@edraj/sauron-browser 1.3.0 → 1.4.0

package/CHANGELOG.md

@@ -2,6 +2,59 @@
 
 All notable changes to `@edraj/sauron-browser` are documented here.
 
+## 1.4.0
+
+### Fixed
+
+- **`captureMessage()` poisoned the entire envelope.** It sent an `exception`
+  block with `type: null`, but the gateway's `ExceptionInfo.ty` is a
+  non-optional string with no default, so the envelope failed to deserialize and
+  was rejected whole (`400 invalid_envelope`) — taking every unrelated error,
+  event and transaction batched alongside it. Every SDK treats a 400 as
+  non-retryable, so the batch was dropped without a retry and without a trace.
+  A message item now carries no `exception` block at all and puts its text in
+  `message`, which is the shape the Python SDK already sent.
+
+  Worth knowing before you upgrade: this also changes server-side grouping.
+  Messages now fingerprint on their normalized text instead of piling into one
+  bucket keyed by a synthetic exception type, so existing message issues will
+  re-split into separate issues.
+- **A failed offline-queue drain silently deleted the rest of the backlog.**
+  `drain()` empties `localStorage` in one shot, so from that point the parked
+  envelopes exist only in a local array — and a send failure re-parked just the
+  payload that had failed before returning, discarding every payload behind it.
+  The whole untried remainder is now re-parked, at the head, preserving the
+  oldest-first order the byte-cap eviction policy depends on. This is the plain
+  reconnect-then-one-500 case the queue exists for. A 401/403 mid-drain now
+  keeps the backlog too — the credentials may be fixed and the client
+  re-inited — and logs a warning instead of disabling in silence.
+
+### Changed
+
+- The anonymous id is now persisted in `localStorage` under `sauron.anon_id`
+  instead of being re-minted in memory on every page load. **Every web app's
+  reported active-user count drops sharply and permanently on the day this is
+  adopted** — the old behaviour counted page loads, not people (a 5-10x
+  inflation, all of it in the "guest" half of the Active Users report). The
+  drop is a data artifact, not a regression.
+- The anonymous id is a durable first-party identifier stored on the user's
+  terminal. That is a retention and consent consequence, not just an
+  implementation detail.
+- `ExceptionValue.type` is `string`, no longer `string | null`, and `ErrorItem`
+  gained an optional `message`. A TypeScript caller that builds these by hand
+  will now see a type error where it previously compiled — passing `null` there
+  is precisely what produced the envelope rejection above.
+
+### Added
+
+- `reset()` — clears the scope user and mints a fresh anonymous id.
+  **Call it on logout.** `setUser(null)` now calls it for you. Without it, the
+  next anonymous visitor on a shared browser reuses the persisted id and a
+  later `identify()` aliases their activity to the previous account,
+  server-side, permanently.
+- `anonymous_id` is sent on the identify item only when the anonymous id was
+  actually used as a `distinct_id` in this browser session.
+
 ## 1.3.0
 
 - **Workflows** — bound a named span of activity with start / end / cancel, and

package/README.md

@@ -92,7 +92,9 @@ Sauron.init({
   sampleRate: 0.5,
   maxBreadcrumbs: 100,
   beforeSend(item, hint) {
-    if (item.type === 'error' && item.exception.value?.includes('token=')) {
+    // `exception` is optional — a `captureMessage` item has none, and carries
+    // its text in `item.message` instead.
+    if (item.type === 'error' && item.exception?.value?.includes('token=')) {
       return null; // PII escape hatch
     }
     return item;
@@ -221,13 +223,24 @@ function captureMessage(message: string, level?: Level, hint?: Hint): void
 
 | Parameter | Type | Default | Description |
 | --- | --- | --- | --- |
-| `message` | `string` | — (required) | Becomes `exception.value`; `exception.type` is `null`. |
+| `message` | `string` | — (required) | Becomes the item's `message`. |
 | `level` | `Level` | `'info'` | Severity. |
-| `hint` | `Hint` | `undefined` | Only `fingerprint`, `event_id`, `message`, `tags`, `contexts` and `extra` are read here — unlike `captureException`, `hint.level`, `hint.mechanism` and `hint.screen` are ignored. |
-
-Emits an error item with mechanism `{ type: 'message', handled: true }`, an
-empty stack trace, the current breadcrumb trail and the current screen. Counts
-against `sampleRate` like any other error item. Returns `void`.
+| `hint` | `Hint` | `undefined` | Only `fingerprint`, `event_id`, `tags`, `contexts` and `extra` are read here — unlike `captureException`, `hint.level`, `hint.mechanism` and `hint.screen` are ignored, and `hint.message` no longer applies because the `message` argument already occupies that field. |
+
+Emits an error item that carries **no `exception` block at all** — a message is
+not an exception — plus the current breadcrumb trail and the current screen.
+Server-side it groups on the message-fallback fingerprint
+(`message` + the message text, normalized), so distinct messages become distinct
+issues instead of piling into one bucket keyed by a synthetic exception type.
+Counts against `sampleRate` like any other error item. Returns `void`.
+
+> Through 1.3.0 this shipped `exception: { type: null, value: message }`. The
+> gateway's exception type is a non-nullable string, so that item failed to
+> deserialize and the whole envelope came back `400 invalid_envelope` — and since
+> a 400 is a non-retryable drop, **every other item batched with it (up to
+> `maxBatch`, default 30) was silently lost too**. If you have a `beforeSend`
+> hook or any code reading `item.exception` on message items, note that the field
+> is now absent and `item.message` carries the text.
 
 ```ts
 Sauron.captureMessage('payment provider returned a soft decline', 'warning', {
@@ -809,7 +822,7 @@ const appFrames = frames.filter((f) => isInAppFrame(f.filename));
 
 ```ts
 const SDK_NAME: string  // 'sauron.javascript'
-const SDK_VERSION: string // '1.2.0'
+const SDK_VERSION: string // '1.4.0'
 ```
 
 The SDK identity embedded in `header.sdk` of every envelope.
@@ -933,7 +946,7 @@ Sauron.track('upgraded', {}, { tags: { tier: 'trial' } });
 
 ```html
 <script type="module">
-  import { Sauron } from 'https://esm.sh/@edraj/sauron-browser@1.2.0';
+  import { Sauron } from 'https://esm.sh/@edraj/sauron-browser@1.4.0';
   Sauron.init({ dsn: 'https://pk_test@ingest.example.com/42' });
 </script>
 ```
@@ -994,9 +1007,16 @@ is parked in the offline queue.
 byte-capped at `maxQueueBytes` (default 1 MiB); the oldest entries are evicted
 first and at least one entry is always kept. It is drained at `init()`, at the
 start of every `flush()`, and on the window `online` event. If a drained
-envelope still fails, it is re-parked and draining stops to avoid a tight loop.
-When `localStorage` is unavailable the queue is disabled and failed envelopes
-are dropped.
+envelope still fails, **it and every envelope behind it are re-parked at the head
+of the queue** (order preserved) and draining stops to avoid a tight loop — a
+single 500 on reconnect costs you nothing. Same on a 401/403: the client
+disables itself but the backlog is kept, so fixing the key and re-`init()`ing
+still delivers it. When `localStorage` is unavailable the queue is disabled and
+failed envelopes are dropped.
+
+> Through 1.3.0 the drain deleted the whole `localStorage` backlog up front and
+> re-parked only the one envelope that failed, so everything queued behind it was
+> lost — the exact reconnect-then-one-500 scenario the queue exists for.
 
 **Page unload.** On `visibilitychange` → `hidden` and on `pagehide`, the pending
 batch is chunked to 1000 items and handed to `navigator.sendBeacon` as an

package/dist/index.cjs

@@ -8,7 +8,7 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
 
 // src/utils.ts
 var SDK_NAME = "sauron.javascript";
-var SDK_VERSION = "1.3.0";
+var SDK_VERSION = "1.4.0";
 function getGlobal() {
   return globalThis;
 }
@@ -91,6 +91,7 @@ function makeLogger(debug) {
 // src/identity.ts
 var DEVICE_ID_KEY = "sauron.device_id";
 var SESSION_ID_KEY = "sauron.session_id";
+var ANON_ID_KEY = "sauron.anon_id";
 function webStorage(name) {
   try {
     const s = globalThis[name];
@@ -123,6 +124,7 @@ function persistentId(cached, storage, key) {
 }
 var deviceId = null;
 var sessionId = null;
+var anonymousId = null;
 function getDeviceId() {
   deviceId = persistentId(deviceId, webStorage("localStorage"), DEVICE_ID_KEY);
   return deviceId;
@@ -131,6 +133,40 @@ function getSessionId() {
   sessionId = persistentId(sessionId, webStorage("sessionStorage"), SESSION_ID_KEY);
   return sessionId;
 }
+function getAnonymousId() {
+  if (anonymousId) return anonymousId;
+  const storage = webStorage("localStorage");
+  if (storage) {
+    try {
+      const existing = storage.getItem(ANON_ID_KEY);
+      if (existing) {
+        anonymousId = existing;
+        return anonymousId;
+      }
+    } catch {
+    }
+  }
+  const fresh = `anon_${uuidv4()}`;
+  if (storage) {
+    try {
+      storage.setItem(ANON_ID_KEY, fresh);
+    } catch {
+    }
+  }
+  anonymousId = fresh;
+  return anonymousId;
+}
+function resetAnonymousId() {
+  anonymousId = null;
+  const storage = webStorage("localStorage");
+  if (storage) {
+    try {
+      storage.removeItem(ANON_ID_KEY);
+    } catch {
+    }
+  }
+  return getAnonymousId();
+}
 
 // src/context.ts
 function getNavigator() {
@@ -628,12 +664,7 @@ function captureMessage(message, level = "info", hint) {
     type: "error",
     timestamp: nowIso(),
     level,
-    exception: {
-      type: null,
-      value: message,
-      mechanism: { type: "message", handled: true },
-      stacktrace: []
-    },
+    message,
     breadcrumbs,
     fingerprint: hint?.fingerprint ?? null,
     session_id: getSessionId(),
@@ -889,12 +920,12 @@ function setScreen(name) {
 function identify(id, traits = {}) {
   const client = getClient();
   if (!client) return;
-  const anonymousId = client.getAnonymousId();
+  const anonymousId2 = client.getAnonymousId();
   client.getScope().setUser({ id, traits });
   const item = {
     type: "identify",
     distinct_id: id,
-    anonymous_id: anonymousId,
+    anonymous_id: anonymousId2,
     traits: traits ?? {}
   };
   client.captureItem(item);
@@ -1399,6 +1430,21 @@ var OfflineQueue = class {
     if (entries.length) this.write([]);
     return entries;
   }
+  /**
+   * Put drained payloads BACK at the head, keeping their relative order.
+   *
+   * The counterpart to {@link drain}: a drain empties the store immediately, so
+   * whatever the caller could not deliver only exists in its local array and is
+   * lost the moment the caller returns. Re-parking at the head (rather than via
+   * {@link enqueue}) keeps the queue oldest-first, which is what the byte-cap
+   * eviction policy assumes — the oldest entry must stay the first one evicted.
+   */
+  requeueFront(payloads) {
+    if (!this.storage || payloads.length === 0) return;
+    const entries = [...payloads, ...this.read()];
+    this.evict(entries);
+    this.write(entries);
+  }
   /** Non-destructive read of the current entries, oldest first. */
   peek() {
     return this.read();
@@ -1584,11 +1630,21 @@ var Transport = class {
       }
     }
   }
-  /** Re-attempt any envelopes that were parked while offline. */
+  /**
+   * Re-attempt any envelopes that were parked while offline.
+   *
+   * `drain()` empties `localStorage` in one shot, so from here on the ONLY copy
+   * of the backlog is the local `payloads` array. Every early return therefore
+   * has to re-park the whole untried remainder, not just the payload that
+   * failed: this used to re-park the failing one and return, which silently
+   * deleted every payload behind it — the exact reconnect-then-one-500 case the
+   * queue exists for.
+   */
   async drainOfflineQueue() {
     if (this.disabled || !this.offline.available) return;
     const payloads = this.offline.drain();
-    for (const json of payloads) {
+    for (let i = 0; i < payloads.length; i++) {
+      const json = payloads[i];
       let outcome;
       try {
         outcome = await this.post(json);
@@ -1596,13 +1652,14 @@ var Transport = class {
         outcome = { action: "retry_backoff" };
       }
       if (outcome.action === "disable") {
+        this.logger.warn("server rejected credentials while draining; disabling client");
         this.disable();
         this.onDisable();
-        this.offline.enqueue(json);
+        this.offline.requeueFront(payloads.slice(i));
         return;
       }
       if (outcome.action === "retry_after" || outcome.action === "retry_backoff") {
-        this.offline.enqueue(json);
+        this.offline.requeueFront(payloads.slice(i));
         return;
       }
     }
@@ -1712,8 +1769,17 @@ var SauronClient = class {
     __publicField(this, "nativeFetch");
     __publicField(this, "enabled", true);
     __publicField(this, "installed", false);
-    __publicField(this, "anonymousId", null);
     __publicField(this, "beaconCleanup", null);
+    /**
+     * Whether the anonymous id has actually been USED as a `distinct_id` in this
+     * browser session.
+     *
+     * A persisted id that has never been observed anonymously must not create a
+     * permanent `identities` alias row on the server: aliasing is a durable
+     * server-side binding of this browser profile to a named user, and an
+     * identify() on a first-ever page load has no anonymous history to link.
+     */
+    __publicField(this, "anonUsed", false);
     this.options = options;
     this.dsn = parseDsn(options.dsn);
     this.logger = makeLogger(options.debug);
@@ -1780,15 +1846,25 @@ var SauronClient = class {
   getDistinctId() {
     const user = this.scope.getUser();
     if (user.id) return user.id;
-    return this.ensureAnonymousId();
+    this.anonUsed = true;
+    return getAnonymousId();
   }
-  /** The anonymous id, or null if one was never needed. */
+  /** The anonymous id, or null when it was never actually used as an identity. */
   getAnonymousId() {
-    return this.anonymousId;
+    return this.anonUsed ? getAnonymousId() : null;
   }
-  ensureAnonymousId() {
-    if (!this.anonymousId) this.anonymousId = `anon_${uuidv4()}`;
-    return this.anonymousId;
+  /**
+   * Forget the current person: clear the scope user and mint a fresh anonymous
+   * id.
+   *
+   * MUST BE CALLED ON LOGOUT. Without it, the next anonymous visitor on this
+   * browser reuses the persisted anon id, and a later identify() aliases their
+   * activity to the previous account server-side, permanently.
+   */
+  reset() {
+    this.scope.setUser(null);
+    resetAnonymousId();
+    this.anonUsed = false;
   }
   /** Stamp a fresh envelope (new `sent_at`, current context) around `items`. */
   makeEnvelope(items) {
@@ -2047,8 +2123,15 @@ function addBreadcrumb2(breadcrumb, hint) {
   addBreadcrumb(breadcrumb, hint);
 }
 function setUser(user) {
+  if (user === null) {
+    getClient()?.reset();
+    return;
+  }
   getClient()?.getScope().setUser(user);
 }
+function reset() {
+  getClient()?.reset();
+}
 function setTag(key, value) {
   getClient()?.getScope().setTag(key, value);
 }
@@ -2078,6 +2161,7 @@ var Sauron = {
   identify: identify2,
   addBreadcrumb: addBreadcrumb2,
   setUser,
+  reset,
   setTag,
   setTags,
   setContext,
@@ -2117,6 +2201,7 @@ exports.isInAppFrame = isInAppFrame;
 exports.parseDsn = parseDsn;
 exports.parseError = parseError;
 exports.parseStackString = parseStackString;
+exports.reset = reset;
 exports.setContext = setContext;
 exports.setExtra = setExtra;
 exports.setScreen = setScreen2;