@decocms/start 4.5.0 → 5.0.0

package/.cursor/skills/deco-edge-caching/SKILL.md

@@ -183,17 +183,21 @@ This is per-isolate in-memory cache (V8 Map). Resets on cold start. Includes req
 
 ## Cache Versioning with BUILD_HASH
 
-Deploy-time cache busting uses a `BUILD_HASH` environment variable (typically the git short SHA) passed to `wrangler deploy`. The worker-entry appends this to cache keys so deploying a new version automatically serves fresh content.
-
-```yaml
-# .github/workflows/deploy.yml
-- name: Deploy to Cloudflare Workers
-  run: npx wrangler deploy
-  env:
-    BUILD_HASH: ${{ github.sha }}
-```
+Every cached entry's key is suffixed with `__v=<hash>` so a new deploy starts a fresh cache namespace and previously-cached HTML (which references now-deleted asset filenames like `/assets/main-XYZ.js`) stops being served the moment the new worker is live. Old entries become orphaned and expire naturally — no purge endpoint call required.
+
+The hash is resolved automatically by `decoVitePlugin()` at build time and injected into the worker bundle as `__DECO_BUILD_HASH__`. Resolution order:
+
+1. `WORKERS_CI_COMMIT_SHA` — Cloudflare Workers Builds default env var ([CF docs](https://developers.cloudflare.com/changelog/2025-06-10-default-env-vars/)). This is the production deploy path-of-record per `MIGRATION_TOOLING_PLAN.md` D6.3.
+2. `git rev-parse --short=12 HEAD` — for someone running `wrangler deploy` from a developer laptop.
+3. `Date.now().toString(36)` — last-resort fallback so the cache-bust invariant never silently regresses.
+
+`createDecoWorkerEntry` reads `env.BUILD_HASH` first (explicit override path, e.g. `wrangler deploy --var BUILD_HASH:foo`) and falls back to the `__DECO_BUILD_HASH__` constant. Sites running `decoVitePlugin()` get the behaviour for free — **no per-site dashboard, `wrangler.jsonc`, or `--var` configuration required**.
 
-The worker-entry reads `env.BUILD_HASH` and injects it into cache keys. On new deploys, old cache entries simply expire naturally — no purge needed.
+The active version is exposed on every cached response via the `X-Cache-Version` header for observability. Confirm a new deploy is shipping the right hash with:
+
+```bash
+curl -sI https://www.example.com/ | grep -i x-cache-version
+```
 
 ## Site-Level Cache Pattern Registration
 

package/.github/workflows/release.yml

@@ -1,5 +1,25 @@
 name: Release
 
+# GOTCHA: GitHub Actions silently skips this workflow when the head
+# commit message contains the canonical CI-skip token (the bracketed
+# phrase "skip" + "ci") ANYWHERE in the message — title or body,
+# inside backticks, inside code blocks, doesn't matter. The
+# semantic-release release commit emits that token by design (so its
+# own commit doesn't loop a release back through CI). Side effect:
+# any PR that DESCRIBES that release commit verbatim in its body
+# inherits the token through the squash-merge and silently skips
+# the next release.
+#
+# When writing a commit message or PR body that needs to reference
+# the suppression behaviour, refer to it descriptively (e.g. "the
+# semantic-release skip token") instead of pasting the literal.
+#
+# Recover with a no-op commit whose entire message — title and body
+# — does NOT contain the literal token.
+#
+# References:
+#  - https://docs.github.com/en/actions/managing-workflow-runs/skipping-workflow-runs
+
 on:
   push:
     branches: [main]
@@ -23,10 +43,14 @@ jobs:
           node-version: 22
           registry-url: https://registry.npmjs.org
 
-      - run: npm install
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.5
+
+      - run: bun install --frozen-lockfile
 
       - name: Release
-        run: npx semantic-release
+        run: bunx semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

package/CHANGELOG.md

@@ -0,0 +1,113 @@
+# Changelog
+
+All notable changes to `@decocms/start` are documented here.
+
+The project follows [Conventional Commits](https://www.conventionalcommits.org/)
+and [semver](https://semver.org/). Releases are cut by semantic-release on
+merges to `main`; this file is the human-curated breaking-change ledger.
+For per-release auto-generated notes (every commit, every fix), see
+[GitHub Releases](https://github.com/decocms/deco-start/releases).
+
+## 5.0.0 — Drop in-Worker OTLP, converge on Cloudflare-native observability
+
+### Breaking — Observability transport rewritten
+
+- **In-Worker OTLP exporter for logs and metrics is gone.**
+  - Removed `createOtelLoggerAdapter()`, `createOtelMeterAdapter()`,
+    `OtelLoggerAdapterOptions`, `OtelMeterAdapterOptions`.
+  - Removed the per-request flush registry: `flushOtelProviders()`,
+    `registerOtelFlushHandler()`, `_resetFlushHandlersForTests()`,
+    `_getFlushHandlerCountForTests()`.
+- **`URLBasedSampler` and the OTel sampler module are gone.**
+  - Removed `URLBasedSampler`, `decodeSamplingConfig`,
+    `createUrlBasedHeadSampler`, `SamplingConfig`, `SamplingRule`,
+    `DEFAULT_SAMPLE_RATIO`, and the entire `@decocms/start/sdk/sampler`
+    export. Use Cloudflare's `observability.traces.head_sampling_rate`
+    in `wrangler.jsonc` instead.
+- **OTLP-related options on `instrumentWorker(handler, options)` are gone.**
+  - Removed: `enableAppSideOtlpLogs`, `otlpEndpoint`, `otlpHeaders`,
+    `otlpMinSeverity`, `samplingConfig`, `exportIntervalMillis`.
+  - Kept: `serviceName`, `analyticsEngineBindingName`,
+    `analyticsEngineEnabled`, `decoRuntimeVersion`, `decoAppsVersion`.
+  - Sites that previously read `OTEL_EXPORTER_OTLP_ENDPOINT`,
+    `OTEL_EXPORTER_OTLP_HEADERS`, `OTEL_LOG_MIN_SEVERITY`, or
+    `OTEL_SAMPLING_CONFIG` should delete those secrets after deploying
+    against `5.0.0`:
+    ```bash
+    wrangler secret delete OTEL_EXPORTER_OTLP_ENDPOINT \
+                           OTEL_EXPORTER_OTLP_HEADERS \
+                           OTEL_LOG_MIN_SEVERITY \
+                           OTEL_SAMPLING_CONFIG
+    ```
+- **OpenTelemetry SDK dependencies dropped from `package.json`:**
+  `@opentelemetry/api-logs`, `@opentelemetry/exporter-logs-otlp-http`,
+  `@opentelemetry/exporter-metrics-otlp-http`, `@opentelemetry/resources`,
+  `@opentelemetry/sdk-logs`, `@opentelemetry/sdk-metrics`,
+  `@opentelemetry/sdk-trace-base`. Only `@opentelemetry/api` remains —
+  it is the bridge between `withTracing()` and the global tracer
+  Cloudflare's runtime exposes.
+
+### Required `wrangler.jsonc` change
+
+Sites must set `observability.enabled: true` at the top level of the
+`observability` block — the master switch. Without it Cloudflare captures
+nothing, regardless of the sub-block flags. Run the codemod to inject
+the canonical block:
+
+```bash
+npx -p @decocms/start deco-cf-observability --write
+```
+
+The canonical block written by `5.0.0`:
+
+```jsonc
+"observability": {
+  "enabled": true,
+  "logs":   { "enabled": true, "invocation_logs": true,
+              "head_sampling_rate": 1,   "persist": true },
+  "traces": { "enabled": true,
+              "head_sampling_rate": 0.1, "persist": true }
+}
+```
+
+External destinations (HyperDX, Datadog, etc.) are no longer wired by
+default. Opt back in via `--destination-logs <slug>` /
+`--destination-traces <slug>` if your site forwards to a destination
+provisioned in the Cloudflare dashboard.
+
+### Unchanged surface
+
+The instrumentation API site code calls is unchanged:
+
+- `instrumentWorker(handler, options)`
+- `withTracing(name, fn, attrs)`, `getActiveSpan`, `setSpanAttribute`
+- `recordRequestMetric`, `recordCacheMetric`, `MetricNames`
+- `logger.{debug,info,warn,error}`, `serializeError`, `LoggerAdapter`,
+  `setLoggerAttributeFloor`
+- `createCompositeLogger`, `createCompositeMeter`
+- `createAnalyticsEngineMeterAdapter`, `setRuntimeEnv`, `getRuntimeEnv`
+
+The `deco.runtime.version`, `deco.apps.version`, and
+`deployment.environment` attribute floor that landed in 4.5.x stays —
+stamped on every span and every log record so dashboards keep working
+under Cloudflare's platform-managed export.
+
+### Future (not in 5.0.0)
+
+`@decocms/start/sdk/otelAdapters/clickhouseCollector` ships as a
+**documented stub that throws**. When the platform-side OTel collector
+gateway lands (forwarding to ClickHouse), the real OTLP/HTTP exporter
+implementation goes here — composed alongside the AE meter for
+dual-emit. The `OtelOptions` shape will gain a single
+`clickhouseCollector?: ClickhouseCollectorOptions` field at that point.
+
+### Migration checklist for site maintainers
+
+1. Bump `@decocms/start` to `^5.0.0`.
+2. `npx -p @decocms/start deco-cf-observability --write`
+3. `wrangler deploy`
+4. Verify CF dashboard captures logs + traces (~5 min):
+   Workers & Pages → `<site>` → Observability
+5. `wrangler secret delete OTEL_EXPORTER_OTLP_ENDPOINT
+   OTEL_EXPORTER_OTLP_HEADERS OTEL_LOG_MIN_SEVERITY
+   OTEL_SAMPLING_CONFIG`

package/bun.lock

@@ -7,13 +7,6 @@
       "dependencies": {
         "@deco-cx/warp-node": "^0.3.16",
         "@opentelemetry/api": "^1.9.1",
-        "@opentelemetry/api-logs": "^0.200.0",
-        "@opentelemetry/exporter-logs-otlp-http": "^0.200.0",
-        "@opentelemetry/exporter-metrics-otlp-http": "^0.200.0",
-        "@opentelemetry/resources": "^2.6.1",
-        "@opentelemetry/sdk-logs": "^0.200.0",
-        "@opentelemetry/sdk-metrics": "^2.0.0",
-        "@opentelemetry/sdk-trace-base": "^2.6.1",
         "clsx": "^2.1.1",
         "fast-json-patch": "^3.1.0",
         "tailwind-merge": "^3.3.1",
@@ -245,28 +238,6 @@
 
     "@opentelemetry/api": ["@opentelemetry/api@1.9.1", "", {}, "sha512-gLyJlPHPZYdAk1JENA9LeHejZe1Ti77/pTeFm/nMXmQH/HFZlcS/O2XJB+L8fkbrNSqhdtlvjBVjxwUYanNH5Q=="],
 
-    "@opentelemetry/api-logs": ["@opentelemetry/api-logs@0.200.0", "", { "dependencies": { "@opentelemetry/api": "^1.3.0" } }, "sha512-IKJBQxh91qJ+3ssRly5hYEJ8NDHu9oY/B1PXVSCWf7zytmYO9RNLB0Ox9XQ/fJ8m6gY6Q6NtBWlmXfaXt5Uc4Q=="],
-
-    "@opentelemetry/core": ["@opentelemetry/core@2.0.0", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.0.0 <1.10.0" } }, "sha512-SLX36allrcnVaPYG3R78F/UZZsBsvbc7lMCLx37LyH5MJ1KAAZ2E3mW9OAD3zGz0G8q/BtoS5VUrjzDydhD6LQ=="],
-
-    "@opentelemetry/exporter-logs-otlp-http": ["@opentelemetry/exporter-logs-otlp-http@0.200.0", "", { "dependencies": { "@opentelemetry/api-logs": "0.200.0", "@opentelemetry/core": "2.0.0", "@opentelemetry/otlp-exporter-base": "0.200.0", "@opentelemetry/otlp-transformer": "0.200.0", "@opentelemetry/sdk-logs": "0.200.0" }, "peerDependencies": { "@opentelemetry/api": "^1.3.0" } }, "sha512-KfWw49htbGGp9s8N4KI8EQ9XuqKJ0VG+yVYVYFiCYSjEV32qpQ5qZ9UZBzOZ6xRb+E16SXOSCT3RkqBVSABZ+g=="],
-
-    "@opentelemetry/exporter-metrics-otlp-http": ["@opentelemetry/exporter-metrics-otlp-http@0.200.0", "", { "dependencies": { "@opentelemetry/core": "2.0.0", "@opentelemetry/otlp-exporter-base": "0.200.0", "@opentelemetry/otlp-transformer": "0.200.0", "@opentelemetry/resources": "2.0.0", "@opentelemetry/sdk-metrics": "2.0.0" }, "peerDependencies": { "@opentelemetry/api": "^1.3.0" } }, "sha512-5BiR6i8yHc9+qW7F6LqkuUnIzVNA7lt0qRxIKcKT+gq3eGUPHZ3DY29sfxI3tkvnwMgtnHDMNze5DdxW39HsAw=="],
-
-    "@opentelemetry/otlp-exporter-base": ["@opentelemetry/otlp-exporter-base@0.200.0", "", { "dependencies": { "@opentelemetry/core": "2.0.0", "@opentelemetry/otlp-transformer": "0.200.0" }, "peerDependencies": { "@opentelemetry/api": "^1.3.0" } }, "sha512-IxJgA3FD7q4V6gGq4bnmQM5nTIyMDkoGFGrBrrDjB6onEiq1pafma55V+bHvGYLWvcqbBbRfezr1GED88lacEQ=="],
-
-    "@opentelemetry/otlp-transformer": ["@opentelemetry/otlp-transformer@0.200.0", "", { "dependencies": { "@opentelemetry/api-logs": "0.200.0", "@opentelemetry/core": "2.0.0", "@opentelemetry/resources": "2.0.0", "@opentelemetry/sdk-logs": "0.200.0", "@opentelemetry/sdk-metrics": "2.0.0", "@opentelemetry/sdk-trace-base": "2.0.0", "protobufjs": "^7.3.0" }, "peerDependencies": { "@opentelemetry/api": "^1.3.0" } }, "sha512-+9YDZbYybOnv7sWzebWOeK6gKyt2XE7iarSyBFkwwnP559pEevKOUD8NyDHhRjCSp13ybh9iVXlMfcj/DwF/yw=="],
-
-    "@opentelemetry/resources": ["@opentelemetry/resources@2.6.1", "", { "dependencies": { "@opentelemetry/core": "2.6.1", "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.3.0 <1.10.0" } }, "sha512-lID/vxSuKWXM55XhAKNoYXu9Cutoq5hFdkbTdI/zDKQktXzcWBVhNsOkiZFTMU9UtEWuGRNe0HUgmsFldIdxVA=="],
-
-    "@opentelemetry/sdk-logs": ["@opentelemetry/sdk-logs@0.200.0", "", { "dependencies": { "@opentelemetry/api-logs": "0.200.0", "@opentelemetry/core": "2.0.0", "@opentelemetry/resources": "2.0.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.4.0 <1.10.0" } }, "sha512-VZG870063NLfObmQQNtCVcdXXLzI3vOjjrRENmU37HYiPFa0ZXpXVDsTD02Nh3AT3xYJzQaWKl2X2lQ2l7TWJA=="],
-
-    "@opentelemetry/sdk-metrics": ["@opentelemetry/sdk-metrics@2.0.0", "", { "dependencies": { "@opentelemetry/core": "2.0.0", "@opentelemetry/resources": "2.0.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.9.0 <1.10.0" } }, "sha512-Bvy8QDjO05umd0+j+gDeWcTaVa1/R2lDj/eOvjzpm8VQj1K1vVZJuyjThpV5/lSHyYW2JaHF2IQ7Z8twJFAhjA=="],
-
-    "@opentelemetry/sdk-trace-base": ["@opentelemetry/sdk-trace-base@2.6.1", "", { "dependencies": { "@opentelemetry/core": "2.6.1", "@opentelemetry/resources": "2.6.1", "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.3.0 <1.10.0" } }, "sha512-r86ut4T1e8vNwB35CqCcKd45yzqH6/6Wzvpk2/cZB8PsPLlZFTvrh8yfOS3CYZYcUmAx4hHTZJ8AO8Dj8nrdhw=="],
-
-    "@opentelemetry/semantic-conventions": ["@opentelemetry/semantic-conventions@1.40.0", "", {}, "sha512-cifvXDhcqMwwTlTK04GBNeIe7yyo28Mfby85QXFe1Yk8nmi36Ab/5UQwptOx84SsoGNRg+EVSjwzfSZMy6pmlw=="],
-
     "@oxc-project/types": ["@oxc-project/types@0.120.0", "", {}, "sha512-k1YNu55DuvAip/MGE1FTsIuU3FUCn6v/ujG9V7Nq5Df/kX2CWb13hhwD0lmJGMGqE+bE1MXvv9SZVnMzEXlWcg=="],
 
     "@oxc-resolver/binding-android-arm-eabi": ["@oxc-resolver/binding-android-arm-eabi@11.19.1", "", { "os": "android", "cpu": "arm" }, "sha512-aUs47y+xyXHUKlbhqHUjBABjvycq6YSD7bpxSW7vplUmdzAlJ93yXY6ZR0c1o1x5A/QKbENCvs3+NlY8IpIVzg=="],
@@ -315,26 +286,6 @@
 
     "@pnpm/npm-conf": ["@pnpm/npm-conf@3.0.2", "", { "dependencies": { "@pnpm/config.env-replace": "^1.1.0", "@pnpm/network.ca-file": "^1.0.1", "config-chain": "^1.1.11" } }, "sha512-h104Kh26rR8tm+a3Qkc5S4VLYint3FE48as7+/5oCEcKR2idC/pF1G6AhIXKI+eHPJa/3J9i5z0Al47IeGHPkA=="],
 
-    "@protobufjs/aspromise": ["@protobufjs/aspromise@1.1.2", "", {}, "sha512-j+gKExEuLmKwvz3OgROXtrJ2UG2x8Ch2YZUxahh+s1F2HZ+wAceUNLkvy6zKCPVRkU++ZWQrdxsUeQXmcg4uoQ=="],
-
-    "@protobufjs/base64": ["@protobufjs/base64@1.1.2", "", {}, "sha512-AZkcAA5vnN/v4PDqKyMR5lx7hZttPDgClv83E//FMNhR2TMcLUhfRUBHCmSl0oi9zMgDDqRUJkSxO3wm85+XLg=="],
-
-    "@protobufjs/codegen": ["@protobufjs/codegen@2.0.4", "", {}, "sha512-YyFaikqM5sH0ziFZCN3xDC7zeGaB/d0IUb9CATugHWbd1FRFwWwt4ld4OYMPWu5a3Xe01mGAULCdqhMlPl29Jg=="],
-
-    "@protobufjs/eventemitter": ["@protobufjs/eventemitter@1.1.0", "", {}, "sha512-j9ednRT81vYJ9OfVuXG6ERSTdEL1xVsNgqpkxMsbIabzSo3goCjDIveeGv5d03om39ML71RdmrGNjG5SReBP/Q=="],
-
-    "@protobufjs/fetch": ["@protobufjs/fetch@1.1.0", "", { "dependencies": { "@protobufjs/aspromise": "^1.1.1", "@protobufjs/inquire": "^1.1.0" } }, "sha512-lljVXpqXebpsijW71PZaCYeIcE5on1w5DlQy5WH6GLbFryLUrBD4932W/E2BSpfRJWseIL4v/KPgBFxDOIdKpQ=="],
-
-    "@protobufjs/float": ["@protobufjs/float@1.0.2", "", {}, "sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ=="],
-
-    "@protobufjs/inquire": ["@protobufjs/inquire@1.1.0", "", {}, "sha512-kdSefcPdruJiFMVSbn801t4vFK7KB/5gd2fYvrxhuJYg8ILrmn9SKSX2tZdV6V+ksulWqS7aXjBcRXl3wHoD9Q=="],
-
-    "@protobufjs/path": ["@protobufjs/path@1.1.2", "", {}, "sha512-6JOcJ5Tm08dOHAbdR3GrvP+yUUfkjG5ePsHYczMFLq3ZmMkAD98cDgcT2iA1lJ9NVwFd4tH/iSSoe44YWkltEA=="],
-
-    "@protobufjs/pool": ["@protobufjs/pool@1.1.0", "", {}, "sha512-0kELaGSIDBKvcgS4zkjz1PeddatrjYcmMWOlAuAPwAeccUrPHdUqo/J6LiymHHEiJT5NrF1UVwxY14f+fy4WQw=="],
-
-    "@protobufjs/utf8": ["@protobufjs/utf8@1.1.0", "", {}, "sha512-Vvn3zZrhQZkkBE8LSuW3em98c0FwgO4nxzv6OdSxPKJIEKY2bGbHn+mhGIPerzI4twdxaP8/0+06HBpwf345Lw=="],
-
     "@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.0.0-rc.10", "", { "os": "android", "cpu": "arm64" }, "sha512-jOHxwXhxmFKuXztiu1ORieJeTbx5vrTkcOkkkn2d35726+iwhrY1w/+nYY/AGgF12thg33qC3R1LMBF5tHTZHg=="],
 
     "@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.0.0-rc.10", "", { "os": "darwin", "cpu": "arm64" }, "sha512-gED05Teg/vtTZbIJBc4VNMAxAFDUPkuO/rAIyyxZjTj1a1/s6z5TII/5yMGZ0uLRCifEtwUQn8OlYzuYc0m70w=="],
@@ -827,8 +778,6 @@
 
     "lodash.uniqby": ["lodash.uniqby@4.7.0", "", {}, "sha512-e/zcLx6CSbmaEgFHCA7BnoQKyCtKMxnuWrJygbwPs/AIn+IMKl66L8/s+wBUn5LRw2pZx3bUHibiV1b6aTWIww=="],
 
-    "long": ["long@5.3.2", "", {}, "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA=="],
-
     "lru-cache": ["lru-cache@11.2.7", "", {}, "sha512-aY/R+aEsRelme17KGQa/1ZSIpLpNYYrhcrepKTZgE+W3WM16YMCaPwOHLHsmopZHELU0Ojin1lPVxKR0MihncA=="],
 
     "magic-string": ["magic-string@0.30.21", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.5" } }, "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ=="],
@@ -951,8 +900,6 @@
 
     "proto-list": ["proto-list@1.2.4", "", {}, "sha512-vtK/94akxsTMhe0/cbfpR+syPuszcuwhqVjJq26CuNDgFGj682oRBXOP5MJpv2r7JtE8MsiepGIqvvOTBwn2vA=="],
 
-    "protobufjs": ["protobufjs@7.5.4", "", { "dependencies": { "@protobufjs/aspromise": "^1.1.2", "@protobufjs/base64": "^1.1.2", "@protobufjs/codegen": "^2.0.4", "@protobufjs/eventemitter": "^1.1.0", "@protobufjs/fetch": "^1.1.0", "@protobufjs/float": "^1.0.2", "@protobufjs/inquire": "^1.1.0", "@protobufjs/path": "^1.1.2", "@protobufjs/pool": "^1.1.0", "@protobufjs/utf8": "^1.1.0", "@types/node": ">=13.7.0", "long": "^5.0.0" } }, "sha512-CvexbZtbov6jW2eXAvLukXjXUW1TzFaivC46BpWc/3BpcCysb5Vffu+B3XHMm8lVEuy2Mm4XGex8hBSg1yapPg=="],
-
     "punycode": ["punycode@2.3.1", "", {}, "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg=="],
 
     "queue-microtask": ["queue-microtask@1.2.3", "", {}, ""],
@@ -1215,20 +1162,6 @@
 
     "@deco-cx/warp-node/undici": ["undici@6.23.0", "", {}, "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g=="],
 
-    "@opentelemetry/exporter-metrics-otlp-http/@opentelemetry/resources": ["@opentelemetry/resources@2.0.0", "", { "dependencies": { "@opentelemetry/core": "2.0.0", "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.3.0 <1.10.0" } }, "sha512-rnZr6dML2z4IARI4zPGQV4arDikF/9OXZQzrC01dLmn0CZxU5U5OLd/m1T7YkGRj5UitjeoCtg/zorlgMQcdTg=="],
-
-    "@opentelemetry/otlp-transformer/@opentelemetry/resources": ["@opentelemetry/resources@2.0.0", "", { "dependencies": { "@opentelemetry/core": "2.0.0", "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.3.0 <1.10.0" } }, "sha512-rnZr6dML2z4IARI4zPGQV4arDikF/9OXZQzrC01dLmn0CZxU5U5OLd/m1T7YkGRj5UitjeoCtg/zorlgMQcdTg=="],
-
-    "@opentelemetry/otlp-transformer/@opentelemetry/sdk-trace-base": ["@opentelemetry/sdk-trace-base@2.0.0", "", { "dependencies": { "@opentelemetry/core": "2.0.0", "@opentelemetry/resources": "2.0.0", "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.3.0 <1.10.0" } }, "sha512-qQnYdX+ZCkonM7tA5iU4fSRsVxbFGml8jbxOgipRGMFHKaXKHQ30js03rTobYjKjIfnOsZSbHKWF0/0v0OQGfw=="],
-
-    "@opentelemetry/resources/@opentelemetry/core": ["@opentelemetry/core@2.6.1", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.0.0 <1.10.0" } }, "sha512-8xHSGWpJP9wBxgBpnqGL0R3PbdWQndL1Qp50qrg71+B28zK5OQmUgcDKLJgzyAAV38t4tOyLMGDD60LneR5W8g=="],
-
-    "@opentelemetry/sdk-logs/@opentelemetry/resources": ["@opentelemetry/resources@2.0.0", "", { "dependencies": { "@opentelemetry/core": "2.0.0", "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.3.0 <1.10.0" } }, "sha512-rnZr6dML2z4IARI4zPGQV4arDikF/9OXZQzrC01dLmn0CZxU5U5OLd/m1T7YkGRj5UitjeoCtg/zorlgMQcdTg=="],
-
-    "@opentelemetry/sdk-metrics/@opentelemetry/resources": ["@opentelemetry/resources@2.0.0", "", { "dependencies": { "@opentelemetry/core": "2.0.0", "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.3.0 <1.10.0" } }, "sha512-rnZr6dML2z4IARI4zPGQV4arDikF/9OXZQzrC01dLmn0CZxU5U5OLd/m1T7YkGRj5UitjeoCtg/zorlgMQcdTg=="],
-
-    "@opentelemetry/sdk-trace-base/@opentelemetry/core": ["@opentelemetry/core@2.6.1", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.0.0 <1.10.0" } }, "sha512-8xHSGWpJP9wBxgBpnqGL0R3PbdWQndL1Qp50qrg71+B28zK5OQmUgcDKLJgzyAAV38t4tOyLMGDD60LneR5W8g=="],
-
     "@pnpm/network.ca-file/graceful-fs": ["graceful-fs@4.2.10", "", {}, "sha512-9ByhssR2fPVsNZj478qUUbKfmL0+t5BDVyjShtyZZLiK7ZDAArFFfopyOTj0M05wE2tJPisA4iTnnXl2YoPvOA=="],
 
     "@semantic-release/git/@semantic-release/error": ["@semantic-release/error@3.0.0", "", {}, "sha512-5hiM4Un+tpl4cKw3lV4UgzJj+SmfNIDCLLw0TepzQxz9ZGV5ixnqkzIVF+3tp0ZHgcMKE+VNGHJjEeyFG2dcSw=="],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/start",
-  "version": "4.5.0",
+  "version": "5.0.0",
   "type": "module",
   "description": "Deco framework for TanStack Start - CMS bridge, admin protocol, hooks, schema generation",
   "main": "./src/index.ts",
@@ -39,7 +39,7 @@
     "./sdk/logger": "./src/sdk/logger.ts",
     "./sdk/composite": "./src/sdk/composite.ts",
     "./sdk/otelAdapters": "./src/sdk/otelAdapters.ts",
-    "./sdk/sampler": "./src/sdk/sampler.ts",
+    "./sdk/otelAdapters/clickhouseCollector": "./src/sdk/otelAdapters/clickhouseCollector.ts",
     "./sdk/observability": "./src/sdk/observability.ts",
     "./sdk/workerEntry": "./src/sdk/workerEntry.ts",
     "./sdk/abTesting": "./src/sdk/abTesting.ts",
@@ -86,7 +86,8 @@
     "lint:unused": "knip",
     "format": "biome format src/ scripts/",
     "format:fix": "biome format --write src/ scripts/",
-    "check": "npm run typecheck && npm run lint && npm run lint:unused"
+    "check": "bun run typecheck && bun run lint && bun run lint:unused",
+    "clean": "rm -rf node_modules .cache dist .wrangler/state node_modules/.vite && bun install"
   },
   "keywords": [
     "deco",
@@ -96,6 +97,7 @@
   ],
   "author": "deco.cx",
   "license": "MIT",
+  "packageManager": "bun@1.3.5",
   "repository": {
     "type": "git",
     "url": "https://github.com/decocms/deco-start.git"
@@ -107,13 +109,6 @@
   "dependencies": {
     "@deco-cx/warp-node": "^0.3.16",
     "@opentelemetry/api": "^1.9.1",
-    "@opentelemetry/api-logs": "^0.200.0",
-    "@opentelemetry/exporter-logs-otlp-http": "^0.200.0",
-    "@opentelemetry/exporter-metrics-otlp-http": "^0.200.0",
-    "@opentelemetry/resources": "^2.6.1",
-    "@opentelemetry/sdk-logs": "^0.200.0",
-    "@opentelemetry/sdk-metrics": "^2.0.0",
-    "@opentelemetry/sdk-trace-base": "^2.6.1",
     "clsx": "^2.1.1",
     "fast-json-patch": "^3.1.0",
     "tailwind-merge": "^3.3.1",

package/scripts/migrate-to-cf-observability.test.ts

@@ -2,10 +2,14 @@
  * Smoke tests for the `migrate-to-cf-observability.ts` codemod.
  *
  * Drives the script as a child process against tmp wrangler.jsonc fixtures.
- * Verifies the three behaviors that matter operationally:
- *  - replacing an existing `observability.logs` block (lebiscuit shape)
- *  - appending a new `observability` block when none exists
+ * Verifies the operationally important behaviors:
+ *  - rewriting an existing observability block to the canonical CF-native
+ *    shape (no destinations, master enabled flag set)
+ *  - appending a new canonical block when none exists
  *  - second run is a no-op (idempotency / CI guard)
+ *  - HyperDX-style destinations are stripped on the next run
+ *  - opt-in destination forwarding via `--destination-logs` /
+ *    `--destination-traces`
  *  - result is valid JSONC (parses after stripping comments)
  */
 import * as cp from "node:child_process";
@@ -38,7 +42,7 @@ describe("migrate-to-cf-observability codemod", () => {
     fs.rmSync(tmpDir, { recursive: true, force: true });
   });
 
-  it("replaces an existing observability.logs block in lebiscuit-shape config", () => {
+  it("rewrites a partial observability block to the canonical CF-native shape", () => {
     fs.writeFileSync(
       wranglerPath,
       `{
@@ -64,19 +68,58 @@ describe("migrate-to-cf-observability codemod", () => {
     expect(r.code).toBe(0);
 
     const result = fs.readFileSync(wranglerPath, "utf8");
-    expect(result).toContain('"destinations": ["hyperdx-logs"]');
-    expect(result).toContain('"destinations": ["hyperdx-traces"]');
+    // Master switch present.
+    expect(result).toContain('"enabled": true');
+    // Both leaves present with rates and persist.
+    expect(result).toContain('"head_sampling_rate": 1');
     expect(result).toContain('"head_sampling_rate": 0.1');
-
+    expect(result.match(/"persist": true/g)?.length).toBe(2);
+    // No destinations by default.
+    expect(result).not.toContain('"destinations"');
+    // Original keys preserved.
+    expect(result).toContain('"name": "lebiscuit-tanstack"');
+    expect(result).toContain('"binding": "DECO_METRICS"');
     // Result must be valid JSONC.
     expect(() => JSON.parse(stripJsoncComments(result))).not.toThrow();
+  });
 
-    // Original key context preserved.
-    expect(result).toContain('"name": "lebiscuit-tanstack"');
-    expect(result).toContain('"binding": "DECO_METRICS"');
+  it("strips stale HyperDX-style destinations from a config that already has them", () => {
+    fs.writeFileSync(
+      wranglerPath,
+      `{
+  "name": "lebiscuit-tanstack",
+  "main": "./src/worker-entry.ts",
+  "observability": {
+    "enabled": true,
+    "logs": {
+      "enabled": true,
+      "invocation_logs": true,
+      "head_sampling_rate": 1,
+      "persist": true,
+      "destinations": ["hyperdx-logs"]
+    },
+    "traces": {
+      "enabled": true,
+      "head_sampling_rate": 0.1,
+      "persist": true,
+      "destinations": ["hyperdx-traces"]
+    }
+  }
+}
+`,
+    );
+
+    const r = runCodemod(["--source", tmpDir, "--write"]);
+    expect(r.code).toBe(0);
+
+    const result = fs.readFileSync(wranglerPath, "utf8");
+    expect(result).not.toContain("hyperdx-logs");
+    expect(result).not.toContain("hyperdx-traces");
+    expect(result).not.toContain('"destinations"');
+    expect(() => JSON.parse(stripJsoncComments(result))).not.toThrow();
   });
 
-  it("appends a new observability block when none exists", () => {
+  it("appends a canonical observability block when none exists", () => {
     fs.writeFileSync(
       wranglerPath,
       `{
@@ -92,7 +135,10 @@ describe("migrate-to-cf-observability codemod", () => {
 
     const result = fs.readFileSync(wranglerPath, "utf8");
     expect(result).toContain('"observability"');
-    expect(result).toContain('"destinations": ["hyperdx-logs"]');
+    expect(result).toContain('"enabled": true');
+    expect(result).toContain('"head_sampling_rate": 1');
+    expect(result).toContain('"head_sampling_rate": 0.1');
+    expect(result).not.toContain('"destinations"');
     expect(() => JSON.parse(stripJsoncComments(result))).not.toThrow();
   });
 
@@ -114,7 +160,7 @@ describe("migrate-to-cf-observability codemod", () => {
 
     const r = runCodemod(["--source", tmpDir, "--write"]);
     expect(r.code).toBe(0);
-    expect(r.stdout).toContain("already on CF-native");
+    expect(r.stdout).toContain("already on the canonical CF observability block");
 
     const after2 = fs.readFileSync(wranglerPath, "utf8");
     expect(after2).toBe(after1);
@@ -135,7 +181,7 @@ describe("migrate-to-cf-observability codemod", () => {
     expect(fs.readFileSync(wranglerPath, "utf8")).toBe(before);
   });
 
-  it("respects --logs / --traces / --traces-rate / --persist flags", () => {
+  it("respects --destination-logs / --destination-traces / --traces-rate / --persist flags", () => {
     fs.writeFileSync(
       wranglerPath,
       `{
@@ -148,9 +194,9 @@ describe("migrate-to-cf-observability codemod", () => {
     runCodemod([
       "--source",
       tmpDir,
-      "--logs",
+      "--destination-logs",
       "my-logs",
-      "--traces",
+      "--destination-traces",
       "my-traces",
       "--traces-rate",
       "0.05",
@@ -162,7 +208,7 @@ describe("migrate-to-cf-observability codemod", () => {
     expect(result).toContain('"destinations": ["my-logs"]');
     expect(result).toContain('"destinations": ["my-traces"]');
     expect(result).toContain('"head_sampling_rate": 0.05');
-    // Both blocks set persist:true (no logs-only persist flag).
+    // Both blocks set persist:true.
     const persistTrueCount = (result.match(/"persist": true/g) ?? []).length;
     expect(persistTrueCount).toBe(2);
   });