@oxygen-agent/cli 1.987.20 → 1.1010.1

package/node_modules/@oxygen/shared/dist/stripe-price-catalog.js

@@ -0,0 +1,184 @@
+import { BASE_PRICING_PLANS, CONTACT_SALES_URL, DEFAULT_BILLING_CURRENCY, PURCHASABLE_PLAN_KEYS, SELF_SERVE_PLAN_TIERS, normalizeBillingCurrency, resolveBasePricingPlan, } from "./billing.js";
+export { CONTACT_SALES_URL, PURCHASABLE_PLAN_KEYS, SELF_SERVE_PLAN_TIERS, normalizeBillingCurrency, };
+const EMPTY_PRICE_IDS = { usd: "" };
+/**
+ * The six purchasable Oxygen rungs: one Stripe Product EACH, one monthly
+ * Price on each. They cannot share a Product -- a Billing Portal configuration
+ * refuses two Prices of the same interval under one Product, which is what
+ * makes the plan picker configurable at all.
+ *
+ * These are consulted BEFORE the grandfathered maps in tierFromPriceId: if an
+ * Oxygen price id were ever also listed in a legacy env var, the legacy branch
+ * winning would grant a $499 customer a $99 plan's credits.
+ */
+const STRIPE_PRICE_OXYGEN_IDS = {
+    oxygen_49: { usd: process.env.STRIPE_PRICE_OXYGEN_49_USD ?? "" },
+    oxygen_99: { usd: process.env.STRIPE_PRICE_OXYGEN_99_USD ?? "" },
+    oxygen_199: { usd: process.env.STRIPE_PRICE_OXYGEN_199_USD ?? "" },
+    oxygen_499: { usd: process.env.STRIPE_PRICE_OXYGEN_499_USD ?? "" },
+    oxygen_999: { usd: process.env.STRIPE_PRICE_OXYGEN_999_USD ?? "" },
+    oxygen_1999: { usd: process.env.STRIPE_PRICE_OXYGEN_1999_USD ?? "" },
+};
+// Grandfathered on 2026-09-19. These three stay pointed at their LIVE prices
+// (35 Starter + 2 Pro subscriptions bill against them) rather than moving into
+// the legacy CSV lists: tierFromPriceId must keep returning "starter"/"pro"/
+// "team" for them so resolveBasePricingPlan yields the plan those customers
+// actually bought. They are simply no longer offered for sale.
+const STRIPE_PRICE_STARTER_IDS = {
+    usd: process.env.STRIPE_PRICE_STARTER_99_USD ?? "",
+};
+const STRIPE_PRICE_PRO_IDS = {
+    usd: process.env.STRIPE_PRICE_PRO_249_USD ?? "",
+};
+const STRIPE_PRICE_TEAM_IDS = {
+    usd: process.env.STRIPE_PRICE_TEAM_749_USD ?? "",
+};
+const LEGACY_STRIPE_PRICE_IDS = {
+    starter_50: {
+        usd: process.env.STRIPE_PRICE_STARTER_USD ?? "",
+    },
+    pro_149: {
+        usd: process.env.STRIPE_PRICE_PRO_USD ?? "",
+    },
+    team_399: {
+        usd: process.env.STRIPE_PRICE_TEAM_USD ?? "",
+    },
+};
+const LEGACY_CURRENT_PLAN_PRICE_IDS = {
+    oxygen: readCommaSeparatedPriceIds(process.env.STRIPE_LEGACY_PRICE_OXYGEN_IDS),
+    starter: readCommaSeparatedPriceIds(process.env.STRIPE_LEGACY_PRICE_STARTER_IDS),
+    pro: readCommaSeparatedPriceIds(process.env.STRIPE_LEGACY_PRICE_PRO_IDS),
+    team: readCommaSeparatedPriceIds(process.env.STRIPE_LEGACY_PRICE_TEAM_IDS),
+};
+const SELF_SERVE_TIER_BY_LEGACY_TIER = {
+    starter_50: "starter",
+    pro_149: "pro",
+    team_399: "team",
+};
+function withPriceIds(plan, priceIds = EMPTY_PRICE_IDS) {
+    return {
+        ...plan,
+        priceIds,
+        priceId: priceIds[DEFAULT_BILLING_CURRENCY],
+    };
+}
+export const PRICING_PLANS = {
+    free: withPriceIds(BASE_PRICING_PLANS.free),
+    oxygen: withPriceIds(BASE_PRICING_PLANS.oxygen, STRIPE_PRICE_OXYGEN_IDS.oxygen_49),
+    starter: withPriceIds(BASE_PRICING_PLANS.starter, STRIPE_PRICE_STARTER_IDS),
+    pro: withPriceIds(BASE_PRICING_PLANS.pro, STRIPE_PRICE_PRO_IDS),
+    team: withPriceIds(BASE_PRICING_PLANS.team, STRIPE_PRICE_TEAM_IDS),
+    scale: withPriceIds(BASE_PRICING_PLANS.scale),
+    enterprise: withPriceIds(BASE_PRICING_PLANS.enterprise),
+};
+/** The six purchasable rungs with their Stripe price ids, cheapest first. */
+export const PURCHASABLE_PLANS = Object.fromEntries(PURCHASABLE_PLAN_KEYS.map((planKey) => {
+    const plan = resolveBasePricingPlan(planKey);
+    if (!plan)
+        throw new Error(`purchasable plan "${planKey}" is missing from the catalog`);
+    return [planKey, withPriceIds(plan, STRIPE_PRICE_OXYGEN_IDS[planKey])];
+}));
+export function getPlanPriceId(plan, currency) {
+    return (plan.priceIds[currency]
+        || (currency === DEFAULT_BILLING_CURRENCY ? plan.priceId : ""));
+}
+/**
+ * Resolve a Stripe price id to the plan key stored in `subscriptions.tier`.
+ *
+ * Returns a plan KEY ("oxygen_499") for the six purchasable rungs and a TIER
+ * ("starter", "growth_250") for grandfathered plans. Both are resolvable by
+ * resolveBasePricingPlan, which is what the credit grant reads — so the rung a
+ * customer paid for is the allowance they receive.
+ */
+export function tierFromPriceId(priceId) {
+    // An absent/unset Stripe price is "" on every map below (each env read falls
+    // back to ""), so without this guard an empty id matches the FIRST unset rung
+    // and silently provisions a paid plan. Never resolve a tier from no price.
+    if (!priceId)
+        return null;
+    for (const planKey of PURCHASABLE_PLAN_KEYS) {
+        if (Object.values(STRIPE_PRICE_OXYGEN_IDS[planKey]).includes(priceId)) {
+            return planKey;
+        }
+    }
+    for (const tier of SELF_SERVE_PLAN_TIERS) {
+        const plan = PRICING_PLANS[tier];
+        if (plan.priceId === priceId
+            || Object.values(plan.priceIds).includes(priceId)) {
+            return tier;
+        }
+    }
+    for (const [tier, priceIds] of Object.entries(LEGACY_STRIPE_PRICE_IDS)) {
+        if (Object.values(priceIds).includes(priceId))
+            return tier;
+    }
+    for (const [tier, priceIds] of Object.entries(LEGACY_CURRENT_PLAN_PRICE_IDS)) {
+        if (priceIds.includes(priceId))
+            return tier;
+    }
+    return null;
+}
+/**
+ * Complete runtime-recognized Price set grouped by the current self-serve
+ * family. Catalog audit/migration code consumes this instead of maintaining a
+ * second env map that can silently omit grandfathered subscriptions.
+ */
+export function recognizedStripePriceIdsBySelfServeTier() {
+    const byTier = {
+        oxygen: [
+            ...PURCHASABLE_PLAN_KEYS.flatMap((planKey) => Object.values(STRIPE_PRICE_OXYGEN_IDS[planKey])),
+            ...LEGACY_CURRENT_PLAN_PRICE_IDS.oxygen,
+        ],
+        starter: [
+            ...Object.values(STRIPE_PRICE_STARTER_IDS),
+            ...LEGACY_CURRENT_PLAN_PRICE_IDS.starter,
+        ],
+        pro: [
+            ...Object.values(STRIPE_PRICE_PRO_IDS),
+            ...LEGACY_CURRENT_PLAN_PRICE_IDS.pro,
+        ],
+        team: [
+            ...Object.values(STRIPE_PRICE_TEAM_IDS),
+            ...LEGACY_CURRENT_PLAN_PRICE_IDS.team,
+        ],
+    };
+    for (const legacyTier of Object.keys(LEGACY_STRIPE_PRICE_IDS)) {
+        byTier[SELF_SERVE_TIER_BY_LEGACY_TIER[legacyTier]]
+            .push(...Object.values(LEGACY_STRIPE_PRICE_IDS[legacyTier]));
+    }
+    return {
+        oxygen: uniqueNonEmptyPriceIds(byTier.oxygen),
+        starter: uniqueNonEmptyPriceIds(byTier.starter),
+        pro: uniqueNonEmptyPriceIds(byTier.pro),
+        team: uniqueNonEmptyPriceIds(byTier.team),
+    };
+}
+function readCommaSeparatedPriceIds(value) {
+    if (!value)
+        return [];
+    return [...new Set(value.split(",").map((entry) => entry.trim()).filter(Boolean))];
+}
+function uniqueNonEmptyPriceIds(values) {
+    return [...new Set(values.map((entry) => entry.trim()).filter(Boolean))];
+}
+export function formatMonthlyPrice(priceCents, currency = DEFAULT_BILLING_CURRENCY) {
+    if (priceCents == null)
+        return "Custom";
+    if (priceCents === 0)
+        return "Free";
+    return new Intl.NumberFormat("en-US", {
+        style: "currency",
+        currency: currency.toUpperCase(),
+        maximumFractionDigits: 0,
+    }).format(priceCents / 100);
+}
+function formatCredits(credits) {
+    if (credits == null)
+        return "Custom credits";
+    return `${new Intl.NumberFormat("en-US").format(credits)} credits`;
+}
+export function getMonthlyAllowanceLabel(plan) {
+    if (plan.monthlyCredits == null)
+        return "Custom monthly credits";
+    return `${formatCredits(plan.monthlyCredits)} / month`;
+}

package/node_modules/@oxygen/shared/dist/stripe-subscription-kind.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Which Stripe subscriptions are NOT an OXYGEN plan.
+ *
+ * OXYGEN runs three recurring rails on the same Stripe customer, and only one of
+ * them is a plan: the PLAN subscription (born from a Checkout Session),
+ * EMAIL INFRASTRUCTURE (`infra-subscription.ts`) and SENDING SEATS
+ * (`seat-subscription.ts`). The two rails are separate on purpose — a workspace
+ * with no plan at all must be able to hold managed inboxes and buy a sending
+ * seat — so a rail event is not a smaller version of a plan event, it is a
+ * different subject entirely, and plan-shaped handling of one is always wrong.
+ *
+ * THE WITNESS IS `metadata.oxygen_kind`. Both rails stamp it at
+ * `subscriptions.create` (the only two such call sites in the repo), and a plan
+ * subscription never carries it: a plan is born from a Checkout Session whose
+ * `subscription_data.metadata` carries organization_id/clerk_org_id and no
+ * `oxygen_kind`. (The third `oxygen_kind` in the codebase, `credit_topup`, rides
+ * a one-off `mode: "payment"` Checkout Session and never produces a
+ * subscription at all.) So the key's PRESENCE is a positive witness of "not a
+ * plan".
+ *
+ * PRESENCE, NOT A VALUE LIST, deliberately. Every previous gate matched the one
+ * value `"email_infra"`, which is why the seat rail — shipped later — walked
+ * straight into the plan handlers: adding a rail silently opted it INTO plan
+ * treatment, the wrong default for a safety gate. Testing presence means the
+ * next rail needs no edit here. This is the same reasoning `orphan-reconcile.ts`
+ * measured in production on 2026-09-06, where all 24 of the 24 daily
+ * `billing.subscription_health.unknown_plan_price` error lines were the same 4
+ * live sending-seat subscriptions x 6 cron runs.
+ *
+ * DELIBERATELY NARROW. This answers "did the subscription declare itself a
+ * non-plan rail", never "does it carry a recognised plan price". The catalog
+ * question stays with `tierFromPriceId` / `recognizedStripePlanItems`, and
+ * callers that need both keep asking both — `orphan-reconcile.ts` reclassifies
+ * only the zero-recognised-item half for exactly that reason.
+ */
+type StripeSubscriptionMetadata = Readonly<Record<string, string | null | undefined>> | null | undefined;
+/** The declared non-plan rail (`email_infra`, `sending_seats`, …), or null for a plan. */
+export declare function nonPlanSubscriptionKind(metadata: StripeSubscriptionMetadata): string | null;
+/** True when the subscription declared itself one of OXYGEN's non-plan rails. */
+export declare function isNonPlanSubscriptionKind(metadata: StripeSubscriptionMetadata): boolean;
+export {};

package/node_modules/@oxygen/shared/dist/stripe-subscription-kind.js

@@ -0,0 +1,44 @@
+/**
+ * Which Stripe subscriptions are NOT an OXYGEN plan.
+ *
+ * OXYGEN runs three recurring rails on the same Stripe customer, and only one of
+ * them is a plan: the PLAN subscription (born from a Checkout Session),
+ * EMAIL INFRASTRUCTURE (`infra-subscription.ts`) and SENDING SEATS
+ * (`seat-subscription.ts`). The two rails are separate on purpose — a workspace
+ * with no plan at all must be able to hold managed inboxes and buy a sending
+ * seat — so a rail event is not a smaller version of a plan event, it is a
+ * different subject entirely, and plan-shaped handling of one is always wrong.
+ *
+ * THE WITNESS IS `metadata.oxygen_kind`. Both rails stamp it at
+ * `subscriptions.create` (the only two such call sites in the repo), and a plan
+ * subscription never carries it: a plan is born from a Checkout Session whose
+ * `subscription_data.metadata` carries organization_id/clerk_org_id and no
+ * `oxygen_kind`. (The third `oxygen_kind` in the codebase, `credit_topup`, rides
+ * a one-off `mode: "payment"` Checkout Session and never produces a
+ * subscription at all.) So the key's PRESENCE is a positive witness of "not a
+ * plan".
+ *
+ * PRESENCE, NOT A VALUE LIST, deliberately. Every previous gate matched the one
+ * value `"email_infra"`, which is why the seat rail — shipped later — walked
+ * straight into the plan handlers: adding a rail silently opted it INTO plan
+ * treatment, the wrong default for a safety gate. Testing presence means the
+ * next rail needs no edit here. This is the same reasoning `orphan-reconcile.ts`
+ * measured in production on 2026-09-06, where all 24 of the 24 daily
+ * `billing.subscription_health.unknown_plan_price` error lines were the same 4
+ * live sending-seat subscriptions x 6 cron runs.
+ *
+ * DELIBERATELY NARROW. This answers "did the subscription declare itself a
+ * non-plan rail", never "does it carry a recognised plan price". The catalog
+ * question stays with `tierFromPriceId` / `recognizedStripePlanItems`, and
+ * callers that need both keep asking both — `orphan-reconcile.ts` reclassifies
+ * only the zero-recognised-item half for exactly that reason.
+ */
+/** The declared non-plan rail (`email_infra`, `sending_seats`, …), or null for a plan. */
+export function nonPlanSubscriptionKind(metadata) {
+    const kind = metadata?.oxygen_kind;
+    return typeof kind === "string" && kind.length > 0 ? kind : null;
+}
+/** True when the subscription declared itself one of OXYGEN's non-plan rails. */
+export function isNonPlanSubscriptionKind(metadata) {
+    return nonPlanSubscriptionKind(metadata) !== null;
+}

package/node_modules/@oxygen/shared/dist/table-limits.d.ts

@@ -1,4 +1,7 @@
 export declare const MAX_TABLE_ACTION_RUN_ROWS = 500000;
+/** Only runs whose resolved steps are all provider-free formulas may use these ceilings. */
+export declare const MAX_FORMULA_ACTION_RUN_ROWS = 1000000;
+export declare const MAX_FORMULA_ACTION_RUN_ITEMS = 5000000;
 export declare const MAX_WORKSPACE_ROW_DELETE_ROWS = 50000;
 /**
  * Platform ceiling for a table action run's `max_concurrency` (T-27).

package/node_modules/@oxygen/shared/dist/table-limits.js

@@ -1,6 +1,9 @@
 // Shared request/action ceilings used by tenant-db enforcement and every
 // surface that resolves a symbolic row selection before invoking it.
 export const MAX_TABLE_ACTION_RUN_ROWS = 500_000;
+/** Only runs whose resolved steps are all provider-free formulas may use these ceilings. */
+export const MAX_FORMULA_ACTION_RUN_ROWS = 1_000_000;
+export const MAX_FORMULA_ACTION_RUN_ITEMS = 5_000_000;
 export const MAX_WORKSPACE_ROW_DELETE_ROWS = 50_000;
 /**
  * Platform ceiling for a table action run's `max_concurrency` (T-27).

package/node_modules/@oxygen/shared/dist/telemetry-export-observer.d.ts

@@ -0,0 +1,94 @@
+import { DiagLogLevel, type DiagLogger } from "@opentelemetry/api";
+/**
+ * Makes a failing OTLP trace/metric export visible in LOGS.
+ *
+ * The SDK exporters report a failed export only through their result callback,
+ * and the processors hand that to `diag`, which has no logger unless one is
+ * installed — so a broken collector path (SigNoz over the private network) and a
+ * healthy one look identical from the sending process. This wraps an exporter so
+ * a failed export becomes one throttled `telemetry.export_failed` line and the
+ * first success afterwards one `telemetry.export_recovered` line, both through
+ * `log()` and therefore through whichever log sinks the process has.
+ *
+ * No recursion: `log()` records go to the LOG sinks, never to a trace or metric
+ * exporter, so a failing trace/metric lane cannot feed itself.
+ *
+ * Never throws, never changes what the SDK sees: the inner result is passed to
+ * the SDK callback untouched, every other exporter method is forwarded, and a
+ * synchronous throw from the inner exporter is recorded and rethrown exactly as
+ * it would have been without the wrapper.
+ *
+ * Nothing from the error's text is logged. OTLP errors carry receiver response
+ * bodies (`OTLPExporterError.data`) and transport errors can carry URLs; the
+ * failure is reduced to an HTTP status and a fixed code (see
+ * `classifyTelemetryExportError`), and the endpoint to origin + path.
+ *
+ * Structural types, not `@opentelemetry/core`/`sdk-metrics` imports: this
+ * package depends on neither, and the shapes used here (`{ code, error }`, the
+ * `ResourceMetrics` tree) are the SDK's stable public contract.
+ */
+export type TelemetryExportSignal = "traces" | "metrics";
+export type TelemetryExportSurface = "web" | "worker";
+type ExportResultLike = {
+    code: number;
+    error?: Error | undefined;
+};
+type ObservableExporter = {
+    export(items: unknown, resultCallback: (result: ExportResultLike) => void): void;
+    shutdown(): Promise<void>;
+};
+export type TelemetryExportObserverOptions = {
+    signal: TelemetryExportSignal;
+    /** The exporter's full URL; only origin + path is ever logged. */
+    endpoint: string;
+    surface: TelemetryExportSurface;
+    /** At most one `telemetry.export_failed` line per window. Default 60 s. */
+    windowMs?: number | undefined;
+    now?: (() => number) | undefined;
+};
+/** Origin + path only: never query strings, fragments or URL credentials. */
+export declare function telemetryEndpointForLog(endpoint: string): string;
+/**
+ * Reduces an OTLP export error to `{ status?, error_code }`. `status` is the
+ * HTTP status an `OTLPExporterError` carries in `code` for a non-retryable
+ * response; a retryable one (429/502/503/504) that exhausted its retries carries
+ * none, hence `http_retryable`. The message is matched against the exporter's
+ * own fixed strings and never copied.
+ */
+export declare function classifyTelemetryExportError(error: unknown): {
+    status?: number;
+    error_code: string;
+};
+export declare function observeTelemetryExporter<E extends ObservableExporter>(inner: E, options: TelemetryExportObserverOptions): E;
+export type TelemetryDropDiagLoggerOptions = {
+    surface: TelemetryExportSurface;
+    /** An existing diagnostics logger that still receives every call unchanged. */
+    next?: DiagLogger | undefined;
+    windowMs?: number | undefined;
+    now?: (() => number) | undefined;
+};
+/**
+ * A `diag` logger that recognises exactly one message: the BatchSpanProcessor's
+ * `Dropped N spans because maxQueueSize reached`, its only report of queue-full
+ * drops. Those become a throttled `telemetry.export_dropped` line carrying the
+ * count; every other diag call is ignored, because SDK diagnostics can carry
+ * receiver responses and exported payloads (the OTLP delegate logs the items it
+ * is about to send at debug). Nothing but the parsed count leaves this function.
+ *
+ * The count cannot name which BatchSpanProcessor dropped: diag is process-wide,
+ * so when a process also runs the Axiom processor, a drop line covers both.
+ *
+ * `next` keeps an operator-enabled diagnostics logger working: it receives every
+ * call as before, and this logger only adds the drop count.
+ */
+export declare function createTelemetryDropDiagLogger(options: TelemetryDropDiagLoggerOptions): DiagLogger;
+/**
+ * Installs `createTelemetryDropDiagLogger` as the global diag logger, once per
+ * process. Returns false when it was already installed. Callers install it only
+ * when an OTLP collector endpoint is configured, so a process without one keeps
+ * its diag configuration exactly as it was.
+ */
+export declare function installTelemetryDropDiagLogger(options: TelemetryDropDiagLoggerOptions & {
+    logLevel?: DiagLogLevel | undefined;
+}): boolean;
+export {};

package/node_modules/@oxygen/shared/dist/telemetry-export-observer.js

@@ -0,0 +1,298 @@
+import { diag, DiagLogLevel } from "@opentelemetry/api";
+import { log } from "./log.js";
+// @opentelemetry/core ExportResultCode.SUCCESS / FAILED.
+const EXPORT_RESULT_SUCCESS = 0;
+const DEFAULT_WINDOW_MS = 60_000;
+// Methods the SDK may call on an exporter besides `export`. Forwarded only when
+// the inner exporter has them, so a reader that probes for an optional method
+// (PeriodicExportingMetricReader reads selectAggregationTemporality) sees
+// exactly what it would have seen on the unwrapped exporter.
+const FORWARDED_METHODS = [
+    "forceFlush",
+    "selectAggregationTemporality",
+    "selectAggregation",
+];
+/** Origin + path only: never query strings, fragments or URL credentials. */
+export function telemetryEndpointForLog(endpoint) {
+    try {
+        const url = new URL(endpoint);
+        return `${url.origin}${url.pathname}`;
+    }
+    catch {
+        return "invalid_url";
+    }
+}
+const SYSTEM_ERROR_CODES = {
+    ETIMEDOUT: "timeout",
+    ESOCKETTIMEDOUT: "timeout",
+    ECONNREFUSED: "connection_refused",
+    ECONNRESET: "connection_reset",
+    EPIPE: "connection_reset",
+    ENOTFOUND: "dns_failed",
+    EAI_AGAIN: "dns_failed",
+    EHOSTUNREACH: "host_unreachable",
+    ENETUNREACH: "host_unreachable",
+};
+/**
+ * Reduces an OTLP export error to `{ status?, error_code }`. `status` is the
+ * HTTP status an `OTLPExporterError` carries in `code` for a non-retryable
+ * response; a retryable one (429/502/503/504) that exhausted its retries carries
+ * none, hence `http_retryable`. The message is matched against the exporter's
+ * own fixed strings and never copied.
+ */
+export function classifyTelemetryExportError(error) {
+    if (!error || typeof error !== "object")
+        return { error_code: "unknown" };
+    const candidate = error;
+    const code = candidate.code;
+    if (typeof code === "number" && Number.isInteger(code) && code >= 100 && code <= 599) {
+        return { status: code, error_code: code >= 500 ? "http_5xx" : `http_${code}` };
+    }
+    const systemCode = typeof code === "string"
+        ? code
+        : typeof candidate.cause?.code === "string"
+            ? candidate.cause.code
+            : undefined;
+    if (systemCode)
+        return { error_code: SYSTEM_ERROR_CODES[systemCode] ?? "transport_failed" };
+    const message = typeof candidate.message === "string" ? candidate.message : "";
+    if (candidate.name === "TimeoutError" || /timed out|timeout/i.test(message))
+        return { error_code: "timeout" };
+    if (/concurren(?:t|cy) (?:export )?limit/i.test(message))
+        return { error_code: "concurrency_limit" };
+    if (/retryable status/i.test(message))
+        return { error_code: "http_retryable" };
+    if (/exceeded size limit/i.test(message))
+        return { error_code: "response_too_large" };
+    return { error_code: "transport_failed" };
+}
+function countItems(signal, items) {
+    if (signal === "traces")
+        return Array.isArray(items) ? items.length : 0;
+    // Metric data points (= live series under cumulative temporality).
+    let points = 0;
+    const scopeMetrics = items?.scopeMetrics;
+    if (!Array.isArray(scopeMetrics))
+        return 0;
+    for (const scope of scopeMetrics) {
+        const metrics = scope?.metrics;
+        if (!Array.isArray(metrics))
+            continue;
+        for (const metric of metrics) {
+            const dataPoints = metric?.dataPoints;
+            if (Array.isArray(dataPoints))
+                points += dataPoints.length;
+        }
+    }
+    return points;
+}
+export function observeTelemetryExporter(inner, options) {
+    const endpoint = telemetryEndpointForLog(options.endpoint);
+    const windowMs = options.windowMs ?? DEFAULT_WINDOW_MS;
+    const now = options.now ?? Date.now;
+    const { signal, surface } = options;
+    let consecutiveFailures = 0;
+    let outageStartedAt = 0;
+    let outageDropped = 0;
+    // Only an outage that produced an export_failed line gets a recovery line, so
+    // a flapping endpoint cannot bypass the failure throttle through recoveries.
+    let outageReported = false;
+    let lastFailureLogAt = Number.NEGATIVE_INFINITY;
+    // Accumulated since the last emitted export_failed line, reported on the next.
+    let suppressedFailures = 0;
+    let pendingDropped = 0;
+    const recordFailure = (error, dropped) => {
+        try {
+            const at = now();
+            if (consecutiveFailures === 0) {
+                outageStartedAt = at;
+                outageDropped = 0;
+                outageReported = false;
+            }
+            consecutiveFailures += 1;
+            outageDropped += dropped;
+            pendingDropped += dropped;
+            if (at - lastFailureLogAt < windowMs) {
+                suppressedFailures += 1;
+                return;
+            }
+            lastFailureLogAt = at;
+            outageReported = true;
+            const { status, error_code } = classifyTelemetryExportError(error);
+            log("warn", "telemetry.export_failed", {
+                signal,
+                endpoint,
+                ...(status === undefined ? {} : { status }),
+                error_code,
+                dropped: pendingDropped,
+                consecutive_failures: consecutiveFailures,
+                suppressed_failures: suppressedFailures,
+                surface,
+            });
+            pendingDropped = 0;
+            suppressedFailures = 0;
+        }
+        catch {
+            // Observation must never change export semantics.
+        }
+    };
+    const recordSuccess = () => {
+        try {
+            if (consecutiveFailures === 0)
+                return;
+            if (outageReported) {
+                log("info", "telemetry.export_recovered", {
+                    signal,
+                    endpoint,
+                    failures: consecutiveFailures,
+                    dropped: outageDropped,
+                    outage_ms: Math.max(0, now() - outageStartedAt),
+                    surface,
+                });
+                // Every suppressed failure since the last line belonged to this outage,
+                // and the recovery line has just accounted for it.
+                pendingDropped = 0;
+                suppressedFailures = 0;
+            }
+            consecutiveFailures = 0;
+        }
+        catch {
+            // Observation must never change export semantics.
+        }
+    };
+    const observed = {
+        export(items, resultCallback) {
+            let dropped = 0;
+            try {
+                dropped = countItems(signal, items);
+            }
+            catch {
+                // Counting is best-effort; never let it block the export itself.
+            }
+            try {
+                inner.export(items, (result) => {
+                    if (result?.code === EXPORT_RESULT_SUCCESS)
+                        recordSuccess();
+                    else
+                        recordFailure(result?.error, dropped);
+                    resultCallback(result);
+                });
+            }
+            catch (error) {
+                recordFailure(error, dropped);
+                throw error;
+            }
+        },
+        shutdown() {
+            return inner.shutdown();
+        },
+    };
+    for (const method of FORWARDED_METHODS) {
+        const fn = inner[method];
+        if (typeof fn === "function")
+            observed[method] = fn.bind(inner);
+    }
+    return observed;
+}
+const DROPPED_SPANS_MESSAGE = /^Dropped (\d+) spans because maxQueueSize reached$/;
+/**
+ * A `diag` logger that recognises exactly one message: the BatchSpanProcessor's
+ * `Dropped N spans because maxQueueSize reached`, its only report of queue-full
+ * drops. Those become a throttled `telemetry.export_dropped` line carrying the
+ * count; every other diag call is ignored, because SDK diagnostics can carry
+ * receiver responses and exported payloads (the OTLP delegate logs the items it
+ * is about to send at debug). Nothing but the parsed count leaves this function.
+ *
+ * The count cannot name which BatchSpanProcessor dropped: diag is process-wide,
+ * so when a process also runs the Axiom processor, a drop line covers both.
+ *
+ * `next` keeps an operator-enabled diagnostics logger working: it receives every
+ * call as before, and this logger only adds the drop count.
+ */
+export function createTelemetryDropDiagLogger(options) {
+    const windowMs = options.windowMs ?? DEFAULT_WINDOW_MS;
+    const now = options.now ?? Date.now;
+    const { next, surface } = options;
+    let pending = 0;
+    let lastEmitAt = Number.NEGATIVE_INFINITY;
+    let timer = null;
+    let emitting = false;
+    const emit = () => {
+        if (pending === 0 || emitting)
+            return;
+        emitting = true;
+        try {
+            lastEmitAt = now();
+            const dropped = pending;
+            pending = 0;
+            log("warn", "telemetry.export_dropped", { signal: "traces", dropped, reason: "queue_full", surface });
+        }
+        finally {
+            emitting = false;
+        }
+    };
+    const record = (dropped) => {
+        pending += dropped;
+        const remaining = windowMs - (now() - lastEmitAt);
+        if (remaining <= 0) {
+            emit();
+            return;
+        }
+        // The BatchSpanProcessor reports a drop run only once it ends, so a
+        // suppressed count could otherwise wait forever for another drop to carry it.
+        if (timer)
+            return;
+        timer = setTimeout(() => {
+            timer = null;
+            try {
+                emit();
+            }
+            catch {
+                // Telemetry about telemetry never throws.
+            }
+        }, remaining);
+        timer.unref?.();
+    };
+    const forward = (level) => (message, ...args) => {
+        if (level === "warn") {
+            try {
+                const match = typeof message === "string" ? DROPPED_SPANS_MESSAGE.exec(message) : null;
+                const dropped = match ? Number(match[1]) : 0;
+                if (Number.isSafeInteger(dropped) && dropped > 0)
+                    record(dropped);
+            }
+            catch {
+                // Telemetry about telemetry never throws.
+            }
+        }
+        next?.[level](message, ...args);
+    };
+    return {
+        error: forward("error"),
+        warn: forward("warn"),
+        info: forward("info"),
+        debug: forward("debug"),
+        verbose: forward("verbose"),
+    };
+}
+// globalThis, not a module-local: Next.js bundles can load this module more
+// than once per process, and a second `diag.setLogger` would replace the first
+// (and, without suppressOverrideMessage, log an override warning).
+const DIAG_BRIDGE_SLOT = Symbol.for("oxygen.telemetry.diag_drop_bridge");
+/**
+ * Installs `createTelemetryDropDiagLogger` as the global diag logger, once per
+ * process. Returns false when it was already installed. Callers install it only
+ * when an OTLP collector endpoint is configured, so a process without one keeps
+ * its diag configuration exactly as it was.
+ */
+export function installTelemetryDropDiagLogger(options) {
+    const carrier = globalThis;
+    if (carrier[DIAG_BRIDGE_SLOT])
+        return false;
+    carrier[DIAG_BRIDGE_SLOT] = true;
+    diag.setLogger(createTelemetryDropDiagLogger(options), {
+        logLevel: options.logLevel ?? DiagLogLevel.WARN,
+        suppressOverrideMessage: true,
+    });
+    return true;
+}