@capxul/observability 2.5.1 → 2.5.3

package/dist/index.d.mts

@@ -1537,6 +1537,11 @@ type PostHogBrowserOptions = PostHogUtilityAppOptions;
  *    recorder script loads from PostHog, so external dependency loading is on.
  *    (Ruling 2026-09-01: pre-launch, every failure needs its evidence; replay
  *    gated to production left staging failures with no recording at all.)
+ *    Flags stay ENABLED for this client: posthog-js starts the recorder only
+ *    after it loads the project's remote config, and it skips that load when
+ *    `advanced_disable_flags` is true ("Remote config is disabled. Falling back
+ *    to local config."). With flags disabled the SDK captured events but never
+ *    recorded a session (0 replay rows in 7 days, verified 2026-09-02).
  *
  * Autocapture stays OFF: funnels run on catalog events, not on DOM guesses.
  */
@@ -1560,7 +1565,7 @@ interface PostHogProductAppOptions {
   readonly disable_conversations: true;
   readonly disable_external_dependency_loading: false;
   readonly person_profiles: "identified_only";
-  readonly advanced_disable_flags: true;
+  readonly advanced_disable_flags: false;
   readonly save_campaign_params: false;
   readonly save_referrer: false;
   readonly session_recording: {
@@ -1573,7 +1578,7 @@ interface PostHogProductAppOptions {
     };
     readonly recordHeaders: true;
     readonly recordBody: true; /** Drops credential headers and masks secrets and OTP codes in bodies. */
-    readonly maskCapturedNetworkRequestFn: (request: CapturedNetworkRequestLike) => CapturedNetworkRequestLike;
+    readonly maskCapturedNetworkRequestFn: <T extends CapturedNetworkRequestLike>(request: T) => T;
   };
   readonly before_send: PostHogBeforeSend;
 }
@@ -1586,13 +1591,16 @@ interface CapxulBrowserAnalyticsInput {
 /** Back-compat alias for the pre-ADR-0020 name. */
 type InitializePostHogBrowserAnalyticsInput = CapxulBrowserAnalyticsInput;
 declare function utilityAppAnalytics(input: CapxulBrowserAnalyticsInput): PostHogUtilityAppOptions;
-/** The posthog-js `CapturedNetworkRequest` fields this profile touches. */
+/**
+ * The posthog-js `CapturedNetworkRequest` fields this profile touches. Kept
+ * structural and optional so posthog-js's own type satisfies it: the masker is
+ * generic over the real request type and returns the same type it was given.
+ */
 interface CapturedNetworkRequestLike {
   readonly requestHeaders?: Record<string, string> | undefined;
   readonly responseHeaders?: Record<string, string> | undefined;
-  readonly requestBody?: string | null | undefined;
-  readonly responseBody?: string | null | undefined;
-  readonly [key: string]: unknown;
+  readonly requestBody?: unknown;
+  readonly responseBody?: unknown;
 }
 /**
  * Replay keeps the request line, status, timing, headers, and bodies, so a
@@ -1600,7 +1608,7 @@ interface CapturedNetworkRequestLike {
  * never leave the browser: bearer tokens, cookies, API keys, and the OTP a
  * user just typed are masked before the recording is sent.
  */
-declare function maskCapturedNetworkRequest(request: CapturedNetworkRequestLike): CapturedNetworkRequestLike;
+declare function maskCapturedNetworkRequest<T extends CapturedNetworkRequestLike>(request: T): T;
 declare function productAppAnalytics(input: CapxulBrowserAnalyticsInput): PostHogProductAppOptions;
 type PostHogBrowserInitialize<Options, T> = (key: string, options: Options) => T;
 interface PostHogBrowserPageviewClient {

package/dist/index.mjs

@@ -1073,7 +1073,7 @@ function productAppAnalytics(input) {
 		disable_conversations: true,
 		disable_external_dependency_loading: false,
 		person_profiles: "identified_only",
-		advanced_disable_flags: true,
+		advanced_disable_flags: false,
 		save_campaign_params: false,
 		save_referrer: false,
 		session_recording: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/observability",
-  "version": "2.5.1",
+  "version": "2.5.3",
   "private": false,
   "repository": {
     "type": "git",