@capxul/observability 4.1.4 → 4.2.0-rc.10

package/README.md

@@ -26,23 +26,28 @@ optional and snake_case; the camelCase spellings are retired.
 One boundary, two named postures, both built on the same sanitizer, token
 guard and missing-key opt-out:
 
-|                 | `utilityAppAnalytics`                      | `productAppAnalytics`                   |
-| --------------- | ------------------------------------------ | --------------------------------------- |
-| For             | capability-URL apps (approval links, docs) | the Capxul product web app              |
-| Persistence     | off                                        | **on** — J1 spans an OTP reload         |
-| Person profiles | identified-only, nothing identifies        | identified-only, identify-driven        |
-| Autocapture     | off                                        | off                                     |
-| Session replay  | off                                        | **on in every environment**, OTP masked |
-| Exceptions      | off                                        | on                                      |
-
-Both stamp `capxul_env` and `producer: "browser"` through `before_send`, which
-also recursively removes URL query strings/fragments (including exception-frame
-filenames) and promoted campaign/search values. Pair either with
-`createPostHogBrowserPageviewTracker`, which reports pathname-only initial
-loads and SPA route changes. Vendor initialization and pageview capture
-failures degrade to disabled analytics. The product profile records ordinary
-text and input values. It masks inputs whose `autocomplete` attribute is
-`one-time-code`.
+|                 | `utilityAppAnalytics`                      | `productAppAnalytics`                           |
+| --------------- | ------------------------------------------ | ----------------------------------------------- |
+| For             | capability-URL apps (approval links, docs) | the Capxul product web app                      |
+| Persistence     | off                                        | **on** — J1 spans an OTP reload                 |
+| Person profiles | identified-only, nothing identifies        | identified-only, identify-driven                |
+| Autocapture     | off                                        | off                                             |
+| Session replay  | off                                        | **on in every environment**, credentials masked |
+| Exceptions      | off                                        | on                                              |
+
+Both stamp `capxul_env` and `producer: "browser"` through `before_send`.
+Utility analytics removes URL queries, fragments, and promoted campaign/search
+values. Product analytics preserves safe URL components and masks credentials.
+Both profiles preserve the PostHog routing token required for transport.
+`createPostHogBrowserPageviewTracker` reports pathname-only initial loads and
+SPA route changes. Vendor initialization and pageview capture failures degrade
+to disabled analytics.
+
+[The redaction rule](../../docs/rules/redaction.md) defines the data classes.
+Product replay masks password, OTP, and credential controls. Ordinary input
+remains visible. Network copies mask credential fields, headers, and URL parts
+while retaining safe codes, public chain evidence, and replay identifiers.
+Existing event schemas and the four auth-event email hashes remain unchanged.
 
 ### Import the standard `posthog-js` build
 

package/dist/capxul-source.json

@@ -0,0 +1,11 @@
+{
+  "source": {
+    "commit": "a7e55e5f1c2af5567a8b285a4ef70b8b5a3289f6",
+    "tree": "91bf1b080c0006fe30131711c13c843afd627158",
+    "branch": "codex/programme-rc",
+    "repository": "https://github.com/Xelmar-tech/infrastructure",
+    "lockfileSha256": "5870f53b72706d103220c1bcf733cb4fb71196aea32a9cfbdc277d73cc959264"
+  },
+  "name": "@capxul/observability",
+  "version": "4.2.0-rc.10"
+}

package/dist/engineering.d.mts

@@ -12,7 +12,7 @@ interface EngineeringTelemetryConfig {
   readonly sdkVersion: string;
   readonly serviceName?: string;
 }
-declare const traceHeaderFilter: (name: string) => boolean;
+declare const traceHeaderFilter: (_name: string) => boolean;
 declare const postHogOtlpEndpoints: (host: string) => {
   readonly logs: `${string}/i/v1/logs`;
   readonly traces: `${string}/i/v1/traces`;

package/dist/engineering.mjs

@@ -1,4 +1,5 @@
-import { Cause, Effect, Exit, Layer, Tracer } from "effect";
+import { i as redactUrlSecrets, n as isCredentialField, r as redactSecrets } from "./src-CWfRYsBI.mjs";
+import { Cause, Effect, Exit, FiberSet, Layer, Stream, Tracer } from "effect";
 import { FetchHttpClient, Headers, HttpClient } from "effect/unstable/http";
 import { OtlpExporter, OtlpLogger, OtlpSerialization, OtlpTracer } from "effect/unstable/observability";
 //#region src/engineering.ts
@@ -8,21 +9,8 @@ const ENGINEERING_CAPXUL_ENVS = [
 	"production",
 	"local"
 ];
-const SAFE_TRACED_HEADER_NAMES = [
-	"content-length",
-	"content-type",
-	"traceparent",
-	"tracestate",
-	"x-request-id"
-];
-const ENGINEERING_REDACTED_HEADER_NAMES = Object.freeze([
-	"authorization",
-	"cookie",
-	"set-cookie",
-	"x-api-key",
-	/auth|email|key|otp|secret|session|token|wallet/i
-]);
-const traceHeaderFilter = (name) => SAFE_TRACED_HEADER_NAMES.includes(name.toLowerCase());
+const traceHeaderFilter = (_name) => true;
+const credentialHeaderPattern = Object.assign(/./u, { test: (name) => isCredentialField(name, "header") });
 const postHogOtlpEndpoints = (host) => {
 	const base = host.replace(/\/+$/, "");
 	return {
@@ -54,23 +42,79 @@ const validateEngineeringTelemetryConfig = (config) => {
 		headers: Object.freeze({ authorization: headerEntries[0][1] })
 	};
 };
-var RedactedEngineeringSpanFailure = class extends Error {
-	constructor() {
-		super("Engineering operation failed");
-		this.name = "RedactedEngineeringSpanFailure";
-		delete this.stack;
+const failureText = (failure, key, limit, source) => {
+	if (failure === null || typeof failure !== "object") return void 0;
+	try {
+		let owner = failure;
+		let descriptor;
+		for (let depth = 0; owner !== null && depth < 4; depth += 1) {
+			descriptor = Object.getOwnPropertyDescriptor(owner, key);
+			if (descriptor !== void 0 || key !== "name") break;
+			owner = Object.getPrototypeOf(owner);
+		}
+		const value = descriptor?.value;
+		return typeof value === "string" || key === "code" && typeof value === "number" ? redactSecrets(String(value), source).slice(0, limit) : void 0;
+	} catch {
+		return;
+	}
+};
+const exportFailure = (failure, source) => {
+	const message = failureText(failure, "message", 2048, source) ?? (typeof failure === "string" ? redactSecrets(failure, source).slice(0, 2048) : "Engineering operation failed");
+	const code = failureText(failure, "code", 128);
+	const error = new Error((code === void 0 ? message : `${message} [code=${code}]`).slice(0, 2048));
+	error.name = failureText(failure, "_tag", 128) ?? failureText(failure, "name", 128) ?? "Error";
+	error.stack = failureText(failure, "stack", 8192, source) ?? `${error.name}: ${error.message}`;
+	return error;
+};
+const exportFailureExit = (cause, source) => Exit.failCause(Cause.fromReasons(cause.reasons.filter((reason) => !Cause.isInterruptReason(reason)).slice(0, 8).map((reason) => Cause.isFailReason(reason) ? Cause.makeFailReason(exportFailure(reason.error, source)) : Cause.makeDieReason(exportFailure(reason.defect, source)))));
+const BROWSER_KEEPALIVE_BYTES = 65536;
+let unfinishedBrowserExportBytes = 0;
+const hasBrowserDocument = () => typeof window !== "undefined" && typeof document !== "undefined";
+const browserExportClient = (client) => HttpClient.transform(client, (response, request) => Effect.acquireUseRelease(Effect.sync(() => {
+	const bytes = "contentLength" in request.body ? request.body.contentLength : void 0;
+	if (request.body._tag === "Stream" || request.body._tag === "FormData" || bytes === void 0 || !Number.isSafeInteger(bytes) || bytes < 0 || unfinishedBrowserExportBytes + bytes > BROWSER_KEEPALIVE_BYTES) return;
+	unfinishedBrowserExportBytes += bytes;
+	return bytes;
+}), (bytes) => response.pipe(Effect.provideService(FetchHttpClient.RequestInit, { keepalive: bytes !== void 0 }), Effect.tap((result) => bytes === void 0 ? Effect.void : Stream.runDrain(result.stream).pipe(Effect.catch((error) => error.reason._tag === "EmptyBodyError" ? Effect.void : Effect.fail(error))))), (bytes) => Effect.sync(() => {
+	if (bytes !== void 0) unfinishedBrowserExportBytes -= bytes;
+})));
+const spanUpstream = (span) => {
+	let current = span;
+	while (current?._tag === "Span") {
+		const upstream = current.attributes.get("chain.upstream");
+		if (upstream === "alchemy" || upstream === "infura") return upstream;
+		current = current.parent._tag === "Some" ? current.parent.value : void 0;
 	}
 };
-const REDACTED_SPAN_FAILURE = Exit.fail(new RedactedEngineeringSpanFailure());
 /** Preserve domain exits while preventing the OTLP serializer from seeing raw causes. */
 const makeLeakSafeEngineeringTracer = (delegate) => Tracer.make({
 	span(options) {
 		const span = delegate.span(options);
 		const wrapped = Object.create(span);
+		Object.defineProperty(wrapped, "attribute", { value: (name, value) => {
+			const source = spanUpstream(span);
+			const header = /^http\.(?:request|response)\.header\.(.+)$/u.exec(name)?.[1];
+			if (header !== void 0 && isCredentialField(header, "header")) span.attribute(name, "[REDACTED]");
+			else if (typeof value === "string" && name === "url.query") span.attribute(name, redactUrlSecrets(`?${value}`).slice(1, 2049));
+			else if (typeof value === "string" && name === "url.path") {
+				const fullUrl = span.attributes.get("url.full");
+				const path = typeof fullUrl === "string" ? /^https?:\/\/[^/]+([^?#]*)/u.exec(fullUrl)?.[1] ?? value : value;
+				span.attribute(name, redactUrlSecrets(path, source).slice(0, 2048));
+			} else if (typeof value === "string" && (name === "url.full" || header === "location" || header === "referer" || header === "referrer")) span.attribute(name, redactUrlSecrets(value, source).slice(0, 2048));
+			else if (header !== void 0 && typeof value === "string") span.attribute(name, redactSecrets(value, source).slice(0, 2048));
+			else span.attribute(name, value);
+		} });
 		Object.defineProperty(wrapped, "end", {
 			configurable: false,
 			enumerable: false,
-			value: (endTime, exit) => span.end(endTime, Exit.isFailure(exit) && !Cause.hasInterruptsOnly(exit.cause) ? REDACTED_SPAN_FAILURE : exit),
+			value: (endTime, exit) => {
+				if (Exit.isFailure(exit) && !Cause.hasInterruptsOnly(exit.cause)) {
+					const first = exit.cause.reasons.find((reason) => !Cause.isInterruptReason(reason));
+					const code = failureText(first === void 0 ? void 0 : Cause.isFailReason(first) ? first.error : first.defect, "code", 128);
+					if (code !== void 0) span.attribute("error.code", code);
+					span.end(endTime, exportFailureExit(exit.cause, spanUpstream(span)));
+				} else span.end(endTime, exit);
+			},
 			writable: false
 		});
 		return wrapped;
@@ -101,8 +145,29 @@ const makeEngineeringTelemetryLayer = (config) => {
 		resource,
 		mergeWithExisting: true
 	});
-	const headerPolicy = Layer.merge(Layer.succeed(HttpClient.TracerHeaderFilter, traceHeaderFilter), Layer.succeed(Headers.CurrentRedactedNames, ENGINEERING_REDACTED_HEADER_NAMES));
-	return Layer.mergeAll(tracing, logging, headerPolicy).pipe(Layer.provide(OtlpSerialization.layerJson), Layer.provide(FetchHttpClient.layer));
+	const headerPolicy = Layer.merge(Layer.succeed(HttpClient.TracerHeaderFilter, traceHeaderFilter), Layer.succeed(Headers.CurrentRedactedNames, [credentialHeaderPattern]));
+	const browserLifecycle = Layer.effectDiscard(Effect.gen(function* () {
+		if (validated.producer !== "browser" || !hasBrowserDocument()) return;
+		const browserWindow = window;
+		const browserDocument = document;
+		const flusher = yield* OtlpExporter.Flusher;
+		const run = yield* FiberSet.makeRuntime();
+		const flush = () => {
+			run(flusher.flush);
+		};
+		const visibilityChanged = () => {
+			if (browserDocument.visibilityState === "hidden") flush();
+		};
+		yield* Effect.acquireRelease(Effect.sync(() => {
+			browserDocument.addEventListener("visibilitychange", visibilityChanged);
+			browserWindow.addEventListener("pagehide", flush);
+		}), () => Effect.sync(() => {
+			browserDocument.removeEventListener("visibilitychange", visibilityChanged);
+			browserWindow.removeEventListener("pagehide", flush);
+		}));
+	}));
+	const transport = Layer.effect(HttpClient.HttpClient, Effect.map(HttpClient.HttpClient, (client) => validated.producer === "browser" && hasBrowserDocument() ? browserExportClient(client) : client)).pipe(Layer.provide(FetchHttpClient.layer));
+	return browserLifecycle.pipe(Layer.provideMerge(Layer.mergeAll(tracing, logging, headerPolicy)), Layer.provide(OtlpSerialization.layerJson), Layer.provide(transport));
 };
 //#endregion
 export { ENGINEERING_CAPXUL_ENVS, makeEngineeringTelemetryLayer, makeLeakSafeEngineeringTracer, postHogOtlpEndpoints, traceHeaderFilter };