@nanonets/graft 0.10.0 → 0.12.0

package/dist/telemetry/contract.js

@@ -0,0 +1,203 @@
+/**
+ * The telemetry contract: the complete, machine-enforced list of what graft may
+ * send. `TELEMETRY.md` is the same list in prose, and the two are kept in
+ * lockstep — an event or property that is not in this file cannot be sent, and
+ * one that is not in `TELEMETRY.md` must not be added here.
+ *
+ * Why an allowlist rather than a review rule: every telemetry incident in the
+ * tools we studied came from a call site quietly adding a property nobody
+ * audited. `track()` (track.ts) drops unknown events and unknown keys instead of
+ * trusting its callers, so a future `track('query', { path })` sends `query`
+ * with no `path` rather than leaking one. The blast radius of a careless call
+ * site is "we lose a metric", never "we received someone's source tree".
+ *
+ * The other half of that guarantee is the value side: every number crosses as a
+ * BUCKET and every string as a member of a fixed union. A raw file count plus a
+ * language set starts to fingerprint a specific repo; `"100-500"` does not. A
+ * raw error message is a path, a symbol, and sometimes a snippet of code; an
+ * enum member is not.
+ *
+ * This module is pure — no I/O, no config, no clock. It is the file a reviewer
+ * (or a suspicious user, since the repo is public) reads to verify the claim.
+ */
+/* -------------------------------------------------------------------------- */
+/* the event → allowed-property-keys map                                      */
+/* -------------------------------------------------------------------------- */
+/**
+ * The contract itself. Common properties (see {@link COMMON_KEYS}) are stamped
+ * centrally by `track()` and are deliberately not repeated per event.
+ */
+export const EVENTS = {
+    /** Once per machine, when the install id is first minted. The denominator. */
+    first_run: new Set(),
+    /** `graft init` completed. Tells us which agents people actually wire, and
+     *  how many decline telemetry at the picker. */
+    init_completed: new Set(['agents', 'consent']),
+    /** A build finished. The activation event — an install that never reaches one
+     *  of these is the funnel leak we most want to see. */
+    build_completed: new Set(['files_bucket', 'langs', 'mode', 'duration_bucket', 'incremental']),
+    /** A build threw. `stage`/`code` are enums; the message never travels. */
+    build_failed: new Set(['stage', 'code']),
+    /** One query, from any surface. The DAU backbone and the dead-command detector. */
+    query: new Set(['command', 'surface', 'hit']),
+    /** One closed agent session, summarised. `graft_reads` vs `source_reads` is
+     *  the single number that says whether an agent prefers graft to grep. */
+    session_summary: new Set(['graft_reads_bucket', 'source_reads_bucket', 'saved_tokens_bucket']),
+};
+/** Stamped on every event by `track()`; not listed per event above. */
+export const COMMON_KEYS = [
+    'app_version',
+    'os',
+    'arch',
+    'node_major',
+    'ci',
+    'agent_host',
+    'repo_id',
+];
+/**
+ * The commands worth counting. A command absent here is simply not reported —
+ * `track()` drops the event rather than sending a free-form string, which is
+ * what keeps a future `graft <something-user-named>` from becoming a data leak.
+ */
+export const TRACKED_COMMANDS = [
+    'ask', 'grep', 'callers', 'skeleton', 'map', 'check', 'blast', 'viz',
+];
+export function isTrackedCommand(name) {
+    return TRACKED_COMMANDS.includes(name);
+}
+/** Where a failing build died. Coarse on purpose: enough to route a bug, not
+ *  enough to describe anyone's repo. */
+export const BUILD_STAGES = ['walk', 'extract', 'graph', 'summarize', 'synthesize', 'write'];
+/**
+ * The failure taxonomy. Anything unrecognised becomes `E_UNKNOWN` — the point of
+ * a closed set is that an unclassified error contributes a count and nothing
+ * else, so no message text can ride along inside a "code".
+ */
+export const ERROR_CODES = [
+    'E_UNKNOWN', 'E_PARSE', 'E_TIMEOUT', 'E_LLM', 'E_AUTH', 'E_RATE_LIMIT',
+    'E_NETWORK', 'E_DISK', 'E_PERMISSION', 'E_OOM', 'E_LOCK',
+];
+/**
+ * Map a thrown value to a code without letting its text through. Only fixed
+ * substrings are matched, and only a member of {@link ERROR_CODES} is returned —
+ * the error's own message is never the return value, not even in part.
+ */
+export function errorCode(err) {
+    const code = err?.code;
+    if (typeof code === 'string') {
+        if (code === 'ENOSPC' || code === 'EDQUOT')
+            return 'E_DISK';
+        if (code === 'EACCES' || code === 'EPERM')
+            return 'E_PERMISSION';
+        if (code === 'ENOMEM')
+            return 'E_OOM';
+        if (code === 'ETIMEDOUT' || code === 'ESOCKETTIMEDOUT')
+            return 'E_TIMEOUT';
+        if (code === 'ENOTFOUND' || code === 'ECONNREFUSED' || code === 'ECONNRESET')
+            return 'E_NETWORK';
+    }
+    const status = err?.status;
+    if (typeof status === 'number') {
+        if (status === 401 || status === 403)
+            return 'E_AUTH';
+        if (status === 429)
+            return 'E_RATE_LIMIT';
+        if (status >= 500)
+            return 'E_LLM';
+    }
+    const msg = err instanceof Error ? err.message.toLowerCase() : '';
+    if (msg.includes('timeout') || msg.includes('timed out'))
+        return 'E_TIMEOUT';
+    if (msg.includes('parse') || msg.includes('syntax'))
+        return 'E_PARSE';
+    if (msg.includes('lock'))
+        return 'E_LOCK';
+    return 'E_UNKNOWN';
+}
+/* -------------------------------------------------------------------------- */
+/* buckets — every number crosses the wire as a label                         */
+/* -------------------------------------------------------------------------- */
+/** Repo scale. Exact counts fingerprint a repo; these five labels answer the
+ *  only question we have ("toy, service, or monorepo?"). */
+export function filesBucket(n) {
+    if (n <= 0)
+        return '0';
+    if (n < 50)
+        return '1-49';
+    if (n < 200)
+        return '50-199';
+    if (n < 1000)
+        return '200-999';
+    if (n < 5000)
+        return '1000-4999';
+    return '5000+';
+}
+/** Wall-clock for a build. Coarse enough that it says "fast/slow", not "this
+ *  exact machine on this exact tree". */
+export function durationBucket(ms) {
+    const s = ms / 1000;
+    if (s < 1)
+        return '<1s';
+    if (s < 5)
+        return '1-5s';
+    if (s < 30)
+        return '5-30s';
+    if (s < 120)
+        return '30s-2m';
+    if (s < 600)
+        return '2-10m';
+    return '10m+';
+}
+/** Generic small-count bucket, for the per-session read counters. */
+export function countBucket(n) {
+    if (n <= 0)
+        return '0';
+    if (n < 5)
+        return '1-4';
+    if (n < 20)
+        return '5-19';
+    if (n < 50)
+        return '20-49';
+    if (n < 200)
+        return '50-199';
+    return '200+';
+}
+/** Estimated tokens saved in one session — the README's central claim, in the
+ *  only resolution we need to defend it. */
+export function savedTokensBucket(n) {
+    if (n <= 0)
+        return '0';
+    if (n < 1000)
+        return '<1k';
+    if (n < 5000)
+        return '1-5k';
+    if (n < 20000)
+        return '5-20k';
+    if (n < 100000)
+        return '20-100k';
+    return '100k+';
+}
+/**
+ * Languages, normalised, filtered to a safe shape, and capped.
+ *
+ * Sorted so `["go","ts"]` and `["ts","go"]` aggregate as one value, deduped, and
+ * cut to eight — a repo with a very long tail of languages is itself a
+ * distinguishing fact, and the tail answers no question we have.
+ *
+ * The character filter is the part that matters. This is the only property in
+ * the contract that is not drawn from a closed set defined in this file: the
+ * values come from the parser registry, several modules away, via
+ * `languageLabelOf() ?? container.name ?? generic.name ?? "unknown"`. That is
+ * safe today, but it means the no-free-text guarantee would rest on a promise
+ * made elsewhere — and a future generic extractor naming itself after the
+ * extension it matched would quietly turn this into a channel for file
+ * metadata. Anything outside `[a-z0-9+#._-]`, or longer than 24 characters, is
+ * therefore dropped here rather than trusted.
+ */
+export function langsValue(langs) {
+    const clean = langs
+        .map((l) => l.toLowerCase().trim())
+        .filter((l) => l.length > 0 && l.length <= 24 && /^[a-z0-9+#._-]+$/.test(l));
+    return [...new Set(clean)].sort().slice(0, 8).join(',');
+}
+//# sourceMappingURL=contract.js.map

package/dist/telemetry/contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../src/telemetry/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,MAAM,GAAwC;IACzD,8EAA8E;IAC9E,SAAS,EAAE,IAAI,GAAG,EAAU;IAC5B;oDACgD;IAChD,cAAc,EAAE,IAAI,GAAG,CAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACtD;2DACuD;IACvD,eAAe,EAAE,IAAI,GAAG,CAAS,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;IACrG,0EAA0E;IAC1E,YAAY,EAAE,IAAI,GAAG,CAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAChD,mFAAmF;IACnF,KAAK,EAAE,IAAI,GAAG,CAAS,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACrD;8EAC0E;IAC1E,eAAe,EAAE,IAAI,GAAG,CAAS,CAAC,oBAAoB,EAAE,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;CACvG,CAAC;AAEF,uEAAuE;AACvE,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,aAAa;IACb,IAAI;IACJ,MAAM;IACN,YAAY;IACZ,IAAI;IACJ,YAAY;IACZ,SAAS;CACD,CAAC;AAcX;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK;CAC5D,CAAC;AAGX,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED;wCACwC;AACxC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,CAAU,CAAC;AAGtG;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc;IACtE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ;CAChD,CAAC;AAGX;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAC;IACtD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC5D,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,cAAc,CAAC;QACjE,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC;QACtC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,iBAAiB;YAAE,OAAO,WAAW,CAAC;QAC3E,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,YAAY;YAAE,OAAO,WAAW,CAAC;IACnG,CAAC;IACD,MAAM,MAAM,GAAI,GAAmC,EAAE,MAAM,CAAC;IAC5D,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,QAAQ,CAAC;QACtD,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,cAAc,CAAC;QAC1C,IAAI,MAAM,IAAI,GAAG;YAAE,OAAO,OAAO,CAAC;IACpC,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IAC7E,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF;4DAC4D;AAC5D,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IACvB,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,CAAC,GAAG,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC7B,IAAI,CAAC,GAAG,IAAI;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC,GAAG,IAAI;QAAE,OAAO,WAAW,CAAC;IACjC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;yCACyC;AACzC,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACpB,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,OAAO,CAAC;IAC3B,IAAI,CAAC,GAAG,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC7B,IAAI,CAAC,GAAG,GAAG;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IACvB,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,OAAO,CAAC;IAC3B,IAAI,CAAC,GAAG,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC7B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;4CAC4C;AAC5C,MAAM,UAAU,iBAAiB,CAAC,CAAS;IACzC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IACvB,IAAI,CAAC,GAAG,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,CAAC,GAAG,IAAI;QAAE,OAAO,MAAM,CAAC;IAC5B,IAAI,CAAC,GAAG,KAAK;QAAE,OAAO,OAAO,CAAC;IAC9B,IAAI,CAAC,GAAG,MAAM;QAAE,OAAO,SAAS,CAAC;IACjC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,UAAU,CAAC,KAAwB;IACjD,MAAM,KAAK,GAAG,KAAK;SAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC"}

package/dist/telemetry/flush.d.ts

@@ -0,0 +1,21 @@
+import { type SendResult } from './send.js';
+/** Matches `UPDATE_TTL_MS`: a day is the natural period for both. */
+export declare const FLUSH_TTL_MS: number;
+export declare function needsFlush(flushedAt: number | undefined, now?: number): boolean;
+/**
+ * Spawn the flush if the queue has something in it and a day has passed. Returns
+ * whether a child was started, for tests. Never waits, never throws.
+ */
+export declare function maybeFlushInBackground(home?: string, now?: number): boolean;
+/**
+ * Whether a failed send is worth keeping the batch for.
+ *
+ * A 5xx or a transport failure is ours to retry — a week offline should not be
+ * a week of lost events. A 4xx is not: a bad key or a malformed batch will fail
+ * identically forever, and retrying it would pin the queue at its cap until it
+ * starts dropping the events that WOULD have sent.
+ */
+export declare function shouldRequeue(res: SendResult): boolean;
+/** The `graft _telemetry-flush` body, running in the detached child. */
+export declare function runFlush(home?: string): Promise<void>;
+//# sourceMappingURL=flush.d.ts.map

package/dist/telemetry/flush.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flush.d.ts","sourceRoot":"","sources":["../../src/telemetry/flush.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAGvD,qEAAqE;AACrE,eAAO,MAAM,YAAY,QAAsB,CAAC;AAMhD,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,SAAa,GAAG,OAAO,CAEnF;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,OAAO,CAe/E;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAGtD;AAED,wEAAwE;AACxE,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3D"}

package/dist/telemetry/flush.js

@@ -0,0 +1,84 @@
+/**
+ * Getting the queue off the machine without any command ever waiting for it.
+ *
+ * Deliberately the same shape as `maybeRefreshInBackground` in `upkeep.ts`,
+ * which has been doing this for the npm registry check since 0.7: check a
+ * timestamp, write the timestamp BEFORE spawning so a child that dies cannot
+ * make every subsequent command spawn another one, then `spawn` detached and
+ * `unref`. The parent returns immediately and never learns the outcome.
+ *
+ * Once a day, not once a command. Events are cheap to hold and the questions we
+ * are asking ("how many repos activated this week") do not get better answers
+ * from lower latency.
+ */
+import { spawn } from 'node:child_process';
+import { statSync } from 'node:fs';
+import { graftCliPath } from '../claude/paths.js';
+import { drain, queuePath, requeue } from './queue.js';
+import { patchState, readState } from './identity.js';
+import { sendBatch } from './send.js';
+import { telemetryOn } from './gate.js';
+/** Matches `UPDATE_TTL_MS`: a day is the natural period for both. */
+export const FLUSH_TTL_MS = 24 * 60 * 60 * 1000;
+function queueHasEvents(home) {
+    try {
+        return statSync(queuePath(home)).size > 0;
+    }
+    catch {
+        return false;
+    }
+}
+export function needsFlush(flushedAt, now = Date.now()) {
+    return typeof flushedAt !== 'number' || now - flushedAt >= FLUSH_TTL_MS;
+}
+/**
+ * Spawn the flush if the queue has something in it and a day has passed. Returns
+ * whether a child was started, for tests. Never waits, never throws.
+ */
+export function maybeFlushInBackground(home, now = Date.now()) {
+    try {
+        if (!telemetryOn(home))
+            return false;
+        if (!queueHasEvents(home))
+            return false;
+        if (!needsFlush(readState(home)?.flushedAt, now))
+            return false;
+        patchState({ flushedAt: now }, home); // before the spawn, so a dying child costs one attempt
+        const child = spawn(process.execPath, [graftCliPath(), '_telemetry-flush'], {
+            detached: true,
+            stdio: 'ignore',
+        });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false; // no spawn available (sandbox, ENOMEM) — try again tomorrow
+    }
+}
+/**
+ * Whether a failed send is worth keeping the batch for.
+ *
+ * A 5xx or a transport failure is ours to retry — a week offline should not be
+ * a week of lost events. A 4xx is not: a bad key or a malformed batch will fail
+ * identically forever, and retrying it would pin the queue at its cap until it
+ * starts dropping the events that WOULD have sent.
+ */
+export function shouldRequeue(res) {
+    if (res.ok)
+        return false;
+    return res.status === undefined || res.status >= 500;
+}
+/** The `graft _telemetry-flush` body, running in the detached child. */
+export async function runFlush(home) {
+    try {
+        if (!telemetryOn(home))
+            return;
+        const events = drain(home);
+        if (events.length === 0)
+            return;
+        if (shouldRequeue(await sendBatch(events)))
+            requeue(events, home);
+    }
+    catch { /* a failed flush is a non-event by design */ }
+}
+//# sourceMappingURL=flush.js.map

package/dist/telemetry/flush.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flush.js","sourceRoot":"","sources":["../../src/telemetry/flush.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,SAAS,EAAmB,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,qEAAqE;AACrE,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD,SAAS,cAAc,CAAC,IAAa;IACnC,IAAI,CAAC;QAAC,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAA6B,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACxE,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,GAAG,GAAG,SAAS,IAAI,YAAY,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAa,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACpE,IAAI,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/D,UAAU,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,uDAAuD;QAC7F,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,EAAE,kBAAkB,CAAC,EAAE;YAC1E,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,4DAA4D;IAC5E,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,GAAe;IAC3C,IAAI,GAAG,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC;AACvD,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAa;IAC1C,IAAI,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YAAE,OAAO;QAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAChC,IAAI,aAAa,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC,CAAC,6CAA6C,CAAC,CAAC;AAC3D,CAAC"}

package/dist/telemetry/gate.d.ts

@@ -0,0 +1,16 @@
+export type OffReason = 'no-key' | 'do-not-track' | 'ci' | 'disabled';
+/** The `DO_NOT_TRACK` convention: set and not `0`/empty means "off". */
+export declare function doNotTrack(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * CI detection. `CI` covers essentially every provider; the rest are the ones
+ * that historically did not set it. Deliberately generous — a false positive
+ * costs one uncounted user, a false negative pollutes the dataset.
+ */
+export declare function inCi(env?: NodeJS.ProcessEnv): boolean;
+/** Null when telemetry may run, otherwise the first gate that closed. */
+export declare function offReason(home?: string, env?: NodeJS.ProcessEnv): OffReason | null;
+export declare function telemetryOn(home?: string, env?: NodeJS.ProcessEnv): boolean;
+/** One line for `graft telemetry status`, naming the gate that is closed so a
+ *  user who thinks they disabled it can see which switch actually took. */
+export declare function explainOff(reason: OffReason): string;
+//# sourceMappingURL=gate.d.ts.map

package/dist/telemetry/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/telemetry/gate.ts"],"names":[],"mappings":"AAuBA,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,cAAc,GAAG,IAAI,GAAG,UAAU,CAAC;AAEtE,wEAAwE;AACxE,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAGxE;AAED;;;;GAIG;AACH,wBAAgB,IAAI,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAMlE;AAED,yEAAyE;AACzE,wBAAgB,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,GAAG,IAAI,CAM/F;AAED,wBAAgB,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAExF;AAED;2EAC2E;AAC3E,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAOpD"}

package/dist/telemetry/gate.js

@@ -0,0 +1,64 @@
+/**
+ * The single "may we send?" predicate, checked before every append and again
+ * before every send.
+ *
+ * Four independent gates, in the order a user would expect them to win:
+ *
+ *   1. A key at all — dev builds and forks have none (see key.ts), so the whole
+ *      subsystem is inert for anyone who did not install a published graft.
+ *   2. `DO_NOT_TRACK` — the cross-tool convention (consoledonottrack.com).
+ *      Honoured unconditionally: it outranks our own setting, because a user who
+ *      set it machine-wide has already answered the question for every tool.
+ *   3. CI — a build server is not a user. Counting it would inflate every number
+ *      we care about and tell us nothing about a person.
+ *   4. The user's own choice, from the `graft init` picker or
+ *      `graft telemetry disable`. Default on when never set.
+ *
+ * Re-checked at every append rather than cached at boot, so `graft telemetry
+ * disable` in one terminal takes effect in a long-lived MCP server in another
+ * without a restart.
+ */
+import { posthogKey } from './key.js';
+import { readState } from './identity.js';
+/** The `DO_NOT_TRACK` convention: set and not `0`/empty means "off". */
+export function doNotTrack(env = process.env) {
+    const v = env.DO_NOT_TRACK;
+    return v !== undefined && v !== '' && v !== '0';
+}
+/**
+ * CI detection. `CI` covers essentially every provider; the rest are the ones
+ * that historically did not set it. Deliberately generous — a false positive
+ * costs one uncounted user, a false negative pollutes the dataset.
+ */
+export function inCi(env = process.env) {
+    if (env.CI !== undefined && env.CI !== '' && env.CI !== '0' && env.CI !== 'false')
+        return true;
+    return Boolean(env.GITHUB_ACTIONS || env.GITLAB_CI || env.BUILDKITE || env.CIRCLECI ||
+        env.TEAMCITY_VERSION || env.JENKINS_URL || env.TF_BUILD || env.BUILD_NUMBER);
+}
+/** Null when telemetry may run, otherwise the first gate that closed. */
+export function offReason(home, env = process.env) {
+    if (!posthogKey())
+        return 'no-key';
+    if (doNotTrack(env))
+        return 'do-not-track';
+    if (inCi(env))
+        return 'ci';
+    if (readState(home)?.enabled === false)
+        return 'disabled';
+    return null;
+}
+export function telemetryOn(home, env = process.env) {
+    return offReason(home, env) === null;
+}
+/** One line for `graft telemetry status`, naming the gate that is closed so a
+ *  user who thinks they disabled it can see which switch actually took. */
+export function explainOff(reason) {
+    switch (reason) {
+        case 'no-key': return 'off — this build has no telemetry key (a fork, or a local `npm run build`); nothing can be sent';
+        case 'do-not-track': return 'off — DO_NOT_TRACK is set in this environment';
+        case 'ci': return 'off — this looks like CI';
+        case 'disabled': return 'off — you disabled it (`graft telemetry enable` to turn it back on)';
+    }
+}
+//# sourceMappingURL=gate.js.map

package/dist/telemetry/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/telemetry/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAI1C,wEAAwE;AACxE,MAAM,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7D,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC;IAC3B,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,IAAI,CAAC,MAAyB,OAAO,CAAC,GAAG;IACvD,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC/F,OAAO,OAAO,CACZ,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ;QACpE,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY,CAC5E,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,SAAS,CAAC,IAAa,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC3E,IAAI,CAAC,UAAU,EAAE;QAAE,OAAO,QAAQ,CAAC;IACnC,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,cAAc,CAAC;IAC3C,IAAI,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,UAAU,CAAC;IAC1D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAa,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC7E,OAAO,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,IAAI,CAAC;AACvC,CAAC;AAED;2EAC2E;AAC3E,MAAM,UAAU,UAAU,CAAC,MAAiB;IAC1C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC,CAAQ,OAAO,iGAAiG,CAAC;QAC/H,KAAK,cAAc,CAAC,CAAE,OAAO,+CAA+C,CAAC;QAC7E,KAAK,IAAI,CAAC,CAAY,OAAO,0BAA0B,CAAC;QACxD,KAAK,UAAU,CAAC,CAAM,OAAO,qEAAqE,CAAC;IACrG,CAAC;AACH,CAAC"}

package/dist/telemetry/identity.d.ts

@@ -0,0 +1,33 @@
+/** Machine-global telemetry state. Shares `~/.graft/` with `update-check.json`. */
+export interface TelemetryState {
+    installId: string;
+    /** The user's choice. Absent means "never chosen" → the default (on) applies. */
+    enabled?: boolean;
+    /** ISO stamp of the one-time first-run notice, so it prints exactly once. */
+    noticeShownAt?: string;
+    /** Epoch ms of the last flush ATTEMPT, mirroring `UpdateCache.checkedAt`. */
+    flushedAt?: number;
+}
+export declare function statePath(home?: string): string;
+export declare function readState(home?: string): TelemetryState | null;
+/** Read-modify-write. Not atomic across processes; a lost update costs at most a
+ *  duplicated notice or an extra flush attempt, never corruption. */
+export declare function patchState(patch: Partial<TelemetryState>, home?: string): TelemetryState;
+export interface Install {
+    id: string;
+    /** True when this call minted the id, i.e. this is the machine's first run. */
+    firstRun: boolean;
+}
+/** The install id, minted on first call. */
+export declare function installId(home?: string): Install;
+/**
+ * The repo id, in `graft/.cache/` rather than `.graft/config.json`.
+ *
+ * `.graft/config.json` would have been the tidier home, but writing it runs
+ * `ensureBuildConfigIgnored`, which appends to the repo's `.gitignore`. Minting
+ * an id during a read-only `graft ask` must not modify a file the user has
+ * committed. `graft/.cache/` is already derived, already git-ignored, and
+ * already where every other per-repo sidecar lives.
+ */
+export declare function repoId(repo: string): string;
+//# sourceMappingURL=identity.d.ts.map

package/dist/telemetry/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/telemetry/identity.ts"],"names":[],"mappings":"AA0BA,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,SAAS,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE1D;AAED,wBAAgB,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAE9D;AAED;qEACqE;AACrE,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,cAAc,CAIxF;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,+EAA+E;IAC/E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,4CAA4C;AAC5C,wBAAgB,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAahD;AAED;;;;;;;;GAQG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO3C"}

package/dist/telemetry/identity.js

@@ -0,0 +1,80 @@
+/**
+ * The two identifiers, and why neither of them identifies anyone.
+ *
+ *   • install id — one per machine, in `~/.graft/telemetry.json`, beside the
+ *     update-check cache that already lives there. Lets us count people rather
+ *     than events, so a dev running forty queries is one user and not forty.
+ *   • repo id — one per checkout, in `graft/.cache/`. Activation and retention
+ *     for graft are per-repo facts ("did this repo ever get past build?"), and
+ *     the install id alone cannot express them.
+ *
+ * Both are `randomUUID()`. Not a machine id, not a hash of the git remote, not
+ * derived from anything real — a coin flip, written down. A hash would at least
+ * be guessable by us (we could hash a public repo URL and look for it); a random
+ * UUID cannot be reversed or confirmed even in principle. Deleting `~/.graft/`
+ * or `graft/` deletes them, and the user simply looks like someone new.
+ *
+ * Every function here is fail-soft: an unwritable home is a very common state
+ * (a locked-down CI image, a read-only container) and it must cost the caller
+ * nothing. A failed persist yields an ephemeral id for this process — still
+ * anonymous, just not stable — and never a throw.
+ */
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { cacheDir, readJson, writeJsonAtomic } from '../util/state.js';
+export function statePath(home = homedir()) {
+    return join(home, '.graft', 'telemetry.json');
+}
+export function readState(home) {
+    return readJson(statePath(home));
+}
+/** Read-modify-write. Not atomic across processes; a lost update costs at most a
+ *  duplicated notice or an extra flush attempt, never corruption. */
+export function patchState(patch, home) {
+    const next = { ...(readState(home) ?? { installId: randomUUID() }), ...patch };
+    try {
+        writeJsonAtomic(statePath(home), next);
+    }
+    catch { /* unwritable home — in-memory only */ }
+    return next;
+}
+/** The install id, minted on first call. */
+export function installId(home) {
+    const existing = readState(home);
+    if (existing?.installId)
+        return { id: existing.installId, firstRun: false };
+    const id = randomUUID();
+    try {
+        writeJsonAtomic(statePath(home), { ...(existing ?? {}), installId: id });
+        return { id, firstRun: true };
+    }
+    catch {
+        // Unwritable home: use the id for this process rather than failing closed.
+        // Reported as firstRun:false so a machine that can never persist doesn't
+        // send a first_run event on every single command.
+        return { id, firstRun: false };
+    }
+}
+/**
+ * The repo id, in `graft/.cache/` rather than `.graft/config.json`.
+ *
+ * `.graft/config.json` would have been the tidier home, but writing it runs
+ * `ensureBuildConfigIgnored`, which appends to the repo's `.gitignore`. Minting
+ * an id during a read-only `graft ask` must not modify a file the user has
+ * committed. `graft/.cache/` is already derived, already git-ignored, and
+ * already where every other per-repo sidecar lives.
+ */
+export function repoId(repo) {
+    const path = join(cacheDir(repo), 'telemetry-repo-id.json');
+    const existing = readJson(path);
+    if (existing?.repoId)
+        return existing.repoId;
+    const id = randomUUID();
+    try {
+        writeJsonAtomic(path, { repoId: id });
+    }
+    catch { /* unwritable — ephemeral */ }
+    return id;
+}
+//# sourceMappingURL=identity.js.map

package/dist/telemetry/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/telemetry/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAavE,MAAM,UAAU,SAAS,CAAC,OAAe,OAAO,EAAE;IAChD,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAa;IACrC,OAAO,QAAQ,CAAiB,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;qEACqE;AACrE,MAAM,UAAU,UAAU,CAAC,KAA8B,EAAE,IAAa;IACtE,MAAM,IAAI,GAAmB,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC;IAC/F,IAAI,CAAC;QAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,sCAAsC,CAAC,CAAC;IAChG,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,4CAA4C;AAC5C,MAAM,UAAU,SAAS,CAAC,IAAa;IACrC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,QAAQ,EAAE,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC5E,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAA2B,CAAC,CAAC;QAClG,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,yEAAyE;QACzE,kDAAkD;QAClD,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAsB,IAAI,CAAC,CAAC;IACrD,IAAI,QAAQ,EAAE,MAAM;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,IAAI,CAAC;QAAC,eAAe,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,4BAA4B,CAAC,CAAC;IACrF,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/telemetry/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Anonymous adoption telemetry. `TELEMETRY.md` is the public contract;
+ * `contract.ts` is the same list enforced in code.
+ *
+ * The whole subsystem is inert unless four things are true at once: the build
+ * carries a key (published releases only), `DO_NOT_TRACK` is unset, this is not
+ * CI, and the user has not disabled it. See `gate.ts`.
+ */
+export { EVENTS, COMMON_KEYS, isTrackedCommand, errorCode, filesBucket, durationBucket, countBucket, savedTokensBucket, langsValue } from './contract.js';
+export type { AgentHost, Surface, TrackedCommand, BuildStage, ErrorCode } from './contract.js';
+export { track, trackFirstRunIfNew, detectHost } from './track.js';
+export type { QueuedEvent, TrackContext } from './track.js';
+export { telemetryOn, offReason, explainOff } from './gate.js';
+export { maybeFlushInBackground, runFlush } from './flush.js';
+export { firstRunNotice, formatStatus, formatDebug, NOTICE, TELEMETRY_DOC_URL } from './notice.js';
+export { patchState, readState } from './identity.js';
+export { flushClosedSessions } from './sessions.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/telemetry/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/telemetry/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1J,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/F,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACnE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC"}

package/dist/telemetry/index.js

@@ -0,0 +1,16 @@
+/**
+ * Anonymous adoption telemetry. `TELEMETRY.md` is the public contract;
+ * `contract.ts` is the same list enforced in code.
+ *
+ * The whole subsystem is inert unless four things are true at once: the build
+ * carries a key (published releases only), `DO_NOT_TRACK` is unset, this is not
+ * CI, and the user has not disabled it. See `gate.ts`.
+ */
+export { EVENTS, COMMON_KEYS, isTrackedCommand, errorCode, filesBucket, durationBucket, countBucket, savedTokensBucket, langsValue } from './contract.js';
+export { track, trackFirstRunIfNew, detectHost } from './track.js';
+export { telemetryOn, offReason, explainOff } from './gate.js';
+export { maybeFlushInBackground, runFlush } from './flush.js';
+export { firstRunNotice, formatStatus, formatDebug, NOTICE, TELEMETRY_DOC_URL } from './notice.js';
+export { patchState, readState } from './identity.js';
+export { flushClosedSessions } from './sessions.js';
+//# sourceMappingURL=index.js.map

package/dist/telemetry/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/telemetry/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE1J,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEnE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC"}

package/dist/telemetry/key.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The PostHog project key, and the reason forks stay silent.
+ *
+ * `BAKED_KEY` is empty in the repository and is rewritten in place by
+ * `scripts/stamp-telemetry-key.mjs`, which runs from `prepublishOnly`. So the
+ * key exists only in the published tarball: a clone, a fork, and a plain
+ * `npm run build` all compile to `''`, and every send path short-circuits. A
+ * contributor cannot accidentally send us their own usage, and a fork cannot
+ * send us anything at all.
+ *
+ * `GRAFT_POSTHOG_KEY` overrides it at runtime so a maintainer can exercise the
+ * real path locally without publishing.
+ *
+ * Public project keys are write-only ingestion keys — they authorise capture and
+ * nothing else — which is why one may sit in a published artifact at all. It is
+ * still not committed here: an empty default is what makes "forks never send"
+ * true by construction rather than by policy.
+ */
+export declare function posthogKey(): string;
+export declare function posthogHost(): string;
+//# sourceMappingURL=key.d.ts.map

package/dist/telemetry/key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.d.ts","sourceRoot":"","sources":["../../src/telemetry/key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA4BH,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED,wBAAgB,WAAW,IAAI,MAAM,CAEpC"}