@glasstrace/sdk 1.17.0 → 1.18.0

package/dist/{index.d-3-cJoY8y.d.cts → index.d-DhatN7mq.d.cts}

@@ -324,4 +324,4 @@ declare const SIDE_EFFECT_OPERATION_PHASES: readonly ["request", "post_response"
  */
 type SideEffectOperationPhase = (typeof SIDE_EFFECT_OPERATION_PHASES)[number];
 
-export { type AnonApiKey as A, type CaptureConfig as C, type GlasstraceEnvVars as G, type ImportGraphPayload as I, type SideEffectOperationKind as S, type SideEffectOperationStatus as a, type SideEffectOperationPhase as b, type SideEffectSemanticFieldKey as c, deriveSessionId as d, type SideEffectOmissionReason as e, type SideEffectSemanticFieldStableCoreKey as f, type SourceMapUploadResponse as g, type SourceMapManifestResponse as h, isSideEffectSemanticFieldKey as i, type SdkDiagnosticCode as j, type SessionId as k, type GlasstraceOptions as l, type SdkInitResponse as m, type SdkHealthReport as n };
+export { type AnonApiKey as A, type CaptureConfig as C, type GlasstraceEnvVars as G, type ImportGraphPayload as I, type SourceMapUploadResponse as S, type SourceMapManifestResponse as a, type SideEffectOperationKind as b, type SideEffectOperationStatus as c, deriveSessionId as d, type SideEffectOperationPhase as e, type SideEffectSemanticFieldKey as f, type SideEffectOmissionReason as g, type SideEffectSemanticFieldStableCoreKey as h, isSideEffectSemanticFieldKey as i, type SdkDiagnosticCode as j, type SessionId as k, type GlasstraceOptions as l, type SdkInitResponse as m, type SdkHealthReport as n };

package/dist/{index.d-3-cJoY8y.d.ts → index.d-DhatN7mq.d.ts}

@@ -324,4 +324,4 @@ declare const SIDE_EFFECT_OPERATION_PHASES: readonly ["request", "post_response"
  */
 type SideEffectOperationPhase = (typeof SIDE_EFFECT_OPERATION_PHASES)[number];
 
-export { type AnonApiKey as A, type CaptureConfig as C, type GlasstraceEnvVars as G, type ImportGraphPayload as I, type SideEffectOperationKind as S, type SideEffectOperationStatus as a, type SideEffectOperationPhase as b, type SideEffectSemanticFieldKey as c, deriveSessionId as d, type SideEffectOmissionReason as e, type SideEffectSemanticFieldStableCoreKey as f, type SourceMapUploadResponse as g, type SourceMapManifestResponse as h, isSideEffectSemanticFieldKey as i, type SdkDiagnosticCode as j, type SessionId as k, type GlasstraceOptions as l, type SdkInitResponse as m, type SdkHealthReport as n };
+export { type AnonApiKey as A, type CaptureConfig as C, type GlasstraceEnvVars as G, type ImportGraphPayload as I, type SourceMapUploadResponse as S, type SourceMapManifestResponse as a, type SideEffectOperationKind as b, type SideEffectOperationStatus as c, deriveSessionId as d, type SideEffectOperationPhase as e, type SideEffectSemanticFieldKey as f, type SideEffectOmissionReason as g, type SideEffectSemanticFieldStableCoreKey as h, isSideEffectSemanticFieldKey as i, type SdkDiagnosticCode as j, type SessionId as k, type GlasstraceOptions as l, type SdkInitResponse as m, type SdkHealthReport as n };

package/dist/index.d.cts

@@ -1,7 +1,8 @@
-export { C as CorrelationIdRequest, G as GlasstraceSpanProcessor, S as SdkError, a as SessionManager, c as captureCorrelationId, g as getDateString, b as getOrigin } from './correlation-id-CelUvw7j.cjs';
-export { F as FetchTarget, G as GlasstraceExporter, a as GlasstraceExporterOptions, I as InitClaimResult, R as ResolvedConfig, c as captureError, b as classifyFetchTarget, d as createGlasstraceSpanProcessor, g as getActiveConfig, e as getDiscoveryHandler, f as getLinkedAccountId, h as getOrCreateAnonKey, i as getStatus, j as isAnonymousMode, k as isProductionDisabled, l as isReady, m as loadCachedConfig, p as performInit, r as readAnonKey, n as readEnvVars, o as registerGlasstrace, q as resolveConfig, s as saveCachedConfig, t as sendInitRequest, w as waitForReady, u as withGlasstraceConfig } from './capture-error-B0txjNut.cjs';
-import { S as SideEffectOperationKind, a as SideEffectOperationStatus, b as SideEffectOperationPhase, c as SideEffectSemanticFieldKey } from './index.d-3-cJoY8y.cjs';
-export { e as SideEffectOmissionReason, f as SideEffectSemanticFieldStableCoreKey, d as deriveSessionId, i as isSideEffectSemanticFieldKey } from './index.d-3-cJoY8y.cjs';
+export { C as CorrelationIdRequest, G as GlasstraceSpanProcessor, S as SdkError, a as SessionManager, c as captureCorrelationId, g as getDateString, b as getOrigin } from './correlation-id-CClOq8Wn.cjs';
+export { F as FetchTarget, G as GlasstraceExporter, a as GlasstraceExporterOptions, I as InitClaimResult, R as ResolvedConfig, c as captureError, b as classifyFetchTarget, d as createGlasstraceSpanProcessor, g as getActiveConfig, e as getDiscoveryHandler, f as getLinkedAccountId, h as getOrCreateAnonKey, i as getStatus, j as isAnonymousMode, k as isProductionDisabled, l as isReady, m as loadCachedConfig, p as performInit, r as readAnonKey, n as readEnvVars, o as registerGlasstrace, q as resolveConfig, s as saveCachedConfig, t as sendInitRequest, w as waitForReady, u as withGlasstraceConfig } from './capture-error-B8qiXFeC.cjs';
+import { b as SideEffectOperationKind, c as SideEffectOperationStatus, e as SideEffectOperationPhase, f as SideEffectSemanticFieldKey } from './index.d-DhatN7mq.cjs';
+export { g as SideEffectOmissionReason, h as SideEffectSemanticFieldStableCoreKey, d as deriveSessionId, i as isSideEffectSemanticFieldKey } from './index.d-DhatN7mq.cjs';
+import { Span } from './trace/span';
 export { RequestMiddlewareFunction, TracedRequestMiddlewareOptions } from './middleware/index.cjs';
 export { WithAsyncCausalityOptions } from './async-context/index.cjs';
 import './export/ReadableSpan';
@@ -157,6 +158,170 @@ interface RecordSideEffectInput {
  */
 declare function recordSideEffect(input: RecordSideEffectInput): void;
 
+/**
+ * Public value-capture primitive (L1 passive capture).
+ *
+ * {@link capture} emits a single allowlisted value-fidelity scalar onto a
+ * caller-**owned** OTel span. It is the counterpart to {@link
+ * recordSideEffect} for the case where the emitter owns the target span
+ * itself (e.g. a passive database adapter that opens a `db.<Model>.<op>`
+ * span) rather than attaching to the ambient active span.
+ *
+ * Why this exists: {@link recordSideEffect} is ambient-only — it resolves
+ * the active span via `getActiveSpan()`. A passive adapter cannot use it,
+ * because at its capture point the ambient span is the database client's
+ * own operation span, which has already ended and is non-recording. So the
+ * adapter must own a fresh recording span and emit onto it explicitly.
+ *
+ * The behavior contract mirrors {@link recordSideEffect}: observational
+ * only. `capture` never executes a side effect, never reads or mutates the
+ * captured value's source, and **never throws**. Every failure mode
+ * (capture-config disabled, ended / `NonRecordingSpan` target, allowlist
+ * rejection, OTel attribute-slot exhaustion) routes to a silent no-op or to
+ * an omission-counter increment that carries no rejected input.
+ *
+ * Capture is **strict-mode only**: timestamp-shaped and unhashed-identifier
+ * values are rejected at emit so they never reach the wire. The `full`
+ * fidelity relaxation is not reachable through this primitive.
+ */
+
+/** Options for {@link capture}. */
+interface CaptureOptions {
+    /**
+     * The caller-owned, recording span to attach the scalar to. `capture`
+     * writes only to this span; it never resolves or touches the ambient
+     * active span. The caller is responsible for `end()`-ing it.
+     */
+    span: Span;
+}
+/**
+ * Emit a single allowlisted value-fidelity scalar onto a caller-owned span.
+ *
+ * The scalar `name` must match the value-fidelity scalar key pattern
+ * (`*Ms` / `*Amount` / `*Bytes` / `*Ratio` / `*Id` / `*Value` / `*Flag`)
+ * and its value must match the suffix type — e.g. a `*Flag` key requires a
+ * `boolean`. Mismatches, timestamp-shaped values, and unhashed `*Id`s are
+ * rejected under strict mode and recorded as an omission count on the
+ * supplied span (never the active span).
+ *
+ * Edge cases (all silent no-ops, never throws):
+ *  - capture-config flag `sideEffectEvidence` is `false` ⇒ no-op, **no
+ *    counter** (mirrors {@link recordSideEffect}: with capture disabled the
+ *    SDK does no allowlist evaluation and writes nothing).
+ *  - the supplied span has already ended or is a `NonRecordingSpan` ⇒
+ *    no-op, **no counter** (its omission counter would itself be a dropped
+ *    span write). The owning adapter passes a fresh recording span, so this
+ *    is a caller-misuse guard.
+ *  - the value fails strict allowlist validation ⇒ an omission count is
+ *    recorded on the supplied span; the rejected value is never emitted.
+ *  - OTel attribute-slot exhaustion ⇒ the attribute write is silently
+ *    dropped.
+ *
+ * @example Project a boolean result field onto an owned database span
+ * ```ts
+ * import { capture } from "@glasstrace/sdk";
+ *
+ * const span = tracer.startSpan("db.Poll.findUnique");
+ * try {
+ *   const row = await query(args);
+ *   if (row) capture("mutedFlag", row.muted, { span });
+ *   return row;
+ * } finally {
+ *   span.end();
+ * }
+ * ```
+ */
+declare function capture(name: string, value: unknown, options: CaptureOptions): void;
+
+/**
+ * Passive Prisma value-capture adapter (L1 capture).
+ *
+ * `prismaAdapter({ allow })` returns a Prisma client extension that, for
+ * each allowlisted `(model, column)`, projects a boolean result field onto
+ * a Glasstrace value-fidelity scalar so an agent can read it back from the
+ * trace. It is **passive and observational**: it never executes a query
+ * itself, never reads or mutates the result, and never changes query
+ * behavior or errors.
+ *
+ * Apply it like any Prisma extension:
+ *
+ * ```ts
+ * import { prismaAdapter } from "@glasstrace/sdk";
+ *
+ * const prisma = new PrismaClient().$extends(
+ *   prismaAdapter({ allow: [{ model: "Poll", column: "muted" }] }),
+ * );
+ * ```
+ *
+ * Design:
+ *  - **OWN a span.** At the capture point the database client's own
+ *    operation span has already ended, so the adapter opens its own
+ *    recording `db.<Model>.<op>` span (parented under the active request
+ *    span) and emits onto it via {@link capture}.
+ *  - **Default-deny.** Nothing is captured unless an explicit `allow` entry
+ *    matches AND the server-pushed `sideEffectEvidence` capture flag is on.
+ *    An empty / unset `allow` captures nothing.
+ *  - **Boolean only.** This adapter projects boolean columns (the strict,
+ *    no-`captureFidelity:full` case). Non-boolean allowlisted columns route
+ *    to a safe omission counter, never a captured value.
+ *  - **Pure observer.** Capture work can never throw into the host query;
+ *    the owned span is always ended; the original query error is re-thrown
+ *    verbatim.
+ *  - **Bounded.** `findMany` / list operations are disabled (no per-row
+ *    capture). The adapter never widens the app's `select`.
+ *
+ * This module has **no dependency on `@prisma/client`** — it is typed
+ * structurally against Prisma's client-extension shape (mirroring the
+ * Drizzle adapter), so it adds no runtime dependency and ships on the edge-
+ * safe root barrel. On a runtime with no active request span (e.g. an edge
+ * runtime with no AsyncLocalStorage), it captures nothing.
+ */
+/** The arguments Prisma passes to a `$allOperations` query-extension callback. */
+interface PrismaAllOperationsArgs {
+    /** The Prisma model name (PascalCase, e.g. `Poll`), or `undefined` for raw ops. */
+    model?: string;
+    /** The Prisma operation (e.g. `findUnique`, `findMany`, `update`). */
+    operation: string;
+    /** The operation arguments, forwarded unchanged to `query`. */
+    args: unknown;
+    /** Executes the underlying operation. Called exactly once. */
+    query: (args: unknown) => Promise<unknown>;
+}
+/**
+ * A Prisma client extension — the object passed to `prisma.$extends(...)`.
+ * Structurally typed so the adapter needs no `@prisma/client` dependency.
+ */
+interface PrismaCaptureExtension {
+    name: string;
+    query: {
+        $allModels: {
+            $allOperations(args: PrismaAllOperationsArgs): Promise<unknown>;
+        };
+    };
+}
+/** A single allowlisted column to project. */
+interface PrismaCaptureColumn {
+    /** The Prisma model name, PascalCase, exactly as Prisma reports it (e.g. `Poll`). */
+    model: string;
+    /** The boolean result column to project (e.g. `muted`). */
+    column: string;
+}
+/** Options for {@link prismaAdapter}. */
+interface PrismaAdapterOptions {
+    /**
+     * The default-deny allowlist. Only `(model, column)` pairs listed here are
+     * eligible for capture; an empty or unset list captures nothing. The
+     * server-side per-tenant allowlist re-enforces this independently at
+     * ingestion.
+     */
+    allow?: ReadonlyArray<PrismaCaptureColumn>;
+}
+/**
+ * Build a passive Prisma value-capture extension. See the module doc for
+ * the full behavior contract.
+ */
+declare function prismaAdapter(options?: PrismaAdapterOptions): PrismaCaptureExtension;
+
 /**
  * Producer-sugar for computing boolean relations to emit as `*Holds`
  * side-effect evidence.
@@ -216,4 +381,4 @@ declare function invariant<T extends number | string | bigint | boolean>(left: T
  */
 declare function isNullInvariant(value: unknown): boolean;
 
-export { type InvariantOp, type RecordSideEffectInput, SideEffectOperationKind, SideEffectOperationPhase, SideEffectOperationStatus, SideEffectSemanticFieldKey, invariant, isNullInvariant, recordSideEffect };
+export { type CaptureOptions, type InvariantOp, type PrismaAdapterOptions, type PrismaCaptureColumn, type PrismaCaptureExtension, type RecordSideEffectInput, SideEffectOperationKind, SideEffectOperationPhase, SideEffectOperationStatus, SideEffectSemanticFieldKey, capture, invariant, isNullInvariant, prismaAdapter, recordSideEffect };

package/dist/index.d.ts

@@ -1,7 +1,8 @@
-export { C as CorrelationIdRequest, G as GlasstraceSpanProcessor, S as SdkError, a as SessionManager, c as captureCorrelationId, g as getDateString, b as getOrigin } from './correlation-id-B9YYmoZw.js';
-export { F as FetchTarget, G as GlasstraceExporter, a as GlasstraceExporterOptions, I as InitClaimResult, R as ResolvedConfig, c as captureError, b as classifyFetchTarget, d as createGlasstraceSpanProcessor, g as getActiveConfig, e as getDiscoveryHandler, f as getLinkedAccountId, h as getOrCreateAnonKey, i as getStatus, j as isAnonymousMode, k as isProductionDisabled, l as isReady, m as loadCachedConfig, p as performInit, r as readAnonKey, n as readEnvVars, o as registerGlasstrace, q as resolveConfig, s as saveCachedConfig, t as sendInitRequest, w as waitForReady, u as withGlasstraceConfig } from './capture-error-Dc01rYNR.js';
-import { S as SideEffectOperationKind, a as SideEffectOperationStatus, b as SideEffectOperationPhase, c as SideEffectSemanticFieldKey } from './index.d-3-cJoY8y.js';
-export { e as SideEffectOmissionReason, f as SideEffectSemanticFieldStableCoreKey, d as deriveSessionId, i as isSideEffectSemanticFieldKey } from './index.d-3-cJoY8y.js';
+export { C as CorrelationIdRequest, G as GlasstraceSpanProcessor, S as SdkError, a as SessionManager, c as captureCorrelationId, g as getDateString, b as getOrigin } from './correlation-id-Ct86Ug4s.js';
+export { F as FetchTarget, G as GlasstraceExporter, a as GlasstraceExporterOptions, I as InitClaimResult, R as ResolvedConfig, c as captureError, b as classifyFetchTarget, d as createGlasstraceSpanProcessor, g as getActiveConfig, e as getDiscoveryHandler, f as getLinkedAccountId, h as getOrCreateAnonKey, i as getStatus, j as isAnonymousMode, k as isProductionDisabled, l as isReady, m as loadCachedConfig, p as performInit, r as readAnonKey, n as readEnvVars, o as registerGlasstrace, q as resolveConfig, s as saveCachedConfig, t as sendInitRequest, w as waitForReady, u as withGlasstraceConfig } from './capture-error-BTI6mCH2.js';
+import { b as SideEffectOperationKind, c as SideEffectOperationStatus, e as SideEffectOperationPhase, f as SideEffectSemanticFieldKey } from './index.d-DhatN7mq.js';
+export { g as SideEffectOmissionReason, h as SideEffectSemanticFieldStableCoreKey, d as deriveSessionId, i as isSideEffectSemanticFieldKey } from './index.d-DhatN7mq.js';
+import { Span } from './trace/span';
 export { RequestMiddlewareFunction, TracedRequestMiddlewareOptions } from './middleware/index.js';
 export { WithAsyncCausalityOptions } from './async-context/index.js';
 import './export/ReadableSpan';
@@ -157,6 +158,170 @@ interface RecordSideEffectInput {
  */
 declare function recordSideEffect(input: RecordSideEffectInput): void;
 
+/**
+ * Public value-capture primitive (L1 passive capture).
+ *
+ * {@link capture} emits a single allowlisted value-fidelity scalar onto a
+ * caller-**owned** OTel span. It is the counterpart to {@link
+ * recordSideEffect} for the case where the emitter owns the target span
+ * itself (e.g. a passive database adapter that opens a `db.<Model>.<op>`
+ * span) rather than attaching to the ambient active span.
+ *
+ * Why this exists: {@link recordSideEffect} is ambient-only — it resolves
+ * the active span via `getActiveSpan()`. A passive adapter cannot use it,
+ * because at its capture point the ambient span is the database client's
+ * own operation span, which has already ended and is non-recording. So the
+ * adapter must own a fresh recording span and emit onto it explicitly.
+ *
+ * The behavior contract mirrors {@link recordSideEffect}: observational
+ * only. `capture` never executes a side effect, never reads or mutates the
+ * captured value's source, and **never throws**. Every failure mode
+ * (capture-config disabled, ended / `NonRecordingSpan` target, allowlist
+ * rejection, OTel attribute-slot exhaustion) routes to a silent no-op or to
+ * an omission-counter increment that carries no rejected input.
+ *
+ * Capture is **strict-mode only**: timestamp-shaped and unhashed-identifier
+ * values are rejected at emit so they never reach the wire. The `full`
+ * fidelity relaxation is not reachable through this primitive.
+ */
+
+/** Options for {@link capture}. */
+interface CaptureOptions {
+    /**
+     * The caller-owned, recording span to attach the scalar to. `capture`
+     * writes only to this span; it never resolves or touches the ambient
+     * active span. The caller is responsible for `end()`-ing it.
+     */
+    span: Span;
+}
+/**
+ * Emit a single allowlisted value-fidelity scalar onto a caller-owned span.
+ *
+ * The scalar `name` must match the value-fidelity scalar key pattern
+ * (`*Ms` / `*Amount` / `*Bytes` / `*Ratio` / `*Id` / `*Value` / `*Flag`)
+ * and its value must match the suffix type — e.g. a `*Flag` key requires a
+ * `boolean`. Mismatches, timestamp-shaped values, and unhashed `*Id`s are
+ * rejected under strict mode and recorded as an omission count on the
+ * supplied span (never the active span).
+ *
+ * Edge cases (all silent no-ops, never throws):
+ *  - capture-config flag `sideEffectEvidence` is `false` ⇒ no-op, **no
+ *    counter** (mirrors {@link recordSideEffect}: with capture disabled the
+ *    SDK does no allowlist evaluation and writes nothing).
+ *  - the supplied span has already ended or is a `NonRecordingSpan` ⇒
+ *    no-op, **no counter** (its omission counter would itself be a dropped
+ *    span write). The owning adapter passes a fresh recording span, so this
+ *    is a caller-misuse guard.
+ *  - the value fails strict allowlist validation ⇒ an omission count is
+ *    recorded on the supplied span; the rejected value is never emitted.
+ *  - OTel attribute-slot exhaustion ⇒ the attribute write is silently
+ *    dropped.
+ *
+ * @example Project a boolean result field onto an owned database span
+ * ```ts
+ * import { capture } from "@glasstrace/sdk";
+ *
+ * const span = tracer.startSpan("db.Poll.findUnique");
+ * try {
+ *   const row = await query(args);
+ *   if (row) capture("mutedFlag", row.muted, { span });
+ *   return row;
+ * } finally {
+ *   span.end();
+ * }
+ * ```
+ */
+declare function capture(name: string, value: unknown, options: CaptureOptions): void;
+
+/**
+ * Passive Prisma value-capture adapter (L1 capture).
+ *
+ * `prismaAdapter({ allow })` returns a Prisma client extension that, for
+ * each allowlisted `(model, column)`, projects a boolean result field onto
+ * a Glasstrace value-fidelity scalar so an agent can read it back from the
+ * trace. It is **passive and observational**: it never executes a query
+ * itself, never reads or mutates the result, and never changes query
+ * behavior or errors.
+ *
+ * Apply it like any Prisma extension:
+ *
+ * ```ts
+ * import { prismaAdapter } from "@glasstrace/sdk";
+ *
+ * const prisma = new PrismaClient().$extends(
+ *   prismaAdapter({ allow: [{ model: "Poll", column: "muted" }] }),
+ * );
+ * ```
+ *
+ * Design:
+ *  - **OWN a span.** At the capture point the database client's own
+ *    operation span has already ended, so the adapter opens its own
+ *    recording `db.<Model>.<op>` span (parented under the active request
+ *    span) and emits onto it via {@link capture}.
+ *  - **Default-deny.** Nothing is captured unless an explicit `allow` entry
+ *    matches AND the server-pushed `sideEffectEvidence` capture flag is on.
+ *    An empty / unset `allow` captures nothing.
+ *  - **Boolean only.** This adapter projects boolean columns (the strict,
+ *    no-`captureFidelity:full` case). Non-boolean allowlisted columns route
+ *    to a safe omission counter, never a captured value.
+ *  - **Pure observer.** Capture work can never throw into the host query;
+ *    the owned span is always ended; the original query error is re-thrown
+ *    verbatim.
+ *  - **Bounded.** `findMany` / list operations are disabled (no per-row
+ *    capture). The adapter never widens the app's `select`.
+ *
+ * This module has **no dependency on `@prisma/client`** — it is typed
+ * structurally against Prisma's client-extension shape (mirroring the
+ * Drizzle adapter), so it adds no runtime dependency and ships on the edge-
+ * safe root barrel. On a runtime with no active request span (e.g. an edge
+ * runtime with no AsyncLocalStorage), it captures nothing.
+ */
+/** The arguments Prisma passes to a `$allOperations` query-extension callback. */
+interface PrismaAllOperationsArgs {
+    /** The Prisma model name (PascalCase, e.g. `Poll`), or `undefined` for raw ops. */
+    model?: string;
+    /** The Prisma operation (e.g. `findUnique`, `findMany`, `update`). */
+    operation: string;
+    /** The operation arguments, forwarded unchanged to `query`. */
+    args: unknown;
+    /** Executes the underlying operation. Called exactly once. */
+    query: (args: unknown) => Promise<unknown>;
+}
+/**
+ * A Prisma client extension — the object passed to `prisma.$extends(...)`.
+ * Structurally typed so the adapter needs no `@prisma/client` dependency.
+ */
+interface PrismaCaptureExtension {
+    name: string;
+    query: {
+        $allModels: {
+            $allOperations(args: PrismaAllOperationsArgs): Promise<unknown>;
+        };
+    };
+}
+/** A single allowlisted column to project. */
+interface PrismaCaptureColumn {
+    /** The Prisma model name, PascalCase, exactly as Prisma reports it (e.g. `Poll`). */
+    model: string;
+    /** The boolean result column to project (e.g. `muted`). */
+    column: string;
+}
+/** Options for {@link prismaAdapter}. */
+interface PrismaAdapterOptions {
+    /**
+     * The default-deny allowlist. Only `(model, column)` pairs listed here are
+     * eligible for capture; an empty or unset list captures nothing. The
+     * server-side per-tenant allowlist re-enforces this independently at
+     * ingestion.
+     */
+    allow?: ReadonlyArray<PrismaCaptureColumn>;
+}
+/**
+ * Build a passive Prisma value-capture extension. See the module doc for
+ * the full behavior contract.
+ */
+declare function prismaAdapter(options?: PrismaAdapterOptions): PrismaCaptureExtension;
+
 /**
  * Producer-sugar for computing boolean relations to emit as `*Holds`
  * side-effect evidence.
@@ -216,4 +381,4 @@ declare function invariant<T extends number | string | bigint | boolean>(left: T
  */
 declare function isNullInvariant(value: unknown): boolean;
 
-export { type InvariantOp, type RecordSideEffectInput, SideEffectOperationKind, SideEffectOperationPhase, SideEffectOperationStatus, SideEffectSemanticFieldKey, invariant, isNullInvariant, recordSideEffect };
+export { type CaptureOptions, type InvariantOp, type PrismaAdapterOptions, type PrismaCaptureColumn, type PrismaCaptureExtension, type RecordSideEffectInput, SideEffectOperationKind, SideEffectOperationPhase, SideEffectOperationStatus, SideEffectSemanticFieldKey, capture, invariant, isNullInvariant, prismaAdapter, recordSideEffect };

package/dist/index.js

@@ -1,16 +1,20 @@
 import {
   GlasstraceExporter,
   SessionManager,
+  attachScalar,
   captureError,
+  checkScalarField,
   classifyFetchTarget,
   createGlasstraceSpanProcessor,
   getDateString,
   getDiscoveryHandler,
   getOrigin,
+  recordOmission,
   recordSideEffect,
   registerGlasstrace,
+  reserveScalarSlot,
   withGlasstraceConfig
-} from "./chunk-F2IPBTDJ.js";
+} from "./chunk-Z2DSC3YI.js";
 import {
   getStatus,
   isReady,
@@ -22,16 +26,20 @@ import {
   captureCorrelationId
 } from "./chunk-EVX6D2TX.js";
 import "./chunk-CL3OVHPO.js";
-import "./chunk-DQ25VOKK.js";
+import {
+  SpanKind,
+  trace
+} from "./chunk-DQ25VOKK.js";
 import "./chunk-YG3X7TUI.js";
 import {
   getActiveConfig,
   getLinkedAccountId,
+  isCaptureEnabled,
   loadCachedConfig,
   performInit,
   saveCachedConfig,
   sendInitRequest
-} from "./chunk-VEQX2YSQ.js";
+} from "./chunk-SONZOTBP.js";
 import {
   isAnonymousMode,
   isProductionDisabled,
@@ -49,6 +57,116 @@ import {
 import "./chunk-YIEXKQYP.js";
 import "./chunk-NSBPE2FW.js";
 
+// src/side-effect/capture.ts
+function capture(name, value, options) {
+  try {
+    runCapture(name, value, options);
+  } catch {
+  }
+}
+function runCapture(name, value, options) {
+  const span = options?.span;
+  if (!span) return;
+  if (!isCaptureEnabled()) return;
+  try {
+    if (typeof span.isRecording === "function" && !span.isRecording()) {
+      return;
+    }
+  } catch {
+    return;
+  }
+  const outcome = checkScalarField(name, value);
+  if (!outcome.accepted) {
+    recordOmission(span, outcome.reason);
+    return;
+  }
+  if (!reserveScalarSlot(span)) {
+    recordOmission(span, "value_too_long");
+    return;
+  }
+  attachScalar(span, name, outcome.value);
+}
+
+// src/adapters/prisma.ts
+var TRACER_NAME = "glasstrace-prisma";
+function hasRecordingActiveSpan() {
+  try {
+    const span = trace.getActiveSpan();
+    if (span === void 0) return false;
+    if (typeof span.isRecording === "function" && !span.isRecording()) {
+      return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+function openOwnedSpan(model, operation) {
+  try {
+    return trace.getTracer(TRACER_NAME).startSpan(`db.${model}.${operation}`, { kind: SpanKind.CLIENT });
+  } catch {
+    return void 0;
+  }
+}
+function deriveFlagKey(column) {
+  return column.endsWith("Flag") ? column : `${column}Flag`;
+}
+function projectAllowlisted(span, columns, result) {
+  if (result === null || typeof result !== "object" || Array.isArray(result)) {
+    return;
+  }
+  const row = result;
+  for (const column of columns) {
+    if (!(column in row)) continue;
+    capture(deriveFlagKey(column), row[column], { span });
+  }
+}
+function prismaAdapter(options = {}) {
+  const policy = /* @__PURE__ */ new Map();
+  for (const entry of options?.allow ?? []) {
+    if (!entry || typeof entry.model !== "string" || typeof entry.column !== "string" || entry.model.length === 0 || entry.column.length === 0) {
+      continue;
+    }
+    let columns = policy.get(entry.model);
+    if (!columns) {
+      columns = /* @__PURE__ */ new Set();
+      policy.set(entry.model, columns);
+    }
+    columns.add(entry.column);
+  }
+  return {
+    name: "glasstrace-capture",
+    query: {
+      $allModels: {
+        async $allOperations(params) {
+          const { model, operation, args, query } = params;
+          const columns = model !== void 0 ? policy.get(model) : void 0;
+          if (model === void 0 || columns === void 0 || operation === "findMany" || !isCaptureEnabled() || !hasRecordingActiveSpan()) {
+            return query(args);
+          }
+          const span = openOwnedSpan(model, operation);
+          if (span === void 0) {
+            return query(args);
+          }
+          try {
+            const result = await query(args);
+            try {
+              projectAllowlisted(span, columns, result);
+            } catch {
+            }
+            return result;
+          } finally {
+            try {
+              span.end();
+            } catch {
+            }
+          }
+        }
+      }
+    }
+  };
+}
+
 // src/side-effect/invariant.ts
 function invariant(left, op, right) {
   switch (op) {
@@ -76,6 +194,7 @@ export {
   GlasstraceSpanProcessor,
   SdkError,
   SessionManager,
+  capture,
   captureCorrelationId,
   captureError,
   classifyFetchTarget,
@@ -96,6 +215,7 @@ export {
   isSideEffectSemanticFieldKey,
   loadCachedConfig,
   performInit,
+  prismaAdapter,
   readAnonKey,
   readEnvVars,
   recordSideEffect,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/side-effect/invariant.ts"],"sourcesContent":["/**\n * Producer-sugar for computing boolean relations to emit as `*Holds`\n * side-effect evidence.\n *\n * These helpers turn a comparison into the boolean a producer passes to\n * `recordSideEffect({ relations: { …Holds: invariant(a, \"eq\", b) } })`.\n * They are pure (no I/O, no Node built-ins) and edge-safe, so they live\n * on the root barrel. The operator set is intentionally minimal and\n * fixed — six binary comparisons plus a separate unary null check — and\n * is not a general expression DSL.\n */\n\n/**\n * The six supported binary comparison operators. `isNull` is **not** an\n * operator here — use {@link isNullInvariant} for the unary case.\n */\nexport type InvariantOp = \"eq\" | \"neq\" | \"lt\" | \"lte\" | \"gt\" | \"gte\";\n\n/**\n * Evaluate a binary comparison invariant and return the boolean result.\n *\n * Both operands are constrained to the same primitive type. `eq`/`neq`\n * use strict equality; the ordering operators (`lt`/`lte`/`gt`/`gte`)\n * use the language relational operators (numeric for numbers/bigints,\n * lexical for strings). Intended for producing a `*Holds` relation, e.g.\n * `invariant(emittedDurationMinutes, \"eq\", declaredDurationMinutes)`.\n *\n * Operands should be comparable primitives. `NaN` follows IEEE-754\n * (unequal to everything; all orderings `false`), so screen `NaN` before\n * asserting a relation. Passing a non-primitive (e.g. a `Symbol`, or an\n * object with a throwing `valueOf`) to an ordering operator throws per\n * JS semantics — the type signature prevents this for typed callers.\n *\n * @param left - The left operand.\n * @param op - One of the six {@link InvariantOp} comparisons.\n * @param right - The right operand (same primitive type as `left`).\n * @returns The boolean result of `left <op> right`.\n *\n * @example\n * recordSideEffect({\n *   kind: \"calendar_link\",\n *   operation: \"invite.create\",\n *   relations: {\n *     durationMatchesHolds: invariant(emittedMinutes, \"eq\", declaredMinutes),\n *   },\n * });\n */\nexport function invariant<T extends number | string | bigint | boolean>(\n  left: T,\n  op: InvariantOp,\n  right: T,\n): boolean {\n  switch (op) {\n    case \"eq\":\n      return left === right;\n    case \"neq\":\n      return left !== right;\n    case \"lt\":\n      return left < right;\n    case \"lte\":\n      return left <= right;\n    case \"gt\":\n      return left > right;\n    case \"gte\":\n      return left >= right;\n  }\n  // For well-typed callers `op` is `never` here, so this `satisfies`\n  // enforces switch exhaustiveness at compile time (adding an\n  // `InvariantOp` member without a case is a type error). The `return`\n  // is the runtime fallback for an untyped (JS) caller passing an\n  // out-of-domain op — it yields a `boolean`, never `undefined`.\n  op satisfies never;\n  return false;\n}\n\n/**\n * Unary null/undefined invariant — `true` when `value` is `null` or\n * `undefined`. Kept separate from {@link invariant} because nullishness\n * is a unary predicate, not a binary comparison (there is no `isNull`\n * operator). Use for a `*Holds` relation asserting a value's absence,\n * e.g. `relations: { recipientMissingHolds: isNullInvariant(recipient) }`.\n *\n * @param value - The value to test.\n * @returns `true` when `value` is `null` or `undefined`, else `false`\n *   (falsy-but-present values like `0`, `\"\"`, `false`, `NaN` are `false`).\n */\nexport function isNullInvariant(value: unknown): boolean {\n  return value === null || value === undefined;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+CO,SAAS,UACd,MACA,IACA,OACS;AACT,UAAQ,IAAI;AAAA,IACV,KAAK;AACH,aAAO,SAAS;AAAA,IAClB,KAAK;AACH,aAAO,SAAS;AAAA,IAClB,KAAK;AACH,aAAO,OAAO;AAAA,IAChB,KAAK;AACH,aAAO,QAAQ;AAAA,IACjB,KAAK;AACH,aAAO,OAAO;AAAA,IAChB,KAAK;AACH,aAAO,QAAQ;AAAA,EACnB;AAMA;AACA,SAAO;AACT;AAaO,SAAS,gBAAgB,OAAyB;AACvD,SAAO,UAAU,QAAQ,UAAU;AACrC;","names":[]}
+{"version":3,"sources":["../src/side-effect/capture.ts","../src/adapters/prisma.ts","../src/side-effect/invariant.ts"],"sourcesContent":["/**\n * Public value-capture primitive (L1 passive capture).\n *\n * {@link capture} emits a single allowlisted value-fidelity scalar onto a\n * caller-**owned** OTel span. It is the counterpart to {@link\n * recordSideEffect} for the case where the emitter owns the target span\n * itself (e.g. a passive database adapter that opens a `db.<Model>.<op>`\n * span) rather than attaching to the ambient active span.\n *\n * Why this exists: {@link recordSideEffect} is ambient-only — it resolves\n * the active span via `getActiveSpan()`. A passive adapter cannot use it,\n * because at its capture point the ambient span is the database client's\n * own operation span, which has already ended and is non-recording. So the\n * adapter must own a fresh recording span and emit onto it explicitly.\n *\n * The behavior contract mirrors {@link recordSideEffect}: observational\n * only. `capture` never executes a side effect, never reads or mutates the\n * captured value's source, and **never throws**. Every failure mode\n * (capture-config disabled, ended / `NonRecordingSpan` target, allowlist\n * rejection, OTel attribute-slot exhaustion) routes to a silent no-op or to\n * an omission-counter increment that carries no rejected input.\n *\n * Capture is **strict-mode only**: timestamp-shaped and unhashed-identifier\n * values are rejected at emit so they never reach the wire. The `full`\n * fidelity relaxation is not reachable through this primitive.\n */\n\nimport { type Span } from \"@opentelemetry/api\";\nimport { checkScalarField } from \"./allowlist.js\";\nimport { attachScalar, recordOmission, reserveScalarSlot } from \"./emit.js\";\nimport { isCaptureEnabled } from \"../init-client.js\";\n\n/** Options for {@link capture}. */\nexport interface CaptureOptions {\n  /**\n   * The caller-owned, recording span to attach the scalar to. `capture`\n   * writes only to this span; it never resolves or touches the ambient\n   * active span. The caller is responsible for `end()`-ing it.\n   */\n  span: Span;\n}\n\n/**\n * Emit a single allowlisted value-fidelity scalar onto a caller-owned span.\n *\n * The scalar `name` must match the value-fidelity scalar key pattern\n * (`*Ms` / `*Amount` / `*Bytes` / `*Ratio` / `*Id` / `*Value` / `*Flag`)\n * and its value must match the suffix type — e.g. a `*Flag` key requires a\n * `boolean`. Mismatches, timestamp-shaped values, and unhashed `*Id`s are\n * rejected under strict mode and recorded as an omission count on the\n * supplied span (never the active span).\n *\n * Edge cases (all silent no-ops, never throws):\n *  - capture-config flag `sideEffectEvidence` is `false` ⇒ no-op, **no\n *    counter** (mirrors {@link recordSideEffect}: with capture disabled the\n *    SDK does no allowlist evaluation and writes nothing).\n *  - the supplied span has already ended or is a `NonRecordingSpan` ⇒\n *    no-op, **no counter** (its omission counter would itself be a dropped\n *    span write). The owning adapter passes a fresh recording span, so this\n *    is a caller-misuse guard.\n *  - the value fails strict allowlist validation ⇒ an omission count is\n *    recorded on the supplied span; the rejected value is never emitted.\n *  - OTel attribute-slot exhaustion ⇒ the attribute write is silently\n *    dropped.\n *\n * @example Project a boolean result field onto an owned database span\n * ```ts\n * import { capture } from \"@glasstrace/sdk\";\n *\n * const span = tracer.startSpan(\"db.Poll.findUnique\");\n * try {\n *   const row = await query(args);\n *   if (row) capture(\"mutedFlag\", row.muted, { span });\n *   return row;\n * } finally {\n *   span.end();\n * }\n * ```\n */\nexport function capture(\n  name: string,\n  value: unknown,\n  options: CaptureOptions,\n): void {\n  try {\n    runCapture(name, value, options);\n  } catch {\n    // Defense-in-depth: an unexpected throw (e.g. a host shim\n    // mis-implementing the OTel API) must never propagate to the\n    // caller's request path. Capture is observationally invisible.\n  }\n}\n\nfunction runCapture(\n  name: string,\n  value: unknown,\n  options: CaptureOptions,\n): void {\n  const span = options?.span;\n  if (!span) return;\n\n  // Capture-config gate first: read at every call so config rotation\n  // takes effect on the next emission. With the flag off the SDK does\n  // nothing and records no counter (a counter would itself require a\n  // span write); this is the maximally fail-closed default.\n  if (!isCaptureEnabled()) return;\n\n  // Caller-misuse guard: an ended / NonRecordingSpan cannot carry the\n  // scalar, and its omission counter would itself be a dropped write —\n  // no-op entirely (no counter). The owning adapter passes a fresh\n  // recording span, so correct use never reaches this branch.\n  try {\n    if (typeof span.isRecording === \"function\" && !span.isRecording()) {\n      return;\n    }\n  } catch {\n    return;\n  }\n\n  // Strict scalar validation — the only mode this primitive supports.\n  const outcome = checkScalarField(name, value);\n  if (!outcome.accepted) {\n    // The omission count lands on the caller-supplied span — never the\n    // ambient active span (which `capture` deliberately never resolves).\n    recordOmission(span, outcome.reason);\n    return;\n  }\n\n  // Enforce the per-operation scalar budget across many `capture()` calls on\n  // the same owned span (e.g. an adapter projecting several columns). Beyond\n  // the budget, deterministically omit rather than over-emit for downstream\n  // truncation — mirroring `recordSideEffect`'s budget handling.\n  if (!reserveScalarSlot(span)) {\n    recordOmission(span, \"value_too_long\");\n    return;\n  }\n\n  attachScalar(span, name, outcome.value);\n}\n","/**\n * Passive Prisma value-capture adapter (L1 capture).\n *\n * `prismaAdapter({ allow })` returns a Prisma client extension that, for\n * each allowlisted `(model, column)`, projects a boolean result field onto\n * a Glasstrace value-fidelity scalar so an agent can read it back from the\n * trace. It is **passive and observational**: it never executes a query\n * itself, never reads or mutates the result, and never changes query\n * behavior or errors.\n *\n * Apply it like any Prisma extension:\n *\n * ```ts\n * import { prismaAdapter } from \"@glasstrace/sdk\";\n *\n * const prisma = new PrismaClient().$extends(\n *   prismaAdapter({ allow: [{ model: \"Poll\", column: \"muted\" }] }),\n * );\n * ```\n *\n * Design:\n *  - **OWN a span.** At the capture point the database client's own\n *    operation span has already ended, so the adapter opens its own\n *    recording `db.<Model>.<op>` span (parented under the active request\n *    span) and emits onto it via {@link capture}.\n *  - **Default-deny.** Nothing is captured unless an explicit `allow` entry\n *    matches AND the server-pushed `sideEffectEvidence` capture flag is on.\n *    An empty / unset `allow` captures nothing.\n *  - **Boolean only.** This adapter projects boolean columns (the strict,\n *    no-`captureFidelity:full` case). Non-boolean allowlisted columns route\n *    to a safe omission counter, never a captured value.\n *  - **Pure observer.** Capture work can never throw into the host query;\n *    the owned span is always ended; the original query error is re-thrown\n *    verbatim.\n *  - **Bounded.** `findMany` / list operations are disabled (no per-row\n *    capture). The adapter never widens the app's `select`.\n *\n * This module has **no dependency on `@prisma/client`** — it is typed\n * structurally against Prisma's client-extension shape (mirroring the\n * Drizzle adapter), so it adds no runtime dependency and ships on the edge-\n * safe root barrel. On a runtime with no active request span (e.g. an edge\n * runtime with no AsyncLocalStorage), it captures nothing.\n */\n\nimport { trace, SpanKind, type Span } from \"@opentelemetry/api\";\nimport { capture } from \"../side-effect/capture.js\";\nimport { isCaptureEnabled } from \"../init-client.js\";\n\n/** The arguments Prisma passes to a `$allOperations` query-extension callback. */\ninterface PrismaAllOperationsArgs {\n  /** The Prisma model name (PascalCase, e.g. `Poll`), or `undefined` for raw ops. */\n  model?: string;\n  /** The Prisma operation (e.g. `findUnique`, `findMany`, `update`). */\n  operation: string;\n  /** The operation arguments, forwarded unchanged to `query`. */\n  args: unknown;\n  /** Executes the underlying operation. Called exactly once. */\n  query: (args: unknown) => Promise<unknown>;\n}\n\n/**\n * A Prisma client extension — the object passed to `prisma.$extends(...)`.\n * Structurally typed so the adapter needs no `@prisma/client` dependency.\n */\nexport interface PrismaCaptureExtension {\n  name: string;\n  query: {\n    $allModels: {\n      $allOperations(args: PrismaAllOperationsArgs): Promise<unknown>;\n    };\n  };\n}\n\n/** A single allowlisted column to project. */\nexport interface PrismaCaptureColumn {\n  /** The Prisma model name, PascalCase, exactly as Prisma reports it (e.g. `Poll`). */\n  model: string;\n  /** The boolean result column to project (e.g. `muted`). */\n  column: string;\n}\n\n/** Options for {@link prismaAdapter}. */\nexport interface PrismaAdapterOptions {\n  /**\n   * The default-deny allowlist. Only `(model, column)` pairs listed here are\n   * eligible for capture; an empty or unset list captures nothing. The\n   * server-side per-tenant allowlist re-enforces this independently at\n   * ingestion.\n   */\n  allow?: ReadonlyArray<PrismaCaptureColumn>;\n}\n\nconst TRACER_NAME = \"glasstrace-prisma\";\n\n/**\n * Whether a **recording** request span is active, fail-closed. The adapter\n * parents its owned span under the request span and must capture nothing when\n * none is present (out-of-request / edge runtimes with no AsyncLocalStorage)\n * or when the active span is ended / a `NonRecordingSpan` (e.g. sampled out) —\n * mirroring `getRecordingActiveSpan` in `side-effect/emit.ts`. Wrapped so an\n * OTel API surface error can never propagate into the host query\n * (pure-observer).\n */\nfunction hasRecordingActiveSpan(): boolean {\n  try {\n    const span = trace.getActiveSpan();\n    if (span === undefined) return false;\n    // `isRecording()` is false for both NonRecordingSpan and ended spans; a\n    // missing impl (host shim) is treated as recording, as elsewhere.\n    if (typeof span.isRecording === \"function\" && !span.isRecording()) {\n      return false;\n    }\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Open the owned `db.<Model>.<op>` recording span, or `undefined` if the OTel\n * API throws. A `undefined` return makes the caller fall back to running the\n * query untouched — the capture machinery must never throw into the host\n * query (pure-observer).\n */\nfunction openOwnedSpan(model: string, operation: string): Span | undefined {\n  try {\n    return trace\n      .getTracer(TRACER_NAME)\n      .startSpan(`db.${model}.${operation}`, { kind: SpanKind.CLIENT });\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Derive the scalar key for a boolean column. A boolean projects onto a\n * `*Flag` scalar; the key is the column with a `Flag` suffix (not doubled if\n * the column already ends in `Flag`). This derivation is deterministic and\n * stable because the server-side operator allowlist keys on the emitted\n * scalar key (`<column>Flag`), not the source column.\n */\nfunction deriveFlagKey(column: string): string {\n  return column.endsWith(\"Flag\") ? column : `${column}Flag`;\n}\n\n/**\n * Project every allowlisted column present in a single-row result onto the\n * owned span via {@link capture}. Guards non-object results (a `findUnique`\n * miss returns `null`; aggregates return non-objects; lists are arrays).\n * Never throws — {@link capture} swallows its own errors, and the call is\n * additionally fenced so a malformed result can never affect the query.\n */\nfunction projectAllowlisted(\n  span: Span,\n  columns: ReadonlySet<string>,\n  result: unknown,\n): void {\n  if (result === null || typeof result !== \"object\" || Array.isArray(result)) {\n    return;\n  }\n  const row = result as Record<string, unknown>;\n  for (const column of columns) {\n    if (!(column in row)) continue;\n    capture(deriveFlagKey(column), row[column], { span });\n  }\n}\n\n/**\n * Build a passive Prisma value-capture extension. See the module doc for\n * the full behavior contract.\n */\nexport function prismaAdapter(\n  options: PrismaAdapterOptions = {},\n): PrismaCaptureExtension {\n  // Compile the allowlist into model -> set(columns) once at construction.\n  const policy = new Map<string, Set<string>>();\n  for (const entry of options?.allow ?? []) {\n    if (\n      !entry ||\n      typeof entry.model !== \"string\" ||\n      typeof entry.column !== \"string\" ||\n      entry.model.length === 0 ||\n      entry.column.length === 0\n    ) {\n      continue;\n    }\n    let columns = policy.get(entry.model);\n    if (!columns) {\n      columns = new Set();\n      policy.set(entry.model, columns);\n    }\n    columns.add(entry.column);\n  }\n\n  return {\n    name: \"glasstrace-capture\",\n    query: {\n      $allModels: {\n        async $allOperations(\n          params: PrismaAllOperationsArgs,\n        ): Promise<unknown> {\n          const { model, operation, args, query } = params;\n\n          // Decide eligibility BEFORE opening a span so the default-deny /\n          // disabled path adds zero span volume (hot-path) and never emits\n          // on an orphan (edge / no request context). All four gates:\n          //  - the model has an allow entry (default-deny);\n          //  - the operation is not a multi-row list op (list/`findMany`\n          //    capture is disabled until a per-row cap + selection rule is\n          //    specified);\n          //  - the capture master switch is on (fail-closed default off);\n          //  - a recording request span is active (in-request, same-trace;\n          //    edge has no ALS / no active span, and a sampled-out span is\n          //    non-recording — capture nothing in both cases).\n          const columns =\n            model !== undefined ? policy.get(model) : undefined;\n          if (\n            model === undefined ||\n            columns === undefined ||\n            operation === \"findMany\" ||\n            !isCaptureEnabled() ||\n            !hasRecordingActiveSpan()\n          ) {\n            return query(args);\n          }\n\n          // OWN a recording db.<Model>.<op> span, parented under the active\n          // request span. The span name is the attribution anchor. If the\n          // OTel API fails to open the span, fall back to running the query\n          // untouched — the capture path must never throw into it.\n          const span = openOwnedSpan(model, operation);\n          if (span === undefined) {\n            return query(args);\n          }\n          try {\n            const result = await query(args);\n            // Fence projection so a malformed result can never alter the\n            // query's own outcome (pure-observer invariant).\n            try {\n              projectAllowlisted(span, columns, result);\n            } catch {\n              // Never let capture work affect the host query result.\n            }\n            return result;\n          } finally {\n            // Always end the owned span, even when `query` throws; the\n            // original error propagates verbatim (not swallowed). The end()\n            // is itself guarded so it cannot mask that error.\n            try {\n              span.end();\n            } catch {\n              // OTel end() failure must not surface to the host query.\n            }\n          }\n        },\n      },\n    },\n  };\n}\n","/**\n * Producer-sugar for computing boolean relations to emit as `*Holds`\n * side-effect evidence.\n *\n * These helpers turn a comparison into the boolean a producer passes to\n * `recordSideEffect({ relations: { …Holds: invariant(a, \"eq\", b) } })`.\n * They are pure (no I/O, no Node built-ins) and edge-safe, so they live\n * on the root barrel. The operator set is intentionally minimal and\n * fixed — six binary comparisons plus a separate unary null check — and\n * is not a general expression DSL.\n */\n\n/**\n * The six supported binary comparison operators. `isNull` is **not** an\n * operator here — use {@link isNullInvariant} for the unary case.\n */\nexport type InvariantOp = \"eq\" | \"neq\" | \"lt\" | \"lte\" | \"gt\" | \"gte\";\n\n/**\n * Evaluate a binary comparison invariant and return the boolean result.\n *\n * Both operands are constrained to the same primitive type. `eq`/`neq`\n * use strict equality; the ordering operators (`lt`/`lte`/`gt`/`gte`)\n * use the language relational operators (numeric for numbers/bigints,\n * lexical for strings). Intended for producing a `*Holds` relation, e.g.\n * `invariant(emittedDurationMinutes, \"eq\", declaredDurationMinutes)`.\n *\n * Operands should be comparable primitives. `NaN` follows IEEE-754\n * (unequal to everything; all orderings `false`), so screen `NaN` before\n * asserting a relation. Passing a non-primitive (e.g. a `Symbol`, or an\n * object with a throwing `valueOf`) to an ordering operator throws per\n * JS semantics — the type signature prevents this for typed callers.\n *\n * @param left - The left operand.\n * @param op - One of the six {@link InvariantOp} comparisons.\n * @param right - The right operand (same primitive type as `left`).\n * @returns The boolean result of `left <op> right`.\n *\n * @example\n * recordSideEffect({\n *   kind: \"calendar_link\",\n *   operation: \"invite.create\",\n *   relations: {\n *     durationMatchesHolds: invariant(emittedMinutes, \"eq\", declaredMinutes),\n *   },\n * });\n */\nexport function invariant<T extends number | string | bigint | boolean>(\n  left: T,\n  op: InvariantOp,\n  right: T,\n): boolean {\n  switch (op) {\n    case \"eq\":\n      return left === right;\n    case \"neq\":\n      return left !== right;\n    case \"lt\":\n      return left < right;\n    case \"lte\":\n      return left <= right;\n    case \"gt\":\n      return left > right;\n    case \"gte\":\n      return left >= right;\n  }\n  // For well-typed callers `op` is `never` here, so this `satisfies`\n  // enforces switch exhaustiveness at compile time (adding an\n  // `InvariantOp` member without a case is a type error). The `return`\n  // is the runtime fallback for an untyped (JS) caller passing an\n  // out-of-domain op — it yields a `boolean`, never `undefined`.\n  op satisfies never;\n  return false;\n}\n\n/**\n * Unary null/undefined invariant — `true` when `value` is `null` or\n * `undefined`. Kept separate from {@link invariant} because nullishness\n * is a unary predicate, not a binary comparison (there is no `isNull`\n * operator). Use for a `*Holds` relation asserting a value's absence,\n * e.g. `relations: { recipientMissingHolds: isNullInvariant(recipient) }`.\n *\n * @param value - The value to test.\n * @returns `true` when `value` is `null` or `undefined`, else `false`\n *   (falsy-but-present values like `0`, `\"\"`, `false`, `NaN` are `false`).\n */\nexport function isNullInvariant(value: unknown): boolean {\n  return value === null || value === undefined;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+EO,SAAS,QACd,MACA,OACA,SACM;AACN,MAAI;AACF,eAAW,MAAM,OAAO,OAAO;AAAA,EACjC,QAAQ;AAAA,EAIR;AACF;AAEA,SAAS,WACP,MACA,OACA,SACM;AACN,QAAM,OAAO,SAAS;AACtB,MAAI,CAAC,KAAM;AAMX,MAAI,CAAC,iBAAiB,EAAG;AAMzB,MAAI;AACF,QAAI,OAAO,KAAK,gBAAgB,cAAc,CAAC,KAAK,YAAY,GAAG;AACjE;AAAA,IACF;AAAA,EACF,QAAQ;AACN;AAAA,EACF;AAGA,QAAM,UAAU,iBAAiB,MAAM,KAAK;AAC5C,MAAI,CAAC,QAAQ,UAAU;AAGrB,mBAAe,MAAM,QAAQ,MAAM;AACnC;AAAA,EACF;AAMA,MAAI,CAAC,kBAAkB,IAAI,GAAG;AAC5B,mBAAe,MAAM,gBAAgB;AACrC;AAAA,EACF;AAEA,eAAa,MAAM,MAAM,QAAQ,KAAK;AACxC;;;AC9CA,IAAM,cAAc;AAWpB,SAAS,yBAAkC;AACzC,MAAI;AACF,UAAM,OAAO,MAAM,cAAc;AACjC,QAAI,SAAS,OAAW,QAAO;AAG/B,QAAI,OAAO,KAAK,gBAAgB,cAAc,CAAC,KAAK,YAAY,GAAG;AACjE,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,SAAS,cAAc,OAAe,WAAqC;AACzE,MAAI;AACF,WAAO,MACJ,UAAU,WAAW,EACrB,UAAU,MAAM,KAAK,IAAI,SAAS,IAAI,EAAE,MAAM,SAAS,OAAO,CAAC;AAAA,EACpE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASA,SAAS,cAAc,QAAwB;AAC7C,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS,GAAG,MAAM;AACrD;AASA,SAAS,mBACP,MACA,SACA,QACM;AACN,MAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAC1E;AAAA,EACF;AACA,QAAM,MAAM;AACZ,aAAW,UAAU,SAAS;AAC5B,QAAI,EAAE,UAAU,KAAM;AACtB,YAAQ,cAAc,MAAM,GAAG,IAAI,MAAM,GAAG,EAAE,KAAK,CAAC;AAAA,EACtD;AACF;AAMO,SAAS,cACd,UAAgC,CAAC,GACT;AAExB,QAAM,SAAS,oBAAI,IAAyB;AAC5C,aAAW,SAAS,SAAS,SAAS,CAAC,GAAG;AACxC,QACE,CAAC,SACD,OAAO,MAAM,UAAU,YACvB,OAAO,MAAM,WAAW,YACxB,MAAM,MAAM,WAAW,KACvB,MAAM,OAAO,WAAW,GACxB;AACA;AAAA,IACF;AACA,QAAI,UAAU,OAAO,IAAI,MAAM,KAAK;AACpC,QAAI,CAAC,SAAS;AACZ,gBAAU,oBAAI,IAAI;AAClB,aAAO,IAAI,MAAM,OAAO,OAAO;AAAA,IACjC;AACA,YAAQ,IAAI,MAAM,MAAM;AAAA,EAC1B;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,MACL,YAAY;AAAA,QACV,MAAM,eACJ,QACkB;AAClB,gBAAM,EAAE,OAAO,WAAW,MAAM,MAAM,IAAI;AAa1C,gBAAM,UACJ,UAAU,SAAY,OAAO,IAAI,KAAK,IAAI;AAC5C,cACE,UAAU,UACV,YAAY,UACZ,cAAc,cACd,CAAC,iBAAiB,KAClB,CAAC,uBAAuB,GACxB;AACA,mBAAO,MAAM,IAAI;AAAA,UACnB;AAMA,gBAAM,OAAO,cAAc,OAAO,SAAS;AAC3C,cAAI,SAAS,QAAW;AACtB,mBAAO,MAAM,IAAI;AAAA,UACnB;AACA,cAAI;AACF,kBAAM,SAAS,MAAM,MAAM,IAAI;AAG/B,gBAAI;AACF,iCAAmB,MAAM,SAAS,MAAM;AAAA,YAC1C,QAAQ;AAAA,YAER;AACA,mBAAO;AAAA,UACT,UAAE;AAIA,gBAAI;AACF,mBAAK,IAAI;AAAA,YACX,QAAQ;AAAA,YAER;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACnNO,SAAS,UACd,MACA,IACA,OACS;AACT,UAAQ,IAAI;AAAA,IACV,KAAK;AACH,aAAO,SAAS;AAAA,IAClB,KAAK;AACH,aAAO,SAAS;AAAA,IAClB,KAAK;AACH,aAAO,OAAO;AAAA,IAChB,KAAK;AACH,aAAO,QAAQ;AAAA,IACjB,KAAK;AACH,aAAO,OAAO;AAAA,IAChB,KAAK;AACH,aAAO,QAAQ;AAAA,EACnB;AAMA;AACA,SAAO;AACT;AAaO,SAAS,gBAAgB,OAAyB;AACvD,SAAO,UAAU,QAAQ,UAAU;AACrC;","names":[]}