@pinta-ai/pinta-cc 1.2.0

package/.claude-plugin/marketplace.json

@@ -0,0 +1,20 @@
+{
+  "name": "pinta-ai",
+  "owner": {
+    "name": "awarecorp",
+    "email": "dev@pinta.sh"
+  },
+  "plugins": [
+    {
+      "name": "pinta-cc",
+      "source": {
+        "source": "url",
+        "url": "https://github.com/awarecorp/pinta-cc.git"
+      },
+      "description": "Claude Code security monitoring plugin — emits OTLP spans for hook events and fail-closes on missing Pinta identity.",
+      "homepage": "https://pinta.sh",
+      "repository": "https://github.com/awarecorp/pinta-cc",
+      "category": "security"
+    }
+  ]
+}

package/.claude-plugin/plugin.json

@@ -0,0 +1,20 @@
+{
+  "name": "pinta-cc",
+  "description": "Generic OTLP forwarder for Claude Code hook events. Converts hook events into OTLP/HTTP spans and sends them to any OpenTelemetry-compatible collector.",
+  "version": "1.2.0",
+  "license": "PolyForm-Noncommercial-1.0.0",
+  "userConfig": {
+    "endpoint": {
+      "title": "OTLP endpoint",
+      "description": "OTLP/HTTP traces endpoint. Pinta Manager auto-fills this. OSS users: any OTel collector.",
+      "type": "string",
+      "sensitive": false
+    },
+    "api_key": {
+      "title": "OTLP authentication",
+      "description": "Token sent as x-pinta-relay-token header. Pinta Manager auto-fills.",
+      "type": "string",
+      "sensitive": true
+    }
+  }
+}

package/CHANGELOG.md

@@ -0,0 +1,42 @@
+# Changelog
+
+All notable changes to pinta-cc are documented here.
+
+## [1.2.0] - 2026-04-29 (BREAKING)
+
+### BREAKING CHANGES
+
+- **Guard module removed** — PreToolUse no longer evaluates server-side block rules. Enforcement is deferred to a future manager-side endpoint.
+- **Pinta CLI dependency removed** — `pinta identity id/email` is no longer invoked. Identity attribution moves to the relay layer (Pinta Manager attaches on forward; OSS users handle in their own pipeline).
+- **`api_key` semantics changed** — was: Pinta backend API key sent as `x-api-key`. Now: token sent as `x-pinta-relay-token` header (or any header via `OTEL_EXPORTER_OTLP_HEADERS` override).
+- **`endpoint` semantics changed** — was: Pinta backend URL. Now: any OTLP/HTTP traces collector URL.
+- **PreToolUse fail-close removed** — without identity to check, the deny path no longer fires. All hooks exit 0 on success, 1 on transport-only failures (handled internally — fail-open).
+- **`member.identity.*` resource attributes removed** — relay attaches identity if present.
+- **`src/enterprise/` directory removed** — `PintaIdentityResolver`, `PintaGuardClient` deleted.
+- **`src/handlers/auth-message.ts` removed** — no auth message to print.
+- **`src/core/guard.ts` removed**.
+
+### Added
+
+- `src/core/env-bridge.ts` — aliases Claude Code's `CLAUDE_PLUGIN_OPTION_*` env vars to OTel-spec `OTEL_EXPORTER_OTLP_*`. Explicit OTel env vars take precedence over the bridge.
+- `vitest` test suite (`tests/core/*.test.ts`) — covers OTLP builder + env-bridge.
+- `hasOtlpEndpoint()` helper in `src/core/config.ts` (currently unused — reserved for future signaling).
+
+### Changed
+
+- `buildOtlpPayload` signature: `{event, traceId, identity, now?}` → `{event, traceId, now?}`.
+- `Transport` reads OTel env vars at every send/flush call; silent-disables when endpoint missing (was: `loadConfig()` threw).
+- `package.json` name: `pinta` → `@pinta-ai/pinta-cc`.
+- `.claude-plugin/plugin.json` description and userConfig descriptions updated for OTel collector framing.
+- Mock server (`tools/mock-server.ts`) reduced to a generic OTLP collector + viewer (removed Pinta-backend-specific endpoints).
+
+### Migration
+
+**For Pinta Manager users:** No action required. Pinta Manager M9d will auto-inject `CLAUDE_PLUGIN_OPTION_ENDPOINT` and `CLAUDE_PLUGIN_OPTION_API_KEY` via Claude Code's settings.json. Marketplace install picks up 1.2.0 on next Claude Code startup.
+
+**For standalone users:**
+1. Update `endpoint` userConfig to your OTLP/HTTP collector URL.
+2. Update `api_key` to whatever token your collector expects (will be sent as `x-pinta-relay-token`).
+3. For non-Pinta collectors needing different auth headers, set `OTEL_EXPORTER_OTLP_HEADERS=Authorization=Bearer <token>` directly in the environment — this overrides the userConfig-based bridge.
+
+**Identity attribution:** v1.1's `member.identity.*` resource attrs are gone. If you depended on them in your pipeline, attach them at your collector / forwarder layer.

package/LICENSE

@@ -0,0 +1,136 @@
+# PolyForm Noncommercial License 1.0.0
+
+<https://polyformproject.org/licenses/noncommercial/1.0.0>
+
+## Acceptance
+
+In order to get any license under these terms, you must agree
+to them as both strict obligations and conditions to all
+your licenses.
+
+## Copyright License
+
+The licensor grants you a copyright license for the
+software to do everything you might do with the software
+that would otherwise infringe the licensor's copyright
+in it for any permitted purpose.  However, you may
+only distribute the software according to [Distribution
+License](#distribution-license) and make changes or new works
+based on the software according to [Changes and New Works
+License](#changes-and-new-works-license).
+
+## Distribution License
+
+The licensor grants you an additional copyright license to
+distribute copies of the software.  Your license to distribute
+covers distributing the software with changes and new works
+permitted by [Changes and New Works
+License](#changes-and-new-works-license).
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of
+the software from you also gets a copy of these terms or the
+URL for them above, as well as copies of any plain-text lines
+beginning with `Required Notice:` that the licensor provided
+with the software.  For example:
+
+> Required Notice: Copyright Pinta AI (https://pinta.sh)
+
+## Changes and New Works License
+
+The licensor grants you an additional copyright license to make
+changes and new works based on the software for any permitted
+purpose.
+
+## Patent License
+
+The licensor grants you a patent license for the software that
+covers patent claims the licensor can license, or becomes able
+to license, that you would infringe by using the software.
+
+## Noncommercial Purposes
+
+Any noncommercial purpose is a permitted purpose.
+
+## Personal Uses
+
+Personal use for research, experiment, and testing for
+the benefit of public knowledge, personal study, private
+entertainment, hobby projects, amateur pursuits, or religious
+observance, without any anticipated commercial application,
+is use for a permitted purpose.
+
+## Noncommercial Organizations
+
+Use by any charitable organization, educational institution,
+public research organization, public safety or health
+organization, environmental protection organization, or
+government institution is use for a permitted purpose
+regardless of the source of funding or obligations resulting
+from the funding.
+
+## Fair Use
+
+You may have "fair use" rights for the software under the
+law.  These terms do not limit them.
+
+## No Other Rights
+
+These terms do not allow you to sublicense or transfer any of
+your licenses to anyone else, or prevent the licensor from
+granting licenses to anyone else.  These terms do not imply
+any other licenses.
+
+## Patent Defense
+
+If you make any written claim that the software infringes or
+contributes to infringement of any patent, your patent license
+for the software granted under these terms ends immediately. If
+your company makes such a claim, your patent license ends
+immediately for work on behalf of your company.
+
+## Violations
+
+The first time you are notified in writing that you have
+violated any of these terms, or done anything with the software
+not covered by your licenses, your licenses can nonetheless
+continue if you come into full compliance with these terms,
+and take practical steps to correct past violations, within
+32 days of receiving notice.  Otherwise, all your licenses
+end immediately.
+
+## No Liability
+
+***As far as the law allows, the software comes as is, without
+any warranty or condition, and the licensor will not be liable
+to you for any damages arising out of these terms or the use
+or nature of the software, under any kind of legal claim.***
+
+## Definitions
+
+The **licensor** is the individual or entity offering these
+terms, and the **software** is the software the licensor makes
+available under these terms.
+
+**You** refers to the individual or entity agreeing to these
+terms.
+
+**Your company** is any legal entity, sole proprietorship,
+or other kind of organization that you work for, plus all
+organizations that have control over, are under the control
+of, or are under common control with that organization.
+**Control** means ownership of substantially all the assets of
+an entity, or the power to direct its management and policies
+by vote, contract, or otherwise.  Control can be direct or
+indirect.
+
+**Your licenses** are all the licenses granted to you for the
+software under these terms.
+
+**Use** means anything you do with the software requiring one
+of your licenses.
+
+---
+
+Required Notice: Copyright (c) 2026 Pinta AI

package/README.md

@@ -0,0 +1,200 @@
+# pinta-cc — Generic OTLP forwarder for Claude Code hook events
+
+Converts Claude Code hook events into OTLP/HTTP spans and forwards them to any OpenTelemetry-compatible collector. No Pinta CLI dependency. No identity check at plugin time. Vendor-neutral.
+
+## Features
+
+- **OTLP transport**: converts 11 hook event types into OTLP/HTTP `resourceSpans` and sends them via `POST {endpoint}/traces`
+- **Bronze flattening**: every top-level field of a hook event is flattened into `cc.<key>` span attributes
+- **ULID per-turn traceId**: `UserPromptSubmit` starts a new ULID-based trace; all subsequent hooks in the same turn share it
+- **Retry queue**: on transport failure, payloads are appended to `.plugin-data/failed-spans.jsonl` (cap 1000) and flushed on the next hook invocation
+- **Vendor-neutral**: any OTel-compatible collector works. Pinta Manager auto-configures the endpoint and token
+- **Identity at relay**: `member.identity.*` attributes are no longer attached at plugin time. Pinta Manager (or your own pipeline) attaches identity at the forwarding layer
+
+## Channels
+
+| Channel | Install path | Auto-update |
+|---------|-------------|-------------|
+| **Pinta Manager v0.2+** | Manager installs and configures automatically | Yes — on manager reconcile |
+| **Marketplace `pinta-cc@pinta-ai`** | `/plugin marketplace add awarecorp/pinta-cc` then `/plugin install pinta-cc@pinta-ai` | Yes — on Claude Code startup |
+
+## Installation
+
+### Pinta Manager (recommended for enterprise)
+
+Pinta Manager v0.2+ handles installation and configuration automatically. No manual steps required.
+
+### Marketplace
+
+```bash
+/plugin marketplace add awarecorp/pinta-cc
+/plugin install pinta-cc@pinta-ai
+```
+
+After installation, Claude Code automatically pulls new versions from the marketplace on every startup.
+
+### Direct from GitHub
+
+```bash
+claude plugin install github:awarecorp/pinta-cc
+```
+
+### Local development
+
+```bash
+git clone https://github.com/awarecorp/pinta-cc.git
+cd pinta-cc
+npm install && npm run build
+claude --plugin-dir .
+```
+
+## Configuration
+
+### userConfig (Claude Code plugin settings)
+
+| Setting | Description | Required |
+|---------|-------------|----------|
+| `endpoint` | OTLP/HTTP traces endpoint. Pinta Manager auto-fills. OSS: any OTel collector URL | Yes |
+| `api_key` | Token sent as `x-pinta-relay-token` header. Pinta Manager auto-fills | Conditional |
+
+### Pinta Manager scenario
+
+Pinta Manager v0.2+ injects `CLAUDE_PLUGIN_OPTION_ENDPOINT` and `CLAUDE_PLUGIN_OPTION_API_KEY` automatically via Claude Code's `settings.json`. No manual configuration needed.
+
+### OSS / direct scenario
+
+Set `endpoint` to your OTLP collector URL (e.g. `http://localhost:4318`) and `api_key` to whatever token your collector expects. The token is sent as `x-pinta-relay-token`.
+
+For collectors that need a different auth header, set `OTEL_EXPORTER_OTLP_HEADERS` directly in your environment — this overrides the `api_key` userConfig:
+
+```bash
+export OTEL_EXPORTER_OTLP_ENDPOINT=https://collector.example.com
+export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer <token>"
+```
+
+### OTel env var precedence
+
+The plugin reads OTel env vars directly. `CLAUDE_PLUGIN_OPTION_*` env vars (set by Claude Code from userConfig) are bridged to their `OTEL_EXPORTER_OTLP_*` equivalents **only when the OTel var is not already set**. Explicit `OTEL_EXPORTER_OTLP_*` always win.
+
+| Plugin userConfig | Bridged to |
+|------------------|-|
+| `CLAUDE_PLUGIN_OPTION_ENDPOINT` | `OTEL_EXPORTER_OTLP_ENDPOINT` |
+| `CLAUDE_PLUGIN_OPTION_API_KEY` | `OTEL_EXPORTER_OTLP_HEADERS=x-pinta-relay-token=<key>` |
+
+## Span attribute conventions
+
+### Resource attributes
+
+| Attribute | Value |
+|-----------|-------|
+| `service.name` | `"claude-code"` |
+| `service.version` | Claude Code CLI version |
+| `telemetry.sdk.name` | `"pinta-cc"` |
+| `telemetry.sdk.version` | Plugin version |
+| `process.pid` | Hook process PID |
+| `process.owner` | OS username |
+| `host.name` | Machine hostname |
+| `host.arch` | CPU architecture |
+
+Note: `member.identity.*` attributes are **not** attached at plugin time (moved to relay layer).
+
+### Span attributes
+
+| Attribute | Value |
+|-----------|-------|
+| `ingest.type` | `"cc"` (discriminator for aware-backend parser) |
+| `cc.hook` | Hook event name (e.g. `PreToolUse`) |
+| `cc.<key>` | All other top-level hook event fields (Bronze flattening) |
+
+## Architecture
+
+```
+src/
+├── index.ts              # Entry point: env-bridge → stdin parse → handler routing
+├── core/
+│   ├── env-bridge.ts     # CLAUDE_PLUGIN_OPTION_* → OTEL_EXPORTER_OTLP_* alias
+│   ├── types.ts          # Hook event types, type guards, skip-list
+│   ├── config.ts         # loadConfig() + hasOtlpEndpoint()
+│   ├── otlp.ts           # OTLP payload builder + Bronze flattening + ULID→traceId
+│   ├── transport.ts      # POST {endpoint}/traces (5s timeout, reads OTel env at call time)
+│   ├── retry-queue.ts    # File-based JSONL queue (cap 1000, 30s stale lock TTL)
+│   ├── trace.ts          # traceId management (ULID, file-based sharing)
+│   ├── identity.ts       # Empty stub (identity attribution moved to relay)
+│   └── redact.ts         # Tier-1 redaction + Tier-3 truncation
+└── handlers/
+    ├── pre-tool-use.ts   # flush → currentTrace → buildOtlpPayload → send → exit 0
+    ├── post-tool-use.ts
+    ├── user-prompt.ts    # flush → newTrace → buildOtlpPayload → send → exit 0
+    ├── session.ts
+    ├── subagent.ts
+    ├── stop.ts
+    ├── permission.ts
+    └── default.ts        # Notification, TaskCreated, TaskCompleted → exit 0 immediately
+```
+
+## Event flow
+
+```
+UserPromptSubmit (newTrace() → POST /traces)
+  → PreToolUse (currentTrace() → POST /traces)
+  → PostToolUse (currentTrace() → POST /traces)
+  → ...
+UserPromptSubmit (next turn, new traceId)
+  → ...
+```
+
+Each hook invocation spawns a fresh Node process. One hook = one OTLP span = one `resourceSpans` entry. Retry queue flush batches multiple spans into a single body.
+
+## Captured events (11)
+
+PreToolUse, PostToolUse, PostToolUseFailure, UserPromptSubmit, SessionStart, SessionEnd, PermissionRequest, PermissionDenied, SubagentStart, SubagentStop, Stop
+
+## Skipped events (3, exit 0 immediately)
+
+Notification, TaskCreated, TaskCompleted
+
+## Development
+
+```bash
+npm install
+npm run build         # tsc → dist/
+npm test              # vitest run
+npm run mock-server   # Generic OTLP collector at http://localhost:3000
+```
+
+### Local integration test
+
+```bash
+# Terminal 1: start the mock OTLP collector
+npm run mock-server
+
+# Terminal 2: run Claude Code with the plugin
+CLAUDE_PLUGIN_OPTION_ENDPOINT=http://localhost:3000 \
+CLAUDE_PLUGIN_OPTION_API_KEY=test-token \
+claude --plugin-dir .
+```
+
+Open `http://localhost:3000` to inspect captured spans.
+
+## BREAKING CHANGES from 1.1.x
+
+| What changed | 1.1.x | 1.2.x | Migration |
+|---|---|---|---|
+| Pinta CLI dependency | Required (`pinta login`) | Removed | Nothing; Pinta Manager or direct OTel env |
+| `endpoint` meaning | Pinta backend URL | Any OTLP collector URL | Update to your collector's `/v1/traces` or equivalent |
+| `api_key` meaning | Pinta backend API key (`x-api-key` header) | Relay token (`x-pinta-relay-token` header) | Pinta Manager: automatic. Standalone: update token |
+| Identity attributes | `member.identity.id/email` in resource attrs | Removed | Attach at your collector/forwarder layer |
+| PreToolUse fail-close | Exit 2 (deny) when identity unresolved | Removed — always exit 0 | No action needed |
+| `src/enterprise/` | Present | Removed | No action needed |
+
+**Pinta Manager users:** No action required. Manager v0.2 auto-injects config on next reconcile.
+
+**Marketplace users:** Auto-updated on next Claude Code startup. Update `endpoint` userConfig to your OTLP collector URL if you manage your own pipeline.
+
+**Direct env var users:** Replace `CLAUDE_PLUGIN_OPTION_API_KEY` token semantics and ensure your collector accepts `x-pinta-relay-token`, or set `OTEL_EXPORTER_OTLP_HEADERS=Authorization=Bearer <token>` directly.
+
+## License
+
+[PolyForm Noncommercial 1.0.0](https://polyformproject.org/licenses/noncommercial/1.0.0) — see [LICENSE](LICENSE).
+
+Commercial use is **not permitted** under this license. Noncommercial use (personal projects, research, educational institutions, nonprofits, government) is allowed. For a commercial license, please contact Pinta AI.

package/dist/core/config.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Plugin config — ONLY the bits we actually use after v1.2.
+ * Endpoint/headers come from OTEL_EXPORTER_OTLP_* env vars (set by
+ * env-bridge.ts at process startup) — they are NOT in this struct.
+ */
+export interface PintaConfig {
+    pluginRoot: string;
+    pluginData: string;
+    tracePath: string;
+}
+export declare function loadConfig(): PintaConfig;
+/** Returns true if OTel endpoint is configured (signal to silently disable telemetry). */
+export declare function hasOtlpEndpoint(): boolean;

package/dist/core/config.js

@@ -0,0 +1,22 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadConfig = loadConfig;
+exports.hasOtlpEndpoint = hasOtlpEndpoint;
+const path_1 = __importDefault(require("path"));
+function loadConfig() {
+    const pluginRoot = process.env.CLAUDE_PLUGIN_ROOT || process.cwd();
+    const pluginData = process.env.CLAUDE_PLUGIN_DATA || path_1.default.join(pluginRoot, ".plugin-data");
+    return {
+        pluginRoot,
+        pluginData,
+        tracePath: path_1.default.join(pluginData, "trace.json"),
+    };
+}
+/** Returns true if OTel endpoint is configured (signal to silently disable telemetry). */
+function hasOtlpEndpoint() {
+    return Boolean(process.env.OTEL_EXPORTER_OTLP_ENDPOINT);
+}
+//# sourceMappingURL=config.js.map

package/dist/core/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":";;;;;AAaA,gCASC;AAGD,0CAEC;AA3BD,gDAAwB;AAaxB,SAAgB,UAAU;IACxB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACnE,MAAM,UAAU,GACd,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAC1E,OAAO;QACL,UAAU;QACV,UAAU;QACV,SAAS,EAAE,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,SAAgB,eAAe;IAC7B,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;AAC1D,CAAC"}

package/dist/core/env-bridge.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Bridge Claude Code's userConfig env vars (CLAUDE_PLUGIN_OPTION_*) to the
+ * OTel SDK standard env vars (OTEL_EXPORTER_OTLP_*).
+ *
+ * Claude Code maps each plugin.json `userConfig.<key>` to a corresponding
+ * `CLAUDE_PLUGIN_OPTION_<KEY>` env var on hook spawn. We keep the user-
+ * facing names friendly (`endpoint`, `api_key`) and translate them into the
+ * canonical OTel env names so transport.ts (and any future OTel SDK adoption)
+ * can read them via the OTel-spec names.
+ *
+ * Pinta Manager auto-injects `CLAUDE_PLUGIN_OPTION_*` via Claude Code's
+ * settings.json. OSS users fill them in via the `/plugin install` UI.
+ *
+ * Existing OTEL_EXPORTER_OTLP_* env vars take precedence (explicit override).
+ */
+export declare function bridgeUserConfigToOtelEnv(): void;

package/dist/core/env-bridge.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.bridgeUserConfigToOtelEnv = bridgeUserConfigToOtelEnv;
+/**
+ * Bridge Claude Code's userConfig env vars (CLAUDE_PLUGIN_OPTION_*) to the
+ * OTel SDK standard env vars (OTEL_EXPORTER_OTLP_*).
+ *
+ * Claude Code maps each plugin.json `userConfig.<key>` to a corresponding
+ * `CLAUDE_PLUGIN_OPTION_<KEY>` env var on hook spawn. We keep the user-
+ * facing names friendly (`endpoint`, `api_key`) and translate them into the
+ * canonical OTel env names so transport.ts (and any future OTel SDK adoption)
+ * can read them via the OTel-spec names.
+ *
+ * Pinta Manager auto-injects `CLAUDE_PLUGIN_OPTION_*` via Claude Code's
+ * settings.json. OSS users fill them in via the `/plugin install` UI.
+ *
+ * Existing OTEL_EXPORTER_OTLP_* env vars take precedence (explicit override).
+ */
+function bridgeUserConfigToOtelEnv() {
+    if (process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT && !process.env.OTEL_EXPORTER_OTLP_ENDPOINT) {
+        process.env.OTEL_EXPORTER_OTLP_ENDPOINT = process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT;
+    }
+    if (process.env.CLAUDE_PLUGIN_OPTION_API_KEY && !process.env.OTEL_EXPORTER_OTLP_HEADERS) {
+        process.env.OTEL_EXPORTER_OTLP_HEADERS =
+            `x-pinta-relay-token=${process.env.CLAUDE_PLUGIN_OPTION_API_KEY}`;
+    }
+}
+//# sourceMappingURL=env-bridge.js.map

package/dist/core/env-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-bridge.js","sourceRoot":"","sources":["../../src/core/env-bridge.ts"],"names":[],"mappings":";;AAeA,8DAQC;AAvBD;;;;;;;;;;;;;;GAcG;AACH,SAAgB,yBAAyB;IACvC,IAAI,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC;QAC1F,OAAO,CAAC,GAAG,CAAC,2BAA2B,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;IACtF,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,CAAC;QACxF,OAAO,CAAC,GAAG,CAAC,0BAA0B;YACpC,uBAAuB,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,CAAC;IACtE,CAAC;AACH,CAAC"}

package/dist/core/identity.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/identity.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=identity.js.map

package/dist/core/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/core/identity.ts"],"names":[],"mappings":""}

package/dist/core/otlp.d.ts

@@ -0,0 +1,57 @@
+import type { BaseEvent } from "./types.js";
+export interface OtlpAttribute {
+    key: string;
+    value: {
+        stringValue: string;
+    } | {
+        intValue: number;
+    } | {
+        doubleValue: number;
+    } | {
+        boolValue: boolean;
+    };
+}
+export interface OtlpSpan {
+    traceId: string;
+    spanId: string;
+    name: string;
+    kind: number;
+    startTimeUnixNano: string;
+    endTimeUnixNano: string;
+    attributes: OtlpAttribute[];
+}
+export interface ResourceSpans {
+    resource: {
+        attributes: OtlpAttribute[];
+    };
+    scopeSpans: Array<{
+        scope: {
+            name: string;
+            version: string;
+        };
+        spans: OtlpSpan[];
+    }>;
+}
+export interface OtlpPayload {
+    resourceSpans: ResourceSpans[];
+}
+/**
+ * Convert a 26-char Crockford ULID into 32 lowercase hex chars (16 bytes)
+ * suitable for an OTLP traceId. Decoding is straightforward because each
+ * Crockford char carries 5 bits and 26 chars = 130 bits; we keep the low
+ * 128 bits (the spec already pads timestamp+randomness into 128 bits).
+ */
+export declare function ulidToTraceId(ulid: string): string;
+/** Generate a fresh 16-hex-char (8-byte) span ID. */
+export declare function newSpanId(): string;
+export declare function buildOtlpPayload(args: {
+    event: BaseEvent;
+    traceId: string;
+    now?: number;
+}): OtlpPayload;
+/**
+ * Combine multiple per-hook payloads into a single OTLP payload by
+ * concatenating their resourceSpans arrays. aware-backend's parser
+ * iterates over resourceSpans natively.
+ */
+export declare function mergeBatch(payloads: OtlpPayload[]): OtlpPayload;