blipit 0.2.1 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e3b3f5df2c1e54476b7900840749686a2fb0d3428f41722ccfe507431d52bbf7
-  data.tar.gz: 509a9d7e0673ea9a82600a798e6f4f71e8d5341633b46754b1e6292a2e4d94b2
+  metadata.gz: '08dd6a2a074cf2d5363dc7a1640afb6e95605dcc8cf142319d788aabaf46c877'
+  data.tar.gz: f07cb8341c0c1c9a2d6f2c3946dbcb25cbead6fded1f24b0a9e0dd7bc494ca38
 SHA512:
-  metadata.gz: 8039c976e246061ceb6144765687e628708c7b317d414fc0e5cc6aa33231f4f857fe8d0b284457ace8abdaf11c8ab9eb974216ceabcbadfc1da4b7ac4513719b
-  data.tar.gz: 554c68f653f4c30640355ffc67353e386d81a0271a62aa699780d9af6446543305a381d188c6d8f2c0ae72f3344cc5aee9557dfe79cd33c8872b919e1b7b1bdb
+  metadata.gz: 6f2a8803675ecfbf37e1eabe6949c182bd37e68ad9b9cd6650f3dae0af080c99cbeaf97d2e1a6ca8997f7d49f712e041c687fa52a7837b6bd06c3c2d8a7df10b
+  data.tar.gz: 39bcdf4469045c253649823b9db645e7161ef0c77ad82f97f8601fda97f14c9209af4e86bd4fe8bbeebd5032ee9a29da716880f3a50496cccee8f32113380d47

data/CHANGELOG.md

@@ -1,3 +1,15 @@
+## 0.3.0
+
+- Runs on Blipit's own core, blipit-nuggets, with no third-party monitoring gem and no runtime dependencies. Events go to `POST /api/v1/events` in Blipit's event format with the `X-Blipit-Key` header; spans go to `/v1/traces`.
+- The same calls keep working: `Blipit.init` (keywords and the configuration block), `capture_exception`, `capture_message`, `capture_security`, `set_user`, `set_tag`, `add_breadcrumb`, `flush`. New: `set_tags`, `set_extras`, `set_context`.
+- Rails needs no extra gem: a Railtie adds `Blipit::Rack`, so controller errors, rendered 500s, Active Job failures and `Rails.error` reports are sent, with the route as the span name. Plain Rack and Sinatra apps add `use Blipit::Rack`. Sidekiq jobs are wrapped on their own.
+- `Net::HTTP` calls and Active Record queries become breadcrumbs (SQL literals replaced by `?`); uncaught exceptions are sent from `at_exit`.
+- Stack frames carry five lines of source around each line; `cause` chains are listed under `extra.exception_chain`.
+- Sending runs on one background thread with a queue of at most 100 events, is flushed at exit, pauses on `429` for the `Retry-After` given, and retries a `5xx` twice. Forked workers (Puma, Unicorn) get their own sender.
+- Passwords, tokens, cookies, sessions, API keys and card numbers are replaced with `[Filtered]` before sending.
+- `project:` is no longer needed; it is still accepted. `Blipit.dsn` is gone.
+- `before_send` now receives the event as a Hash in Blipit's format.
+
 ## 0.2.1
 
 - Events carry the `gem:blipit` package and version, so the dashboard can show when this project runs an old Blipit SDK. A `before_send` you set still runs after it.

data/README.md

@@ -2,6 +2,8 @@
 
 Blipit error monitoring for Ruby. Know your app broke before your users tell you.
 
+Built on Blipit's own core, blipit-nuggets. No third-party monitoring gem and no runtime dependencies.
+
 ## Install
 
 ```sh
@@ -17,27 +19,40 @@ Call `Blipit.init` once at startup, before the app starts serving requests.
 ```ruby
 require "blipit"
 
-Blipit.init(key: "<public key>", project: <project id>, environment: "production", release: "myapp@1.4.2")
+Blipit.init(key: "<public key>", environment: "production", release: "myapp@1.4.2")
 ```
 
-Both values are on the project's Keys page at app.blipit.io. Unhandled exceptions are reported on their own. If the key or project id is empty (for example an unset environment variable), `init` prints a warning, returns `false` and Blipit stays off; it never raises, so a missing key cannot stop the app from booting.
+The key is on the project's Keys page at app.blipit.io. `project:` is still accepted for older setups and no longer needed. If the key is empty (for example an unset environment variable), `init` prints a warning, returns `false` and Blipit stays off; it never raises, so a missing key cannot stop the app from booting.
+
+A block works too, with the same option names:
+
+```ruby
+Blipit.init(key: ENV["BLIPIT_KEY"]) do |config|
+  config.environment = "staging"
+  config.traces_sample_rate = 0.2
+  config.before_send = ->(event, hint) { event }
+end
+```
 
 ## Rails
 
-Rails rescues controller and job errors before they reach Ruby, so Rails apps need `sentry-rails` next to `blipit`:
+Nothing else to install. Put the `Blipit.init` call in `config/initializers/blipit.rb`:
 
 ```ruby
-gem "blipit"
-gem "sentry-rails"
+Blipit.init(key: ENV["BLIPIT_KEY"], environment: Rails.env, release: ENV["GIT_SHA"])
 ```
 
-Then put the `Blipit.init` call in `config/initializers/blipit.rb`:
+`blipit` adds `Blipit::Rack` to the middleware stack, so controller errors and errors Rails renders as a 500 page are reported with the request (URL, method, user agent; never cookies, auth headers or bodies). Active Job failures, errors passed to `Rails.error` and Active Record queries (as breadcrumbs, literals replaced by `?`) come along. 404s are left out.
+
+## Rack and Sinatra
 
 ```ruby
-Blipit.init(key: ENV["BLIPIT_KEY"], project: ENV["BLIPIT_PROJECT"], environment: Rails.env, release: ENV["GIT_SHA"])
+use Blipit::Rack
 ```
 
-`blipit` loads `sentry-rails` on its own when Rails is running, and `Blipit.init` configures it, so controller errors, job errors and request context are reported. Without `sentry-rails` in the Gemfile, `Blipit.init` prints a warning saying controller errors will not be sent.
+## Sidekiq
+
+Jobs are wrapped on their own when Sidekiq is loaded before `Blipit.init`: a failing job is reported with its class and queue.
 
 ## Manual capture
 
@@ -46,6 +61,7 @@ Blipit.capture_exception(error)
 Blipit.capture_message("cache miss rate above 50%", level: :warning)
 Blipit.set_user(id: "42", email: "ana@example.com")
 Blipit.set_tag("region", "ap-southeast-1")
+Blipit.set_context("order", id: 1042, total: 99.5)
 Blipit.add_breadcrumb("cache cleared", category: "cache")
 ```
 
@@ -60,12 +76,42 @@ Both forms work. Without a kind or an actor it prints a warning and sends nothin
 
 `kind` is one of `login_failed`, `login_blocked`, `login_succeeded`, `password_reset_requested` or `privilege_granted`; any other kind arrives as a plain message. Login attempts need the project's secret key (init with it on the server) and the Scale plan; with the public key ingest refuses them with 403 `security_needs_secret_key`.
 
-## Performance
+## Options
 
-Pass `traces_sample_rate: 0.2` to `init` and requests show up on the Performance page.
+| Option | Default | |
+| --- | --- | --- |
+| `environment`, `release` | `production`, none | Shown on every issue. |
+| `sample_rate` | `1.0` | Share of error events to send. |
+| `traces_sample_rate` | `0.0` | Share of requests and jobs traced for Pulse. |
+| `before_send` | none | `->(event, hint)`: change the event (a Hash in Blipit's format) or return `nil` to drop it. |
+| `before_breadcrumb` | none | Same for breadcrumbs. |
+| `excluded_exceptions` | `[]` | Classes or class names never sent. |
+| `enabled_environments` | all | Blipit stays off in any other environment. |
+| `server_name`, `max_breadcrumbs`, `shutdown_timeout`, `debug` | | |
+| `default_integrations` | `true` | `false` keeps only what you capture yourself. |
 
-Docs: https://docs.blipit.io/ruby
+Other options from older versions are accepted and ignored.
+
+## Pulse (performance)
+
+Pass `traces_sample_rate: 0.2` to `init`. Requests (named after the route), jobs, `Net::HTTP` calls and SQL queries show up on the Pulse page, and errors link to their trace.
+
+## How sending works
+
+Events go to `POST /api/v1/events` and spans to `/v1/traces` from one background thread, with a queue of at most 100 events (the oldest is dropped first), flushed at exit. A `429` pauses sending for the `Retry-After` the server gives; a `5xx` or network error is retried twice. Keys and values that look like passwords, tokens, cookies, sessions or card numbers are replaced with `[Filtered]` before anything leaves the process.
 
 ## Updates
 
 In development Blipit prints one line when a newer version is out, with the reason and the command. Update with `bundle update blipit`. Details: https://docs.blipit.io/updates
+
+## Tests
+
+```sh
+gem install minitest webrick
+ruby -Ilib test/blipit_test.rb
+ruby -Ilib test/rails_test.rb
+```
+
+The Rails smoke test needs `railties` and `activejob` and exits quietly without them.
+
+Docs: https://docs.blipit.io/ruby

data/lib/blipit/integrations.rb

@@ -0,0 +1,267 @@
+module Blipit
+  module Integrations
+    module_function
+
+    def capture_error(error, handled: false)
+      client = Blipit.client
+      return unless client
+
+      client.capture(client.exception_event(error, handled: handled), { exception: error })
+    end
+
+    def child_span(name, attrs)
+      client = Blipit.client
+      return nil if client.nil? || Thread.current[:blipit_internal]
+
+      client.start_span(name, 3, attrs)
+    end
+
+    def finish(span, error = false, start_ns: nil)
+      client = Blipit.client
+      client.finish_span(span, error, start_ns: start_ns) if client
+    end
+
+    def breadcrumb(category, message, data, level = "info")
+      client = Blipit.client
+      return if client.nil? || Thread.current[:blipit_internal]
+
+      client.add_breadcrumb({ category: category, message: message, data: data, level: level })
+    end
+
+    def name_route(route)
+      span = Thread.current[:blipit_span]
+      return unless span && span.sampled && span.kind == 2 && route && !route.to_s.empty?
+
+      r = route.to_s.sub(/\(\.:format\)\z/, "")[0, 512]
+      span.name = "#{span.attrs['http.request.method'] || 'GET'} #{r}"
+      span.attrs["http.route"] = r
+    end
+
+    def around(kind, name, attrs, request = nil)
+      client = Blipit.client
+      return yield(nil) unless client
+
+      outer = Thread.current[:blipit_span]
+      return yield(nil) if outer && outer.kind == kind
+
+      previous_scope = client.isolate
+      client.scope.request = request if request
+      previous_span = outer
+      span = client.start_span(name, kind, attrs, root: true)
+      Thread.current[:blipit_span] = span if span
+      begin
+        yield span
+      ensure
+        Thread.current[:blipit_span] = previous_span
+        client.restore(previous_scope)
+      end
+    end
+
+    def db(name, sql, duration_ms, system)
+      breadcrumb("query", Nuggets.redact_sql(sql), { "db.system" => system })
+      client = Blipit.client
+      span = child_span("#{Nuggets.sql_op(sql)} #{system}", "db.system" => system, "db.operation.name" => Nuggets.sql_op(sql), "db.query.text" => Nuggets.redact_sql(sql))
+      return unless span && client
+
+      finish(span, false, start_ns: Process.clock_gettime(Process::CLOCK_REALTIME, :nanosecond) - (duration_ms.to_f * 1_000_000).to_i)
+    end
+
+    def job(name, system)
+      around(5, name, { "messaging.system" => system, "messaging.operation.name" => "process" }) do |span|
+        client = Blipit.client
+        client.scope.tags["job"] = name.to_s[0, 256] if client
+        begin
+          result = yield
+          finish(span)
+          result
+        rescue Exception => e
+          capture_error(e) unless e.is_a?(SystemExit) || e.is_a?(SignalException)
+          finish(span, true)
+          raise
+        end
+      end
+    end
+
+    module NetHTTP
+      def request(req, body = nil, &block)
+        client = Blipit.client
+        return super if client.nil? || !started? || Thread.current[:blipit_internal]
+
+        host = port == (use_ssl? ? 443 : 80) ? address.to_s : "#{address}:#{port}"
+        return super if host.downcase == client.own_host
+
+        url = Nuggets.clean_url("#{use_ssl? ? 'https' : 'http'}://#{host}#{req.path}")
+        span = Integrations.child_span("#{req.method} #{host}", "http.request.method" => req.method, "url.full" => url, "server.address" => address.to_s)
+        begin
+          response = super
+        rescue StandardError
+          Integrations.finish(span, true)
+          Integrations.breadcrumb("http", "#{req.method} #{url} failed", { "method" => req.method, "url" => url }, "error")
+          raise
+        end
+        status = response.code.to_i
+        span.attrs["http.response.status_code"] = status if span && span.sampled
+        Integrations.finish(span, status >= 500)
+        Integrations.breadcrumb("http", "#{req.method} #{url} [#{status}]", { "method" => req.method, "url" => url, "status_code" => status }, status >= 500 ? "error" : "info")
+        response
+      end
+    end
+
+    def install_net_http
+      return if @net_http
+
+      @net_http = true
+      Net::HTTP.prepend(NetHTTP)
+    end
+
+    def install_at_exit
+      return if @at_exit
+
+      @at_exit = true
+      at_exit do
+        error = $!
+        if error && !error.is_a?(SystemExit) && !error.is_a?(Interrupt)
+          client = Blipit.client
+          client.capture(client.exception_event(error, handled: false, level: "fatal"), { exception: error }) if client
+        end
+        Blipit.flush((Blipit.client && Blipit.client.options[:shutdown_timeout]) || 2)
+      end
+    end
+
+    def install_active_support
+      return if @active_support || !defined?(::ActiveSupport::Notifications)
+
+      @active_support = true
+      ::ActiveSupport::Notifications.subscribe("sql.active_record") do |*args|
+        payload = args.last
+        next if payload[:name] == "SCHEMA" || payload[:cached]
+
+        connection = payload[:connection]
+        system = connection.respond_to?(:adapter_name) ? connection.adapter_name.to_s.downcase : "sql"
+        duration = args[2] && args[1] ? (args[2] - args[1]) * 1000.0 : 0
+        Integrations.db("sql", payload[:sql].to_s, duration, system)
+      end
+      if defined?(::ActiveSupport.on_load)
+        ::ActiveSupport.on_load(:active_job) do
+          around_perform { |job, block| Blipit::Integrations.job(job.class.name, "active_job") { block.call } }
+        end
+      end
+    end
+
+    def install_rails_errors
+      return if @rails_errors || !defined?(::Rails) || !::Rails.respond_to?(:error) || !::Rails.error.respond_to?(:subscribe)
+
+      @rails_errors = true
+      ::Rails.error.subscribe(ErrorSubscriber.new)
+    end
+
+    class ErrorSubscriber
+      def report(error, handled:, severity: :error, context: {}, source: nil)
+        client = Blipit.client
+        return if client.nil? || source.to_s == "application.action_dispatch"
+
+        level = { error: "error", warning: "warning", info: "info" }[severity] || "error"
+        event = client.exception_event(error, handled: handled, level: level)
+        return unless event
+
+        extra = context.is_a?(Hash) ? context.reject { |k, _| k.to_s == "controller" || k.to_s == "request" } : {}
+        event["extra"] = (event["extra"] || {}).merge("rails" => extra.transform_keys(&:to_s)) unless extra.empty?
+        event["tags"] = { "rails.source" => source.to_s } if source
+        client.capture(event, { exception: error })
+      rescue StandardError
+        nil
+      end
+    end
+
+    class SidekiqMiddleware
+      def call(_worker, job, queue)
+        name = (job["wrapped"] || job["class"]).to_s
+        Integrations.job(name, "sidekiq") do
+          client = Blipit.client
+          client.scope.tags["sidekiq.queue"] = queue.to_s[0, 256] if client
+          yield
+        end
+      end
+    end
+
+    def install_sidekiq
+      return if @sidekiq || !defined?(::Sidekiq) || !::Sidekiq.respond_to?(:configure_server)
+
+      @sidekiq = true
+      ::Sidekiq.configure_server do |config|
+        config.server_middleware { |chain| chain.add(SidekiqMiddleware) }
+      end
+    end
+
+    def install(options)
+      return if options[:default_integrations] == false
+
+      install_at_exit
+      install_net_http
+      install_active_support
+      install_rails_errors
+      install_sidekiq
+    end
+  end
+
+  class Rack
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      return @app.call(env) unless Blipit.client
+
+      scheme = env["HTTP_X_FORWARDED_PROTO"] || env["rack.url_scheme"] || "http"
+      host = env["HTTP_HOST"] || env["SERVER_NAME"].to_s
+      path = "#{env['SCRIPT_NAME']}#{env['PATH_INFO']}"
+      method = env["REQUEST_METHOD"] || "GET"
+      header = ->(name) { env["HTTP_#{name.upcase.tr('-', '_')}"] || (name == "content-type" ? env["CONTENT_TYPE"] : nil) }
+      request = Nuggets.request_info(method, "#{scheme}://#{host}#{path}", env["QUERY_STRING"], header)
+      clean_path = (path.empty? ? "/" : path)[0, 512]
+      Integrations.around(2, "#{method} #{clean_path}", { "http.request.method" => method, "url.path" => clean_path }, request) do |span|
+        status = 500
+        begin
+          status, headers, body = @app.call(env)
+          error = env["action_dispatch.exception"] || env["rack.exception"] || env["sinatra.error"]
+          Integrations.capture_error(error) if error && status.to_i >= 500
+          [status, headers, body]
+        rescue Exception => e
+          Integrations.capture_error(e) unless e.is_a?(SystemExit) || e.is_a?(SignalException)
+          raise
+        ensure
+          Integrations.name_route(rails_route(env) || (env["sinatra.route"] && env["sinatra.route"].to_s.split(" ", 2).last))
+          if span && span.sampled
+            span.attrs["http.response.status_code"] = status.to_i
+            Integrations.finish(span, status.to_i >= 500)
+          end
+        end
+      end
+    end
+  end
+
+  class Rack
+    private
+
+    def rails_route(env)
+      return env["action_dispatch.route_uri_pattern"] if env["action_dispatch.route_uri_pattern"]
+
+      route = env["action_dispatch.route"]
+      route.respond_to?(:path) && route.path.respond_to?(:spec) ? route.path.spec.to_s : nil
+    rescue StandardError
+      nil
+    end
+  end
+
+  if defined?(::Rails::Railtie)
+    class Railtie < ::Rails::Railtie
+      initializer "blipit.rack" do |app|
+        app.config.middleware.insert(0, Blipit::Rack)
+      end
+
+      config.after_initialize do
+        Blipit::Integrations.install_rails_errors if Blipit.client
+      end
+    end
+  end
+end

data/lib/blipit/nuggets.rb

@@ -0,0 +1,600 @@
+require "json"
+require "net/http"
+require "rbconfig"
+require "securerandom"
+require "socket"
+require "time"
+require "uri"
+require_relative "version"
+
+module Blipit
+  module Nuggets
+    SDK_NAME = "blipit-ruby"
+    FILTERED = "[Filtered]"
+    LEVELS = { "fatal" => "fatal", "critical" => "fatal", "error" => "error", "warning" => "warning", "warn" => "warning", "info" => "info", "log" => "info", "debug" => "debug" }.freeze
+    CATEGORIES = %w[ui.click ui.input navigation http console query custom].freeze
+    SECURITY_KINDS = %w[login_failed login_succeeded login_blocked password_reset_requested privilege_granted].freeze
+    WARNING_KINDS = %w[login_failed login_blocked privilege_granted].freeze
+    SECURITY_FIELDS = { actor_id: 128, ip: 45, user_agent: 512, database: 64, outcome: 64, target: 256 }.freeze
+    HEADER_ALLOW = %w[user-agent referer content-type accept-language].freeze
+    MAX_EVENTS = 100
+    MAX_SPANS = 10_000
+    SPAN_BATCH = 1000
+    SPAN_FLUSH = 5.0
+    SENSITIVE_KEY = /pass(?:word|wd)?|pwd|secret|token|api[_-]?key|auth(?:orization)?|cookie|session|credit|card|cvv|ssn|csrf|private[_-]?key/i.freeze
+    SENSITIVE_PAIR = /(?<![\w.-])([\w.-]+)((?:\s*=\s*|["']\s*:\s*)["']?)(?!\[Filtered\])([^&\s"',;}]+)/.freeze
+    BEARER = %r{\b(Bearer|Basic|Token)\s+[\w.~+/=-]{8,}}.freeze
+    CARD_LIKE = /\b\d(?:[ -]?\d){12,18}\b/.freeze
+    KEEP = %w[event_id trace_id span_id parent_span_id].freeze
+    TAG_KEY = /\A[a-zA-Z0-9_.-]{1,64}\z/.freeze
+    LIB_DIRS = [RbConfig::CONFIG["rubylibdir"], RbConfig::CONFIG["rubyarchdir"]].compact.freeze
+
+    module_function
+
+    def luhn(digits)
+      sum = 0
+      digits.reverse.each_char.with_index do |ch, i|
+        d = ch.ord - 48
+        if i.odd?
+          d *= 2
+          d -= 9 if d > 9
+        end
+        sum += d
+      end
+      (sum % 10).zero?
+    end
+
+    def scrub_text(text)
+      out = text.gsub(BEARER) { "#{Regexp.last_match(1)} #{FILTERED}" }
+      if out.match?(SENSITIVE_KEY)
+        out = out.gsub(SENSITIVE_PAIR) do
+          m = Regexp.last_match
+          m[1].match?(SENSITIVE_KEY) ? "#{m[1]}#{m[2]}#{FILTERED}" : m[0]
+        end
+      end
+      out.gsub(CARD_LIKE) do |match|
+        digits = match.delete(" -")
+        digits.length.between?(13, 19) && luhn(digits) ? FILTERED : match
+      end
+    end
+
+    def scrub(value)
+      case value
+      when String then scrub_text(value)
+      when Array then value.map { |v| scrub(v) }
+      when Hash
+        value.each_with_object({}) do |(k, v), out|
+          name = k.to_s
+          out[k] = if KEEP.include?(name)
+                     v
+                   elsif name.match?(SENSITIVE_KEY) && !v.nil? && v != ""
+                     FILTERED
+                   else
+                     scrub(v)
+                   end
+        end
+      else value
+      end
+    end
+
+    def text(value, size)
+      return nil if value.nil?
+
+      out = value.to_s.dup.force_encoding(Encoding::UTF_8).scrub
+      out.empty? ? nil : out[0, size]
+    end
+
+    def redact_sql(sql)
+      sql.to_s.gsub(/'(?:[^']|'')*'/, "?").gsub(/(?<![\w$.])-?\d+(?:\.\d+)?(?![\w.])/, "?").gsub(/\(\s*\?(?:\s*,\s*\?)+\s*\)/, "(?)").gsub(/\s+/, " ").strip[0, 2000]
+    end
+
+    def sql_op(sql)
+      m = /\A\s*(\w+)/.match(sql.to_s)
+      m ? m[1].upcase : "QUERY"
+    end
+
+    def clean_url(raw)
+      uri = URI.parse(raw.to_s)
+      uri.user = nil
+      uri.password = nil
+      uri.query = nil
+      uri.fragment = nil
+      uri.to_s[0, 2048]
+    rescue StandardError
+      raw.to_s.split("?", 2).first.to_s[0, 2048]
+    end
+
+    def scrub_query(query)
+      query.to_s.split("&").map do |pair|
+        name = pair.split("=", 2).first.to_s
+        pair.include?("=") && name.match?(SENSITIVE_KEY) ? "#{name}=#{FILTERED}" : pair
+      end.join("&")[0, 2048]
+    end
+
+    def now_iso
+      Time.now.utc.iso8601(3)
+    end
+
+    def request_info(method, url, query, header)
+      out = { "url" => clean_url(url), "method" => (method || "GET").to_s[0, 16] }
+      out["query_string"] = scrub_query(query) if query && !query.empty?
+      headers = {}
+      HEADER_ALLOW.each do |name|
+        value = header.call(name)
+        headers[name] = value.to_s[0, 1024] if value && !value.to_s.empty?
+      end
+      out["headers"] = headers unless headers.empty?
+      out
+    end
+
+    def retry_after(header, body)
+      if header && !header.to_s.empty?
+        return [Integer(header.to_s, 10), 1].max.to_f if header.to_s.match?(/\A\d+\z/)
+
+        begin
+          return [Time.httpdate(header.to_s) - Time.now, 1].max.to_f
+        rescue ArgumentError
+          nil
+        end
+      end
+      wait = body.is_a?(Hash) ? body["retry_after"] : nil
+      wait.is_a?(Numeric) ? [wait.to_f, 1.0].max : 60.0
+    end
+
+    def security_event(kind, actor, fields)
+      kind = kind.to_s
+      level = WARNING_KINDS.include?(kind) ? "warning" : "info"
+      message = "#{kind} for #{actor}"
+      return { "message" => message, "level" => level, "tags" => { "security.kind" => kind } } unless SECURITY_KINDS.include?(kind)
+
+      security = { "kind" => kind, "actor" => actor.to_s.strip[0, 256] }
+      SECURITY_FIELDS.each do |field, size|
+        value = fields[field]
+        security[field.to_s] = value.to_s.strip[0, size] unless value.nil? || value.to_s.empty?
+      end
+      { "message" => message, "level" => level, "security" => security, "tags" => { "security.kind" => kind } }
+    end
+
+    class Scope
+      attr_accessor :user, :tags, :extra, :breadcrumbs, :request, :fingerprint
+
+      def initialize(parent = nil, max = 100)
+        @max = parent ? parent.max : max
+        @user = parent && parent.user ? parent.user.dup : nil
+        @tags = parent ? parent.tags.dup : {}
+        @extra = parent ? parent.extra.dup : {}
+        @breadcrumbs = parent ? parent.breadcrumbs.dup : []
+        @fingerprint = parent && parent.fingerprint ? parent.fingerprint.dup : nil
+        @request = nil
+      end
+
+      attr_reader :max
+
+      def add(crumb)
+        @breadcrumbs << crumb
+        @breadcrumbs.shift while @breadcrumbs.size > @max
+      end
+    end
+
+    Span = Struct.new(:trace_id, :span_id, :parent_id, :name, :kind, :start, :finish, :error, :attrs, :sampled)
+
+    class Client
+      attr_reader :options, :key, :own_host, :environment
+      attr_accessor :limited_until, :noticed
+
+      def initialize(key, endpoint, options)
+        @key = key
+        @base = endpoint.to_s.chomp("/")
+        uri = URI.parse(@base)
+        @own_host = (uri.port == uri.default_port ? uri.host.to_s : "#{uri.host}:#{uri.port}").downcase
+        @options = options
+        @environment = (options[:environment] || "production").to_s
+        @debug = options[:debug] ? true : false
+        @sample_rate = (options[:sample_rate] || 1.0).to_f
+        @traces_rate = [[options[:traces_sample_rate].to_f, 0.0].max, 1.0].min
+        @global = Scope.new(nil, [(options[:max_breadcrumbs] || 100).to_i, 100].min)
+        @limited_until = 0.0
+        @noticed = false
+        @sources = {}
+        reset_worker
+      end
+
+      def reset_worker
+        @mutex = Mutex.new
+        @cond = ConditionVariable.new
+        @queue = []
+        @busy = 0
+        @thread = nil
+        @spans = []
+        @spans_since = 0.0
+        @pid = Process.pid
+      end
+
+      def traces_rate
+        @traces_rate
+      end
+
+      def development?
+        @debug || @environment == "development"
+      end
+
+      def scope
+        Thread.current[:blipit_scope] || @global
+      end
+
+      def isolate
+        previous = Thread.current[:blipit_scope]
+        Thread.current[:blipit_scope] = Scope.new(scope)
+        previous
+      end
+
+      def restore(previous)
+        Thread.current[:blipit_scope] = previous
+      end
+
+      def add_breadcrumb(crumb, hint = {})
+        category = (crumb[:category] || crumb["category"] || "custom").to_s
+        mapped = if CATEGORIES.include?(category)
+                   category
+                 else
+                   category == "db" || category.start_with?("sql") ? "query" : "custom"
+                 end
+        out = { "timestamp" => now, "category" => mapped }
+        message = crumb[:message] || crumb["message"]
+        out["message"] = Nuggets.text(message, 1024) if message
+        level = LEVELS[(crumb[:level] || crumb["level"] || "info").to_s.downcase] || "info"
+        out["level"] = level == "fatal" ? "error" : level
+        data = (crumb[:data] || crumb["data"] || {}).to_h.dup
+        data["category"] ||= category[0, 64] if category != mapped
+        out["data"] = data unless data.empty?
+        before = @options[:before_breadcrumb]
+        if before
+          out = safely { before.call(out, hint) }
+          return if out.nil? || out == false
+        end
+        scope.add(out)
+      end
+
+      def exception_event(error, handled: true, level: "error")
+        return nil if seen?(error)
+
+        Array(@options[:excluded_exceptions]).each do |item|
+          return nil if (item.is_a?(Module) && error.is_a?(item)) || item.to_s == error.class.name
+        end
+        exc = { "type" => Nuggets.text(error.class.name, 256) || "Exception", "value" => Nuggets.text(error.message, 4096) || "", "handled" => handled }
+        frames = frames_of(error)
+        exc["stacktrace"] = { "frames" => frames } unless frames.empty?
+        event = { "exception" => exc, "level" => level }
+        chain = []
+        cause = error.cause
+        while cause && chain.size < 8
+          chain << { "type" => cause.class.name.to_s, "value" => cause.message.to_s[0, 1024] }
+          cause = cause.cause
+        end
+        event["extra"] = { "exception_chain" => chain } unless chain.empty?
+        event
+      end
+
+      def seen?(error)
+        return true if error.instance_variable_defined?(:@__blipit_seen)
+
+        error.instance_variable_set(:@__blipit_seen, true)
+        false
+      rescue StandardError
+        false
+      end
+
+      def frames_of(error)
+        locations = error.backtrace_locations
+        frames = if locations
+                   locations.map { |loc| frame(loc.absolute_path || loc.path, loc.lineno, loc.label) }
+                 else
+                   Array(error.backtrace).map do |line|
+                     m = /\A(.+?):(\d+)(?::in [`'](.*)')?\z/.match(line)
+                     m ? frame(m[1], m[2].to_i, m[3]) : nil
+                   end.compact
+                 end
+        frames.reverse.last(128)
+      end
+
+      def frame(path, lineno, label)
+        path = path.to_s
+        out = { "filename" => short(path)[0, 1024], "lineno" => [lineno.to_i, 0].max, "in_app" => in_app?(path) }
+        out["function"] = label.to_s[0, 512] if label
+        lines = source(path)
+        if lines && lineno.to_i.positive? && lineno.to_i <= lines.size
+          i = lineno.to_i - 1
+          out["context_line"] = lines[i].chomp[0, 512]
+          out["pre_context"] = lines[[i - 5, 0].max...i].map { |l| l.chomp[0, 512] }
+          out["post_context"] = (lines[(i + 1)..(i + 5)] || []).map { |l| l.chomp[0, 512] }
+        end
+        out
+      end
+
+      def source(path)
+        return nil if @options[:include_source_context] == false || path.start_with?("<")
+        return @sources[path] if @sources.key?(path)
+
+        @sources.shift if @sources.size >= 50
+        @sources[path] = File.file?(path) && File.size(path) < 1_000_000 ? File.readlines(path).map { |l| l.force_encoding(Encoding::UTF_8).scrub } : nil
+      rescue StandardError
+        @sources[path] = nil
+      end
+
+      def in_app?(path)
+        return false if path.empty? || path.start_with?("<") || path.include?("/gems/")
+
+        LIB_DIRS.none? { |dir| path.start_with?(dir) }
+      end
+
+      def short(path)
+        return path.split("/gems/", 2).last if path.include?("/gems/")
+
+        cwd = Dir.pwd
+        path.start_with?("#{cwd}/") ? path[(cwd.size + 1)..-1] : path
+      end
+
+      def capture(partial, hint = {})
+        return nil if partial.nil?
+        return nil if partial["security"].nil? && @sample_rate < 1.0 && rand >= @sample_rate
+        return nil if monotonic < @limited_until
+
+        current = scope
+        event = {
+          "event_id" => SecureRandom.hex(16),
+          "timestamp" => now,
+          "platform" => "ruby",
+          "level" => "error",
+          "environment" => @environment[0, 64],
+          "contexts" => {
+            "runtime" => { "name" => RUBY_ENGINE, "version" => RUBY_VERSION },
+            "os" => { "name" => RbConfig::CONFIG["host_os"].to_s, "version" => "" }
+          },
+          "sdk" => { "name" => SDK_NAME, "version" => Blipit::VERSION }
+        }
+        event["release"] = Nuggets.text(@options[:release], 256) if @options[:release]
+        tags = {}
+        tags["server"] = @options[:server_name].to_s if @options[:server_name]
+        tags.merge!(current.tags)
+        tags.merge!(partial.delete("tags") || {})
+        span = Thread.current[:blipit_span]
+        tags["trace_id"] = span.trace_id if span && span.sampled
+        clean = {}
+        tags.each do |k, v|
+          clean[k.to_s] = v.to_s[0, 256] if k.to_s.match?(TAG_KEY) && !v.nil? && clean.size < 32
+        end
+        event["tags"] = clean unless clean.empty?
+        extra = current.extra.merge(partial.delete("extra") || {})
+        event["extra"] = extra unless extra.empty?
+        user = partial.delete("user") || current.user
+        if user
+          u = {}
+          %w[id email username].each do |field|
+            value = user[field.to_sym] || user[field]
+            u[field] = value.to_s[0, field == "email" ? 256 : 128] unless value.nil? || value.to_s.empty?
+          end
+          event["user"] = u unless u.empty?
+        end
+        event["breadcrumbs"] = current.breadcrumbs.last(100) unless current.breadcrumbs.empty?
+        event["request"] = current.request.dup if current.request
+        fingerprint = partial.delete("fingerprint") || current.fingerprint
+        event["fingerprint"] = Array(fingerprint).first(8).map { |f| f.to_s[0, 256] } if fingerprint
+        event.merge!(partial)
+        event["message"] = Nuggets.text(event["message"], 8192) if event.key?("message")
+        event = Nuggets.scrub(event.reject { |_, v| v.nil? })
+        before = @options[:before_send]
+        if before
+          event = safely(event) { before.call(event, hint) }
+          return nil unless event
+        end
+        submit(:event, event)
+        event["event_id"]
+      end
+
+      def submit(kind, item)
+        reset_worker if Process.pid != @pid
+        @mutex.synchronize do
+          if kind == :event && @queue.count { |k, _| k == :event } >= MAX_EVENTS
+            index = @queue.index { |k, _| k == :event }
+            @queue.delete_at(index) if index
+          end
+          @queue << [kind, item]
+          wake
+        end
+      end
+
+      def wake
+        @thread = Thread.new { run } if @thread.nil? || !@thread.alive?
+        @cond.broadcast
+      end
+
+      def run
+        Thread.current[:blipit_internal] = true
+        Thread.current.name = "blipit-worker" if Thread.current.respond_to?(:name=)
+        loop do
+          kind = nil
+          item = nil
+          @mutex.synchronize do
+            while @queue.empty?
+              if !@spans.empty? && monotonic - @spans_since >= SPAN_FLUSH
+                move_spans
+                next
+              end
+              @cond.wait(@mutex, @spans.empty? ? 30 : 1)
+              return if @queue.empty? && @spans.empty?
+            end
+            kind, item = @queue.shift
+            @busy += 1
+          end
+          begin
+            kind == :event ? deliver("/api/v1/events", item, true) : deliver("/v1/traces", otlp(item), false)
+          rescue StandardError => e
+            debug("[blipit] send failed: #{e.class}: #{e.message}")
+          ensure
+            @mutex.synchronize do
+              @busy -= 1
+              @cond.broadcast
+            end
+          end
+        end
+      end
+
+      def deliver(path, body, event)
+        3.times do |attempt|
+          return if monotonic < @limited_until
+
+          status, headers, payload = post(path, body)
+          if status == 429
+            @limited_until = monotonic + Nuggets.retry_after(headers["retry-after"], payload)
+            debug("[blipit] rate limited, pausing sends")
+            return
+          end
+          if status.positive? && status < 500
+            debug("[blipit] #{path} rejected #{status} #{payload}") if status >= 400
+            notice(payload["latest"]) if event && status == 202 && development? && payload.is_a?(Hash)
+            return
+          end
+          sleep(0.5 * (2**attempt))
+        end
+      end
+
+      def post(path, body)
+        uri = URI.parse(@base + path)
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.use_ssl = uri.scheme == "https"
+        http.open_timeout = 5
+        http.read_timeout = (@options[:http_timeout] || 5).to_f
+        request = Net::HTTP::Post.new(uri.request_uri, "Content-Type" => "application/json", "X-Blipit-Key" => @key, "User-Agent" => "#{SDK_NAME}/#{Blipit::VERSION}")
+        request.body = JSON.generate(body)
+        response = http.start { |h| h.request(request) }
+        parsed = begin
+          JSON.parse(response.body.to_s)
+        rescue JSON::ParserError
+          nil
+        end
+        [response.code.to_i, { "retry-after" => response["retry-after"] }, parsed]
+      rescue StandardError => e
+        debug("[blipit] #{path} not sent: #{e.class}: #{e.message}")
+        [0, {}, nil]
+      end
+
+      def notice(latest)
+        return if @noticed
+
+        line = Blipit.notice_line(latest)
+        return unless line
+
+        @noticed = true
+        warn(line)
+      end
+
+      def flush(timeout = 2)
+        deadline = monotonic + timeout.to_f
+        @mutex.synchronize do
+          move_spans
+          while (!@queue.empty? || @busy.positive?) && monotonic < deadline
+            wake
+            @cond.wait(@mutex, [deadline - monotonic, 0.01].max)
+          end
+        end
+      end
+
+      def move_spans
+        @queue << [:spans, @spans.shift(SPAN_BATCH)] until @spans.empty?
+      end
+
+      def start_span(name, kind, attrs, root: false)
+        return nil if @traces_rate <= 0
+
+        parent = root ? nil : Thread.current[:blipit_span]
+        return nil if parent.nil? && !root
+
+        sampled = parent ? parent.sampled : rand < @traces_rate
+        return Span.new("", "", nil, name, kind, 0, 0, false, {}, false) unless sampled
+
+        Span.new(parent ? parent.trace_id : SecureRandom.hex(16), SecureRandom.hex(8), parent ? parent.span_id : nil, name, kind, now_ns, 0, false, attrs, true)
+      end
+
+      def finish_span(span, error = false, start_ns: nil)
+        return if span.nil? || !span.sampled
+
+        span.finish = now_ns
+        span.start = start_ns if start_ns
+        span.error ||= error
+        reset_worker if Process.pid != @pid
+        @mutex.synchronize do
+          @spans_since = monotonic if @spans.empty?
+          @spans << span if @spans.size < MAX_SPANS
+          move_spans if @spans.size >= SPAN_BATCH
+          wake
+        end
+      end
+
+      def resource
+        host = Socket.gethostname
+        pairs = [
+          ["service.name", @options[:server_name] || ENV["OTEL_SERVICE_NAME"] || "ruby"],
+          ["host.name", host],
+          ["service.instance.id", "#{host}:#{Process.pid}"],
+          ["deployment.environment", @environment],
+          ["service.version", @options[:release]],
+          ["process.runtime.version", RUBY_VERSION],
+          ["telemetry.sdk.name", SDK_NAME]
+        ]
+        pairs.reject { |_, v| v.nil? || v.to_s.empty? }.map { |k, v| { "key" => k, "value" => { "stringValue" => v.to_s } } }
+      end
+
+      def otlp(spans)
+        attr = lambda do |k, v|
+          value = case v
+                  when true, false then { "boolValue" => v }
+                  when Integer then { "intValue" => v }
+                  when Float then { "doubleValue" => v }
+                  else { "stringValue" => v.to_s }
+                  end
+          { "key" => k, "value" => value }
+        end
+        rows = spans.map do |s|
+          row = {
+            "traceId" => s.trace_id,
+            "spanId" => s.span_id,
+            "name" => s.name.to_s[0, 512],
+            "kind" => s.kind,
+            "startTimeUnixNano" => s.start.to_s,
+            "endTimeUnixNano" => s.finish.to_s,
+            "attributes" => Nuggets.scrub(s.attrs).map { |k, v| attr.call(k, v) } + [attr.call("blipit.sample_rate", @traces_rate)],
+            "status" => { "code" => s.error ? 2 : 1 }
+          }
+          row["parentSpanId"] = s.parent_id if s.parent_id
+          row
+        end
+        { "resourceSpans" => [{ "resource" => { "attributes" => resource }, "scopeSpans" => [{ "scope" => { "name" => SDK_NAME }, "spans" => rows }] }] }
+      end
+
+      def debug(line)
+        warn(line) if @debug
+      end
+
+      private
+
+      def safely(fallback = nil)
+        yield
+      rescue StandardError => e
+        warn("[blipit] a callback raised #{e.class}: #{e.message}")
+        fallback
+      end
+
+      def now
+        Nuggets.now_iso
+      end
+
+      def now_ns
+        Process.clock_gettime(Process::CLOCK_REALTIME, :nanosecond)
+      end
+
+      def monotonic
+        Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      end
+    end
+  end
+end

data/lib/blipit/version.rb

@@ -1,3 +1,3 @@
 module Blipit
-  VERSION = "0.2.1"
+  VERSION = "0.3.0"
 end

data/lib/blipit.rb

@@ -1,15 +1,8 @@
-require "sentry-ruby"
 require "json"
 require "uri"
 require_relative "blipit/version"
-
-if defined?(::Rails::Railtie)
-  begin
-    require "sentry-rails"
-  rescue LoadError
-    nil
-  end
-end
+require_relative "blipit/nuggets"
+require_relative "blipit/integrations"
 
 module Blipit
   DEFAULT_ENDPOINT = "https://in.blipit.io"
@@ -20,158 +13,156 @@ module Blipit
   MISSING_KEY_WARNING = "[blipit] Blipit.init got no key, so Blipit is off and nothing is sent. " \
                         "Pass the project's key (app.blipit.io, Keys), for example from ENV[\"BLIPIT_KEY\"]; " \
                         "with Rails config caching, check that the value is set where the app boots."
-  MISSING_PROJECT_WARNING = "[blipit] Blipit.init got no project id, so Blipit is off and nothing is sent. " \
-                            "Pass project: with the id from the project's Keys page at app.blipit.io."
-  RAILS_WARNING = "[blipit] Rails is loaded but sentry-rails is not, so errors raised in controllers and jobs are not reported " \
-                  "(Rails rescues them before they reach Ruby). Add gem \"sentry-rails\" to your Gemfile next to gem \"blipit\" " \
-                  "and run bundle install."
   MISSING_ACTOR_WARNING = "[blipit] capture_security needs a kind and an actor, so this login attempt was not sent."
   UPDATE_COMMAND = "bundle update blipit"
-  PACKAGE = { "name" => "gem:blipit", "version" => VERSION }.freeze
-
-  if Sentry::HTTPTransport.method_defined?(:do_request)
-    class NoticeTransport < Sentry::HTTPTransport
-      def do_request(*args)
-        response = super
-        Blipit.notice(response)
-        response
+
+  class Sink
+    def method_missing(_name, *_args)
+      self
+    end
+
+    def respond_to_missing?(_name, _include_private = false)
+      true
+    end
+  end
+
+  class Config
+    def initialize(options)
+      @options = options
+    end
+
+    attr_reader :options
+
+    def method_missing(name, *args)
+      key = name.to_s
+      if key.end_with?("=")
+        @options[key.chomp("=").to_sym] = args.first
+      elsif @options.key?(name)
+        @options[name]
+      else
+        Sink.new
       end
     end
+
+    def respond_to_missing?(_name, _include_private = false)
+      true
+    end
   end
 
   class << self
-    def dsn(key, project, endpoint = DEFAULT_ENDPOINT)
-      scheme = endpoint.start_with?("http://") ? "http" : "https"
-      host = endpoint.sub(%r{\A[a-z]+://}i, "").chomp("/")
-      "#{scheme}://#{key}@#{host}/#{project}"
-    end
+    attr_reader :client
 
-    def init(key:, project:, environment: nil, release: nil, traces_sample_rate: 0.0, endpoint: DEFAULT_ENDPOINT, **options)
+    def init(key:, project: nil, environment: nil, release: nil, traces_sample_rate: 0.0, endpoint: DEFAULT_ENDPOINT, **options)
       if key.nil? || key.to_s.strip.empty?
         warn(MISSING_KEY_WARNING)
         return false
       end
-      if project.nil? || project.to_s.strip.empty?
-        warn(MISSING_PROJECT_WARNING)
+      options = options.merge(environment: environment, release: release, traces_sample_rate: traces_sample_rate)
+      config = Config.new(options)
+      yield config if block_given?
+      options = config.options
+      enabled = options[:enabled_environments]
+      if enabled.is_a?(Array) && !enabled.empty? && !enabled.map(&:to_s).include?((options[:environment] || "production").to_s)
+        @client = nil
         return false
       end
-      @public_key = key.to_s.start_with?("blipit_pk_")
-      warn(RAILS_WARNING) if defined?(::Rails::Railtie) && !defined?(::Sentry::Rails)
-
-      Sentry.init do |config|
-        config.dsn = dsn(key, project, endpoint)
-        config.environment = environment if environment
-        config.release = release if release
-        config.traces_sample_rate = traces_sample_rate
-        config.send_default_pii = false
-        options.each { |name, value| config.public_send("#{name}=", value) }
-        yield config if block_given?
-        user_before_send = config.before_send
-        config.before_send = lambda do |event, hint|
-          with_identity(event)
-          user_before_send ? user_before_send.call(event, hint) : event
-        end
-        if (config.environment == "development" || config.debug) && config.transport.transport_class.nil? && defined?(NoticeTransport)
-          config.transport.transport_class = NoticeTransport
-        end
-      end
+      @client&.flush(0.5)
+      key = key.to_s.strip
+      @public_key = key.start_with?("blipit_pk_")
+      @public_key_warned = false
+      @client = Nuggets::Client.new(key, endpoint, options)
+      Integrations.install(options)
       true
     end
 
-    def update_notice(header, current = VERSION)
-      latest = JSON.parse(URI.decode_www_form_component(header.to_s.gsub("+", "%2B")))
-      version = latest.is_a?(Hash) ? latest["version"] : nil
+    def notice_line(latest, current = VERSION)
+      return nil unless latest.is_a?(Hash)
+
+      version = latest["version"]
       return nil unless version.is_a?(String) && !version.empty? && version != current
 
       note = latest["note"].is_a?(String) ? latest["note"].strip : ""
       why = note.empty? ? "" : " — #{note}"
       "[blipit] #{version} is available (you have #{current})#{why} — #{UPDATE_COMMAND}"
-    rescue StandardError
-      nil
     end
 
-    def notice(response)
-      return if @noticed
-
-      header = response["x-blipit-latest"]
-      line = header && update_notice(header)
-      return unless line
-
-      @noticed = true
-      warn(line)
+    def update_notice(header, current = VERSION)
+      notice_line(JSON.parse(URI.decode_www_form_component(header.to_s.gsub("+", "%2B"))), current)
     rescue StandardError
       nil
     end
 
-    def with_identity(event)
-      sdk = event.sdk.is_a?(Hash) ? event.sdk : {}
-      packages = Array(sdk["packages"] || sdk[:packages])
-      return if packages.any? { |p| p.is_a?(Hash) && (p["name"] || p[:name]) == PACKAGE["name"] }
+    def capture_exception(error, **options)
+      return nil unless @client
 
-      event.sdk = sdk.merge("packages" => packages + [PACKAGE.dup])
-    rescue StandardError
-      nil
-    end
+      event = @client.exception_event(error, handled: true, level: (options[:level] || "error").to_s)
+      return nil unless event
 
-    def capture_exception(error, **options)
-      Sentry.capture_exception(error, **options)
+      @client.capture(event.merge(extras(options)), { exception: error })
     end
 
     def capture_message(message, level: :info, **options)
-      Sentry.capture_message(message, level: level, **options)
+      return nil unless @client
+
+      event = { "message" => message.to_s, "level" => Nuggets::LEVELS[level.to_s.downcase] || "info" }
+      @client.capture(event.merge(extras(options)))
     end
 
     def set_user(user)
-      Sentry.set_user(user)
+      @client.scope.user = user ? user.to_h : nil if @client
     end
 
     def set_tag(key, value)
-      Sentry.set_tags(key => value)
+      @client.scope.tags[key.to_s[0, 64]] = value.to_s[0, 256] if @client
+    end
+
+    def set_tags(tags)
+      tags.each { |k, v| set_tag(k, v) }
+    end
+
+    def set_extras(extras)
+      @client.scope.extra.merge!(extras.transform_keys(&:to_s)) if @client
+    end
+
+    def set_context(name, value)
+      return unless @client
+
+      value.nil? ? @client.scope.extra.delete(name.to_s) : @client.scope.extra[name.to_s] = value
     end
 
     def add_breadcrumb(message, category: nil, level: :info, data: {})
-      Sentry.add_breadcrumb(Sentry::Breadcrumb.new(message: message, category: category, level: level, data: data))
+      @client&.add_breadcrumb({ message: message, category: category || "custom", level: level, data: data })
     end
 
-    def capture_security(kind_arg = nil, actor_arg = nil, kind: nil, actor: nil, outcome: nil, actor_id: nil, ip: nil, user_agent: nil, target: nil)
+    def capture_security(kind_arg = nil, actor_arg = nil, kind: nil, actor: nil, outcome: nil, actor_id: nil, ip: nil, user_agent: nil, target: nil, database: nil)
       kind ||= kind_arg
       actor ||= actor_arg
       if kind.to_s.empty? || actor.to_s.strip.empty?
         warn(MISSING_ACTOR_WARNING)
         return
       end
+      return nil unless @client
+
       if @public_key
         warn(PUBLIC_KEY_WARNING) unless @public_key_warned
         @public_key_warned = true
         return
       end
-      payload = {
-        kind: kind,
-        actor: actor,
-        outcome: outcome,
-        actor_id: actor_id,
-        ip: ip,
-        user_agent: user_agent,
-        target: target
-      }.compact
-      level = WARNING_KINDS.include?(kind.to_s) ? :warning : :info
-      Sentry.with_scope do |scope|
-        scope.set_context("security", payload)
-        scope.set_tag("security.kind", kind)
-        Sentry.capture_message("#{kind} for #{actor}", level: level)
-      end
+      fields = { outcome: outcome, actor_id: actor_id, ip: ip, user_agent: user_agent, target: target, database: database }
+      @client.capture(Nuggets.security_event(kind, actor, fields))
     end
 
     def flush(timeout = 2)
-      client = Sentry.get_current_client
-      return unless client
+      @client&.flush(timeout)
+    end
 
-      executor = Sentry.background_worker&.instance_variable_get(:@executor)
-      if executor.respond_to?(:scheduled_task_count)
-        deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout
-        sleep 0.01 while executor.scheduled_task_count > executor.completed_task_count && Process.clock_gettime(Process::CLOCK_MONOTONIC) < deadline
-      end
-      client.flush
+    private
+
+    def extras(options)
+      out = {}
+      %i[tags extra user fingerprint].each { |k| out[k.to_s] = options[k] if options[k] }
+      out["extra"] = (out["extra"] || {}).merge(options[:contexts].transform_keys(&:to_s)) if options[:contexts].is_a?(Hash)
+      out
     end
   end
 end

metadata

@@ -1,55 +1,27 @@
 --- !ruby/object:Gem::Specification
 name: blipit
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0
 platform: ruby
 authors:
 - Louward Labs
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-12 00:00:00.000000000 Z
+date: 2026-10-22 00:00:00.000000000 Z
 dependencies:
-- !ruby/object:Gem::Dependency
-  name: logger
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: sentry-ruby
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '5.0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '5.0'
 - !ruby/object:Gem::Dependency
   name: minitest
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '5.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '5.0'
 - !ruby/object:Gem::Dependency
@@ -76,6 +48,8 @@ files:
 - CHANGELOG.md
 - README.md
 - lib/blipit.rb
+- lib/blipit/integrations.rb
+- lib/blipit/nuggets.rb
 - lib/blipit/version.rb
 homepage: https://blipit.io
 licenses: