@edraj/sauron-browser 1.4.0 → 1.5.0

package/dist/index.d.cts

@@ -144,6 +144,19 @@ interface TransactionItem {
     workflow_id?: string;
     workflow_name?: string;
     timestamp: string;
+    /**
+     * Developer-supplied flat string tags for THIS transaction.
+     *
+     * Unlike {@link EventItem} and the error item, this is NOT merged with the
+     * scope — see {@link TransactionInput.tags}. Omitted entirely when empty.
+     */
+    tags?: Record<string, string>;
+    /**
+     * Developer-supplied freeform JSON for THIS transaction — the request body,
+     * the response body, a retry count. Capped and replaced with a truncation
+     * marker past {@link MAX_TRANSACTION_EXTRA_BYTES}. Omitted when empty.
+     */
+    extra?: Record<string, unknown>;
 }
 /** An identity association (PostHog-style `identify`). */
 interface IdentifyItem {
@@ -330,6 +343,29 @@ interface TransactionInput {
     httpMethod?: string | null;
     httpStatus?: number | null;
     url?: string | null;
+    /**
+     * Flat string tags for this transaction.
+     *
+     * **Per-call only — the scope is NOT merged in**, which is the one place
+     * transactions differ from `track()` and `captureException()`. Those two
+     * merge `setTag`/`setExtra` defaults; a transaction carries only what its own
+     * call site attached. Transactions are the highest-volume signal (one per
+     * navigation and per HTTP call), so inheriting a global blob would write it
+     * onto every row.
+     */
+    tags?: Record<string, string>;
+    /**
+     * Freeform JSON for this transaction — the request body, the response body,
+     * an order id, a retry count.
+     *
+     * Per-call only, for the reason on {@link TransactionInput.tags}. Serialized
+     * and capped at {@link MAX_TRANSACTION_EXTRA_BYTES}; past that the whole map
+     * is replaced with `{ _truncated: true, _bytes: N }` so one large body cannot
+     * take a batched envelope over the ingest limit and drop every span in it.
+     *
+     * Nothing here is scrubbed. `beforeSend` is the redaction seam.
+     */
+    extra?: Record<string, unknown>;
 }
 
 /**
@@ -374,6 +410,24 @@ declare class Scope {
     readonly extra: Record<string, unknown>;
     constructor(maxBreadcrumbs?: number);
     setMaxBreadcrumbs(max: number): void;
+    /**
+     * Replace the scope user.
+     *
+     * `id` is coerced with `String()` for the same reason `SauronClient.
+     * prepareIdentify` coerces its own — a plain-JS caller can (and does) pass
+     * `setUser({ id: user.id })` where `user.id` is a number, and TypeScript
+     * cannot stop them. This path is the one that BYPASSES `identify()`'s
+     * coercion entirely, and the consequence is not cosmetic: the scope user
+     * lands in the envelope context, where the server's `distinct_id` is a
+     * non-`Option` Rust `String`. A JSON number there fails deserialization of
+     * the ENVELOPE, not of the one field — so the whole batch 400s, and a 400
+     * is non-retryable, so every event in it is dropped for good.
+     *
+     * Rebuilding the whole object (rather than merging into the existing one)
+     * is deliberate and is the behaviour the Flutter SDK was fixed to match:
+     * `email` and `traits` come from the input alone, so setting a new user
+     * never inherits the previous person's contact details.
+     */
     setUser(user: UserInput): void;
     /** The user context for an envelope. Never null — defaults to an empty user. */
     getUser(): UserContext;
@@ -438,14 +492,40 @@ declare class SauronClient {
     /** The anonymous id, or null when it was never actually used as an identity. */
     getAnonymousId(): string | null;
     /**
-     * Forget the current person: clear the scope user and mint a fresh anonymous
-     * id.
+     * Forget the current person: clear the scope user, mint a fresh anonymous
+     * id, forget the last identified user, and rotate the session id.
      *
      * MUST BE CALLED ON LOGOUT. Without it, the next anonymous visitor on this
      * browser reuses the persisted anon id, and a later identify() aliases their
-     * activity to the previous account server-side, permanently.
+     * activity to the previous account server-side, permanently. Rotating the
+     * session id matters too: the server's `bump_session` is last-write-wins on
+     * `distinct_id`, so without rotation one `sessions` row could otherwise
+     * serially represent two different people and record only whichever wrote
+     * last.
      */
     reset(): void;
+    /**
+     * Prepare for an `identify()`; returns the `anonymous_id` to send.
+     *
+     * When a DIFFERENT user identifies than last time, the current anon id
+     * belongs to the previous person and is already burned server-side, so it is
+     * replaced before anything else happens and `null` is sent instead of a
+     * cross-user alias. This cannot repair events already sent under the burned
+     * alias — nothing can — but it bounds a forgotten `reset()` to one guest
+     * window instead of every future one.
+     *
+     * `id` is coerced with `String()` before comparing/persisting: a plain-JS
+     * caller can pass a number (`Sauron.identify(user.id)`), and `Storage`
+     * itself applies `ToString` on write — so comparing an un-coerced `id`
+     * against a value that already round-tripped through storage would treat
+     * the SAME numeric user as a switch on every single call. The comparison
+     * against `last` is an explicit `!== null` (not a truthiness check) so an
+     * app that (unusually) identifies with `''` still has a later, different id
+     * correctly detected as a real switch — a falsy string is not "no identity
+     * yet". `last`/the persisted value are digests, not the raw id — see
+     * `hashIdentity`.
+     */
+    prepareIdentify(id: string): string | null;
     /** Stamp a fresh envelope (new `sent_at`, current context) around `items`. */
     makeEnvelope(items: EnvelopeItem[]): Envelope;
     /** Add a breadcrumb, running it through `beforeBreadcrumb` first. */
@@ -517,7 +597,34 @@ declare function parseError(err: unknown): Frame[];
 /** Small dependency-free helpers shared across the SDK. */
 /** SDK identity, embedded in every envelope header. */
 declare const SDK_NAME = "sauron.javascript";
-declare const SDK_VERSION = "1.4.0";
+declare const SDK_VERSION = "1.5.0";
+/**
+ * Largest serialized `extra` a single transaction may carry, in bytes.
+ *
+ * Transactions are the highest-volume signal and they ship in BATCHED
+ * envelopes, so one oversized payload does not fail alone — ingest rejects the
+ * whole envelope past `INGEST_MAX_BODY_BYTES` (1 MiB by default) and every
+ * unrelated span batched with it is lost. Since the motivating use of
+ * transaction `extra` is request and response bodies, that is not a remote
+ * hazard.
+ */
+declare const MAX_TRANSACTION_EXTRA_BYTES: number;
+/**
+ * Cap a transaction's `extra`, substituting a marker when it is too large.
+ *
+ * Replaces the WHOLE map rather than trimming keys: a half-written JSON value
+ * is worse than an honest marker, and per-key trimming would make the result
+ * depend on key iteration order, which differs across the five SDKs. The
+ * marker is deliberately readable on the dashboard — `_truncated` says data
+ * was dropped rather than silently serving a short object that looks complete.
+ *
+ * Returns the input unchanged when it fits. A value that cannot be serialized
+ * at all (a cycle, a BigInt) is replaced by the same marker with `_bytes: -1`,
+ * because the alternative is throwing from inside `trackTransaction` — and an
+ * SDK that crashes the app it is measuring is worse than one that drops a
+ * payload.
+ */
+declare function capTransactionExtra(extra: Record<string, unknown>, maxBytes?: number): Record<string, unknown>;
 
 /**
  * `@edraj/sauron-browser` — public API surface.
@@ -540,7 +647,16 @@ declare function captureException(err: unknown, hint?: Hint): void;
 declare function captureMessage(message: string, level?: Level, hint?: Hint): void;
 /** Record a product-analytics event, optionally with per-call tags/contexts/extra. */
 declare function track(name: string, properties?: Record<string, unknown>, options?: TrackOptions): void;
-/** Associate the session with a known user. */
+/**
+ * Associate the session with a known user.
+ *
+ * The `anonymous_id` sent with the identify item is the current anon id — but
+ * only when it was actually used as a `distinct_id` this session, and never
+ * when it belongs to a different person than the last one who identified on
+ * this device. In that case a fresh anon id is minted first and `null` is
+ * sent instead, since the old one is already permanently bound to the
+ * previous person server-side (see `reset()`).
+ */
 declare function identify(id: string, traits?: Record<string, unknown>): void;
 /** Record a performance transaction (navigation, http, screen load, ...). */
 declare function trackTransaction(input: TransactionInput): void;
@@ -570,14 +686,15 @@ declare function addBreadcrumb(breadcrumb: BreadcrumbInput, hint?: Hint): void;
 /**
  * Set (or clear, with `null`) the current user.
  *
- * `setUser(null)` is a logout, so it also rotates the anonymous id — otherwise
+ * `setUser(null)` is a logout, so it also calls `reset()` for you — otherwise
  * the next anonymous visitor on this browser inherits the previous person's
  * durable id and a later identify() aliases them together server-side.
  */
 declare function setUser(user: UserInput): void;
 /**
- * Forget the current person: clears the scope user and mints a fresh anonymous
- * id. Call this on logout.
+ * Forget the current person: clears the scope user, mints a fresh anonymous
+ * id, forgets the last identified user, and rotates the session id so a
+ * single session can never span two different people. Call this on logout.
  */
 declare function reset(): void;
 /** Set a single scope tag (lifted onto later errors/events). */
@@ -619,4 +736,4 @@ declare const Sauron: {
     getClient: typeof getClient;
 };
 
-export { type ActiveWorkflow, type AppContext, type BeforeBreadcrumb, type BeforeSend, type Breadcrumb, type BreadcrumbBatchItem, type BreadcrumbInput, type CaptureOptions, type Context, type DeviceContext, type Dsn, DsnError, type Envelope, type EnvelopeHeader, type EnvelopeItem, type ErrorItem, type EventItem, type ExceptionValue, type Frame, type Hint, type IdentifyItem, type InitOptions, type ItemType, type Level, type Mechanism, type OsContext, type ResolvedOptions, type RuntimeContext, SDK_NAME, SDK_VERSION, Sauron, SauronClient, type SdkInfo, type TrackOptions, type TransactionInput, type TransactionItem, type TransactionOp, type TransportOptions, type UserContext, type UserInput, type WorkflowResult, type WorkflowStatus, addBreadcrumb, buildEnvelope, cancelWorkflow, captureException, captureMessage, close, Sauron as default, endWorkflow, flush, getClient, getScreen, getWorkflow, identify, init, isInAppFrame, parseDsn, parseError, parseStackString, reset, setContext, setExtra, setScreen, setTag, setTags, setUser, startWorkflow, track, trackTransaction };
+export { type ActiveWorkflow, type AppContext, type BeforeBreadcrumb, type BeforeSend, type Breadcrumb, type BreadcrumbBatchItem, type BreadcrumbInput, type CaptureOptions, type Context, type DeviceContext, type Dsn, DsnError, type Envelope, type EnvelopeHeader, type EnvelopeItem, type ErrorItem, type EventItem, type ExceptionValue, type Frame, type Hint, type IdentifyItem, type InitOptions, type ItemType, type Level, MAX_TRANSACTION_EXTRA_BYTES, type Mechanism, type OsContext, type ResolvedOptions, type RuntimeContext, SDK_NAME, SDK_VERSION, Sauron, SauronClient, type SdkInfo, type TrackOptions, type TransactionInput, type TransactionItem, type TransactionOp, type TransportOptions, type UserContext, type UserInput, type WorkflowResult, type WorkflowStatus, addBreadcrumb, buildEnvelope, cancelWorkflow, capTransactionExtra, captureException, captureMessage, close, Sauron as default, endWorkflow, flush, getClient, getScreen, getWorkflow, identify, init, isInAppFrame, parseDsn, parseError, parseStackString, reset, setContext, setExtra, setScreen, setTag, setTags, setUser, startWorkflow, track, trackTransaction };

package/dist/index.d.ts

@@ -144,6 +144,19 @@ interface TransactionItem {
     workflow_id?: string;
     workflow_name?: string;
     timestamp: string;
+    /**
+     * Developer-supplied flat string tags for THIS transaction.
+     *
+     * Unlike {@link EventItem} and the error item, this is NOT merged with the
+     * scope — see {@link TransactionInput.tags}. Omitted entirely when empty.
+     */
+    tags?: Record<string, string>;
+    /**
+     * Developer-supplied freeform JSON for THIS transaction — the request body,
+     * the response body, a retry count. Capped and replaced with a truncation
+     * marker past {@link MAX_TRANSACTION_EXTRA_BYTES}. Omitted when empty.
+     */
+    extra?: Record<string, unknown>;
 }
 /** An identity association (PostHog-style `identify`). */
 interface IdentifyItem {
@@ -330,6 +343,29 @@ interface TransactionInput {
     httpMethod?: string | null;
     httpStatus?: number | null;
     url?: string | null;
+    /**
+     * Flat string tags for this transaction.
+     *
+     * **Per-call only — the scope is NOT merged in**, which is the one place
+     * transactions differ from `track()` and `captureException()`. Those two
+     * merge `setTag`/`setExtra` defaults; a transaction carries only what its own
+     * call site attached. Transactions are the highest-volume signal (one per
+     * navigation and per HTTP call), so inheriting a global blob would write it
+     * onto every row.
+     */
+    tags?: Record<string, string>;
+    /**
+     * Freeform JSON for this transaction — the request body, the response body,
+     * an order id, a retry count.
+     *
+     * Per-call only, for the reason on {@link TransactionInput.tags}. Serialized
+     * and capped at {@link MAX_TRANSACTION_EXTRA_BYTES}; past that the whole map
+     * is replaced with `{ _truncated: true, _bytes: N }` so one large body cannot
+     * take a batched envelope over the ingest limit and drop every span in it.
+     *
+     * Nothing here is scrubbed. `beforeSend` is the redaction seam.
+     */
+    extra?: Record<string, unknown>;
 }
 
 /**
@@ -374,6 +410,24 @@ declare class Scope {
     readonly extra: Record<string, unknown>;
     constructor(maxBreadcrumbs?: number);
     setMaxBreadcrumbs(max: number): void;
+    /**
+     * Replace the scope user.
+     *
+     * `id` is coerced with `String()` for the same reason `SauronClient.
+     * prepareIdentify` coerces its own — a plain-JS caller can (and does) pass
+     * `setUser({ id: user.id })` where `user.id` is a number, and TypeScript
+     * cannot stop them. This path is the one that BYPASSES `identify()`'s
+     * coercion entirely, and the consequence is not cosmetic: the scope user
+     * lands in the envelope context, where the server's `distinct_id` is a
+     * non-`Option` Rust `String`. A JSON number there fails deserialization of
+     * the ENVELOPE, not of the one field — so the whole batch 400s, and a 400
+     * is non-retryable, so every event in it is dropped for good.
+     *
+     * Rebuilding the whole object (rather than merging into the existing one)
+     * is deliberate and is the behaviour the Flutter SDK was fixed to match:
+     * `email` and `traits` come from the input alone, so setting a new user
+     * never inherits the previous person's contact details.
+     */
     setUser(user: UserInput): void;
     /** The user context for an envelope. Never null — defaults to an empty user. */
     getUser(): UserContext;
@@ -438,14 +492,40 @@ declare class SauronClient {
     /** The anonymous id, or null when it was never actually used as an identity. */
     getAnonymousId(): string | null;
     /**
-     * Forget the current person: clear the scope user and mint a fresh anonymous
-     * id.
+     * Forget the current person: clear the scope user, mint a fresh anonymous
+     * id, forget the last identified user, and rotate the session id.
      *
      * MUST BE CALLED ON LOGOUT. Without it, the next anonymous visitor on this
      * browser reuses the persisted anon id, and a later identify() aliases their
-     * activity to the previous account server-side, permanently.
+     * activity to the previous account server-side, permanently. Rotating the
+     * session id matters too: the server's `bump_session` is last-write-wins on
+     * `distinct_id`, so without rotation one `sessions` row could otherwise
+     * serially represent two different people and record only whichever wrote
+     * last.
      */
     reset(): void;
+    /**
+     * Prepare for an `identify()`; returns the `anonymous_id` to send.
+     *
+     * When a DIFFERENT user identifies than last time, the current anon id
+     * belongs to the previous person and is already burned server-side, so it is
+     * replaced before anything else happens and `null` is sent instead of a
+     * cross-user alias. This cannot repair events already sent under the burned
+     * alias — nothing can — but it bounds a forgotten `reset()` to one guest
+     * window instead of every future one.
+     *
+     * `id` is coerced with `String()` before comparing/persisting: a plain-JS
+     * caller can pass a number (`Sauron.identify(user.id)`), and `Storage`
+     * itself applies `ToString` on write — so comparing an un-coerced `id`
+     * against a value that already round-tripped through storage would treat
+     * the SAME numeric user as a switch on every single call. The comparison
+     * against `last` is an explicit `!== null` (not a truthiness check) so an
+     * app that (unusually) identifies with `''` still has a later, different id
+     * correctly detected as a real switch — a falsy string is not "no identity
+     * yet". `last`/the persisted value are digests, not the raw id — see
+     * `hashIdentity`.
+     */
+    prepareIdentify(id: string): string | null;
     /** Stamp a fresh envelope (new `sent_at`, current context) around `items`. */
     makeEnvelope(items: EnvelopeItem[]): Envelope;
     /** Add a breadcrumb, running it through `beforeBreadcrumb` first. */
@@ -517,7 +597,34 @@ declare function parseError(err: unknown): Frame[];
 /** Small dependency-free helpers shared across the SDK. */
 /** SDK identity, embedded in every envelope header. */
 declare const SDK_NAME = "sauron.javascript";
-declare const SDK_VERSION = "1.4.0";
+declare const SDK_VERSION = "1.5.0";
+/**
+ * Largest serialized `extra` a single transaction may carry, in bytes.
+ *
+ * Transactions are the highest-volume signal and they ship in BATCHED
+ * envelopes, so one oversized payload does not fail alone — ingest rejects the
+ * whole envelope past `INGEST_MAX_BODY_BYTES` (1 MiB by default) and every
+ * unrelated span batched with it is lost. Since the motivating use of
+ * transaction `extra` is request and response bodies, that is not a remote
+ * hazard.
+ */
+declare const MAX_TRANSACTION_EXTRA_BYTES: number;
+/**
+ * Cap a transaction's `extra`, substituting a marker when it is too large.
+ *
+ * Replaces the WHOLE map rather than trimming keys: a half-written JSON value
+ * is worse than an honest marker, and per-key trimming would make the result
+ * depend on key iteration order, which differs across the five SDKs. The
+ * marker is deliberately readable on the dashboard — `_truncated` says data
+ * was dropped rather than silently serving a short object that looks complete.
+ *
+ * Returns the input unchanged when it fits. A value that cannot be serialized
+ * at all (a cycle, a BigInt) is replaced by the same marker with `_bytes: -1`,
+ * because the alternative is throwing from inside `trackTransaction` — and an
+ * SDK that crashes the app it is measuring is worse than one that drops a
+ * payload.
+ */
+declare function capTransactionExtra(extra: Record<string, unknown>, maxBytes?: number): Record<string, unknown>;
 
 /**
  * `@edraj/sauron-browser` — public API surface.
@@ -540,7 +647,16 @@ declare function captureException(err: unknown, hint?: Hint): void;
 declare function captureMessage(message: string, level?: Level, hint?: Hint): void;
 /** Record a product-analytics event, optionally with per-call tags/contexts/extra. */
 declare function track(name: string, properties?: Record<string, unknown>, options?: TrackOptions): void;
-/** Associate the session with a known user. */
+/**
+ * Associate the session with a known user.
+ *
+ * The `anonymous_id` sent with the identify item is the current anon id — but
+ * only when it was actually used as a `distinct_id` this session, and never
+ * when it belongs to a different person than the last one who identified on
+ * this device. In that case a fresh anon id is minted first and `null` is
+ * sent instead, since the old one is already permanently bound to the
+ * previous person server-side (see `reset()`).
+ */
 declare function identify(id: string, traits?: Record<string, unknown>): void;
 /** Record a performance transaction (navigation, http, screen load, ...). */
 declare function trackTransaction(input: TransactionInput): void;
@@ -570,14 +686,15 @@ declare function addBreadcrumb(breadcrumb: BreadcrumbInput, hint?: Hint): void;
 /**
  * Set (or clear, with `null`) the current user.
  *
- * `setUser(null)` is a logout, so it also rotates the anonymous id — otherwise
+ * `setUser(null)` is a logout, so it also calls `reset()` for you — otherwise
  * the next anonymous visitor on this browser inherits the previous person's
  * durable id and a later identify() aliases them together server-side.
  */
 declare function setUser(user: UserInput): void;
 /**
- * Forget the current person: clears the scope user and mints a fresh anonymous
- * id. Call this on logout.
+ * Forget the current person: clears the scope user, mints a fresh anonymous
+ * id, forgets the last identified user, and rotates the session id so a
+ * single session can never span two different people. Call this on logout.
  */
 declare function reset(): void;
 /** Set a single scope tag (lifted onto later errors/events). */
@@ -619,4 +736,4 @@ declare const Sauron: {
     getClient: typeof getClient;
 };
 
-export { type ActiveWorkflow, type AppContext, type BeforeBreadcrumb, type BeforeSend, type Breadcrumb, type BreadcrumbBatchItem, type BreadcrumbInput, type CaptureOptions, type Context, type DeviceContext, type Dsn, DsnError, type Envelope, type EnvelopeHeader, type EnvelopeItem, type ErrorItem, type EventItem, type ExceptionValue, type Frame, type Hint, type IdentifyItem, type InitOptions, type ItemType, type Level, type Mechanism, type OsContext, type ResolvedOptions, type RuntimeContext, SDK_NAME, SDK_VERSION, Sauron, SauronClient, type SdkInfo, type TrackOptions, type TransactionInput, type TransactionItem, type TransactionOp, type TransportOptions, type UserContext, type UserInput, type WorkflowResult, type WorkflowStatus, addBreadcrumb, buildEnvelope, cancelWorkflow, captureException, captureMessage, close, Sauron as default, endWorkflow, flush, getClient, getScreen, getWorkflow, identify, init, isInAppFrame, parseDsn, parseError, parseStackString, reset, setContext, setExtra, setScreen, setTag, setTags, setUser, startWorkflow, track, trackTransaction };
+export { type ActiveWorkflow, type AppContext, type BeforeBreadcrumb, type BeforeSend, type Breadcrumb, type BreadcrumbBatchItem, type BreadcrumbInput, type CaptureOptions, type Context, type DeviceContext, type Dsn, DsnError, type Envelope, type EnvelopeHeader, type EnvelopeItem, type ErrorItem, type EventItem, type ExceptionValue, type Frame, type Hint, type IdentifyItem, type InitOptions, type ItemType, type Level, MAX_TRANSACTION_EXTRA_BYTES, type Mechanism, type OsContext, type ResolvedOptions, type RuntimeContext, SDK_NAME, SDK_VERSION, Sauron, SauronClient, type SdkInfo, type TrackOptions, type TransactionInput, type TransactionItem, type TransactionOp, type TransportOptions, type UserContext, type UserInput, type WorkflowResult, type WorkflowStatus, addBreadcrumb, buildEnvelope, cancelWorkflow, capTransactionExtra, captureException, captureMessage, close, Sauron as default, endWorkflow, flush, getClient, getScreen, getWorkflow, identify, init, isInAppFrame, parseDsn, parseError, parseStackString, reset, setContext, setExtra, setScreen, setTag, setTags, setUser, startWorkflow, track, trackTransaction };

package/dist/index.js

@@ -4,7 +4,7 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
 
 // src/utils.ts
 var SDK_NAME = "sauron.javascript";
-var SDK_VERSION = "1.4.0";
+var SDK_VERSION = "1.5.0";
 function getGlobal() {
   return globalThis;
 }
@@ -83,11 +83,60 @@ function makeLogger(debug) {
     warn: (...args) => console.warn("[sauron]", ...args)
   };
 }
+var MAX_TRANSACTION_EXTRA_BYTES = 16 * 1024;
+function capTransactionExtra(extra, maxBytes = MAX_TRANSACTION_EXTRA_BYTES) {
+  let bytes;
+  try {
+    const json = JSON.stringify(extra);
+    if (json === void 0) return { _truncated: true, _bytes: -1 };
+    bytes = utf8Length(json);
+  } catch {
+    return { _truncated: true, _bytes: -1 };
+  }
+  if (bytes <= maxBytes) return extra;
+  return { _truncated: true, _bytes: bytes };
+}
+function utf8Length(s) {
+  let n = 0;
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c < 128) n += 1;
+    else if (c < 2048) n += 2;
+    else if (c >= 55296 && c <= 56319) {
+      n += 4;
+      i++;
+    } else n += 3;
+  }
+  return n;
+}
 
 // src/identity.ts
 var DEVICE_ID_KEY = "sauron.device_id";
 var SESSION_ID_KEY = "sauron.session_id";
 var ANON_ID_KEY = "sauron.anon_id";
+var LAST_IDENTIFIED_KEY = "sauron.last_identified";
+var LAST_IDENTIFIED_FORMAT = "v1";
+function encodeLastIdentified(digest) {
+  return `${LAST_IDENTIFIED_FORMAT}:${digest}`;
+}
+function decodeLastIdentified(raw) {
+  if (raw === null) return null;
+  const sep = raw.indexOf(":");
+  if (sep < 0 || raw.slice(0, sep) !== LAST_IDENTIFIED_FORMAT) return null;
+  const digest = raw.slice(sep + 1);
+  return digest === "" ? null : digest;
+}
+function fnv1a32(s) {
+  let h = 2166136261;
+  for (let i = 0; i < s.length; i++) {
+    h ^= s.charCodeAt(i);
+    h = Math.imul(h, 16777619);
+  }
+  return (h >>> 0).toString(16).padStart(8, "0");
+}
+function hashIdentity(id) {
+  return fnv1a32(id) + fnv1a32("
" + id);
+}
 function webStorage(name) {
   try {
     const s = globalThis[name];
@@ -121,6 +170,7 @@ function persistentId(cached, storage, key) {
 var deviceId = null;
 var sessionId = null;
 var anonymousId = null;
+var lastIdentified = null;
 function getDeviceId() {
   deviceId = persistentId(deviceId, webStorage("localStorage"), DEVICE_ID_KEY);
   return deviceId;
@@ -129,6 +179,17 @@ function getSessionId() {
   sessionId = persistentId(sessionId, webStorage("sessionStorage"), SESSION_ID_KEY);
   return sessionId;
 }
+function rotateSessionId() {
+  sessionId = null;
+  const storage = webStorage("sessionStorage");
+  if (storage) {
+    try {
+      storage.removeItem(SESSION_ID_KEY);
+    } catch {
+    }
+  }
+  return getSessionId();
+}
 function getAnonymousId() {
   if (anonymousId) return anonymousId;
   const storage = webStorage("localStorage");
@@ -163,6 +224,37 @@ function resetAnonymousId() {
   }
   return getAnonymousId();
 }
+function getLastIdentified() {
+  const storage = webStorage("localStorage");
+  if (!storage) return decodeLastIdentified(lastIdentified);
+  try {
+    const stored = storage.getItem(LAST_IDENTIFIED_KEY);
+    return decodeLastIdentified(stored ?? lastIdentified);
+  } catch {
+    return decodeLastIdentified(lastIdentified);
+  }
+}
+function setLastIdentified(id) {
+  const encoded = encodeLastIdentified(id);
+  lastIdentified = encoded;
+  const storage = webStorage("localStorage");
+  if (storage) {
+    try {
+      storage.setItem(LAST_IDENTIFIED_KEY, encoded);
+    } catch {
+    }
+  }
+}
+function clearLastIdentified() {
+  lastIdentified = null;
+  const storage = webStorage("localStorage");
+  if (storage) {
+    try {
+      storage.removeItem(LAST_IDENTIFIED_KEY);
+    } catch {
+    }
+  }
+}
 
 // src/context.ts
 function getNavigator() {
@@ -809,13 +901,31 @@ var Scope = class {
     this.maxBreadcrumbs = Math.max(0, max);
     this.trim();
   }
+  /**
+   * Replace the scope user.
+   *
+   * `id` is coerced with `String()` for the same reason `SauronClient.
+   * prepareIdentify` coerces its own — a plain-JS caller can (and does) pass
+   * `setUser({ id: user.id })` where `user.id` is a number, and TypeScript
+   * cannot stop them. This path is the one that BYPASSES `identify()`'s
+   * coercion entirely, and the consequence is not cosmetic: the scope user
+   * lands in the envelope context, where the server's `distinct_id` is a
+   * non-`Option` Rust `String`. A JSON number there fails deserialization of
+   * the ENVELOPE, not of the one field — so the whole batch 400s, and a 400
+   * is non-retryable, so every event in it is dropped for good.
+   *
+   * Rebuilding the whole object (rather than merging into the existing one)
+   * is deliberate and is the behaviour the Flutter SDK was fixed to match:
+   * `email` and `traits` come from the input alone, so setting a new user
+   * never inherits the previous person's contact details.
+   */
   setUser(user) {
     if (user === null) {
       this.user = null;
       return;
     }
     this.user = {
-      id: user.id ?? null,
+      id: user.id === null || user.id === void 0 ? null : String(user.id),
       email: user.email ?? null,
       traits: user.traits ?? {}
     };
@@ -916,11 +1026,12 @@ function setScreen(name) {
 function identify(id, traits = {}) {
   const client = getClient();
   if (!client) return;
-  const anonymousId2 = client.getAnonymousId();
-  client.getScope().setUser({ id, traits });
+  const distinctId = String(id);
+  const anonymousId2 = client.prepareIdentify(distinctId);
+  client.getScope().setUser({ id: distinctId, traits });
   const item = {
     type: "identify",
-    distinct_id: id,
+    distinct_id: distinctId,
     anonymous_id: anonymousId2,
     traits: traits ?? {}
   };
@@ -937,7 +1048,7 @@ function normalizeOp(op) {
   return op && TRANSACTION_OPS.includes(op) ? op : "custom";
 }
 function buildTransactionItem(input, distinctId, sessionId2) {
-  return {
+  const item = {
     type: "transaction",
     name: input.name,
     op: normalizeOp(input.op),
@@ -950,6 +1061,11 @@ function buildTransactionItem(input, distinctId, sessionId2) {
     session_id: sessionId2,
     timestamp: nowIso()
   };
+  if (input.tags && Object.keys(input.tags).length > 0) item.tags = { ...input.tags };
+  if (input.extra && Object.keys(input.extra).length > 0) {
+    item.extra = capTransactionExtra({ ...input.extra });
+  }
+  return item;
 }
 function trackTransaction(input) {
   const client = getClient();
@@ -1850,18 +1966,56 @@ var SauronClient = class {
     return this.anonUsed ? getAnonymousId() : null;
   }
   /**
-   * Forget the current person: clear the scope user and mint a fresh anonymous
-   * id.
+   * Forget the current person: clear the scope user, mint a fresh anonymous
+   * id, forget the last identified user, and rotate the session id.
    *
    * MUST BE CALLED ON LOGOUT. Without it, the next anonymous visitor on this
    * browser reuses the persisted anon id, and a later identify() aliases their
-   * activity to the previous account server-side, permanently.
+   * activity to the previous account server-side, permanently. Rotating the
+   * session id matters too: the server's `bump_session` is last-write-wins on
+   * `distinct_id`, so without rotation one `sessions` row could otherwise
+   * serially represent two different people and record only whichever wrote
+   * last.
    */
   reset() {
     this.scope.setUser(null);
     resetAnonymousId();
+    clearLastIdentified();
+    rotateSessionId();
     this.anonUsed = false;
   }
+  /**
+   * Prepare for an `identify()`; returns the `anonymous_id` to send.
+   *
+   * When a DIFFERENT user identifies than last time, the current anon id
+   * belongs to the previous person and is already burned server-side, so it is
+   * replaced before anything else happens and `null` is sent instead of a
+   * cross-user alias. This cannot repair events already sent under the burned
+   * alias — nothing can — but it bounds a forgotten `reset()` to one guest
+   * window instead of every future one.
+   *
+   * `id` is coerced with `String()` before comparing/persisting: a plain-JS
+   * caller can pass a number (`Sauron.identify(user.id)`), and `Storage`
+   * itself applies `ToString` on write — so comparing an un-coerced `id`
+   * against a value that already round-tripped through storage would treat
+   * the SAME numeric user as a switch on every single call. The comparison
+   * against `last` is an explicit `!== null` (not a truthiness check) so an
+   * app that (unusually) identifies with `''` still has a later, different id
+   * correctly detected as a real switch — a falsy string is not "no identity
+   * yet". `last`/the persisted value are digests, not the raw id — see
+   * `hashIdentity`.
+   */
+  prepareIdentify(id) {
+    const digest = hashIdentity(String(id));
+    const last = getLastIdentified();
+    if (last !== null && last !== digest) {
+      resetAnonymousId();
+      rotateSessionId();
+      this.anonUsed = false;
+    }
+    setLastIdentified(digest);
+    return this.getAnonymousId();
+  }
   /** Stamp a fresh envelope (new `sent_at`, current context) around `items`. */
   makeEnvelope(items) {
     const header = {
@@ -2174,6 +2328,6 @@ var Sauron = {
 };
 var index_default = Sauron;
 
-export { DsnError, SDK_NAME, SDK_VERSION, Sauron, SauronClient, addBreadcrumb2 as addBreadcrumb, buildEnvelope, cancelWorkflow2 as cancelWorkflow, captureException2 as captureException, captureMessage2 as captureMessage, close, index_default as default, endWorkflow2 as endWorkflow, flush, getClient, getScreen2 as getScreen, getWorkflow2 as getWorkflow, identify2 as identify, init2 as init, isInAppFrame, parseDsn, parseError, parseStackString, reset, setContext, setExtra, setScreen2 as setScreen, setTag, setTags, setUser, startWorkflow2 as startWorkflow, track2 as track, trackTransaction2 as trackTransaction };
+export { DsnError, MAX_TRANSACTION_EXTRA_BYTES, SDK_NAME, SDK_VERSION, Sauron, SauronClient, addBreadcrumb2 as addBreadcrumb, buildEnvelope, cancelWorkflow2 as cancelWorkflow, capTransactionExtra, captureException2 as captureException, captureMessage2 as captureMessage, close, index_default as default, endWorkflow2 as endWorkflow, flush, getClient, getScreen2 as getScreen, getWorkflow2 as getWorkflow, identify2 as identify, init2 as init, isInAppFrame, parseDsn, parseError, parseStackString, reset, setContext, setExtra, setScreen2 as setScreen, setTag, setTags, setUser, startWorkflow2 as startWorkflow, track2 as track, trackTransaction2 as trackTransaction };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map