renor-engine 0.0.0-stage → 1.0.0

package/dist/mvp/serverCard.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SERVER_ENDPOINT = exports.SERVER_TITLE = exports.SERVER_VERSION = exports.SERVER_NAME = void 0;
+exports.buildServerCard = buildServerCard;
+exports.serverCardText = serverCardText;
+/** The MCP server's identity: its initialize reply and this card both take it from here. */
+exports.SERVER_NAME = 'renor';
+exports.SERVER_VERSION = '0.1.0';
+exports.SERVER_TITLE = 'Renor';
+/** The hosted server's one public endpoint (the gateway's /mcp), Streamable HTTP. */
+exports.SERVER_ENDPOINT = 'https://mcp.renor.cloud/mcp';
+function byName(a, b) {
+    return a.name < b.name ? -1 : a.name > b.name ? 1 : 0;
+}
+/** The card for the tools an agent sees, in name order, so the file does not depend on registration order. */
+function buildServerCard(tools) {
+    return {
+        serverInfo: { name: exports.SERVER_NAME, title: exports.SERVER_TITLE, version: exports.SERVER_VERSION },
+        remotes: [{ type: 'streamable-http', url: exports.SERVER_ENDPOINT }],
+        authentication: { required: true, schemes: ['oauth2'] },
+        tools: [...tools].sort(byName),
+        resources: [],
+        prompts: [],
+    };
+}
+/** The exact bytes the gateway serves: two-space JSON with a final newline. */
+function serverCardText(card) {
+    return `${JSON.stringify(card, null, 2)}\n`;
+}

package/dist/mvp/storedSize.js

@@ -0,0 +1,139 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StoredSizeGauge = void 0;
+exports.measureMarkdownBytes = measureMarkdownBytes;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+/**
+ * How many bytes of Markdown a workspace stores: its notes and the engine's own ledger, every regular `.md` file under
+ * the memory directory. The search index (`.memory-index/`), the caches and the auth state are derived or private
+ * state, not the user's memory, and are not counted. A symbolic link is never followed.
+ *
+ * The figure goes to the gateway on the `/internal/gateway-token` call it makes for every request, so the control plane
+ * can record it, show it, and cap writes, without a call of its own and without waking an engine to ask: an engine that
+ * is asleep has not changed what it stores.
+ */
+/** The folder holding the index. It sits inside the memory directory and is never user content. */
+const INDEX_DIR = '.memory-index';
+/** Files stat'ed at once: enough to hide the latency, few enough to stay polite to a small VM. */
+const STAT_CHUNK = 64;
+/** The bytes of every regular `.md` file below `root`. Unreadable content fails measurement; vanished files are skipped. */
+async function measureMarkdownBytes(root) {
+    let total = 0;
+    const folders = [root];
+    while (folders.length > 0) {
+        const folder = folders.pop();
+        let entries;
+        try {
+            entries = await fs_1.default.promises.readdir(folder, { withFileTypes: true });
+        }
+        catch (err) {
+            // A folder that vanished while the walk was running is not an error; an unreadable root is.
+            if (folder === root || err.code !== 'ENOENT')
+                throw err;
+            continue;
+        }
+        const files = [];
+        for (const entry of entries) {
+            // `isDirectory()` and `isFile()` are false for a symbolic link, so a link is skipped, never followed.
+            if (entry.isDirectory()) {
+                if (entry.name !== INDEX_DIR)
+                    folders.push(path_1.default.join(folder, entry.name));
+            }
+            else if (entry.isFile() && entry.name.endsWith('.md')) {
+                files.push(path_1.default.join(folder, entry.name));
+            }
+        }
+        for (let i = 0; i < files.length; i += STAT_CHUNK) {
+            const sizes = await Promise.all(files.slice(i, i + STAT_CHUNK).map(async (file) => {
+                try {
+                    const stat = await fs_1.default.promises.lstat(file);
+                    return stat.isFile() ? stat.size : 0;
+                }
+                catch (err) {
+                    if (err.code !== 'ENOENT')
+                        throw err;
+                    return 0; // deleted between the listing and the stat
+                }
+            }));
+            for (const size of sizes)
+                total += size;
+        }
+    }
+    return total;
+}
+/**
+ * The last measured size, served at once by read(). It never blocks and never throws: a missing or stale figure only starts one
+ * measurement in the background (one at a time), whose result the next caller gets. The first measurement starts when
+ * the gauge is made, so early reporting calls can have a figure. A measurement that fails keeps the last good
+ * figure and is retried after the TTL, not on every reporting call. readFresh() instead awaits a current walk for admission.
+ */
+class StoredSizeGauge {
+    dir;
+    bytes = null;
+    measuredAt = 0;
+    running = null;
+    ttlMs;
+    now;
+    measure;
+    constructor(dir, options = {}) {
+        this.dir = dir;
+        this.ttlMs = options.ttlMs ?? 30_000;
+        this.now = options.now ?? Date.now;
+        this.measure = options.measure ?? measureMarkdownBytes;
+        this.refresh();
+    }
+    /** The bytes as of the last finished measurement, or null before the first one has finished. */
+    read() {
+        if (this.bytes === null || this.now() - this.measuredAt >= this.ttlMs)
+            this.refresh();
+        return this.bytes;
+    }
+    refresh() {
+        if (this.running)
+            return;
+        // Started now, and whatever a measurement does, even a synchronous throw, stays out of the caller's way.
+        let attempt;
+        try {
+            attempt = Promise.resolve(this.measure(this.dir));
+        }
+        catch (err) {
+            attempt = Promise.reject(err);
+        }
+        this.running = attempt
+            .then((bytes) => {
+            if (Number.isSafeInteger(bytes) && bytes >= 0)
+                this.bytes = bytes;
+        }, () => {
+            // Keep the last good figure.
+        })
+            .finally(() => {
+            this.measuredAt = this.now();
+            this.running = null;
+        });
+    }
+    /** Admission checks must measure after previous writes, never reuse the TTL or an in-flight older walk. */
+    async readFresh() {
+        await this.settled();
+        try {
+            const bytes = await this.measure(this.dir);
+            if (!Number.isSafeInteger(bytes) || bytes < 0)
+                return null;
+            this.bytes = bytes;
+            this.measuredAt = this.now();
+            return bytes;
+        }
+        catch {
+            // A cached good value cannot authorize a write after a failed current measurement.
+            return null;
+        }
+    }
+    /** Resolves when the measurement in flight, if any, has finished. */
+    settled() {
+        return this.running ?? Promise.resolve();
+    }
+}
+exports.StoredSizeGauge = StoredSizeGauge;

package/dist/mvp/telemetry.js

@@ -0,0 +1,441 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RECALL_TOOLS = exports.REJECTION_KINDS = void 0;
+exports.isRecallTool = isRecallTool;
+exports.isPlatformInitialize = isPlatformInitialize;
+exports.isSafeArgName = isSafeArgName;
+exports.telemetryInstanceId = telemetryInstanceId;
+exports.emitTelemetry = emitTelemetry;
+exports.flushTelemetry = flushTelemetry;
+const node_crypto_1 = require("node:crypto");
+const toolRefusal_1 = require("../toolRefusal");
+/**
+ * How a tool's input schema refused a call: a CLOSED set, so a kind can name the family of the failure and nothing the
+ * caller wrote. `missing`: the argument (or all of them) was absent. `wrong_type`: present, but not the type the
+ * schema takes (a number sent as a string, a null). `too_small` / `too_big`: under a minimum or over a maximum, of a length
+ * or of a value. `invalid_value`: not one of the values the schema lists. `invalid_format`: not the format it takes
+ * (a UUID, a pattern). `other`: any refusal this list has no word for.
+ */
+exports.REJECTION_KINDS = ['missing', 'wrong_type', 'too_small', 'too_big', 'invalid_value', 'invalid_format', 'other'];
+const SAFE_TOOL = /^[a-z][a-z0-9_]{0,64}$/;
+const SAFE_ARG = /^[A-Za-z_][A-Za-z0-9_]{0,63}$/;
+const OPAQUE_ID = /^[0-9a-f]{8}$/;
+const SESSION_ID = /^[0-9a-f]{16}$/;
+/** Ids a `read` event lists, as many as readUsefulness.ts lists: `items` still counts them all. */
+const MAX_EVENT_IDS = 20;
+// The values a field that is not free text may take. The type of each field is made from its list, so the two cannot part.
+const TOOL_ERROR_KINDS = ['validation', 'unavailable', 'internal', 'auth', 'other'];
+const AUTH_KINDS = ['login_ok', 'login_fail', 'token_ok', 'token_fail'];
+const SESSION_KINDS = ['mcp_init', 'mcp_close'];
+const READ_TOOLS = ['get_context', 'search_memory', 'retrieve_memory'];
+const USE_VIAS = ['read', 'cite', 'update'];
+/**
+ * The tools that read stored memory back to the agent: the usage report's "memory read" tools (docs/USAGE-METRICS.md) and
+ * read_memory. A first call to one of them is a recall. Decided here, from the tool's name, so no caller can set the flag.
+ */
+exports.RECALL_TOOLS = [
+    'get_context', 'search_memory', 'search_text', 'search_history', 'retrieve_memory', 'lookup_entity', 'export_memory', 'read_memory',
+];
+function isRecallTool(tool) {
+    return exports.RECALL_TOOLS.includes(tool);
+}
+/**
+ * The `clientInfo.name` the platform's own MCP calls present: the gateway's dashboard import (engine/apps/gateway/src/dashboard-import.ts)
+ * and the dashboard's memory inventory (supabase/functions/memory-inventory/renor-tenant.ts). A session that presents one is the
+ * platform acting for a person, not an agent reaching for memory, so the recall share leaves it out. The name is what the client
+ * declares about itself: a client that declares one only drops its own session from the share, and nothing else follows from it.
+ */
+const PLATFORM_CLIENT_NAMES = new Set(['renor-dashboard', 'renor-dashboard-import']);
+/** True when an `initialize` request names a platform client (see PLATFORM_CLIENT_NAMES). Reads the body; keeps nothing from it. */
+function isPlatformInitialize(body) {
+    const params = typeof body === 'object' && body !== null ? body.params : undefined;
+    const clientInfo = typeof params === 'object' && params !== null ? params.clientInfo : undefined;
+    const name = typeof clientInfo === 'object' && clientInfo !== null ? clientInfo.name : undefined;
+    return typeof name === 'string' && PLATFORM_CLIENT_NAMES.has(name);
+}
+const READ_FIELDS = ['event', 'tool', 'read', 'relevant', 'judged', 'items', 'ids'];
+const READ_USED_FIELDS = ['event', 'tool', 'read', 'via', 'after_s'];
+const FIRST_CALL_FIELDS = ['event', 'tool', 'recall', 'session'];
+/** Exactly these keys and no other: a field nobody listed is a field nobody reviewed, so the event is dropped whole. */
+function hasOnlyFields(payload, allowed) {
+    const keys = Object.keys(payload);
+    return keys.length === allowed.length && keys.every(key => allowed.includes(key));
+}
+const isOpaqueId = (value) => typeof value === 'string' && OPAQUE_ID.test(value);
+const isSessionId = (value) => typeof value === 'string' && SESSION_ID.test(value);
+const isCount = (value) => typeof value === 'number' && Number.isInteger(value) && value >= 0;
+const isFiniteNumber = (value) => typeof value === 'number' && Number.isFinite(value);
+const isSafeTool = (value) => typeof value === 'string' && SAFE_TOOL.test(value);
+/** An argument name as the tools declare them: an identifier. Anything else is left unnamed, and the call is still counted. */
+function isSafeArgName(name) {
+    return typeof name === 'string' && SAFE_ARG.test(name);
+}
+/** The member of `allowed` that `value` is, or undefined. Only a string can be one, and what comes back is the list's own string. */
+function oneOf(value, allowed) {
+    return typeof value === 'string' ? allowed.find(member => member === value) : undefined;
+}
+/**
+ * `ids` as a NEW array of opaque ids, or null. It walks the indexes itself and never asks the array anything: an array can carry
+ * its own `every` or `toJSON`, and `every` skips a hole that JSON.stringify writes as `null`. Each element is read once and what
+ * is kept is the element as it was checked.
+ */
+function opaqueIds(value) {
+    if (!Array.isArray(value))
+        return null;
+    const length = value.length;
+    if (typeof length !== 'number' || !(length <= MAX_EVENT_IDS))
+        return null;
+    const ids = [];
+    for (let index = 0; index < length; index++) {
+        if (!Object.prototype.hasOwnProperty.call(value, index))
+            return null;
+        const id = value[index];
+        if (!isOpaqueId(id))
+            return null;
+        ids.push(id);
+    }
+    return ids;
+}
+/**
+ * The one door out: what is written is what comes out of here. The payload belongs to the caller, so it is only read: each field
+ * once, into a local, and checked by its TYPE (a regex or an `includes` on an object coerces it through its own toString and
+ * passes, while JSON.stringify then writes the object out as it is). The event that leaves is a NEW object made of those checked
+ * values, so nothing the caller still owns can reach a sink: not a field nobody listed, not an accessor that answers differently
+ * the second time, not an array's own `every` or `toJSON`. A value that fails its check drops the whole event; a read event
+ * is dropped for a field nobody listed too, where the older events just leave that field out.
+ */
+function cleanEvent(payload) {
+    if (typeof payload !== 'object' || payload === null)
+        return null;
+    const fields = payload;
+    switch (fields.event) {
+        case 'tool_use': {
+            const { tool, ok, ms, error_kind, error_reason } = fields;
+            if (!isSafeTool(tool) || typeof ok !== 'boolean' || !isFiniteNumber(ms))
+                return null;
+            const errorKind = error_kind === undefined ? undefined : oneOf(error_kind, TOOL_ERROR_KINDS);
+            if (error_kind !== undefined && !errorKind)
+                return null;
+            // The closed set is the whole gate for a reason: anything that is not one of its literals is dropped
+            // rather than logged, so no code can be a message, a statement or a path however it was produced. A
+            // dropped reason leaves the call counted, exactly as it was before reasons existed.
+            const errorReason = (0, toolRefusal_1.isToolErrorReason)(error_reason) ? error_reason : undefined;
+            return {
+                event: 'tool_use',
+                tool,
+                ok,
+                ms,
+                ...(errorKind ? { error_kind: errorKind } : {}),
+                ...(errorReason ? { error_reason: errorReason } : {}),
+            };
+        }
+        case 'auth': {
+            const kind = oneOf(fields.kind, AUTH_KINDS);
+            return kind ? { event: 'auth', kind } : null;
+        }
+        case 'session': {
+            const { kind: rawKind, session } = fields;
+            const kind = oneOf(rawKind, SESSION_KINDS);
+            if (!kind)
+                return null;
+            if (session === undefined)
+                return { event: 'session', kind };
+            return isSessionId(session) ? { event: 'session', kind, session } : null;
+        }
+        // A session's first tool call: the tool, whether it is a recall and the opaque id of the session. Nothing else: not the
+        // call's arguments, its result or its timing. `recall` must be the tool's own answer from RECALL_TOOLS, or the event is dropped.
+        case 'first_call': {
+            if (!hasOnlyFields(fields, FIRST_CALL_FIELDS))
+                return null;
+            const { tool, recall, session } = fields;
+            if (!isSafeTool(tool) || typeof recall !== 'boolean' || recall !== isRecallTool(tool) || !isSessionId(session))
+                return null;
+            return { event: 'first_call', tool, recall, session };
+        }
+        // A rejection line may name a tool and an argument and say how it failed, from the closed set: nothing else gets out.
+        case 'tool_rejected': {
+            const { tool, arg, kind } = fields;
+            const rejection = oneOf(kind, exports.REJECTION_KINDS);
+            if (!isSafeTool(tool) || !rejection)
+                return null;
+            if (arg === undefined)
+                return { event: 'tool_rejected', tool, kind: rejection };
+            return isSafeArgName(arg) ? { event: 'tool_rejected', tool, arg, kind: rejection } : null;
+        }
+        // The read-usefulness events carry nothing but counts and opaque ids.
+        case 'read': {
+            if (!hasOnlyFields(fields, READ_FIELDS))
+                return null;
+            const { tool, read, relevant, judged, items, ids } = fields;
+            const readTool = oneOf(tool, READ_TOOLS);
+            const opaque = opaqueIds(ids);
+            if (!readTool || !isOpaqueId(read) || typeof relevant !== 'boolean' || typeof judged !== 'boolean' || !isCount(items) || !opaque)
+                return null;
+            return { event: 'read', tool: readTool, read, relevant, judged, items, ids: opaque };
+        }
+        case 'read_used': {
+            if (!hasOnlyFields(fields, READ_USED_FIELDS))
+                return null;
+            const { tool, read, via, after_s } = fields;
+            const readTool = oneOf(tool, READ_TOOLS);
+            const usedVia = oneOf(via, USE_VIAS);
+            if (!readTool || !isOpaqueId(read) || !usedVia || !isCount(after_s))
+                return null;
+            return { event: 'read_used', tool: readTool, read, via: usedVia, after_s };
+        }
+        default:
+            return null;
+    }
+}
+const pendingRemote = new Set();
+function env(name) {
+    return (process.env[name] ?? '').trim();
+}
+function remoteDisabled() {
+    return env('RENOR_TELEMETRY_DISABLED').toLowerCase() === 'true';
+}
+function pseudonymousInstance(instance) {
+    const salt = env('RENOR_TELEMETRY_HASH_SALT');
+    return (0, node_crypto_1.createHash)('sha256')
+        .update(`renor-telemetry:\0${salt}\0${instance}`)
+        .digest('hex')
+        .slice(0, 24);
+}
+function isFailure(line) {
+    if (line.event === 'tool_use')
+        return !line.ok;
+    if (line.event === 'auth')
+        return line.kind.endsWith('_fail');
+    return false;
+}
+function safeTimeoutMs() {
+    const parsed = Number(env('RENOR_TELEMETRY_TIMEOUT_MS') || '1500');
+    if (!Number.isFinite(parsed))
+        return 1500;
+    return Math.min(5000, Math.max(250, Math.trunc(parsed)));
+}
+async function postJson(url, init) {
+    try {
+        const response = await fetch(url, {
+            ...init,
+            signal: AbortSignal.timeout(safeTimeoutMs()),
+        });
+        await response.body?.cancel();
+    }
+    catch {
+        // Remote observability must never affect Renor availability.
+    }
+}
+function posthogEndpoint() {
+    const explicit = env('RENOR_POSTHOG_CAPTURE_URL');
+    if (explicit)
+        return explicit;
+    const host = env('RENOR_POSTHOG_HOST') || 'https://us.i.posthog.com';
+    return `${host.replace(/\/$/, '')}/i/v0/e/`;
+}
+async function sendPostHog(line) {
+    const apiKey = env('RENOR_POSTHOG_KEY');
+    if (!apiKey)
+        return;
+    const { event, instance: _instance, ts, ...properties } = line;
+    await postJson(posthogEndpoint(), {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+            api_key: apiKey,
+            distinct_id: pseudonymousInstance(line.instance),
+            event: `renor_${event}`,
+            timestamp: ts,
+            properties: {
+                service: 'renor-core',
+                $process_person_profile: false,
+                ...properties,
+            },
+        }),
+    });
+}
+function sentryEnvelopeEndpoint(dsn) {
+    try {
+        const parsed = new URL(dsn);
+        const parts = parsed.pathname.split('/').filter(Boolean);
+        const projectId = parts.pop();
+        if (!projectId || !/^\d+$/.test(projectId))
+            return null;
+        const prefix = parts.length ? `/${parts.join('/')}` : '';
+        return `${parsed.origin}${prefix}/api/${projectId}/envelope/`;
+    }
+    catch {
+        return null;
+    }
+}
+async function sendSentry(line) {
+    if (!isFailure(line))
+        return;
+    const dsn = env('RENOR_SENTRY_DSN');
+    if (!dsn)
+        return;
+    const endpoint = sentryEnvelopeEndpoint(dsn);
+    if (!endpoint)
+        return;
+    const eventId = (0, node_crypto_1.randomBytes)(16).toString('hex');
+    const tags = {
+        service: 'renor-core',
+        event: line.event,
+        instance_id: pseudonymousInstance(line.instance),
+    };
+    const extra = {};
+    if (line.event === 'tool_use') {
+        tags.tool = line.tool;
+        tags.error_kind = line.error_kind ?? 'other';
+        extra.ok = line.ok;
+        extra.ms = line.ms;
+        if (line.error_reason)
+            tags.error_reason = line.error_reason;
+    }
+    else if (line.event === 'auth') {
+        tags.kind = line.kind;
+    }
+    const payload = {
+        event_id: eventId,
+        timestamp: line.ts,
+        level: 'error',
+        platform: 'node',
+        message: 'Renor operational failure',
+        tags,
+        extra,
+    };
+    const envelope = JSON.stringify({ event_id: eventId, sent_at: line.ts, dsn }) +
+        '\n' +
+        JSON.stringify({ type: 'event' }) +
+        '\n' +
+        JSON.stringify(payload);
+    await postJson(endpoint, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-sentry-envelope' },
+        body: envelope,
+    });
+}
+function otlpAttributes(line) {
+    const attrs = [
+        { key: 'renor.event', value: { stringValue: line.event } },
+        {
+            key: 'renor.instance_id',
+            value: { stringValue: pseudonymousInstance(line.instance) },
+        },
+    ];
+    if (line.event === 'tool_use') {
+        attrs.push({ key: 'renor.tool', value: { stringValue: line.tool } }, { key: 'renor.ok', value: { boolValue: line.ok } }, { key: 'renor.duration_ms', value: { intValue: String(Math.max(0, Math.trunc(line.ms))) } });
+        if (line.error_kind) {
+            attrs.push({ key: 'renor.error_kind', value: { stringValue: line.error_kind } });
+        }
+        if (line.error_reason) {
+            attrs.push({ key: 'renor.error_reason', value: { stringValue: line.error_reason } });
+        }
+    }
+    else if (line.event === 'auth') {
+        attrs.push({ key: 'renor.auth_kind', value: { stringValue: line.kind } });
+    }
+    else if (line.event === 'tool_rejected') {
+        attrs.push({ key: 'renor.tool', value: { stringValue: line.tool } }, { key: 'renor.rejection_kind', value: { stringValue: line.kind } });
+        if (line.arg)
+            attrs.push({ key: 'renor.rejected_arg', value: { stringValue: line.arg } });
+    }
+    else if (line.event === 'session') {
+        attrs.push({ key: 'renor.session_kind', value: { stringValue: line.kind } });
+    }
+    return attrs;
+}
+async function sendLangfuse(line) {
+    // A trace span per call; a read-usefulness event is a count, and PostHog takes it. A first call is already a tool_use span.
+    if (line.event === 'read' || line.event === 'read_used' || line.event === 'first_call')
+        return;
+    const publicKey = env('LANGFUSE_PUBLIC_KEY');
+    const secretKey = env('LANGFUSE_SECRET_KEY');
+    if (!publicKey || !secretKey)
+        return;
+    const host = (env('LANGFUSE_HOST') || 'https://cloud.langfuse.com').replace(/\/$/, '');
+    const endMs = Date.parse(line.ts);
+    if (!Number.isFinite(endMs))
+        return;
+    const durationMs = line.event === 'tool_use' ? Math.max(0, line.ms) : 0;
+    const startMs = Math.max(0, endMs - durationMs);
+    const traceId = (0, node_crypto_1.randomBytes)(16).toString('hex');
+    const spanId = (0, node_crypto_1.randomBytes)(8).toString('hex');
+    const suffix = line.event === 'tool_use' || line.event === 'tool_rejected' ? line.tool :
+        line.event === 'auth' || line.event === 'session' ? line.kind :
+            'read';
+    const body = {
+        resourceSpans: [
+            {
+                resource: {
+                    attributes: [
+                        { key: 'service.name', value: { stringValue: 'renor-core' } },
+                    ],
+                },
+                scopeSpans: [
+                    {
+                        scope: { name: 'renor.telemetry', version: '1' },
+                        spans: [
+                            {
+                                traceId,
+                                spanId,
+                                name: `renor.${line.event}.${suffix}`,
+                                startTimeUnixNano: String(BigInt(Math.trunc(startMs)) * 1000000n),
+                                endTimeUnixNano: String(BigInt(Math.trunc(endMs)) * 1000000n),
+                                attributes: otlpAttributes(line),
+                                status: { code: isFailure(line) ? 2 : 1 },
+                            },
+                        ],
+                    },
+                ],
+            },
+        ],
+    };
+    await postJson(`${host}/api/public/otel/v1/traces`, {
+        method: 'POST',
+        headers: {
+            authorization: `Basic ${Buffer.from(`${publicKey}:${secretKey}`).toString('base64')}`,
+            'content-type': 'application/json',
+            'x-langfuse-ingestion-version': '4',
+        },
+        body: JSON.stringify(body),
+    });
+}
+async function forwardRemote(line) {
+    if (remoteDisabled())
+        return;
+    await Promise.allSettled([
+        sendPostHog(line),
+        sendSentry(line),
+        sendLangfuse(line),
+    ]);
+}
+function dispatchRemote(line) {
+    const task = forwardRemote(line).finally(() => pendingRemote.delete(task));
+    pendingRemote.add(task);
+}
+function telemetryInstanceId() {
+    const raw = (process.env.MVP_INSTANCE_ID ?? 'unknown').trim().toLowerCase();
+    return /^[a-z0-9_-]{1,32}$/.test(raw) ? raw : 'unknown';
+}
+function emitTelemetry(payload) {
+    try {
+        const event = cleanEvent(payload);
+        if (!event)
+            return;
+        const line = {
+            ts: new Date().toISOString(),
+            instance: telemetryInstanceId(),
+            ...event,
+        };
+        console.log(JSON.stringify(line));
+        dispatchRemote(line);
+    }
+    catch {
+        // Telemetry must never break the product.
+    }
+}
+/** Primarily for orderly shutdowns and deterministic tests. */
+async function flushTelemetry() {
+    await Promise.allSettled([...pendingRemote]);
+}