shield360 1.0.1 → 1.2.0

package/dist/otel/app-logs.js

@@ -0,0 +1,195 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_ATTRIBUTE_LENGTH = exports.MAX_BODY_LENGTH = exports.DEFAULT_MAX_PER_SECOND = exports.DEFAULT_LOGGER_NAME = exports.DEFAULT_LOG_LEVEL = void 0;
+exports.createLimiter = createLimiter;
+exports.isOwnScope = isOwnScope;
+exports.maskAttribute = maskAttribute;
+exports.resolveCaptureLogs = resolveCaptureLogs;
+exports.resolveLogLevel = resolveLogLevel;
+exports.enableAppLogs = enableAppLogs;
+exports.disableAppLogs = disableAppLogs;
+exports.appLogsEnabled = appLogsEnabled;
+exports.createLogger = createLogger;
+/**
+ * Application logs to Shield360, when asked for.
+ *
+ * Shield360 ingests OTLP logs on the same per-API-key route as traces. The
+ * logger here writes OpenTelemetry log records through the SDK's own
+ * LoggerProvider (otel/events.ts), so they go to the same destination with the
+ * same Authorization header as the spans, and carry the trace and span ids of
+ * whatever span is active when they are written.
+ *
+ * Nothing is sent unless it is turned on: `captureLogs: true` in init(), or
+ * SHIELD360_CAPTURE_LOGS=true. Until then every logger is a no-op, so a
+ * library can create one at import time without deciding for the application.
+ *
+ * Every record, from Shield360.logger() or a bridge (log-bridges.ts), passes
+ * the same checks as the Python SDK's handler: the level; never the SDK's own
+ * scopes (`shield360`, `opentelemetry`); at most `maxPerSecond` records a
+ * second per logger (500 by default); masking by the contract every SDK
+ * shares (sdk/rasp/README.md, "Masking"): credential pairs, bearer
+ * credentials and opaque tokens in the body and attributes, the whole value of
+ * an attribute named like a credential, lists and maps item by item, readable
+ * identifiers kept (not `code.*` or `exception.type`); the body and stack
+ * trace cut to 16,384 characters after masking, other strings to 4,096; and
+ * the application call site as `code.function.name`,
+ * `code.file.path` and `code.line.number` unless captureCodeLocation is off.
+ */
+const api_logs_1 = require("@opentelemetry/api-logs");
+const masking_1 = require("../masking");
+const code_location_1 = require("./code-location");
+const utils_1 = require("./utils");
+// The OpenTelemetry log data model's severity numbers and short names.
+const SEVERITY = {
+    debug: api_logs_1.SeverityNumber.DEBUG,
+    info: api_logs_1.SeverityNumber.INFO,
+    warn: api_logs_1.SeverityNumber.WARN,
+    error: api_logs_1.SeverityNumber.ERROR,
+    fatal: api_logs_1.SeverityNumber.FATAL,
+};
+const SEVERITY_TEXT = {
+    debug: 'DEBUG',
+    info: 'INFO',
+    warn: 'WARN',
+    error: 'ERROR',
+    fatal: 'FATAL',
+};
+const LEVEL_ALIASES = { warning: 'warn', critical: 'fatal' };
+exports.DEFAULT_LOG_LEVEL = 'info';
+exports.DEFAULT_LOGGER_NAME = 'app';
+exports.DEFAULT_MAX_PER_SECOND = 500;
+exports.MAX_BODY_LENGTH = 16384;
+exports.MAX_ATTRIBUTE_LENGTH = 4096;
+const OWN_SCOPES = ['shield360', 'opentelemetry', '@opentelemetry'];
+const LONG_ATTRIBUTES = new Set(['exception.stacktrace']);
+const UNMASKED_ATTRIBUTES = new Set(['exception.type']);
+const STACK_LIMIT = 64;
+let provider = null;
+let minSeverity = SEVERITY[exports.DEFAULT_LOG_LEVEL];
+let locator = null;
+/** A fixed-window limiter: true for at most `maxPerSecond` calls in each second. */
+function createLimiter(maxPerSecond = exports.DEFAULT_MAX_PER_SECOND, now = Date.now) {
+    let windowStart = 0;
+    let count = 0;
+    return () => {
+        const t = now();
+        if (t - windowStart >= 1000) {
+            windowStart = t;
+            count = 0;
+        }
+        count += 1;
+        return count <= maxPerSecond;
+    };
+}
+/** Whether a scope is the SDK's own (`shield360`, `opentelemetry`, or below them). */
+function isOwnScope(name) {
+    const lower = name.toLowerCase();
+    return OWN_SCOPES.some((own) => lower === own || lower.startsWith(own + '.') || lower.startsWith(own + '/'));
+}
+/**
+ * An attribute value as it may leave the process (sdk/rasp/README.md, Masking):
+ * the whole value under a credential name, strings masked then cut, lists and
+ * maps item by item; code.* and exception.type as they are.
+ */
+function maskAttribute(key, value) {
+    if (key.startsWith('code.') || UNMASKED_ATTRIBUTES.has(key))
+        return value;
+    return (0, masking_1.maskValue)(key, value, LONG_ATTRIBUTES.has(key) ? exports.MAX_BODY_LENGTH : exports.MAX_ATTRIBUTE_LENGTH);
+}
+function captureStack() {
+    const previous = Error.stackTraceLimit;
+    try {
+        Error.stackTraceLimit = STACK_LIMIT;
+        return new Error().stack;
+    }
+    finally {
+        Error.stackTraceLimit = previous;
+    }
+}
+/** The option, else SHIELD360_CAPTURE_LOGS, else off. */
+function resolveCaptureLogs(option) {
+    return option ?? (0, utils_1.parseBoolEnv)('SHIELD360_CAPTURE_LOGS') ?? false;
+}
+/** The option, else SHIELD360_LOG_LEVEL, else `info`. Unknown names fall back to `info`. */
+function resolveLogLevel(option) {
+    const raw = (option ?? process.env.SHIELD360_LOG_LEVEL ?? exports.DEFAULT_LOG_LEVEL).trim().toLowerCase();
+    const name = LEVEL_ALIASES[raw] ?? raw;
+    return name in SEVERITY ? name : exports.DEFAULT_LOG_LEVEL;
+}
+/** Start sending: records at `level` and above go through `logProvider`. */
+function enableAppLogs(logProvider, level = exports.DEFAULT_LOG_LEVEL, options = {}) {
+    provider = logProvider;
+    minSeverity = SEVERITY[level];
+    locator = options.captureCodeLocation === false ? null : new code_location_1.CodeLocationSpanProcessor({ codeRoot: options.codeRoot });
+}
+/** Stop sending; every logger goes back to a no-op. */
+function disableAppLogs() {
+    provider = null;
+    minSeverity = SEVERITY[exports.DEFAULT_LOG_LEVEL];
+    locator = null;
+}
+function appLogsEnabled() {
+    return provider !== null;
+}
+function emit(scope, level, allow, message, attributes) {
+    const current = provider;
+    if (!current || SEVERITY[level] < minSeverity || isOwnScope(scope))
+        return;
+    try {
+        if (!allow())
+            return;
+        const given = { ...(attributes ?? {}) };
+        let body;
+        if (message instanceof Error) {
+            body = message.message;
+            given['exception.type'] = message.name;
+            given['exception.message'] = message.message;
+            if (message.stack)
+                given['exception.stacktrace'] = message.stack;
+        }
+        else {
+            body = String(message);
+        }
+        const where = locator;
+        if (where && given[code_location_1.ATTR_CODE_FILE_PATH] === undefined) {
+            const frame = where.findApplicationFrame(captureStack());
+            if (frame) {
+                if (frame.functionName)
+                    given[code_location_1.ATTR_CODE_FUNCTION_NAME] = frame.functionName;
+                given[code_location_1.ATTR_CODE_FILE_PATH] = frame.filePath;
+                given[code_location_1.ATTR_CODE_LINE_NUMBER] = frame.lineNumber;
+            }
+        }
+        const attrs = {};
+        for (const [key, value] of Object.entries(given))
+            attrs[key] = maskAttribute(key, value);
+        // No context is passed: the logs SDK takes the active one, which links the
+        // record to the active span's trace and span ids.
+        current.getLogger(scope).emit({
+            severityNumber: SEVERITY[level],
+            severityText: SEVERITY_TEXT[level],
+            body: (0, masking_1.maskText)(body, exports.MAX_BODY_LENGTH),
+            attributes: attrs,
+        });
+    }
+    catch {
+        // Logging never throws into the application.
+    }
+}
+/**
+ * A logger whose records go to Shield360 when application logs are on
+ * (`captureLogs: true` or SHIELD360_CAPTURE_LOGS=true), and nowhere otherwise.
+ * `name` becomes the record's instrumentation scope; it defaults to `app`.
+ */
+function createLogger(name = exports.DEFAULT_LOGGER_NAME, options = {}) {
+    const scope = name || exports.DEFAULT_LOGGER_NAME;
+    const allow = createLimiter(options.maxPerSecond);
+    return {
+        debug: (message, attributes) => emit(scope, 'debug', allow, message, attributes),
+        info: (message, attributes) => emit(scope, 'info', allow, message, attributes),
+        warn: (message, attributes) => emit(scope, 'warn', allow, message, attributes),
+        error: (message, attributes) => emit(scope, 'error', allow, message, attributes),
+        fatal: (message, attributes) => emit(scope, 'fatal', allow, message, attributes),
+    };
+}
+//# sourceMappingURL=app-logs.js.map

package/dist/otel/app-logs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-logs.js","sourceRoot":"","sources":["../../src/otel/app-logs.ts"],"names":[],"mappings":";;;AAyFA,sCAYC;AAGD,gCAGC;AAOD,sCAGC;AAaD,gDAEC;AAGD,0CAIC;AAGD,sCAIC;AAGD,wCAIC;AAED,wCAEC;AA8CD,oCAUC;AArND;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,sDAAwE;AACxE,wCAAiD;AACjD,mDAAiI;AACjI,mCAAuC;AAgBvC,uEAAuE;AACvE,MAAM,QAAQ,GAAqC;IACjD,KAAK,EAAE,yBAAc,CAAC,KAAK;IAC3B,IAAI,EAAE,yBAAc,CAAC,IAAI;IACzB,IAAI,EAAE,yBAAc,CAAC,IAAI;IACzB,KAAK,EAAE,yBAAc,CAAC,KAAK;IAC3B,KAAK,EAAE,yBAAc,CAAC,KAAK;CAC5B,CAAC;AACF,MAAM,aAAa,GAA6B;IAC9C,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;CACf,CAAC;AACF,MAAM,aAAa,GAA6B,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAE1E,QAAA,iBAAiB,GAAa,MAAM,CAAC;AACrC,QAAA,mBAAmB,GAAG,KAAK,CAAC;AAC5B,QAAA,sBAAsB,GAAG,GAAG,CAAC;AAC7B,QAAA,eAAe,GAAG,KAAK,CAAC;AACxB,QAAA,oBAAoB,GAAG,IAAI,CAAC;AAEzC,MAAM,UAAU,GAAG,CAAC,WAAW,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC;AACpE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;AAC1D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;AACxD,MAAM,WAAW,GAAG,EAAE,CAAC;AAcvB,IAAI,QAAQ,GAAwB,IAAI,CAAC;AACzC,IAAI,WAAW,GAAmB,QAAQ,CAAC,yBAAiB,CAAC,CAAC;AAC9D,IAAI,OAAO,GAAqC,IAAI,CAAC;AAErD,oFAAoF;AACpF,SAAgB,aAAa,CAAC,YAAY,GAAG,8BAAsB,EAAE,MAAoB,IAAI,CAAC,GAAG;IAC/F,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,GAAG,EAAE;QACV,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC,GAAG,WAAW,IAAI,IAAI,EAAE,CAAC;YAC5B,WAAW,GAAG,CAAC,CAAC;YAChB,KAAK,GAAG,CAAC,CAAC;QACZ,CAAC;QACD,KAAK,IAAI,CAAC,CAAC;QACX,OAAO,KAAK,IAAI,YAAY,CAAC;IAC/B,CAAC,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAgB,UAAU,CAAC,IAAY;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC;AAC/G,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,GAAW,EAAE,KAAc;IACvD,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,OAAO,IAAA,mBAAS,EAAC,GAAG,EAAE,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,uBAAe,CAAC,CAAC,CAAC,4BAAoB,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,CAAC;IACvC,IAAI,CAAC;QACH,KAAK,CAAC,eAAe,GAAG,WAAW,CAAC;QACpC,OAAO,IAAI,KAAK,EAAE,CAAC,KAAK,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,eAAe,GAAG,QAAQ,CAAC;IACnC,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,SAAgB,kBAAkB,CAAC,MAAgB;IACjD,OAAO,MAAM,IAAI,IAAA,oBAAY,EAAC,wBAAwB,CAAC,IAAI,KAAK,CAAC;AACnE,CAAC;AAED,4FAA4F;AAC5F,SAAgB,eAAe,CAAC,MAAe;IAC7C,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,yBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClG,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;IACvC,OAAO,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAE,IAAiB,CAAC,CAAC,CAAC,yBAAiB,CAAC;AACnE,CAAC;AAED,4EAA4E;AAC5E,SAAgB,aAAa,CAAC,WAAyB,EAAE,QAAkB,yBAAiB,EAAE,UAA0B,EAAE;IACxH,QAAQ,GAAG,WAAW,CAAC;IACvB,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,GAAG,OAAO,CAAC,mBAAmB,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,yCAAyB,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;AACzH,CAAC;AAED,uDAAuD;AACvD,SAAgB,cAAc;IAC5B,QAAQ,GAAG,IAAI,CAAC;IAChB,WAAW,GAAG,QAAQ,CAAC,yBAAiB,CAAC,CAAC;IAC1C,OAAO,GAAG,IAAI,CAAC;AACjB,CAAC;AAED,SAAgB,cAAc;IAC5B,OAAO,QAAQ,KAAK,IAAI,CAAC;AAC3B,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,KAAe,EAAE,KAAoB,EAAE,OAAuB,EAAE,UAA0B;IACrH,MAAM,OAAO,GAAG,QAAQ,CAAC;IACzB,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,WAAW,IAAI,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO;IAC3E,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO;QACrB,MAAM,KAAK,GAAkB,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;QACvD,IAAI,IAAY,CAAC;QACjB,IAAI,OAAO,YAAY,KAAK,EAAE,CAAC;YAC7B,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;YACvB,KAAK,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;YACvC,KAAK,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;YAC7C,IAAI,OAAO,CAAC,KAAK;gBAAE,KAAK,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC;QACtB,IAAI,KAAK,IAAI,KAAK,CAAC,mCAAmB,CAAC,KAAK,SAAS,EAAE,CAAC;YACtD,MAAM,KAAK,GAAG,KAAK,CAAC,oBAAoB,CAAC,YAAY,EAAE,CAAC,CAAC;YACzD,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,KAAK,CAAC,YAAY;oBAAE,KAAK,CAAC,uCAAuB,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;gBAC5E,KAAK,CAAC,mCAAmB,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;gBAC5C,KAAK,CAAC,qCAAqB,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;YAClD,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAkB,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,GAAG,EAAE,KAAK,CAA0B,CAAC;QAClH,2EAA2E;QAC3E,kDAAkD;QAClD,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;YAC5B,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC;YAC/B,YAAY,EAAE,aAAa,CAAC,KAAK,CAAC;YAClC,IAAI,EAAE,IAAA,kBAAQ,EAAC,IAAI,EAAE,uBAAe,CAAC;YACrC,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,OAAe,2BAAmB,EAAE,UAAyB,EAAE;IAC1F,MAAM,KAAK,GAAG,IAAI,IAAI,2BAAmB,CAAC;IAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO;QACL,KAAK,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC;QAChF,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC;QAC9E,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC;QAC9E,KAAK,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC;QAChF,KAAK,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC;KACjF,CAAC;AACJ,CAAC"}

package/dist/otel/build-info.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Build and VCS resource attributes (service.version, vcs.*), resolved once
+ * at init. Per attribute, the first valid value wins from: explicit config
+ * (init option, SHIELD360_* env — SHIELD360_SERVICE_VERSION, then its alias
+ * SHIELD360_RELEASE, for service.version), OTel env (OTEL_SERVICE_VERSION,
+ * OTEL_RESOURCE_ATTRIBUTES), then CI/platform env. CI values come from a
+ * single provider and are never mixed across providers.
+ * Values are never logged.
+ */
+export declare const ATTR_SERVICE_VERSION = "service.version";
+export declare const ATTR_VCS_REVISION = "vcs.ref.head.revision";
+export declare const ATTR_VCS_REPOSITORY_URL = "vcs.repository.url.full";
+export declare const ATTR_VCS_REF_NAME = "vcs.ref.head.name";
+type Env = Record<string, string | undefined>;
+export declare function sanitiseRevision(value: string | undefined): string | undefined;
+export declare function sanitiseText(value: string | undefined): string | undefined;
+/** Normalise to https://host/owner/repo (http stays http), with credentials removed. */
+export declare function sanitiseRepositoryUrl(value: string | undefined): string | undefined;
+export declare function parseOtelResourceAttributes(value: string | undefined): Record<string, string>;
+export declare function resolveBuildAttributes(options?: {
+    serviceVersion?: string;
+}, env?: Env): Record<string, string>;
+export {};

package/dist/otel/build-info.js

@@ -0,0 +1,176 @@
+"use strict";
+/**
+ * Build and VCS resource attributes (service.version, vcs.*), resolved once
+ * at init. Per attribute, the first valid value wins from: explicit config
+ * (init option, SHIELD360_* env — SHIELD360_SERVICE_VERSION, then its alias
+ * SHIELD360_RELEASE, for service.version), OTel env (OTEL_SERVICE_VERSION,
+ * OTEL_RESOURCE_ATTRIBUTES), then CI/platform env. CI values come from a
+ * single provider and are never mixed across providers.
+ * Values are never logged.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ATTR_VCS_REF_NAME = exports.ATTR_VCS_REPOSITORY_URL = exports.ATTR_VCS_REVISION = exports.ATTR_SERVICE_VERSION = void 0;
+exports.sanitiseRevision = sanitiseRevision;
+exports.sanitiseText = sanitiseText;
+exports.sanitiseRepositoryUrl = sanitiseRepositoryUrl;
+exports.parseOtelResourceAttributes = parseOtelResourceAttributes;
+exports.resolveBuildAttributes = resolveBuildAttributes;
+exports.ATTR_SERVICE_VERSION = 'service.version';
+exports.ATTR_VCS_REVISION = 'vcs.ref.head.revision';
+exports.ATTR_VCS_REPOSITORY_URL = 'vcs.repository.url.full';
+exports.ATTR_VCS_REF_NAME = 'vcs.ref.head.name';
+const MAX_TEXT = 256;
+const HOST_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/i;
+function sanitiseRevision(value) {
+    const v = value?.trim();
+    return v && /^[0-9a-fA-F]{7,64}$/.test(v) ? v.toLowerCase() : undefined;
+}
+function sanitiseText(value) {
+    // eslint-disable-next-line no-control-regex
+    const v = value?.replace(/[\u0000-\u001f\u007f-\u009f]/g, '').trim().slice(0, MAX_TEXT);
+    return v || undefined;
+}
+/** Normalise to https://host/owner/repo (http stays http), with credentials removed. */
+function sanitiseRepositoryUrl(value) {
+    const v = value?.trim();
+    if (!v)
+        return undefined;
+    let scheme = 'https';
+    let hostname;
+    let port = '';
+    let path;
+    const scp = /^[^@/\s]+@([^:/\s]+):(?!\/)([^?#]+)/.exec(v);
+    if (scp) {
+        [, hostname, path] = scp;
+    }
+    else {
+        let url;
+        try {
+            url = new URL(v);
+        }
+        catch {
+            return undefined;
+        }
+        const protocol = url.protocol.slice(0, -1);
+        if (!['https', 'http', 'ssh', 'git'].includes(protocol))
+            return undefined;
+        if (protocol === 'http')
+            scheme = 'http';
+        // The port is kept for web URLs and dropped for ssh/git transports.
+        if (protocol === 'https' || protocol === 'http')
+            port = url.port;
+        hostname = url.hostname;
+        path = url.pathname;
+    }
+    if (!HOST_RE.test(hostname))
+        return undefined;
+    path = path.replace(/^\/+|\/+$/g, '').replace(/\.git$/, '').replace(/\/+$/, '');
+    if (!path)
+        return undefined;
+    return `${scheme}://${hostname.toLowerCase()}${port ? `:${port}` : ''}/${path}`;
+}
+function strip(prefix, value) {
+    return value?.startsWith(prefix) ? value.slice(prefix.length) : value;
+}
+const VERCEL_HOSTS = {
+    github: 'github.com',
+    gitlab: 'gitlab.com',
+    bitbucket: 'bitbucket.org',
+};
+/** CI providers in priority order; repo and ref come only from the chosen one. */
+const CI_PROVIDERS = [
+    (e) => ({
+        revision: e.GITHUB_SHA,
+        repo: e.GITHUB_REPOSITORY
+            ? `${e.GITHUB_SERVER_URL || 'https://github.com'}/${e.GITHUB_REPOSITORY}`
+            : undefined,
+        ref: e.GITHUB_HEAD_REF || e.GITHUB_REF_NAME,
+    }),
+    (e) => ({ revision: e.CI_COMMIT_SHA, repo: e.CI_PROJECT_URL, ref: e.CI_COMMIT_REF_NAME }),
+    (e) => {
+        const host = VERCEL_HOSTS[(e.VERCEL_GIT_PROVIDER || '').toLowerCase()];
+        const owner = e.VERCEL_GIT_REPO_OWNER;
+        const slug = e.VERCEL_GIT_REPO_SLUG;
+        return {
+            revision: e.VERCEL_GIT_COMMIT_SHA,
+            repo: host && owner && slug ? `https://${host}/${owner}/${slug}` : undefined,
+            ref: e.VERCEL_GIT_COMMIT_REF,
+        };
+    },
+    (e) => ({ revision: e.COMMIT_REF, repo: e.REPOSITORY_URL, ref: e.BRANCH }),
+    (e) => ({ revision: e.RENDER_GIT_COMMIT, ref: e.RENDER_GIT_BRANCH }),
+    (e) => ({
+        revision: e.RAILWAY_GIT_COMMIT_SHA,
+        repo: e.RAILWAY_GIT_REPO_OWNER && e.RAILWAY_GIT_REPO_NAME
+            ? `https://github.com/${e.RAILWAY_GIT_REPO_OWNER}/${e.RAILWAY_GIT_REPO_NAME}`
+            : undefined,
+        ref: e.RAILWAY_GIT_BRANCH,
+    }),
+    (e) => ({ revision: e.HEROKU_SLUG_COMMIT || e.SOURCE_VERSION }),
+    (e) => ({
+        revision: e.CODEBUILD_RESOLVED_SOURCE_VERSION,
+        repo: e.CODEBUILD_SOURCE_REPO_URL,
+        ref: strip('refs/heads/', e.CODEBUILD_WEBHOOK_HEAD_REF),
+    }),
+    (e) => ({ revision: e.BUILDKITE_COMMIT, repo: e.BUILDKITE_REPO, ref: e.BUILDKITE_BRANCH }),
+    (e) => ({ revision: e.CIRCLE_SHA1, repo: e.CIRCLE_REPOSITORY_URL, ref: e.CIRCLE_BRANCH }),
+    (e) => ({
+        revision: e.BITBUCKET_COMMIT,
+        repo: e.BITBUCKET_GIT_HTTP_ORIGIN,
+        ref: e.BITBUCKET_BRANCH,
+    }),
+    (e) => ({
+        revision: e.BUILD_SOURCEVERSION,
+        repo: e.BUILD_REPOSITORY_URI,
+        ref: e.BUILD_SOURCEBRANCHNAME,
+    }),
+    (e) => ({ revision: e.GIT_COMMIT, repo: e.GIT_URL, ref: strip('origin/', e.GIT_BRANCH) }),
+];
+function ciCandidates(env) {
+    for (const provider of CI_PROVIDERS) {
+        const c = provider(env);
+        if (c.revision)
+            return c;
+    }
+    return {};
+}
+function parseOtelResourceAttributes(value) {
+    const attrs = {};
+    for (const item of (value || '').split(',')) {
+        const eq = item.indexOf('=');
+        if (eq <= 0)
+            continue;
+        try {
+            attrs[item.slice(0, eq).trim()] = decodeURIComponent(item.slice(eq + 1).trim());
+        }
+        catch {
+            // Skip values that are not valid percent-encoding.
+        }
+    }
+    return attrs;
+}
+function firstValid(sanitise, ...values) {
+    for (const value of values) {
+        const v = sanitise(value);
+        if (v)
+            return v;
+    }
+    return undefined;
+}
+function resolveBuildAttributes(options = {}, env = process.env) {
+    const ci = ciCandidates(env);
+    const otel = parseOtelResourceAttributes(env.OTEL_RESOURCE_ATTRIBUTES);
+    const resolved = {
+        [exports.ATTR_SERVICE_VERSION]: firstValid(sanitiseText, options.serviceVersion, env.SHIELD360_SERVICE_VERSION, env.SHIELD360_RELEASE, env.OTEL_SERVICE_VERSION, otel[exports.ATTR_SERVICE_VERSION]),
+        [exports.ATTR_VCS_REVISION]: firstValid(sanitiseRevision, env.SHIELD360_GIT_COMMIT, otel[exports.ATTR_VCS_REVISION], ci.revision),
+        [exports.ATTR_VCS_REPOSITORY_URL]: firstValid(sanitiseRepositoryUrl, env.SHIELD360_GIT_REPOSITORY_URL, otel[exports.ATTR_VCS_REPOSITORY_URL], ci.repo),
+        [exports.ATTR_VCS_REF_NAME]: firstValid(sanitiseText, env.SHIELD360_GIT_BRANCH, otel[exports.ATTR_VCS_REF_NAME], ci.ref),
+    };
+    const attrs = {};
+    for (const [key, value] of Object.entries(resolved)) {
+        if (value)
+            attrs[key] = value;
+    }
+    return attrs;
+}
+//# sourceMappingURL=build-info.js.map

package/dist/otel/build-info.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-info.js","sourceRoot":"","sources":["../../src/otel/build-info.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAoBH,4CAGC;AAED,oCAIC;AAGD,sDA6BC;AAuED,kEAYC;AAUD,wDAuCC;AA/LY,QAAA,oBAAoB,GAAG,iBAAiB,CAAC;AACzC,QAAA,iBAAiB,GAAG,uBAAuB,CAAC;AAC5C,QAAA,uBAAuB,GAAG,yBAAyB,CAAC;AACpD,QAAA,iBAAiB,GAAG,mBAAmB,CAAC;AAYrD,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,OAAO,GAAG,oEAAoE,CAAC;AAErF,SAAgB,gBAAgB,CAAC,KAAyB;IACxD,MAAM,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACxB,OAAO,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAED,SAAgB,YAAY,CAAC,KAAyB;IACpD,4CAA4C;IAC5C,MAAM,CAAC,GAAG,KAAK,EAAE,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACxF,OAAO,CAAC,IAAI,SAAS,CAAC;AACxB,CAAC;AAED,wFAAwF;AACxF,SAAgB,qBAAqB,CAAC,KAAyB;IAC7D,MAAM,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACxB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,MAAM,GAAG,OAAO,CAAC;IACrB,IAAI,QAAgB,CAAC;IACrB,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,IAAY,CAAC;IACjB,MAAM,GAAG,GAAG,qCAAqC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,GAAG,EAAE,CAAC;QACR,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1E,IAAI,QAAQ,KAAK,MAAM;YAAE,MAAM,GAAG,MAAM,CAAC;QACzC,oEAAoE;QACpE,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,MAAM;YAAE,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACjE,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QACxB,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChF,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,OAAO,GAAG,MAAM,MAAM,QAAQ,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;AAClF,CAAC;AAED,SAAS,KAAK,CAAC,MAAc,EAAE,KAAyB;IACtD,OAAO,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACxE,CAAC;AAED,MAAM,YAAY,GAA2B;IAC3C,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,eAAe;CAC3B,CAAC;AAEF,kFAAkF;AAClF,MAAM,YAAY,GAAoC;IACpD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACN,QAAQ,EAAE,CAAC,CAAC,UAAU;QACtB,IAAI,EAAE,CAAC,CAAC,iBAAiB;YACvB,CAAC,CAAC,GAAG,CAAC,CAAC,iBAAiB,IAAI,oBAAoB,IAAI,CAAC,CAAC,iBAAiB,EAAE;YACzE,CAAC,CAAC,SAAS;QACb,GAAG,EAAE,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,eAAe;KAC5C,CAAC;IACF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,kBAAkB,EAAE,CAAC;IACzF,CAAC,CAAC,EAAE,EAAE;QACJ,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,CAAC,CAAC,qBAAqB,CAAC;QACtC,MAAM,IAAI,GAAG,CAAC,CAAC,oBAAoB,CAAC;QACpC,OAAO;YACL,QAAQ,EAAE,CAAC,CAAC,qBAAqB;YACjC,IAAI,EAAE,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;YAC5E,GAAG,EAAE,CAAC,CAAC,qBAAqB;SAC7B,CAAC;IACJ,CAAC;IACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC;IACpE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACN,QAAQ,EAAE,CAAC,CAAC,sBAAsB;QAClC,IAAI,EACF,CAAC,CAAC,sBAAsB,IAAI,CAAC,CAAC,qBAAqB;YACjD,CAAC,CAAC,sBAAsB,CAAC,CAAC,sBAAsB,IAAI,CAAC,CAAC,qBAAqB,EAAE;YAC7E,CAAC,CAAC,SAAS;QACf,GAAG,EAAE,CAAC,CAAC,kBAAkB;KAC1B,CAAC;IACF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,kBAAkB,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;IAC/D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACN,QAAQ,EAAE,CAAC,CAAC,iCAAiC;QAC7C,IAAI,EAAE,CAAC,CAAC,yBAAyB;QACjC,GAAG,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,0BAA0B,CAAC;KACxD,CAAC;IACF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAC1F,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;IACzF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACN,QAAQ,EAAE,CAAC,CAAC,gBAAgB;QAC5B,IAAI,EAAE,CAAC,CAAC,yBAAyB;QACjC,GAAG,EAAE,CAAC,CAAC,gBAAgB;KACxB,CAAC;IACF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACN,QAAQ,EAAE,CAAC,CAAC,mBAAmB;QAC/B,IAAI,EAAE,CAAC,CAAC,oBAAoB;QAC5B,GAAG,EAAE,CAAC,CAAC,sBAAsB;KAC9B,CAAC;IACF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;CAC1F,CAAC;AAEF,SAAS,YAAY,CAAC,GAAQ;IAC5B,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAgB,2BAA2B,CAAC,KAAyB;IACnE,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACtB,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;QACrD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,QAAmB,EAAE,GAAG,MAAiC;IAC3E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAgB,sBAAsB,CACpC,UAAuC,EAAE,EACzC,MAAW,OAAO,CAAC,GAAG;IAEtB,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,2BAA2B,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAuC;QACnD,CAAC,4BAAoB,CAAC,EAAE,UAAU,CAChC,YAAY,EACZ,OAAO,CAAC,cAAc,EACtB,GAAG,CAAC,yBAAyB,EAC7B,GAAG,CAAC,iBAAiB,EACrB,GAAG,CAAC,oBAAoB,EACxB,IAAI,CAAC,4BAAoB,CAAC,CAC3B;QACD,CAAC,yBAAiB,CAAC,EAAE,UAAU,CAC7B,gBAAgB,EAChB,GAAG,CAAC,oBAAoB,EACxB,IAAI,CAAC,yBAAiB,CAAC,EACvB,EAAE,CAAC,QAAQ,CACZ;QACD,CAAC,+BAAuB,CAAC,EAAE,UAAU,CACnC,qBAAqB,EACrB,GAAG,CAAC,4BAA4B,EAChC,IAAI,CAAC,+BAAuB,CAAC,EAC7B,EAAE,CAAC,IAAI,CACR;QACD,CAAC,yBAAiB,CAAC,EAAE,UAAU,CAC7B,YAAY,EACZ,GAAG,CAAC,oBAAoB,EACxB,IAAI,CAAC,yBAAiB,CAAC,EACvB,EAAE,CAAC,GAAG,CACP;KACF,CAAC;IACF,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAChC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/otel/code-location.d.ts

@@ -0,0 +1,49 @@
+import type { Context } from '@opentelemetry/api';
+import type { ReadableSpan, Span, SpanProcessor } from '@opentelemetry/sdk-trace-node';
+export declare const ATTR_CODE_FUNCTION_NAME = "code.function.name";
+export declare const ATTR_CODE_FILE_PATH = "code.file.path";
+export declare const ATTR_CODE_LINE_NUMBER = "code.line.number";
+export interface CodeLocationOptions {
+    codeRoot?: string;
+    cwd?: string;
+    home?: string;
+}
+interface Frame {
+    functionName?: string;
+    filePath: string;
+    lineNumber: number;
+}
+/** captureCodeLocation option wins; otherwise SHIELD360_CAPTURE_CODE_LOCATION; default on. */
+export declare function resolveCaptureCodeLocation(option?: boolean): boolean;
+/**
+ * Drops the first home directory or CI workspace prefix of an absolute path:
+ * the last resort for a path under no code root, repository, working directory
+ * or the current user's home. Other absolute paths (/srv/app/...) are kept.
+ */
+export declare function anonymiseAbsolutePath(path: string): string;
+export declare class PathNormaliser {
+    private readonly codeRoot?;
+    private readonly cwd;
+    private readonly home;
+    private readonly gitDirs;
+    constructor(options?: CodeLocationOptions);
+    /** Repo-relative path for a stack-frame file (path or file:// URL). */
+    normalise(file: string): string;
+    /** Nearest ancestor containing .git; each directory is probed at most once. */
+    private gitRoot;
+}
+export declare class CodeLocationSpanProcessor implements SpanProcessor {
+    private readonly normaliser;
+    private readonly cache;
+    constructor(options?: CodeLocationOptions);
+    onStart(span: Span, _parentContext: Context): void;
+    /** Visible for tests: number of cached frame lines. */
+    get cacheSize(): number;
+    /** First application frame in a V8 stack string. */
+    findApplicationFrame(stack: string | undefined): Frame | undefined;
+    private parseLine;
+    onEnd(_span: ReadableSpan): void;
+    forceFlush(): Promise<void>;
+    shutdown(): Promise<void>;
+}
+export {};