@microsoft/managed-apps-cli 0.18.0 → 0.19.0

package/dist/Logger/BufferedTelemetryWriter.js

@@ -0,0 +1,163 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+import { randomUUID } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { stripSensitiveDataFromObject, TelemetryEventNames, } from '@microsoft/managed-apps-common/telemetry';
+import { TELEMETRY_DIRECTORY } from '../Constants.js';
+import { getScrubbedCustomDimensions } from './Scrubber/ScrubCustomDimensions.js';
+const telemetryJournalFileName = /^telemetry-\d+-[0-9a-f-]+\.json$/i;
+const telemetryJournalRetentionMs = 7 * 24 * 60 * 60 * 1000;
+const maxTelemetryJournals = 20;
+// Captures remote telemetry emitted before the command resolves its environment and cloud,
+// so it can be replayed through the correctly routed OneDS writer afterward.
+export class BufferedTelemetryWriter {
+    _events = [];
+    trackActivityEvent(eventName, eventData, timestamp) {
+        this._events.push({
+            method: 'trackActivityEvent',
+            args: [eventName, eventData],
+            timestamp: timestamp ?? new Date().toISOString(),
+        });
+    }
+    trackErrorEvent(eventName, eventData, timestamp) {
+        this._events.push({
+            method: 'trackErrorEvent',
+            args: [eventName, eventData],
+            timestamp: timestamp ?? new Date().toISOString(),
+        });
+    }
+    startScenario(scenarioName, startData, timestamp) {
+        this._events.push({
+            method: 'startScenario',
+            args: [scenarioName, startData],
+            timestamp: timestamp ?? new Date().toISOString(),
+        });
+    }
+    progressScenario(scenarioName, progressData, timestamp) {
+        this._events.push({
+            method: 'progressScenario',
+            args: [scenarioName, progressData],
+            timestamp: timestamp ?? new Date().toISOString(),
+        });
+    }
+    completeScenario(scenarioName, completeData, timestamp) {
+        this._events.push({
+            method: 'completeScenario',
+            args: [scenarioName, completeData],
+            timestamp: timestamp ?? new Date().toISOString(),
+        });
+    }
+    scenarioFailed(scenarioName, failureData, timestamp) {
+        this._events.push({
+            method: 'scenarioFailed',
+            args: [scenarioName, failureData],
+            timestamp: timestamp ?? new Date().toISOString(),
+        });
+    }
+    scenarioCompletedWithError(scenarioName, completeWithErrorData, timestamp) {
+        this._events.push({
+            method: 'scenarioCompletedWithError',
+            args: [scenarioName, completeWithErrorData],
+            timestamp: timestamp ?? new Date().toISOString(),
+        });
+    }
+    flush() {
+        return Promise.resolve();
+    }
+    setCustomDimension(_key, _value) { }
+    replay(writer, transformEventData) {
+        for (const event of this._events) {
+            const [name, eventData] = event.args;
+            writer[event.method](name, transformEventData ? transformEventData(eventData) : eventData, event.timestamp);
+        }
+    }
+    clear() {
+        this._events.length = 0;
+    }
+    writeToTemporaryFile(directory = TELEMETRY_DIRECTORY) {
+        if (this._events.length === 0) {
+            return undefined;
+        }
+        try {
+            fs.mkdirSync(directory, { recursive: true });
+            try {
+                cleanupTelemetryJournals(directory);
+            }
+            catch {
+                // Retention is best effort and must not prevent persisting the current journal.
+            }
+            const filePath = path.join(directory, `telemetry-${Date.now()}-${randomUUID()}.json`);
+            const temporaryFilePath = `${filePath}.${process.pid}.tmp`;
+            fs.writeFileSync(temporaryFilePath, stripSensitiveDataFromObject({
+                events: this._events.map((event) => ({
+                    ...event,
+                    args: [event.args[0], getScrubbedEventData(event)],
+                })),
+            }), 'utf-8');
+            fs.renameSync(temporaryFilePath, filePath);
+            return filePath;
+        }
+        catch {
+            return undefined;
+        }
+    }
+}
+function cleanupTelemetryJournals(directory) {
+    const expirationTime = Date.now() - telemetryJournalRetentionMs;
+    const journals = fs
+        .readdirSync(directory, { withFileTypes: true })
+        .filter((entry) => entry.isFile() && telemetryJournalFileName.test(entry.name))
+        .map((entry) => {
+        const filePath = path.join(directory, entry.name);
+        return { filePath, modifiedTime: fs.statSync(filePath).mtimeMs };
+    });
+    const retainedJournals = journals
+        .filter((journal) => {
+        if (journal.modifiedTime >= expirationTime) {
+            return true;
+        }
+        fs.rmSync(journal.filePath);
+        return false;
+    })
+        .sort((left, right) => left.modifiedTime - right.modifiedTime);
+    const journalsToRemove = retainedJournals.slice(0, Math.max(0, retainedJournals.length - (maxTelemetryJournals - 1)));
+    for (const journal of journalsToRemove) {
+        fs.rmSync(journal.filePath);
+    }
+}
+function getScrubbedEventData(event) {
+    const [name, eventData] = event.args;
+    const eventName = getOneDsEventName(event.method);
+    const dimensions = event.method === 'trackActivityEvent' || event.method === 'trackErrorEvent'
+        ? { ...eventData, operationName: name }
+        : {
+            operationName: name,
+            ...eventData,
+            scenarioName: name,
+            ...(event.method === 'completeScenario' && { scenarioResult: 'Success' }),
+            ...(event.method === 'scenarioFailed' && { scenarioResult: 'Failed' }),
+            ...(event.method === 'scenarioCompletedWithError' && {
+                scenarioResult: 'SuccessWithErrors',
+            }),
+        };
+    return getScrubbedCustomDimensions(eventName, name, dimensions);
+}
+function getOneDsEventName(method) {
+    switch (method) {
+        case 'trackActivityEvent':
+            return TelemetryEventNames.Activity;
+        case 'trackErrorEvent':
+            return TelemetryEventNames.Error;
+        case 'startScenario':
+            return TelemetryEventNames.StartScenario;
+        case 'progressScenario':
+            return TelemetryEventNames.ProgressScenario;
+        case 'completeScenario':
+        case 'scenarioFailed':
+        case 'scenarioCompletedWithError':
+            return TelemetryEventNames.EndScenario;
+    }
+}
+//# sourceMappingURL=BufferedTelemetryWriter.js.map

package/dist/Logger/BufferedTelemetryWriter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BufferedTelemetryWriter.js","sourceRoot":"","sources":["../../src/Logger/BufferedTelemetryWriter.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAElD,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAE/E,MAAM,wBAAwB,GAAG,mCAAmC,CAAC;AACrE,MAAM,2BAA2B,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5D,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,2FAA2F;AAC3F,6EAA6E;AAC7E,MAAM,OAAO,uBAAuB;IACjB,OAAO,GAA6B,EAAE,CAAC;IAEjD,kBAAkB,CAAC,SAAiB,EAAE,SAAkB,EAAE,SAAkB;QACjF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YAChB,MAAM,EAAE,oBAAoB;YAC5B,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;YAC5B,SAAS,EAAE,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACjD,CAAC,CAAC;IACL,CAAC;IAEM,eAAe,CAAC,SAAiB,EAAE,SAAkB,EAAE,SAAkB;QAC9E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YAChB,MAAM,EAAE,iBAAiB;YACzB,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;YAC5B,SAAS,EAAE,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACjD,CAAC,CAAC;IACL,CAAC;IAEM,aAAa,CAAC,YAAoB,EAAE,SAAkB,EAAE,SAAkB;QAC/E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YAChB,MAAM,EAAE,eAAe;YACvB,IAAI,EAAE,CAAC,YAAY,EAAE,SAAS,CAAC;YAC/B,SAAS,EAAE,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACjD,CAAC,CAAC;IACL,CAAC;IAEM,gBAAgB,CAAC,YAAoB,EAAE,YAAqB,EAAE,SAAkB;QACrF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YAChB,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;YAClC,SAAS,EAAE,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACjD,CAAC,CAAC;IACL,CAAC;IAEM,gBAAgB,CAAC,YAAoB,EAAE,YAAqB,EAAE,SAAkB;QACrF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YAChB,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;YAClC,SAAS,EAAE,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACjD,CAAC,CAAC;IACL,CAAC;IAEM,cAAc,CAAC,YAAoB,EAAE,WAAoB,EAAE,SAAkB;QAClF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YAChB,MAAM,EAAE,gBAAgB;YACxB,IAAI,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC;YACjC,SAAS,EAAE,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACjD,CAAC,CAAC;IACL,CAAC;IAEM,0BAA0B,CAC/B,YAAoB,EACpB,qBAA8B,EAC9B,SAAkB;QAElB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YAChB,MAAM,EAAE,4BAA4B;YACpC,IAAI,EAAE,CAAC,YAAY,EAAE,qBAAqB,CAAC;YAC3C,SAAS,EAAE,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACjD,CAAC,CAAC;IACL,CAAC;IAEM,KAAK;QACV,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAEM,kBAAkB,CAAC,IAAY,EAAE,MAAc,IAAS,CAAC;IAEzD,MAAM,CACX,MAAwB,EACxB,kBAA0E;QAE1E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;YACrC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAClB,IAAI,EACJ,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,EAC9D,KAAK,CAAC,SAAS,CAChB,CAAC;QACJ,CAAC;IACH,CAAC;IAEM,KAAK;QACV,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,CAAC;IAEM,oBAAoB,CAAC,SAAS,GAAG,mBAAmB;QACzD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7C,IAAI,CAAC;gBACH,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,gFAAgF;YAClF,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,IAAI,CAAC,GAAG,EAAE,IAAI,UAAU,EAAE,OAAO,CAAC,CAAC;YACtF,MAAM,iBAAiB,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;YAC3D,EAAE,CAAC,aAAa,CACd,iBAAiB,EACjB,4BAA4B,CAAC;gBAC3B,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACnC,GAAG,KAAK;oBACR,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,oBAAoB,CAAC,KAAK,CAAC,CAAC;iBACnD,CAAC,CAAC;aACJ,CAAC,EACF,OAAO,CACR,CAAC;YACF,EAAE,CAAC,UAAU,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;YAC3C,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF;AAED,SAAS,wBAAwB,CAAC,SAAiB;IACjD,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,2BAA2B,CAAC;IAChE,MAAM,QAAQ,GAAG,EAAE;SAChB,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAC/C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAC9E,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IAEL,MAAM,gBAAgB,GAAG,QAAQ;SAC9B,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;QAClB,IAAI,OAAO,CAAC,YAAY,IAAI,cAAc,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;IAEjE,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,KAAK,CAC7C,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,CAAC,MAAM,GAAG,CAAC,oBAAoB,GAAG,CAAC,CAAC,CAAC,CAClE,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAA6B;IACzD,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;IACrC,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,UAAU,GACd,KAAK,CAAC,MAAM,KAAK,oBAAoB,IAAI,KAAK,CAAC,MAAM,KAAK,iBAAiB;QACzE,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE;QACvC,CAAC,CAAC;YACE,aAAa,EAAE,IAAI;YACnB,GAAG,SAAS;YACZ,YAAY,EAAE,IAAI;YAClB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,kBAAkB,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;YACzE,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,gBAAgB,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;YACtE,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,4BAA4B,IAAI;gBACnD,cAAc,EAAE,mBAAmB;aACpC,CAAC;SACH,CAAC;IAER,OAAO,2BAA2B,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAwC;IACjE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,oBAAoB;YACvB,OAAO,mBAAmB,CAAC,QAAQ,CAAC;QACtC,KAAK,iBAAiB;YACpB,OAAO,mBAAmB,CAAC,KAAK,CAAC;QACnC,KAAK,eAAe;YAClB,OAAO,mBAAmB,CAAC,aAAa,CAAC;QAC3C,KAAK,kBAAkB;YACrB,OAAO,mBAAmB,CAAC,gBAAgB,CAAC;QAC9C,KAAK,kBAAkB,CAAC;QACxB,KAAK,gBAAgB,CAAC;QACtB,KAAK,4BAA4B;YAC/B,OAAO,mBAAmB,CAAC,WAAW,CAAC;IAC3C,CAAC;AACH,CAAC"}

package/dist/Logger/CliLogger.d.ts

@@ -1,69 +1,47 @@
 /*!
  * Copyright (C) Microsoft Corporation. All rights reserved.
  */
+import { type Region } from '@microsoft/managed-apps-common/services';
 import type { ILogger, ScenarioTracker } from '@microsoft/managed-apps-common/telemetry';
-import type { CliHttpClient } from '../HttpClient/CliHttpClient.js';
 import type { CliSettings, IAuthenticationProvider } from '../Types/Cli.types.js';
 import { type OneDsHttpForwardOptions } from './OneDSWriter.js';
+export interface TelemetryContext {
+    region: Region;
+    environmentId?: string;
+}
 /**
  * Logger implementation for the CLI.
  *
- * Telemetry is **unauthenticated by default**: the OneDS writer is constructed at
- * `create()` time with `telemetryLocation: 'global'` and no `geoLocation`, so events
- * start flowing immediately without any auth dependency. The writer is then upgraded to
- * the EU-aware authed version via one of two paths:
- *
- * - `tryEagerUpgradeAsync` — called from `runVerb` after MSAL is initialized. If a
- *   cached account already exists, the upgrade runs synchronously before the first event
- *   so signed-in users get authed telemetry for the entire session.
- * - `CliHttpClient.onFirstAuth` callback — registered in `create()`, fires (background)
- *   after the verb's first successful authed HTTP call. Handles users who sign in
- *   mid-session via MSAL.
- *
- * Verbs that never make an authed HTTP call and have no cached account stay on the
- * unauthenticated writer for their whole lifetime — events still reach 1DS, just on
- * the global endpoint with no `geoLocation` or `tenantId`.
- *
- * 1DS event submission uses its own ingestion credentials (not the Entra bearer token),
- * so events can be sent regardless of sign-in state.
+ * Remote telemetry is buffered until the command resolves its target environment and region.
+ * Console telemetry is initialized immediately when enabled.
  */
 export declare class CliLogger implements ILogger {
     private _telemetryWriters;
-    private _unauthWriter?;
+    private _bufferedWriter?;
+    private _remoteWriter?;
     private readonly _customDimensions;
-    private _upgradeFired;
     private readonly _sessionId;
-    private _upgradeConfig?;
+    private readonly _origin;
+    private readonly _authenticationProvider;
+    private readonly _appId;
+    private readonly _httpForwardOptions?;
+    private _telemetryContext?;
+    private _environmentMetadataPromise?;
+    private _isRemoteTelemetrySuppressed;
+    private _isEnvironmentlessTelemetry;
     private constructor();
-    static create(cliSettings: CliSettings, httpClient: CliHttpClient, authenticationProvider: IAuthenticationProvider, httpForwardOptions?: OneDsHttpForwardOptions): Promise<CliLogger>;
-    /**
-     * Eagerly run the upgrade when a cached account already exists at verb-start time,
-     * so even the first telemetry event of the session lands on the authenticated writer.
-     * Called from `ArgumentProvider.runVerb` after `authProvider.initAsync(region)` but
-     * before any event is emitted.
-     *
-     * No-op if no cached account is present (we don't want to block CLI startup on a
-     * network call when the user isn't even signed in), or if the upgrade has already
-     * fired. For not-signed-in users the lazy `onFirstAuth` path still handles things
-     * later if the verb itself triggers a sign-in.
-     *
-     * Cost: ~100-500ms for signed-in users — the time `getEnvironmentByName` takes.
-     * Signed-in-but-offline users will block on the default fetch timeout before
-     * falling through; events still flow to the unauthenticated writer in that case.
-     */
-    tryEagerUpgradeAsync(authenticationProvider: IAuthenticationProvider): Promise<void>;
+    static create(cliSettings: CliSettings, authenticationProvider: IAuthenticationProvider, httpForwardOptions?: OneDsHttpForwardOptions): Promise<CliLogger>;
+    setCustomDimension(_key: string, _value: string): void;
     /**
-     * Replaces the unauthenticated OneDS writer with an EU-aware authed one. Called from
-     * two paths:
-     * - `tryEagerUpgradeAsync` (blocking, before the first event) when a cached account
-     *   is already present at verb-start time.
-     * - `CliHttpClient.onFirstAuth` (fire-and-forget) after the verb's first successful
-     *   authed HTTP call, when the user signed in mid-session.
-     * Best-effort — on any failure the unauthenticated writer stays in place and events
-     * keep flowing to the global endpoint.
+     * Records the command's resolved routing context and activates the remote writer once the
+     * environment metadata is available.
      */
-    private _upgradeToAuthedWriterAsync;
-    setCustomDimension(_key: string, _value: string): void;
+    setTelemetryContext(context: TelemetryContext): Promise<void>;
+    private _getEnvironmentMetadataAsync;
+    private _activateRemoteWriter;
+    private _activateEnvironmentlessRemoteWriter;
+    private _createRemoteWriterAndReplay;
+    writeBufferedTelemetryToFile(directory?: string): string | undefined;
     trackActivityEvent(eventName: string, eventData?: object): void;
     trackErrorEvent(eventName: string, eventData?: object): void;
     trackScenario(eventName: string, eventData?: object): ScenarioTracker;
@@ -74,7 +52,7 @@ export declare class CliLogger implements ILogger {
     }): void;
     get sessionId(): string | undefined;
     set sessionId(_value: string);
-    flush(): Promise<void>;
+    flush(retainBufferedTelemetry?: boolean): Promise<void>;
     withDefaults(_extras: Record<string, string | number | boolean>): ILogger;
     addDefaults(_extras: Record<string, string | number | boolean>): void;
 }

package/dist/Logger/CliLogger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CliLogger.d.ts","sourceRoot":"","sources":["../../src/Logger/CliLogger.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAGzF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EACV,WAAW,EACX,uBAAuB,EAExB,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EAAE,KAAK,uBAAuB,EAAe,MAAM,eAAe,CAAC;AAiG1E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,SAAU,YAAW,OAAO;IACvC,OAAO,CAAC,iBAAiB,CAA0B;IACnD,OAAO,CAAC,aAAa,CAAC,CAAc;IACpC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA8B;IAChE,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,cAAc,CAAC,CAOrB;IAEF,OAAO;WAKa,MAAM,CACxB,WAAW,EAAE,WAAW,EACxB,UAAU,EAAE,aAAa,EACzB,sBAAsB,EAAE,uBAAuB,EAC/C,kBAAkB,CAAC,EAAE,uBAAuB,GAC3C,OAAO,CAAC,SAAS,CAAC;IAqErB;;;;;;;;;;;;;;OAcG;IACU,oBAAoB,CAC/B,sBAAsB,EAAE,uBAAuB,GAC9C,OAAO,CAAC,IAAI,CAAC;IAShB;;;;;;;;;OASG;YACW,2BAA2B;IAyDlC,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAetD,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAW/D,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAW5D,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe;IAuBrE,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI;IAI5D,YAAY,CAAC,SAAS,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAI5E,IAAW,SAAS,IAAI,MAAM,GAAG,SAAS,CAEzC;IAED,IAAW,SAAS,CAAC,MAAM,EAAE,MAAM,EAElC;IAEM,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAMtB,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,OAAO;IAOzE,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI;CAG7E"}
+{"version":3,"file":"CliLogger.d.ts","sourceRoot":"","sources":["../../src/Logger/CliLogger.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,EAAE,KAAK,MAAM,EAA2B,MAAM,yCAAyC,CAAC;AAC/F,OAAO,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAGzF,OAAO,KAAK,EACV,WAAW,EACX,uBAAuB,EAExB,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EAAE,KAAK,uBAAuB,EAAe,MAAM,eAAe,CAAC;AAE1E,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAwID;;;;;GAKG;AACH,qBAAa,SAAU,YAAW,OAAO;IACvC,OAAO,CAAC,iBAAiB,CAA0B;IACnD,OAAO,CAAC,eAAe,CAAC,CAA0B;IAClD,OAAO,CAAC,aAAa,CAAC,CAAc;IACpC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA8B;IAChE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAA0B;IAClE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAA0B;IAC/D,OAAO,CAAC,iBAAiB,CAAC,CAAmB;IAC7C,OAAO,CAAC,2BAA2B,CAAC,CAElC;IACF,OAAO,CAAC,4BAA4B,CAAS;IAC7C,OAAO,CAAC,2BAA2B,CAAS;IAE5C,OAAO;WAgBa,MAAM,CACxB,WAAW,EAAE,WAAW,EACxB,sBAAsB,EAAE,uBAAuB,EAC/C,kBAAkB,CAAC,EAAE,uBAAuB,GAC3C,OAAO,CAAC,SAAS,CAAC;IA4Cd,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAiB7D;;;OAGG;IACU,mBAAmB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;YAuB5D,4BAA4B;YAoB5B,qBAAqB;IAuBnC,OAAO,CAAC,oCAAoC;IAc5C,OAAO,CAAC,4BAA4B;IA6C7B,4BAA4B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAGpE,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAW/D,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAW5D,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe;IAuBrE,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI;IAI5D,YAAY,CAAC,SAAS,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAI5E,IAAW,SAAS,IAAI,MAAM,GAAG,SAAS,CAEzC;IAED,IAAW,SAAS,CAAC,MAAM,EAAE,MAAM,EAElC;IAEY,KAAK,CAAC,uBAAuB,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAc3D,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,OAAO;IAOzE,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI;CAG7E"}

package/dist/Logger/CliLogger.js

@@ -3,13 +3,39 @@
  */
 import { randomUUID } from 'node:crypto';
 import { getEnvironmentByName } from '@microsoft/managed-apps-actions';
-import { cloudToRegionSafe } from '@microsoft/managed-apps-common/services';
+import { regionToClusterCategory } from '@microsoft/managed-apps-common/services';
 import packageJson from '../../package.json' with { type: 'json' };
 import { getCliEnvVarBool } from '../Utils/EnvVars.js';
+import { BufferedTelemetryWriter } from './BufferedTelemetryWriter.js';
 import { ConsoleWriter } from './ConsoleWriter.js';
 import { EUGeoRegions } from './Constants.js';
 import { resolveUserTelemetrySettings } from './LoggerSettings.js';
 import { OneDSWriter } from './OneDSWriter.js';
+const environmentlessIdentifierDimensions = new Set(['environmentid', 'tenantid', 'objectid']);
+function isEnvironmentlessIdentifierDimension(key) {
+    return environmentlessIdentifierDimensions.has(key.toLowerCase());
+}
+function removeEnvironmentlessIdentifierDimensions(eventData) {
+    if (!eventData) {
+        return eventData;
+    }
+    return Object.fromEntries(Object.entries(eventData).filter(([key]) => !isEnvironmentlessIdentifierDimension(key)));
+}
+/**
+ * Returns true if the environment's cluster category is compatible with the region's cluster
+ * category. First Release environments are part of the public production cloud.
+ * If the environment has no cluster category, it is considered a match for all regions.
+ *
+ * This is required to handle the edge case when a command is run against a non-prod environment
+ * without providing the --cloud param.
+ */
+function doesEnvironmentMatchRegion(metadata, region) {
+    const environmentClusterCategory = metadata?.properties.cluster?.category?.toLowerCase();
+    const regionClusterCategory = regionToClusterCategory(region);
+    return (!environmentClusterCategory ||
+        environmentClusterCategory === regionClusterCategory ||
+        (regionClusterCategory === 'prod' && environmentClusterCategory === 'firstrelease'));
+}
 function stringifyErrorWithStack(error) {
     if (!error)
         return undefined;
@@ -99,169 +125,161 @@ function createScenarioLogger(telemetryWriters, name, data) {
 /**
  * Logger implementation for the CLI.
  *
- * Telemetry is **unauthenticated by default**: the OneDS writer is constructed at
- * `create()` time with `telemetryLocation: 'global'` and no `geoLocation`, so events
- * start flowing immediately without any auth dependency. The writer is then upgraded to
- * the EU-aware authed version via one of two paths:
- *
- * - `tryEagerUpgradeAsync` — called from `runVerb` after MSAL is initialized. If a
- *   cached account already exists, the upgrade runs synchronously before the first event
- *   so signed-in users get authed telemetry for the entire session.
- * - `CliHttpClient.onFirstAuth` callback — registered in `create()`, fires (background)
- *   after the verb's first successful authed HTTP call. Handles users who sign in
- *   mid-session via MSAL.
- *
- * Verbs that never make an authed HTTP call and have no cached account stay on the
- * unauthenticated writer for their whole lifetime — events still reach 1DS, just on
- * the global endpoint with no `geoLocation` or `tenantId`.
- *
- * 1DS event submission uses its own ingestion credentials (not the Entra bearer token),
- * so events can be sent regardless of sign-in state.
+ * Remote telemetry is buffered until the command resolves its target environment and region.
+ * Console telemetry is initialized immediately when enabled.
  */
 export class CliLogger {
     _telemetryWriters = [];
-    _unauthWriter;
+    _bufferedWriter;
+    _remoteWriter;
     _customDimensions = {};
-    _upgradeFired = false;
     _sessionId;
-    _upgradeConfig;
-    constructor(telemetryWriters, sessionId) {
+    _origin;
+    _authenticationProvider;
+    _appId;
+    _httpForwardOptions;
+    _telemetryContext;
+    _environmentMetadataPromise;
+    _isRemoteTelemetrySuppressed = false;
+    _isEnvironmentlessTelemetry = false;
+    constructor(telemetryWriters, sessionId, origin, authenticationProvider, appId, httpForwardOptions) {
         this._telemetryWriters = telemetryWriters;
         this._sessionId = sessionId;
+        this._origin = origin;
+        this._authenticationProvider = authenticationProvider;
+        this._appId = appId ?? '';
+        this._httpForwardOptions = httpForwardOptions;
     }
-    static async create(cliSettings, httpClient, authenticationProvider, httpForwardOptions) {
-        const environmentId = cliSettings.appConfig?.environmentId;
-        const region = cloudToRegionSafe(cliSettings.appConfig?.cloud);
-        const appId = cliSettings.appConfig?.appId;
+    static async create(cliSettings, authenticationProvider, httpForwardOptions) {
         const sessionId = randomUUID();
         const telemetryWriters = [];
         const userTelemetrySettings = resolveUserTelemetrySettings();
         if (userTelemetrySettings.console) {
             telemetryWriters.push(new ConsoleWriter(sessionId, cliSettings.origin));
         }
-        const instance = new CliLogger(telemetryWriters, sessionId);
+        const instance = new CliLogger(telemetryWriters, sessionId, cliSettings.origin, authenticationProvider, cliSettings.appConfig?.appId, httpForwardOptions);
         // In mocked-backend mode (E2E) never open a real 1DS/remote telemetry channel: it bypasses
         // the injected mock HttpClient and would attempt live network egress, hanging the CLI on
         // flush at exit. This keeps "mock all backend calls" complete for E2E runs.
         const suppressRemoteTelemetry = getCliEnvVarBool('MOCK_BACKEND');
-        if (userTelemetrySettings.remote && region && environmentId && !suppressRemoteTelemetry) {
-            // Push the unauthenticated writer immediately. Defaults to the global 1DS endpoint
-            // and omits `geoLocation`; if/when auth succeeds, the upgrade swaps in the EU-aware
-            // writer below.
-            const unauth = new OneDSWriter(sessionId, region, 'global', environmentId, appId ?? '', undefined, packageJson.version, cliSettings.origin, httpForwardOptions);
-            instance._unauthWriter = unauth;
-            instance._telemetryWriters.push(unauth);
-            instance._upgradeConfig = {
-                sessionId,
-                region,
-                environmentId,
-                appId,
-                cliSettings,
-                httpForwardOptions,
-            };
-            // Register the lazy upgrade: fires once when the verb makes its first successful
-            // authed HTTP call. By that point we know auth works, so the metadata fetch can't
-            // pop a browser.
-            httpClient.onFirstAuth(() => instance._upgradeToAuthedWriterAsync(authenticationProvider));
+        if (userTelemetrySettings.remote && !suppressRemoteTelemetry) {
+            instance._bufferedWriter = new BufferedTelemetryWriter();
+            instance._telemetryWriters.push(instance._bufferedWriter);
         }
         // Emit the first-party embedding host correlation id (if supplied via
         // MS_CLI_EMBEDDING_HOST_CORRELATION_ID) on every event. It is injected as a default
         // property here and promoted to a dedicated top-level telemetry column
-        // (`embeddingHostCorrelationId`) by the OneDS writer's propertyColumnMap. Set after the
-        // writers exist so it lands on the console + unauth writers immediately and survives the
-        // authed-writer swap (re-applied from `_customDimensions`). The internal per-invocation
-        // `sessionId` is intentionally left untouched.
+        // (`embeddingHostCorrelationId`) by the OneDS writer's propertyColumnMap. Preserve it until
+        // the delayed remote writer is created, while applying it to the console writer immediately.
+        // The internal per-invocation `sessionId` is intentionally left untouched.
         if (cliSettings.embeddingHostCorrelationId) {
             instance.setCustomDimension('embeddingHostCorrelationId', cliSettings.embeddingHostCorrelationId);
         }
         return instance;
     }
-    /**
-     * Eagerly run the upgrade when a cached account already exists at verb-start time,
-     * so even the first telemetry event of the session lands on the authenticated writer.
-     * Called from `ArgumentProvider.runVerb` after `authProvider.initAsync(region)` but
-     * before any event is emitted.
-     *
-     * No-op if no cached account is present (we don't want to block CLI startup on a
-     * network call when the user isn't even signed in), or if the upgrade has already
-     * fired. For not-signed-in users the lazy `onFirstAuth` path still handles things
-     * later if the verb itself triggers a sign-in.
-     *
-     * Cost: ~100-500ms for signed-in users — the time `getEnvironmentByName` takes.
-     * Signed-in-but-offline users will block on the default fetch timeout before
-     * falling through; events still flow to the unauthenticated writer in that case.
-     */
-    async tryEagerUpgradeAsync(authenticationProvider) {
-        if (this._upgradeFired || !this._upgradeConfig) {
-            return;
+    setCustomDimension(_key, _value) {
+        try {
+            if (!_key || !_value) {
+                return;
+            }
+            if (this._isEnvironmentlessTelemetry && isEnvironmentlessIdentifierDimension(_key)) {
+                return;
+            }
+            this._customDimensions[_key] = _value;
+            this._telemetryWriters.forEach((writer) => {
+                writer.setCustomDimension(_key, _value);
+            });
         }
-        if (await authenticationProvider.getCachedAccountAsync()) {
-            await this._upgradeToAuthedWriterAsync(authenticationProvider);
+        catch {
+            // No-op. Telemetry failures should not block CLI operations
         }
     }
     /**
-     * Replaces the unauthenticated OneDS writer with an EU-aware authed one. Called from
-     * two paths:
-     * - `tryEagerUpgradeAsync` (blocking, before the first event) when a cached account
-     *   is already present at verb-start time.
-     * - `CliHttpClient.onFirstAuth` (fire-and-forget) after the verb's first successful
-     *   authed HTTP call, when the user signed in mid-session.
-     * Best-effort — on any failure the unauthenticated writer stays in place and events
-     * keep flowing to the global endpoint.
+     * Records the command's resolved routing context and activates the remote writer once the
+     * environment metadata is available.
      */
-    async _upgradeToAuthedWriterAsync(authenticationProvider) {
-        if (this._upgradeFired || !this._upgradeConfig || !this._unauthWriter) {
+    async setTelemetryContext(context) {
+        if (!this._telemetryContext) {
+            this._telemetryContext = context;
+        }
+        else if (!this._telemetryContext.environmentId && context.environmentId) {
+            // The initial region is authoritative. Environment resolution may happen later.
+            this._telemetryContext = {
+                ...this._telemetryContext,
+                environmentId: context.environmentId,
+            };
+        }
+        else {
+            // Context already complete; avoid redundant metadata lookups.
             return;
         }
-        this._upgradeFired = true;
-        const { sessionId, region, environmentId, appId, cliSettings, httpForwardOptions } = this._upgradeConfig;
-        try {
-            const metadata = await getEnvironmentByName(environmentId);
-            let telemetryLocation = 'global';
-            if (metadata?.properties?.location && EUGeoRegions.has(metadata.properties.location)) {
-                telemetryLocation = 'eu';
-            }
-            const authed = new OneDSWriter(sessionId, region, telemetryLocation, environmentId, appId ?? '', metadata?.properties?.cluster?.geoShortName, packageJson.version, cliSettings.origin, httpForwardOptions);
-            // Replace the unauth writer in place. Pre-upgrade events have already been
-            // dispatched to the unauth writer's channel; we don't re-send them.
-            const idx = this._telemetryWriters.indexOf(this._unauthWriter);
-            if (idx >= 0) {
-                this._telemetryWriters[idx] = authed;
-            }
-            else {
-                this._telemetryWriters.push(authed);
-            }
-            this._unauthWriter = authed;
-            // Re-apply previously set dimensions to the replacement writer.
-            for (const [key, value] of Object.entries(this._customDimensions)) {
-                authed.setCustomDimension(key, value);
-            }
-            // Set the tenantId dimension AFTER the swap so it lands on the authed writer
-            // (and any ConsoleWriter that's still in the list), not the discarded unauth one.
-            const tenantId = authenticationProvider.getUserTenantId();
-            if (tenantId) {
-                this.setCustomDimension('tenantId', tenantId);
+        if (this._telemetryContext.environmentId) {
+            const metadata = await this._getEnvironmentMetadataAsync(this._telemetryContext.environmentId, this._telemetryContext.region);
+            await this._activateRemoteWriter(metadata);
+        }
+    }
+    async _getEnvironmentMetadataAsync(environmentId, region) {
+        this._environmentMetadataPromise ??= getEnvironmentByName(environmentId)
+            .then((metadata) => {
+            if (!metadata.location || !doesEnvironmentMatchRegion(metadata, region)) {
+                this._isRemoteTelemetrySuppressed = true;
+                return undefined;
             }
+            return metadata;
+        })
+            .catch(() => {
+            this._isRemoteTelemetrySuppressed = true;
+            return undefined;
+        });
+        return this._environmentMetadataPromise;
+    }
+    async _activateRemoteWriter(environmentMetadata) {
+        if (!this._bufferedWriter ||
+            !this._telemetryContext?.environmentId ||
+            !environmentMetadata ||
+            !environmentMetadata.location ||
+            this._isRemoteTelemetrySuppressed) {
+            // Keep unresolved or mismatched-environment events buffered for CLI teardown to persist.
+            return;
         }
-        catch {
-            // Best-effort. Unauth writer stays in place; subsequent events keep going to global.
+        const telemetryLocation = EUGeoRegions.has(environmentMetadata.location) ? 'eu' : 'global';
+        this._createRemoteWriterAndReplay(this._telemetryContext.region, telemetryLocation, this._telemetryContext.environmentId, environmentMetadata.properties.cluster?.geoShortName);
+    }
+    _activateEnvironmentlessRemoteWriter() {
+        if (!this._bufferedWriter || this._telemetryContext?.environmentId) {
+            return;
         }
+        this._isEnvironmentlessTelemetry = true;
+        this._createRemoteWriterAndReplay(this._telemetryContext?.region ?? 'prod', 'global', undefined, undefined);
     }
-    setCustomDimension(_key, _value) {
+    _createRemoteWriterAndReplay(region, telemetryLocation, environmentId, geoLocation) {
+        if (!this._bufferedWriter || this._remoteWriter) {
+            return;
+        }
         try {
-            if (!_key || !_value) {
-                return;
+            const remoteWriter = new OneDSWriter(this._sessionId, region, telemetryLocation, environmentId, this._appId, geoLocation, packageJson.version, this._origin, this._httpForwardOptions);
+            this._remoteWriter = remoteWriter;
+            for (const [key, value] of Object.entries(this._customDimensions)) {
+                if (!this._isEnvironmentlessTelemetry || !isEnvironmentlessIdentifierDimension(key)) {
+                    remoteWriter.setCustomDimension(key, value);
+                }
             }
-            // not guarding on _upgradeFired to preserve dimensions set before the swap is complete
-            this._customDimensions[_key] = _value;
-            this._telemetryWriters.forEach((writer) => {
-                writer.setCustomDimension(_key, _value);
-            });
+            if (!this._isEnvironmentlessTelemetry) {
+                const tenantId = this._authenticationProvider.getUserTenantId();
+                if (tenantId) {
+                    remoteWriter.setCustomDimension('tenantId', tenantId);
+                }
+            }
+            this._bufferedWriter.replay(remoteWriter, this._isEnvironmentlessTelemetry ? removeEnvironmentlessIdentifierDimensions : undefined);
+            this._telemetryWriters.push(remoteWriter);
         }
         catch {
-            // No-op. Telemetry failures should not block CLI operations
+            // Keep the buffer intact; CLI teardown persists it after the command session ends.
         }
     }
+    writeBufferedTelemetryToFile(directory) {
+        return this._bufferedWriter?.writeToTemporaryFile(directory);
+    }
     trackActivityEvent(eventName, eventData) {
         try {
             if (this._telemetryWriters.length === 0) {
@@ -319,8 +337,19 @@ export class CliLogger {
     set sessionId(_value) {
         // No-op
     }
-    flush() {
-        return Promise.all(this._telemetryWriters.map((writer) => writer.flush())).then(() => undefined);
+    async flush(retainBufferedTelemetry = false) {
+        if (this._environmentMetadataPromise) {
+            // Ensure any in-flight metadata lookup can activate and replay buffered remote telemetry.
+            const metadata = await this._environmentMetadataPromise;
+            await this._activateRemoteWriter(metadata);
+        }
+        else {
+            this._activateEnvironmentlessRemoteWriter();
+        }
+        await Promise.all(this._telemetryWriters.map((writer) => writer.flush()));
+        if (this._remoteWriter && !retainBufferedTelemetry) {
+            this._bufferedWriter?.clear();
+        }
     }
     withDefaults(_extras) {
         // No-op — CLI logger does not implement local scope defaults today.