@capxul/observability 2.4.0 → 2.5.1

package/dist/index.d.mts

@@ -1530,10 +1530,13 @@ type PostHogBrowserOptions = PostHogUtilityAppOptions;
  *    step 1 and step 3 are different anonymous "users" and every multi-page
  *    funnel lies.
  *  - identify-driven person profiles (ADR-0020 A2 wires the calls at L1).
- *  - session replay, PRODUCTION only. Ordinary text and input values remain
- *    visible. Inputs with `autocomplete="one-time-code"` are masked. Canvas and
- *    header/body capture stay off. Below production replay stays off, which is
- *    also why external dependency loading (the recorder script) stays blocked.
+ *  - session replay in EVERY environment. Ordinary text and input values remain
+ *    visible. Inputs with `autocomplete="one-time-code"` are masked. Network
+ *    timing plus request/response headers and bodies are recorded, so a failed
+ *    call shows its status and body in the replay. Canvas stays off. The
+ *    recorder script loads from PostHog, so external dependency loading is on.
+ *    (Ruling 2026-09-01: pre-launch, every failure needs its evidence; replay
+ *    gated to production left staging failures with no recording at all.)
  *
  * Autocapture stays OFF: funnels run on catalog events, not on DOM guesses.
  */
@@ -1543,16 +1546,19 @@ interface PostHogProductAppOptions {
   readonly autocapture: false;
   readonly capture_pageview: false;
   readonly capture_pageleave: true;
-  readonly disable_session_recording: boolean;
+  readonly disable_session_recording: false;
   readonly disable_persistence: false;
   readonly capture_heatmaps: false;
   readonly capture_exceptions: true;
-  readonly capture_performance: false;
+  readonly capture_performance: {
+    readonly network_timing: true;
+    readonly web_vitals: false;
+  };
   readonly disable_surveys: true;
   readonly disable_web_experiments: true;
   readonly disable_product_tours: true;
   readonly disable_conversations: true;
-  readonly disable_external_dependency_loading: boolean;
+  readonly disable_external_dependency_loading: false;
   readonly person_profiles: "identified_only";
   readonly advanced_disable_flags: true;
   readonly save_campaign_params: false;
@@ -1565,8 +1571,9 @@ interface PostHogProductAppOptions {
     readonly captureCanvas: {
       readonly recordCanvas: false;
     };
-    readonly recordHeaders: false;
-    readonly recordBody: false;
+    readonly recordHeaders: true;
+    readonly recordBody: true; /** Drops credential headers and masks secrets and OTP codes in bodies. */
+    readonly maskCapturedNetworkRequestFn: (request: CapturedNetworkRequestLike) => CapturedNetworkRequestLike;
   };
   readonly before_send: PostHogBeforeSend;
 }
@@ -1579,6 +1586,21 @@ interface CapxulBrowserAnalyticsInput {
 /** Back-compat alias for the pre-ADR-0020 name. */
 type InitializePostHogBrowserAnalyticsInput = CapxulBrowserAnalyticsInput;
 declare function utilityAppAnalytics(input: CapxulBrowserAnalyticsInput): PostHogUtilityAppOptions;
+/** The posthog-js `CapturedNetworkRequest` fields this profile touches. */
+interface CapturedNetworkRequestLike {
+  readonly requestHeaders?: Record<string, string> | undefined;
+  readonly responseHeaders?: Record<string, string> | undefined;
+  readonly requestBody?: string | null | undefined;
+  readonly responseBody?: string | null | undefined;
+  readonly [key: string]: unknown;
+}
+/**
+ * Replay keeps the request line, status, timing, headers, and bodies, so a
+ * failed call carries its evidence. Credential headers and secret material
+ * never leave the browser: bearer tokens, cookies, API keys, and the OTP a
+ * user just typed are masked before the recording is sent.
+ */
+declare function maskCapturedNetworkRequest(request: CapturedNetworkRequestLike): CapturedNetworkRequestLike;
 declare function productAppAnalytics(input: CapxulBrowserAnalyticsInput): PostHogProductAppOptions;
 type PostHogBrowserInitialize<Options, T> = (key: string, options: Options) => T;
 interface PostHogBrowserPageviewClient {
@@ -1632,4 +1654,4 @@ declare class InMemoryTelemetryBusAdapter implements TelemetryPort {
   reportHandledError(_error: CapxulError, _context?: HandledErrorReportContext): Effect.Effect<void, never>;
 }
 //#endregion
-export { AccountBalanceFailedTelemetryEventSchema, AccountBalanceReadTelemetryEventSchema, AuthFailedTelemetryEventSchema, AuthOtpDeliveredTelemetryEventSchema, AuthOtpExpiredTelemetryEventSchema, AuthOtpRequestedTelemetryEventSchema, AuthSignedOutTelemetryEventSchema, AuthVerifiedTelemetryEventSchema, BROWSER_GATED_TELEMETRY_EVENTS, BootstrapFailedTelemetryEventSchema, BootstrapResolvedTelemetryEventSchema, CAPXUL_ENVS, CONTRACT_FIRST_TELEMETRY_EVENTS, CapxulBrowserAnalyticsInput, CapxulEnv, DepositInitiatedTelemetryEventSchema, DepositSettledTelemetryEventSchema, FINANCIAL_OPS_TARGET_TELEMETRY_PRODUCERS, FaucetConfirmedTelemetryEventSchema, FaucetFailedTelemetryEventSchema, FaucetRequestedTelemetryEventSchema, FunnelJourney, FunnelStepPropertyFilter, type HandledErrorReportContext, InMemoryTelemetryBusAdapter, InitializePostHogBrowserAnalyticsInput, Journey, MemberActivationFailedTelemetryEventSchema, MemberActivationReadyTelemetryEventSchema, MemberActivationStartedTelemetryEventSchema, MovementScanCheckpointTelemetryEventSchema, MovementScanIncidentTelemetryEventSchema, MovementScanWindowTelemetryEventSchema, NonEmptyTelemetryEventNames, OnboardingDashboardReachedTelemetryEventSchema, OnboardingIntentSelectedTelemetryEventSchema, OnboardingOrganizationSubmittedTelemetryEventSchema, OnboardingProfileSubmittedTelemetryEventSchema, OrgCreateFailedTelemetryEventSchema, OrgCreateStartedTelemetryEventSchema, OrgCreatedTelemetryEventSchema, OrgInviteAcceptedTelemetryEventSchema, OrgInviteExpiredTelemetryEventSchema, OrgInviteSentTelemetryEventSchema, OrgRolesSeededTelemetryEventSchema, OrgSafeConfirmedTelemetryEventSchema, OrgSafeCreatedTelemetryEventSchema, OrganizationCreationFailedTelemetryEventSchema, OrganizationCreationReadyTelemetryEventSchema, OrganizationCreationStartedTelemetryEventSchema, PII, PRODUCT_MAPPER_GATED_TELEMETRY_EVENTS, PaymentFailedTelemetryEventSchema, PaymentInitiatedTelemetryEventSchema, PaymentSettledTelemetryEventSchema, PermissionMirrorVerificationTelemetryEventSchema, PointEventJourney, PostHogBeforeSend, PostHogBrowserCapture, PostHogBrowserInitialize, PostHogBrowserOptions, PostHogBrowserPageviewClient, PostHogProductAppOptions, PostHogTelemetryAdapter, PostHogUtilityAppOptions, ProvisioningSafeConfirmedTelemetryEventSchema, ProvisioningSafeCreatedTelemetryEventSchema, RecordingTelemetryAdapter, SYNCABLE_CAPXUL_ENVS, TELEMETRY_EVENT_NAMES, TELEMETRY_EVENT_SCHEMAS, TELEMETRY_JOURNEYS, TELEMETRY_PRODUCERS, TelemetryEnvelopeDefaults, TelemetryEvent, TelemetryEventName, TelemetryGroupInput, TelemetryIdentifyInput, type TelemetryPort, TelemetryProducer, TelemetryProps, TelemetryRedactionOptions, TrackHandler, createCapxulBeforeSend, createPostHogBrowserPageviewTracker, getTrackHandler, initializeCapxulBrowserAnalytics, initializePostHogBrowserAnalytics, productAppAnalytics, redactTelemetryEvent, redactTelemetryProps, sanitizePostHogBrowserEvent, setTrackHandler, stampTelemetryEnvelope, track, utilityAppAnalytics };
+export { AccountBalanceFailedTelemetryEventSchema, AccountBalanceReadTelemetryEventSchema, AuthFailedTelemetryEventSchema, AuthOtpDeliveredTelemetryEventSchema, AuthOtpExpiredTelemetryEventSchema, AuthOtpRequestedTelemetryEventSchema, AuthSignedOutTelemetryEventSchema, AuthVerifiedTelemetryEventSchema, BROWSER_GATED_TELEMETRY_EVENTS, BootstrapFailedTelemetryEventSchema, BootstrapResolvedTelemetryEventSchema, CAPXUL_ENVS, CONTRACT_FIRST_TELEMETRY_EVENTS, CapturedNetworkRequestLike, CapxulBrowserAnalyticsInput, CapxulEnv, DepositInitiatedTelemetryEventSchema, DepositSettledTelemetryEventSchema, FINANCIAL_OPS_TARGET_TELEMETRY_PRODUCERS, FaucetConfirmedTelemetryEventSchema, FaucetFailedTelemetryEventSchema, FaucetRequestedTelemetryEventSchema, FunnelJourney, FunnelStepPropertyFilter, type HandledErrorReportContext, InMemoryTelemetryBusAdapter, InitializePostHogBrowserAnalyticsInput, Journey, MemberActivationFailedTelemetryEventSchema, MemberActivationReadyTelemetryEventSchema, MemberActivationStartedTelemetryEventSchema, MovementScanCheckpointTelemetryEventSchema, MovementScanIncidentTelemetryEventSchema, MovementScanWindowTelemetryEventSchema, NonEmptyTelemetryEventNames, OnboardingDashboardReachedTelemetryEventSchema, OnboardingIntentSelectedTelemetryEventSchema, OnboardingOrganizationSubmittedTelemetryEventSchema, OnboardingProfileSubmittedTelemetryEventSchema, OrgCreateFailedTelemetryEventSchema, OrgCreateStartedTelemetryEventSchema, OrgCreatedTelemetryEventSchema, OrgInviteAcceptedTelemetryEventSchema, OrgInviteExpiredTelemetryEventSchema, OrgInviteSentTelemetryEventSchema, OrgRolesSeededTelemetryEventSchema, OrgSafeConfirmedTelemetryEventSchema, OrgSafeCreatedTelemetryEventSchema, OrganizationCreationFailedTelemetryEventSchema, OrganizationCreationReadyTelemetryEventSchema, OrganizationCreationStartedTelemetryEventSchema, PII, PRODUCT_MAPPER_GATED_TELEMETRY_EVENTS, PaymentFailedTelemetryEventSchema, PaymentInitiatedTelemetryEventSchema, PaymentSettledTelemetryEventSchema, PermissionMirrorVerificationTelemetryEventSchema, PointEventJourney, PostHogBeforeSend, PostHogBrowserCapture, PostHogBrowserInitialize, PostHogBrowserOptions, PostHogBrowserPageviewClient, PostHogProductAppOptions, PostHogTelemetryAdapter, PostHogUtilityAppOptions, ProvisioningSafeConfirmedTelemetryEventSchema, ProvisioningSafeCreatedTelemetryEventSchema, RecordingTelemetryAdapter, SYNCABLE_CAPXUL_ENVS, TELEMETRY_EVENT_NAMES, TELEMETRY_EVENT_SCHEMAS, TELEMETRY_JOURNEYS, TELEMETRY_PRODUCERS, TelemetryEnvelopeDefaults, TelemetryEvent, TelemetryEventName, TelemetryGroupInput, TelemetryIdentifyInput, type TelemetryPort, TelemetryProducer, TelemetryProps, TelemetryRedactionOptions, TrackHandler, createCapxulBeforeSend, createPostHogBrowserPageviewTracker, getTrackHandler, initializeCapxulBrowserAnalytics, initializePostHogBrowserAnalytics, maskCapturedNetworkRequest, productAppAnalytics, redactTelemetryEvent, redactTelemetryProps, sanitizePostHogBrowserEvent, setTrackHandler, stampTelemetryEnvelope, track, utilityAppAnalytics };

package/dist/index.mjs

@@ -988,24 +988,90 @@ function utilityAppAnalytics(input) {
 		before_send: createCapxulBeforeSend(input.capxulEnv)
 	};
 }
+const CREDENTIAL_HEADERS = new Set([
+	"authorization",
+	"proxy-authorization",
+	"proxy-authenticate",
+	"www-authenticate",
+	"cookie",
+	"set-cookie",
+	"x-api-key",
+	"x-auth-token"
+]);
+/** Any JSON field whose name says "credential", however it is spelled. */
+const CREDENTIAL_FIELD_NAME = /(?:otp|code|pass(?:word|wd|phrase)?|token|secret|credential|api[_-]?key|private[_-]?key|authorization|cookie|session)/iu;
+/** Secret material in captured text: bearer tokens, JWTs, keys, and credential fields. */
+const NETWORK_TEXT_MASKS = [
+	[/\bBearer\s+[^\s,;"]+/giu, "Bearer [REDACTED]"],
+	[/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[REDACTED]"],
+	[/\b0x[a-fA-F0-9]{40,}\b/gu, "[REDACTED]"],
+	[/\b([A-Za-z_][A-Za-z0-9_.-]*=)[^&\s"]+/gu, "$1[REDACTED]"]
+];
+/** `"name": "value"` JSON pairs; the name decides whether the value is masked. */
+const JSON_STRING_FIELD = /("([^"\\]*)"\s*:\s*")((?:[^"\\]|\\.)*)(")/gu;
+const QUERY_PAIR = /\b([A-Za-z_][A-Za-z0-9_.-]*=)[^&\s"]+/gu;
+function maskNetworkText(text) {
+	return NETWORK_TEXT_MASKS.slice(0, 3).reduce((current, [pattern, replacement]) => current.replace(pattern, replacement), text).replace(JSON_STRING_FIELD, (whole, open, name, _value, close) => CREDENTIAL_FIELD_NAME.test(name) ? `${open}[REDACTED]${close}` : whole).replace(QUERY_PAIR, (whole, name) => CREDENTIAL_FIELD_NAME.test(name) ? `${name}[REDACTED]` : whole);
+}
+function maskNetworkHeaders(headers) {
+	if (headers === void 0) return void 0;
+	const masked = {};
+	for (const [name, value] of Object.entries(headers)) masked[name] = CREDENTIAL_HEADERS.has(name.toLowerCase()) ? "[REDACTED]" : maskNetworkText(value);
+	return masked;
+}
+/** Mask by KEY at every depth: a credential-named field loses its whole value. */
+function maskJsonValue(value, depth = 0) {
+	if (typeof value === "string") return maskNetworkText(value);
+	if (typeof value !== "object" || value === null) return value;
+	if (depth >= 16) return "[REDACTED]";
+	if (Array.isArray(value)) return value.map((item) => maskJsonValue(item, depth + 1));
+	const masked = {};
+	for (const [key, nested] of Object.entries(value)) masked[key] = CREDENTIAL_FIELD_NAME.test(key) ? "[REDACTED]" : maskJsonValue(nested, depth + 1);
+	return masked;
+}
+function maskNetworkBody(body) {
+	if (typeof body !== "string") return body;
+	try {
+		const parsed = JSON.parse(body);
+		if (typeof parsed === "object" && parsed !== null) return JSON.stringify(maskJsonValue(parsed));
+	} catch {}
+	return maskNetworkText(body);
+}
+/**
+* Replay keeps the request line, status, timing, headers, and bodies, so a
+* failed call carries its evidence. Credential headers and secret material
+* never leave the browser: bearer tokens, cookies, API keys, and the OTP a
+* user just typed are masked before the recording is sent.
+*/
+function maskCapturedNetworkRequest(request) {
+	return {
+		...request,
+		requestHeaders: maskNetworkHeaders(request.requestHeaders),
+		responseHeaders: maskNetworkHeaders(request.responseHeaders),
+		requestBody: maskNetworkBody(request.requestBody),
+		responseBody: maskNetworkBody(request.responseBody)
+	};
+}
 function productAppAnalytics(input) {
-	const replay = input.capxulEnv === "production";
 	return {
 		api_host: input.host,
 		defaults: "2026-01-30",
 		autocapture: false,
 		capture_pageview: false,
 		capture_pageleave: true,
-		disable_session_recording: !replay,
+		disable_session_recording: false,
 		disable_persistence: false,
 		capture_heatmaps: false,
 		capture_exceptions: true,
-		capture_performance: false,
+		capture_performance: {
+			network_timing: true,
+			web_vitals: false
+		},
 		disable_surveys: true,
 		disable_web_experiments: true,
 		disable_product_tours: true,
 		disable_conversations: true,
-		disable_external_dependency_loading: !replay,
+		disable_external_dependency_loading: false,
 		person_profiles: "identified_only",
 		advanced_disable_flags: true,
 		save_campaign_params: false,
@@ -1014,8 +1080,9 @@ function productAppAnalytics(input) {
 			maskAllInputs: true,
 			maskInputFn: (text, element) => element?.getAttribute("autocomplete")?.toLowerCase().split(/\s+/u).includes("one-time-code") ? "*".repeat(text.length) : text,
 			captureCanvas: { recordCanvas: false },
-			recordHeaders: false,
-			recordBody: false
+			recordHeaders: true,
+			recordBody: true,
+			maskCapturedNetworkRequestFn: maskCapturedNetworkRequest
 		},
 		before_send: createCapxulBeforeSend(input.capxulEnv)
 	};
@@ -1389,4 +1456,4 @@ function rotr(value, bits) {
 	return value >>> bits | value << 32 - bits;
 }
 //#endregion
-export { AccountBalanceFailedTelemetryEventSchema, AccountBalanceReadTelemetryEventSchema, AuthFailedTelemetryEventSchema, AuthOtpDeliveredTelemetryEventSchema, AuthOtpExpiredTelemetryEventSchema, AuthOtpRequestedTelemetryEventSchema, AuthSignedOutTelemetryEventSchema, AuthVerifiedTelemetryEventSchema, BROWSER_GATED_TELEMETRY_EVENTS, BootstrapFailedTelemetryEventSchema, BootstrapResolvedTelemetryEventSchema, CAPXUL_ENVS, CONTRACT_FIRST_TELEMETRY_EVENTS, DepositInitiatedTelemetryEventSchema, DepositSettledTelemetryEventSchema, FINANCIAL_OPS_TARGET_TELEMETRY_PRODUCERS, FaucetConfirmedTelemetryEventSchema, FaucetFailedTelemetryEventSchema, FaucetRequestedTelemetryEventSchema, InMemoryTelemetryBusAdapter, MemberActivationFailedTelemetryEventSchema, MemberActivationReadyTelemetryEventSchema, MemberActivationStartedTelemetryEventSchema, MovementScanCheckpointTelemetryEventSchema, MovementScanIncidentTelemetryEventSchema, MovementScanWindowTelemetryEventSchema, OnboardingDashboardReachedTelemetryEventSchema, OnboardingIntentSelectedTelemetryEventSchema, OnboardingOrganizationSubmittedTelemetryEventSchema, OnboardingProfileSubmittedTelemetryEventSchema, OrgCreateFailedTelemetryEventSchema, OrgCreateStartedTelemetryEventSchema, OrgCreatedTelemetryEventSchema, OrgInviteAcceptedTelemetryEventSchema, OrgInviteExpiredTelemetryEventSchema, OrgInviteSentTelemetryEventSchema, OrgRolesSeededTelemetryEventSchema, OrgSafeConfirmedTelemetryEventSchema, OrgSafeCreatedTelemetryEventSchema, OrganizationCreationFailedTelemetryEventSchema, OrganizationCreationReadyTelemetryEventSchema, OrganizationCreationStartedTelemetryEventSchema, PII, PRODUCT_MAPPER_GATED_TELEMETRY_EVENTS, PaymentFailedTelemetryEventSchema, PaymentInitiatedTelemetryEventSchema, PaymentSettledTelemetryEventSchema, PermissionMirrorVerificationTelemetryEventSchema, PostHogTelemetryAdapter, ProvisioningSafeConfirmedTelemetryEventSchema, ProvisioningSafeCreatedTelemetryEventSchema, RecordingTelemetryAdapter, SYNCABLE_CAPXUL_ENVS, TELEMETRY_EVENT_NAMES, TELEMETRY_EVENT_SCHEMAS, TELEMETRY_JOURNEYS, TELEMETRY_PRODUCERS, createCapxulBeforeSend, createPostHogBrowserPageviewTracker, getTrackHandler, initializeCapxulBrowserAnalytics, initializePostHogBrowserAnalytics, productAppAnalytics, redactTelemetryEvent, redactTelemetryProps, sanitizePostHogBrowserEvent, setTrackHandler, stampTelemetryEnvelope, track, utilityAppAnalytics };
+export { AccountBalanceFailedTelemetryEventSchema, AccountBalanceReadTelemetryEventSchema, AuthFailedTelemetryEventSchema, AuthOtpDeliveredTelemetryEventSchema, AuthOtpExpiredTelemetryEventSchema, AuthOtpRequestedTelemetryEventSchema, AuthSignedOutTelemetryEventSchema, AuthVerifiedTelemetryEventSchema, BROWSER_GATED_TELEMETRY_EVENTS, BootstrapFailedTelemetryEventSchema, BootstrapResolvedTelemetryEventSchema, CAPXUL_ENVS, CONTRACT_FIRST_TELEMETRY_EVENTS, DepositInitiatedTelemetryEventSchema, DepositSettledTelemetryEventSchema, FINANCIAL_OPS_TARGET_TELEMETRY_PRODUCERS, FaucetConfirmedTelemetryEventSchema, FaucetFailedTelemetryEventSchema, FaucetRequestedTelemetryEventSchema, InMemoryTelemetryBusAdapter, MemberActivationFailedTelemetryEventSchema, MemberActivationReadyTelemetryEventSchema, MemberActivationStartedTelemetryEventSchema, MovementScanCheckpointTelemetryEventSchema, MovementScanIncidentTelemetryEventSchema, MovementScanWindowTelemetryEventSchema, OnboardingDashboardReachedTelemetryEventSchema, OnboardingIntentSelectedTelemetryEventSchema, OnboardingOrganizationSubmittedTelemetryEventSchema, OnboardingProfileSubmittedTelemetryEventSchema, OrgCreateFailedTelemetryEventSchema, OrgCreateStartedTelemetryEventSchema, OrgCreatedTelemetryEventSchema, OrgInviteAcceptedTelemetryEventSchema, OrgInviteExpiredTelemetryEventSchema, OrgInviteSentTelemetryEventSchema, OrgRolesSeededTelemetryEventSchema, OrgSafeConfirmedTelemetryEventSchema, OrgSafeCreatedTelemetryEventSchema, OrganizationCreationFailedTelemetryEventSchema, OrganizationCreationReadyTelemetryEventSchema, OrganizationCreationStartedTelemetryEventSchema, PII, PRODUCT_MAPPER_GATED_TELEMETRY_EVENTS, PaymentFailedTelemetryEventSchema, PaymentInitiatedTelemetryEventSchema, PaymentSettledTelemetryEventSchema, PermissionMirrorVerificationTelemetryEventSchema, PostHogTelemetryAdapter, ProvisioningSafeConfirmedTelemetryEventSchema, ProvisioningSafeCreatedTelemetryEventSchema, RecordingTelemetryAdapter, SYNCABLE_CAPXUL_ENVS, TELEMETRY_EVENT_NAMES, TELEMETRY_EVENT_SCHEMAS, TELEMETRY_JOURNEYS, TELEMETRY_PRODUCERS, createCapxulBeforeSend, createPostHogBrowserPageviewTracker, getTrackHandler, initializeCapxulBrowserAnalytics, initializePostHogBrowserAnalytics, maskCapturedNetworkRequest, productAppAnalytics, redactTelemetryEvent, redactTelemetryProps, sanitizePostHogBrowserEvent, setTrackHandler, stampTelemetryEnvelope, track, utilityAppAnalytics };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/observability",
-  "version": "2.4.0",
+  "version": "2.5.1",
   "private": false,
   "repository": {
     "type": "git",
@@ -36,8 +36,8 @@
     "posthog-js": "^1.418.10",
     "vite-plus": "0.1.23",
     "vitest": "npm:@voidzero-dev/vite-plus-test@0.1.23",
-    "@capxul/errors": "0.0.1",
-    "@capxul/types": "0.2.0",
+    "@capxul/errors": "0.0.2",
+    "@capxul/types": "0.2.1",
     "@capxul/typescript-config": "0.0.0"
   },
   "scripts": {