@oxygen-agent/cli 1.936.1 → 1.948.1

package/node_modules/@oxygen/shared/dist/knowledge-bootstrap.js

@@ -2,28 +2,35 @@
  * Knowledge bootstrap — the once-per-workspace, automatic company research pass.
  *
  * WHAT IT IS. Exactly once in a workspace's life, OXYGEN researches the customer's
- * OWN company from the domain we already resolved at org creation
- * (control-DB `organizations.iconDomain`, `iconStatus = 'ok'`), then fills the typed
- * company profile (`ox_context.company_profile`) and writes one cited wiki page.
- * A founder who signs up should not face an empty Knowledge Graph and have to type
- * their own positioning back at us; every grounded AI action downstream (message
- * drafts, AI columns, agent runs) reads that profile, so an empty one degrades the
- * whole product's first hour.
+ * OWN company from the domain the creator typed when the workspace was created
+ * (control-DB `organizations.iconDomain`), then fills the typed company profile
+ * (`ox_context.company_profile`) and writes one cited wiki page. A founder who
+ * signs up should not face an empty Knowledge Graph and have to type their own
+ * positioning back at us; every grounded AI action downstream (message drafts, AI
+ * columns, agent runs) reads that profile, so an empty one degrades the whole
+ * product's first hour.
  *
  * WHY THIS IS NOT A VIOLATION OF THE PAID-ACTIONS RULE. `CLAUDE.md` says never run
  * paid provider actions unless the user explicitly asks. This slice is a deliberate,
- * founder-approved exception: signup IS the standing authorization, the same way an
- * armed table-webhook auto-run configuration is scoped standing permission for the
- * columns it queues. The exception is defensible ONLY because every one of the
- * following properties holds. They are load-bearing — do not drop one for
+ * founder-approved exception: naming the company at workspace creation IS the
+ * standing authorization, the same way an armed table-webhook auto-run
+ * configuration is scoped standing permission for the columns it queues — and
+ * since 2026-09-11 the pass is OXYGEN-funded, so it never draws down the
+ * customer's balance at all. The exception is defensible ONLY because every one of
+ * the following properties holds. They are load-bearing — do not drop one for
  * convenience, and if you remove one, the exception no longer stands:
  *
  *   1. CAPPED      — `KNOWLEDGE_BOOTSTRAP_MAX_CREDITS` is a hard ceiling on the whole
  *                    pass, with `KNOWLEDGE_BOOTSTRAP_ENRICHMENT_MAX_CREDITS` a tighter
- *                    sub-ceiling on the provider (external-money) half.
- *   2. CONSENTED   — it runs only for a workspace whose own domain we already derived
- *                    at signup; a personal-email signup is `skipped_personal_email`
- *                    upstream and never reaches here, so we never research a stranger.
+ *                    sub-ceiling on the provider (external-money) half. The cap bounds
+ *                    OXYGEN's own money now, and it is the same number.
+ *   2. AUTHORIZED  — it runs only for a workspace whose creator typed the company
+ *                    website into the REQUIRED field at workspace creation; that
+ *                    entry is recorded as `knowledge_bootstrap_consent` (source
+ *                    `workspace_creation`) and read FAIL-CLOSED, so a workspace that
+ *                    predates the field is never researched and a personal-email
+ *                    signup with no website never reaches the worker. We never
+ *                    research a stranger.
  *   3. JOURNALLED  — the marker below records status, timing, run id, credits and the
  *                    domain in `knowledge_state.watermarks`; the URLs read land as
  *                    immutable `page_sources` rows plus an `ingest` knowledge_log
@@ -36,6 +43,14 @@
  *                    ordinary revisioned wiki writes a human can revert.
  *   6. EXACTLY-ONCE — the marker is claimed with a conditional UPDATE, so N worker
  *                    replicas polling one tenant produce one run, never N runs.
+ *   7. OXYGEN-FUNDED — the automatic pass meters managed credits through the ordinary
+ *                    tool and AI-column lanes (so the cap, the marker and the run row
+ *                    all stay honest), and the worker then grants exactly the credits
+ *                    it used back to the workspace as an idempotent `bonus` ledger
+ *                    row keyed by the run (`KNOWLEDGE_BOOTSTRAP_COVERAGE_IDEMPOTENCY_PREFIX`).
+ *                    The customer's balance nets to zero and both rows are visible in
+ *                    their ledger. Only the AUTOMATIC pass is covered: a requested
+ *                    `--live --max-credits` re-run is the customer's own paid action.
  *
  * CAP ARITHMETIC (prices re-read from packages/integrations/src/cogs-rates.ts —
  * confirm them there rather than trusting this comment after a re-pricing):
@@ -52,8 +67,9 @@
  *                                overall ceiling.
  *   Hard cap           300 cr  — 85 cr nominal plus room for two retried synthesis
  *                                passes. 3% of the 10,000-credit signup grant
- *                                (FREE_SIGNUP_GRANT_CREDITS, ./billing.ts), so the
- *                                pass can never eat a founder's trial.
+ *                                (FREE_SIGNUP_GRANT_CREDITS, ./billing.ts), which is
+ *                                the headroom the balance gate needs even though the
+ *                                spend is granted back.
  *
  *   The obvious implementation — firecrawl.map + 3x firecrawl.scrape — costs
  *   4 x 40 = 160 cr for the SAME job, because Firecrawl bills per page. exa.contents
@@ -132,12 +148,14 @@ export function isKnowledgeBootstrapStatus(value) {
         KNOWLEDGE_BOOTSTRAP_STATUSES.includes(value));
 }
 // ---------------------------------------------------------------------------
-// Consent (property 2 of the exception above, made explicit)
+// Authorization (property 2 of the exception above, made explicit)
 // ---------------------------------------------------------------------------
 /**
- * Control-DB `organizations.metadata` key carrying the workspace's recorded consent
- * to the automatic research pass. Written once at signup by the setup surface; read
- * by the worker cycle before anything is spent.
+ * Control-DB `organizations.metadata` key carrying the workspace's recorded
+ * authorization for the automatic research pass. Written once, when the creator
+ * names the company website at workspace creation (`source: "workspace_creation"`;
+ * rows written by the retired `/setup` checkbox carry `source: "signup"` and stay
+ * valid); read by the worker cycle before anything is spent.
  *
  * It lives in shared, not in either caller, so the writer and the reader cannot
  * drift onto two different key names — a silent drift there would either deny every
@@ -208,6 +226,14 @@ export const KNOWLEDGE_BOOTSTRAP_LINKEDIN_METADATA_KEY = "company_linkedin_url";
  * dead and the workspace is recoverable through the product.
  */
 export const KNOWLEDGE_BOOTSTRAP_STUCK_AFTER_MS = 60 * 60 * 1000;
+/**
+ * Idempotency-key prefix for the ledger row that hands an automatic pass's
+ * credits back to the workspace (property 7 above). The key is
+ * `${prefix}:${run_id}`, so one pass is covered exactly once no matter how many
+ * times the worker revisits the outcome, and a `--force` re-run — a different
+ * run — is covered only if it was itself automatic.
+ */
+export const KNOWLEDGE_BOOTSTRAP_COVERAGE_IDEMPOTENCY_PREFIX = "knowledge_bootstrap_coverage";
 // ---------------------------------------------------------------------------
 // Write targets (what a bootstrap actually changes)
 // ---------------------------------------------------------------------------

package/node_modules/@oxygen/shared/dist/langfuse.d.ts

@@ -39,6 +39,7 @@ export type LlmSpanBody = {
 };
 export type LlmGenerationBody = LlmSpanBody & {
     model?: string | null;
+    modelParameters?: Record<string, unknown>;
     completionStartTime?: Date | null;
     usageDetails?: Record<string, number>;
     costDetails?: Record<string, number>;
@@ -74,6 +75,7 @@ export type LlmTracingClient = {
     trace(body: LlmTraceBody): void;
     span(body: LlmSpanBody): void;
     generation(body: LlmGenerationBody): void;
+    embedding(body: LlmGenerationBody): void;
     event(body: LlmEventBody): void;
     /**
      * Attach a score to an existing trace.
@@ -90,9 +92,9 @@ export type LlmTracingClient = {
      * describes.
      */
     score(body: LlmScoreBody): Promise<boolean>;
-    /** Never rejects; bounded at ~5s. */
+    /** Never rejects; bounded at 5s on workers, 15s in serverless after(). */
     flush(): Promise<void>;
-    /** Flush + stop background timers. Never rejects; bounded at ~5s. */
+    /** Flush + stop timers. Same worker/serverless bound as flush(). */
     shutdown(): Promise<void>;
 };
 /**
@@ -114,7 +116,7 @@ export declare function resolveLlmTracingEnvironment(env?: EnvMap): string;
  * the SDK's own implementation so the two can never drift.
  */
 export declare function llmTraceIdForSeed(seed: string): string;
-export type LlmEmissionKind = "span" | "generation" | "event";
+export type LlmEmissionKind = "span" | "generation" | "embedding" | "event";
 /** v5 correlating attributes, propagated onto the emitted observation. */
 export type LlmCorrelation = {
     traceName?: string;
@@ -124,6 +126,9 @@ export type LlmCorrelation = {
 };
 export type LlmEmission = {
     kind: LlmEmissionKind;
+    observationId?: string;
+    parentObservationId?: string;
+    isRoot?: boolean;
     /** External seed (turn/run id) — hashed into the W3C trace id. */
     traceSeed: string;
     name: string;

package/node_modules/@oxygen/shared/dist/langfuse.js

@@ -21,11 +21,9 @@
 //   * Trace ids stay deterministic: sha256(seed) — same trace per turn/run, so
 //     lease-reclaim replays still converge onto ONE trace. See
 //     llmTraceIdForSeed.
-//   * Observation ids can NO LONGER be chosen. v5 observation ids are W3C span
-//     ids minted by OTel. The caller's stable id (`gen:<turn>:<n>`, `tool:…`)
-//     is preserved as metadata.oxygen_observation_id for correlation, but it no
-//     longer upserts: a replayed slice appends duplicate observations to the
-//     same trace instead of overwriting them.
+//   * A private OTel id generator emits one real deterministic root per seed.
+//     Child ids identify physical observations; oxygen_observation_id preserves
+//     the caller's logical identity without conflating repeated executions.
 //   * v5 is observations-first: correlating attributes (userId, sessionId,
 //     tags) must ride EVERY observation, not just the root, or per-session cost
 //     rollups miss the cost-bearing generations. They are applied through
@@ -34,7 +32,9 @@
 //   * Trace-level input/output is deprecated in v5. Overall IO goes on the ROOT
 //     observation instead; setTraceIO()/setActiveTraceIO() are deliberately not
 //     used here.
-import { createHash } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
+import { OXYGEN_VERSION } from "./version.js";
+import { prepareLlmPayload } from "./llm-payload.js";
 import { log } from "./log.js";
 const FLUSH_TIMEOUT_MS = 5_000;
 const WARN_THROTTLE_MS = 30_000;
@@ -45,9 +45,7 @@ const WARN_THROTTLE_MS = 30_000;
  * meant every flush that ran long lost its spans instead of finishing late.
  */
 const LANGFUSE_EXPORT_TIMEOUT_SECONDS = 10;
-// Defensive per-field bound, well under Langfuse's ~1 MB event cap. Copilot
-// transcripts max out around 150 KB; anything larger is truncated with an
-// explicit marker rather than risking a rejected ingestion batch.
+// Scores are API strings; unlike observation payloads they cannot use chunks.
 const MAX_JSON_FIELD_CHARS = 400_000;
 /**
  * FAIL CLOSED: LLM tracing is on only when OXYGEN_LLM_TRACING_ENABLED is exactly
@@ -100,42 +98,13 @@ export function resolveLlmTracingEnvironment(env = process.env) {
 export function llmTraceIdForSeed(seed) {
     return createHash("sha256").update(seed, "utf8").digest("hex").slice(0, 32);
 }
-/**
- * Deterministic synthetic parent span id for one trace.
- *
- * v5 does not let a caller choose observation ids, and the worker emits a single
- * run's observations from different processes and slices — so there is no real
- * root span id to nest under. Every observation of a run instead attaches to
- * this stable pseudo-parent, which reproduces EXACTLY the flat shape the v3
- * adapter already produced (v3 passed only `traceId`, never
- * `parentObservationId`, so observations were already siblings of the trace).
- */
+/** The real root's stable W3C span id, also used across worker resumes. */
 function rootSpanIdForSeed(seed) {
     return createHash("sha256").update(`langfuse-root:${seed}`, "utf8").digest("hex").slice(0, 16);
 }
-// Bound one JSON-bearing field. Over the cap → an explicit truncation marker
-// (never a silently clipped payload that parses as complete).
-function boundJsonField(value) {
-    if (value === undefined || value === null)
-        return value;
-    let serialized;
-    try {
-        serialized = JSON.stringify(value) ?? "";
-    }
-    catch {
-        return { truncated: true, reason: "unserializable" };
-    }
-    if (serialized.length <= MAX_JSON_FIELD_CHARS)
-        return value;
-    return {
-        truncated: true,
-        chars: serialized.length,
-        preview: serialized.slice(0, MAX_JSON_FIELD_CHARS),
-    };
-}
 // A score's `comment` is free text (a thumbs-down reason is user-authored and
 // unbounded) and the API types it as a STRING, so it cannot take
-// boundJsonField's `{truncated, preview}` envelope. It gets the same
+// a recoverable payload envelope. It gets the same
 // MAX_JSON_FIELD_CHARS ceiling and the same "explicit marker, never a silent
 // clip" rule, with the marker counted INSIDE the cap so the bound holds.
 const COMMENT_TRUNCATION_MARKER = "…[truncated]";
@@ -149,13 +118,13 @@ function compact(body) {
     for (const [key, value] of Object.entries(body)) {
         if (value === undefined || value === null)
             continue;
-        out[key] = key === "input" || key === "output" ? boundJsonField(value) : value;
+        out[key] = value;
     }
     return out;
 }
-function boundedNever(rejectable, warn) {
+function boundedNever(rejectable, warn, timeoutMs = FLUSH_TIMEOUT_MS) {
     return new Promise((resolve) => {
-        const timer = setTimeout(resolve, FLUSH_TIMEOUT_MS);
+        const timer = setTimeout(resolve, timeoutMs);
         timer.unref?.();
         rejectable
             .catch((error) => warn(error))
@@ -165,52 +134,98 @@ function boundedNever(rejectable, warn) {
         });
     });
 }
-/**
- * The real v4 emitter. Everything OTel is loaded LAZILY, on first emission, so
- * a runtime with tracing disabled (the packed CLI, every test) never pays for
- * the OTel tree — matching the "inert unless enabled" doctrine the flag already
- * promises.
- */
+/** Lazy, private, always-sampled OTel transport. Never register it globally. */
 function createOtelEmitter(env, warn) {
     let handle = null;
     const init = () => {
         handle ??= (async () => {
             try {
-                const [{ LangfuseSpanProcessor }, { BasicTracerProvider }, tracing] = await Promise.all([
-                    import("@langfuse/otel"),
-                    import("@opentelemetry/sdk-trace-base"),
-                    import("@langfuse/tracing"),
+                const [{ LangfuseSpanProcessor }, { BasicTracerProvider, AlwaysOnSampler }, tracing, otel, core] = await Promise.all([
+                    import("@langfuse/otel"), import("@opentelemetry/sdk-trace-base"),
+                    import("@langfuse/tracing"), import("@opentelemetry/api"), import("@langfuse/core"),
                 ]);
                 const processor = new LangfuseSpanProcessor({
                     publicKey: env.LANGFUSE_PUBLIC_KEY,
                     secretKey: env.LANGFUSE_SECRET_KEY,
                     ...(env.LANGFUSE_BASE_URL?.trim() ? { baseUrl: env.LANGFUSE_BASE_URL.trim() } : {}),
                     environment: resolveLlmTracingEnvironment(env),
-                    // SECONDS, and the OTLP POST's own deadline. The SDK default is 5,
-                    // which is exactly FLUSH_TIMEOUT_MS — zero headroom, so a batch that
-                    // needed 6s was guaranteed to die on the transport and be dropped:
-                    // 37 `llm_tracing.ingest_failed` warns over 30 days to 2026-09-09,
-                    // every one stage='flush' / 'Request timed out', against 275,970
-                    // traces Langfuse accepted in the same window. 10s gives the POST
-                    // room without touching FLUSH_TIMEOUT_MS — boundedNever still
-                    // releases the caller at 5s, so a slow Langfuse can never hold a
-                    // worker tick.
+                    release: env.VERCEL_GIT_COMMIT_SHA || env.OXYGEN_GIT_SHA || OXYGEN_VERSION,
                     timeout: LANGFUSE_EXPORT_TIMEOUT_SECONDS,
+                    // SimpleSpanProcessor hits the exporter's concurrent-request limit
+                    // on large chunk bursts. Batch them, starting promptly; after() drains
+                    // the batch with a bound above the exporter's own deadline.
+                    exportMode: "batched",
+                    flushInterval: 1,
+                    flushAt: 128,
                 });
-                // PRIVATE provider. Deliberately NOT .register()ed — see the file
-                // header: the global provider carries the Axiom OTLP exporters, and a
-                // processor there would receive every prompt-bearing span.
-                //
-                // v5's smart default span filter needs no override here: this provider
-                // only ever creates spans through the Langfuse tracer, and
-                // `langfuse-sdk` spans are in the default allow-list.
-                const provider = new BasicTracerProvider({ spanProcessors: [processor] });
-                tracing.setLangfuseTracerProvider(provider);
-                return {
-                    processor,
-                    startObservation: tracing.startObservation,
-                    propagateAttributes: tracing.propagateAttributes,
+                let identity;
+                const provider = new BasicTracerProvider({
+                    spanProcessors: [{
+                            onStart: (span) => {
+                                // Directly pass the private parent claim to the processor. A
+                                // standalone process may have no global context manager at all;
+                                // context.with()/propagateAttributes alone would silently lose
+                                // the claim and user/session on every observation in that case.
+                                const parentContext = identity && !identity.isRoot
+                                    ? core.setLangfuseTraceIdInBaggage(otel.ROOT_CONTEXT, identity.traceId)
+                                    : otel.ROOT_CONTEXT;
+                                processor.onStart(span, parentContext);
+                                if (identity)
+                                    span.setAttributes(compact({
+                                        "user.id": identity.correlation.userId,
+                                        "session.id": identity.correlation.sessionId,
+                                        "langfuse.trace.name": identity.correlation.traceName,
+                                        "langfuse.trace.tags": identity.correlation.tags,
+                                    }));
+                            },
+                            onEnd: (span) => processor.onEnd(span),
+                            forceFlush: () => processor.forceFlush(),
+                            shutdown: () => processor.shutdown(),
+                        }], sampler: new AlwaysOnSampler(),
+                    idGenerator: {
+                        generateTraceId: () => identity?.traceId ?? randomBytes(16).toString("hex"),
+                        generateSpanId: () => identity?.spanId ?? randomBytes(8).toString("hex"),
+                    },
+                });
+                // Only used to avoid repeatedly creating provisional roots in this
+                // process. A final root emission always updates the same physical id.
+                const roots = new Set();
+                const emit = (emission) => {
+                    const traceId = llmTraceIdForSeed(emission.traceSeed);
+                    const rootId = rootSpanIdForSeed(emission.traceSeed);
+                    if (!emission.isRoot && !roots.has(traceId)) {
+                        emit({
+                            kind: "span", traceSeed: emission.traceSeed, isRoot: true,
+                            observationId: rootId, name: emission.correlation.traceName ?? emission.name.split(".")[0] + ".run",
+                            attributes: { version: OXYGEN_VERSION, metadata: { oxygen_trace_root: true, oxygen_trace_seed: emission.traceSeed, oxygen_capture_version: 2 } },
+                            correlation: emission.correlation, startTime: emission.startTime, endTime: emission.startTime,
+                        });
+                    }
+                    if (emission.isRoot) {
+                        roots.add(traceId);
+                        if (roots.size > 4096)
+                            roots.delete(roots.values().next().value);
+                    }
+                    // SDK configuration is module-local, whereas Next bundles and tests
+                    // may construct more than one private client. Select THIS provider
+                    // immediately before the synchronous creation; never use global OTel.
+                    tracing.setLangfuseTracerProvider(provider);
+                    identity = { traceId, spanId: emission.observationId ?? randomBytes(8).toString("hex"), isRoot: emission.isRoot === true, correlation: emission.correlation };
+                    try {
+                        otel.context.with(emission.isRoot ? otel.ROOT_CONTEXT : core.setLangfuseTraceIdInBaggage(otel.ROOT_CONTEXT, traceId), () => tracing.propagateAttributes(emission.correlation, () => {
+                            const observation = tracing.startObservation(emission.name, emission.attributes, {
+                                asType: emission.kind, startTime: emission.startTime,
+                                ...(emission.isRoot ? {} : { parentSpanContext: { traceId, spanId: emission.parentObservationId ?? rootId, traceFlags: 1 } }),
+                            });
+                            if (emission.kind !== "event")
+                                observation.end(emission.endTime);
+                        }));
+                    }
+                    finally {
+                        identity = undefined;
+                    }
                 };
+                return { processor, emit };
             }
             catch (error) {
                 warn(error, { stage: "init" });
@@ -220,33 +235,7 @@ function createOtelEmitter(env, warn) {
         return handle;
     };
     return {
-        emit: (emission) => {
-            void init()
-                .then((h) => {
-                if (!h)
-                    return;
-                const traceId = llmTraceIdForSeed(emission.traceSeed);
-                // propagateAttributes is scope-based in v5: the observation must be
-                // created INSIDE the callback to inherit userId/sessionId/tags.
-                h.propagateAttributes(emission.correlation, () => {
-                    // The kind is a union, so no single overload matches it. Every
-                    // overload returns an observation extending the same base, and the
-                    // only method used here is .end() — so resolving against the span
-                    // overload is safe while the real kind is passed at runtime.
-                    const observation = h.startObservation(emission.name, emission.attributes, {
-                        asType: emission.kind,
-                        startTime: emission.startTime,
-                        parentSpanContext: {
-                            traceId,
-                            spanId: rootSpanIdForSeed(emission.traceSeed),
-                            traceFlags: 1,
-                        },
-                    });
-                    observation.end(emission.endTime);
-                });
-            })
-                .catch((error) => warn(error, { stage: emission.kind }));
-        },
+        emit: (emission) => { void init().then((h) => h?.emit(emission)).catch((error) => warn(error, { stage: emission.kind })); },
         flush: () => init().then((h) => h?.processor.forceFlush() ?? Promise.resolve()),
         shutdown: () => init().then((h) => h?.processor.shutdown() ?? Promise.resolve()),
     };
@@ -330,7 +319,52 @@ export function createLlmTracingClient(env = process.env, options) {
             ...context,
         });
     };
-    const emitter = options?.emitterImpl ?? createOtelEmitter(env, warn);
+    const transport = options?.emitterImpl ?? createOtelEmitter(env, warn);
+    const emitter = {
+        ...transport,
+        emit: (emission) => {
+            const observationId = emission.observationId ?? randomBytes(8).toString("hex");
+            const metadata = { ...emission.attributes.metadata, oxygen_capture_version: 2 };
+            const attributes = { ...emission.attributes, version: OXYGEN_VERSION, metadata };
+            const chunkEmissions = [];
+            const capture = (value, field, key) => {
+                const prepared = prepareLlmPayload(value, key);
+                for (const chunk of prepared.chunks) {
+                    chunkEmissions.push({
+                        kind: "event", traceSeed: emission.traceSeed, name: "llm.payload_chunk", parentObservationId: observationId,
+                        attributes: { version: OXYGEN_VERSION, input: chunk, metadata: {
+                                oxygen_capture_version: 2, oxygen_payload_id: chunk.payload_id,
+                                oxygen_payload_chunk_index: chunk.index, oxygen_payload_chunk_count: prepared.chunks.length,
+                                oxygen_observation_id: `${metadata.oxygen_observation_id ?? observationId}:payload:${field}:${chunk.index}`,
+                            } },
+                        correlation: emission.correlation, startTime: emission.endTime ?? emission.startTime, endTime: emission.endTime ?? emission.startTime,
+                    });
+                }
+                return prepared.value;
+            };
+            for (const key of ["input", "output", "modelParameters"]) {
+                if (key in attributes)
+                    attributes[key] = capture(attributes[key], key);
+            }
+            if (typeof attributes.statusMessage === "string") {
+                const status = prepareLlmPayload(attributes.statusMessage);
+                if (typeof status.value === "string" && status.value.length <= 2000)
+                    attributes.statusMessage = status.value;
+                else {
+                    metadata.status_message = attributes.statusMessage;
+                    attributes.statusMessage = "See metadata.status_message for full error detail";
+                }
+            }
+            for (const [key, value] of Object.entries(metadata))
+                metadata[key] = capture(value, `metadata.${key}`, key);
+            if (attributes.modelParameters && typeof attributes.modelParameters === "object") {
+                attributes.modelParameters = Object.fromEntries(Object.entries(attributes.modelParameters).map(([key, value]) => [key, typeof value === "number" || typeof value === "string" ? value : JSON.stringify(value)]));
+            }
+            transport.emit({ ...emission, observationId, attributes });
+            for (const chunk of chunkEmissions)
+                transport.emit(chunk);
+        },
+    };
     const scorer = options?.scorerImpl ?? createApiScorer(env, warn);
     const guarded = (fn, stage) => {
         try {
@@ -360,19 +394,44 @@ export function createLlmTracingClient(env = process.env, options) {
             tags: input.tags,
         });
     };
+    const modelObservation = (body, kind) => guarded(() => {
+        emitter.emit({
+            kind,
+            traceSeed: body.traceId,
+            name: body.name,
+            attributes: compact({
+                input: body.input,
+                output: body.output,
+                level: body.level,
+                statusMessage: body.statusMessage,
+                model: body.model,
+                modelParameters: body.modelParameters,
+                completionStartTime: body.completionStartTime,
+                usageDetails: body.usageDetails,
+                costDetails: body.costDetails,
+                metadata: { ...(body.metadata ?? {}), oxygen_observation_id: body.id },
+            }),
+            // The cost-bearing observation: v5 session cost only rolls up when
+            // the generation itself carries the session.
+            correlation: correlate({ sessionId: body.sessionId, userId: body.userId }),
+            startTime: body.startTime ?? new Date(),
+            ...(body.endTime ? { endTime: body.endTime } : {}),
+        });
+    }, kind);
     return {
         trace: (body) => guarded(() => {
             const startTime = body.startTime ?? new Date();
             emitter.emit({
                 kind: "span",
                 traceSeed: body.id,
+                observationId: rootSpanIdForSeed(body.id), isRoot: true,
                 name: body.name,
                 // Overall trace IO lives on this ROOT observation — v5 deprecates
                 // trace-level input/output, so it is deliberately not set separately.
                 attributes: compact({
                     input: body.input,
                     output: body.output,
-                    metadata: { ...(body.metadata ?? {}), oxygen_observation_id: body.id },
+                    metadata: { ...(body.metadata ?? {}), oxygen_observation_id: body.id, oxygen_trace_root: true, oxygen_trace_seed: body.id },
                 }),
                 correlation: correlate({
                     traceName: body.name,
@@ -383,6 +442,15 @@ export function createLlmTracingClient(env = process.env, options) {
                 startTime,
                 endTime: body.endTime ?? startTime,
             });
+            if (body.metadata?.observation_scope === "execution_slice") {
+                const sliceStart = typeof body.metadata.slice_started_at === "string" ? new Date(body.metadata.slice_started_at) : startTime;
+                emitter.emit({
+                    kind: "span", traceSeed: body.id, name: `${body.name}.slice`,
+                    attributes: compact({ input: body.input, output: body.output, metadata: { ...body.metadata, oxygen_observation_id: `${body.id}:slice:${body.metadata.slice_id}` } }),
+                    correlation: correlate({ sessionId: body.sessionId, userId: body.userId }),
+                    startTime: Number.isFinite(sliceStart.getTime()) ? sliceStart : startTime, endTime: body.endTime ?? startTime,
+                });
+            }
         }, "trace"),
         span: (body) => guarded(() => {
             emitter.emit({
@@ -401,29 +469,8 @@ export function createLlmTracingClient(env = process.env, options) {
                 ...(body.endTime ? { endTime: body.endTime } : {}),
             });
         }, "span"),
-        generation: (body) => guarded(() => {
-            emitter.emit({
-                kind: "generation",
-                traceSeed: body.traceId,
-                name: body.name,
-                attributes: compact({
-                    input: body.input,
-                    output: body.output,
-                    level: body.level,
-                    statusMessage: body.statusMessage,
-                    model: body.model,
-                    completionStartTime: body.completionStartTime,
-                    usageDetails: body.usageDetails,
-                    costDetails: body.costDetails,
-                    metadata: { ...(body.metadata ?? {}), oxygen_observation_id: body.id },
-                }),
-                // The cost-bearing observation: v5 session cost only rolls up when
-                // the generation itself carries the session.
-                correlation: correlate({ sessionId: body.sessionId, userId: body.userId }),
-                startTime: body.startTime ?? new Date(),
-                ...(body.endTime ? { endTime: body.endTime } : {}),
-            });
-        }, "generation"),
+        generation: (body) => modelObservation(body, "generation"),
+        embedding: (body) => modelObservation(body, "embedding"),
         event: (body) => guarded(() => {
             const startTime = body.startTime ?? new Date();
             emitter.emit({
@@ -452,10 +499,10 @@ export function createLlmTracingClient(env = process.env, options) {
             }
         },
         // The "never rejects, bounded at ~5s" contract is the CLIENT's, so it is
-        // enforced here rather than inside one emitter — an emitter that throws
+        // enforced here (15s for serverless after()) rather than inside one emitter — an emitter that throws
         // synchronously or rejects must still not escape into product code.
-        flush: () => boundedNever((async () => emitter.flush())(), (error) => warn(error, { stage: "flush" })),
-        shutdown: () => boundedNever((async () => emitter.shutdown())(), (error) => warn(error, { stage: "shutdown" })),
+        flush: () => boundedNever((async () => emitter.flush())(), (error) => warn(error, { stage: "flush" }), env.VERCEL ? 15_000 : FLUSH_TIMEOUT_MS),
+        shutdown: () => boundedNever((async () => emitter.shutdown())(), (error) => warn(error, { stage: "shutdown" }), env.VERCEL ? 15_000 : FLUSH_TIMEOUT_MS),
     };
 }
 // --- Process-wide singleton (both runtimes construct at most one client) ------

package/node_modules/@oxygen/shared/dist/llm-payload.d.ts

@@ -0,0 +1,10 @@
+export type LlmPayloadChunk = {
+    payload_id: string;
+    index: number;
+    data: string;
+};
+/** Only credentials are masked: prompts, tool arguments and token counts stay. */
+export declare function prepareLlmPayload(value: unknown, fieldKey?: string): {
+    value: unknown;
+    chunks: LlmPayloadChunk[];
+};