Implement managed browser security, individual agents and observability

packages/core/request-transfer-facts.cjs

@@ -0,0 +1,21 @@
+'use strict';
+const {z}=require('zod');
+const {FileFactsSchema}=require('./transfer-facts.cjs');
+// Network bodies are not independently identified files: they may contain passwords,
+// OAuth tokens, multipart form secrets or binary credential envelopes. No digest field.
+const RequestFactsSchema=z.object({bytes:FileFactsSchema.shape.bytes,detectedType:FileFactsSchema.shape.detectedType}).strict();
+function requestTransferFacts(value){return value?RequestFactsSchema.parse(value):undefined;}
+function requestFactsForTransfer(transfer){return RequestFactsSchema.parse({bytes:transfer.size,detectedType:transfer.detectedType});}
+function migrateQueuedRequestFacts(queue){
+ if(!Array.isArray(queue))throw Error('Invalid security event queue');
+ return queue.map(event=>{
+  if(!event||!['upload.authorized','upload.block'].includes(event.kind))return event;
+  const {file,request,...rest}=event;
+  // Preserve delivery identity and decision, but discard old generic-body digest.
+  // Invalid legacy facts do not become a new loosely typed logging channel.
+  const candidate=request||file;
+  const parsed=RequestFactsSchema.safeParse(candidate?{bytes:candidate.bytes,detectedType:candidate.detectedType}:undefined);
+  return {...rest,...(parsed.success?{request:parsed.data}:{})};
+ });
+}
+module.exports={RequestFactsSchema,requestTransferFacts,requestFactsForTransfer,migrateQueuedRequestFacts};