@superblocksteam/telemetry 2.0.0-SNAPSHOT.329be19cb7ca892b

package/LICENSE.txt

@@ -0,0 +1,87 @@
+Superblocks Community Software License
+
+This Superblocks Community License Agreement (the “Agreement”) sets forth the terms on which DayZero
+Software, Inc. d/b/a Superblocks (“Superblocks”) makes available certain software made available by Superblocks
+under this Agreement (the “Software”). BY INSTALLING, DOWNLOADING, ACCESSING, USING OR
+DISTRIBUTING ANY OF THE SOFTWARE, YOU AGREE TO THE TERMS AND CONDITIONS OF THIS
+AGREEMENT.IF YOU DO NOT AGREE TO SUCH TERMS AND CONDITIONS, YOU MUST NOT USE THE
+SOFTWARE. IF YOU ARE RECEIVING THE SOFTWARE ON BEHALF OF A LEGAL ENTITY, YOU
+REPRESENT AND WARRANT THAT YOU HAVE THE ACTUAL AUTHORITY TO AGREE TO THE
+TERMS AND CONDITIONS OF THIS AGREEMENT ON BEHALF OF SUCH ENTITY. “Licensee” means you,
+an individual, or the entity on whose behalf you are receiving the Software.
+
+1. LICENSE GRANT AND CONDITIONS.
+
+1.1 License. Subject to the terms and conditions of this Agreement, Superblocks hereby grants to Licensee a
+non-exclusive, royalty-free, worldwide, non-transferable, non-sublicenseable license during the term of this
+Agreement to: (a) use the Software; (b) prepare modifications and derivative works of the Software; (c)
+distribute the Software (including without limitation in source code or object code form); and (d) reproduce
+copies of the Software (the “License”). Licensee is not granted the right to, and Licensee shall not, exercise the
+License for an Excluded Purpose. For purposes of this Agreement, “Excluded Purpose” means making
+available any software-as-a-service, platform-as-a-service, infrastructure-as-a-service or other similar online
+service that competes with Superblocks’ products or services.
+
+1.2 Conditions. In consideration of the License, Licensee’s distribution of the Software is subject to the
+following conditions:
+
+  a. Licensee must cause any Software modified by Licensee to carry prominent notices stating that Licensee
+  modified the Software.
+  b. On each Software copy, Licensee shall reproduce and not remove or alter all Superblocks or third party
+  copyright or other proprietary notices contained in the Software, and Licensee must provide the notice
+  below with each copy.
+
+  “This software is made available by DayZero Software, Inc. d/b/a Superblocks, under the terms of the
+  Superblocks Community License Agreement. © 2022 DayZero Software, Inc.”
+
+1.3 Licensee Modifications. Licensee may add its own copyright notices to modifications made by Licensee
+and may provide additional or different license terms and conditions for use, reproduction, or distribution of
+Licensee’s modifications. While redistributing the Software or modifications thereof, Licensee may choose to
+offer, for a fee or free of charge, support, warranty, indemnity, or other obligations. Licensee, and not
+Superblocks, will be responsible for any such obligations.
+
+1.4 No Sublicensing. The License does not include the right to sublicense the Software, however, each recipient
+to which Licensee provides the Software may exercise the Licenses so long as such recipient agrees to the terms
+and conditions of this Agreement.
+
+2. TERM AND TERMINATION. This Agreement will continue unless and until earlier terminated as set forth
+herein. If Licensee breaches any of its conditions or obligations under this Agreement, this Agreement will
+terminate automatically and the License will terminate automatically and permanently.
+
+3. INTELLECTUAL PROPERTY. As between the parties, Superblocks will retain all right, title, and interest in
+the Software, and all intellectual property rights therein. Superblocks hereby reserves all rights not expressly
+granted to Licensee in this Agreement. Superblocks hereby reserves all rights in its trademarks and service
+marks, and no licenses therein are granted in this Agreement.
+
+4. DISCLAIMER. SUPERBLOCKS HEREBY DISCLAIMS ANY AND ALL WARRANTIES AND
+CONDITIONS, EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, AND SPECIFICALLY
+DISCLAIMS ANY WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR
+PURPOSE, WITH RESPECT TO THE SOFTWARE.
+
+5. LIMITATION OF LIABILITY. SUPERBLOCKS WILL NOT BE LIABLE FOR ANY DAMAGES OF
+ANY KIND, INCLUDING BUT NOT LIMITED TO, LOST PROFITS OR ANY CONSEQUENTIAL,
+SPECIAL, INCIDENTAL, INDIRECT, OR DIRECT DAMAGES, HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, ARISING OUT OF THIS AGREEMENT. THE FOREGOING SHALL APPLY TO
+THE EXTENT PERMITTED BY APPLICABLE LAW.
+
+6. GENERAL.
+
+6.1  Governing Law. This Agreement will be governed by and interpreted in accordance with the laws of the
+state of California, without reference to its conflict of laws principles. If Licensee is located within the United
+States, all disputes arising out of this Agreement are subject to the exclusive jurisdiction of courts located in San
+Mateo County, California. USA. If Licensee is located outside of the United States, any dispute, controversy or
+claim arising out of or relating to this Agreement will be referred to and finally determined by arbitration in
+accordance with the JAMS International Arbitration Rules. The tribunal will consist of one neutral arbitrator.
+The place of arbitration will be Palo Alto, California. The language to be used in the arbitral proceedings will be
+English. Judgment upon the award rendered by the arbitrator may be entered in any court having jurisdiction
+thereof.
+
+6.2.  Assignment. Licensee may not assign its rights under this Agreement to any third party. Superblocks may
+freely assign its rights under this Agreement to any third party.
+
+6.3.  Other.  This Agreement is the entire agreement between the parties regarding the subject matter hereof.
+No amendment or modification of this Agreement will be valid or binding upon the parties unless made in
+writing and signed by the duly authorized representatives of both parties. In the event that any provision,
+including without limitation any condition, of this Agreement is held to be unenforceable, this Agreement and
+all licenses and rights granted hereunder will immediately terminate. Waiver by Superblocks of a breach of any
+provision of this Agreement or the failure by Superblocks to exercise any right hereunder will not be construed
+as a waiver of any subsequent breach of that right or as a waiver of any other right.

package/README.md

@@ -0,0 +1,298 @@
+# @superblocksteam/telemetry
+
+Canonical telemetry bootstrap package for all Superblocks services. This package provides policy-aware OpenTelemetry initialization with tier-based routing and sanitization.
+
+## Overview
+
+This is the **ONLY approved way** to initialize OpenTelemetry in Superblocks services. Direct usage of `NodeSDK` or `WebTracerProvider` outside this package is prohibited.
+
+- **Logging**: Policy-aware log export (severity filtering, sanitization). See [docs/LOGGING.md](docs/LOGGING.md) for what to log at each level and forbidden fields.
+
+## Tiered Telemetry Model
+
+| Tier       | Description                                                    | Egress                  |
+| ---------- | -------------------------------------------------------------- | ----------------------- |
+| **Tier 1** | Full fidelity debugging (code, prompts, stack traces)          | Local only (cloud-prem) |
+| **Tier 2** | Sanitized operational telemetry (latency, errors, token usage) | Exported by default     |
+| **Tier 3** | AI experience telemetry (prompts, responses, quality signals)  | Exported by default     |
+
+## Usage
+
+### Node.js Services
+
+```typescript
+import { initNodeTelemetry } from "@superblocksteam/telemetry/node";
+import { getDefaultPolicy, DeploymentType } from "@superblocksteam/shared";
+
+const policy = getDefaultPolicy(DeploymentType.CLOUD_PREM);
+
+const telemetry = initNodeTelemetry(
+  {
+    serviceName: "my-service",
+    serviceVersion: "1.0.0",
+    environment: process.env.NODE_ENV ?? "development",
+    otlpUrl: process.env.OTEL_EXPORTER_OTLP_ENDPOINT,
+  },
+  policy,
+);
+
+// Graceful shutdown
+process.on("SIGTERM", async () => {
+  await telemetry.shutdown();
+});
+```
+
+### Browser
+
+```typescript
+import { initBrowserTelemetry } from "@superblocksteam/telemetry/browser";
+import { getDefaultPolicy, DeploymentType } from "@superblocksteam/shared";
+
+const policy = getDefaultPolicy(DeploymentType.CLOUD);
+
+initBrowserTelemetry(
+  {
+    serviceName: "superblocks-ui",
+    serviceVersion: "1.0.0",
+    environment: "production",
+    otlpUrl: "https://app.superblocks.com/api/v1/traces",
+  },
+  policy,
+);
+```
+
+### Testing
+
+```typescript
+import { initTestTelemetry } from "@superblocksteam/telemetry/testing";
+
+describe("MyService", () => {
+  const { spanExporter, reset } = initTestTelemetry();
+
+  beforeEach(() => reset());
+
+  it("creates expected spans", async () => {
+    await myService.doSomething();
+
+    const spans = spanExporter.getSpans();
+    expect(spans).toHaveLength(1);
+    expect(spans[0].name).toBe("doSomething");
+  });
+
+  it("does not leak Tier 1 data", async () => {
+    await myService.processWithSensitiveData();
+
+    spanExporter.assertNoAttribute("prompt", /.*/);
+    spanExporter.assertNoAttribute("code", /.*/);
+  });
+});
+```
+
+## Tier Policy Hints
+
+Use tier policy hints to inform the Collector how to route specific spans. This is useful when the SDK knows something the Collector can't infer from attributes alone.
+
+```typescript
+import { trace } from "@opentelemetry/api";
+import {
+  markSensitive,
+  markForAIAnalysis,
+  markDebugOnly,
+} from "@superblocksteam/telemetry";
+
+const tracer = trace.getTracer("my-service");
+
+// Span containing secrets — Tier 1 only, never exported
+tracer.startActiveSpan("decrypt_customer_secret", (span) => {
+  markSensitive(span);
+  // ... decrypt operation
+  span.end();
+});
+
+// GenAI span for quality analysis — include in Tier 3
+tracer.startActiveSpan("gen_ai.chat", (span) => {
+  markForAIAnalysis(span);
+  span.setAttribute("gen_ai.system", "anthropic");
+  // ... LLM call
+  span.end();
+});
+
+// High-cardinality debug span — skip export (cost control)
+tracer.startActiveSpan("debug.cache_lookup", (span) => {
+  markDebugOnly(span);
+  span.setAttribute("cache.key", cacheKey);
+  // ... lookup
+  span.end();
+});
+```
+
+### Available Hints
+
+| Helper                    | Hint Value      | Effect                           |
+| ------------------------- | --------------- | -------------------------------- |
+| `markSensitive(span)`     | `tier1_only`    | Tier 1 only, skip Tier 2/3       |
+| `markForAIAnalysis(span)` | `include_tier3` | Include in Tier 3 (AI analytics) |
+| `markDebugOnly(span)`     | `skip_export`   | Tier 1 only, skip all export     |
+
+You can also set hints directly:
+
+```typescript
+import {
+  TIER_HINT_ATTRIBUTE,
+  TierPolicyHint,
+} from "@superblocksteam/telemetry";
+
+span.setAttribute(TIER_HINT_ATTRIBUTE, TierPolicyHint.TIER1_ONLY);
+```
+
+## NPM Registry Sanitization
+
+Telemetry attributes describing npm install attempts (`registry_host`,
+`package_name`, `npm.outcome`) ship out of cloud-prem and must be sanitized
+**at the emit boundary** so customer infrastructure hostnames and registry
+tokens never appear in exported traces, metrics, logs, or audit events.
+Every emitter (the `NpmRegistryEmitter`, P6.3 audit events, any future
+runner) MUST pass values through the helpers in
+[`npm-registry/sanitize.ts`](src/npm-registry/sanitize.ts); the
+dashboard/collector layer is not the right place to sanitize.
+
+The metrics emitter and the four named OTel spans live alongside it in
+[`src/npm-registry/`](src/npm-registry/) (`emitter.ts`, `spans.ts`). The
+emitter defines its own **per-path** short outcome enums
+(`install`/`probe`/`lookup`/`config`, e.g. `auth_failed`) — the long-form
+`NPM_OUTCOMES` below stays as the **audit-event** surface
+(`registry_auth_failed`); the divergence is intentional until an explicit
+audit-schema migration. `registry_host` is bucketed on the metric/span path
+but kept **raw** (guarded by `auditNpmRegistryHost`) on per-org log lines.
+
+| Attribute             | Rule                                                                                                                                                                                                                                 | Helper                                                |
+| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------- |
+| `registry_host`       | Bucket to `public_npm` / `private` / `unknown`. Raw hostnames never ship.                                                                                                                                                            | `bucketNpmRegistryHost`                               |
+| `package_name_bucket` | Metric destinations: bucket to `public` / `private` / `unknown` / `invalid`. Cardinality-safe; never carries the raw name.                                                                                                           | `bucketNpmPackageName` (or `npmAttributesForMetric`)  |
+| `package_name`        | Audit/log destinations only: emit verbatim (lowercased) if it parses as a valid npm name and is not a known-secret value pattern; else `invalid`.                                                                                    | `sanitizeNpmPackageName` (or `npmAttributesForAudit`) |
+| `npm.outcome`         | Audit-surface closed allowlist of 7 values; unknown coerces to `other`. (Metric paths use the shorter per-path enums in `emitter.ts`.)                                                                                               | `normalizeNpmOutcome`                                 |
+| Registry token        | Never an attribute. Bucketing strips it from URLs; `tier2-traces` lists token-shaped attribute NAMES as forbidden and `containsForbiddenPattern` rejects token-shaped VALUES (including `npm_<36+>`) smuggled into the package name. | n/a                                                   |
+
+### `registry_host`
+
+```
+public_npm | private | unknown
+```
+
+Only `registry.npmjs.org` (case-insensitive, port/path stripped) maps to
+`public_npm`. Everything else — customer Artifactory, JFrog, GitHub
+Packages, anything reachable behind a customer VPN — maps to `private`.
+Empty input or a URL that fails to parse maps to `unknown`. GitHub
+Packages (`npm.pkg.github.com`) is intentionally `private`: customers
+deploy it as their private registry, and a `private` bucket avoids the
+false negative of treating their setup as public.
+
+### `package_name` — decision
+
+The right shape is destination-dependent, so the helper exposes both a
+metric-safe bucket and an audit-safe verbatim form. Emitters pick the
+wrapper for their destination; the type system enforces that metric
+emitters never see the raw name.
+
+**Metric destinations — `package_name_bucket`**
+
+Metric destinations (OTel metric attributes, Datadog tags, span
+attributes that flow into shared metric pipelines) get a four-value
+bucket:
+
+```
+public | private | unknown | invalid
+```
+
+- Cardinality: an OTel metric tagged with the raw package name is
+  unbounded — each unique install attempt creates a new time series, and
+  on Datadog that translates directly into custom-metric billing.
+- Privacy: metric destinations are typically shared across orgs and
+  retained centrally. Emitting `@customer-acme/billing-engine` as a
+  metric tag leaks customer-internal package naming to anyone with read
+  access to the metric store. Bucketing strips that leak at the source.
+- Mapping: a valid name on `public_npm` is `public`; a valid name on a
+  private registry is `private`; a valid name with no/`unknown`
+  registry is `unknown`; anything that fails the npm name spec or
+  matches a known-secret value pattern is `invalid`.
+
+**Audit/log destinations — `package_name`**
+
+Audit events and internal logs (per-org event streams, lower volume,
+retained for forensic value) emit the lowercased name verbatim, gated
+by a value-pattern guardrail. The forensic signal — "which package
+failed for org X?" — is exactly the workflow these destinations exist
+to serve; bucketing would destroy it.
+
+- Package names are not credentials. The customer already shares them
+  with us via app code (which we render and store), install logs, and
+  the CVE-visibility surface in the parent project (AGENT-2579).
+- Any input matching a known-secret value pattern
+  (`containsForbiddenPattern` from the tier-2 traces contract — GitHub
+  PATs, AWS keys, JWTs, Bearer tokens, PEM blocks, **npm registry
+  tokens (`npm_<36+>`)**, etc.) is rejected with `invalid`. This is a
+  developer-error backstop, not a primary defense; the primary defense
+  is that emitters never pass arbitrary strings as `package_name` in
+  the first place.
+- Names that fail the npm name spec (`lodash@4.17.21`, `./local`,
+  `github:foo/bar`, anything with whitespace or shell metacharacters)
+  are rejected with `invalid` — those aren't package names, they're
+  install specs, and emitting them as a "package name" would mis-tag
+  the audit event.
+
+If a future customer has a contractual requirement to redact even
+audit-event names, tighten `sanitizeNpmPackageName` (e.g. hash scoped
+names) rather than adding a parallel emitter — the goal is one place to
+argue about the policy.
+
+### `npm.outcome`
+
+Closed enum, allowlist explicit. The first values match the structured
+error from APPS-4179 (P1.2) and APPS-4195 (P1.5); `tls_failed` was added in
+APPS-4381; `other` is the catch-all so dashboards never see free-form
+strings.
+
+```
+success | not_in_registry | registry_unreachable | registry_auth_failed
+       | tls_failed | lockfile_url_mismatch | other
+```
+
+This long-form enum is the **audit-event** surface. The metric emitter
+(APPS-4378) uses shorter per-path enums in
+[`emitter.ts`](src/npm-registry/emitter.ts) — install `auth_failed` /
+`unreachable`, probe `ok` / `invalid_response`, etc. — and normalizes the
+long forms to them. Coercion happens at the emit boundary — never at the
+dashboard.
+
+### Source-of-truth + acceptance
+
+**Decision (APPS-4190, signed off in #19574):** `package_name` is destination-dependent — bucketed (`package_name_bucket`) for metric destinations, verbatim-lowercased for audit/log destinations. Future P6.2/P6.3 emitters do NOT re-argue this; tighten the helper instead.
+
+- Helper: [`packages/telemetry/src/npm-registry/sanitize.ts`](src/npm-registry/sanitize.ts)
+- Tests: [`sanitize.test.ts`](src/npm-registry/sanitize.test.ts) — covers each rule + a token-leak regression that asserts no token-bearing input ever appears in output
+- Forbidden-attribute backstop: `npm.token` / `npm_token` / `npm.registry_token` / `registry_token` in `FORBIDDEN_TIER_2_SPAN_ATTRIBUTES`
+- Ticket: [APPS-4190](https://linear.app/superblocks/issue/APPS-4190) — referenced from downstream tickets (APPS-4189 metrics, APPS-4191 audit events)
+
+## Key Principles
+
+1. **Policy Required** — Cannot initialize telemetry without a `TelemetryPolicy`
+2. **Tier Enforcement** — Exporters are automatically enabled/disabled based on policy
+3. **Sanitization at Source** — Tier 2/3 payloads are sanitized before export
+4. **Fire-and-Forget** — Export failures never block core request paths
+5. **Consistent Resources** — All services emit standardized resource attributes
+
+## Package Structure
+
+```
+@superblocksteam/telemetry
+├── /node          # Node.js bootstrap (initNodeTelemetry)
+├── /browser       # Browser bootstrap (initBrowserTelemetry)
+├── /testing       # Test utilities (in-memory exporters)
+└── /common        # Shared utilities (resource, router, sanitizer)
+```
+
+## Related Documentation
+
+- [O11y Refactor Project](../../engineering/projects/o11y-refactor/README.md)
+- [Telemetry Policy Schema](../../engineering/projects/o11y-refactor/epics/epic-a1-telemetry-policy.md)
+- [Tier 2 Traces Contract](https://github.com/superblocksteam/engineering/blob/main/projects/o11y-refactor/contracts/tier2-traces.v0.2.0.json)

package/dist/browser/console-logging.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Console Log Attributes
+ *
+ * Used to attach structured key-value metadata to console.* calls so the
+ * EarlyConsoleBuffer (and the live OTel patch) can forward them as OTEL log
+ * record attributes.
+ *
+ * Usage:
+ *   import { consoleLogAttributes } from '@superblocksteam/telemetry/browser';
+ *   console.info("user loaded", consoleLogAttributes({ userId: "abc123" }));
+ */
+export declare class ConsoleLogAttributes {
+    readonly attributes: Record<string, unknown>;
+    constructor(attributes: Record<string, unknown>);
+    static create(attrs: Record<string, unknown>): ConsoleLogAttributes;
+}
+export declare const consoleLogAttributes: (attrs: Record<string, unknown>) => ConsoleLogAttributes;
+//# sourceMappingURL=console-logging.d.ts.map

package/dist/browser/console-logging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"console-logging.d.ts","sourceRoot":"","sources":["../../src/browser/console-logging.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,qBAAa,oBAAoB;aACH,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAAnC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE/D,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,oBAAoB;CAGpE;AAGD,eAAO,MAAM,oBAAoB,GAC/B,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,oBAEF,CAAC"}

package/dist/browser/console-logging.js

@@ -0,0 +1,32 @@
+"use strict";
+/**
+ * Console Log Attributes
+ *
+ * Used to attach structured key-value metadata to console.* calls so the
+ * EarlyConsoleBuffer (and the live OTel patch) can forward them as OTEL log
+ * record attributes.
+ *
+ * Usage:
+ *   import { consoleLogAttributes } from '@superblocksteam/telemetry/browser';
+ *   console.info("user loaded", consoleLogAttributes({ userId: "abc123" }));
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.consoleLogAttributes = exports.ConsoleLogAttributes = void 0;
+// The attributes that should be passed to OTEL logs as part of the message context.
+// To use, create an instance of this class and pass it as an argument to console.* methods.
+class ConsoleLogAttributes {
+    attributes;
+    constructor(attributes) {
+        this.attributes = attributes;
+    }
+    static create(attrs) {
+        return new ConsoleLogAttributes(attrs);
+    }
+}
+exports.ConsoleLogAttributes = ConsoleLogAttributes;
+// Convenience factory
+const consoleLogAttributes = (attrs) => {
+    return new ConsoleLogAttributes(attrs);
+};
+exports.consoleLogAttributes = consoleLogAttributes;
+//# sourceMappingURL=console-logging.js.map

package/dist/browser/console-logging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"console-logging.js","sourceRoot":"","sources":["../../src/browser/console-logging.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAEH,oFAAoF;AACpF,4FAA4F;AAC5F,MAAa,oBAAoB;IACH;IAA5B,YAA4B,UAAmC;QAAnC,eAAU,GAAV,UAAU,CAAyB;IAAG,CAAC;IAEnE,MAAM,CAAC,MAAM,CAAC,KAA8B;QAC1C,OAAO,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;CACF;AAND,oDAMC;AAED,sBAAsB;AACf,MAAM,oBAAoB,GAAG,CAClC,KAA8B,EACR,EAAE;IACxB,OAAO,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC,CAAC;AAJW,QAAA,oBAAoB,wBAI/B"}

package/dist/browser/early-console-buffer.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Early Console Buffer
+ *
+ * Patches console.log/info/debug/warn/error as early as possible (before OTel
+ * initialises) to capture logs in a ring buffer. On OTel init, the buffer is
+ * flushed to the OTel Logger and all subsequent console calls are forwarded
+ * directly.
+ *
+ * IMPORTANT: Each patched method ALWAYS calls through to the original console
+ * method first, so downstream patchers (Datadog RUM, PostHog, etc.) that wrap
+ * console after us continue to receive every call.
+ */
+import { type Logger } from "@opentelemetry/api-logs";
+declare class EarlyConsoleBuffer {
+    private static instance;
+    private buffer;
+    private maxBufferSize;
+    private originalMethods;
+    private otelLogger;
+    private isPatched;
+    private disabled;
+    static getInstance(): EarlyConsoleBuffer;
+    /**
+     * Patch console methods immediately with buffering.
+     * Safe to call multiple times — subsequent calls are no-ops.
+     */
+    patchEarly(): void;
+    private patchMethod;
+    private bufferLog;
+    /**
+     * Disable the buffer without forwarding to OTel. Discards buffered entries
+     * and removes the buffering wrapper so subsequent console calls go straight
+     * to the original methods (no memory leak from the ever-growing ring buffer).
+     *
+     * Use this when log export is disabled (e.g. on-premise deployments) so the
+     * buffer-and-evict path doesn't run indefinitely.
+     */
+    disable(): void;
+    /**
+     * Called once OTel is ready. Flushes buffered entries then routes all future
+     * console calls directly to the OTel logger.
+     */
+    enableOpenTelemetry(otelLogger: Logger): void;
+    private flushBuffer;
+    private sendToOpenTelemetry;
+    private formatConsoleArgs;
+}
+export default EarlyConsoleBuffer;
+//# sourceMappingURL=early-console-buffer.d.ts.map

package/dist/browser/early-console-buffer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"early-console-buffer.d.ts","sourceRoot":"","sources":["../../src/browser/early-console-buffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,MAAM,EAAkB,MAAM,yBAAyB,CAAC;AAuBtE,cAAM,kBAAkB;IACtB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAqB;IAE5C,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,aAAa,CAAQ;IAE7B,OAAO,CAAC,eAAe,CAAgC;IACvD,OAAO,CAAC,UAAU,CAAiC;IACnD,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,QAAQ,CAAS;IAEzB,MAAM,CAAC,WAAW,IAAI,kBAAkB;IAOxC;;;OAGG;IACH,UAAU,IAAI,IAAI;IA4BlB,OAAO,CAAC,WAAW;IAkBnB,OAAO,CAAC,SAAS;IAOjB;;;;;;;OAOG;IACH,OAAO,IAAI,IAAI;IAqBf;;;OAGG;IACH,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAM7C,OAAO,CAAC,WAAW;IAwBnB,OAAO,CAAC,mBAAmB;IA8B3B,OAAO,CAAC,iBAAiB;CAkB1B;AAED,eAAe,kBAAkB,CAAC"}