Add packaged DLP broker and protected Windows service foundation

tests/broker-diagnostics.test.mjs

@@ -0,0 +1,61 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createRequire} from 'node:module';
+import {createServer} from 'node:http';
+import {DiagnosticsSchema} from '../packages/core/diagnostics.mjs';
+const require=createRequire(import.meta.url);
+const {createDiagnostics}=require('../apps/browser/diagnostics.cjs');
+const {createBrokerDiagnostics}=require('../apps/network-broker/diagnostics-adapter.cjs');
+async function fixture(t){
+  const payloads=[];
+  const server=createServer((request,response)=>{
+    const chunks=[];let bytes=0;
+    request.on('data',chunk=>{bytes+=chunk.length;if(bytes>1048576){request.destroy();return;}chunks.push(chunk);});
+    request.on('end',()=>{payloads.push(JSON.parse(Buffer.concat(chunks).toString()));response.setHeader('content-type','application/json');response.end('{}');});
+  }).listen(0,'127.0.0.1');
+  await new Promise(resolve=>server.once('listening',resolve));
+  const diagnostics=createDiagnostics();
+  diagnostics.configure(DiagnosticsSchema.parse({enabled:true,mode:'debug',endpoint:`http://127.0.0.1:${server.address().port}`,sampleRate:1,debugSampleRate:1,flushIntervalMs:10000}));
+  t.after(async()=>{await diagnostics.shutdown();server.closeAllConnections();await new Promise(resolve=>server.close(resolve));});
+  return {diagnostics,adapter:createBrokerDiagnostics(diagnostics),payloads,spans:()=>payloads.flatMap(p=>p.resourceSpans||[]).flatMap(p=>p.scopeSpans||[]).flatMap(p=>p.spans||[])};
+}
+test('broker stages export actual correlated OTLP timing without payloads or authority',async t=>{
+  const f=await fixture(t),secret='PRIVATE_BROKER_SECRET',attributes={bytes:12,policyVersion:4,url:'http://private-company.test/',authority:secret,token:secret,content:secret};
+  await f.adapter.wrap('request',async()=>{
+    for(const stage of ['framing','buffer','inspect','authorize','forward'])assert.equal(await f.adapter.wrap(stage,async()=>17,attributes),17);
+  });
+  await f.diagnostics.flush();
+  const spans=f.spans();assert.equal(spans.length,6);
+  const operations=spans.map(span=>span.attributes.find(attribute=>attribute.key==='safetynet.operation')?.value.stringValue).sort();
+  assert.deepEqual(operations,['broker.authorize','broker.buffer','broker.forward','broker.framing','broker.inspect','broker.request'].sort());
+  const parent=spans.find(span=>!span.parentSpanId);assert.ok(parent);
+  for(const child of spans.filter(span=>span!==parent)){
+    assert.equal(child.parentSpanId,parent.spanId);assert.equal(child.traceId,parent.traceId);
+    assert.ok(BigInt(child.endTimeUnixNano)>=BigInt(child.startTimeUnixNano));
+    assert.ok(child.attributes.some(attribute=>attribute.key==='safetynet.duration.ms'));
+  }
+  const text=JSON.stringify(f.payloads);assert.equal(text.includes(secret),false);assert.equal(text.includes('private-company'),false);
+  assert.equal(f.diagnostics.status().lifetimeFailedExports,0);
+});
+test('disabled diagnostics preserve the exact enforcement failure with no exports',async t=>{
+  const f=await fixture(t);f.diagnostics.configure({enabled:false});
+  const failure=new Error('PRIVATE_ENFORCEMENT_FAILURE');
+  await assert.rejects(f.adapter.wrap('inspect',async()=>{throw failure;}),error=>error===failure);
+  assert.equal(await f.adapter.wrap('forward',async()=>23),23);
+  await f.diagnostics.flush();assert.equal(f.spans().length,0);
+});
+test('enabled failure tracing preserves error identity without exporting error text',async t=>{
+  const f=await fixture(t),failure=new Error('PRIVATE_ERROR_DETAIL');
+  await assert.rejects(f.adapter.wrap('inspect',async()=>{throw failure;}),error=>error===failure);
+  await f.diagnostics.flush();assert.equal(f.spans().length,1);
+  assert.equal(JSON.stringify(f.payloads).includes('PRIVATE_ERROR_DETAIL'),false);
+  assert.equal(f.spans()[0].status.code,2);
+});
+test('adapter rejects unknown stages and never reads telemetry accessors',()=>{
+  let touched=false,seen;
+  const adapter=createBrokerDiagnostics({span:(_name,attributes,fn)=>{seen=attributes;return fn();}});
+  const attributes={get bytes(){touched=true;throw Error('private');},count:2,url:'private',operation:'private'};
+  assert.equal(adapter.wrap('buffer',()=>true,attributes),true);
+  assert.equal(touched,false);assert.deepEqual(seen,{operation:'broker.buffer',count:2});
+  assert.throws(()=>adapter.wrap('private',()=>true),{message:'broker_diagnostics_stage_invalid'});
+});