@superblocksteam/telemetry 2.0.129 → 2.0.130-next.1

package/dist-esm/npm-registry/spans.js

@@ -0,0 +1,86 @@
+/**
+ * NPM Registry Spans (APPS-4378)
+ *
+ * OTel-native `startActiveSpan` helpers for the four named npm-registry spans.
+ * Using the global tracer (`trace.getTracer`) means LLMObs interop is
+ * automatic: a span started inside an `@llmobs.decorate`'d context becomes a
+ * child of that task span (shared global tracer provider); outside any LLMObs
+ * context (server verify, CLI bootstrap) it is a root span.
+ *
+ * `org_id` rides on spans (per-trace context), never on a metric label. Raw
+ * registry hostnames are bucketed via {@link bucketNpmRegistryHost} before
+ * they reach a span attribute, matching the metric path — the one exception
+ * is the structured-log path, which keeps the raw host (see
+ * {@link auditNpmRegistryHost} in ./sanitize).
+ */
+import { SpanStatusCode, trace, } from "@opentelemetry/api";
+/** Instrumentation scope for every npm-registry span. */
+const TRACER_NAME = "superblocks.npm-registry";
+/** The four named spans (APPS-4378). */
+export const NPM_REGISTRY_SPAN = {
+    VERIFY: "npm_registry.verify",
+    LOOKUP_PACKAGE: "npm_registry.lookup_package",
+    PREPARE_FOR_PRIVATE_REGISTRY: "npm_registry.prepare_for_private_registry",
+    SYNC_HOME_NPMRC: "npm_registry.sync_home_npmrc",
+};
+/**
+ * Canonical span-attribute keys, shared across the four spans so the
+ * dimension names never drift between call sites.
+ */
+export const NPM_REGISTRY_SPAN_ATTR = {
+    ORG_ID: "org_id",
+    /** Bucketed (`public_npm | private | unknown`) — never the raw host. */
+    REGISTRY_HOST: "registry_host",
+    OUTCOME: "outcome",
+    DURATION_MS: "duration_ms",
+    /** Richer `NpmRegistryFetchResult.source` for drill-down. */
+    SOURCE: "source",
+    REGISTRY_CONFIGURED: "registry_configured",
+    /** Tri-valued: `true | false | "unknown"`. */
+    ALLOW_INSTALL_SCRIPTS: "allow_install_scripts",
+    PACKAGE_NAME_BUCKET: "package_name_bucket",
+    /** Span-attribute ONLY — raw byte counts are unbounded, never a metric label. */
+    PACKAGE_UNPACKED_SIZE_BYTES: "package_unpacked_size_bytes",
+};
+/**
+ * Start an active npm-registry span over the global tracer, run `fn`, and
+ * end the span in `finally`. On throw, the error is recorded
+ * (`span.recordException`) and the span status set to ERROR before the throw
+ * propagates. `fn` receives the span so it can attach final attributes
+ * (outcome / duration) once the operation resolves.
+ */
+export async function withNpmRegistrySpan(spanName, initialAttributes, fn) {
+    const tracer = trace.getTracer(TRACER_NAME);
+    return tracer.startActiveSpan(spanName, async (span) => {
+        if (Object.keys(initialAttributes).length > 0) {
+            span.setAttributes(initialAttributes);
+        }
+        try {
+            return await fn(span);
+        }
+        catch (err) {
+            // `recordException` accepts Error | string; narrow rather than cast.
+            span.recordException(err instanceof Error ? err : String(err));
+            span.setStatus({ code: SpanStatusCode.ERROR });
+            throw err;
+        }
+        finally {
+            span.end();
+        }
+    });
+}
+/**
+ * Coerce a registry-reported `dist.unpackedSize` to a span-safe value: a
+ * finite, non-negative number, else `undefined`. A hostile or buggy registry
+ * cannot smuggle a non-numeric byte count onto the span through this guard.
+ *
+ * Callers MUST omit the attribute when this returns `undefined` rather than
+ * calling `setAttribute(key, undefined)` (some OTel exporters mishandle
+ * undefined values). The lookup call site guards with `if (size !== undefined)`.
+ */
+export function npmPackageUnpackedSizeBytes(raw) {
+    return typeof raw === "number" && Number.isFinite(raw) && raw >= 0
+        ? raw
+        : undefined;
+}
+//# sourceMappingURL=spans.js.map

package/dist-esm/npm-registry/spans.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spans.js","sourceRoot":"","sources":["../../src/npm-registry/spans.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAGL,cAAc,EACd,KAAK,GACN,MAAM,oBAAoB,CAAC;AAE5B,yDAAyD;AACzD,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAE/C,wCAAwC;AACxC,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,MAAM,EAAE,qBAAqB;IAC7B,cAAc,EAAE,6BAA6B;IAC7C,4BAA4B,EAAE,2CAA2C;IACzE,eAAe,EAAE,8BAA8B;CACvC,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,MAAM,EAAE,QAAQ;IAChB,wEAAwE;IACxE,aAAa,EAAE,eAAe;IAC9B,OAAO,EAAE,SAAS;IAClB,WAAW,EAAE,aAAa;IAC1B,6DAA6D;IAC7D,MAAM,EAAE,QAAQ;IAChB,mBAAmB,EAAE,qBAAqB;IAC1C,8CAA8C;IAC9C,qBAAqB,EAAE,uBAAuB;IAC9C,mBAAmB,EAAE,qBAAqB;IAC1C,iFAAiF;IACjF,2BAA2B,EAAE,6BAA6B;CAClD,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,iBAA6B,EAC7B,EAA8B;IAE9B,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACrD,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,IAAI,CAAC,eAAe,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC;YAC/C,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAY;IACtD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAChE,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@superblocksteam/telemetry",
-  "version": "2.0.129",
+  "version": "2.0.130-next.1",
   "description": "Superblocks Telemetry - Canonical OTEL bootstrap with tier-aware policy enforcement",
   "license": "Superblocks Community Software License",
   "repository": {
@@ -72,17 +72,17 @@
     "chokidar-cli": "^3.0.0",
     "eslint": "^9.39.1",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-config-turbo": "^2.6.1",
+    "eslint-config-turbo": "^2.9.16",
     "globals": "^16.5.0",
     "pino": "^8.0.0",
     "premove": "^4.0.0",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.47.0",
     "vitest": "^2.0.0",
-    "@superblocksteam/shared": "0.9590.9"
+    "@superblocksteam/shared": "0.9591.1"
   },
   "peerDependencies": {
-    "@superblocksteam/shared": "0.9590.9"
+    "@superblocksteam/shared": "0.9591.1"
   },
   "engines": {
     "node": ">=24"

package/dist/common/npm-install-metrics.d.ts

@@ -1,88 +0,0 @@
-/**
- * NPM Install Metrics (APPS-4189 / P6.2)
- *
- * Emits `superblocks.npm.install.*` metrics from every npm install path
- * Superblocks owns and returns the matching attribute set so the caller can
- * annotate its active llmobs span with the same dimensions. The metric and
- * span streams share a closed attribute set so dashboards and traces join
- * cleanly without dimension drift.
- *
- * Cardinality budget (documented contract — must not regress without a
- * migration plan; every dashboard and Datadog saved facet pins on these):
- *
- *   - `registry_host` ≤ 3  (`public_npm` | `private` | `unknown`)
- *   - `outcome`       ≤ 6  (`NPM_OUTCOMES`)
- *   - `runner`        ≤ 4  (`NPM_INSTALL_RUNNERS`)
- *
- * Total dimension product is bounded at 3 × 6 × 4 = 72 series, well under
- * any per-metric ceiling. New runners or outcomes go through P6.1
- * (sanitization policy) so a future emitter cannot blow the budget by
- * accident.
- *
- * Every value flows through the P6.1 helpers in `./sanitize-npm-attributes`
- * before reaching an OTel instrument, so raw registry hostnames and tokens
- * cannot escape via this emitter — the same guarantee the audit-event
- * emitter (P6.3) relies on.
- */
-import { type NpmOutcome, type NpmRegistryBucket } from "./sanitize-npm-attributes.js";
-/**
- * Closed enum of npm install call sites that emit metrics. One value per
- * call site Superblocks owns. Names are stabilised here; renaming any
- * value breaks every saved dashboard and alert split on `runner`, so
- * additions/removals must come with a migration plan.
- *
- *   - `install_all`      — full install from package.json (no specific
- *                          packages). Covers both `AppShell.runNpmInstall`
- *                          and `AppShell.runPackageManagerInstall`; the
- *                          two are semantically the same operation routed
- *                          through different package managers.
- *   - `install_specific` — `AppShell.installSpecificPackages` (named
- *                          packages via `npm add` / equivalent).
- *   - `prefetch`         — `installTemplateModules` (template
- *                          `node_modules` prefetch during AiService
- *                          construction).
- */
-export declare const NPM_INSTALL_RUNNERS: readonly ["install_all", "install_specific", "prefetch"];
-export type NpmInstallRunner = (typeof NPM_INSTALL_RUNNERS)[number];
-export interface NpmInstallMetricInput {
-    /** Which install call site emitted this event. */
-    runner: NpmInstallRunner;
-    /**
-     * Registry URL or bare hostname the install was attempting (`null` /
-     * `undefined` is fine — bucketed to `unknown`). Always passed through
-     * `bucketNpmRegistryHost` before emission, so raw hostnames cannot leak.
-     */
-    registryHost: string | null | undefined;
-    /**
-     * Outcome key. Free-form on input; coerced to the closed
-     * `NPM_OUTCOMES` enum at the emit boundary (unknown strings → `other`).
-     * Use the `NpmInstallBlocked.reason` value for failures and the literal
-     * `"success"` on the happy path.
-     */
-    outcome: string | null | undefined;
-    /** Elapsed wall-clock time in milliseconds; clamped at 0. */
-    durationMs: number;
-}
-/**
- * Attribute set shaped for direct spread into
- * `llmobs.annotate({ tags: ... })`. Returned by `recordNpmInstall` so the
- * span on the active install call site carries the exact same values that
- * just went into the metric pipeline.
- */
-export interface NpmInstallSpanAttributes {
-    "npm.registry_host": NpmRegistryBucket;
-    "npm.outcome": NpmOutcome;
-}
-/**
- * Emit one observation of the install metric triple and return the matching
- * span-attribute pair. Idempotent w.r.t. the metric SDK; safe to call from
- * `finally` blocks where the same code path may also throw.
- */
-export declare function recordNpmInstall(input: NpmInstallMetricInput): NpmInstallSpanAttributes;
-/**
- * Test-only: clear cached instruments + last-seen gauge state. Required
- * when a test installs its own MeterProvider, so the next emit re-binds to
- * the test provider and prior runs' gauge entries don't bleed across.
- */
-export declare function _resetNpmInstallMetricsForTesting(): void;
-//# sourceMappingURL=npm-install-metrics.d.ts.map

package/dist/common/npm-install-metrics.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"npm-install-metrics.d.ts","sourceRoot":"","sources":["../../src/common/npm-install-metrics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,iBAAiB,EACvB,MAAM,8BAA8B,CAAC;AAEtC;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,mBAAmB,0DAItB,CAAC;AACX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAuEpE,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,MAAM,EAAE,gBAAgB,CAAC;IACzB;;;;OAIG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACxC;;;;;OAKG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACnC,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,mBAAmB,EAAE,iBAAiB,CAAC;IACvC,aAAa,EAAE,UAAU,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,qBAAqB,GAC3B,wBAAwB,CAwB1B;AAED;;;;GAIG;AACH,wBAAgB,iCAAiC,IAAI,IAAI,CAIxD"}

package/dist/common/npm-install-metrics.js

@@ -1,140 +0,0 @@
-"use strict";
-/**
- * NPM Install Metrics (APPS-4189 / P6.2)
- *
- * Emits `superblocks.npm.install.*` metrics from every npm install path
- * Superblocks owns and returns the matching attribute set so the caller can
- * annotate its active llmobs span with the same dimensions. The metric and
- * span streams share a closed attribute set so dashboards and traces join
- * cleanly without dimension drift.
- *
- * Cardinality budget (documented contract — must not regress without a
- * migration plan; every dashboard and Datadog saved facet pins on these):
- *
- *   - `registry_host` ≤ 3  (`public_npm` | `private` | `unknown`)
- *   - `outcome`       ≤ 6  (`NPM_OUTCOMES`)
- *   - `runner`        ≤ 4  (`NPM_INSTALL_RUNNERS`)
- *
- * Total dimension product is bounded at 3 × 6 × 4 = 72 series, well under
- * any per-metric ceiling. New runners or outcomes go through P6.1
- * (sanitization policy) so a future emitter cannot blow the budget by
- * accident.
- *
- * Every value flows through the P6.1 helpers in `./sanitize-npm-attributes`
- * before reaching an OTel instrument, so raw registry hostnames and tokens
- * cannot escape via this emitter — the same guarantee the audit-event
- * emitter (P6.3) relies on.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.NPM_INSTALL_RUNNERS = void 0;
-exports.recordNpmInstall = recordNpmInstall;
-exports._resetNpmInstallMetricsForTesting = _resetNpmInstallMetricsForTesting;
-const api_1 = require("@opentelemetry/api");
-const sanitize_npm_attributes_js_1 = require("./sanitize-npm-attributes.js");
-/**
- * Closed enum of npm install call sites that emit metrics. One value per
- * call site Superblocks owns. Names are stabilised here; renaming any
- * value breaks every saved dashboard and alert split on `runner`, so
- * additions/removals must come with a migration plan.
- *
- *   - `install_all`      — full install from package.json (no specific
- *                          packages). Covers both `AppShell.runNpmInstall`
- *                          and `AppShell.runPackageManagerInstall`; the
- *                          two are semantically the same operation routed
- *                          through different package managers.
- *   - `install_specific` — `AppShell.installSpecificPackages` (named
- *                          packages via `npm add` / equivalent).
- *   - `prefetch`         — `installTemplateModules` (template
- *                          `node_modules` prefetch during AiService
- *                          construction).
- */
-exports.NPM_INSTALL_RUNNERS = [
-    "install_all",
-    "install_specific",
-    "prefetch",
-];
-const METER_NAME = "@superblocksteam/telemetry/npm-install";
-const METRIC_COUNT = "superblocks.npm.install.count";
-const METRIC_DURATION = "superblocks.npm.install.duration";
-const METRIC_STATUS = "superblocks.npm.install.status";
-/**
- * Last-seen status keyed by the attribute tuple. The observable gauge
- * callback reads this on every collection cycle. Entries are intentionally
- * kept until the process exits (or the test reset helper runs): the gauge
- * is "last-seen for dashboards" and a stale combo dropping out would lie
- * about the most recent outcome. The map is bounded by the cardinality
- * budget above (72 entries worst case).
- */
-const lastStatusByLabels = new Map();
-let cachedMeter;
-let cachedInstruments;
-/**
- * Lazy instrument factory. Re-creates instruments and re-registers the
- * gauge callback when the global MeterProvider changes (the typical case
- * is a test that calls `metrics.setGlobalMeterProvider` for isolation —
- * the previous Meter's instruments are no longer wired to the active
- * provider so calling `.add()` / `.record()` on them silently drops data).
- */
-function getInstruments() {
-    const meter = api_1.metrics.getMeter(METER_NAME);
-    if (meter === cachedMeter && cachedInstruments) {
-        return cachedInstruments;
-    }
-    cachedMeter = meter;
-    cachedInstruments = {
-        counter: meter.createCounter(METRIC_COUNT, {
-            description: "Count of npm install invocations from Superblocks-owned paths.",
-            unit: "{install}",
-        }),
-        histogram: meter.createHistogram(METRIC_DURATION, {
-            description: "Duration of npm install invocations.",
-            unit: "ms",
-        }),
-    };
-    const gauge = meter.createObservableGauge(METRIC_STATUS, {
-        description: "Last-seen npm install status (1 = success, 0 = anything else) per runner+registry+outcome. For at-a-glance dashboards.",
-    });
-    gauge.addCallback((result) => {
-        for (const { value, attrs } of lastStatusByLabels.values()) {
-            result.observe(value, attrs);
-        }
-    });
-    return cachedInstruments;
-}
-/**
- * Emit one observation of the install metric triple and return the matching
- * span-attribute pair. Idempotent w.r.t. the metric SDK; safe to call from
- * `finally` blocks where the same code path may also throw.
- */
-function recordNpmInstall(input) {
-    const { counter, histogram } = getInstruments();
-    const registry_host = (0, sanitize_npm_attributes_js_1.bucketNpmRegistryHost)(input.registryHost);
-    const outcome = (0, sanitize_npm_attributes_js_1.normalizeNpmOutcome)(input.outcome);
-    const attrs = {
-        runner: input.runner,
-        registry_host,
-        outcome,
-    };
-    counter.add(1, attrs);
-    histogram.record(Math.max(0, input.durationMs), attrs);
-    const key = `${attrs.runner}|${attrs.registry_host}|${attrs.outcome}`;
-    lastStatusByLabels.set(key, {
-        value: outcome === "success" ? 1 : 0,
-        attrs,
-    });
-    return {
-        "npm.registry_host": registry_host,
-        "npm.outcome": outcome,
-    };
-}
-/**
- * Test-only: clear cached instruments + last-seen gauge state. Required
- * when a test installs its own MeterProvider, so the next emit re-binds to
- * the test provider and prior runs' gauge entries don't bleed across.
- */
-function _resetNpmInstallMetricsForTesting() {
-    cachedMeter = undefined;
-    cachedInstruments = undefined;
-    lastStatusByLabels.clear();
-}
-//# sourceMappingURL=npm-install-metrics.js.map

package/dist/common/npm-install-metrics.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"npm-install-metrics.js","sourceRoot":"","sources":["../../src/common/npm-install-metrics.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;;;AA4IH,4CA0BC;AAOD,8EAIC;AA/KD,4CAA0E;AAE1E,6EAKsC;AAEtC;;;;;;;;;;;;;;;;GAgBG;AACU,QAAA,mBAAmB,GAAG;IACjC,aAAa;IACb,kBAAkB;IAClB,UAAU;CACF,CAAC;AAGX,MAAM,UAAU,GAAG,wCAAwC,CAAC;AAE5D,MAAM,YAAY,GAAG,+BAA+B,CAAC;AACrD,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAC3D,MAAM,aAAa,GAAG,gCAAgC,CAAC;AAavD;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAG/B,CAAC;AAEJ,IAAI,WAA8B,CAAC;AACnC,IAAI,iBAA0C,CAAC;AAE/C;;;;;;GAMG;AACH,SAAS,cAAc;IACrB,MAAM,KAAK,GAAG,aAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,WAAW,IAAI,iBAAiB,EAAE,CAAC;QAC/C,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,WAAW,GAAG,KAAK,CAAC;IACpB,iBAAiB,GAAG;QAClB,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,EAAE;YACzC,WAAW,EACT,gEAAgE;YAClE,IAAI,EAAE,WAAW;SAClB,CAAC;QACF,SAAS,EAAE,KAAK,CAAC,eAAe,CAAC,eAAe,EAAE;YAChD,WAAW,EAAE,sCAAsC;YACnD,IAAI,EAAE,IAAI;SACX,CAAC;KACH,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,CAAC,qBAAqB,CAAC,aAAa,EAAE;QACvD,WAAW,EACT,wHAAwH;KAC3H,CAAC,CAAC;IACH,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,EAAE;QAC3B,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAiCD;;;;GAIG;AACH,SAAgB,gBAAgB,CAC9B,KAA4B;IAE5B,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IAEhD,MAAM,aAAa,GAAG,IAAA,kDAAqB,EAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,IAAA,gDAAmB,EAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,KAAK,GAAyB;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa;QACb,OAAO;KACR,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtB,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IAEvD,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;IACtE,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE;QAC1B,KAAK,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,KAAK;KACN,CAAC,CAAC;IAEH,OAAO;QACL,mBAAmB,EAAE,aAAa;QAClC,aAAa,EAAE,OAAO;KACvB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,iCAAiC;IAC/C,WAAW,GAAG,SAAS,CAAC;IACxB,iBAAiB,GAAG,SAAS,CAAC;IAC9B,kBAAkB,CAAC,KAAK,EAAE,CAAC;AAC7B,CAAC"}

package/dist/common/sanitize-npm-attributes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sanitize-npm-attributes.d.ts","sourceRoot":"","sources":["../../src/common/sanitize-npm-attributes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,eAAO,MAAM,oBAAoB,+CAIvB,CAAC;AACX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAKtE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,iBAAiB,CAkBnB;AAeD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,CAWR;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB,sDAK3B,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7E,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,cAAc,EAAE,iBAAiB,GAChC,oBAAoB,CAetB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,yIAQf,CAAC;AACX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAIvD,iEAAiE;AACjE,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,UAAU,CAGZ;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,0EAA0E;AAC1E,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,iBAAiB,CAAC;IACjC,mBAAmB,EAAE,oBAAoB,CAAC;IAC1C,OAAO,EAAE,UAAU,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,iBAAiB,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,UAAU,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,kBAAkB,GACxB,mBAAmB,CAUrB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,kBAAkB,GACxB,kBAAkB,CAMpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CA0BpE"}

package/dist/common/sanitize-npm-attributes.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sanitize-npm-attributes.js","sourceRoot":"","sources":["../../src/common/sanitize-npm-attributes.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;;;AA4BH,sDAoBC;AAoCD,wDAaC;AAwBD,oDAkBC;AAuBD,kDAKC;AA+BD,wDAYC;AAQD,sDAQC;AA2BD,wEA0BC;AArRD,iEAAuE;AAE1D,QAAA,oBAAoB,GAAG;IAClC,YAAY;IACZ,SAAS;IACT,SAAS;CACD,CAAC;AAGX,yDAAyD;AACzD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAS,CAAC,oBAAoB,CAAC,CAAC,CAAC;AAEjE;;;;;;;;;;;;;GAaG;AACH,SAAgB,qBAAqB,CACnC,KAAgC;IAEhC,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAErC,IAAI,IAAY,CAAC;IACjB,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,CAAC;IAED,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAClC,OAAO,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED,iFAAiF;AACjF,MAAM,qBAAqB,GACzB,oDAAoD,CAAC;AAEvD;;;;;;GAMG;AACH,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAExC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAgB,sBAAsB,CACpC,KAAgC;IAEhC,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,GAAG,2BAA2B;QAAE,OAAO,SAAS,CAAC;IACnE,0EAA0E;IAC1E,2EAA2E;IAC3E,IAAI,IAAA,0CAAwB,EAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACU,QAAA,wBAAwB,GAAG;IACtC,QAAQ;IACR,SAAS;IACT,SAAS;IACT,SAAS;CACD,CAAC;AAGX,SAAgB,oBAAoB,CAClC,KAAgC,EAChC,cAAiC;IAEjC,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,GAAG,2BAA2B;QAAE,OAAO,SAAS,CAAC;IACnE,IAAI,IAAA,0CAAwB,EAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACxD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IACzE,QAAQ,cAAc,EAAE,CAAC;QACvB,KAAK,YAAY;YACf,OAAO,QAAQ,CAAC;QAClB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACU,QAAA,YAAY,GAAG;IAC1B,SAAS;IACT,iBAAiB;IACjB,sBAAsB;IACtB,sBAAsB;IACtB,YAAY;IACZ,uBAAuB;IACvB,OAAO;CACC,CAAC;AAGX,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS,oBAAY,CAAC,CAAC;AAEtD,iEAAiE;AACjE,SAAgB,mBAAmB,CACjC,KAAgC;IAEhC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9C,OAAO,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAoB,CAAC,CAAC,CAAC,OAAO,CAAC;AACtE,CAAC;AA0BD;;;;GAIG;AACH,SAAgB,sBAAsB,CACpC,KAAyB;IAEzB,MAAM,aAAa,GAAG,qBAAqB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACjE,OAAO;QACL,aAAa;QACb,mBAAmB,EAAE,oBAAoB,CACvC,KAAK,CAAC,YAAY,EAClB,aAAa,CACd;QACD,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CACnC,KAAyB;IAEzB,OAAO;QACL,aAAa,EAAE,qBAAqB,CAAC,KAAK,CAAC,aAAa,CAAC;QACzD,YAAY,EAAE,sBAAsB,CAAC,KAAK,CAAC,YAAY,CAAC;QACxD,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAgB,8BAA8B,CAAC,KAAa;IAC1D,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC/B,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,mEAAmE;IACnE,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,EAAE;QACxD,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC5C,OAAO,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC;IAChE,CAAC,CAAC,CAAC;IACH,sEAAsE;IACtE,qEAAqE;IACrE,qEAAqE;IACrE,yDAAyD;IACzD,GAAG,GAAG,GAAG,CAAC,OAAO,CACf,8CAA8C,EAC9C,CAAC,EAAE,EAAE,IAAY,EAAE,EAAE,CAAC,GAAG,IAAI,SAAS,CACvC,CAAC;IACF,oEAAoE;IACpE,0EAA0E;IAC1E,yEAAyE;IACzE,GAAG,GAAG,GAAG,CAAC,OAAO,CACf,oDAAoD,EACpD,CAAC,EAAE,EAAE,IAAY,EAAE,EAAE,CAAC,WAAW,IAAI,SAAS,CAC/C,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist-esm/common/npm-install-metrics.d.ts

@@ -1,88 +0,0 @@
-/**
- * NPM Install Metrics (APPS-4189 / P6.2)
- *
- * Emits `superblocks.npm.install.*` metrics from every npm install path
- * Superblocks owns and returns the matching attribute set so the caller can
- * annotate its active llmobs span with the same dimensions. The metric and
- * span streams share a closed attribute set so dashboards and traces join
- * cleanly without dimension drift.
- *
- * Cardinality budget (documented contract — must not regress without a
- * migration plan; every dashboard and Datadog saved facet pins on these):
- *
- *   - `registry_host` ≤ 3  (`public_npm` | `private` | `unknown`)
- *   - `outcome`       ≤ 6  (`NPM_OUTCOMES`)
- *   - `runner`        ≤ 4  (`NPM_INSTALL_RUNNERS`)
- *
- * Total dimension product is bounded at 3 × 6 × 4 = 72 series, well under
- * any per-metric ceiling. New runners or outcomes go through P6.1
- * (sanitization policy) so a future emitter cannot blow the budget by
- * accident.
- *
- * Every value flows through the P6.1 helpers in `./sanitize-npm-attributes`
- * before reaching an OTel instrument, so raw registry hostnames and tokens
- * cannot escape via this emitter — the same guarantee the audit-event
- * emitter (P6.3) relies on.
- */
-import { type NpmOutcome, type NpmRegistryBucket } from "./sanitize-npm-attributes.js";
-/**
- * Closed enum of npm install call sites that emit metrics. One value per
- * call site Superblocks owns. Names are stabilised here; renaming any
- * value breaks every saved dashboard and alert split on `runner`, so
- * additions/removals must come with a migration plan.
- *
- *   - `install_all`      — full install from package.json (no specific
- *                          packages). Covers both `AppShell.runNpmInstall`
- *                          and `AppShell.runPackageManagerInstall`; the
- *                          two are semantically the same operation routed
- *                          through different package managers.
- *   - `install_specific` — `AppShell.installSpecificPackages` (named
- *                          packages via `npm add` / equivalent).
- *   - `prefetch`         — `installTemplateModules` (template
- *                          `node_modules` prefetch during AiService
- *                          construction).
- */
-export declare const NPM_INSTALL_RUNNERS: readonly ["install_all", "install_specific", "prefetch"];
-export type NpmInstallRunner = (typeof NPM_INSTALL_RUNNERS)[number];
-export interface NpmInstallMetricInput {
-    /** Which install call site emitted this event. */
-    runner: NpmInstallRunner;
-    /**
-     * Registry URL or bare hostname the install was attempting (`null` /
-     * `undefined` is fine — bucketed to `unknown`). Always passed through
-     * `bucketNpmRegistryHost` before emission, so raw hostnames cannot leak.
-     */
-    registryHost: string | null | undefined;
-    /**
-     * Outcome key. Free-form on input; coerced to the closed
-     * `NPM_OUTCOMES` enum at the emit boundary (unknown strings → `other`).
-     * Use the `NpmInstallBlocked.reason` value for failures and the literal
-     * `"success"` on the happy path.
-     */
-    outcome: string | null | undefined;
-    /** Elapsed wall-clock time in milliseconds; clamped at 0. */
-    durationMs: number;
-}
-/**
- * Attribute set shaped for direct spread into
- * `llmobs.annotate({ tags: ... })`. Returned by `recordNpmInstall` so the
- * span on the active install call site carries the exact same values that
- * just went into the metric pipeline.
- */
-export interface NpmInstallSpanAttributes {
-    "npm.registry_host": NpmRegistryBucket;
-    "npm.outcome": NpmOutcome;
-}
-/**
- * Emit one observation of the install metric triple and return the matching
- * span-attribute pair. Idempotent w.r.t. the metric SDK; safe to call from
- * `finally` blocks where the same code path may also throw.
- */
-export declare function recordNpmInstall(input: NpmInstallMetricInput): NpmInstallSpanAttributes;
-/**
- * Test-only: clear cached instruments + last-seen gauge state. Required
- * when a test installs its own MeterProvider, so the next emit re-binds to
- * the test provider and prior runs' gauge entries don't bleed across.
- */
-export declare function _resetNpmInstallMetricsForTesting(): void;
-//# sourceMappingURL=npm-install-metrics.d.ts.map

package/dist-esm/common/npm-install-metrics.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"npm-install-metrics.d.ts","sourceRoot":"","sources":["../../src/common/npm-install-metrics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,iBAAiB,EACvB,MAAM,8BAA8B,CAAC;AAEtC;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,mBAAmB,0DAItB,CAAC;AACX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAuEpE,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,MAAM,EAAE,gBAAgB,CAAC;IACzB;;;;OAIG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACxC;;;;;OAKG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACnC,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,mBAAmB,EAAE,iBAAiB,CAAC;IACvC,aAAa,EAAE,UAAU,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,qBAAqB,GAC3B,wBAAwB,CAwB1B;AAED;;;;GAIG;AACH,wBAAgB,iCAAiC,IAAI,IAAI,CAIxD"}

package/dist-esm/common/npm-install-metrics.js

@@ -1,135 +0,0 @@
-/**
- * NPM Install Metrics (APPS-4189 / P6.2)
- *
- * Emits `superblocks.npm.install.*` metrics from every npm install path
- * Superblocks owns and returns the matching attribute set so the caller can
- * annotate its active llmobs span with the same dimensions. The metric and
- * span streams share a closed attribute set so dashboards and traces join
- * cleanly without dimension drift.
- *
- * Cardinality budget (documented contract — must not regress without a
- * migration plan; every dashboard and Datadog saved facet pins on these):
- *
- *   - `registry_host` ≤ 3  (`public_npm` | `private` | `unknown`)
- *   - `outcome`       ≤ 6  (`NPM_OUTCOMES`)
- *   - `runner`        ≤ 4  (`NPM_INSTALL_RUNNERS`)
- *
- * Total dimension product is bounded at 3 × 6 × 4 = 72 series, well under
- * any per-metric ceiling. New runners or outcomes go through P6.1
- * (sanitization policy) so a future emitter cannot blow the budget by
- * accident.
- *
- * Every value flows through the P6.1 helpers in `./sanitize-npm-attributes`
- * before reaching an OTel instrument, so raw registry hostnames and tokens
- * cannot escape via this emitter — the same guarantee the audit-event
- * emitter (P6.3) relies on.
- */
-import { metrics } from "@opentelemetry/api";
-import { bucketNpmRegistryHost, normalizeNpmOutcome, } from "./sanitize-npm-attributes.js";
-/**
- * Closed enum of npm install call sites that emit metrics. One value per
- * call site Superblocks owns. Names are stabilised here; renaming any
- * value breaks every saved dashboard and alert split on `runner`, so
- * additions/removals must come with a migration plan.
- *
- *   - `install_all`      — full install from package.json (no specific
- *                          packages). Covers both `AppShell.runNpmInstall`
- *                          and `AppShell.runPackageManagerInstall`; the
- *                          two are semantically the same operation routed
- *                          through different package managers.
- *   - `install_specific` — `AppShell.installSpecificPackages` (named
- *                          packages via `npm add` / equivalent).
- *   - `prefetch`         — `installTemplateModules` (template
- *                          `node_modules` prefetch during AiService
- *                          construction).
- */
-export const NPM_INSTALL_RUNNERS = [
-    "install_all",
-    "install_specific",
-    "prefetch",
-];
-const METER_NAME = "@superblocksteam/telemetry/npm-install";
-const METRIC_COUNT = "superblocks.npm.install.count";
-const METRIC_DURATION = "superblocks.npm.install.duration";
-const METRIC_STATUS = "superblocks.npm.install.status";
-/**
- * Last-seen status keyed by the attribute tuple. The observable gauge
- * callback reads this on every collection cycle. Entries are intentionally
- * kept until the process exits (or the test reset helper runs): the gauge
- * is "last-seen for dashboards" and a stale combo dropping out would lie
- * about the most recent outcome. The map is bounded by the cardinality
- * budget above (72 entries worst case).
- */
-const lastStatusByLabels = new Map();
-let cachedMeter;
-let cachedInstruments;
-/**
- * Lazy instrument factory. Re-creates instruments and re-registers the
- * gauge callback when the global MeterProvider changes (the typical case
- * is a test that calls `metrics.setGlobalMeterProvider` for isolation —
- * the previous Meter's instruments are no longer wired to the active
- * provider so calling `.add()` / `.record()` on them silently drops data).
- */
-function getInstruments() {
-    const meter = metrics.getMeter(METER_NAME);
-    if (meter === cachedMeter && cachedInstruments) {
-        return cachedInstruments;
-    }
-    cachedMeter = meter;
-    cachedInstruments = {
-        counter: meter.createCounter(METRIC_COUNT, {
-            description: "Count of npm install invocations from Superblocks-owned paths.",
-            unit: "{install}",
-        }),
-        histogram: meter.createHistogram(METRIC_DURATION, {
-            description: "Duration of npm install invocations.",
-            unit: "ms",
-        }),
-    };
-    const gauge = meter.createObservableGauge(METRIC_STATUS, {
-        description: "Last-seen npm install status (1 = success, 0 = anything else) per runner+registry+outcome. For at-a-glance dashboards.",
-    });
-    gauge.addCallback((result) => {
-        for (const { value, attrs } of lastStatusByLabels.values()) {
-            result.observe(value, attrs);
-        }
-    });
-    return cachedInstruments;
-}
-/**
- * Emit one observation of the install metric triple and return the matching
- * span-attribute pair. Idempotent w.r.t. the metric SDK; safe to call from
- * `finally` blocks where the same code path may also throw.
- */
-export function recordNpmInstall(input) {
-    const { counter, histogram } = getInstruments();
-    const registry_host = bucketNpmRegistryHost(input.registryHost);
-    const outcome = normalizeNpmOutcome(input.outcome);
-    const attrs = {
-        runner: input.runner,
-        registry_host,
-        outcome,
-    };
-    counter.add(1, attrs);
-    histogram.record(Math.max(0, input.durationMs), attrs);
-    const key = `${attrs.runner}|${attrs.registry_host}|${attrs.outcome}`;
-    lastStatusByLabels.set(key, {
-        value: outcome === "success" ? 1 : 0,
-        attrs,
-    });
-    return {
-        "npm.registry_host": registry_host,
-        "npm.outcome": outcome,
-    };
-}
-/**
- * Test-only: clear cached instruments + last-seen gauge state. Required
- * when a test installs its own MeterProvider, so the next emit re-binds to
- * the test provider and prior runs' gauge entries don't bleed across.
- */
-export function _resetNpmInstallMetricsForTesting() {
-    cachedMeter = undefined;
-    cachedInstruments = undefined;
-    lastStatusByLabels.clear();
-}
-//# sourceMappingURL=npm-install-metrics.js.map

package/dist-esm/common/npm-install-metrics.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"npm-install-metrics.js","sourceRoot":"","sources":["../../src/common/npm-install-metrics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,OAAO,EAA+B,MAAM,oBAAoB,CAAC;AAE1E,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GAGpB,MAAM,8BAA8B,CAAC;AAEtC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,aAAa;IACb,kBAAkB;IAClB,UAAU;CACF,CAAC;AAGX,MAAM,UAAU,GAAG,wCAAwC,CAAC;AAE5D,MAAM,YAAY,GAAG,+BAA+B,CAAC;AACrD,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAC3D,MAAM,aAAa,GAAG,gCAAgC,CAAC;AAavD;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAG/B,CAAC;AAEJ,IAAI,WAA8B,CAAC;AACnC,IAAI,iBAA0C,CAAC;AAE/C;;;;;;GAMG;AACH,SAAS,cAAc;IACrB,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,WAAW,IAAI,iBAAiB,EAAE,CAAC;QAC/C,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,WAAW,GAAG,KAAK,CAAC;IACpB,iBAAiB,GAAG;QAClB,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,EAAE;YACzC,WAAW,EACT,gEAAgE;YAClE,IAAI,EAAE,WAAW;SAClB,CAAC;QACF,SAAS,EAAE,KAAK,CAAC,eAAe,CAAC,eAAe,EAAE;YAChD,WAAW,EAAE,sCAAsC;YACnD,IAAI,EAAE,IAAI;SACX,CAAC;KACH,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,CAAC,qBAAqB,CAAC,aAAa,EAAE;QACvD,WAAW,EACT,wHAAwH;KAC3H,CAAC,CAAC;IACH,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,EAAE;QAC3B,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAiCD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAA4B;IAE5B,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IAEhD,MAAM,aAAa,GAAG,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,KAAK,GAAyB;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa;QACb,OAAO;KACR,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtB,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IAEvD,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;IACtE,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE;QAC1B,KAAK,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,KAAK;KACN,CAAC,CAAC;IAEH,OAAO;QACL,mBAAmB,EAAE,aAAa;QAClC,aAAa,EAAE,OAAO;KACvB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iCAAiC;IAC/C,WAAW,GAAG,SAAS,CAAC;IACxB,iBAAiB,GAAG,SAAS,CAAC;IAC9B,kBAAkB,CAAC,KAAK,EAAE,CAAC;AAC7B,CAAC"}

package/dist-esm/common/sanitize-npm-attributes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sanitize-npm-attributes.d.ts","sourceRoot":"","sources":["../../src/common/sanitize-npm-attributes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,eAAO,MAAM,oBAAoB,+CAIvB,CAAC;AACX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAKtE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,iBAAiB,CAkBnB;AAeD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,CAWR;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB,sDAK3B,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7E,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,cAAc,EAAE,iBAAiB,GAChC,oBAAoB,CAetB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,yIAQf,CAAC;AACX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAIvD,iEAAiE;AACjE,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,UAAU,CAGZ;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,0EAA0E;AAC1E,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,iBAAiB,CAAC;IACjC,mBAAmB,EAAE,oBAAoB,CAAC;IAC1C,OAAO,EAAE,UAAU,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,iBAAiB,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,UAAU,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,kBAAkB,GACxB,mBAAmB,CAUrB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,kBAAkB,GACxB,kBAAkB,CAMpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CA0BpE"}

package/dist-esm/common/sanitize-npm-attributes.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sanitize-npm-attributes.js","sourceRoot":"","sources":["../../src/common/sanitize-npm-attributes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,YAAY;IACZ,SAAS;IACT,SAAS;CACD,CAAC;AAGX,yDAAyD;AACzD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAS,CAAC,oBAAoB,CAAC,CAAC,CAAC;AAEjE;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAgC;IAEhC,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAErC,IAAI,IAAY,CAAC;IACjB,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,CAAC;IAED,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAClC,OAAO,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED,iFAAiF;AACjF,MAAM,qBAAqB,GACzB,oDAAoD,CAAC;AAEvD;;;;;;GAMG;AACH,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAExC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAgC;IAEhC,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,GAAG,2BAA2B;QAAE,OAAO,SAAS,CAAC;IACnE,0EAA0E;IAC1E,2EAA2E;IAC3E,IAAI,wBAAwB,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,QAAQ;IACR,SAAS;IACT,SAAS;IACT,SAAS;CACD,CAAC;AAGX,MAAM,UAAU,oBAAoB,CAClC,KAAgC,EAChC,cAAiC;IAEjC,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,GAAG,2BAA2B;QAAE,OAAO,SAAS,CAAC;IACnE,IAAI,wBAAwB,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACxD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IACzE,QAAQ,cAAc,EAAE,CAAC;QACvB,KAAK,YAAY;YACf,OAAO,QAAQ,CAAC;QAClB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,SAAS;IACT,iBAAiB;IACjB,sBAAsB;IACtB,sBAAsB;IACtB,YAAY;IACZ,uBAAuB;IACvB,OAAO;CACC,CAAC;AAGX,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS,YAAY,CAAC,CAAC;AAEtD,iEAAiE;AACjE,MAAM,UAAU,mBAAmB,CACjC,KAAgC;IAEhC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9C,OAAO,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAoB,CAAC,CAAC,CAAC,OAAO,CAAC;AACtE,CAAC;AA0BD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAyB;IAEzB,MAAM,aAAa,GAAG,qBAAqB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACjE,OAAO;QACL,aAAa;QACb,mBAAmB,EAAE,oBAAoB,CACvC,KAAK,CAAC,YAAY,EAClB,aAAa,CACd;QACD,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAyB;IAEzB,OAAO;QACL,aAAa,EAAE,qBAAqB,CAAC,KAAK,CAAC,aAAa,CAAC;QACzD,YAAY,EAAE,sBAAsB,CAAC,KAAK,CAAC,YAAY,CAAC;QACxD,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAa;IAC1D,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC/B,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,mEAAmE;IACnE,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,EAAE;QACxD,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC5C,OAAO,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC;IAChE,CAAC,CAAC,CAAC;IACH,sEAAsE;IACtE,qEAAqE;IACrE,qEAAqE;IACrE,yDAAyD;IACzD,GAAG,GAAG,GAAG,CAAC,OAAO,CACf,8CAA8C,EAC9C,CAAC,EAAE,EAAE,IAAY,EAAE,EAAE,CAAC,GAAG,IAAI,SAAS,CACvC,CAAC;IACF,oEAAoE;IACpE,0EAA0E;IAC1E,yEAAyE;IACzE,GAAG,GAAG,GAAG,CAAC,OAAO,CACf,oDAAoD,EACpD,CAAC,EAAE,EAAE,IAAY,EAAE,EAAE,CAAC,WAAW,IAAI,SAAS,CAC/C,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC"}