@open-mercato/telemetry 0.8.1-develop.7275.1.f772b944d4 → 0.8.1-develop.7295.1.d0e0e33014

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
-[build:telemetry] found 20 entry points
+[build:telemetry] found 30 entry points
 [build:telemetry] built successfully

package/AGENTS.md

@@ -53,7 +53,10 @@ off by default. Spec:
 - Ask before adding a built-in metric, auto-instrumentation, production
   dependency, or new global hook.
 - OpenTelemetry packages must stay optional and may only be imported by
-  `provider/otlp-provider.ts`.
+  `provider/otlp-provider.ts` (Node SDK) and `browser/BrowserTelemetry.tsx` (web
+  SDK). Both must load them through a dynamic `import()` so a disabled
+  deployment never resolves them. Adding a third runtime importer needs
+  approval; `import type` is erased and unrestricted.
 - Ask before changing the `pg` `enhancedDatabaseReporting: false` guard or
   broadening the accepted inbound-trace trust model.
 
@@ -74,7 +77,17 @@ off by default. Spec:
 - Never store provider, shared-logger extension, or runtime bridge state only in
   a module local; cross-bundle state uses `globalThis` symbol registries.
 - Never replace provider-owned span delegation with a finished-span sink.
-- Never import this package from a client component.
+- Never import this package from a client component, except the dedicated
+  `@open-mercato/telemetry/browser` entry — the only client-safe surface. It must
+  stay env-free, must never import the server facade (`node:async_hooks`), and
+  must keep the OTel web SDK behind a dynamic `import()` gated on a non-null
+  server-resolved config.
+- Never move an env-reading or collector-credential helper into the `/browser`
+  entry; those belong to `@open-mercato/telemetry/browser/server`, which throws
+  on load in a browser.
+- Never expose the OTLP collector endpoint or its credential to the browser;
+  browser spans go through the same-origin `telemetry` module proxy, which adds
+  `OTEL_EXPORTER_OTLP_HEADERS` server-side.
 
 ## Architecture
 
@@ -95,6 +108,13 @@ host/queue shared runtime bridge ── absent while off
   registration.
 - `src/nextjs-config.ts`: build-time constants only; no runtime imports.
 - `src/nextjs.ts`: enabled runtime helper.
+- `src/browser/*`: browser RUM. `config.ts` (shared, env-free contract) and
+  `BrowserTelemetry.tsx` (boots the web SDK) form the client-safe `/browser`
+  entry; `server.ts` is the server-only `/browser/server` entry that reads env
+  and the collector credential. Off unless `TELEMETRY_BROWSER_ENABLED` is set
+  alongside an active backend.
+- `src/modules/telemetry/*`: the `telemetry` module — the authenticated,
+  rate-limited same-origin OTLP proxy (`POST /api/telemetry/browser-traces`).
 
 ## Validation
 

package/README.md

@@ -78,6 +78,79 @@ names, a custom-provider bootstrap must import `@open-mercato/telemetry`,
 register a provider whose `name` matches `TELEMETRY_BACKEND`, and call
 `initTelemetry()` directly. Unregistered names remain a hard no-op.
 
+## Browser RUM (client-side telemetry)
+
+Server traces can only prove where the time *isn't*: a page can render an API
+answer in 50 ms yet leave the user waiting seconds on bundle download,
+hydration, or a click handler — all invisible to server spans. The
+`@open-mercato/telemetry/browser` entry closes that gap with the OpenTelemetry
+web SDK: document-load and fetch spans from the backoffice.
+
+Interaction spans are deliberately **not** collected. The upstream
+`UserInteractionInstrumentation` patches `addEventListener` when it starts, but
+React attaches a single delegated `click` listener to the root container during
+hydration — before this SDK boots from `useEffect` — so the patch would never see
+a backoffice click. Booting earlier would put the SDK back on the critical path,
+which defeats the point; an instrumentation that silently emits nothing is worse
+than an absent one.
+
+Browser RUM is off by default and needs an explicit opt-in on top of an active
+server backend:
+
+```dotenv
+TELEMETRY_BROWSER_ENABLED=true
+# TELEMETRY_BROWSER_SAMPLING_RATIO=1.0  # 0.0-1.0 (default 1.0)
+# TELEMETRY_BROWSER_SERVICE_NAME=       # default: <OTEL_SERVICE_NAME>-browser
+```
+
+The wiring has three parts, all shipped with a fresh scaffold:
+
+- `resolveBrowserTelemetryConfig()` — from the server-only
+  `@open-mercato/telemetry/browser/server` entry — runs on the server (the
+  backend layout is `force-dynamic`) and returns `null` unless browser telemetry
+  is fully configured. Deliberately not `NEXT_PUBLIC_*`, so toggling needs no
+  rebuild.
+- `<BrowserTelemetry config={...} />` is a `'use client'` component that
+  dynamically `import()`s the web SDK only when the config is non-null; the SDK
+  never enters the critical bundle path, and every failure is swallowed.
+- The `telemetry` module (enabled in `modules.ts` via
+  `{ id: 'telemetry', from: '@open-mercato/telemetry' }`) serves the
+  same-origin proxy `POST /api/telemetry/browser-traces` — authenticated,
+  budgeted per user, size-capped — and forwards batches to the configured OTLP
+  collector, adding `OTEL_EXPORTER_OTLP_HEADERS` server-side so the credential
+  never reaches the browser.
+
+  The ingest budget is 400 batches/min **per authenticated user**, sized from the
+  export cadence: the batch processor's 3s delay means at most 20 batches/min per
+  open tab, so the budget covers roughly 20 concurrent tabs. Over it, a batch is
+  dropped with `204` — never `429`, which the OTLP exporter treats as retryable
+  and would answer with a backoff storm. The endpoint deliberately does not use
+  the dispatcher's IP-keyed rate limiter, which collapses to one deployment-wide
+  bucket whenever `RATE_LIMIT_TRUST_PROXY_DEPTH` is 0.
+
+`@open-mercato/telemetry/browser` is the ONLY part of this package a client
+bundle may import. Everything that reads the environment or the collector
+credential lives behind `@open-mercato/telemetry/browser/server`, which throws if
+it is ever loaded in a browser; the server facade stays server-only
+(`node:async_hooks`).
+
+### End-to-end traces need `TELEMETRY_TRUST_INBOUND_TRACE=true`
+
+The browser injects `traceparent` plus the `x-original-traceparent` backup header
+the server propagator understands. The server nevertheless **ignores every
+inbound trace header by default** — at an HTTP boundary they are
+caller-controlled, so accepting them would let any caller dictate trace ids.
+
+```dotenv
+TELEMETRY_TRUST_INBOUND_TRACE=true
+```
+
+Set it only when the app is reachable exclusively through trusted infrastructure;
+it applies to *all* inbound requests, not just RUM. Without it, browser RUM still
+works — each page simply produces one browser trace and one server trace instead
+of a single joined one, and the server logs
+`telemetry.browser.trace_continuity_disabled` once at startup to say so.
+
 ## Existing apps
 
 Fresh create-app scaffolds are already wired. Older apps can run:
@@ -279,7 +352,9 @@ consumer.
 - Metric labels must remain low-cardinality and must never contain tenant,
   organization, or user IDs.
 
-The package is server-only because span context uses `node:async_hooks`.
+The package is server-only because span context uses `node:async_hooks` — with
+one exception: `@open-mercato/telemetry/browser` is the dedicated client-safe
+entry for browser RUM and never imports the server facade.
 
 ## Validation
 

package/build.mjs

@@ -6,5 +6,5 @@ const packageDir = dirname(fileURLToPath(import.meta.url))
 
 await buildPackage(packageDir, {
   name: 'telemetry',
-  entryPoints: 'src/**/*.ts',
+  entryPoints: 'src/**/*.{ts,tsx}',
 })

package/dist/browser/BrowserTelemetry.js

@@ -0,0 +1,110 @@
+"use client";
+import * as React from "react";
+import { createBackupHeaderPropagator } from "./propagator.js";
+let bootstrapped = false;
+function resetBrowserTelemetryBootstrap() {
+  bootstrapped = false;
+}
+async function startBrowserTelemetry(config) {
+  const [
+    { WebTracerProvider },
+    { BatchSpanProcessor, ParentBasedSampler, TraceIdRatioBasedSampler },
+    { OTLPTraceExporter },
+    { resourceFromAttributes },
+    { registerInstrumentations },
+    { DocumentLoadInstrumentation },
+    { FetchInstrumentation },
+    { W3CTraceContextPropagator },
+    { defaultTextMapSetter }
+  ] = await Promise.all([
+    import("@opentelemetry/sdk-trace-web"),
+    import("@opentelemetry/sdk-trace-base"),
+    import("@opentelemetry/exporter-trace-otlp-http"),
+    import("@opentelemetry/resources"),
+    import("@opentelemetry/instrumentation"),
+    import("@opentelemetry/instrumentation-document-load"),
+    import("@opentelemetry/instrumentation-fetch"),
+    import("@opentelemetry/core"),
+    import("@opentelemetry/api")
+  ]);
+  const provider = new WebTracerProvider({
+    resource: resourceFromAttributes({
+      "service.name": config.serviceName,
+      // Plain attribute name (not the semconv `deployment.environment.name`) so browser spans sort
+      // alongside the server spans, which use OTEL_RESOURCE_ATTRIBUTES.
+      ...config.environment ? { "deployment.environment": config.environment } : {},
+      "user_agent.original": navigator.userAgent
+    }),
+    sampler: new ParentBasedSampler({
+      root: new TraceIdRatioBasedSampler(config.samplingRatio)
+    }),
+    spanProcessors: [
+      new BatchSpanProcessor(
+        new OTLPTraceExporter({ url: config.endpoint }),
+        // The interesting spans arrive in bursts around a navigation; a short delay keeps them
+        // close together in the trace view without one request per span.
+        { scheduledDelayMillis: 3e3, maxQueueSize: 512 }
+      )
+    ]
+  });
+  provider.register({
+    propagator: createBackupHeaderPropagator(new W3CTraceContextPropagator(), defaultTextMapSetter)
+  });
+  const patchTarget = window;
+  const frameworkFetch = patchTarget.__omOriginalFetch ? window.fetch : null;
+  if (frameworkFetch && patchTarget.__omOriginalFetch) {
+    window.fetch = patchTarget.__omOriginalFetch;
+  }
+  try {
+    registerInstrumentations({
+      tracerProvider: provider,
+      instrumentations: [
+        // Navigation + resource timings: chunk download vs. parse vs. hydrate.
+        new DocumentLoadInstrumentation(),
+        // The client-side START of each API call — the number the server can never see.
+        new FetchInstrumentation({
+          // Never instrument our own export, or each batch would generate the next one.
+          ignoreUrls: [new RegExp(escapeRegExp(config.endpoint))],
+          clearTimingResources: true
+        })
+        // No `UserInteractionInstrumentation` here, deliberately. It works by patching
+        // `addEventListener` when `enable()` runs, but React attaches a SINGLE delegated `click`
+        // listener to the root container during `createRoot`/hydration — and this SDK boots from
+        // `useEffect`, which React runs strictly after hydration. The patch would land after the
+        // only listener that will ever see a backoffice click, so it produces no spans at all
+        // (confirmed in manual QA). Booting early enough to beat hydration would mean putting the
+        // SDK back on the critical path, which is the one thing this file refuses to do. An
+        // instrumentation that silently produces nothing is worse than an absent one: an empty
+        // interaction view reads as "nobody clicks" rather than "this is broken".
+      ]
+    });
+  } finally {
+    if (frameworkFetch) {
+      patchTarget.__omOriginalFetch = window.fetch;
+      window.fetch = frameworkFetch;
+    }
+  }
+  const flush = () => void provider.forceFlush().catch(() => {
+  });
+  document.addEventListener("visibilitychange", () => {
+    if (document.visibilityState === "hidden") flush();
+  });
+  window.addEventListener("pagehide", flush);
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function BrowserTelemetry({ config }) {
+  React.useEffect(() => {
+    if (!config || bootstrapped) return;
+    bootstrapped = true;
+    void startBrowserTelemetry(config).catch(() => {
+    });
+  }, [config]);
+  return null;
+}
+export {
+  BrowserTelemetry,
+  resetBrowserTelemetryBootstrap
+};
+//# sourceMappingURL=BrowserTelemetry.js.map

package/dist/browser/BrowserTelemetry.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/browser/BrowserTelemetry.tsx"],
+  "sourcesContent": ["'use client'\n\n/**\n * Browser RUM. Boots the OpenTelemetry web SDK once per page load and exports\n * spans through the same-origin proxy (`/api/telemetry/browser-traces`).\n *\n * Why this exists: server traces can only prove where the time *isn't*. A page\n * can render an API answer in 50 ms yet leave the user waiting seconds before\n * the request is even sent \u2014 bundle download, hydration, or a click handler\n * stuck behind a re-render are all invisible to every server span.\n *\n * Two rules this file lives by:\n *  - **The SDK is `import()`ed, never statically imported.** RUM often\n *    diagnoses routes suspected to be bundle-bound; shipping the SDK in the\n *    critical path would be self-defeating. Document-load timings survive the\n *    late start because they are read back from the PerformanceTimeline.\n *  - **It can never break the app.** Every failure is swallowed. No\n *    user-facing surface, no retry.\n *\n * This file, `config.ts`, and `propagator.ts` are the only parts of\n * `@open-mercato/telemetry` a client bundle may reach (via the `/browser` entry).\n * None of them may import the server facade (`node:async_hooks`) or the\n * env-reading `browser/server.ts`; the two wirings are independent and meet only\n * at the collector.\n */\n\nimport * as React from 'react'\nimport type { BrowserTelemetryConfig } from './config'\nimport { createBackupHeaderPropagator } from './propagator'\n\n/** Module-level so React StrictMode's double-invoke (and any remount) cannot start a second SDK. */\nlet bootstrapped = false\n\n/**\n * Test seam. Production has exactly one bootstrap per page load, so nothing else\n * may call this \u2014 a second bootstrap would double every span.\n */\nexport function resetBrowserTelemetryBootstrap(): void {\n  bootstrapped = false\n}\n\nasync function startBrowserTelemetry(config: BrowserTelemetryConfig): Promise<void> {\n  const [\n    { WebTracerProvider },\n    { BatchSpanProcessor, ParentBasedSampler, TraceIdRatioBasedSampler },\n    { OTLPTraceExporter },\n    { resourceFromAttributes },\n    { registerInstrumentations },\n    { DocumentLoadInstrumentation },\n    { FetchInstrumentation },\n    { W3CTraceContextPropagator },\n    { defaultTextMapSetter },\n  ] = await Promise.all([\n    import('@opentelemetry/sdk-trace-web'),\n    import('@opentelemetry/sdk-trace-base'),\n    import('@opentelemetry/exporter-trace-otlp-http'),\n    import('@opentelemetry/resources'),\n    import('@opentelemetry/instrumentation'),\n    import('@opentelemetry/instrumentation-document-load'),\n    import('@opentelemetry/instrumentation-fetch'),\n    import('@opentelemetry/core'),\n    import('@opentelemetry/api'),\n  ])\n\n  const provider = new WebTracerProvider({\n    resource: resourceFromAttributes({\n      'service.name': config.serviceName,\n      // Plain attribute name (not the semconv `deployment.environment.name`) so browser spans sort\n      // alongside the server spans, which use OTEL_RESOURCE_ATTRIBUTES.\n      ...(config.environment ? { 'deployment.environment': config.environment } : {}),\n      'user_agent.original': navigator.userAgent,\n    }),\n    sampler: new ParentBasedSampler({\n      root: new TraceIdRatioBasedSampler(config.samplingRatio),\n    }),\n    spanProcessors: [\n      new BatchSpanProcessor(\n        new OTLPTraceExporter({ url: config.endpoint }),\n        // The interesting spans arrive in bursts around a navigation; a short delay keeps them\n        // close together in the trace view without one request per span.\n        { scheduledDelayMillis: 3_000, maxQueueSize: 512 },\n      ),\n    ],\n  })\n\n  // Standard `traceparent` plus the backup copy the server continues once\n  // TELEMETRY_TRUST_INBOUND_TRACE is on \u2014 see `propagator.ts` for why that flag is the supported\n  // way to get one end-to-end trace, and what happens without it.\n  provider.register({\n    propagator: createBackupHeaderPropagator(new W3CTraceContextPropagator(), defaultTextMapSetter),\n  })\n\n  // \u2500\u2500 The fetch-patch dance (do not simplify) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  // `@open-mercato/ui`'s api utils install a global wrapper at module load so that stray\n  // `fetch()` calls still get the 401 session-refresh / 403 banner behaviour:\n  //     w.__omOriginalFetch = window.fetch            // pristine native fetch\n  //     window.fetch = (i, x) => apiFetch(i, x)\n  // and `apiFetch` then calls `__omOriginalFetch` to avoid recursing into itself. Since the whole\n  // backoffice (DataTable, CrudForm, react-query queryFns\u2026) imports `apiFetch` DIRECTLY, those\n  // calls never touch `window.fetch` \u2014 so instrumenting `window.fetch` alone yields document-load\n  // spans and almost no API spans, which is worse than none at all: it looks like it works.\n  //\n  // Fix: let the instrumentation patch the *native* fetch, then hand the patched version back as\n  // the stash. Both paths end up instrumented exactly once:\n  //     apiFetch          \u2192 __omOriginalFetch = OTel(native)         \u2713\n  //     window.fetch      \u2192 apiFetch wrapper \u2192 OTel(native)          \u2713\n  // Assigning `__omOriginalFetch = window.fetch` instead would loop forever\n  // (apiFetch \u2192 wrapper \u2192 apiFetch \u2192 \u2026). The swap is synchronous \u2014 `registerInstrumentations`\n  // calls `enable()` inline \u2014 so no caller can observe the intermediate state.\n  const patchTarget = window as Window & { __omOriginalFetch?: typeof window.fetch }\n  const frameworkFetch = patchTarget.__omOriginalFetch ? window.fetch : null\n  if (frameworkFetch && patchTarget.__omOriginalFetch) {\n    window.fetch = patchTarget.__omOriginalFetch\n  }\n\n  // `finally`, not a plain sequence: the instrumentation constructors below are evaluated inside\n  // this window, and a throw from any of them (SDK version skew, a browser missing an API an\n  // instrumentation touches) would otherwise leave `window.fetch` as the raw native fetch stashed\n  // above. `apiFetch` would keep working \u2014 it reads `__omOriginalFetch` \u2014 but every stray\n  // `window.fetch(...)` would silently bypass the framework wrapper's 401 session-refresh and 403\n  // banner behaviour for the rest of the page's life. This is the one path where the file's\n  // \"every failure is swallowed\" rule would leave global state degraded.\n  try {\n    registerInstrumentations({\n      tracerProvider: provider,\n      instrumentations: [\n        // Navigation + resource timings: chunk download vs. parse vs. hydrate.\n        new DocumentLoadInstrumentation(),\n        // The client-side START of each API call \u2014 the number the server can never see.\n        new FetchInstrumentation({\n          // Never instrument our own export, or each batch would generate the next one.\n          ignoreUrls: [new RegExp(escapeRegExp(config.endpoint))],\n          clearTimingResources: true,\n        }),\n        // No `UserInteractionInstrumentation` here, deliberately. It works by patching\n        // `addEventListener` when `enable()` runs, but React attaches a SINGLE delegated `click`\n        // listener to the root container during `createRoot`/hydration \u2014 and this SDK boots from\n        // `useEffect`, which React runs strictly after hydration. The patch would land after the\n        // only listener that will ever see a backoffice click, so it produces no spans at all\n        // (confirmed in manual QA). Booting early enough to beat hydration would mean putting the\n        // SDK back on the critical path, which is the one thing this file refuses to do. An\n        // instrumentation that silently produces nothing is worse than an absent one: an empty\n        // interaction view reads as \"nobody clicks\" rather than \"this is broken\".\n      ],\n    })\n  } finally {\n    if (frameworkFetch) {\n      // On the success path `window.fetch` is OTel's patched native fetch; on the throw path it is\n      // the pristine native one. Either way this restores the framework wrapper on top of whatever\n      // the stash should now hold, so the pre-swap contract holds in both.\n      patchTarget.__omOriginalFetch = window.fetch\n      window.fetch = frameworkFetch\n    }\n  }\n\n  // BatchSpanProcessor would otherwise drop whatever is still queued when the user navigates away\n  // \u2014 which is exactly when a slow page gets abandoned, i.e. the spans we most want.\n  //\n  // `forceFlush` exports through the OTLP fetch transport, which sets `keepalive: true` on the\n  // request whenever the payload and the number of in-flight requests are within the browser's\n  // limits \u2014 so the batch survives the page going away. That is the durable path here;\n  // `sendBeacon` would be the other candidate, but upstream deprecated its export delegate in\n  // favour of the fetch one, so reaching for it would trade a supported API for a doomed one.\n  //\n  // Both events, because neither alone covers every exit: `visibilitychange` misses some bfcache\n  // entries, and `pagehide` does not fire when a tab is merely backgrounded. A second flush with\n  // an empty queue is a no-op, so the overlap costs nothing.\n  const flush = () => void provider.forceFlush().catch(() => {})\n  document.addEventListener('visibilitychange', () => {\n    if (document.visibilityState === 'hidden') flush()\n  })\n  window.addEventListener('pagehide', flush)\n}\n\nfunction escapeRegExp(value: string): string {\n  return value.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')\n}\n\n/**\n * Renders nothing. `config` is resolved server-side (`resolveBrowserTelemetryConfig()`) and is\n * `null` whenever browser telemetry is disabled for the environment \u2014 which is the default, and\n * keeps the SDK chunk from ever being requested.\n */\nexport function BrowserTelemetry({ config }: { config: BrowserTelemetryConfig | null }) {\n  React.useEffect(() => {\n    if (!config || bootstrapped) return\n    bootstrapped = true\n    void startBrowserTelemetry(config).catch(() => {\n      // Telemetry must never degrade the app it measures: stay silent and stay down (no retry).\n    })\n  }, [config])\n\n  return null\n}\n"],
+  "mappings": ";AA0BA,YAAY,WAAW;AAEvB,SAAS,oCAAoC;AAG7C,IAAI,eAAe;AAMZ,SAAS,iCAAuC;AACrD,iBAAe;AACjB;AAEA,eAAe,sBAAsB,QAA+C;AAClF,QAAM;AAAA,IACJ,EAAE,kBAAkB;AAAA,IACpB,EAAE,oBAAoB,oBAAoB,yBAAyB;AAAA,IACnE,EAAE,kBAAkB;AAAA,IACpB,EAAE,uBAAuB;AAAA,IACzB,EAAE,yBAAyB;AAAA,IAC3B,EAAE,4BAA4B;AAAA,IAC9B,EAAE,qBAAqB;AAAA,IACvB,EAAE,0BAA0B;AAAA,IAC5B,EAAE,qBAAqB;AAAA,EACzB,IAAI,MAAM,QAAQ,IAAI;AAAA,IACpB,OAAO,8BAA8B;AAAA,IACrC,OAAO,+BAA+B;AAAA,IACtC,OAAO,yCAAyC;AAAA,IAChD,OAAO,0BAA0B;AAAA,IACjC,OAAO,gCAAgC;AAAA,IACvC,OAAO,8CAA8C;AAAA,IACrD,OAAO,sCAAsC;AAAA,IAC7C,OAAO,qBAAqB;AAAA,IAC5B,OAAO,oBAAoB;AAAA,EAC7B,CAAC;AAED,QAAM,WAAW,IAAI,kBAAkB;AAAA,IACrC,UAAU,uBAAuB;AAAA,MAC/B,gBAAgB,OAAO;AAAA;AAAA;AAAA,MAGvB,GAAI,OAAO,cAAc,EAAE,0BAA0B,OAAO,YAAY,IAAI,CAAC;AAAA,MAC7E,uBAAuB,UAAU;AAAA,IACnC,CAAC;AAAA,IACD,SAAS,IAAI,mBAAmB;AAAA,MAC9B,MAAM,IAAI,yBAAyB,OAAO,aAAa;AAAA,IACzD,CAAC;AAAA,IACD,gBAAgB;AAAA,MACd,IAAI;AAAA,QACF,IAAI,kBAAkB,EAAE,KAAK,OAAO,SAAS,CAAC;AAAA;AAAA;AAAA,QAG9C,EAAE,sBAAsB,KAAO,cAAc,IAAI;AAAA,MACnD;AAAA,IACF;AAAA,EACF,CAAC;AAKD,WAAS,SAAS;AAAA,IAChB,YAAY,6BAA6B,IAAI,0BAA0B,GAAG,oBAAoB;AAAA,EAChG,CAAC;AAmBD,QAAM,cAAc;AACpB,QAAM,iBAAiB,YAAY,oBAAoB,OAAO,QAAQ;AACtE,MAAI,kBAAkB,YAAY,mBAAmB;AACnD,WAAO,QAAQ,YAAY;AAAA,EAC7B;AASA,MAAI;AACF,6BAAyB;AAAA,MACvB,gBAAgB;AAAA,MAChB,kBAAkB;AAAA;AAAA,QAEhB,IAAI,4BAA4B;AAAA;AAAA,QAEhC,IAAI,qBAAqB;AAAA;AAAA,UAEvB,YAAY,CAAC,IAAI,OAAO,aAAa,OAAO,QAAQ,CAAC,CAAC;AAAA,UACtD,sBAAsB;AAAA,QACxB,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAUH;AAAA,IACF,CAAC;AAAA,EACH,UAAE;AACA,QAAI,gBAAgB;AAIlB,kBAAY,oBAAoB,OAAO;AACvC,aAAO,QAAQ;AAAA,IACjB;AAAA,EACF;AAcA,QAAM,QAAQ,MAAM,KAAK,SAAS,WAAW,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AAC7D,WAAS,iBAAiB,oBAAoB,MAAM;AAClD,QAAI,SAAS,oBAAoB,SAAU,OAAM;AAAA,EACnD,CAAC;AACD,SAAO,iBAAiB,YAAY,KAAK;AAC3C;AAEA,SAAS,aAAa,OAAuB;AAC3C,SAAO,MAAM,QAAQ,uBAAuB,MAAM;AACpD;AAOO,SAAS,iBAAiB,EAAE,OAAO,GAA8C;AACtF,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,UAAU,aAAc;AAC7B,mBAAe;AACf,SAAK,sBAAsB,MAAM,EAAE,MAAM,MAAM;AAAA,IAE/C,CAAC;AAAA,EACH,GAAG,CAAC,MAAM,CAAC;AAEX,SAAO;AACT;",
+  "names": []
+}

package/dist/browser/config.js

@@ -0,0 +1,5 @@
+const BROWSER_TRACES_PATH = "/api/telemetry/browser-traces";
+export {
+  BROWSER_TRACES_PATH
+};
+//# sourceMappingURL=config.js.map

package/dist/browser/config.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/browser/config.ts"],
+  "sourcesContent": ["/**\n * The browser-RUM contract shared by both halves of the feature: the shape the\n * server resolves (`browser/server.ts`) and the shape the client component\n * consumes (`browser/BrowserTelemetry.tsx`).\n *\n * Deliberately dependency-free and env-free so it can sit in a client bundle.\n * Everything that reads `process.env` lives in `browser/server.ts`, which is a\n * server-only module and is never reachable from the `/browser` entry.\n */\n\n/** Same-origin path the browser exporter posts to; served by the `telemetry` module's API route. */\nexport const BROWSER_TRACES_PATH = '/api/telemetry/browser-traces'\n\nexport type BrowserTelemetryConfig = {\n  /** Same-origin OTLP endpoint (the proxy route). */\n  endpoint: string\n  serviceName: string\n  /** `deployment.environment` \u2014 kept as a plain attribute name to match existing server spans. */\n  environment: string | null\n  samplingRatio: number\n}\n"],
+  "mappings": "AAWO,MAAM,sBAAsB;",
+  "names": []
+}

package/dist/browser/index.js

@@ -0,0 +1,10 @@
+import { BrowserTelemetry } from "./BrowserTelemetry.js";
+import { BROWSER_TRACES_PATH } from "./config.js";
+import { BACKUP_TRACEPARENT_HEADER, BACKUP_TRACESTATE_HEADER } from "../trace-headers.js";
+export {
+  BACKUP_TRACEPARENT_HEADER,
+  BACKUP_TRACESTATE_HEADER,
+  BROWSER_TRACES_PATH,
+  BrowserTelemetry
+};
+//# sourceMappingURL=index.js.map

package/dist/browser/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/browser/index.ts"],
+  "sourcesContent": ["/**\n * Browser RUM entry \u2014 the ONLY part of `@open-mercato/telemetry` a client\n * bundle may reach. Import from `@open-mercato/telemetry/browser`.\n *\n * Everything here is env-free. The server half \u2014 `resolveBrowserTelemetryConfig()`\n * plus the collector endpoint/credential readers \u2014 lives behind\n * `@open-mercato/telemetry/browser/server`, which refuses to load in a browser.\n * A server component resolves the config there and passes it to\n * `<BrowserTelemetry />`, a `'use client'` boundary that dynamically loads the\n * OTel web SDK only when the config is non-null.\n */\nexport { BrowserTelemetry } from './BrowserTelemetry'\nexport { BROWSER_TRACES_PATH } from './config'\nexport type { BrowserTelemetryConfig } from './config'\nexport { BACKUP_TRACEPARENT_HEADER, BACKUP_TRACESTATE_HEADER } from '../trace-headers'\n"],
+  "mappings": "AAWA,SAAS,wBAAwB;AACjC,SAAS,2BAA2B;AAEpC,SAAS,2BAA2B,gCAAgC;",
+  "names": []
+}

package/dist/browser/propagator.js

@@ -0,0 +1,19 @@
+import { BACKUP_TRACEPARENT_HEADER, BACKUP_TRACESTATE_HEADER } from "../trace-headers.js";
+function createBackupHeaderPropagator(w3c, defaultTextMapSetter) {
+  return {
+    inject(ctx, carrier, setter) {
+      w3c.inject(ctx, carrier, setter);
+      const mirror = {};
+      w3c.inject(ctx, mirror, defaultTextMapSetter);
+      if (mirror.traceparent) setter.set(carrier, BACKUP_TRACEPARENT_HEADER, mirror.traceparent);
+      if (mirror.tracestate) setter.set(carrier, BACKUP_TRACESTATE_HEADER, mirror.tracestate);
+    },
+    // A browser is always the root of its own trace — nothing inbound to extract.
+    extract: (ctx) => ctx,
+    fields: () => [...w3c.fields(), BACKUP_TRACEPARENT_HEADER, BACKUP_TRACESTATE_HEADER]
+  };
+}
+export {
+  createBackupHeaderPropagator
+};
+//# sourceMappingURL=propagator.js.map

package/dist/browser/propagator.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/browser/propagator.ts"],
+  "sourcesContent": ["/**\n * The browser's outbound trace propagator: standard W3C plus the backup copy\n * (`x-original-traceparent`) that a load balancer will not rewrite \u2014 the mirror\n * image of `provider/otlp-provider.ts`'s `backupHeaderPropagator`.\n *\n * Injecting these headers is necessary but NOT sufficient for one end-to-end\n * trace. The server ignores every inbound trace header \u2014 standard and backup\n * alike \u2014 unless `TELEMETRY_TRUST_INBOUND_TRACE=true`, because at an HTTP\n * boundary they are caller-controlled. That flag is therefore the supported way\n * to stitch a browser span to its server span; the backup header is what\n * survives a proxy in between. Without the flag RUM still works, it just yields\n * two disconnected traces per page (the server warns about that once).\n *\n * The W3C propagator is passed in rather than imported: the web SDK is only ever\n * loaded through a dynamic `import()` inside `BrowserTelemetry.tsx`. Keeping the\n * logic here \u2014 free of any runtime OTel import \u2014 is also what lets a test drive\n * the real injector against the real server extractor.\n */\nimport type { TextMapPropagator, TextMapSetter } from '@opentelemetry/api'\nimport { BACKUP_TRACEPARENT_HEADER, BACKUP_TRACESTATE_HEADER } from '../trace-headers'\n\nexport function createBackupHeaderPropagator(\n  w3c: TextMapPropagator,\n  defaultTextMapSetter: TextMapSetter<Record<string, string>>,\n): TextMapPropagator {\n  return {\n    inject(ctx, carrier, setter) {\n      w3c.inject(ctx, carrier, setter)\n      // Inject into a plain temp carrier so the values can be mirrored regardless\n      // of the real carrier's setter shape.\n      const mirror: Record<string, string> = {}\n      w3c.inject(ctx, mirror, defaultTextMapSetter)\n      if (mirror.traceparent) setter.set(carrier, BACKUP_TRACEPARENT_HEADER, mirror.traceparent)\n      if (mirror.tracestate) setter.set(carrier, BACKUP_TRACESTATE_HEADER, mirror.tracestate)\n    },\n    // A browser is always the root of its own trace \u2014 nothing inbound to extract.\n    extract: (ctx) => ctx,\n    fields: () => [...w3c.fields(), BACKUP_TRACEPARENT_HEADER, BACKUP_TRACESTATE_HEADER],\n  }\n}\n"],
+  "mappings": "AAmBA,SAAS,2BAA2B,gCAAgC;AAE7D,SAAS,6BACd,KACA,sBACmB;AACnB,SAAO;AAAA,IACL,OAAO,KAAK,SAAS,QAAQ;AAC3B,UAAI,OAAO,KAAK,SAAS,MAAM;AAG/B,YAAM,SAAiC,CAAC;AACxC,UAAI,OAAO,KAAK,QAAQ,oBAAoB;AAC5C,UAAI,OAAO,YAAa,QAAO,IAAI,SAAS,2BAA2B,OAAO,WAAW;AACzF,UAAI,OAAO,WAAY,QAAO,IAAI,SAAS,0BAA0B,OAAO,UAAU;AAAA,IACxF;AAAA;AAAA,IAEA,SAAS,CAAC,QAAQ;AAAA,IAClB,QAAQ,MAAM,CAAC,GAAG,IAAI,OAAO,GAAG,2BAA2B,wBAAwB;AAAA,EACrF;AACF;",
+  "names": []
+}

package/dist/browser/server.js

@@ -0,0 +1,95 @@
+import { parseBooleanWithDefault } from "@open-mercato/shared/lib/boolean";
+import { isTelemetryBackendEnabled } from "@open-mercato/shared/lib/telemetry/runtime";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { readTelemetryEnv } from "../env.js";
+import { BROWSER_TRACES_PATH } from "./config.js";
+if (typeof window !== "undefined") {
+  throw new Error("[internal] @open-mercato/telemetry/browser/server is server-only; import @open-mercato/telemetry/browser instead");
+}
+const logger = createLogger("telemetry").child({ component: "browser-config" });
+function readDeploymentEnvironment(raw) {
+  if (!raw) return null;
+  for (const pair of raw.split(",")) {
+    const idx = pair.indexOf("=");
+    if (idx === -1) continue;
+    if (pair.slice(0, idx).trim() !== "deployment.environment") continue;
+    const value = pair.slice(idx + 1).trim();
+    if (value) return value;
+  }
+  return null;
+}
+function readSamplingRatio(raw) {
+  if (!raw) return 1;
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed)) return 1;
+  return Math.min(1, Math.max(0, parsed));
+}
+let warnedAboutTraceContinuity = false;
+function warnWhenTracesCannotStitch() {
+  if (warnedAboutTraceContinuity) return;
+  if (readTelemetryEnv().trustInboundTrace) return;
+  warnedAboutTraceContinuity = true;
+  logger.warn("telemetry.browser.trace_continuity_disabled", {
+    detail: "Browser RUM is enabled but TELEMETRY_TRUST_INBOUND_TRACE is not true, so browser spans and their server spans will land in separate traces. Set it to true when the app is only reachable through trusted infrastructure."
+  });
+}
+function resetBrowserTelemetryWarnings() {
+  warnedAboutTraceContinuity = false;
+}
+const BROWSER_TELEMETRY_TEST_COOKIE = "om_test_browser_telemetry";
+function resolveTestOptIn(cookieHeader) {
+  if (process.env.OM_TEST_MODE !== "1") return null;
+  if (process.env.OM_TEST_BROWSER_TELEMETRY_MODE !== "opt-in") return null;
+  if (!cookieHeader) return null;
+  const pattern = new RegExp(`(?:^|;)\\s*${BROWSER_TELEMETRY_TEST_COOKIE}=on(?:;|$)`);
+  if (!pattern.test(cookieHeader)) return null;
+  return {
+    endpoint: BROWSER_TRACES_PATH,
+    serviceName: `${process.env.OTEL_SERVICE_NAME?.trim() || "open-mercato"}-browser`,
+    environment: readDeploymentEnvironment(process.env.OTEL_RESOURCE_ATTRIBUTES),
+    samplingRatio: 1
+  };
+}
+function resolveBrowserTelemetryConfig(options = {}) {
+  const testOptIn = resolveTestOptIn(options.cookieHeader);
+  if (testOptIn) return testOptIn;
+  if (!parseBooleanWithDefault(process.env.TELEMETRY_BROWSER_ENABLED, false)) return null;
+  if (!isTelemetryBackendEnabled()) return null;
+  if (!resolveCollectorTracesUrl()) return null;
+  warnWhenTracesCannotStitch();
+  const serviceName = process.env.TELEMETRY_BROWSER_SERVICE_NAME?.trim() || `${process.env.OTEL_SERVICE_NAME?.trim() || "open-mercato"}-browser`;
+  return {
+    endpoint: BROWSER_TRACES_PATH,
+    serviceName,
+    environment: readDeploymentEnvironment(process.env.OTEL_RESOURCE_ATTRIBUTES),
+    samplingRatio: readSamplingRatio(process.env.TELEMETRY_BROWSER_SAMPLING_RATIO)
+  };
+}
+function resolveCollectorTracesUrl() {
+  const signal = process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT?.trim();
+  if (signal) return signal;
+  const generic = process.env.OTEL_EXPORTER_OTLP_ENDPOINT?.trim();
+  if (!generic) return null;
+  return `${generic.replace(/\/+$/, "")}/v1/traces`;
+}
+function resolveCollectorHeaders() {
+  const raw = process.env.OTEL_EXPORTER_OTLP_HEADERS?.trim();
+  if (!raw) return {};
+  const headers = {};
+  for (const pair of raw.split(",")) {
+    const idx = pair.indexOf("=");
+    if (idx <= 0) continue;
+    const key = pair.slice(0, idx).trim();
+    const value = pair.slice(idx + 1).trim();
+    if (key && value) headers[key] = value;
+  }
+  return headers;
+}
+export {
+  BROWSER_TELEMETRY_TEST_COOKIE,
+  resetBrowserTelemetryWarnings,
+  resolveBrowserTelemetryConfig,
+  resolveCollectorHeaders,
+  resolveCollectorTracesUrl
+};
+//# sourceMappingURL=server.js.map

package/dist/browser/server.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/browser/server.ts"],
+  "sourcesContent": ["/**\n * Server-only half of browser RUM: resolves the client configuration and the\n * collector coordinates from the telemetry env the host already sets\n * (`TELEMETRY_BACKEND`, `OTEL_EXPORTER_OTLP_*`), so enabling RUM is one flag and\n * no new endpoint plumbing.\n *\n * Import from `@open-mercato/telemetry/browser/server` \u2014 NOT from\n * `@open-mercato/telemetry/browser`, which is the client-safe entry. The split is\n * the point: `resolveCollectorHeaders()` returns the collector credential, which\n * must never be reachable from a client bundle. The guard below turns a wrong\n * import into an immediate, loud failure instead of a silent leak.\n *\n * Resolved at request time in the backend layout (`force-dynamic`) and passed to\n * the client as props \u2014 deliberately NOT `NEXT_PUBLIC_*`, which would bake the\n * values into the build and require a rebuild to toggle.\n */\nimport { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'\nimport { isTelemetryBackendEnabled } from '@open-mercato/shared/lib/telemetry/runtime'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { readTelemetryEnv } from '../env'\nimport { BROWSER_TRACES_PATH, type BrowserTelemetryConfig } from './config'\n\nif (typeof window !== 'undefined') {\n  throw new Error('[internal] @open-mercato/telemetry/browser/server is server-only; import @open-mercato/telemetry/browser instead')\n}\n\nconst logger = createLogger('telemetry').child({ component: 'browser-config' })\n\n/** `deployment.environment=dev,foo=bar` \u2192 `dev`. */\nfunction readDeploymentEnvironment(raw: string | undefined): string | null {\n  if (!raw) return null\n  for (const pair of raw.split(',')) {\n    const idx = pair.indexOf('=')\n    if (idx === -1) continue\n    if (pair.slice(0, idx).trim() !== 'deployment.environment') continue\n    const value = pair.slice(idx + 1).trim()\n    if (value) return value\n  }\n  return null\n}\n\nfunction readSamplingRatio(raw: string | undefined): number {\n  if (!raw) return 1\n  const parsed = Number(raw)\n  if (!Number.isFinite(parsed)) return 1\n  return Math.min(1, Math.max(0, parsed))\n}\n\nlet warnedAboutTraceContinuity = false\n\n/**\n * Browser spans stitch to their server spans only when the server continues the\n * inbound trace, which is exactly what `TELEMETRY_TRUST_INBOUND_TRACE` gates. RUM\n * without it still works \u2014 it just yields two disconnected traces per page, which\n * looks like a bug and is the single most likely misconfiguration, so say it once\n * per process rather than let an operator discover it in the trace view.\n */\nfunction warnWhenTracesCannotStitch(): void {\n  if (warnedAboutTraceContinuity) return\n  // Same reader the provider's propagator consults, so the warning can never\n  // disagree with the behaviour it describes.\n  if (readTelemetryEnv().trustInboundTrace) return\n  warnedAboutTraceContinuity = true\n  logger.warn('telemetry.browser.trace_continuity_disabled', {\n    detail:\n      'Browser RUM is enabled but TELEMETRY_TRUST_INBOUND_TRACE is not true, so browser spans and their server spans will land in separate traces. Set it to true when the app is only reachable through trusted infrastructure.',\n  })\n}\n\n/** Test seam: the warn-once latch is process-wide, which a second test case would otherwise miss. */\nexport function resetBrowserTelemetryWarnings(): void {\n  warnedAboutTraceContinuity = false\n}\n\n/**\n * Cookie an integration spec sets to boot RUM for its own page only. See\n * `resolveTestOptIn` for why a per-request switch is the only way to cover the\n * enabled path.\n */\nexport const BROWSER_TELEMETRY_TEST_COOKIE = 'om_test_browser_telemetry'\n\n/**\n * Browser RUM is an environment-wide switch read from `process.env`, so a Playwright spec cannot\n * turn it on for one page \u2014 and turning it on for the whole integration environment would boot the\n * web SDK on every page of every other spec. This is the same targeted escape hatch the auth and\n * AI-chat rate limiters use (`OM_TEST_MODE=1` plus a second, explicit `*_MODE=opt-in` variable):\n * both are absent in production, and only then is the request's cookie consulted at all.\n *\n * The synthetic config it returns is deliberately self-contained \u2014 no `TELEMETRY_BACKEND`, no\n * collector endpoint \u2014 so enabling it costs the integration environment nothing but the one page\n * that asked for it. With no collector configured the proxy answers `204`, which is exactly the\n * accept-and-drop contract the route documents, and the spec asserts on the batch the browser\n * posted rather than on anything the collector received.\n */\nfunction resolveTestOptIn(cookieHeader: string | null | undefined): BrowserTelemetryConfig | null {\n  if (process.env.OM_TEST_MODE !== '1') return null\n  if (process.env.OM_TEST_BROWSER_TELEMETRY_MODE !== 'opt-in') return null\n  if (!cookieHeader) return null\n  const pattern = new RegExp(`(?:^|;)\\\\s*${BROWSER_TELEMETRY_TEST_COOKIE}=on(?:;|$)`)\n  if (!pattern.test(cookieHeader)) return null\n  return {\n    endpoint: BROWSER_TRACES_PATH,\n    serviceName: `${process.env.OTEL_SERVICE_NAME?.trim() || 'open-mercato'}-browser`,\n    environment: readDeploymentEnvironment(process.env.OTEL_RESOURCE_ATTRIBUTES),\n    samplingRatio: 1,\n  }\n}\n\n/**\n * Returns `null` when browser telemetry is off \u2014 which is the default\n * everywhere, including local. Requires an active server telemetry backend\n * *and* an explicit opt-in: RUM without a reachable collector is pure overhead\n * in the client bundle.\n *\n * `options.cookieHeader` is the request's raw `Cookie` header, and is read only by the\n * integration-test opt-in above; production resolution is env-only and never consults it.\n */\nexport function resolveBrowserTelemetryConfig(\n  options: { cookieHeader?: string | null } = {},\n): BrowserTelemetryConfig | null {\n  const testOptIn = resolveTestOptIn(options.cookieHeader)\n  if (testOptIn) return testOptIn\n\n  if (!parseBooleanWithDefault(process.env.TELEMETRY_BROWSER_ENABLED, false)) return null\n  if (!isTelemetryBackendEnabled()) return null\n  if (!resolveCollectorTracesUrl()) return null\n\n  warnWhenTracesCannotStitch()\n\n  const serviceName =\n    process.env.TELEMETRY_BROWSER_SERVICE_NAME?.trim() ||\n    `${process.env.OTEL_SERVICE_NAME?.trim() || 'open-mercato'}-browser`\n\n  return {\n    endpoint: BROWSER_TRACES_PATH,\n    serviceName,\n    environment: readDeploymentEnvironment(process.env.OTEL_RESOURCE_ATTRIBUTES),\n    samplingRatio: readSamplingRatio(process.env.TELEMETRY_BROWSER_SAMPLING_RATIO),\n  }\n}\n\n/**\n * Where the proxy forwards to. Per the OTLP spec a signal-specific endpoint is\n * used verbatim, while the generic one gets `/v1/traces` appended.\n */\nexport function resolveCollectorTracesUrl(): string | null {\n  const signal = process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT?.trim()\n  if (signal) return signal\n  const generic = process.env.OTEL_EXPORTER_OTLP_ENDPOINT?.trim()\n  if (!generic) return null\n  return `${generic.replace(/\\/+$/, '')}/v1/traces`\n}\n\n/**\n * `OTEL_EXPORTER_OTLP_HEADERS=Authorization=Basic <b64>,key=value` \u2192 header record.\n * Split on the FIRST `=` only: base64 credentials routinely end in `=` padding.\n */\nexport function resolveCollectorHeaders(): Record<string, string> {\n  const raw = process.env.OTEL_EXPORTER_OTLP_HEADERS?.trim()\n  if (!raw) return {}\n  const headers: Record<string, string> = {}\n  for (const pair of raw.split(',')) {\n    const idx = pair.indexOf('=')\n    if (idx <= 0) continue\n    const key = pair.slice(0, idx).trim()\n    const value = pair.slice(idx + 1).trim()\n    if (key && value) headers[key] = value\n  }\n  return headers\n}\n"],
+  "mappings": "AAgBA,SAAS,+BAA+B;AACxC,SAAS,iCAAiC;AAC1C,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB;AACjC,SAAS,2BAAwD;AAEjE,IAAI,OAAO,WAAW,aAAa;AACjC,QAAM,IAAI,MAAM,kHAAkH;AACpI;AAEA,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,iBAAiB,CAAC;AAG9E,SAAS,0BAA0B,KAAwC;AACzE,MAAI,CAAC,IAAK,QAAO;AACjB,aAAW,QAAQ,IAAI,MAAM,GAAG,GAAG;AACjC,UAAM,MAAM,KAAK,QAAQ,GAAG;AAC5B,QAAI,QAAQ,GAAI;AAChB,QAAI,KAAK,MAAM,GAAG,GAAG,EAAE,KAAK,MAAM,yBAA0B;AAC5D,UAAM,QAAQ,KAAK,MAAM,MAAM,CAAC,EAAE,KAAK;AACvC,QAAI,MAAO,QAAO;AAAA,EACpB;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,KAAiC;AAC1D,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAAS,OAAO,GAAG;AACzB,MAAI,CAAC,OAAO,SAAS,MAAM,EAAG,QAAO;AACrC,SAAO,KAAK,IAAI,GAAG,KAAK,IAAI,GAAG,MAAM,CAAC;AACxC;AAEA,IAAI,6BAA6B;AASjC,SAAS,6BAAmC;AAC1C,MAAI,2BAA4B;AAGhC,MAAI,iBAAiB,EAAE,kBAAmB;AAC1C,+BAA6B;AAC7B,SAAO,KAAK,+CAA+C;AAAA,IACzD,QACE;AAAA,EACJ,CAAC;AACH;AAGO,SAAS,gCAAsC;AACpD,+BAA6B;AAC/B;AAOO,MAAM,gCAAgC;AAe7C,SAAS,iBAAiB,cAAwE;AAChG,MAAI,QAAQ,IAAI,iBAAiB,IAAK,QAAO;AAC7C,MAAI,QAAQ,IAAI,mCAAmC,SAAU,QAAO;AACpE,MAAI,CAAC,aAAc,QAAO;AAC1B,QAAM,UAAU,IAAI,OAAO,cAAc,6BAA6B,YAAY;AAClF,MAAI,CAAC,QAAQ,KAAK,YAAY,EAAG,QAAO;AACxC,SAAO;AAAA,IACL,UAAU;AAAA,IACV,aAAa,GAAG,QAAQ,IAAI,mBAAmB,KAAK,KAAK,cAAc;AAAA,IACvE,aAAa,0BAA0B,QAAQ,IAAI,wBAAwB;AAAA,IAC3E,eAAe;AAAA,EACjB;AACF;AAWO,SAAS,8BACd,UAA4C,CAAC,GACd;AAC/B,QAAM,YAAY,iBAAiB,QAAQ,YAAY;AACvD,MAAI,UAAW,QAAO;AAEtB,MAAI,CAAC,wBAAwB,QAAQ,IAAI,2BAA2B,KAAK,EAAG,QAAO;AACnF,MAAI,CAAC,0BAA0B,EAAG,QAAO;AACzC,MAAI,CAAC,0BAA0B,EAAG,QAAO;AAEzC,6BAA2B;AAE3B,QAAM,cACJ,QAAQ,IAAI,gCAAgC,KAAK,KACjD,GAAG,QAAQ,IAAI,mBAAmB,KAAK,KAAK,cAAc;AAE5D,SAAO;AAAA,IACL,UAAU;AAAA,IACV;AAAA,IACA,aAAa,0BAA0B,QAAQ,IAAI,wBAAwB;AAAA,IAC3E,eAAe,kBAAkB,QAAQ,IAAI,gCAAgC;AAAA,EAC/E;AACF;AAMO,SAAS,4BAA2C;AACzD,QAAM,SAAS,QAAQ,IAAI,oCAAoC,KAAK;AACpE,MAAI,OAAQ,QAAO;AACnB,QAAM,UAAU,QAAQ,IAAI,6BAA6B,KAAK;AAC9D,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,GAAG,QAAQ,QAAQ,QAAQ,EAAE,CAAC;AACvC;AAMO,SAAS,0BAAkD;AAChE,QAAM,MAAM,QAAQ,IAAI,4BAA4B,KAAK;AACzD,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,QAAM,UAAkC,CAAC;AACzC,aAAW,QAAQ,IAAI,MAAM,GAAG,GAAG;AACjC,UAAM,MAAM,KAAK,QAAQ,GAAG;AAC5B,QAAI,OAAO,EAAG;AACd,UAAM,MAAM,KAAK,MAAM,GAAG,GAAG,EAAE,KAAK;AACpC,UAAM,QAAQ,KAAK,MAAM,MAAM,CAAC,EAAE,KAAK;AACvC,QAAI,OAAO,MAAO,SAAQ,GAAG,IAAI;AAAA,EACnC;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/telemetry/__integration__/TC-TELEMETRY-001.spec.js

@@ -0,0 +1,34 @@
+import { expect, test } from "@playwright/test";
+import { apiRequest, getAuthToken } from "@open-mercato/core/helpers/integration/api";
+test.describe("TC-TELEMETRY-001: browser traces proxy", () => {
+  let token = "";
+  test.beforeAll(async ({ request }) => {
+    token = await getAuthToken(request, "admin");
+  });
+  test("unauthenticated span ingest is rejected", async ({ request }) => {
+    const res = await request.post("/api/telemetry/browser-traces", {
+      headers: { "Content-Type": "application/json" },
+      data: { resourceSpans: [] }
+    });
+    expect(res.status(), "span ingest must not be an unauthenticated endpoint").toBe(401);
+  });
+  test("authenticated batch is accepted", async ({ request }) => {
+    const res = await apiRequest(request, "POST", "/api/telemetry/browser-traces", {
+      token,
+      data: { resourceSpans: [] }
+    });
+    expect([204, 202], "an authenticated batch is always accepted").toContain(res.status());
+  });
+  test("an oversized payload is refused with 413", async ({ request }) => {
+    const oversized = `{"resourceSpans":["${"x".repeat(11e5)}"]}`;
+    const res = await request.post("/api/telemetry/browser-traces", {
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json"
+      },
+      data: oversized
+    });
+    expect(res.status(), "payloads above the 1 MB cap are refused").toBe(413);
+  });
+});
+//# sourceMappingURL=TC-TELEMETRY-001.spec.js.map

package/dist/modules/telemetry/__integration__/TC-TELEMETRY-001.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/telemetry/__integration__/TC-TELEMETRY-001.spec.ts"],
+  "sourcesContent": ["import { expect, test } from '@playwright/test'\nimport { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'\n\n/**\n * TC-TELEMETRY-001: browser RUM span-ingest proxy contract.\n *\n * Route: POST /api/telemetry/browser-traces (requireAuth). The proxy accepts\n * OTLP/HTTP batches from authenticated backoffice sessions and forwards them\n * to the configured collector. It is deliberately fire-and-forget: when browser\n * telemetry is disabled for the environment (the default, and the state of the\n * integration test env) it accepts and drops with 204 so a stale client never\n * retries. Oversized payloads are refused with 413 before buffering.\n */\ntest.describe('TC-TELEMETRY-001: browser traces proxy', () => {\n  let token = ''\n\n  test.beforeAll(async ({ request }) => {\n    token = await getAuthToken(request, 'admin')\n  })\n\n  test('unauthenticated span ingest is rejected', async ({ request }) => {\n    const res = await request.post('/api/telemetry/browser-traces', {\n      headers: { 'Content-Type': 'application/json' },\n      data: { resourceSpans: [] },\n    })\n    expect(res.status(), 'span ingest must not be an unauthenticated endpoint').toBe(401)\n  })\n\n  test('authenticated batch is accepted', async ({ request }) => {\n    const res = await apiRequest(request, 'POST', '/api/telemetry/browser-traces', {\n      token,\n      data: { resourceSpans: [] },\n    })\n    // 204 = telemetry disabled for the environment (accept-and-drop, the\n    // default here); 202 = forwarded to a configured collector.\n    expect([204, 202], 'an authenticated batch is always accepted').toContain(res.status())\n  })\n\n  test('an oversized payload is refused with 413', async ({ request }) => {\n    const oversized = `{\"resourceSpans\":[\"${'x'.repeat(1_100_000)}\"]}`\n    const res = await request.post('/api/telemetry/browser-traces', {\n      headers: {\n        Authorization: `Bearer ${token}`,\n        'Content-Type': 'application/json',\n      },\n      data: oversized,\n    })\n    expect(res.status(), 'payloads above the 1 MB cap are refused').toBe(413)\n  })\n})\n"],
+  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,YAAY,oBAAoB;AAYzC,KAAK,SAAS,0CAA0C,MAAM;AAC5D,MAAI,QAAQ;AAEZ,OAAK,UAAU,OAAO,EAAE,QAAQ,MAAM;AACpC,YAAQ,MAAM,aAAa,SAAS,OAAO;AAAA,EAC7C,CAAC;AAED,OAAK,2CAA2C,OAAO,EAAE,QAAQ,MAAM;AACrE,UAAM,MAAM,MAAM,QAAQ,KAAK,iCAAiC;AAAA,MAC9D,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,EAAE,eAAe,CAAC,EAAE;AAAA,IAC5B,CAAC;AACD,WAAO,IAAI,OAAO,GAAG,qDAAqD,EAAE,KAAK,GAAG;AAAA,EACtF,CAAC;AAED,OAAK,mCAAmC,OAAO,EAAE,QAAQ,MAAM;AAC7D,UAAM,MAAM,MAAM,WAAW,SAAS,QAAQ,iCAAiC;AAAA,MAC7E;AAAA,MACA,MAAM,EAAE,eAAe,CAAC,EAAE;AAAA,IAC5B,CAAC;AAGD,WAAO,CAAC,KAAK,GAAG,GAAG,2CAA2C,EAAE,UAAU,IAAI,OAAO,CAAC;AAAA,EACxF,CAAC;AAED,OAAK,4CAA4C,OAAO,EAAE,QAAQ,MAAM;AACtE,UAAM,YAAY,sBAAsB,IAAI,OAAO,IAAS,CAAC;AAC7D,UAAM,MAAM,MAAM,QAAQ,KAAK,iCAAiC;AAAA,MAC9D,SAAS;AAAA,QACP,eAAe,UAAU,KAAK;AAAA,QAC9B,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM;AAAA,IACR,CAAC;AACD,WAAO,IAAI,OAAO,GAAG,yCAAyC,EAAE,KAAK,GAAG;AAAA,EAC1E,CAAC;AACH,CAAC;",
+  "names": []
+}