[clbotdev]

Closes #11.

@codelitdev/observability: batch and retry telemetry, keep identifier properties

Dropped events. Every capture and every log line was its own HTTP request, aborted after 2 seconds with no retry. From one test host a request took about 0.75 s on its own and over 2 s under a burst. In a SendLit run, 8 of 32 requests were dropped silently, including abuse-control events. Now:

• Captures and log lines are queued and sent in batches: PostHog /batch/ (each event keeps its own timestamp), and one OTLP request per batch of log records.
• A batch goes out every second, or as soon as 50 items are waiting.
• Each request has a 10-second timeout, with two retries (after 0.5 s and 2 s) on network errors, timeouts, 429 and 5xx. Other 4xx responses aren't retried.
• The queue holds at most 1,000 items and drops the oldest when full.
• shutdown() sends what's queued and waits for it, still bounded by the caller's timeout.

The flush timer is unref'd, so a CLI or test process isn't kept alive by pending telemetry. It still has to call shutdown() to send its last batch.

Masked ids. pickAllowlisted ran every string value through the long-token mask, so any UUID property (team_id, organization_id) arrived as [redacted-token]. ContextPolicy now has an optional identifierKeys set. Allowlisted keys on that list skip only the long-token mask; email and secret masking still apply. It's opt-in, so a key like session_id is never exposed by accident.

@codelitdev/oauth-server-kit: show the auth API's error on the sign-in page

post() in the hosted sign-in page threw "Sign-in failed. Please try again." for every non-2xx response. Product refusals, such as SendLit's disposable-email and per-IP signup limits, and Better Auth errors never reached the person. The page now shows the response's message and falls back to the generic text when there is none. showError sets textContent, so the message isn't parsed as HTML.

Testing

• observability: new transport.test.ts covers batching a burst (120 items → 50/50/20), the interval flush, retries on network errors and 5xx, giving up after retries, no retry on 400, the request timeout and the bounded queue. create.test.ts covers identifierKeys (UUID kept, email in an id key still masked, non-id token still masked) and the default client posting one /batch/ request with timestamps.
• oauth-server-kit: a new test runs the page's real inline script against a stub DOM and fetch. A 403 with a message shows that message, and a 502 HTML page shows the generic text. The test fails on the old code.
• bun run verify passes in a clean checkout: lint, preset check, typecheck, drift, all tests, build and packed-package checks.
• Live in SendLit with these builds (cloud mode, the real PostHog project):
  • Batches were sent and the startup failures were retried successfully.
  • The sign-in page showed "Disposable or temporary email addresses can't be used to sign up. Use your work or personal email."

Changesets: patch for both packages; the fixed group releases them all together.