@capxul/observability 4.2.0 → 4.20.0-beta.2

package/README.md

@@ -94,3 +94,17 @@ vp run --filter @capxul/observability build
 
 Read [`CONTEXT.md`](./CONTEXT.md) before changing event names, schemas,
 redaction, journeys, or adapter behavior.
+
+## Engineering composition
+
+Import `makeEngineeringTelemetryLayer` and `flushEngineeringTelemetry` from
+`@capxul/observability/engineering`. The layer shares OTLP logs, traces, and delta
+metrics. The flush Effect attempts delivery without claiming ingestion. Optional
+`enabled` stops collection for the acquired layer when false or when its callback
+throws. `shutdownTimeout` applies per exporter; a host can set it to zero after
+it runs an explicit flush under its own total deadline.
+
+Set `privacy: "minimal"` for hosts that must export only closed operation/error
+codes, timings, environment, and validated correlation. This opt-in removes
+free-form logs, provider messages, URLs, bodies, and source paths, including
+span exception events. Default consumers retain the existing redaction policy.

package/dist/engineering.d.mts

@@ -1,4 +1,4 @@
-import { Layer, Tracer } from "effect";
+import { Duration, Effect, Layer, Tracer } from "effect";
 import { OtlpExporter } from "effect/unstable/observability";
 //#region src/engineering.d.ts
 type EngineeringProducer = "browser" | "server";
@@ -11,15 +11,24 @@ interface EngineeringTelemetryConfig {
   readonly producer: EngineeringProducer;
   readonly sdkVersion: string;
   readonly serviceName?: string;
+  /** False or a thrown callback disables this acquired layer for its remaining lifetime. */
+  readonly enabled?: boolean | (() => boolean);
+  /** Codes, timings, and correlation only; no free text or private source paths. */
+  readonly privacy?: "minimal";
+  readonly shutdownTimeout?: Duration.Input;
+  readonly exportInterval?: Duration.Input;
 }
 declare const traceHeaderFilter: (_name: string) => boolean;
 declare const postHogOtlpEndpoints: (host: string) => {
   readonly logs: `${string}/i/v1/logs`;
   readonly traces: `${string}/i/v1/traces`;
+  readonly metrics: `${string}/i/v1/metrics`;
 };
 /** Preserve domain exits while preventing the OTLP serializer from seeing raw causes. */
-declare const makeLeakSafeEngineeringTracer: (delegate: Tracer.Tracer) => Tracer.Tracer;
+declare const makeLeakSafeEngineeringTracer: (delegate: Tracer.Tracer, enabled?: () => boolean) => Tracer.Tracer;
+/** Attempt to drain all engineering signals; completion does not prove ingestion. */
+declare const flushEngineeringTelemetry: Effect.Effect<void, never, OtlpExporter.Flusher>;
 /** Shared browser/server OTLP layer. OtlpLogger merges with incumbent loggers once. */
 declare const makeEngineeringTelemetryLayer: (config: EngineeringTelemetryConfig) => Layer.Layer<OtlpExporter.Flusher, never, never>;
 //#endregion
-export { ENGINEERING_CAPXUL_ENVS, EngineeringCapxulEnv, EngineeringProducer, EngineeringTelemetryConfig, makeEngineeringTelemetryLayer, makeLeakSafeEngineeringTracer, postHogOtlpEndpoints, traceHeaderFilter };
+export { ENGINEERING_CAPXUL_ENVS, EngineeringCapxulEnv, EngineeringProducer, EngineeringTelemetryConfig, flushEngineeringTelemetry, makeEngineeringTelemetryLayer, makeLeakSafeEngineeringTracer, postHogOtlpEndpoints, traceHeaderFilter };

package/dist/engineering.mjs

@@ -1,7 +1,7 @@
-import { i as redactUrlSecrets, n as isCredentialField, r as redactSecrets } from "./src-CWfRYsBI.mjs";
-import { Cause, Effect, Exit, FiberSet, Layer, Stream, Tracer } from "effect";
-import { FetchHttpClient, Headers, HttpClient } from "effect/unstable/http";
-import { OtlpExporter, OtlpLogger, OtlpSerialization, OtlpTracer } from "effect/unstable/observability";
+import { c as redactSecrets, i as CAPXUL_ERROR_CODES, l as redactUrlSecrets, n as isCapxulOperation, o as FAILURE_MODES, s as isCredentialField } from "./operations-sJPrehYY.mjs";
+import { Cause, Effect, Exit, FiberSet, Layer, Logger, Stream, Tracer } from "effect";
+import { FetchHttpClient, Headers, HttpBody, HttpClient, HttpClientResponse } from "effect/unstable/http";
+import { OtlpExporter, OtlpLogger, OtlpMetrics, OtlpSerialization, OtlpTracer } from "effect/unstable/observability";
 //#region src/engineering.ts
 const ENGINEERING_CAPXUL_ENVS = [
 	"development",
@@ -15,13 +15,18 @@ const postHogOtlpEndpoints = (host) => {
 	const base = host.replace(/\/+$/, "");
 	return {
 		logs: `${base}/i/v1/logs`,
-		traces: `${base}/i/v1/traces`
+		traces: `${base}/i/v1/traces`,
+		metrics: `${base}/i/v1/metrics`
 	};
 };
 const ENGINEERING_CAPXUL_ENV_SET = new Set(ENGINEERING_CAPXUL_ENVS);
 const ENGINEERING_PRODUCERS = /* @__PURE__ */ new Set(["browser", "server"]);
 const PUBLIC_POSTHOG_AUTHORIZATION = /^Bearer phc_[A-Za-z0-9_-]{1,191}$/u;
 const SAFE_RESOURCE_VALUE = /^[A-Za-z0-9][A-Za-z0-9._+@/-]{0,127}$/u;
+function validateEngineeringPrivacy(config) {
+	if (config.privacy !== void 0 && config.privacy !== "minimal") throw new TypeError("engineering telemetry privacy must be minimal when specified");
+	if (config.privacy === "minimal" && (!/^[A-Za-z0-9][A-Za-z0-9._+@-]{0,127}$/u.test(config.sdkVersion) || config.serviceName !== void 0 && !/^[A-Za-z0-9][A-Za-z0-9._+@-]{0,127}$/u.test(config.serviceName))) throw new TypeError("minimal engineering resource values must not contain paths");
+}
 const validateEngineeringTelemetryConfig = (config) => {
 	let url;
 	try {
@@ -32,6 +37,8 @@ const validateEngineeringTelemetryConfig = (config) => {
 	if (url.protocol !== "https:" || url.username.length > 0 || url.password.length > 0 || url.pathname !== "/" || url.search.length > 0 || url.hash.length > 0 || !(url.hostname === "posthog.com" || url.hostname.endsWith(".posthog.com"))) throw new TypeError("engineering telemetry host must be a credential-free HTTPS origin");
 	if (!ENGINEERING_CAPXUL_ENV_SET.has(config.capxulEnv)) throw new TypeError("engineering telemetry capxulEnv is not canonical");
 	if (!ENGINEERING_PRODUCERS.has(config.producer)) throw new TypeError("engineering telemetry producer is not canonical");
+	if (config.enabled !== void 0 && typeof config.enabled !== "boolean" && typeof config.enabled !== "function") throw new TypeError("engineering telemetry enabled must be a boolean or callback");
+	validateEngineeringPrivacy(config);
 	if (!SAFE_RESOURCE_VALUE.test(config.sdkVersion)) throw new TypeError("engineering telemetry sdkVersion must be a bounded safe value");
 	if (config.serviceName !== void 0 && !SAFE_RESOURCE_VALUE.test(config.serviceName)) throw new TypeError("engineering telemetry serviceName must be a bounded safe value");
 	const headerEntries = Object.entries(config.headers);
@@ -82,25 +89,34 @@ const spanUpstream = (span) => {
 	let current = span;
 	while (current?._tag === "Span") {
 		const upstream = current.attributes.get("chain.upstream");
-		if (upstream === "alchemy" || upstream === "infura") return upstream;
+		if (upstream === "alchemy" || upstream === "infura" || upstream === "gateway") return upstream;
 		current = current.parent._tag === "Some" ? current.parent.value : void 0;
 	}
 };
+function redactHttpPath(path, fullUrl, source) {
+	let origin = "https://redaction.invalid";
+	try {
+		const url = new URL(String(fullUrl));
+		if (url.protocol === "https:" || url.protocol === "http:") origin = url.origin;
+	} catch {}
+	const prefix = path.startsWith("/") ? origin : "";
+	return redactUrlSecrets(`${prefix}${path}`, source).slice(prefix.length, prefix.length + 2048);
+}
 /** Preserve domain exits while preventing the OTLP serializer from seeing raw causes. */
-const makeLeakSafeEngineeringTracer = (delegate) => Tracer.make({
+const makeLeakSafeEngineeringTracer = (delegate, enabled = () => true) => Tracer.make({
 	span(options) {
-		const span = delegate.span(options);
+		const span = enabled() ? delegate.span(options) : new Tracer.NativeSpan(options);
 		const wrapped = Object.create(span);
 		Object.defineProperty(wrapped, "attribute", { value: (name, value) => {
 			const source = spanUpstream(span);
 			const header = /^http\.(?:request|response)\.header\.(.+)$/u.exec(name)?.[1];
 			if (header !== void 0 && isCredentialField(header, "header")) span.attribute(name, "[REDACTED]");
 			else if (typeof value === "string" && name === "url.query") span.attribute(name, redactUrlSecrets(`?${value}`).slice(1, 2049));
-			else if (typeof value === "string" && name === "url.path") {
-				const fullUrl = span.attributes.get("url.full");
-				const path = typeof fullUrl === "string" ? /^https?:\/\/[^/]+([^?#]*)/u.exec(fullUrl)?.[1] ?? value : value;
-				span.attribute(name, redactUrlSecrets(path, source).slice(0, 2048));
-			} else if (typeof value === "string" && (name === "url.full" || header === "location" || header === "referer" || header === "referrer")) span.attribute(name, redactUrlSecrets(value, source).slice(0, 2048));
+			else if (typeof value === "string" && (name === "url.path" || name === "http.target")) {
+				const fullUrl = span.attributes.get("url.full") ?? span.attributes.get("http.url");
+				const path = name === "url.path" && typeof fullUrl === "string" ? /^https?:\/\/[^/]+([^?#]*)/u.exec(fullUrl)?.[1] ?? value : value;
+				span.attribute(name, redactHttpPath(path, fullUrl, source));
+			} else if (typeof value === "string" && (name === "url.full" || name === "http.url" || header === "location" || header === "referer" || header === "referrer")) span.attribute(name, redactUrlSecrets(value, source).slice(0, 2048));
 			else if (header !== void 0 && typeof value === "string") span.attribute(name, redactSecrets(value, source).slice(0, 2048));
 			else span.attribute(name, value);
 		} });
@@ -108,6 +124,15 @@ const makeLeakSafeEngineeringTracer = (delegate) => Tracer.make({
 			configurable: false,
 			enumerable: false,
 			value: (endTime, exit) => {
+				if (!enabled()) {
+					Object.defineProperty(wrapped, "status", { value: {
+						_tag: "Ended",
+						startTime: span.status.startTime,
+						endTime,
+						exit
+					} });
+					return;
+				}
 				if (Exit.isFailure(exit) && !Cause.hasInterruptsOnly(exit.cause)) {
 					const first = exit.cause.reasons.find((reason) => !Cause.isInterruptReason(reason));
 					const code = failureText(first === void 0 ? void 0 : Cause.isFailReason(first) ? first.error : first.defect, "code", 128);
@@ -121,53 +146,361 @@ const makeLeakSafeEngineeringTracer = (delegate) => Tracer.make({
 	},
 	...delegate.context === void 0 ? {} : { context: delegate.context.bind(delegate) }
 });
+const MINIMAL_LOG_NAMES = /* @__PURE__ */ new Set([
+	"capxul_sdk_operation",
+	"identity.transition",
+	"convex.connection.changed",
+	"convex.action.connection_lost",
+	"cli.command.completed",
+	"cli.sdk.operation.failed"
+]);
+const MINIMAL_ERROR_CODES = /* @__PURE__ */ new Set([
+	...CAPXUL_ERROR_CODES,
+	"CLI_USAGE",
+	"CLI_CONFIG",
+	"CLI_STORAGE",
+	"CLI_DEFECT"
+]);
+const MINIMAL_NUMBERS = /* @__PURE__ */ new Set([
+	"schema_version",
+	"duration_ms",
+	"wait_duration_ms",
+	"retry_count",
+	"http.status_code",
+	"http.response.status_code",
+	"http_status",
+	"rpc.code",
+	"connection_count",
+	"connection_retries"
+]);
+const MINIMAL_CORRELATIONS = /* @__PURE__ */ new Set([
+	"correlation_id",
+	"journey_id",
+	"invocation_id"
+]);
+const MINIMAL_METRIC_LABELS = /* @__PURE__ */ new Set([
+	"command",
+	"outcome",
+	"capxul_env",
+	"unit"
+]);
+const MINIMAL_METRIC_NAMES = /* @__PURE__ */ new Set(["capxul.cli.command.count", "capxul.cli.command.duration"]);
+const traceId = (value) => typeof value === "string" && /^(?!0+$)[0-9a-f]{32}$/u.test(value);
+const spanId = (value) => typeof value === "string" && /^(?!0+$)[0-9a-f]{16}$/u.test(value);
+const minimalName = (value) => typeof value === "string" && (MINIMAL_LOG_NAMES.has(value) || isCapxulOperation(value)) ? value : "capxul.engineering";
+const MINIMAL_ENUM_VALUES = /* @__PURE__ */ new Map([
+	["outcome", [
+		"succeeded",
+		"refused",
+		"failed",
+		"cancelled",
+		"applied"
+	]],
+	["mode", FAILURE_MODES],
+	["failure_mode", FAILURE_MODES],
+	["capxul_env", ENGINEERING_CAPXUL_ENVS],
+	["producer", ["browser", "server"]],
+	["command", ["doctor"]],
+	["output_mode", ["human", "json"]],
+	["unit", [
+		"1",
+		"s",
+		"ms"
+	]]
+]);
+const MINIMAL_CODE_KEYS = /* @__PURE__ */ new Set([
+	"error.code",
+	"error_code",
+	"failure_code",
+	"refusal_code",
+	"capxul_error_code"
+]);
+const MINIMAL_VERSION_KEYS = /* @__PURE__ */ new Set([
+	"sdk_version",
+	"cli_version",
+	"release"
+]);
+function minimalStringValue(key, text) {
+	if (key === "operation") return isCapxulOperation(text);
+	if (MINIMAL_CODE_KEYS.has(key)) return MINIMAL_ERROR_CODES.has(text);
+	if (MINIMAL_VERSION_KEYS.has(key)) return /^[A-Za-z0-9][A-Za-z0-9._+@-]{0,127}$/u.test(text);
+	if (key === "trace_id") return traceId(text);
+	if (key === "span_id" || key === "parent_span_id") return spanId(text);
+	const values = MINIMAL_ENUM_VALUES.get(key);
+	if (values !== void 0) return values.includes(text);
+	return MINIMAL_CORRELATIONS.has(key) && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(text) && !/^0x[0-9a-f]+$/iu.test(text) && redactSecrets(text) === text;
+}
+/** A named privacy projection, separate from the default credential-only redaction policy. */
+function minimalAttributes(attributes, metric = false) {
+	return attributes.flatMap(({ key, value }) => {
+		if (metric && !MINIMAL_METRIC_LABELS.has(key)) return [];
+		const text = value.stringValue;
+		const number = value.doubleValue ?? value.intValue;
+		if (MINIMAL_NUMBERS.has(key) && typeof number === "number" && Number.isFinite(number)) return [{
+			key,
+			value: { doubleValue: number }
+		}];
+		if (typeof text !== "string") return [];
+		return minimalStringValue(key, text) ? [{
+			key,
+			value: { stringValue: text }
+		}] : [];
+	});
+}
+const finiteProtocolNumber = (value) => typeof value === "number" && Number.isFinite(value) ? value : void 0;
+const protocolCount = (value, maximum = Number.MAX_SAFE_INTEGER) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && value <= maximum ? value : void 0;
+const protocolFlags = (value) => protocolCount(Object.getOwnPropertyDescriptor(value, "flags")?.value, 4294967295);
+function protocolTime(value) {
+	if (typeof value === "string" && /^\d{1,20}$/u.test(value) && BigInt(value) <= 18446744073709551615n) return value;
+	const number = protocolCount(value);
+	if (number !== void 0) return String(number);
+	if (value === null || typeof value !== "object") return void 0;
+	const low = protocolCount(Object.getOwnPropertyDescriptor(value, "low")?.value, 4294967295);
+	const high = protocolCount(Object.getOwnPropertyDescriptor(value, "high")?.value, 4294967295);
+	return low === void 0 || high === void 0 ? void 0 : (BigInt(high) << 32n | BigInt(low)).toString();
+}
+function minimalNumberPoints(points) {
+	return points.flatMap((point) => {
+		const attributes = minimalAttributes(point.attributes, true);
+		const asDouble = finiteProtocolNumber(point.asDouble);
+		const asInt = typeof point.asInt === "number" && Number.isSafeInteger(point.asInt) ? point.asInt : void 0;
+		if (attributes.length !== point.attributes.length || asDouble === void 0 && asInt === void 0) return [];
+		return [{
+			attributes,
+			timeUnixNano: protocolTime(point.timeUnixNano),
+			startTimeUnixNano: protocolTime(point.startTimeUnixNano),
+			asDouble,
+			asInt: asDouble === void 0 ? asInt : void 0,
+			flags: protocolFlags(point)
+		}];
+	});
+}
+function minimalHistogramPoints(points) {
+	return points.flatMap((point) => {
+		const attributes = minimalAttributes(point.attributes ?? [], true);
+		const count = protocolCount(point.count);
+		const bucketCounts = point.bucketCounts;
+		const explicitBounds = point.explicitBounds;
+		if (attributes.length !== (point.attributes?.length ?? 0) || count === void 0 || !Array.isArray(bucketCounts) || !bucketCounts.every((value) => protocolCount(value) !== void 0) || !Array.isArray(explicitBounds) || !explicitBounds.every((value) => finiteProtocolNumber(value) !== void 0) || bucketCounts.length !== explicitBounds.length + 1) return [];
+		return [{
+			attributes,
+			timeUnixNano: protocolTime(point.timeUnixNano),
+			startTimeUnixNano: protocolTime(point.startTimeUnixNano),
+			count,
+			sum: finiteProtocolNumber(point.sum),
+			min: finiteProtocolNumber(point.min),
+			max: finiteProtocolNumber(point.max),
+			bucketCounts: bucketCounts.map((value) => value),
+			explicitBounds: explicitBounds.map((value) => value),
+			flags: protocolFlags(point)
+		}];
+	});
+}
+function minimalSerialization(config) {
+	const service = config.serviceName ?? "capxul-sdk";
+	const resource = { attributes: Object.entries({
+		"service.name": service,
+		"service.version": config.sdkVersion,
+		sdk_version: config.sdkVersion,
+		capxul_env: config.capxulEnv,
+		producer: config.producer
+	}).map(([key, value]) => ({
+		key,
+		value: { stringValue: value }
+	})) };
+	return {
+		logs: (data) => HttpBody.jsonUnsafe({ resourceLogs: data.resourceLogs.map((entry) => ({
+			resource,
+			scopeLogs: entry.scopeLogs.map((scope) => ({
+				scope: { name: service },
+				logRecords: (scope.logRecords ?? []).map((record) => ({
+					timeUnixNano: protocolTime(record.timeUnixNano),
+					observedTimeUnixNano: protocolTime(record.observedTimeUnixNano),
+					severityNumber: protocolCount(record.severityNumber, 24),
+					severityText: [
+						"All",
+						"Trace",
+						"Debug",
+						"Info",
+						"Warn",
+						"Error",
+						"Fatal",
+						"None"
+					].includes(record.severityText ?? "") ? record.severityText : void 0,
+					body: { stringValue: minimalName(record.body?.stringValue) },
+					attributes: minimalAttributes(record.attributes),
+					droppedAttributesCount: protocolCount(record.droppedAttributesCount) ?? 0,
+					traceId: traceId(record.traceId) ? record.traceId : void 0,
+					spanId: spanId(record.spanId) ? record.spanId : void 0,
+					flags: protocolFlags(record)
+				}))
+			}))
+		})) }),
+		traces: (data) => HttpBody.jsonUnsafe({ resourceSpans: data.resourceSpans.map((entry) => ({
+			resource,
+			scopeSpans: entry.scopeSpans.map((scope) => ({
+				scope: { name: service },
+				spans: scope.spans.filter((span) => traceId(span.traceId) && spanId(span.spanId)).map((span) => {
+					const attributes = minimalAttributes(span.attributes);
+					const code = attributes.find((attribute) => attribute.key === "error.code");
+					return {
+						traceId: span.traceId,
+						spanId: span.spanId,
+						name: minimalName(span.name),
+						kind: protocolCount(span.kind, 5) ?? 0,
+						startTimeUnixNano: protocolTime(span.startTimeUnixNano),
+						endTimeUnixNano: protocolTime(span.endTimeUnixNano),
+						attributes,
+						droppedAttributesCount: protocolCount(span.droppedAttributesCount) ?? 0,
+						parentSpanId: spanId(span.parentSpanId) ? span.parentSpanId : void 0,
+						flags: protocolFlags(span),
+						status: { code: protocolCount(span.status.code, 2) ?? 0 },
+						events: span.events.slice(0, 8).map((event) => ({
+							timeUnixNano: protocolTime(event.timeUnixNano),
+							droppedAttributesCount: protocolCount(event.droppedAttributesCount) ?? 0,
+							name: event.name === "exception" ? "exception" : minimalName(event.name),
+							attributes: event.name === "exception" ? [{
+								key: "exception.type",
+								value: code?.value ?? { stringValue: "Error" }
+							}] : minimalAttributes(event.attributes)
+						})),
+						droppedEventsCount: protocolCount(span.droppedEventsCount) ?? 0,
+						links: span.links.filter((link) => traceId(link.traceId) && spanId(link.spanId)).slice(0, 8).map((link) => ({
+							traceId: link.traceId,
+							spanId: link.spanId,
+							flags: protocolFlags(link),
+							attributes: minimalAttributes(link.attributes),
+							droppedAttributesCount: protocolCount(link.droppedAttributesCount) ?? 0
+						})),
+						droppedLinksCount: protocolCount(span.droppedLinksCount) ?? 0
+					};
+				})
+			}))
+		})) }),
+		metrics: (data) => {
+			const resourceMetrics = data.resourceMetrics.map((entry) => ({
+				resource,
+				scopeMetrics: entry.scopeMetrics.map((scope) => ({
+					scope: { name: service },
+					metrics: scope.metrics.filter((metric) => MINIMAL_METRIC_NAMES.has(metric.name)).flatMap((metric) => {
+						const gauge = metric.gauge === void 0 ? void 0 : { dataPoints: minimalNumberPoints(metric.gauge.dataPoints) };
+						const sum = metric.sum === void 0 ? void 0 : {
+							aggregationTemporality: protocolCount(metric.sum.aggregationTemporality, 2) ?? 0,
+							isMonotonic: metric.sum.isMonotonic === true,
+							dataPoints: minimalNumberPoints(metric.sum.dataPoints)
+						};
+						const histogram = metric.histogram === void 0 ? void 0 : {
+							aggregationTemporality: protocolCount(metric.histogram.aggregationTemporality, 2) ?? 0,
+							dataPoints: minimalHistogramPoints(metric.histogram.dataPoints)
+						};
+						if (![
+							gauge,
+							sum,
+							histogram
+						].some((series) => (series?.dataPoints.length ?? 0) > 0)) return [];
+						return [{
+							name: metric.name,
+							unit: [
+								"1",
+								"s",
+								"ms"
+							].includes(metric.unit ?? "") ? metric.unit : "1",
+							...gauge === void 0 ? {} : { gauge },
+							...sum === void 0 ? {} : { sum },
+							...histogram === void 0 ? {} : { histogram }
+						}];
+					})
+				}))
+			}));
+			return resourceMetrics.some((entry) => entry.scopeMetrics.some((scope) => scope.metrics.length > 0)) ? HttpBody.jsonUnsafe({ resourceMetrics }) : HttpBody.empty;
+		}
+	};
+}
+/** Attempt to drain all engineering signals; completion does not prove ingestion. */
+const flushEngineeringTelemetry = Effect.flatMap(OtlpExporter.Flusher, (flusher) => flusher.flush);
 /** Shared browser/server OTLP layer. OtlpLogger merges with incumbent loggers once. */
 const makeEngineeringTelemetryLayer = (config) => {
 	const validated = validateEngineeringTelemetryConfig(config);
-	const endpoints = postHogOtlpEndpoints(validated.host);
-	const resource = {
-		serviceName: validated.serviceName ?? "capxul-sdk",
-		serviceVersion: validated.sdkVersion,
-		attributes: {
-			capxul_env: validated.capxulEnv,
-			producer: validated.producer,
-			sdk_version: validated.sdkVersion
-		}
-	};
-	const tracing = Layer.effect(Tracer.Tracer, OtlpTracer.make({
-		url: endpoints.traces,
-		headers: validated.headers,
-		resource
-	}).pipe(Effect.map(makeLeakSafeEngineeringTracer))).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));
-	const logging = OtlpLogger.layer({
-		url: endpoints.logs,
-		headers: validated.headers,
-		resource,
-		mergeWithExisting: true
-	});
-	const headerPolicy = Layer.merge(Layer.succeed(HttpClient.TracerHeaderFilter, traceHeaderFilter), Layer.succeed(Headers.CurrentRedactedNames, [credentialHeaderPattern]));
-	const browserLifecycle = Layer.effectDiscard(Effect.gen(function* () {
-		if (validated.producer !== "browser" || !hasBrowserDocument()) return;
-		const browserWindow = window;
-		const browserDocument = document;
-		const flusher = yield* OtlpExporter.Flusher;
-		const run = yield* FiberSet.makeRuntime();
-		const flush = () => {
-			run(flusher.flush);
+	return Layer.suspend(() => {
+		const endpoints = postHogOtlpEndpoints(validated.host);
+		let disabled = false;
+		const enabled = () => {
+			if (disabled) return false;
+			try {
+				disabled = (typeof validated.enabled === "function" ? validated.enabled() : validated.enabled ?? true) !== true;
+			} catch {
+				disabled = true;
+			}
+			return !disabled;
 		};
-		const visibilityChanged = () => {
-			if (browserDocument.visibilityState === "hidden") flush();
+		const delivery = {
+			...validated.shutdownTimeout === void 0 ? {} : { shutdownTimeout: validated.shutdownTimeout },
+			...validated.exportInterval === void 0 ? {} : { exportInterval: validated.exportInterval }
 		};
-		yield* Effect.acquireRelease(Effect.sync(() => {
-			browserDocument.addEventListener("visibilitychange", visibilityChanged);
-			browserWindow.addEventListener("pagehide", flush);
-		}), () => Effect.sync(() => {
-			browserDocument.removeEventListener("visibilitychange", visibilityChanged);
-			browserWindow.removeEventListener("pagehide", flush);
+		const resource = {
+			serviceName: validated.serviceName ?? "capxul-sdk",
+			serviceVersion: validated.sdkVersion,
+			attributes: {
+				capxul_env: validated.capxulEnv,
+				producer: validated.producer,
+				sdk_version: validated.sdkVersion
+			}
+		};
+		const tracing = Layer.effect(Tracer.Tracer, OtlpTracer.make({
+			url: endpoints.traces,
+			headers: validated.headers,
+			resource,
+			...delivery
+		}).pipe(Effect.map((tracer) => makeLeakSafeEngineeringTracer(tracer, enabled)))).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));
+		const logging = Logger.layer([OtlpLogger.make({
+			url: endpoints.logs,
+			headers: validated.headers,
+			resource,
+			...delivery
+		}).pipe(Effect.map((logger) => Logger.make((options) => {
+			if (enabled()) logger.log(options);
+		})))], { mergeWithExisting: true }).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));
+		const metrics = OtlpMetrics.layer({
+			url: endpoints.metrics,
+			headers: validated.headers,
+			resource,
+			temporality: "delta",
+			...delivery
+		});
+		const headerPolicy = Layer.merge(Layer.succeed(HttpClient.TracerHeaderFilter, traceHeaderFilter), Layer.succeed(Headers.CurrentRedactedNames, [credentialHeaderPattern]));
+		const browserLifecycle = Layer.effectDiscard(Effect.gen(function* () {
+			if (validated.producer !== "browser" || !hasBrowserDocument()) return;
+			const browserWindow = window;
+			const browserDocument = document;
+			const flusher = yield* OtlpExporter.Flusher;
+			const run = yield* FiberSet.makeRuntime();
+			const flush = () => {
+				run(flusher.flush);
+			};
+			const visibilityChanged = () => {
+				if (browserDocument.visibilityState === "hidden") flush();
+			};
+			yield* Effect.acquireRelease(Effect.sync(() => {
+				browserDocument.addEventListener("visibilitychange", visibilityChanged);
+				browserWindow.addEventListener("pagehide", flush);
+			}), () => Effect.sync(() => {
+				browserDocument.removeEventListener("visibilitychange", visibilityChanged);
+				browserWindow.removeEventListener("pagehide", flush);
+			}));
 		}));
-	}));
-	const transport = Layer.effect(HttpClient.HttpClient, Effect.map(HttpClient.HttpClient, (client) => validated.producer === "browser" && hasBrowserDocument() ? browserExportClient(client) : client)).pipe(Layer.provide(FetchHttpClient.layer));
-	return browserLifecycle.pipe(Layer.provideMerge(Layer.mergeAll(tracing, logging, headerPolicy)), Layer.provide(OtlpSerialization.layerJson), Layer.provide(transport));
+		const transport = Layer.effect(HttpClient.HttpClient, Effect.map(HttpClient.HttpClient, (client) => {
+			const selectedTransport = validated.producer === "browser" && hasBrowserDocument() ? browserExportClient(client) : client;
+			return HttpClient.transform(selectedTransport, (response, request) => Effect.suspend(() => enabled() && request.body._tag !== "Empty" ? response : Effect.succeed(HttpClientResponse.fromWeb(request, new Response(null, { status: 200 })))));
+		})).pipe(Layer.provide(FetchHttpClient.layer));
+		const serialization = Layer.effect(OtlpSerialization.OtlpSerialization, Effect.map(OtlpSerialization.OtlpSerialization, (json) => {
+			const projected = minimalSerialization(validated);
+			return validated.privacy === "minimal" ? projected : {
+				...json,
+				metrics: projected.metrics
+			};
+		})).pipe(Layer.provide(OtlpSerialization.layerJson));
+		return browserLifecycle.pipe(Layer.provideMerge(Layer.mergeAll(tracing, logging, metrics, headerPolicy)), Layer.provide(serialization), Layer.provide(transport));
+	});
 };
 //#endregion
-export { ENGINEERING_CAPXUL_ENVS, makeEngineeringTelemetryLayer, makeLeakSafeEngineeringTracer, postHogOtlpEndpoints, traceHeaderFilter };
+export { ENGINEERING_CAPXUL_ENVS, flushEngineeringTelemetry, makeEngineeringTelemetryLayer, makeLeakSafeEngineeringTracer, postHogOtlpEndpoints, traceHeaderFilter };