@superblocksteam/telemetry 2.0.0-SNAPSHOT.329be19cb7ca892b

package/dist-esm/npm-registry/emitter.js

@@ -0,0 +1,525 @@
+/**
+ * NPM Registry Metrics Emitter (APPS-4378 / APPS-4189)
+ *
+ * One emitter for the whole npm-registry subsystem. It owns every
+ * `superblocks.npm.*` metric and centralizes the sanitize-at-emit-boundary
+ * discipline: no raw registry hostname, package name, or token can escape via
+ * a metric label because every dimension is coerced to a closed enum or a
+ * bounded bucket here, the moment before it reaches an OTel instrument.
+ *
+ * Wiring follows the rest of the npm subsystem: the meter is resolved lazily
+ * from the OTel global (`metrics.getMeter`) and instruments are cached and
+ * re-bound when the global MeterProvider changes (the typical case is a test
+ * installing its own provider for isolation). The emitter is therefore a
+ * zero-config process singleton (`npmRegistryEmitter`) — no DI plumbing
+ * through AiServiceConfig / NpmRegistryClientDeps.
+ *
+ * Metrics (all `superblocks.npm.*`, durations in seconds):
+ *
+ *   - `config.lookup_total`     counter   {result}
+ *   - `config.lookup_duration_seconds` histogram {result} buckets [0.05,0.25,1,3,10,30]
+ *   - `config.policy_fallback_total`   counter {branch}  lastKnownPolicy supplied the policy
+ *   - `sync_home_npmrc.outcome_total`  counter {outcome}  CLI boot home npmrc materialization
+ *   - `sync_project_npmrc.outcome_total` counter {outcome}  project-dir .npmrc reconcile (boot + install)
+ *   - `install.outcome_total`   counter   {outcome, configured, registry_host, runner}
+ *   - `install.duration_seconds`histogram {…same…}  buckets [0.5,2,5,15,60,300]
+ *   - `install.status`          gauge     {…same…}  last-seen 1=success/0=else
+ *   - `probe.outcome_total`     counter   {outcome, registry_host}
+ *   - `probe.duration_seconds`  histogram {…same…}  buckets [0.1,0.5,1,3,10,30]
+ *   - `lookup.calls_total`      counter   {outcome, registry_host}
+ *   - `lookup.duration_seconds` histogram {…same…}  buckets [0.05,0.25,1,3,10,30]
+ *   - `killswitch.enabled`      gauge     {}         1 when the feature is suppressed
+ *
+ * Cardinality budget (documented contract — must not regress without a
+ * migration plan; every dashboard / Datadog facet pins on these):
+ *
+ *   - registry_host ≤ 3   (`public_npm | private | unknown`)
+ *   - install.outcome ≤ 7 (`NPM_INSTALL_OUTCOMES`)
+ *   - probe.outcome ≤ 5   (`NPM_PROBE_OUTCOMES`)
+ *   - lookup.outcome ≤ 3  (`NPM_LOOKUP_TOOL_OUTCOMES`)
+ *   - config.result ≤ 5   (`NPM_CONFIG_LOOKUP_RESULTS`)
+ *   - config.force_refresh ≤ 2 (boolean)
+ *   - config.policy_fallback.branch ≤ 2 (`NPM_POLICY_FALLBACK_BRANCHES`)
+ *   - sync_home_npmrc.outcome ≤ 5 (`NPM_SYNC_HOME_NPMRC_OUTCOMES`)
+ *   - sync_project_npmrc.outcome ≤ 5 (`NPM_SYNC_PROJECT_NPMRC_OUTCOMES`)
+ *   - configured ≤ 2, runner ≤ 5 (`NPM_INSTALL_RUNNERS`)
+ *
+ * Worst-case distinct series across every instrument is ≈ 730: the three
+ * install instruments (status gauge + counter + histogram) dominate at
+ * outcome×configured×registry_host×runner = 7×2×3×5 = 210 each → 630, plus
+ * probe 5×3×2=30, config 5×2(force_refresh)×2(counter+histogram)=20, lookup
+ * 3×3×2=18, the policy-fallback counter 2, the sync-home-npmrc counter 5,
+ * the sync-project-npmrc counter 5, and the killswitch gauge 1. How it grew
+ * over time: the runner count went from 3 to 4 (`auto_upgrade`) then 5
+ * (`uninstall`), adding `config.force_refresh` grew config from 8 to 16,
+ * adding `stale` as its own config result grew it from 16 to 20, and the
+ * policy-fallback (2 series), sync-home-npmrc (5 series), and
+ * sync-project-npmrc (5 series) counters were added. Adding a label value
+ * must increase the count, not decrease it.
+ * Still well under the internal 150K flag and the Datadog billing boundary.
+ * Per-pod `host` is stripped at the collector for the `superblocks.npm.*`
+ * family so series are aggregated by `service.name`.
+ *
+ * Each path has its OWN closed outcome enum + `normalize*` coercer because the
+ * paths legitimately diverge (probe has `ok`/`invalid_response`, install has
+ * `tls_failed`/`lockfile_url_mismatch`, …). `auth_failed` is deliberately a
+ * first-class outcome on install/probe — an expected, fast-failing
+ * customer-config mode — kept separable from infra failures (`unreachable` /
+ * `tls_failed`) so a future alert can page on infra spikes while routing auth
+ * to a dashboard. These short names diverge from the long-form `NPM_OUTCOMES`
+ * in `./sanitize` (which stays as the audit-event surface): the install path
+ * normalizes the long `NpmInstallBlocked.reason` values to the short forms.
+ */
+import { metrics } from "@opentelemetry/api";
+import { bucketNpmRegistryHost } from "./sanitize.js";
+/**
+ * Closed enum of npm install call sites that emit metrics. One value per call
+ * site Superblocks owns; renaming a value breaks every dashboard split on
+ * `runner`, so additions/removals need a migration plan.
+ *
+ *   - `install_all`      — full install from package.json (no specific
+ *                          packages). Covers both `AppShell.runNpmInstall`
+ *                          and `AppShell.runPackageManagerInstall`.
+ *   - `install_specific` — `AppShell.installSpecificPackages` (`npm add`).
+ *   - `prefetch`         — `installTemplateModules` (template `node_modules`
+ *                          prefetch during AiService construction).
+ *   - `auto_upgrade`     — `upgradeCliWithPackageManager` in the CLI SDK
+ *                          (`automatic-upgrades.ts`). Owns the dev-server
+ *                          self-upgrade install; a perimeter block here
+ *                          crash-loops the live-edit pod, so the metric is
+ *                          the only signal that distinguishes that from a
+ *                          working upgrade. APPS-4544.
+ *   - `uninstall`        — `AppShell.uninstallPackages` (`npm uninstall` /
+ *                          `pnpm remove`). Same registry and script-policy
+ *                          wrappers as install; a distinct runner so
+ *                          dashboards can split remove from add.
+ */
+export const NPM_INSTALL_RUNNERS = [
+    "auto_upgrade",
+    "install_all",
+    "install_specific",
+    "prefetch",
+    "uninstall",
+];
+const METER_NAME = "@superblocksteam/telemetry/npm-registry";
+const METRIC_CONFIG_LOOKUP = "superblocks.npm.config.lookup_total";
+const METRIC_CONFIG_DURATION = "superblocks.npm.config.lookup_duration_seconds";
+const METRIC_POLICY_FALLBACK = "superblocks.npm.config.policy_fallback_total";
+const METRIC_SYNC_HOME_NPMRC = "superblocks.npm.sync_home_npmrc.outcome_total";
+const METRIC_SYNC_PROJECT_NPMRC = "superblocks.npm.sync_project_npmrc.outcome_total";
+const METRIC_INSTALL_OUTCOME = "superblocks.npm.install.outcome_total";
+const METRIC_INSTALL_DURATION = "superblocks.npm.install.duration_seconds";
+const METRIC_INSTALL_STATUS = "superblocks.npm.install.status";
+const METRIC_PROBE_OUTCOME = "superblocks.npm.probe.outcome_total";
+const METRIC_PROBE_DURATION = "superblocks.npm.probe.duration_seconds";
+const METRIC_LOOKUP_CALLS = "superblocks.npm.lookup.calls_total";
+const METRIC_LOOKUP_DURATION = "superblocks.npm.lookup.duration_seconds";
+const METRIC_KILLSWITCH = "superblocks.npm.killswitch.enabled";
+/**
+ * Explicit histogram boundaries (seconds). Coarse on purpose: latency
+ * histograms here exist to detect regressions / alert on pathological cases,
+ * not for fine percentile work, so 6 finite buckets beat OTel's default 12.
+ * The SDK appends an implicit `(last, +∞)` overflow bucket, so values past the
+ * top boundary are still counted — the arrays stay finite (no `Infinity`).
+ */
+const INSTALL_DURATION_BUCKETS = [0.5, 2, 5, 15, 60, 300];
+const PROBE_DURATION_BUCKETS = [0.1, 0.5, 1, 3, 10, 30];
+const LOOKUP_DURATION_BUCKETS = [0.05, 0.25, 1, 3, 10, 30];
+// Config lookups span sub-ms cache hits to multi-second cold fetches (network
+// round-trip + possible JWT-refresh retry), so reuse the lookup-tool scale.
+const CONFIG_DURATION_BUCKETS = [0.05, 0.25, 1, 3, 10, 30];
+// ---------------------------------------------------------------------------
+// Per-path closed outcome enums + emit-boundary coercers.
+// ---------------------------------------------------------------------------
+/**
+ * `config.lookup_total` result. Derived inside `NpmRegistryClient.getConfig`
+ * (the only place that knows cache hit vs miss): in-TTL non-empty hit → `hit`;
+ * fresh fetch with a configured registry → `miss`; empty / 404 / flag-off →
+ * `not_configured`; serving last-known-good config during an outage → `stale`;
+ * no usable cache during an outage / any throw → `error`.
+ *
+ * `stale` means the client is still serving a real configured registry from
+ * cache, just past the point where it would normally refresh. On-call needs to
+ * tell this apart from a real failure, so it is its own result instead of
+ * folding into `error` (which used to mix "still working off cache" with
+ * "broken"). The age of the cached value rides on the WARN log only, never as
+ * a metric label, so it adds no metric series.
+ */
+export const NPM_CONFIG_LOOKUP_RESULTS = [
+    "hit",
+    "miss",
+    "not_configured",
+    "stale",
+    "error",
+];
+/** Unknown config-lookup states are an error condition, not a new series. */
+export function normalizeConfigLookupResult(input) {
+    return (NPM_CONFIG_LOOKUP_RESULTS.find((result) => result === input) ?? "error");
+}
+/**
+ * `config.policy_fallback_total` branch. Records where the in-memory cache
+ * could not supply an `npmAllowInstallScripts` policy, so
+ * `NpmRegistryClient.lastKnownPolicy` was used instead. That happens when an
+ * earlier auth-failure or 4xx branch wiped the cache, which is a sign
+ * something went wrong, so it is worth alerting on.
+ *
+ *   - `not_configured_404`: the branch of `getConfig` that keeps the policy on a 404.
+ *   - `unreachable`: the no-usable-cache branch of `serveStaleOrUnconfigured`.
+ */
+export const NPM_POLICY_FALLBACK_BRANCHES = [
+    "not_configured_404",
+    "unreachable",
+];
+/**
+ * `sync_home_npmrc.outcome_total` outcome. Mirrors the `SyncHomeNpmrcOutcome`
+ * union in the CLI's `home-npmrc.mts` and the `outcome` span attribute, so the
+ * metric and the `npm_registry.sync_home_npmrc` span join on the same value.
+ * Keep this list in sync with that union; an unknown value folds to `error`
+ * rather than adding a new series.
+ */
+export const NPM_SYNC_HOME_NPMRC_OUTCOMES = [
+    "written",
+    "restored-not-configured",
+    "skipped-unreachable",
+    "skipped-snapshot-failed",
+    "error",
+];
+export function normalizeSyncHomeNpmrcOutcome(input) {
+    return (NPM_SYNC_HOME_NPMRC_OUTCOMES.find((outcome) => outcome === input) ?? "error");
+}
+/**
+ * `sync_project_npmrc.outcome_total` outcome. Mirrors project-dir reconcile
+ * in `maybeWriteNpmrcForDir` (boot + install). Keep in sync with that call
+ * site; unknown values fold to `error`.
+ *
+ *   - `written`: configured rewrite with a fresh JWT
+ *   - `restored-not-configured`: restored from a clean backup, or noop
+ *   - `deleted-not-configured`: removed a Superblocks-authored stale file
+ *   - `skipped-unreachable`: fail-closed leave-alone on cold-cache outage
+ *   - `error`: unexpected failure (gitignore refuse, unlink/restore miss, boot catch)
+ */
+export const NPM_SYNC_PROJECT_NPMRC_OUTCOMES = [
+    "written",
+    "restored-not-configured",
+    "deleted-not-configured",
+    "skipped-unreachable",
+    "error",
+];
+export function normalizeSyncProjectNpmrcOutcome(input) {
+    return (NPM_SYNC_PROJECT_NPMRC_OUTCOMES.find((outcome) => outcome === input) ??
+        "error");
+}
+/**
+ * `install.outcome_total` outcome. Short forms; the install path normalizes
+ * the long `NpmInstallBlocked.reason` values (`registry_auth_failed`,
+ * `registry_unreachable`) to these via {@link normalizeInstallOutcome}.
+ */
+export const NPM_INSTALL_OUTCOMES = [
+    "success",
+    "auth_failed",
+    "not_in_registry",
+    "unreachable",
+    "tls_failed",
+    "lockfile_url_mismatch",
+    "package_substituted",
+    "vulnerable_package",
+    "other",
+];
+/**
+ * Long-form `NpmInstallBlocked.reason` → short install-metric outcome.
+ * `NPM_INSTALL_OUTCOMES` above is the canonical list for the metric; a blocked
+ * reason that is neither already a short outcome nor aliased here folds to
+ * `other` on the metric (the precise reason still rides on the log/audit
+ * surface via `NPM_OUTCOMES` in ./sanitize). Add an entry here when a new
+ * `NpmInstallBlocked.reason` should get its own metric facet rather than
+ * collapsing to `other`.
+ */
+const INSTALL_OUTCOME_ALIASES = new Map([
+    ["registry_auth_failed", "auth_failed"],
+    ["registry_unreachable", "unreachable"],
+]);
+export function normalizeInstallOutcome(input) {
+    if (input == null)
+        return "other";
+    return (NPM_INSTALL_OUTCOMES.find((outcome) => outcome === input) ??
+        INSTALL_OUTCOME_ALIASES.get(input) ??
+        "other");
+}
+/** `probe.outcome_total` outcome. Mapped from the server `ProbeResult`. */
+export const NPM_PROBE_OUTCOMES = [
+    "ok",
+    "auth_failed",
+    "unreachable",
+    "tls_failed",
+    "invalid_response",
+];
+/**
+ * Unknown → `unreachable`: the typed call site maps the closed `ProbeReason`
+ * exhaustively, so this floor only fires on a non-typed (JS) caller, where
+ * "we couldn't classify the probe" is safest reported as a connectivity
+ * failure rather than silently dropped or minted as a new series.
+ */
+export function normalizeProbeOutcome(input) {
+    return (NPM_PROBE_OUTCOMES.find((outcome) => outcome === input) ?? "unreachable");
+}
+/** `lookup.calls_total` outcome (the Clark `lookupNpmPackage` tool). */
+export const NPM_LOOKUP_TOOL_OUTCOMES = [
+    "in_registry",
+    "not_in_registry",
+    "error",
+];
+/** Auth / unreachable / fail-closed / throw all collapse to `error` here. */
+export function normalizeLookupToolOutcome(input) {
+    return (NPM_LOOKUP_TOOL_OUTCOMES.find((outcome) => outcome === input) ?? "error");
+}
+const SECONDS_PER_MS = 1 / 1000;
+const toSeconds = (durationMs) => Math.max(0, durationMs) * SECONDS_PER_MS;
+/**
+ * The npm-registry metrics emitter. Constructed once as the
+ * {@link npmRegistryEmitter} singleton; no `Meter` is injected — instruments
+ * resolve lazily from the OTel global and re-bind on provider change.
+ */
+export class NpmRegistryEmitter {
+    /**
+     * Last-seen install status keyed by the attribute tuple. The observable
+     * gauge reads this each collection cycle. Every key component is coerced to
+     * a closed enum / bounded bucket at the emit boundary
+     * (`normalizeInstallOutcome`, `bucketNpmRegistryHost`, the `NpmInstallRunner`
+     * union, a boolean), so the map is **bounded by construction** at
+     * runner(4) × configured(2) × registry_host(3) × outcome(7) = 168 entries —
+     * it cannot grow with traffic, only with deliberate enum changes. Entries
+     * persist until process exit / `_resetForTesting` (a "last-seen for
+     * dashboards" gauge must not drop a combo and lie about the most recent
+     * outcome); no eviction is needed at this bound. The cardinality regression
+     * test pins the resulting series count.
+     */
+    lastInstallStatus = new Map();
+    /** Returns `true` when the kill-switch is asserting (feature suppressed). */
+    killswitchState;
+    cachedMeter;
+    cachedInstruments;
+    /**
+     * Lazy instrument factory. Re-creates instruments and re-registers the
+     * observable-gauge callbacks when the global MeterProvider changes (a stale
+     * instrument bound to a replaced provider silently drops data).
+     */
+    getInstruments() {
+        const meter = metrics.getMeter(METER_NAME);
+        if (meter === this.cachedMeter && this.cachedInstruments) {
+            return this.cachedInstruments;
+        }
+        this.cachedMeter = meter;
+        this.cachedInstruments = {
+            configCounter: meter.createCounter(METRIC_CONFIG_LOOKUP, {
+                description: "Count of NpmRegistryClient.getConfig outcomes (cache hit/miss, not-configured, error).",
+                unit: "{lookup}",
+            }),
+            configHistogram: meter.createHistogram(METRIC_CONFIG_DURATION, {
+                description: "Duration of NpmRegistryClient.getConfig resolutions (cache hits are sub-ms; misses include the network fetch).",
+                unit: "s",
+                advice: { explicitBucketBoundaries: CONFIG_DURATION_BUCKETS },
+            }),
+            policyFallbackCounter: meter.createCounter(METRIC_POLICY_FALLBACK, {
+                description: "Count of times NpmRegistryClient.lastKnownPolicy supplied the install-scripts policy because the cache could not (cache hard-cleared by an earlier auth/4xx branch).",
+                unit: "{fallback}",
+            }),
+            syncHomeNpmrcCounter: meter.createCounter(METRIC_SYNC_HOME_NPMRC, {
+                description: "Count of CLI ~/.superblocks/npmrc materialization outcomes at dev-server boot / cache refresh.",
+                unit: "{sync}",
+            }),
+            syncProjectNpmrcCounter: meter.createCounter(METRIC_SYNC_PROJECT_NPMRC, {
+                description: "Count of project-dir .npmrc reconcile outcomes (boot + install write boundaries).",
+                unit: "{sync}",
+            }),
+            installCounter: meter.createCounter(METRIC_INSTALL_OUTCOME, {
+                description: "Count of npm install outcomes from Superblocks-owned paths.",
+                unit: "{install}",
+            }),
+            installHistogram: meter.createHistogram(METRIC_INSTALL_DURATION, {
+                description: "Duration of npm install invocations.",
+                unit: "s",
+                advice: { explicitBucketBoundaries: INSTALL_DURATION_BUCKETS },
+            }),
+            probeCounter: meter.createCounter(METRIC_PROBE_OUTCOME, {
+                description: "Count of org npm-registry verify-probe outcomes.",
+                unit: "{probe}",
+            }),
+            probeHistogram: meter.createHistogram(METRIC_PROBE_DURATION, {
+                description: "Duration of org npm-registry verify probes.",
+                unit: "s",
+                advice: { explicitBucketBoundaries: PROBE_DURATION_BUCKETS },
+            }),
+            lookupCounter: meter.createCounter(METRIC_LOOKUP_CALLS, {
+                description: "Count of Clark lookupNpmPackage tool outcomes.",
+                unit: "{call}",
+            }),
+            lookupHistogram: meter.createHistogram(METRIC_LOOKUP_DURATION, {
+                description: "Duration of Clark lookupNpmPackage tool calls.",
+                unit: "s",
+                advice: { explicitBucketBoundaries: LOOKUP_DURATION_BUCKETS },
+            }),
+        };
+        const statusGauge = meter.createObservableGauge(METRIC_INSTALL_STATUS, {
+            description: "Last-seen npm install status (1 = success, 0 = anything else) per runner+configured+registry+outcome. For at-a-glance dashboards.",
+        });
+        statusGauge.addCallback((result) => {
+            // Observable callbacks run on the metric export thread; an uncaught
+            // throw here aborts the whole collection cycle and drops every metric.
+            // Never let one escape.
+            try {
+                for (const { value, attrs } of this.lastInstallStatus.values()) {
+                    result.observe(value, attrs);
+                }
+            }
+            catch {
+                // Swallow: a metrics callback must not crash collection.
+            }
+        });
+        const killswitchGauge = meter.createObservableGauge(METRIC_KILLSWITCH, {
+            description: "1 when the npm-registry feature is suppressed (LD flag off / kill-switch active), 0 otherwise. One series per process.",
+        });
+        killswitchGauge.addCallback((result) => {
+            // Same export-thread safety as the status gauge: if the kill-switch
+            // state source throws (e.g. a flag client is momentarily unavailable),
+            // don't take down the whole npm-registry metric stream with it.
+            try {
+                if (this.killswitchState) {
+                    result.observe(this.killswitchState() ? 1 : 0);
+                }
+            }
+            catch {
+                // Swallow: a metrics callback must not crash collection.
+            }
+        });
+        return this.cachedInstruments;
+    }
+    /**
+     * Emit one `config.lookup_total` + `config.lookup_duration_seconds`
+     * observation. `durationMs` is the time `getConfig` spent resolving — sub-ms
+     * for a cache hit, the network round-trip (+ any JWT-refresh retry) for a
+     * miss — so dashboards can tell fast cache hits from slow cold fetches.
+     * `forceRefresh` records whether the caller bypassed the TTL cache hit, so
+     * forced just-in-time refreshes can be split from organic TTL-expiry misses.
+     */
+    recordConfigLookup(result, durationMs, forceRefresh = false) {
+        const attrs = {
+            result: normalizeConfigLookupResult(result),
+            force_refresh: forceRefresh,
+        };
+        const { configCounter, configHistogram } = this.getInstruments();
+        configCounter.add(1, attrs);
+        configHistogram.record(toSeconds(durationMs), attrs);
+    }
+    /**
+     * Emit one `config.policy_fallback_total` observation. Call from the
+     * `getConfig` 404 branch and the `serveStaleOrUnconfigured` no-cache branch
+     * when `lastKnownPolicy` supplied a value the cache could not. That means an
+     * earlier auth or 4xx branch wiped the cache, which is a sign something went
+     * wrong and is worth alerting on.
+     */
+    recordPolicyFallback(branch) {
+        const { policyFallbackCounter } = this.getInstruments();
+        policyFallbackCounter.add(1, { branch });
+    }
+    /**
+     * Emit one `sync_home_npmrc.outcome_total` observation alongside the
+     * `npm_registry.sync_home_npmrc` span, so the health of writing the npmrc at
+     * boot can be alerted on per `service.name` without querying traces.
+     * `outcome` is the `SyncHomeNpmrcOutcome`; an unknown value folds to `error`.
+     */
+    recordSyncHomeNpmrc(outcome) {
+        const { syncHomeNpmrcCounter } = this.getInstruments();
+        syncHomeNpmrcCounter.add(1, {
+            outcome: normalizeSyncHomeNpmrcOutcome(outcome),
+        });
+    }
+    /**
+     * Emit one `sync_project_npmrc.outcome_total` observation for project-dir
+     * `.npmrc` reconcile (boot + install). Unknown outcomes fold to `error`.
+     */
+    recordSyncProjectNpmrc(outcome) {
+        const { syncProjectNpmrcCounter } = this.getInstruments();
+        syncProjectNpmrcCounter.add(1, {
+            outcome: normalizeSyncProjectNpmrcOutcome(outcome),
+        });
+    }
+    /**
+     * Emit the install outcome counter + duration histogram + last-seen status
+     * gauge, and return the matching span-attribute pair for `llmobs.annotate`.
+     * Safe to call from a `finally` block.
+     */
+    recordInstall(input) {
+        const { installCounter, installHistogram } = this.getInstruments();
+        const registry_host = bucketNpmRegistryHost(input.registryHost);
+        const outcome = normalizeInstallOutcome(input.outcome);
+        const attrs = {
+            runner: input.runner,
+            outcome,
+            configured: input.configured,
+            registry_host,
+        };
+        installCounter.add(1, attrs);
+        installHistogram.record(toSeconds(input.durationMs), attrs);
+        const key = `${attrs.runner}|${attrs.configured}|${attrs.registry_host}|${attrs.outcome}`;
+        this.lastInstallStatus.set(key, {
+            value: outcome === "success" ? 1 : 0,
+            attrs,
+        });
+        return { "npm.registry_host": registry_host, "npm.outcome": outcome };
+    }
+    /** Emit one `probe.outcome_total` + `probe.duration_seconds` observation. */
+    recordProbe(input) {
+        const { probeCounter, probeHistogram } = this.getInstruments();
+        const attrs = {
+            outcome: normalizeProbeOutcome(input.outcome),
+            registry_host: bucketNpmRegistryHost(input.registryHost),
+        };
+        probeCounter.add(1, attrs);
+        probeHistogram.record(toSeconds(input.durationMs), attrs);
+    }
+    /** Emit one `lookup.calls_total` + `lookup.duration_seconds` observation. */
+    recordLookupTool(input) {
+        const { lookupCounter, lookupHistogram } = this.getInstruments();
+        const attrs = {
+            outcome: normalizeLookupToolOutcome(input.outcome),
+            registry_host: bucketNpmRegistryHost(input.registryHost),
+        };
+        lookupCounter.add(1, attrs);
+        lookupHistogram.record(toSeconds(input.durationMs), attrs);
+    }
+    /**
+     * Register the kill-switch state source. `getCurrentState` returns `true`
+     * when the feature is suppressed (LD flag off). Idempotent — the latest
+     * source wins; the observable gauge reads it on each scrape. Calling this
+     * also ensures the instruments (and thus the gauge callback) are wired.
+     */
+    setKillswitch(getCurrentState) {
+        this.killswitchState = getCurrentState;
+        this.getInstruments();
+    }
+    /**
+     * Test-only: drop cached instruments, last-seen status, and the kill-switch
+     * source so the next emit re-binds to a freshly-installed test provider.
+     */
+    _resetForTesting() {
+        this.cachedMeter = undefined;
+        this.cachedInstruments = undefined;
+        this.lastInstallStatus.clear();
+        this.killswitchState = undefined;
+    }
+}
+/** Process-wide singleton. All npm-registry call sites emit through this. */
+export const npmRegistryEmitter = new NpmRegistryEmitter();
+/**
+ * Back-compat free function for the install path (APPS-4189 call sites in
+ * `shell.ts` / `template-renderer.ts`). Delegates to the singleton and returns
+ * the span-attribute pair for `llmobs.annotate`.
+ */
+export function recordNpmInstall(input) {
+    return npmRegistryEmitter.recordInstall(input);
+}
+/** Test-only reset for the singleton (see {@link NpmRegistryEmitter._resetForTesting}). */
+export function _resetNpmRegistryEmitterForTesting() {
+    npmRegistryEmitter._resetForTesting();
+}
+//# sourceMappingURL=emitter.js.map

package/dist-esm/npm-registry/emitter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emitter.js","sourceRoot":"","sources":["../../src/npm-registry/emitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuEG;AAEH,OAAO,EAAE,OAAO,EAA+B,MAAM,oBAAoB,CAAC;AAE1E,OAAO,EAAE,qBAAqB,EAA0B,MAAM,eAAe,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,cAAc;IACd,aAAa;IACb,kBAAkB;IAClB,UAAU;IACV,WAAW;CACH,CAAC;AAGX,MAAM,UAAU,GAAG,yCAAyC,CAAC;AAE7D,MAAM,oBAAoB,GAAG,qCAAqC,CAAC;AACnE,MAAM,sBAAsB,GAAG,gDAAgD,CAAC;AAChF,MAAM,sBAAsB,GAAG,8CAA8C,CAAC;AAC9E,MAAM,sBAAsB,GAAG,+CAA+C,CAAC;AAC/E,MAAM,yBAAyB,GAC7B,kDAAkD,CAAC;AACrD,MAAM,sBAAsB,GAAG,uCAAuC,CAAC;AACvE,MAAM,uBAAuB,GAAG,0CAA0C,CAAC;AAC3E,MAAM,qBAAqB,GAAG,gCAAgC,CAAC;AAC/D,MAAM,oBAAoB,GAAG,qCAAqC,CAAC;AACnE,MAAM,qBAAqB,GAAG,wCAAwC,CAAC;AACvE,MAAM,mBAAmB,GAAG,oCAAoC,CAAC;AACjE,MAAM,sBAAsB,GAAG,yCAAyC,CAAC;AACzE,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;AAC1D,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;AACxD,MAAM,uBAAuB,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;AAC3D,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,uBAAuB,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;AAE3D,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,KAAK;IACL,MAAM;IACN,gBAAgB;IAChB,OAAO;IACP,OAAO;CACC,CAAC;AAGX,6EAA6E;AAC7E,MAAM,UAAU,2BAA2B,CACzC,KAAgC;IAEhC,OAAO,CACL,yBAAyB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,OAAO,CACxE,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,oBAAoB;IACpB,aAAa;CACL,CAAC;AAIX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,SAAS;IACT,yBAAyB;IACzB,qBAAqB;IACrB,yBAAyB;IACzB,OAAO;CACC,CAAC;AAIX,MAAM,UAAU,6BAA6B,CAC3C,KAAgC;IAEhC,OAAO,CACL,4BAA4B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,CAAC,IAAI,OAAO,CAC7E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,SAAS;IACT,yBAAyB;IACzB,wBAAwB;IACxB,qBAAqB;IACrB,OAAO;CACC,CAAC;AAIX,MAAM,UAAU,gCAAgC,CAC9C,KAAgC;IAEhC,OAAO,CACL,+BAA+B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,CAAC;QACpE,OAAO,CACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,SAAS;IACT,aAAa;IACb,iBAAiB;IACjB,aAAa;IACb,YAAY;IACZ,uBAAuB;IACvB,qBAAqB;IACrB,oBAAoB;IACpB,OAAO;CACC,CAAC;AAEX;;;;;;;;GAQG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAA4B;IACjE,CAAC,sBAAsB,EAAE,aAAa,CAAC;IACvC,CAAC,sBAAsB,EAAE,aAAa,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,UAAU,uBAAuB,CACrC,KAAgC;IAEhC,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,OAAO,CAAC;IAClC,OAAO,CACL,oBAAoB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,CAAC;QACzD,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC;QAClC,OAAO,CACR,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,IAAI;IACJ,aAAa;IACb,aAAa;IACb,YAAY;IACZ,kBAAkB;CACV,CAAC;AAEX;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAgC;IAEhC,OAAO,CACL,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,CAAC,IAAI,aAAa,CACzE,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,aAAa;IACb,iBAAiB;IACjB,OAAO;CACC,CAAC;AAEX,6EAA6E;AAC7E,MAAM,UAAU,0BAA0B,CACxC,KAAgC;IAEhC,OAAO,CACL,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,CAAC,IAAI,OAAO,CACzE,CAAC;AACJ,CAAC;AAsGD,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC;AAChC,MAAM,SAAS,GAAG,CAAC,UAAkB,EAAU,EAAE,CAC/C,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,cAAc,CAAC;AAE3C;;;;GAIG;AACH,MAAM,OAAO,kBAAkB;IAC7B;;;;;;;;;;;;OAYG;IACc,iBAAiB,GAAG,IAAI,GAAG,EAGzC,CAAC;IAEJ,6EAA6E;IACrE,eAAe,CAA8B;IAE7C,WAAW,CAAoB;IAC/B,iBAAiB,CAA0B;IAEnD;;;;OAIG;IACK,cAAc;QACpB,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,KAAK,KAAK,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC,iBAAiB,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QAEzB,IAAI,CAAC,iBAAiB,GAAG;YACvB,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,oBAAoB,EAAE;gBACvD,WAAW,EACT,wFAAwF;gBAC1F,IAAI,EAAE,UAAU;aACjB,CAAC;YACF,eAAe,EAAE,KAAK,CAAC,eAAe,CAAC,sBAAsB,EAAE;gBAC7D,WAAW,EACT,gHAAgH;gBAClH,IAAI,EAAE,GAAG;gBACT,MAAM,EAAE,EAAE,wBAAwB,EAAE,uBAAuB,EAAE;aAC9D,CAAC;YACF,qBAAqB,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,EAAE;gBACjE,WAAW,EACT,sKAAsK;gBACxK,IAAI,EAAE,YAAY;aACnB,CAAC;YACF,oBAAoB,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,EAAE;gBAChE,WAAW,EACT,gGAAgG;gBAClG,IAAI,EAAE,QAAQ;aACf,CAAC;YACF,uBAAuB,EAAE,KAAK,CAAC,aAAa,CAAC,yBAAyB,EAAE;gBACtE,WAAW,EACT,mFAAmF;gBACrF,IAAI,EAAE,QAAQ;aACf,CAAC;YACF,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,EAAE;gBAC1D,WAAW,EACT,6DAA6D;gBAC/D,IAAI,EAAE,WAAW;aAClB,CAAC;YACF,gBAAgB,EAAE,KAAK,CAAC,eAAe,CAAC,uBAAuB,EAAE;gBAC/D,WAAW,EAAE,sCAAsC;gBACnD,IAAI,EAAE,GAAG;gBACT,MAAM,EAAE,EAAE,wBAAwB,EAAE,wBAAwB,EAAE;aAC/D,CAAC;YACF,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,oBAAoB,EAAE;gBACtD,WAAW,EAAE,kDAAkD;gBAC/D,IAAI,EAAE,SAAS;aAChB,CAAC;YACF,cAAc,EAAE,KAAK,CAAC,eAAe,CAAC,qBAAqB,EAAE;gBAC3D,WAAW,EAAE,6CAA6C;gBAC1D,IAAI,EAAE,GAAG;gBACT,MAAM,EAAE,EAAE,wBAAwB,EAAE,sBAAsB,EAAE;aAC7D,CAAC;YACF,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,mBAAmB,EAAE;gBACtD,WAAW,EAAE,gDAAgD;gBAC7D,IAAI,EAAE,QAAQ;aACf,CAAC;YACF,eAAe,EAAE,KAAK,CAAC,eAAe,CAAC,sBAAsB,EAAE;gBAC7D,WAAW,EAAE,gDAAgD;gBAC7D,IAAI,EAAE,GAAG;gBACT,MAAM,EAAE,EAAE,wBAAwB,EAAE,uBAAuB,EAAE;aAC9D,CAAC;SACH,CAAC;QAEF,MAAM,WAAW,GAAG,KAAK,CAAC,qBAAqB,CAAC,qBAAqB,EAAE;YACrE,WAAW,EACT,mIAAmI;SACtI,CAAC,CAAC;QACH,WAAW,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,EAAE;YACjC,oEAAoE;YACpE,uEAAuE;YACvE,wBAAwB;YACxB,IAAI,CAAC;gBACH,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC;oBAC/D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,yDAAyD;YAC3D,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,eAAe,GAAG,KAAK,CAAC,qBAAqB,CAAC,iBAAiB,EAAE;YACrE,WAAW,EACT,wHAAwH;SAC3H,CAAC,CAAC;QACH,eAAe,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,EAAE;YACrC,oEAAoE;YACpE,uEAAuE;YACvE,gEAAgE;YAChE,IAAI,CAAC;gBACH,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;oBACzB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,yDAAyD;YAC3D,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAChB,MAAiC,EACjC,UAAkB,EAClB,YAAY,GAAG,KAAK;QAEpB,MAAM,KAAK,GAA2B;YACpC,MAAM,EAAE,2BAA2B,CAAC,MAAM,CAAC;YAC3C,aAAa,EAAE,YAAY;SAC5B,CAAC;QACF,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACjE,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5B,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;OAMG;IACH,oBAAoB,CAAC,MAA+B;QAClD,MAAM,EAAE,qBAAqB,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACxD,qBAAqB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACH,mBAAmB,CAAC,OAAkC;QACpD,MAAM,EAAE,oBAAoB,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACvD,oBAAoB,CAAC,GAAG,CAAC,CAAC,EAAE;YAC1B,OAAO,EAAE,6BAA6B,CAAC,OAAO,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,sBAAsB,CAAC,OAAkC;QACvD,MAAM,EAAE,uBAAuB,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1D,uBAAuB,CAAC,GAAG,CAAC,CAAC,EAAE;YAC7B,OAAO,EAAE,gCAAgC,CAAC,OAAO,CAAC;SACnD,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,KAA4B;QACxC,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACnE,MAAM,aAAa,GAAG,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,KAAK,GAAsB;YAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO;YACP,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,aAAa;SACd,CAAC;QAEF,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7B,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;QAE5D,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC1F,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE;YAC9B,KAAK,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,KAAK;SACN,CAAC,CAAC;QAEH,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IACxE,CAAC;IAED,6EAA6E;IAC7E,WAAW,CAAC,KAA0B;QACpC,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAC/D,MAAM,KAAK,GAAoB;YAC7B,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC;YAC7C,aAAa,EAAE,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC;SACzD,CAAC;QACF,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC3B,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED,6EAA6E;IAC7E,gBAAgB,CAAC,KAA+B;QAC9C,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACjE,MAAM,KAAK,GAAyB;YAClC,OAAO,EAAE,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC;YAClD,aAAa,EAAE,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC;SACzD,CAAC;QACF,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5B,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,eAA8B;QAC1C,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,cAAc,EAAE,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,gBAAgB;QACd,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACnC,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;IACnC,CAAC;CACF;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,EAAE,CAAC;AAE3D;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAA4B;IAE5B,OAAO,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AACjD,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,kCAAkC;IAChD,kBAAkB,CAAC,gBAAgB,EAAE,CAAC;AACxC,CAAC"}

package/dist-esm/npm-registry/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * NPM Registry Telemetry
+ *
+ * Sanitization helpers, the unified metrics emitter, and the named OTel spans
+ * for the npm-registry subsystem (config fetch, install, verify probe, the
+ * Clark lookup tool, CLI npmrc sync). Re-exported from the package root, so
+ * callers import from `@superblocksteam/telemetry` rather than this subpath.
+ */
+export * from "./sanitize.js";
+export * from "./emitter.js";
+export * from "./spans.js";
+//# sourceMappingURL=index.d.ts.map

package/dist-esm/npm-registry/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/npm-registry/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist-esm/npm-registry/index.js

@@ -0,0 +1,12 @@
+/**
+ * NPM Registry Telemetry
+ *
+ * Sanitization helpers, the unified metrics emitter, and the named OTel spans
+ * for the npm-registry subsystem (config fetch, install, verify probe, the
+ * Clark lookup tool, CLI npmrc sync). Re-exported from the package root, so
+ * callers import from `@superblocksteam/telemetry` rather than this subpath.
+ */
+export * from "./sanitize.js";
+export * from "./emitter.js";
+export * from "./spans.js";
+//# sourceMappingURL=index.js.map

package/dist-esm/npm-registry/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/npm-registry/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}