@superblocksteam/telemetry 2.0.0-SNAPSHOT.329be19cb7ca892b

package/dist/node/init.js

@@ -0,0 +1,365 @@
+"use strict";
+/**
+ * Node.js Telemetry Bootstrap
+ *
+ * This is the ONLY approved way to initialize telemetry in Node.js services.
+ * Direct NodeSDK usage outside this package is prohibited.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initNodeTelemetry = initNodeTelemetry;
+exports.getTelemetryInstance = getTelemetryInstance;
+exports.isTelemetryInitialized = isTelemetryInitialized;
+exports.resetTelemetry = resetTelemetry;
+const api_1 = require("@opentelemetry/api");
+const api_logs_1 = require("@opentelemetry/api-logs");
+const context_async_hooks_1 = require("@opentelemetry/context-async-hooks");
+const core_1 = require("@opentelemetry/core");
+const exporter_logs_otlp_http_1 = require("@opentelemetry/exporter-logs-otlp-http");
+const exporter_metrics_otlp_http_1 = require("@opentelemetry/exporter-metrics-otlp-http");
+const exporter_trace_otlp_http_1 = require("@opentelemetry/exporter-trace-otlp-http");
+const sdk_logs_1 = require("@opentelemetry/sdk-logs");
+const sdk_metrics_1 = require("@opentelemetry/sdk-metrics");
+const sdk_node_1 = require("@opentelemetry/sdk-node");
+const sdk_trace_base_1 = require("@opentelemetry/sdk-trace-base");
+const tier2_traces_js_1 = require("../common/contracts/tier2-traces.js");
+const policy_evaluator_js_1 = require("../common/policy-evaluator.js");
+const resource_js_1 = require("../common/resource.js");
+const trace_sanitizer_js_1 = require("../common/trace-sanitizer.js");
+const policy_js_1 = require("../types/policy.js");
+const dynamic_attribute_processor_js_1 = require("./dynamic-attribute-processor.js");
+const resilient_exporter_js_1 = require("./exporters/resilient-exporter.js");
+const local_obs_mode_js_1 = require("./local-obs-mode.js");
+const log_processor_js_1 = require("./log-processor.js");
+const metrics_client_js_1 = require("./metrics-client.js");
+const sanitizing_processor_js_1 = require("./sanitizing-processor.js");
+const service_tracers_js_1 = require("./service-tracers.js");
+function getInstance() {
+    return globalThis.__superblocksNodeTelemetryInstance;
+}
+function setInstance(next) {
+    globalThis.__superblocksNodeTelemetryInstance = next;
+}
+/**
+ * Create a no-op telemetry instance for CI environments.
+ *
+ * IMPORTANT: We intentionally do NOT use NodeSDK here. NodeSDK.start()
+ * auto-configures OTLP exporters for traces, metrics, and logs from
+ * environment defaults (localhost:4318). During shutdown, these exporters
+ * try to flush to the non-existent collector, causing ECONNREFUSED errors
+ * that fail test suites even when all tests pass.
+ *
+ * Instead, we return a lightweight instance that uses the global OTel API
+ * (which returns no-op tracers/meters/loggers when no provider is registered).
+ */
+function createNoOpInstance(config, policy) {
+    const policyEvaluator = new policy_evaluator_js_1.TelemetryPolicyEvaluator(policy);
+    // Use a no-op meter for the metrics client
+    const defaultMeter = api_1.metrics.getMeter(config.serviceName, config.serviceVersion);
+    return {
+        sdk: undefined,
+        policyEvaluator,
+        // No-op mode has no SDK/exporter, so secondary services collapse to the
+        // global (no-op) tracer — options.serviceName is accepted but inert.
+        getTracer: (name, _options) => api_1.trace.getTracer(name ?? config.serviceName, config.serviceVersion),
+        getMeter: (name) => api_1.metrics.getMeter(name ?? config.serviceName, config.serviceVersion),
+        getLogger: (name) => api_logs_1.logs.getLogger(name ?? config.serviceName, config.serviceVersion),
+        metricsClient: new metrics_client_js_1.MetricsClient(defaultMeter),
+        shutdown: async () => {
+            // No-op: nothing to flush or shut down
+        },
+    };
+}
+/**
+ * Fallback logger for SanitizingSpanProcessor when config.logger is not provided.
+ * Forwards to console so processor messages are still visible.
+ */
+function createConsoleFallbackLogger() {
+    const log = (level) => (a, b) => {
+        if (typeof a === "string") {
+            if (level === "warn")
+                console.warn(a);
+            else
+                console.error(a);
+        }
+        else {
+            if (level === "warn")
+                console.warn(b ?? "", a);
+            else
+                console.error(b ?? "", a);
+        }
+    };
+    return {
+        error: log("error"),
+        warn: log("warn"),
+    };
+}
+/**
+ * Validate telemetry configuration.
+ *
+ * @param config - Configuration to validate
+ * @throws Error if configuration is invalid
+ */
+function validateNodeTelemetryConfig(config) {
+    if (!config.serviceName?.trim()) {
+        throw new Error("[Telemetry] serviceName is required and cannot be empty");
+    }
+    if (!config.serviceVersion?.trim()) {
+        throw new Error("[Telemetry] serviceVersion is required and cannot be empty");
+    }
+    if (!config.environment?.trim()) {
+        throw new Error("[Telemetry] environment is required and cannot be empty");
+    }
+    if (config.otlpUrl) {
+        try {
+            new URL(config.otlpUrl);
+        }
+        catch (error) {
+            throw new Error(`[Telemetry] Invalid otlpUrl: ${config.otlpUrl} (${error.message})`);
+        }
+    }
+}
+/**
+ * Initialize Node.js telemetry with policy enforcement.
+ *
+ * This is the ONLY approved way to initialize telemetry in Node.js services.
+ * Direct NodeSDK usage outside this package is prohibited.
+ *
+ * @param config - Service configuration
+ * @param policy - Telemetry policy (REQUIRED)
+ * @returns Telemetry instance with SDK and utilities
+ *
+ * @example
+ * ```typescript
+ * import { initNodeTelemetry } from '@superblocksteam/telemetry/node';
+ * import { getDefaultPolicy, DeploymentType } from '@superblocksteam/shared';
+ *
+ * const policy = getDefaultPolicy(DeploymentType.CLOUD_PREM);
+ * const telemetry = initNodeTelemetry({
+ *   serviceName: 'my-service',
+ *   serviceVersion: '1.0.0',
+ *   environment: 'production',
+ *   otlpUrl: 'http://localhost:4318',
+ * }, policy);
+ *
+ * const tracer = telemetry.getTracer();
+ * ```
+ */
+function initNodeTelemetry(config, policy) {
+    // Policy is required
+    if (!policy) {
+        throw new Error("[Telemetry] Policy is required. Cannot initialize telemetry without a policy.");
+    }
+    // Validate config
+    validateNodeTelemetryConfig(config);
+    // Return existing instance if already initialized
+    const existing = getInstance();
+    if (existing) {
+        // Warn if config differs from existing
+        const existingPolicy = existing.policyEvaluator.getPolicy();
+        if (existingPolicy.deploymentType !== policy.deploymentType) {
+            console.warn(`[Telemetry] Already initialized with different deployment type ` +
+                `(existing: ${existingPolicy.deploymentType}, requested: ${policy.deploymentType}). ` +
+                `Returning existing instance.`);
+        }
+        return existing;
+    }
+    // CI environment detection - use no-op telemetry
+    if (process.env.CI === "true") {
+        const ciMessage = "[Telemetry] CI environment detected, using no-op telemetry";
+        if (typeof config.logger?.info === "function") {
+            config.logger.info(ciMessage);
+        }
+        else {
+            console.debug(ciMessage);
+        }
+        const noOp = createNoOpInstance(config, policy);
+        setInstance(noOp);
+        return noOp;
+    }
+    const policyEvaluator = new policy_evaluator_js_1.TelemetryPolicyEvaluator(policy);
+    const resource = (0, resource_js_1.buildResource)(config);
+    // Validate resource has required attributes
+    (0, resource_js_1.validateResource)(resource);
+    // Track dropped spans for observability
+    let droppedSpans = 0;
+    const onDrop = (count, reason) => {
+        droppedSpans += count;
+        console.warn(`[Telemetry] Dropped ${count} spans (${reason}). Total dropped: ${droppedSpans}`);
+    };
+    // Create trace exporter if URL provided and Tier 2 export is enabled.
+    // Traces go through SanitizingSpanProcessor: only contract-compliant spans are exported.
+    // Use isExportEnabled (not canExport) - sampling applies at runtime, not initialization.
+    let spanProcessor;
+    if (config.otlpUrl &&
+        policyEvaluator.isExportEnabled(policy_js_1.TelemetryTier.TIER_2_OPERATIONAL)) {
+        const tier2Exporter = new resilient_exporter_js_1.ResilientExporter({
+            delegate: new exporter_trace_otlp_http_1.OTLPTraceExporter({
+                headers: config.otlpHeaders,
+                url: `${config.otlpUrl}/v1/traces`,
+            }),
+            onDrop,
+            logger: config.logger,
+        });
+        const hashConfig = config.traceSanitizerHashConfig ?? null;
+        const attributeSets = (0, tier2_traces_js_1.getTraceSanitizerAttributeSets)(policy.deploymentType);
+        const traceSanitizer = new trace_sanitizer_js_1.TraceSanitizer({
+            hashConfig,
+            ...attributeSets,
+        });
+        const spanProcessorLogger = config.logger ?? createConsoleFallbackLogger();
+        spanProcessor = new sanitizing_processor_js_1.SanitizingSpanProcessor(policyEvaluator, sanitizing_processor_js_1.noopSpanProcessor, tier2Exporter, traceSanitizer, spanProcessorLogger);
+        // Local-obs override: bypass the sanitizer so the local LGTM stack sees
+        // every span (service graph, raw attrs). Same exporter as cloud — only the
+        // processor changes.
+        if ((0, local_obs_mode_js_1.isLocalObsMode)()) {
+            spanProcessor = new sdk_trace_base_1.BatchSpanProcessor(tier2Exporter);
+        }
+        // Stamp late-known identity (e.g. a dev-server's app/user/org, resolved at
+        // connect) onto every span without re-initializing the SDK.
+        if (config.dynamicAttributes) {
+            spanProcessor = new dynamic_attribute_processor_js_1.DynamicAttributeSpanProcessor(spanProcessor, config.dynamicAttributes);
+        }
+    }
+    // Create metric exporter if enabled
+    // Use isExportEnabled (not canExport) - sampling applies at runtime, not initialization
+    let metricReader;
+    if (config.otlpUrl &&
+        config.metricsEnabled !== false &&
+        policyEvaluator.isExportEnabled(policy_js_1.TelemetryTier.TIER_2_OPERATIONAL)) {
+        metricReader = new sdk_metrics_1.PeriodicExportingMetricReader({
+            exporter: new exporter_metrics_otlp_http_1.OTLPMetricExporter({
+                headers: config.otlpHeaders,
+                temporalityPreference: sdk_metrics_1.AggregationTemporality.DELTA,
+                url: `${config.otlpUrl}/v1/metrics`,
+            }),
+            exportIntervalMillis: 10000, // every 10 seconds
+        });
+    }
+    // Create log processor with policy-aware filtering and sanitization
+    // The PolicyAwareLogProcessor wraps the batch processor to:
+    // 1. Filter logs by severity level based on export mode (LOCAL_ONLY, ERRORS_ONLY, INFO_AND_ABOVE)
+    // 2. Sanitize log bodies and attributes to remove PII, file paths, stack traces
+    // 3. Remove forbidden fields that should never be exported
+    let logProcessor;
+    let loggingPolicy = (0, log_processor_js_1.getLoggingPolicy)(policy);
+    // Local-obs override: ship info+ logs to the local LGTM stack regardless of
+    // the deployment policy's export mode (cloud-prem is ERRORS_ONLY). Mirrors the
+    // span sanitizer bypass above. See isLocalObsMode for why this is local-only.
+    if ((0, local_obs_mode_js_1.isLocalObsMode)()) {
+        loggingPolicy = {
+            ...loggingPolicy,
+            exportMode: log_processor_js_1.LogExportMode.INFO_AND_ABOVE,
+        };
+    }
+    if (config.otlpUrl &&
+        config.logsEnabled !== false &&
+        policyEvaluator.isExportEnabled(policy_js_1.TelemetryTier.TIER_2_OPERATIONAL) &&
+        loggingPolicy.exportMode !== log_processor_js_1.LogExportMode.LOCAL_ONLY) {
+        const batchProcessor = new sdk_logs_1.BatchLogRecordProcessor({
+            exporter: new exporter_logs_otlp_http_1.OTLPLogExporter({
+                headers: config.otlpHeaders,
+                url: `${config.otlpUrl}/v1/logs`,
+            }),
+        });
+        logProcessor = new log_processor_js_1.PolicyAwareLogProcessor(loggingPolicy, batchProcessor);
+        // Same late-known identity as spans: stamp before the policy processor so
+        // sanitization sees (and can redact) the identity attributes.
+        if (config.dynamicAttributes) {
+            logProcessor = new dynamic_attribute_processor_js_1.DynamicAttributeLogRecordProcessor(logProcessor, config.dynamicAttributes);
+        }
+    }
+    // Create the SDK
+    // Note: instrumentations typed as unknown[] for flexibility with various OTEL instrumentation packages
+    const sdk = new sdk_node_1.NodeSDK({
+        resource,
+        spanProcessor,
+        metricReader,
+        logRecordProcessor: logProcessor,
+        contextManager: new context_async_hooks_1.AsyncLocalStorageContextManager(),
+        textMapPropagator: new core_1.W3CTraceContextPropagator(),
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- OTEL instrumentation types vary
+        instrumentations: (config.instrumentations ?? []),
+    });
+    sdk.start();
+    const tracesEnabled = spanProcessor
+        ? "enabled (Tier 2 sanitized)"
+        : "disabled";
+    const metricsEnabled = metricReader ? "enabled" : "disabled";
+    const logsEnabled = logProcessor ? "enabled" : "disabled";
+    if (typeof config.logger?.info === "function") {
+        config.logger.info({
+            component: "telemetry",
+            deploymentType: policy.deploymentType,
+            logs: logsEnabled,
+            metrics: metricsEnabled,
+            serviceName: config.serviceName,
+            traces: tracesEnabled,
+        }, "Telemetry initialized");
+    }
+    else {
+        console.info(`[Telemetry] Initialized for ${config.serviceName} (${policy.deploymentType})` +
+            ` | Traces: ${tracesEnabled} | Metrics: ${metricsEnabled} | Logs: ${logsEnabled}`);
+    }
+    const defaultMeter = api_1.metrics.getMeter(config.serviceName, config.serviceVersion);
+    // Secondary-service tracers (e.g. server LLM-Obs spans under
+    // `superblocks-ai-code-gen`). They reuse the SAME span processor so
+    // sanitization + export are identical; the SDK owns its lifecycle.
+    const serviceTracers = (0, service_tracers_js_1.createServiceTracers)({
+        baseResource: resource,
+        defaultServiceName: config.serviceName,
+        serviceVersion: config.serviceVersion,
+        spanProcessor,
+    });
+    const created = {
+        sdk,
+        policyEvaluator,
+        getTracer: (name, options) => serviceTracers.getTracer(name ?? config.serviceName, options?.serviceName ?? config.serviceName),
+        getMeter: (name) => api_1.metrics.getMeter(name ?? config.serviceName, config.serviceVersion),
+        getLogger: (name) => api_logs_1.logs.getLogger(name ?? config.serviceName, config.serviceVersion),
+        metricsClient: new metrics_client_js_1.MetricsClient(defaultMeter),
+        shutdown: async () => {
+            try {
+                // Best-effort flush of secondary providers; never let it block the
+                // primary SDK teardown (which owns the shared span processor).
+                try {
+                    await serviceTracers.shutdown();
+                }
+                catch (error) {
+                    console.warn("[Telemetry] serviceTracers shutdown failed:", error);
+                }
+                await sdk.shutdown();
+            }
+            finally {
+                setInstance(undefined);
+            }
+        },
+    };
+    setInstance(created);
+    return created;
+}
+/**
+ * Get the current telemetry instance.
+ *
+ * @throws Error if not initialized
+ */
+function getTelemetryInstance() {
+    const current = getInstance();
+    if (!current) {
+        throw new Error("[Telemetry] Not initialized. Call initNodeTelemetry() first.");
+    }
+    return current;
+}
+/**
+ * Check if telemetry is initialized.
+ */
+function isTelemetryInitialized() {
+    return getInstance() !== undefined;
+}
+/**
+ * Reset telemetry (for testing only).
+ * @internal
+ */
+function resetTelemetry() {
+    setInstance(undefined);
+}
+//# sourceMappingURL=init.js.map

package/dist/node/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/node/init.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAoOH,8CAwPC;AAOD,oDAQC;AAKD,wDAEC;AAMD,wCAEC;AAxfD,4CAAmE;AACnE,sDAAuD;AACvD,4EAAqF;AACrF,8CAAgE;AAChE,oFAAyE;AACzE,0FAA+E;AAC/E,sFAA4E;AAC5E,sDAGiC;AACjC,4DAGoC;AACpC,sDAAkD;AAClD,kEAGuC;AAEvC,yEAAqF;AACrF,uEAAyE;AACzE,uDAAwE;AACxE,qEAA8D;AAE9D,kDAAoE;AACpE,qFAG0C;AAC1C,6EAAsE;AACtE,2DAAqD;AACrD,yDAI4B;AAC5B,2DAAoD;AACpD,uEAGmC;AACnC,6DAA4D;AAqD5D,SAAS,WAAW;IAClB,OAAO,UAAU,CAAC,kCAAkC,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,IAAuC;IAC1D,UAAU,CAAC,kCAAkC,GAAG,IAAI,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,kBAAkB,CACzB,MAA2B,EAC3B,MAAuB;IAEvB,MAAM,eAAe,GAAG,IAAI,8CAAwB,CAAC,MAAM,CAAC,CAAC;IAE7D,2CAA2C;IAC3C,MAAM,YAAY,GAAG,aAAO,CAAC,QAAQ,CACnC,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,cAAc,CACtB,CAAC;IAEF,OAAO;QACL,GAAG,EAAE,SAAS;QACd,eAAe;QACf,wEAAwE;QACxE,qEAAqE;QACrE,SAAS,EAAE,CAAC,IAAa,EAAE,QAA2B,EAAE,EAAE,CACxD,WAAK,CAAC,SAAS,CAAC,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;QACpE,QAAQ,EAAE,CAAC,IAAa,EAAE,EAAE,CAC1B,aAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;QACrE,SAAS,EAAE,CAAC,IAAa,EAAE,EAAE,CAC3B,eAAI,CAAC,SAAS,CAAC,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;QACnE,aAAa,EAAE,IAAI,iCAAa,CAAC,YAAY,CAAC;QAC9C,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,uCAAuC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,2BAA2B;IAIlC,MAAM,GAAG,GACP,CAAC,KAAuB,EAAE,EAAE,CAC5B,CAAC,CAAkB,EAAE,CAAU,EAAQ,EAAE;QACvC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,KAAK,KAAK,MAAM;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;gBACjC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,IAAI,KAAK,KAAK,MAAM;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;;gBAC1C,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC,CAAC;IACJ,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC;QACnB,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC;KAClB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,2BAA2B,CAAC,MAA2B;IAC9D,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,gCAAgC,MAAM,CAAC,OAAO,KAAM,KAAe,CAAC,OAAO,GAAG,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,SAAgB,iBAAiB,CAC/B,MAA2B,EAC3B,MAAuB;IAEvB,qBAAqB;IACrB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IAED,kBAAkB;IAClB,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAEpC,kDAAkD;IAClD,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,IAAI,QAAQ,EAAE,CAAC;QACb,uCAAuC;QACvC,MAAM,cAAc,GAAG,QAAQ,CAAC,eAAe,CAAC,SAAS,EAAE,CAAC;QAC5D,IAAI,cAAc,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,EAAE,CAAC;YAC5D,OAAO,CAAC,IAAI,CACV,iEAAiE;gBAC/D,cAAc,cAAc,CAAC,cAAc,gBAAgB,MAAM,CAAC,cAAc,KAAK;gBACrF,8BAA8B,CACjC,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,iDAAiD;IACjD,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,SAAS,GACb,4DAA4D,CAAC;QAC/D,IAAI,OAAO,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,WAAW,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,8CAAwB,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,IAAA,2BAAa,EAAC,MAAM,CAAC,CAAC;IAEvC,4CAA4C;IAC5C,IAAA,8BAAgB,EAAC,QAAQ,CAAC,CAAC;IAE3B,wCAAwC;IACxC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,EAAE;QAC/C,YAAY,IAAI,KAAK,CAAC;QACtB,OAAO,CAAC,IAAI,CACV,uBAAuB,KAAK,WAAW,MAAM,qBAAqB,YAAY,EAAE,CACjF,CAAC;IACJ,CAAC,CAAC;IAEF,sEAAsE;IACtE,yFAAyF;IACzF,yFAAyF;IACzF,IAAI,aAAwC,CAAC;IAC7C,IACE,MAAM,CAAC,OAAO;QACd,eAAe,CAAC,eAAe,CAAC,yBAAa,CAAC,kBAAkB,CAAC,EACjE,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,yCAAiB,CAAC;YAC1C,QAAQ,EAAE,IAAI,4CAAiB,CAAC;gBAC9B,OAAO,EAAE,MAAM,CAAC,WAAW;gBAC3B,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,YAAY;aACnC,CAAC;YACF,MAAM;YACN,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,IAAI,IAAI,CAAC;QAC3D,MAAM,aAAa,GAAG,IAAA,gDAA8B,EAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC5E,MAAM,cAAc,GAAG,IAAI,mCAAc,CAAC;YACxC,UAAU;YACV,GAAG,aAAa;SACjB,CAAC,CAAC;QACH,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,IAAI,2BAA2B,EAAE,CAAC;QAC3E,aAAa,GAAG,IAAI,iDAAuB,CACzC,eAAe,EACf,2CAAiB,EACjB,aAAa,EACb,cAAc,EACd,mBAAmB,CACpB,CAAC;QACF,wEAAwE;QACxE,2EAA2E;QAC3E,qBAAqB;QACrB,IAAI,IAAA,kCAAc,GAAE,EAAE,CAAC;YACrB,aAAa,GAAG,IAAI,mCAAkB,CAAC,aAAa,CAAC,CAAC;QACxD,CAAC;QACD,2EAA2E;QAC3E,4DAA4D;QAC5D,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC7B,aAAa,GAAG,IAAI,8DAA6B,CAC/C,aAAa,EACb,MAAM,CAAC,iBAAiB,CACzB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,wFAAwF;IACxF,IAAI,YAAuD,CAAC;IAC5D,IACE,MAAM,CAAC,OAAO;QACd,MAAM,CAAC,cAAc,KAAK,KAAK;QAC/B,eAAe,CAAC,eAAe,CAAC,yBAAa,CAAC,kBAAkB,CAAC,EACjE,CAAC;QACD,YAAY,GAAG,IAAI,2CAA6B,CAAC;YAC/C,QAAQ,EAAE,IAAI,+CAAkB,CAAC;gBAC/B,OAAO,EAAE,MAAM,CAAC,WAAW;gBAC3B,qBAAqB,EAAE,oCAAsB,CAAC,KAAK;gBACnD,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,aAAa;aACpC,CAAC;YACF,oBAAoB,EAAE,KAAK,EAAE,mBAAmB;SACjD,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,4DAA4D;IAC5D,kGAAkG;IAClG,gFAAgF;IAChF,2DAA2D;IAC3D,IAAI,YAA4C,CAAC;IACjD,IAAI,aAAa,GAAG,IAAA,mCAAgB,EAAC,MAAM,CAAC,CAAC;IAE7C,4EAA4E;IAC5E,+EAA+E;IAC/E,8EAA8E;IAC9E,IAAI,IAAA,kCAAc,GAAE,EAAE,CAAC;QACrB,aAAa,GAAG;YACd,GAAG,aAAa;YAChB,UAAU,EAAE,gCAAa,CAAC,cAAc;SACzC,CAAC;IACJ,CAAC;IAED,IACE,MAAM,CAAC,OAAO;QACd,MAAM,CAAC,WAAW,KAAK,KAAK;QAC5B,eAAe,CAAC,eAAe,CAAC,yBAAa,CAAC,kBAAkB,CAAC;QACjE,aAAa,CAAC,UAAU,KAAK,gCAAa,CAAC,UAAU,EACrD,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,kCAAuB,CAAC;YACjD,QAAQ,EAAE,IAAI,yCAAe,CAAC;gBAC5B,OAAO,EAAE,MAAM,CAAC,WAAW;gBAC3B,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,UAAU;aACjC,CAAC;SACH,CAAC,CAAC;QACH,YAAY,GAAG,IAAI,0CAAuB,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;QAC1E,0EAA0E;QAC1E,8DAA8D;QAC9D,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC7B,YAAY,GAAG,IAAI,mEAAkC,CACnD,YAAY,EACZ,MAAM,CAAC,iBAAiB,CACzB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,iBAAiB;IACjB,uGAAuG;IACvG,MAAM,GAAG,GAAG,IAAI,kBAAO,CAAC;QACtB,QAAQ;QACR,aAAa;QACb,YAAY;QACZ,kBAAkB,EAAE,YAAY;QAChC,cAAc,EAAE,IAAI,qDAA+B,EAAE;QACrD,iBAAiB,EAAE,IAAI,gCAAyB,EAAE;QAClD,iGAAiG;QACjG,gBAAgB,EAAE,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAQ;KACzD,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,EAAE,CAAC;IAEZ,MAAM,aAAa,GAAG,aAAa;QACjC,CAAC,CAAC,4BAA4B;QAC9B,CAAC,CAAC,UAAU,CAAC;IACf,MAAM,cAAc,GAAG,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IAC7D,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IAC1D,IAAI,OAAO,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,IAAI,CAChB;YACE,SAAS,EAAE,WAAW;YACtB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,cAAc;YACvB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM,EAAE,aAAa;SACtB,EACD,uBAAuB,CACxB,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CACV,+BAA+B,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,cAAc,GAAG;YAC5E,cAAc,aAAa,eAAe,cAAc,YAAY,WAAW,EAAE,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,aAAO,CAAC,QAAQ,CACnC,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,cAAc,CACtB,CAAC;IAEF,6DAA6D;IAC7D,oEAAoE;IACpE,mEAAmE;IACnE,MAAM,cAAc,GAAG,IAAA,yCAAoB,EAAC;QAC1C,YAAY,EAAE,QAAQ;QACtB,kBAAkB,EAAE,MAAM,CAAC,WAAW;QACtC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,aAAa;KACd,CAAC,CAAC;IAEH,MAAM,OAAO,GAA0B;QACrC,GAAG;QACH,eAAe;QACf,SAAS,EAAE,CAAC,IAAa,EAAE,OAA0B,EAAE,EAAE,CACvD,cAAc,CAAC,SAAS,CACtB,IAAI,IAAI,MAAM,CAAC,WAAW,EAC1B,OAAO,EAAE,WAAW,IAAI,MAAM,CAAC,WAAW,CAC3C;QACH,QAAQ,EAAE,CAAC,IAAa,EAAE,EAAE,CAC1B,aAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;QACrE,SAAS,EAAE,CAAC,IAAa,EAAE,EAAE,CAC3B,eAAI,CAAC,SAAS,CAAC,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;QACnE,aAAa,EAAE,IAAI,iCAAa,CAAC,YAAY,CAAC;QAC9C,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,IAAI,CAAC;gBACH,mEAAmE;gBACnE,+DAA+D;gBAC/D,IAAI,CAAC;oBACH,MAAM,cAAc,CAAC,QAAQ,EAAE,CAAC;gBAClC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,IAAI,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;gBACrE,CAAC;gBACD,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;YACvB,CAAC;oBAAS,CAAC;gBACT,WAAW,CAAC,SAAS,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;KACF,CAAC;IAEF,WAAW,CAAC,OAAO,CAAC,CAAC;IACrB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB;IAClC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAgB,sBAAsB;IACpC,OAAO,WAAW,EAAE,KAAK,SAAS,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc;IAC5B,WAAW,CAAC,SAAS,CAAC,CAAC;AACzB,CAAC"}

package/dist/node/local-obs-mode.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Local-observability mode toggle for the Node telemetry pipeline.
+ *
+ * `SUPERBLOCKS_LOCAL_OBS=true` is set ONLY by local dev tooling (the workspace
+ * Tilt profiles and `pnpm start:all`) and NEVER in any deployed environment —
+ * it appears in no helm chart, terraform config, or CI workflow. Code gated on
+ * this can therefore change export behavior for local development without
+ * affecting ee/staging/prod.
+ *
+ * This is the single source of truth for that gate so the checks can't drift:
+ * it must match EXACTLY the string "true" (not truthy, not "1"/"TRUE"), which is
+ * what guarantees the local-only log paths (the server's pino->OTLP bridge and
+ * the info-level log-export override) never activate in a deployed environment
+ * and therefore never duplicate log volume into Datadog.
+ */
+export declare function isLocalObsMode(env?: NodeJS.ProcessEnv): boolean;
+//# sourceMappingURL=local-obs-mode.d.ts.map

package/dist/node/local-obs-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-obs-mode.d.ts","sourceRoot":"","sources":["../../src/node/local-obs-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAE5E"}

package/dist/node/local-obs-mode.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isLocalObsMode = isLocalObsMode;
+/**
+ * Local-observability mode toggle for the Node telemetry pipeline.
+ *
+ * `SUPERBLOCKS_LOCAL_OBS=true` is set ONLY by local dev tooling (the workspace
+ * Tilt profiles and `pnpm start:all`) and NEVER in any deployed environment —
+ * it appears in no helm chart, terraform config, or CI workflow. Code gated on
+ * this can therefore change export behavior for local development without
+ * affecting ee/staging/prod.
+ *
+ * This is the single source of truth for that gate so the checks can't drift:
+ * it must match EXACTLY the string "true" (not truthy, not "1"/"TRUE"), which is
+ * what guarantees the local-only log paths (the server's pino->OTLP bridge and
+ * the info-level log-export override) never activate in a deployed environment
+ * and therefore never duplicate log volume into Datadog.
+ */
+function isLocalObsMode(env = process.env) {
+    return env.SUPERBLOCKS_LOCAL_OBS === "true";
+}
+//# sourceMappingURL=local-obs-mode.js.map

package/dist/node/local-obs-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-obs-mode.js","sourceRoot":"","sources":["../../src/node/local-obs-mode.ts"],"names":[],"mappings":";;AAeA,wCAEC;AAjBD;;;;;;;;;;;;;;GAcG;AACH,SAAgB,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,OAAO,GAAG,CAAC,qBAAqB,KAAK,MAAM,CAAC;AAC9C,CAAC"}

package/dist/node/log-processor.d.ts

@@ -0,0 +1,132 @@
+/**
+ * Policy-Aware Log Processor
+ *
+ * Wraps a delegate LogRecordProcessor to provide:
+ * 1. Export mode filtering (LOCAL_ONLY, ERRORS_ONLY, INFO_AND_ABOVE)
+ * 2. Severity level filtering
+ * 3. Log body and attribute sanitization
+ *
+ * @see https://github.com/superblocksteam/engineering/blob/main/projects/o11y-refactor/epics/epic-c4-logging-strategy.md
+ */
+import type { Context } from "@opentelemetry/api";
+import type { LogRecordProcessor, ReadableLogRecord } from "@opentelemetry/sdk-logs";
+import type { SensitivePattern } from "../common/log-sanitizer.js";
+import { TelemetryPolicy } from "../types/policy.js";
+/**
+ * Controls what logs are exported via OTEL.
+ */
+export declare enum LogExportMode {
+    /** No log export - local stdout/stderr only */
+    LOCAL_ONLY = "local_only",
+    /** Export WARN/ERROR/FATAL only (default for cloud-prem) */
+    ERRORS_ONLY = "errors_only",
+    /** Export INFO and above (not recommended for cloud-prem) */
+    INFO_AND_ABOVE = "info_and_above"
+}
+/**
+ * Logging-specific policy configuration.
+ * All sanitization is driven by these fields; when they are empty/off, no redaction is applied.
+ */
+export interface LoggingPolicyConfig {
+    /** What logs to export */
+    exportMode: LogExportMode;
+    /** Maximum log level for local retention */
+    localMaxLevel: "trace" | "debug" | "info" | "warn" | "error" | "fatal";
+    /** Patterns to redact from message/body and string values (e.g. JWT, API keys). When empty, no secret redaction. */
+    messageSecretPatterns: SensitivePattern[];
+    /** Attribute keys (lowercase) that trigger value → [REDACTED]. When empty, no key-based secret redaction. */
+    secretFieldNames: Set<string>;
+    /** Regex patterns for attribute key names that trigger value → [REDACTED]. When empty, only secretFieldNames apply. */
+    secretFieldPatterns: RegExp[];
+    /** When true, stack traces in body/attributes are replaced with placeholder. When false, left as-is. */
+    redactStackTraces: boolean;
+    /** Regex patterns to redact from log content (replaced with [REDACTED]). */
+    redactPatterns: RegExp[];
+    /** Pattern+replacement rules for sensitive values (path, email). */
+    sensitivePatterns: SensitivePattern[];
+    /** Fields to exclude from exported logs (key and value omitted). */
+    forbiddenFields: Set<string>;
+}
+/**
+ * Parse a string value into a LogExportMode, returning undefined if unrecognized.
+ * Used to validate SUPERBLOCKS_LOG_EXPORT_MODE env var values.
+ */
+export declare function parseLogExportMode(value: string | undefined): LogExportMode | undefined;
+/**
+ * Get logging policy based on telemetry policy.
+ *
+ * @param policy - Telemetry policy
+ * @param exportModeOverride - Optional override for the export mode. When set, overrides the
+ *   deployment-type default (e.g. allows INFO_AND_ABOVE on a cloud-prem trial environment).
+ *   Cloud-prem sanitization (redaction, forbidden fields) is still applied regardless of override.
+ * @returns Logging policy configuration
+ */
+export declare function getLoggingPolicy(policy: TelemetryPolicy, exportModeOverride?: LogExportMode): LoggingPolicyConfig;
+/**
+ * Returns the effective Pino log level from the current logging policy and env level.
+ * 1. Applies exportMode: when ERRORS_ONLY, never below warn so export paths never see INFO/DEBUG.
+ * 2. Applies localMaxLevel: caps local retention so we never set the logger more verbose than
+ *    policy.localMaxLevel (e.g. localMaxLevel "debug" prevents trace from being written locally).
+ *
+ * Use when policy is available (e.g. after initNodeTelemetry) to sync logger level from policy.
+ *
+ * @param loggingPolicy - Logging policy (e.g. from getLoggingPolicy(telemetryPolicy))
+ * @param envLevel - Level from env (e.g. SUPERBLOCKS_SERVER_LOG_LEVEL)
+ * @returns Level to pass to Pino
+ */
+export declare function getMinimumPinoLevelFromLoggingPolicy(loggingPolicy: LoggingPolicyConfig, envLevel: string): string;
+/**
+ * Returns the effective Pino log level for a deployment given the env-configured level.
+ * Used at logger bootstrap when policy is not yet initialized (e.g. server logger module load).
+ * Delegates to getMinimumPinoLevelFromLoggingPolicy with a synthetic policy from deployment type
+ * so the exportMode → level rule lives in one place.
+ *
+ * @param envLevel - Level from env (e.g. SUPERBLOCKS_SERVER_LOG_LEVEL)
+ * @param deploymentType - Deployment type from env (e.g. SUPERBLOCKS_DEPLOYMENT_TYPE)
+ * @param exportModeOverride - Optional override from env (e.g. SUPERBLOCKS_LOG_EXPORT_MODE).
+ *   When set to a valid LogExportMode, overrides the deployment-type default.
+ *   NOTE: This function runs at bootstrap before the policy evaluator is initialized,
+ *   so it cannot verify the Tier 2 export gate. The override only lowers the Pino
+ *   stdout level; actual telemetry export is gated by getLoggingPolicy() after init,
+ *   which always enforces !canExportTier2 before applying the override.
+ * @returns Level to pass to Pino (envLevel or 'warn' for cloud-prem when envLevel is below warn)
+ */
+export declare function getMinimumPinoLevelForDeployment(envLevel: string, deploymentType: string, exportModeOverride?: LogExportMode): string;
+/**
+ * Log processor that filters and sanitizes logs based on policy.
+ *
+ * This processor:
+ * 1. Blocks all logs if exportMode is LOCAL_ONLY
+ * 2. Filters by severity level based on exportMode
+ * 3. Sanitizes log body and attributes before forwarding
+ */
+export declare class PolicyAwareLogProcessor implements LogRecordProcessor {
+    private readonly policy;
+    private readonly delegate;
+    constructor(policy: LoggingPolicyConfig, delegate: LogRecordProcessor);
+    /**
+     * Called when a log record is emitted.
+     */
+    onEmit(logRecord: ReadableLogRecord, context?: Context): void;
+    /** True when policy has no sanitization (cloud passthrough). */
+    private isPassthroughPolicy;
+    /**
+     * Sanitize a log record for export.
+     * Mutates the log record in place to preserve OTEL SDK internal state.
+     * All redaction is policy-driven; when config is empty/off, content is left as-is.
+     */
+    private sanitizeLogRecord;
+    /**
+     * Sanitize log attributes.
+     */
+    private sanitizeAttributes;
+    /**
+     * Shutdown the processor.
+     */
+    shutdown(): Promise<void>;
+    /**
+     * Force flush pending logs.
+     */
+    forceFlush(): Promise<void>;
+}
+//# sourceMappingURL=log-processor.d.ts.map

package/dist/node/log-processor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-processor.d.ts","sourceRoot":"","sources":["../../src/node/log-processor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EACV,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAoBnE,OAAO,EAAE,eAAe,EAAiB,MAAM,oBAAoB,CAAC;AAOpE;;GAEG;AACH,oBAAY,aAAa;IACvB,+CAA+C;IAC/C,UAAU,eAAe;IACzB,4DAA4D;IAC5D,WAAW,gBAAgB;IAC3B,6DAA6D;IAC7D,cAAc,mBAAmB;CAClC;AAMD;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,0BAA0B;IAC1B,UAAU,EAAE,aAAa,CAAC;IAC1B,4CAA4C;IAC5C,aAAa,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;IACvE,oHAAoH;IACpH,qBAAqB,EAAE,gBAAgB,EAAE,CAAC;IAC1C,6GAA6G;IAC7G,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,uHAAuH;IACvH,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,wGAAwG;IACxG,iBAAiB,EAAE,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,oEAAoE;IACpE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;IACtC,oEAAoE;IACpE,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,aAAa,GAAG,SAAS,CAS3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,eAAe,EACvB,kBAAkB,CAAC,EAAE,aAAa,GACjC,mBAAmB,CAyDrB;AAiCD;;;;;;;;;;;GAWG;AACH,wBAAgB,oCAAoC,CAClD,aAAa,EAAE,mBAAmB,EAClC,QAAQ,EAAE,MAAM,GACf,MAAM,CAiBR;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,EACtB,kBAAkB,CAAC,EAAE,aAAa,GACjC,MAAM,CAsBR;AAuDD;;;;;;;GAOG;AACH,qBAAa,uBAAwB,YAAW,kBAAkB;IAChE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;gBAElC,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,kBAAkB;IAKrE;;OAEG;IACH,MAAM,CAAC,SAAS,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI;IAqB7D,gEAAgE;IAChE,OAAO,CAAC,mBAAmB;IAa3B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IA6CzB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAuE1B;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAI/B;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CAGlC"}