@alwaysmeticulous/backend-recorder-workerd 2.343.0 → 2.346.0

package/dist/sidecar-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"sidecar-client.js","names":[],"sources":["../src/sidecar-client.ts"],"sourcesContent":["import { warnOnce } from \"./log\";\nimport { getOriginalFetch } from \"./original-fetch\";\nimport {\n  type CaptureEvent,\n  type CaptureEventsPayload,\n  type CoverageReportRequest,\n  type OutboundFetchLookupRequest,\n  type OutboundFetchLookupResponse,\n  type ReplaySessionInfoResponse,\n  SIDECAR_EVENTS_PATH,\n  SIDECAR_PROTOCOL_VERSION,\n  SIDECAR_PROTOCOL_VERSION_HEADER,\n  SIDECAR_REPLAY_COVERAGE_PATH,\n  SIDECAR_REPLAY_OUTBOUND_FETCH_PATH,\n  SIDECAR_REPLAY_SESSION_PATH,\n} from \"./protocol\";\nimport { sidecarFetch, type SidecarTransport } from \"./sidecar-transport\";\n\ntype FetchFn = typeof globalThis.fetch;\n\n/**\n * Replay calls sit in the request path, unlike record mode's fire-and-forget reporting, so\n * they must be bounded: without a timeout a wedged sidecar would hang every outbound fetch\n * the app makes, and therefore the whole replay, with nothing to look at.\n */\nconst SESSION_INFO_TIMEOUT_MS = 10_000;\nconst LOOKUP_TIMEOUT_MS = 5_000;\n\n/**\n * Capture reporting is off the response path (it runs under `ctx.waitUntil`), so a timeout here\n * is not about latency the app can see — it is about not holding the request context open on a\n * sidecar that will never answer. A refused connection rejects immediately, but a sidecar URL\n * pointing at a host that drops packets rather than refusing them (a firewalled container or LAN\n * address instead of loopback) would otherwise leave the POST pending until the runtime tears the\n * context down, on every captured call.\n *\n * Generous relative to what it bounds: a local sidecar answers a small batch in single-digit\n * milliseconds, so this only ever fires on one that is wedged or unreachable — never on one that\n * is merely busy. Being generous costs nothing because {@link withTimeout} clears the timer the\n * moment the POST settles.\n */\nconst CAPTURE_POST_TIMEOUT_MS = 2_000;\n\n/**\n * The same bound for a service-binding transport, where the sidecar is a Worker that hands the\n * batch to a Durable Object before answering. That object may live in another region and is\n * single-threaded, so a busy one can legitimately take far longer than a loopback process — and\n * failing the report early would drop spans a slightly longer wait would have recorded.\n * `waitUntil` allows 30s past the response, so this stays well inside its budget.\n */\nconst CAPTURE_POST_BINDING_TIMEOUT_MS = 10_000;\n\n/**\n * Coverage reports are larger than capture events — the first one of an isolate\n * carries the whole id→line map — so they get more headroom than\n * {@link CAPTURE_POST_TIMEOUT_MS}. Still bounded, and for the same reason: an\n * unreachable sidecar must not hold the request context open.\n */\nconst COVERAGE_POST_TIMEOUT_MS = 5_000;\n\n/** POSTs capture events to the sidecar. Never rejects — reporting failures only warn (once). */\nexport const postCaptureEvents = async (\n  transport: SidecarTransport,\n  events: CaptureEvent[],\n): Promise<void> => {\n  const timeoutMs =\n    transport.kind === \"binding\"\n      ? CAPTURE_POST_BINDING_TIMEOUT_MS\n      : CAPTURE_POST_TIMEOUT_MS;\n  try {\n    const payload: CaptureEventsPayload = { events };\n    await withTimeout(timeoutMs, async (signal) => {\n      const response = await sidecarFetch(\n        transport,\n        getOriginalFetch(),\n        SIDECAR_EVENTS_PATH,\n        {\n          method: \"POST\",\n          headers: {\n            \"content-type\": \"application/json\",\n            [SIDECAR_PROTOCOL_VERSION_HEADER]: SIDECAR_PROTOCOL_VERSION,\n          },\n          body: JSON.stringify(payload),\n          signal,\n        },\n      );\n      if (!response.ok) {\n        warnOnce(\n          \"sidecar-rejected\",\n          `Meticulous sidecar rejected capture events (HTTP ${response.status}).`,\n        );\n      }\n      await response.arrayBuffer().catch(() => undefined);\n    });\n  } catch (error) {\n    warnOnce(\n      \"sidecar-unreachable\",\n      \"Could not reach the Meticulous backend recorder sidecar — backend session events are not being recorded.\",\n      error,\n    );\n  }\n};\n\n/**\n * Outcome of the session handshake.\n *\n * `unavailable` and `unreachable` both mean \"do not replay\", but they are kept apart\n * because only the first is a settled answer. The caller caches per isolate, and caching a\n * one-off network blip would disable mocking for the rest of the session — silently sending\n * every later outbound call to the real service.\n */\nexport type ReplaySessionInfoResult =\n  /** The sidecar holds mocks for this session. */\n  | { outcome: \"found\"; clockAnchorMs: number | undefined }\n  /** The sidecar answered and will never serve this session: no mocks, or no such route. */\n  | { outcome: \"unavailable\" }\n  /** Could not get an answer — timeout, transport error, 5xx. May succeed later. */\n  | { outcome: \"unreachable\" };\n\n/**\n * Asks whether the sidecar holds mocks for a session, and at what instant to freeze the\n * clock while serving it.\n *\n * A 404 is how a record-only sidecar answers, so it counts as a settled `unavailable`\n * rather than a retryable blip.\n */\nexport const getReplaySessionInfo = async (\n  fetchFn: FetchFn,\n  sidecarUrl: string,\n  frontendSessionId: string,\n): Promise<ReplaySessionInfoResult> => {\n  const url = `${sidecarUrl}${SIDECAR_REPLAY_SESSION_PATH}?sessionId=${encodeURIComponent(\n    frontendSessionId,\n  )}`;\n  try {\n    return await withTimeout(SESSION_INFO_TIMEOUT_MS, async (signal) => {\n      const response = await fetchFn(url, {\n        headers: {\n          [SIDECAR_PROTOCOL_VERSION_HEADER]: SIDECAR_PROTOCOL_VERSION,\n        },\n        signal,\n      });\n      if (!response.ok) {\n        await response.arrayBuffer().catch(() => undefined);\n        // 4xx is the sidecar telling us something definitive — no such route (a record-only\n        // sidecar), or a protocol version it will not speak. Retrying cannot change either.\n        // 5xx may well be a sidecar still finding its feet, so leave it retryable.\n        if (response.status >= 500) {\n          warnOnce(\n            \"replay-session-unreachable\",\n            `Meticulous replay sidecar failed the replay session handshake (HTTP ${response.status}) — will retry on the next request.`,\n          );\n          return { outcome: \"unreachable\" };\n        }\n        warnOnce(\n          \"replay-session-unavailable\",\n          `Meticulous replay sidecar did not recognise the replay session route (HTTP ${response.status}) — outbound calls will not be mocked.`,\n        );\n        return { outcome: \"unavailable\" };\n      }\n      const info = (await response.json()) as ReplaySessionInfoResponse;\n      if (info.found !== true) {\n        warnOnce(\n          \"replay-session-unknown\",\n          \"Meticulous replay sidecar holds no mocks for this session — outbound calls will not be mocked.\",\n        );\n        return { outcome: \"unavailable\" };\n      }\n      return {\n        outcome: \"found\",\n        clockAnchorMs:\n          typeof info.clockAnchorMs === \"number\"\n            ? info.clockAnchorMs\n            : undefined,\n      };\n    });\n  } catch (error) {\n    warnOnce(\n      \"replay-session-unreachable\",\n      \"Could not reach the Meticulous replay sidecar — will retry on the next request.\",\n      error,\n    );\n    return { outcome: \"unreachable\" };\n  }\n};\n\n/**\n * Looks up a recorded response for one outbound call. Never rejects; returns undefined when\n * the sidecar could not be consulted, which the caller fails the request on — an unanswered\n * lookup is not evidence that a real call is safe.\n */\nexport const postOutboundFetchLookup = async (\n  fetchFn: FetchFn,\n  sidecarUrl: string,\n  payload: OutboundFetchLookupRequest,\n): Promise<OutboundFetchLookupResponse | undefined> => {\n  try {\n    return await withTimeout(LOOKUP_TIMEOUT_MS, async (signal) => {\n      const response = await fetchFn(\n        `${sidecarUrl}${SIDECAR_REPLAY_OUTBOUND_FETCH_PATH}`,\n        {\n          method: \"POST\",\n          headers: {\n            \"content-type\": \"application/json\",\n            [SIDECAR_PROTOCOL_VERSION_HEADER]: SIDECAR_PROTOCOL_VERSION,\n          },\n          body: JSON.stringify(payload),\n          signal,\n        },\n      );\n      if (!response.ok) {\n        warnOnce(\n          \"replay-lookup-rejected\",\n          `Meticulous replay sidecar rejected a mock lookup (HTTP ${response.status}).`,\n        );\n        await response.arrayBuffer().catch(() => undefined);\n        return undefined;\n      }\n      return (await response.json()) as OutboundFetchLookupResponse;\n    });\n  } catch (error) {\n    warnOnce(\n      \"replay-lookup-unreachable\",\n      \"Could not reach the Meticulous replay sidecar for a mock lookup — the call will fail.\",\n      error,\n    );\n    return undefined;\n  }\n};\n\n/**\n * Outcome of a coverage report.\n *\n * `unsupported` and `failed` both mean the report did not land, but only the\n * first is settled: the caller latches `unsupported` and stops collecting, while\n * `failed` leaves the id→line map queued for the next report. Conflating them\n * would either disable coverage on one blip or lose a map permanently.\n */\nexport type CoverageReportOutcome = \"accepted\" | \"unsupported\" | \"failed\";\n\n/**\n * Reports one request's line coverage. Runs under `ctx.waitUntil`, so it is off\n * the response path like record-mode capture reporting.\n *\n * Returns `unsupported` when the sidecar will never accept coverage (404 — an\n * older sidecar, or one started without coverage enabled), which the caller\n * latches so it stops paying to serialise hits for the rest of the isolate's\n * life.\n */\nexport const postCoverageReport = async (\n  fetchFn: FetchFn,\n  sidecarUrl: string,\n  payload: CoverageReportRequest,\n): Promise<CoverageReportOutcome> => {\n  try {\n    return await withTimeout(COVERAGE_POST_TIMEOUT_MS, async (signal) => {\n      const response = await fetchFn(\n        `${sidecarUrl}${SIDECAR_REPLAY_COVERAGE_PATH}`,\n        {\n          method: \"POST\",\n          headers: {\n            \"content-type\": \"application/json\",\n            [SIDECAR_PROTOCOL_VERSION_HEADER]: SIDECAR_PROTOCOL_VERSION,\n          },\n          body: JSON.stringify(payload),\n          signal,\n        },\n      );\n      await response.arrayBuffer().catch(() => undefined);\n      if (response.status === 404) {\n        return \"unsupported\";\n      }\n      if (!response.ok) {\n        warnOnce(\n          \"coverage-rejected\",\n          `Meticulous replay sidecar rejected a coverage report (HTTP ${response.status}).`,\n        );\n        return \"failed\";\n      }\n      return \"accepted\";\n    });\n  } catch (error) {\n    warnOnce(\n      \"coverage-unreachable\",\n      \"Could not report line coverage to the Meticulous replay sidecar.\",\n      error,\n    );\n    return \"failed\";\n  }\n};\n\n/**\n * Runs `send` under an abort signal that fires after `ms`, clearing the timer as soon as the\n * call settles — including the response body read, which an abort must still cut short.\n *\n * Deliberately not `AbortSignal.timeout`: its timer cannot be cancelled, and a pending timer\n * keeps workerd's request context alive. Bounding a 5ms POST at 2s would then pin the context\n * for the remaining ~2s on every captured call — worse than the unbounded wait it exists to\n * prevent, and on the healthy path rather than the broken one. `body-capture.ts` uses this\n * same clearable shape, for the same reason.\n */\nconst withTimeout = async <T>(\n  ms: number,\n  send: (signal: AbortSignal) => Promise<T>,\n): Promise<T> => {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), ms);\n  try {\n    return await send(controller.signal);\n  } finally {\n    clearTimeout(timer);\n  }\n};\n"],"mappings":";;;;;;;;;;AAyBA,MAAM,0BAA0B;AAChC,MAAM,oBAAoB;;;;;;;;;;;;;;AAe1B,MAAM,0BAA0B;;;;;;;;AAShC,MAAM,kCAAkC;;;;;;;AAQxC,MAAM,2BAA2B;;AAGjC,MAAa,oBAAoB,OAC/B,WACA,WACkB;CAClB,MAAM,YACJ,UAAU,SAAS,YACf,kCACA;AACN,KAAI;EACF,MAAM,UAAgC,EAAE,QAAQ;AAChD,QAAM,YAAY,WAAW,OAAO,WAAW;GAC7C,MAAM,WAAW,MAAM,aACrB,WACA,kBAAkB,EAClB,qBACA;IACE,QAAQ;IACR,SAAS;KACP,gBAAgB;MACf,kCAAA;KACF;IACD,MAAM,KAAK,UAAU,QAAQ;IAC7B;IACD,CACF;AACD,OAAI,CAAC,SAAS,GACZ,UACE,oBACA,oDAAoD,SAAS,OAAO,IACrE;AAEH,SAAM,SAAS,aAAa,CAAC,YAAY,KAAA,EAAU;IACnD;UACK,OAAO;AACd,WACE,uBACA,4GACA,MACD;;;;;;;;;;AA2BL,MAAa,uBAAuB,OAClC,SACA,YACA,sBACqC;CACrC,MAAM,MAAM,GAAG,aAAa,4BAA4B,aAAa,mBACnE,kBACD;AACD,KAAI;AACF,SAAO,MAAM,YAAY,yBAAyB,OAAO,WAAW;GAClE,MAAM,WAAW,MAAM,QAAQ,KAAK;IAClC,SAAS,GACN,kCAAA,KACF;IACD;IACD,CAAC;AACF,OAAI,CAAC,SAAS,IAAI;AAChB,UAAM,SAAS,aAAa,CAAC,YAAY,KAAA,EAAU;AAInD,QAAI,SAAS,UAAU,KAAK;AAC1B,cACE,8BACA,uEAAuE,SAAS,OAAO,qCACxF;AACD,YAAO,EAAE,SAAS,eAAe;;AAEnC,aACE,8BACA,8EAA8E,SAAS,OAAO,wCAC/F;AACD,WAAO,EAAE,SAAS,eAAe;;GAEnC,MAAM,OAAQ,MAAM,SAAS,MAAM;AACnC,OAAI,KAAK,UAAU,MAAM;AACvB,aACE,0BACA,iGACD;AACD,WAAO,EAAE,SAAS,eAAe;;AAEnC,UAAO;IACL,SAAS;IACT,eACE,OAAO,KAAK,kBAAkB,WAC1B,KAAK,gBACL,KAAA;IACP;IACD;UACK,OAAO;AACd,WACE,8BACA,mFACA,MACD;AACD,SAAO,EAAE,SAAS,eAAe;;;;;;;;AASrC,MAAa,0BAA0B,OACrC,SACA,YACA,YACqD;AACrD,KAAI;AACF,SAAO,MAAM,YAAY,mBAAmB,OAAO,WAAW;GAC5D,MAAM,WAAW,MAAM,QACrB,GAAG,aAAa,sCAChB;IACE,QAAQ;IACR,SAAS;KACP,gBAAgB;MACf,kCAAA;KACF;IACD,MAAM,KAAK,UAAU,QAAQ;IAC7B;IACD,CACF;AACD,OAAI,CAAC,SAAS,IAAI;AAChB,aACE,0BACA,0DAA0D,SAAS,OAAO,IAC3E;AACD,UAAM,SAAS,aAAa,CAAC,YAAY,KAAA,EAAU;AACnD;;AAEF,UAAQ,MAAM,SAAS,MAAM;IAC7B;UACK,OAAO;AACd,WACE,6BACA,yFACA,MACD;AACD;;;;;;;;;;;;AAuBJ,MAAa,qBAAqB,OAChC,SACA,YACA,YACmC;AACnC,KAAI;AACF,SAAO,MAAM,YAAY,0BAA0B,OAAO,WAAW;GACnE,MAAM,WAAW,MAAM,QACrB,GAAG,aAAa,gCAChB;IACE,QAAQ;IACR,SAAS;KACP,gBAAgB;MACf,kCAAA;KACF;IACD,MAAM,KAAK,UAAU,QAAQ;IAC7B;IACD,CACF;AACD,SAAM,SAAS,aAAa,CAAC,YAAY,KAAA,EAAU;AACnD,OAAI,SAAS,WAAW,IACtB,QAAO;AAET,OAAI,CAAC,SAAS,IAAI;AAChB,aACE,qBACA,8DAA8D,SAAS,OAAO,IAC/E;AACD,WAAO;;AAET,UAAO;IACP;UACK,OAAO;AACd,WACE,wBACA,oEACA,MACD;AACD,SAAO;;;;;;;;;;;;;AAcX,MAAM,cAAc,OAClB,IACA,SACe;CACf,MAAM,aAAa,IAAI,iBAAiB;CACxC,MAAM,QAAQ,iBAAiB,WAAW,OAAO,EAAE,GAAG;AACtD,KAAI;AACF,SAAO,MAAM,KAAK,WAAW,OAAO;WAC5B;AACR,eAAa,MAAM"}
+{"version":3,"file":"sidecar-client.js","names":[],"sources":["../src/sidecar-client.ts"],"sourcesContent":["import { warnOnce } from \"./log\";\nimport { getOriginalFetch } from \"./original-fetch\";\nimport {\n  type CaptureEvent,\n  type CaptureEventsPayload,\n  type CoverageReportRequest,\n  type OutboundFetchAgentSwarmTestingRequest,\n  type OutboundFetchAgentSwarmTestingResponse,\n  type OutboundFetchLookupRequest,\n  type OutboundFetchLookupResponse,\n  type ReplaySessionInfoResponse,\n  SIDECAR_EVENTS_PATH,\n  SIDECAR_AGENT_SWARM_TESTING_OUTBOUND_FETCH_PATH,\n  SIDECAR_PROTOCOL_VERSION,\n  SIDECAR_PROTOCOL_VERSION_HEADER,\n  SIDECAR_REPLAY_COVERAGE_PATH,\n  SIDECAR_REPLAY_OUTBOUND_FETCH_PATH,\n  SIDECAR_REPLAY_SESSION_PATH,\n} from \"./protocol\";\nimport { sidecarFetch, type SidecarTransport } from \"./sidecar-transport\";\n\ntype FetchFn = typeof globalThis.fetch;\n\n/**\n * Replay calls sit in the request path, unlike record mode's fire-and-forget reporting, so\n * they must be bounded: without a timeout a wedged sidecar would hang every outbound fetch\n * the app makes, and therefore the whole replay, with nothing to look at.\n */\nconst SESSION_INFO_TIMEOUT_MS = 10_000;\nconst LOOKUP_TIMEOUT_MS = 5_000;\n\nconst AGENT_SWARM_TESTING_TIMEOUT_MS = 5_000;\n\n/**\n * Capture reporting is off the response path (it runs under `ctx.waitUntil`), so a timeout here\n * is not about latency the app can see — it is about not holding the request context open on a\n * sidecar that will never answer. A refused connection rejects immediately, but a sidecar URL\n * pointing at a host that drops packets rather than refusing them (a firewalled container or LAN\n * address instead of loopback) would otherwise leave the POST pending until the runtime tears the\n * context down, on every captured call.\n *\n * Generous relative to what it bounds: a local sidecar answers a small batch in single-digit\n * milliseconds, so this only ever fires on one that is wedged or unreachable — never on one that\n * is merely busy. Being generous costs nothing because {@link withTimeout} clears the timer the\n * moment the POST settles.\n */\nconst CAPTURE_POST_TIMEOUT_MS = 2_000;\n\n/**\n * The same bound for a service-binding transport, where the sidecar is a Worker that hands the\n * batch to a Durable Object before answering. That object may live in another region and is\n * single-threaded, so a busy one can legitimately take far longer than a loopback process — and\n * failing the report early would drop spans a slightly longer wait would have recorded.\n * `waitUntil` allows 30s past the response, so this stays well inside its budget.\n */\nconst CAPTURE_POST_BINDING_TIMEOUT_MS = 10_000;\n\n/**\n * Coverage reports are larger than capture events — the first one of an isolate\n * carries the whole id→line map — so they get more headroom than\n * {@link CAPTURE_POST_TIMEOUT_MS}. Still bounded, and for the same reason: an\n * unreachable sidecar must not hold the request context open.\n */\nconst COVERAGE_POST_TIMEOUT_MS = 5_000;\n\n/** POSTs capture events to the sidecar. Never rejects — reporting failures only warn (once). */\nexport const postCaptureEvents = async (\n  transport: SidecarTransport,\n  events: CaptureEvent[],\n): Promise<void> => {\n  const timeoutMs =\n    transport.kind === \"binding\"\n      ? CAPTURE_POST_BINDING_TIMEOUT_MS\n      : CAPTURE_POST_TIMEOUT_MS;\n  try {\n    const payload: CaptureEventsPayload = { events };\n    await withTimeout(timeoutMs, async (signal) => {\n      const response = await sidecarFetch(\n        transport,\n        getOriginalFetch(),\n        SIDECAR_EVENTS_PATH,\n        {\n          method: \"POST\",\n          headers: {\n            \"content-type\": \"application/json\",\n            [SIDECAR_PROTOCOL_VERSION_HEADER]: SIDECAR_PROTOCOL_VERSION,\n          },\n          body: JSON.stringify(payload),\n          signal,\n        },\n      );\n      if (!response.ok) {\n        warnOnce(\n          \"sidecar-rejected\",\n          `Meticulous sidecar rejected capture events (HTTP ${response.status}).`,\n        );\n      }\n      await response.arrayBuffer().catch(() => undefined);\n    });\n  } catch (error) {\n    warnOnce(\n      \"sidecar-unreachable\",\n      \"Could not reach the Meticulous backend recorder sidecar — backend session events are not being recorded.\",\n      error,\n    );\n  }\n};\n\n/**\n * Outcome of the session handshake.\n *\n * `unavailable` and `unreachable` both mean \"do not replay\", but they are kept apart\n * because only the first is a settled answer. The caller caches per isolate, and caching a\n * one-off network blip would disable mocking for the rest of the session — silently sending\n * every later outbound call to the real service.\n */\nexport type ReplaySessionInfoResult =\n  /** The sidecar holds mocks for this session. */\n  | { outcome: \"found\"; clockAnchorMs: number | undefined }\n  /** The sidecar answered and will never serve this session: no mocks, or no such route. */\n  | { outcome: \"unavailable\" }\n  /** Could not get an answer — timeout, transport error, 5xx. May succeed later. */\n  | { outcome: \"unreachable\" };\n\n/**\n * Asks whether the sidecar holds mocks for a session, and at what instant to freeze the\n * clock while serving it.\n *\n * A 404 is how a record-only sidecar answers, so it counts as a settled `unavailable`\n * rather than a retryable blip.\n */\nexport const getReplaySessionInfo = async (\n  fetchFn: FetchFn,\n  sidecarUrl: string,\n  frontendSessionId: string,\n): Promise<ReplaySessionInfoResult> => {\n  const url = `${sidecarUrl}${SIDECAR_REPLAY_SESSION_PATH}?sessionId=${encodeURIComponent(\n    frontendSessionId,\n  )}`;\n  try {\n    return await withTimeout(SESSION_INFO_TIMEOUT_MS, async (signal) => {\n      const response = await fetchFn(url, {\n        headers: {\n          [SIDECAR_PROTOCOL_VERSION_HEADER]: SIDECAR_PROTOCOL_VERSION,\n        },\n        signal,\n      });\n      if (!response.ok) {\n        await response.arrayBuffer().catch(() => undefined);\n        // 4xx is the sidecar telling us something definitive — no such route (a record-only\n        // sidecar), or a protocol version it will not speak. Retrying cannot change either.\n        // 5xx may well be a sidecar still finding its feet, so leave it retryable.\n        if (response.status >= 500) {\n          warnOnce(\n            \"replay-session-unreachable\",\n            `Meticulous replay sidecar failed the replay session handshake (HTTP ${response.status}) — will retry on the next request.`,\n          );\n          return { outcome: \"unreachable\" };\n        }\n        warnOnce(\n          \"replay-session-unavailable\",\n          `Meticulous replay sidecar did not recognise the replay session route (HTTP ${response.status}) — outbound calls will not be mocked.`,\n        );\n        return { outcome: \"unavailable\" };\n      }\n      const info = (await response.json()) as ReplaySessionInfoResponse;\n      if (info.found !== true) {\n        warnOnce(\n          \"replay-session-unknown\",\n          \"Meticulous replay sidecar holds no mocks for this session — outbound calls will not be mocked.\",\n        );\n        return { outcome: \"unavailable\" };\n      }\n      return {\n        outcome: \"found\",\n        clockAnchorMs:\n          typeof info.clockAnchorMs === \"number\"\n            ? info.clockAnchorMs\n            : undefined,\n      };\n    });\n  } catch (error) {\n    warnOnce(\n      \"replay-session-unreachable\",\n      \"Could not reach the Meticulous replay sidecar — will retry on the next request.\",\n      error,\n    );\n    return { outcome: \"unreachable\" };\n  }\n};\n\n/**\n * Looks up a recorded response for one outbound call. Never rejects; returns undefined when\n * the sidecar could not be consulted, which the caller fails the request on — an unanswered\n * lookup is not evidence that a real call is safe.\n */\nexport const postOutboundFetchLookup = async (\n  fetchFn: FetchFn,\n  sidecarUrl: string,\n  payload: OutboundFetchLookupRequest,\n): Promise<OutboundFetchLookupResponse | undefined> => {\n  try {\n    return await withTimeout(LOOKUP_TIMEOUT_MS, async (signal) => {\n      const response = await fetchFn(\n        `${sidecarUrl}${SIDECAR_REPLAY_OUTBOUND_FETCH_PATH}`,\n        {\n          method: \"POST\",\n          headers: {\n            \"content-type\": \"application/json\",\n            [SIDECAR_PROTOCOL_VERSION_HEADER]: SIDECAR_PROTOCOL_VERSION,\n          },\n          body: JSON.stringify(payload),\n          signal,\n        },\n      );\n      if (!response.ok) {\n        warnOnce(\n          \"replay-lookup-rejected\",\n          `Meticulous replay sidecar rejected a mock lookup (HTTP ${response.status}).`,\n        );\n        await response.arrayBuffer().catch(() => undefined);\n        return undefined;\n      }\n      return (await response.json()) as OutboundFetchLookupResponse;\n    });\n  } catch (error) {\n    warnOnce(\n      \"replay-lookup-unreachable\",\n      \"Could not reach the Meticulous replay sidecar for a mock lookup — the call will fail.\",\n      error,\n    );\n    return undefined;\n  }\n};\n\n/**\n * Outcome of a coverage report.\n *\n * `unsupported` and `failed` both mean the report did not land, but only the\n * first is settled: the caller latches `unsupported` and stops collecting, while\n * `failed` leaves the id→line map queued for the next report. Conflating them\n * would either disable coverage on one blip or lose a map permanently.\n */\nexport type CoverageReportOutcome = \"accepted\" | \"unsupported\" | \"failed\";\n\n/**\n * Reports one request's line coverage. Runs under `ctx.waitUntil`, so it is off\n * the response path like record-mode capture reporting.\n *\n * Returns `unsupported` when the sidecar will never accept coverage (404 — an\n * older sidecar, or one started without coverage enabled), which the caller\n * latches so it stops paying to serialise hits for the rest of the isolate's\n * life.\n */\nexport const postCoverageReport = async (\n  fetchFn: FetchFn,\n  sidecarUrl: string,\n  payload: CoverageReportRequest,\n): Promise<CoverageReportOutcome> => {\n  try {\n    return await withTimeout(COVERAGE_POST_TIMEOUT_MS, async (signal) => {\n      const response = await fetchFn(\n        `${sidecarUrl}${SIDECAR_REPLAY_COVERAGE_PATH}`,\n        {\n          method: \"POST\",\n          headers: {\n            \"content-type\": \"application/json\",\n            [SIDECAR_PROTOCOL_VERSION_HEADER]: SIDECAR_PROTOCOL_VERSION,\n          },\n          body: JSON.stringify(payload),\n          signal,\n        },\n      );\n      await response.arrayBuffer().catch(() => undefined);\n      if (response.status === 404) {\n        return \"unsupported\";\n      }\n      if (!response.ok) {\n        warnOnce(\n          \"coverage-rejected\",\n          `Meticulous replay sidecar rejected a coverage report (HTTP ${response.status}).`,\n        );\n        return \"failed\";\n      }\n      return \"accepted\";\n    });\n  } catch (error) {\n    warnOnce(\n      \"coverage-unreachable\",\n      \"Could not report line coverage to the Meticulous replay sidecar.\",\n      error,\n    );\n    return \"failed\";\n  }\n};\n\n/**\n * Offers one outbound call to the interceptor service. Never rejects; returns undefined when\n * the interceptor could not be consulted, which the caller turns into a passthrough — never\n * a failed call.\n */\nexport const postAgentSwarmTestingOutboundFetch = async (\n  fetchFn: FetchFn,\n  sidecarUrl: string,\n  payload: OutboundFetchAgentSwarmTestingRequest,\n): Promise<OutboundFetchAgentSwarmTestingResponse | undefined> => {\n  try {\n    return await withTimeout(AGENT_SWARM_TESTING_TIMEOUT_MS, async (signal) => {\n      const response = await fetchFn(\n        `${sidecarUrl}${SIDECAR_AGENT_SWARM_TESTING_OUTBOUND_FETCH_PATH}`,\n        {\n          method: \"POST\",\n          headers: {\n            \"content-type\": \"application/json\",\n            [SIDECAR_PROTOCOL_VERSION_HEADER]: SIDECAR_PROTOCOL_VERSION,\n          },\n          body: JSON.stringify(payload),\n          signal,\n        },\n      );\n      if (!response.ok) {\n        warnOnce(\n          \"intercept-lookup-rejected\",\n          `Meticulous interceptor rejected an outbound fetch intercept (HTTP ${response.status}) - the call will pass through.`,\n        );\n        await response.arrayBuffer().catch(() => undefined);\n        return undefined;\n      }\n      return (await response.json()) as OutboundFetchAgentSwarmTestingResponse;\n    });\n  } catch (error) {\n    warnOnce(\n      \"agent-swarm-testing-lookup-unreachable\",\n      \"Could not reach the Meticulous interceptor for an outbound fetch - the call will pass through.\",\n      error,\n    );\n    return undefined;\n  }\n};\n\n/**\n * Runs `send` under an abort signal that fires after `ms`, clearing the timer as soon as the\n * call settles — including the response body read, which an abort must still cut short.\n *\n * Deliberately not `AbortSignal.timeout`: its timer cannot be cancelled, and a pending timer\n * keeps workerd's request context alive. Bounding a 5ms POST at 2s would then pin the context\n * for the remaining ~2s on every captured call — worse than the unbounded wait it exists to\n * prevent, and on the healthy path rather than the broken one. `body-capture.ts` uses this\n * same clearable shape, for the same reason.\n */\nconst withTimeout = async <T>(\n  ms: number,\n  send: (signal: AbortSignal) => Promise<T>,\n): Promise<T> => {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), ms);\n  try {\n    return await send(controller.signal);\n  } finally {\n    clearTimeout(timer);\n  }\n};\n"],"mappings":";;;;;;;;;;AA4BA,MAAM,0BAA0B;AAChC,MAAM,oBAAoB;AAE1B,MAAM,iCAAiC;;;;;;;;;;;;;;AAevC,MAAM,0BAA0B;;;;;;;;AAShC,MAAM,kCAAkC;;;;;;;AAQxC,MAAM,2BAA2B;;AAGjC,MAAa,oBAAoB,OAC/B,WACA,WACkB;CAClB,MAAM,YACJ,UAAU,SAAS,YACf,kCACA;AACN,KAAI;EACF,MAAM,UAAgC,EAAE,QAAQ;AAChD,QAAM,YAAY,WAAW,OAAO,WAAW;GAC7C,MAAM,WAAW,MAAM,aACrB,WACA,kBAAkB,EAClB,qBACA;IACE,QAAQ;IACR,SAAS;KACP,gBAAgB;MACf,kCAAA;KACF;IACD,MAAM,KAAK,UAAU,QAAQ;IAC7B;IACD,CACF;AACD,OAAI,CAAC,SAAS,GACZ,UACE,oBACA,oDAAoD,SAAS,OAAO,IACrE;AAEH,SAAM,SAAS,aAAa,CAAC,YAAY,KAAA,EAAU;IACnD;UACK,OAAO;AACd,WACE,uBACA,4GACA,MACD;;;;;;;;;;AA2BL,MAAa,uBAAuB,OAClC,SACA,YACA,sBACqC;CACrC,MAAM,MAAM,GAAG,aAAa,4BAA4B,aAAa,mBACnE,kBACD;AACD,KAAI;AACF,SAAO,MAAM,YAAY,yBAAyB,OAAO,WAAW;GAClE,MAAM,WAAW,MAAM,QAAQ,KAAK;IAClC,SAAS,GACN,kCAAA,KACF;IACD;IACD,CAAC;AACF,OAAI,CAAC,SAAS,IAAI;AAChB,UAAM,SAAS,aAAa,CAAC,YAAY,KAAA,EAAU;AAInD,QAAI,SAAS,UAAU,KAAK;AAC1B,cACE,8BACA,uEAAuE,SAAS,OAAO,qCACxF;AACD,YAAO,EAAE,SAAS,eAAe;;AAEnC,aACE,8BACA,8EAA8E,SAAS,OAAO,wCAC/F;AACD,WAAO,EAAE,SAAS,eAAe;;GAEnC,MAAM,OAAQ,MAAM,SAAS,MAAM;AACnC,OAAI,KAAK,UAAU,MAAM;AACvB,aACE,0BACA,iGACD;AACD,WAAO,EAAE,SAAS,eAAe;;AAEnC,UAAO;IACL,SAAS;IACT,eACE,OAAO,KAAK,kBAAkB,WAC1B,KAAK,gBACL,KAAA;IACP;IACD;UACK,OAAO;AACd,WACE,8BACA,mFACA,MACD;AACD,SAAO,EAAE,SAAS,eAAe;;;;;;;;AASrC,MAAa,0BAA0B,OACrC,SACA,YACA,YACqD;AACrD,KAAI;AACF,SAAO,MAAM,YAAY,mBAAmB,OAAO,WAAW;GAC5D,MAAM,WAAW,MAAM,QACrB,GAAG,aAAa,sCAChB;IACE,QAAQ;IACR,SAAS;KACP,gBAAgB;MACf,kCAAA;KACF;IACD,MAAM,KAAK,UAAU,QAAQ;IAC7B;IACD,CACF;AACD,OAAI,CAAC,SAAS,IAAI;AAChB,aACE,0BACA,0DAA0D,SAAS,OAAO,IAC3E;AACD,UAAM,SAAS,aAAa,CAAC,YAAY,KAAA,EAAU;AACnD;;AAEF,UAAQ,MAAM,SAAS,MAAM;IAC7B;UACK,OAAO;AACd,WACE,6BACA,yFACA,MACD;AACD;;;;;;;;;;;;AAuBJ,MAAa,qBAAqB,OAChC,SACA,YACA,YACmC;AACnC,KAAI;AACF,SAAO,MAAM,YAAY,0BAA0B,OAAO,WAAW;GACnE,MAAM,WAAW,MAAM,QACrB,GAAG,aAAa,gCAChB;IACE,QAAQ;IACR,SAAS;KACP,gBAAgB;MACf,kCAAA;KACF;IACD,MAAM,KAAK,UAAU,QAAQ;IAC7B;IACD,CACF;AACD,SAAM,SAAS,aAAa,CAAC,YAAY,KAAA,EAAU;AACnD,OAAI,SAAS,WAAW,IACtB,QAAO;AAET,OAAI,CAAC,SAAS,IAAI;AAChB,aACE,qBACA,8DAA8D,SAAS,OAAO,IAC/E;AACD,WAAO;;AAET,UAAO;IACP;UACK,OAAO;AACd,WACE,wBACA,oEACA,MACD;AACD,SAAO;;;;;;;;AASX,MAAa,qCAAqC,OAChD,SACA,YACA,YACgE;AAChE,KAAI;AACF,SAAO,MAAM,YAAY,gCAAgC,OAAO,WAAW;GACzE,MAAM,WAAW,MAAM,QACrB,GAAG,aAAa,mDAChB;IACE,QAAQ;IACR,SAAS;KACP,gBAAgB;MACf,kCAAA;KACF;IACD,MAAM,KAAK,UAAU,QAAQ;IAC7B;IACD,CACF;AACD,OAAI,CAAC,SAAS,IAAI;AAChB,aACE,6BACA,qEAAqE,SAAS,OAAO,iCACtF;AACD,UAAM,SAAS,aAAa,CAAC,YAAY,KAAA,EAAU;AACnD;;AAEF,UAAQ,MAAM,SAAS,MAAM;IAC7B;UACK,OAAO;AACd,WACE,0CACA,kGACA,MACD;AACD;;;;;;;;;;;;;AAcJ,MAAM,cAAc,OAClB,IACA,SACe;CACf,MAAM,aAAa,IAAI,iBAAiB;CACxC,MAAM,QAAQ,iBAAiB,WAAW,OAAO,EAAE,GAAG;AACtD,KAAI;AACF,SAAO,MAAM,KAAK,WAAW,OAAO;WAC5B;AACR,eAAa,MAAM"}

package/dist/{replay-sidecar-url.js → sidecar-url.js}

@@ -1,7 +1,8 @@
 import { warnOnce } from "./log.js";
-//#region src/replay-sidecar-url.ts
+//#region src/sidecar-url.ts
 /**
-* Validation for the replay sidecar origin carried on inbound requests.
+* Validation for a sidecar origin, whether it arrives on a request header (replay) or in a
+* deployment env var (agent-swarm testing).
 *
 * The value arrives in a request header, so in principle anything that can reach the worker
 * can propose one — and the shim POSTs outbound request bodies to whatever it accepts. The
@@ -19,21 +20,21 @@ const ALLOWED_HOSTNAMES = new Set([
 	"host.docker.internal",
 	"host.containers.internal"
 ]);
-const parseReplaySidecarUrl = (raw) => {
+const parseSidecarUrl = (raw) => {
 	if (typeof raw !== "string" || raw.length === 0) return;
 	if (raw.length > MAX_URL_LENGTH) {
-		warnOnce("replay-sidecar-url", "Ignoring an implausibly long Meticulous replay sidecar URL.");
+		warnOnce("sidecar-url", "Ignoring an implausibly long Meticulous sidecar URL.");
 		return;
 	}
 	let url;
 	try {
 		url = new URL(raw);
 	} catch {
-		warnOnce("replay-sidecar-url", "Ignoring an unparseable Meticulous replay sidecar URL.");
+		warnOnce("sidecar-url", "Ignoring an unparseable Meticulous sidecar URL.");
 		return;
 	}
 	if (!(url.protocol === "http:" && url.username === "" && url.password === "" && (url.pathname === "" || url.pathname === "/") && url.search === "" && url.hash === "" && isLocalHostname(url.hostname))) {
-		warnOnce("replay-sidecar-url", `Ignoring the Meticulous replay sidecar URL "${raw}" — only a plain http:// origin on a loopback, docker-gateway or private-network host is honoured.`);
+		warnOnce("sidecar-url", `Ignoring the Meticulous sidecar URL "${raw}" — only a plain http:// origin on a loopback, docker-gateway or private-network host is honoured.`);
 		return;
 	}
 	return url.origin;
@@ -54,6 +55,6 @@ const isPrivateIpv4 = (hostname) => {
 	return first === 127 || first === 10 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168;
 };
 //#endregion
-export { parseReplaySidecarUrl };
+export { parseSidecarUrl };
 
-//# sourceMappingURL=replay-sidecar-url.js.map
+//# sourceMappingURL=sidecar-url.js.map

package/dist/sidecar-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sidecar-url.js","names":[],"sources":["../src/sidecar-url.ts"],"sourcesContent":["import { warnOnce } from \"./log\";\n\n/**\n * Validation for a sidecar origin, whether it arrives on a request header (replay) or in a\n * deployment env var (agent-swarm testing).\n *\n * The value arrives in a request header, so in principle anything that can reach the worker\n * can propose one — and the shim POSTs outbound request bodies to whatever it accepts. The\n * guard therefore only honours an origin that could plausibly be a Meticulous replay\n * sidecar running alongside the app: plaintext HTTP on a loopback, docker-gateway or\n * private-network host.\n *\n * `https:` is rejected deliberately. A sidecar reachable over loopback or a pod network has\n * no TLS to offer, so permitting `https:` would buy nothing except a way for a forged header\n * to exfiltrate request bodies to an arbitrary internet host.\n */\n\nconst MAX_URL_LENGTH = 2048;\n\nconst ALLOWED_HOSTNAMES = new Set([\n  \"localhost\",\n  // Docker Desktop and Podman expose the host to containers under these names.\n  \"host.docker.internal\",\n  \"host.containers.internal\",\n]);\n\nexport const parseSidecarUrl = (\n  raw: string | null | undefined,\n): string | undefined => {\n  if (typeof raw !== \"string\" || raw.length === 0) {\n    return undefined;\n  }\n  if (raw.length > MAX_URL_LENGTH) {\n    warnOnce(\n      \"sidecar-url\",\n      \"Ignoring an implausibly long Meticulous sidecar URL.\",\n    );\n    return undefined;\n  }\n\n  let url: URL;\n  try {\n    url = new URL(raw);\n  } catch {\n    warnOnce(\"sidecar-url\", \"Ignoring an unparseable Meticulous sidecar URL.\");\n    return undefined;\n  }\n\n  const isAcceptable =\n    url.protocol === \"http:\" &&\n    url.username === \"\" &&\n    url.password === \"\" &&\n    (url.pathname === \"\" || url.pathname === \"/\") &&\n    url.search === \"\" &&\n    url.hash === \"\" &&\n    isLocalHostname(url.hostname);\n\n  if (!isAcceptable) {\n    warnOnce(\n      \"sidecar-url\",\n      `Ignoring the Meticulous sidecar URL \"${raw}\" — only a plain http:// origin on a loopback, docker-gateway or private-network host is honoured.`,\n    );\n    return undefined;\n  }\n\n  // Return the parsed origin rather than the raw string: it is what `fetch` would resolve\n  // the value to anyway, so the host that was validated is exactly the host that gets\n  // called (alternative IPv4 spellings like \"0177.0.0.1\" normalize here, rather than being\n  // checked in one form and dialled in another). Carries no trailing slash, matching\n  // resolveSidecarUrl's normalization so the self-capture prefix check lines up.\n  return url.origin;\n};\n\nconst isLocalHostname = (hostname: string): boolean => {\n  const lower = hostname.toLowerCase();\n  if (ALLOWED_HOSTNAMES.has(lower)) {\n    return true;\n  }\n  // URL keeps IPv6 literals bracketed.\n  const unbracketed =\n    lower.startsWith(\"[\") && lower.endsWith(\"]\")\n      ? lower.slice(1, -1)\n      : undefined;\n  if (unbracketed !== undefined) {\n    return unbracketed === \"::1\";\n  }\n  return isPrivateIpv4(lower);\n};\n\nconst isPrivateIpv4 = (hostname: string): boolean => {\n  const parts = hostname.split(\".\");\n  if (parts.length !== 4) {\n    return false;\n  }\n  const octets = parts.map((part) =>\n    // Reject anything that is not a plain decimal octet: \"010\" and \"0x7f\" are parsed\n    // inconsistently across resolvers, and \"1e2\" would pass a bare Number() check.\n    /^\\d{1,3}$/.test(part) ? Number(part) : Number.NaN,\n  );\n  if (octets.some((octet) => Number.isNaN(octet) || octet > 255)) {\n    return false;\n  }\n  const [first, second] = octets;\n  // Deliberately excludes link-local (169.254.0.0/16): no sidecar is ever reachable there,\n  // but the cloud metadata endpoints are (169.254.169.254), so allowing it would only widen\n  // the SSRF surface. The rest of the codebase blocks that range for the same reason — see\n  // `staging-backend-url.ts` and `assets-app-server.ts`.\n  return (\n    first === 127 || // loopback\n    first === 10 || // RFC1918\n    (first === 172 && second >= 16 && second <= 31) || // RFC1918\n    (first === 192 && second === 168) // RFC1918\n  );\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAiBA,MAAM,iBAAiB;AAEvB,MAAM,oBAAoB,IAAI,IAAI;CAChC;CAEA;CACA;CACD,CAAC;AAEF,MAAa,mBACX,QACuB;AACvB,KAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,EAC5C;AAEF,KAAI,IAAI,SAAS,gBAAgB;AAC/B,WACE,eACA,uDACD;AACD;;CAGF,IAAI;AACJ,KAAI;AACF,QAAM,IAAI,IAAI,IAAI;SACZ;AACN,WAAS,eAAe,kDAAkD;AAC1E;;AAYF,KAAI,EARF,IAAI,aAAa,WACjB,IAAI,aAAa,MACjB,IAAI,aAAa,OAChB,IAAI,aAAa,MAAM,IAAI,aAAa,QACzC,IAAI,WAAW,MACf,IAAI,SAAS,MACb,gBAAgB,IAAI,SAAS,GAEZ;AACjB,WACE,eACA,wCAAwC,IAAI,oGAC7C;AACD;;AAQF,QAAO,IAAI;;AAGb,MAAM,mBAAmB,aAA8B;CACrD,MAAM,QAAQ,SAAS,aAAa;AACpC,KAAI,kBAAkB,IAAI,MAAM,CAC9B,QAAO;CAGT,MAAM,cACJ,MAAM,WAAW,IAAI,IAAI,MAAM,SAAS,IAAI,GACxC,MAAM,MAAM,GAAG,GAAG,GAClB,KAAA;AACN,KAAI,gBAAgB,KAAA,EAClB,QAAO,gBAAgB;AAEzB,QAAO,cAAc,MAAM;;AAG7B,MAAM,iBAAiB,aAA8B;CACnD,MAAM,QAAQ,SAAS,MAAM,IAAI;AACjC,KAAI,MAAM,WAAW,EACnB,QAAO;CAET,MAAM,SAAS,MAAM,KAAK,SAGxB,YAAY,KAAK,KAAK,GAAG,OAAO,KAAK,GAAG,IACzC;AACD,KAAI,OAAO,MAAM,UAAU,OAAO,MAAM,MAAM,IAAI,QAAQ,IAAI,CAC5D,QAAO;CAET,MAAM,CAAC,OAAO,UAAU;AAKxB,QACE,UAAU,OACV,UAAU,MACT,UAAU,OAAO,UAAU,MAAM,UAAU,MAC3C,UAAU,OAAO,WAAW"}

package/dist/spans/span-builder.js

@@ -1,3 +1,4 @@
+import { HTTP_RESPONSE_BODY_ENCODING_ATTR } from "../body-encoding.js";
 import { CAPTURED_HEADERS } from "../protocol.js";
 import { MAX_POSTGRES_JS_RESULT_SIZE, POSTGRES_JS_ERROR_ATTR, POSTGRES_JS_QUERY_PARAMS_ATTR, POSTGRES_JS_QUERY_TEXT_ATTR, POSTGRES_JS_RESULT_ATTR, POSTGRES_JS_RESULT_TRUNCATED_ATTR, POSTGRES_JS_ROW_MODE_ATTR, postgresJsCommandOf } from "../postgres/capture.js";
 import { CLIENT_TECHNOLOGY_ATTR, CLIENT_TECHNOLOGY_POSTGRES_JS, CLIENT_TECHNOLOGY_WORKERD_BINDING, CLIENT_TECHNOLOGY_WORKERD_FETCH, CLIENT_TECHNOLOGY_WORKERD_KV, FRONTEND_SESSION_ID_ATTR, SESSION_ID_ORIGIN_ATTR, WORKERD_BINDING_NAME_ATTR, WORKERD_KV_ARGS_ATTR, WORKERD_KV_ARGS_TRUNCATED_ATTR, WORKERD_KV_KEY_ATTR, WORKERD_KV_OMITTED_ATTR, WORKERD_KV_OPERATION_ATTR, WORKERD_KV_RESULT_ATTR, WORKERD_KV_RESULT_TRUNCATED_ATTR, WORKERD_KV_VALUE_ATTR, WORKERD_KV_VALUE_TRUNCATED_ATTR } from "./attributes.js";
@@ -130,6 +131,7 @@ var SpanBuilder = class {
 		if (event.responseBody !== void 0) {
 			attributes["http.response.body"] = event.responseBody.body;
 			attributes["http.response.body.truncated"] = event.responseBody.truncated;
+			if (event.responseBody.encoding !== void 0) attributes[HTTP_RESPONSE_BODY_ENCODING_ATTR] = event.responseBody.encoding;
 		}
 		return this.buildClientSpan(event, name, attributes, buildStatus(event, 2));
 	}

package/dist/spans/span-builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"span-builder.js","names":[],"sources":["../../src/spans/span-builder.ts"],"sourcesContent":["import {\n  type BindingRequestEvent,\n  CAPTURED_HEADERS,\n  type CaptureEvent,\n  type InboundRequestEvent,\n  type KvOperationEvent,\n  type OutboundRequestEvent,\n  type PostgresQueryEvent,\n} from \"../protocol\";\nimport {\n  MAX_POSTGRES_JS_RESULT_SIZE,\n  POSTGRES_JS_ERROR_ATTR,\n  POSTGRES_JS_QUERY_PARAMS_ATTR,\n  POSTGRES_JS_QUERY_TEXT_ATTR,\n  POSTGRES_JS_RESULT_ATTR,\n  POSTGRES_JS_RESULT_TRUNCATED_ATTR,\n  POSTGRES_JS_ROW_MODE_ATTR,\n  postgresJsCommandOf,\n} from \"../postgres/capture\";\nimport {\n  CLIENT_TECHNOLOGY_ATTR,\n  CLIENT_TECHNOLOGY_POSTGRES_JS,\n  CLIENT_TECHNOLOGY_WORKERD_BINDING,\n  CLIENT_TECHNOLOGY_WORKERD_FETCH,\n  CLIENT_TECHNOLOGY_WORKERD_KV,\n  FRONTEND_SESSION_ID_ATTR,\n  SESSION_ID_ORIGIN_ATTR,\n  WORKERD_BINDING_NAME_ATTR,\n  WORKERD_KV_ARGS_ATTR,\n  WORKERD_KV_ARGS_TRUNCATED_ATTR,\n  WORKERD_KV_KEY_ATTR,\n  WORKERD_KV_OMITTED_ATTR,\n  WORKERD_KV_OPERATION_ATTR,\n  WORKERD_KV_RESULT_ATTR,\n  WORKERD_KV_RESULT_TRUNCATED_ATTR,\n  WORKERD_KV_VALUE_ATTR,\n  WORKERD_KV_VALUE_TRUNCATED_ATTR,\n} from \"./attributes\";\nimport {\n  msToHrTime,\n  type ReadableSpan,\n  SPAN_KIND_CLIENT,\n  SPAN_KIND_SERVER,\n  SPAN_STATUS_ERROR,\n  SPAN_STATUS_UNSET,\n  type SpanStatus,\n} from \"./readable-span\";\nimport { redactUrlCredentials } from \"./url-redaction\";\n\n/**\n * Builds spans from shim capture events.\n *\n * Each inbound request becomes a SERVER span and the root of its own trace; every other event of\n * that request becomes a CLIENT span parented under it. The shim supplies the trace and\n * server-span ids (see `CorrelatedEvent`), so building a span needs no memory of earlier events\n * — which is what lets a Worker-hosted sidecar be evicted between two batches of one request\n * without splitting its trace.\n *\n * The `requestId → ids` fallback below exists only for a shim that predates those fields. It is\n * the reason this is a class rather than a function.\n *\n * Shared with the Node recorder's sidecar (`packages/backend-recorder-js/src/sidecar/`), which\n * re-exports it: both sidecars must produce identical spans or a recording made through one\n * cannot be replayed by the machinery built for the other.\n */\nexport class SpanBuilder {\n  /**\n   * Legacy fallback ids, keyed by `requestId`. Outbound events usually arrive BEFORE their\n   * inbound event (the inbound is only reported once the handler completes), so an entry is\n   * created lazily on first sight from either event kind.\n   */\n  private readonly traceContexts = new Map<string, TraceContextEntry>();\n\n  build(event: CaptureEvent): ReadableSpan | null {\n    switch (event.kind) {\n      case \"inbound\":\n        return this.buildInboundSpan(event);\n      case \"outbound\":\n        return this.buildOutboundSpan(event);\n      case \"binding\":\n        return this.buildBindingSpan(event);\n      case \"kv\":\n        return this.buildKvSpan(event);\n      case \"postgres\":\n        return this.buildPostgresSpan(event);\n      default:\n        // Wire input, possibly from a newer shim — skip rather than crash.\n        return null;\n    }\n  }\n\n  private buildInboundSpan(event: InboundRequestEvent): ReadableSpan {\n    const ids = this.resolveIds(event);\n    const url = parseUrl(event.url);\n    const attributes = buildHttpAttributes(event, url);\n\n    // Only the SERVER span carries it, matching MetHttpInstrumentation on the Node path: the\n    // marker describes where this request's session id came from, and the CLIENT spans under\n    // it share the same trace.\n    if (event.sessionIdOrigin !== undefined) {\n      attributes[SESSION_ID_ORIGIN_ATTR] = event.sessionIdOrigin;\n    }\n\n    return {\n      name: `${event.method} ${url.path}`,\n      kind: SPAN_KIND_SERVER,\n      status: buildStatus(event, SPAN_KIND_SERVER),\n      startTime: msToHrTime(event.startTimeMs),\n      endTime: msToHrTime(event.endTimeMs),\n      duration: msToHrTime(Math.max(0, event.endTimeMs - event.startTimeMs)),\n      attributes,\n      spanContext: () => ({\n        traceId: ids.traceId,\n        spanId: ids.serverSpanId,\n      }),\n    };\n  }\n\n  private buildOutboundSpan(event: OutboundRequestEvent): ReadableSpan {\n    return this.buildHttpClientSpan(\n      event,\n      CLIENT_TECHNOLOGY_WORKERD_FETCH,\n      event.method,\n    );\n  }\n\n  /**\n   * A binding call. Named after the binding rather than the bare method, since the `env` key is\n   * what identifies the call — the URL is whatever the app invented.\n   */\n  private buildBindingSpan(event: BindingRequestEvent): ReadableSpan {\n    return this.buildHttpClientSpan(\n      event,\n      CLIENT_TECHNOLOGY_WORKERD_BINDING,\n      `${event.method} ${event.bindingName ?? \"$unknown\"}`,\n      event.bindingName !== undefined\n        ? { [WORKERD_BINDING_NAME_ATTR]: event.bindingName }\n        : undefined,\n    );\n  }\n\n  /**\n   * A KV operation. Named `kv.<binding>.<operation>` after the Prisma convention\n   * (`prisma.<model>.<operation>`) rather than the `METHOD TARGET` shape the HTTP-like spans use\n   * — nothing about a KV call is an HTTP method, and the dotted name keeps a `get` on a\n   * namespace distinguishable from a `GET` through a service binding at a glance.\n   */\n  private buildKvSpan(event: KvOperationEvent): ReadableSpan {\n    const attributes: Record<string, unknown> = {\n      [CLIENT_TECHNOLOGY_ATTR]: CLIENT_TECHNOLOGY_WORKERD_KV,\n      [WORKERD_KV_OPERATION_ATTR]: event.operation,\n      ...(event.bindingName !== undefined\n        ? { [WORKERD_BINDING_NAME_ATTR]: event.bindingName }\n        : {}),\n      ...(event.key !== undefined ? { [WORKERD_KV_KEY_ATTR]: event.key } : {}),\n      ...(event.omitted !== undefined\n        ? { [WORKERD_KV_OMITTED_ATTR]: event.omitted }\n        : {}),\n      ...(event.error !== undefined ? { \"error.type\": event.error } : {}),\n      ...frontendSessionAttribute(event),\n    };\n    if (event.args !== undefined) {\n      attributes[WORKERD_KV_ARGS_ATTR] = event.args.body;\n      attributes[WORKERD_KV_ARGS_TRUNCATED_ATTR] = event.args.truncated;\n    }\n    if (event.value !== undefined) {\n      attributes[WORKERD_KV_VALUE_ATTR] = event.value.body;\n      attributes[WORKERD_KV_VALUE_TRUNCATED_ATTR] = event.value.truncated;\n    }\n    if (event.result !== undefined) {\n      attributes[WORKERD_KV_RESULT_ATTR] = event.result.body;\n      attributes[WORKERD_KV_RESULT_TRUNCATED_ATTR] = event.result.truncated;\n    }\n\n    return this.buildClientSpan(\n      event,\n      `kv.${event.bindingName ?? \"$unknown\"}.${event.operation}`,\n      attributes,\n      event.error !== undefined\n        ? { code: SPAN_STATUS_ERROR, message: event.error }\n        : { code: SPAN_STATUS_UNSET },\n    );\n  }\n\n  /**\n   * A postgres.js query. Name and attributes match what the Node instrumentation emits\n   * (`postgresjs.<command>`), because the same store loads both.\n   */\n  private buildPostgresSpan(event: PostgresQueryEvent): ReadableSpan {\n    const attributes: Record<string, unknown> = {\n      [CLIENT_TECHNOLOGY_ATTR]: CLIENT_TECHNOLOGY_POSTGRES_JS,\n      [POSTGRES_JS_QUERY_TEXT_ATTR]: event.queryText,\n      [POSTGRES_JS_QUERY_PARAMS_ATTR]: event.params,\n      [POSTGRES_JS_ROW_MODE_ATTR]: event.rowMode,\n      ...frontendSessionAttribute(event),\n    };\n    if (event.result !== undefined) {\n      // Re-cap here as well as at capture time: the attribute contract is what the store\n      // reads, and a shim that capped differently must not widen it.\n      const truncated =\n        event.result.truncated ||\n        event.result.body.length > MAX_POSTGRES_JS_RESULT_SIZE;\n      attributes[POSTGRES_JS_RESULT_ATTR] = truncated\n        ? event.result.body.slice(0, MAX_POSTGRES_JS_RESULT_SIZE)\n        : event.result.body;\n      attributes[POSTGRES_JS_RESULT_TRUNCATED_ATTR] = truncated;\n    }\n    if (event.errorJson !== undefined) {\n      attributes[POSTGRES_JS_ERROR_ATTR] = event.errorJson;\n    }\n\n    return this.buildClientSpan(\n      event,\n      `postgresjs.${postgresJsCommandOf(event.queryText)}`,\n      attributes,\n      event.errorJson !== undefined\n        ? { code: SPAN_STATUS_ERROR }\n        : { code: SPAN_STATUS_UNSET },\n    );\n  }\n\n  private buildHttpClientSpan(\n    event: OutboundRequestEvent | BindingRequestEvent,\n    technology: string,\n    name: string,\n    extraAttributes?: Record<string, unknown>,\n  ): ReadableSpan {\n    const url = parseUrl(event.url);\n    const attributes = buildHttpAttributes(event, url);\n    attributes[CLIENT_TECHNOLOGY_ATTR] = technology;\n    Object.assign(attributes, extraAttributes);\n    if (event.requestBody !== undefined) {\n      attributes[\"http.request.body\"] = event.requestBody.body;\n      attributes[\"http.request.body.truncated\"] = event.requestBody.truncated;\n    }\n    if (event.responseBody !== undefined) {\n      attributes[\"http.response.body\"] = event.responseBody.body;\n      attributes[\"http.response.body.truncated\"] = event.responseBody.truncated;\n    }\n\n    return this.buildClientSpan(\n      event,\n      name,\n      attributes,\n      buildStatus(event, SPAN_KIND_CLIENT),\n    );\n  }\n\n  private buildClientSpan(\n    event: CaptureEvent,\n    name: string,\n    attributes: Record<string, unknown>,\n    status: SpanStatus,\n  ): ReadableSpan {\n    const ids = this.resolveIds(event);\n    const spanId = randomHex(8);\n    return {\n      name,\n      parentSpanId: ids.serverSpanId,\n      kind: SPAN_KIND_CLIENT,\n      status,\n      startTime: msToHrTime(event.startTimeMs),\n      endTime: msToHrTime(event.endTimeMs),\n      duration: msToHrTime(Math.max(0, event.endTimeMs - event.startTimeMs)),\n      attributes,\n      spanContext: () => ({ traceId: ids.traceId, spanId }),\n    };\n  }\n\n  /**\n   * The trace and server-span ids for an event: the shim's, when it sent them, and otherwise a\n   * pair invented per `requestId` and remembered — the pre-`traceId` behaviour.\n   */\n  private resolveIds(event: CaptureEvent): TraceContextEntry {\n    if (event.traceId !== undefined && event.serverSpanId !== undefined) {\n      return {\n        traceId: event.traceId,\n        serverSpanId: event.serverSpanId,\n        lastSeenMs: event.endTimeMs,\n      };\n    }\n    const existing = this.traceContexts.get(event.requestId);\n    if (existing) {\n      existing.lastSeenMs = event.endTimeMs;\n      return existing;\n    }\n    this.pruneTraceContexts(event.endTimeMs);\n    const entry: TraceContextEntry = {\n      traceId: randomHex(16),\n      serverSpanId: randomHex(8),\n      lastSeenMs: event.endTimeMs,\n    };\n    this.traceContexts.set(event.requestId, entry);\n    return entry;\n  }\n\n  private pruneTraceContexts(nowMs: number): void {\n    if (this.traceContexts.size < TRACE_CONTEXT_PRUNE_THRESHOLD) {\n      return;\n    }\n    for (const [requestId, entry] of this.traceContexts) {\n      if (nowMs - entry.lastSeenMs > TRACE_CONTEXT_TTL_MS) {\n        this.traceContexts.delete(requestId);\n      }\n    }\n  }\n}\n\ninterface TraceContextEntry {\n  traceId: string;\n  serverSpanId: string;\n  lastSeenMs: number;\n}\n\nconst TRACE_CONTEXT_TTL_MS = 10 * 60 * 1000;\nconst TRACE_CONTEXT_PRUNE_THRESHOLD = 1_000;\n\nconst HEX = \"0123456789abcdef\";\n\n/** WebCrypto rather than `node:crypto`, so this runs in a Worker as well as in Node. */\nexport const randomHex = (bytes: number): string => {\n  const buffer = crypto.getRandomValues(new Uint8Array(bytes));\n  let hex = \"\";\n  for (const byte of buffer) {\n    hex += HEX[byte >> 4] + HEX[byte & 0x0f];\n  }\n  return hex;\n};\n\nconst capturedHeaders = new Set<string>(CAPTURED_HEADERS);\n\ninterface ParsedUrl {\n  full: string;\n  path: string;\n  query: string | undefined;\n  scheme: string | undefined;\n  host: string | undefined;\n  port: number | undefined;\n}\n\nconst parseUrl = (raw: string): ParsedUrl => {\n  try {\n    const url = redactUrlCredentials(new URL(raw));\n    const defaultPort = url.protocol === \"https:\" ? 443 : 80;\n    return {\n      full: url.toString(),\n      path: url.pathname,\n      query: url.search ? url.search.slice(1) : undefined,\n      scheme: url.protocol.replace(/:$/, \"\"),\n      host: url.hostname,\n      port: url.port ? parseInt(url.port, 10) : defaultPort,\n    };\n  } catch {\n    return {\n      full: raw,\n      path: raw.split(\"?\")[0] || \"/\",\n      query: undefined,\n      scheme: undefined,\n      host: undefined,\n      port: undefined,\n    };\n  }\n};\n\nconst frontendSessionAttribute = (\n  event: CaptureEvent,\n): Record<string, string> =>\n  event.frontendSessionId !== undefined\n    ? { [FRONTEND_SESSION_ID_ATTR]: event.frontendSessionId }\n    : {};\n\nconst buildHttpAttributes = (\n  event: InboundRequestEvent | OutboundRequestEvent | BindingRequestEvent,\n  url: ParsedUrl,\n): Record<string, unknown> => {\n  const attributes: Record<string, unknown> = {\n    \"http.request.method\": event.method,\n    \"url.full\": url.full,\n    \"url.path\": url.path,\n    ...(url.query !== undefined ? { \"url.query\": url.query } : {}),\n    ...(url.scheme !== undefined ? { \"url.scheme\": url.scheme } : {}),\n    ...(url.host !== undefined ? { \"server.address\": url.host } : {}),\n    ...(url.port !== undefined ? { \"server.port\": url.port } : {}),\n    ...(event.statusCode !== undefined\n      ? { \"http.response.status_code\": event.statusCode }\n      : {}),\n    ...(event.error !== undefined ? { \"error.type\": event.error } : {}),\n    ...frontendSessionAttribute(event),\n  };\n  // The shim already filters to CAPTURED_HEADERS; re-filter here so a stale or third-party\n  // shim can't persist sensitive headers via the sidecar.\n  for (const [name, values] of Object.entries(event.requestHeaders)) {\n    if (capturedHeaders.has(name.toLowerCase())) {\n      attributes[`http.request.header.${name}`] = values;\n    }\n  }\n  for (const [name, values] of Object.entries(event.responseHeaders ?? {})) {\n    if (capturedHeaders.has(name.toLowerCase())) {\n      attributes[`http.response.header.${name}`] = values;\n    }\n  }\n  return attributes;\n};\n\nconst buildStatus = (\n  event: InboundRequestEvent | OutboundRequestEvent | BindingRequestEvent,\n  kind: number,\n): SpanStatus => {\n  if (event.error !== undefined) {\n    return { code: SPAN_STATUS_ERROR, message: event.error };\n  }\n  // Standard OTel HTTP semantics: client spans error on 4xx/5xx, server spans only on 5xx.\n  const errorThreshold = kind === SPAN_KIND_CLIENT ? 400 : 500;\n  if (event.statusCode !== undefined && event.statusCode >= errorThreshold) {\n    return { code: SPAN_STATUS_ERROR };\n  }\n  return { code: SPAN_STATUS_UNSET };\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAiEA,IAAa,cAAb,MAAyB;;;;;;CAMvB,gCAAiC,IAAI,KAAgC;CAErE,MAAM,OAA0C;AAC9C,UAAQ,MAAM,MAAd;GACE,KAAK,UACH,QAAO,KAAK,iBAAiB,MAAM;GACrC,KAAK,WACH,QAAO,KAAK,kBAAkB,MAAM;GACtC,KAAK,UACH,QAAO,KAAK,iBAAiB,MAAM;GACrC,KAAK,KACH,QAAO,KAAK,YAAY,MAAM;GAChC,KAAK,WACH,QAAO,KAAK,kBAAkB,MAAM;GACtC,QAEE,QAAO;;;CAIb,iBAAyB,OAA0C;EACjE,MAAM,MAAM,KAAK,WAAW,MAAM;EAClC,MAAM,MAAM,SAAS,MAAM,IAAI;EAC/B,MAAM,aAAa,oBAAoB,OAAO,IAAI;AAKlD,MAAI,MAAM,oBAAoB,KAAA,EAC5B,YAAW,0BAA0B,MAAM;AAG7C,SAAO;GACL,MAAM,GAAG,MAAM,OAAO,GAAG,IAAI;GAC7B,MAAA;GACA,QAAQ,YAAY,OAAA,EAAwB;GAC5C,WAAW,WAAW,MAAM,YAAY;GACxC,SAAS,WAAW,MAAM,UAAU;GACpC,UAAU,WAAW,KAAK,IAAI,GAAG,MAAM,YAAY,MAAM,YAAY,CAAC;GACtE;GACA,oBAAoB;IAClB,SAAS,IAAI;IACb,QAAQ,IAAI;IACb;GACF;;CAGH,kBAA0B,OAA2C;AACnE,SAAO,KAAK,oBACV,OACA,iCACA,MAAM,OACP;;;;;;CAOH,iBAAyB,OAA0C;AACjE,SAAO,KAAK,oBACV,OACA,mCACA,GAAG,MAAM,OAAO,GAAG,MAAM,eAAe,cACxC,MAAM,gBAAgB,KAAA,IAClB,GAAG,4BAA4B,MAAM,aAAa,GAClD,KAAA,EACL;;;;;;;;CASH,YAAoB,OAAuC;EACzD,MAAM,aAAsC;IACzC,yBAAyB;IACzB,4BAA4B,MAAM;GACnC,GAAI,MAAM,gBAAgB,KAAA,IACtB,GAAG,4BAA4B,MAAM,aAAa,GAClD,EAAE;GACN,GAAI,MAAM,QAAQ,KAAA,IAAY,GAAG,sBAAsB,MAAM,KAAK,GAAG,EAAE;GACvE,GAAI,MAAM,YAAY,KAAA,IAClB,GAAG,0BAA0B,MAAM,SAAS,GAC5C,EAAE;GACN,GAAI,MAAM,UAAU,KAAA,IAAY,EAAE,cAAc,MAAM,OAAO,GAAG,EAAE;GAClE,GAAG,yBAAyB,MAAM;GACnC;AACD,MAAI,MAAM,SAAS,KAAA,GAAW;AAC5B,cAAW,wBAAwB,MAAM,KAAK;AAC9C,cAAW,kCAAkC,MAAM,KAAK;;AAE1D,MAAI,MAAM,UAAU,KAAA,GAAW;AAC7B,cAAW,yBAAyB,MAAM,MAAM;AAChD,cAAW,mCAAmC,MAAM,MAAM;;AAE5D,MAAI,MAAM,WAAW,KAAA,GAAW;AAC9B,cAAW,0BAA0B,MAAM,OAAO;AAClD,cAAW,oCAAoC,MAAM,OAAO;;AAG9D,SAAO,KAAK,gBACV,OACA,MAAM,MAAM,eAAe,WAAW,GAAG,MAAM,aAC/C,YACA,MAAM,UAAU,KAAA,IACZ;GAAE,MAAA;GAAyB,SAAS,MAAM;GAAO,GACjD,EAAE,MAAA,GAAyB,CAChC;;;;;;CAOH,kBAA0B,OAAyC;EACjE,MAAM,aAAsC;IACzC,yBAAyB;IACzB,8BAA8B,MAAM;IACpC,gCAAgC,MAAM;IACtC,4BAA4B,MAAM;GACnC,GAAG,yBAAyB,MAAM;GACnC;AACD,MAAI,MAAM,WAAW,KAAA,GAAW;GAG9B,MAAM,YACJ,MAAM,OAAO,aACb,MAAM,OAAO,KAAK,SAAA;AACpB,cAAW,2BAA2B,YAClC,MAAM,OAAO,KAAK,MAAM,GAAG,4BAA4B,GACvD,MAAM,OAAO;AACjB,cAAW,qCAAqC;;AAElD,MAAI,MAAM,cAAc,KAAA,EACtB,YAAW,0BAA0B,MAAM;AAG7C,SAAO,KAAK,gBACV,OACA,cAAc,oBAAoB,MAAM,UAAU,IAClD,YACA,MAAM,cAAc,KAAA,IAChB,EAAE,MAAA,GAAyB,GAC3B,EAAE,MAAA,GAAyB,CAChC;;CAGH,oBACE,OACA,YACA,MACA,iBACc;EAEd,MAAM,aAAa,oBAAoB,OAD3B,SAAS,MAAM,IACsB,CAAC;AAClD,aAAW,0BAA0B;AACrC,SAAO,OAAO,YAAY,gBAAgB;AAC1C,MAAI,MAAM,gBAAgB,KAAA,GAAW;AACnC,cAAW,uBAAuB,MAAM,YAAY;AACpD,cAAW,iCAAiC,MAAM,YAAY;;AAEhE,MAAI,MAAM,iBAAiB,KAAA,GAAW;AACpC,cAAW,wBAAwB,MAAM,aAAa;AACtD,cAAW,kCAAkC,MAAM,aAAa;;AAGlE,SAAO,KAAK,gBACV,OACA,MACA,YACA,YAAY,OAAA,EAAwB,CACrC;;CAGH,gBACE,OACA,MACA,YACA,QACc;EACd,MAAM,MAAM,KAAK,WAAW,MAAM;EAClC,MAAM,SAAS,UAAU,EAAE;AAC3B,SAAO;GACL;GACA,cAAc,IAAI;GAClB,MAAA;GACA;GACA,WAAW,WAAW,MAAM,YAAY;GACxC,SAAS,WAAW,MAAM,UAAU;GACpC,UAAU,WAAW,KAAK,IAAI,GAAG,MAAM,YAAY,MAAM,YAAY,CAAC;GACtE;GACA,oBAAoB;IAAE,SAAS,IAAI;IAAS;IAAQ;GACrD;;;;;;CAOH,WAAmB,OAAwC;AACzD,MAAI,MAAM,YAAY,KAAA,KAAa,MAAM,iBAAiB,KAAA,EACxD,QAAO;GACL,SAAS,MAAM;GACf,cAAc,MAAM;GACpB,YAAY,MAAM;GACnB;EAEH,MAAM,WAAW,KAAK,cAAc,IAAI,MAAM,UAAU;AACxD,MAAI,UAAU;AACZ,YAAS,aAAa,MAAM;AAC5B,UAAO;;AAET,OAAK,mBAAmB,MAAM,UAAU;EACxC,MAAM,QAA2B;GAC/B,SAAS,UAAU,GAAG;GACtB,cAAc,UAAU,EAAE;GAC1B,YAAY,MAAM;GACnB;AACD,OAAK,cAAc,IAAI,MAAM,WAAW,MAAM;AAC9C,SAAO;;CAGT,mBAA2B,OAAqB;AAC9C,MAAI,KAAK,cAAc,OAAO,8BAC5B;AAEF,OAAK,MAAM,CAAC,WAAW,UAAU,KAAK,cACpC,KAAI,QAAQ,MAAM,aAAa,qBAC7B,MAAK,cAAc,OAAO,UAAU;;;AAY5C,MAAM,uBAAuB,MAAU;AACvC,MAAM,gCAAgC;AAEtC,MAAM,MAAM;;AAGZ,MAAa,aAAa,UAA0B;CAClD,MAAM,SAAS,OAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;CAC5D,IAAI,MAAM;AACV,MAAK,MAAM,QAAQ,OACjB,QAAO,IAAI,QAAQ,KAAK,IAAI,OAAO;AAErC,QAAO;;AAGT,MAAM,kBAAkB,IAAI,IAAY,iBAAiB;AAWzD,MAAM,YAAY,QAA2B;AAC3C,KAAI;EACF,MAAM,MAAM,qBAAqB,IAAI,IAAI,IAAI,CAAC;EAC9C,MAAM,cAAc,IAAI,aAAa,WAAW,MAAM;AACtD,SAAO;GACL,MAAM,IAAI,UAAU;GACpB,MAAM,IAAI;GACV,OAAO,IAAI,SAAS,IAAI,OAAO,MAAM,EAAE,GAAG,KAAA;GAC1C,QAAQ,IAAI,SAAS,QAAQ,MAAM,GAAG;GACtC,MAAM,IAAI;GACV,MAAM,IAAI,OAAO,SAAS,IAAI,MAAM,GAAG,GAAG;GAC3C;SACK;AACN,SAAO;GACL,MAAM;GACN,MAAM,IAAI,MAAM,IAAI,CAAC,MAAM;GAC3B,OAAO,KAAA;GACP,QAAQ,KAAA;GACR,MAAM,KAAA;GACN,MAAM,KAAA;GACP;;;AAIL,MAAM,4BACJ,UAEA,MAAM,sBAAsB,KAAA,IACxB,GAAG,2BAA2B,MAAM,mBAAmB,GACvD,EAAE;AAER,MAAM,uBACJ,OACA,QAC4B;CAC5B,MAAM,aAAsC;EAC1C,uBAAuB,MAAM;EAC7B,YAAY,IAAI;EAChB,YAAY,IAAI;EAChB,GAAI,IAAI,UAAU,KAAA,IAAY,EAAE,aAAa,IAAI,OAAO,GAAG,EAAE;EAC7D,GAAI,IAAI,WAAW,KAAA,IAAY,EAAE,cAAc,IAAI,QAAQ,GAAG,EAAE;EAChE,GAAI,IAAI,SAAS,KAAA,IAAY,EAAE,kBAAkB,IAAI,MAAM,GAAG,EAAE;EAChE,GAAI,IAAI,SAAS,KAAA,IAAY,EAAE,eAAe,IAAI,MAAM,GAAG,EAAE;EAC7D,GAAI,MAAM,eAAe,KAAA,IACrB,EAAE,6BAA6B,MAAM,YAAY,GACjD,EAAE;EACN,GAAI,MAAM,UAAU,KAAA,IAAY,EAAE,cAAc,MAAM,OAAO,GAAG,EAAE;EAClE,GAAG,yBAAyB,MAAM;EACnC;AAGD,MAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,MAAM,eAAe,CAC/D,KAAI,gBAAgB,IAAI,KAAK,aAAa,CAAC,CACzC,YAAW,uBAAuB,UAAU;AAGhD,MAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,MAAM,mBAAmB,EAAE,CAAC,CACtE,KAAI,gBAAgB,IAAI,KAAK,aAAa,CAAC,CACzC,YAAW,wBAAwB,UAAU;AAGjD,QAAO;;AAGT,MAAM,eACJ,OACA,SACe;AACf,KAAI,MAAM,UAAU,KAAA,EAClB,QAAO;EAAE,MAAA;EAAyB,SAAS,MAAM;EAAO;CAG1D,MAAM,iBAAiB,SAAA,IAA4B,MAAM;AACzD,KAAI,MAAM,eAAe,KAAA,KAAa,MAAM,cAAc,eACxD,QAAO,EAAE,MAAA,GAAyB;AAEpC,QAAO,EAAE,MAAA,GAAyB"}
+{"version":3,"file":"span-builder.js","names":[],"sources":["../../src/spans/span-builder.ts"],"sourcesContent":["import { HTTP_RESPONSE_BODY_ENCODING_ATTR } from \"../body-encoding\";\nimport {\n  type BindingRequestEvent,\n  CAPTURED_HEADERS,\n  type CaptureEvent,\n  type InboundRequestEvent,\n  type KvOperationEvent,\n  type OutboundRequestEvent,\n  type PostgresQueryEvent,\n} from \"../protocol\";\nimport {\n  MAX_POSTGRES_JS_RESULT_SIZE,\n  POSTGRES_JS_ERROR_ATTR,\n  POSTGRES_JS_QUERY_PARAMS_ATTR,\n  POSTGRES_JS_QUERY_TEXT_ATTR,\n  POSTGRES_JS_RESULT_ATTR,\n  POSTGRES_JS_RESULT_TRUNCATED_ATTR,\n  POSTGRES_JS_ROW_MODE_ATTR,\n  postgresJsCommandOf,\n} from \"../postgres/capture\";\nimport {\n  CLIENT_TECHNOLOGY_ATTR,\n  CLIENT_TECHNOLOGY_POSTGRES_JS,\n  CLIENT_TECHNOLOGY_WORKERD_BINDING,\n  CLIENT_TECHNOLOGY_WORKERD_FETCH,\n  CLIENT_TECHNOLOGY_WORKERD_KV,\n  FRONTEND_SESSION_ID_ATTR,\n  SESSION_ID_ORIGIN_ATTR,\n  WORKERD_BINDING_NAME_ATTR,\n  WORKERD_KV_ARGS_ATTR,\n  WORKERD_KV_ARGS_TRUNCATED_ATTR,\n  WORKERD_KV_KEY_ATTR,\n  WORKERD_KV_OMITTED_ATTR,\n  WORKERD_KV_OPERATION_ATTR,\n  WORKERD_KV_RESULT_ATTR,\n  WORKERD_KV_RESULT_TRUNCATED_ATTR,\n  WORKERD_KV_VALUE_ATTR,\n  WORKERD_KV_VALUE_TRUNCATED_ATTR,\n} from \"./attributes\";\nimport {\n  msToHrTime,\n  type ReadableSpan,\n  SPAN_KIND_CLIENT,\n  SPAN_KIND_SERVER,\n  SPAN_STATUS_ERROR,\n  SPAN_STATUS_UNSET,\n  type SpanStatus,\n} from \"./readable-span\";\nimport { redactUrlCredentials } from \"./url-redaction\";\n\n/**\n * Builds spans from shim capture events.\n *\n * Each inbound request becomes a SERVER span and the root of its own trace; every other event of\n * that request becomes a CLIENT span parented under it. The shim supplies the trace and\n * server-span ids (see `CorrelatedEvent`), so building a span needs no memory of earlier events\n * — which is what lets a Worker-hosted sidecar be evicted between two batches of one request\n * without splitting its trace.\n *\n * The `requestId → ids` fallback below exists only for a shim that predates those fields. It is\n * the reason this is a class rather than a function.\n *\n * Shared with the Node recorder's sidecar (`packages/backend-recorder-js/src/sidecar/`), which\n * re-exports it: both sidecars must produce identical spans or a recording made through one\n * cannot be replayed by the machinery built for the other.\n */\nexport class SpanBuilder {\n  /**\n   * Legacy fallback ids, keyed by `requestId`. Outbound events usually arrive BEFORE their\n   * inbound event (the inbound is only reported once the handler completes), so an entry is\n   * created lazily on first sight from either event kind.\n   */\n  private readonly traceContexts = new Map<string, TraceContextEntry>();\n\n  build(event: CaptureEvent): ReadableSpan | null {\n    switch (event.kind) {\n      case \"inbound\":\n        return this.buildInboundSpan(event);\n      case \"outbound\":\n        return this.buildOutboundSpan(event);\n      case \"binding\":\n        return this.buildBindingSpan(event);\n      case \"kv\":\n        return this.buildKvSpan(event);\n      case \"postgres\":\n        return this.buildPostgresSpan(event);\n      default:\n        // Wire input, possibly from a newer shim — skip rather than crash.\n        return null;\n    }\n  }\n\n  private buildInboundSpan(event: InboundRequestEvent): ReadableSpan {\n    const ids = this.resolveIds(event);\n    const url = parseUrl(event.url);\n    const attributes = buildHttpAttributes(event, url);\n\n    // Only the SERVER span carries it, matching MetHttpInstrumentation on the Node path: the\n    // marker describes where this request's session id came from, and the CLIENT spans under\n    // it share the same trace.\n    if (event.sessionIdOrigin !== undefined) {\n      attributes[SESSION_ID_ORIGIN_ATTR] = event.sessionIdOrigin;\n    }\n\n    return {\n      name: `${event.method} ${url.path}`,\n      kind: SPAN_KIND_SERVER,\n      status: buildStatus(event, SPAN_KIND_SERVER),\n      startTime: msToHrTime(event.startTimeMs),\n      endTime: msToHrTime(event.endTimeMs),\n      duration: msToHrTime(Math.max(0, event.endTimeMs - event.startTimeMs)),\n      attributes,\n      spanContext: () => ({\n        traceId: ids.traceId,\n        spanId: ids.serverSpanId,\n      }),\n    };\n  }\n\n  private buildOutboundSpan(event: OutboundRequestEvent): ReadableSpan {\n    return this.buildHttpClientSpan(\n      event,\n      CLIENT_TECHNOLOGY_WORKERD_FETCH,\n      event.method,\n    );\n  }\n\n  /**\n   * A binding call. Named after the binding rather than the bare method, since the `env` key is\n   * what identifies the call — the URL is whatever the app invented.\n   */\n  private buildBindingSpan(event: BindingRequestEvent): ReadableSpan {\n    return this.buildHttpClientSpan(\n      event,\n      CLIENT_TECHNOLOGY_WORKERD_BINDING,\n      `${event.method} ${event.bindingName ?? \"$unknown\"}`,\n      event.bindingName !== undefined\n        ? { [WORKERD_BINDING_NAME_ATTR]: event.bindingName }\n        : undefined,\n    );\n  }\n\n  /**\n   * A KV operation. Named `kv.<binding>.<operation>` after the Prisma convention\n   * (`prisma.<model>.<operation>`) rather than the `METHOD TARGET` shape the HTTP-like spans use\n   * — nothing about a KV call is an HTTP method, and the dotted name keeps a `get` on a\n   * namespace distinguishable from a `GET` through a service binding at a glance.\n   */\n  private buildKvSpan(event: KvOperationEvent): ReadableSpan {\n    const attributes: Record<string, unknown> = {\n      [CLIENT_TECHNOLOGY_ATTR]: CLIENT_TECHNOLOGY_WORKERD_KV,\n      [WORKERD_KV_OPERATION_ATTR]: event.operation,\n      ...(event.bindingName !== undefined\n        ? { [WORKERD_BINDING_NAME_ATTR]: event.bindingName }\n        : {}),\n      ...(event.key !== undefined ? { [WORKERD_KV_KEY_ATTR]: event.key } : {}),\n      ...(event.omitted !== undefined\n        ? { [WORKERD_KV_OMITTED_ATTR]: event.omitted }\n        : {}),\n      ...(event.error !== undefined ? { \"error.type\": event.error } : {}),\n      ...frontendSessionAttribute(event),\n    };\n    if (event.args !== undefined) {\n      attributes[WORKERD_KV_ARGS_ATTR] = event.args.body;\n      attributes[WORKERD_KV_ARGS_TRUNCATED_ATTR] = event.args.truncated;\n    }\n    if (event.value !== undefined) {\n      attributes[WORKERD_KV_VALUE_ATTR] = event.value.body;\n      attributes[WORKERD_KV_VALUE_TRUNCATED_ATTR] = event.value.truncated;\n    }\n    if (event.result !== undefined) {\n      attributes[WORKERD_KV_RESULT_ATTR] = event.result.body;\n      attributes[WORKERD_KV_RESULT_TRUNCATED_ATTR] = event.result.truncated;\n    }\n\n    return this.buildClientSpan(\n      event,\n      `kv.${event.bindingName ?? \"$unknown\"}.${event.operation}`,\n      attributes,\n      event.error !== undefined\n        ? { code: SPAN_STATUS_ERROR, message: event.error }\n        : { code: SPAN_STATUS_UNSET },\n    );\n  }\n\n  /**\n   * A postgres.js query. Name and attributes match what the Node instrumentation emits\n   * (`postgresjs.<command>`), because the same store loads both.\n   */\n  private buildPostgresSpan(event: PostgresQueryEvent): ReadableSpan {\n    const attributes: Record<string, unknown> = {\n      [CLIENT_TECHNOLOGY_ATTR]: CLIENT_TECHNOLOGY_POSTGRES_JS,\n      [POSTGRES_JS_QUERY_TEXT_ATTR]: event.queryText,\n      [POSTGRES_JS_QUERY_PARAMS_ATTR]: event.params,\n      [POSTGRES_JS_ROW_MODE_ATTR]: event.rowMode,\n      ...frontendSessionAttribute(event),\n    };\n    if (event.result !== undefined) {\n      // Re-cap here as well as at capture time: the attribute contract is what the store\n      // reads, and a shim that capped differently must not widen it.\n      const truncated =\n        event.result.truncated ||\n        event.result.body.length > MAX_POSTGRES_JS_RESULT_SIZE;\n      attributes[POSTGRES_JS_RESULT_ATTR] = truncated\n        ? event.result.body.slice(0, MAX_POSTGRES_JS_RESULT_SIZE)\n        : event.result.body;\n      attributes[POSTGRES_JS_RESULT_TRUNCATED_ATTR] = truncated;\n    }\n    if (event.errorJson !== undefined) {\n      attributes[POSTGRES_JS_ERROR_ATTR] = event.errorJson;\n    }\n\n    return this.buildClientSpan(\n      event,\n      `postgresjs.${postgresJsCommandOf(event.queryText)}`,\n      attributes,\n      event.errorJson !== undefined\n        ? { code: SPAN_STATUS_ERROR }\n        : { code: SPAN_STATUS_UNSET },\n    );\n  }\n\n  private buildHttpClientSpan(\n    event: OutboundRequestEvent | BindingRequestEvent,\n    technology: string,\n    name: string,\n    extraAttributes?: Record<string, unknown>,\n  ): ReadableSpan {\n    const url = parseUrl(event.url);\n    const attributes = buildHttpAttributes(event, url);\n    attributes[CLIENT_TECHNOLOGY_ATTR] = technology;\n    Object.assign(attributes, extraAttributes);\n    if (event.requestBody !== undefined) {\n      attributes[\"http.request.body\"] = event.requestBody.body;\n      attributes[\"http.request.body.truncated\"] = event.requestBody.truncated;\n    }\n    if (event.responseBody !== undefined) {\n      attributes[\"http.response.body\"] = event.responseBody.body;\n      attributes[\"http.response.body.truncated\"] = event.responseBody.truncated;\n      if (event.responseBody.encoding !== undefined) {\n        attributes[HTTP_RESPONSE_BODY_ENCODING_ATTR] =\n          event.responseBody.encoding;\n      }\n    }\n\n    return this.buildClientSpan(\n      event,\n      name,\n      attributes,\n      buildStatus(event, SPAN_KIND_CLIENT),\n    );\n  }\n\n  private buildClientSpan(\n    event: CaptureEvent,\n    name: string,\n    attributes: Record<string, unknown>,\n    status: SpanStatus,\n  ): ReadableSpan {\n    const ids = this.resolveIds(event);\n    const spanId = randomHex(8);\n    return {\n      name,\n      parentSpanId: ids.serverSpanId,\n      kind: SPAN_KIND_CLIENT,\n      status,\n      startTime: msToHrTime(event.startTimeMs),\n      endTime: msToHrTime(event.endTimeMs),\n      duration: msToHrTime(Math.max(0, event.endTimeMs - event.startTimeMs)),\n      attributes,\n      spanContext: () => ({ traceId: ids.traceId, spanId }),\n    };\n  }\n\n  /**\n   * The trace and server-span ids for an event: the shim's, when it sent them, and otherwise a\n   * pair invented per `requestId` and remembered — the pre-`traceId` behaviour.\n   */\n  private resolveIds(event: CaptureEvent): TraceContextEntry {\n    if (event.traceId !== undefined && event.serverSpanId !== undefined) {\n      return {\n        traceId: event.traceId,\n        serverSpanId: event.serverSpanId,\n        lastSeenMs: event.endTimeMs,\n      };\n    }\n    const existing = this.traceContexts.get(event.requestId);\n    if (existing) {\n      existing.lastSeenMs = event.endTimeMs;\n      return existing;\n    }\n    this.pruneTraceContexts(event.endTimeMs);\n    const entry: TraceContextEntry = {\n      traceId: randomHex(16),\n      serverSpanId: randomHex(8),\n      lastSeenMs: event.endTimeMs,\n    };\n    this.traceContexts.set(event.requestId, entry);\n    return entry;\n  }\n\n  private pruneTraceContexts(nowMs: number): void {\n    if (this.traceContexts.size < TRACE_CONTEXT_PRUNE_THRESHOLD) {\n      return;\n    }\n    for (const [requestId, entry] of this.traceContexts) {\n      if (nowMs - entry.lastSeenMs > TRACE_CONTEXT_TTL_MS) {\n        this.traceContexts.delete(requestId);\n      }\n    }\n  }\n}\n\ninterface TraceContextEntry {\n  traceId: string;\n  serverSpanId: string;\n  lastSeenMs: number;\n}\n\nconst TRACE_CONTEXT_TTL_MS = 10 * 60 * 1000;\nconst TRACE_CONTEXT_PRUNE_THRESHOLD = 1_000;\n\nconst HEX = \"0123456789abcdef\";\n\n/** WebCrypto rather than `node:crypto`, so this runs in a Worker as well as in Node. */\nexport const randomHex = (bytes: number): string => {\n  const buffer = crypto.getRandomValues(new Uint8Array(bytes));\n  let hex = \"\";\n  for (const byte of buffer) {\n    hex += HEX[byte >> 4] + HEX[byte & 0x0f];\n  }\n  return hex;\n};\n\nconst capturedHeaders = new Set<string>(CAPTURED_HEADERS);\n\ninterface ParsedUrl {\n  full: string;\n  path: string;\n  query: string | undefined;\n  scheme: string | undefined;\n  host: string | undefined;\n  port: number | undefined;\n}\n\nconst parseUrl = (raw: string): ParsedUrl => {\n  try {\n    const url = redactUrlCredentials(new URL(raw));\n    const defaultPort = url.protocol === \"https:\" ? 443 : 80;\n    return {\n      full: url.toString(),\n      path: url.pathname,\n      query: url.search ? url.search.slice(1) : undefined,\n      scheme: url.protocol.replace(/:$/, \"\"),\n      host: url.hostname,\n      port: url.port ? parseInt(url.port, 10) : defaultPort,\n    };\n  } catch {\n    return {\n      full: raw,\n      path: raw.split(\"?\")[0] || \"/\",\n      query: undefined,\n      scheme: undefined,\n      host: undefined,\n      port: undefined,\n    };\n  }\n};\n\nconst frontendSessionAttribute = (\n  event: CaptureEvent,\n): Record<string, string> =>\n  event.frontendSessionId !== undefined\n    ? { [FRONTEND_SESSION_ID_ATTR]: event.frontendSessionId }\n    : {};\n\nconst buildHttpAttributes = (\n  event: InboundRequestEvent | OutboundRequestEvent | BindingRequestEvent,\n  url: ParsedUrl,\n): Record<string, unknown> => {\n  const attributes: Record<string, unknown> = {\n    \"http.request.method\": event.method,\n    \"url.full\": url.full,\n    \"url.path\": url.path,\n    ...(url.query !== undefined ? { \"url.query\": url.query } : {}),\n    ...(url.scheme !== undefined ? { \"url.scheme\": url.scheme } : {}),\n    ...(url.host !== undefined ? { \"server.address\": url.host } : {}),\n    ...(url.port !== undefined ? { \"server.port\": url.port } : {}),\n    ...(event.statusCode !== undefined\n      ? { \"http.response.status_code\": event.statusCode }\n      : {}),\n    ...(event.error !== undefined ? { \"error.type\": event.error } : {}),\n    ...frontendSessionAttribute(event),\n  };\n  // The shim already filters to CAPTURED_HEADERS; re-filter here so a stale or third-party\n  // shim can't persist sensitive headers via the sidecar.\n  for (const [name, values] of Object.entries(event.requestHeaders)) {\n    if (capturedHeaders.has(name.toLowerCase())) {\n      attributes[`http.request.header.${name}`] = values;\n    }\n  }\n  for (const [name, values] of Object.entries(event.responseHeaders ?? {})) {\n    if (capturedHeaders.has(name.toLowerCase())) {\n      attributes[`http.response.header.${name}`] = values;\n    }\n  }\n  return attributes;\n};\n\nconst buildStatus = (\n  event: InboundRequestEvent | OutboundRequestEvent | BindingRequestEvent,\n  kind: number,\n): SpanStatus => {\n  if (event.error !== undefined) {\n    return { code: SPAN_STATUS_ERROR, message: event.error };\n  }\n  // Standard OTel HTTP semantics: client spans error on 4xx/5xx, server spans only on 5xx.\n  const errorThreshold = kind === SPAN_KIND_CLIENT ? 400 : 500;\n  if (event.statusCode !== undefined && event.statusCode >= errorThreshold) {\n    return { code: SPAN_STATUS_ERROR };\n  }\n  return { code: SPAN_STATUS_UNSET };\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAkEA,IAAa,cAAb,MAAyB;;;;;;CAMvB,gCAAiC,IAAI,KAAgC;CAErE,MAAM,OAA0C;AAC9C,UAAQ,MAAM,MAAd;GACE,KAAK,UACH,QAAO,KAAK,iBAAiB,MAAM;GACrC,KAAK,WACH,QAAO,KAAK,kBAAkB,MAAM;GACtC,KAAK,UACH,QAAO,KAAK,iBAAiB,MAAM;GACrC,KAAK,KACH,QAAO,KAAK,YAAY,MAAM;GAChC,KAAK,WACH,QAAO,KAAK,kBAAkB,MAAM;GACtC,QAEE,QAAO;;;CAIb,iBAAyB,OAA0C;EACjE,MAAM,MAAM,KAAK,WAAW,MAAM;EAClC,MAAM,MAAM,SAAS,MAAM,IAAI;EAC/B,MAAM,aAAa,oBAAoB,OAAO,IAAI;AAKlD,MAAI,MAAM,oBAAoB,KAAA,EAC5B,YAAW,0BAA0B,MAAM;AAG7C,SAAO;GACL,MAAM,GAAG,MAAM,OAAO,GAAG,IAAI;GAC7B,MAAA;GACA,QAAQ,YAAY,OAAA,EAAwB;GAC5C,WAAW,WAAW,MAAM,YAAY;GACxC,SAAS,WAAW,MAAM,UAAU;GACpC,UAAU,WAAW,KAAK,IAAI,GAAG,MAAM,YAAY,MAAM,YAAY,CAAC;GACtE;GACA,oBAAoB;IAClB,SAAS,IAAI;IACb,QAAQ,IAAI;IACb;GACF;;CAGH,kBAA0B,OAA2C;AACnE,SAAO,KAAK,oBACV,OACA,iCACA,MAAM,OACP;;;;;;CAOH,iBAAyB,OAA0C;AACjE,SAAO,KAAK,oBACV,OACA,mCACA,GAAG,MAAM,OAAO,GAAG,MAAM,eAAe,cACxC,MAAM,gBAAgB,KAAA,IAClB,GAAG,4BAA4B,MAAM,aAAa,GAClD,KAAA,EACL;;;;;;;;CASH,YAAoB,OAAuC;EACzD,MAAM,aAAsC;IACzC,yBAAyB;IACzB,4BAA4B,MAAM;GACnC,GAAI,MAAM,gBAAgB,KAAA,IACtB,GAAG,4BAA4B,MAAM,aAAa,GAClD,EAAE;GACN,GAAI,MAAM,QAAQ,KAAA,IAAY,GAAG,sBAAsB,MAAM,KAAK,GAAG,EAAE;GACvE,GAAI,MAAM,YAAY,KAAA,IAClB,GAAG,0BAA0B,MAAM,SAAS,GAC5C,EAAE;GACN,GAAI,MAAM,UAAU,KAAA,IAAY,EAAE,cAAc,MAAM,OAAO,GAAG,EAAE;GAClE,GAAG,yBAAyB,MAAM;GACnC;AACD,MAAI,MAAM,SAAS,KAAA,GAAW;AAC5B,cAAW,wBAAwB,MAAM,KAAK;AAC9C,cAAW,kCAAkC,MAAM,KAAK;;AAE1D,MAAI,MAAM,UAAU,KAAA,GAAW;AAC7B,cAAW,yBAAyB,MAAM,MAAM;AAChD,cAAW,mCAAmC,MAAM,MAAM;;AAE5D,MAAI,MAAM,WAAW,KAAA,GAAW;AAC9B,cAAW,0BAA0B,MAAM,OAAO;AAClD,cAAW,oCAAoC,MAAM,OAAO;;AAG9D,SAAO,KAAK,gBACV,OACA,MAAM,MAAM,eAAe,WAAW,GAAG,MAAM,aAC/C,YACA,MAAM,UAAU,KAAA,IACZ;GAAE,MAAA;GAAyB,SAAS,MAAM;GAAO,GACjD,EAAE,MAAA,GAAyB,CAChC;;;;;;CAOH,kBAA0B,OAAyC;EACjE,MAAM,aAAsC;IACzC,yBAAyB;IACzB,8BAA8B,MAAM;IACpC,gCAAgC,MAAM;IACtC,4BAA4B,MAAM;GACnC,GAAG,yBAAyB,MAAM;GACnC;AACD,MAAI,MAAM,WAAW,KAAA,GAAW;GAG9B,MAAM,YACJ,MAAM,OAAO,aACb,MAAM,OAAO,KAAK,SAAA;AACpB,cAAW,2BAA2B,YAClC,MAAM,OAAO,KAAK,MAAM,GAAG,4BAA4B,GACvD,MAAM,OAAO;AACjB,cAAW,qCAAqC;;AAElD,MAAI,MAAM,cAAc,KAAA,EACtB,YAAW,0BAA0B,MAAM;AAG7C,SAAO,KAAK,gBACV,OACA,cAAc,oBAAoB,MAAM,UAAU,IAClD,YACA,MAAM,cAAc,KAAA,IAChB,EAAE,MAAA,GAAyB,GAC3B,EAAE,MAAA,GAAyB,CAChC;;CAGH,oBACE,OACA,YACA,MACA,iBACc;EAEd,MAAM,aAAa,oBAAoB,OAD3B,SAAS,MAAM,IACsB,CAAC;AAClD,aAAW,0BAA0B;AACrC,SAAO,OAAO,YAAY,gBAAgB;AAC1C,MAAI,MAAM,gBAAgB,KAAA,GAAW;AACnC,cAAW,uBAAuB,MAAM,YAAY;AACpD,cAAW,iCAAiC,MAAM,YAAY;;AAEhE,MAAI,MAAM,iBAAiB,KAAA,GAAW;AACpC,cAAW,wBAAwB,MAAM,aAAa;AACtD,cAAW,kCAAkC,MAAM,aAAa;AAChE,OAAI,MAAM,aAAa,aAAa,KAAA,EAClC,YAAW,oCACT,MAAM,aAAa;;AAIzB,SAAO,KAAK,gBACV,OACA,MACA,YACA,YAAY,OAAA,EAAwB,CACrC;;CAGH,gBACE,OACA,MACA,YACA,QACc;EACd,MAAM,MAAM,KAAK,WAAW,MAAM;EAClC,MAAM,SAAS,UAAU,EAAE;AAC3B,SAAO;GACL;GACA,cAAc,IAAI;GAClB,MAAA;GACA;GACA,WAAW,WAAW,MAAM,YAAY;GACxC,SAAS,WAAW,MAAM,UAAU;GACpC,UAAU,WAAW,KAAK,IAAI,GAAG,MAAM,YAAY,MAAM,YAAY,CAAC;GACtE;GACA,oBAAoB;IAAE,SAAS,IAAI;IAAS;IAAQ;GACrD;;;;;;CAOH,WAAmB,OAAwC;AACzD,MAAI,MAAM,YAAY,KAAA,KAAa,MAAM,iBAAiB,KAAA,EACxD,QAAO;GACL,SAAS,MAAM;GACf,cAAc,MAAM;GACpB,YAAY,MAAM;GACnB;EAEH,MAAM,WAAW,KAAK,cAAc,IAAI,MAAM,UAAU;AACxD,MAAI,UAAU;AACZ,YAAS,aAAa,MAAM;AAC5B,UAAO;;AAET,OAAK,mBAAmB,MAAM,UAAU;EACxC,MAAM,QAA2B;GAC/B,SAAS,UAAU,GAAG;GACtB,cAAc,UAAU,EAAE;GAC1B,YAAY,MAAM;GACnB;AACD,OAAK,cAAc,IAAI,MAAM,WAAW,MAAM;AAC9C,SAAO;;CAGT,mBAA2B,OAAqB;AAC9C,MAAI,KAAK,cAAc,OAAO,8BAC5B;AAEF,OAAK,MAAM,CAAC,WAAW,UAAU,KAAK,cACpC,KAAI,QAAQ,MAAM,aAAa,qBAC7B,MAAK,cAAc,OAAO,UAAU;;;AAY5C,MAAM,uBAAuB,MAAU;AACvC,MAAM,gCAAgC;AAEtC,MAAM,MAAM;;AAGZ,MAAa,aAAa,UAA0B;CAClD,MAAM,SAAS,OAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;CAC5D,IAAI,MAAM;AACV,MAAK,MAAM,QAAQ,OACjB,QAAO,IAAI,QAAQ,KAAK,IAAI,OAAO;AAErC,QAAO;;AAGT,MAAM,kBAAkB,IAAI,IAAY,iBAAiB;AAWzD,MAAM,YAAY,QAA2B;AAC3C,KAAI;EACF,MAAM,MAAM,qBAAqB,IAAI,IAAI,IAAI,CAAC;EAC9C,MAAM,cAAc,IAAI,aAAa,WAAW,MAAM;AACtD,SAAO;GACL,MAAM,IAAI,UAAU;GACpB,MAAM,IAAI;GACV,OAAO,IAAI,SAAS,IAAI,OAAO,MAAM,EAAE,GAAG,KAAA;GAC1C,QAAQ,IAAI,SAAS,QAAQ,MAAM,GAAG;GACtC,MAAM,IAAI;GACV,MAAM,IAAI,OAAO,SAAS,IAAI,MAAM,GAAG,GAAG;GAC3C;SACK;AACN,SAAO;GACL,MAAM;GACN,MAAM,IAAI,MAAM,IAAI,CAAC,MAAM;GAC3B,OAAO,KAAA;GACP,QAAQ,KAAA;GACR,MAAM,KAAA;GACN,MAAM,KAAA;GACP;;;AAIL,MAAM,4BACJ,UAEA,MAAM,sBAAsB,KAAA,IACxB,GAAG,2BAA2B,MAAM,mBAAmB,GACvD,EAAE;AAER,MAAM,uBACJ,OACA,QAC4B;CAC5B,MAAM,aAAsC;EAC1C,uBAAuB,MAAM;EAC7B,YAAY,IAAI;EAChB,YAAY,IAAI;EAChB,GAAI,IAAI,UAAU,KAAA,IAAY,EAAE,aAAa,IAAI,OAAO,GAAG,EAAE;EAC7D,GAAI,IAAI,WAAW,KAAA,IAAY,EAAE,cAAc,IAAI,QAAQ,GAAG,EAAE;EAChE,GAAI,IAAI,SAAS,KAAA,IAAY,EAAE,kBAAkB,IAAI,MAAM,GAAG,EAAE;EAChE,GAAI,IAAI,SAAS,KAAA,IAAY,EAAE,eAAe,IAAI,MAAM,GAAG,EAAE;EAC7D,GAAI,MAAM,eAAe,KAAA,IACrB,EAAE,6BAA6B,MAAM,YAAY,GACjD,EAAE;EACN,GAAI,MAAM,UAAU,KAAA,IAAY,EAAE,cAAc,MAAM,OAAO,GAAG,EAAE;EAClE,GAAG,yBAAyB,MAAM;EACnC;AAGD,MAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,MAAM,eAAe,CAC/D,KAAI,gBAAgB,IAAI,KAAK,aAAa,CAAC,CACzC,YAAW,uBAAuB,UAAU;AAGhD,MAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,MAAM,mBAAmB,EAAE,CAAC,CACtE,KAAI,gBAAgB,IAAI,KAAK,aAAa,CAAC,CACzC,YAAW,wBAAwB,UAAU;AAGjD,QAAO;;AAGT,MAAM,eACJ,OACA,SACe;AACf,KAAI,MAAM,UAAU,KAAA,EAClB,QAAO;EAAE,MAAA;EAAyB,SAAS,MAAM;EAAO;CAG1D,MAAM,iBAAiB,SAAA,IAA4B,MAAM;AACzD,KAAI,MAAM,eAAe,KAAA,KAAa,MAAM,cAAc,eACxD,QAAO,EAAE,MAAA,GAAyB;AAEpC,QAAO,EAAE,MAAA,GAAyB"}

package/dist/version.js

@@ -8,7 +8,7 @@
 * Replaced by tsdown's `define`. The guard keeps a direct source import
 * (vitest, typecheck) working, where no bundler has substituted the value.
 */
-const WORKERD_SHIM_VERSION = "2.343.0";
+const WORKERD_SHIM_VERSION = "2.346.0";
 //#endregion
 export { WORKERD_SHIM_VERSION };
 

package/dist/with-meticulous.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-meticulous.js","names":[],"sources":["../src/with-meticulous.ts"],"sourcesContent":["import { installBindingPatch } from \"./binding-patch\";\nimport { CaptureBuffer } from \"./capture-buffer\";\nimport {\n  type RequestCaptureContext,\n  type RequestReplayContext,\n  requestCaptureContext,\n} from \"./context\";\nimport { runReplayWithCoverage } from \"./coverage/replay-coverage\";\nimport { installFetchPatch } from \"./fetch-patch\";\nimport { isHealthProbeRequest } from \"./health-probe\";\nimport { installKvPatch } from \"./kv-patch\";\nimport { warnOnce } from \"./log\";\nimport { getOriginalFetch } from \"./original-fetch\";\nimport { headersToRecord } from \"./outbound-capture\";\nimport {\n  FRONTEND_SESSION_ID_HEADER,\n  type InboundRequestEvent,\n  parseVirtualTimeMs,\n  REPLAY_ID_HEADER,\n  REPLAY_SIDECAR_URL_HEADER,\n  VIRTUAL_TIME_HEADER,\n} from \"./protocol\";\nimport {\n  isProvisionalSessionIdCandidate,\n  mintProvisionalSessionId,\n} from \"./provisional-session-id\";\nimport { publishSessionIdOnResponse } from \"./publish-session-id\";\nimport { publishWorkerdShimVersionOnResponse } from \"./publish-shim-version\";\nimport { installReplayLogTagging } from \"./replay-log-tagging\";\nimport { parseReplaySidecarUrl } from \"./replay-sidecar-url\";\nimport { getReplaySessionInfo } from \"./sidecar-client\";\nimport {\n  resolveSidecarTransport,\n  type SidecarFetcher,\n  type SidecarTransport,\n} from \"./sidecar-transport\";\nimport { randomHex } from \"./spans/span-builder\";\nimport { installVirtualClock } from \"./virtual-clock\";\nimport { installVirtualRandom } from \"./virtual-random\";\n\n/** Structural subset of workerd's ExecutionContext — avoids a @cloudflare/workers-types dependency. */\nexport interface MeticulousExecutionContext {\n  waitUntil(promise: Promise<unknown>): void;\n}\n\nexport interface WithMeticulousOptions {\n  /**\n   * Overrides the sidecar service binding; defaults to the `METICULOUS_SIDECAR` binding on\n   * `env`. This is how a **deployed** Worker records — see {@link SidecarTransport}.\n   */\n  sidecarBinding?: SidecarFetcher;\n  /** Overrides the sidecar origin; defaults to the METICULOUS_SIDECAR_URL var/binding. */\n  sidecarUrl?: string;\n  /**\n   * Binding names to leave unrecorded, on top of the defaults (`ASSETS`, `__STATIC_CONTENT`,\n   * `METICULOUS_SIDECAR`). Use this for a binding whose traffic is high-volume or binary. Applies\n   * to KV namespaces as well as `fetch`-shaped bindings.\n   */\n  skipBindings?: readonly string[];\n  /**\n   * Whether to mint a session id for a document navigation that carries none, so the\n   * server-side render is recorded under the same session as the page it produces. On by\n   * default; set `false` (or the `METICULOUS_BACKEND_PROVISIONAL_SESSION_IDS` var to\n   * `\"false\"`) to opt out. See provisional-session-id.ts.\n   */\n  mintProvisionalSessionIds?: boolean;\n}\n\n/** What the mode-agnostic core needs from whichever handler shape wraps it. */\nexport interface MeticulousInvocation {\n  request: Request;\n  env: unknown;\n  ctx: MeticulousExecutionContext;\n  invokeHandler: () => Response | Promise<Response>;\n}\n\n/**\n * Records, or replays, one inbound request. Shared by `withMeticulous` (an ES-module Worker's\n * `fetch`) and `withMeticulousPagesFunction` (a Pages Functions `onRequest`), which differ only\n * in how they get at the request, the env and `waitUntil`.\n */\nexport const runWithMeticulous = async (\n  { request, env, ctx, invokeHandler }: MeticulousInvocation,\n  options: WithMeticulousOptions | undefined,\n): Promise<Response> => {\n  let transport: SidecarTransport | undefined;\n  let replayContext: RequestReplayContext | undefined;\n  try {\n    replayContext = await resolveReplayContext(request, ctx);\n    transport =\n      replayContext === undefined\n        ? resolveSidecarTransport(options, env)\n        : undefined;\n    if (replayContext !== undefined || transport !== undefined) {\n      installFetchPatch();\n    }\n    if (transport !== undefined) {\n      // Lazily, inside the request path, and never at module scope: the package declares no\n      // `sideEffects` and is built with `platform: \"neutral\"`, so a module-scope side effect can\n      // legitimately be tree-shaken by a customer's bundler. Re-run per request because `env` is\n      // the only handle on the binding instances.\n      //\n      // Record mode only. Binding and KV calls are recorded as their own technologies\n      // (`workerd-binding`, `workerd-kv`) and the replay sidecar's store holds only\n      // `workerd-fetch` spans, so there is nothing to serve them from — and patching would only\n      // route them into the capture tee, which POSTs to an events route a replay sidecar 404s.\n      //\n      // `skipInstances` keeps the sidecar's own binding out of the recording by identity rather\n      // than by name, so it holds however the customer named it or passed it in.\n      const patchOptions = {\n        ...(options?.skipBindings !== undefined\n          ? { skipBindings: options.skipBindings }\n          : {}),\n        ...(transport.kind === \"binding\"\n          ? { skipInstances: [transport.instance] }\n          : {}),\n      };\n      installBindingPatch(env, patchOptions);\n      installKvPatch(env, patchOptions);\n    }\n  } catch (error) {\n    warnOnce(\n      \"shim-init\",\n      \"Failed to initialize the Meticulous backend recorder shim — recording disabled.\",\n      error,\n    );\n    replayContext = undefined;\n    transport = undefined;\n  }\n\n  if (replayContext !== undefined) {\n    // Workerd has no process.stdout/process.stderr seam like Node. Patch its\n    // console methods instead; each call resolves this request's replay id from\n    // the AsyncLocalStorage entered below.\n    installReplayLogTagging();\n    // Install the clock before any app code runs, so a module that reads Date.now() at call time\n    // (the firebase auth libraries do) sees the session's frozen instant.\n    installVirtualClock();\n    // Likewise the random generators: an id the app mints during SSR (a guest id, a request id)\n    // otherwise differs between a base and a head replay, and every rendered page carrying it\n    // diffs forever.\n    installVirtualRandom();\n    // No inbound reporting in replay mode: there is no exporter behind the replay sidecar, and\n    // the events route 404s there.\n    const replayResponse = await runReplayWithCoverage(\n      replayContext,\n      invokeHandler,\n    );\n    return publishWorkerdShimVersionOnResponse(replayResponse);\n  }\n\n  if (transport === undefined) {\n    return invokeHandler();\n  }\n\n  // Never enter the capture context for a health probe, so neither the inbound request nor\n  // anything it fans out to is recorded. The fetch, binding and KV patches are all\n  // pass-throughs without a context, so this covers the whole subtree in one place.\n  if (\n    isHealthProbeRequest(request.method, request.url, (name) =>\n      request.headers.get(name),\n    )\n  ) {\n    return invokeHandler();\n  }\n\n  const captureCtx = buildCaptureContext(\n    request,\n    transport,\n    ctx,\n    resolveMintProvisionalSessionIds(options, env),\n  );\n  const mintedSessionId =\n    captureCtx.sessionIdOrigin === \"backend\"\n      ? captureCtx.frontendSessionId\n      : undefined;\n  const startTimeMs = Date.now();\n  let requestHeaders: Record<string, string[]> = {};\n  let method = \"GET\";\n  let url = \"\";\n  try {\n    requestHeaders = headersToRecord(request.headers);\n    method = request.method;\n    url = request.url;\n  } catch (error) {\n    warnOnce(\n      \"inbound-capture\",\n      \"Failed to capture the inbound request.\",\n      error,\n    );\n  }\n\n  const reportInbound = (\n    outcome:\n      | { statusCode: number; responseHeaders: Record<string, string[]> }\n      | { error: string },\n  ): void => {\n    try {\n      const event: InboundRequestEvent = {\n        kind: \"inbound\",\n        requestId: captureCtx.requestId,\n        ...(captureCtx.frontendSessionId !== undefined\n          ? { frontendSessionId: captureCtx.frontendSessionId }\n          : {}),\n        ...(captureCtx.sessionIdOrigin !== undefined\n          ? { sessionIdOrigin: captureCtx.sessionIdOrigin }\n          : {}),\n        traceId: captureCtx.traceId,\n        serverSpanId: captureCtx.serverSpanId,\n        method,\n        url,\n        requestHeaders,\n        startTimeMs,\n        endTimeMs: Date.now(),\n        ...outcome,\n      };\n      captureCtx.buffer.add(event);\n    } catch (error) {\n      warnOnce(\n        \"inbound-report\",\n        \"Failed to report the inbound request.\",\n        error,\n      );\n    }\n  };\n\n  let response: Response;\n  try {\n    response = await requestCaptureContext.run(captureCtx, invokeHandler);\n  } catch (error) {\n    reportInbound({ error: String(error) });\n    closeBuffer(captureCtx);\n    throw error;\n  }\n\n  // Ahead of reporting, so what we record as the response headers is what the browser is\n  // actually served.\n  if (mintedSessionId !== undefined) {\n    response = publishSessionIdOnResponse(response, mintedSessionId);\n  }\n  response = publishWorkerdShimVersionOnResponse(response);\n\n  try {\n    reportInbound({\n      statusCode: response.status,\n      responseHeaders: headersToRecord(response.headers),\n    });\n  } catch (error) {\n    warnOnce(\"inbound-report\", \"Failed to report the inbound request.\", error);\n  }\n  closeBuffer(captureCtx);\n  return response;\n};\n\n/**\n * Hands the request's single report to `waitUntil`. `close()` drains the outstanding body reads\n * first, which is why there is one `waitUntil` per request rather than one per captured call.\n */\nconst closeBuffer = (ctx: RequestCaptureContext): void => {\n  try {\n    ctx.waitUntil(ctx.buffer.close());\n  } catch (error) {\n    warnOnce(\n      \"buffer-close\",\n      \"ctx.waitUntil failed — capture events may be lost.\",\n      error,\n    );\n  }\n};\n\n/**\n * Whether this request should be replayed, and the context to serve it under.\n *\n * Both replay identity ids and a usable sidecar URL must be present: mocks are indexed per session\n * and consumed per replay. The sidecar is consulted once per (sidecar, session) per isolate to\n * confirm it holds mocks and to learn the clock anchor — a sidecar that does not recognise the\n * session, or the route, means replay is unavailable and the request runs normally.\n */\nconst resolveReplayContext = async (\n  request: Request,\n  ctx: MeticulousExecutionContext,\n): Promise<RequestReplayContext | undefined> => {\n  let sidecarUrl: string | undefined;\n  let frontendSessionId: string | undefined;\n  let replayId: string | undefined;\n  let virtualTimeMs: number | undefined;\n  try {\n    sidecarUrl = parseReplaySidecarUrl(\n      request.headers.get(REPLAY_SIDECAR_URL_HEADER),\n    );\n    frontendSessionId =\n      request.headers.get(FRONTEND_SESSION_ID_HEADER) ?? undefined;\n    replayId = request.headers.get(REPLAY_ID_HEADER) ?? undefined;\n    virtualTimeMs = parseVirtualTimeMs(\n      request.headers.get(VIRTUAL_TIME_HEADER),\n    );\n  } catch {\n    return undefined;\n  }\n  if (\n    sidecarUrl === undefined ||\n    frontendSessionId === undefined ||\n    replayId === undefined\n  ) {\n    return undefined;\n  }\n\n  const info = await getCachedReplaySessionInfo(sidecarUrl, frontendSessionId);\n  if (info === null) {\n    return undefined;\n  }\n\n  return {\n    mode: \"replay\",\n    requestId: crypto.randomUUID(),\n    frontendSessionId,\n    replayId,\n    sidecarUrl,\n    clockAnchorMs: info.clockAnchorMs,\n    ...(virtualTimeMs !== undefined ? { virtualTimeMs } : {}),\n    waitUntil: buildWaitUntil(ctx),\n  };\n};\n\n// Caches the promise, not the result, so concurrent first requests share one round trip.\n// Bounded so a stream of unrecognised session ids cannot grow it without limit.\nconst MAX_CACHED_SESSIONS = 50;\nconst replaySessionInfoCache = new Map<\n  string,\n  Promise<{ clockAnchorMs: number | undefined } | null>\n>();\n\nconst getCachedReplaySessionInfo = (\n  sidecarUrl: string,\n  frontendSessionId: string,\n): Promise<{ clockAnchorMs: number | undefined } | null> => {\n  const key = `${sidecarUrl}\u0000${frontendSessionId}`;\n  const cached = replaySessionInfoCache.get(key);\n  if (cached !== undefined) {\n    return cached;\n  }\n  const pending = getReplaySessionInfo(\n    getOriginalFetch(),\n    sidecarUrl,\n    frontendSessionId,\n  ).then((result) => {\n    if (result.outcome === \"unreachable\") {\n      // Only settled answers are worth keeping. Caching a timeout or transport blip would\n      // disable mocking for this session for the life of the isolate, quietly sending every\n      // later outbound call to the real service — the failure this path exists to prevent.\n      // Dropping the entry costs one extra handshake and lets the next request recover.\n      replaySessionInfoCache.delete(key);\n      return null;\n    }\n    return result.outcome === \"found\"\n      ? { clockAnchorMs: result.clockAnchorMs }\n      : null;\n  });\n  if (replaySessionInfoCache.size >= MAX_CACHED_SESSIONS) {\n    const oldest = replaySessionInfoCache.keys().next();\n    if (!oldest.done) {\n      replaySessionInfoCache.delete(oldest.value);\n    }\n  }\n  replaySessionInfoCache.set(key, pending);\n  return pending;\n};\n\nconst buildCaptureContext = (\n  request: Request,\n  transport: SidecarTransport,\n  ctx: MeticulousExecutionContext,\n  mintProvisionalSessionIds: boolean,\n): RequestCaptureContext => {\n  let frontendSessionId: string | undefined;\n  let sessionIdOrigin: \"backend\" | undefined;\n  try {\n    frontendSessionId =\n      request.headers.get(FRONTEND_SESSION_ID_HEADER) ?? undefined;\n    // A top-level document navigation cannot carry the header, so for one we mint the id\n    // ourselves and hand it to the page on the response — otherwise the server-side render this\n    // request is about is recorded against no session at all. Every outbound, binding, KV and\n    // postgres event reads the id back off this context, so putting it here attributes the whole\n    // request. See provisional-session-id.ts.\n    if (\n      mintProvisionalSessionIds &&\n      frontendSessionId === undefined &&\n      isProvisionalSessionIdCandidate(request.method, (name) =>\n        request.headers.get(name),\n      )\n    ) {\n      frontendSessionId = mintProvisionalSessionId();\n      sessionIdOrigin = \"backend\";\n    }\n  } catch {\n    frontendSessionId = undefined;\n    sessionIdOrigin = undefined;\n  }\n  const waitUntil = buildWaitUntil(ctx);\n  return {\n    mode: \"record\",\n    requestId: crypto.randomUUID(),\n    frontendSessionId,\n    ...(sessionIdOrigin !== undefined ? { sessionIdOrigin } : {}),\n    transport,\n    buffer: new CaptureBuffer(transport, waitUntil),\n    traceId: randomHex(16),\n    serverSpanId: randomHex(8),\n    waitUntil,\n  };\n};\n\n/**\n * On by default: the render it attributes — the page's very first — is otherwise recorded\n * against no session at all, and the only thing that reaches a replay for those spans is\n * ingestion's time-window guess.\n *\n * Opting out is a worker var rather than a host environment variable for the same reason the\n * sidecar URL is: workerd cannot see the host's environment.\n */\nconst resolveMintProvisionalSessionIds = (\n  options: WithMeticulousOptions | undefined,\n  env: unknown,\n): boolean => {\n  if (options?.mintProvisionalSessionIds !== undefined) {\n    return options.mintProvisionalSessionIds;\n  }\n  const fromEnv =\n    env !== null && typeof env === \"object\"\n      ? (env as Record<string, unknown>)[\n          \"METICULOUS_BACKEND_PROVISIONAL_SESSION_IDS\"\n        ]\n      : undefined;\n  return fromEnv !== \"false\";\n};\n\nconst buildWaitUntil =\n  (ctx: MeticulousExecutionContext) =>\n  (promise: Promise<unknown>): void => {\n    try {\n      ctx.waitUntil(promise);\n    } catch (error) {\n      warnOnce(\n        \"wait-until\",\n        \"ctx.waitUntil failed — capture events may be lost.\",\n        error,\n      );\n    }\n  };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAiFA,MAAa,oBAAoB,OAC/B,EAAE,SAAS,KAAK,KAAK,iBACrB,YACsB;CACtB,IAAI;CACJ,IAAI;AACJ,KAAI;AACF,kBAAgB,MAAM,qBAAqB,SAAS,IAAI;AACxD,cACE,kBAAkB,KAAA,IACd,wBAAwB,SAAS,IAAI,GACrC,KAAA;AACN,MAAI,kBAAkB,KAAA,KAAa,cAAc,KAAA,EAC/C,oBAAmB;AAErB,MAAI,cAAc,KAAA,GAAW;GAa3B,MAAM,eAAe;IACnB,GAAI,SAAS,iBAAiB,KAAA,IAC1B,EAAE,cAAc,QAAQ,cAAc,GACtC,EAAE;IACN,GAAI,UAAU,SAAS,YACnB,EAAE,eAAe,CAAC,UAAU,SAAS,EAAE,GACvC,EAAE;IACP;AACD,uBAAoB,KAAK,aAAa;AACtC,kBAAe,KAAK,aAAa;;UAE5B,OAAO;AACd,WACE,aACA,mFACA,MACD;AACD,kBAAgB,KAAA;AAChB,cAAY,KAAA;;AAGd,KAAI,kBAAkB,KAAA,GAAW;AAI/B,2BAAyB;AAGzB,uBAAqB;AAIrB,wBAAsB;AAOtB,SAAO,oCAAoC,MAJd,sBAC3B,eACA,cACD,CACyD;;AAG5D,KAAI,cAAc,KAAA,EAChB,QAAO,eAAe;AAMxB,KACE,qBAAqB,QAAQ,QAAQ,QAAQ,MAAM,SACjD,QAAQ,QAAQ,IAAI,KAAK,CAC1B,CAED,QAAO,eAAe;CAGxB,MAAM,aAAa,oBACjB,SACA,WACA,KACA,iCAAiC,SAAS,IAAI,CAC/C;CACD,MAAM,kBACJ,WAAW,oBAAoB,YAC3B,WAAW,oBACX,KAAA;CACN,MAAM,cAAc,KAAK,KAAK;CAC9B,IAAI,iBAA2C,EAAE;CACjD,IAAI,SAAS;CACb,IAAI,MAAM;AACV,KAAI;AACF,mBAAiB,gBAAgB,QAAQ,QAAQ;AACjD,WAAS,QAAQ;AACjB,QAAM,QAAQ;UACP,OAAO;AACd,WACE,mBACA,0CACA,MACD;;CAGH,MAAM,iBACJ,YAGS;AACT,MAAI;GACF,MAAM,QAA6B;IACjC,MAAM;IACN,WAAW,WAAW;IACtB,GAAI,WAAW,sBAAsB,KAAA,IACjC,EAAE,mBAAmB,WAAW,mBAAmB,GACnD,EAAE;IACN,GAAI,WAAW,oBAAoB,KAAA,IAC/B,EAAE,iBAAiB,WAAW,iBAAiB,GAC/C,EAAE;IACN,SAAS,WAAW;IACpB,cAAc,WAAW;IACzB;IACA;IACA;IACA;IACA,WAAW,KAAK,KAAK;IACrB,GAAG;IACJ;AACD,cAAW,OAAO,IAAI,MAAM;WACrB,OAAO;AACd,YACE,kBACA,yCACA,MACD;;;CAIL,IAAI;AACJ,KAAI;AACF,aAAW,MAAM,sBAAsB,IAAI,YAAY,cAAc;UAC9D,OAAO;AACd,gBAAc,EAAE,OAAO,OAAO,MAAM,EAAE,CAAC;AACvC,cAAY,WAAW;AACvB,QAAM;;AAKR,KAAI,oBAAoB,KAAA,EACtB,YAAW,2BAA2B,UAAU,gBAAgB;AAElE,YAAW,oCAAoC,SAAS;AAExD,KAAI;AACF,gBAAc;GACZ,YAAY,SAAS;GACrB,iBAAiB,gBAAgB,SAAS,QAAQ;GACnD,CAAC;UACK,OAAO;AACd,WAAS,kBAAkB,yCAAyC,MAAM;;AAE5E,aAAY,WAAW;AACvB,QAAO;;;;;;AAOT,MAAM,eAAe,QAAqC;AACxD,KAAI;AACF,MAAI,UAAU,IAAI,OAAO,OAAO,CAAC;UAC1B,OAAO;AACd,WACE,gBACA,sDACA,MACD;;;;;;;;;;;AAYL,MAAM,uBAAuB,OAC3B,SACA,QAC8C;CAC9C,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;AACJ,KAAI;AACF,eAAa,sBACX,QAAQ,QAAQ,IAAI,0BAA0B,CAC/C;AACD,sBACE,QAAQ,QAAQ,IAAA,0BAA+B,IAAI,KAAA;AACrD,aAAW,QAAQ,QAAQ,IAAA,yBAAqB,IAAI,KAAA;AACpD,kBAAgB,mBACd,QAAQ,QAAQ,IAAI,oBAAoB,CACzC;SACK;AACN;;AAEF,KACE,eAAe,KAAA,KACf,sBAAsB,KAAA,KACtB,aAAa,KAAA,EAEb;CAGF,MAAM,OAAO,MAAM,2BAA2B,YAAY,kBAAkB;AAC5E,KAAI,SAAS,KACX;AAGF,QAAO;EACL,MAAM;EACN,WAAW,OAAO,YAAY;EAC9B;EACA;EACA;EACA,eAAe,KAAK;EACpB,GAAI,kBAAkB,KAAA,IAAY,EAAE,eAAe,GAAG,EAAE;EACxD,WAAW,eAAe,IAAI;EAC/B;;AAKH,MAAM,sBAAsB;AAC5B,MAAM,yCAAyB,IAAI,KAGhC;AAEH,MAAM,8BACJ,YACA,sBAC0D;CAC1D,MAAM,MAAM,GAAG,WAAW,GAAG;CAC7B,MAAM,SAAS,uBAAuB,IAAI,IAAI;AAC9C,KAAI,WAAW,KAAA,EACb,QAAO;CAET,MAAM,UAAU,qBACd,kBAAkB,EAClB,YACA,kBACD,CAAC,MAAM,WAAW;AACjB,MAAI,OAAO,YAAY,eAAe;AAKpC,0BAAuB,OAAO,IAAI;AAClC,UAAO;;AAET,SAAO,OAAO,YAAY,UACtB,EAAE,eAAe,OAAO,eAAe,GACvC;GACJ;AACF,KAAI,uBAAuB,QAAQ,qBAAqB;EACtD,MAAM,SAAS,uBAAuB,MAAM,CAAC,MAAM;AACnD,MAAI,CAAC,OAAO,KACV,wBAAuB,OAAO,OAAO,MAAM;;AAG/C,wBAAuB,IAAI,KAAK,QAAQ;AACxC,QAAO;;AAGT,MAAM,uBACJ,SACA,WACA,KACA,8BAC0B;CAC1B,IAAI;CACJ,IAAI;AACJ,KAAI;AACF,sBACE,QAAQ,QAAQ,IAAA,0BAA+B,IAAI,KAAA;AAMrD,MACE,6BACA,sBAAsB,KAAA,KACtB,gCAAgC,QAAQ,SAAS,SAC/C,QAAQ,QAAQ,IAAI,KAAK,CAC1B,EACD;AACA,uBAAoB,0BAA0B;AAC9C,qBAAkB;;SAEd;AACN,sBAAoB,KAAA;AACpB,oBAAkB,KAAA;;CAEpB,MAAM,YAAY,eAAe,IAAI;AACrC,QAAO;EACL,MAAM;EACN,WAAW,OAAO,YAAY;EAC9B;EACA,GAAI,oBAAoB,KAAA,IAAY,EAAE,iBAAiB,GAAG,EAAE;EAC5D;EACA,QAAQ,IAAI,cAAc,WAAW,UAAU;EAC/C,SAAS,UAAU,GAAG;EACtB,cAAc,UAAU,EAAE;EAC1B;EACD;;;;;;;;;;AAWH,MAAM,oCACJ,SACA,QACY;AACZ,KAAI,SAAS,8BAA8B,KAAA,EACzC,QAAO,QAAQ;AAQjB,SALE,QAAQ,QAAQ,OAAO,QAAQ,WAC1B,IACC,gDAEF,KAAA,OACa;;AAGrB,MAAM,kBACH,SACA,YAAoC;AACnC,KAAI;AACF,MAAI,UAAU,QAAQ;UACf,OAAO;AACd,WACE,cACA,sDACA,MACD"}
+{"version":3,"file":"with-meticulous.js","names":[],"sources":["../src/with-meticulous.ts"],"sourcesContent":["import { installBindingPatch } from \"./binding-patch\";\nimport { CaptureBuffer } from \"./capture-buffer\";\nimport {\n  type RequestAgentSwarmTestingContext,\n  type RequestCaptureContext,\n  type RequestReplayContext,\n  requestCaptureContext,\n} from \"./context\";\nimport { runReplayWithCoverage } from \"./coverage/replay-coverage\";\nimport { installFetchPatch } from \"./fetch-patch\";\nimport { isHealthProbeRequest } from \"./health-probe\";\nimport { installKvPatch } from \"./kv-patch\";\nimport { warnOnce } from \"./log\";\nimport { getOriginalFetch } from \"./original-fetch\";\nimport { headersToRecord } from \"./outbound-capture\";\nimport {\n  AGENT_SWARM_TESTING_RUN_ID_ENV_KEY,\n  AGENT_SWARM_TESTING_SIDECAR_URL_ENV_KEY,\n  FRONTEND_SESSION_ID_HEADER,\n  type InboundRequestEvent,\n  parseVirtualTimeMs,\n  REPLAY_ID_HEADER,\n  REPLAY_SIDECAR_URL_HEADER,\n  VIRTUAL_TIME_HEADER,\n} from \"./protocol\";\nimport {\n  isProvisionalSessionIdCandidate,\n  mintProvisionalSessionId,\n} from \"./provisional-session-id\";\nimport { publishSessionIdOnResponse } from \"./publish-session-id\";\nimport { publishWorkerdShimVersionOnResponse } from \"./publish-shim-version\";\nimport { installReplayLogTagging } from \"./replay-log-tagging\";\nimport { parseSidecarUrl } from \"./sidecar-url\";\nimport { getReplaySessionInfo } from \"./sidecar-client\";\nimport {\n  resolveSidecarTransport,\n  type SidecarFetcher,\n  type SidecarTransport,\n} from \"./sidecar-transport\";\nimport { randomHex } from \"./spans/span-builder\";\nimport { installVirtualClock } from \"./virtual-clock\";\nimport { installVirtualRandom } from \"./virtual-random\";\n\n/** Structural subset of workerd's ExecutionContext — avoids a @cloudflare/workers-types dependency. */\nexport interface MeticulousExecutionContext {\n  waitUntil(promise: Promise<unknown>): void;\n}\n\nexport interface WithMeticulousOptions {\n  /**\n   * Overrides the sidecar service binding; defaults to the `METICULOUS_SIDECAR` binding on\n   * `env`. This is how a **deployed** Worker records — see {@link SidecarTransport}.\n   */\n  sidecarBinding?: SidecarFetcher;\n  /** Overrides the sidecar origin; defaults to the METICULOUS_SIDECAR_URL var/binding. */\n  sidecarUrl?: string;\n  /**\n   * Binding names to leave unrecorded, on top of the defaults (`ASSETS`, `__STATIC_CONTENT`,\n   * `METICULOUS_SIDECAR`). Use this for a binding whose traffic is high-volume or binary. Applies\n   * to KV namespaces as well as `fetch`-shaped bindings.\n   */\n  skipBindings?: readonly string[];\n  /**\n   * Whether to mint a session id for a document navigation that carries none, so the\n   * server-side render is recorded under the same session as the page it produces. On by\n   * default; set `false` (or the `METICULOUS_BACKEND_PROVISIONAL_SESSION_IDS` var to\n   * `\"false\"`) to opt out. See provisional-session-id.ts.\n   */\n  mintProvisionalSessionIds?: boolean;\n}\n\n/** What the mode-agnostic core needs from whichever handler shape wraps it. */\nexport interface MeticulousInvocation {\n  request: Request;\n  env: unknown;\n  ctx: MeticulousExecutionContext;\n  invokeHandler: () => Response | Promise<Response>;\n}\n\n/**\n * Records, replays, or runs agent-swarm testing on, one inbound request. Shared by\n * `withMeticulous` (an ES-module Worker's `fetch`) and `withMeticulousPagesFunction` (a Pages\n * Functions `onRequest`), which differ only in how they get at the request, the env and\n * `waitUntil`.\n *\n * Replay takes precedence over agent-swarm testing, and either over recording: nothing but\n * Meticulous's own runners emit the replay header, so a header present is a deliberate\n * choice, and the sidecar env vars a stale image can carry are not.\n */\nexport const runWithMeticulous = async (\n  { request, env, ctx, invokeHandler }: MeticulousInvocation,\n  options: WithMeticulousOptions | undefined,\n): Promise<Response> => {\n  let transport: SidecarTransport | undefined;\n  let replayContext: RequestReplayContext | undefined;\n  let agentSwarmTestingContext: RequestAgentSwarmTestingContext | undefined;\n  try {\n    replayContext = await resolveReplayContext(request, ctx);\n    if (replayContext === undefined) {\n      agentSwarmTestingContext = resolveAgentSwarmTestingContext(\n        request,\n        env,\n        ctx,\n      );\n    }\n    transport =\n      replayContext === undefined && agentSwarmTestingContext === undefined\n        ? resolveSidecarTransport(options, env)\n        : undefined;\n    if (\n      replayContext !== undefined ||\n      agentSwarmTestingContext !== undefined ||\n      transport !== undefined\n    ) {\n      installFetchPatch();\n    }\n    if (transport !== undefined) {\n      // Lazily, inside the request path, and never at module scope: the package declares no\n      // `sideEffects` and is built with `platform: \"neutral\"`, so a module-scope side effect can\n      // legitimately be tree-shaken by a customer's bundler. Re-run per request because `env` is\n      // the only handle on the binding instances.\n      //\n      // Record mode only. Binding and KV calls are recorded as their own technologies\n      // (`workerd-binding`, `workerd-kv`) and the replay sidecar's store holds only\n      // `workerd-fetch` spans, so there is nothing to serve them from — and patching would only\n      // route them into the capture tee, which POSTs to an events route a replay sidecar 404s.\n      //\n      // `skipInstances` keeps the sidecar's own binding out of the recording by identity rather\n      // than by name, so it holds however the customer named it or passed it in.\n      const patchOptions = {\n        ...(options?.skipBindings !== undefined\n          ? { skipBindings: options.skipBindings }\n          : {}),\n        ...(transport.kind === \"binding\"\n          ? { skipInstances: [transport.instance] }\n          : {}),\n      };\n      installBindingPatch(env, patchOptions);\n      installKvPatch(env, patchOptions);\n    }\n  } catch (error) {\n    warnOnce(\n      \"shim-init\",\n      \"Failed to initialize the Meticulous backend recorder shim — recording disabled.\",\n      error,\n    );\n    replayContext = undefined;\n    agentSwarmTestingContext = undefined;\n    transport = undefined;\n  }\n\n  if (replayContext !== undefined) {\n    // Workerd has no process.stdout/process.stderr seam like Node. Patch its\n    // console methods instead; each call resolves this request's replay id from\n    // the AsyncLocalStorage entered below.\n    installReplayLogTagging();\n    // Install the clock before any app code runs, so a module that reads Date.now() at call time\n    // (the firebase auth libraries do) sees the session's frozen instant.\n    installVirtualClock();\n    // Likewise the random generators: an id the app mints during SSR (a guest id, a request id)\n    // otherwise differs between a base and a head replay, and every rendered page carrying it\n    // diffs forever.\n    installVirtualRandom();\n    // No inbound reporting in replay mode: there is no exporter behind the replay sidecar, and\n    // the events route 404s there.\n    const replayResponse = await runReplayWithCoverage(\n      replayContext,\n      invokeHandler,\n    );\n    return publishWorkerdShimVersionOnResponse(replayResponse);\n  }\n\n  if (agentSwarmTestingContext !== undefined) {\n    const testingResponse = await requestCaptureContext.run(\n      agentSwarmTestingContext,\n      invokeHandler,\n    );\n    return publishWorkerdShimVersionOnResponse(testingResponse);\n  }\n\n  if (transport === undefined) {\n    return invokeHandler();\n  }\n\n  // Never enter the capture context for a health probe, so neither the inbound request nor\n  // anything it fans out to is recorded. The fetch, binding and KV patches are all\n  // pass-throughs without a context, so this covers the whole subtree in one place.\n  if (\n    isHealthProbeRequest(request.method, request.url, (name) =>\n      request.headers.get(name),\n    )\n  ) {\n    return invokeHandler();\n  }\n\n  const captureCtx = buildCaptureContext(\n    request,\n    transport,\n    ctx,\n    resolveMintProvisionalSessionIds(options, env),\n  );\n  const mintedSessionId =\n    captureCtx.sessionIdOrigin === \"backend\"\n      ? captureCtx.frontendSessionId\n      : undefined;\n  const startTimeMs = Date.now();\n  let requestHeaders: Record<string, string[]> = {};\n  let method = \"GET\";\n  let url = \"\";\n  try {\n    requestHeaders = headersToRecord(request.headers);\n    method = request.method;\n    url = request.url;\n  } catch (error) {\n    warnOnce(\n      \"inbound-capture\",\n      \"Failed to capture the inbound request.\",\n      error,\n    );\n  }\n\n  const reportInbound = (\n    outcome:\n      | { statusCode: number; responseHeaders: Record<string, string[]> }\n      | { error: string },\n  ): void => {\n    try {\n      const event: InboundRequestEvent = {\n        kind: \"inbound\",\n        requestId: captureCtx.requestId,\n        ...(captureCtx.frontendSessionId !== undefined\n          ? { frontendSessionId: captureCtx.frontendSessionId }\n          : {}),\n        ...(captureCtx.sessionIdOrigin !== undefined\n          ? { sessionIdOrigin: captureCtx.sessionIdOrigin }\n          : {}),\n        traceId: captureCtx.traceId,\n        serverSpanId: captureCtx.serverSpanId,\n        method,\n        url,\n        requestHeaders,\n        startTimeMs,\n        endTimeMs: Date.now(),\n        ...outcome,\n      };\n      captureCtx.buffer.add(event);\n    } catch (error) {\n      warnOnce(\n        \"inbound-report\",\n        \"Failed to report the inbound request.\",\n        error,\n      );\n    }\n  };\n\n  let response: Response;\n  try {\n    response = await requestCaptureContext.run(captureCtx, invokeHandler);\n  } catch (error) {\n    reportInbound({ error: String(error) });\n    closeBuffer(captureCtx);\n    throw error;\n  }\n\n  // Ahead of reporting, so what we record as the response headers is what the browser is\n  // actually served.\n  if (mintedSessionId !== undefined) {\n    response = publishSessionIdOnResponse(response, mintedSessionId);\n  }\n  response = publishWorkerdShimVersionOnResponse(response);\n\n  try {\n    reportInbound({\n      statusCode: response.status,\n      responseHeaders: headersToRecord(response.headers),\n    });\n  } catch (error) {\n    warnOnce(\"inbound-report\", \"Failed to report the inbound request.\", error);\n  }\n  closeBuffer(captureCtx);\n  return response;\n};\n\n/**\n * Hands the request's single report to `waitUntil`. `close()` drains the outstanding body reads\n * first, which is why there is one `waitUntil` per request rather than one per captured call.\n */\nconst closeBuffer = (ctx: RequestCaptureContext): void => {\n  try {\n    ctx.waitUntil(ctx.buffer.close());\n  } catch (error) {\n    warnOnce(\n      \"buffer-close\",\n      \"ctx.waitUntil failed — capture events may be lost.\",\n      error,\n    );\n  }\n};\n\n/**\n * Whether this request should be replayed, and the context to serve it under.\n *\n * Both replay identity ids and a usable sidecar URL must be present: mocks are indexed per session\n * and consumed per replay. The sidecar is consulted once per (sidecar, session) per isolate to\n * confirm it holds mocks and to learn the clock anchor — a sidecar that does not recognise the\n * session, or the route, means replay is unavailable and the request runs normally.\n */\nconst resolveReplayContext = async (\n  request: Request,\n  ctx: MeticulousExecutionContext,\n): Promise<RequestReplayContext | undefined> => {\n  let sidecarUrl: string | undefined;\n  let frontendSessionId: string | undefined;\n  let replayId: string | undefined;\n  let virtualTimeMs: number | undefined;\n  try {\n    sidecarUrl = parseSidecarUrl(\n      request.headers.get(REPLAY_SIDECAR_URL_HEADER),\n    );\n    frontendSessionId =\n      request.headers.get(FRONTEND_SESSION_ID_HEADER) ?? undefined;\n    replayId = request.headers.get(REPLAY_ID_HEADER) ?? undefined;\n    virtualTimeMs = parseVirtualTimeMs(\n      request.headers.get(VIRTUAL_TIME_HEADER),\n    );\n  } catch {\n    return undefined;\n  }\n  if (\n    sidecarUrl === undefined ||\n    frontendSessionId === undefined ||\n    replayId === undefined\n  ) {\n    return undefined;\n  }\n\n  const info = await getCachedReplaySessionInfo(sidecarUrl, frontendSessionId);\n  if (info === null) {\n    return undefined;\n  }\n\n  return {\n    mode: \"replay\",\n    requestId: crypto.randomUUID(),\n    frontendSessionId,\n    replayId,\n    sidecarUrl,\n    clockAnchorMs: info.clockAnchorMs,\n    ...(virtualTimeMs !== undefined ? { virtualTimeMs } : {}),\n    waitUntil: buildWaitUntil(ctx),\n  };\n};\n\n/**\n * Whether this deployment is running agent-swarm testing, and the context to serve requests\n * under.\n *\n * Activates on the two deployment env vars — a validated interceptor origin plus a run id —\n * neither of which changes per request, which is why env vars work here where replay needs\n * headers (replay is per-session, and workerd cannot see container environment variables;\n * these vars are set on the container by whoever deploys it for a swarm run). There is no\n * session handshake with the interceptor: the mode is best-effort by design, so nothing is\n * gated on the interceptor being reachable.\n */\nconst resolveAgentSwarmTestingContext = (\n  request: Request,\n  env: unknown,\n  ctx: MeticulousExecutionContext,\n): RequestAgentSwarmTestingContext | undefined => {\n  let sidecarUrl: string | undefined;\n  let runId: string | undefined;\n  try {\n    const envRecord =\n      env !== null && typeof env === \"object\"\n        ? (env as Record<string, unknown>)\n        : {};\n    const rawSidecarUrl = envRecord[AGENT_SWARM_TESTING_SIDECAR_URL_ENV_KEY];\n    sidecarUrl =\n      typeof rawSidecarUrl === \"string\"\n        ? parseSidecarUrl(rawSidecarUrl)\n        : undefined;\n    const rawRunId = envRecord[AGENT_SWARM_TESTING_RUN_ID_ENV_KEY];\n    runId =\n      typeof rawRunId === \"string\" && rawRunId !== \"\" ? rawRunId : undefined;\n  } catch {\n    return undefined;\n  }\n  if (sidecarUrl === undefined || runId === undefined) {\n    return undefined;\n  }\n\n  return {\n    mode: \"agent-swarm-testing\",\n    requestId: crypto.randomUUID(),\n    runId,\n    frontendSessionId:\n      request.headers.get(FRONTEND_SESSION_ID_HEADER) ?? undefined,\n    sidecarUrl,\n    waitUntil: buildWaitUntil(ctx),\n  };\n};\n\n// Caches the promise, not the result, so concurrent first requests share one round trip.\n// Bounded so a stream of unrecognised session ids cannot grow it without limit.\nconst MAX_CACHED_SESSIONS = 50;\nconst replaySessionInfoCache = new Map<\n  string,\n  Promise<{ clockAnchorMs: number | undefined } | null>\n>();\n\nconst getCachedReplaySessionInfo = (\n  sidecarUrl: string,\n  frontendSessionId: string,\n): Promise<{ clockAnchorMs: number | undefined } | null> => {\n  const key = `${sidecarUrl}\u0000${frontendSessionId}`;\n  const cached = replaySessionInfoCache.get(key);\n  if (cached !== undefined) {\n    return cached;\n  }\n  const pending = getReplaySessionInfo(\n    getOriginalFetch(),\n    sidecarUrl,\n    frontendSessionId,\n  ).then((result) => {\n    if (result.outcome === \"unreachable\") {\n      // Only settled answers are worth keeping. Caching a timeout or transport blip would\n      // disable mocking for this session for the life of the isolate, quietly sending every\n      // later outbound call to the real service — the failure this path exists to prevent.\n      // Dropping the entry costs one extra handshake and lets the next request recover.\n      replaySessionInfoCache.delete(key);\n      return null;\n    }\n    return result.outcome === \"found\"\n      ? { clockAnchorMs: result.clockAnchorMs }\n      : null;\n  });\n  if (replaySessionInfoCache.size >= MAX_CACHED_SESSIONS) {\n    const oldest = replaySessionInfoCache.keys().next();\n    if (!oldest.done) {\n      replaySessionInfoCache.delete(oldest.value);\n    }\n  }\n  replaySessionInfoCache.set(key, pending);\n  return pending;\n};\n\nconst buildCaptureContext = (\n  request: Request,\n  transport: SidecarTransport,\n  ctx: MeticulousExecutionContext,\n  mintProvisionalSessionIds: boolean,\n): RequestCaptureContext => {\n  let frontendSessionId: string | undefined;\n  let sessionIdOrigin: \"backend\" | undefined;\n  try {\n    frontendSessionId =\n      request.headers.get(FRONTEND_SESSION_ID_HEADER) ?? undefined;\n    // A top-level document navigation cannot carry the header, so for one we mint the id\n    // ourselves and hand it to the page on the response — otherwise the server-side render this\n    // request is about is recorded against no session at all. Every outbound, binding, KV and\n    // postgres event reads the id back off this context, so putting it here attributes the whole\n    // request. See provisional-session-id.ts.\n    if (\n      mintProvisionalSessionIds &&\n      frontendSessionId === undefined &&\n      isProvisionalSessionIdCandidate(request.method, (name) =>\n        request.headers.get(name),\n      )\n    ) {\n      frontendSessionId = mintProvisionalSessionId();\n      sessionIdOrigin = \"backend\";\n    }\n  } catch {\n    frontendSessionId = undefined;\n    sessionIdOrigin = undefined;\n  }\n  const waitUntil = buildWaitUntil(ctx);\n  return {\n    mode: \"record\",\n    requestId: crypto.randomUUID(),\n    frontendSessionId,\n    ...(sessionIdOrigin !== undefined ? { sessionIdOrigin } : {}),\n    transport,\n    buffer: new CaptureBuffer(transport, waitUntil),\n    traceId: randomHex(16),\n    serverSpanId: randomHex(8),\n    waitUntil,\n  };\n};\n\n/**\n * On by default: the render it attributes — the page's very first — is otherwise recorded\n * against no session at all, and the only thing that reaches a replay for those spans is\n * ingestion's time-window guess.\n *\n * Opting out is a worker var rather than a host environment variable for the same reason the\n * sidecar URL is: workerd cannot see the host's environment.\n */\nconst resolveMintProvisionalSessionIds = (\n  options: WithMeticulousOptions | undefined,\n  env: unknown,\n): boolean => {\n  if (options?.mintProvisionalSessionIds !== undefined) {\n    return options.mintProvisionalSessionIds;\n  }\n  const fromEnv =\n    env !== null && typeof env === \"object\"\n      ? (env as Record<string, unknown>)[\n          \"METICULOUS_BACKEND_PROVISIONAL_SESSION_IDS\"\n        ]\n      : undefined;\n  return fromEnv !== \"false\";\n};\n\nconst buildWaitUntil =\n  (ctx: MeticulousExecutionContext) =>\n  (promise: Promise<unknown>): void => {\n    try {\n      ctx.waitUntil(promise);\n    } catch (error) {\n      warnOnce(\n        \"wait-until\",\n        \"ctx.waitUntil failed — capture events may be lost.\",\n        error,\n      );\n    }\n  };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyFA,MAAa,oBAAoB,OAC/B,EAAE,SAAS,KAAK,KAAK,iBACrB,YACsB;CACtB,IAAI;CACJ,IAAI;CACJ,IAAI;AACJ,KAAI;AACF,kBAAgB,MAAM,qBAAqB,SAAS,IAAI;AACxD,MAAI,kBAAkB,KAAA,EACpB,4BAA2B,gCACzB,SACA,KACA,IACD;AAEH,cACE,kBAAkB,KAAA,KAAa,6BAA6B,KAAA,IACxD,wBAAwB,SAAS,IAAI,GACrC,KAAA;AACN,MACE,kBAAkB,KAAA,KAClB,6BAA6B,KAAA,KAC7B,cAAc,KAAA,EAEd,oBAAmB;AAErB,MAAI,cAAc,KAAA,GAAW;GAa3B,MAAM,eAAe;IACnB,GAAI,SAAS,iBAAiB,KAAA,IAC1B,EAAE,cAAc,QAAQ,cAAc,GACtC,EAAE;IACN,GAAI,UAAU,SAAS,YACnB,EAAE,eAAe,CAAC,UAAU,SAAS,EAAE,GACvC,EAAE;IACP;AACD,uBAAoB,KAAK,aAAa;AACtC,kBAAe,KAAK,aAAa;;UAE5B,OAAO;AACd,WACE,aACA,mFACA,MACD;AACD,kBAAgB,KAAA;AAChB,6BAA2B,KAAA;AAC3B,cAAY,KAAA;;AAGd,KAAI,kBAAkB,KAAA,GAAW;AAI/B,2BAAyB;AAGzB,uBAAqB;AAIrB,wBAAsB;AAOtB,SAAO,oCAAoC,MAJd,sBAC3B,eACA,cACD,CACyD;;AAG5D,KAAI,6BAA6B,KAAA,EAK/B,QAAO,oCAAoC,MAJb,sBAAsB,IAClD,0BACA,cACD,CAC0D;AAG7D,KAAI,cAAc,KAAA,EAChB,QAAO,eAAe;AAMxB,KACE,qBAAqB,QAAQ,QAAQ,QAAQ,MAAM,SACjD,QAAQ,QAAQ,IAAI,KAAK,CAC1B,CAED,QAAO,eAAe;CAGxB,MAAM,aAAa,oBACjB,SACA,WACA,KACA,iCAAiC,SAAS,IAAI,CAC/C;CACD,MAAM,kBACJ,WAAW,oBAAoB,YAC3B,WAAW,oBACX,KAAA;CACN,MAAM,cAAc,KAAK,KAAK;CAC9B,IAAI,iBAA2C,EAAE;CACjD,IAAI,SAAS;CACb,IAAI,MAAM;AACV,KAAI;AACF,mBAAiB,gBAAgB,QAAQ,QAAQ;AACjD,WAAS,QAAQ;AACjB,QAAM,QAAQ;UACP,OAAO;AACd,WACE,mBACA,0CACA,MACD;;CAGH,MAAM,iBACJ,YAGS;AACT,MAAI;GACF,MAAM,QAA6B;IACjC,MAAM;IACN,WAAW,WAAW;IACtB,GAAI,WAAW,sBAAsB,KAAA,IACjC,EAAE,mBAAmB,WAAW,mBAAmB,GACnD,EAAE;IACN,GAAI,WAAW,oBAAoB,KAAA,IAC/B,EAAE,iBAAiB,WAAW,iBAAiB,GAC/C,EAAE;IACN,SAAS,WAAW;IACpB,cAAc,WAAW;IACzB;IACA;IACA;IACA;IACA,WAAW,KAAK,KAAK;IACrB,GAAG;IACJ;AACD,cAAW,OAAO,IAAI,MAAM;WACrB,OAAO;AACd,YACE,kBACA,yCACA,MACD;;;CAIL,IAAI;AACJ,KAAI;AACF,aAAW,MAAM,sBAAsB,IAAI,YAAY,cAAc;UAC9D,OAAO;AACd,gBAAc,EAAE,OAAO,OAAO,MAAM,EAAE,CAAC;AACvC,cAAY,WAAW;AACvB,QAAM;;AAKR,KAAI,oBAAoB,KAAA,EACtB,YAAW,2BAA2B,UAAU,gBAAgB;AAElE,YAAW,oCAAoC,SAAS;AAExD,KAAI;AACF,gBAAc;GACZ,YAAY,SAAS;GACrB,iBAAiB,gBAAgB,SAAS,QAAQ;GACnD,CAAC;UACK,OAAO;AACd,WAAS,kBAAkB,yCAAyC,MAAM;;AAE5E,aAAY,WAAW;AACvB,QAAO;;;;;;AAOT,MAAM,eAAe,QAAqC;AACxD,KAAI;AACF,MAAI,UAAU,IAAI,OAAO,OAAO,CAAC;UAC1B,OAAO;AACd,WACE,gBACA,sDACA,MACD;;;;;;;;;;;AAYL,MAAM,uBAAuB,OAC3B,SACA,QAC8C;CAC9C,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;AACJ,KAAI;AACF,eAAa,gBACX,QAAQ,QAAQ,IAAI,0BAA0B,CAC/C;AACD,sBACE,QAAQ,QAAQ,IAAA,0BAA+B,IAAI,KAAA;AACrD,aAAW,QAAQ,QAAQ,IAAA,yBAAqB,IAAI,KAAA;AACpD,kBAAgB,mBACd,QAAQ,QAAQ,IAAI,oBAAoB,CACzC;SACK;AACN;;AAEF,KACE,eAAe,KAAA,KACf,sBAAsB,KAAA,KACtB,aAAa,KAAA,EAEb;CAGF,MAAM,OAAO,MAAM,2BAA2B,YAAY,kBAAkB;AAC5E,KAAI,SAAS,KACX;AAGF,QAAO;EACL,MAAM;EACN,WAAW,OAAO,YAAY;EAC9B;EACA;EACA;EACA,eAAe,KAAK;EACpB,GAAI,kBAAkB,KAAA,IAAY,EAAE,eAAe,GAAG,EAAE;EACxD,WAAW,eAAe,IAAI;EAC/B;;;;;;;;;;;;;AAcH,MAAM,mCACJ,SACA,KACA,QACgD;CAChD,IAAI;CACJ,IAAI;AACJ,KAAI;EACF,MAAM,YACJ,QAAQ,QAAQ,OAAO,QAAQ,WAC1B,MACD,EAAE;EACR,MAAM,gBAAgB,UAAU;AAChC,eACE,OAAO,kBAAkB,WACrB,gBAAgB,cAAc,GAC9B,KAAA;EACN,MAAM,WAAW,UAAU;AAC3B,UACE,OAAO,aAAa,YAAY,aAAa,KAAK,WAAW,KAAA;SACzD;AACN;;AAEF,KAAI,eAAe,KAAA,KAAa,UAAU,KAAA,EACxC;AAGF,QAAO;EACL,MAAM;EACN,WAAW,OAAO,YAAY;EAC9B;EACA,mBACE,QAAQ,QAAQ,IAAA,0BAA+B,IAAI,KAAA;EACrD;EACA,WAAW,eAAe,IAAI;EAC/B;;AAKH,MAAM,sBAAsB;AAC5B,MAAM,yCAAyB,IAAI,KAGhC;AAEH,MAAM,8BACJ,YACA,sBAC0D;CAC1D,MAAM,MAAM,GAAG,WAAW,GAAG;CAC7B,MAAM,SAAS,uBAAuB,IAAI,IAAI;AAC9C,KAAI,WAAW,KAAA,EACb,QAAO;CAET,MAAM,UAAU,qBACd,kBAAkB,EAClB,YACA,kBACD,CAAC,MAAM,WAAW;AACjB,MAAI,OAAO,YAAY,eAAe;AAKpC,0BAAuB,OAAO,IAAI;AAClC,UAAO;;AAET,SAAO,OAAO,YAAY,UACtB,EAAE,eAAe,OAAO,eAAe,GACvC;GACJ;AACF,KAAI,uBAAuB,QAAQ,qBAAqB;EACtD,MAAM,SAAS,uBAAuB,MAAM,CAAC,MAAM;AACnD,MAAI,CAAC,OAAO,KACV,wBAAuB,OAAO,OAAO,MAAM;;AAG/C,wBAAuB,IAAI,KAAK,QAAQ;AACxC,QAAO;;AAGT,MAAM,uBACJ,SACA,WACA,KACA,8BAC0B;CAC1B,IAAI;CACJ,IAAI;AACJ,KAAI;AACF,sBACE,QAAQ,QAAQ,IAAA,0BAA+B,IAAI,KAAA;AAMrD,MACE,6BACA,sBAAsB,KAAA,KACtB,gCAAgC,QAAQ,SAAS,SAC/C,QAAQ,QAAQ,IAAI,KAAK,CAC1B,EACD;AACA,uBAAoB,0BAA0B;AAC9C,qBAAkB;;SAEd;AACN,sBAAoB,KAAA;AACpB,oBAAkB,KAAA;;CAEpB,MAAM,YAAY,eAAe,IAAI;AACrC,QAAO;EACL,MAAM;EACN,WAAW,OAAO,YAAY;EAC9B;EACA,GAAI,oBAAoB,KAAA,IAAY,EAAE,iBAAiB,GAAG,EAAE;EAC5D;EACA,QAAQ,IAAI,cAAc,WAAW,UAAU;EAC/C,SAAS,UAAU,GAAG;EACtB,cAAc,UAAU,EAAE;EAC1B;EACD;;;;;;;;;;AAWH,MAAM,oCACJ,SACA,QACY;AACZ,KAAI,SAAS,8BAA8B,KAAA,EACzC,QAAO,QAAQ;AAQjB,SALE,QAAQ,QAAQ,OAAO,QAAQ,WAC1B,IACC,gDAEF,KAAA,OACa;;AAGrB,MAAM,kBACH,SACA,YAAoC;AACnC,KAAI;AACF,MAAI,UAAU,QAAQ;UACf,OAAO;AACd,WACE,cACA,sDACA,MACD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alwaysmeticulous/backend-recorder-workerd",
-  "version": "2.343.0",
+  "version": "2.346.0",
   "type": "module",
   "description": "Meticulous backend recorder shim for Cloudflare Workers (workerd). Reports inbound and outbound HTTP capture events to a local Meticulous recorder sidecar during development recording.",
   "license": "ISC",

package/dist/replay-sidecar-url.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"replay-sidecar-url.js","names":[],"sources":["../src/replay-sidecar-url.ts"],"sourcesContent":["import { warnOnce } from \"./log\";\n\n/**\n * Validation for the replay sidecar origin carried on inbound requests.\n *\n * The value arrives in a request header, so in principle anything that can reach the worker\n * can propose one — and the shim POSTs outbound request bodies to whatever it accepts. The\n * guard therefore only honours an origin that could plausibly be a Meticulous replay\n * sidecar running alongside the app: plaintext HTTP on a loopback, docker-gateway or\n * private-network host.\n *\n * `https:` is rejected deliberately. A sidecar reachable over loopback or a pod network has\n * no TLS to offer, so permitting `https:` would buy nothing except a way for a forged header\n * to exfiltrate request bodies to an arbitrary internet host.\n */\n\nconst MAX_URL_LENGTH = 2048;\n\nconst ALLOWED_HOSTNAMES = new Set([\n  \"localhost\",\n  // Docker Desktop and Podman expose the host to containers under these names.\n  \"host.docker.internal\",\n  \"host.containers.internal\",\n]);\n\nexport const parseReplaySidecarUrl = (\n  raw: string | null | undefined,\n): string | undefined => {\n  if (typeof raw !== \"string\" || raw.length === 0) {\n    return undefined;\n  }\n  if (raw.length > MAX_URL_LENGTH) {\n    warnOnce(\n      \"replay-sidecar-url\",\n      \"Ignoring an implausibly long Meticulous replay sidecar URL.\",\n    );\n    return undefined;\n  }\n\n  let url: URL;\n  try {\n    url = new URL(raw);\n  } catch {\n    warnOnce(\n      \"replay-sidecar-url\",\n      \"Ignoring an unparseable Meticulous replay sidecar URL.\",\n    );\n    return undefined;\n  }\n\n  const isAcceptable =\n    url.protocol === \"http:\" &&\n    url.username === \"\" &&\n    url.password === \"\" &&\n    (url.pathname === \"\" || url.pathname === \"/\") &&\n    url.search === \"\" &&\n    url.hash === \"\" &&\n    isLocalHostname(url.hostname);\n\n  if (!isAcceptable) {\n    warnOnce(\n      \"replay-sidecar-url\",\n      `Ignoring the Meticulous replay sidecar URL \"${raw}\" — only a plain http:// origin on a loopback, docker-gateway or private-network host is honoured.`,\n    );\n    return undefined;\n  }\n\n  // Return the parsed origin rather than the raw string: it is what `fetch` would resolve\n  // the value to anyway, so the host that was validated is exactly the host that gets\n  // called (alternative IPv4 spellings like \"0177.0.0.1\" normalize here, rather than being\n  // checked in one form and dialled in another). Carries no trailing slash, matching\n  // resolveSidecarUrl's normalization so the self-capture prefix check lines up.\n  return url.origin;\n};\n\nconst isLocalHostname = (hostname: string): boolean => {\n  const lower = hostname.toLowerCase();\n  if (ALLOWED_HOSTNAMES.has(lower)) {\n    return true;\n  }\n  // URL keeps IPv6 literals bracketed.\n  const unbracketed =\n    lower.startsWith(\"[\") && lower.endsWith(\"]\")\n      ? lower.slice(1, -1)\n      : undefined;\n  if (unbracketed !== undefined) {\n    return unbracketed === \"::1\";\n  }\n  return isPrivateIpv4(lower);\n};\n\nconst isPrivateIpv4 = (hostname: string): boolean => {\n  const parts = hostname.split(\".\");\n  if (parts.length !== 4) {\n    return false;\n  }\n  const octets = parts.map((part) =>\n    // Reject anything that is not a plain decimal octet: \"010\" and \"0x7f\" are parsed\n    // inconsistently across resolvers, and \"1e2\" would pass a bare Number() check.\n    /^\\d{1,3}$/.test(part) ? Number(part) : Number.NaN,\n  );\n  if (octets.some((octet) => Number.isNaN(octet) || octet > 255)) {\n    return false;\n  }\n  const [first, second] = octets;\n  // Deliberately excludes link-local (169.254.0.0/16): no sidecar is ever reachable there,\n  // but the cloud metadata endpoints are (169.254.169.254), so allowing it would only widen\n  // the SSRF surface. The rest of the codebase blocks that range for the same reason — see\n  // `staging-backend-url.ts` and `assets-app-server.ts`.\n  return (\n    first === 127 || // loopback\n    first === 10 || // RFC1918\n    (first === 172 && second >= 16 && second <= 31) || // RFC1918\n    (first === 192 && second === 168) // RFC1918\n  );\n};\n"],"mappings":";;;;;;;;;;;;;;;AAgBA,MAAM,iBAAiB;AAEvB,MAAM,oBAAoB,IAAI,IAAI;CAChC;CAEA;CACA;CACD,CAAC;AAEF,MAAa,yBACX,QACuB;AACvB,KAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,EAC5C;AAEF,KAAI,IAAI,SAAS,gBAAgB;AAC/B,WACE,sBACA,8DACD;AACD;;CAGF,IAAI;AACJ,KAAI;AACF,QAAM,IAAI,IAAI,IAAI;SACZ;AACN,WACE,sBACA,yDACD;AACD;;AAYF,KAAI,EARF,IAAI,aAAa,WACjB,IAAI,aAAa,MACjB,IAAI,aAAa,OAChB,IAAI,aAAa,MAAM,IAAI,aAAa,QACzC,IAAI,WAAW,MACf,IAAI,SAAS,MACb,gBAAgB,IAAI,SAAS,GAEZ;AACjB,WACE,sBACA,+CAA+C,IAAI,oGACpD;AACD;;AAQF,QAAO,IAAI;;AAGb,MAAM,mBAAmB,aAA8B;CACrD,MAAM,QAAQ,SAAS,aAAa;AACpC,KAAI,kBAAkB,IAAI,MAAM,CAC9B,QAAO;CAGT,MAAM,cACJ,MAAM,WAAW,IAAI,IAAI,MAAM,SAAS,IAAI,GACxC,MAAM,MAAM,GAAG,GAAG,GAClB,KAAA;AACN,KAAI,gBAAgB,KAAA,EAClB,QAAO,gBAAgB;AAEzB,QAAO,cAAc,MAAM;;AAG7B,MAAM,iBAAiB,aAA8B;CACnD,MAAM,QAAQ,SAAS,MAAM,IAAI;AACjC,KAAI,MAAM,WAAW,EACnB,QAAO;CAET,MAAM,SAAS,MAAM,KAAK,SAGxB,YAAY,KAAK,KAAK,GAAG,OAAO,KAAK,GAAG,IACzC;AACD,KAAI,OAAO,MAAM,UAAU,OAAO,MAAM,MAAM,IAAI,QAAQ,IAAI,CAC5D,QAAO;CAET,MAAM,CAAC,OAAO,UAAU;AAKxB,QACE,UAAU,OACV,UAAU,MACT,UAAU,OAAO,UAAU,MAAM,UAAU,MAC3C,UAAU,OAAO,WAAW"}