@indigoai-us/hq-cloud 6.18.97 → 6.18.99

package/dist/telemetry/consent-source.d.ts

@@ -0,0 +1,68 @@
+/**
+ * One consent decision shared by the usage, skill and outcome collectors.
+ *
+ * `GET /v1/usage/opt-in` returns `enabled` (authoritative) plus a
+ * `consentSource` that names the rule that decided it. The server also returns
+ * a legacy `source` field, which is stored provenance (`"cli"`, `"menubar"`,
+ * `null`) and is never read as the rule here. This module turns that answer, or the lack of one, into what
+ * a collector should do with personal (unattributed) rows this run. Company
+ * rows are not decided here: they keep shipping under each collector's
+ * existing consent split whenever personal rows are off.
+ *
+ * Decision table (first match wins):
+ *
+ * | Input (`consentSource`)                 | collect      | optInSource        | buffer | discardBuffer | localMayOverride |
+ * |-----------------------------------------|--------------|--------------------|--------|---------------|------------------|
+ * | forceCollect (fleet agent)              | true         | agent-required     | no     | no            | no               |
+ * | GET failed                              | local===true | menubar-fallback   | no     | no            | no               |
+ * | notice-pending                          | false        | notice-pending     | yes    | no            | no               |
+ * | plan-required                           | enabled      | plan-required      | no     | if !enabled   | no               |
+ * | default-on                              | enabled      | default-on         | no     | if !enabled   | no               |
+ * | personal-toggle                         | enabled      | personal-toggle    | no     | if !enabled   | yes              |
+ * | agent-required (server says so)         | enabled      | agent-required     | no     | if !enabled   | no               |
+ * | legacy-opt-in / missing / other         | enabled      | server             | no     | if !enabled   | yes              |
+ *
+ * `localMayOverride` gates the existing `unset` self-heal in `telemetry.ts`:
+ * only a personal-choice answer may be replaced by the locally cached answer,
+ * so a required plan can never be turned off by the menubar preference.
+ *
+ * `discardBuffer` is set whenever the server answers `enabled: false` for any
+ * source other than notice-pending: rows held during a notice period are only
+ * ever delivered while that account's collection is on.
+ */
+import type { TelemetryOptInResponse } from "../vault-client.js";
+export type TelemetryConsentSource = "plan-required" | "notice-pending" | "default-on" | "personal-toggle" | "agent-required" | "legacy-opt-in";
+/**
+ * Collector-facing label for where the decision came from. `"server"` is kept
+ * for legacy answers so existing dashboards and tests read the same as before.
+ */
+export type DecidedOptInSource = "server" | "menubar-fallback" | "agent-required" | "plan-required" | "notice-pending" | "default-on" | "personal-toggle";
+export interface CollectionDecision {
+    /** Ship personal / unattributed rows this run. */
+    collect: boolean;
+    optInSource: DecidedOptInSource;
+    /** Hold personal rows in the account's pre-consent buffer instead of dropping them. */
+    buffer: boolean;
+    /** The person refused: delete the account's pre-consent buffer unsent. */
+    discardBuffer: boolean;
+    /** The `unset` self-heal may replay the local menubar answer. */
+    localMayOverride: boolean;
+    /** The normalised server source, when the server answered. */
+    source?: TelemetryConsentSource;
+    /** Short human-readable explanation for logs. */
+    reason: string;
+}
+export interface LocalConsentInput {
+    /** Fleet agents always collect; the GET is never made. */
+    forceCollect?: boolean;
+    /** `~/.hq/menubar.json` `telemetryEnabled`; read only when the GET failed. */
+    localEnabled?: boolean;
+}
+/** Absent or unrecognised `consentSource` → `"legacy-opt-in"` (today's behaviour). */
+export declare function normalizeConsentSource(source: string | null | undefined): TelemetryConsentSource;
+/**
+ * @param resp the server answer, or `undefined` when the GET failed (or was
+ *   skipped because `forceCollect` is set).
+ */
+export declare function decideCollection(resp: TelemetryOptInResponse | undefined, local: LocalConsentInput): CollectionDecision;
+//# sourceMappingURL=consent-source.d.ts.map

package/dist/telemetry/consent-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-source.d.ts","sourceRoot":"","sources":["../../src/telemetry/consent-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAEjE,MAAM,MAAM,sBAAsB,GAC9B,eAAe,GACf,gBAAgB,GAChB,YAAY,GACZ,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,CAAC;AAWpB;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAC1B,QAAQ,GACR,kBAAkB,GAClB,gBAAgB,GAChB,eAAe,GACf,gBAAgB,GAChB,YAAY,GACZ,iBAAiB,CAAC;AAEtB,MAAM,WAAW,kBAAkB;IACjC,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,kBAAkB,CAAC;IAChC,uFAAuF;IACvF,MAAM,EAAE,OAAO,CAAC;IAChB,0EAA0E;IAC1E,aAAa,EAAE,OAAO,CAAC;IACvB,iEAAiE;IACjE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAChC,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,0DAA0D;IAC1D,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,sFAAsF;AACtF,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,sBAAsB,CAIxB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,sBAAsB,GAAG,SAAS,EACxC,KAAK,EAAE,iBAAiB,GACvB,kBAAkB,CAoEpB"}

package/dist/telemetry/consent-source.js

@@ -0,0 +1,87 @@
+const KNOWN_SOURCES = new Set([
+    "plan-required",
+    "notice-pending",
+    "default-on",
+    "personal-toggle",
+    "agent-required",
+    "legacy-opt-in",
+]);
+/** Absent or unrecognised `consentSource` → `"legacy-opt-in"` (today's behaviour). */
+export function normalizeConsentSource(source) {
+    return typeof source === "string" && KNOWN_SOURCES.has(source)
+        ? source
+        : "legacy-opt-in";
+}
+/**
+ * @param resp the server answer, or `undefined` when the GET failed (or was
+ *   skipped because `forceCollect` is set).
+ */
+export function decideCollection(resp, local) {
+    if (local.forceCollect) {
+        return {
+            collect: true,
+            optInSource: "agent-required",
+            buffer: false,
+            discardBuffer: false,
+            localMayOverride: false,
+            reason: "fleet agent: collection is always on",
+        };
+    }
+    if (resp === undefined) {
+        return {
+            collect: local.localEnabled === true,
+            optInSource: "menubar-fallback",
+            buffer: false,
+            discardBuffer: false,
+            localMayOverride: false,
+            reason: "opt-in check failed: using the local menubar preference",
+        };
+    }
+    const enabled = resp.enabled === true;
+    // The rule is `consentSource`. The legacy `source` field is provenance only.
+    const source = normalizeConsentSource(resp.consentSource);
+    const base = { buffer: false, discardBuffer: !enabled, localMayOverride: false, source };
+    switch (source) {
+        case "notice-pending":
+            return {
+                ...base,
+                collect: false,
+                optInSource: "notice-pending",
+                buffer: true,
+                discardBuffer: false,
+                reason: "plan notice pending: personal rows are held, not sent",
+            };
+        case "plan-required":
+        case "default-on":
+            return {
+                ...base,
+                collect: enabled,
+                optInSource: source,
+                reason: `${source}: the local preference cannot turn collection off`,
+            };
+        case "agent-required":
+            return {
+                ...base,
+                collect: enabled,
+                optInSource: "agent-required",
+                reason: "server reports an agent identity",
+            };
+        case "personal-toggle":
+            return {
+                ...base,
+                collect: enabled,
+                optInSource: "personal-toggle",
+                localMayOverride: true,
+                reason: enabled ? "personal opt-in" : "personal opt-out",
+            };
+        case "legacy-opt-in":
+            return {
+                ...base,
+                collect: enabled,
+                optInSource: "server",
+                localMayOverride: true,
+                reason: "legacy opt-in answer",
+            };
+    }
+}
+//# sourceMappingURL=consent-source.js.map

package/dist/telemetry/consent-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-source.js","sourceRoot":"","sources":["../../src/telemetry/consent-source.ts"],"names":[],"mappings":"AA0CA,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAyB;IACzE,eAAe;IACf,gBAAgB;IAChB,YAAY;IACZ,iBAAiB;IACjB,gBAAgB;IAChB,eAAe;CAChB,CAAC,CAAC;AAsCH,sFAAsF;AACtF,MAAM,UAAU,sBAAsB,CACpC,MAAiC;IAEjC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;QAC5D,CAAC,CAAE,MAAiC;QACpC,CAAC,CAAC,eAAe,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAwC,EACxC,KAAwB;IAExB,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,gBAAgB;YAC7B,MAAM,EAAE,KAAK;YACb,aAAa,EAAE,KAAK;YACpB,gBAAgB,EAAE,KAAK;YACvB,MAAM,EAAE,sCAAsC;SAC/C,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,YAAY,KAAK,IAAI;YACpC,WAAW,EAAE,kBAAkB;YAC/B,MAAM,EAAE,KAAK;YACb,aAAa,EAAE,KAAK;YACpB,gBAAgB,EAAE,KAAK;YACvB,MAAM,EAAE,yDAAyD;SAClE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;IACtC,6EAA6E;IAC7E,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACzF,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,gBAAgB;YACnB,OAAO;gBACL,GAAG,IAAI;gBACP,OAAO,EAAE,KAAK;gBACd,WAAW,EAAE,gBAAgB;gBAC7B,MAAM,EAAE,IAAI;gBACZ,aAAa,EAAE,KAAK;gBACpB,MAAM,EAAE,uDAAuD;aAChE,CAAC;QACJ,KAAK,eAAe,CAAC;QACrB,KAAK,YAAY;YACf,OAAO;gBACL,GAAG,IAAI;gBACP,OAAO,EAAE,OAAO;gBAChB,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,GAAG,MAAM,mDAAmD;aACrE,CAAC;QACJ,KAAK,gBAAgB;YACnB,OAAO;gBACL,GAAG,IAAI;gBACP,OAAO,EAAE,OAAO;gBAChB,WAAW,EAAE,gBAAgB;gBAC7B,MAAM,EAAE,kCAAkC;aAC3C,CAAC;QACJ,KAAK,iBAAiB;YACpB,OAAO;gBACL,GAAG,IAAI;gBACP,OAAO,EAAE,OAAO;gBAChB,WAAW,EAAE,iBAAiB;gBAC9B,gBAAgB,EAAE,IAAI;gBACtB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,kBAAkB;aACzD,CAAC;QACJ,KAAK,eAAe;YAClB,OAAO;gBACL,GAAG,IAAI;gBACP,OAAO,EAAE,OAAO;gBAChB,WAAW,EAAE,QAAQ;gBACrB,gBAAgB,EAAE,IAAI;gBACtB,MAAM,EAAE,sBAAsB;aAC/B,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/telemetry/pre-consent-buffer.d.ts

@@ -0,0 +1,55 @@
+export declare const PRE_CONSENT_BUFFER_MAX_BYTES: number;
+/** A lock untouched for this long is treated as abandoned and reclaimed. */
+export declare const PRE_CONSENT_LOCK_STALE_MS: number;
+/** How long append / flush / discard wait for the lock before giving up. */
+export declare const PRE_CONSENT_LOCK_WAIT_MS: number;
+export interface PreConsentLockOptions {
+    staleMs?: number;
+    waitMs?: number;
+    retryMs?: number;
+}
+/** The buffer lock was still held by another process when the wait ran out. */
+export declare class PreConsentLockTimeoutError extends Error {
+    constructor(lockPath: string, waitMs: number);
+}
+export type PreConsentStream = "usage" | "skill";
+type Row = Record<string, unknown>;
+/** Buffer file for this account and stream, or `undefined` when the uid is absent or unsafe. */
+export declare function preConsentBufferPath(bufferDir: string, personUid: string | undefined, stream?: PreConsentStream): string | undefined;
+/**
+ * Split rows into batches the server accepts: at most `maxEvents` rows and a
+ * serialized `events` array of at most `maxBytes`. Rows are already bounded
+ * to fit a batch by the collectors.
+ */
+export declare function chunkRows(rows: Row[], maxEvents: number, maxBytes: number): Row[][];
+export interface AppendResult {
+    batchesAppended: number;
+    /** Oldest batches removed to stay under the cap (may include new ones if a single append exceeds it). */
+    batchesDropped: number;
+}
+/** Append batches for `personUid`, then drop the oldest until the file fits `maxBytes`. */
+export declare function appendPreConsentBatches(file: string, personUid: string, batches: Row[][], opts?: {
+    maxBytes?: number;
+    now?: () => string;
+    lock?: PreConsentLockOptions;
+}): Promise<AppendResult>;
+export interface FlushResult {
+    batchesSent: number;
+    eventsSent: number;
+    /** A POST failed; that batch and the ones after it are still stored. */
+    failed: boolean;
+}
+/**
+ * POST each stored batch in order, removing it from the file only after its
+ * own POST succeeds. The lock is held across the POSTs, so an append that
+ * arrives mid-flush waits and then adds to what is left.
+ */
+export declare function flushPreConsentBuffer<T extends Row = Row>(file: string, personUid: string, post: (events: T[]) => Promise<unknown>, opts?: {
+    lock?: PreConsentLockOptions;
+}): Promise<FlushResult>;
+/** Delete the account's buffer without sending it. Returns true when a file was removed. */
+export declare function discardPreConsentBuffer(file: string, opts?: {
+    lock?: PreConsentLockOptions;
+}): Promise<boolean>;
+export {};
+//# sourceMappingURL=pre-consent-buffer.d.ts.map

package/dist/telemetry/pre-consent-buffer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pre-consent-buffer.d.ts","sourceRoot":"","sources":["../../src/telemetry/pre-consent-buffer.ts"],"names":[],"mappings":"AA8BA,eAAO,MAAM,4BAA4B,QAAkB,CAAC;AAC5D,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,QAAgB,CAAC;AACvD,4EAA4E;AAC5E,eAAO,MAAM,wBAAwB,QAAY,CAAC;AAGlD,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,+EAA+E;AAC/E,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAI7C;AAED,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,OAAO,CAAC;AAEjD,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAanC,gGAAgG;AAChG,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,GAAE,gBAA0B,GACjC,MAAM,GAAG,SAAS,CAKpB;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,EAAE,EAAE,CAmBnF;AAuJD,MAAM,WAAW,YAAY;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,yGAAyG;IACzG,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,2FAA2F;AAC3F,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,EAAE,EAAE,EAChB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,qBAAqB,CAAA;CAAO,GACjF,OAAO,CAAC,YAAY,CAAC,CAuBvB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,EAC7D,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,EACvC,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,qBAAqB,CAAA;CAAO,GAC1C,OAAO,CAAC,WAAW,CAAC,CAgCtB;AAED,4FAA4F;AAC5F,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,qBAAqB,CAAA;CAAO,GAC1C,OAAO,CAAC,OAAO,CAAC,CAWlB"}

package/dist/telemetry/pre-consent-buffer.js

@@ -0,0 +1,303 @@
+/**
+ * Pre-consent telemetry buffer (policy indigo-pre-consent-telemetry-buffer-delivery).
+ *
+ * While the server answers `consentSource: "notice-pending"`, personal rows are not
+ * sent. The collector stores the batches it would have sent here instead, one
+ * file per account, and delivers them once the same account's collection is on.
+ *
+ * Layout:
+ *   <bufferDir>/<personUid>.jsonl          usage rows   (POST /v1/usage)
+ *   <bufferDir>/skill/<personUid>.jsonl    skill rows   (POST /v1/skill-invocations)
+ * `<bufferDir>` defaults to `~/.hq/telemetry-buffer`. Each line is one stored
+ * batch: `{"v":1,"personUid":"prs_…","bufferedAt":"<ISO>","events":[…]}`.
+ *
+ * Rules:
+ * - Account-bound: the path is derived from the signed-in `personUid`; a line
+ *   naming a different uid is never sent and is dropped on the next rewrite.
+ * - Delete-after-ack: flushing POSTs one stored batch at a time and removes a
+ *   batch only after its own POST succeeds. The first failure stops the flush
+ *   and keeps that batch and everything after it.
+ * - Discard on refusal: `discardPreConsentBuffer` deletes the file unsent.
+ * - Size cap: appends drop the oldest batches until the file fits the cap.
+ * - Locking: append, flush and discard each hold `<file>.lock` (created with
+ *   O_EXCL) for their whole read-modify-write, so two collectors or two runs
+ *   cannot overwrite each other's changes. A lock older than the stale age is
+ *   taken to be left by a crashed process and is reclaimed.
+ */
+import { randomBytes } from "node:crypto";
+import { promises as fs } from "node:fs";
+import * as path from "node:path";
+export const PRE_CONSENT_BUFFER_MAX_BYTES = 5 * 1024 * 1024;
+/** A lock untouched for this long is treated as abandoned and reclaimed. */
+export const PRE_CONSENT_LOCK_STALE_MS = 5 * 60 * 1000;
+/** How long append / flush / discard wait for the lock before giving up. */
+export const PRE_CONSENT_LOCK_WAIT_MS = 10 * 1000;
+const LOCK_RETRY_MS = 50;
+/** The buffer lock was still held by another process when the wait ran out. */
+export class PreConsentLockTimeoutError extends Error {
+    constructor(lockPath, waitMs) {
+        super(`pre-consent buffer lock ${lockPath} still held after ${waitMs} ms`);
+        this.name = "PreConsentLockTimeoutError";
+    }
+}
+// Person uids are server-issued `prs_*` ids. Anything with a path separator or
+// a dot segment is refused so a uid can never point outside the buffer dir.
+const SAFE_UID = /^[A-Za-z0-9_-]{1,128}$/;
+/** Buffer file for this account and stream, or `undefined` when the uid is absent or unsafe. */
+export function preConsentBufferPath(bufferDir, personUid, stream = "usage") {
+    if (personUid === undefined || !SAFE_UID.test(personUid))
+        return undefined;
+    return stream === "usage"
+        ? path.join(bufferDir, `${personUid}.jsonl`)
+        : path.join(bufferDir, stream, `${personUid}.jsonl`);
+}
+/**
+ * Split rows into batches the server accepts: at most `maxEvents` rows and a
+ * serialized `events` array of at most `maxBytes`. Rows are already bounded
+ * to fit a batch by the collectors.
+ */
+export function chunkRows(rows, maxEvents, maxBytes) {
+    const batches = [];
+    let current = [];
+    let bytes = 2;
+    for (const row of rows) {
+        const rowBytes = Buffer.byteLength(JSON.stringify(row), "utf-8");
+        if (current.length > 0 &&
+            (current.length >= maxEvents || bytes + 1 + rowBytes > maxBytes)) {
+            batches.push(current);
+            current = [];
+            bytes = 2;
+        }
+        bytes += rowBytes + (current.length > 0 ? 1 : 0);
+        current.push(row);
+    }
+    if (current.length > 0)
+        batches.push(current);
+    return batches;
+}
+async function readLines(file) {
+    let raw;
+    try {
+        raw = await fs.readFile(file, "utf-8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return [];
+        throw err;
+    }
+    return raw.split("\n").filter((line) => line.trim().length > 0);
+}
+function parseLine(line, personUid) {
+    try {
+        const parsed = JSON.parse(line);
+        if (parsed.v === 1 &&
+            parsed.personUid === personUid &&
+            Array.isArray(parsed.events) &&
+            parsed.events.length > 0) {
+            return parsed;
+        }
+    }
+    catch {
+        // A torn or corrupt line is dropped.
+    }
+    return undefined;
+}
+function uniqueSuffix() {
+    return `${process.pid}.${randomBytes(6).toString("hex")}`;
+}
+/** Create the buffer directory as 0700. `mkdir`'s mode is filtered by the umask and ignored for an existing dir, so chmod after. */
+async function ensureDir(dir) {
+    await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+    await fs.chmod(dir, 0o700);
+}
+async function dirExists(dir) {
+    try {
+        return (await fs.stat(dir)).isDirectory();
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return false;
+        throw err;
+    }
+}
+/** Atomic rewrite (tmp + rename); an empty list removes the file. Call with the lock held. */
+async function writeLines(file, lines) {
+    if (lines.length === 0) {
+        await fs.rm(file, { force: true });
+        return;
+    }
+    const tmp = `${file}.${uniqueSuffix()}.tmp`;
+    try {
+        await fs.writeFile(tmp, lines.map((line) => `${line}\n`).join(""), {
+            encoding: "utf-8",
+            mode: 0o600,
+        });
+        await fs.rename(tmp, file);
+    }
+    catch (err) {
+        await fs.rm(tmp, { force: true });
+        throw err;
+    }
+}
+/** The lock was already reclaimed or removed: nothing to do. Any other error is real. */
+function ignoreMissing(err) {
+    if (err.code === "ENOENT")
+        return undefined;
+    throw err;
+}
+/** Remove the lock at `lockPath` if it is older than `staleMs`. Returns true when the caller should retry at once. */
+async function reclaimIfStale(lockPath, staleMs) {
+    let mtimeMs;
+    try {
+        mtimeMs = (await fs.stat(lockPath)).mtimeMs;
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return true;
+        throw err;
+    }
+    if (Date.now() - mtimeMs <= staleMs)
+        return false;
+    // Rename first so only one waiter removes this particular stale lock.
+    const aside = `${lockPath}.${uniqueSuffix()}.stale`;
+    try {
+        await fs.rename(lockPath, aside);
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return true;
+        throw err;
+    }
+    await fs.rm(aside, { force: true });
+    return true;
+}
+async function acquireLock(file, opts) {
+    const lockPath = `${file}.lock`;
+    const staleMs = opts.staleMs ?? PRE_CONSENT_LOCK_STALE_MS;
+    const waitMs = opts.waitMs ?? PRE_CONSENT_LOCK_WAIT_MS;
+    const retryMs = opts.retryMs ?? LOCK_RETRY_MS;
+    const token = `${uniqueSuffix()} ${new Date().toISOString()}\n`;
+    const deadline = Date.now() + waitMs;
+    for (;;) {
+        try {
+            const handle = await fs.open(lockPath, "wx", 0o600);
+            try {
+                await handle.writeFile(token, "utf-8");
+            }
+            finally {
+                await handle.close();
+            }
+            return {
+                async refresh() {
+                    const now = new Date();
+                    await fs.utimes(lockPath, now, now).catch(ignoreMissing);
+                },
+                async release() {
+                    // Remove the lock only if it is still ours: after a stale reclaim it
+                    // may belong to another process.
+                    const current = await fs.readFile(lockPath, "utf-8").catch(ignoreMissing);
+                    if (current === token)
+                        await fs.rm(lockPath, { force: true });
+                },
+            };
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                throw err;
+        }
+        if (await reclaimIfStale(lockPath, staleMs))
+            continue;
+        if (Date.now() >= deadline)
+            throw new PreConsentLockTimeoutError(lockPath, waitMs);
+        await new Promise((resolve) => setTimeout(resolve, retryMs));
+    }
+}
+async function withLock(file, opts, fn) {
+    const lock = await acquireLock(file, opts);
+    try {
+        return await fn(lock);
+    }
+    finally {
+        await lock.release();
+    }
+}
+/** Append batches for `personUid`, then drop the oldest until the file fits `maxBytes`. */
+export async function appendPreConsentBatches(file, personUid, batches, opts = {}) {
+    const nonEmpty = batches.filter((batch) => batch.length > 0);
+    if (nonEmpty.length === 0)
+        return { batchesAppended: 0, batchesDropped: 0 };
+    const maxBytes = opts.maxBytes ?? PRE_CONSENT_BUFFER_MAX_BYTES;
+    const bufferedAt = (opts.now ?? (() => new Date().toISOString()))();
+    const added = nonEmpty.map((events) => JSON.stringify({ v: 1, personUid, bufferedAt, events }));
+    await ensureDir(path.dirname(file));
+    return withLock(file, opts.lock ?? {}, async () => {
+        const existing = (await readLines(file)).filter((line) => parseLine(line, personUid));
+        const lines = [...existing, ...added];
+        let total = lines.reduce((sum, line) => sum + Buffer.byteLength(line, "utf-8") + 1, 0);
+        let dropped = 0;
+        while (lines.length > 0 && total > maxBytes) {
+            const oldest = lines.shift();
+            total -= Buffer.byteLength(oldest, "utf-8") + 1;
+            dropped++;
+        }
+        await writeLines(file, lines);
+        return { batchesAppended: added.length, batchesDropped: dropped };
+    });
+}
+/**
+ * POST each stored batch in order, removing it from the file only after its
+ * own POST succeeds. The lock is held across the POSTs, so an append that
+ * arrives mid-flush waits and then adds to what is left.
+ */
+export async function flushPreConsentBuffer(file, personUid, post, opts = {}) {
+    // Nothing was ever buffered here; do not create the directory just to look.
+    if (!(await dirExists(path.dirname(file))))
+        return { batchesSent: 0, eventsSent: 0, failed: false };
+    return withLock(file, opts.lock ?? {}, async (lock) => {
+        const lines = await readLines(file);
+        if (lines.length === 0)
+            return { batchesSent: 0, eventsSent: 0, failed: false };
+        const remaining = lines
+            .map((line) => ({ line, batch: parseLine(line, personUid) }))
+            .filter((entry) => entry.batch !== undefined);
+        if (remaining.length !== lines.length) {
+            await writeLines(file, remaining.map((entry) => entry.line));
+        }
+        let batchesSent = 0;
+        let eventsSent = 0;
+        while (remaining.length > 0) {
+            const { batch } = remaining[0];
+            try {
+                // Stored rows were written by this module from the collector's own
+                // wire rows, so they have the collector's row type.
+                await post(batch.events);
+            }
+            catch {
+                return { batchesSent, eventsSent, failed: true };
+            }
+            remaining.shift();
+            batchesSent++;
+            eventsSent += batch.events.length;
+            await writeLines(file, remaining.map((entry) => entry.line));
+            await lock.refresh();
+        }
+        return { batchesSent, eventsSent, failed: false };
+    });
+}
+/** Delete the account's buffer without sending it. Returns true when a file was removed. */
+export async function discardPreConsentBuffer(file, opts = {}) {
+    if (!(await dirExists(path.dirname(file))))
+        return false;
+    return withLock(file, opts.lock ?? {}, async () => {
+        try {
+            await fs.unlink(file);
+            return true;
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                return false;
+            throw err;
+        }
+    });
+}
+//# sourceMappingURL=pre-consent-buffer.js.map

package/dist/telemetry/pre-consent-buffer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pre-consent-buffer.js","sourceRoot":"","sources":["../../src/telemetry/pre-consent-buffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC5D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACvD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,CAAC;AAClD,MAAM,aAAa,GAAG,EAAE,CAAC;AAQzB,+EAA+E;AAC/E,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAAY,QAAgB,EAAE,MAAc;QAC1C,KAAK,CAAC,2BAA2B,QAAQ,qBAAqB,MAAM,KAAK,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAaD,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,QAAQ,GAAG,wBAAwB,CAAC;AAE1C,gGAAgG;AAChG,MAAM,UAAU,oBAAoB,CAClC,SAAiB,EACjB,SAA6B,EAC7B,SAA2B,OAAO;IAElC,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3E,OAAO,MAAM,KAAK,OAAO;QACvB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,SAAS,QAAQ,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,IAAW,EAAE,SAAiB,EAAE,QAAgB;IACxE,MAAM,OAAO,GAAY,EAAE,CAAC;IAC5B,IAAI,OAAO,GAAU,EAAE,CAAC;IACxB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;QACjE,IACE,OAAO,CAAC,MAAM,GAAG,CAAC;YAClB,CAAC,OAAO,CAAC,MAAM,IAAI,SAAS,IAAI,KAAK,GAAG,CAAC,GAAG,QAAQ,GAAG,QAAQ,CAAC,EAChE,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,GAAG,CAAC,CAAC;QACZ,CAAC;QACD,KAAK,IAAI,QAAQ,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAChE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,SAAiB;IAChD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyB,CAAC;QACxD,IACE,MAAM,CAAC,CAAC,KAAK,CAAC;YACd,MAAM,CAAC,SAAS,KAAK,SAAS;YAC9B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YAC5B,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EACxB,CAAC;YACD,OAAO,MAAqB,CAAC;QAC/B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,GAAG,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,oIAAoI;AACpI,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACnE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,KAAe;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,YAAY,EAAE,MAAM,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;YACjE,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,yFAAyF;AACzF,SAAS,aAAa,CAAC,GAAY;IACjC,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACvE,MAAM,GAAG,CAAC;AACZ,CAAC;AAQD,sHAAsH;AACtH,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,OAAe;IAC7D,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,OAAO;QAAE,OAAO,KAAK,CAAC;IAClD,sEAAsE;IACtE,MAAM,KAAK,GAAG,GAAG,QAAQ,IAAI,YAAY,EAAE,QAAQ,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,IAA2B;IAClE,MAAM,QAAQ,GAAG,GAAG,IAAI,OAAO,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,yBAAyB,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,wBAAwB,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,aAAa,CAAC;IAC9C,MAAM,KAAK,GAAG,GAAG,YAAY,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACpD,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACzC,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YACD,OAAO;gBACL,KAAK,CAAC,OAAO;oBACX,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;gBAC3D,CAAC;gBACD,KAAK,CAAC,OAAO;oBACX,qEAAqE;oBACrE,iCAAiC;oBACjC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;oBAC1E,IAAI,OAAO,KAAK,KAAK;wBAAE,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChE,CAAC;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QAClE,CAAC;QACD,IAAI,MAAM,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC;YAAE,SAAS;QACtD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAM,IAAI,0BAA0B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnF,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,IAAY,EACZ,IAA2B,EAC3B,EAAkC;IAElC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAQD,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAY,EACZ,SAAiB,EACjB,OAAgB,EAChB,OAAgF,EAAE;IAElF,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;IAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,4BAA4B,CAAC;IAC/D,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACpC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAwB,CAAC,CAC9E,CAAC;IAEF,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,QAAQ,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC;QACtC,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACvF,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAY,CAAC;YACvC,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAChD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9B,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC;AASD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAY,EACZ,SAAiB,EACjB,IAAuC,EACvC,OAAyC,EAAE;IAE3C,4EAA4E;IAC5E,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACpG,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACpD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAChF,MAAM,SAAS,GAAG,KAAK;aACpB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;aAC5D,MAAM,CAAC,CAAC,KAAK,EAAiD,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;QAC/F,IAAI,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,CAAC;gBACH,mEAAmE;gBACnE,oDAAoD;gBACpD,MAAM,IAAI,CAAC,KAAK,CAAC,MAAa,CAAC,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACnD,CAAC;YACD,SAAS,CAAC,KAAK,EAAE,CAAC;YAClB,WAAW,EAAE,CAAC;YACd,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;YAClC,MAAM,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7D,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAY,EACZ,OAAyC,EAAE;IAE3C,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,KAAK,IAAI,EAAE;QAChD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACnE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/telemetry.d.ts

@@ -23,6 +23,7 @@
  * sync. The cursor is only advanced for batches the server 2xx'd, so a
  * transient outage retries automatically on the next sync.
  */
+import { type DecidedOptInSource } from "./telemetry/consent-source.js";
 import type { TelemetryOptInResponse, UsageBatch, UsageIngestResult } from "./vault-client.js";
 /**
  * Minimal subset of `VaultClient` the collector needs. Declared as an
@@ -116,6 +117,8 @@ export interface CollectTelemetryOptions {
      * check is skipped (including menubar fallback).
      */
     forceCollect?: boolean;
+    /** Override `~/.hq/telemetry-buffer` (the pre-consent buffer) for tests. */
+    bufferDir?: string;
     /** Diagnostic sink. No-op by default. */
     log?: (msg: string) => void;
 }
@@ -133,7 +136,13 @@ export interface CollectTelemetryResult {
      */
     companyScopeOnly?: boolean;
     /** Source for the `enabled` decision — useful for diagnosing missing-events reports. */
-    optInSource: "server" | "menubar-fallback" | "menubar-reasserted" | "agent-required" | "skipped";
+    optInSource: DecidedOptInSource | "menubar-reasserted" | "skipped";
+    /** Personal rows held in the account's pre-consent buffer this run (notice-pending). */
+    preConsentBuffered?: number;
+    /** Previously buffered rows delivered this run, before the regular scan. */
+    preConsentFlushed?: number;
+    /** The account refused (personal opt-out) and its buffer was deleted unsent. */
+    preConsentDiscarded?: boolean;
     /** How many `.jsonl` files we considered (before the cursor diff). */
     filesScanned: number;
     /** Total events successfully POSTed across all batches. */

package/dist/telemetry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAiBH,OAAO,KAAK,EACV,sBAAsB,EACtB,UAAU,EACV,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AAI3B;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,iBAAiB,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrD,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzD;;;OAGG;IACH,iBAAiB,CAAC,CAChB,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,GAC/B,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,oJAAoJ;IACpJ,SAAS,EAAE,MAAM,CAAC;IAClB,+HAA+H;IAC/H,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,mFAAmF;IACnF,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,+CAA+C;IAC/C,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,6DAA6D;IAC7D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,yCAAyC;IACzC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACrC,4KAA4K;IAC5K,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,wFAAwF;IACxF,WAAW,EACP,QAAQ,GACR,kBAAkB,GAClB,oBAAoB,GACpB,gBAAgB,GAChB,SAAS,CAAC;IACd,sEAAsE;IACtE,YAAY,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAkND;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,OAAO,GACf,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAyBpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,OAAO,EACZ,UAAU,CAAC,EAAE,MAAM,GAClB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CA4ChC;AAshBD;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,sBAAsB,CAAC,CAsoBjC"}
+{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAiBH,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,+BAA+B,CAAC;AAQvC,OAAO,KAAK,EACV,sBAAsB,EACtB,UAAU,EACV,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AAI3B;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,iBAAiB,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrD,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzD;;;OAGG;IACH,iBAAiB,CAAC,CAChB,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,GAC/B,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,oJAAoJ;IACpJ,SAAS,EAAE,MAAM,CAAC;IAClB,+HAA+H;IAC/H,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,mFAAmF;IACnF,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,+CAA+C;IAC/C,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,6DAA6D;IAC7D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACrC,4KAA4K;IAC5K,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,wFAAwF;IACxF,WAAW,EAAE,kBAAkB,GAAG,oBAAoB,GAAG,SAAS,CAAC;IACnE,wFAAwF;IACxF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,4EAA4E;IAC5E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gFAAgF;IAChF,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,sEAAsE;IACtE,YAAY,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAkND;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,OAAO,GACf,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAyBpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,OAAO,EACZ,UAAU,CAAC,EAAE,MAAM,GAClB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CA4ChC;AAshBD;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,sBAAsB,CAAC,CAiwBjC"}