@flareapp/core 2.11.0 → 2.12.1

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as TracesEnvelope, A as Attributes, B as MessageLevel, C as convertToError, D as assert, E as assertKey, F as EntryPointType, G as SamplingContext, H as OtelSpan, I as Framework, J as SpanEvent, K as SdkInfo, L as Glow, M as BufferedSpan, N as Config, O as AnyValue, P as EntryPointHandler, Q as StackFrame, R as KeyValue, S as createIdentityTagger, U as OverriddenGrouping, V as OtelLogRecord, W as Report, X as SpanStatus, Y as SpanOptions, Z as SpanStatusCode, at as FrameworkName, b as extractCode, c as RejectionReporter, d as DEFAULT_URL_DENYLIST, et as TracesSampler, f as redactObjectValues, g as now, h as safeDecode, it as SpanTypeName, j as BufferedLog, k as AttributeValue, l as describeRejectionReason, m as resolveDenylist, n as urlAttributes, nt as BrowserSpanEventType, o as SafeCloneOptions, p as redactUrlQuery, q as Span, r as toCustomContext, rt as BrowserSpanType, s as safeClone, tt as User, u as routeRejection, v as glowsToEvents, x as SdkTaggable, y as flatJsonStringify, z as LogsEnvelope } from "./urlAttributes-DhkRD7pA.mjs";
+import { $ as StackFrame, A as AttributeValue, B as LogsEnvelope, C as createIdentityTagger, D as assertKey, F as EntryPointHandler, G as Report, H as OtelLogRecord, I as EntryPointType, J as Span, K as SamplingContext, L as Framework, M as BufferedLog, N as BufferedSpan, O as assert, P as Config, Q as SpanStatusCode, R as Glow, S as SdkTaggable, U as OtelSpan, V as MessageLevel, W as OverriddenGrouping, X as SpanOptions, Y as SpanEvent, Z as SpanStatus, at as SpanTypeName, b as extractCode, c as RejectionReporter, d as DEFAULT_URL_DENYLIST, et as TracesEnvelope, f as redactObjectValues, g as now, h as safeDecode, it as BrowserSpanType, j as Attributes, k as AnyValue, l as describeRejectionReason, m as resolveDenylist, n as urlAttributes, nt as User, o as SafeCloneOptions, ot as FrameworkName, p as redactUrlQuery, q as SdkInfo, r as toCustomContext, rt as BrowserSpanEventType, s as safeClone, tt as TracesSampler, u as routeRejection, v as glowsToEvents, w as convertToError, x as evictLruIfNew, y as flatJsonStringify, z as KeyValue } from "./urlAttributes-rWoVW31H.mjs";
 
 //#region src/api/Api.d.ts
 declare class Api {
@@ -6,8 +6,7 @@ declare class Api {
   private pendingKeepaliveRequests;
   /**
    * How many keepalive bytes are still available. Logs and traces share one browser allowance and both
-   * flush on page hide, so whichever goes second has to pack against what is left rather than assume the
-   * whole budget, or it exceeds the gate in send() and silently degrades to a cancellable fetch.
+   * flush on page hide, so whichever goes second must pack against what is left, not the whole budget.
    */
   keepaliveBudgetRemaining(): number;
   report(report: Report, url: string, key: string | null, reportBrowserExtensionErrors: boolean, debug?: boolean): Promise<void>;
@@ -127,14 +126,13 @@ declare function readLinesFromFile(fileText: string, lineNumber: number, columnN
 interface ActiveSpanHolder {
   getActive(): Span | undefined;
   /**
-   * Run `fn` with `span` active, restoring the prior active span afterward. A callback (not a bare setter) so a Node
-   * holder can back it with AsyncLocalStorage.run(...) to preserve async-scoped context.
+   * Runs `fn` with `span` active, then restores the previous active span. Takes a callback, not a
+   * setter, so a Node holder can implement it with `AsyncLocalStorage.run(...)`.
    */
   withActive<T>(span: Span, fn: () => T): T;
   /**
-   * Persistent "active root" that getActive() falls back to when no withActive scope is on the stack. Used by
-   * long-lived pageload/navigation roots so child spans (e.g. fetches) auto-parent to them. Optional; a holder that
-   * omits it simply has no active-root support.
+   * Fallback span that getActive() returns when no withActive scope is active. Long-lived
+   * pageload/navigation roots use it so child spans auto-parent to them. Optional.
    */
   setActiveRoot?(span: Span | undefined): void;
 }
@@ -187,10 +185,9 @@ declare class Tracer {
   getActiveSpan(): Span | undefined;
   setActiveRoot(span?: Span): void;
   /**
-   * Take one span against `traceId`'s cap up front, for a caller that publishes a span id before the
-   * span exists (the component profilers do; their descendants record first). False means the trace is
-   * full and the caller should stay transparent instead of handing out an id the cap will refuse.
-   * Consumed by the matching `startSpan({ claimed: true })`.
+   * Claims a span slot before the span exists, for a caller that publishes a span id early (the
+   * component profilers do; their descendants record first). Returns false when the trace is full.
+   * Paired with `startSpan({ claimed: true })`.
    */
   claimSpanSlot(traceId: string): boolean;
   addSpanListener(fn: SpanLifecycleListener): () => void;
@@ -201,20 +198,20 @@ declare class Tracer {
   clear(): void;
   continueFromTraceparent(header: string): void;
   /**
-   * Runs `fn` with the span active, so spans started inside auto-parent to it, then ends it.
+   * Runs `fn` with the span active, so spans started inside it auto-parent to it, then ends the span.
    * Records an error status first if `fn` throws or its returned promise rejects.
    */
   withSpan<T>(name: string, fn: (span: Span) => T, opts?: SpanOptions): T;
-  /** Starts a span the caller must end. Unlike `withSpan`, it does not become the active span,
-   *  so spans started after it do not auto-parent to it. */
+  /**
+   * Starts a span the caller must end. Unlike `withSpan`, it does not become the active span, so spans
+   * started after it do not auto-parent to it.
+   */
   startSpan(name: string, opts?: SpanOptions): Span;
-  /** A real Span handle that records nothing, so callers never have to branch on whether tracing is on. */
   private startInertSpan;
   private resolveTrace;
   private getOrSeedState;
   private createState;
   private makeSpan;
-  /** Bounded, LRU by insertion order, like traceStates. Holds primitives only, never a span. */
   private rememberClosed;
   private onSpanEnd;
 }
@@ -246,22 +243,13 @@ declare class Flare {
    *                         default; a platform can back it with AsyncLocalStorage instead.
    */
   constructor(api?: Api, contextCollector?: ContextCollector, fileReader?: FileReader, scopeProvider?: ScopeProvider, scheduler?: FlushScheduler, activeSpanHolder?: ActiveSpanHolder);
-  /**
-   * Register an in-flight report so `flush()` can wait for it. Every entry point wraps its whole async
-   * pipeline, from beforeEvaluate through api.report, so flush() waits on all of it.
-   *
-   * What goes in the Set is a shadow promise that mirrors `p`'s timing but cannot reject, so a failed
-   * report never surfaces as an unhandled rejection warning. `p` itself is returned untouched, so the
-   * caller still observes real success or failure.
-   */
   private track;
   /**
-   * Wait until every in-flight report settles or `timeoutMs` elapses. Always resolves, never rejects.
-   * Written for `@flareapp/node`'s fatal handler, which awaits the fatal report itself then flushes to
-   * drain any other concurrent reports before `process.exit`.
+   * Waits until every in-flight report settles, or `timeoutMs` elapses. Always resolves, never rejects.
+   * Used by `@flareapp/node`'s fatal handler to drain other reports before `process.exit`.
    *
-   * Snapshotting the Set bounds the wait: reports started after this line are not awaited, so a handler
-   * that keeps emitting during shutdown cannot block the process forever. Call flush again for those.
+   * Only reports already in flight are awaited, so a handler still emitting during shutdown cannot block
+   * forever. Call flush again to catch those.
    */
   flush(timeoutMs?: number): Promise<void>;
   get config(): Readonly<Config>;
@@ -298,10 +286,6 @@ declare class Flare {
   setEntryPoint(handler: EntryPointHandler): this;
   setSdkInfo(info: SdkInfo): this;
   setFramework(framework: Framework): this;
-  /**
-   * True when a report must not be captured: consent withdrawn, or dropped by sampling. Consent is
-   * checked first, so a blocked report never runs the sampler or assembles a report (no cookie read).
-   */
   private shouldSkipCapture;
   report(error: Error, attributes?: Attributes): Promise<void>;
   private reportInternal;
@@ -314,15 +298,6 @@ declare class Flare {
   private buildBaseAttributes;
   private assembleAttributes;
   private buildLogAttributes;
-  /**
-   * Local roots only, snapshotted by the Tracer at span START so a long-lived root does not drift into
-   * the next page's scope. Children get none, and no span ever runs the DOM collector.
-   *
-   * Everything assembled is inherited except user identity (excluding the opaque `user.id`): a root span
-   * goes out for every page view, so email, full name, IP and `user.attributes` would turn normal
-   * browsing into PII traffic. The rest — `context.custom`, `addContextGroup` bags — stays in, because
-   * the trace viewer renders any span attribute whose key does not start with `flare.`.
-   */
   private getScopeAttributes;
   private spanResourceAttributes;
   private buildReport;
@@ -350,11 +325,9 @@ declare function spanId(): string;
 //#endregion
 //#region src/stacktrace/NullFileReader.d.ts
 /**
- * No-op `FileReader` returning `null` for every URL. Default for `Flare`'s `fileReader` param so `new Flare()` builds
- * reports without picking an environment; stack frames just omit source snippets. Consumer packages inject the real
- * ones: `@flareapp/js` a fetch-based reader, `@flareapp/node` a disk reader. The `read(url) -> Promise<string | null>`
- * interface lets the stack-trace builder treat all three the same (render on text, skip on null), so core needs no
- * environment checks.
+ * No-op `FileReader` returning `null` for every URL. Default for `Flare`'s `fileReader` param, so
+ * `new Flare()` builds reports without picking an environment; stack frames just omit source snippets.
+ * `@flareapp/js` and `@flareapp/node` inject a real fetch- or disk-based reader instead.
  */
 declare class NullFileReader implements FileReader {
   read(_url: string): Promise<string | null>;
@@ -422,4 +395,4 @@ declare function buildDeviceContextGroup(info: DeviceInfo): Record<string, Attri
 //#region src/stacktrace/createStackTrace.d.ts
 declare function createStackTrace(error: Error, debug: boolean, fileReader: FileReader): Promise<Array<StackFrame>>;
 //#endregion
-export { type ActiveSpanHolder, type AnyValue, Api, type AttributeValue, type Attributes, BrowserSpanEventType, BrowserSpanType, type BufferedLog, type BufferedSpan, type Config, type ContextCollector, DEFAULT_MAX_LIVE_TRACES, DEFAULT_URL_DENYLIST, type DeviceInfo, type DeviceInfoProvider, type EffectiveConnectionType, type EntryPointHandler, type EntryPointType, type FileReader, Flare, type FlushFn, type FlushScheduler, type Framework, FrameworkName, GlobalScopeProvider, type Glow, InMemoryActiveSpanHolder, type KeyValue, Logger, type LoggerDeps, type LogsEnvelope, MAX_BREADCRUMB_URL_LENGTH, type MessageLevel, NoopFlushScheduler, NullDeviceInfoProvider, NullFileReader, type OtelLogRecord, type OtelSpan, type OverriddenGrouping, type RejectionReporter, type Report, type SafeCloneOptions, type SamplingContext, Scope, type ScopeProvider, type SdkInfo, type SdkTaggable, type Span, type SpanEvent, type SpanLifecycleEvent, type SpanLifecycleListener, type SpanOptions, type SpanPhase, type SpanStatus, SpanStatusCode, type SpanTypeName, type StackFrame, Tracer, type TracerDeps, type TracesEnvelope, type TracesSampler, USER_IDENTITY_KEYS, type User, assert, assertKey, breadcrumbUrl, buildDeviceContextGroup, buildTraceparent, buildTracesEnvelope, convertToError, createIdentityTagger, createStackTrace, defaultNowNano, describeRejectionReason, deviceInfoToAttributes, extractCode, flatJsonStringify, getCodeSnippet, glowsToEvents, now, parseTraceparent, readLinesFromFile, recordBreadcrumb, redactObjectValues, redactUrlQuery, resolveDenylist, routeRejection, safeClone, safeDecode, spanId, toCustomContext, urlAttributes, userIdentityAttributes };
+export { type ActiveSpanHolder, type AnyValue, Api, type AttributeValue, type Attributes, BrowserSpanEventType, BrowserSpanType, type BufferedLog, type BufferedSpan, type Config, type ContextCollector, DEFAULT_MAX_LIVE_TRACES, DEFAULT_URL_DENYLIST, type DeviceInfo, type DeviceInfoProvider, type EffectiveConnectionType, type EntryPointHandler, type EntryPointType, type FileReader, Flare, type FlushFn, type FlushScheduler, type Framework, FrameworkName, GlobalScopeProvider, type Glow, InMemoryActiveSpanHolder, type KeyValue, Logger, type LoggerDeps, type LogsEnvelope, MAX_BREADCRUMB_URL_LENGTH, type MessageLevel, NoopFlushScheduler, NullDeviceInfoProvider, NullFileReader, type OtelLogRecord, type OtelSpan, type OverriddenGrouping, type RejectionReporter, type Report, type SafeCloneOptions, type SamplingContext, Scope, type ScopeProvider, type SdkInfo, type SdkTaggable, type Span, type SpanEvent, type SpanLifecycleEvent, type SpanLifecycleListener, type SpanOptions, type SpanPhase, type SpanStatus, SpanStatusCode, type SpanTypeName, type StackFrame, Tracer, type TracerDeps, type TracesEnvelope, type TracesSampler, USER_IDENTITY_KEYS, type User, assert, assertKey, breadcrumbUrl, buildDeviceContextGroup, buildTraceparent, buildTracesEnvelope, convertToError, createIdentityTagger, createStackTrace, defaultNowNano, describeRejectionReason, deviceInfoToAttributes, evictLruIfNew, extractCode, flatJsonStringify, getCodeSnippet, glowsToEvents, now, parseTraceparent, readLinesFromFile, recordBreadcrumb, redactObjectValues, redactUrlQuery, resolveDenylist, routeRejection, safeClone, safeDecode, spanId, toCustomContext, urlAttributes, userIdentityAttributes };

package/dist/index.mjs

@@ -1,13 +1,13 @@
-import { A as SOURCEMAP_VERSION, C as convertToError, D as assert, E as assertKey, O as CLIENT_VERSION, S as createIdentityTagger, _ as MAX_TRAVERSAL_DEPTH, a as describeRejectionReason, b as spendNode, c as redactObjectValues, d as safeDecode, f as now, g as safeClone, h as flatJsonStringify, i as setDefined, k as KEY, l as redactUrlQuery, m as glowsToEvents, n as urlAttributes, o as routeRejection, p as timelineEvents, r as toCustomContext, s as DEFAULT_URL_DENYLIST, u as resolveDenylist, v as TRUNCATED, x as extractCode, y as createTraversalBudget } from "./urlAttributes-DmpMd_4O.mjs";
+import { A as KEY, C as createIdentityTagger, D as assertKey, O as assert, S as evictLruIfNew, _ as MAX_TRAVERSAL_DEPTH, a as describeRejectionReason, b as spendNode, c as redactObjectValues, d as safeDecode, f as now, g as safeClone, h as flatJsonStringify, i as setDefined, j as SOURCEMAP_VERSION, k as CLIENT_VERSION, l as redactUrlQuery, m as glowsToEvents, n as urlAttributes, o as routeRejection, p as timelineEvents, r as toCustomContext, s as DEFAULT_URL_DENYLIST, u as resolveDenylist, v as TRUNCATED, w as convertToError, x as extractCode, y as createTraversalBudget } from "./urlAttributes-c-cPzjo7.mjs";
 import ErrorStackParser from "error-stack-parser";
 
 //#region src/framework.ts
 /**
-* Framework names the Flare backend recognises. Wire format, so the values never change: they ship as
-* `flare.framework.name` and (lowercased) as `context.custom.framework`.
+* Framework names the Flare backend recognizes. Wire format: these values never change, since they
+* ship as `flare.framework.name` and (lowercased) as `context.custom.framework`.
 *
-* `Js` and `Node` are the base SDKs' fallback claim, overwritten when a framework package tags its
-* own name. `NodeElectron` is an Electron main process; its renderers report their own.
+* `Js` and `Node` are fallback claims from the base SDKs, overwritten when a framework package sets
+* its own name. `NodeElectron` is the Electron main process; renderers report their own name.
 */
 const FrameworkName = {
 	Js: "js",
@@ -23,7 +23,7 @@ const FrameworkName = {
 //#endregion
 //#region src/spanTypes.ts
 /**
-* Span types the Flare backend recognises. Wire format, so the values never change: they ship as the
+* Span types the Flare backend recognizes. Wire format, so the values never change: they ship as the
 * `flare.span_type` attribute and the backend groups performance data by them.
 *
 * These are the browser client's set. They live in core because core's `SpanOptions.spanType` needs
@@ -37,6 +37,10 @@ const BrowserSpanType = {
 	Component: "browser_component",
 	WebVital: "browser_web_vital"
 };
+/**
+* Span event types on an error report. Kept apart from `BrowserSpanType`: these are points in time,
+* not spans with a duration. That is also why a route change is not called `browser_navigation`.
+*/
 const BrowserSpanEventType = {
 	Click: "browser_click",
 	Input: "browser_input",
@@ -55,7 +59,6 @@ const SpanStatusCode = {
 //#endregion
 //#region src/util/utf8Bytes.ts
 const textEncoder = new TextEncoder();
-/** UTF-8 byte length of `value`. */
 function utf8Bytes(value) {
 	return textEncoder.encode(value).length;
 }
@@ -69,8 +72,7 @@ var Api = class {
 	pendingKeepaliveRequests = 0;
 	/**
 	* How many keepalive bytes are still available. Logs and traces share one browser allowance and both
-	* flush on page hide, so whichever goes second has to pack against what is left rather than assume the
-	* whole budget, or it exceeds the gate in send() and silently degrades to a cancellable fetch.
+	* flush on page hide, so whichever goes second must pack against what is left, not the whole budget.
 	*/
 	keepaliveBudgetRemaining() {
 		if (this.pendingKeepaliveRequests >= MAX_PENDING_KEEPALIVE_REQUESTS) return 0;
@@ -170,11 +172,6 @@ function recordBreadcrumb(scopeProvider, config, type, attributes, startTimeUnix
 
 //#endregion
 //#region src/telemetry/TelemetryBuffer.ts
-/**
-* The batching machine behind both telemetry signals: hold records, ship them when a size, weight or time
-* trigger fires, and shed the oldest when nothing can drain. One instance owns one signal; what that signal
-* is comes entirely from the policy.
-*/
 var TelemetryBuffer = class {
 	entries = [];
 	bufferedBytes = 0;
@@ -284,11 +281,6 @@ var TelemetryBuffer = class {
 			if (dropped) this.bufferedBytes -= dropped.bytes;
 		}
 	}
-	/**
-	* Newest-wins. An over-budget record is skipped, not a stop signal, so a smaller older record behind a fat
-	* one still ships. Runs on visibilitychange:hidden, which fires on plain backgrounding too, so the tail this
-	* leaves behind is retained and re-armed rather than dropped (see flush).
-	*/
 	packForKeepalive(config, resource) {
 		const fixedBytes = this.policy.emptyEnvelopeBytes(resource);
 		const budget = Math.min(config.keepaliveMaxBytes, this.policy.keepaliveBudget?.(config) ?? config.keepaliveMaxBytes);
@@ -317,11 +309,6 @@ var TelemetryBuffer = class {
 
 //#endregion
 //#region src/telemetry/resourceIdentity.ts
-/**
-* Builds the attributes that go on every logs or traces envelope: the caller's own attributes in `base`, with
-* our SDK, service and framework identity on top. Our keys win, so a user value cannot overwrite something
-* like `telemetry.sdk.name`.
-*/
 function buildResourceIdentity(base, config, sdk, framework) {
 	const identity = {
 		"telemetry.sdk.language": "javascript",
@@ -342,18 +329,6 @@ function buildResourceIdentity(base, config, sdk, framework) {
 
 //#endregion
 //#region src/logging/otel.ts
-/**
-* Converts one attribute value into the OpenTelemetry `AnyValue` shape. Strings, numbers and booleans become
-* leaves, arrays and objects are walked recursively. Anything OpenTelemetry cannot carry (null, undefined,
-* NaN, functions) returns null and the caller drops that key.
-*
-* A value that contains itself becomes the string `[Circular]`. `inPath` only holds the parents of the value
-* being converted right now, so the same object used twice side by side is converted twice instead of being
-* wrongly called circular.
-*
-* The walk also stops at a maximum depth and a maximum number of nodes, see traversalBudget.ts. Pass `budget`
-* to let several calls share one allowance, otherwise every call gets its own.
-*/
 function valueToOpenTelemetry(value, inPath = /* @__PURE__ */ new WeakSet(), budget = createTraversalBudget()) {
 	return convert(value, inPath, 0, budget);
 }
@@ -438,17 +413,9 @@ function buildLogsEnvelope(records, resourceAttributes, scopeName, scopeVersion)
 		}]
 	}] };
 }
-/**
-* How many UTF-8 bytes one record adds to an envelope. We measure the real toOtelLogRecord output instead of
-* reusing the cached BufferedLog estimate, because keepaliveMaxBytes is a hard browser limit and an estimate
-* is not good enough.
-*
-* Uses flatJsonStringify to match Api.logs, which sends the envelope through the same encoder.
-*/
 function otelLogRecordBytes(record) {
 	return utf8Bytes(flatJsonStringify(toOtelLogRecord(record)));
 }
-/** UTF-8 bytes of an empty envelope: the fixed overhead every batch has, before any records are added. */
 function emptyLogsEnvelopeBytes(resourceAttributes, scopeName, scopeVersion) {
 	return utf8Bytes(flatJsonStringify(buildLogsEnvelope([], resourceAttributes, scopeName, scopeVersion)));
 }
@@ -608,7 +575,6 @@ function partitionAttributes(attributes) {
 
 //#endregion
 //#region src/Scope.ts
-/** `USER_IDENTITY_KEYS` derives from this, so adding a field here can never leave the clear pass stale. */
 const USER_FIELD_KEYS = {
 	id: "user.id",
 	email: "user.email",
@@ -788,11 +754,9 @@ function isApplicationFrame(fileName) {
 //#endregion
 //#region src/stacktrace/NullFileReader.ts
 /**
-* No-op `FileReader` returning `null` for every URL. Default for `Flare`'s `fileReader` param so `new Flare()` builds
-* reports without picking an environment; stack frames just omit source snippets. Consumer packages inject the real
-* ones: `@flareapp/js` a fetch-based reader, `@flareapp/node` a disk reader. The `read(url) -> Promise<string | null>`
-* interface lets the stack-trace builder treat all three the same (render on text, skip on null), so core needs no
-* environment checks.
+* No-op `FileReader` returning `null` for every URL. Default for `Flare`'s `fileReader` param, so
+* `new Flare()` builds reports without picking an environment; stack frames just omit source snippets.
+* `@flareapp/js` and `@flareapp/node` inject a real fetch- or disk-based reader instead.
 */
 var NullFileReader = class {
 	read(_url) {
@@ -978,28 +942,15 @@ function buildTracesEnvelope(spans, resourceAttributes, scopeName, scopeVersion)
 		}]
 	}] };
 }
-/**
-* How many UTF-8 bytes one span adds to an envelope. We measure the real toOtelSpan output instead of reusing
-* the cached BufferedSpan estimate, because keepaliveMaxBytes is a hard browser limit and an estimate is not
-* good enough.
-*
-* We use flatJsonStringify instead of JSON.stringify because a span keeps values the caller still owns, like
-* status.message, and those can turn unserializable after the span ended. This runs from a visibilitychange
-* listener with no try/catch around it, so a throw here loses the flush. flatJsonStringify handles the usual
-* suspects (circular references, BigInt, a getter that throws on a plain object) but is not bulletproof: a
-* class instance with a throwing getter goes through untouched and can still throw.
-*/
 function otelSpanBytes(span) {
 	return utf8Bytes(flatJsonStringify(toOtelSpan(span)));
 }
-/** UTF-8 bytes of an empty envelope: the fixed overhead every batch has, before any spans are added. */
 function emptyTracesEnvelopeBytes(resourceAttributes, scopeName, scopeVersion) {
 	return utf8Bytes(JSON.stringify(buildTracesEnvelope([], resourceAttributes, scopeName, scopeVersion)));
 }
 
 //#endregion
 //#region src/tracing/SpanBuffer.ts
-/** The span half of the shared telemetry buffer: names the config keys, the envelope and the ingest call. */
 var SpanBuffer = class {
 	inner;
 	constructor(deps) {
@@ -1084,11 +1035,9 @@ function parseTraceparent(header) {
 function isPromiseLike(value) {
 	return (typeof value === "object" || typeof value === "function") && value !== null && typeof value.then === "function";
 }
-/** `SpanOptions.parent` is a structurally overlapping union; `isRecording` is what tells a real Span apart. */
 function isSpan(parent) {
 	return "isRecording" in parent;
 }
-/** A SpanImpl carries the epoch it was created under; a hand-stitched `{traceId, spanId}` parent does not. */
 function hasEpoch(parent) {
 	return "epoch" in parent && typeof parent.epoch === "number";
 }
@@ -1097,16 +1046,6 @@ function defaultNowNano() {
 	const ms = performanceApi && typeof performanceApi.now === "function" && typeof performanceApi.timeOrigin === "number" ? performanceApi.timeOrigin + performanceApi.now() : Date.now();
 	return Math.round(ms * 1e6);
 }
-/**
-* Both trace maps cap their size the same way: insertion order is LRU, so the first key is the one to drop.
-* Only evicts when `key` is not already in the map. A set() that overwrites an existing key does not grow the
-* map, so it must not evict an unrelated entry to make room for it.
-*/
-function evictLruIfNew(map, key, cap) {
-	if (map.has(key) || map.size < cap) return;
-	const lru = map.keys().next().value;
-	if (lru !== void 0) map.delete(lru);
-}
 const MAX_CLOSED_TRACES = 100;
 /** Bounded backstop for the live TraceState map: an app that never ends spans must not grow it forever. */
 const DEFAULT_MAX_LIVE_TRACES = 1e3;
@@ -1145,10 +1084,9 @@ var Tracer = class {
 		this.holder.setActiveRoot?.(span);
 	}
 	/**
-	* Take one span against `traceId`'s cap up front, for a caller that publishes a span id before the
-	* span exists (the component profilers do; their descendants record first). False means the trace is
-	* full and the caller should stay transparent instead of handing out an id the cap will refuse.
-	* Consumed by the matching `startSpan({ claimed: true })`.
+	* Claims a span slot before the span exists, for a caller that publishes a span id early (the
+	* component profilers do; their descendants record first). Returns false when the trace is full.
+	* Paired with `startSpan({ claimed: true })`.
 	*/
 	claimSpanSlot(traceId) {
 		const config = this.deps.getConfig();
@@ -1187,7 +1125,7 @@ var Tracer = class {
 		this.pendingContinuation = parseTraceparent(header);
 	}
 	/**
-	* Runs `fn` with the span active, so spans started inside auto-parent to it, then ends it.
+	* Runs `fn` with the span active, so spans started inside it auto-parent to it, then ends the span.
 	* Records an error status first if `fn` throws or its returned promise rejects.
 	*/
 	withSpan(name, fn, opts = {}) {
@@ -1217,8 +1155,10 @@ var Tracer = class {
 			}
 		});
 	}
-	/** Starts a span the caller must end. Unlike `withSpan`, it does not become the active span,
-	*  so spans started after it do not auto-parent to it. */
+	/**
+	* Starts a span the caller must end. Unlike `withSpan`, it does not become the active span, so spans
+	* started after it do not auto-parent to it.
+	*/
 	startSpan(name, opts = {}) {
 		const config = this.deps.getConfig();
 		const spanId$1 = opts.spanId ?? spanId();
@@ -1248,7 +1188,6 @@ var Tracer = class {
 		this.emitSpanEvent("start", span);
 		return span;
 	}
-	/** A real Span handle that records nothing, so callers never have to branch on whether tracing is on. */
 	startInertSpan(name, spanId, opts, config) {
 		const span = this.makeSpan({
 			traceId: traceId(),
@@ -1355,7 +1294,6 @@ var Tracer = class {
 		if (opts.attributes) for (const [key, value] of Object.entries(opts.attributes)) span.setAttribute(key, value);
 		return span;
 	}
-	/** Bounded, LRU by insertion order, like traceStates. Holds primitives only, never a span. */
 	rememberClosed(state) {
 		evictLruIfNew(this.closedTraces, state.traceId, MAX_CLOSED_TRACES);
 		this.closedTraces.set(state.traceId, {
@@ -1410,8 +1348,6 @@ var Tracer = class {
 
 //#endregion
 //#region src/Flare.ts
-/** Scope attributes a span never inherits. Derived from `USER_IDENTITY_KEYS` so a future user field is
-*  excluded automatically, without anyone needing to remember to list it here. See `getScopeAttributes`. */
 const SPAN_SCOPE_EXCLUDED_KEYS = USER_IDENTITY_KEYS.filter((key) => key !== USER_FIELD_KEYS.id);
 const DEFAULT_SDK_NAME = "@flareapp/core";
 var Flare = class {
@@ -1496,14 +1432,6 @@ var Flare = class {
 			activeSpanHolder
 		});
 	}
-	/**
-	* Register an in-flight report so `flush()` can wait for it. Every entry point wraps its whole async
-	* pipeline, from beforeEvaluate through api.report, so flush() waits on all of it.
-	*
-	* What goes in the Set is a shadow promise that mirrors `p`'s timing but cannot reject, so a failed
-	* report never surfaces as an unhandled rejection warning. `p` itself is returned untouched, so the
-	* caller still observes real success or failure.
-	*/
 	track(p) {
 		const tracked = p.then(() => void 0, () => void 0);
 		this.inflight.add(tracked);
@@ -1511,12 +1439,11 @@ var Flare = class {
 		return p;
 	}
 	/**
-	* Wait until every in-flight report settles or `timeoutMs` elapses. Always resolves, never rejects.
-	* Written for `@flareapp/node`'s fatal handler, which awaits the fatal report itself then flushes to
-	* drain any other concurrent reports before `process.exit`.
+	* Waits until every in-flight report settles, or `timeoutMs` elapses. Always resolves, never rejects.
+	* Used by `@flareapp/node`'s fatal handler to drain other reports before `process.exit`.
 	*
-	* Snapshotting the Set bounds the wait: reports started after this line are not awaited, so a handler
-	* that keeps emitting during shutdown cannot block the process forever. Call flush again for those.
+	* Only reports already in flight are awaited, so a handler still emitting during shutdown cannot block
+	* forever. Call flush again to catch those.
 	*/
 	flush(timeoutMs = 2e3) {
 		this._logger.flush();
@@ -1663,10 +1590,6 @@ var Flare = class {
 		this.framework = framework;
 		return this;
 	}
-	/**
-	* True when a report must not be captured: consent withdrawn, or dropped by sampling. Consent is
-	* checked first, so a blocked report never runs the sampler or assembles a report (no cookie read).
-	*/
 	shouldSkipCapture() {
 		if (this._config.hasConsent === false) return true;
 		return this._config.sampleRate < 1 && Math.random() >= this._config.sampleRate;
@@ -1791,15 +1714,6 @@ var Flare = class {
 			record: this.assembleAttributes(collectorRecord, userAttributes, false)
 		};
 	}
-	/**
-	* Local roots only, snapshotted by the Tracer at span START so a long-lived root does not drift into
-	* the next page's scope. Children get none, and no span ever runs the DOM collector.
-	*
-	* Everything assembled is inherited except user identity (excluding the opaque `user.id`): a root span
-	* goes out for every page view, so email, full name, IP and `user.attributes` would turn normal
-	* browsing into PII traffic. The rest — `context.custom`, `addContextGroup` bags — stays in, because
-	* the trace viewer renders any span attribute whose key does not start with `flare.`.
-	*/
 	getScopeAttributes() {
 		const scoped = { ...this.assembleAttributes({}, {}, false) };
 		for (const key of SPAN_SCOPE_EXCLUDED_KEYS) delete scoped[key];
@@ -1902,4 +1816,4 @@ function hasNetworkSignal(network) {
 }
 
 //#endregion
-export { Api, BrowserSpanEventType, BrowserSpanType, DEFAULT_MAX_LIVE_TRACES, DEFAULT_URL_DENYLIST, Flare, FrameworkName, GlobalScopeProvider, InMemoryActiveSpanHolder, Logger, MAX_BREADCRUMB_URL_LENGTH, NoopFlushScheduler, NullDeviceInfoProvider, NullFileReader, Scope, SpanStatusCode, Tracer, USER_IDENTITY_KEYS, assert, assertKey, breadcrumbUrl, buildDeviceContextGroup, buildTraceparent, buildTracesEnvelope, convertToError, createIdentityTagger, createStackTrace, defaultNowNano, describeRejectionReason, deviceInfoToAttributes, extractCode, flatJsonStringify, getCodeSnippet, glowsToEvents, now, parseTraceparent, readLinesFromFile, recordBreadcrumb, redactObjectValues, redactUrlQuery, resolveDenylist, routeRejection, safeClone, safeDecode, spanId, toCustomContext, urlAttributes, userIdentityAttributes };
+export { Api, BrowserSpanEventType, BrowserSpanType, DEFAULT_MAX_LIVE_TRACES, DEFAULT_URL_DENYLIST, Flare, FrameworkName, GlobalScopeProvider, InMemoryActiveSpanHolder, Logger, MAX_BREADCRUMB_URL_LENGTH, NoopFlushScheduler, NullDeviceInfoProvider, NullFileReader, Scope, SpanStatusCode, Tracer, USER_IDENTITY_KEYS, assert, assertKey, breadcrumbUrl, buildDeviceContextGroup, buildTraceparent, buildTracesEnvelope, convertToError, createIdentityTagger, createStackTrace, defaultNowNano, describeRejectionReason, deviceInfoToAttributes, evictLruIfNew, extractCode, flatJsonStringify, getCodeSnippet, glowsToEvents, now, parseTraceparent, readLinesFromFile, recordBreadcrumb, redactObjectValues, redactUrlQuery, resolveDenylist, routeRejection, safeClone, safeDecode, spanId, toCustomContext, urlAttributes, userIdentityAttributes };

package/dist/{urlAttributes-Cinqzwjy.cjs → urlAttributes-CAhKmW6d.cjs}

@@ -1,6 +1,6 @@
 
 //#region src/env/index.ts
-const CLIENT_VERSION = typeof process !== "undefined" && true ? "2.11.0" : "?";
+const CLIENT_VERSION = typeof process !== "undefined" && true ? "2.12.1" : "?";
 const KEY = typeof FLARE_JS_KEY === "undefined" ? "" : FLARE_JS_KEY;
 const SOURCEMAP_VERSION = typeof FLARE_SOURCEMAP_VERSION === "undefined" ? "" : FLARE_SOURCEMAP_VERSION;
 
@@ -87,6 +87,14 @@ function createIdentityTagger(config) {
 	};
 }
 
+//#endregion
+//#region src/util/evictLruIfNew.ts
+function evictLruIfNew(map, key, cap) {
+	if (map.has(key) || map.size < cap) return;
+	const lru = map.keys().next().value;
+	if (lru !== void 0) map.delete(lru);
+}
+
 //#endregion
 //#region src/util/extractCode.ts
 const MAX_CODE_LENGTH = 64;
@@ -98,28 +106,16 @@ function extractCode(error) {
 
 //#endregion
 //#region src/util/traversalBudget.ts
-/**
-* Cycle detection only tracks the ancestor path, so a value holding the same child under two keys is not
-* a cycle but still costs 2^depth to walk. Host data (glows, addContext, span attributes) reaches that
-* shape through any object graph shared by reference.
-*
-* The node cap only bounds that walk if EVERY visited node is charged, primitive leaves included. It used
-* to charge containers only, so 15 shared objects over an array of 1000 strings walked ~17M uncharged
-* strings before the cap fired: 1.2s and 1GB. Callers must spend before their leaf branches return, not
-* after. We do not memoize instead: a value shared under two keys is not a cycle and must not read as one.
-*/
 const MAX_TRAVERSAL_DEPTH = 24;
 const MAX_TRAVERSAL_NODES = 5e4;
 function createTraversalBudget(nodes = MAX_TRAVERSAL_NODES) {
 	return { remaining: nodes };
 }
-/** Consumes one node. False once the budget is spent: stop descending. */
 function spendNode(budget) {
 	if (budget.remaining <= 0) return false;
 	budget.remaining--;
 	return true;
 }
-/** Marks where a walk stopped, so a truncated payload does not read as a complete one. */
 const TRUNCATED = "[truncated: too large]";
 
 //#endregion
@@ -182,10 +178,6 @@ function truncate(value, max) {
 	if (value.length <= max) return value;
 	return `${value.slice(0, max)}…[truncated ${value.length - max} chars]`;
 }
-/**
-* Literal object / null prototypes only. Class instances may have side-effecting getters or
-* non-enumerable internals we should not traverse, so they are left to the caller's mode policy.
-*/
 function isPlainObject(value) {
 	if (value === null || typeof value !== "object") return false;
 	const proto = Object.getPrototypeOf(value);
@@ -235,6 +227,10 @@ function now() {
 
 //#endregion
 //#region src/util/redactUrl.ts
+/**
+* Matched against query-string keys, cookie names, and (in framework SDKs) prop/route-param keys. Values for
+* matching keys are replaced with [redacted] before sending so credentials/PII don't leak in error reports.
+*/
 const DEFAULT_URL_DENYLIST = /password|passwd|pwd|token|secret|authorization|\bauth\b|bearer|oauth|credentials?|cookie|api[-_]?key|private[-_]?key|session|csrf|xsrf|\bpin\b|\bssn\b|card[-_]?number|\bcvv\b/i;
 function resolveDenylist(custom, replaceDefault = false, defaultDenylist = DEFAULT_URL_DENYLIST) {
 	if (!custom) return defaultDenylist;
@@ -284,10 +280,6 @@ function redactObjectValues(obj, denylist = DEFAULT_URL_DENYLIST) {
 	for (const key of Object.keys(obj)) result[key] = denylist.test(key) ? "[redacted]" : obj[key];
 	return result;
 }
-/**
-* Removes userinfo (`user:pass@`) from an absolute URL's authority only. A path or query can legally
-* contain `@`, so only the authority (after `scheme://`, up to the first `/`, `?`, `#`) is inspected.
-*/
 function stripUserinfo(url) {
 	const schemeMatch = /^[a-z][a-z0-9+.-]*:\/\//i.exec(url);
 	if (!schemeMatch) return url;
@@ -333,9 +325,9 @@ function hasStack(reason) {
 }
 /**
 * Routes by whether `reason` carries a stack: stack-bearing reasons go to `reportSilently`, stackless
-* ones to `reportUnhandledRejection`.
-* The `.catch` is what stops a transport failure from surfacing as a second unhandled rejection.
-* `reportSilently` is assumed async and left unwrapped, so a synchronous throw there still propagates.
+* ones to `reportUnhandledRejection`. The `.catch` stops a transport failure from surfacing as a second
+* unhandled rejection. `reportSilently` is assumed async and left unwrapped, so a synchronous throw there
+* still propagates.
 */
 function routeRejection(reporter, reason) {
 	if (reason instanceof Error) {
@@ -481,6 +473,12 @@ Object.defineProperty(exports, 'describeRejectionReason', {
     return describeRejectionReason;
   }
 });
+Object.defineProperty(exports, 'evictLruIfNew', {
+  enumerable: true,
+  get: function () {
+    return evictLruIfNew;
+  }
+});
 Object.defineProperty(exports, 'extractCode', {
   enumerable: true,
   get: function () {