@unbrained/pm-cli 2026.10.17 → 2026.10.19

package/docs/SDK.md

@@ -210,6 +210,32 @@ follow the migration guidance for changed unions or error codes. The shared
 [primitive inventory](SDK_PRIMITIVE_INVENTORY.md) records CLI/MCP ownership:
 presentation modules import the SDK and have zero private-core edges.
 
+### Portable merge settlement
+
+Tracked by [pm-gh1475](../.agents/pm/issues/pm-gh1475.toon) and
+[pm-gh1491](../.agents/pm/issues/pm-gh1491.toon). Import `runMergeInstall`,
+`runMergeReconcile`, and `inspectMergeReceiptEvidence` from
+`@unbrained/pm-cli/sdk/merge`. `runMergeInstall({ preCommitHook: true }, global)`
+explicitly installs the merge-aware pre-commit hook; the default installs no hook.
+`runMergeReconcile({ stage: true }, global)` previews first and stages only
+verified lossless history and receipt artifacts. It refuses forced acceptance,
+competing values, unrelated drift, dirty reconciliation paths and unresolved Git
+paths. `staged_paths` reports exactly which relative paths were added to the index.
+
+The single-commit journey pauses Git with `git merge --no-commit --no-ff` before
+reconciliation or an opted-in pre-commit hook runs. `durable_receipt_ids` on the
+inspection result reports counterparts with matching immutable provenance in
+the active Git index. `unstaged_durable_receipt_ids` separates valid filesystem
+sidecars that a read-only preview may inspect. Guarded staging prepares new
+sidecars before auditing and restores their new index entries if apply fails.
+Inspection lists indexed candidates once and reads bounded object batches.
+Guarded settlement resolves tracker aliases before preview, proof verification
+and apply, so every phase uses the same physical tracker root.
+Ordinary apply requires indexed proof first. Missing portable proof
+refuses an audit write even with `force`; local receipts alone cannot authorize
+committed history references. See [Merge safety](MERGE_SAFETY.md#settle-a-lossless-merge-in-one-commit)
+for the complete operator workflow and recovery boundaries.
+
 ### Build an entire custom project tool
 
 The [SDK-only custom-tool exemplar](examples/sdk-custom-tool/README.md)

package/docs/SDK_CONTEXT_COORDINATION.md

@@ -1,6 +1,8 @@
 # SDK context coordination primitives
 
-Trackers: [pm-e200](../.agents/pm/features/pm-e200.toon), [pm-ez1dfg](../.agents/pm/tasks/pm-ez1dfg.toon), [pm-4ri6](../.agents/pm/features/pm-4ri6.toon), and [pm-hcrmye](../.agents/pm/issues/pm-hcrmye.toon).
+Trackers: [pm-e200](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/features/pm-e200.toon), [pm-ez1dfg](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-ez1dfg.toon), [pm-4ri6](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/features/pm-4ri6.toon), [pm-hcrmye](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-hcrmye.toon), [pm-gh1485](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-gh1485.toon), and [pm-xj80p9](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-xj80p9.toon).
+
+Tracker records live in the repository and are excluded from the npm package.
 
 `pm` treats project management as context management. These primitives let an
 agent learn what changed, avoid creating redundant work, and keep that work
@@ -38,10 +40,61 @@ idempotently or deduplicate replays. `--cursor-mode row` preserves the previous
 shape with one `cursor` per event and no trailer for consumers that checkpoint
 every row. Already issued version-1 cursors remain accepted by `--since`.
 
-Node runtimes use the rebuildable SQLite event projection. Runtimes such as Bun
-that do not expose `node:sqlite` transparently scan the authoritative history
+Version-1 cursor ordering uses recorded timestamps, stream ids, and offsets.
+A fact committed later with an older timestamp falls before an advanced cursor.
+Clock-independent ordering and late-commit recovery remain tracked by
+[pm-10l1vm](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-10l1vm.toon). Hosts needing complete concurrent
+observation can retain a fixed lower boundary and deduplicate snapshots by
+`item_id` and `version` while work is being committed.
+
+Runtimes exposing `node:sqlite` use the rebuildable SQLite event projection.
+Runtimes without it transparently scan the authoritative history
 streams with the same ordering, filters, pagination, and cursor contract; pages
 identify that path with `source: "authoritative_history"`.
+Writers without SQLite use the same pending and committed invalidation protocol,
+so a later Node writer cannot certify a cache that omitted their facts.
+Incremental writes also verify the previous size receipt before advancing it,
+so merged history cannot be hidden by a later append. Upgraded runtimes rebuild
+legacy projections that could contain omitted facts with apparently current
+receipts; authoritative history does not require a format migration.
+
+Index readers take a synchronous SQLite read transaction containing both event
+rows and their stream-size receipts, then close the database before checking
+authoritative files. They acquire neither history-index writer lock. File
+identity and write timestamps, authoritative stream sizes, and pending or
+committed invalidations must still match before a snapshot is returned. A
+concurrent change refuses the optional snapshot; it cannot certify older rows
+using a newer size receipt.
+
+Incremental projection writes also use a zero SQLite busy timeout. Native
+reader or writer contention falls back to the authoritative append and
+invalidation protocol instead of spending a separate SQLite wait budget.
+An unexpired, token-owned append lease marks ordinary incremental work as
+active until its commit or invalidation completes. Native contention retains
+the cache file and a committed contention marker; a zero-wait native probe
+distinguishes an ongoing contender from settled damage before requesting repair.
+
+Authoritative writers fail fast when an active owner holds the projection writer
+lock, including when a full repair owns it. They publish an invalidation instead.
+Stale-owner recovery follows the built-in lock policy. A repair
+refuses publication if those markers changed during its scan. Full projection
+construction yields between batches, and marker cleanup occurs outside the
+short invalidation publication lock.
+After a refused full publication or failed repair, a best effort per-tracker runtime receipt
+defers automatic repair for five seconds. Busy periods therefore do not restart
+a complete SQLite build on every read. Pages and recency reads continue using
+authoritative history; after the cooldown, a later read can repair during a
+quiet interval. This backoff bounds repair frequency, not index availability
+during continuous writes.
+
+Transient generation changes and SQLite contention use authoritative fallback
+directly. Missing, incompatible, or damaged projections receive one optional
+repair attempt without waiting for either projection lock. Repair failure or
+invalidation after rebuilding
+falls back to authoritative JSONL with the same filters and cursor format.
+Pages may change `source` between calls. A fallback still reports malformed or
+inaccessible authoritative history as an error. A successful repair may scan
+the workspace; this protocol bounds lock waiting, not total execution time.
 
 `--full` also includes the complete authoritative history entry.
 `--type`, `--author`, and `--item` accept repeatable or comma-separated values.
@@ -109,10 +162,7 @@ Package authors can query the same scorer used by create/copy and the bundled
 governance audit:
 
 ```ts
-import {
-  findSimilarItems,
-  scoreItemSimilarity,
-} from "@unbrained/pm-cli/sdk";
+import { findSimilarItems, scoreItemSimilarity } from "@unbrained/pm-cli/sdk";
 
 const score = scoreItemSimilarity("Fix OAuth refresh", "Fix oauth refresh");
 const matches = await findSimilarItems(
@@ -155,6 +205,20 @@ accepted aliases for existing automation.
 
 ## Scale contract
 
+The mixed-reader acceptance used 100 fixed-boundary snapshot observers,
+five SDK writer lanes, and five CLI writer lanes, with five updates per lane.
+Both separate traced and untraced cohorts passed 5,000 unique observations,
+duplicate-free pages, strict history integrity, and a 2,000 ms first-observation
+ceiling. These are bounded host measurements recorded in
+[pm-gh1485](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-gh1485.toon).
+
+The native regression suspends filesystem validation and requires an
+authoritative writer to finish before that reader resumes. Run it with:
+
+```bash
+node scripts/run-tests.mjs test -- tests/unit/core/history/event-index-snapshots.spec.ts
+```
+
 Event catch-up reads from a persistent ordered projection and follows only new
 rows. Similarity governance is zero-cost when off and index-bounded when
 enabled on an indexed workspace. Production bundles are syntax-, whitespace-,

package/docs/SDK_STORAGE_LIFECYCLE.md

@@ -1,6 +1,9 @@
 # SDK Storage Lifecycle
 
-Tracked by [pm-p5u6](../.agents/pm/chores/pm-p5u6.toon).
+Tracked by [pm-p5u6](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-p5u6.toon) and
+[pm-xj80p9](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-xj80p9.toon).
+
+Tracker records live in the repository and are excluded from the npm package.
 
 Detached telemetry reads existing settings without scaffolding schemas/identity.
 Locks, queue/state rewrites and event/OTLP completion preserve owner-removed
@@ -10,7 +13,17 @@ storage. Delivery stays best effort/nonblocking; foreground defaults create pare
 import { acquireLock, writeFileAtomic } from "@unbrained/pm-cli/sdk";
 
 const policy = { createParentDirectories: false };
-const release = await acquireLock(root, "job", 60, "worker", false, true, 5000, policy);
+const lockOptions = { ...policy, maxWaitMs: 0 };
+const release = await acquireLock(
+  root,
+  "job",
+  60,
+  "worker",
+  false,
+  true,
+  5000,
+  lockOptions,
+);
 try {
   await writeFileAtomic(resultPath, serializedResult, policy);
 } finally {
@@ -22,6 +35,15 @@ Owners initialize lock/result parents; absence fails without recreation. The
 policy cannot pin identity or prevent symlink/replacement races. Extension lock
 overrides own their lifecycle.
 
+For optional background work, pass `maxWaitMs: 0` in the final `acquireLock`
+options object. The built-in lock then fails fast for active contention, even
+when `PM_LOCK_WAIT_MS` requests a longer wait. Stale-lock handling may still
+retry creation after removing a confirmed stale owner. A positive `maxWaitMs` caps the normal
+environment-or-caller retry budget without increasing it. Filesystem calls and
+extension execution still take their ordinary execution time; the cap is not a
+wall-clock timeout. Extension lock overrides receive `max_wait_ms` and remain
+responsible for observing it.
+
 Async scripts use `registerTempOperation`: signal children, check after
 uncancellable SDK work, `finish` after finally disposal. Interrupts close admission
 and await completion; timeout retains evidence. Sync scripts use

package/docs/TESTING.md

@@ -97,6 +97,13 @@ so PR-local CodeFactor maintainability annotations fail locally before commit or
 push. Existing legacy high-complexity test fixtures are tracked separately and
 must not be used as precedent for new changed production/script code.
 
+Module-usage checks share the SDK boundary's literal-specifier parser and walk
+nested AST nodes, including lazy `import("./module.js")` references. Unused
+modules, comment-only references, and computed paths do not gain incoming
+references. The regression is tracked by
+[pm-f38ovr](../.agents/pm/issues/pm-f38ovr.toon); no module allowance or threshold
+increase is required to keep optional SDK capabilities lazy.
+
 The same required static gate validates an explicit seven-day Dependabot
 cooldown for every updater and requires both npm and GitHub Actions entries.
 Missing values, semver overrides outside 7–90 days, invalid YAML, removed
@@ -209,6 +216,14 @@ Use focused runs while iterating, then run coverage before closure when risk or
 
 ## CI Retry and Timeout Diagnostics
 
+The required `Gates (coverage)` job runs after the coverage matrix settles and
+explicitly requires every shard to succeed. Failed, canceled, skipped, or missing
+shard outcomes fail that required context before checkout or report merging.
+Shard artifacts retain failure diagnostics. After successful shard admission,
+coverage-threshold failures still retain merged reports and Codecov uploads.
+This enforcement is tracked by [pm-0p4aal](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-0p4aal.toon).
+Tracker records live in the repository and are excluded from the npm package.
+
 Platform regressions from [pm-hrhfgi](../.agents/pm/issues/pm-hrhfgi.toon) and
 [pm-zk67yf](../.agents/pm/issues/pm-zk67yf.toon) have portable negative controls.
 Complete source scans process at most 32 item files per batch; the descriptor

package/docs/examples/ci/github-actions-pm-extension-gate.yml

@@ -16,7 +16,7 @@ jobs:
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 11.10.0
+          version: 11.28.5
 
       - name: Setup Node
         uses: actions/setup-node@v4

package/docs/examples/ci/gitlab-ci-pm-extension-gate.yml

@@ -8,7 +8,7 @@ stages:
 
 before_script:
   - corepack enable
-  - corepack prepare pnpm@11.10.0 --activate
+  - corepack prepare pnpm@11.28.5 --activate
   - pnpm install --frozen-lockfile
 
 build:

package/docs/examples/ci/jenkins-pm-extension-gate.Jenkinsfile

@@ -9,7 +9,7 @@ pipeline {
     stage("Install") {
       steps {
         sh "corepack enable"
-        sh "corepack prepare pnpm@11.10.0 --activate"
+        sh "corepack prepare pnpm@11.28.5 --activate"
         sh "pnpm install --frozen-lockfile"
       }
     }

package/docs/generated/FLAG_LEXICON_BUDGETS.md

@@ -39,7 +39,7 @@ This file is generated by `listPmFlagLexicon()`. Compatibility aliases do not co
 | `history-repair` | evidence | 27 | 27 |
 | `history-compact` | evidence | 30 | 30 |
 | `history-author-acknowledge` | evidence | 28 | 28 |
-| `merge` | workspace | 27 | 27 |
+| `merge` | workspace | 29 | 29 |
 | `schema` | workspace | 43 | 43 |
 | `profile` | workspace | 22 | 22 |
 | `activity` | context | 35 | 35 |
@@ -110,7 +110,7 @@ This file is generated by `listPmFlagLexicon()`. Compatibility aliases do not co
 | `item test worker` | internal | 20 | 20 |
 | `history acknowledge` | evidence | 28 | 28 |
 | `item copy` | intake | 24 | 24 |
-| `workspace merge` | workspace | 27 | 27 |
+| `workspace merge` | workspace | 29 | 29 |
 | `item duplicates` | context | 25 | 25 |
 | `calendar meet` | automation | 33 | 33 |
 | `calendar event` | automation | 33 | 33 |

package/docs/generated/REFUSAL_CLOSURE_CENSUS.md

@@ -4,12 +4,12 @@ Tracker: `pm-f05lsg`.
 
 Every catalog code is listed. An `uncovered` row is an explicit closure obligation, never an omission or implied approval.
 
-- Catalog error codes: 419
+- Catalog error codes: 422
 - Executable error codes: 19
 - Executable-code ratchet floor: 18
 - Required executable canonical codes: `bulk_ids_input_empty`, `bulk_ids_input_missing_path`, `bulk_ids_input_unreadable`, `invalid_argument_value`, `manifest_unknown_key`, `missing_lifecycle_target`, `missing_required_argument`, `no_version_bounds_declared`, `projection_options_mutually_exclusive`, `tracker_not_initialized`, `tracker_root_missing`, `tracker_root_not_directory`, `tracker_root_unreadable`, `unknown_context_intent`, `unknown_field_projection`, `unknown_option`, `unknown_subcommand`
-- Uncovered error codes: 400
-- Coverage fraction: 0.045346
+- Uncovered error codes: 403
+- Coverage fraction: 0.045024
 - Closed-domain probes: 19
 - Grammar probes: 117
 
@@ -221,9 +221,12 @@ Every catalog code is listed. An `uncovered` row is an explicit closure obligati
 | `merge_git_config_unwritable` | `merge_git_config_unwritable` | uncovered | none | 0 |
 | `merge_receipt_evidence_invalid` | `merge_receipt_evidence_invalid` | uncovered | none | 0 |
 | `merge_receipt_history_reference_missing` | `merge_receipt_history_reference_missing` | uncovered | none | 0 |
+| `merge_receipt_not_portable` | `merge_receipt_not_portable` | uncovered | none | 0 |
 | `merge_receipts_pending` | `merge_receipts_pending` | uncovered | none | 0 |
 | `merge_reconcile_receipt_evidence_untrusted` | `merge_reconcile_receipt_evidence_untrusted` | uncovered | none | 0 |
 | `merge_root_not_found` | `merge_root_not_found` | uncovered | none | 0 |
+| `merge_settlement_hook_conflict` | `merge_settlement_hook_conflict` | uncovered | none | 0 |
+| `merge_settlement_review_required` | `merge_settlement_review_required` | uncovered | none | 0 |
 | `missing_allowed_values` | `missing_allowed_values` | uncovered | none | 0 |
 | `missing_budget` | `missing_budget` | uncovered | none | 0 |
 | `missing_cli_flag` | `missing_cli_flag` | uncovered | none | 0 |

package/marketplace.json

@@ -1 +1 @@
-{"name":"pm","owner":{"name":"unbrained","url":"https://github.com/unbraind/pm-cli"},"description":"Official marketplace for pm CLI — native git-based project management for Claude Code and AI coding agents.","version":"2026.10.17","plugins":[{"name":"pm-claude","source":"./plugins/pm-claude","description":"Native pm CLI integration for Claude Code — 32 MCP tools, 14 workflow skills with slash invocations, 4 subagents, hybrid TUI task tracking, session context injection, and coordination subagents for git-based project management without leaving Claude Code.","version":"2026.10.17","author":{"name":"unbrained","url":"https://github.com/unbraind/pm-cli"},"homepage":"https://github.com/unbraind/pm-cli","repository":"https://github.com/unbraind/pm-cli","license":"MIT","keywords":["pm-cli","project-management","mcp","tasks","agents","workflows","git-native","task-tracker","ai"],"category":"productivity"}]}
+{"name":"pm","owner":{"name":"unbrained","url":"https://github.com/unbraind/pm-cli"},"description":"Official marketplace for pm CLI — native git-based project management for Claude Code and AI coding agents.","version":"2026.10.19","plugins":[{"name":"pm-claude","source":"./plugins/pm-claude","description":"Native pm CLI integration for Claude Code — 32 MCP tools, 14 workflow skills with slash invocations, 4 subagents, hybrid TUI task tracking, session context injection, and coordination subagents for git-based project management without leaving Claude Code.","version":"2026.10.19","author":{"name":"unbrained","url":"https://github.com/unbraind/pm-cli"},"homepage":"https://github.com/unbraind/pm-cli","repository":"https://github.com/unbraind/pm-cli","license":"MIT","keywords":["pm-cli","project-management","mcp","tasks","agents","workflows","git-native","task-tracker","ai"],"category":"productivity"}]}

package/node_modules/@opentelemetry/core/package.json

@@ -86,7 +86,8 @@
     "@opentelemetry/api": ">=1.0.0 <1.10.0"
   },
   "dependencies": {
-    "@opentelemetry/semantic-conventions": "^1.29.0"
+    "@opentelemetry/semantic-conventions": "^1.29.0",
+    "@opentelemetry/api": "1.9.1"
   },
   "homepage": "https://github.com/open-telemetry/opentelemetry-js/tree/main/packages/opentelemetry-core",
   "sideEffects": false,

package/node_modules/@opentelemetry/instrumentation/package.json

@@ -72,7 +72,8 @@
   "dependencies": {
     "@opentelemetry/api-logs": "0.220.0",
     "import-in-the-middle": "^3.0.0",
-    "require-in-the-middle": "^8.0.0"
+    "require-in-the-middle": "^8.0.0",
+    "@opentelemetry/api": "1.9.1"
   },
   "peerDependencies": {
     "@opentelemetry/api": "^1.3.0"

package/node_modules/@opentelemetry/resources/package.json

@@ -83,7 +83,8 @@
   },
   "dependencies": {
     "@opentelemetry/core": "2.12.0",
-    "@opentelemetry/semantic-conventions": "^1.29.0"
+    "@opentelemetry/semantic-conventions": "^1.29.0",
+    "@opentelemetry/api": "1.9.1"
   },
   "homepage": "https://github.com/open-telemetry/opentelemetry-js/tree/main/packages/opentelemetry-resources",
   "sideEffects": false,

package/node_modules/@opentelemetry/sdk-trace/package.json

@@ -92,7 +92,8 @@
   "dependencies": {
     "@opentelemetry/core": "2.12.0",
     "@opentelemetry/resources": "2.12.0",
-    "@opentelemetry/semantic-conventions": "^1.29.0"
+    "@opentelemetry/semantic-conventions": "^1.29.0",
+    "@opentelemetry/api": "1.9.1"
   },
   "homepage": "https://github.com/open-telemetry/opentelemetry-js/tree/main/packages/sdk-trace",
   "sideEffects": false,

package/node_modules/@opentelemetry/sdk-trace-base/package.json

@@ -92,7 +92,8 @@
     "@opentelemetry/core": "2.12.0",
     "@opentelemetry/resources": "2.12.0",
     "@opentelemetry/sdk-trace": "2.12.0",
-    "@opentelemetry/semantic-conventions": "^1.29.0"
+    "@opentelemetry/semantic-conventions": "^1.29.0",
+    "@opentelemetry/api": "1.9.1"
   },
   "homepage": "https://github.com/open-telemetry/opentelemetry-js/tree/main/packages/opentelemetry-sdk-trace-base",
   "sideEffects": false,

package/node_modules/@sentry/core/build/cjs/client.js

@@ -333,8 +333,10 @@ class Client {
     this.emit("beforeSendEvent", event, hint);
     const genAiSpanItem = extractGenAiSpans.extractGenAiSpansFromEvent(event, this);
     let env = envelope.createEventEnvelope(event, this._dsn, this._options._metadata, this._options.tunnel);
-    for (const attachment of hint.attachments || []) {
-      env = envelope$1.addItemToEnvelope(env, envelope$1.createAttachmentEnvelopeItem(attachment));
+    if (!eventUtils.isInternalException(hint)) {
+      for (const attachment of hint.attachments || []) {
+        env = envelope$1.addItemToEnvelope(env, envelope$1.createAttachmentEnvelopeItem(attachment));
+      }
     }
     if (genAiSpanItem) {
       env = envelope$1.addItemToEnvelope(env, genAiSpanItem);
@@ -588,8 +590,7 @@ class Client {
         this.recordDroppedEvent("event_processor", dataCategory);
         throw _makeDoNotSendEventError("An event processor returned `null`, will not send event.");
       }
-      const isInternalException = hint.data?.__sentry__ === true;
-      if (isInternalException) {
+      if (eventUtils.isInternalException(hint)) {
         return prepared;
       }
       const result = processBeforeSend(this, options, prepared, hint);

package/node_modules/@sentry/core/build/cjs/tracing/ai/gen-ai-attributes.js

@@ -31,8 +31,6 @@ const GEN_AI_RESPONSE_TOOL_CALLS_ATTRIBUTE = "gen_ai.response.tool_calls";
 const GEN_AI_AGENT_NAME_ATTRIBUTE = "gen_ai.agent.name";
 const GEN_AI_PIPELINE_NAME_ATTRIBUTE = "gen_ai.pipeline.name";
 const GEN_AI_CONVERSATION_ID_ATTRIBUTE = "gen_ai.conversation.id";
-const GEN_AI_USAGE_CACHE_CREATION_INPUT_TOKENS_ATTRIBUTE = "gen_ai.usage.cache_creation_input_tokens";
-const GEN_AI_USAGE_CACHE_READ_INPUT_TOKENS_ATTRIBUTE = "gen_ai.usage.cache_read_input_tokens";
 const GEN_AI_USAGE_INPUT_TOKENS_CACHE_WRITE_ATTRIBUTE = "gen_ai.usage.input_tokens.cache_write";
 const GEN_AI_USAGE_INPUT_TOKENS_CACHED_ATTRIBUTE = "gen_ai.usage.input_tokens.cached";
 const GEN_AI_INVOKE_AGENT_OPERATION_ATTRIBUTE = "gen_ai.invoke_agent";
@@ -84,8 +82,6 @@ exports.GEN_AI_TOOL_INPUT_ATTRIBUTE = GEN_AI_TOOL_INPUT_ATTRIBUTE;
 exports.GEN_AI_TOOL_NAME_ATTRIBUTE = GEN_AI_TOOL_NAME_ATTRIBUTE;
 exports.GEN_AI_TOOL_OUTPUT_ATTRIBUTE = GEN_AI_TOOL_OUTPUT_ATTRIBUTE;
 exports.GEN_AI_TOOL_TYPE_ATTRIBUTE = GEN_AI_TOOL_TYPE_ATTRIBUTE;
-exports.GEN_AI_USAGE_CACHE_CREATION_INPUT_TOKENS_ATTRIBUTE = GEN_AI_USAGE_CACHE_CREATION_INPUT_TOKENS_ATTRIBUTE;
-exports.GEN_AI_USAGE_CACHE_READ_INPUT_TOKENS_ATTRIBUTE = GEN_AI_USAGE_CACHE_READ_INPUT_TOKENS_ATTRIBUTE;
 exports.GEN_AI_USAGE_INPUT_TOKENS_ATTRIBUTE = GEN_AI_USAGE_INPUT_TOKENS_ATTRIBUTE;
 exports.GEN_AI_USAGE_INPUT_TOKENS_CACHED_ATTRIBUTE = GEN_AI_USAGE_INPUT_TOKENS_CACHED_ATTRIBUTE;
 exports.GEN_AI_USAGE_INPUT_TOKENS_CACHE_WRITE_ATTRIBUTE = GEN_AI_USAGE_INPUT_TOKENS_CACHE_WRITE_ATTRIBUTE;

package/node_modules/@sentry/core/build/cjs/tracing/ai/utils.js

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 
+const attributes = require('@sentry/conventions/attributes');
 const currentScopes = require('../../currentScopes.js');
 const hasSpanStreamingEnabled = require('../spans/hasSpanStreamingEnabled.js');
 const is = require('../../utils/is.js');
@@ -27,23 +28,26 @@ function shouldEnableTruncation(enableTruncation) {
 function buildMethodPath(currentPath, prop) {
   return currentPath ? `${currentPath}.${prop}` : prop;
 }
-function setTokenUsageAttributes(span, promptTokens, completionTokens, cachedInputTokens, cachedOutputTokens) {
-  if (promptTokens !== void 0) {
-    span.setAttributes({
-      [genAiAttributes.GEN_AI_USAGE_INPUT_TOKENS_ATTRIBUTE]: promptTokens
-    });
-  }
-  if (completionTokens !== void 0) {
-    span.setAttributes({
-      [genAiAttributes.GEN_AI_USAGE_OUTPUT_TOKENS_ATTRIBUTE]: completionTokens
-    });
-  }
-  if (promptTokens !== void 0 || completionTokens !== void 0 || cachedInputTokens !== void 0 || cachedOutputTokens !== void 0) {
-    const totalTokens = (promptTokens ?? 0) + (completionTokens ?? 0) + (cachedInputTokens ?? 0) + (cachedOutputTokens ?? 0);
-    span.setAttributes({
-      [genAiAttributes.GEN_AI_USAGE_TOTAL_TOKENS_ATTRIBUTE]: totalTokens
-    });
+function getTokenUsageAttributes(promptTokens, completionTokens, cacheCreationInputTokens, cacheReadInputTokens, totalTokens) {
+  const attributes$1 = {};
+  if (typeof promptTokens === "number") {
+    attributes$1[genAiAttributes.GEN_AI_USAGE_INPUT_TOKENS_ATTRIBUTE] = promptTokens;
   }
+  if (typeof cacheCreationInputTokens === "number") {
+    attributes$1[attributes.GEN_AI_USAGE_CACHE_CREATION_INPUT_TOKENS] = cacheCreationInputTokens;
+  }
+  if (typeof cacheReadInputTokens === "number") {
+    attributes$1[attributes.GEN_AI_USAGE_CACHE_READ_INPUT_TOKENS] = cacheReadInputTokens;
+  }
+  if (typeof completionTokens === "number") {
+    attributes$1[genAiAttributes.GEN_AI_USAGE_OUTPUT_TOKENS_ATTRIBUTE] = completionTokens;
+  }
+  if (typeof totalTokens === "number") {
+    attributes$1[genAiAttributes.GEN_AI_USAGE_TOTAL_TOKENS_ATTRIBUTE] = totalTokens;
+  } else if (typeof promptTokens === "number" || typeof completionTokens === "number") {
+    attributes$1[genAiAttributes.GEN_AI_USAGE_TOTAL_TOKENS_ATTRIBUTE] = (typeof promptTokens === "number" ? promptTokens : 0) + (typeof completionTokens === "number" ? completionTokens : 0);
+  }
+  return attributes$1;
 }
 function endStreamSpan(span, state, recordOutputs) {
   if (!span.isRecording()) {
@@ -54,12 +58,18 @@ function endStreamSpan(span, state, recordOutputs) {
   };
   if (state.responseId) attrs[genAiAttributes.GEN_AI_RESPONSE_ID_ATTRIBUTE] = state.responseId;
   if (state.responseModel) attrs[genAiAttributes.GEN_AI_RESPONSE_MODEL_ATTRIBUTE] = state.responseModel;
-  if (state.promptTokens !== void 0) attrs[genAiAttributes.GEN_AI_USAGE_INPUT_TOKENS_ATTRIBUTE] = state.promptTokens;
-  if (state.completionTokens !== void 0) attrs[genAiAttributes.GEN_AI_USAGE_OUTPUT_TOKENS_ATTRIBUTE] = state.completionTokens;
-  if (state.totalTokens !== void 0) {
-    attrs[genAiAttributes.GEN_AI_USAGE_TOTAL_TOKENS_ATTRIBUTE] = state.totalTokens;
-  } else if (state.promptTokens !== void 0 || state.completionTokens !== void 0 || state.cacheCreationInputTokens !== void 0 || state.cacheReadInputTokens !== void 0) {
-    attrs[genAiAttributes.GEN_AI_USAGE_TOTAL_TOKENS_ATTRIBUTE] = (state.promptTokens ?? 0) + (state.completionTokens ?? 0) + (state.cacheCreationInputTokens ?? 0) + (state.cacheReadInputTokens ?? 0);
+  Object.assign(
+    attrs,
+    getTokenUsageAttributes(
+      state.promptTokens,
+      state.completionTokens,
+      state.cacheCreationInputTokens,
+      state.cacheReadInputTokens,
+      state.totalTokens
+    )
+  );
+  if (typeof state.reasoningOutputTokens === "number") {
+    attrs[attributes.GEN_AI_USAGE_REASONING_OUTPUT_TOKENS] = state.reasoningOutputTokens;
   }
   if (state.finishReasons.length) {
     attrs[genAiAttributes.GEN_AI_RESPONSE_FINISH_REASONS_ATTRIBUTE] = JSON.stringify(state.finishReasons);
@@ -135,9 +145,9 @@ function wrapPromiseWithMethods(originalPromiseLike, instrumentedPromise) {
 exports.buildMethodPath = buildMethodPath;
 exports.endStreamSpan = endStreamSpan;
 exports.extractSystemInstructions = extractSystemInstructions;
+exports.getTokenUsageAttributes = getTokenUsageAttributes;
 exports.getTruncatedJsonString = getTruncatedJsonString;
 exports.resolveAIRecordingOptions = resolveAIRecordingOptions;
-exports.setTokenUsageAttributes = setTokenUsageAttributes;
 exports.shouldEnableTruncation = shouldEnableTruncation;
 exports.wrapPromiseWithMethods = wrapPromiseWithMethods;
 //# sourceMappingURL=utils.js.map

package/node_modules/@sentry/core/build/cjs/tracing/anthropic-ai/index.js

@@ -77,12 +77,13 @@ function addMetadataAttributes(span, response) {
       [genAiAttributes.GEN_AI_RESPONSE_MODEL_ATTRIBUTE]: response.model
     });
     if ("usage" in response && response.usage) {
-      utils$1.setTokenUsageAttributes(
-        span,
-        response.usage.input_tokens,
-        response.usage.output_tokens,
-        response.usage.cache_creation_input_tokens,
-        response.usage.cache_read_input_tokens
+      span.setAttributes(
+        utils$1.getTokenUsageAttributes(
+          response.usage.input_tokens + (response.usage.cache_creation_input_tokens ?? 0) + (response.usage.cache_read_input_tokens ?? 0),
+          response.usage.output_tokens,
+          response.usage.cache_creation_input_tokens,
+          response.usage.cache_read_input_tokens
+        )
       );
     }
   }

package/node_modules/@sentry/core/build/cjs/tracing/anthropic-ai/streaming.js

@@ -28,7 +28,9 @@ function handleMessageMetadata(event, state) {
     if (message.id) state.responseId = message.id;
     if (message.model) state.responseModel = message.model;
     if (message.usage) {
-      if (typeof message.usage.input_tokens === "number") state.promptTokens = message.usage.input_tokens;
+      if (typeof message.usage.input_tokens === "number") {
+        state.promptTokens = message.usage.input_tokens + (message.usage.cache_creation_input_tokens ?? 0) + (message.usage.cache_read_input_tokens ?? 0);
+      }
       if (typeof message.usage.cache_creation_input_tokens === "number")
         state.cacheCreationInputTokens = message.usage.cache_creation_input_tokens;
       if (typeof message.usage.cache_read_input_tokens === "number")

package/node_modules/@sentry/core/build/cjs/tracing/google-genai/index.js

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 
+const attributes = require('@sentry/conventions/attributes');
 const semanticAttributes = require('../../semanticAttributes.js');
 const string = require('../../utils/string.js');
 const spanstatus = require('../spanstatus.js');
@@ -114,20 +115,18 @@ function addResponseAttributes(span, response, recordOutputs) {
   }
   if (response.usageMetadata && typeof response.usageMetadata === "object") {
     const usage = response.usageMetadata;
-    if (typeof usage.promptTokenCount === "number") {
-      span.setAttributes({
-        [genAiAttributes.GEN_AI_USAGE_INPUT_TOKENS_ATTRIBUTE]: usage.promptTokenCount
-      });
-    }
-    if (typeof usage.candidatesTokenCount === "number") {
-      span.setAttributes({
-        [genAiAttributes.GEN_AI_USAGE_OUTPUT_TOKENS_ATTRIBUTE]: usage.candidatesTokenCount
-      });
-    }
-    if (typeof usage.totalTokenCount === "number") {
-      span.setAttributes({
-        [genAiAttributes.GEN_AI_USAGE_TOTAL_TOKENS_ATTRIBUTE]: usage.totalTokenCount
-      });
+    const hasOutput = typeof usage.candidatesTokenCount === "number" || typeof usage.thoughtsTokenCount === "number";
+    span.setAttributes(
+      utils$1.getTokenUsageAttributes(
+        usage.promptTokenCount,
+        hasOutput ? (usage.candidatesTokenCount ?? 0) + (usage.thoughtsTokenCount ?? 0) : void 0,
+        void 0,
+        usage.cachedContentTokenCount,
+        usage.totalTokenCount
+      )
+    );
+    if (typeof usage.thoughtsTokenCount === "number") {
+      span.setAttribute(attributes.GEN_AI_USAGE_REASONING_OUTPUT_TOKENS, usage.thoughtsTokenCount);
     }
   }
   if (recordOutputs && Array.isArray(response.candidates) && response.candidates.length > 0) {

package/node_modules/@sentry/core/build/cjs/tracing/google-genai/streaming.js

@@ -22,8 +22,13 @@ function handleResponseMetadata(chunk, state) {
   const usage = chunk.usageMetadata;
   if (usage) {
     if (typeof usage.promptTokenCount === "number") state.promptTokens = usage.promptTokenCount;
-    if (typeof usage.candidatesTokenCount === "number") state.completionTokens = usage.candidatesTokenCount;
+    if (typeof usage.candidatesTokenCount === "number") state.candidateTokens = usage.candidatesTokenCount;
+    if (typeof usage.thoughtsTokenCount === "number") state.reasoningOutputTokens = usage.thoughtsTokenCount;
+    if (state.candidateTokens !== void 0 || state.reasoningOutputTokens !== void 0) {
+      state.completionTokens = (state.candidateTokens ?? 0) + (state.reasoningOutputTokens ?? 0);
+    }
     if (typeof usage.totalTokenCount === "number") state.totalTokens = usage.totalTokenCount;
+    if (typeof usage.cachedContentTokenCount === "number") state.cacheReadInputTokens = usage.cachedContentTokenCount;
   }
 }
 function handleCandidateContent(chunk, state, recordOutputs) {