-aligned agent security observability.
|
|
35
|
+
* Span names are illustrative — attributes are the stable surface under validation.
|
|
36
|
+
*/
|
|
37
|
+
declare const AGENT_SECURITY_TELEMETRY_CONTRACT: TelemetryContract;
|
|
38
|
+
//#endregion
|
|
39
|
+
export { AGENT_SECURITY_TELEMETRY_CONTRACT, ATTRIBUTE_TYPES, type AttributeSpec, type AttributeType, type ChangeKind, type ChangeType, type ContractSnapshot, type OtelContext, type ReadableSpanLike, SCHEMA_ATTRS, SNAPSHOT_SPEC, STABILITIES, type SchemaAttributeKey, type SchemaProcessorMode, type SchemaValidationProcessorOptions, SchemaValidationSpanProcessor, type SchemaViolation, type SnapshotAttribute, type SnapshotChange, type SnapshotDiff, type SnapshotSpan, type SpanLike, type SpanProcessorLike, type SpanShape, type SpanSpec, type Stability, type TelemetryContract, type ValidateOptions, type ViolationCode, type ViolationSeverity, allowsAdditionalAttributes, contractToSnapshot, createSchemaValidationProcessor, defineContract, diffSnapshots, formatDiff, formatViolation, hasBreakingChanges, hasErrors, highCardinalityKeys, isHighCardinalityKey, parseSnapshot, resolveAttributeSpec, serializeSnapshot, validateSpan };
|
|
33
40
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","names":[],"sources":["../src/redaction.ts"],"mappings":";;;;;;;AAwDa
|
|
1
|
+
{"version":3,"file":"index.d.ts","names":[],"sources":["../src/redaction.ts","../src/contracts/agent-security.ts"],"mappings":";;;;;;;AAwDa;;;;AC7Cb;;;;AA+EE;;;;;;;;iBDtDc,mBAAA,CAAoB,QAA2B,EAAjB,iBAAiB;;;;;;iBAkB/C,oBAAA,CACd,QAAA,EAAU,iBAAiB,EAC3B,GAAA;;;;;;;cC7CW,iCAAA,EA+EX,iBAAA"}
|
package/dist/index.js
CHANGED
|
@@ -39,5 +39,143 @@ function isHighCardinalityKey(contract, key) {
|
|
|
39
39
|
}
|
|
40
40
|
|
|
41
41
|
//#endregion
|
|
42
|
-
|
|
42
|
+
//#region src/contracts/agent-security.ts
|
|
43
|
+
const stringAttr = { type: "string" };
|
|
44
|
+
const boolAttr = { type: "boolean" };
|
|
45
|
+
const numberAttr = { type: "number" };
|
|
46
|
+
const stringArrayAttr = { type: "string[]" };
|
|
47
|
+
/**
|
|
48
|
+
* Published telemetry contract for Google SAIF-aligned agent security observability.
|
|
49
|
+
* Span names are illustrative — attributes are the stable surface under validation.
|
|
50
|
+
*/
|
|
51
|
+
const AGENT_SECURITY_TELEMETRY_CONTRACT = defineContract({
|
|
52
|
+
service: "autotel-agent-security",
|
|
53
|
+
version: "1.0.0",
|
|
54
|
+
commonAttributes: {
|
|
55
|
+
"autotel.agent": {
|
|
56
|
+
...boolAttr,
|
|
57
|
+
required: false,
|
|
58
|
+
description: "Agent audit marker"
|
|
59
|
+
},
|
|
60
|
+
"agent.controller.id": {
|
|
61
|
+
...stringAttr,
|
|
62
|
+
highCardinality: true,
|
|
63
|
+
description: "Hashed controlling human user id"
|
|
64
|
+
},
|
|
65
|
+
"agent.input.provenance": {
|
|
66
|
+
...stringAttr,
|
|
67
|
+
enum: [
|
|
68
|
+
"user_direct",
|
|
69
|
+
"user_voice",
|
|
70
|
+
"rag",
|
|
71
|
+
"memory",
|
|
72
|
+
"tool_result",
|
|
73
|
+
"external_untrusted"
|
|
74
|
+
]
|
|
75
|
+
},
|
|
76
|
+
"agent.action.risk_class": {
|
|
77
|
+
...stringAttr,
|
|
78
|
+
enum: [
|
|
79
|
+
"read",
|
|
80
|
+
"write",
|
|
81
|
+
"destructive",
|
|
82
|
+
"financial",
|
|
83
|
+
"exfiltration_capable"
|
|
84
|
+
]
|
|
85
|
+
},
|
|
86
|
+
"agent.consent.required": { ...boolAttr },
|
|
87
|
+
"agent.consent.outcome": {
|
|
88
|
+
...stringAttr,
|
|
89
|
+
enum: [
|
|
90
|
+
"approved",
|
|
91
|
+
"denied",
|
|
92
|
+
"timeout",
|
|
93
|
+
"revoked"
|
|
94
|
+
]
|
|
95
|
+
},
|
|
96
|
+
"agent.scope.active": { ...stringArrayAttr },
|
|
97
|
+
"agent.memory.operation": {
|
|
98
|
+
...stringAttr,
|
|
99
|
+
enum: [
|
|
100
|
+
"read",
|
|
101
|
+
"write",
|
|
102
|
+
"delete",
|
|
103
|
+
"search"
|
|
104
|
+
]
|
|
105
|
+
},
|
|
106
|
+
"agent.memory.isolation_key": {
|
|
107
|
+
...stringAttr,
|
|
108
|
+
highCardinality: true
|
|
109
|
+
},
|
|
110
|
+
"agent.plan.step_index": { ...numberAttr },
|
|
111
|
+
"agent.plan.tool_intents": { ...stringArrayAttr },
|
|
112
|
+
"agent.plan.risk.verdict": {
|
|
113
|
+
...stringAttr,
|
|
114
|
+
enum: [
|
|
115
|
+
"low",
|
|
116
|
+
"medium",
|
|
117
|
+
"high",
|
|
118
|
+
"critical"
|
|
119
|
+
]
|
|
120
|
+
},
|
|
121
|
+
"agent.plan.risk.score": { ...numberAttr },
|
|
122
|
+
"agent.plan.risk.categories": { ...stringArrayAttr },
|
|
123
|
+
"policy.decision": {
|
|
124
|
+
...stringAttr,
|
|
125
|
+
enum: [
|
|
126
|
+
"permit",
|
|
127
|
+
"deny",
|
|
128
|
+
"challenge",
|
|
129
|
+
"observe",
|
|
130
|
+
"error"
|
|
131
|
+
]
|
|
132
|
+
},
|
|
133
|
+
"tool.input_hash": { ...stringAttr },
|
|
134
|
+
"tool.output_hash": { ...stringAttr },
|
|
135
|
+
"mcp.tool.destructive": { ...boolAttr },
|
|
136
|
+
"mcp.tool.untrusted_content": { ...boolAttr },
|
|
137
|
+
"mcp.security.injection.verdict": {
|
|
138
|
+
...stringAttr,
|
|
139
|
+
enum: [
|
|
140
|
+
"clean",
|
|
141
|
+
"suspicious",
|
|
142
|
+
"malicious"
|
|
143
|
+
]
|
|
144
|
+
},
|
|
145
|
+
"security.event": { ...stringAttr },
|
|
146
|
+
"security.category": { ...stringAttr },
|
|
147
|
+
"security.outcome": { ...stringAttr },
|
|
148
|
+
"security.severity": {
|
|
149
|
+
...stringAttr,
|
|
150
|
+
enum: [
|
|
151
|
+
"info",
|
|
152
|
+
"warning",
|
|
153
|
+
"error",
|
|
154
|
+
"critical"
|
|
155
|
+
]
|
|
156
|
+
}
|
|
157
|
+
},
|
|
158
|
+
spans: {
|
|
159
|
+
"agent.action": {
|
|
160
|
+
description: "Scoped agent action or tool call with audit metadata",
|
|
161
|
+
attributes: {
|
|
162
|
+
"agent.id": {
|
|
163
|
+
...stringAttr,
|
|
164
|
+
required: true
|
|
165
|
+
},
|
|
166
|
+
"tool.name": { ...stringAttr }
|
|
167
|
+
}
|
|
168
|
+
},
|
|
169
|
+
"tools/call": {
|
|
170
|
+
description: "MCP tool invocation with boundary security signals",
|
|
171
|
+
attributes: { "mcp.tool.name": {
|
|
172
|
+
...stringAttr,
|
|
173
|
+
required: true
|
|
174
|
+
} }
|
|
175
|
+
}
|
|
176
|
+
}
|
|
177
|
+
});
|
|
178
|
+
|
|
179
|
+
//#endregion
|
|
180
|
+
export { AGENT_SECURITY_TELEMETRY_CONTRACT, ATTRIBUTE_TYPES, SCHEMA_ATTRS, SNAPSHOT_SPEC, STABILITIES, SchemaValidationSpanProcessor, allowsAdditionalAttributes, contractToSnapshot, createSchemaValidationProcessor, defineContract, diffSnapshots, formatDiff, formatViolation, hasBreakingChanges, hasErrors, highCardinalityKeys, isHighCardinalityKey, parseSnapshot, resolveAttributeSpec, serializeSnapshot, validateSpan };
|
|
43
181
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","names":[],"sources":["../src/redaction.ts"],"sourcesContent":["/**\n * Cardinality posture helpers.\n *\n * The old cardinality rule — \"keep unique-value counts down\" — was a constraint\n * invented because dashboards have pixels and a graph with 10k series is\n * unreadable to a human. An agent does not look at the graph; it reads the\n * spans. A high-cardinality field (the user id, the sender domain, the request\n * id) is then the single most useful attribute on a trace when the agent is\n * chasing one specific failure.\n *\n * So the contract lets you mark attributes `highCardinality: true` as a\n * deliberate signal, and this module turns that into a *protect list*: the keys\n * a redactor or span-name normalizer must NOT strip, even when an aggressive\n * default would otherwise drop them.\n */\n\nimport type { TelemetryContract } from './contract.js';\n\n/**\n * Every attribute key in the contract flagged `highCardinality: true`, across\n * both common and per-span attributes. Feed this into a redaction/normalization\n * allow-list so the fields most useful to an agent reader survive.\n *\n * @example\n * ```ts\n * import { init } from 'autotel';\n * import { highCardinalityKeys } from 'autotel-schema';\n * import { contract } from './telemetry.contract';\n *\n * init({\n * service: 'checkout',\n * // keep user.id / request.id intact even under the strict redactor\n * attributeRedactor: { allowKeys: highCardinalityKeys(contract), preset: 'strict' },\n * });\n * ```\n */\nexport function highCardinalityKeys(contract: TelemetryContract): string[] {\n const keys = new Set<string>();\n for (const [key, spec] of Object.entries(contract.commonAttributes ?? {})) {\n if (spec.highCardinality) keys.add(key);\n }\n for (const spanSpec of Object.values(contract.spans)) {\n for (const [key, spec] of Object.entries(spanSpec.attributes ?? {})) {\n if (spec.highCardinality) keys.add(key);\n }\n }\n return [...keys].toSorted();\n}\n\n/**\n * Predicate form of {@link highCardinalityKeys} — `true` when `key` is declared\n * high-cardinality anywhere in the contract. Useful inside a custom\n * `spanNameNormalizer` or redactor callback.\n */\nexport function isHighCardinalityKey(\n contract: TelemetryContract,\n key: string,\n): boolean {\n if (contract.commonAttributes?.[key]?.highCardinality) return true;\n for (const spanSpec of Object.values(contract.spans)) {\n if (spanSpec.attributes?.[key]?.highCardinality) return true;\n }\n return false;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAoCA,SAAgB,oBAAoB,UAAuC;CACzE,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,SAAS,oBAAoB,CAAC,CAAC,GACtE,IAAI,KAAK,iBAAiB,KAAK,IAAI,GAAG;CAExC,KAAK,MAAM,YAAY,OAAO,OAAO,SAAS,KAAK,GACjD,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,SAAS,cAAc,CAAC,CAAC,GAChE,IAAI,KAAK,iBAAiB,KAAK,IAAI,GAAG;CAG1C,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,SAAS;AAC5B;;;;;;AAOA,SAAgB,qBACd,UACA,KACS;CACT,IAAI,SAAS,mBAAmB,IAAI,EAAE,iBAAiB,OAAO;CAC9D,KAAK,MAAM,YAAY,OAAO,OAAO,SAAS,KAAK,GACjD,IAAI,SAAS,aAAa,IAAI,EAAE,iBAAiB,OAAO;CAE1D,OAAO;AACT"}
|
|
1
|
+
{"version":3,"file":"index.js","names":[],"sources":["../src/redaction.ts","../src/contracts/agent-security.ts"],"sourcesContent":["/**\n * Cardinality posture helpers.\n *\n * The old cardinality rule — \"keep unique-value counts down\" — was a constraint\n * invented because dashboards have pixels and a graph with 10k series is\n * unreadable to a human. An agent does not look at the graph; it reads the\n * spans. A high-cardinality field (the user id, the sender domain, the request\n * id) is then the single most useful attribute on a trace when the agent is\n * chasing one specific failure.\n *\n * So the contract lets you mark attributes `highCardinality: true` as a\n * deliberate signal, and this module turns that into a *protect list*: the keys\n * a redactor or span-name normalizer must NOT strip, even when an aggressive\n * default would otherwise drop them.\n */\n\nimport type { TelemetryContract } from './contract.js';\n\n/**\n * Every attribute key in the contract flagged `highCardinality: true`, across\n * both common and per-span attributes. Feed this into a redaction/normalization\n * allow-list so the fields most useful to an agent reader survive.\n *\n * @example\n * ```ts\n * import { init } from 'autotel';\n * import { highCardinalityKeys } from 'autotel-schema';\n * import { contract } from './telemetry.contract';\n *\n * init({\n * service: 'checkout',\n * // keep user.id / request.id intact even under the strict redactor\n * attributeRedactor: { allowKeys: highCardinalityKeys(contract), preset: 'strict' },\n * });\n * ```\n */\nexport function highCardinalityKeys(contract: TelemetryContract): string[] {\n const keys = new Set<string>();\n for (const [key, spec] of Object.entries(contract.commonAttributes ?? {})) {\n if (spec.highCardinality) keys.add(key);\n }\n for (const spanSpec of Object.values(contract.spans)) {\n for (const [key, spec] of Object.entries(spanSpec.attributes ?? {})) {\n if (spec.highCardinality) keys.add(key);\n }\n }\n return [...keys].toSorted();\n}\n\n/**\n * Predicate form of {@link highCardinalityKeys} — `true` when `key` is declared\n * high-cardinality anywhere in the contract. Useful inside a custom\n * `spanNameNormalizer` or redactor callback.\n */\nexport function isHighCardinalityKey(\n contract: TelemetryContract,\n key: string,\n): boolean {\n if (contract.commonAttributes?.[key]?.highCardinality) return true;\n for (const spanSpec of Object.values(contract.spans)) {\n if (spanSpec.attributes?.[key]?.highCardinality) return true;\n }\n return false;\n}\n","import { defineContract } from '../contract.js';\n\nconst stringAttr = { type: 'string' as const };\nconst boolAttr = { type: 'boolean' as const };\nconst numberAttr = { type: 'number' as const };\nconst stringArrayAttr = { type: 'string[]' as const };\n\n/**\n * Published telemetry contract for Google SAIF-aligned agent security observability.\n * Span names are illustrative — attributes are the stable surface under validation.\n */\nexport const AGENT_SECURITY_TELEMETRY_CONTRACT = defineContract({\n service: 'autotel-agent-security',\n version: '1.0.0',\n commonAttributes: {\n 'autotel.agent': { ...boolAttr, required: false, description: 'Agent audit marker' },\n 'agent.controller.id': {\n ...stringAttr,\n highCardinality: true,\n description: 'Hashed controlling human user id',\n },\n 'agent.input.provenance': {\n ...stringAttr,\n enum: [\n 'user_direct',\n 'user_voice',\n 'rag',\n 'memory',\n 'tool_result',\n 'external_untrusted',\n ],\n },\n 'agent.action.risk_class': {\n ...stringAttr,\n enum: ['read', 'write', 'destructive', 'financial', 'exfiltration_capable'],\n },\n 'agent.consent.required': { ...boolAttr },\n 'agent.consent.outcome': {\n ...stringAttr,\n enum: ['approved', 'denied', 'timeout', 'revoked'],\n },\n 'agent.scope.active': { ...stringArrayAttr },\n 'agent.memory.operation': {\n ...stringAttr,\n enum: ['read', 'write', 'delete', 'search'],\n },\n 'agent.memory.isolation_key': { ...stringAttr, highCardinality: true },\n 'agent.plan.step_index': { ...numberAttr },\n 'agent.plan.tool_intents': { ...stringArrayAttr },\n 'agent.plan.risk.verdict': {\n ...stringAttr,\n enum: ['low', 'medium', 'high', 'critical'],\n },\n 'agent.plan.risk.score': { ...numberAttr },\n 'agent.plan.risk.categories': { ...stringArrayAttr },\n 'policy.decision': {\n ...stringAttr,\n enum: ['permit', 'deny', 'challenge', 'observe', 'error'],\n },\n 'tool.input_hash': { ...stringAttr },\n 'tool.output_hash': { ...stringAttr },\n 'mcp.tool.destructive': { ...boolAttr },\n 'mcp.tool.untrusted_content': { ...boolAttr },\n 'mcp.security.injection.verdict': {\n ...stringAttr,\n enum: ['clean', 'suspicious', 'malicious'],\n },\n 'security.event': { ...stringAttr },\n 'security.category': { ...stringAttr },\n 'security.outcome': { ...stringAttr },\n 'security.severity': {\n ...stringAttr,\n enum: ['info', 'warning', 'error', 'critical'],\n },\n },\n spans: {\n 'agent.action': {\n description: 'Scoped agent action or tool call with audit metadata',\n attributes: {\n 'agent.id': { ...stringAttr, required: true },\n 'tool.name': { ...stringAttr },\n },\n },\n 'tools/call': {\n description: 'MCP tool invocation with boundary security signals',\n attributes: {\n 'mcp.tool.name': { ...stringAttr, required: true },\n },\n },\n },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAoCA,SAAgB,oBAAoB,UAAuC;CACzE,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,SAAS,oBAAoB,CAAC,CAAC,GACtE,IAAI,KAAK,iBAAiB,KAAK,IAAI,GAAG;CAExC,KAAK,MAAM,YAAY,OAAO,OAAO,SAAS,KAAK,GACjD,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,SAAS,cAAc,CAAC,CAAC,GAChE,IAAI,KAAK,iBAAiB,KAAK,IAAI,GAAG;CAG1C,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,SAAS;AAC5B;;;;;;AAOA,SAAgB,qBACd,UACA,KACS;CACT,IAAI,SAAS,mBAAmB,IAAI,EAAE,iBAAiB,OAAO;CAC9D,KAAK,MAAM,YAAY,OAAO,OAAO,SAAS,KAAK,GACjD,IAAI,SAAS,aAAa,IAAI,EAAE,iBAAiB,OAAO;CAE1D,OAAO;AACT;;;;AC7DA,MAAM,aAAa,EAAE,MAAM,SAAkB;AAC7C,MAAM,WAAW,EAAE,MAAM,UAAmB;AAC5C,MAAM,aAAa,EAAE,MAAM,SAAkB;AAC7C,MAAM,kBAAkB,EAAE,MAAM,WAAoB;;;;;AAMpD,MAAa,oCAAoC,eAAe;CAC9D,SAAS;CACT,SAAS;CACT,kBAAkB;EAChB,iBAAiB;GAAE,GAAG;GAAU,UAAU;GAAO,aAAa;EAAqB;EACnF,uBAAuB;GACrB,GAAG;GACH,iBAAiB;GACjB,aAAa;EACf;EACA,0BAA0B;GACxB,GAAG;GACH,MAAM;IACJ;IACA;IACA;IACA;IACA;IACA;GACF;EACF;EACA,2BAA2B;GACzB,GAAG;GACH,MAAM;IAAC;IAAQ;IAAS;IAAe;IAAa;GAAsB;EAC5E;EACA,0BAA0B,EAAE,GAAG,SAAS;EACxC,yBAAyB;GACvB,GAAG;GACH,MAAM;IAAC;IAAY;IAAU;IAAW;GAAS;EACnD;EACA,sBAAsB,EAAE,GAAG,gBAAgB;EAC3C,0BAA0B;GACxB,GAAG;GACH,MAAM;IAAC;IAAQ;IAAS;IAAU;GAAQ;EAC5C;EACA,8BAA8B;GAAE,GAAG;GAAY,iBAAiB;EAAK;EACrE,yBAAyB,EAAE,GAAG,WAAW;EACzC,2BAA2B,EAAE,GAAG,gBAAgB;EAChD,2BAA2B;GACzB,GAAG;GACH,MAAM;IAAC;IAAO;IAAU;IAAQ;GAAU;EAC5C;EACA,yBAAyB,EAAE,GAAG,WAAW;EACzC,8BAA8B,EAAE,GAAG,gBAAgB;EACnD,mBAAmB;GACjB,GAAG;GACH,MAAM;IAAC;IAAU;IAAQ;IAAa;IAAW;GAAO;EAC1D;EACA,mBAAmB,EAAE,GAAG,WAAW;EACnC,oBAAoB,EAAE,GAAG,WAAW;EACpC,wBAAwB,EAAE,GAAG,SAAS;EACtC,8BAA8B,EAAE,GAAG,SAAS;EAC5C,kCAAkC;GAChC,GAAG;GACH,MAAM;IAAC;IAAS;IAAc;GAAW;EAC3C;EACA,kBAAkB,EAAE,GAAG,WAAW;EAClC,qBAAqB,EAAE,GAAG,WAAW;EACrC,oBAAoB,EAAE,GAAG,WAAW;EACpC,qBAAqB;GACnB,GAAG;GACH,MAAM;IAAC;IAAQ;IAAW;IAAS;GAAU;EAC/C;CACF;CACA,OAAO;EACL,gBAAgB;GACd,aAAa;GACb,YAAY;IACV,YAAY;KAAE,GAAG;KAAY,UAAU;IAAK;IAC5C,aAAa,EAAE,GAAG,WAAW;GAC/B;EACF;EACA,cAAc;GACZ,aAAa;GACb,YAAY,EACV,iBAAiB;IAAE,GAAG;IAAY,UAAU;GAAK,EACnD;EACF;CACF;AACF,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "autotel-schema",
|
|
3
|
-
"version": "
|
|
3
|
+
"version": "2.0.0",
|
|
4
4
|
"description": "Your telemetry surface as a typed, versioned contract — declare the spans and attributes your service emits, validate live spans against them, and diff the surface across commits to catch breaking trace changes before they ship.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./dist/index.js",
|
|
@@ -27,7 +27,7 @@
|
|
|
27
27
|
},
|
|
28
28
|
"files": [
|
|
29
29
|
"dist",
|
|
30
|
-
"
|
|
30
|
+
"snapshots",
|
|
31
31
|
"README.md"
|
|
32
32
|
],
|
|
33
33
|
"keywords": [
|
|
@@ -44,7 +44,7 @@
|
|
|
44
44
|
"author": "Jag Reehal <jag@jagreehal.com> (https://jagreehal.com)",
|
|
45
45
|
"license": "MIT",
|
|
46
46
|
"peerDependencies": {
|
|
47
|
-
"autotel": "4.
|
|
47
|
+
"autotel": "4.2.0"
|
|
48
48
|
},
|
|
49
49
|
"peerDependenciesMeta": {
|
|
50
50
|
"autotel": {
|
|
@@ -0,0 +1,238 @@
|
|
|
1
|
+
{
|
|
2
|
+
"spec": "autotel-schema-snapshot/v1",
|
|
3
|
+
"service": "autotel-agent-security",
|
|
4
|
+
"version": "1.0.0",
|
|
5
|
+
"commonAttributes": {
|
|
6
|
+
"agent.action.risk_class": {
|
|
7
|
+
"type": "string",
|
|
8
|
+
"stability": "stable",
|
|
9
|
+
"required": false,
|
|
10
|
+
"highCardinality": false,
|
|
11
|
+
"enum": [
|
|
12
|
+
"read",
|
|
13
|
+
"write",
|
|
14
|
+
"destructive",
|
|
15
|
+
"financial",
|
|
16
|
+
"exfiltration_capable"
|
|
17
|
+
]
|
|
18
|
+
},
|
|
19
|
+
"agent.consent.outcome": {
|
|
20
|
+
"type": "string",
|
|
21
|
+
"stability": "stable",
|
|
22
|
+
"required": false,
|
|
23
|
+
"highCardinality": false,
|
|
24
|
+
"enum": [
|
|
25
|
+
"approved",
|
|
26
|
+
"denied",
|
|
27
|
+
"timeout",
|
|
28
|
+
"revoked"
|
|
29
|
+
]
|
|
30
|
+
},
|
|
31
|
+
"agent.consent.required": {
|
|
32
|
+
"type": "boolean",
|
|
33
|
+
"stability": "stable",
|
|
34
|
+
"required": false,
|
|
35
|
+
"highCardinality": false
|
|
36
|
+
},
|
|
37
|
+
"agent.controller.id": {
|
|
38
|
+
"type": "string",
|
|
39
|
+
"stability": "stable",
|
|
40
|
+
"required": false,
|
|
41
|
+
"highCardinality": true,
|
|
42
|
+
"description": "Hashed controlling human user id"
|
|
43
|
+
},
|
|
44
|
+
"agent.input.provenance": {
|
|
45
|
+
"type": "string",
|
|
46
|
+
"stability": "stable",
|
|
47
|
+
"required": false,
|
|
48
|
+
"highCardinality": false,
|
|
49
|
+
"enum": [
|
|
50
|
+
"user_direct",
|
|
51
|
+
"user_voice",
|
|
52
|
+
"rag",
|
|
53
|
+
"memory",
|
|
54
|
+
"tool_result",
|
|
55
|
+
"external_untrusted"
|
|
56
|
+
]
|
|
57
|
+
},
|
|
58
|
+
"agent.memory.isolation_key": {
|
|
59
|
+
"type": "string",
|
|
60
|
+
"stability": "stable",
|
|
61
|
+
"required": false,
|
|
62
|
+
"highCardinality": true
|
|
63
|
+
},
|
|
64
|
+
"agent.memory.operation": {
|
|
65
|
+
"type": "string",
|
|
66
|
+
"stability": "stable",
|
|
67
|
+
"required": false,
|
|
68
|
+
"highCardinality": false,
|
|
69
|
+
"enum": [
|
|
70
|
+
"read",
|
|
71
|
+
"write",
|
|
72
|
+
"delete",
|
|
73
|
+
"search"
|
|
74
|
+
]
|
|
75
|
+
},
|
|
76
|
+
"agent.plan.risk.categories": {
|
|
77
|
+
"type": "string[]",
|
|
78
|
+
"stability": "stable",
|
|
79
|
+
"required": false,
|
|
80
|
+
"highCardinality": false
|
|
81
|
+
},
|
|
82
|
+
"agent.plan.risk.score": {
|
|
83
|
+
"type": "number",
|
|
84
|
+
"stability": "stable",
|
|
85
|
+
"required": false,
|
|
86
|
+
"highCardinality": false
|
|
87
|
+
},
|
|
88
|
+
"agent.plan.risk.verdict": {
|
|
89
|
+
"type": "string",
|
|
90
|
+
"stability": "stable",
|
|
91
|
+
"required": false,
|
|
92
|
+
"highCardinality": false,
|
|
93
|
+
"enum": [
|
|
94
|
+
"low",
|
|
95
|
+
"medium",
|
|
96
|
+
"high",
|
|
97
|
+
"critical"
|
|
98
|
+
]
|
|
99
|
+
},
|
|
100
|
+
"agent.plan.step_index": {
|
|
101
|
+
"type": "number",
|
|
102
|
+
"stability": "stable",
|
|
103
|
+
"required": false,
|
|
104
|
+
"highCardinality": false
|
|
105
|
+
},
|
|
106
|
+
"agent.plan.tool_intents": {
|
|
107
|
+
"type": "string[]",
|
|
108
|
+
"stability": "stable",
|
|
109
|
+
"required": false,
|
|
110
|
+
"highCardinality": false
|
|
111
|
+
},
|
|
112
|
+
"agent.scope.active": {
|
|
113
|
+
"type": "string[]",
|
|
114
|
+
"stability": "stable",
|
|
115
|
+
"required": false,
|
|
116
|
+
"highCardinality": false
|
|
117
|
+
},
|
|
118
|
+
"autotel.agent": {
|
|
119
|
+
"type": "boolean",
|
|
120
|
+
"stability": "stable",
|
|
121
|
+
"required": false,
|
|
122
|
+
"highCardinality": false,
|
|
123
|
+
"description": "Agent audit marker"
|
|
124
|
+
},
|
|
125
|
+
"mcp.security.injection.verdict": {
|
|
126
|
+
"type": "string",
|
|
127
|
+
"stability": "stable",
|
|
128
|
+
"required": false,
|
|
129
|
+
"highCardinality": false,
|
|
130
|
+
"enum": [
|
|
131
|
+
"clean",
|
|
132
|
+
"suspicious",
|
|
133
|
+
"malicious"
|
|
134
|
+
]
|
|
135
|
+
},
|
|
136
|
+
"mcp.tool.destructive": {
|
|
137
|
+
"type": "boolean",
|
|
138
|
+
"stability": "stable",
|
|
139
|
+
"required": false,
|
|
140
|
+
"highCardinality": false
|
|
141
|
+
},
|
|
142
|
+
"mcp.tool.untrusted_content": {
|
|
143
|
+
"type": "boolean",
|
|
144
|
+
"stability": "stable",
|
|
145
|
+
"required": false,
|
|
146
|
+
"highCardinality": false
|
|
147
|
+
},
|
|
148
|
+
"policy.decision": {
|
|
149
|
+
"type": "string",
|
|
150
|
+
"stability": "stable",
|
|
151
|
+
"required": false,
|
|
152
|
+
"highCardinality": false,
|
|
153
|
+
"enum": [
|
|
154
|
+
"permit",
|
|
155
|
+
"deny",
|
|
156
|
+
"challenge",
|
|
157
|
+
"observe",
|
|
158
|
+
"error"
|
|
159
|
+
]
|
|
160
|
+
},
|
|
161
|
+
"security.category": {
|
|
162
|
+
"type": "string",
|
|
163
|
+
"stability": "stable",
|
|
164
|
+
"required": false,
|
|
165
|
+
"highCardinality": false
|
|
166
|
+
},
|
|
167
|
+
"security.event": {
|
|
168
|
+
"type": "string",
|
|
169
|
+
"stability": "stable",
|
|
170
|
+
"required": false,
|
|
171
|
+
"highCardinality": false
|
|
172
|
+
},
|
|
173
|
+
"security.outcome": {
|
|
174
|
+
"type": "string",
|
|
175
|
+
"stability": "stable",
|
|
176
|
+
"required": false,
|
|
177
|
+
"highCardinality": false
|
|
178
|
+
},
|
|
179
|
+
"security.severity": {
|
|
180
|
+
"type": "string",
|
|
181
|
+
"stability": "stable",
|
|
182
|
+
"required": false,
|
|
183
|
+
"highCardinality": false,
|
|
184
|
+
"enum": [
|
|
185
|
+
"info",
|
|
186
|
+
"warning",
|
|
187
|
+
"error",
|
|
188
|
+
"critical"
|
|
189
|
+
]
|
|
190
|
+
},
|
|
191
|
+
"tool.input_hash": {
|
|
192
|
+
"type": "string",
|
|
193
|
+
"stability": "stable",
|
|
194
|
+
"required": false,
|
|
195
|
+
"highCardinality": false
|
|
196
|
+
},
|
|
197
|
+
"tool.output_hash": {
|
|
198
|
+
"type": "string",
|
|
199
|
+
"stability": "stable",
|
|
200
|
+
"required": false,
|
|
201
|
+
"highCardinality": false
|
|
202
|
+
}
|
|
203
|
+
},
|
|
204
|
+
"spans": {
|
|
205
|
+
"agent.action": {
|
|
206
|
+
"stability": "stable",
|
|
207
|
+
"additionalAttributes": false,
|
|
208
|
+
"attributes": {
|
|
209
|
+
"agent.id": {
|
|
210
|
+
"type": "string",
|
|
211
|
+
"stability": "stable",
|
|
212
|
+
"required": true,
|
|
213
|
+
"highCardinality": false
|
|
214
|
+
},
|
|
215
|
+
"tool.name": {
|
|
216
|
+
"type": "string",
|
|
217
|
+
"stability": "stable",
|
|
218
|
+
"required": false,
|
|
219
|
+
"highCardinality": false
|
|
220
|
+
}
|
|
221
|
+
},
|
|
222
|
+
"description": "Scoped agent action or tool call with audit metadata"
|
|
223
|
+
},
|
|
224
|
+
"tools/call": {
|
|
225
|
+
"stability": "stable",
|
|
226
|
+
"additionalAttributes": false,
|
|
227
|
+
"attributes": {
|
|
228
|
+
"mcp.tool.name": {
|
|
229
|
+
"type": "string",
|
|
230
|
+
"stability": "stable",
|
|
231
|
+
"required": true,
|
|
232
|
+
"highCardinality": false
|
|
233
|
+
}
|
|
234
|
+
},
|
|
235
|
+
"description": "MCP tool invocation with boundary security signals"
|
|
236
|
+
}
|
|
237
|
+
}
|
|
238
|
+
}
|
package/src/attrs.ts
DELETED
|
@@ -1,23 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Wire constants for the schema contract — the keys autotel-schema reads from
|
|
3
|
-
* and stamps onto spans. Dependency-free so CLI, browser, and edge code can
|
|
4
|
-
* share the exact same strings the runtime uses.
|
|
5
|
-
*/
|
|
6
|
-
|
|
7
|
-
/**
|
|
8
|
-
* Resource/span attributes that announce the contract to a reader. Stamping
|
|
9
|
-
* `telemetry.schema.version` means an agent following a trace knows *which*
|
|
10
|
-
* version of your public telemetry API it is looking at — the difference
|
|
11
|
-
* between "confidently correct" and "confidently wrong" after a rename.
|
|
12
|
-
*/
|
|
13
|
-
export const SCHEMA_ATTRS = {
|
|
14
|
-
/** The service this contract describes (mirrors `service.name`). */
|
|
15
|
-
SERVICE: 'telemetry.schema.service',
|
|
16
|
-
/** Semver of the telemetry contract that produced this span. */
|
|
17
|
-
VERSION: 'telemetry.schema.version',
|
|
18
|
-
} as const;
|
|
19
|
-
|
|
20
|
-
export type SchemaAttributeKey = (typeof SCHEMA_ATTRS)[keyof typeof SCHEMA_ATTRS];
|
|
21
|
-
|
|
22
|
-
/** Snapshot file spec marker — bump only on a breaking snapshot format change. */
|
|
23
|
-
export const SNAPSHOT_SPEC = 'autotel-schema-snapshot/v1' as const;
|