@codemieai/code 0.15.5 → 0.15.7

package/dist/providers/plugins/sso/proxy/plugins/otlp-spool/forwarder.js

@@ -0,0 +1,287 @@
+import { logger } from '../../../../../../utils/logger.js';
+import { sanitizeLogArgs } from '../../../../../../utils/security.js';
+import { isSSOCredentials, isJWTCredentials } from '../../../../../core/types.js';
+import { buildAuthHeaders } from '../../../../../core/codemie-auth-helpers.js';
+import { CODEMIE_ENDPOINTS } from '../../../sso.http-client.js';
+import { OTEL_STREAMS } from './spool-paths.js';
+import { advanceCursor, markSessionEnded, } from './session-status.js';
+import { snapshotPendingBytes, snapshotPendingHookRecords } from './spool-io.js';
+import { areCredentialsStale, markCredentialsStale } from './auth-state.js';
+const HOOK_EVENT_TYPE_MAP = {
+    SessionStart: 'agent.session.start',
+    Stop: 'agent.session.stop',
+    StopFailure: 'agent.turn.error',
+    SessionEnd: 'agent.session.end',
+    UserPromptSubmit: 'agent.prompt.submit',
+    PreToolUse: 'agent.tool.start',
+    PostToolUse: 'agent.tool.end',
+    PostToolUseFailure: 'agent.tool.error',
+    SubagentStart: 'agent.subagent.start',
+    SubagentStop: 'agent.subagent.stop',
+    PreCompact: 'agent.session.compact',
+    Notification: 'agent.notification',
+};
+const OTEL_ENDPOINTS = {
+    logs: CODEMIE_ENDPOINTS.CLI_ANALYTICS_LOGS,
+    metrics: CODEMIE_ENDPOINTS.CLI_ANALYTICS_METRICS,
+    traces: CODEMIE_ENDPOINTS.CLI_ANALYTICS_TRACES,
+};
+const MAX_PROMPT_CHARS = 200;
+const MAX_TOOL_FIELD_CHARS = 300;
+const FORWARD_TIMEOUT_MS = 20_000;
+/* ------------------------------------------------------------------ auth --- */
+function decodeJwtClaims(token) {
+    const parts = token.split('.');
+    if (parts.length < 2)
+        return {};
+    try {
+        return JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf-8'));
+    }
+    catch {
+        return {};
+    }
+}
+function resolveUserEmail(credentials) {
+    if (isJWTCredentials(credentials)) {
+        const claims = decodeJwtClaims(credentials.token);
+        if (typeof claims['email'] === 'string' && claims['email'])
+            return claims['email'];
+    }
+    if (isSSOCredentials(credentials)) {
+        const accessToken = credentials.cookies['codemie_access_token'];
+        if (accessToken) {
+            const claims = decodeJwtClaims(accessToken);
+            const email = claims['email'] ?? claims['preferred_username'];
+            if (typeof email === 'string' && email)
+                return email;
+        }
+    }
+    return '';
+}
+function buildAuthHeadersFromCreds(credentials) {
+    if (isSSOCredentials(credentials))
+        return buildAuthHeaders(credentials.cookies);
+    if (isJWTCredentials(credentials))
+        return buildAuthHeaders(credentials.token);
+    return null;
+}
+/* ------------------------------------------------------------------ http --- */
+async function postToBackend(url, body, contentType, credentials) {
+    const headers = buildAuthHeadersFromCreds(credentials);
+    if (!headers)
+        throw new Error('Unsupported credential type');
+    headers['Content-Type'] = contentType;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), FORWARD_TIMEOUT_MS);
+    try {
+        return await fetch(url, { method: 'POST', headers, body, signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+const isAuthFailure = (response) => response.status === 401 || response.status === 403;
+/**
+ * POST a batch, retrying once on 401/403. Anything other than `'ok'` leaves the
+ * bytes on disk with the cursor untouched, so the next tick retries them.
+ */
+async function send(sessionId, stream, url, body, contentType, credentials) {
+    if (areCredentialsStale()) {
+        return 'failed';
+    }
+    try {
+        let response = await postToBackend(url, body, contentType, credentials);
+        if (isAuthFailure(response)) {
+            response = await postToBackend(url, body, contentType, credentials);
+            if (isAuthFailure(response))
+                return 'auth-expired';
+        }
+        if (response.ok) {
+            return 'ok';
+        }
+        logger.debug('[otlp-forwarder] non-success response', ...sanitizeLogArgs({ sessionId, stream, status: response.status }));
+        return 'failed';
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        logger.debug('[otlp-forwarder] request error', ...sanitizeLogArgs({ sessionId, stream, err: msg }));
+        return 'failed';
+    }
+}
+/* --------------------------------------------------------------- mapping --- */
+function hookEventType(hookName, event) {
+    if (hookName === 'PreToolUse') {
+        return event['input'] && event['input']['denied']
+            ? 'agent.tool.denied'
+            : 'agent.tool.start';
+    }
+    return HOOK_EVENT_TYPE_MAP[hookName] ?? 'agent.event';
+}
+function boundedText(value, maxChars) {
+    if (value === undefined || value === null)
+        return '';
+    const text = typeof value === 'string'
+        ? value
+        : (() => {
+            try {
+                return JSON.stringify(value) ?? String(value);
+            }
+            catch {
+                return String(value);
+            }
+        })();
+    return text.slice(0, maxChars);
+}
+function limitHookPayload(hookEvent) {
+    const limited = { ...hookEvent };
+    if (Object.prototype.hasOwnProperty.call(hookEvent, 'prompt')) {
+        limited.prompt = boundedText(hookEvent.prompt, MAX_PROMPT_CHARS);
+    }
+    for (const field of ['tool_input', 'tool_response', 'error']) {
+        if (Object.prototype.hasOwnProperty.call(hookEvent, field)) {
+            limited[field] = boundedText(hookEvent[field], MAX_TOOL_FIELD_CHARS);
+        }
+    }
+    // Prevent a nested/raw copy from bypassing the limits.
+    delete limited.raw;
+    return limited;
+}
+async function resolveGitInfo(ctx, cwd) {
+    if (!cwd || ctx.git.branch !== undefined)
+        return;
+    try {
+        const { detectGitBranch, detectGitRemoteRepo } = await import('../../../../../../utils/processes.js');
+        const [branch, remote] = await Promise.all([
+            detectGitBranch(cwd).then((v) => v ?? ''),
+            detectGitRemoteRepo(cwd).then((v) => v ?? ''),
+        ]);
+        ctx.git.branch = branch;
+        ctx.git.remote = remote;
+    }
+    catch {
+        /* best-effort */
+    }
+}
+async function mapHookRecords(records, ctx) {
+    const mapped = [];
+    let containsSessionEnd = false;
+    let malformed = 0;
+    for (const record of records) {
+        let spoolData;
+        let hookEvent;
+        try {
+            spoolData = JSON.parse(record);
+            hookEvent = JSON.parse(spoolData.raw);
+        }
+        catch {
+            // Complete but unusable record: dropped deliberately. Its bytes are still
+            // acknowledged with the batch so the cursor can never get stuck on it.
+            malformed += 1;
+            continue;
+        }
+        const hookName = String(hookEvent['hook_event_name'] ?? '');
+        if (hookName === 'SessionEnd')
+            containsSessionEnd = true;
+        const cwd = String(hookEvent['cwd'] ?? '');
+        await resolveGitInfo(ctx, cwd);
+        const limited = limitHookPayload(hookEvent);
+        mapped.push(JSON.stringify({
+            ...limited,
+            type: hookEventType(hookName, hookEvent),
+            session_id: String(hookEvent['session_id'] ?? ''),
+            timestamp: new Date(spoolData.timestamp).toISOString(),
+            user_email: ctx.userEmail,
+            developer_name: ctx.userEmail,
+            git_branch: ctx.git.branch ?? '',
+            repo_remote: ctx.git.remote ?? '',
+            codemie_project_name: ctx.projectName,
+            cwd,
+            prompt_body: boundedText(hookEvent['prompt'], MAX_PROMPT_CHARS),
+            raw: limited,
+        }));
+    }
+    return {
+        ndjson: mapped.length > 0 ? `${mapped.join('\n')}\n` : '',
+        containsSessionEnd,
+        malformed,
+    };
+}
+/* ------------------------------------------------------------ forwarding --- */
+async function buildForwardContext(credentials) {
+    const { readState } = await import('../../../../../../cli/commands/proxy/daemon-manager.js');
+    const state = await readState();
+    return {
+        credentials,
+        baseUrl: state?.targetUrl ?? state?.url ?? '',
+        projectName: state?.project ?? '',
+        userEmail: resolveUserEmail(credentials),
+        git: {},
+    };
+}
+/** Forward the complete hook records after the hooks cursor. */
+async function forwardHooks(sessionId, ctx) {
+    const batch = await snapshotPendingHookRecords(sessionId);
+    if (!batch) {
+        return 'idle';
+    }
+    const payload = await mapHookRecords(batch.records, ctx);
+    if (payload.malformed > 0) {
+        logger.debug('[otlp-forwarder] skipped malformed hook records', ...sanitizeLogArgs({ sessionId, count: payload.malformed }));
+    }
+    if (payload.ndjson.length === 0) {
+        // Nothing sendable, but the bytes were consumed — keep the cursor aligned.
+        await advanceCursor(sessionId, 'hooks', batch.cursor + batch.byteLength);
+        return 'idle';
+    }
+    const url = `${ctx.baseUrl}${CODEMIE_ENDPOINTS.CLI_ANALYTICS_EVENT_HOOKS}`;
+    const result = await send(sessionId, 'hooks', url, payload.ndjson, 'application/x-ndjson', ctx.credentials);
+    if (result !== 'ok')
+        return result;
+    await advanceCursor(sessionId, 'hooks', batch.cursor + batch.byteLength);
+    if (payload.containsSessionEnd) {
+        await markSessionEnded(sessionId);
+    }
+    return 'ok';
+}
+/** Forward the raw protobuf bytes after an OTEL stream's cursor. */
+async function forwardOtelStream(sessionId, stream, ctx) {
+    const pending = await snapshotPendingBytes(sessionId, stream);
+    if (!pending)
+        return 'idle';
+    const url = `${ctx.baseUrl}${OTEL_ENDPOINTS[stream]}`;
+    const result = await send(sessionId, stream, url, pending.bytes, 'application/x-protobuf', ctx.credentials);
+    if (result !== 'ok')
+        return result;
+    await advanceCursor(sessionId, stream, pending.cursor + pending.bytes.length);
+    return 'ok';
+}
+/**
+ * Forward everything a session has pending to the CodeMie analytics backend.
+ *
+ * Each stream is read from its own cursor and acknowledged independently, so a
+ * failure on one stream never blocks or rewinds another. Cursors only advance
+ * after a successful response, which yields at-least-once delivery: a crash
+ * between backend success and cursor persistence re-sends that batch.
+ *
+ * A forwarded `SessionEnd` only records `endedAt`; it never stops later ticks
+ * from delivering bytes that failed or were appended afterwards.
+ */
+export async function forwardSession(sessionId, hooksOnly, credentials) {
+    const ctx = await buildForwardContext(credentials);
+    const hooksResult = await forwardHooks(sessionId, ctx);
+    if (hooksResult === 'auth-expired') {
+        markCredentialsStale();
+        return;
+    }
+    if (hooksOnly) {
+        return;
+    }
+    for (const stream of OTEL_STREAMS) {
+        const result = await forwardOtelStream(sessionId, stream, ctx);
+        if (result === 'auth-expired') {
+            markCredentialsStale();
+            return;
+        }
+    }
+}
+//# sourceMappingURL=forwarder.js.map

package/dist/providers/plugins/sso/proxy/plugins/otlp-spool/forwarder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forwarder.js","sourceRoot":"","sources":["../../../../../../../src/providers/plugins/sso/proxy/plugins/otlp-spool/forwarder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAmB,MAAM,kBAAkB,CAAC;AACjE,OAAO,EACL,aAAa,EACb,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5E,MAAM,mBAAmB,GAA2B;IAClD,YAAY,EAAE,qBAAqB;IACnC,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EAAE,kBAAkB;IAC/B,UAAU,EAAE,mBAAmB;IAC/B,gBAAgB,EAAE,qBAAqB;IACvC,UAAU,EAAE,kBAAkB;IAC9B,WAAW,EAAE,gBAAgB;IAC7B,kBAAkB,EAAE,kBAAkB;IACtC,aAAa,EAAE,sBAAsB;IACrC,YAAY,EAAE,qBAAqB;IACnC,UAAU,EAAE,uBAAuB;IACnC,YAAY,EAAE,oBAAoB;CACnC,CAAC;AAEF,MAAM,cAAc,GAA+B;IACjD,IAAI,EAAE,iBAAiB,CAAC,kBAAkB;IAC1C,OAAO,EAAE,iBAAiB,CAAC,qBAAqB;IAChD,MAAM,EAAE,iBAAiB,CAAC,oBAAoB;CAC/C,CAAC;AAEF,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAalC,iFAAiF;AAEjF,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAGrE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,WAA4C;IACpE,IAAI,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC;YAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAChE,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,oBAAoB,CAAC,CAAC;YAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,yBAAyB,CAChC,WAA4C;IAE5C,IAAI,gBAAgB,CAAC,WAAW,CAAC;QAAE,OAAO,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAChF,IAAI,gBAAgB,CAAC,WAAW,CAAC;QAAE,OAAO,gBAAgB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AAEjF,KAAK,UAAU,aAAa,CAC1B,GAAW,EACX,IAAqB,EACrB,WAAmB,EACnB,WAA4C;IAE5C,MAAM,OAAO,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC7D,OAAO,CAAC,cAAc,CAAC,GAAG,WAAW,CAAC;IAEtC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACxF,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,QAAkB,EAAW,EAAE,CACpD,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC;AAErD;;;GAGG;AACH,KAAK,UAAU,IAAI,CACjB,SAAiB,EACjB,MAAc,EACd,GAAW,EACX,IAAqB,EACrB,WAAmB,EACnB,WAA4C;IAE5C,IAAI,mBAAmB,EAAE,EAAE,CAAC;QAC1B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,CAAC;QACH,IAAI,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QACxE,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;YACpE,IAAI,aAAa,CAAC,QAAQ,CAAC;gBAAE,OAAO,cAAc,CAAC;QACrD,CAAC;QACD,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,CAAC,KAAK,CACV,uCAAuC,EACvC,GAAG,eAAe,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CACnE,CAAC;QAEF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,CAAC,KAAK,CACV,gCAAgC,EAChC,GAAG,eAAe,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CACpD,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,SAAS,aAAa,CAAC,QAAgB,EAAE,KAA8B;IACrE,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,IAAK,KAAK,CAAC,OAAO,CAA6B,CAAC,QAAQ,CAAC;YAC5E,CAAC,CAAC,mBAAmB;YACrB,CAAC,CAAC,kBAAkB,CAAC;IACzB,CAAC;IACD,OAAO,mBAAmB,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC;AACxD,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,QAAgB;IACnD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,IAAI,GACR,OAAO,KAAK,KAAK,QAAQ;QACvB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,CAAC,GAAG,EAAE;YACJ,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACX,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAkC;IAC1D,MAAM,OAAO,GAA4B,EAAE,GAAG,SAAS,EAAE,CAAC;IAE1D,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC9D,OAAO,CAAC,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,YAAY,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,CAAC;QAC7D,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,oBAAoB,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,uDAAuD;IACvD,OAAO,OAAO,CAAC,GAAG,CAAC;IAEnB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAmB,EAAE,GAAW;IAC5D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO;IACjD,IAAI,CAAC;QACH,MAAM,EAAE,eAAe,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACtF,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACzC,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACzC,mBAAmB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;SAC9C,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;AACH,CAAC;AAQD,KAAK,UAAU,cAAc,CAAC,OAAiB,EAAE,GAAmB;IAClE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,SAA4B,CAAC;QACjC,IAAI,SAAkC,CAAC;QACvC,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAsB,CAAC;YACpD,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAA4B,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,uEAAuE;YACvE,SAAS,IAAI,CAAC,CAAC;YACf,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,IAAI,QAAQ,KAAK,YAAY;YAAE,kBAAkB,GAAG,IAAI,CAAC;QAEzD,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAE/B,MAAM,OAAO,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CACT,IAAI,CAAC,SAAS,CAAC;YACb,GAAG,OAAO;YACV,IAAI,EAAE,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC;YACxC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;YACjD,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;YACtD,UAAU,EAAE,GAAG,CAAC,SAAS;YACzB,cAAc,EAAE,GAAG,CAAC,SAAS;YAC7B,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE;YAChC,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE;YACjC,oBAAoB,EAAE,GAAG,CAAC,WAAW;YACrC,GAAG;YACH,WAAW,EAAE,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;YAC/D,GAAG,EAAE,OAAO;SACb,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;QACzD,kBAAkB;QAClB,SAAS;KACV,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF,KAAK,UAAU,mBAAmB,CAChC,WAA4C;IAE5C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAChC,wDAAwD,CACzD,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAEhC,OAAO;QACL,WAAW;QACX,OAAO,EAAE,KAAK,EAAE,SAAS,IAAI,KAAK,EAAE,GAAG,IAAI,EAAE;QAC7C,WAAW,EAAE,KAAK,EAAE,OAAO,IAAI,EAAE;QACjC,SAAS,EAAE,gBAAgB,CAAC,WAAW,CAAC;QACxC,GAAG,EAAE,EAAE;KACR,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,KAAK,UAAU,YAAY,CACzB,SAAiB,EACjB,GAAmB;IAEnB,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,KAAK,CACV,iDAAiD,EACjD,GAAG,eAAe,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAC5D,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,2EAA2E;QAC3E,MAAM,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;QACzE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,OAAO,GAAG,iBAAiB,CAAC,yBAAyB,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,sBAAsB,EAAE,GAAG,CAAC,WAAW,CACjF,CAAC;IACF,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAEnC,MAAM,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IAEzE,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oEAAoE;AACpE,KAAK,UAAU,iBAAiB,CAC9B,SAAiB,EACjB,MAAkB,EAClB,GAAmB;IAEnB,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC;IAE5B,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,wBAAwB,EAAE,GAAG,CAAC,WAAW,CACjF,CAAC;IACF,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAEnC,MAAM,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAiB,EACjB,SAAkB,EAClB,WAA4C;IAE5C,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAEnD,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACvD,IAAI,WAAW,KAAK,cAAc,EAAE,CAAC;QACnC,oBAAoB,EAAE,CAAA;QACtB,OAAO;IACT,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,OAAO;IACT,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAC/D,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;YAC9B,oBAAoB,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/providers/plugins/sso/proxy/plugins/otlp-spool/session-lock.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Per-session serialization lock.
+ *
+ * Same-session operations are serialized; different sessions run fully in
+ * parallel. The map entry is cleaned up once no more waiters remain.
+ */
+export declare function withSessionLock<T>(sessionId: string, fn: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=session-lock.d.ts.map

package/dist/providers/plugins/sso/proxy/plugins/otlp-spool/session-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-lock.d.ts","sourceRoot":"","sources":["../../../../../../../src/providers/plugins/sso/proxy/plugins/otlp-spool/session-lock.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,wBAAgB,eAAe,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAqBtF"}

package/dist/providers/plugins/sso/proxy/plugins/otlp-spool/session-lock.js

@@ -0,0 +1,29 @@
+/**
+ * Per-session serialization lock.
+ *
+ * Same-session operations are serialized; different sessions run fully in
+ * parallel. The map entry is cleaned up once no more waiters remain.
+ */
+const locks = new Map();
+export function withSessionLock(sessionId, fn) {
+    const previous = locks.get(sessionId) ?? Promise.resolve();
+    let resolveCurrent;
+    const current = new Promise((resolve) => {
+        resolveCurrent = resolve;
+    });
+    locks.set(sessionId, current);
+    const result = previous.then(async () => {
+        try {
+            return await fn();
+        }
+        finally {
+            // Clean up the map entry only if it still points to this chain link.
+            if (locks.get(sessionId) === current) {
+                locks.delete(sessionId);
+            }
+            resolveCurrent();
+        }
+    });
+    return result;
+}
+//# sourceMappingURL=session-lock.js.map

package/dist/providers/plugins/sso/proxy/plugins/otlp-spool/session-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-lock.js","sourceRoot":"","sources":["../../../../../../../src/providers/plugins/sso/proxy/plugins/otlp-spool/session-lock.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;AAE/C,MAAM,UAAU,eAAe,CAAI,SAAiB,EAAE,EAAoB;IACxE,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3D,IAAI,cAA2B,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC5C,cAAc,GAAG,OAAO,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAE9B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QACtC,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,qEAAqE;YACrE,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,OAAO,EAAE,CAAC;gBACrC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;YACD,cAAc,EAAE,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/providers/plugins/sso/proxy/plugins/otlp-spool/session-status.d.ts

@@ -0,0 +1,40 @@
+import { type SpoolStream } from './spool-paths.js';
+/** Byte offsets that have been acknowledged by the backend, per stream. */
+export type SessionCursors = Record<SpoolStream, number>;
+export interface SessionStatus {
+    /**
+     * Delivery progress. A cursor is a byte offset into the corresponding spool
+     * file and is only advanced after the backend acknowledges those bytes.
+     */
+    cursors: SessionCursors;
+    /** Consecutive ticks a hooks-only session has waited for OTEL data. */
+    waitTicks: number;
+    /**
+     * Time when a successfully forwarded hooks batch contained `SessionEnd`.
+     * Marks *normal completion*, not *delivery completion*: forwarding continues
+     * for any bytes that are still pending or appended afterwards.
+     */
+    endedAt?: number;
+}
+export declare function createStatus(): SessionStatus;
+/** Read and normalize a session status, or `null` when there is no status file. */
+export declare function readStatus(sessionId: string): Promise<SessionStatus | null>;
+export declare function writeStatus(sessionId: string, status: SessionStatus): Promise<void>;
+/**
+ * Read-modify-write a status under the session lock.
+ *
+ * NOTE: the session lock is not reentrant — never call this while already
+ * holding the lock for the same session.
+ */
+export declare function updateStatus(sessionId: string, mutate: (status: SessionStatus) => void): Promise<void>;
+export declare function markSessionEnded(sessionId: string): Promise<void>;
+/** Advance an acknowledged cursor. Monotonic: never moves backwards. */
+export declare function advanceCursor(sessionId: string, stream: SpoolStream, nextOffset: number): Promise<void>;
+/**
+ * Create a default status if the session has none.
+ * Caller MUST already hold the session lock.
+ */
+export declare function ensureStatusLocked(sessionId: string): Promise<void>;
+/** Lock-acquiring variant — never call while holding the session lock. */
+export declare function ensureStatus(sessionId: string): Promise<void>;
+//# sourceMappingURL=session-status.d.ts.map

package/dist/providers/plugins/sso/proxy/plugins/otlp-spool/session-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-status.d.ts","sourceRoot":"","sources":["../../../../../../../src/providers/plugins/sso/proxy/plugins/otlp-spool/session-status.ts"],"names":[],"mappings":"AACA,OAAO,EAAwC,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAG1F,2EAA2E;AAC3E,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAEzD,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,OAAO,EAAE,cAAc,CAAC;IACxB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,YAAY,IAAI,aAAa,CAE5C;AA0BD,mFAAmF;AACnF,wBAAsB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAOjF;AAED,wBAAsB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAGzF;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,GACtC,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIvE;AAED,wEAAwE;AACxE,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGzE;AAED,0EAA0E;AAC1E,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE"}

package/dist/providers/plugins/sso/proxy/plugins/otlp-spool/session-status.js

@@ -0,0 +1,82 @@
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { SPOOL_STREAMS, spoolRoot, statusFile } from './spool-paths.js';
+import { withSessionLock } from './session-lock.js';
+export function createStatus() {
+    return { cursors: { hooks: 0, logs: 0, metrics: 0, traces: 0 }, waitTicks: 0 };
+}
+function toOffset(value) {
+    return typeof value === 'number' && Number.isFinite(value) && value > 0 ? Math.floor(value) : 0;
+}
+/**
+ * Coerce whatever is on disk into a well-formed status. Unknown fields (e.g.
+ * the removed `*Written` flags, flat cursors, `forwarded`) are dropped.
+ */
+function normalizeStatus(raw) {
+    const status = createStatus();
+    if (typeof raw !== 'object' || raw === null)
+        return status;
+    const source = raw;
+    const cursors = (source['cursors'] ?? {});
+    for (const stream of SPOOL_STREAMS) {
+        status.cursors[stream] = toOffset(cursors[stream]);
+    }
+    status.waitTicks = toOffset(source['waitTicks']);
+    const endedAt = toOffset(source['endedAt']);
+    if (endedAt > 0)
+        status.endedAt = endedAt;
+    return status;
+}
+/** Read and normalize a session status, or `null` when there is no status file. */
+export async function readStatus(sessionId) {
+    try {
+        const raw = await readFile(statusFile(sessionId), 'utf-8');
+        return normalizeStatus(JSON.parse(raw));
+    }
+    catch {
+        return null;
+    }
+}
+export async function writeStatus(sessionId, status) {
+    await mkdir(spoolRoot(), { recursive: true });
+    await writeFile(statusFile(sessionId), JSON.stringify(status), 'utf-8');
+}
+/**
+ * Read-modify-write a status under the session lock.
+ *
+ * NOTE: the session lock is not reentrant — never call this while already
+ * holding the lock for the same session.
+ */
+export async function updateStatus(sessionId, mutate) {
+    await withSessionLock(sessionId, async () => {
+        const status = await readStatus(sessionId);
+        if (!status)
+            return; // session was swept — nothing to acknowledge
+        mutate(status);
+        await writeStatus(sessionId, status);
+    });
+}
+export async function markSessionEnded(sessionId) {
+    await updateStatus(sessionId, (status) => {
+        status.endedAt ??= Date.now();
+    });
+}
+/** Advance an acknowledged cursor. Monotonic: never moves backwards. */
+export async function advanceCursor(sessionId, stream, nextOffset) {
+    await updateStatus(sessionId, (status) => {
+        status.cursors[stream] = Math.max(status.cursors[stream], nextOffset);
+    });
+}
+/**
+ * Create a default status if the session has none.
+ * Caller MUST already hold the session lock.
+ */
+export async function ensureStatusLocked(sessionId) {
+    if (await readStatus(sessionId))
+        return;
+    await writeStatus(sessionId, createStatus());
+}
+/** Lock-acquiring variant — never call while holding the session lock. */
+export async function ensureStatus(sessionId) {
+    await withSessionLock(sessionId, () => ensureStatusLocked(sessionId));
+}
+//# sourceMappingURL=session-status.js.map

package/dist/providers/plugins/sso/proxy/plugins/otlp-spool/session-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-status.js","sourceRoot":"","sources":["../../../../../../../src/providers/plugins/sso/proxy/plugins/otlp-spool/session-status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAqBpD,MAAM,UAAU,YAAY;IAC1B,OAAO,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClG,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAE3D,MAAM,MAAM,GAAG,GAA8B,CAAC;IAC9C,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAA4B,CAAC;IACrE,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;QACnC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5C,IAAI,OAAO,GAAG,CAAC;QAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAE1C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAAiB;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3D,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,SAAiB,EAAE,MAAqB;IACxE,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,SAAiB,EACjB,MAAuC;IAEvC,MAAM,eAAe,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,6CAA6C;QAClE,MAAM,CAAC,MAAM,CAAC,CAAC;QACf,MAAM,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,SAAiB;IACtD,MAAM,YAAY,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE;QACvC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,SAAiB,EACjB,MAAmB,EACnB,UAAkB;IAElB,MAAM,YAAY,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE;QACvC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,SAAiB;IACxD,IAAI,MAAM,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO;IACxC,MAAM,WAAW,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAiB;IAClD,MAAM,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;AACxE,CAAC"}

package/dist/providers/plugins/sso/proxy/plugins/otlp-spool/spool-config.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Env-backed tuning for the OTLP spool. Read lazily on every call so overrides
+ * take effect without a restart.
+ *
+ * Duration knobs are in minutes and accept fractions (`0.5` = 30s). A missing,
+ * unparsable, zero or negative value falls back to the default — notably, a
+ * zero interval would otherwise degenerate into a spin loop.
+ */
+/** How often pending spool bytes are forwarded. */
+export declare function sendIntervalMs(): number;
+/** How often drained, inactive sessions are garbage-collected. */
+export declare function sweepIntervalMs(): number;
+/**
+ * Ticks a hooks-only session waits for OTEL data before being force-forwarded.
+ *
+ * NOTE: this is a tick count, so the effective wait is
+ * `sendIntervalMs() * hooksOnlyWaitTicks()` — currently ~6 minutes, chosen to
+ * out-wait one OTEL exporter flush cycle (~60s) plus a send interval.
+ * Revisit this value whenever OTLP_SEND_INTERVAL_MINUTES changes.
+ */
+export declare function hooksOnlyWaitTicks(): number;
+/** Whether a hooks-only session may be forwarded without any OTEL data. */
+export declare function hooksOnlyForwardAllowed(): boolean;
+/**
+ * Quiet period after a normally ended session (`endedAt`) before its drained
+ * spool may be deleted. Sized to cover a late OTEL export plus the send
+ * interval needed to forward it.
+ */
+export declare function endedSessionGraceMs(): number;
+/**
+ * Inactivity period after which a session that never reported `SessionEnd` is
+ * considered abandoned and its drained spool may be deleted. Measured from the
+ * latest spool-file write, never from session creation or cursor updates.
+ */
+export declare function abandonedSessionGraceMs(): number;
+//# sourceMappingURL=spool-config.d.ts.map

package/dist/providers/plugins/sso/proxy/plugins/otlp-spool/spool-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spool-config.d.ts","sourceRoot":"","sources":["../../../../../../../src/providers/plugins/sso/proxy/plugins/otlp-spool/spool-config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAoBH,mDAAmD;AACnD,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,kEAAkE;AAClE,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,2EAA2E;AAC3E,wBAAgB,uBAAuB,IAAI,OAAO,CAEjD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD"}

package/dist/providers/plugins/sso/proxy/plugins/otlp-spool/spool-config.js

@@ -0,0 +1,62 @@
+/**
+ * Env-backed tuning for the OTLP spool. Read lazily on every call so overrides
+ * take effect without a restart.
+ *
+ * Duration knobs are in minutes and accept fractions (`0.5` = 30s). A missing,
+ * unparsable, zero or negative value falls back to the default — notably, a
+ * zero interval would otherwise degenerate into a spin loop.
+ */
+const MINUTE_MS = 60_000;
+function envMinutesMs(name, fallbackMinutes) {
+    const parsed = Number(process.env[name]);
+    const minutes = Number.isFinite(parsed) && parsed > 0 ? parsed : fallbackMinutes;
+    return minutes * MINUTE_MS;
+}
+function envCount(name, fallbackValue) {
+    const parsed = Number(process.env[name]);
+    return Number.isFinite(parsed) && parsed >= 0 ? parsed : fallbackValue;
+}
+function envBoolean(name, fallbackValue) {
+    const raw = process.env[name];
+    return raw === undefined ? fallbackValue : raw === 'true';
+}
+/** How often pending spool bytes are forwarded. */
+export function sendIntervalMs() {
+    return envMinutesMs('OTLP_SEND_INTERVAL_MINUTES', 2);
+}
+/** How often drained, inactive sessions are garbage-collected. */
+export function sweepIntervalMs() {
+    return envMinutesMs('OTLP_SWEEP_INTERVAL_MINUTES', 15);
+}
+/**
+ * Ticks a hooks-only session waits for OTEL data before being force-forwarded.
+ *
+ * NOTE: this is a tick count, so the effective wait is
+ * `sendIntervalMs() * hooksOnlyWaitTicks()` — currently ~6 minutes, chosen to
+ * out-wait one OTEL exporter flush cycle (~60s) plus a send interval.
+ * Revisit this value whenever OTLP_SEND_INTERVAL_MINUTES changes.
+ */
+export function hooksOnlyWaitTicks() {
+    return envCount('OTLP_SEND_MAX_ATTEMPTS', 3);
+}
+/** Whether a hooks-only session may be forwarded without any OTEL data. */
+export function hooksOnlyForwardAllowed() {
+    return envBoolean('OTLP_ALLOW_HOOKS_ONLY_FORWARD', true);
+}
+/**
+ * Quiet period after a normally ended session (`endedAt`) before its drained
+ * spool may be deleted. Sized to cover a late OTEL export plus the send
+ * interval needed to forward it.
+ */
+export function endedSessionGraceMs() {
+    return envMinutesMs('OTLP_ENDED_SESSION_GRACE_MINUTES', 15);
+}
+/**
+ * Inactivity period after which a session that never reported `SessionEnd` is
+ * considered abandoned and its drained spool may be deleted. Measured from the
+ * latest spool-file write, never from session creation or cursor updates.
+ */
+export function abandonedSessionGraceMs() {
+    return envMinutesMs('OTLP_ABANDONED_SESSION_GRACE_MINUTES', 60);
+}
+//# sourceMappingURL=spool-config.js.map

package/dist/providers/plugins/sso/proxy/plugins/otlp-spool/spool-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spool-config.js","sourceRoot":"","sources":["../../../../../../../src/providers/plugins/sso/proxy/plugins/otlp-spool/spool-config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,SAAS,GAAG,MAAM,CAAC;AAEzB,SAAS,YAAY,CAAC,IAAY,EAAE,eAAuB;IACzD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC;IACjF,OAAO,OAAO,GAAG,SAAS,CAAC;AAC7B,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,aAAqB;IACnD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC;AACzE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,aAAsB;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC;AAC5D,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,cAAc;IAC5B,OAAO,YAAY,CAAC,4BAA4B,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,eAAe;IAC7B,OAAO,YAAY,CAAC,6BAA6B,EAAE,EAAE,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,QAAQ,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,uBAAuB;IACrC,OAAO,UAAU,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,YAAY,CAAC,kCAAkC,EAAE,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,YAAY,CAAC,sCAAsC,EAAE,EAAE,CAAC,CAAC;AAClE,CAAC"}

package/dist/providers/plugins/sso/proxy/plugins/otlp-spool/spool-io.d.ts

@@ -0,0 +1,39 @@
+import { type SpoolStream } from './spool-paths.js';
+/**
+ * Append spool bytes and make the session discoverable.
+ *
+ * Holds the session lock so an append can never interleave with a forwarder
+ * snapshot (torn record), a cursor advance, or a sweep deletion.
+ */
+export declare function appendSpool(sessionId: string, stream: SpoolStream, data: string | Buffer): Promise<void>;
+export interface PendingBytes {
+    /** Cursor the snapshot was taken from — pass it back when acknowledging. */
+    cursor: number;
+    bytes: Buffer;
+}
+/**
+ * Consistent snapshot of the bytes pending for an OTEL stream.
+ *
+ * The lock guarantees the snapshot never contains a partially written append,
+ * so the protobuf payload handed to the backend is always whole.
+ * Must NOT be called while already holding the session lock.
+ */
+export declare function snapshotPendingBytes(sessionId: string, stream: SpoolStream): Promise<PendingBytes | null>;
+export interface PendingHookBatch {
+    cursor: number;
+    /** Complete, newline-terminated NDJSON records. */
+    records: string[];
+    /** Exact number of source bytes these records occupy, including newlines. */
+    byteLength: number;
+}
+/**
+ * Consistent snapshot of the complete NDJSON records pending for hooks.
+ *
+ * The chunk is cut at the last newline byte, so an incomplete trailing record
+ * stays pending and `byteLength` is a byte-exact acknowledgement amount.
+ * Cutting on a newline is safe for UTF-8: `0x0a` cannot occur inside a
+ * multi-byte sequence.
+ * Must NOT be called while already holding the session lock.
+ */
+export declare function snapshotPendingHookRecords(sessionId: string): Promise<PendingHookBatch | null>;
+//# sourceMappingURL=spool-io.d.ts.map

package/dist/providers/plugins/sso/proxy/plugins/otlp-spool/spool-io.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spool-io.d.ts","sourceRoot":"","sources":["../../../../../../../src/providers/plugins/sso/proxy/plugins/otlp-spool/spool-io.ts"],"names":[],"mappings":"AACA,OAAO,EAAyB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AA2C3E;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,GAAG,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAoBf;AAID,MAAM,WAAW,YAAY;IAC3B,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAQ9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAsB,0BAA0B,CAC9C,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAoBlC"}