trail-code 0.0.0-stage → 0.28.0-semantic.3

package/dist/telemetry/gate.js

@@ -0,0 +1,81 @@
+/**
+ * The single "may we send?" predicate, checked before every append and again
+ * before every send.
+ *
+ * Four independent gates, in the order a user would expect them to win:
+ *
+ *   1. A key at all — dev builds and forks have none (see key.ts), so the whole
+ *      subsystem is inert for anyone who did not install a published graft.
+ *   2. `DO_NOT_TRACK` — the cross-tool convention (consoledonottrack.com).
+ *      Honoured unconditionally: it outranks our own setting, because a user who
+ *      set it machine-wide has already answered the question for every tool.
+ *   3. CI — a build server is not a user. Counting it would inflate every number
+ *      we care about and tell us nothing about a person.
+ *   4. The user's own choice, from the `graft init` picker or
+ *      `graft telemetry disable`. Default on when never set.
+ *
+ * Re-checked at every append rather than cached at boot, so `graft telemetry
+ * disable` in one terminal takes effect in a long-lived MCP server in another
+ * without a restart.
+ */
+import { posthogKey } from './key.js';
+import { readState } from './identity.js';
+import { cmd } from '../brand.js';
+/** The `DO_NOT_TRACK` convention: set and not `0`/empty means "off". */
+export function doNotTrack(env = process.env) {
+    const v = env.DO_NOT_TRACK;
+    return v !== undefined && v !== '' && v !== '0';
+}
+/**
+ * Every variable {@link inCi} reads, named once.
+ *
+ * Exported because a test that needs telemetry actually ON has to clear all of
+ * them, and clearing a hand-copied subset is how this list silently drifts: the
+ * `cursor-session-end` test cleared `CI` alone, so it passed on a laptop and failed
+ * on GitHub Actions — where `GITHUB_ACTIONS` is set — for every run until someone
+ * read the log. One list, both callers.
+ */
+export const CI_ENV_VARS = [
+    'CI', 'GITHUB_ACTIONS', 'GITLAB_CI', 'BUILDKITE', 'CIRCLECI',
+    'TEAMCITY_VERSION', 'JENKINS_URL', 'TF_BUILD', 'BUILD_NUMBER',
+];
+/**
+ * CI detection. `CI` covers essentially every provider; the rest are the ones
+ * that historically did not set it. Deliberately generous — a false positive
+ * costs one uncounted user, a false negative pollutes the dataset.
+ *
+ * `CI` is the one read with a value test: `CI=false` is a real thing a user sets
+ * to mean "not CI", while the provider-specific vars are presence-only — none of
+ * them is ever deliberately set to a falsy string.
+ */
+export function inCi(env = process.env) {
+    if (env.CI !== undefined && env.CI !== '' && env.CI !== '0' && env.CI !== 'false')
+        return true;
+    return CI_ENV_VARS.some((name) => name !== 'CI' && Boolean(env[name]));
+}
+/** Null when telemetry may run, otherwise the first gate that closed. */
+export function offReason(home, env = process.env) {
+    if (!posthogKey())
+        return 'no-key';
+    if (doNotTrack(env))
+        return 'do-not-track';
+    if (inCi(env))
+        return 'ci';
+    if (readState(home)?.enabled === false)
+        return 'disabled';
+    return null;
+}
+export function telemetryOn(home, env = process.env) {
+    return offReason(home, env) === null;
+}
+/** One line for `graft telemetry status`, naming the gate that is closed so a
+ *  user who thinks they disabled it can see which switch actually took. */
+export function explainOff(reason) {
+    switch (reason) {
+        case 'no-key': return 'off: this build has no telemetry key (a fork, or a local `npm run build`), so nothing can be sent';
+        case 'do-not-track': return 'off: DO_NOT_TRACK is set in this environment';
+        case 'ci': return 'off: this looks like CI';
+        case 'disabled': return `off: you disabled it (\`${cmd('graft telemetry enable')}\` to turn it back on)`;
+    }
+}
+//# sourceMappingURL=gate.js.map

package/dist/telemetry/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/telemetry/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAIlC,wEAAwE;AACxE,MAAM,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7D,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC;IAC3B,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC;AAClD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU;IAC5D,kBAAkB,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc;CACrD,CAAC;AAEX;;;;;;;;GAQG;AACH,MAAM,UAAU,IAAI,CAAC,MAAyB,OAAO,CAAC,GAAG;IACvD,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC/F,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,SAAS,CAAC,IAAa,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC3E,IAAI,CAAC,UAAU,EAAE;QAAE,OAAO,QAAQ,CAAC;IACnC,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,cAAc,CAAC;IAC3C,IAAI,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,UAAU,CAAC;IAC1D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAa,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC7E,OAAO,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,IAAI,CAAC;AACvC,CAAC;AAED;2EAC2E;AAC3E,MAAM,UAAU,UAAU,CAAC,MAAiB;IAC1C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC,CAAQ,OAAO,mGAAmG,CAAC;QACjI,KAAK,cAAc,CAAC,CAAE,OAAO,8CAA8C,CAAC;QAC5E,KAAK,IAAI,CAAC,CAAY,OAAO,yBAAyB,CAAC;QACvD,KAAK,UAAU,CAAC,CAAM,OAAO,2BAA2B,GAAG,CAAC,wBAAwB,CAAC,wBAAwB,CAAC;IAChH,CAAC;AACH,CAAC"}

package/dist/telemetry/identity.d.ts

@@ -0,0 +1,40 @@
+/** Machine-global telemetry state. Shares `~/.graft/` with `update-check.json`. */
+export interface TelemetryState {
+    installId: string;
+    /** The user's choice. Absent means "never chosen" → the default (on) applies. */
+    enabled?: boolean;
+    /** ISO stamp of the one-time first-run notice, so it prints exactly once. */
+    noticeShownAt?: string;
+    /** ISO stamp of the `first_run` event. Its own field rather than "did this
+     *  call mint the install id", because the postinstall hook now mints the id
+     *  before any command runs — see `trackFirstRunIfNew`. */
+    firstRunAt?: string;
+    /** The version the `install` event was last sent for, so an upgrade counts as
+     *  an install and a repeated `npm install` of the same version does not. */
+    installedVersion?: string;
+    /** Epoch ms of the last flush ATTEMPT, mirroring `UpdateCache.checkedAt`. */
+    flushedAt?: number;
+}
+export declare function statePath(home?: string): string;
+export declare function readState(home?: string): TelemetryState | null;
+/** Read-modify-write. Not atomic across processes; a lost update costs at most a
+ *  duplicated notice or an extra flush attempt, never corruption. */
+export declare function patchState(patch: Partial<TelemetryState>, home?: string): TelemetryState;
+export interface Install {
+    id: string;
+    /** True when this call minted the id, i.e. this is the machine's first run. */
+    firstRun: boolean;
+}
+/** The install id, minted on first call. */
+export declare function installId(home?: string): Install;
+/**
+ * The repo id, in `graft/.cache/` rather than `.graft/config.json`.
+ *
+ * `.graft/config.json` would have been the tidier home, but writing it runs
+ * `ensureBuildConfigIgnored`, which appends to the repo's `.gitignore`. Minting
+ * an id during a read-only `graft ask` must not modify a file the user has
+ * committed. `graft/.cache/` is already derived, already git-ignored, and
+ * already where every other per-repo sidecar lives.
+ */
+export declare function repoId(repo: string): string;
+//# sourceMappingURL=identity.d.ts.map

package/dist/telemetry/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/telemetry/identity.ts"],"names":[],"mappings":"AA0BA,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;8DAE0D;IAC1D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;gFAC4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,SAAS,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE1D;AAED,wBAAgB,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAE9D;AAED;qEACqE;AACrE,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,cAAc,CAIxF;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,+EAA+E;IAC/E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,4CAA4C;AAC5C,wBAAgB,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAahD;AAED;;;;;;;;GAQG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO3C"}

package/dist/telemetry/identity.js

@@ -0,0 +1,80 @@
+/**
+ * The two identifiers, and why neither of them identifies anyone.
+ *
+ *   • install id — one per machine, in `~/.graft/telemetry.json`, beside the
+ *     update-check cache that already lives there. Lets us count people rather
+ *     than events, so a dev running forty queries is one user and not forty.
+ *   • repo id — one per checkout, in `graft/.cache/`. Activation and retention
+ *     for graft are per-repo facts ("did this repo ever get past build?"), and
+ *     the install id alone cannot express them.
+ *
+ * Both are `randomUUID()`. Not a machine id, not a hash of the git remote, not
+ * derived from anything real — a coin flip, written down. A hash would at least
+ * be guessable by us (we could hash a public repo URL and look for it); a random
+ * UUID cannot be reversed or confirmed even in principle. Deleting `~/.graft/`
+ * or `graft/` deletes them, and the user simply looks like someone new.
+ *
+ * Every function here is fail-soft: an unwritable home is a very common state
+ * (a locked-down CI image, a read-only container) and it must cost the caller
+ * nothing. A failed persist yields an ephemeral id for this process — still
+ * anonymous, just not stable — and never a throw.
+ */
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { cacheDir, readJson, writeJsonAtomic } from '../util/state.js';
+export function statePath(home = homedir()) {
+    return join(home, '.graft', 'telemetry.json');
+}
+export function readState(home) {
+    return readJson(statePath(home));
+}
+/** Read-modify-write. Not atomic across processes; a lost update costs at most a
+ *  duplicated notice or an extra flush attempt, never corruption. */
+export function patchState(patch, home) {
+    const next = { ...(readState(home) ?? { installId: randomUUID() }), ...patch };
+    try {
+        writeJsonAtomic(statePath(home), next);
+    }
+    catch { /* unwritable home — in-memory only */ }
+    return next;
+}
+/** The install id, minted on first call. */
+export function installId(home) {
+    const existing = readState(home);
+    if (existing?.installId)
+        return { id: existing.installId, firstRun: false };
+    const id = randomUUID();
+    try {
+        writeJsonAtomic(statePath(home), { ...(existing ?? {}), installId: id });
+        return { id, firstRun: true };
+    }
+    catch {
+        // Unwritable home: use the id for this process rather than failing closed.
+        // Reported as firstRun:false so a machine that can never persist doesn't
+        // send a first_run event on every single command.
+        return { id, firstRun: false };
+    }
+}
+/**
+ * The repo id, in `graft/.cache/` rather than `.graft/config.json`.
+ *
+ * `.graft/config.json` would have been the tidier home, but writing it runs
+ * `ensureBuildConfigIgnored`, which appends to the repo's `.gitignore`. Minting
+ * an id during a read-only `graft ask` must not modify a file the user has
+ * committed. `graft/.cache/` is already derived, already git-ignored, and
+ * already where every other per-repo sidecar lives.
+ */
+export function repoId(repo) {
+    const path = join(cacheDir(repo), 'telemetry-repo-id.json');
+    const existing = readJson(path);
+    if (existing?.repoId)
+        return existing.repoId;
+    const id = randomUUID();
+    try {
+        writeJsonAtomic(path, { repoId: id });
+    }
+    catch { /* unwritable — ephemeral */ }
+    return id;
+}
+//# sourceMappingURL=identity.js.map

package/dist/telemetry/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/telemetry/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAoBvE,MAAM,UAAU,SAAS,CAAC,OAAe,OAAO,EAAE;IAChD,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAa;IACrC,OAAO,QAAQ,CAAiB,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;qEACqE;AACrE,MAAM,UAAU,UAAU,CAAC,KAA8B,EAAE,IAAa;IACtE,MAAM,IAAI,GAAmB,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC;IAC/F,IAAI,CAAC;QAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,sCAAsC,CAAC,CAAC;IAChG,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,4CAA4C;AAC5C,MAAM,UAAU,SAAS,CAAC,IAAa;IACrC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,QAAQ,EAAE,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC5E,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAA2B,CAAC,CAAC;QAClG,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,yEAAyE;QACzE,kDAAkD;QAClD,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAsB,IAAI,CAAC,CAAC;IACrD,IAAI,QAAQ,EAAE,MAAM;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,IAAI,CAAC;QAAC,eAAe,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,4BAA4B,CAAC,CAAC;IACrF,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/telemetry/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Anonymous adoption telemetry. `TELEMETRY.md` is the public contract;
+ * `contract.ts` is the same list enforced in code.
+ *
+ * The whole subsystem is inert unless four things are true at once: the build
+ * carries a key (published releases only), `DO_NOT_TRACK` is unset, this is not
+ * CI, and the user has not disabled it. See `gate.ts`.
+ */
+export { EVENTS, VALUES, COMMON_KEYS, isTrackedCommand, errorCode, filesBucket, durationBucket, countBucket, savedTokensBucket, hookMsBucket, langsValue } from './contract.js';
+export type { AgentHost, Surface, TrackedCommand, BuildStage, ErrorCode } from './contract.js';
+export { track, trackFirstRunIfNew, trackInstallIfNew, detectHost } from './track.js';
+export type { QueuedEvent, TrackContext } from './track.js';
+export { telemetryOn, offReason, explainOff } from './gate.js';
+export { maybeFlushInBackground, runFlush } from './flush.js';
+export { firstRunNotice, formatStatus, formatDebug, NOTICE, TELEMETRY_DOC_URL } from './notice.js';
+export { patchState, readState } from './identity.js';
+export { flushClosedSessions, summarizeSession } from './sessions.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/telemetry/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/telemetry/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChL,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/F,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACtF,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC"}

package/dist/telemetry/index.js

@@ -0,0 +1,16 @@
+/**
+ * Anonymous adoption telemetry. `TELEMETRY.md` is the public contract;
+ * `contract.ts` is the same list enforced in code.
+ *
+ * The whole subsystem is inert unless four things are true at once: the build
+ * carries a key (published releases only), `DO_NOT_TRACK` is unset, this is not
+ * CI, and the user has not disabled it. See `gate.ts`.
+ */
+export { EVENTS, VALUES, COMMON_KEYS, isTrackedCommand, errorCode, filesBucket, durationBucket, countBucket, savedTokensBucket, hookMsBucket, langsValue } from './contract.js';
+export { track, trackFirstRunIfNew, trackInstallIfNew, detectHost } from './track.js';
+export { telemetryOn, offReason, explainOff } from './gate.js';
+export { maybeFlushInBackground, runFlush } from './flush.js';
+export { firstRunNotice, formatStatus, formatDebug, NOTICE, TELEMETRY_DOC_URL } from './notice.js';
+export { patchState, readState } from './identity.js';
+export { flushClosedSessions, summarizeSession } from './sessions.js';
+//# sourceMappingURL=index.js.map

package/dist/telemetry/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/telemetry/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhL,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEtF,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC"}

package/dist/telemetry/key.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The PostHog project key, and the reason forks stay silent.
+ *
+ * `BAKED_KEY` is empty in the repository and is rewritten in place by
+ * `scripts/stamp-telemetry-key.mjs`, which runs from `prepublishOnly`. So the
+ * key exists only in the published tarball: a clone, a fork, and a plain
+ * `npm run build` all compile to `''`, and every send path short-circuits. A
+ * contributor cannot accidentally send us their own usage, and a fork cannot
+ * send us anything at all.
+ *
+ * `GRAFT_POSTHOG_KEY` overrides it at runtime so a maintainer can exercise the
+ * real path locally without publishing.
+ *
+ * Public project keys are write-only ingestion keys — they authorise capture and
+ * nothing else — which is why one may sit in a published artifact at all. It is
+ * still not committed here: an empty default is what makes "forks never send"
+ * true by construction rather than by policy.
+ */
+export declare function posthogKey(): string;
+export declare function posthogHost(): string;
+//# sourceMappingURL=key.d.ts.map

package/dist/telemetry/key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.d.ts","sourceRoot":"","sources":["../../src/telemetry/key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA4BH,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED,wBAAgB,WAAW,IAAI,MAAM,CAEpC"}

package/dist/telemetry/key.js

@@ -0,0 +1,49 @@
+/**
+ * The PostHog project key, and the reason forks stay silent.
+ *
+ * `BAKED_KEY` is empty in the repository and is rewritten in place by
+ * `scripts/stamp-telemetry-key.mjs`, which runs from `prepublishOnly`. So the
+ * key exists only in the published tarball: a clone, a fork, and a plain
+ * `npm run build` all compile to `''`, and every send path short-circuits. A
+ * contributor cannot accidentally send us their own usage, and a fork cannot
+ * send us anything at all.
+ *
+ * `GRAFT_POSTHOG_KEY` overrides it at runtime so a maintainer can exercise the
+ * real path locally without publishing.
+ *
+ * Public project keys are write-only ingestion keys — they authorise capture and
+ * nothing else — which is why one may sit in a published artifact at all. It is
+ * still not committed here: an empty default is what makes "forks never send"
+ * true by construction rather than by policy.
+ */
+/** Rewritten at publish time. Do not hand-edit — see the module comment. */
+const BAKED_KEY = '';
+/**
+ * Nanonets' own PostHog host, not `us.i.posthog.com`.
+ *
+ * Every Nanonets product ingests through a nanonets.com proxy rather than
+ * PostHog directly, on one shared project token, so pointing graft at PostHog
+ * Cloud would put its events in a project nobody looks at.
+ *
+ * `events.` rather than `e.` because graft is server-side, and this is the host
+ * the other server-side integration already uses (the agents-platform Go
+ * backend sets `POSTHOG_HOST=https://events.nanonets.com`). The one documented
+ * objection to it — 400 `invalid_payload` — was gzip-compressed ingest from
+ * `posthog-js` in a browser, fixed there with `disable_compression: true`. We
+ * send plain uncompressed JSON from Node, so that failure mode cannot apply.
+ *
+ * Probed directly, that host answers 401 to a well-formed batch with a bad key,
+ * so it serves `/batch/` and parses the body — see the note in send.ts.
+ *
+ * The HOST is safe to commit; the KEY is not, and stays empty here. That
+ * asymmetry is the point: with no key, a fork built from this source sends
+ * nothing no matter where the host points.
+ */
+const BAKED_HOST = 'https://events.nanonets.com';
+export function posthogKey() {
+    return process.env.GRAFT_POSTHOG_KEY || BAKED_KEY;
+}
+export function posthogHost() {
+    return (process.env.GRAFT_POSTHOG_HOST || BAKED_HOST).replace(/\/+$/, '');
+}
+//# sourceMappingURL=key.js.map

package/dist/telemetry/key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.js","sourceRoot":"","sources":["../../src/telemetry/key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,4EAA4E;AAC5E,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,GAAG,6BAA6B,CAAC;AAEjD,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,SAAS,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,UAAU,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC"}

package/dist/telemetry/notice.d.ts

@@ -0,0 +1,19 @@
+export declare const TELEMETRY_DOC_URL = "https://github.com/trailhq/Trail-Code/blob/main/TELEMETRY.md";
+export declare const NOTICE: string;
+/**
+ * The notice text the first time it is due, then null forever after. Marks it as
+ * shown before returning, so two concurrent commands print it at most twice
+ * rather than every time.
+ */
+export declare function firstRunNotice(home?: string, env?: NodeJS.ProcessEnv): string | null;
+/** `graft telemetry status`. `env` is a test seam, as elsewhere in this module —
+ *  a real run must be gated on the real `DO_NOT_TRACK` and CI variables. */
+export declare function formatStatus(home?: string, env?: NodeJS.ProcessEnv): string;
+/**
+ * `graft telemetry debug` — Next.js's `NEXT_TELEMETRY_DEBUG` and Astro's
+ * `DEBUG=astro:telemetry` in command form. Prints the pending queue and the
+ * literal JSON body a flush would POST, and sends nothing. The point is that a
+ * user never has to take our word for the contract.
+ */
+export declare function formatDebug(home?: string): string;
+//# sourceMappingURL=notice.d.ts.map

package/dist/telemetry/notice.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notice.d.ts","sourceRoot":"","sources":["../../src/telemetry/notice.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,iBAAiB,iEAAiE,CAAC;AAEhG,eAAO,MAAM,MAAM,QAGP,CAAC;AAEb;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,IAAI,CASpF;AAED;4EAC4E;AAC5E,wBAAgB,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAqB3E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAkBjD"}

package/dist/telemetry/notice.js

@@ -0,0 +1,93 @@
+/**
+ * The one-time disclosure, and the `graft telemetry` command's output.
+ *
+ * The notice is the whole reason this design is defensible. Every telemetry
+ * backlash in the tools we looked at — the GitHub CLI's silent 2.91.0 rollout,
+ * Gatsby's on-by-default addition, the .NET SDK's opt-out that distributors now
+ * patch out — was about a tool that started sending without saying so. Homebrew
+ * does exactly what is done here and is uncontroversial: print once, in plain
+ * language, before anything leaves, and say how to turn it off in the same
+ * breath.
+ *
+ * Once per MACHINE, not per repo: a dev with twelve checkouts should read this
+ * one time. `graft init`'s picker is the other disclosure surface, for the users
+ * who see it — this catches everyone else.
+ */
+import { patchState, readState } from './identity.js';
+import { doNotTrack, explainOff, offReason } from './gate.js';
+import { peek } from './queue.js';
+import { buildBatch } from './send.js';
+import { posthogHost } from './key.js';
+import { brand, cmd, inBrand } from '../brand.js';
+export const TELEMETRY_DOC_URL = 'https://github.com/trailhq/Trail-Code/blob/main/TELEMETRY.md';
+export const NOTICE = [
+    '· graft collects anonymous usage stats (no code, no file paths, no queries).',
+    `  What exactly: ${TELEMETRY_DOC_URL}. Turn it off with \`graft telemetry disable\`.`,
+].join('\n');
+/**
+ * The notice text the first time it is due, then null forever after. Marks it as
+ * shown before returning, so two concurrent commands print it at most twice
+ * rather than every time.
+ */
+export function firstRunNotice(home, env) {
+    try {
+        if (offReason(home, env) !== null)
+            return null; // nothing to disclose if nothing can be sent
+        if (readState(home)?.noticeShownAt)
+            return null;
+        patchState({ noticeShownAt: new Date().toISOString() }, home);
+        return inBrand(NOTICE, brand(env));
+    }
+    catch {
+        return null;
+    }
+}
+/** `graft telemetry status`. `env` is a test seam, as elsewhere in this module —
+ *  a real run must be gated on the real `DO_NOT_TRACK` and CI variables. */
+export function formatStatus(home, env) {
+    const reason = offReason(home, env);
+    const pending = peek(home).length;
+    const lines = [
+        reason === null
+            ? 'telemetry: on, anonymous and aggregate-only'
+            : `telemetry: ${explainOff(reason)}`,
+        `  contract:  ${TELEMETRY_DOC_URL}`,
+    ];
+    if (doNotTrack(env))
+        lines.push('  update check: off — DO_NOT_TRACK is set');
+    if (reason === null || reason === 'disabled') {
+        lines.push(`  endpoint:  ${posthogHost()}`);
+        lines.push(`  queued:    ${pending} event${pending === 1 ? '' : 's'} waiting for the next daily flush`);
+    }
+    lines.push(reason === 'disabled'
+        ? `  enable:    ${cmd('graft telemetry enable')}`
+        : `  disable:   ${cmd('graft telemetry disable')}  (or set DO_NOT_TRACK=1)`);
+    lines.push(`  inspect:   ${cmd('graft telemetry debug')}   (prints the exact batch, sends nothing)`);
+    return lines.join('\n');
+}
+/**
+ * `graft telemetry debug` — Next.js's `NEXT_TELEMETRY_DEBUG` and Astro's
+ * `DEBUG=astro:telemetry` in command form. Prints the pending queue and the
+ * literal JSON body a flush would POST, and sends nothing. The point is that a
+ * user never has to take our word for the contract.
+ */
+export function formatDebug(home) {
+    const events = peek(home);
+    if (events.length === 0) {
+        return [
+            'telemetry: nothing queued.',
+            '  Run a graft command first: events are written locally and flushed once a day.',
+        ].join('\n');
+    }
+    // A literal placeholder, never the key itself. This output is written to be
+    // pasted into an issue; the project key is not the user's to share and is not
+    // needed to audit what graft sends.
+    const body = { api_key: '<omitted: graft\'s own ingestion key>', ...buildBatch(events) };
+    return [
+        `telemetry: ${events.length} event(s) queued. This is the exact body a flush would POST`,
+        `to ${posthogHost()}/batch/. Running this command sends nothing.`,
+        '',
+        JSON.stringify(body, null, 2),
+    ].join('\n');
+}
+//# sourceMappingURL=notice.js.map

package/dist/telemetry/notice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notice.js","sourceRoot":"","sources":["../../src/telemetry/notice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,CAAC,MAAM,iBAAiB,GAAG,8DAA8D,CAAC;AAEhG,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,8EAA8E;IAC9E,mBAAmB,iBAAiB,iDAAiD;CACtF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa,EAAE,GAAuB;IACnE,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,6CAA6C;QAC7F,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,aAAa;YAAE,OAAO,IAAI,CAAC;QAChD,UAAU,CAAC,EAAE,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9D,OAAO,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,YAAY,CAAC,IAAa,EAAE,GAAuB;IACjE,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,KAAK,GAAG;QACZ,MAAM,KAAK,IAAI;YACb,CAAC,CAAC,6CAA6C;YAC/C,CAAC,CAAC,cAAc,UAAU,CAAC,MAAM,CAAC,EAAE;QACtC,gBAAgB,iBAAiB,EAAE;KACpC,CAAC;IACF,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IAC7E,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,gBAAgB,WAAW,EAAE,EAAE,CAAC,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,gBAAgB,OAAO,SAAS,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,mCAAmC,CAAC,CAAC;IAC1G,CAAC;IACD,KAAK,CAAC,IAAI,CACR,MAAM,KAAK,UAAU;QACnB,CAAC,CAAC,gBAAgB,GAAG,CAAC,wBAAwB,CAAC,EAAE;QACjD,CAAC,CAAC,gBAAgB,GAAG,CAAC,yBAAyB,CAAC,2BAA2B,CAC9E,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,uBAAuB,CAAC,4CAA4C,CAAC,CAAC;IACrG,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAa;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,4BAA4B;YAC5B,iFAAiF;SAClF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,oCAAoC;IACpC,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,uCAAuC,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;IACzF,OAAO;QACL,cAAc,MAAM,CAAC,MAAM,6DAA6D;QACxF,MAAM,WAAW,EAAE,8CAA8C;QACjE,EAAE;QACF,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;KAC9B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/telemetry/queue.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The ceiling on the queue. An unflushable machine — permanently offline, or a
+ * key that never works — must not grow a file in someone's home forever.
+ *
+ * Bytes are the bound, because size is the only thing cheap enough to check on
+ * every append (one `statSync`); counting lines would mean reading the whole
+ * file each time. {@link TRIM_TO_EVENTS} is not a second ceiling — it is how
+ * FAR a trim cuts back, so a queue of unusually small events sheds a worthwhile
+ * amount rather than one line at a time. Between trims the file can hold more
+ * than that many events, and can exceed the byte bound by one append.
+ */
+export declare const MAX_QUEUE_BYTES: number;
+export declare const TRIM_TO_EVENTS = 500;
+export declare function queuePath(home?: string): string;
+/**
+ * Append one event. Never throws — a full disk or a read-only home must not fail
+ * the command the user actually ran.
+ */
+export declare function enqueue(event: unknown, home?: string): void;
+/**
+ * Take everything pending, leaving an empty queue behind.
+ *
+ * The rename is what makes this safe against a concurrent append: from the
+ * instant it returns, other processes are writing to a brand-new file. Malformed
+ * lines are skipped rather than poisoning the batch — a torn write from a crash
+ * mid-append should cost one event, not the whole queue.
+ */
+export declare function drain(home?: string): unknown[];
+/** Read without draining, for `graft telemetry debug`. */
+export declare function peek(home?: string): unknown[];
+/** Put a failed batch back, so a flush that could not reach the network does not
+ *  silently discard a week of events. Oldest-first, ahead of anything queued
+ *  since the drain. */
+export declare function requeue(events: unknown[], home?: string): void;
+//# sourceMappingURL=queue.d.ts.map

package/dist/telemetry/queue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"queue.d.ts","sourceRoot":"","sources":["../../src/telemetry/queue.ts"],"names":[],"mappings":"AAuBA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,QAAa,CAAC;AAC1C,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC,wBAAgB,SAAS,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE1D;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAO3D;AA6BD;;;;;;;GAOG;AACH,wBAAgB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,EAAE,CAa9C;AAED,0DAA0D;AAC1D,wBAAgB,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,EAAE,CAS7C;AAED;;uBAEuB;AACvB,wBAAgB,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAQ9D"}