@corbado/observe 1.12.0 → 1.13.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @corbado/observe
 
+## 1.13.0
+
+### Minor Changes
+
+- e0c70aa: New tracker plugin `fixedSourcePath(policy)` for `initCore`: the batch source path (`meta.trackingSourcePath`) comes from the integration's policy (e.g. `pageSourcePath(PAGES)` of `@corbado/autocapture`) instead of the server-driven `sourcePathQuery` config, so it can be declared in the integration's collection manifest. A failing policy sends the fully masked path. `init()` / `CorbadoTracker` are unchanged.
+
+## 1.12.1
+
+### Patch Changes
+
+- a5b4069: Reader metadata: optional `storage` (`ReaderStorage`: area, keys, lifetime, retention) for readers of Observe's own storage. The SDK's local, session and cookie storage readers declare it and no longer list fields, so the manifest extractor lists them in the new `storage` section instead of `sources`. Reader metadata is stripped from builds; no runtime change.
+
 ## 1.12.0
 
 ### Minor Changes

package/dist/analysis/index.mjs

@@ -11,6 +11,7 @@ export * from "./plugins/cookie-storage.mjs";
 export * from "./plugins/cross-origin-session.mjs";
 export * from "./plugins/raw-errors.mjs";
 export * from "./plugins/probes.mjs";
+export * from "./plugins/fixed-source-path.mjs";
 export * from "./probe-lane.mjs";
 export * from "./transport.mjs";
 export * from "./queue.mjs";

package/dist/analysis/plugins/fixed-source-path.mjs

@@ -0,0 +1,47 @@
+// src/plugins/fixed-source-path.ts
+import { readLocationPath } from "../readers/page.mjs";
+var MAX_SOURCE_PATH = 2048;
+function maskedSourcePath(path) {
+  const segments = String(path ?? "").split("/").filter((segment) => segment !== "");
+  return segments.length === 0 ? "/" : "/" + segments.map(() => "*").join("/");
+}
+function fixedSourcePath(policy) {
+  if (typeof policy !== "function") return {};
+  return {
+    sourcePath: () => {
+      const { path, search } = readLocationPath({
+        key: "page:location.fixed-source-path",
+        title: "Page path and declared parameters",
+        accessNote: "location.pathname and location.search, reduced by the integration's declared page templates and parameters (trackingSourcePath); everything else is masked",
+        group: "Page",
+        origin: "observe-external",
+        fields: [
+          {
+            path: "url.path",
+            label: "Page path (declared parts only)",
+            category: "technical",
+            exposure: "partial",
+            transform: { note: "declared page templates and path parameters; other segments become '*'" }
+          },
+          {
+            path: "url.query",
+            label: "Page address parameters (declared ones only)",
+            category: "technical",
+            exposure: "redacted",
+            transform: { note: "declared parameters as their declared reduction; other values become '*'" }
+          }
+        ]
+      });
+      try {
+        const out = policy(path, search);
+        return typeof out === "string" ? out.slice(0, MAX_SOURCE_PATH) : maskedSourcePath(path);
+      } catch {
+        return maskedSourcePath(path);
+      }
+    }
+  };
+}
+export {
+  fixedSourcePath,
+  maskedSourcePath
+};

package/dist/analysis/readers/page.mjs

@@ -21,6 +21,9 @@ function readSourcePath(_meta, mode, allow) {
   const search = applySourcePathQuery(window.location.search, mode, allow);
   return `${window.location.pathname}${search}`;
 }
+function readLocationPath(_meta) {
+  return { path: window.location.pathname, search: window.location.search };
+}
 function readCookieScope(_meta) {
   return { hostname: window.location.hostname, https: window.location.protocol === "https:" };
 }
@@ -29,6 +32,7 @@ export {
   readCookieScope,
   readDocumentComplete,
   readDocumentHidden,
+  readLocationPath,
   readPageUrl,
   readSourcePath
 };

package/dist/analysis/storage/index.mjs

@@ -28,17 +28,13 @@ var LocalStorage = class {
     accessNote: "localStorage, Observe's own cbo_ keys",
     group: "Observe SDK state",
     origin: "observe-internal",
-    fields: [
-      {
-        path: "value",
-        label: "Observe's own saved data",
-        category: "technical",
-        exposure: "none",
-        transform: {
-          note: "own cbo_* keys only (session, sequence, outbox, config cache, experiments, client env, debug); written and read back by the SDK"
-        }
-      }
-    ]
+    fields: [],
+    storage: {
+      area: "local",
+      keys: ["cbo_*"],
+      lifetime: "persistent",
+      retention: "Kept on the device; Observe replaces or removes its entries as they change"
+    }
   });
   /**
    * Error situations:
@@ -99,17 +95,13 @@ var CookieStorage = class {
     accessNote: "document.cookie, Observe's own cbo_ cookies",
     group: "Observe SDK state",
     origin: "observe-internal",
-    fields: [
-      {
-        path: "value",
-        label: "Observe's own cookies",
-        category: "technical",
-        exposure: "none",
-        transform: {
-          note: "own cbo_* cookies only (cookie storage mode); the cookie string is scanned for the requested key"
-        }
-      }
-    ]
+    fields: [],
+    storage: {
+      area: "cookie",
+      keys: ["cbo_*"],
+      lifetime: "browser",
+      retention: "Removed when the browser closes"
+    }
   });
   /**
    * Error situations:
@@ -183,17 +175,13 @@ var SessionStorage = class {
     accessNote: "sessionStorage, Observe's own cbo_ keys",
     group: "Observe SDK state",
     origin: "observe-internal",
-    fields: [
-      {
-        path: "value",
-        label: "Observe's own data for this tab",
-        category: "technical",
-        exposure: "none",
-        transform: {
-          note: "own cbo_* keys only (per-tab session, sequence and tab id); written and read back by the SDK"
-        }
-      }
-    ]
+    fields: [],
+    storage: {
+      area: "session",
+      keys: ["cbo_*"],
+      lifetime: "tab",
+      retention: "Removed when the tab closes"
+    }
   });
   /**
    * Error situations:

package/dist/analysis/tracker-core.mjs

@@ -132,6 +132,7 @@ var CorbadoTrackerCore = class _CorbadoTrackerCore {
     this.eachPlugin(installed, (plugin) => {
       if (plugin.session) this.bridge = plugin.session(this) || this.bridge;
       if (plugin.rawErrors) this.rawErrors = plugin.rawErrors;
+      if (typeof plugin.sourcePath === "function") this.fixedSourcePath = plugin.sourcePath;
     });
     if (options.fixedDataConfig?.crossOriginSession && !this.bridge) {
       this.logger.warn("fixedDataConfig.crossOriginSession is ignored without the crossOriginSession() plugin");
@@ -270,6 +271,8 @@ var CorbadoTrackerCore = class _CorbadoTrackerCore {
   bridge;
   /** Raw-error serializer of a plugin; undefined = operation step errors drop `rawError`. */
   rawErrors;
+  /** Fixed source path of a plugin; undefined = the server-driven `sourcePathQuery` policy. */
+  fixedSourcePath;
   /** @internal Shared passive page observation and per-operation context registration. */
   getWindowObserver() {
     return this.windowObserver ??= new SharedWindowObserver(
@@ -719,6 +722,14 @@ var CorbadoTrackerCore = class _CorbadoTrackerCore {
     if (typeof window === "undefined") {
       return void 0;
     }
+    if (this.fixedSourcePath) {
+      try {
+        const path = this.fixedSourcePath();
+        return typeof path === "string" ? path : void 0;
+      } catch {
+        return void 0;
+      }
+    }
     return readSourcePath(
       {
         key: "page:location.source-path",

package/dist/analysis/version.mjs

@@ -1,6 +1,6 @@
 // src/version.ts
 var SDK_NAME = "@corbado/observe";
-var SDK_VERSION = true ? "1.12.0" : "0.0.0-dev";
+var SDK_VERSION = true ? "1.13.0" : "0.0.0-dev";
 export {
   SDK_NAME,
   SDK_VERSION