@getargvio/argvio 0.1.0

package/dist/index.js

@@ -0,0 +1,785 @@
+import { SeverityNumber } from '@opentelemetry/api-logs';
+import { LoggerProvider, BatchLogRecordProcessor } from '@opentelemetry/sdk-logs';
+import { MeterProvider, PeriodicExportingMetricReader } from '@opentelemetry/sdk-metrics';
+import { NodeTracerProvider, BatchSpanProcessor } from '@opentelemetry/sdk-trace-node';
+import { Metadata } from '@grpc/grpc-js';
+import { OTLPTraceExporter as OTLPTraceExporter$1 } from '@opentelemetry/exporter-trace-otlp-http';
+import { OTLPTraceExporter } from '@opentelemetry/exporter-trace-otlp-grpc';
+import { OTLPMetricExporter as OTLPMetricExporter$1 } from '@opentelemetry/exporter-metrics-otlp-http';
+import { OTLPMetricExporter } from '@opentelemetry/exporter-metrics-otlp-grpc';
+import { OTLPLogExporter as OTLPLogExporter$1 } from '@opentelemetry/exporter-logs-otlp-http';
+import { OTLPLogExporter } from '@opentelemetry/exporter-logs-otlp-grpc';
+import { readFileSync, mkdirSync, writeFileSync } from 'fs';
+import { resourceFromAttributes } from '@opentelemetry/resources';
+import { ATTR_SERVICE_VERSION, ATTR_SERVICE_NAME } from '@opentelemetry/semantic-conventions';
+import { randomBytes } from 'crypto';
+import { homedir } from 'os';
+import { dirname, join } from 'path';
+
+// src/client.ts
+
+// src/tier.ts
+var Tier = {
+  /** No persistent or cross-invocation identifiers; aggregate counts only. */
+  Anonymous: 0,
+  /** Adds command path, flag names (not values), exit code, and latency. */
+  Basic: 1,
+  /** Adds session correlation and classified (not raw) error signatures. */
+  Full: 2,
+  /**
+   * The explicit opt-in tier: raw error detail (stack traces, messages)
+   * and any other field the allowlist marks opt-in-only. Never the
+   * default; a vendor or user must positively select it.
+   */
+  OptIn: 3
+};
+var RESOURCE_ATTR_TIER = "cli.analytics.tier";
+var TIER_STRINGS = {
+  [Tier.Anonymous]: "anonymous",
+  [Tier.Basic]: "basic",
+  [Tier.Full]: "full",
+  [Tier.OptIn]: "opt-in"
+};
+function tierToString(tier) {
+  return TIER_STRINGS[tier] ?? "unknown";
+}
+function parseTier(value) {
+  switch (value) {
+    case "anonymous":
+      return Tier.Anonymous;
+    case "basic":
+      return Tier.Basic;
+    case "full":
+      return Tier.Full;
+    case "opt-in":
+      return Tier.OptIn;
+    default:
+      return void 0;
+  }
+}
+function isValidTier(value) {
+  return value === Tier.Anonymous || value === Tier.Basic || value === Tier.Full || value === Tier.OptIn;
+}
+function tierAllows(tier, required) {
+  return tier >= required;
+}
+function clampTier(tier, ceiling) {
+  return tier > ceiling ? ceiling : tier;
+}
+var ErrorCategory = {
+  Unknown: "unknown",
+  /** Bad input, invalid flags/args. */
+  User: "user",
+  Validation: "validation",
+  Network: "network",
+  Auth: "auth",
+  Internal: "internal",
+  Timeout: "timeout",
+  Canceled: "canceled"
+};
+var ERROR_CATEGORY_VALUES = new Set(Object.values(ErrorCategory));
+function isValidErrorCategory(value) {
+  return ERROR_CATEGORY_VALUES.has(value);
+}
+
+// src/options.ts
+var DEFAULT_ENDPOINT_HTTP = "https://ingest.argvio.io:4318";
+var DEFAULT_ENDPOINT_GRPC = "ingest.argvio.io:4317";
+var DEFAULT_AUTH_HEADER = "x-argvio-api-key";
+var DEFAULT_EXPORT_TIMEOUT_MS = 1e4;
+var DEFAULT_SHUTDOWN_TIMEOUT_MS = 5e3;
+var DEFAULT_QUEUE_SIZE = 2048;
+function resolveConfig(apiKey, cliName, cliVersion, options = {}) {
+  const transport = options.transport ?? "http";
+  return {
+    apiKey,
+    cliName,
+    cliVersion,
+    transport,
+    endpoint: options.endpoint || (transport === "grpc" ? DEFAULT_ENDPOINT_GRPC : DEFAULT_ENDPOINT_HTTP),
+    insecure: options.insecure ?? false,
+    authHeader: options.authHeader || DEFAULT_AUTH_HEADER,
+    defaultTier: options.defaultTier ?? Tier.Anonymous,
+    consentProvider: options.consentProvider,
+    disabled: options.disabled ?? false,
+    exportTimeoutMs: options.exportTimeoutMs && options.exportTimeoutMs > 0 ? options.exportTimeoutMs : DEFAULT_EXPORT_TIMEOUT_MS,
+    shutdownTimeoutMs: options.shutdownTimeoutMs && options.shutdownTimeoutMs > 0 ? options.shutdownTimeoutMs : DEFAULT_SHUTDOWN_TIMEOUT_MS,
+    queueSize: options.queueSize && options.queueSize > 0 ? options.queueSize : DEFAULT_QUEUE_SIZE,
+    resourceAttributes: options.resourceAttributes ?? {}
+  };
+}
+var SCHEME_RE = /^[a-z][a-z0-9+.-]*:\/\//i;
+function withScheme(endpoint, insecure) {
+  if (!SCHEME_RE.test(endpoint)) {
+    return `${insecure ? "http" : "https"}://${endpoint}`;
+  }
+  return insecure ? endpoint.replace(/^https:\/\//i, "http://") : endpoint;
+}
+function grpcMetadata(cfg) {
+  const metadata = new Metadata();
+  metadata.set(cfg.authHeader, cfg.apiKey);
+  return metadata;
+}
+function httpHeaders(cfg) {
+  return { [cfg.authHeader]: cfg.apiKey };
+}
+function buildExporters(cfg) {
+  if (cfg.transport === "grpc") {
+    const url = withScheme(cfg.endpoint, cfg.insecure);
+    const metadata = grpcMetadata(cfg);
+    return {
+      trace: new OTLPTraceExporter({ url, metadata, timeoutMillis: cfg.exportTimeoutMs }),
+      metric: new OTLPMetricExporter({ url, metadata, timeoutMillis: cfg.exportTimeoutMs }),
+      log: new OTLPLogExporter({ url, metadata, timeoutMillis: cfg.exportTimeoutMs })
+    };
+  }
+  const base = withScheme(cfg.endpoint, cfg.insecure).replace(/\/+$/, "");
+  const headers = httpHeaders(cfg);
+  return {
+    trace: new OTLPTraceExporter$1({
+      url: `${base}/v1/traces`,
+      headers,
+      timeoutMillis: cfg.exportTimeoutMs
+    }),
+    metric: new OTLPMetricExporter$1({
+      url: `${base}/v1/metrics`,
+      headers,
+      timeoutMillis: cfg.exportTimeoutMs
+    }),
+    log: new OTLPLogExporter$1({
+      url: `${base}/v1/logs`,
+      headers,
+      timeoutMillis: cfg.exportTimeoutMs
+    })
+  };
+}
+var SDK_NAME = "@getargvio/argvio";
+function sdkVersion() {
+  try {
+    const pkgUrl = new URL("../package.json", import.meta.url);
+    const pkg = JSON.parse(readFileSync(pkgUrl, "utf8"));
+    return pkg.version ?? "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+function buildResource(cfg) {
+  return resourceFromAttributes({
+    [ATTR_SERVICE_NAME]: cfg.cliName,
+    [ATTR_SERVICE_VERSION]: cfg.cliVersion,
+    "telemetry.sdk.name": SDK_NAME,
+    "telemetry.sdk.version": sdkVersion(),
+    "telemetry.sdk.language": "nodejs",
+    ...cfg.resourceAttributes
+  });
+}
+
+// src/errors.ts
+var ArgvioError = class extends Error {
+  constructor(message) {
+    super(`argvio: ${message}`);
+    this.name = "ArgvioError";
+  }
+};
+var errNoProviderResolved = new ArgvioError("no consent provider resolved a tier");
+var errNoConsentFile = new ArgvioError("no consent config file path resolved");
+var errUnknownTierValue = new ArgvioError("unknown tier value in consent config");
+
+// src/consentEnv.ts
+var CI_ENV_VARS = [
+  "CI",
+  "CONTINUOUS_INTEGRATION",
+  "GITHUB_ACTIONS",
+  "GITLAB_CI",
+  "CIRCLECI",
+  "TRAVIS",
+  "JENKINS_URL",
+  "BUILDKITE",
+  "TEAMCITY_VERSION",
+  "APPVEYOR",
+  "TF_BUILD",
+  // Azure Pipelines
+  "DRONE",
+  // Drone CI
+  "CODEBUILD_BUILD_ID",
+  "BITBUCKET_BUILD_NUMBER"
+];
+function isCI() {
+  return CI_ENV_VARS.some((name) => {
+    const value = process.env[name];
+    return value !== void 0 && value !== "" && value !== "false" && value !== "0";
+  });
+}
+function isDoNotTrackRequested() {
+  const value = process.env["DO_NOT_TRACK"];
+  if (value === void 0) return false;
+  return value !== "" && value !== "0" && value !== "false";
+}
+var EnvConsentProvider = class {
+  resolve() {
+    if (isCI()) return Tier.Anonymous;
+    throw errNoProviderResolved;
+  }
+};
+var AttrCommandPath = "cli.command.path";
+var AttrCommandFlags = "cli.command.flags";
+var AttrExitCode = "cli.command.exit_code";
+var AttrHelpUsed = "cli.command.help_used";
+var AttrSessionId = "cli.session.id";
+var AttrErrorCategory = "cli.error.category";
+var AttrErrorMessage = "cli.error.message";
+var AttrErrorStack = "cli.error.stack";
+var MetricCommandDuration = "cli.command.duration";
+function newSessionId() {
+  try {
+    return randomBytes(16).toString("hex");
+  } catch {
+    return "";
+  }
+}
+
+// src/safety.ts
+var ARGVIO_DEBUG = process.env["ARGVIO_DEBUG"] === "1";
+var DroppedCounters = class {
+  queueOverflow = 0;
+  belowTierCeil = 0;
+  recoveredErrors = 0;
+  snapshot() {
+    return {
+      queueOverflowDropped: this.queueOverflow,
+      belowTierDropped: this.belowTierCeil,
+      recoveredErrors: this.recoveredErrors
+    };
+  }
+};
+function logRecovered(err) {
+  if (!ARGVIO_DEBUG) return;
+  const msg = err instanceof Error ? err.message : "(non-error thrown value)";
+  process.stderr.write(`argvio: recovered internal error: ${msg}
+`);
+}
+function safeRun(fn, counters) {
+  try {
+    fn();
+  } catch (err) {
+    if (counters) counters.recoveredErrors++;
+    logRecovered(err);
+  }
+}
+
+// src/client.ts
+var INSTRUMENTATION_NAME = "@getargvio/argvio";
+var JobQueue = class {
+  constructor(maxSize, counters) {
+    this.maxSize = maxSize;
+    this.counters = counters;
+  }
+  maxSize;
+  counters;
+  items = [];
+  draining = false;
+  push(job) {
+    if (this.items.length >= this.maxSize) {
+      this.counters.queueOverflow++;
+      return;
+    }
+    this.items.push(job);
+    this.scheduleDrain();
+  }
+  /**
+   * Enqueues a control signal (e.g. a drain sentinel) bypassing the size
+   * bound, so `waitForDrain` waits for genuine backlog instead of
+   * silently racing ahead when the queue happens to be full.
+   */
+  pushControl(job) {
+    this.items.push(job);
+    this.scheduleDrain();
+  }
+  scheduleDrain() {
+    if (this.draining) return;
+    this.draining = true;
+    setImmediate(() => {
+      void this.drain();
+    });
+  }
+  async drain() {
+    for (; ; ) {
+      const job = this.items.shift();
+      if (!job) break;
+      try {
+        await job();
+      } catch (err) {
+        this.counters.recoveredErrors++;
+        if (ARGVIO_DEBUG) {
+          const msg = err instanceof Error ? err.message : "(non-error thrown value)";
+          process.stderr.write(`argvio: recovered internal error: ${msg}
+`);
+        }
+      }
+    }
+    this.draining = false;
+  }
+  /** Resolves once every job enqueued before this call has finished executing, or `timeoutMs` elapses. */
+  async waitForDrain(timeoutMs) {
+    const done = new Promise((resolve) => {
+      this.pushControl(() => {
+        resolve();
+      });
+    });
+    await withTimeout(done, timeoutMs);
+  }
+};
+async function withTimeout(promise, timeoutMs) {
+  let timer;
+  const timeout = new Promise((resolve) => {
+    timer = setTimeout(resolve, timeoutMs);
+  });
+  try {
+    await Promise.race([promise, timeout]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+function toError(value) {
+  return value instanceof Error ? value : new Error(String(value));
+}
+var Client = class {
+  tier;
+  disabled;
+  /** Set if construction encountered a problem; the Client still degrades to a safe disabled no-op. */
+  initError;
+  counters = new DroppedCounters();
+  queue;
+  shutdownTimeoutMs;
+  shuttingDown = false;
+  shutdownStarted = false;
+  sessionId;
+  tracerProvider;
+  meterProvider;
+  loggerProvider;
+  logger;
+  latencyHist;
+  invocationsCounter;
+  sessionsCounter;
+  errorEventsCounter;
+  /** @internal use {@link createClient} */
+  constructor(params) {
+    this.disabled = params.disabled;
+    this.initError = params.initError;
+    this.tier = params.tier;
+    this.shutdownTimeoutMs = params.shutdownTimeoutMs;
+    this.queue = new JobQueue(params.queueSize, this.counters);
+    this.tracerProvider = params.tracerProvider;
+    this.meterProvider = params.meterProvider;
+    this.loggerProvider = params.loggerProvider;
+    this.logger = params.logger;
+    this.latencyHist = params.latencyHist;
+    this.invocationsCounter = params.invocationsCounter;
+    this.sessionsCounter = params.sessionsCounter;
+    this.errorEventsCounter = params.errorEventsCounter;
+  }
+  enabled() {
+    return !this.disabled && !this.shuttingDown;
+  }
+  /** A snapshot of in-process counters about dropped records. Never sent over the network. */
+  stats() {
+    return this.counters.snapshot();
+  }
+  gate(required) {
+    if (!this.enabled()) return false;
+    if (!tierAllows(this.tier, required)) {
+      this.counters.belowTierCeil++;
+      return false;
+    }
+    return true;
+  }
+  tierAttr() {
+    return { [RESOURCE_ATTR_TIER]: tierToString(this.tier) };
+  }
+  emitEvent(name, severity, attributes = {}) {
+    this.queue.push(() => {
+      this.logger?.emit({
+        eventName: name,
+        timestamp: Date.now(),
+        severityNumber: severity,
+        attributes: { ...this.tierAttr(), ...attributes }
+      });
+    });
+  }
+  /**
+   * Lazily generates a session correlation ID at `Tier.Full`+. A random,
+   * non-persistent identifier scoped to a single process invocation —
+   * not a user or device identifier.
+   */
+  ensureSessionId() {
+    if (!tierAllows(this.tier, Tier.Full)) return "";
+    if (this.sessionId === void 0) {
+      this.sessionId = newSessionId();
+    }
+    return this.sessionId;
+  }
+  /**
+   * Records the start of a CLI process session. Call once, as early as
+   * possible. At `Tier.Anonymous` this only increments an aggregate
+   * session counter. At `Tier.Basic`+ it also emits a `cli.session_start`
+   * event. At `Tier.Full`+ the event carries a per-process session
+   * correlation ID.
+   */
+  recordSessionStart() {
+    safeRun(() => {
+      if (!this.enabled()) return;
+      this.queue.push(() => {
+        this.sessionsCounter?.add(1, this.tierAttr());
+      });
+      if (!tierAllows(this.tier, Tier.Basic)) return;
+      const attrs = {};
+      const id = this.ensureSessionId();
+      if (id) attrs[AttrSessionId] = id;
+      this.emitEvent("cli.session_start", SeverityNumber.INFO, attrs);
+    }, this.counters);
+  }
+  /** Records the end of a CLI process session. Call once, symmetric with {@link recordSessionStart}. */
+  recordSessionEnd() {
+    safeRun(() => {
+      if (!this.enabled() || !tierAllows(this.tier, Tier.Basic)) return;
+      const attrs = {};
+      const id = this.ensureSessionId();
+      if (id) attrs[AttrSessionId] = id;
+      this.emitEvent("cli.session_end", SeverityNumber.INFO, attrs);
+    }, this.counters);
+  }
+  /**
+   * Records that a command began executing. `commandPath` should be the
+   * full command path (e.g. `"mycli sub subsub"`), not just the leaf
+   * command name. `flagNames` is the list of flag *names* the user set —
+   * never flag values, which this SDK never accepts anywhere in the
+   * taxonomy.
+   *
+   * At `Tier.Anonymous` this only increments an aggregate invocation
+   * counter with no path/flag detail. At `Tier.Basic`+ the full command
+   * path and flag names are included.
+   */
+  recordCommandInvocation(commandPath, flagNames = []) {
+    safeRun(() => {
+      if (!this.enabled()) return;
+      this.queue.push(() => {
+        this.invocationsCounter?.add(1, this.tierAttr());
+      });
+      if (!tierAllows(this.tier, Tier.Basic)) return;
+      const attrs = { [AttrCommandPath]: commandPath };
+      if (flagNames.length > 0) attrs[AttrCommandFlags] = [...flagNames];
+      this.emitEvent("cli.command_invocation", SeverityNumber.INFO, attrs);
+    }, this.counters);
+  }
+  /**
+   * Records the exit code a command finished with. Pass `""` for
+   * `commandPath` if unknown (e.g. a single-command CLI). At
+   * `Tier.Anonymous` the exit code is recorded without a command path.
+   * At `Tier.Basic`+ the command path is included.
+   */
+  recordExitCode(commandPath, code) {
+    safeRun(() => {
+      if (!this.gate(Tier.Anonymous)) return;
+      const attrs = { [AttrExitCode]: code };
+      if (tierAllows(this.tier, Tier.Basic) && commandPath) {
+        attrs[AttrCommandPath] = commandPath;
+      }
+      const severity = code !== 0 ? SeverityNumber.WARN : SeverityNumber.INFO;
+      this.emitEvent("cli.exit_code", severity, attrs);
+    }, this.counters);
+  }
+  /**
+   * Records how long a command took to execute, in milliseconds, on a
+   * histogram (`cli.command.duration`). Available at every tier.
+   */
+  recordLatency(commandPath, durationMs) {
+    safeRun(() => {
+      if (!this.gate(Tier.Anonymous)) return;
+      const attrs = { ...this.tierAttr() };
+      if (tierAllows(this.tier, Tier.Basic) && commandPath) {
+        attrs[AttrCommandPath] = commandPath;
+      }
+      this.queue.push(() => {
+        this.latencyHist?.record(durationMs, attrs);
+      });
+    }, this.counters);
+  }
+  /** Records that a command's help output was requested (`-h`/`--help` or an explicit help command). */
+  recordHelpFlagUsage(commandPath) {
+    safeRun(() => {
+      if (!this.gate(Tier.Anonymous)) return;
+      const attrs = { [AttrHelpUsed]: true };
+      if (tierAllows(this.tier, Tier.Basic) && commandPath) {
+        attrs[AttrCommandPath] = commandPath;
+      }
+      this.emitEvent("cli.help_flag_used", SeverityNumber.INFO, attrs);
+    }, this.counters);
+  }
+  /**
+   * Records that a command failed with an error, classified by
+   * `category` rather than its raw message or stack trace — this is
+   * deliberately the only error-recording capability available below
+   * `Tier.OptIn`. Raw error detail is only reachable via {@link optIn}.
+   *
+   * Requires `Tier.Full`+; at lower tiers this is a no-op (counted in
+   * `stats().belowTierDropped`).
+   */
+  recordError(commandPath, category = ErrorCategory.Unknown) {
+    safeRun(() => {
+      if (!this.gate(Tier.Full)) return;
+      const cat = isValidErrorCategory(category) ? category : ErrorCategory.Unknown;
+      const attrs = { [AttrErrorCategory]: cat };
+      if (commandPath) attrs[AttrCommandPath] = commandPath;
+      this.queue.push(() => {
+        this.errorEventsCounter?.add(1, { ...this.tierAttr(), [AttrErrorCategory]: cat });
+      });
+      this.emitEvent("cli.error", SeverityNumber.ERROR, attrs);
+    }, this.counters);
+  }
+  /**
+   * Returns an {@link OptInScope} if, and only if, this Client's resolved
+   * consent tier is `Tier.OptIn`; otherwise returns `undefined`. There is
+   * no other way to reach raw error detail (message, stack trace)
+   * anywhere in this package — it's structurally impossible to pass that
+   * data through {@link recordError}'s signature.
+   */
+  optIn() {
+    if (this.enabled() && this.tier === Tier.OptIn) return new OptInScope(this);
+    return void 0;
+  }
+  /** @internal called only by {@link OptInScope}. */
+  _recordErrorDetail(commandPath, err, stack) {
+    safeRun(() => {
+      if (!this.gate(Tier.OptIn)) return;
+      const attrs = { [AttrErrorMessage]: err.message };
+      if (commandPath) attrs[AttrCommandPath] = commandPath;
+      if (stack) attrs[AttrErrorStack] = stack;
+      this.emitEvent("cli.error_detail", SeverityNumber.ERROR, attrs);
+    }, this.counters);
+  }
+  /**
+   * Blocks until all telemetry queued so far has been handed to the
+   * exporters and an export attempt has completed, or `timeoutMs`
+   * elapses, whichever comes first. Safe to call on a disabled Client
+   * (a no-op).
+   */
+  async flush(timeoutMs = this.shutdownTimeoutMs) {
+    if (!this.enabled()) return;
+    await this.queue.waitForDrain(timeoutMs);
+    await withTimeout(
+      Promise.all(
+        [
+          this.tracerProvider?.forceFlush(),
+          this.meterProvider?.forceFlush(),
+          this.loggerProvider?.forceFlush()
+        ].filter((p) => Boolean(p))
+      ).then(() => void 0),
+      timeoutMs
+    );
+  }
+  /**
+   * Flushes any queued telemetry (best-effort, bounded by `timeoutMs`)
+   * and releases all background resources. After `shutdown`, the Client
+   * permanently behaves as a disabled no-op. Safe to call on a disabled
+   * Client, and safe to call more than once.
+   */
+  async shutdown(timeoutMs = this.shutdownTimeoutMs) {
+    if (this.disabled || this.shutdownStarted) return;
+    this.shutdownStarted = true;
+    this.shuttingDown = true;
+    await this.queue.waitForDrain(timeoutMs);
+    await withTimeout(
+      Promise.all(
+        [
+          this.tracerProvider?.shutdown(),
+          this.meterProvider?.shutdown(),
+          this.loggerProvider?.shutdown()
+        ].filter((p) => Boolean(p))
+      ).then(() => void 0),
+      timeoutMs
+    );
+  }
+};
+var OptInScope = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /** Records an error's message at full fidelity. */
+  recordErrorDetail(commandPath, err) {
+    this.client._recordErrorDetail(commandPath, err);
+  }
+  /** Identical to {@link recordErrorDetail} but also attaches a raw stack trace. */
+  recordErrorDetailWithStack(commandPath, err, stack) {
+    this.client._recordErrorDetail(commandPath, err, stack);
+  }
+};
+function resolveConsentTier(cfg) {
+  if (!cfg.consentProvider) return cfg.defaultTier;
+  try {
+    const tier = cfg.consentProvider.resolve();
+    return isValidTier(tier) ? tier : cfg.defaultTier;
+  } catch {
+    return cfg.defaultTier;
+  }
+}
+function disabledClient(initError = null) {
+  return new Client({
+    disabled: true,
+    initError,
+    tier: Tier.Anonymous,
+    queueSize: 0,
+    shutdownTimeoutMs: 0
+  });
+}
+function createClient(apiKey, cliName, cliVersion, options = {}) {
+  try {
+    const cfg = resolveConfig(apiKey, cliName, cliVersion, options);
+    if (cfg.disabled || process.env["ARGVIO_DISABLED"] === "1" || isDoNotTrackRequested()) {
+      return disabledClient();
+    }
+    const tier = resolveConsentTier(cfg);
+    const exporters = buildExporters(cfg);
+    const resource = buildResource(cfg);
+    const tracerProvider = new NodeTracerProvider({
+      resource,
+      spanProcessors: [
+        new BatchSpanProcessor(exporters.trace, {
+          maxQueueSize: cfg.queueSize,
+          exportTimeoutMillis: cfg.exportTimeoutMs
+        })
+      ]
+    });
+    const meterProvider = new MeterProvider({
+      resource,
+      readers: [
+        new PeriodicExportingMetricReader({
+          exporter: exporters.metric,
+          exportTimeoutMillis: cfg.exportTimeoutMs
+        })
+      ]
+    });
+    const loggerProvider = new LoggerProvider({
+      resource,
+      processors: [
+        new BatchLogRecordProcessor({
+          exporter: exporters.log,
+          maxQueueSize: cfg.queueSize,
+          exportTimeoutMillis: cfg.exportTimeoutMs
+        })
+      ]
+    });
+    const meter = meterProvider.getMeter(INSTRUMENTATION_NAME);
+    const logger = loggerProvider.getLogger(INSTRUMENTATION_NAME);
+    return new Client({
+      disabled: false,
+      initError: null,
+      tier,
+      queueSize: cfg.queueSize,
+      shutdownTimeoutMs: cfg.shutdownTimeoutMs,
+      tracerProvider,
+      meterProvider,
+      loggerProvider,
+      logger,
+      latencyHist: meter.createHistogram(MetricCommandDuration, {
+        unit: "ms",
+        description: "Duration of a CLI command invocation."
+      }),
+      invocationsCounter: meter.createCounter("cli.invocations", {
+        description: "Count of CLI command invocations."
+      }),
+      sessionsCounter: meter.createCounter("cli.sessions", {
+        description: "Count of CLI process sessions."
+      }),
+      errorEventsCounter: meter.createCounter("cli.errors", {
+        description: "Count of recorded CLI errors."
+      })
+    });
+  } catch (err) {
+    return disabledClient(toError(err));
+  }
+}
+
+// src/consent.ts
+var StaticProvider = class {
+  constructor(tier) {
+    this.tier = tier;
+  }
+  tier;
+  resolve() {
+    return isValidTier(this.tier) ? this.tier : Tier.Anonymous;
+  }
+};
+var DisabledProvider = class {
+  resolve() {
+    return Tier.Anonymous;
+  }
+};
+function chainProviders(...providers) {
+  return {
+    resolve() {
+      for (const provider of providers) {
+        if (!provider) continue;
+        try {
+          return provider.resolve();
+        } catch {
+          continue;
+        }
+      }
+      throw errNoProviderResolved;
+    }
+  };
+}
+function userConfigDir() {
+  switch (process.platform) {
+    case "win32":
+      return process.env["APPDATA"];
+    case "darwin":
+      return join(homedir(), "Library", "Application Support");
+    default:
+      return process.env["XDG_CONFIG_HOME"] || join(homedir(), ".config");
+  }
+}
+function defaultConsentPath(cliName) {
+  const dir = userConfigDir();
+  if (!dir) return void 0;
+  return join(dir, cliName || "argvio", "argvio-consent.json");
+}
+var FileConsentProvider = class {
+  /** The resolved config file path (after defaults/overrides), primarily for diagnostics and tests. */
+  path;
+  constructor(cliName, options = {}) {
+    this.path = options.path || defaultConsentPath(cliName);
+  }
+  /**
+   * A missing file, unreadable file, or malformed contents all throw
+   * synchronously, so callers should place `FileConsentProvider` inside
+   * `chainProviders` with a sane fallback (e.g.
+   * `new StaticProvider(Tier.Anonymous)`).
+   */
+  resolve() {
+    if (!this.path) throw errNoConsentFile;
+    const data = readFileSync(this.path, "utf8");
+    const parsed = JSON.parse(data);
+    const tier = parseTier(parsed.tier ?? "");
+    if (tier === void 0) throw errUnknownTierValue;
+    return tier;
+  }
+  /**
+   * Persists `tier` as the chosen consent tier, creating the parent
+   * directory if needed. Intended for use by a vendor's first-run
+   * consent prompt. Does not itself enforce any tier ceiling — it's the
+   * vendor's own UX writing the user's explicit choice.
+   */
+  store(tier) {
+    if (!this.path) throw errNoConsentFile;
+    if (!isValidTier(tier)) throw errUnknownTierValue;
+    mkdirSync(dirname(this.path), { recursive: true, mode: 448 });
+    const contents = { tier: tierToString(tier) };
+    writeFileSync(this.path, JSON.stringify(contents), { mode: 384 });
+  }
+};
+
+export { AttrCommandFlags, AttrCommandPath, AttrErrorCategory, AttrErrorMessage, AttrErrorStack, AttrExitCode, AttrHelpUsed, AttrSessionId, Client, DEFAULT_AUTH_HEADER, DEFAULT_ENDPOINT_GRPC, DEFAULT_ENDPOINT_HTTP, DEFAULT_EXPORT_TIMEOUT_MS, DEFAULT_QUEUE_SIZE, DEFAULT_SHUTDOWN_TIMEOUT_MS, DisabledProvider, EnvConsentProvider, ErrorCategory, FileConsentProvider, MetricCommandDuration, OptInScope, RESOURCE_ATTR_TIER, StaticProvider, Tier, chainProviders, clampTier, createClient, isCI, isDoNotTrackRequested, isValidErrorCategory, isValidTier, parseTier, tierAllows, tierToString };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map