autotel 3.5.0 → 3.7.0

package/dist/attribute-redacting-processor-DtTS9xxh.d.cts

@@ -0,0 +1,175 @@
+import { ReadableSpan, Span, SpanProcessor } from "@opentelemetry/sdk-trace-base";
+import { AttributeValue, Context } from "@opentelemetry/api";
+
+//#region src/attribute-redacting-processor.d.ts
+/**
+ * Custom redactor function type
+ */
+type AttributeRedactorFn = (key: string, value: AttributeValue) => AttributeValue;
+/**
+ * Built-in redactor preset names
+ */
+type AttributeRedactorPreset = 'default' | 'strict' | 'pci-dss';
+/**
+ * Masker function type - receives the matched string and returns a masked version
+ */
+type MaskFn = (match: string) => string;
+/**
+ * Value pattern configuration
+ */
+interface ValuePatternConfig {
+  /** Name for debugging/logging */
+  name: string;
+  /** Regex pattern to match in values */
+  pattern: RegExp;
+  /** Custom replacement (default: uses global replacement) */
+  replacement?: string;
+  /** Mask function for smart partial masking (overrides replacement) */
+  mask?: MaskFn;
+}
+/**
+ * Built-in PII pattern names
+ */
+type BuiltinPatternName = keyof typeof builtinPatterns;
+/**
+ * Attribute redactor configuration
+ */
+interface AttributeRedactorConfig {
+  /** Patterns to match against attribute keys (redacts entire value if key matches) */
+  keyPatterns?: RegExp[];
+  /** Patterns to match against attribute values (redacts matched portion) */
+  valuePatterns?: ValuePatternConfig[];
+  /** Dot-notation paths to redact (e.g. 'user.password', 'payment.card') */
+  paths?: string[];
+  /** Built-in PII patterns to enable. `true` enables all, `false` disables all, array selects specific ones. */
+  builtins?: boolean | BuiltinPatternName[];
+  /** Custom RegExp patterns for string-level redaction */
+  patterns?: RegExp[];
+  /** Default replacement string (default: '[REDACTED]') */
+  replacement?: string;
+  /** Custom redactor function for full control */
+  redactor?: AttributeRedactorFn;
+}
+/**
+ * Processor options
+ */
+interface AttributeRedactingProcessorOptions {
+  redactor: AttributeRedactorConfig | AttributeRedactorPreset;
+}
+/**
+ * Built-in patterns for detecting sensitive data
+ */
+declare const REDACTOR_PATTERNS: {
+  readonly email: RegExp;
+  readonly phone: RegExp;
+  readonly ssn: RegExp;
+  readonly creditCard: RegExp;
+  readonly bearerToken: RegExp;
+  readonly apiKeyInValue: RegExp;
+  readonly jwt: RegExp;
+  readonly sensitiveKey: RegExp;
+};
+/**
+ * Built-in PII detection patterns with smart masking.
+ * Each builtin preserves just enough signal for debugging while scrubbing PII.
+ */
+declare const builtinPatterns: {
+  /** Credit card numbers → ****1111 (PCI DSS: last 4 allowed) */readonly creditCard: {
+    readonly pattern: RegExp;
+    readonly mask: (m: string) => string;
+  }; /** Email addresses → a***@***.com */
+  readonly email: {
+    readonly pattern: RegExp;
+    readonly mask: (m: string) => string;
+  }; /** IPv4 addresses → ***.***.***.100 (last octet only) */
+  readonly ipv4: {
+    readonly pattern: RegExp;
+    readonly mask: (m: string) => string;
+  };
+  /**
+   * International / formatted phone numbers.
+   *
+   * Matches:
+   * - `+33 1 23 45 67 89` -> `+33******89`
+   * - `(415) 555-1234` -> `********34`
+   * - `555-123-4567` / `555.123.4567` / `5551234567` -> `********67`
+   *
+   * Bare short digit runs like `12345678` are intentionally not matched.
+   */
+  readonly phone: {
+    readonly pattern: RegExp;
+    readonly mask: (m: string) => string;
+  }; /** JWT tokens → eyJ***.*** */
+  readonly jwt: {
+    readonly pattern: RegExp;
+    readonly mask: () => string;
+  }; /** Bearer tokens → Bearer *** */
+  readonly bearer: {
+    readonly pattern: RegExp;
+    readonly mask: () => string;
+  }; /** IBAN → FR76****189 (country + check digits + last 3) */
+  readonly iban: {
+    readonly pattern: RegExp;
+    readonly mask: (m: string) => string;
+  };
+};
+/**
+ * Built-in redactor presets
+ */
+declare const REDACTOR_PRESETS: Record<AttributeRedactorPreset, AttributeRedactorConfig>;
+/**
+ * Normalize redactor config that may have been deserialized from JSON/YAML.
+ * Converts regex-like values back to RegExp instances.
+ */
+declare function normalizeAttributeRedactorConfig(raw: AttributeRedactorConfig | AttributeRedactorPreset | unknown): AttributeRedactorConfig | AttributeRedactorPreset | undefined;
+/**
+ * Create a proxy wrapper around ReadableSpan with redacted attributes
+ *
+ * Since ReadableSpan.attributes is readonly, we use a Proxy to intercept
+ * attribute access and return the redacted version.
+ */
+declare function createRedactedSpan(span: ReadableSpan, redactor: AttributeRedactorFn): ReadableSpan;
+/**
+ * Create an attribute redactor function from a config or preset.
+ *
+ * This is useful when you need to apply the same redaction logic
+ * outside of the span processor pipeline (e.g., for canonical log lines).
+ *
+ * @example
+ * ```typescript
+ * const redactor = createAttributeRedactor('default');
+ * const redactedValue = redactor('user.password', 'secret123');
+ * // redactedValue === '[REDACTED]'
+ * ```
+ */
+declare function createAttributeRedactor(config: AttributeRedactorConfig | AttributeRedactorPreset): AttributeRedactorFn;
+/**
+ * Span processor that redacts sensitive data from span attributes.
+ *
+ * Redaction happens in onEnd() when all attributes are finalized.
+ * Uses a Proxy wrapper to intercept attribute access since ReadableSpan
+ * attributes are readonly.
+ *
+ * Common use cases:
+ * - PII compliance (GDPR, CCPA)
+ * - PCI-DSS compliance for payment data
+ * - Preventing secrets from leaking to observability backends
+ */
+declare class AttributeRedactingProcessor implements SpanProcessor {
+  private readonly wrappedProcessor;
+  private readonly redactor;
+  constructor(wrappedProcessor: SpanProcessor, options: AttributeRedactingProcessorOptions);
+  /**
+   * Pass through onStart unchanged - attributes aren't finalized yet
+   */
+  onStart(span: Span, parentContext: Context): void;
+  /**
+   * Redact attributes and forward to wrapped processor
+   */
+  onEnd(span: ReadableSpan): void;
+  forceFlush(): Promise<void>;
+  shutdown(): Promise<void>;
+}
+//#endregion
+export { AttributeRedactorPreset as a, REDACTOR_PATTERNS as c, builtinPatterns as d, createAttributeRedactor as f, AttributeRedactorFn as i, REDACTOR_PRESETS as l, normalizeAttributeRedactorConfig as m, AttributeRedactingProcessorOptions as n, BuiltinPatternName as o, createRedactedSpan as p, AttributeRedactorConfig as r, MaskFn as s, AttributeRedactingProcessor as t, ValuePatternConfig as u };
+//# sourceMappingURL=attribute-redacting-processor-DtTS9xxh.d.cts.map

package/dist/attribute-redacting-processor-DtTS9xxh.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attribute-redacting-processor-DtTS9xxh.d.cts","names":[],"sources":["../src/attribute-redacting-processor.ts"],"mappings":";;;;;;;KAsCY,mBAAA,IACV,GAAA,UACA,KAAA,EAAO,cAAA,KACJ,cAAc;;AAuBJ;AAMf;KAxBY,uBAAA;;;AAwBiD;KAnBjD,MAAA,IAAU,KAAa;;;;UAKlB,kBAAA;EA8BM;EA5BrB,IAAA;EAqCW;EAnCX,OAAA,EAAS,MAAA;EAmCqB;EAjC9B,WAAA;EAec;EAbd,IAAA,GAAO,MAAM;AAAA;;;;KAMH,kBAAA,gBAAkC,eAAe;;;;UAK5C,uBAAA;EAoBe;EAlB9B,WAAA,GAAc,MAAA;EAwBC;EArBf,aAAA,GAAgB,kBAAA;;EAGhB,KAAA;EAmBA;EAhBA,QAAA,aAAqB,kBAAA;EAgBe;EAbpC,QAAA,GAAW,MAAA;EAagD;EAV3D,WAAA;EA6BQ;EA1BR,QAAA,GAAW,mBAAA;AAAA;;;;UAMI,kCAAA;EACf,QAAA,EAAU,uBAAA,GAA0B,uBAAuB;AAAA;;;;cAMhD,iBAAA;EAAA;;;;;;;;;;;;;cAmBA,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAoHA,gBAAA,EAAkB,MAAA,CAC7B,uBAAA,EACA,uBAAA;AAvDkB;AAqDpB;;;AArDoB,iBAsGJ,gCAAA,CACd,GAAA,EAAK,uBAAA,GAA0B,uBAAA,aAC9B,uBAAA,GAA0B,uBAAA;;;;;;;iBA4NpB,kBAAA,CACP,IAAA,EAAM,YAAA,EACN,QAAA,EAAU,mBAAA,GACT,YAAA;;AAhRsB;AA+CzB;;;;;;;;;;;iBAwQgB,uBAAA,CACd,MAAA,EAAQ,uBAAA,GAA0B,uBAAA,GACjC,mBAAA;;;;AAxQiD;AAsDnD;;;;;;;;cAkOY,2BAAA,YAAuC,aAAA;EAAA,iBACjC,gBAAA;EAAA,iBACA,QAAA;cAGf,gBAAA,EAAkB,aAAA,EAClB,OAAA,EAAS,kCAAA;EA/DV;;AAAY;EAyEb,OAAA,CAAQ,IAAA,EAAM,IAAA,EAAM,aAAA,EAAe,OAAA;EAlCE;;;EAyCrC,KAAA,CAAM,IAAA,EAAM,YAAA;EAWZ,UAAA,IAAc,OAAA;EAId,QAAA,IAAY,OAAA;AAAA"}

package/dist/attribute-redacting-processor-DtTS9xxh.d.ts

@@ -0,0 +1,175 @@
+import { ReadableSpan, Span, SpanProcessor } from "@opentelemetry/sdk-trace-base";
+import { AttributeValue, Context } from "@opentelemetry/api";
+
+//#region src/attribute-redacting-processor.d.ts
+/**
+ * Custom redactor function type
+ */
+type AttributeRedactorFn = (key: string, value: AttributeValue) => AttributeValue;
+/**
+ * Built-in redactor preset names
+ */
+type AttributeRedactorPreset = 'default' | 'strict' | 'pci-dss';
+/**
+ * Masker function type - receives the matched string and returns a masked version
+ */
+type MaskFn = (match: string) => string;
+/**
+ * Value pattern configuration
+ */
+interface ValuePatternConfig {
+  /** Name for debugging/logging */
+  name: string;
+  /** Regex pattern to match in values */
+  pattern: RegExp;
+  /** Custom replacement (default: uses global replacement) */
+  replacement?: string;
+  /** Mask function for smart partial masking (overrides replacement) */
+  mask?: MaskFn;
+}
+/**
+ * Built-in PII pattern names
+ */
+type BuiltinPatternName = keyof typeof builtinPatterns;
+/**
+ * Attribute redactor configuration
+ */
+interface AttributeRedactorConfig {
+  /** Patterns to match against attribute keys (redacts entire value if key matches) */
+  keyPatterns?: RegExp[];
+  /** Patterns to match against attribute values (redacts matched portion) */
+  valuePatterns?: ValuePatternConfig[];
+  /** Dot-notation paths to redact (e.g. 'user.password', 'payment.card') */
+  paths?: string[];
+  /** Built-in PII patterns to enable. `true` enables all, `false` disables all, array selects specific ones. */
+  builtins?: boolean | BuiltinPatternName[];
+  /** Custom RegExp patterns for string-level redaction */
+  patterns?: RegExp[];
+  /** Default replacement string (default: '[REDACTED]') */
+  replacement?: string;
+  /** Custom redactor function for full control */
+  redactor?: AttributeRedactorFn;
+}
+/**
+ * Processor options
+ */
+interface AttributeRedactingProcessorOptions {
+  redactor: AttributeRedactorConfig | AttributeRedactorPreset;
+}
+/**
+ * Built-in patterns for detecting sensitive data
+ */
+declare const REDACTOR_PATTERNS: {
+  readonly email: RegExp;
+  readonly phone: RegExp;
+  readonly ssn: RegExp;
+  readonly creditCard: RegExp;
+  readonly bearerToken: RegExp;
+  readonly apiKeyInValue: RegExp;
+  readonly jwt: RegExp;
+  readonly sensitiveKey: RegExp;
+};
+/**
+ * Built-in PII detection patterns with smart masking.
+ * Each builtin preserves just enough signal for debugging while scrubbing PII.
+ */
+declare const builtinPatterns: {
+  /** Credit card numbers → ****1111 (PCI DSS: last 4 allowed) */readonly creditCard: {
+    readonly pattern: RegExp;
+    readonly mask: (m: string) => string;
+  }; /** Email addresses → a***@***.com */
+  readonly email: {
+    readonly pattern: RegExp;
+    readonly mask: (m: string) => string;
+  }; /** IPv4 addresses → ***.***.***.100 (last octet only) */
+  readonly ipv4: {
+    readonly pattern: RegExp;
+    readonly mask: (m: string) => string;
+  };
+  /**
+   * International / formatted phone numbers.
+   *
+   * Matches:
+   * - `+33 1 23 45 67 89` -> `+33******89`
+   * - `(415) 555-1234` -> `********34`
+   * - `555-123-4567` / `555.123.4567` / `5551234567` -> `********67`
+   *
+   * Bare short digit runs like `12345678` are intentionally not matched.
+   */
+  readonly phone: {
+    readonly pattern: RegExp;
+    readonly mask: (m: string) => string;
+  }; /** JWT tokens → eyJ***.*** */
+  readonly jwt: {
+    readonly pattern: RegExp;
+    readonly mask: () => string;
+  }; /** Bearer tokens → Bearer *** */
+  readonly bearer: {
+    readonly pattern: RegExp;
+    readonly mask: () => string;
+  }; /** IBAN → FR76****189 (country + check digits + last 3) */
+  readonly iban: {
+    readonly pattern: RegExp;
+    readonly mask: (m: string) => string;
+  };
+};
+/**
+ * Built-in redactor presets
+ */
+declare const REDACTOR_PRESETS: Record<AttributeRedactorPreset, AttributeRedactorConfig>;
+/**
+ * Normalize redactor config that may have been deserialized from JSON/YAML.
+ * Converts regex-like values back to RegExp instances.
+ */
+declare function normalizeAttributeRedactorConfig(raw: AttributeRedactorConfig | AttributeRedactorPreset | unknown): AttributeRedactorConfig | AttributeRedactorPreset | undefined;
+/**
+ * Create a proxy wrapper around ReadableSpan with redacted attributes
+ *
+ * Since ReadableSpan.attributes is readonly, we use a Proxy to intercept
+ * attribute access and return the redacted version.
+ */
+declare function createRedactedSpan(span: ReadableSpan, redactor: AttributeRedactorFn): ReadableSpan;
+/**
+ * Create an attribute redactor function from a config or preset.
+ *
+ * This is useful when you need to apply the same redaction logic
+ * outside of the span processor pipeline (e.g., for canonical log lines).
+ *
+ * @example
+ * ```typescript
+ * const redactor = createAttributeRedactor('default');
+ * const redactedValue = redactor('user.password', 'secret123');
+ * // redactedValue === '[REDACTED]'
+ * ```
+ */
+declare function createAttributeRedactor(config: AttributeRedactorConfig | AttributeRedactorPreset): AttributeRedactorFn;
+/**
+ * Span processor that redacts sensitive data from span attributes.
+ *
+ * Redaction happens in onEnd() when all attributes are finalized.
+ * Uses a Proxy wrapper to intercept attribute access since ReadableSpan
+ * attributes are readonly.
+ *
+ * Common use cases:
+ * - PII compliance (GDPR, CCPA)
+ * - PCI-DSS compliance for payment data
+ * - Preventing secrets from leaking to observability backends
+ */
+declare class AttributeRedactingProcessor implements SpanProcessor {
+  private readonly wrappedProcessor;
+  private readonly redactor;
+  constructor(wrappedProcessor: SpanProcessor, options: AttributeRedactingProcessorOptions);
+  /**
+   * Pass through onStart unchanged - attributes aren't finalized yet
+   */
+  onStart(span: Span, parentContext: Context): void;
+  /**
+   * Redact attributes and forward to wrapped processor
+   */
+  onEnd(span: ReadableSpan): void;
+  forceFlush(): Promise<void>;
+  shutdown(): Promise<void>;
+}
+//#endregion
+export { AttributeRedactorPreset as a, REDACTOR_PATTERNS as c, builtinPatterns as d, createAttributeRedactor as f, AttributeRedactorFn as i, REDACTOR_PRESETS as l, normalizeAttributeRedactorConfig as m, AttributeRedactingProcessorOptions as n, BuiltinPatternName as o, createRedactedSpan as p, AttributeRedactorConfig as r, MaskFn as s, AttributeRedactingProcessor as t, ValuePatternConfig as u };
+//# sourceMappingURL=attribute-redacting-processor-DtTS9xxh.d.ts.map

package/dist/attribute-redacting-processor-DtTS9xxh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attribute-redacting-processor-DtTS9xxh.d.ts","names":[],"sources":["../src/attribute-redacting-processor.ts"],"mappings":";;;;;;;KAsCY,mBAAA,IACV,GAAA,UACA,KAAA,EAAO,cAAA,KACJ,cAAc;;AAuBJ;AAMf;KAxBY,uBAAA;;;AAwBiD;KAnBjD,MAAA,IAAU,KAAa;;;;UAKlB,kBAAA;EA8BM;EA5BrB,IAAA;EAqCW;EAnCX,OAAA,EAAS,MAAA;EAmCqB;EAjC9B,WAAA;EAec;EAbd,IAAA,GAAO,MAAM;AAAA;;;;KAMH,kBAAA,gBAAkC,eAAe;;;;UAK5C,uBAAA;EAoBe;EAlB9B,WAAA,GAAc,MAAA;EAwBC;EArBf,aAAA,GAAgB,kBAAA;;EAGhB,KAAA;EAmBA;EAhBA,QAAA,aAAqB,kBAAA;EAgBe;EAbpC,QAAA,GAAW,MAAA;EAagD;EAV3D,WAAA;EA6BQ;EA1BR,QAAA,GAAW,mBAAA;AAAA;;;;UAMI,kCAAA;EACf,QAAA,EAAU,uBAAA,GAA0B,uBAAuB;AAAA;;;;cAMhD,iBAAA;EAAA;;;;;;;;;;;;;cAmBA,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAoHA,gBAAA,EAAkB,MAAA,CAC7B,uBAAA,EACA,uBAAA;AAvDkB;AAqDpB;;;AArDoB,iBAsGJ,gCAAA,CACd,GAAA,EAAK,uBAAA,GAA0B,uBAAA,aAC9B,uBAAA,GAA0B,uBAAA;;;;;;;iBA4NpB,kBAAA,CACP,IAAA,EAAM,YAAA,EACN,QAAA,EAAU,mBAAA,GACT,YAAA;;AAhRsB;AA+CzB;;;;;;;;;;;iBAwQgB,uBAAA,CACd,MAAA,EAAQ,uBAAA,GAA0B,uBAAA,GACjC,mBAAA;;;;AAxQiD;AAsDnD;;;;;;;;cAkOY,2BAAA,YAAuC,aAAA;EAAA,iBACjC,gBAAA;EAAA,iBACA,QAAA;cAGf,gBAAA,EAAkB,aAAA,EAClB,OAAA,EAAS,kCAAA;EA/DV;;AAAY;EAyEb,OAAA,CAAQ,IAAA,EAAM,IAAA,EAAM,aAAA,EAAe,OAAA;EAlCE;;;EAyCrC,KAAA,CAAM,IAAA,EAAM,YAAA;EAWZ,UAAA,IAAc,OAAA;EAId,QAAA,IAAY,OAAA;AAAA"}