@focale/sdk

Shared Focale OpenTelemetry core: DSN parse, watch(), redaction, and OTLP/HTTP JSON exporters. Runtime start() lives in a separate package so land can add only the detected runtime.

import { start } from '@focale/sdk-node';
import { watch } from '@focale/sdk';

await start(); // FOCALE_DSN

export const POST = watch('auth.signup', async (req) => { /* existing */ });

| Package | Role | |---------|------| | @focale/sdk | core (watch, parseDsn, startProviders) | | @focale/sdk-node | Node start() + HTTP framework instrumentations | | @focale/sdk-browser | browser start() stub | | @focale/sdk-deno | Deno start() stub | | @focale/sdk-edge | edge start() stub |

Publishing

Releases go out from .github/workflows/sdk.yml on main via npm trusted publishing (OIDC). There is no NPM_TOKEN.

npm trust needs npm 11.15+ (Node 22 still ships npm 10). After each name exists on the registry, register the workflow while logged in as an @focale owner with 2FA:

npx -y npm@latest trust github @focale/sdk --repo focale/root --file sdk.yml --allow-publish

Repeat for @focale/sdk-node, @focale/sdk-browser, @focale/sdk-deno, and @focale/sdk-edge. Website equivalent: package Settings / access, organization focale, repository root, workflow filename sdk.yml, allowed action npm publish, no GitHub environment.

npm trust cannot create the first version: the package must already exist. Publish 0.1.0 once interactively from each package directory (2FA, no provenance), then run npm trust. pnpm --filter … pack fails on pnpm 9; pack from the package dir instead:

cd packages/sdk
tarball="$(pnpm pack --pack-destination /tmp | tail -n1)"
npm publish "$tarball" --access public

Repeat for sdk-node, sdk-browser, sdk-deno, sdk-edge. Later versions come from CI. After that you can require 2FA and disallow tokens.