Add packaged DLP broker and protected Windows service foundation

apps/network-broker/diagnostics-adapter.cjs

@@ -0,0 +1,28 @@
+'use strict';
+// Trusted caller supplies its already policy-authorized diagnostics instance.
+// This adapter neither creates an exporter nor configures/enables diagnostics.
+const stages=Object.freeze({
+  request:['browser.network','broker.request'],
+  framing:['browser.request','broker.framing'],
+  buffer:['browser.request','broker.buffer'],
+  inspect:['browser.request','broker.inspect'],
+  authorize:['browser.network','broker.authorize'],
+  forward:['browser.network','broker.forward']
+});
+function createBrokerDiagnostics(diagnostics){
+  if(!diagnostics||typeof diagnostics.span!=='function')throw new TypeError('broker_diagnostics_invalid');
+  const span=diagnostics.span.bind(diagnostics);
+  return Object.freeze({
+    wrap(stage,fn,input={}){
+      if(!Object.hasOwn(stages,stage)||typeof fn!=='function')throw new TypeError('broker_diagnostics_stage_invalid');
+      const [name,operation]=stages[stage],attributes={operation};
+      // Data descriptors only: never evaluate untrusted telemetry getters.
+      if(input&&typeof input==='object')for(const key of ['bytes','count','policyVersion']){
+        const descriptor=Object.getOwnPropertyDescriptor(input,key);
+        if(descriptor&&'value'in descriptor&&Number.isSafeInteger(descriptor.value)&&descriptor.value>=0)attributes[key]=descriptor.value;
+      }
+      return span(name,attributes,fn);
+    }
+  });
+}
+module.exports={createBrokerDiagnostics};