@autter/runtime-node 1.9.0 → 1.10.0

package/dist/chunk-HBH64LWQ.cjs

@@ -0,0 +1,878 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+
+
+
+
+
+
+
+var _chunkS6WJ5YLPcjs = require('./chunk-S6WJ5YLP.cjs');
+
+// src/doctor.ts
+var _fs = require('fs');
+var _path = require('path');
+
+// src/connectivity.ts
+var _promises = require('dns/promises');
+var _net = require('net');
+var _tls = require('tls');
+var elapsed = (start) => Math.round(performance.now() - start);
+function errCode(err) {
+  const e = err;
+  return typeof _optionalChain([e, 'optionalAccess', _ => _.code]) === "string" ? e.code : String(_nullishCoalesce(_optionalChain([e, 'optionalAccess', _2 => _2.message]), () => ( err)));
+}
+function proxyNote(env) {
+  const proxy = env.HTTPS_PROXY || env.https_proxy || env.HTTP_PROXY || env.http_proxy;
+  return proxy ? ` HTTPS_PROXY is set, but Node's HTTP client (and the OTLP exporter) do not use it: if this network only allows traffic through the proxy, allow the ingester host directly or run the app where it can reach it.` : "";
+}
+function connectOnce(address, port, timeoutMs, tls) {
+  return new Promise((resolve) => {
+    let socket;
+    const timer = setTimeout(() => {
+      _optionalChain([socket, 'optionalAccess', _3 => _3.destroy, 'call', _4 => _4()]);
+      resolve({ ok: false, code: "TIMEOUT" });
+    }, timeoutMs);
+    const done = (result) => {
+      clearTimeout(timer);
+      _optionalChain([socket, 'optionalAccess', _5 => _5.destroy, 'call', _6 => _6()]);
+      resolve(result);
+    };
+    try {
+      socket = tls ? _tls.connect.call(void 0, { host: address, port, servername: tls.servername, ALPNProtocols: ["http/1.1"] }, () => done({ ok: true })) : _net.connect.call(void 0, { host: address, port }, () => done({ ok: true }));
+      socket.on("error", (err) => done({ ok: false, code: errCode(err) }));
+    } catch (err) {
+      done({ ok: false, code: errCode(err) });
+    }
+  });
+}
+var TCP_HINTS = {
+  TIMEOUT: "Packets to this address get no answer: an outbound firewall, security group or egress rule is dropping them, or (for an IPv6 address) the network has no IPv6 route.",
+  ECONNREFUSED: "The host answered but nothing listens on this port: check the port in the endpoint, or that the ingester is running.",
+  ENETUNREACH: "No route to this network from here (often IPv6 on an IPv4-only network).",
+  EHOSTUNREACH: "No route to this host from here."
+};
+var TLS_HINTS = {
+  SELF_SIGNED_CERT_IN_CHAIN: "A proxy or security product is intercepting TLS with its own certificate. Point NODE_EXTRA_CA_CERTS at its CA certificate.",
+  UNABLE_TO_GET_ISSUER_CERT_LOCALLY: "The certificate's issuer is not trusted here (TLS interception or a private CA). Point NODE_EXTRA_CA_CERTS at that CA certificate.",
+  DEPTH_ZERO_SELF_SIGNED_CERT: "The ingester uses a self-signed certificate. Point NODE_EXTRA_CA_CERTS at it.",
+  ERR_TLS_CERT_ALTNAME_INVALID: "The certificate is not for this host name: check the endpoint URL.",
+  CERT_HAS_EXPIRED: "The ingester's certificate has expired.",
+  TIMEOUT: "TCP connected but the TLS handshake never finished: a middlebox may be blocking it."
+};
+async function diagnoseConnectivity(endpoint, options = {}) {
+  const timeoutMs = _nullishCoalesce(options.timeoutMs, () => ( 5e3));
+  const env = _nullishCoalesce(options.env, () => ( process.env));
+  let url;
+  try {
+    url = new URL(endpoint);
+  } catch (e2) {
+    return {
+      ok: false,
+      host: endpoint,
+      port: 0,
+      steps: [],
+      failed: { step: "dns", detail: `not a URL: ${endpoint}`, hint: "Use the ingester's base URL, e.g. https://otlp.autter.dev or http://localhost:4318." }
+    };
+  }
+  const host = url.hostname.replace(/^\[|\]$/g, "");
+  const secure = url.protocol === "https:";
+  const port = Number(url.port) || (secure ? 443 : 80);
+  const steps = [];
+  const report = (failed) => ({
+    ok: !failed,
+    host,
+    port,
+    steps,
+    ...failed ? { failed } : {}
+  });
+  let addresses;
+  if (_net.isIP.call(void 0, host)) {
+    addresses = [{ address: host, family: _net.isIP.call(void 0, host) }];
+  } else {
+    const start2 = performance.now();
+    try {
+      addresses = await _promises.lookup.call(void 0, host, { all: true });
+      steps.push({ step: "dns", ok: true, ms: elapsed(start2), detail: `${host} \u2192 ${addresses.map((a) => a.address).join(", ")}` });
+    } catch (err) {
+      const code = errCode(err);
+      const detail = `${host} does not resolve (${code})`;
+      steps.push({ step: "dns", ok: false, ms: elapsed(start2), detail });
+      return report({
+        step: "dns",
+        detail,
+        hint: "Check the host name in the endpoint; on a VPN or in a container, check its DNS settings."
+      });
+    }
+  }
+  const ordered = [...addresses].sort((a, b) => a.family - b.family).slice(0, 3);
+  let reached = null;
+  const tcpFailures = [];
+  let lastCode = "TIMEOUT";
+  for (const { address } of ordered) {
+    const start2 = performance.now();
+    const result = await connectOnce(address, port, timeoutMs, null);
+    if (result.ok) {
+      steps.push({ step: "tcp", ok: true, ms: elapsed(start2), detail: `connected to ${address}:${port}` });
+      reached = address;
+      break;
+    }
+    lastCode = result.code;
+    tcpFailures.push(`${address}:${port} ${result.code === "TIMEOUT" ? `timed out after ${timeoutMs} ms` : result.code}`);
+  }
+  if (tcpFailures.length && reached) {
+    steps[steps.length - 1].detail += ` (failed first: ${tcpFailures.join("; ")})`;
+  }
+  if (!reached) {
+    const detail = tcpFailures.join("; ");
+    steps.push({ step: "tcp", ok: false, ms: 0, detail });
+    return report({ step: "tcp", detail, hint: (_nullishCoalesce(TCP_HINTS[lastCode], () => ( "The connection failed."))) + proxyNote(env) });
+  }
+  if (secure) {
+    const start2 = performance.now();
+    const result = await connectOnce(reached, port, timeoutMs, { servername: host });
+    if (!result.ok) {
+      const detail = `TLS handshake with ${host} failed (${result.code})`;
+      steps.push({ step: "tls", ok: false, ms: elapsed(start2), detail });
+      return report({ step: "tls", detail, hint: _nullishCoalesce(TLS_HINTS[result.code], () => ( "The TLS handshake failed.")) });
+    }
+    steps.push({ step: "tls", ok: true, ms: elapsed(start2), detail: `certificate valid for ${host}` });
+  }
+  const start = performance.now();
+  const base = endpoint.replace(/\/$/, "");
+  const res = await _chunkS6WJ5YLPcjs.compatRequest.call(void 0, "GET", `${base}/livez`, { unref: false, timeoutMs });
+  if (!res) {
+    const detail = `no HTTP answer from ${base}/livez within ${timeoutMs} ms`;
+    steps.push({ step: "http", ok: false, ms: elapsed(start), detail });
+    return report({
+      step: "http",
+      detail,
+      hint: "The connection opens but no HTTP response comes back: a proxy or load balancer in front of the ingester may be holding the request." + proxyNote(env)
+    });
+  }
+  steps.push({ step: "http", ok: true, ms: elapsed(start), detail: `GET /livez answered ${res.status}` });
+  return report();
+}
+
+// src/doctor.ts
+var SDK_PACKAGES = ["@autter/runtime-node", "@autter/runtime-next", "@autter/runtime-browser"];
+var DEFAULT_ENDPOINT = "https://otlp.autter.dev";
+function resolveEndpoint(flag, env = process.env) {
+  return (flag || env.AUTTER_ENDPOINT || env.AUTTER_RUNTIME_ENDPOINT || env.OTEL_EXPORTER_OTLP_ENDPOINT || DEFAULT_ENDPOINT).replace(/\/$/, "");
+}
+function installedSdks(cwd) {
+  const found = /* @__PURE__ */ new Map();
+  for (let dir = cwd; ; dir = _path.dirname.call(void 0, dir)) {
+    for (const name of SDK_PACKAGES) {
+      if (found.has(name)) continue;
+      const file = _path.join.call(void 0, dir, "node_modules", ...name.split("/"), "package.json");
+      if (!_fs.existsSync.call(void 0, file)) continue;
+      try {
+        const version = JSON.parse(_fs.readFileSync.call(void 0, file, "utf8")).version;
+        if (typeof version === "string") found.set(name, version);
+      } catch (e3) {
+      }
+    }
+    if (_path.dirname.call(void 0, dir) === dir) break;
+  }
+  if (!found.has(_chunkS6WJ5YLPcjs.SDK_IDENTITY.name)) found.set(_chunkS6WJ5YLPcjs.SDK_IDENTITY.name, _chunkS6WJ5YLPcjs.SDK_IDENTITY.version);
+  return [...found].map(([name, version]) => ({ name, version }));
+}
+function featuresInUse(sdks) {
+  return _chunkS6WJ5YLPcjs.COMPAT_MANIFEST.features.filter(
+    (feature) => sdks.some((sdk) => {
+      const min = feature.sdks[sdk.name];
+      return min !== void 0 && _chunkS6WJ5YLPcjs.versionAtLeast.call(void 0, sdk.version, min) === true;
+    })
+  ).map((feature) => feature.id);
+}
+async function checkKey(endpoint, key, timeoutMs) {
+  const res = await _chunkS6WJ5YLPcjs.compatRequest.call(void 0, "POST", `${endpoint}/v1/traces`, {
+    body: JSON.stringify({ resourceSpans: [] }),
+    headers: { authorization: `Bearer ${key}` },
+    unref: false,
+    timeoutMs
+  });
+  if (!res) return { key: "unknown" };
+  const detail = _chunkS6WJ5YLPcjs.refusalReason.call(void 0, res.body) || void 0;
+  const withDetail = (key2) => detail ? { key: key2, detail } : { key: key2 };
+  if (res.status >= 200 && res.status < 300) return { key: "accepted" };
+  if (res.status === 401) return withDetail("rejected");
+  if (res.status === 403) return withDetail("client_key");
+  if (res.status === 503) return withDetail(res.headers["retry-after"] ? "unverified" : "storage_unavailable");
+  return withDetail("unknown");
+}
+var STORAGE_TEXT = {
+  up: "ready: ClickHouse accepts writes",
+  down: "ClickHouse is unreachable or failing writes (retryable): ingest answers 503 and exporters retry",
+  auth_failed: "ClickHouse refuses the ingester's credentials: fix CLICKHOUSE_USER/CLICKHOUSE_PASSWORD on the ingester",
+  schema_missing: "ClickHouse tables are missing: check the ingester logs for the boot migrations, then restart it",
+  unconfigured: "no ClickHouse configured (CLICKHOUSE_URL unset): every ingest request is refused with 503"
+};
+async function checkStorage(endpoint, timeoutMs) {
+  const res = await _chunkS6WJ5YLPcjs.compatRequest.call(void 0, "GET", `${endpoint}/healthz`, { unref: false, timeoutMs });
+  if (!res) return null;
+  let body = {};
+  try {
+    body = JSON.parse(res.body);
+  } catch (e4) {
+  }
+  const reported = typeof body.clickhouse === "string" ? body.clickhouse : null;
+  if (res.status === 404) {
+    return { state: "unknown", ok: true, writeChecked: false, detail: "not checked: this ingester has no /healthz" };
+  }
+  if (!reported) {
+    if (res.status >= 200 && res.status < 300) {
+      return {
+        state: "up",
+        ok: true,
+        writeChecked: false,
+        detail: "reachable (this ingester predates 1.12 and does not check writes; `verify` does)"
+      };
+    }
+    return res.status === 503 ? { state: "down", ok: false, writeChecked: false, detail: "/healthz answered 503: the ingester is not ready" } : { state: "unknown", ok: true, writeChecked: false, detail: `not checked: /healthz answered ${res.status}` };
+  }
+  const ok = res.status >= 200 && res.status < 300 && reported === "up";
+  return { state: reported, ok, writeChecked: true, detail: _nullishCoalesce(STORAGE_TEXT[reported], () => ( `ClickHouse ${reported}`)) };
+}
+function versionSkew(sdks, info) {
+  return sdks.map((sdk) => {
+    const emitted = _chunkS6WJ5YLPcjs.COMPAT_MANIFEST.features.filter((f) => {
+      const min = f.sdks[sdk.name];
+      return min !== void 0 && _chunkS6WJ5YLPcjs.versionAtLeast.call(void 0, sdk.version, min) === true;
+    });
+    const notYet = _chunkS6WJ5YLPcjs.COMPAT_MANIFEST.features.filter((f) => {
+      const min = f.sdks[sdk.name];
+      return min !== void 0 && _chunkS6WJ5YLPcjs.versionAtLeast.call(void 0, sdk.version, min) === false;
+    });
+    if (!_optionalChain([info, 'optionalAccess', _7 => _7.version])) {
+      return { sdk: sdk.name, version: sdk.version, status: "unknown", detail: "ingester version unknown" };
+    }
+    const unstored = emitted.filter((f) => _chunkS6WJ5YLPcjs.versionAtLeast.call(void 0, info.version, f.ingester) === false);
+    if (unstored.length) {
+      const need = unstored.map((f) => f.ingester).sort((a, b) => _chunkS6WJ5YLPcjs.versionAtLeast.call(void 0, a, b) ? -1 : 1)[0];
+      return {
+        sdk: sdk.name,
+        version: sdk.version,
+        status: "ingester_behind",
+        detail: `ingester ${info.version} is behind: ${unstored.length} feature(s) this SDK sends need ingester >= ${need} (${unstored.map((f) => f.id).join(", ")})`
+      };
+    }
+    const available = notYet.filter((f) => _chunkS6WJ5YLPcjs.versionAtLeast.call(void 0, info.version, f.ingester) === true);
+    if (available.length) {
+      const need = available.map((f) => f.sdks[sdk.name]).sort((a, b) => _chunkS6WJ5YLPcjs.versionAtLeast.call(void 0, a, b) ? -1 : 1)[0];
+      return {
+        sdk: sdk.name,
+        version: sdk.version,
+        status: "sdk_behind",
+        detail: `the ingester stores ${available.length} feature(s) this SDK does not send yet; ${sdk.name} >= ${need} adds them (${available.map((f) => f.id).join(", ")})`
+      };
+    }
+    return { sdk: sdk.name, version: sdk.version, status: "in_sync", detail: `in sync with ingester ${info.version}` };
+  });
+}
+async function runDoctor(options = {}) {
+  const endpoint = resolveEndpoint(options.endpoint);
+  const timeoutMs = _nullishCoalesce(options.timeoutMs, () => ( 5e3));
+  const sdks = installedSdks(_nullishCoalesce(options.cwd, () => ( process.cwd())));
+  const features = _optionalChain([options, 'access', _8 => _8.features, 'optionalAccess', _9 => _9.length]) ? options.features : featuresInUse(sdks);
+  const routes = [
+    ...new Set(
+      features.map((id) => _optionalChain([_chunkS6WJ5YLPcjs.COMPAT_MANIFEST, 'access', _10 => _10.features, 'access', _11 => _11.find, 'call', _12 => _12((f) => f.id === id), 'optionalAccess', _13 => _13.route])).filter((route) => Boolean(route))
+    )
+  ];
+  const { info, error } = await _chunkS6WJ5YLPcjs.fetchIngesterCompat.call(void 0, endpoint, { probeRoutes: routes, unref: false, timeoutMs });
+  const issues = [];
+  const seen = /* @__PURE__ */ new Set();
+  const add = (issue) => {
+    const key2 = `${issue.feature}:${issue.kind}:${issue.component}`;
+    if (!seen.has(key2)) {
+      seen.add(key2);
+      issues.push(issue);
+    }
+  };
+  _chunkS6WJ5YLPcjs.evaluateCompat.call(void 0, { features, ingester: info }).forEach(add);
+  for (const sdk of sdks) {
+    if (_optionalChain([options, 'access', _14 => _14.features, 'optionalAccess', _15 => _15.length])) {
+      _chunkS6WJ5YLPcjs.evaluateCompat.call(void 0, { features: options.features, ingester: null, sdk }).forEach(add);
+    }
+  }
+  const keyCheck = options.key ? await checkKey(endpoint, options.key, timeoutMs) : null;
+  const key = _nullishCoalesce(_optionalChain([keyCheck, 'optionalAccess', _16 => _16.key]), () => ( "not_checked"));
+  const storage = info ? await checkStorage(endpoint, timeoutMs) : null;
+  const connectivity = info ? void 0 : await diagnoseConnectivity(endpoint, { timeoutMs });
+  const featureRows = features.flatMap((id) => {
+    const feature = _chunkS6WJ5YLPcjs.COMPAT_MANIFEST.features.find((f) => f.id === id);
+    if (!feature) return [];
+    const bad = issues.some((issue) => issue.feature === id);
+    const known = _optionalChain([info, 'optionalAccess', _17 => _17.version]) != null || feature.route !== void 0 && _optionalChain([info, 'optionalAccess', _18 => _18.routes, 'optionalAccess', _19 => _19[feature.route]]) !== void 0;
+    return [{ id, title: feature.title, status: bad ? "incompatible" : known ? "ok" : "unknown" }];
+  });
+  const exitCode = !info ? 2 : issues.length || _optionalChain([storage, 'optionalAccess', _20 => _20.ok]) === false || key === "rejected" || key === "client_key" || key === "storage_unavailable" || key === "unverified" ? 1 : 0;
+  return {
+    endpoint,
+    sdks,
+    ingester: info,
+    ...error && !info ? { ingesterError: error } : {},
+    key,
+    ..._optionalChain([keyCheck, 'optionalAccess', _21 => _21.detail]) ? { keyDetail: keyCheck.detail } : {},
+    storage,
+    features: featureRows,
+    skew: versionSkew(sdks, info),
+    issues,
+    ...connectivity ? { connectivity } : {},
+    exitCode
+  };
+}
+function formatDoctorReport(report) {
+  const lines = [];
+  lines.push(`Autter Runtime doctor`);
+  lines.push(`  endpoint   ${report.endpoint}`);
+  for (const sdk of report.sdks) lines.push(`  sdk        ${sdk.name}@${sdk.version}`);
+  if (!report.ingester) {
+    lines.push(`  ingester   unreachable or unidentified (${_nullishCoalesce(report.ingesterError, () => ( "unknown error"))})`);
+  } else if (report.ingester.version) {
+    lines.push(`  ingester   @autter/otlp-ingester@${report.ingester.version}`);
+    const schema = report.ingester.schema;
+    if (schema) {
+      lines.push(
+        `  schema     ${schema.status}${schema.applied.length ? ` (level ${schema.applied[schema.applied.length - 1]})` : ""}`
+      );
+    }
+  } else {
+    lines.push(`  ingester   1.4.0 or older (no /v1/compat endpoint; upgrade for a full report)`);
+  }
+  if (report.storage) lines.push(`  storage    ${report.storage.ok ? "" : "NOT READY: "}${report.storage.detail}`);
+  {
+    const reason = report.keyDetail ? ` (${report.keyDetail})` : "";
+    const text = {
+      accepted: "accepted",
+      rejected: `REJECTED (401${reason}): check AUTTER_RUNTIME_KEY`,
+      client_key: `refused (403${reason}): server SDKs need a server key (autter_rt_\u2026)`,
+      storage_unavailable: "accepted, but the ingester's ClickHouse is unavailable (503)",
+      unverified: "could not be checked: the ingester's key validator is unavailable (503); exporters retry",
+      unknown: `could not be verified${reason}`,
+      not_checked: "not checked (pass --key or set AUTTER_RUNTIME_KEY)"
+    }[report.key];
+    lines.push(`  key        ${text}`);
+  }
+  if (report.connectivity) {
+    lines.push("", "Connection");
+    for (const step of report.connectivity.steps) {
+      lines.push(`  ${step.ok ? "ok  " : "FAIL"} ${step.step.padEnd(5)} ${step.detail}${step.ms ? ` (${step.ms} ms)` : ""}`);
+    }
+    if (report.connectivity.failed) lines.push(`  -> ${report.connectivity.failed.hint}`);
+  }
+  if (report.skew.some((line) => line.status !== "unknown")) {
+    lines.push("", "Versions");
+    for (const line of report.skew) {
+      const mark = line.status === "in_sync" ? "ok  " : line.status === "ingester_behind" ? "FAIL" : line.status === "sdk_behind" ? "note" : "??  ";
+      lines.push(`  ${mark} ${line.sdk}@${line.version}: ${line.detail}`);
+    }
+  }
+  if (report.features.length) {
+    lines.push("", "Features");
+    for (const feature of report.features) {
+      const mark = feature.status === "ok" ? "on  " : feature.status === "incompatible" ? "FAIL" : "??  ";
+      lines.push(`  ${mark} ${feature.title} (${feature.id})`);
+    }
+  }
+  if (report.issues.length) {
+    lines.push("", "Problems");
+    for (const issue of report.issues) lines.push(`  - ${issue.message}`);
+  }
+  if (report.storage && !report.storage.ok) lines.push(`${report.issues.length ? "" : "\nProblems\n"}  - Storage: ${report.storage.detail}`);
+  lines.push("", verdict(report));
+  return lines.join("\n");
+}
+function verdict(report) {
+  if (report.exitCode === 2) {
+    return _optionalChain([report, 'access', _22 => _22.connectivity, 'optionalAccess', _23 => _23.failed]) ? `Could not reach the ingester: the ${report.connectivity.failed.step.toUpperCase()} step failed (see Connection above).` : "Could not check the ingester. Pass --endpoint <url> (or set AUTTER_ENDPOINT).";
+  }
+  if (report.exitCode === 1) {
+    if (report.storage && !report.storage.ok) return "Not ready: the ingester cannot store data right now (see storage above).";
+    if (report.key !== "accepted" && report.key !== "not_checked" && !report.issues.length) return "Not ready: the key was not accepted (see key above).";
+    return "Incompatible: see the problems above.";
+  }
+  if (report.key === "not_checked") {
+    return "Versions compatible and storage ready. Key not checked: pass --key, or run `npx @autter/runtime-node verify` to send a test event end to end.";
+  }
+  return "Ready: versions compatible, storage ready, key accepted. `npx @autter/runtime-node verify` sends a test event end to end.";
+}
+var DOCTOR_USAGE = `Usage: npx @autter/runtime-node doctor [options]
+
+Checks that your Autter SDKs and the ingester's version, ClickHouse schema
+and storage match, which features are active, and the ingest key. For an
+end-to-end check that sends a test event, use: npx @autter/runtime-node verify
+
+Options:
+  --endpoint <url>    Ingester base URL (default: $AUTTER_ENDPOINT, $OTEL_EXPORTER_OTLP_ENDPOINT, or ${DEFAULT_ENDPOINT})
+  --key <key>         Also verify an ingest key (default: $AUTTER_RUNTIME_KEY)
+  --features <a,b>    Only check these features (${_chunkS6WJ5YLPcjs.COMPAT_MANIFEST.features.map((f) => f.id).join(", ")})
+  --json              Machine-readable output
+  --timeout <ms>      Per-request timeout (default 5000)
+
+Exit codes: 0 ready, 1 mismatch, rejected key or storage not ready, 2 ingester unreachable.`;
+function parseDoctorArgs(argv, env = process.env) {
+  const options = {};
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    const [flag, inline] = arg.includes("=") ? [arg.slice(0, arg.indexOf("=")), arg.slice(arg.indexOf("=") + 1)] : [arg, void 0];
+    const value = () => _nullishCoalesce(inline, () => ( argv[++i]));
+    switch (flag) {
+      case "-h":
+      case "--help":
+        return { help: true };
+      case "--endpoint":
+        options.endpoint = value();
+        break;
+      case "--key":
+        options.key = value();
+        break;
+      case "--features":
+        options.features = (_nullishCoalesce(value(), () => ( ""))).split(",").map((f) => f.trim()).filter(Boolean);
+        break;
+      case "--json":
+        options.json = true;
+        break;
+      case "--timeout": {
+        const ms = Number(value());
+        if (!Number.isFinite(ms) || ms <= 0) return { error: "--timeout needs a positive number of ms" };
+        options.timeoutMs = ms;
+        break;
+      }
+      default:
+        return { error: `unknown option ${arg}` };
+    }
+  }
+  if (!options.key && env.AUTTER_RUNTIME_KEY) options.key = env.AUTTER_RUNTIME_KEY;
+  return options;
+}
+
+// src/verify.ts
+var _crypto = require('crypto');
+
+
+var ORDER = ["key", "network", "ingester", "storage", "auth", "ingest", "stored", "trace", "release", "logs"];
+function defaultService(cwd, env) {
+  if (env.AUTTER_SERVICE) return env.AUTTER_SERVICE;
+  if (env.OTEL_SERVICE_NAME) return env.OTEL_SERVICE_NAME;
+  try {
+    const name = JSON.parse(_fs.readFileSync.call(void 0, _path.join.call(void 0, cwd, "package.json"), "utf8")).name;
+    if (typeof name === "string" && name) return name.replace(/^@[^/]+\//, "");
+  } catch (e5) {
+  }
+  return "autter-verify";
+}
+function defaultRelease(env) {
+  return env.AUTTER_RELEASE || env.GIT_SHA || env.VERCEL_GIT_COMMIT_SHA || env.RENDER_GIT_COMMIT || env.RAILWAY_GIT_COMMIT_SHA || env.CF_PAGES_COMMIT_SHA || env.GITHUB_SHA || null;
+}
+var nowNanos = () => (BigInt(Date.now()) * 1000000n).toString();
+var str = (key, value) => ({ key, value: { stringValue: value } });
+function resourceAttributes(opts) {
+  return [
+    str("service.name", opts.service),
+    str("deployment.environment", opts.environment),
+    ...opts.release ? [str("service.version", opts.release)] : [],
+    str("autter.verify.id", opts.traceId)
+  ];
+}
+function testTraces(opts) {
+  const end = nowNanos();
+  const start = (BigInt(end) - 1000000n).toString();
+  return {
+    resourceSpans: [
+      {
+        resource: { attributes: resourceAttributes(opts) },
+        scopeSpans: [
+          {
+            scope: { name: "autter-verify", version: _chunkS6WJ5YLPcjs.SDK_IDENTITY.version },
+            spans: [
+              {
+                traceId: opts.traceId,
+                spanId: _crypto.randomBytes.call(void 0, 8).toString("hex"),
+                name: "autter verify",
+                kind: 1,
+                startTimeUnixNano: start,
+                endTimeUnixNano: end,
+                attributes: [str("autter.verify", "true")],
+                ...opts.withError ? {
+                  status: { code: 2, message: "autter verify test event" },
+                  events: [
+                    {
+                      name: "exception",
+                      timeUnixNano: end,
+                      attributes: [
+                        str("exception.type", "AutterVerifyTestEvent"),
+                        str("exception.message", "Test event from autter-runtime verify (never opens an issue)"),
+                        str("autter.severity", "info")
+                      ]
+                    }
+                  ]
+                } : {}
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  };
+}
+function testLogs(opts) {
+  return {
+    resourceLogs: [
+      {
+        resource: { attributes: resourceAttributes(opts) },
+        scopeLogs: [
+          {
+            scope: { name: "autter-verify" },
+            logRecords: [
+              {
+                timeUnixNano: nowNanos(),
+                severityNumber: 9,
+                severityText: "INFO",
+                body: { stringValue: "autter verify test log record" },
+                traceId: opts.traceId,
+                attributes: [str("autter.verify", "true")]
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  };
+}
+function parse(res) {
+  if (!res) return null;
+  try {
+    return JSON.parse(res.body);
+  } catch (e6) {
+    return null;
+  }
+}
+var AUTH_FIX = {
+  401: "Check AUTTER_RUNTIME_KEY: it must be a server key (autter_rt_\u2026) of this repository, not revoked. Create one in Autter \u2192 Repository \u2192 Settings \u2192 Runtime.",
+  403: "Server SDKs need a server key (autter_rt_\u2026). Client keys (autter_rtc_\u2026) are for browsers only, upload keys (autter_rtu_\u2026) for source maps only.",
+  429: "The ingester is rate limiting this key or address; wait for Retry-After and run verify again.",
+  503: "The ingester could not check the key or store data right now. Run again in a few seconds; if it persists, see storage above."
+};
+async function runVerify(options = {}, env = process.env) {
+  const endpoint = resolveEndpoint(options.endpoint, env);
+  const timeoutMs = _nullishCoalesce(options.timeoutMs, () => ( 5e3));
+  const waitMs = _nullishCoalesce(options.waitMs, () => ( 2e4));
+  const pollMs = _nullishCoalesce(options.pollMs, () => ( 500));
+  const cwd = _nullishCoalesce(options.cwd, () => ( process.cwd()));
+  const service = options.service || defaultService(cwd, env);
+  const environment = options.environment || "verify";
+  const release = options.release || defaultRelease(env);
+  const traceId = _crypto.randomBytes.call(void 0, 16).toString("hex");
+  const key = _chunkS6WJ5YLPcjs.resolveIngestKey.call(void 0, options.key, env);
+  const steps = [];
+  const add = (step) => steps.push(step);
+  const finish = (exitCode) => {
+    const firstFailure = _nullishCoalesce(steps.find((s) => s.status === "fail"), () => ( null));
+    for (const name of ORDER) {
+      if (!steps.some((s) => s.step === name)) steps.push({ step: name, status: "skip", detail: "not run: an earlier step failed" });
+    }
+    steps.sort((a, b) => ORDER.indexOf(a.step) - ORDER.indexOf(b.step));
+    return {
+      endpoint,
+      service,
+      environment,
+      release,
+      traceId,
+      steps,
+      firstFailure,
+      exitCode: _nullishCoalesce(exitCode, () => ( (firstFailure ? 1 : 0)))
+    };
+  };
+  const headers = key ? { authorization: `Bearer ${key}` } : {};
+  if (!key) {
+    add({
+      step: "key",
+      status: "fail",
+      detail: "no ingest key: --key not given and AUTTER_RUNTIME_KEY is not set",
+      fix: "Set AUTTER_RUNTIME_KEY to a server key (autter_rt_\u2026), or pass --key. Locally with the repo's docker compose: autter_rt_local_dev_only."
+    });
+    return finish();
+  }
+  const kind = key.startsWith("autter_rtc_") ? "client key" : key.startsWith("autter_rtu_") ? "upload key" : "key";
+  if (kind !== "key") {
+    add({ step: "key", status: "fail", detail: `the key is a ${kind}`, fix: AUTH_FIX[403] });
+    return finish();
+  }
+  add({ step: "key", status: "pass", detail: `${key.slice(0, Math.min(10, key.length))}\u2026 (${key.length} characters)` });
+  const network = await diagnoseConnectivity(endpoint, { timeoutMs, env });
+  if (!network.ok) {
+    add({ step: "network", status: "fail", detail: `${network.failed.step.toUpperCase()}: ${network.failed.detail}`, fix: network.failed.hint });
+    return finish(2);
+  }
+  const total = network.steps.reduce((sum, s) => sum + s.ms, 0);
+  add({ step: "network", status: "pass", detail: `${network.steps.map((s) => s.step.toUpperCase()).join(", ")} ok (${network.host}:${network.port}, ${total} ms)` });
+  const { info, error } = await _chunkS6WJ5YLPcjs.fetchIngesterCompat.call(void 0, endpoint, { unref: false, timeoutMs });
+  if (!info) {
+    add({
+      step: "ingester",
+      status: "fail",
+      detail: `the server answered but is not an Autter ingester (${_nullishCoalesce(error, () => ( "unknown"))})`,
+      fix: "Point --endpoint (AUTTER_ENDPOINT) at the ingester's base URL, without /v1/traces."
+    });
+    return finish();
+  }
+  const skew = versionSkew(installedSdks(cwd), info).filter((line) => line.status === "ingester_behind");
+  add({
+    step: "ingester",
+    status: skew.length ? "warn" : "pass",
+    detail: `@autter/otlp-ingester@${_nullishCoalesce(info.version, () => ( "1.4.0 or older"))}${info.schema ? `, schema ${info.schema.status}` : ""}${skew.length ? `; ${skew.map((l) => l.detail).join("; ")}` : ""}`
+  });
+  const storage = await checkStorage(endpoint, timeoutMs);
+  if (storage && !storage.ok) {
+    add({ step: "storage", status: "fail", detail: `ClickHouse ${storage.state}`, fix: storage.detail });
+    return finish();
+  }
+  add({ step: "storage", status: _optionalChain([storage, 'optionalAccess', _24 => _24.writeChecked]) ? "pass" : "warn", detail: _nullishCoalesce(_optionalChain([storage, 'optionalAccess', _25 => _25.detail]), () => ( "not checked: /healthz did not answer")) });
+  const authRes = await _chunkS6WJ5YLPcjs.compatRequest.call(void 0, "GET", `${endpoint}/v1/verify`, { headers, unref: false, timeoutMs });
+  let lookupSupported = true;
+  if (_optionalChain([authRes, 'optionalAccess', _26 => _26.status]) === 404) {
+    lookupSupported = false;
+    const probe = await _chunkS6WJ5YLPcjs.compatRequest.call(void 0, "POST", `${endpoint}/v1/traces`, {
+      body: JSON.stringify({ resourceSpans: [] }),
+      headers,
+      unref: false,
+      timeoutMs
+    });
+    if (!probe || probe.status >= 300) {
+      const status = _nullishCoalesce(_optionalChain([probe, 'optionalAccess', _27 => _27.status]), () => ( 0));
+      add({ step: "auth", status: "fail", detail: probe ? `${status}: ${_chunkS6WJ5YLPcjs.refusalReason.call(void 0, probe.body) || "refused"}` : "no answer", fix: AUTH_FIX[status] });
+      return finish();
+    }
+    add({ step: "auth", status: "pass", detail: "key accepted" });
+  } else if (!authRes || authRes.status !== 200) {
+    const status = _nullishCoalesce(_optionalChain([authRes, 'optionalAccess', _28 => _28.status]), () => ( 0));
+    add({ step: "auth", status: "fail", detail: authRes ? `${status}: ${_chunkS6WJ5YLPcjs.refusalReason.call(void 0, authRes.body) || "refused"}` : "no answer", fix: AUTH_FIX[status] });
+    return finish();
+  } else {
+    const body = parse(authRes);
+    const lastRejected = _optionalChain([body, 'optionalAccess', _29 => _29.delivery, 'optionalAccess', _30 => _30.lastRejected]);
+    add({
+      step: "auth",
+      status: "pass",
+      detail: "key accepted" + (lastRejected ? `; this key's last refused request: ${lastRejected.route} ${lastRejected.status} ${_nullishCoalesce(lastRejected.reason, () => ( ""))}${lastRejected.error ? ` (${lastRejected.error})` : ""} at ${lastRejected.at}` : "")
+    });
+  }
+  const ingestRes = await _chunkS6WJ5YLPcjs.compatRequest.call(void 0, "POST", `${endpoint}/v1/traces`, {
+    body: JSON.stringify(testTraces({ service, environment, release, traceId, withError: lookupSupported })),
+    headers,
+    unref: false,
+    timeoutMs
+  });
+  if (!ingestRes || ingestRes.status >= 300) {
+    const status = _nullishCoalesce(_optionalChain([ingestRes, 'optionalAccess', _31 => _31.status]), () => ( 0));
+    add({
+      step: "ingest",
+      status: "fail",
+      detail: ingestRes ? `/v1/traces ${status}: ${_chunkS6WJ5YLPcjs.refusalReason.call(void 0, ingestRes.body) || "refused"}` : "no answer from /v1/traces",
+      fix: _nullishCoalesce(AUTH_FIX[status], () => ( "Run with --json and check the ingester's logs."))
+    });
+    return finish();
+  }
+  const partial = _optionalChain([parse, 'call', _32 => _32(ingestRes), 'optionalAccess', _33 => _33.partialSuccess]);
+  const rejected = Number(_nullishCoalesce(_optionalChain([partial, 'optionalAccess', _34 => _34.rejectedSpans]), () => ( 0)));
+  const summary = ingestRes.headers["x-autter-ingest"];
+  if (rejected > 0) {
+    add({ step: "ingest", status: "fail", detail: `/v1/traces accepted the request but rejected ${rejected} span(s): ${_nullishCoalesce(_optionalChain([partial, 'optionalAccess', _35 => _35.errorMessage]), () => ( ""))}` });
+    return finish();
+  }
+  add({ step: "ingest", status: "pass", detail: `/v1/traces ${ingestRes.status}${summary ? `: ${summary}` : ""}` });
+  if (!lookupSupported) {
+    add({
+      step: "stored",
+      status: "warn",
+      detail: `not checked: ingester ${_nullishCoalesce(info.version, () => ( "1.4.0 or older"))} has no /v1/verify (upgrade it to have verify read the event back)`
+    });
+    add({ step: "trace", status: "skip", detail: "not checked (needs /v1/verify)" });
+    add({ step: "release", status: release ? "skip" : "warn", detail: release ? "not checked (needs /v1/verify)" : "no release set (see below)" });
+    add({ step: "logs", status: "skip", detail: "not checked (needs /v1/verify)" });
+    return finish();
+  }
+  const started = Date.now();
+  let lookup2 = null;
+  let lookupStatus = 0;
+  for (; ; ) {
+    const res = await _chunkS6WJ5YLPcjs.compatRequest.call(void 0, "GET", `${endpoint}/v1/verify/${traceId}`, { headers, unref: false, timeoutMs });
+    lookupStatus = _nullishCoalesce(_optionalChain([res, 'optionalAccess', _36 => _36.status]), () => ( 0));
+    const body = _optionalChain([res, 'optionalAccess', _37 => _37.status]) === 200 ? parse(res) : null;
+    if (_optionalChain([body, 'optionalAccess', _38 => _38.stored])) {
+      lookup2 = body;
+      if (body.stored.spans.rows > 0 && body.stored.occurrences.rows > 0) break;
+    }
+    if (Date.now() - started >= waitMs) break;
+    await new Promise((resolve) => setTimeout(resolve, pollMs));
+  }
+  const seconds = ((Date.now() - started) / 1e3).toFixed(1);
+  const stored = _optionalChain([lookup2, 'optionalAccess', _39 => _39.stored]);
+  if (!stored || stored.spans.rows === 0 || stored.occurrences.rows === 0) {
+    add({
+      step: "stored",
+      status: "fail",
+      detail: !stored ? `could not read it back (GET /v1/verify answered ${lookupStatus || "nothing"})` : `accepted but not found after ${seconds} s: ${stored.spans.rows} span(s), ${stored.occurrences.rows} error(s) stored`,
+      fix: "The ingester answered 200 but the rows are not in ClickHouse. Check the ingester's logs for write errors and its /healthz `writes` section."
+    });
+    return finish();
+  }
+  add({ step: "stored", status: "pass", detail: `${stored.spans.rows} span and ${stored.occurrences.rows} error stored after ${seconds} s` });
+  add({ step: "trace", status: "pass", detail: `the error is linked to its span by trace id ${traceId}` });
+  if (!release) {
+    add({
+      step: "release",
+      status: "warn",
+      detail: `no release set: errors are not tied to a deploy, so "broke in release X" can't work`,
+      fix: "Pass `release` to initAutterServer (and initAutterBrowser), e.g. process.env.GIT_SHA; run verify with --release or GIT_SHA set."
+    });
+  } else if (stored.occurrences.releases.includes(release) && stored.spans.releases.includes(release)) {
+    add({ step: "release", status: "pass", detail: `release ${release} stored on the error and the span` });
+  } else {
+    add({
+      step: "release",
+      status: "fail",
+      detail: `sent release ${release}, stored ${JSON.stringify(stored.occurrences.releases)}`,
+      fix: "The ingester did not keep service.version: check for a collector or proxy that rewrites resource attributes."
+    });
+  }
+  const logsSupported = info.version === null ? false : _chunkS6WJ5YLPcjs.versionAtLeast.call(void 0, info.version, "1.4.0") === true;
+  if (!logsSupported || stored.logs === null) {
+    add({ step: "logs", status: "skip", detail: "not checked: this ingester stores no OTLP logs (operation logging needs ingester >= 1.4.0)" });
+    return finish();
+  }
+  const logRes = await _chunkS6WJ5YLPcjs.compatRequest.call(void 0, "POST", `${endpoint}/v1/logs`, {
+    body: JSON.stringify(testLogs({ service, environment, release, traceId })),
+    headers,
+    unref: false,
+    timeoutMs
+  });
+  if (!logRes || logRes.status >= 300) {
+    add({
+      step: "logs",
+      status: "fail",
+      detail: logRes ? `/v1/logs ${logRes.status}: ${_chunkS6WJ5YLPcjs.refusalReason.call(void 0, logRes.body) || "refused"}` : "no answer from /v1/logs",
+      fix: _optionalChain([logRes, 'optionalAccess', _40 => _40.status]) === 404 ? "This ingester has no /v1/logs: upgrade it, or check for a path prefix in the endpoint." : AUTH_FIX[_nullishCoalesce(_optionalChain([logRes, 'optionalAccess', _41 => _41.status]), () => ( 0))]
+    });
+    return finish();
+  }
+  const logStart = Date.now();
+  let logRows = 0;
+  for (; ; ) {
+    const body = parse(await _chunkS6WJ5YLPcjs.compatRequest.call(void 0, "GET", `${endpoint}/v1/verify/${traceId}`, { headers, unref: false, timeoutMs }));
+    logRows = _nullishCoalesce(_optionalChain([body, 'optionalAccess', _42 => _42.stored, 'optionalAccess', _43 => _43.logs, 'optionalAccess', _44 => _44.rows]), () => ( 0));
+    if (logRows > 0 || Date.now() - logStart >= waitMs) break;
+    await new Promise((resolve) => setTimeout(resolve, pollMs));
+  }
+  add(
+    logRows > 0 ? { step: "logs", status: "pass", detail: `${logRows} log record stored after ${((Date.now() - logStart) / 1e3).toFixed(1)} s` } : { step: "logs", status: "fail", detail: "/v1/logs accepted the record but it was not stored", fix: "Check the ingester's logs for runtime_logs write errors." }
+  );
+  return finish();
+}
+var MARK = { pass: "ok  ", fail: "FAIL", warn: "warn", skip: "--  " };
+function formatVerifyReport(report) {
+  const lines = [
+    "Autter Runtime verify",
+    `  endpoint   ${report.endpoint}`,
+    `  service    ${report.service} (environment ${report.environment}${report.release ? `, release ${report.release}` : ", no release"})`,
+    `  test id    ${report.traceId}`,
+    ""
+  ];
+  for (const step of report.steps) {
+    lines.push(`  ${MARK[step.status]} ${step.step.padEnd(9)} ${step.detail}`);
+    if (step.status !== "pass" && step.status !== "skip" && step.fix) lines.push(`                 -> ${step.fix}`);
+  }
+  lines.push("");
+  if (report.firstFailure) {
+    lines.push(`First failing step: ${report.firstFailure.step}. ${_nullishCoalesce(report.firstFailure.fix, () => ( ""))}`.trim());
+  } else {
+    const warned = report.steps.filter((s) => s.status === "warn").map((s) => s.step);
+    lines.push(
+      `Delivered: a test event from "${report.service}" was accepted and stored.` + (warned.length ? ` Check the warnings: ${warned.join(", ")}.` : "") + ' It is stored under environment "' + report.environment + '" and never opens an issue.'
+    );
+  }
+  return lines.join("\n");
+}
+var VERIFY_USAGE = `Usage: npx @autter/runtime-node verify [options]
+
+Sends one tagged test event (a span with an error, and a log record) through
+the real path and reads it back, naming the first step that fails:
+key, network (DNS/TCP/TLS/HTTP), ingester, storage, auth, ingest, stored,
+trace, release, logs. The test event is stored under environment "verify"
+and never opens an issue.
+
+Options:
+  --endpoint <url>      Ingester base URL (default: $AUTTER_ENDPOINT, $OTEL_EXPORTER_OTLP_ENDPOINT, or https://otlp.autter.dev)
+  --key <key>           Server ingest key (default: $AUTTER_RUNTIME_KEY)
+  --service <name>      Service name (default: $AUTTER_SERVICE, $OTEL_SERVICE_NAME, or package.json name)
+  --environment <name>  Environment for the test event (default: verify)
+  --release <id>        Release to check (default: $AUTTER_RELEASE, $GIT_SHA or your platform's commit variable)
+  --wait <ms>           How long to wait for the event to be stored (default 20000)
+  --timeout <ms>        Per-request timeout (default 5000)
+  --json                Machine-readable output
+
+Exit codes: 0 delivered, 1 a step failed, 2 ingester unreachable.`;
+function parseVerifyArgs(argv) {
+  const options = {};
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    const [flag, inline] = arg.includes("=") ? [arg.slice(0, arg.indexOf("=")), arg.slice(arg.indexOf("=") + 1)] : [arg, void 0];
+    const value = () => _nullishCoalesce(inline, () => ( argv[++i]));
+    const ms = (name) => {
+      const n = Number(value());
+      return Number.isFinite(n) && n > 0 ? n : { error: `${name} needs a positive number of ms` };
+    };
+    switch (flag) {
+      case "-h":
+      case "--help":
+        return { help: true };
+      case "--endpoint":
+        options.endpoint = value();
+        break;
+      case "--key":
+        options.key = value();
+        break;
+      case "--service":
+        options.service = value();
+        break;
+      case "--environment":
+        options.environment = value();
+        break;
+      case "--release":
+        options.release = value();
+        break;
+      case "--json":
+        options.json = true;
+        break;
+      case "--wait": {
+        const n = ms("--wait");
+        if (typeof n !== "number") return n;
+        options.waitMs = n;
+        break;
+      }
+      case "--timeout": {
+        const n = ms("--timeout");
+        if (typeof n !== "number") return n;
+        options.timeoutMs = n;
+        break;
+      }
+      default:
+        return { error: `unknown option ${arg}` };
+    }
+  }
+  return options;
+}
+
+
+
+
+
+
+
+
+
+
+exports.runDoctor = runDoctor; exports.formatDoctorReport = formatDoctorReport; exports.DOCTOR_USAGE = DOCTOR_USAGE; exports.parseDoctorArgs = parseDoctorArgs; exports.runVerify = runVerify; exports.formatVerifyReport = formatVerifyReport; exports.VERIFY_USAGE = VERIFY_USAGE; exports.parseVerifyArgs = parseVerifyArgs;