@xeonr/telemetry 0.0.0-stage → 0.2.0

package/dist/processor.js

@@ -0,0 +1,163 @@
+/**
+ * The span processors `init` installs, in order:
+ *
+ * 1. IdentitySpanProcessor stamps the request's identity on every span
+ *    started under it (go-platform's telemetry.SpanProcessor).
+ * 2. SanitizeSpanProcessor strips queries and credentials from URL attributes
+ *    and names client spans `HTTP <METHOD> <peer>` (§4.3). The http and undici
+ *    spans already arrive without a query (@lntrn/otel's
+ *    noQueryInstrumentationConfig, applied in `instrumentations()`); this is
+ *    the backstop for every other span.
+ * 3. The processors a service adds at run time (`addSpanProcessor`), e.g. the
+ *    upl-im pipeline's own trace store.
+ * 4. The OTLP batch processor, behind ExportGuard.
+ */
+import { context, createContextKey, metrics, SpanKind } from "@opentelemetry/api";
+import { attributes, stateFrom } from "./identity.js";
+import { SCOPE } from "./job.js";
+import { stripTarget, stripUrl } from "./sanitize.js";
+const PEER = createContextKey("xeonr.telemetry.peer");
+/** `peer.service` (go-platform's KeyPeerService). */
+export const KEY_PEER_SERVICE = "peer.service";
+/** Runs `fn` with `peer` named on every HTTP client span it starts: `peer.service`, and the span name `HTTP GET <peer>`. */
+export function withPeer(peer, fn, ctx = context.active()) {
+    return context.with(ctx.setValue(PEER, peer), fn);
+}
+/** @internal */
+export function peerFrom(ctx) {
+    return ctx.getValue(PEER);
+}
+export class IdentitySpanProcessor {
+    onStart(span, parent) {
+        const s = stateFrom(parent);
+        if (s)
+            span.setAttributes(attributes(s.identity()));
+    }
+    onEnd() { }
+    forceFlush() {
+        return Promise.resolve();
+    }
+    shutdown() {
+        return Promise.resolve();
+    }
+}
+const URL_ATTRS = ["url.full", "http.url"];
+const TARGET_ATTRS = ["http.target"];
+const DROP_ATTRS = ["url.query"];
+export class SanitizeSpanProcessor {
+    onStart(span, parent) {
+        const attrs = span.attributes;
+        for (const k of URL_ATTRS) {
+            const v = attrs[k];
+            if (typeof v === "string")
+                attrs[k] = stripUrl(v);
+        }
+        for (const k of TARGET_ATTRS) {
+            const v = attrs[k];
+            if (typeof v === "string")
+                attrs[k] = stripTarget(v);
+        }
+        for (const k of DROP_ATTRS)
+            delete attrs[k];
+        if (span.kind !== SpanKind.CLIENT)
+            return;
+        const method = attrs["http.request.method"] ?? attrs["http.method"];
+        if (typeof method !== "string")
+            return;
+        const peer = peerFrom(parent);
+        if (peer)
+            span.setAttribute(KEY_PEER_SERVICE, peer);
+        span.updateName(peer ? `HTTP ${method} ${peer}` : `HTTP ${method}`);
+    }
+    onEnd() { }
+    forceFlush() {
+        return Promise.resolve();
+    }
+    shutdown() {
+        return Promise.resolve();
+    }
+}
+/** Processors added after boot. A span sees the processors that were there when it started. */
+export class DynamicSpanProcessor {
+    #processors = [];
+    #seen = new WeakMap();
+    add(p) {
+        this.#processors.push(p);
+    }
+    onStart(span, parent) {
+        if (this.#processors.length === 0)
+            return;
+        const ps = [...this.#processors];
+        this.#seen.set(span, ps);
+        for (const p of ps)
+            p.onStart(span, parent);
+    }
+    onEnd(span) {
+        for (const p of this.#seen.get(span) ?? [])
+            p.onEnd(span);
+    }
+    async forceFlush() {
+        await Promise.all(this.#processors.map((p) => p.forceFlush()));
+    }
+    async shutdown() {
+        await Promise.all(this.#processors.map((p) => p.shutdown()));
+    }
+}
+export const METRIC_ROOTLESS_CLIENT_SPANS = "xeonr_telemetry_rootless_client_spans_total";
+/** The event attribute that keeps a span event out of the OTLP export. */
+export const KEY_LOCAL_EVENT = "xeonr.local";
+/**
+ * Attributes for a span event that only the service's own processors may see
+ * (`addSpanProcessor`), never the collector: payloads a product shows its own
+ * users (the upl-im pipeline's run traces), which §4.2 forbids in Lantern.
+ *
+ * ```ts
+ * span.addEvent("rpc.request", localEvent({ payload }));
+ * ```
+ */
+export function localEvent(attrs) {
+    return { ...attrs, [KEY_LOCAL_EVENT]: true };
+}
+/**
+ * Sits in front of the OTLP batch processor:
+ *
+ * - Keeps a client or producer span that has no parent out of the export
+ *   (obs.rooted-spans: a database, cache or client span is never a trace
+ *   root). Such a span means the work ran on a context with no span: a loop
+ *   or callback not under `startJob`. The instrumentations that can refuse
+ *   those spans already do (`requireParentSpan`); this catches the rest
+ *   (mysql2, aws-sdk). Each one dropped is counted in
+ *   xeonr_telemetry_rootless_client_spans_total{scope}, so the gap stays visible.
+ * - Drops `localEvent` events from what is exported.
+ */
+export class ExportGuard {
+    #inner;
+    constructor(inner) {
+        this.#inner = inner;
+    }
+    onStart(span, parent) {
+        this.#inner.onStart(span, parent);
+    }
+    onEnd(span) {
+        if ((span.kind === SpanKind.CLIENT || span.kind === SpanKind.PRODUCER) && !span.parentSpanContext) {
+            metrics
+                .getMeter(SCOPE)
+                .createCounter(METRIC_ROOTLESS_CLIENT_SPANS, { description: "Client and producer spans dropped because they had no parent." })
+                .add(1, { scope: span.instrumentationScope.name });
+            return;
+        }
+        if (span.events.some((e) => e.attributes?.[KEY_LOCAL_EVENT] === true)) {
+            const events = span.events.filter((e) => e.attributes?.[KEY_LOCAL_EVENT] !== true);
+            this.#inner.onEnd(Object.create(span, { events: { value: events } }));
+            return;
+        }
+        this.#inner.onEnd(span);
+    }
+    forceFlush() {
+        return this.#inner.forceFlush();
+    }
+    shutdown() {
+        return this.#inner.shutdown();
+    }
+}
+//# sourceMappingURL=processor.js.map

package/dist/processor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"processor.js","sourceRoot":"","sources":["../src/processor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,EAAgB,MAAM,oBAAoB,CAAC;AAEhG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,IAAI,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;AAEtD,qDAAqD;AACrD,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAE/C,4HAA4H;AAC5H,MAAM,UAAU,QAAQ,CAAI,IAAY,EAAE,EAAW,EAAE,MAAe,OAAO,CAAC,MAAM,EAAE;IACrF,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,QAAQ,CAAC,GAAY;IACpC,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAuB,CAAC;AACjD,CAAC;AAED,MAAM,OAAO,qBAAqB;IACjC,OAAO,CAAC,IAAU,EAAE,MAAe;QAClC,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC;YAAE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,KAAK,KAAU,CAAC;IAChB,UAAU;QACT,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC;IACD,QAAQ;QACP,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC;CACD;AAED,MAAM,SAAS,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;AAC3C,MAAM,YAAY,GAAG,CAAC,aAAa,CAAC,CAAC;AACrC,MAAM,UAAU,GAAG,CAAC,WAAW,CAAC,CAAC;AAEjC,MAAM,OAAO,qBAAqB;IACjC,OAAO,CAAC,IAAU,EAAE,MAAe;QAClC,MAAM,KAAK,GAAI,IAA2D,CAAC,UAAU,CAAC;QACtF,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACnB,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACnB,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,KAAK,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,UAAU;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QAE5C,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;YAAE,OAAO;QAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,qBAAqB,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QACpE,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI;YAAE,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,KAAK,KAAU,CAAC;IAChB,UAAU;QACT,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC;IACD,QAAQ;QACP,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC;CACD;AAED,+FAA+F;AAC/F,MAAM,OAAO,oBAAoB;IACvB,WAAW,GAAoB,EAAE,CAAC;IAClC,KAAK,GAAG,IAAI,OAAO,EAAoC,CAAC;IAEjE,GAAG,CAAC,CAAgB;QACnB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,CAAC,IAAU,EAAE,MAAe;QAClC,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC1C,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,EAAE;YAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IACD,KAAK,CAAC,IAAkB;QACvB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;IACD,KAAK,CAAC,UAAU;QACf,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,KAAK,CAAC,QAAQ;QACb,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC;CACD;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,6CAA6C,CAAC;AAE1F,0EAA0E;AAC1E,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAoC,KAAQ;IACrE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,WAAW;IACd,MAAM,CAAgB;IAC/B,YAAY,KAAoB;QAC/B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,CAAC,IAAU,EAAE,MAAe;QAClC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,KAAK,CAAC,IAAkB;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACnG,OAAO;iBACL,QAAQ,CAAC,KAAK,CAAC;iBACf,aAAa,CAAC,4BAA4B,EAAE,EAAE,WAAW,EAAE,+DAA+D,EAAE,CAAC;iBAC7H,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC;YACpD,OAAO;QACR,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,eAAe,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YACvE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,eAAe,CAAC,KAAK,IAAI,CAAC,CAAC;YACnF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAiB,CAAC,CAAC;YACtF,OAAO;QACR,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,UAAU;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IACjC,CAAC;IACD,QAAQ;QACP,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC/B,CAAC;CACD"}

package/dist/register.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=register.d.ts.map

package/dist/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../src/register.ts"],"names":[],"mappings":""}

package/dist/register.js

@@ -0,0 +1,34 @@
+/**
+ * `node --import @xeonr/telemetry/register app.js`
+ *
+ * Starts telemetry before the app loads (obs.node-telemetry):
+ * - registers OpenTelemetry's ES module hook, so the instrumentations can
+ *   patch ES modules as they are imported;
+ * - calls `init()`, which reads OTEL_* and ENV;
+ * - flushes when the event loop empties. On SIGTERM/SIGINT it does nothing if
+ *   the app handles the signal itself (the app calls `shutdown()` once it has
+ *   drained, so the last requests' spans are kept); if not, it flushes and
+ *   re-raises the signal, so the exit code is the usual one.
+ *
+ * `--require @xeonr/telemetry/register` loads the same module for a CommonJS
+ * app (Node ≥ 22.12 loads ES modules from require).
+ *
+ * Only the main thread starts telemetry: Node also runs preloads inside the
+ * module-hooks thread and in worker threads, which would start a second SDK.
+ */
+import { register } from "node:module";
+import { isMainThread } from "node:worker_threads";
+import { init, shutdown } from "./sdk.js";
+if (isMainThread) {
+    register("@opentelemetry/instrumentation/hook.mjs", import.meta.url);
+    init();
+    process.once("beforeExit", () => void shutdown());
+    for (const signal of ["SIGTERM", "SIGINT"]) {
+        process.once(signal, () => {
+            if (process.listenerCount(signal) > 0)
+                return;
+            void shutdown().finally(() => process.kill(process.pid, signal));
+        });
+    }
+}
+//# sourceMappingURL=register.js.map

package/dist/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../src/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAE1C,IAAI,YAAY,EAAE,CAAC;IAClB,QAAQ,CAAC,yCAAyC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrE,IAAI,EAAE,CAAC;IAEP,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAClD,KAAK,MAAM,MAAM,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAU,EAAE,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;YACzB,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,OAAO;YAC9C,KAAK,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;IACJ,CAAC;AACF,CAAC"}

package/dist/sanitize.d.ts

@@ -0,0 +1,17 @@
+/**
+ * What never reaches a span (observability plan §4.2 "never recorded";
+ * obs.no-pii, log.no-secrets): query strings, credentials in URLs, tokens and
+ * emails in error texts.
+ */
+/** Redacts tokens, credentials, emails and URL queries from a message, and caps it at 1 KiB. */
+export declare function sanitize(msg: string): string;
+/** An error's type and sanitised message, for an exception event or a status. */
+export declare function sanitizeError(err: unknown): {
+    type: string;
+    message: string;
+};
+/** A URL without credentials, query or fragment; "" if it does not parse. */
+export declare function stripUrl(raw: string): string;
+/** A path or target ("/a/b?x=1") without its query or fragment. */
+export declare function stripTarget(raw: string): string;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../src/sanitize.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH,gGAAgG;AAChG,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAS5C;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAG7E;AAED,6EAA6E;AAC7E,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAY5C;AAED,mEAAmE;AACnE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG/C"}

package/dist/sanitize.js

@@ -0,0 +1,52 @@
+/**
+ * What never reaches a span (observability plan §4.2 "never recorded";
+ * obs.no-pii, log.no-secrets): query strings, credentials in URLs, tokens and
+ * emails in error texts.
+ */
+const MAX_MESSAGE = 1024;
+// go-platform's telemetry/sanitize.go, rule for rule.
+const JWT = /eyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]*/g;
+const BEARER = /\b(bearer|basic)\s+[A-Za-z0-9._~+/=-]+/gi;
+const EMAIL = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
+const SECRET = /\b(password|passwd|secret|token|api[_-]?key|client_secret|assertion|code)=([^\s&"']+)/gi;
+// URLs lose their query and fragment: presigned URLs carry credentials there.
+const URL_QUERY = /\b(https?:\/\/[^\s?#"']+)[?#][^\s"']*/gi;
+/** Redacts tokens, credentials, emails and URL queries from a message, and caps it at 1 KiB. */
+export function sanitize(msg) {
+    let out = msg
+        .replace(JWT, "[REDACTED]")
+        .replace(BEARER, "$1 [REDACTED]")
+        .replace(EMAIL, "[REDACTED]")
+        .replace(SECRET, "$1=[REDACTED]")
+        .replace(URL_QUERY, "$1");
+    if (out.length > MAX_MESSAGE)
+        out = out.slice(0, MAX_MESSAGE) + "…";
+    return out;
+}
+/** An error's type and sanitised message, for an exception event or a status. */
+export function sanitizeError(err) {
+    if (err instanceof Error)
+        return { type: err.name || "Error", message: sanitize(err.message) };
+    return { type: typeof err, message: sanitize(String(err)) };
+}
+/** A URL without credentials, query or fragment; "" if it does not parse. */
+export function stripUrl(raw) {
+    try {
+        const u = new URL(raw);
+        u.username = "";
+        u.password = "";
+        u.search = "";
+        u.hash = "";
+        return u.toString();
+    }
+    catch {
+        const cut = raw.search(/[?#]/);
+        return cut < 0 ? raw : raw.slice(0, cut);
+    }
+}
+/** A path or target ("/a/b?x=1") without its query or fragment. */
+export function stripTarget(raw) {
+    const cut = raw.search(/[?#]/);
+    return cut < 0 ? raw : raw.slice(0, cut);
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../src/sanitize.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,GAAG,IAAI,CAAC;AAEzB,sDAAsD;AACtD,MAAM,GAAG,GAAG,0DAA0D,CAAC;AACvE,MAAM,MAAM,GAAG,0CAA0C,CAAC;AAC1D,MAAM,KAAK,GAAG,iDAAiD,CAAC;AAChE,MAAM,MAAM,GAAG,yFAAyF,CAAC;AACzG,8EAA8E;AAC9E,MAAM,SAAS,GAAG,yCAAyC,CAAC;AAE5D,gGAAgG;AAChG,MAAM,UAAU,QAAQ,CAAC,GAAW;IACnC,IAAI,GAAG,GAAG,GAAG;SACX,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC;SAC1B,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC;SAChC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC;SAC5B,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC;SAChC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,MAAM,GAAG,WAAW;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,GAAG,GAAG,CAAC;IACpE,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,GAAY;IACzC,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/F,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,QAAQ,CAAC,GAAW;IACnC,IAAI,CAAC;QACJ,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC;QAChB,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC;QAChB,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;AACF,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,WAAW,CAAC,GAAW;IACtC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC"}

package/dist/sdk.d.ts

@@ -0,0 +1,50 @@
+import type { Instrumentation } from "@opentelemetry/instrumentation";
+import { type SpanProcessor } from "@opentelemetry/sdk-trace";
+type Env = Record<string, string | undefined>;
+export interface InitOptions {
+    /** `service.name` when OTEL_SERVICE_NAME is unset. */
+    serviceName?: string;
+    /** `service.namespace` when OTEL_SERVICE_NAMESPACE is unset: the owning Lantern sub-team. */
+    namespace?: string;
+    /** More instrumentations, appended to the fixed list. */
+    instrumentations?: Instrumentation[];
+    /** The environment to read. Default `process.env`. */
+    env?: Env;
+}
+export interface Endpoint {
+    /** What was configured, for the boot line. */
+    configured: string;
+    /** The URL handed to the gRPC exporters: its scheme decides cleartext or TLS. */
+    url: string;
+    transport: "cleartext" | "tls";
+}
+/**
+ * The OTLP endpoint, as go-platform's otel.Init reads it: a Go-style
+ * `host:port` or a URL. An in-cluster host, or OTEL_EXPORTER_OTLP_INSECURE=true,
+ * is cleartext (the platform collector only speaks cleartext); anything else
+ * is TLS. Undefined when OTEL_EXPORTER_OTLP_ENDPOINT is unset.
+ */
+export declare function resolveEndpoint(env?: Env): Endpoint | undefined;
+/** `deployment.environment`: ENV, as the Go services read it, else NODE_ENV in the fleet's spelling. */
+export declare function environment(env?: Env): string | undefined;
+/** The fixed instrumentation list (never auto-instrumentations-node). */
+export declare function instrumentations(): Instrumentation[];
+/**
+ * Starts telemetry once per process; later calls are no-ops. `register`
+ * calls it before the app loads, which is the only way to call it in a
+ * service: instrumentations patch modules as they are first imported.
+ */
+export declare function init(opts?: InitOptions): void;
+/**
+ * Adds a span processor after boot (the upl-im pipeline's run-trace store).
+ * It sees spans started from now on. Throws before `init`.
+ */
+export declare function addSpanProcessor(p: SpanProcessor): void;
+/** Exports what is buffered, without stopping. For CLIs and batch runs before they exit. */
+export declare function forceFlush(): Promise<void>;
+/** Flushes and stops every provider. Call it last, after the server and workers have drained. Safe to call twice. */
+export declare function shutdown(): Promise<void>;
+/** Whether `init` has run (and so `register` was loaded). */
+export declare function initialised(): boolean;
+export {};
+//# sourceMappingURL=sdk.d.ts.map

package/dist/sdk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../src/sdk.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAUtE,OAAO,EAAuC,KAAK,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAKnG,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAM9C,MAAM,WAAW,WAAW;IAC3B,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6FAA6F;IAC7F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,eAAe,EAAE,CAAC;IACrC,sDAAsD;IACtD,GAAG,CAAC,EAAE,GAAG,CAAC;CACV;AAED,MAAM,WAAW,QAAQ;IACxB,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,WAAW,GAAG,KAAK,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,GAAiB,GAAG,QAAQ,GAAG,SAAS,CAW5E;AAED,wGAAwG;AACxG,wBAAgB,WAAW,CAAC,GAAG,GAAE,GAAiB,GAAG,MAAM,GAAG,SAAS,CAOtE;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,IAAI,eAAe,EAAE,CA+BpD;AAaD;;;;GAIG;AACH,wBAAgB,IAAI,CAAC,IAAI,GAAE,WAAgB,GAAG,IAAI,CAgFjD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,aAAa,GAAG,IAAI,CAGvD;AAED,4FAA4F;AAC5F,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAOhD;AAED,qHAAqH;AACrH,wBAAgB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAGxC;AAED,6DAA6D;AAC7D,wBAAgB,WAAW,IAAI,OAAO,CAErC"}

package/dist/sdk.js

@@ -0,0 +1,217 @@
+/**
+ * `init()`: the one telemetry bootstrap for a Xeonr Node service
+ * (obs.node-telemetry), mirroring go-platform's otel.Init: same env vars,
+ * no-op on an empty endpoint with one Info line, one `telemetry initialised`
+ * line otherwise, shut down last.
+ *
+ * The OpenTelemetry part is `@lntrn/otel`'s `setup()`, Lantern's add-on for
+ * the stock NodeSDK. What is Xeonr's is chosen here: OTLP gRPC to the cluster
+ * collector (Lantern's own edge is OTLP/HTTP only), AlwaysOn, W3C trace
+ * context as the only propagator (baggage is sent only by this package's
+ * in-cluster helpers), the fixed instrumentation list, no log export (logs go
+ * to stdout, where the Lantern agent collects them), no HTTP RED metrics
+ * (spanmetrics derives them), and the identity and sanitising processors.
+ */
+import { hostname } from "node:os";
+import { noQueryInstrumentationConfig, setup } from "@lntrn/otel";
+import { metrics, trace } from "@opentelemetry/api";
+import { W3CTraceContextPropagator } from "@opentelemetry/core";
+import { OTLPMetricExporter } from "@opentelemetry/exporter-metrics-otlp-grpc";
+import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-grpc";
+import { HostMetrics } from "@opentelemetry/host-metrics";
+import { AwsInstrumentation } from "@opentelemetry/instrumentation-aws-sdk";
+import { HttpInstrumentation } from "@opentelemetry/instrumentation-http";
+import { IORedisInstrumentation } from "@opentelemetry/instrumentation-ioredis";
+import { MySQL2Instrumentation } from "@opentelemetry/instrumentation-mysql2";
+import { PgInstrumentation } from "@opentelemetry/instrumentation-pg";
+import { PinoInstrumentation } from "@opentelemetry/instrumentation-pino";
+import { RuntimeNodeInstrumentation } from "@opentelemetry/instrumentation-runtime-node";
+import { UndiciInstrumentation } from "@opentelemetry/instrumentation-undici";
+import { AggregationType, PeriodicExportingMetricReader } from "@opentelemetry/sdk-metrics";
+import { AlwaysOnSampler, BatchSpanProcessor } from "@opentelemetry/sdk-trace";
+import { bootLine } from "./boot.js";
+import { SCOPE } from "./job.js";
+import { DynamicSpanProcessor, IdentitySpanProcessor, ExportGuard, SanitizeSpanProcessor } from "./processor.js";
+/** Bounds one export so a dead collector never stalls a request or the shutdown for long. */
+const EXPORT_TIMEOUT_MS = 3000;
+const DEFAULT_METRIC_INTERVAL_MS = 10_000;
+/**
+ * The OTLP endpoint, as go-platform's otel.Init reads it: a Go-style
+ * `host:port` or a URL. An in-cluster host, or OTEL_EXPORTER_OTLP_INSECURE=true,
+ * is cleartext (the platform collector only speaks cleartext); anything else
+ * is TLS. Undefined when OTEL_EXPORTER_OTLP_ENDPOINT is unset.
+ */
+export function resolveEndpoint(env = process.env) {
+    const configured = (env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT || env.OTEL_EXPORTER_OTLP_ENDPOINT)?.trim();
+    if (!configured)
+        return undefined;
+    const scheme = /^([a-z][a-z0-9+.-]*):\/\//i.exec(configured)?.[1]?.toLowerCase();
+    if (scheme)
+        return { configured, url: configured, transport: scheme === "http" ? "cleartext" : "tls" };
+    const host = configured.split(":")[0]?.toLowerCase() ?? "";
+    const inClusterHost = host.endsWith(".svc") || host.endsWith(".svc.cluster.local") || (!host.includes(".") && host !== "localhost");
+    if (env.OTEL_EXPORTER_OTLP_INSECURE?.trim().toLowerCase() === "true" || inClusterHost) {
+        return { configured, url: `http://${configured}`, transport: "cleartext" };
+    }
+    return { configured, url: `https://${configured}`, transport: "tls" };
+}
+/** `deployment.environment`: ENV, as the Go services read it, else NODE_ENV in the fleet's spelling. */
+export function environment(env = process.env) {
+    const e = env.ENV?.trim();
+    if (e)
+        return e;
+    const n = env.NODE_ENV?.trim().toLowerCase();
+    if (n === "production")
+        return "prod";
+    if (n === "development")
+        return "dev";
+    return n || undefined;
+}
+/** The fixed instrumentation list (never auto-instrumentations-node). */
+export function instrumentations() {
+    // @lntrn/otel's hooks keep the query off http and undici spans at the
+    // source (obs.no-pii): no `url.query`, `url.full` as origin + path, no
+    // legacy `http.target`/`http.url`. SanitizeSpanProcessor stays behind them
+    // for every other span (aws-sdk, a service's own) and for credentials and
+    // fragments in URLs.
+    const noQuery = noQueryInstrumentationConfig();
+    const http = noQuery["@opentelemetry/instrumentation-http"];
+    return [
+        new HttpInstrumentation({
+            startIncomingSpanHook: http.startIncomingSpanHook,
+            // RequestOptions' fields may be undefined; the hook reads them as optional.
+            startOutgoingSpanHook: (options) => http.startOutgoingSpanHook(options),
+            // Kubelet probes are not traffic.
+            ignoreIncomingRequestHook: (req) => (req.url ?? "").split("?")[0] === "/healthz",
+            requireParentforOutgoingSpans: true,
+        }),
+        new UndiciInstrumentation({ ...noQuery["@opentelemetry/instrumentation-undici"], requireParentforSpans: true }),
+        new IORedisInstrumentation({
+            requireParentSpan: true,
+            // The command only: arguments are keys and values.
+            dbStatementSerializer: (cmd) => cmd,
+        }),
+        new MySQL2Instrumentation({ maskStatement: true }),
+        new PgInstrumentation({ requireParentSpan: true, enhancedDatabaseReporting: false }),
+        new AwsInstrumentation({ suppressInternalInstrumentation: true }),
+        new RuntimeNodeInstrumentation(),
+        // trace_id/span_id on any pino logger the service makes; never log export.
+        new PinoInstrumentation({ disableLogSending: true }),
+    ];
+}
+/** otelhttp-style RED histograms are off: spanmetrics derives RED from the spans (§5.7). */
+const VIEWS = [
+    "http.server.request.duration",
+    "http.client.request.duration",
+    "http.server.duration",
+    "http.client.duration",
+].map((instrumentName) => ({ instrumentName, aggregation: { type: AggregationType.DROP } }));
+let started;
+let stopping;
+/**
+ * Starts telemetry once per process; later calls are no-ops. `register`
+ * calls it before the app loads, which is the only way to call it in a
+ * service: instrumentations patch modules as they are first imported.
+ */
+export function init(opts = {}) {
+    if (started)
+        return;
+    const env = opts.env ?? process.env;
+    const endpoint = env.OTEL_SDK_DISABLED?.trim().toLowerCase() === "true" ? undefined : resolveEndpoint(env);
+    const serviceName = env.OTEL_SERVICE_NAME?.trim() || opts.serviceName;
+    const namespace = env.OTEL_SERVICE_NAMESPACE?.trim() || opts.namespace;
+    const serviceVersion = env.OTEL_SERVICE_VERSION?.trim();
+    const deployment = environment(env);
+    const metricInterval = Number(env.OTEL_METRIC_EXPORT_INTERVAL) || DEFAULT_METRIC_INTERVAL_MS;
+    const dynamic = new DynamicSpanProcessor();
+    const spanProcessors = [new IdentitySpanProcessor(), new SanitizeSpanProcessor(), dynamic];
+    if (endpoint) {
+        spanProcessors.push(new ExportGuard(new BatchSpanProcessor({
+            exporter: new OTLPTraceExporter({ url: endpoint.url, timeoutMillis: EXPORT_TIMEOUT_MS }),
+            exportTimeoutMillis: EXPORT_TIMEOUT_MS,
+        })));
+    }
+    const attributes = { "service.instance.id": env.SERVICE_INSTANCE_ID?.trim() || hostname() };
+    if (deployment)
+        attributes["deployment.environment"] = deployment;
+    const lantern = setup({
+        // No endpoint → `none`: providers with no exporter, so spans still
+        // get ids and log lines still carry them. With one, the exporters
+        // are this package's gRPC ones, given below.
+        target: endpoint ? "otel" : "none",
+        ...(serviceName ? { serviceName } : {}),
+        ...(serviceVersion ? { serviceVersion } : {}),
+        ...(namespace ? { namespace } : {}),
+        ...(deployment ? { environment: deployment } : {}),
+        attributes,
+        instrumentations: [...instrumentations(), ...(opts.instrumentations ?? [])],
+        sdk: {
+            sampler: new AlwaysOnSampler(),
+            textMapPropagator: new W3CTraceContextPropagator(),
+            spanProcessors,
+            metricReaders: endpoint
+                ? [
+                    new PeriodicExportingMetricReader({
+                        exporter: new OTLPMetricExporter({ url: endpoint.url, timeoutMillis: EXPORT_TIMEOUT_MS }),
+                        exportIntervalMillis: metricInterval,
+                        exportTimeoutMillis: EXPORT_TIMEOUT_MS,
+                    }),
+                ]
+                : [],
+            views: VIEWS,
+            logRecordProcessors: [],
+        },
+    }, 
+    // setup() must not pick a Lantern edge or device target from stray LNTRN_* vars.
+    { ...env, LNTRN_TARGET: undefined });
+    started = { lantern, dynamic };
+    if (endpoint) {
+        // Process CPU and memory beside runtime-node's event loop and heap
+        // metrics. process.* only: system.* would report the node, not the pod.
+        new HostMetrics({ meterProvider: metrics.getMeterProvider(), name: SCOPE, metricGroups: ["process.cpu", "process.memory"] }).start();
+    }
+    if (!endpoint) {
+        bootLine("info", "telemetry export disabled", { reason: "OTEL_EXPORTER_OTLP_ENDPOINT is not set" });
+        return;
+    }
+    bootLine("info", "telemetry initialised", {
+        endpoint: endpoint.configured,
+        transport: endpoint.transport,
+        protocol: "grpc",
+        sampler: "always_on",
+        metric_interval_ms: metricInterval,
+        "service.name": serviceName,
+        "service.namespace": namespace,
+        "service.version": serviceVersion,
+        "deployment.environment": deployment,
+    });
+}
+/**
+ * Adds a span processor after boot (the upl-im pipeline's run-trace store).
+ * It sees spans started from now on. Throws before `init`.
+ */
+export function addSpanProcessor(p) {
+    if (!started)
+        throw new Error("@xeonr/telemetry: addSpanProcessor before init: start the process with --import @xeonr/telemetry/register");
+    started.dynamic.add(p);
+}
+/** Exports what is buffered, without stopping. For CLIs and batch runs before they exit. */
+export async function forceFlush() {
+    if (!started)
+        return;
+    const tracerProvider = trace.getTracerProvider();
+    const tp = tracerProvider.getDelegate?.() ?? tracerProvider;
+    const mp = metrics.getMeterProvider();
+    await Promise.allSettled([tp.forceFlush?.(), mp.forceFlush?.()]);
+}
+/** Flushes and stops every provider. Call it last, after the server and workers have drained. Safe to call twice. */
+export function shutdown() {
+    if (!started)
+        return Promise.resolve();
+    return (stopping ??= started.lantern.shutdown());
+}
+/** Whether `init` has run (and so `register` was loaded). */
+export function initialised() {
+    return started !== undefined;
+}
+//# sourceMappingURL=sdk.js.map

package/dist/sdk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk.js","sourceRoot":"","sources":["../src/sdk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,4BAA4B,EAAE,KAAK,EAAgB,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,6BAA6B,EAAoB,MAAM,4BAA4B,CAAC;AAC9G,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAsB,MAAM,0BAA0B,CAAC;AACnG,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAIjH,6FAA6F;AAC7F,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAqB1C;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAW,OAAO,CAAC,GAAG;IACrD,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,kCAAkC,IAAI,GAAG,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,CAAC;IACvG,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,MAAM,GAAG,4BAA4B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACjF,IAAI,MAAM;QAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IACvG,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC;IACpI,IAAI,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,aAAa,EAAE,CAAC;QACvF,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,UAAU,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,UAAU,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACvE,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,WAAW,CAAC,MAAW,OAAO,CAAC,GAAG;IACjD,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAChB,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAI,CAAC,KAAK,YAAY;QAAE,OAAO,MAAM,CAAC;IACtC,IAAI,CAAC,KAAK,aAAa;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,CAAC,IAAI,SAAS,CAAC;AACvB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,gBAAgB;IAC/B,sEAAsE;IACtE,uEAAuE;IACvE,2EAA2E;IAC3E,0EAA0E;IAC1E,qBAAqB;IACrB,MAAM,OAAO,GAAG,4BAA4B,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,qCAAqC,CAAC,CAAC;IAE5D,OAAO;QACN,IAAI,mBAAmB,CAAC;YACvB,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;YACjD,4EAA4E;YAC5E,qBAAqB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAmB,CAAC;YACnF,kCAAkC;YAClC,yBAAyB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU;YAChF,6BAA6B,EAAE,IAAI;SACnC,CAAC;QACF,IAAI,qBAAqB,CAAC,EAAE,GAAG,OAAO,CAAC,uCAAuC,CAAC,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;QAC/G,IAAI,sBAAsB,CAAC;YAC1B,iBAAiB,EAAE,IAAI;YACvB,mDAAmD;YACnD,qBAAqB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG;SACnC,CAAC;QACF,IAAI,qBAAqB,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QAClD,IAAI,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC;QACpF,IAAI,kBAAkB,CAAC,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC;QACjE,IAAI,0BAA0B,EAAE;QAChC,2EAA2E;QAC3E,IAAI,mBAAmB,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;KACpD,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,KAAK,GAAkB;IAC5B,8BAA8B;IAC9B,8BAA8B;IAC9B,sBAAsB;IACtB,sBAAsB;CACtB,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AAE7F,IAAI,OAAwE,CAAC;AAC7E,IAAI,QAAmC,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,IAAI,CAAC,OAAoB,EAAE;IAC1C,IAAI,OAAO;QAAE,OAAO;IACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC3G,MAAM,WAAW,GAAG,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC;IACtE,MAAM,SAAS,GAAG,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC;IACvE,MAAM,cAAc,GAAG,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;IACxD,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,0BAA0B,CAAC;IAE7F,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC3C,MAAM,cAAc,GAAoB,CAAC,IAAI,qBAAqB,EAAE,EAAE,IAAI,qBAAqB,EAAE,EAAE,OAAO,CAAC,CAAC;IAC5G,IAAI,QAAQ,EAAE,CAAC;QACd,cAAc,CAAC,IAAI,CAClB,IAAI,WAAW,CACd,IAAI,kBAAkB,CAAC;YACtB,QAAQ,EAAE,IAAI,iBAAiB,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC;YACxF,mBAAmB,EAAE,iBAAiB;SACtC,CAAC,CACF,CACD,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAA2B,EAAE,qBAAqB,EAAE,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE,EAAE,CAAC;IACpH,IAAI,UAAU;QAAE,UAAU,CAAC,wBAAwB,CAAC,GAAG,UAAU,CAAC;IAElE,MAAM,OAAO,GAAG,KAAK,CACpB;QACC,mEAAmE;QACnE,kEAAkE;QAClE,6CAA6C;QAC7C,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAClC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,UAAU;QACV,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QAC3E,GAAG,EAAE;YACJ,OAAO,EAAE,IAAI,eAAe,EAAE;YAC9B,iBAAiB,EAAE,IAAI,yBAAyB,EAAE;YAClD,cAAc;YACd,aAAa,EAAE,QAAQ;gBACtB,CAAC,CAAC;oBACA,IAAI,6BAA6B,CAAC;wBACjC,QAAQ,EAAE,IAAI,kBAAkB,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC;wBACzF,oBAAoB,EAAE,cAAc;wBACpC,mBAAmB,EAAE,iBAAiB;qBACtC,CAAC;iBACF;gBACF,CAAC,CAAC,EAAE;YACL,KAAK,EAAE,KAAK;YACZ,mBAAmB,EAAE,EAAE;SACvB;KACD;IACD,iFAAiF;IACjF,EAAE,GAAG,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,CACnC,CAAC;IACF,OAAO,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC/B,IAAI,QAAQ,EAAE,CAAC;QACd,mEAAmE;QACnE,wEAAwE;QACxE,IAAI,WAAW,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,aAAa,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACtI,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,QAAQ,CAAC,MAAM,EAAE,2BAA2B,EAAE,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC,CAAC;QACpG,OAAO;IACR,CAAC;IACD,QAAQ,CAAC,MAAM,EAAE,uBAAuB,EAAE;QACzC,QAAQ,EAAE,QAAQ,CAAC,UAAU;QAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,WAAW;QACpB,kBAAkB,EAAE,cAAc;QAClC,cAAc,EAAE,WAAW;QAC3B,mBAAmB,EAAE,SAAS;QAC9B,iBAAiB,EAAE,cAAc;QACjC,wBAAwB,EAAE,UAAU;KACpC,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAgB;IAChD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,2GAA2G,CAAC,CAAC;IAC3I,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,UAAU;IAC/B,IAAI,CAAC,OAAO;QAAE,OAAO;IAErB,MAAM,cAAc,GAAG,KAAK,CAAC,iBAAiB,EAAmD,CAAC;IAClG,MAAM,EAAE,GAAG,cAAc,CAAC,WAAW,EAAE,EAAE,IAAI,cAAc,CAAC;IAC5D,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAe,CAAC;IACnD,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,QAAQ;IACvB,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IACvC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,WAAW;IAC1B,OAAO,OAAO,KAAK,SAAS,CAAC;AAC9B,CAAC"}