@agentsbloom/sdk 0.2.0 → 0.5.0

package/telemetry.js

@@ -1,50 +1,77 @@
-/**
- * OTLP trace exporter initialization for the AgentsBloom SDK.
- *
- * The OpenTelemetry SDK packages required to actually export spans
- * (@opentelemetry/sdk-trace-node, sdk-trace-base, exporter-trace-otlp-http,
- * resources, semantic-conventions) are loaded via dynamic import() so that
- * a merchant application that never calls setupTelemetry() is never forced
- * to install them. They are declared as optionalDependencies in
- * package.json rather than dependencies.
- */
-
-/**
- * Initialize an OTLP trace exporter/provider pair.
- *
- * @param {Object} options
- * @param {string} options.otlpEndpoint - OTLP collector base URL (traces are posted to `${otlpEndpoint}/v1/traces`)
- * @param {string} options.serviceName - Service name attached as the resource's service.name attribute
- * @param {number} options.samplingRatio - Trace sampling ratio 0.0-1.0 (currently informational; not yet wired into a sampler)
- * @param {string} options.apiKey - API key sent as a Bearer token in the exporter's Authorization header
- * @returns {Promise<{ provider: import('@opentelemetry/sdk-trace-node').NodeTracerProvider, exporter: import('@opentelemetry/exporter-trace-otlp-http').OTLPTraceExporter } | null>}
- *   The initialized provider/exporter handle, or null if the optional OTel SDK packages are unavailable.
- */
-let optionalDependencyWarningLogged = false;
-
-export async function initExporter({ otlpEndpoint, serviceName, samplingRatio, apiKey } = {}) {
-  try {
-    const { NodeTracerProvider } = await import('@opentelemetry/sdk-trace-node');
-    const { BatchSpanProcessor } = await import('@opentelemetry/sdk-trace-base');
-    const { OTLPTraceExporter } = await import('@opentelemetry/exporter-trace-otlp-http');
-    const { Resource } = await import('@opentelemetry/resources');
-    const { SemanticResourceAttributes } = await import('@opentelemetry/semantic-conventions');
-
-    const exporter = new OTLPTraceExporter({
-      url: `${otlpEndpoint}/v1/traces`,
-      headers: { Authorization: `Bearer ${apiKey}` },
-    });
-    const provider = new NodeTracerProvider({
-      resource: new Resource({ [SemanticResourceAttributes.SERVICE_NAME]: serviceName }),
-    });
-    provider.addSpanProcessor(new BatchSpanProcessor(exporter));
-    provider.register();
-    return { provider, exporter };
-  } catch {
-    if (!optionalDependencyWarningLogged) {
-      optionalDependencyWarningLogged = true;
-      console.warn('🌸 AgentsBloom: OTel SDK packages unavailable, continuing without export.');
-    }
-    return null;
-  }
-}
+/**
+ * OTLP trace exporter initialization for the AgentsBloom SDK.
+ *
+ * The OpenTelemetry SDK packages required to actually export spans
+ * (@opentelemetry/sdk-trace-node, sdk-trace-base, exporter-trace-otlp-http,
+ * resources, semantic-conventions) are loaded via dynamic import() so that
+ * a merchant application that never calls setupTelemetry() is never forced
+ * to install them. They are declared as optionalDependencies in
+ * package.json rather than dependencies.
+ *
+ * Dependency-audit note (2026-08): upgraded to the OpenTelemetry JS 2.x line
+ * (sdk-trace-*@2.10, resources@2.10, exporter-trace-otlp-http@0.221) which
+ * fixes GHSA-8988-4f7v-96qf and friends. The 2.x API differences this file
+ * absorbs:
+ *   - `Resource` class is gone -> `resourceFromAttributes()`
+ *   - `SemanticResourceAttributes.SERVICE_NAME` is gone ->
+ *       `ATTR_SERVICE_NAME` from @opentelemetry/semantic-conventions
+ *   - `provider.register()` no longer accepts a global logger/meter; plain
+ *     registration is still supported.
+ */
+
+let optionalDependencyWarningLogged = false;
+
+export async function initExporter({ otlpEndpoint, serviceName, samplingRatio, apiKey } = {}) {
+  try {
+    const { NodeTracerProvider } = await import('@opentelemetry/sdk-trace-node');
+    const { BatchSpanProcessor } = await import('@opentelemetry/sdk-trace-base');
+    const { OTLPTraceExporter } = await import('@opentelemetry/exporter-trace-otlp-http');
+    const { resourceFromAttributes } = await import('@opentelemetry/resources');
+    let serviceNameKey;
+    try {
+      ({ ATTR_SERVICE_NAME: serviceNameKey } = await import('@opentelemetry/semantic-conventions'));
+    } catch {
+      // Very new/old semantic-conventions layouts fall back to the literal.
+      serviceNameKey = 'service.name';
+    }
+
+    const exporter = new OTLPTraceExporter({
+      url: `${otlpEndpoint}/v1/traces`,
+      // Only send an Authorization header when there is actually a credential;
+      // `Bearer ` with an empty value is a malformed header, not "no auth".
+      ...(apiKey ? { headers: { Authorization: `Bearer ${apiKey}` } } : {}),
+    });
+
+    // `samplingRatio` was accepted, logged as "sampling: N%", and then never
+    // used — every deployment exported 100% of spans regardless of the value,
+    // which is a cost and a data-volume surprise rather than a security bug,
+    // but it made the option a lie. Wire it up for real.
+    const ratio = Number.isFinite(samplingRatio) ? Math.min(1, Math.max(0, samplingRatio)) : 1;
+    let sampler;
+    if (ratio < 1) {
+      try {
+        const { TraceIdRatioBasedSampler, ParentBasedSampler } = await import('@opentelemetry/sdk-trace-base');
+        // Parent-based so a sampled distributed trace stays intact end to end.
+        sampler = new ParentBasedSampler({ root: new TraceIdRatioBasedSampler(ratio) });
+      } catch {
+        sampler = undefined;
+      }
+    }
+
+    // 2.x: span processors are passed at construction via `spanProcessors`
+    // (addSpanProcessor was removed from the public provider API).
+    const provider = new NodeTracerProvider({
+      resource: resourceFromAttributes({ [serviceNameKey || 'service.name']: serviceName }),
+      spanProcessors: [new BatchSpanProcessor(exporter)],
+      ...(sampler ? { sampler } : {}),
+    });
+    provider.register();
+    return { provider, exporter };
+  } catch (err) {
+    if (!optionalDependencyWarningLogged) {
+      optionalDependencyWarningLogged = true;
+      console.warn(`🌸 AgentsBloom: OTel SDK packages unavailable, continuing without export. (${err?.message || 'unknown reason'})`);
+    }
+    return null;
+  }
+}

package/assets/logo-mark.svg

@@ -1,25 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64" role="img" aria-labelledby="agentsbloom-title">
-  <title id="agentsbloom-title">AgentsBloom</title>
-  <style>
-    @media (prefers-color-scheme: dark) {
-      .s1 { stop-color: #4A90F7; }
-      .s2 { stop-color: #4EE2F8; }
-      .s3 { stop-color: #C3AFFF; }
-    }
-  </style>
-  <defs>
-    <linearGradient id="lotus-gradient" x1="0" y1="0" x2="1" y2="1">
-      <stop class="s1" offset="0%" stop-color="#1A73E8" />
-      <stop class="s2" offset="50%" stop-color="#22D3EE" />
-      <stop class="s3" offset="100%" stop-color="#A78BFA" />
-    </linearGradient>
-  </defs>
-  <g fill="url(#lotus-gradient)">
-    <path d="M32 52c1.6 2 2.7 3.7 3.3 5.2.2.6 0 1-.6 1.3l-2.7 1.5-2.7-1.5c-.6-.3-.8-.7-.6-1.3.6-1.5 1.7-3.2 3.3-5.2z" />
-    <path d="M14.5 20.8c.2-1 .7-1.2 1.6-.8 4.5 1.9 8 4.8 10.5 8.7 2.3 3.6 3.6 7.7 3.8 12.2 0 1-.4 1.4-1.3 1.1-4.7-1.5-8.4-4.3-11.1-8.4-2.6-4-3.8-8.3-3.5-12.8z" />
-    <path d="M49.5 20.8c-.2-1-.7-1.2-1.6-.8-4.5 1.9-8 4.8-10.5 8.7-2.3 3.6-3.6 7.7-3.8 12.2 0 1 .4 1.4 1.3 1.1 4.7-1.5 8.4-4.3 11.1-8.4 2.6-4 3.8-8.3 3.5-12.8z" />
-    <path d="M4 30c0-1 .3-1.5 1.3-1.6 6.5-.5 12.5 1.2 17.6 4.8 4.6 3.3 7.7 7.8 9.3 13.2.3 1 .1 1.6-.9 1.7-6.8.8-13-.7-18.4-4.6C7.5 39.6 4.3 34.9 4 30z" />
-    <path d="M60 30c0-1-.3-1.5-1.3-1.6-6.5-.5-12.5 1.2-17.6 4.8-4.6 3.3-7.7 7.8-9.3 13.2-.3 1-.1 1.6.9 1.7 6.8.8 13-.7 18.4-4.6C56.5 39.6 59.7 34.9 60 30z" />
-    <path d="M32 6c4.5 6 7.2 12 8 18 .8 6-.5 12-4 18l-4 6-4-6c-3.5-6-4.8-12-4-18 .8-6 3.5-12 8-18z" />
-  </g>
-</svg>