@determinate-systems/detsys-ts 1.0.0 → 2.0.0

package/dist/index.mjs

@@ -1,20 +1,29 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import * as fs$1 from "node:fs";
-import { constants, createReadStream, createWriteStream, readFileSync } from "node:fs";
-import * as os$1 from "node:os";
-import { tmpdir } from "node:os";
+import * as nodeFs from "node:fs";
+import fs, { createReadStream } from "node:fs";
+import os, { tmpdir } from "node:os";
 import { promisify } from "node:util";
 import * as actionsCore from "@actions/core";
 import * as exec$1 from "@actions/exec";
-import os from "os";
-import fs, { chmod, copyFile, mkdir, readFile, readdir, stat } from "node:fs/promises";
-import { gzip } from "node:zlib";
-import { createHash, randomUUID } from "node:crypto";
+import os$1 from "os";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import * as otelApi from "@opentelemetry/api";
+import { SeverityNumber, logs } from "@opentelemetry/api-logs";
+import { AsyncLocalStorageContextManager } from "@opentelemetry/context-async-hooks";
+import * as otelCore from "@opentelemetry/core";
+import { OTLPLogExporter } from "@opentelemetry/exporter-logs-otlp-http";
+import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";
+import * as otelResources from "@opentelemetry/resources";
+import * as sdkLogs from "@opentelemetry/sdk-logs";
+import * as sdkTrace from "@opentelemetry/sdk-trace-base";
+import * as semconv from "@opentelemetry/semantic-conventions";
 import got, { TimeoutError } from "got";
 import { resolveSrv } from "node:dns/promises";
 import * as actionsCache from "@actions/cache";
+import * as semconvIncubating from "@opentelemetry/semantic-conventions/incubating";
 import { exec } from "node:child_process";
-import * as path from "node:path";
+import fs$1, { chmod, copyFile, mkdir, readFile } from "node:fs/promises";
+import path from "node:path";
 //#region src/linux-release-info.ts
 /*!
 * linux-release-info
@@ -26,7 +35,7 @@ import * as path from "node:path";
 * Licensed under MIT
 * Copyright (c) 2018-2020 [Samuel Carreira]
 */
-const readFileAsync = promisify(fs$1.readFile);
+const readFileAsync = promisify(fs.readFile);
 const linuxReleaseInfoOptionsDefaults = {
 	mode: "async",
 	customFile: null,
@@ -44,7 +53,7 @@ function releaseInfo(infoOptions) {
 		...infoOptions
 	};
 	const searchOsReleaseFileList = osReleaseFileList(options.customFile);
-	if (os$1.type() !== "Linux") {
+	if (os.type() !== "Linux") {
 		if (options.mode === "sync") return getOsInfo();
 		else return Promise.resolve(getOsInfo());
 	}
@@ -93,11 +102,11 @@ function osReleaseFileList(customFile) {
 */
 function getOsInfo() {
 	return {
-		type: os$1.type(),
-		platform: os$1.platform(),
-		hostname: os$1.hostname(),
-		arch: os$1.arch(),
-		release: os$1.release()
+		type: os.type(),
+		platform: os.platform(),
+		hostname: os.hostname(),
+		arch: os.arch(),
+		release: os.release()
 	};
 }
 async function readAsyncOsReleaseFile(fileList, options) {
@@ -117,7 +126,7 @@ function readSyncOsreleaseFile(releaseFileList, options) {
 	let fileData = null;
 	for (const osReleaseFile of releaseFileList) try {
 		if (options.debug) console.log(`Trying to read '${osReleaseFile}'...`);
-		fileData = fs$1.readFileSync(osReleaseFile, "binary");
+		fileData = fs.readFileSync(osReleaseFile, "binary");
 		if (options.debug) console.log(`Read data:\n${fileData}`);
 		break;
 	} catch (error) {
@@ -191,11 +200,11 @@ function getPropertyWithDefault(data, name, defaultValue) {
 /**
 * The Action runner's platform.
 */
-const platform = os.platform();
+const platform = os$1.platform();
 /**
 * The Action runner's architecture.
 */
-const arch = os.arch();
+const arch = os$1.arch();
 /**
 * Whether the Action runner is a Windows system.
 */
@@ -222,112 +231,6 @@ async function getDetails() {
 	};
 }
 //#endregion
-//#region src/errors.ts
-/**
-* Coerce a value of type `unknown` into a string.
-*/
-function stringifyError(e) {
-	if (e instanceof Error) return e.message;
-	else if (typeof e === "string") return e;
-	else return JSON.stringify(e);
-}
-//#endregion
-//#region src/backtrace.ts
-/**
-* @packageDocumentation
-* Collects backtraces for executables for diagnostics
-*/
-const START_SLOP_SECONDS = 5;
-async function collectBacktraces(prefixes, programNameDenyList, startTimestampMs) {
-	if (isMacOS) return await collectBacktracesMacOS(prefixes, programNameDenyList, startTimestampMs);
-	if (isLinux) return await collectBacktracesSystemd(prefixes, programNameDenyList, startTimestampMs);
-	return /* @__PURE__ */ new Map();
-}
-async function collectBacktracesMacOS(prefixes, programNameDenyList, startTimestampMs) {
-	const backtraces = /* @__PURE__ */ new Map();
-	try {
-		const { stdout: logJson } = await exec$1.getExecOutput("log", [
-			"show",
-			"--style",
-			"json",
-			"--last",
-			"1m",
-			"--no-info",
-			"--predicate",
-			"sender = 'ReportCrash'"
-		], { silent: true });
-		const sussyArray = JSON.parse(logJson);
-		if (!Array.isArray(sussyArray)) throw new Error(`Log json isn't an array: ${logJson}`);
-		if (sussyArray.length > 0) {
-			actionsCore.info(`Collecting crash data...`);
-			const delay = async (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-			await delay(5e3);
-		}
-	} catch {
-		actionsCore.debug("Failed to check logs for in-progress crash dumps; now proceeding with the assumption that all crash dumps completed.");
-	}
-	const dirs = [["system", "/Library/Logs/DiagnosticReports/"], ["user", `${process.env["HOME"]}/Library/Logs/DiagnosticReports/`]];
-	for (const [source, dir] of dirs) {
-		const fileNames = (await readdir(dir)).filter((fileName) => {
-			return prefixes.some((prefix) => fileName.startsWith(prefix));
-		}).filter((fileName) => {
-			return !programNameDenyList.some((programName) => fileName.startsWith(programName));
-		}).filter((fileName) => {
-			return !fileName.endsWith(".diag");
-		});
-		const doGzip = promisify(gzip);
-		for (const fileName of fileNames) try {
-			if ((await stat(`${dir}/${fileName}`)).ctimeMs >= startTimestampMs) {
-				const buf = await doGzip(await readFile(`${dir}/${fileName}`));
-				backtraces.set(`backtrace_value_${source}_${fileName}`, buf.toString("base64"));
-			}
-		} catch (innerError) {
-			backtraces.set(`backtrace_failure_${source}_${fileName}`, stringifyError(innerError));
-		}
-	}
-	return backtraces;
-}
-async function collectBacktracesSystemd(prefixes, programNameDenyList, startTimestampMs) {
-	const sinceSeconds = Math.ceil((Date.now() - startTimestampMs) / 1e3) + START_SLOP_SECONDS;
-	const backtraces = /* @__PURE__ */ new Map();
-	const coredumps = [];
-	try {
-		const { stdout: coredumpjson } = await exec$1.getExecOutput("coredumpctl", [
-			"--json=pretty",
-			"list",
-			"--since",
-			`${sinceSeconds} seconds ago`
-		], { silent: true });
-		const sussyArray = JSON.parse(coredumpjson);
-		if (!Array.isArray(sussyArray)) throw new Error(`Coredump isn't an array: ${coredumpjson}`);
-		for (const sussyObject of sussyArray) {
-			const keys = Object.keys(sussyObject);
-			if (keys.includes("exe") && keys.includes("pid")) {
-				if (typeof sussyObject.exe == "string" && typeof sussyObject.pid == "number") {
-					const execParts = sussyObject.exe.split("/");
-					const binaryName = execParts[execParts.length - 1];
-					if (prefixes.some((prefix) => binaryName.startsWith(prefix)) && !programNameDenyList.includes(binaryName)) coredumps.push({
-						exe: sussyObject.exe,
-						pid: sussyObject.pid
-					});
-				} else actionsCore.debug(`Mysterious coredump entry missing exe string and/or pid number: ${JSON.stringify(sussyObject)}`);
-			} else actionsCore.debug(`Mysterious coredump entry missing exe value and/or pid value: ${JSON.stringify(sussyObject)}`);
-		}
-	} catch (innerError) {
-		actionsCore.debug(`Cannot collect backtraces: ${stringifyError(innerError)}`);
-		return backtraces;
-	}
-	const doGzip = promisify(gzip);
-	for (const coredump of coredumps) try {
-		const { stdout: logText } = await exec$1.getExecOutput("coredumpctl", ["info", `${coredump.pid}`], { silent: true });
-		const buf = await doGzip(logText);
-		backtraces.set(`backtrace_value_${coredump.pid}`, buf.toString("base64"));
-	} catch (innerError) {
-		backtraces.set(`backtrace_failure_${coredump.pid}`, stringifyError(innerError));
-	}
-	return backtraces;
-}
-//#endregion
 //#region src/checksums.ts
 /**
 * @packageDocumentation
@@ -463,6 +366,418 @@ function hashEnvironmentVariables(prefix, variables) {
 	return `${prefix}-${hash.digest("hex")}`;
 }
 //#endregion
+//#region src/errors.ts
+/**
+* Coerce a value of type `unknown` into a string.
+*/
+function stringifyError(e) {
+	if (e instanceof Error) return e.message;
+	else if (typeof e === "string") return e;
+	else return JSON.stringify(e);
+}
+//#endregion
+//#region src/telemetry.ts
+/**
+* @packageDocumentation
+* OpenTelemetry traces and logs for Determinate Systems' GitHub Actions.
+*
+* The OpenTelemetry API is a no-op until a provider is registered globally.
+* That means instrumentation call sites -- spans, log records -- can be
+* written unconditionally: when export is disabled they cost nothing and no
+* branching is needed at the call site.
+*
+* The SDK configures itself from the standard `OTEL_*` environment variables.
+* This module only supplies defaults for the variables the user has not set,
+* so every documented OpenTelemetry knob works here as it does anywhere else.
+*/
+/** The instrumentation scope name for everything this library emits. */
+const SCOPE_NAME = "detsys-ts";
+/**
+* The OTLP/HTTP collector for all Actions.
+* The exporters add `/v1/traces` and `/v1/logs` to this URL.
+*
+* This collector is a fixed service.
+* It is not one of the install.determinate.systems backends.
+* Thus it does not use their SRV failover.
+*/
+const DEFAULT_OTLP_ENDPOINT = "https://otel.determinate.systems";
+/**
+* The token for {@link DEFAULT_OTLP_ENDPOINT}.
+* The exporters send it as `Authorization: Bearer <token>`.
+* That is the default scheme of the collector's `bearertokenauth` extension.
+*
+* This token is public.
+* It ships in `dist/`, on npm, and in each workflow that uses this library.
+* It permits telemetry writes and no other operation.
+* Change it in the collector configuration and in this file at the same time.
+*/
+const OTLP_INGEST_TOKEN = "8bfa2d8b689352981286f0149c4e55cc0dff30a4f7a735b560e31479904a74e1";
+/**
+* How long to wait for buffered spans and logs to reach the collector before
+* giving up. The Action's process exits immediately afterward, so this is a
+* hard ceiling on how much a slow collector can delay a workflow.
+*/
+const SHUTDOWN_TIMEOUT_MS = 5e3;
+/**
+* The default for `OTEL_ATTRIBUTE_VALUE_LENGTH_LIMIT`.
+*
+* The SDK's own default is unlimited. Attributes here can carry pasted
+* command output and other unbounded text, which the collector should not
+* have to absorb, so cap them. File-sized payloads go out as log records
+* instead: a log record's body is not an attribute and is not truncated.
+*/
+const DEFAULT_ATTRIBUTE_VALUE_LENGTH_LIMIT = 8192;
+/** The OTLP environment variables a child process inherits from this run. */
+const OTLP_EXPORT_VARIABLES = [
+	"OTEL_EXPORTER_OTLP_ENDPOINT",
+	"OTEL_EXPORTER_OTLP_HEADERS",
+	"OTEL_EXPORTER_OTLP_COMPRESSION"
+];
+/**
+* Our own propagator instance, rather than the global one.
+*
+* The global propagator only exists once {@link Telemetry.start} has
+* registered it, which would make traceparent handling silently depend on
+* start-up ordering. Owning an instance keeps {@link traceparentOf} and {@link
+* contextFromTraceparent} correct no matter when they're called.
+*/
+const PROPAGATOR = new otelCore.W3CTraceContextPropagator();
+const SEVERITY = {
+	debug: SeverityNumber.DEBUG,
+	info: SeverityNumber.INFO,
+	notice: SeverityNumber.INFO2,
+	warning: SeverityNumber.WARN,
+	error: SeverityNumber.ERROR
+};
+/**
+* Whether this run exports telemetry at all.
+*
+* `OTEL_SDK_DISABLED=true` is the standard way to turn the export off. An
+* empty `OTEL_EXPORTER_OTLP_ENDPOINT` does the same, which is what this
+* library documented before `OTEL_SDK_DISABLED` was in the specification.
+*/
+function exportEnabled() {
+	if (otelCore.getBooleanFromEnv("OTEL_SDK_DISABLED")) return false;
+	const endpoint = process.env["OTEL_EXPORTER_OTLP_ENDPOINT"];
+	if (endpoint !== void 0 && endpoint.trim() === "") return false;
+	return true;
+}
+/**
+* Fill in the `OTEL_*` variables this run needs and the user has not set.
+*
+* From here on the exporters read their whole configuration from the
+* environment, exactly as they would in any other OpenTelemetry program.
+* Child processes inherit the same variables, so their telemetry reaches the
+* same collector without any further arrangement.
+*/
+function applyOtlpEnvironmentDefaults() {
+	if (otelCore.getStringFromEnv("OTEL_EXPORTER_OTLP_ENDPOINT") === void 0) process.env["OTEL_EXPORTER_OTLP_ENDPOINT"] = DEFAULT_OTLP_ENDPOINT;
+	if (exportsToDefaultCollector()) {
+		const headers = otelCore.parseKeyPairsIntoRecord(otelCore.getStringFromEnv("OTEL_EXPORTER_OTLP_HEADERS"));
+		if (!Object.keys(headers).some((name) => name.toLowerCase() === "authorization")) {
+			headers["Authorization"] = `Bearer ${OTLP_INGEST_TOKEN}`;
+			process.env["OTEL_EXPORTER_OTLP_HEADERS"] = encodeOtlpHeaders(headers);
+		}
+	}
+	if (otelCore.getStringFromEnv("OTEL_EXPORTER_OTLP_COMPRESSION") === void 0) process.env["OTEL_EXPORTER_OTLP_COMPRESSION"] = "gzip";
+	if (otelCore.getNumberFromEnv("OTEL_ATTRIBUTE_VALUE_LENGTH_LIMIT") === void 0) process.env["OTEL_ATTRIBUTE_VALUE_LENGTH_LIMIT"] = `${DEFAULT_ATTRIBUTE_VALUE_LENGTH_LIMIT}`;
+}
+/**
+* Whether this run sends its data to {@link DEFAULT_OTLP_ENDPOINT}.
+*
+* Only that collector gets {@link OTLP_INGEST_TOKEN}. A collector the user
+* chose must not receive our credentials.
+*/
+function exportsToDefaultCollector() {
+	const endpoint = otelCore.getStringFromEnv("OTEL_EXPORTER_OTLP_ENDPOINT");
+	if (endpoint === void 0) return false;
+	try {
+		return new URL(endpoint).toString() === new URL(DEFAULT_OTLP_ENDPOINT).toString();
+	} catch {
+		return false;
+	}
+}
+/**
+* The OTLP variables in the environment, for a child process that does not
+* inherit ours.
+*/
+function otlpExportEnvironment() {
+	const environment = {};
+	for (const name of OTLP_EXPORT_VARIABLES) {
+		const value = otelCore.getStringFromEnv(name);
+		if (value !== void 0) environment[name] = value;
+	}
+	return environment;
+}
+/**
+* Make the value of `OTEL_EXPORTER_OTLP_HEADERS`.
+*
+* The variable uses the W3C baggage format.
+* The reader decodes each percent-encoded value.
+* Thus you must encode the space in `Bearer <token>`.
+* If you do not encode it, the scheme and the token become two entries.
+*/
+function encodeOtlpHeaders(headers) {
+	return Object.entries(headers).map(([name, value]) => `${encodeURIComponent(name)}=${encodeURIComponent(value)}`).join(",");
+}
+/**
+* The generator of the trace and span IDs of this run.
+*
+* It makes random IDs, as the default generator does.
+* It can also give one span an identity that you supply.
+* That is how a span that one process announces starts in a different process.
+* See {@link Telemetry.startAnnouncedSpan}.
+*/
+var PinnedIdGenerator = class {
+	/** Give the next span this identity. */
+	pin(traceId, spanId) {
+		this.traceId = traceId;
+		this.spanId = spanId;
+	}
+	/** Give each subsequent span a random identity again. */
+	unpin() {
+		this.traceId = void 0;
+		this.spanId = void 0;
+	}
+	generateTraceId() {
+		return this.traceId ?? randomHex(16);
+	}
+	generateSpanId() {
+		return this.spanId ?? randomHex(8);
+	}
+};
+/**
+* Owns the OpenTelemetry SDK's lifecycle. Constructing this does nothing on
+* its own; `start()` registers the global providers and `shutdown()` flushes
+* whatever is buffered.
+*/
+var Telemetry = class {
+	/** Whether OTLP export is actually running. */
+	get enabled() {
+		return this.tracerProvider !== void 0;
+	}
+	/**
+	* Register the global tracer and logger providers.
+	*
+	* Safe to call at most once. If it throws, telemetry stays disabled and the
+	* Action carries on: instrumentation degrades to the API's no-ops rather
+	* than failing the workflow.
+	*/
+	start(options) {
+		if (this.enabled || !exportEnabled()) return;
+		try {
+			applyOtlpEnvironmentDefaults();
+			const resource = otelResources.defaultResource().merge(otelResources.resourceFromAttributes({
+				[semconv.ATTR_SERVICE_NAME]: options.serviceName,
+				...options.serviceVersion === void 0 ? {} : { [semconv.ATTR_SERVICE_VERSION]: options.serviceVersion },
+				...options.resourceAttributes
+			})).merge(otelResources.detectResources({ detectors: [otelResources.envDetector] }));
+			this.idGenerator = new PinnedIdGenerator();
+			this.tracerProvider = new sdkTrace.BasicTracerProvider({
+				resource,
+				idGenerator: this.idGenerator,
+				spanProcessors: [new sdkTrace.BatchSpanProcessor(new OTLPTraceExporter())]
+			});
+			this.loggerProvider = new sdkLogs.LoggerProvider({
+				resource,
+				logRecordLimits: { attributeValueLengthLimit: otelCore.getNumberFromEnv("OTEL_ATTRIBUTE_VALUE_LENGTH_LIMIT") },
+				processors: [new sdkLogs.BatchLogRecordProcessor({ exporter: new OTLPLogExporter() })]
+			});
+			otelApi.context.setGlobalContextManager(new AsyncLocalStorageContextManager().enable());
+			otelApi.propagation.setGlobalPropagator(PROPAGATOR);
+			otelApi.trace.setGlobalTracerProvider(this.tracerProvider);
+			logs.setGlobalLoggerProvider(this.loggerProvider);
+			actionsCore.debug(`OpenTelemetry export enabled to ${otelCore.getStringFromEnv("OTEL_EXPORTER_OTLP_ENDPOINT")}`);
+		} catch (e) {
+			this.tracerProvider = void 0;
+			this.loggerProvider = void 0;
+			this.idGenerator = void 0;
+			actionsCore.debug(`Failed to start OpenTelemetry export, continuing without it: ${stringifyError(e)}`);
+		}
+	}
+	/**
+	* Start the span that {@link newTraceparent} announced.
+	*
+	* A workflow job runs each Action as a process of its own.
+	* Thus a span that covers more than one Action can only start in one of them.
+	* The Action that announces such a span makes its identity known first, and
+	* starts the span itself last, in the process that runs at the end.
+	* The spans that already point at that identity then find their parent.
+	*
+	* The span starts at `startTime`, which is the moment of the announcement.
+	* It is a child of the span in `parentContext`, and a root span if that
+	* context holds no span.
+	*
+	* Returns undefined if the export is off, or if `traceparent` does not name a
+	* usable span.
+	*/
+	startAnnouncedSpan(name, traceparent, startTime, parentContext = otelApi.ROOT_CONTEXT) {
+		const generator = this.idGenerator;
+		const spanContext = otelApi.trace.getSpanContext(contextFromTraceparent(traceparent));
+		if (generator === void 0 || this.tracerProvider === void 0 || spanContext === void 0 || !otelApi.isSpanContextValid(spanContext)) return;
+		const tracer = this.tracerProvider.getTracer(SCOPE_NAME, "1.0");
+		try {
+			generator.pin(spanContext.traceId, spanContext.spanId);
+			return tracer.startSpan(name, { startTime }, parentContext);
+		} finally {
+			generator.unpin();
+		}
+	}
+	/**
+	* Flush buffered spans and logs and tear the SDK down.
+	*
+	* Never throws and never hangs: the Action calls this on its way out, so a
+	* broken or slow collector must not be able to fail or stall the workflow.
+	*/
+	async shutdown() {
+		const providers = [this.tracerProvider, this.loggerProvider].flatMap((p) => p ?? []);
+		if (providers.length === 0) return;
+		try {
+			await withTimeout(Promise.all(providers.map(async (p) => p.shutdown())), SHUTDOWN_TIMEOUT_MS);
+		} catch (e) {
+			actionsCore.debug(`Error flushing OpenTelemetry data: ${stringifyError(e)}`);
+		} finally {
+			this.tracerProvider = void 0;
+			this.loggerProvider = void 0;
+			this.idGenerator = void 0;
+		}
+	}
+};
+/**
+* The tracer for this library. Returns a no-op tracer until {@link
+* Telemetry.start} has run, so this is always safe to call.
+*/
+function getTracer() {
+	return otelApi.trace.getTracer(SCOPE_NAME, "1.0");
+}
+/**
+* The logger for this library. Returns a no-op logger until {@link
+* Telemetry.start} has run, so this is always safe to call.
+*/
+function getLogger() {
+	return logs.getLogger(SCOPE_NAME, "1.0");
+}
+/**
+* Emit a log record at `level`, correlated to whatever span is currently
+* active.
+*/
+function emitLogRecord(level, message, attributes) {
+	getLogger().emit({
+		severityNumber: SEVERITY[level],
+		severityText: level.toUpperCase(),
+		body: message,
+		attributes,
+		context: otelApi.context.active()
+	});
+}
+/**
+* Serialize a span as a W3C `traceparent` header value, suitable for stashing
+* in the Action's state or handing to a child process.
+*
+* Returns undefined when telemetry is disabled, since the no-op span's context
+* is all zeroes and would not be a valid parent.
+*/
+function traceparentOf(span) {
+	if (span === void 0 || !otelApi.isSpanContextValid(span.spanContext())) return;
+	const carrier = {};
+	PROPAGATOR.inject(otelApi.trace.setSpan(otelApi.ROOT_CONTEXT, span), carrier, otelApi.defaultTextMapSetter);
+	return carrier["traceparent"];
+}
+/**
+* Make the identity of a span, but do not start the span.
+*
+* Announce the result to whatever must point at the span before it starts:
+* a different process, or a request this process makes too early to record.
+* Start the span itself with {@link Telemetry.startAnnouncedSpan}.
+*
+* The span is in the trace of `parent`, or in a new trace of its own if there
+* is no usable parent.
+* A new trace is sampled, because a process that only forwards an identity
+* cannot ask the sampler, and an unsampled parent would discard the work of
+* each process that joins.
+*/
+function newTraceparent(parent) {
+	const parentContext = otelApi.trace.getSpanContext(contextFromTraceparent(parent));
+	if (parentContext !== void 0 && otelApi.isSpanContextValid(parentContext)) {
+		const flags = parentContext.traceFlags.toString(16).padStart(2, "0");
+		return `00-${parentContext.traceId}-${randomHex(8)}-${flags}`;
+	}
+	return `00-${randomHex(16)}-${randomHex(8)}-01`;
+}
+/**
+* The W3C trace context headers of the operation in progress, for an outgoing
+* HTTP request.
+*
+* Put these headers on the request.
+* The service that answers it can then put its own work in this trace.
+*
+* The headers describe the span that is active now.
+* When no span is active yet -- a request the Action makes before it starts a
+* span of its own -- they describe the span that `$TRACEPARENT` names, which is
+* the span the Action announced, or the span of the workflow job.
+*
+* The result is empty when the export is off.
+* A no-op span's context is all zeroes, and is not a valid parent.
+*/
+function traceContextHeaders() {
+	const active = otelApi.context.active();
+	const context = otelApi.trace.getSpanContext(active) === void 0 ? contextFromTraceparent(process.env["TRACEPARENT"]) : active;
+	const carrier = {};
+	PROPAGATOR.inject(context, carrier, otelApi.defaultTextMapSetter);
+	return carrier;
+}
+/**
+* Rebuild a Context from a W3C `traceparent` value, so a span started in one
+* process can parent spans started in another. Falls back to the root context
+* when `traceparent` is absent or unparseable.
+*/
+function contextFromTraceparent(traceparent) {
+	if (traceparent === void 0 || traceparent === "") return otelApi.ROOT_CONTEXT;
+	return PROPAGATOR.extract(otelApi.ROOT_CONTEXT, { traceparent }, otelApi.defaultTextMapGetter);
+}
+/**
+* Mark `span` as failed and attach the exception to it.
+*/
+function recordSpanError(span, error) {
+	span.recordException(error instanceof Error ? error : new Error(stringifyError(error)));
+	span.setStatus({
+		code: otelApi.SpanStatusCode.ERROR,
+		message: stringifyError(error)
+	});
+}
+/**
+* Run `fn` inside a new active span, ending the span when it settles and
+* marking it failed if it throws. The error is always re-thrown: this records,
+* it does not swallow.
+*/
+async function withSpan(name, fn, attributes) {
+	return await getTracer().startActiveSpan(name, { attributes }, async (span) => {
+		try {
+			return await fn(span);
+		} catch (e) {
+			recordSpanError(span, e);
+			throw e;
+		} finally {
+			span.end();
+		}
+	});
+}
+/** A random ID of `bytes` bytes, in the lowercase hex the W3C format uses. */
+function randomHex(bytes) {
+	return randomBytes(bytes).toString("hex");
+}
+/** Reject if `promise` has not settled within `timeoutMs`. */
+async function withTimeout(promise, timeoutMs) {
+	let timer;
+	try {
+		return await Promise.race([promise, new Promise((_resolve, reject) => {
+			timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`timed out after ${timeoutMs}ms`)), timeoutMs);
+		})]);
+	} finally {
+		if (timer !== void 0) clearTimeout(timer);
+	}
+}
+//#endregion
 //#region src/ids-host.ts
 /**
 * @packageDocumentation
@@ -500,6 +815,7 @@ var IdsHost = class {
 					actionsCore.info(`Retrying after error ${error.code}, retry #: ${retryCount}`);
 				}],
 				beforeRequest: [async (options) => {
+					for (const [name, value] of Object.entries(traceContextHeaders())) options.headers[name] = value;
 					const currentUrl = options.url;
 					if (this.isUrlSubjectToDynamicUrls(currentUrl)) {
 						const newUrl = new URL(currentUrl);
@@ -544,6 +860,13 @@ var IdsHost = class {
 		if (url === void 0) return new URL(DEFAULT_IDS_HOST);
 		return url;
 	}
+	/**
+	* The diagnostics endpoint of the current backend.
+	*
+	* This library reports nothing there: its telemetry is OpenTelemetry. The
+	* URL is for the programs an Action runs, which have diagnostics of their
+	* own.
+	*/
 	async getDiagnosticsUrl() {
 		if (this.runtimeDiagnosticsUrl === "") return;
 		if (this.runtimeDiagnosticsUrl !== "-" && this.runtimeDiagnosticsUrl !== void 0) try {
@@ -728,6 +1051,85 @@ const getStringOrUndefined = (name) => {
 	else return value;
 };
 //#endregion
+//#region src/log.ts
+/**
+* @packageDocumentation
+* Logging that tees to both the GitHub Actions console and OpenTelemetry.
+*
+* These are drop-in replacements for the `@actions/core` logging functions.
+* Every call still writes to the workflow log exactly as it did before -- the
+* user-visible output is unchanged -- and additionally emits an OpenTelemetry
+* LogRecord correlated to the currently active span.
+*
+* When telemetry is disabled the OpenTelemetry half is a no-op, so these
+* behave identically to calling `@actions/core` directly.
+*/
+var log_exports = /* @__PURE__ */ __exportAll({
+	debug: () => debug,
+	error: () => error,
+	group: () => group,
+	info: () => info,
+	notice: () => notice,
+	setFailed: () => setFailed,
+	warning: () => warning
+});
+function tee(level, message, attributes) {
+	const text = typeof message === "string" ? message : stringifyError(message);
+	emitLogRecord(level, text, attributes);
+	return text;
+}
+/**
+* Write a debug message. Only visible in the workflow log when the user has
+* enabled step debug logging, but always exported to OpenTelemetry.
+*/
+function debug(message, attributes) {
+	actionsCore.debug(tee("debug", message, attributes));
+}
+/** Write an informational message to the workflow log. */
+function info(message, attributes) {
+	actionsCore.info(tee("info", message, attributes));
+}
+/** Write a notice annotation to the workflow log. */
+function notice(message, properties, attributes) {
+	tee("notice", message, attributes);
+	actionsCore.notice(message, properties);
+}
+/** Write a warning annotation to the workflow log. */
+function warning(message, properties, attributes) {
+	tee("warning", message, attributes);
+	actionsCore.warning(message, properties);
+}
+/** Write an error annotation to the workflow log. */
+function error(message, properties, attributes) {
+	tee("error", message, attributes);
+	actionsCore.error(message, properties);
+}
+/**
+* Fail the workflow step, recording the reason as an OpenTelemetry error log.
+*/
+function setFailed(message, attributes) {
+	tee("error", message, attributes);
+	actionsCore.setFailed(message);
+}
+/**
+* Run `fn` inside both a collapsible group in the workflow log and an active
+* OpenTelemetry span of the same name.
+*
+* This is the replacement for a `startGroup`/`endGroup` pair: the group closes
+* and the span ends even if `fn` throws, and a throwing `fn` marks the span
+* failed before re-throwing.
+*/
+async function group(name, fn, attributes) {
+	return await withSpan(name, async () => {
+		actionsCore.startGroup(name);
+		try {
+			return await fn();
+		} finally {
+			actionsCore.endGroup();
+		}
+	}, attributes);
+}
+//#endregion
 //#region src/platform.ts
 /**
 * @packageDocumentation
@@ -805,40 +1207,52 @@ function noisilyGetInput(suffix, legacyPrefix) {
 * @packageDocumentation
 * Determinate Systems' TypeScript library for creating GitHub Actions logic.
 */
-const pkgVersion = "1.0";
-const EVENT_BACKTRACES = "backtrace";
-const EVENT_EXCEPTION = "exception";
-const EVENT_ARTIFACT_CACHE_HIT = "artifact_cache_hit";
-const EVENT_ARTIFACT_CACHE_MISS = "artifact_cache_miss";
-const EVENT_ARTIFACT_CACHE_PERSIST = "artifact_cache_persist";
-const EVENT_PREFLIGHT_REQUIRE_NIX_DENIED = "preflight-require-nix-denied";
-const EVENT_STORE_IDENTITY_FAILED = "store_identity_failed";
-const FACT_ARTIFACT_FETCHED_FROM_CACHE = "artifact_fetched_from_cache";
-const FACT_ENDED_WITH_EXCEPTION = "ended_with_exception";
-const FACT_FINAL_EXCEPTION = "final_exception";
-const FACT_OS = "$os";
-const FACT_OS_VERSION = "$os_version";
-const FACT_SOURCE_URL = "source_url";
-const FACT_SOURCE_URL_ETAG = "source_url_etag";
-const FACT_SOURCE_CHECKSUMS_SHA256 = "source_checksums_sha256";
-const FACT_NIX_VERSION = "nix_version";
-const FACT_NIX_LOCATION = "nix_location";
-const FACT_NIX_STORE_TRUST = "nix_store_trusted";
-const FACT_NIX_STORE_VERSION = "nix_store_version";
-const FACT_NIX_STORE_CHECK_METHOD = "nix_store_check_method";
-const FACT_NIX_STORE_CHECK_ERROR = "nix_store_check_error";
+const EVENT_IDS_FAILOVER = "detsys.ids_failover";
+const EVENT_PREFLIGHT_REQUIRE_NIX_DENIED = "detsys.preflight_require_nix_denied";
+const EVENT_REQUEST_TIMEOUT = "detsys.request_timeout";
+const EVENT_STORE_IDENTITY_FAILED = "detsys.store_identity_failed";
+const ATTR_PROJECT = "detsys.project";
+const ATTR_IDS_PROJECT = "detsys.ids_project";
+const ATTR_EXECUTION_PHASE = "detsys.execution_phase";
+const ATTR_CROSS_PHASE_ID = "detsys.cross_phase_id";
+const ATTR_ANONYMOUS_ID = "detsys.anonymous_id";
+const ATTR_CORRELATION_SOURCE = "detsys.correlation_source";
+const ATTR_ARCH_OS = "detsys.arch_os";
+const ATTR_NIX_SYSTEM = "detsys.nix_system";
+const ATTR_FEATURE_PREFIX = "detsys.feature.";
+const ATTR_GITHUB_EVENT_NAME = "detsys.github.event_name";
+const ATTR_GITHUB_ACTION_REPOSITORY = "detsys.github.action_repository";
+const ATTR_GITHUB_REPOSITORY_HASH = "detsys.github.repository_hash";
+const ATTR_GITHUB_ORGANIZATION_HASH = "detsys.github.organization_hash";
+const ATTR_GITHUB_WORKFLOW_HASH = "detsys.github.workflow_hash";
+const ATTR_GITHUB_WORKFLOW_JOB_HASH = "detsys.github.workflow_job_hash";
+const ATTR_GITHUB_WORKFLOW_RUN_HASH = "detsys.github.workflow_run_hash";
+const ATTR_GITHUB_WORKFLOW_RUN_DIFFERENTIATOR_HASH = "detsys.github.workflow_run_differentiator_hash";
+const ATTR_ARTIFACT_NAME = "detsys.artifact.name";
+const ATTR_ARTIFACT_FETCH_SUFFIX = "detsys.artifact.fetch_suffix";
+const ATTR_ARTIFACT_CACHE_HIT = "detsys.artifact.cache_hit";
+const ATTR_SOURCE_URL = "detsys.source.url";
+const ATTR_SOURCE_ETAG = "detsys.source.etag";
+const ATTR_SOURCE_CHECKSUMS_SHA256 = "detsys.source.checksums_sha256";
+const ATTR_NIX_LOCATION = "detsys.nix.location";
+const ATTR_NIX_VERSION = "detsys.nix.version";
+const ATTR_NIX_STORE_TRUST = "detsys.nix.store_trust";
+const ATTR_NIX_STORE_VERSION = "detsys.nix.store_version";
+const ATTR_NIX_STORE_CHECK_METHOD = "detsys.nix.store_check_method";
+const ATTR_NIX_STORE_CHECK_ERROR = "detsys.nix.store_check_error";
+const ATTR_ATTACHMENT_NAME = "detsys.attachment.name";
+const ATTR_ATTACHMENT_PATH = "detsys.attachment.path";
 const STATE_KEY_EXECUTION_PHASE = "detsys_action_execution_phase";
 const STATE_KEY_NIX_NOT_FOUND = "detsys_action_nix_not_found";
 const STATE_NOT_FOUND = "not-found";
 const STATE_KEY_CROSS_PHASE_ID = "detsys_cross_phase_id";
-const STATE_BACKTRACE_START_TIMESTAMP = "detsys_backtrace_start_timestamp";
-const DIAGNOSTIC_ENDPOINT_TIMEOUT_MS = 1e4;
+const STATE_KEY_TRACEPARENT = "detsys_otel_traceparent";
+const STATE_KEY_JOB_TRACEPARENT = "detsys_otel_job_traceparent";
+const STATE_KEY_JOB_SPAN_START = "detsys_otel_job_span_start";
+const ENV_TRACEPARENT = "TRACEPARENT";
+const SPAN_JOB = "github_actions_job";
+const SPAN_CHECK_IN = "check_in";
 const CHECK_IN_ENDPOINT_TIMEOUT_MS = 1e3;
-const PROGRAM_NAME_CRASH_DENY_LIST = [
-	"nix-expr-tests",
-	"nix-store-tests",
-	"nix-util-tests"
-];
 const determinateStateDir = "/var/lib/determinate";
 const determinateIdentityFile = path.join(determinateStateDir, "identity.json");
 const isRoot = typeof process.geteuid === "function" && process.geteuid() === 0;
@@ -861,14 +1275,14 @@ async function sudoWriteCorrelationHashes(hashes) {
 	const buffer = Buffer.from(hashes);
 	const code = await exec$1.exec("sudo", ["tee", determinateIdentityFile], {
 		input: buffer,
-		outStream: createWriteStream("/dev/null")
+		outStream: nodeFs.createWriteStream("/dev/null")
 	});
 	if (code !== 0) throw new Error(`sudo tee exit: ${code}`);
 }
 /** Writes correlation hashes to the Determinate state directory, escalating if necessary */
 async function writeCorrelationHashes(hashes) {
 	await ensureDeterminateStateDir();
-	if (isRoot) await fs.writeFile(determinateIdentityFile, hashes, "utf-8");
+	if (isRoot) await fs$1.writeFile(determinateIdentityFile, hashes, "utf-8");
 	else return sudoWriteCorrelationHashes(hashes);
 }
 var DetSysAction = class {
@@ -881,6 +1295,7 @@ var DetSysAction = class {
 	constructor(actionOptions) {
 		this.actionOptions = makeOptionsConfident(actionOptions);
 		this.idsHost = new IdsHost(this.actionOptions.idsProjectName, actionOptions.diagnosticsSuffix, process.env["INPUT_DIAGNOSTIC-ENDPOINT"], getNumberOrUndefined("timeout-request"));
+		this.telemetry = new Telemetry();
 		this.exceptionAttachments = /* @__PURE__ */ new Map();
 		this.nixStoreTrust = "unknown";
 		this.strictMode = getBool("_internal-strict-mode");
@@ -889,54 +1304,33 @@ var DetSysAction = class {
 			process.env["ACTIONS_ID_TOKEN_REQUEST_TOKEN"] = void 0;
 		}
 		this.features = {};
-		this.featureEventMetadata = {};
-		this.events = [];
+		this.pendingAttributes = {};
 		this.getCrossPhaseId();
-		this.collectBacktraceSetup();
-		this.facts = {
-			$lib: "idslib",
-			$lib_version: pkgVersion,
-			project: this.actionOptions.name,
-			ids_project: this.actionOptions.idsProjectName
-		};
-		for (const [target, env] of [
-			["github_action_ref", "GITHUB_ACTION_REF"],
-			["github_action_repository", "GITHUB_ACTION_REPOSITORY"],
-			["github_event_name", "GITHUB_EVENT_NAME"],
-			["$os", "RUNNER_OS"],
-			["arch", "RUNNER_ARCH"]
-		]) {
-			const value = process.env[env];
-			if (value) this.facts[target] = value;
-		}
 		this.identity = identify();
 		this.archOs = getArchOs();
 		this.nixSystem = getNixPlatform(this.archOs);
-		this.facts.$app_name = `${this.actionOptions.name}/action`;
-		this.facts.arch_os = this.archOs;
-		this.facts.nix_system = this.nixSystem;
-		getDetails().then((details) => {
-			if (details.name !== "unknown") this.addFact(FACT_OS, details.name);
-			if (details.version !== "unknown") this.addFact(FACT_OS_VERSION, details.version);
-		}).catch((e) => {
+		this.systemDetails = getDetails().then((details) => ({
+			name: details.name,
+			version: details.version
+		})).catch((e) => {
 			actionsCore.debug(`Failure getting platform details: ${stringifyError$1(e)}`);
 		});
 		this.executionPhase = this.determineExecutionPhase();
-		this.facts.execution_phase = this.executionPhase;
 		if (this.actionOptions.fetchStyle === "gh-env-style") this.architectureFetchSuffix = this.archOs;
 		else if (this.actionOptions.fetchStyle === "nix-style") this.architectureFetchSuffix = this.nixSystem;
 		else if (this.actionOptions.fetchStyle === "universal") this.architectureFetchSuffix = "universal";
 		else throw new Error(`fetchStyle ${this.actionOptions.fetchStyle} is not a valid style`);
 		this.sourceParameters = constructSourceParameters(this.actionOptions.legacySourcePrefix);
-		this.recordEvent(`begin_${this.executionPhase}`);
 	}
 	/**
-	* Attach a file to the diagnostics data in error conditions.
+	* Attach a file to the telemetry for this run, to be emitted if the Action
+	* fails.
 	*
 	* The file at `location` doesn't need to exist when stapleFile is called.
 	*
-	* If the file doesn't exist or is unreadable when trying to staple the attachments, the JS error will be stored in a context value at `staple_failure_{name}`.
-	* If the file is readable, the file's contents will be stored in a context value at `staple_value_{name}`.
+	* Each attachment becomes one OpenTelemetry log record, correlated to the
+	* phase's span: the file's contents as the body if it can be read, the
+	* reason it could not be read otherwise.
 	*/
 	stapleFile(name, location) {
 		this.exceptionAttachments.set(name, location);
@@ -954,9 +1348,29 @@ var DetSysAction = class {
 		const tmpDir = process.env["RUNNER_TEMP"] || tmpdir();
 		return path.join(tmpDir, `${this.actionOptions.name}-${randomUUID()}`);
 	}
-	addFact(key, value) {
-		this.facts[key] = value;
+	/**
+	* Describe this run with an attribute.
+	*
+	* The attribute lands on the phase's root span, not on whichever span
+	* happens to be active, because it describes the run as a whole. Set it
+	* whenever the value becomes known: attributes set before the span opens
+	* are replayed onto it.
+	*
+	* Namespace your keys, as OpenTelemetry expects: `detsys.nix.version`, not
+	* `nix_version`.
+	*/
+	setAttribute(key, value) {
+		if (this.phaseSpan === void 0) this.pendingAttributes[key] = value;
+		else this.phaseSpan.setAttribute(key, value);
 	}
+	/**
+	* The diagnostics endpoint for the programs this Action runs, such as
+	* `nix-installer` and `magic-nix-cache`.
+	*
+	* This library reports nothing there. Its own telemetry is OpenTelemetry;
+	* see {@link getTelemetryEnvironment} for putting a child process's
+	* telemetry in this run's trace.
+	*/
 	async getDiagnosticsUrl() {
 		return await this.idsHost.getDiagnosticsUrl();
 	}
@@ -974,20 +1388,17 @@ var DetSysAction = class {
 	getCorrelationHashes() {
 		return this.identity;
 	}
-	recordEvent(eventName, context = {}) {
-		const prefixedName = eventName === "$feature_flag_called" || eventName === "$groupidentify" ? eventName : `${this.actionOptions.eventPrefix}${eventName}`;
-		this.events.push({
-			name: prefixedName,
-			distinct_id: this.identity.$anon_distinct_id,
-			uuid: randomUUID(),
-			timestamp: /* @__PURE__ */ new Date(),
-			properties: {
-				...context,
-				...this.identity,
-				...this.facts,
-				...Object.fromEntries(Object.entries(this.featureEventMetadata).map(([name, variant]) => [`$feature/${name}`, variant]))
-			}
-		});
+	/**
+	* Record that something happened, as a span event.
+	*
+	* The event lands on whichever span is active, so that it sits on the
+	* operation that produced it, and on the phase's root span when there is no
+	* nested span in progress.
+	*
+	* Namespace your attribute keys, as OpenTelemetry expects.
+	*/
+	addEvent(name, attributes) {
+		(otelApi.trace.getActiveSpan() ?? this.phaseSpan)?.addEvent(name, attributes);
 	}
 	/**
 	* Unpacks the closure returned by `fetchArtifact()`, imports the
@@ -997,7 +1408,7 @@ var DetSysAction = class {
 	async unpackClosure(bin) {
 		const artifact = await this.fetchArtifact();
 		const { stdout } = await promisify(exec)(`cat "${artifact}" | xz -d | nix-store --import`);
-		return `${stdout.split(os$1.EOL).at(-2)}/bin/${bin}`;
+		return `${stdout.split(os.EOL).at(-2)}/bin/${bin}`;
 	}
 	/**
 	* Fetches the executable at the URL determined by the `source-*` inputs and
@@ -1005,7 +1416,7 @@ var DetSysAction = class {
 	*/
 	async fetchExecutable() {
 		const binaryPath = await this.fetchArtifact();
-		await chmod(binaryPath, constants.S_IXUSR | constants.S_IXGRP);
+		await chmod(binaryPath, nodeFs.constants.S_IXUSR | nodeFs.constants.S_IXGRP);
 		return binaryPath;
 	}
 	get isMain() {
@@ -1015,63 +1426,219 @@ var DetSysAction = class {
 		return this.executionPhase === "post";
 	}
 	async executeAsync() {
+		const phaseStartTime = /* @__PURE__ */ new Date();
 		try {
-			await this.checkIn();
-			const correlationHashes = JSON.stringify(this.getCorrelationHashes());
-			process.env.DETSYS_CORRELATION = correlationHashes;
-			try {
-				await writeCorrelationHashes(correlationHashes);
-			} catch (error) {
-				this.recordEvent(EVENT_STORE_IDENTITY_FAILED, { error: String(error) });
-			}
-			if (!await this.preflightRequireNix()) {
-				this.recordEvent(EVENT_PREFLIGHT_REQUIRE_NIX_DENIED);
-				return;
-			} else {
-				await this.preflightNixStoreInfo();
-				await this.preflightNixVersion();
-				this.addFact(FACT_NIX_STORE_TRUST, this.nixStoreTrust);
-			}
-			if (this.isMain) {
-				this.recordGroup();
-				await this.main();
-				await this.preflightNixVersion();
-			} else if (this.isPost) await this.post();
-			this.addFact(FACT_ENDED_WITH_EXCEPTION, false);
+			this.announceJobTrace(phaseStartTime);
+			await this.startTelemetry();
+			this.startPhaseSpan(phaseStartTime);
+			await this.withPhaseSpanActive(async () => {
+				await withSpan(SPAN_CHECK_IN, async () => {
+					await this.checkIn();
+				});
+				const correlationHashes = JSON.stringify(this.getCorrelationHashes());
+				process.env.DETSYS_CORRELATION = correlationHashes;
+				try {
+					await writeCorrelationHashes(correlationHashes);
+				} catch (error) {
+					this.addEvent(EVENT_STORE_IDENTITY_FAILED, { [semconv.ATTR_EXCEPTION_MESSAGE]: stringifyError$1(error) });
+				}
+				if (!await this.preflightRequireNix()) {
+					this.addEvent(EVENT_PREFLIGHT_REQUIRE_NIX_DENIED);
+					return;
+				} else {
+					await this.preflightNixStoreInfo();
+					await this.preflightNixVersion();
+					this.setAttribute(ATTR_NIX_STORE_TRUST, this.nixStoreTrust);
+				}
+				if (this.isMain) {
+					await this.main();
+					await this.preflightNixVersion();
+				} else if (this.isPost) await this.post();
+			});
 		} catch (e) {
-			this.addFact(FACT_ENDED_WITH_EXCEPTION, true);
 			const reportable = stringifyError$1(e);
-			this.addFact(FACT_FINAL_EXCEPTION, reportable);
-			if (this.isPost) actionsCore.warning(reportable);
-			else actionsCore.setFailed(reportable);
-			const doGzip = promisify(gzip);
-			const exceptionContext = /* @__PURE__ */ new Map();
-			for (const [attachmentLabel, filePath] of this.exceptionAttachments) try {
-				const buf = await doGzip(readFileSync(filePath));
-				exceptionContext.set(`staple_value_${attachmentLabel}`, buf.toString("base64"));
-			} catch (innerError) {
-				exceptionContext.set(`staple_failure_${attachmentLabel}`, stringifyError$1(innerError));
-			}
-			this.recordEvent(EVENT_EXCEPTION, Object.fromEntries(exceptionContext));
+			if (this.phaseSpan !== void 0) recordSpanError(this.phaseSpan, e);
+			if (this.isPost) warning(reportable);
+			else setFailed(reportable);
+			await this.withPhaseSpanActive(async () => {
+				await this.emitAttachments();
+			});
 		} finally {
-			if (this.isPost) await this.collectBacktraces();
 			await this.complete();
 		}
 	}
+	/**
+	* Run `fn` with the phase's root span as the active span, so anything it
+	* starts is parented into this phase's trace.
+	*/
+	async withPhaseSpanActive(fn) {
+		const span = this.phaseSpan;
+		if (span === void 0) return await fn();
+		return await otelApi.context.with(otelApi.trace.setSpan(otelApi.context.active(), span), fn);
+	}
+	/**
+	* Start the OpenTelemetry export.
+	*
+	* All runs export their data.
+	* To stop the export, set `OTEL_SDK_DISABLED` to `true`, or set
+	* `OTEL_EXPORTER_OTLP_ENDPOINT` to an empty value.
+	* The SDK then does not start.
+	* The OpenTelemetry API stays in its no-op state.
+	* Each span and log record then does nothing.
+	* Thus the call sites do not test if the export is on.
+	*/
+	async startTelemetry() {
+		this.telemetry.start({
+			serviceName: `${this.actionOptions.name}-action`,
+			serviceVersion: process.env["GITHUB_ACTION_REF"],
+			resourceAttributes: await this.telemetryResourceAttributes()
+		});
+	}
+	/**
+	* Put every Action of this workflow job in one trace.
+	*
+	* A job runs each Action as a process of its own.
+	* Thus the Actions can only agree on a trace through the job's environment.
+	* The first Action to run makes the identity of the job's span and exports it
+	* as `$TRACEPARENT`.
+	* Each later step finds it there: the other Actions, and the programs the
+	* workflow runs, such as Nix.
+	*
+	* The span itself starts and ends in the post phase of the Action that
+	* announced it.
+	* GitHub Actions runs the post phases in the reverse of the order of the main
+	* phases, thus that phase is the last one of the job.
+	* The span then covers the whole job.
+	* See {@link endJobSpan}.
+	*
+	* A `$TRACEPARENT` that is already set belongs to an earlier Action, or to the
+	* system that started the workflow.
+	* Do not change it, and join that trace.
+	*/
+	announceJobTrace(startTime) {
+		if (!this.isMain || !exportEnabled()) return;
+		if (process.env[ENV_TRACEPARENT]) return;
+		const traceparent = newTraceparent();
+		actionsCore.exportVariable(ENV_TRACEPARENT, traceparent);
+		actionsCore.saveState(STATE_KEY_JOB_TRACEPARENT, traceparent);
+		actionsCore.saveState(STATE_KEY_JOB_SPAN_START, `${startTime.getTime()}`);
+	}
+	/**
+	* End the job's span, if this Action is the one that announced it.
+	*
+	* The span also starts here.
+	* A span belongs to the process that ends it, and the process that made the
+	* announcement stopped long ago.
+	* See {@link announceJobTrace}.
+	*/
+	endJobSpan() {
+		if (!this.isPost) return;
+		const traceparent = actionsCore.getState(STATE_KEY_JOB_TRACEPARENT);
+		if (traceparent === "") return;
+		const startTime = parseInt(actionsCore.getState(STATE_KEY_JOB_SPAN_START), 10);
+		this.telemetry.startAnnouncedSpan(SPAN_JOB, traceparent, new Date(Number.isFinite(startTime) ? startTime : Date.now()))?.end();
+	}
+	/**
+	* Start the root span of this execution phase.
+	*
+	* The span starts at the moment the phase did, and thus covers the start of
+	* the SDK, which comes before it.
+	*
+	* `main` and `post` are separate processes.
+	* Thus the main phase saves the identity of its span in the Action's state,
+	* and the post phase makes its span a child of it.
+	* A `$TRACEPARENT` in the environment is the span of the workflow job, or of
+	* the system that started the workflow.
+	*/
+	startPhaseSpan(startTime) {
+		if (!this.telemetry.enabled) return;
+		const parent = actionsCore.getState(STATE_KEY_TRACEPARENT) || process.env[ENV_TRACEPARENT] || void 0;
+		const span = getTracer().startSpan(`${this.actionOptions.name}:${this.executionPhase}`, { startTime }, contextFromTraceparent(parent));
+		span.setAttributes(this.pendingAttributes);
+		this.pendingAttributes = {};
+		const traceparent = traceparentOf(span);
+		if (traceparent !== void 0) {
+			process.env[ENV_TRACEPARENT] = traceparent;
+			if (this.isMain) actionsCore.saveState(STATE_KEY_TRACEPARENT, traceparent);
+		}
+		this.phaseSpan = span;
+	}
+	/**
+	* The stable, run-scoped attributes attached to every span and log record.
+	*
+	* The correlation data here is hashed and does not identify a repository,
+	* an organization, or a person.
+	*/
+	async telemetryResourceAttributes() {
+		const details = await this.systemDetails;
+		return {
+			[semconvIncubating.ATTR_OS_TYPE]: osType(),
+			[semconvIncubating.ATTR_HOST_ARCH]: hostArch(),
+			...details?.name === void 0 || details.name === "unknown" ? {} : { [semconvIncubating.ATTR_OS_NAME]: details.name },
+			...details?.version === void 0 || details.version === "unknown" ? {} : { [semconvIncubating.ATTR_OS_VERSION]: details.version },
+			[ATTR_PROJECT]: this.actionOptions.name,
+			[ATTR_IDS_PROJECT]: this.actionOptions.idsProjectName,
+			[ATTR_EXECUTION_PHASE]: this.executionPhase,
+			[ATTR_CROSS_PHASE_ID]: this.getCrossPhaseId(),
+			[ATTR_ANONYMOUS_ID]: this.identity.$anon_distinct_id,
+			[ATTR_CORRELATION_SOURCE]: this.identity.correlation_source,
+			[ATTR_ARCH_OS]: this.archOs,
+			[ATTR_NIX_SYSTEM]: this.nixSystem,
+			[ATTR_GITHUB_EVENT_NAME]: process.env["GITHUB_EVENT_NAME"],
+			[ATTR_GITHUB_ACTION_REPOSITORY]: process.env["GITHUB_ACTION_REPOSITORY"],
+			[ATTR_GITHUB_REPOSITORY_HASH]: this.identity.github_repository_hash,
+			[ATTR_GITHUB_ORGANIZATION_HASH]: this.identity.$groups["github_organization"],
+			[ATTR_GITHUB_WORKFLOW_HASH]: this.identity.github_workflow_hash,
+			[ATTR_GITHUB_WORKFLOW_JOB_HASH]: this.identity.github_workflow_job_hash,
+			[ATTR_GITHUB_WORKFLOW_RUN_HASH]: this.identity.github_workflow_run_hash,
+			[ATTR_GITHUB_WORKFLOW_RUN_DIFFERENTIATOR_HASH]: this.identity.github_workflow_run_differentiator_hash
+		};
+	}
+	/**
+	* The W3C `traceparent` identifying the span currently in progress.
+	*
+	* Hand this to a child process -- as `$TRACEPARENT` -- so that its own
+	* OpenTelemetry data joins this Action's trace. Returns undefined when
+	* OpenTelemetry export is disabled for this run.
+	*/
+	getTraceparent() {
+		return traceparentOf(otelApi.trace.getActiveSpan() ?? this.phaseSpan);
+	}
+	/**
+	* The environment variables that let a child process add data to this
+	* Action's trace: the current `$TRACEPARENT` and the OTLP export settings.
+	*
+	* Add these variables to the environment of each child process to trace.
+	* A child that inherits this process's environment already has the OTLP
+	* settings; only `$TRACEPARENT` changes as the run proceeds.
+	*
+	* The result is empty if the OpenTelemetry export is off.
+	* Thus it is always safe to add them.
+	*/
+	async getTelemetryEnvironment() {
+		if (!this.telemetry.enabled) return {};
+		const environment = otlpExportEnvironment();
+		const traceparent = this.getTraceparent();
+		if (traceparent !== void 0) environment[ENV_TRACEPARENT] = traceparent;
+		return environment;
+	}
 	async getClient() {
 		return await this.idsHost.getGot((incitingError, prevUrl, nextUrl) => {
 			this.recordPlausibleTimeout(incitingError);
-			this.recordEvent("ids-failover", {
-				previousUrl: prevUrl.toString(),
-				nextUrl: nextUrl.toString()
+			this.addEvent(EVENT_IDS_FAILOVER, {
+				"detsys.ids.previous_url": prevUrl.toString(),
+				"detsys.ids.next_url": nextUrl.toString()
 			});
 		});
 	}
+	/**
+	* Check in, and tell the user about the incidents and the maintenance the
+	* check-in reports.
+	*/
 	async checkIn() {
 		const checkin = await this.requestCheckIn();
 		if (checkin === void 0) return;
 		this.features = checkin.options;
-		for (const [key, feature] of Object.entries(this.features)) this.featureEventMetadata[key] = feature.variant;
 		const impactSymbol = /* @__PURE__ */ new Map([
 			["none", "⚪"],
 			["maintenance", "🛠️"],
@@ -1092,24 +1659,60 @@ var DetSysAction = class {
 			}
 		}
 	}
+	/**
+	* The variant of a feature flag this run resolved, if the check-in returned
+	* one.
+	*
+	* Each variant this Action asks for becomes an attribute of the run, under
+	* `detsys.feature.`, so the telemetry can be sliced by the flags that
+	* changed what the run did.
+	*/
 	getFeature(name) {
 		if (!this.features.hasOwnProperty(name)) return;
-		const result = this.features[name];
-		if (result === void 0) return;
-		this.recordEvent("$feature_flag_called", {
-			$feature_flag: name,
-			$feature_flag_response: result.variant
-		});
-		return result;
-	}
-	recordGroup() {
-		const ghorg_hash = this.identity.$groups["github_organization"];
-		const ghorg_name = process.env["GITHUB_REPOSITORY_OWNER"];
-		if (ghorg_hash !== void 0 && ghorg_name !== void 0) this.recordEvent("$groupidentify", {
-			$group_type: "github_organization",
-			$group_key: ghorg_hash,
-			$group_set: { name: ghorg_name }
-		});
+		const feature = this.features[name];
+		this.setAttribute(`${ATTR_FEATURE_PREFIX}${name}`, feature.variant);
+		return feature;
+	}
+	/**
+	* The person properties the check-in evaluates feature flags against.
+	*
+	* These names are the flag-targeting contract with the feature flag
+	* service, which is why they keep their `$`-prefixed spelling. They are not
+	* telemetry: nothing here is reported anywhere. The telemetry for this run
+	* is OpenTelemetry, and it names the same values the way OpenTelemetry
+	* does.
+	*/
+	async checkInPersonProperties() {
+		const properties = {
+			ci: "github",
+			$lib: "idslib",
+			$lib_version: "1.0",
+			$app_name: `${this.actionOptions.name}/action`,
+			project: this.actionOptions.name,
+			ids_project: this.actionOptions.idsProjectName,
+			arch_os: this.archOs,
+			nix_system: this.nixSystem,
+			execution_phase: this.executionPhase
+		};
+		for (const [target, variable] of [
+			["github_action_ref", "GITHUB_ACTION_REF"],
+			["github_action_repository", "GITHUB_ACTION_REPOSITORY"],
+			["github_event_name", "GITHUB_EVENT_NAME"],
+			["$os", "RUNNER_OS"],
+			["arch", "RUNNER_ARCH"]
+		]) {
+			const value = process.env[variable];
+			if (value) properties[target] = value;
+		}
+		const details = await this.systemDetails;
+		if (details !== void 0) {
+			if (details.name !== "unknown") properties.$os = details.name;
+			if (details.version !== "unknown") properties.$os_version = details.version;
+		}
+		return {
+			...properties,
+			...this.identity
+		};
 	}
 	/**
 	* Check in to install.determinate.systems, to accomplish three things:
@@ -1128,11 +1731,7 @@ var DetSysAction = class {
 					distinct_id: this.identity.$anon_distinct_id,
 					anon_distinct_id: this.identity.$anon_distinct_id,
 					groups: this.identity.$groups,
-					person_properties: {
-						ci: "github",
-						...this.identity,
-						...this.facts
-					}
+					person_properties: await this.checkInPersonProperties()
 				};
 				return await (await this.getClient()).post(checkInUrl, {
 					json: props,
@@ -1147,12 +1746,12 @@ var DetSysAction = class {
 	}
 	recordPlausibleTimeout(e) {
 		if (e instanceof TimeoutError && "timings" in e && "request" in e) {
-			const reportContext = {
-				url: e.request.requestUrl?.toString(),
-				retry_count: e.request.retryCount
+			const attributes = {
+				[semconv.ATTR_URL_FULL]: e.request.requestUrl?.toString(),
+				[semconv.ATTR_HTTP_REQUEST_RESEND_COUNT]: e.request.retryCount
 			};
-			for (const [key, value] of Object.entries(e.timings.phases)) if (Number.isFinite(value)) reportContext[`timing_phase_${key}`] = value;
-			this.recordEvent("timeout", reportContext);
+			for (const [key, value] of Object.entries(e.timings.phases)) if (Number.isFinite(value)) attributes[`detsys.http.timing.${key}`] = value;
+			this.addEvent(EVENT_REQUEST_TIMEOUT, attributes);
 		}
 	}
 	/**
@@ -1170,49 +1769,54 @@ var DetSysAction = class {
 	async fetchArtifact() {
 		const sourceBinary = getStringOrNull("source-binary");
 		if (sourceBinary !== null && sourceBinary !== "") {
-			actionsCore.debug(`Using the provided source binary at ${sourceBinary}`);
+			debug(`Using the provided source binary at ${sourceBinary}`);
 			return sourceBinary;
 		}
-		const expectedArtifactHash = await this.resolveExpectedArtifactHash();
-		actionsCore.startGroup(`Downloading ${this.actionOptions.name} for ${this.architectureFetchSuffix}`);
-		try {
-			actionsCore.info(`Fetching from ${await this.getSourceUrl()}`);
-			const correlatedUrl = await this.getSourceUrl();
-			correlatedUrl.searchParams.set("ci", "github");
-			correlatedUrl.searchParams.set("correlation", JSON.stringify(this.identity));
-			const versionCheckup = await (await this.getClient()).head(correlatedUrl);
-			if (versionCheckup.headers.etag) {
-				const v = versionCheckup.headers.etag;
-				this.addFact(FACT_SOURCE_URL_ETAG, v);
-				actionsCore.debug(`Checking the tool cache for ${await this.getSourceUrl()} at ${v}`);
-				const cached = await this.getCachedVersion(v, expectedArtifactHash);
-				if (cached) {
-					this.facts[FACT_ARTIFACT_FETCHED_FROM_CACHE] = true;
-					actionsCore.debug(`Tool cache hit.`);
-					await this.verifyArtifactHash(cached, expectedArtifactHash);
-					return cached;
+		return await withSpan("fetch_artifact", async (span) => {
+			const expectedArtifactHash = await this.resolveExpectedArtifactHash();
+			actionsCore.startGroup(`Downloading ${this.actionOptions.name} for ${this.architectureFetchSuffix}`);
+			try {
+				info(`Fetching from ${await this.getSourceUrl()}`);
+				const correlatedUrl = await this.getSourceUrl();
+				correlatedUrl.searchParams.set("ci", "github");
+				correlatedUrl.searchParams.set("correlation", JSON.stringify(this.identity));
+				const versionCheckup = await (await this.getClient()).head(correlatedUrl);
+				if (versionCheckup.headers.etag) {
+					const v = versionCheckup.headers.etag;
+					this.setAttribute(ATTR_SOURCE_ETAG, v);
+					debug(`Checking the tool cache for ${await this.getSourceUrl()} at ${v}`);
+					const cached = await this.getCachedVersion(v, expectedArtifactHash);
+					if (cached) {
+						span.setAttribute(ATTR_ARTIFACT_CACHE_HIT, true);
+						debug(`Tool cache hit.`);
+						await this.verifyArtifactHash(cached, expectedArtifactHash);
+						return cached;
+					}
 				}
-			}
-			this.facts[FACT_ARTIFACT_FETCHED_FROM_CACHE] = false;
-			actionsCore.debug(`No match from the cache, re-fetching from the redirect: ${versionCheckup.url}`);
-			const destFile = this.getTemporaryName();
-			const fetchStream = await this.downloadFile(new URL(versionCheckup.url), destFile);
-			await this.verifyArtifactHash(destFile, expectedArtifactHash);
-			if (fetchStream.response?.headers.etag) {
-				const v = fetchStream.response.headers.etag;
-				try {
-					await this.saveCachedVersion(v, destFile, expectedArtifactHash);
-				} catch (e) {
-					actionsCore.debug(`Error caching the artifact: ${stringifyError$1(e)}`);
+				span.setAttribute(ATTR_ARTIFACT_CACHE_HIT, false);
+				debug(`No match from the cache, re-fetching from the redirect: ${versionCheckup.url}`);
+				const destFile = this.getTemporaryName();
+				const fetchStream = await this.downloadFile(new URL(versionCheckup.url), destFile);
+				await this.verifyArtifactHash(destFile, expectedArtifactHash);
+				if (fetchStream.response?.headers.etag) {
+					const v = fetchStream.response.headers.etag;
+					try {
+						await this.saveCachedVersion(v, destFile, expectedArtifactHash);
+					} catch (e) {
+						debug(`Error caching the artifact: ${stringifyError$1(e)}`);
+					}
 				}
+				return destFile;
+			} catch (e) {
+				this.recordPlausibleTimeout(e);
+				throw e;
+			} finally {
+				actionsCore.endGroup();
 			}
-			return destFile;
-		} catch (e) {
-			this.recordPlausibleTimeout(e);
-			throw e;
-		} finally {
-			actionsCore.endGroup();
-		}
+		}, {
+			[ATTR_ARTIFACT_NAME]: this.actionOptions.name,
+			[ATTR_ARTIFACT_FETCH_SUFFIX]: this.architectureFetchSuffix
+		});
 	}
 	/**
 	* Read the `source-checksums-url` and `source-checksums-sha256` inputs and,
@@ -1228,7 +1832,7 @@ var DetSysAction = class {
 		if (checksumsUrl === null || checksumsSha256 === null) throw new Error("`source-checksums-url` and `source-checksums-sha256` must be set together");
 		assertChecksumSourceIsPinned(this.sourceParameters);
 		const expectedFileHash = checksumsSha256.toLowerCase();
-		this.addFact(FACT_SOURCE_CHECKSUMS_SHA256, expectedFileHash);
+		this.setAttribute(ATTR_SOURCE_CHECKSUMS_SHA256, expectedFileHash);
 		const parsedUrl = new URL(checksumsUrl);
 		const safeUrl = parsedUrl.origin + parsedUrl.pathname;
 		actionsCore.info(`Fetching checksums file from ${safeUrl}`);
@@ -1257,13 +1861,16 @@ var DetSysAction = class {
 		if (this.strictMode) actionsCore.setFailed(`strict mode failure: ${msg}`);
 	}
 	async downloadFile(url, destination) {
+		return await withSpan("download_file", async () => this.download(url, destination));
+	}
+	async download(url, destination) {
 		const client = await this.getClient();
 		return new Promise((resolve, reject) => {
 			let writeStream;
 			let failed = false;
 			const retry = (stream) => {
 				if (writeStream) writeStream.destroy();
-				writeStream = createWriteStream(destination, {
+				writeStream = nodeFs.createWriteStream(destination, {
 					encoding: "binary",
 					mode: 493
 				});
@@ -1283,8 +1890,10 @@ var DetSysAction = class {
 		});
 	}
 	async complete() {
-		this.recordEvent(`complete_${this.executionPhase}`);
-		await this.submitEvents();
+		this.phaseSpan?.end();
+		this.phaseSpan = void 0;
+		this.endJobSpan();
+		await this.telemetry.shutdown();
 	}
 	async getCheckInUrl() {
 		const checkInUrl = await this.idsHost.getDynamicRootUrl();
@@ -1295,7 +1904,7 @@ var DetSysAction = class {
 	async getSourceUrl() {
 		const p = this.sourceParameters;
 		if (p.url) {
-			this.addFact(FACT_SOURCE_URL, p.url);
+			this.setAttribute(ATTR_SOURCE_URL, p.url);
 			return new URL(p.url);
 		}
 		const fetchUrl = await this.idsHost.getRootUrl();
@@ -1306,7 +1915,7 @@ var DetSysAction = class {
 		else if (p.revision) fetchUrl.pathname += `/rev/${p.revision}`;
 		else fetchUrl.pathname += `/stable`;
 		fetchUrl.pathname += `/${this.architectureFetchSuffix}`;
-		this.addFact(FACT_SOURCE_URL, fetchUrl.toString());
+		this.setAttribute(ATTR_SOURCE_URL, fetchUrl.toString());
 		return fetchUrl;
 	}
 	cacheKey(version, expectedHash) {
@@ -1315,179 +1924,188 @@ var DetSysAction = class {
 		return `determinatesystem-${this.actionOptions.name}-${this.architectureFetchSuffix}-${cleanedVersion}${hashSuffix}`;
 	}
 	async getCachedVersion(version, expectedHash) {
-		const startCwd = process.cwd();
-		try {
-			const tempDir = this.getTemporaryName();
-			await mkdir(tempDir);
-			process.chdir(tempDir);
-			process.env.GITHUB_WORKSPACE_BACKUP = process.env.GITHUB_WORKSPACE;
-			delete process.env.GITHUB_WORKSPACE;
-			if (await actionsCache.restoreCache([this.actionOptions.name], this.cacheKey(version, expectedHash), [], void 0, true)) {
-				this.recordEvent(EVENT_ARTIFACT_CACHE_HIT);
-				return `${tempDir}/${this.actionOptions.name}`;
+		return await withSpan("artifact_cache_restore", async (span) => {
+			const startCwd = process.cwd();
+			try {
+				const tempDir = this.getTemporaryName();
+				await mkdir(tempDir);
+				process.chdir(tempDir);
+				process.env.GITHUB_WORKSPACE_BACKUP = process.env.GITHUB_WORKSPACE;
+				delete process.env.GITHUB_WORKSPACE;
+				if (await actionsCache.restoreCache([this.actionOptions.name], this.cacheKey(version, expectedHash), [], void 0, true)) {
+					span.setAttribute(ATTR_ARTIFACT_CACHE_HIT, true);
+					return `${tempDir}/${this.actionOptions.name}`;
+				}
+				span.setAttribute(ATTR_ARTIFACT_CACHE_HIT, false);
+				return;
+			} finally {
+				process.env.GITHUB_WORKSPACE = process.env.GITHUB_WORKSPACE_BACKUP;
+				delete process.env.GITHUB_WORKSPACE_BACKUP;
+				process.chdir(startCwd);
 			}
-			this.recordEvent(EVENT_ARTIFACT_CACHE_MISS);
-			return;
-		} finally {
-			process.env.GITHUB_WORKSPACE = process.env.GITHUB_WORKSPACE_BACKUP;
-			delete process.env.GITHUB_WORKSPACE_BACKUP;
-			process.chdir(startCwd);
-		}
+		});
 	}
 	async saveCachedVersion(version, toolPath, expectedHash) {
-		const startCwd = process.cwd();
-		try {
-			const tempDir = this.getTemporaryName();
-			await mkdir(tempDir);
-			process.chdir(tempDir);
-			await copyFile(toolPath, `${tempDir}/${this.actionOptions.name}`);
-			process.env.GITHUB_WORKSPACE_BACKUP = process.env.GITHUB_WORKSPACE;
-			delete process.env.GITHUB_WORKSPACE;
-			await actionsCache.saveCache([this.actionOptions.name], this.cacheKey(version, expectedHash), void 0, true);
-			this.recordEvent(EVENT_ARTIFACT_CACHE_PERSIST);
-		} finally {
-			process.env.GITHUB_WORKSPACE = process.env.GITHUB_WORKSPACE_BACKUP;
-			delete process.env.GITHUB_WORKSPACE_BACKUP;
-			process.chdir(startCwd);
-		}
-	}
-	collectBacktraceSetup() {
-		if (!process.env.DETSYS_BACKTRACE_COLLECTOR) {
-			actionsCore.exportVariable("DETSYS_BACKTRACE_COLLECTOR", this.getCrossPhaseId());
-			actionsCore.saveState(STATE_BACKTRACE_START_TIMESTAMP, Date.now());
-		}
+		return await withSpan("artifact_cache_persist", async () => {
+			const startCwd = process.cwd();
+			try {
+				const tempDir = this.getTemporaryName();
+				await mkdir(tempDir);
+				process.chdir(tempDir);
+				await copyFile(toolPath, `${tempDir}/${this.actionOptions.name}`);
+				process.env.GITHUB_WORKSPACE_BACKUP = process.env.GITHUB_WORKSPACE;
+				delete process.env.GITHUB_WORKSPACE;
+				await actionsCache.saveCache([this.actionOptions.name], this.cacheKey(version, expectedHash), void 0, true);
+			} finally {
+				process.env.GITHUB_WORKSPACE = process.env.GITHUB_WORKSPACE_BACKUP;
+				delete process.env.GITHUB_WORKSPACE_BACKUP;
+				process.chdir(startCwd);
+			}
+		});
 	}
-	async collectBacktraces() {
-		try {
-			if (process.env.DETSYS_BACKTRACE_COLLECTOR !== this.getCrossPhaseId()) return;
-			const backtraces = await collectBacktraces(this.actionOptions.binaryNamePrefixes, this.actionOptions.binaryNamesDenyList, parseInt(actionsCore.getState(STATE_BACKTRACE_START_TIMESTAMP)));
-			actionsCore.debug(`Backtraces identified: ${backtraces.size}`);
-			if (backtraces.size > 0) this.recordEvent(EVENT_BACKTRACES, Object.fromEntries(backtraces));
-		} catch (innerError) {
-			actionsCore.debug(`Error collecting backtraces: ${stringifyError$1(innerError)}`);
+	/**
+	* Emit the files `stapleFile` collected, as log records correlated to this
+	* phase's span. The Action has already failed by the time this runs.
+	*/
+	async emitAttachments() {
+		for (const [name, location] of this.exceptionAttachments) {
+			const attributes = {
+				[ATTR_ATTACHMENT_NAME]: name,
+				[ATTR_ATTACHMENT_PATH]: location.toString()
+			};
+			try {
+				emitLogRecord("error", await readFile(location, "utf-8"), attributes);
+			} catch (innerError) {
+				emitLogRecord("error", `Attachment unavailable`, {
+					...attributes,
+					[semconv.ATTR_EXCEPTION_MESSAGE]: stringifyError$1(innerError)
+				});
+			}
 		}
 	}
 	async preflightRequireNix() {
-		let nixLocation;
-		const pathParts = (process.env["PATH"] || "").split(":");
-		for (const location of pathParts) {
-			const candidateNix = path.join(location, "nix");
-			try {
-				await fs.access(candidateNix, fs.constants.X_OK);
-				actionsCore.debug(`Found Nix at ${candidateNix}`);
-				nixLocation = candidateNix;
-				break;
-			} catch {
-				actionsCore.debug(`Nix not at ${candidateNix}`);
+		return await withSpan("preflight_require_nix", async () => {
+			let nixLocation;
+			const pathParts = (process.env["PATH"] || "").split(":");
+			for (const location of pathParts) {
+				const candidateNix = path.join(location, "nix");
+				try {
+					await fs$1.access(candidateNix, fs$1.constants.X_OK);
+					debug(`Found Nix at ${candidateNix}`);
+					nixLocation = candidateNix;
+					break;
+				} catch {
+					actionsCore.debug(`Nix not at ${candidateNix}`);
+				}
 			}
-		}
-		this.addFact(FACT_NIX_LOCATION, nixLocation || "");
-		if (this.actionOptions.requireNix === "ignore") return true;
-		if (actionsCore.getState(STATE_KEY_NIX_NOT_FOUND) === STATE_NOT_FOUND) return false;
-		if (nixLocation !== void 0) return true;
-		actionsCore.saveState(STATE_KEY_NIX_NOT_FOUND, STATE_NOT_FOUND);
-		switch (this.actionOptions.requireNix) {
-			case "fail":
-				actionsCore.setFailed(["This action can only be used when Nix is installed.", "Add `- uses: DeterminateSystems/determinate-nix-action@v3` earlier in your workflow."].join(" "));
-				break;
-			case "warn": actionsCore.warning(["This action is in no-op mode because Nix is not installed.", "Add `- uses: DeterminateSystems/determinate-nix-action@v3` earlier in your workflow."].join(" "));
-		}
-		return false;
+			this.setAttribute(ATTR_NIX_LOCATION, nixLocation || "");
+			if (this.actionOptions.requireNix === "ignore") return true;
+			if (actionsCore.getState(STATE_KEY_NIX_NOT_FOUND) === STATE_NOT_FOUND) return false;
+			if (nixLocation !== void 0) return true;
+			actionsCore.saveState(STATE_KEY_NIX_NOT_FOUND, STATE_NOT_FOUND);
+			switch (this.actionOptions.requireNix) {
+				case "fail":
+					setFailed(["This action can only be used when Nix is installed.", "Add `- uses: DeterminateSystems/determinate-nix-action@v3` earlier in your workflow."].join(" "));
+					break;
+				case "warn": warning(["This action is in no-op mode because Nix is not installed.", "Add `- uses: DeterminateSystems/determinate-nix-action@v3` earlier in your workflow."].join(" "));
+			}
+			return false;
+		});
 	}
 	async preflightNixStoreInfo() {
-		let output = "";
-		const options = {};
-		options.silent = true;
-		options.listeners = { stdout: (data) => {
-			output += data.toString();
-		} };
-		try {
-			output = "";
-			await exec$1.exec("nix", [
-				"store",
-				"info",
-				"--json"
-			], options);
-			this.addFact(FACT_NIX_STORE_CHECK_METHOD, "info");
-		} catch {
+		return await withSpan("preflight_nix_store_info", async (span) => {
+			let output = "";
+			const options = {};
+			options.silent = true;
+			options.listeners = { stdout: (data) => {
+				output += data.toString();
+			} };
 			try {
 				output = "";
 				await exec$1.exec("nix", [
 					"store",
-					"ping",
+					"info",
 					"--json"
 				], options);
-				this.addFact(FACT_NIX_STORE_CHECK_METHOD, "ping");
+				this.setAttribute(ATTR_NIX_STORE_CHECK_METHOD, "info");
 			} catch {
-				this.addFact(FACT_NIX_STORE_CHECK_METHOD, "none");
-				return;
+				try {
+					output = "";
+					await exec$1.exec("nix", [
+						"store",
+						"ping",
+						"--json"
+					], options);
+					this.setAttribute(ATTR_NIX_STORE_CHECK_METHOD, "ping");
+				} catch {
+					this.setAttribute(ATTR_NIX_STORE_CHECK_METHOD, "none");
+					return;
+				}
 			}
-		}
-		try {
-			const parsed = JSON.parse(output);
-			if (parsed.trusted === true || parsed.trusted === 1) this.nixStoreTrust = "trusted";
-			else if (parsed.trusted === false || parsed.trusted === 0) this.nixStoreTrust = "untrusted";
-			else if (parsed.trusted !== void 0) this.addFact(FACT_NIX_STORE_CHECK_ERROR, `Mysterious trusted value: ${JSON.stringify(parsed.trusted)}`);
-			this.addFact(FACT_NIX_STORE_VERSION, JSON.stringify(parsed.version));
-		} catch (e) {
-			this.addFact(FACT_NIX_STORE_CHECK_ERROR, stringifyError$1(e));
-		}
+			try {
+				const parsed = JSON.parse(output);
+				if (parsed.trusted === true || parsed.trusted === 1) this.nixStoreTrust = "trusted";
+				else if (parsed.trusted === false || parsed.trusted === 0) this.nixStoreTrust = "untrusted";
+				else if (parsed.trusted !== void 0) this.setAttribute(ATTR_NIX_STORE_CHECK_ERROR, `Mysterious trusted value: ${JSON.stringify(parsed.trusted)}`);
+				this.setAttribute(ATTR_NIX_STORE_VERSION, JSON.stringify(parsed.version));
+			} catch (e) {
+				this.setAttribute(ATTR_NIX_STORE_CHECK_ERROR, stringifyError$1(e));
+			}
+			span.setAttribute(ATTR_NIX_STORE_TRUST, this.nixStoreTrust);
+		});
 	}
 	async preflightNixVersion() {
-		let output = "unknown";
-		try {
-			({stdout: output} = await exec$1.getExecOutput("nix", ["--version"], { silent: true }));
-			output = output.trim() || "unknown";
-		} catch {}
-		this.addFact(FACT_NIX_VERSION, output);
-	}
-	async submitEvents() {
-		const diagnosticsUrl = await this.idsHost.getDiagnosticsUrl();
-		if (diagnosticsUrl === void 0) {
-			actionsCore.debug("Diagnostics are disabled. Not sending the following events:");
-			actionsCore.debug(JSON.stringify(this.events, void 0, 2));
-			return;
-		}
-		const batch = {
-			sent_at: /* @__PURE__ */ new Date(),
-			batch: this.events
-		};
-		try {
-			await (await this.getClient()).post(diagnosticsUrl, {
-				json: batch,
-				timeout: { request: DIAGNOSTIC_ENDPOINT_TIMEOUT_MS }
-			});
-		} catch (err) {
-			this.recordPlausibleTimeout(err);
-			actionsCore.debug(`Error submitting diagnostics event to ${diagnosticsUrl}: ${stringifyError$1(err)}`);
-		}
-		this.events = [];
+		return await withSpan("preflight_nix_version", async (span) => {
+			let output = "unknown";
+			try {
+				({stdout: output} = await exec$1.getExecOutput("nix", ["--version"], { silent: true }));
+				output = output.trim() || "unknown";
+			} catch {}
+			this.setAttribute(ATTR_NIX_VERSION, output);
+			span.setAttribute(ATTR_NIX_VERSION, output);
+		});
 	}
 };
 function stringifyError$1(error) {
 	return error instanceof Error || typeof error == "string" ? error.toString() : JSON.stringify(error);
 }
+/**
+* The runner's operating system, as `os.type` spells it.
+*/
+function osType() {
+	switch (platform) {
+		case "win32": return semconvIncubating.OS_TYPE_VALUE_WINDOWS;
+		case "darwin": return semconvIncubating.OS_TYPE_VALUE_DARWIN;
+		case "linux": return semconvIncubating.OS_TYPE_VALUE_LINUX;
+		default: return platform;
+	}
+}
+/**
+* The runner's architecture, as `host.arch` spells it.
+*/
+function hostArch() {
+	switch (arch) {
+		case "x64": return semconvIncubating.HOST_ARCH_VALUE_AMD64;
+		case "arm64": return semconvIncubating.HOST_ARCH_VALUE_ARM64;
+		case "ia32": return semconvIncubating.HOST_ARCH_VALUE_X86;
+		case "arm": return semconvIncubating.HOST_ARCH_VALUE_ARM32;
+		default: return arch;
+	}
+}
 function makeOptionsConfident(actionOptions) {
 	const idsProjectName = actionOptions.idsProjectName ?? actionOptions.name;
 	const finalOpts = {
 		name: actionOptions.name,
 		idsProjectName,
-		eventPrefix: actionOptions.eventPrefix || "action:",
 		fetchStyle: actionOptions.fetchStyle,
 		legacySourcePrefix: actionOptions.legacySourcePrefix,
-		requireNix: actionOptions.requireNix,
-		binaryNamePrefixes: actionOptions.binaryNamePrefixes ?? [
-			"nix",
-			"determinate-nixd",
-			actionOptions.name
-		],
-		binaryNamesDenyList: actionOptions.binaryNamesDenyList ?? PROGRAM_NAME_CRASH_DENY_LIST
+		requireNix: actionOptions.requireNix
 	};
 	actionsCore.debug("idslib options:");
 	actionsCore.debug(JSON.stringify(finalOpts, void 0, 2));
 	return finalOpts;
 }
 //#endregion
-export { DetSysAction, IdsHost, inputs_exports as inputs, platform_exports as platform, stringifyError };
+export { DetSysAction, IdsHost, SCOPE_NAME, contextFromTraceparent, getLogger, getTracer, inputs_exports as inputs, log_exports as log, platform_exports as platform, recordSpanError, stringifyError, traceContextHeaders, traceparentOf, withSpan };
 
 //# sourceMappingURL=index.mjs.map