@nekuda/webmcp-sdk 0.4.0-dev.7.3

package/CHANGELOG.md

@@ -0,0 +1,244 @@
+# Changelog
+
+## Unreleased — usage telemetry schema 2 (breaking wire format)
+
+The usage-telemetry channel emits **three events instead of two**, carrying
+derived signals instead of raw page and payload strings. `schema` bumps `1` → `2`.
+Nothing was deployed against `1`, so there is no compatibility shim: an ingest
+reading v1 events reads nothing from this build. `registerTools` behavior, the
+`tracking` channel, and every public API besides the exported event types are
+unchanged. See `docs/telemetry-schema.md`.
+
+### Breaking
+
+- **`sdk_init` fires once per page load, not once per `registerTools` call.** It is
+  scheduled at import time and flushed on the next task, so it now fires even when
+  nobody registers anything — which is the only way a broken integration is
+  visible. A page with three `registerTools` calls no longer emits three "init"
+  events.
+- **Per-call information moved to the new `tool_registration` event**, one per
+  `registerTools` call: `registrationIndex`, `trigger`, `settleMs`, the `config.*`
+  booleans (moved off `sdk_init`, which fires before any batch may have run), and
+  `tools[]` — the per-tool registration outcomes v1 computed and discarded, so a
+  site where 3 of 8 tools fail on a duplicate name is now distinguishable from one
+  where all 8 registered. Each entry carries a `schemaHash`, parameter-shape
+  metrics, and `descriptionLength` — never a parameter name, description, or schema.
+  The event emits when the batch settles, at a 2 s timeout, or on `pagehide` —
+  whichever comes first — so a surface whose `registerTool` never resolves still
+  reports; tools unsettled at that point carry `outcome: "pending"`, which is not one
+  of the registration states `registerTools` itself returns. Each telemetry-enabled
+  batch therefore holds one timer and one `{ once: true }` `pagehide` listener until
+  it emits, both released on emit.
+- **`tool_call` carries derived signals only.** Added: `callIndex`,
+  `toolCallIndex`, `precededBy`, `routeTemplate`, `agentRuntime`,
+  `timeSinceInitMs`, `tool.{stableKey,schemaHash,intent}`,
+  `response.{bytes,contentBlocks,isError}`, and `errorSignature` (the message with
+  quoted literals, opaque tokens, emails, URLs, relative paths, and digit runs
+  templated to `*`, so failures cluster and interpolated values do not ship).
+  Removed:
+  raw `input`, raw `response`, raw `error`, and the whole environment/page block.
+  Consequence: it carries no input signal at all in the interim — the
+  `schemaValid`/`missingRequired` block needs a JSON-Schema subset validator and is
+  deferred.
+- **Every high-cardinality and PII-shaped field is gone**, replaced by a derived
+  one: `fullUserAgent` → `client.agentRuntime` + UA-CH brand, `url`/`path` →
+  `routeTemplate` (`/products/12345` → `/products/:id`, word slugs kept and anything
+  else → `:token`, query and fragment dropped), `referrer` → `referrerClass`,
+  `screen` → `formFactor`,
+  `language` → its primary subtag, and `timezone`/`platform`/`title` dropped
+  outright. They are not allowlist entries set to `false` — they no longer exist,
+  so no allowlist change brings them back.
+- **No browser storage anywhere in this channel.** `visitorId` is gone and
+  `sessionId` is minted in memory per page load (the ePrivacy Art. 5(3) concern).
+  Cross-visit stitching is permanently impossible here; the authenticated
+  `tracking` channel keeps its own storage-backed identity and this one never reads
+  it. `tracking: { disabled: true }` consequently has nothing to narrow here.
+- **Arrival order is not guaranteed.** `tool_registration` can reach the wire
+  before `sdk_init`. Consumers join the three on `sessionId` and must not assume
+  ordering.
+- **`TelemetryEvent` is now a discriminated union** of `SdkInitEvent |
+  ToolRegistrationEvent | ToolCallEvent`, exported alongside `RegisteredToolEntry`,
+  `TelemetryEnvelope`, and the derived value unions (`AgentRuntime`,
+  `ReferrerClass`, `SurfaceInfo`, `ToolShapeMetrics`, …). The v1 open event shape
+  (`[key: string]: unknown`) is gone, so a field cannot reach the wire with nothing
+  declaring it.
+
+### Added
+
+- **`globalThis.__WEBMCP_TELEMETRY__ = false`** silences the channel page-wide
+  without touching a `registerTools` call site — the only lever a site has when the
+  calls come from generated code it does not edit. Strictly `false`, like GPC is
+  strictly `true`. It, GPC, and an absent `document` are read at emit time and so
+  silence everything; `telemetry: false` cancels `sdk_init` page-wide but reaches the
+  other two events per batch — see `docs/telemetry-schema.md` for the exact matrix.
+- **Optional `source` and `intent` on `defineTool`** (`"scanner_generated"` /
+  `"merchant_authored"`; `"answer"` / `"act"` / `"transact"`), validated as enums
+  and reported per tool. Both stay absent when omitted — absence is the honest
+  signal, not a defaulted `merchant_authored`. Both enums are exported from the
+  package entry as `ToolSource` / `ToolIntent`.
+- **`x-api-key` on telemetry beacons when the page configures one.** Same
+  `/v1/telemetry` path either way; the header only adds tenant attribution, and an
+  unkeyed page keeps sending anonymously. Note it makes the request non-simple
+  under CORS, so an authenticated beacon costs an `OPTIONS` preflight.
+- **`surface.provenance`** separates a `native` WebMCP surface from a `polyfill` or
+  `extension` one (a shim opts in via a `__webmcpProvenance` marker), and
+  `sdk.installMode` distinguishes an npm build from a CDN snippet — injected at build
+  time via `bun build --define '__WEBMCP_INSTALL_MODE__="cdn_snippet"'`, defaulting to
+  `"npm"` for any absent or unrecognized value.
+- **`tools[]` degrades instead of dropping the event.** A batch over the 64 KB
+  bound first loses every entry's shape detail, keeping identity and outcome, and
+  only then collapses to `{ __truncated, originalBytes, toolCount }` — so "this
+  site registered 500 tools" survives even when the entries do not. Both degraded
+  shapes are named on the wire contract (`StrippedToolEntry`, `TruncatedTools`), so
+  `ToolRegistrationEvent.tools` is a union: narrow with `Array.isArray` before
+  reading entries.
+- **Each batch's beacons carry that batch's own `apiKey`.** On a page where two
+  tenants each call `registerTools` with their own key, a batch's
+  `tool_registration` and `tool_call` authenticate as the tenant that registered
+  them rather than as whichever key the page configured last. A keyless batch still
+  authenticates as the tenant the page named, and `sdk_init` — which carries page
+  context and no tool identity — keeps using the page's key. `precededBy` is scoped
+  the same way, being the one field that puts another batch's `stableKey` on this
+  batch's event: the call chain breaks where the tenant changes rather than naming
+  tenant A's tool in an event signed with tenant B's key.
+
+### Fixed
+
+- **The baked ingest host is `ingest.<zone>`, which is the host the backend
+  actually serves.** Every published build pointed at `collect.agentlane.com` /
+  `collect.agentlane.dev`, and neither name has a DNS record: a dedicated
+  `collect.<zone>` host was planned, then dropped in favour of the DNS zone's
+  record budget, leaving the backend serving both paths on `ingest.<zone>` while
+  the SDK kept shipping the name that was cut. Every beacon on **both** channels —
+  `/v1/collect` as well as `/v1/telemetry` — failed at DNS resolution, and
+  silently, because the transport swallows every error by design.
+
+  Verified against dev: `collect.agentlane.dev` does not resolve, `ingest.agentlane.dev`
+  does, and the dev publish artifact built from this change delivers all three
+  telemetry events (HTTP 200) and lands them in the raw zone unquarantined. The
+  in-source fallback, both publish workflows and their baked-host guardrails move
+  together. Paths are unchanged and an explicit `endpoint` override still wins.
+
+## 0.4.0 — @nekuda/webmcp-sdk, publishable dual-flavor builds
+
+The package is renamed **`@nekuda/webmcp` → `@nekuda/webmcp-sdk`** and becomes
+publishable: prod releases go to public npmjs (tag + human approval), dev
+prereleases to npmjs under the `dev` dist-tag on every merge to `main`.
+Telemetry `sdk.name` and the OTEL logger name follow the rename.
+
+### Changed
+
+- **Real ingest domains, baked per flavor.** The placeholder collect/telemetry
+  defaults are replaced by `https://collect.agentlane.com` (prod, also the
+  in-source fallback) and `https://collect.agentlane.dev` (dev builds), injected
+  at build time via `bun build --define __WEBMCP_INGEST_BASE__`. Paths are
+  unchanged (`/v1/collect`, `/v1/telemetry`); explicit `endpoint` overrides
+  still win.
+- **Dev builds label their exact version.** `sdk.version` in telemetry events is
+  injectable via `__WEBMCP_SDK_VERSION__`, so a `0.4.0-dev.N` build no longer
+  reports itself as the base release.
+- **Published artifact is `dist/`** — browser ESM bundle plus type declarations
+  (`main`/`types`/`exports` now point there; the tarball ships `dist` and this
+  changelog only). Relative imports in `src/` carry explicit `.js` extensions so the
+  emitted `.d.ts` resolves under `moduleResolution: node16`/`nodenext`; without them
+  a Node-ESM consumer with the usual `skipLibCheck: true` silently gets no types at
+  all for the whole package.
+- **`@opentelemetry/api-logs` is no longer inlined into the bundle.** The build
+  marks it external, restoring the optional-peer design: the guarded lazy import
+  resolves the host's copy when installed and no-ops otherwise.
+
+## 0.3.0 — default-on anonymous usage telemetry
+
+Adds a second telemetry channel, independent of the opt-in `tracking` channel.
+It is **on by default and needs no `apiKey`**, so it reports from every site the
+SDK runs on. `tracking` behavior is unchanged.
+
+### Added
+
+- **Default-on usage telemetry.** One `sdk_init` event per `registerTools` call
+  (tools registered, WebMCP availability, browser, `tracking`/`otel`/custom-endpoint
+  booleans) and one `tool_call` event per settled invocation (outcome, duration,
+  error class). Fire-and-forget, no correlation ID, no batching.
+- **Unauthenticated `/v1/telemetry` endpoint**, separate from `/v1/collect`: the
+  request carries no `x-api-key` and no key in the URL or body. As with the collect
+  default, the built-in domain is a **placeholder** — no prod telemetry endpoint is
+  stood up yet.
+- **`telemetry: false` on `registerTools`** opts a batch out entirely: no events,
+  no identity resolution, no storage access, no network.
+- **Global Privacy Control honored.** `navigator.globalPrivacyControl === true`
+  silences the channel with no opt-out flag needed.
+- **Browser-only.** With no `document` in scope the channel emits nothing, so a
+  module-scope `registerTools` stays silent during SSR/prerender rather than
+  beaconing from the consumer's server. Unsupported browsers still report — they
+  are missing only `document.modelContext`, which is the adoption signal itself.
+- **`tracking: { disabled: true }` keeps this channel out of browser storage.**
+  The two channels share one storage namespace, so a closed consent gate means no
+  identity is created, read, or emitted here either — the channel still reports
+  the storage-free adoption fields (`telemetry: false` and GPC are its opt-outs).
+  A consent-gated tenant also reports `config.trackingEnabled: false`, since that
+  channel emits nothing.
+- **`TelemetryEvent` exported** from the entry module.
+
+### Breaking
+
+- **`defineTool` rejects a `stableKey` that isn't dot-namespaced `domain.action`**
+  (`TypeError`): two or more `[a-z0-9_]+` segments joined by `.`. Closes the gap
+  where a `stableKey` copying the wire `name` (e.g. `search_blog_posts`) passed
+  validation cleanly — exactly the rename-fragility the field exists to prevent.
+
+### What v1 collects
+
+v1 deliberately collects the **superset** of the spec's included and excluded
+field sets: the envelope plus full user agent, language, timezone, screen,
+platform, page fields (origin/url/path/referrer/title), anonymous
+visitor/session identity, and — on `tool_call` — the tool identity, input,
+response, and error message. Payloads are bounded to 64 KB; no stack traces.
+Every field is gated by the typed allowlist in `src/telemetry-fields.ts`, all
+`true` today, so dropping a field is a one-line change plus a release. Disabling
+`visitorId`/`sessionId` there makes the channel storage-free.
+
+## 0.2.0 — the tracking event schema and its transports (breaking)
+
+Settles the tool-call event schema and both of its outputs, and adapts the
+backend transport to the deployed ingest contract. Consumers of
+`registerTools({ tracking })` must migrate.
+
+### Added
+
+- **`otel: true` on `tracking`** emits each event as an OTEL LogRecord through the
+  global `LoggerProvider` (optional peer dependency `@opentelemetry/api-logs`
+  `>=0.50.0`; the host app owns exporters). Independent of and composable with the
+  backend transport — a call can emit to neither output, either, or both.
+- **`endpoint` on `tracking`** overrides the collect URL.
+- **Optional `ToolDefinition.version`**, emitted as `toolVersion` for drift
+  analytics; absent from events when omitted.
+- **`callId`** correlates each invocation's request/response pair, and
+  `duration_ms` reports client-measured elapsed time on the response event.
+- **Serialized events bounded to 64 KB** (schema §1.5): `response`, then `input`,
+  then `error` are replaced by a `{ __truncated: true, originalBytes }` marker only
+  as far as needed to fit, then page strings are sliced.
+
+### Breaking
+
+- **The SDK is silent by default.** The 0.1.0 `console.log` tracking stub is gone:
+  with neither `apiKey` nor `otel` set, no event is built at all — no identity, no
+  storage access, no output. Anything relying on the console output must set `otel`.
+- **`customerId` removed from `TrackingOptions` and the event body.** It was
+  required in 0.1.0; the backend now resolves the `api_key` to an `org_id` and
+  injects it server-side, so `apiKey` is the sole tenant credential.
+- **Transport is `x-api-key` header + `fetch`, not `?api_key=` + `sendBeacon`.**
+  The deployed authorizer's identity source is the `x-api-key` header, which
+  `sendBeacon` cannot set, so the beacon path is dropped. Sends now use
+  `fetch(endpoint, { keepalive: true, headers: { "x-api-key": … } })` — the key
+  travels only in the header, never in the URL or body.
+- **`defineTool` rejects a `stableKey` or `version` over 1024 characters**
+  (`TypeError`). They are identity keys copied verbatim onto every event and never
+  truncated in flight, so the cap is enforced at authoring time instead.
+
+### Migration
+
+- Replace `tracking: { customerId }` with `tracking: { apiKey }`.
+- No prod collect domain is stood up yet: consumers targeting a live backend
+  must pass an explicit `endpoint` (e.g. the deployed dev API Gateway URL).
+- Client-side visitor/session storage is now namespaced off a non-reversible
+  hash of `apiKey` instead of `customerId`; existing anonymous identities re-mint.

package/dist/define.d.ts

@@ -0,0 +1,79 @@
+import type { ToolAnnotations } from "./spec.js";
+/** How the tool came to exist. Reported on telemetry as `tools[].source`. */
+export type ToolSource = "scanner_generated" | "merchant_authored";
+/** What the tool is for. Reported on telemetry as `tools[].intent`. */
+export type ToolIntent = "answer" | "act" | "transact";
+/** The declared `source`/`intent` values, shared with the telemetry builders. */
+export declare const TOOL_SOURCES: readonly ToolSource[];
+export declare const TOOL_INTENTS: readonly ToolIntent[];
+/**
+ * A developer-authored (or plugin-generated) tool declaration. Declaring is
+ * side-effect-free — nothing touches the browser until `registerTools`.
+ */
+export interface ToolDefinition<TInput extends Record<string, unknown> = Record<string, unknown>> {
+    /**
+     * Developer-authored durable identity. The WebMCP `name` is the wire identity and
+     * may be renamed freely; `stableKey` is what the platform keys on when the site is
+     * later connected (analytics continuity, claiming), so it must survive renames and
+     * codegen re-runs. It is never sent to the browser API. Enforced shape: dot-namespaced
+     * `domain.action` (`[a-z0-9_]+` segments, at least two, joined by `.`) — see
+     * `STABLE_KEY_PATTERN`.
+     */
+    stableKey: string;
+    /**
+     * WebMCP tool name: 1–128 chars of [A-Za-z0-9_\-.]. Optional — defaults to
+     * `stableKey` when omitted, so a tool needs an explicit name only when its wire
+     * identity should differ from its durable key.
+     */
+    name?: string;
+    /** Optional human-readable display name. */
+    title?: string;
+    /** What the tool does, for the agent. Required and non-empty per spec. */
+    description: string;
+    /** JSON Schema for `execute`'s input, as a plain object. */
+    inputSchema?: Record<string, unknown>;
+    annotations?: ToolAnnotations;
+    /**
+     * Optional per-tool version, surfaced on emitted tracking events as `toolVersion`
+     * for drift analytics. Free-form string (e.g. semver or a codegen hash); when
+     * omitted, `toolVersion` is absent from emitted events (the backend defaults it
+     * to `unknown`).
+     */
+    version?: string;
+    /**
+     * Optional provenance: was this tool emitted by the scanner or written by hand?
+     * Left absent when omitted — the SDK never guesses `merchant_authored`, since
+     * absence is the honest signal and the backend can bucket it separately.
+     */
+    source?: ToolSource;
+    /**
+     * Optional purpose classification, reported per tool on telemetry. Per-tool
+     * rather than per-batch because one tool answers while another transacts.
+     */
+    intent?: ToolIntent;
+    /**
+     * The page-owned behavior. May return anything JSON-serializable, a plain string,
+     * or a ready-made `{ content: [...] }` result — the SDK normalizes for the agent.
+     * Thrown errors propagate to the agent unchanged.
+     */
+    execute(input: TInput): unknown;
+}
+declare const defined: unique symbol;
+/**
+ * A validated, frozen tool — the only thing `registerTools` accepts. `name` is
+ * always resolved (falling back to `stableKey`), so it is required here.
+ */
+export type WebMCPTool<TInput extends Record<string, unknown> = Record<string, unknown>> = Readonly<ToolDefinition<TInput> & {
+    name: string;
+}> & {
+    readonly [defined]: true;
+};
+/** `WebMCPTool` erased of its input type, for heterogeneous collections. */
+export type AnyWebMCPTool = WebMCPTool<any>;
+/**
+ * Validate and freeze a tool definition. Validation is eager and throws `TypeError`
+ * so an invalid tool fails at module-evaluation time (an authoring/codegen bug),
+ * not at registration time on some visitor's browser.
+ */
+export declare function defineTool<TInput extends Record<string, unknown> = Record<string, unknown>>(definition: ToolDefinition<TInput>): WebMCPTool<TInput>;
+export {};

package/dist/index.d.ts

@@ -0,0 +1,82 @@
+/**
+ * @nekuda/webmcp-sdk — the phase-1 WebMCP SDK: a thin wrapper over the plain-JS WebMCP
+ * spec (https://webmachinelearning.github.io/webmcp/) for registering and
+ * unregistering tools. Plugin-generated code targets THIS surface, never the raw
+ * `document.modelContext` API — the wrapper pins a spec version and absorbs the
+ * draft's monthly breaking churn (R23).
+ *
+ * The seam contract (what plugin codegen may rely on):
+ *
+ * 1. `defineTool(definition)` is side-effect-free: it validates eagerly, freezes,
+ *    and returns the tool. Nothing touches the browser until `registerTools`.
+ * 2. `stableKey` lives on the definition, next to `name`. It is the
+ *    developer-authored durable identity — it survives renames and codegen re-runs
+ *    and is never sent to the browser.
+ * 3. Registration lifecycle: `registerTools(tools, { signal?, tracking?, telemetry? })`
+ *    registers on call
+ *    and returns `{ ready, unregister, signal }`. Unregistration happens ONLY via
+ *    `unregister()` or the external signal aborting (page teardown / SPA unmount).
+ *    Browsers without a WebMCP surface are a graceful no-op (`state: "unsupported"`).
+ * 4. "Connect later without rewrite": generated modules only `defineTool` and
+ *    EXPORT tools; one entry module calls `registerTools`. Connecting a site to the
+ *    platform later (API key, telemetry) changes wrapper internals and config only —
+ *    generated modules and their imports do not change. See `examples/add-to-cart.ts`.
+ * 5. Anonymous tool-call tracking is opt-in via `registerTools`'s `tracking`
+ *    option (see `TrackingOptions`) and default-silent: with neither `apiKey`
+ *    nor `otel` set, no event is built at all — no identity resolution, no
+ *    storage writes, no network, and zero behavior change. When enabled it
+ *    resolves an anonymous visitor/session identity and emits a
+ *    request+response event per tool call. The two outputs are independent and
+ *    composable: `apiKey` POSTs each event to the collect endpoint via `fetch`
+ *    (`keepalive: true`), authenticated with the `x-api-key` **header** (never a
+ *    query param or body field); the backend resolves the key to `org_id` and
+ *    injects it server-side, so the client never sends or knows it. `otel: true`
+ *    emits each event as a
+ *    LogRecord through the global OTEL `LoggerProvider` (optional peer dep —
+ *    the host app owns exporters). `disabled: true` is the hard consent gate for
+ *    both outputs — but for THIS channel only; the default-on telemetry channel of
+ *    point 6 has its own opt-out (`telemetry: false`) and `disabled` does not
+ *    narrow it. See `src/tracking.ts`, `src/transport.ts`, and
+ *    `examples/add-to-cart.ts`.
+ * 6. Anonymous usage telemetry is a SECOND, independent channel: default-ON, so it
+ *    reports from every site the SDK runs on, not only from `apiKey` tenants. Three
+ *    events (`TelemetryEvent`), all `schema: 2` and joined on an in-memory
+ *    `sessionId`: `sdk_init` once per page load, scheduled at *import* time so a
+ *    site that loads the SDK and never registers is still visible;
+ *    `tool_registration` once per `registerTools` call, carrying each tool's
+ *    outcome; and `tool_call` once per settled invocation, as derived signals only —
+ *    no raw `input`, `response`, or error message, unlike point 5. All three go to a
+ *    separate `/v1/telemetry` endpoint, fire-and-forget, no batching; arrival order
+ *    is NOT guaranteed, so consumers join on `sessionId` and never on ordering. A
+ *    page that configures point 5's `apiKey` has it sent here as `x-api-key` too,
+ *    which only adds tenant attribution — an unkeyed page sends anonymously to the
+ *    same path. It composes with point 5: a call can emit to neither channel, either
+ *    one, or both. Three page-level levers silence it entirely (no event, no
+ *    network), because all three are read at emit time:
+ *    `globalThis.__WEBMCP_TELEMETRY__ = false` (strictly `false`), Global Privacy
+ *    Control (`navigator.globalPrivacyControl === true`), and no `document` in scope —
+ *    so the module-scope `registerTools` of point 4 stays silent during
+ *    SSR/prerender instead of beaconing from the consumer's server. A fourth,
+ *    `telemetry: false` on `registerTools`, silences that batch's `tool_registration`
+ *    and `tool_call` and cancels `sdk_init` page-wide; see `RegisterToolsOptions` for
+ *    what that does and does not cover. No browser storage is touched
+ *    anywhere in this channel: no `visitorId`, no stored `sessionId`, which is why
+ *    point 5's `disabled` consent gate has nothing to narrow here. An unsupported
+ *    browser still reports — it is missing only `document.modelContext`, and that
+ *    fact is itself the adoption signal. Every field is gated by the two baked-in
+ *    allowlists in `src/telemetry-fields.ts` (one by event path, one by per-tool
+ *    key; all `true` today), so dropping a field is a one-line change there. See
+ *    `src/telemetry.ts` and `docs/telemetry-schema.md`.
+ * 7. Transport wiring (endpoints, the OTEL logs API, apiKey handling) is
+ *    wrapper-internal: it is reached only through `TrackingOptions` and the
+ *    `telemetry` flag, never as a separate export, so connecting a site to the
+ *    platform stays a config-only change to the entry module (point 4).
+ */
+export { type AnyWebMCPTool, type ToolDefinition, type ToolIntent, type ToolSource, type WebMCPTool, defineTool, } from "./define.js";
+export { type RegisterToolsOptions, type ToolRegistration, type ToolRegistrationResult, type ToolRegistrationState, registerTools, } from "./register.js";
+export { type ModelContextLike, type RegisterToolOptions, type SpecTool, type ToolAnnotations, resolveModelContext, } from "./spec.js";
+export type { AgentRuntime, FormFactor, FrameContext, PageVisibility, ReferrerClass, SurfaceGlobal, SurfaceInfo, SurfaceProvenance, } from "./telemetry-context.js";
+export type { ClientContext, InstallMode, PageContext, RegisteredToolEntry, RegistrationTrigger, SdkInfo, SdkInitEvent, StrippedToolEntry, TelemetryEnvelope, TelemetryEvent, TelemetryEventName, ToolCallEvent, ToolCallOutcome, ToolCallResponseMetrics, ToolCallToolInfo, ToolRegistrationEvent, ToolRegistrationOutcome, TrackingConfigInfo, TruncatedTools, } from "./telemetry-events.js";
+/** The per-tool shape metrics `tool_registration` entries inherit as optional. */
+export type { ToolShapeMetrics } from "./tool-metrics.js";
+export type { TrackingEvent, TrackingOptions } from "./tracking.js";