@flareapp/core 2.7.0 → 2.9.0

package/dist/index.mjs

@@ -1,196 +1,84 @@
+import { D as CLIENT_VERSION, E as assert, O as KEY, S as convertToError, T as assertKey, _ as TRUNCATED, a as routeRejection, b as extractCode, c as redactUrlQuery, d as now, f as timelineEvents, g as MAX_TRAVERSAL_DEPTH, h as safeClone, i as describeRejectionReason, k as SOURCEMAP_VERSION, l as resolveDenylist, m as flatJsonStringify, n as urlAttributes, o as DEFAULT_URL_DENYLIST, p as glowsToEvents, r as toCustomContext, s as redactObjectValues, u as safeDecode, v as createTraversalBudget, x as createIdentityTagger, y as spendNode } from "./urlAttributes-qNkR9fIF.mjs";
 import ErrorStackParser from "error-stack-parser";
 
-//#region src/env/index.ts
-const CLIENT_VERSION = typeof process !== "undefined" && true ? "2.7.0" : "?";
-const KEY = typeof FLARE_JS_KEY === "undefined" ? "" : FLARE_JS_KEY;
-const SOURCEMAP_VERSION = typeof FLARE_SOURCEMAP_VERSION === "undefined" ? "" : FLARE_SOURCEMAP_VERSION;
-
-//#endregion
-//#region src/util/assert.ts
-function assert(value, message, debug) {
-	if (debug && !value) console.error(`Flare JavaScript client v${CLIENT_VERSION}: ${message}`);
-	return !!value;
-}
-
-//#endregion
-//#region src/util/assertKey.ts
-function assertKey(key, debug) {
-	return assert(key, "The client was not yet initialised with an API key. Run client.light('<flare-project-key>') when you initialise your app. If you are running in dev mode and didn't run the light command on purpose, you can ignore this error.", debug);
-}
-
-//#endregion
-//#region src/util/convertToError.ts
-function convertToError(error) {
-	if (error instanceof Error) return error;
-	if (typeof error === "string") return new Error(error);
-	if (typeof error === "object" && error !== null) {
-		const obj = error;
-		const message = typeof obj.message === "string" ? obj.message : String(error);
-		const converted = new Error(message);
-		if (typeof obj.stack === "string") converted.stack = obj.stack;
-		if (typeof obj.name === "string") converted.name = obj.name;
-		return converted;
-	}
-	return new Error(String(error));
-}
-
-//#endregion
-//#region src/util/extractCode.ts
-const MAX_CODE_LENGTH = 64;
-function extractCode(error) {
-	const code = error.code;
-	if (typeof code !== "string" || code.length === 0) return;
-	return code.slice(0, MAX_CODE_LENGTH);
-}
-
-//#endregion
-//#region src/util/flatJsonStringify.ts
-function flatJsonStringify(json) {
-	return JSON.stringify(decycle(json));
-}
-function isPlainObject(value) {
-	if (typeof value !== "object" || value === null) return false;
-	const proto = Object.getPrototypeOf(value);
-	return proto === Object.prototype || proto === null;
-}
-function decycle(root) {
-	const inPath = /* @__PURE__ */ new WeakSet();
-	function clone(node) {
-		if (Array.isArray(node)) {
-			if (inPath.has(node)) return "[Circular]";
-			inPath.add(node);
-			const result = node.map(clone);
-			inPath.delete(node);
-			return result;
-		}
-		if (isPlainObject(node)) {
-			if (inPath.has(node)) return "[Circular]";
-			inPath.add(node);
-			const result = {};
-			for (const [k, v] of Object.entries(node)) result[k] = clone(v);
-			inPath.delete(node);
-			return result;
-		}
-		return node;
-	}
-	return clone(root);
-}
-
-//#endregion
-//#region src/util/glowsToEvents.ts
-function glowsToEvents(glows) {
-	return glows.map((glow) => ({
-		type: "php_glow",
-		startTimeUnixNano: Math.round(glow.microtime * 1e9),
-		endTimeUnixNano: null,
-		attributes: {
-			"glow.name": String(glow.name),
-			"glow.level": glow.messageLevel,
-			"glow.context": glow.metaData ?? {}
-		}
-	}));
-}
+//#region src/framework.ts
+/**
+* Framework names the Flare backend recognises. Wire format, so the values never change: they ship as
+* `flare.framework.name` and (lowercased) as `context.custom.framework`.
+*
+* `Js` and `Node` are the base SDKs' fallback claim, overwritten when a framework package tags its
+* own name. `NodeElectron` is an Electron main process; its renderers report their own.
+*/
+const FrameworkName = {
+	Js: "js",
+	Node: "node",
+	NodeElectron: "node-electron",
+	React: "react",
+	Vue: "vue",
+	Svelte: "svelte",
+	SvelteKit: "sveltekit",
+	ReactNative: "react-native"
+};
 
 //#endregion
-//#region src/util/now.ts
-function now() {
-	return Math.round(Date.now() / 1e3);
-}
+//#region src/spanTypes.ts
+/**
+* Span types the Flare backend recognises. Wire format, so the values never change: they ship as the
+* `flare.span_type` attribute and the backend groups performance data by them.
+*
+* These are the browser client's set. They live in core because core's `SpanOptions.spanType` needs
+* to name them and core cannot import from `@flareapp/js`.
+*/
+const BrowserSpanType = {
+	Pageload: "browser_pageload",
+	Navigation: "browser_navigation",
+	Fetch: "browser_fetch",
+	Xhr: "browser_xhr",
+	Component: "browser_component",
+	WebVital: "browser_web_vital"
+};
+const BrowserSpanEventType = {
+	Click: "browser_click",
+	Input: "browser_input",
+	RouteChange: "browser_route_change"
+};
 
 //#endregion
-//#region src/util/redactUrl.ts
-const DEFAULT_URL_DENYLIST = /password|passwd|pwd|token|secret|authorization|\bauth\b|bearer|oauth|credentials?|cookie|api[-_]?key|private[-_]?key|session|csrf|xsrf|\bpin\b|\bssn\b|card[-_]?number|\bcvv\b/i;
-function resolveDenylist(custom, replaceDefault = false, defaultDenylist = DEFAULT_URL_DENYLIST) {
-	if (!custom) return defaultDenylist;
-	if (replaceDefault) {
-		const safeFlags = custom.flags.replace(/[gy]/g, "");
-		return new RegExp(custom.source, safeFlags);
-	}
-	const flags = unionFlags(defaultDenylist.flags, custom.flags);
-	return new RegExp(`(?:${defaultDenylist.source})|(?:${custom.source})`, flags);
-}
-function unionFlags(a, b) {
-	const merged = /* @__PURE__ */ new Set();
-	for (const flag of a + b) {
-		if (flag === "g" || flag === "y") continue;
-		merged.add(flag);
-	}
-	return [...merged].join("");
-}
-function redactUrlQuery(fullPath, denylist = DEFAULT_URL_DENYLIST) {
-	const queryStart = fullPath.indexOf("?");
-	if (queryStart === -1) return fullPath;
-	const hashStart = fullPath.indexOf("#", queryStart);
-	const queryEnd = hashStart === -1 ? fullPath.length : hashStart;
-	const prefix = fullPath.slice(0, queryStart + 1);
-	const queryString = fullPath.slice(queryStart + 1, queryEnd);
-	const suffix = fullPath.slice(queryEnd);
-	return `${prefix}${queryString.split("&").map((pair) => {
-		if (pair === "") return pair;
-		const eq = pair.indexOf("=");
-		const rawKey = eq === -1 ? pair : pair.slice(0, eq);
-		const decodedKey = safeDecode(rawKey);
-		if (!denylist.test(decodedKey)) return pair;
-		return eq === -1 ? rawKey : `${rawKey}=[redacted]`;
-	}).join("&")}${suffix}`;
-}
-function safeDecode(value) {
-	try {
-		return decodeURIComponent(value);
-	} catch {
-		return value;
-	}
-}
+//#region src/types.ts
+/** OTel status codes. Wire format: these numbers ship in the span envelope, so the values never change. */
+const SpanStatusCode = {
+	Unset: 0,
+	Ok: 1,
+	Error: 2
+};
 
 //#endregion
-//#region src/util/rejection.ts
-/** Best-effort human-readable description of an arbitrary rejection reason. */
-function describeRejectionReason(reason) {
-	if (typeof reason === "string") return reason;
-	if (reason && typeof reason === "object") {
-		const message = reason.message;
-		if (typeof message === "string" && message) return message;
-		try {
-			return JSON.stringify(reason);
-		} catch {
-			return "Unhandled promise rejection (non-serializable reason)";
-		}
-	}
-	return String(reason);
-}
-function hasStack$1(reason) {
-	return !!reason && typeof reason === "object" && typeof reason.stack === "string";
-}
-/**
-* Route a rejection reason to the reporter: an Error (or any stack-bearing
-* object) goes to `reportSilently` so the STACK survives; only a stackless
-* reason falls back to `reportUnhandledRejection` (string message, empty-stack
-* `UnhandledRejection` class). Any rejection from `reportUnhandledRejection`'s
-* returned promise is swallowed so a transport failure cannot itself surface as
-* an unhandled rejection. `reportSilently` is assumed not to throw synchronously
-* (core's does its work asynchronously); it is intentionally not wrapped, so a
-* synchronous throw there would propagate.
-*/
-function routeRejection(reporter, reason) {
-	if (reason instanceof Error) {
-		reporter.reportSilently(reason);
-		return;
-	}
-	if (hasStack$1(reason)) {
-		const error = new Error(describeRejectionReason(reason));
-		error.stack = reason.stack;
-		reporter.reportSilently(error);
-		return;
-	}
-	Promise.resolve(reporter.reportUnhandledRejection(describeRejectionReason(reason))).catch(() => {});
+//#region src/util/utf8Bytes.ts
+const textEncoder = new TextEncoder();
+/** UTF-8 byte length of `value`. */
+function utf8Bytes(value) {
+	return textEncoder.encode(value).length;
 }
 
 //#endregion
 //#region src/api/Api.ts
+const MAX_PENDING_KEEPALIVE_BYTES = 6e4;
+const MAX_PENDING_KEEPALIVE_REQUESTS = 15;
 var Api = class {
+	pendingKeepaliveBytes = 0;
+	pendingKeepaliveRequests = 0;
+	/**
+	* How many keepalive bytes are still available. Logs and traces share one browser allowance and both
+	* flush on page hide, so whichever goes second has to pack against what is left rather than assume the
+	* whole budget, or it exceeds the gate in send() and silently degrades to a cancellable fetch.
+	*/
+	keepaliveBudgetRemaining() {
+		if (this.pendingKeepaliveRequests >= MAX_PENDING_KEEPALIVE_REQUESTS) return 0;
+		return Math.max(0, MAX_PENDING_KEEPALIVE_BYTES - this.pendingKeepaliveBytes);
+	}
 	report(report, url, key, reportBrowserExtensionErrors, debug = false) {
-		return fetch(url, {
-			method: "POST",
+		return this.send({
+			url,
 			headers: {
 				"Accept": "application/json",
 				"Content-Type": "application/json",
@@ -198,34 +86,274 @@ var Api = class {
 				"X-Report-Browser-Extension-Errors": JSON.stringify(reportBrowserExtensionErrors),
 				"X-Flare-Client-Version": "2"
 			},
-			body: flatJsonStringify(report)
-		}).then((response) => {
-			if (debug && response.status !== 201) console.error(`Received response with status ${response.status} from Flare`);
-		}, (error) => {
-			if (debug) console.error(error);
+			body: flatJsonStringify(report),
+			label: "Flare",
+			debug,
+			keepalive: false
 		});
 	}
 	logs(envelope, url, key, debug = false, keepalive = false) {
+		return this.send({
+			url,
+			headers: this.ingestHeaders(key),
+			body: flatJsonStringify(envelope),
+			label: "Flare logs",
+			debug,
+			keepalive
+		});
+	}
+	traces(envelope, url, key, debug = false, keepalive = false) {
+		let body;
+		try {
+			body = JSON.stringify(envelope);
+		} catch {
+			body = flatJsonStringify(envelope);
+		}
+		return this.send({
+			url,
+			headers: this.ingestHeaders(key),
+			body,
+			label: "Flare traces",
+			debug,
+			keepalive
+		});
+	}
+	ingestHeaders(key) {
+		return {
+			"Accept": "application/json",
+			"Content-Type": "application/json",
+			"x-api-token": key ?? ""
+		};
+	}
+	send(request) {
+		const { url, headers, body, label, debug, keepalive: keepaliveRequested } = request;
+		const bytes = keepaliveRequested ? utf8Bytes(body) : 0;
+		const keepalive = keepaliveRequested && this.pendingKeepaliveRequests < MAX_PENDING_KEEPALIVE_REQUESTS && this.pendingKeepaliveBytes + bytes <= MAX_PENDING_KEEPALIVE_BYTES;
+		if (keepalive) {
+			this.pendingKeepaliveBytes += bytes;
+			this.pendingKeepaliveRequests += 1;
+		}
 		return fetch(url, {
 			method: "POST",
 			keepalive,
-			headers: {
-				"Accept": "application/json",
-				"Content-Type": "application/json",
-				"x-api-token": key ?? ""
-			},
-			body: flatJsonStringify(envelope)
+			headers,
+			body
 		}).then((response) => {
-			if (debug && response.status !== 201) console.error(`Received response with status ${response.status} from Flare logs`);
+			if (debug && response.status !== 201) console.error(`Received response with status ${response.status} from ${label}`);
 		}, (error) => {
 			if (debug) console.error(error);
+		}).finally(() => {
+			if (keepalive) {
+				this.pendingKeepaliveBytes -= bytes;
+				this.pendingKeepaliveRequests -= 1;
+			}
+		});
+	}
+};
+
+//#endregion
+//#region src/breadcrumbs/recordBreadcrumb.ts
+const MAX_BREADCRUMB_URL_LENGTH = 256;
+function breadcrumbUrl(href, denylist) {
+	const redacted = redactUrlQuery(href, denylist);
+	return redacted.length > MAX_BREADCRUMB_URL_LENGTH ? redacted.slice(0, MAX_BREADCRUMB_URL_LENGTH) : redacted;
+}
+function recordBreadcrumb(scopeProvider, config, type, attributes, startTimeUnixNano) {
+	if (!config.enableBreadcrumbs) return;
+	scopeProvider.active().addBreadcrumb({
+		type,
+		startTimeUnixNano,
+		endTimeUnixNano: null,
+		attributes
+	}, config.maxBreadcrumbs);
+}
+
+//#endregion
+//#region src/telemetry/TelemetryBuffer.ts
+/**
+* The batching machine behind both telemetry signals: hold records, ship them when a size, weight or time
+* trigger fires, and shed the oldest when nothing can drain. One instance owns one signal; what that signal
+* is comes entirely from the policy.
+*/
+var TelemetryBuffer = class {
+	entries = [];
+	bufferedBytes = 0;
+	timer;
+	timerActive = false;
+	constructor(deps, policy) {
+		this.deps = deps;
+		this.policy = policy;
+		const flush = (opts) => this.flush(opts);
+		this.deps.scheduler.register(flush);
+	}
+	length() {
+		return this.entries.length;
+	}
+	add(record) {
+		const config = this.deps.getConfig();
+		const limits = this.policy.limits(config);
+		const bytes = this.policy.estimateBytes(record);
+		if (bytes > limits.maxBytes) {
+			if (config.debug) console.error(this.policy.oversizedMessage);
+			return;
+		}
+		this.entries.push({
+			record,
+			bytes
 		});
+		this.bufferedBytes += bytes;
+		this.policy.onRecordBuffered?.(record);
+		this.evaluateTriggers(config, limits);
+		this.trim(limits);
+	}
+	flush(opts) {
+		const config = this.deps.getConfig();
+		if (!this.policy.enabled(config)) return;
+		if (this.entries.length === 0) return;
+		if (!assertKey(config.key, config.debug)) {
+			this.clearTimer();
+			return;
+		}
+		this.clearTimer();
+		const resource = this.policy.resourceForFlush();
+		let selected;
+		let sendKeepalive = !!opts?.keepalive;
+		if (opts?.keepalive) {
+			selected = this.packForKeepalive(config, resource);
+			if (selected.length === 0) {
+				selected = this.entries;
+				this.entries = [];
+				this.bufferedBytes = 0;
+				sendKeepalive = false;
+			} else {
+				this.entries = this.entries.filter((entry) => !selected.includes(entry));
+				this.bufferedBytes = this.entries.reduce((sum, entry) => sum + entry.bytes, 0);
+				if (this.entries.length > 0) this.armTimer(this.policy.limits(config));
+			}
+		} else {
+			selected = this.entries;
+			this.entries = [];
+			this.bufferedBytes = 0;
+		}
+		if (selected.length === 0) return;
+		try {
+			this.policy.send(this.policy.buildEnvelope(selected.map((entry) => entry.record), resource), config, sendKeepalive);
+		} catch (error) {
+			if (config.debug) console.error(this.policy.sendFailureMessage, error);
+		}
+	}
+	clear() {
+		this.entries = [];
+		this.bufferedBytes = 0;
+		this.clearTimer();
+	}
+	evaluateTriggers(config, limits) {
+		if (this.entries.length >= limits.maxSize) {
+			this.flush();
+			return;
+		}
+		if (this.bufferedBytes >= limits.maxBytes) {
+			this.flush();
+			return;
+		}
+		this.armTimer(limits);
+	}
+	armTimer(limits) {
+		if (this.timerActive) return;
+		this.timerActive = true;
+		this.timer = setTimeout(() => {
+			this.timerActive = false;
+			this.timer = void 0;
+			this.flush();
+		}, limits.flushIntervalMs);
+		this.timer.unref?.();
+	}
+	trim(limits) {
+		if (this.entries.length > limits.maxSize) {
+			const excess = this.entries.length - limits.maxSize;
+			for (let i = 0; i < excess; i++) this.bufferedBytes -= this.entries[i].bytes;
+			this.entries = this.entries.slice(excess);
+		}
+		while (this.entries.length > 1 && this.bufferedBytes > limits.maxBytes) {
+			const dropped = this.entries.shift();
+			if (dropped) this.bufferedBytes -= dropped.bytes;
+		}
+	}
+	/**
+	* Newest-wins. An over-budget record is skipped, not a stop signal, so a smaller older record behind a fat
+	* one still ships. Runs on visibilitychange:hidden, which fires on plain backgrounding too, so the tail this
+	* leaves behind is retained and re-armed rather than dropped (see flush).
+	*/
+	packForKeepalive(config, resource) {
+		const fixedBytes = this.policy.emptyEnvelopeBytes(resource);
+		const budget = Math.min(config.keepaliveMaxBytes, this.policy.keepaliveBudget?.(config) ?? config.keepaliveMaxBytes);
+		const selected = [];
+		let selectedBytes = 0;
+		let droppedCount = 0;
+		for (let i = this.entries.length - 1; i >= 0; i--) {
+			const entry = this.entries[i];
+			const candidateBytes = this.policy.recordBytes(entry.record);
+			if (fixedBytes + selectedBytes + candidateBytes + selected.length <= budget) {
+				selected.unshift(entry);
+				selectedBytes += candidateBytes;
+			} else if (config.debug) droppedCount++;
+		}
+		if (config.debug && droppedCount > 0) console.error(this.policy.keepaliveDropMessage(droppedCount));
+		return selected;
+	}
+	clearTimer() {
+		if (this.timer) {
+			clearTimeout(this.timer);
+			this.timer = void 0;
+		}
+		this.timerActive = false;
 	}
 };
 
+//#endregion
+//#region src/telemetry/resourceIdentity.ts
+/**
+* Builds the attributes that go on every logs or traces envelope: the caller's own attributes in `base`, with
+* our SDK, service and framework identity on top. Our keys win, so a user value cannot overwrite something
+* like `telemetry.sdk.name`.
+*/
+function buildResourceIdentity(base, config, sdk, framework) {
+	const identity = {
+		"telemetry.sdk.language": "javascript",
+		"telemetry.sdk.name": sdk.name,
+		"telemetry.sdk.version": sdk.version,
+		"flare.language.name": "javascript"
+	};
+	if (config.serviceName) identity["service.name"] = config.serviceName;
+	if (config.version) identity["service.version"] = config.version;
+	if (config.stage) identity["service.stage"] = config.stage;
+	if (framework?.name) identity["flare.framework.name"] = framework.name;
+	if (framework?.version) identity["flare.framework.version"] = framework.version;
+	return {
+		...base,
+		...identity
+	};
+}
+
 //#endregion
 //#region src/logging/otel.ts
-function valueToOpenTelemetry(value, inPath = /* @__PURE__ */ new WeakSet()) {
+/**
+* Converts one attribute value into the OpenTelemetry `AnyValue` shape. Strings, numbers and booleans become
+* leaves, arrays and objects are walked recursively. Anything OpenTelemetry cannot carry (null, undefined,
+* NaN, functions) returns null and the caller drops that key.
+*
+* A value that contains itself becomes the string `[Circular]`. `inPath` only holds the parents of the value
+* being converted right now, so the same object used twice side by side is converted twice instead of being
+* wrongly called circular.
+*
+* The walk also stops at a maximum depth and a maximum number of nodes, see traversalBudget.ts. Pass `budget`
+* to let several calls share one allowance, otherwise every call gets its own.
+*/
+function valueToOpenTelemetry(value, inPath = /* @__PURE__ */ new WeakSet(), budget = createTraversalBudget()) {
+	return convert(value, inPath, 0, budget);
+}
+function convert(value, inPath, depth, budget) {
+	if (!spendNode(budget)) return { stringValue: TRUNCATED };
 	if (typeof value === "string") return { stringValue: value };
 	if (typeof value === "boolean") return { boolValue: value };
 	if (typeof value === "number") {
@@ -233,12 +361,13 @@ function valueToOpenTelemetry(value, inPath = /* @__PURE__ */ new WeakSet()) {
 		return Number.isInteger(value) ? { intValue: value } : { doubleValue: value };
 	}
 	if (value === null || value === void 0) return null;
+	if (depth >= MAX_TRAVERSAL_DEPTH) return { stringValue: TRUNCATED };
 	if (Array.isArray(value)) {
 		if (inPath.has(value)) return { stringValue: "[Circular]" };
 		inPath.add(value);
 		const values = [];
 		for (const item of value) {
-			const mapped = valueToOpenTelemetry(item, inPath);
+			const mapped = convert(item, inPath, depth + 1, budget);
 			if (mapped !== null) values.push(mapped);
 		}
 		inPath.delete(value);
@@ -249,7 +378,7 @@ function valueToOpenTelemetry(value, inPath = /* @__PURE__ */ new WeakSet()) {
 		inPath.add(value);
 		const values = [];
 		for (const [key, item] of Object.entries(value)) {
-			const mapped = valueToOpenTelemetry(item, inPath);
+			const mapped = convert(item, inPath, depth + 1, budget);
 			if (mapped !== null) values.push({
 				key,
 				value: mapped
@@ -261,9 +390,10 @@ function valueToOpenTelemetry(value, inPath = /* @__PURE__ */ new WeakSet()) {
 	return null;
 }
 function attributesToOpenTelemetry(attributes) {
+	const budget = createTraversalBudget();
 	const out = [];
 	for (const [key, value] of Object.entries(attributes)) {
-		const mapped = valueToOpenTelemetry(value);
+		const mapped = valueToOpenTelemetry(value, /* @__PURE__ */ new WeakSet(), budget);
 		if (mapped !== null) out.push({
 			key,
 			value: mapped
@@ -274,6 +404,18 @@ function attributesToOpenTelemetry(attributes) {
 
 //#endregion
 //#region src/logging/envelope.ts
+function toOtelLogRecord(record) {
+	return {
+		timeUnixNano: record.timeUnixNano,
+		observedTimeUnixNano: record.timeUnixNano,
+		severityNumber: record.severityNumber,
+		severityText: record.severityText,
+		body: { stringValue: record.message },
+		attributes: record.recordAttributes,
+		flags: 0,
+		droppedAttributesCount: 0
+	};
+}
 function buildLogsEnvelope(records, resourceAttributes, scopeName, scopeVersion) {
 	return { resourceLogs: [{
 		resource: {
@@ -287,19 +429,24 @@ function buildLogsEnvelope(records, resourceAttributes, scopeName, scopeVersion)
 				attributes: [],
 				droppedAttributesCount: 0
 			},
-			logRecords: records.map((record) => ({
-				timeUnixNano: record.timeUnixNano,
-				observedTimeUnixNano: record.timeUnixNano,
-				severityNumber: record.severityNumber,
-				severityText: record.severityText,
-				body: { stringValue: record.message },
-				attributes: record.recordAttributes,
-				flags: 0,
-				droppedAttributesCount: 0
-			}))
+			logRecords: records.map(toOtelLogRecord)
 		}]
 	}] };
 }
+/**
+* How many UTF-8 bytes one record adds to an envelope. We measure the real toOtelLogRecord output instead of
+* reusing the cached BufferedLog estimate, because keepaliveMaxBytes is a hard browser limit and an estimate
+* is not good enough.
+*
+* Uses flatJsonStringify to match Api.logs, which sends the envelope through the same encoder.
+*/
+function otelLogRecordBytes(record) {
+	return utf8Bytes(flatJsonStringify(toOtelLogRecord(record)));
+}
+/** UTF-8 bytes of an empty envelope: the fixed overhead every batch has, before any records are added. */
+function emptyLogsEnvelopeBytes(resourceAttributes, scopeName, scopeVersion) {
+	return utf8Bytes(flatJsonStringify(buildLogsEnvelope([], resourceAttributes, scopeName, scopeVersion)));
+}
 
 //#endregion
 //#region src/logging/severity.ts
@@ -326,14 +473,42 @@ function isAtOrAboveMinimum(level, minimum) {
 //#endregion
 //#region src/logging/Logger.ts
 var Logger = class {
-	buffer = [];
+	inner;
 	resourceAttributes = {};
-	timer;
-	timerActive = false;
 	constructor(deps) {
 		this.deps = deps;
-		const flush = (opts) => this.flush(opts);
-		this.deps.scheduler.register(flush);
+		this.inner = new TelemetryBuffer({
+			getConfig: deps.getConfig,
+			scheduler: deps.scheduler
+		}, {
+			limits: (config) => ({
+				maxSize: config.maxLogBufferSize,
+				maxBytes: config.logFlushMaxBytes,
+				flushIntervalMs: config.logFlushIntervalMs
+			}),
+			enabled: (config) => config.enableLogs,
+			keepaliveBudget: () => deps.api.keepaliveBudgetRemaining(),
+			estimateBytes: (record) => this.estimateBytes(record),
+			emptyEnvelopeBytes: (resource) => {
+				const sdk = deps.getSdkInfo();
+				return emptyLogsEnvelopeBytes(resource, sdk.name, sdk.version);
+			},
+			recordBytes: (record) => otelLogRecordBytes(record),
+			oversizedMessage: "Flare: dropping oversized log record",
+			keepaliveDropMessage: (count) => `Flare: dropped ${count} log record(s) from keepalive envelope (over budget)`,
+			sendFailureMessage: "Flare: failed to send buffered log records",
+			resourceForFlush: () => this.resourceForFlush(),
+			buildEnvelope: (records, resource) => {
+				const sdk = deps.getSdkInfo();
+				return buildLogsEnvelope(records, resource, sdk.name, sdk.version);
+			},
+			send: (envelope, config, keepalive) => {
+				deps.track(deps.api.logs(envelope, config.logsIngestUrl, config.key, config.debug, keepalive));
+			},
+			onRecordBuffered: (record) => {
+				this.resourceAttributes = record.resourceAttributes;
+			}
+		});
 	}
 	debug(message, context = {}, attributes = {}) {
 		this.record("debug", message, context, attributes);
@@ -360,7 +535,13 @@ var Logger = class {
 		this.record("emergency", message, context, attributes);
 	}
 	bufferLength() {
-		return this.buffer.length;
+		return this.inner.length();
+	}
+	flush(opts) {
+		this.inner.flush(opts);
+	}
+	clear() {
+		this.inner.clear();
 	}
 	record(level, message, context, attributes) {
 		const config = this.deps.getConfig();
@@ -371,115 +552,21 @@ var Logger = class {
 			...attributes
 		};
 		const { record, resource } = this.deps.buildLogAttributes(userAttributes);
-		const buffered = {
+		this.inner.add({
 			timeUnixNano: String(Date.now()) + "000000",
 			severityNumber: severityNumber(level),
 			severityText: severityText(level),
 			message,
 			recordAttributes: attributesToOpenTelemetry(record),
 			resourceAttributes: resource
-		};
-		if (this.estimateBytes(buffered) > config.logFlushMaxBytes) {
-			if (config.debug) console.error("Flare: dropping oversized log record");
-			return;
-		}
-		this.buffer.push(buffered);
-		this.resourceAttributes = resource;
-		this.evaluateTriggers(config);
-		this.trim(config);
-	}
-	evaluateTriggers(config) {
-		if (this.buffer.length >= config.maxLogBufferSize) {
-			this.flush();
-			return;
-		}
-		if (this.bufferBytes() >= config.logFlushMaxBytes) {
-			this.flush();
-			return;
-		}
-		this.armTimer(config);
-	}
-	armTimer(config) {
-		if (this.timerActive) return;
-		this.timerActive = true;
-		this.timer = setTimeout(() => this.flush(), config.logFlushIntervalMs);
-		this.timer.unref?.();
-	}
-	trim(config) {
-		if (this.buffer.length > config.maxLogBufferSize) this.buffer = this.buffer.slice(this.buffer.length - config.maxLogBufferSize);
-		while (this.buffer.length > 1 && this.bufferBytes() > config.logFlushMaxBytes) this.buffer.shift();
-	}
-	flush(opts) {
-		const config = this.deps.getConfig();
-		if (!config.enableLogs) return;
-		if (this.buffer.length === 0) return;
-		if (!assertKey(config.key, config.debug)) {
-			this.clearTimer();
-			return;
-		}
-		this.clearTimer();
-		let records;
-		if (opts?.keepalive) {
-			records = this.packForKeepalive(config);
-			this.buffer = this.buffer.filter((log) => !records.includes(log));
-			if (this.buffer.length > 0) this.armTimer(config);
-		} else {
-			records = this.buffer;
-			this.buffer = [];
-		}
-		if (records.length === 0) return;
-		this.deps.track(this.deps.api.logs(this.buildEnvelope(records), config.logsIngestUrl, config.key, config.debug, !!opts?.keepalive));
-	}
-	clear() {
-		this.buffer = [];
-		this.clearTimer();
-	}
-	packForKeepalive(config) {
-		let selected = [];
-		for (let i = this.buffer.length - 1; i >= 0; i--) {
-			const trial = [this.buffer[i], ...selected];
-			if (new TextEncoder().encode(flatJsonStringify(this.buildEnvelope(trial))).length <= config.keepaliveMaxBytes) selected = trial;
-			else if (config.debug) console.error("Flare: dropping log record from keepalive envelope (over budget)");
-		}
-		return selected;
-	}
-	buildEnvelope(records) {
-		const sdk = this.deps.getSdkInfo();
-		return buildLogsEnvelope(records, this.resourceForFlush(), sdk.name, sdk.version);
+		});
 	}
 	resourceForFlush() {
-		const config = this.deps.getConfig();
-		const sdk = this.deps.getSdkInfo();
-		const framework = this.deps.getFramework();
-		const identity = {
-			"telemetry.sdk.language": "javascript",
-			"telemetry.sdk.name": sdk.name,
-			"telemetry.sdk.version": sdk.version,
-			"flare.language.name": "javascript"
-		};
-		if (config.serviceName) identity["service.name"] = config.serviceName;
-		if (config.version) identity["service.version"] = config.version;
-		if (config.stage) identity["service.stage"] = config.stage;
-		if (framework?.name) identity["flare.framework.name"] = framework.name;
-		if (framework?.version) identity["flare.framework.version"] = framework.version;
-		return {
-			...this.resourceAttributes,
-			...identity
-		};
-	}
-	clearTimer() {
-		if (this.timer) {
-			clearTimeout(this.timer);
-			this.timer = void 0;
-		}
-		this.timerActive = false;
+		return buildResourceIdentity(this.resourceAttributes, this.deps.getConfig(), this.deps.getSdkInfo(), this.deps.getFramework());
 	}
 	estimateBytes(log) {
 		return flatJsonStringify(log).length;
 	}
-	bufferBytes() {
-		return this.buffer.reduce((sum, log) => sum + this.estimateBytes(log), 0);
-	}
 };
 
 //#endregion
@@ -513,31 +600,17 @@ function partitionAttributes(attributes) {
 
 //#endregion
 //#region src/Scope.ts
-/**
-* Maps each `User` identity field to the flat report attribute key it projects to.
-* `Flare.setUser`'s set pass writes through these so the literal key strings live in
-* exactly one place; `USER_IDENTITY_KEYS` (the clear pass) derives from them, so adding
-* a field here can never silently leave the clear pass out of date.
-*/
+/** `USER_IDENTITY_KEYS` derives from this, so adding a field here can never leave the clear pass stale. */
 const USER_FIELD_KEYS = {
 	id: "user.id",
 	email: "user.email",
 	fullName: "user.full_name",
 	ipAddress: "client.address"
 };
-/**
-* The report attribute keys that `Flare.setUser` owns: the four projected identity
-* fields plus the `user.attributes` bag for extras. Single source of truth so the
-* clear pass and the set pass in `setUser` cannot drift, and so consumers that must
-* stamp identity outside core's report pipeline (Electron's forwarded-renderer path)
-* pick up the exact same set instead of re-hardcoding it.
-*/
+/** Every key `Flare.setUser` owns. Consumers stamping identity outside core's report pipeline (Electron's
+*  forwarded-renderer path) reuse this exact set. */
 const USER_IDENTITY_KEYS = [...Object.values(USER_FIELD_KEYS), "user.attributes"];
-/**
-* Pick the user-identity attributes currently set on a scope. Used where identity must
-* be copied onto a report that does not flow through `Flare.report()` (which would
-* otherwise spread `pendingAttributes` automatically).
-*/
+/** For reports that do not flow through `Flare.report()`, which would spread `pendingAttributes` itself. */
 function userIdentityAttributes(scope) {
 	const attrs = {};
 	for (const key of USER_IDENTITY_KEYS) {
@@ -547,39 +620,16 @@ function userIdentityAttributes(scope) {
 	return attrs;
 }
 /**
-* Holds the per-call mutable state that used to live on the `Flare` instance:
-* breadcrumbs (`glows`), custom attributes (`pendingAttributes`), and the
-* current entry-point handler.
-*
-* Why this exists as its own class: in the browser there is one `Flare` per
-* page and one user at a time, so a single shared bag of state is fine. In
-* Node, a single `Flare` instance serves many concurrent requests, and each
-* request wants its own breadcrumbs and its own custom context that do NOT
-* leak into other requests. Splitting this state out of `Flare` lets the
-* consumer choose: one global `Scope` (browser) or one `Scope` per request
-* via AsyncLocalStorage (Node).
-*
-* `Flare` reads and writes this through `scopeProvider.active()` instead of
-* holding the state directly, so the per-request behavior comes from the
-* provider, not from the class itself.
-*
-* `NodeScope` (in `@flareapp/node`) extends this with a `request` bucket
-* (HTTP method, path, headers). User identity is written to `pendingAttributes`
-* by `Flare.setUser`, so it needs no dedicated field. Browser does not need `request`.
+* Per-call mutable state, split out of `Flare` so the consumer can choose one global `Scope` (browser, one
+* user at a time) or one per request via AsyncLocalStorage (Node, where concurrent requests must not leak
+* into each other). `@flareapp/node`'s `NodeScope` extends this with a `request` bucket.
 */
 var Scope = class {
 	glows = [];
+	breadcrumbs = [];
 	pendingAttributes = {};
 	entryPoint = null;
-	/**
-	* Append a breadcrumb. Caps the list at `maxGlowsPerReport` by dropping the
-	* OLDEST entries when the limit is exceeded; this keeps reports below a
-	* payload-size threshold while preserving the most recent events leading
-	* up to an error.
-	*
-	* `slice(length - max)` returns the trailing `max` items, which is the
-	* shortest way to drop from the front and keep insertion order.
-	*/
+	/** Caps at `maxGlowsPerReport` by dropping the oldest, so the payload stays bounded. */
 	addGlow(glow, maxGlowsPerReport) {
 		this.glows.push(glow);
 		if (this.glows.length > maxGlowsPerReport) this.glows = this.glows.slice(this.glows.length - maxGlowsPerReport);
@@ -587,29 +637,24 @@ var Scope = class {
 	clearGlows() {
 		this.glows = [];
 	}
-	/**
-	* Set a single attribute on this scope. Called from `Flare.addContext` and
-	* `Flare.addContextGroup`. Last write wins.
-	*/
+	/** Drops the oldest when full. */
+	addBreadcrumb(breadcrumb, maxBreadcrumbs) {
+		if (maxBreadcrumbs <= 0) return;
+		this.breadcrumbs.push(breadcrumb);
+		if (this.breadcrumbs.length > maxBreadcrumbs) this.breadcrumbs = this.breadcrumbs.slice(this.breadcrumbs.length - maxBreadcrumbs);
+	}
+	clearBreadcrumbs() {
+		this.breadcrumbs = [];
+	}
 	setAttribute(key, value) {
 		this.pendingAttributes[key] = value;
 	}
-	/**
-	* Shallow-merge a bag of attributes into this scope. Used by Node's
-	* AsyncLocalStorage provider when patching the live request context via
-	* `flare.mergeContext({ ... })`. Last write wins per key; nested objects
-	* are NOT deep-merged.
-	*/
+	/** Shallow: last write wins per key, nested objects are not deep-merged. */
 	mergeAttributes(partial) {
 		Object.assign(this.pendingAttributes, partial);
 	}
 };
-/**
-* The simplest provider: one `Scope` for the lifetime of the provider, shared
-* by every caller. This is the right default for environments with a single
-* logical context (browser tab, CLI script, etc.) and is the default that
-* `Flare`'s constructor falls back to when no provider is supplied.
-*/
+/** One `Scope` for the provider's lifetime. The right default for a browser tab or a CLI script. */
 var GlobalScopeProvider = class {
 	scope = new Scope();
 	active() {
@@ -636,11 +681,14 @@ function getCodeSnippet(fileReader, url, lineNumber, columnNumber) {
 	});
 }
 function readFile(fileReader, url) {
-	if (cachedFiles[url] !== void 0) return Promise.resolve(cachedFiles[url]);
-	return fileReader.read(url).then((text) => {
-		if (text !== null) cachedFiles[url] = text;
+	const cached = cachedFiles[url];
+	if (cached !== void 0) return cached;
+	const pending = fileReader.read(url).then((text) => {
+		if (text === null) delete cachedFiles[url];
 		return text;
 	});
+	cachedFiles[url] = pending;
+	return pending;
 }
 function readLinesFromFile(fileText, lineNumber, columnNumber, maxSnippetLineLength = 1e3, maxSnippetLines = 40) {
 	const codeSnippet = {};
@@ -732,25 +780,11 @@ function isApplicationFrame(fileName) {
 //#endregion
 //#region src/stacktrace/NullFileReader.ts
 /**
-* No-op `FileReader` that returns `null` for every URL it is asked to read.
-*
-* Used as the default for `Flare`'s `fileReader` constructor parameter so the
-* class is usable without picking a side: instantiated bare (`new Flare()`),
-* reports still build, but stack frames omit source-code snippets — which is
-* the correct, safe behavior in an environment we know nothing about.
-*
-* The two real implementations live in the consumer packages and take their
-* place once the right environment is established:
-*
-* - `@flareapp/js` injects `FetchFileReader`, which `fetch()`s source maps
-*   and original files over HTTP for browser stack frames.
-* - `@flareapp/node` injects `DiskFileReader`, which reads files from disk
-*   via `node:fs/promises` for server stack frames.
-*
-* The interface (`read(url) -> Promise<string | null>`) lets the stack-trace
-* builder treat all three the same way: ask for a URL, render the snippet
-* when text comes back, gracefully skip it when `null` does. No environment
-* checks anywhere in core.
+* No-op `FileReader` returning `null` for every URL. Default for `Flare`'s `fileReader` param so `new Flare()` builds
+* reports without picking an environment; stack frames just omit source snippets. Consumer packages inject the real
+* ones: `@flareapp/js` a fetch-based reader, `@flareapp/node` a disk reader. The `read(url) -> Promise<string | null>`
+* interface lets the stack-trace builder treat all three the same (render on text, skip on null), so core needs no
+* environment checks.
 */
 var NullFileReader = class {
 	read(_url) {
@@ -758,18 +792,632 @@ var NullFileReader = class {
 	}
 };
 
+//#endregion
+//#region src/tracing/context.ts
+var InMemoryActiveSpanHolder = class {
+	active;
+	root;
+	getActive() {
+		return this.active ?? this.root;
+	}
+	withActive(span, fn) {
+		const previous = this.active;
+		this.active = span;
+		try {
+			return fn();
+		} finally {
+			this.active = previous;
+		}
+	}
+	setActiveRoot(span) {
+		this.root = span;
+	}
+};
+
+//#endregion
+//#region src/tracing/ids.ts
+function randomHex(bytes) {
+	const randomBytes = new Uint8Array(bytes);
+	const cryptoApi = globalThis.crypto;
+	if (cryptoApi && typeof cryptoApi.getRandomValues === "function") cryptoApi.getRandomValues(randomBytes);
+	else for (let i = 0; i < bytes; i++) randomBytes[i] = Math.floor(Math.random() * 256);
+	if (randomBytes.every((b) => b === 0)) randomBytes[bytes - 1] = 1;
+	let out = "";
+	for (let i = 0; i < bytes; i++) out += randomBytes[i].toString(16).padStart(2, "0");
+	return out;
+}
+function traceId() {
+	return randomHex(16);
+}
+function spanId() {
+	return randomHex(8);
+}
+
+//#endregion
+//#region src/tracing/sampler.ts
+function resolveSampling(samplingContext, config, rng = Math.random) {
+	if (samplingContext.parentSampled !== void 0) return samplingContext.parentSampled;
+	let rate;
+	if (config.tracesSampler) {
+		let result;
+		try {
+			result = config.tracesSampler(samplingContext);
+		} catch (error) {
+			if (config.debug) console.error("Flare: tracesSampler threw, treating span as not sampled", error);
+			return false;
+		}
+		if (typeof result === "boolean") return result;
+		rate = result;
+	} else rate = config.tracesSampleRate;
+	rate = Math.max(0, Math.min(1, rate));
+	if (rate <= 0) return false;
+	if (rate >= 1) return true;
+	return rng() < rate;
+}
+
+//#endregion
+//#region src/tracing/Span.ts
+var SpanImpl = class {
+	traceId;
+	spanId;
+	parentSpanId;
+	name;
+	isRecording;
+	epoch;
+	stateGeneration;
+	startTimeUnixNano;
+	scopeAttributes;
+	endTimeUnixNano = 0;
+	status = { code: SpanStatusCode.Unset };
+	attributes = {};
+	droppedAttributesCount = 0;
+	events = [];
+	droppedEventsCount = 0;
+	ended = false;
+	constructor(init, deps) {
+		this.deps = deps;
+		this.traceId = init.traceId;
+		this.spanId = init.spanId;
+		this.parentSpanId = init.parentSpanId;
+		this.name = init.name;
+		this.isRecording = init.recording;
+		this.epoch = init.epoch;
+		this.stateGeneration = init.stateGeneration;
+		this.startTimeUnixNano = init.startTimeUnixNano;
+		this.scopeAttributes = init.scopeAttributes;
+	}
+	setAttribute(key, value) {
+		if (this.ended) return this;
+		if (!(key in this.attributes) && Object.keys(this.attributes).length >= this.deps.maxAttributesPerSpan) {
+			this.droppedAttributesCount++;
+			return this;
+		}
+		this.attributes[key] = value;
+		return this;
+	}
+	setStatus(status) {
+		if (!this.ended) this.status = status;
+		return this;
+	}
+	addEvent(name, attributes = {}) {
+		if (this.ended) return this;
+		if (this.events.length >= this.deps.maxEventsPerSpan) {
+			this.droppedEventsCount++;
+			return this;
+		}
+		const capped = {};
+		let dropped = 0;
+		for (const [key, value] of Object.entries(attributes)) {
+			if (Object.keys(capped).length >= this.deps.maxAttributesPerSpanEvent) {
+				dropped++;
+				continue;
+			}
+			capped[key] = value;
+		}
+		this.events.push({
+			name,
+			timeUnixNano: this.deps.now(),
+			attributes: capped,
+			droppedAttributesCount: dropped
+		});
+		return this;
+	}
+	end(endTimeUnixNano) {
+		if (this.ended) return;
+		this.ended = true;
+		this.endTimeUnixNano = endTimeUnixNano ?? this.deps.now();
+		this.deps.onEnd(this);
+	}
+};
+
+//#endregion
+//#region src/tracing/envelope.ts
+function toOtelSpan(span) {
+	const status = span.status.message !== void 0 ? {
+		code: span.status.code,
+		message: span.status.message
+	} : { code: span.status.code };
+	return {
+		traceId: span.traceId,
+		spanId: span.spanId,
+		parentSpanId: span.parentSpanId,
+		name: span.name,
+		startTimeUnixNano: span.startTimeUnixNano,
+		endTimeUnixNano: span.endTimeUnixNano,
+		status,
+		attributes: span.recordAttributes,
+		events: span.events,
+		droppedAttributesCount: span.droppedAttributesCount,
+		droppedEventsCount: span.droppedEventsCount,
+		links: [],
+		droppedLinksCount: 0
+	};
+}
+function buildTracesEnvelope(spans, resourceAttributes, scopeName, scopeVersion) {
+	return { resourceSpans: [{
+		resource: {
+			attributes: attributesToOpenTelemetry(resourceAttributes),
+			droppedAttributesCount: 0
+		},
+		scopeSpans: [{
+			scope: {
+				name: scopeName,
+				version: scopeVersion,
+				attributes: [],
+				droppedAttributesCount: 0
+			},
+			spans: spans.map(toOtelSpan)
+		}]
+	}] };
+}
+/**
+* How many UTF-8 bytes one span adds to an envelope. We measure the real toOtelSpan output instead of reusing
+* the cached BufferedSpan estimate, because keepaliveMaxBytes is a hard browser limit and an estimate is not
+* good enough.
+*
+* We use flatJsonStringify instead of JSON.stringify because a span keeps values the caller still owns, like
+* status.message, and those can turn unserializable after the span ended. This runs from a visibilitychange
+* listener with no try/catch around it, so a throw here loses the flush. flatJsonStringify handles the usual
+* suspects (circular references, BigInt, a getter that throws on a plain object) but is not bulletproof: a
+* class instance with a throwing getter goes through untouched and can still throw.
+*/
+function otelSpanBytes(span) {
+	return utf8Bytes(flatJsonStringify(toOtelSpan(span)));
+}
+/** UTF-8 bytes of an empty envelope: the fixed overhead every batch has, before any spans are added. */
+function emptyTracesEnvelopeBytes(resourceAttributes, scopeName, scopeVersion) {
+	return utf8Bytes(JSON.stringify(buildTracesEnvelope([], resourceAttributes, scopeName, scopeVersion)));
+}
+
+//#endregion
+//#region src/tracing/SpanBuffer.ts
+/** The span half of the shared telemetry buffer: names the config keys, the envelope and the ingest call. */
+var SpanBuffer = class {
+	inner;
+	constructor(deps) {
+		this.deps = deps;
+		this.inner = new TelemetryBuffer({
+			getConfig: deps.getConfig,
+			scheduler: deps.scheduler
+		}, {
+			limits: (config) => ({
+				maxSize: config.maxSpanBufferSize,
+				maxBytes: config.spanFlushMaxBytes,
+				flushIntervalMs: config.spanFlushIntervalMs
+			}),
+			enabled: (config) => config.enableTracing,
+			keepaliveBudget: () => deps.api.keepaliveBudgetRemaining(),
+			estimateBytes: (span) => this.estimateBytes(span),
+			emptyEnvelopeBytes: (resource) => {
+				const sdk = deps.getSdkInfo();
+				return emptyTracesEnvelopeBytes(resource, sdk.name, sdk.version);
+			},
+			recordBytes: (span) => otelSpanBytes(span),
+			oversizedMessage: "Flare: dropping oversized span",
+			keepaliveDropMessage: (count) => `Flare: dropped ${count} span(s) from keepalive envelope (over budget)`,
+			sendFailureMessage: "Flare: failed to send buffered spans",
+			resourceForFlush: () => this.resourceForFlush(),
+			buildEnvelope: (spans, resource) => {
+				const sdk = deps.getSdkInfo();
+				return buildTracesEnvelope(spans, resource, sdk.name, sdk.version);
+			},
+			send: (envelope, config, keepalive) => {
+				deps.track(deps.api.traces(envelope, config.tracesIngestUrl, config.key, config.debug, keepalive));
+			}
+		});
+	}
+	length() {
+		return this.inner.length();
+	}
+	add(span) {
+		this.inner.add(span);
+	}
+	flush(opts) {
+		this.inner.flush(opts);
+	}
+	clear() {
+		this.inner.clear();
+	}
+	resourceForFlush() {
+		return buildResourceIdentity(this.deps.getResourceAttributes(), this.deps.getConfig(), this.deps.getSdkInfo(), this.deps.getFramework());
+	}
+	estimateBytes(span) {
+		return JSON.stringify(span).length;
+	}
+};
+
+//#endregion
+//#region src/tracing/traceparent.ts
+const HEX32 = /^[0-9a-f]{32}$/;
+const HEX16 = /^[0-9a-f]{16}$/;
+const HEX8 = /^[0-9a-f]{2}$/;
+const ZERO32 = "0".repeat(32);
+const ZERO16 = "0".repeat(16);
+function buildTraceparent(traceId, spanId, sampled) {
+	return `00-${traceId}-${spanId}-${sampled ? "01" : "00"}`;
+}
+function parseTraceparent(header) {
+	const parts = header.trim().split("-");
+	if (parts.length !== 4) return null;
+	const [version, traceId, spanId, flags] = parts;
+	if (version !== "00") return null;
+	if (!HEX32.test(traceId) || traceId === ZERO32) return null;
+	if (!HEX16.test(spanId) || spanId === ZERO16) return null;
+	if (!HEX8.test(flags)) return null;
+	return {
+		traceId,
+		parentSpanId: spanId,
+		sampled: (parseInt(flags, 16) & 1) === 1
+	};
+}
+
+//#endregion
+//#region src/tracing/Tracer.ts
+function isPromiseLike(value) {
+	return (typeof value === "object" || typeof value === "function") && value !== null && typeof value.then === "function";
+}
+/** `SpanOptions.parent` is a structurally overlapping union; `isRecording` is what tells a real Span apart. */
+function isSpan(parent) {
+	return "isRecording" in parent;
+}
+/** A SpanImpl carries the epoch it was created under; a hand-stitched `{traceId, spanId}` parent does not. */
+function hasEpoch(parent) {
+	return "epoch" in parent && typeof parent.epoch === "number";
+}
+function defaultNowNano() {
+	const performanceApi = globalThis.performance;
+	const ms = performanceApi && typeof performanceApi.now === "function" && typeof performanceApi.timeOrigin === "number" ? performanceApi.timeOrigin + performanceApi.now() : Date.now();
+	return Math.round(ms * 1e6);
+}
+/**
+* Both trace maps cap their size the same way: insertion order is LRU, so the first key is the one to drop.
+* Only evicts when `key` is not already in the map. A set() that overwrites an existing key does not grow the
+* map, so it must not evict an unrelated entry to make room for it.
+*/
+function evictLruIfNew(map, key, cap) {
+	if (map.has(key) || map.size < cap) return;
+	const lru = map.keys().next().value;
+	if (lru !== void 0) map.delete(lru);
+}
+const MAX_CLOSED_TRACES = 100;
+/** Bounded backstop for the live TraceState map: an app that never ends spans must not grow it forever. */
+const DEFAULT_MAX_LIVE_TRACES = 1e3;
+var Tracer = class {
+	buffer;
+	holder;
+	traceStates = /* @__PURE__ */ new Map();
+	closedTraces = /* @__PURE__ */ new Map();
+	stateGeneration = 0;
+	now;
+	rng;
+	maxLiveTraces;
+	epoch = 0;
+	pendingContinuation = null;
+	spanListeners = /* @__PURE__ */ new Set();
+	constructor(deps) {
+		this.deps = deps;
+		this.buffer = new SpanBuffer({
+			api: deps.api,
+			getConfig: deps.getConfig,
+			getSdkInfo: deps.getSdkInfo,
+			getFramework: deps.getFramework,
+			getResourceAttributes: deps.getResourceAttributes,
+			track: deps.track,
+			scheduler: deps.scheduler
+		});
+		this.holder = deps.activeSpanHolder ?? new InMemoryActiveSpanHolder();
+		this.now = deps.now ?? defaultNowNano;
+		this.rng = deps.rng ?? Math.random;
+		this.maxLiveTraces = deps.maxLiveTraces ?? DEFAULT_MAX_LIVE_TRACES;
+	}
+	getActiveSpan() {
+		return this.holder.getActive();
+	}
+	setActiveRoot(span) {
+		this.holder.setActiveRoot?.(span);
+	}
+	/**
+	* Take one span against `traceId`'s cap up front, for a caller that publishes a span id before the
+	* span exists (the component profilers do; their descendants record first). False means the trace is
+	* full and the caller should stay transparent instead of handing out an id the cap will refuse.
+	* Consumed by the matching `startSpan({ claimed: true })`.
+	*/
+	claimSpanSlot(traceId) {
+		const config = this.deps.getConfig();
+		if (!config.enableTracing) return false;
+		const state = this.traceStates.get(traceId);
+		if (!state || !state.recording || state.startedSpanCount >= config.maxSpansPerTrace) return false;
+		state.startedSpanCount++;
+		return true;
+	}
+	addSpanListener(fn) {
+		this.spanListeners.add(fn);
+		return () => {
+			this.spanListeners.delete(fn);
+		};
+	}
+	emitSpanEvent(phase, span) {
+		for (const fn of this.spanListeners) try {
+			fn({
+				phase,
+				span
+			});
+		} catch {}
+	}
+	flush(opts) {
+		this.buffer.flush(opts);
+	}
+	clear() {
+		this.buffer.clear();
+		this.traceStates.clear();
+		this.closedTraces.clear();
+		this.setActiveRoot(void 0);
+		this.pendingContinuation = null;
+		this.epoch++;
+	}
+	continueFromTraceparent(header) {
+		this.pendingContinuation = parseTraceparent(header);
+	}
+	/**
+	* Runs `fn` with the span active, so spans started inside auto-parent to it, then ends it.
+	* Records an error status first if `fn` throws or its returned promise rejects.
+	*/
+	withSpan(name, fn, opts = {}) {
+		const span = this.startSpan(name, opts);
+		const finishError = (error) => {
+			span.setStatus({
+				code: SpanStatusCode.Error,
+				message: error instanceof Error ? error.message : String(error)
+			});
+			span.end();
+		};
+		return this.holder.withActive(span, () => {
+			try {
+				const result = fn(span);
+				if (isPromiseLike(result)) return result.then((value) => {
+					span.end();
+					return value;
+				}, (error) => {
+					finishError(error);
+					throw error;
+				});
+				span.end();
+				return result;
+			} catch (error) {
+				finishError(error);
+				throw error;
+			}
+		});
+	}
+	/** Starts a span the caller must end. Unlike `withSpan`, it does not become the active span,
+	*  so spans started after it do not auto-parent to it. */
+	startSpan(name, opts = {}) {
+		const config = this.deps.getConfig();
+		const spanId$1 = opts.spanId ?? spanId();
+		const continuation = this.pendingContinuation;
+		this.pendingContinuation = null;
+		if (!config.enableTracing) return this.startInertSpan(name, spanId$1, opts, config);
+		const { traceId, parentSpanId, state } = this.resolveTrace(spanId$1, name, opts, config, continuation);
+		let recording = state.recording;
+		if (opts.claimed) {} else if (state.startedSpanCount >= config.maxSpansPerTrace) {
+			recording = false;
+			if (config.debug && !state.loggedCap) {
+				state.loggedCap = true;
+				console.error("Flare: maxSpansPerTrace reached, dropping span");
+			}
+		} else state.startedSpanCount++;
+		state.openSpanCount++;
+		const isLocalRoot = state.localRootSpanId === spanId$1;
+		const span = this.makeSpan({
+			traceId,
+			spanId: spanId$1,
+			parentSpanId,
+			name,
+			recording,
+			isLocalRoot,
+			stateGeneration: state.generation
+		}, opts, config);
+		this.emitSpanEvent("start", span);
+		return span;
+	}
+	/** A real Span handle that records nothing, so callers never have to branch on whether tracing is on. */
+	startInertSpan(name, spanId, opts, config) {
+		const span = this.makeSpan({
+			traceId: traceId(),
+			spanId,
+			parentSpanId: null,
+			name,
+			recording: false,
+			isLocalRoot: true,
+			stateGeneration: 0
+		}, opts, config);
+		this.emitSpanEvent("start", span);
+		return span;
+	}
+	resolveTrace(spanId, name, opts, config, continuation) {
+		let parent = opts.forceRoot ? opts.parent : opts.parent ?? this.holder.getActive();
+		if (parent && hasEpoch(parent) && parent.epoch !== this.epoch) parent = void 0;
+		if (parent && "spanId" in parent && "traceId" in parent) {
+			const traceId = parent.traceId;
+			const fallbackRecording = () => isSpan(parent) ? parent.isRecording : resolveSampling({
+				name,
+				attributes: opts.attributes ?? {},
+				spanType: opts.spanType
+			}, config, this.rng);
+			const state = this.getOrSeedState(traceId, spanId, fallbackRecording);
+			return {
+				traceId,
+				parentSpanId: parent.spanId,
+				state
+			};
+		}
+		if (continuation) {
+			const recording = resolveSampling({
+				name,
+				parentSampled: continuation.sampled,
+				attributes: opts.attributes ?? {},
+				spanType: opts.spanType
+			}, config, this.rng);
+			const state = this.createState(continuation.traceId, spanId, recording);
+			return {
+				traceId: continuation.traceId,
+				parentSpanId: continuation.parentSpanId,
+				state
+			};
+		}
+		const traceId$1 = traceId();
+		const recording = resolveSampling({
+			name,
+			attributes: opts.attributes ?? {},
+			spanType: opts.spanType
+		}, config, this.rng);
+		return {
+			traceId: traceId$1,
+			parentSpanId: null,
+			state: this.createState(traceId$1, spanId, recording)
+		};
+	}
+	getOrSeedState(traceId, localRootSpanId, fallbackRecording) {
+		const existing = this.traceStates.get(traceId);
+		if (existing) {
+			this.traceStates.delete(traceId);
+			this.traceStates.set(traceId, existing);
+			return existing;
+		}
+		const closed = this.closedTraces.get(traceId);
+		if (closed) {
+			this.closedTraces.delete(traceId);
+			const state = this.createState(traceId, closed.localRootSpanId, closed.recording);
+			state.startedSpanCount = closed.startedSpanCount;
+			state.rootEnded = true;
+			return state;
+		}
+		return this.createState(traceId, localRootSpanId, fallbackRecording());
+	}
+	createState(traceId, localRootSpanId, recording) {
+		evictLruIfNew(this.traceStates, traceId, this.maxLiveTraces);
+		const state = {
+			traceId,
+			recording,
+			localRootSpanId,
+			rootEnded: false,
+			startedSpanCount: 0,
+			openSpanCount: 0,
+			generation: ++this.stateGeneration,
+			loggedCap: false
+		};
+		this.traceStates.set(traceId, state);
+		return state;
+	}
+	makeSpan(init, opts, config) {
+		const scopeAttributes = init.recording && init.isLocalRoot ? this.deps.getScopeAttributes() : {};
+		const span = new SpanImpl({
+			...init,
+			startTimeUnixNano: opts.startTimeUnixNano ?? this.now(),
+			epoch: this.epoch,
+			scopeAttributes
+		}, {
+			maxAttributesPerSpan: config.maxAttributesPerSpan,
+			maxEventsPerSpan: config.maxEventsPerSpan,
+			maxAttributesPerSpanEvent: config.maxAttributesPerSpanEvent,
+			now: this.now,
+			onEnd: (s) => this.onSpanEnd(s)
+		});
+		if (opts.spanType) span.setAttribute("flare.span_type", opts.spanType);
+		if (opts.attributes) for (const [key, value] of Object.entries(opts.attributes)) span.setAttribute(key, value);
+		return span;
+	}
+	/** Bounded, LRU by insertion order, like traceStates. Holds primitives only, never a span. */
+	rememberClosed(state) {
+		evictLruIfNew(this.closedTraces, state.traceId, MAX_CLOSED_TRACES);
+		this.closedTraces.set(state.traceId, {
+			localRootSpanId: state.localRootSpanId,
+			recording: state.recording,
+			startedSpanCount: state.startedSpanCount
+		});
+	}
+	onSpanEnd(span) {
+		this.emitSpanEvent("end", span);
+		if (span.epoch !== this.epoch) return;
+		const state = this.traceStates.get(span.traceId);
+		if (state && state.generation === span.stateGeneration) {
+			state.openSpanCount--;
+			if (span.spanId === state.localRootSpanId) state.rootEnded = true;
+			if (state.rootEnded && state.openSpanCount <= 0) {
+				this.traceStates.delete(span.traceId);
+				this.rememberClosed(state);
+			}
+		}
+		if (!span.isRecording) return;
+		if (!this.deps.getConfig().enableTracing) return;
+		try {
+			const record = {
+				...span.scopeAttributes,
+				...span.attributes
+			};
+			const buffered = {
+				traceId: span.traceId,
+				spanId: span.spanId,
+				parentSpanId: span.parentSpanId,
+				name: span.name,
+				startTimeUnixNano: span.startTimeUnixNano,
+				endTimeUnixNano: span.endTimeUnixNano,
+				status: span.status,
+				recordAttributes: attributesToOpenTelemetry(record),
+				droppedAttributesCount: span.droppedAttributesCount,
+				droppedEventsCount: span.droppedEventsCount,
+				events: span.events.map((event) => ({
+					name: event.name,
+					timeUnixNano: event.timeUnixNano,
+					attributes: attributesToOpenTelemetry(event.attributes),
+					droppedAttributesCount: event.droppedAttributesCount
+				}))
+			};
+			this.buffer.add(buffered);
+		} catch (error) {
+			if (this.deps.getConfig().debug) console.error("Flare: failed to buffer span", error);
+		}
+	}
+};
+
 //#endregion
 //#region src/Flare.ts
+/** Scope attributes a span never inherits. Derived from `USER_IDENTITY_KEYS` so a future user field is
+*  excluded automatically, without anyone needing to remember to list it here. See `getScopeAttributes`. */
+const SPAN_SCOPE_EXCLUDED_KEYS = USER_IDENTITY_KEYS.filter((key) => key !== USER_FIELD_KEYS.id);
 const DEFAULT_SDK_NAME = "@flareapp/core";
 var Flare = class {
 	inflight = /* @__PURE__ */ new Set();
 	_logger;
+	_tracer;
 	_config = {
 		key: null,
 		version: "",
 		sourcemapVersionId: SOURCEMAP_VERSION,
 		stage: "",
 		maxGlowsPerReport: 30,
+		enableBreadcrumbs: false,
+		maxBreadcrumbs: 100,
 		ingestUrl: "https://ingress.flareapp.io/v1/errors",
 		reportBrowserExtensionErrors: false,
 		debug: false,
@@ -783,7 +1431,17 @@ var Flare = class {
 		maxLogBufferSize: 100,
 		logFlushIntervalMs: 5e3,
 		logFlushMaxBytes: 8e5,
-		keepaliveMaxBytes: 6e4
+		keepaliveMaxBytes: 6e4,
+		enableTracing: false,
+		tracesIngestUrl: "https://ingress.flareapp.io/v1/traces",
+		tracesSampleRate: 1,
+		maxSpanBufferSize: 100,
+		spanFlushIntervalMs: 5e3,
+		spanFlushMaxBytes: 8e5,
+		maxSpansPerTrace: 1024,
+		maxAttributesPerSpan: 128,
+		maxEventsPerSpan: 128,
+		maxAttributesPerSpanEvent: 128
 	};
 	sdkInfo = {
 		name: DEFAULT_SDK_NAME,
@@ -791,18 +1449,19 @@ var Flare = class {
 	};
 	framework = null;
 	/**
-	* @param api              sends the report over HTTP.
-	* @param contextCollector returns per-report attributes (browser DOM info, Node
-	*                         process info, etc). Default is a no-op.
-	* @param fileReader       reads source files for stack-trace snippets. Default
-	*                         returns null (no snippets); `@flareapp/js` injects a
-	*                         fetch-based reader, `@flareapp/node` injects a disk reader.
-	* @param scopeProvider    returns the current `Scope` (per-call mutable state:
-	*                         glows, pendingAttributes, entryPoint). Browser uses a
-	*                         single global scope; Node uses an AsyncLocalStorage-
-	*                         backed provider so each request gets its own.
+	* @param api              fetch transport for reports, logs and traces. Stateless: ingest url and
+	*                         key are passed per call, so tests swap in a fake.
+	* @param contextCollector per-report attributes (browser DOM, Node process). No-op by default.
+	* @param fileReader       source files for stack-trace snippets. Defaults to no snippets;
+	*                         `@flareapp/js` injects a fetch reader, `@flareapp/node` a disk reader.
+	* @param scopeProvider    the current `Scope`. Browser uses one global scope; Node an
+	*                         AsyncLocalStorage-backed provider so each request gets its own.
+	* @param scheduler        drains the log and span buffers when the host's lifecycle ends (browser
+	*                         unload, process exit). No-op by default, leaving only size/timer flushes.
+	* @param activeSpanHolder tracks the active span so new spans auto-parent to it. In-memory by
+	*                         default; a platform can back it with AsyncLocalStorage instead.
 	*/
-	constructor(api = new Api(), contextCollector = () => ({}), fileReader = new NullFileReader(), scopeProvider = new GlobalScopeProvider(), scheduler = new NoopFlushScheduler()) {
+	constructor(api = new Api(), contextCollector = () => ({}), fileReader = new NullFileReader(), scopeProvider = new GlobalScopeProvider(), scheduler = new NoopFlushScheduler(), activeSpanHolder = new InMemoryActiveSpanHolder()) {
 		this.api = api;
 		this.contextCollector = contextCollector;
 		this.fileReader = fileReader;
@@ -816,57 +1475,25 @@ var Flare = class {
 			track: (p) => this.track(p),
 			scheduler
 		});
+		this._tracer = new Tracer({
+			api: this.api,
+			getConfig: () => this._config,
+			getSdkInfo: () => this.sdkInfo,
+			getFramework: () => this.framework,
+			getScopeAttributes: () => this.getScopeAttributes(),
+			getResourceAttributes: () => this.spanResourceAttributes(),
+			track: (p) => this.track(p),
+			scheduler,
+			activeSpanHolder
+		});
 	}
 	/**
-	* Register an in-flight report so `flush()` can wait for it. Called by
-	* every public report entry point (`report`, `reportSilently`,
-	* `reportMessage`, `reportUnhandledRejection`, `test`); each wraps its
-	* full async pipeline (beforeEvaluate -> stack trace + source snippets ->
-	* beforeSubmit -> `api.report()`) so the entire roundtrip is what's
-	* tracked, not just the HTTP send at the end.
-	*
-	* Two problems this method solves at once.
-	*
-	* Problem 1: hold a reference to the work without leaking rejections.
-	*
-	*   `p` is the real report pipeline; it can reject (network failure,
-	*   `beforeSubmit` throws, etc). If we stored `p` directly in `inflight`
-	*   and no caller attached a `.catch` (the global error listeners use
-	*   `reportSilently` which DOES catch, but the path is still subtle), an
-	*   eventual rejection would surface as an unhandled-rejection warning
-	*   on Node and a console error in the browser. Bad citizen.
-	*
-	*   So we build a SHADOW promise that mirrors `p`'s timing but cannot
-	*   reject:
-	*
-	*     p.then(
-	*         () => undefined,   // on fulfilment, value is undefined
-	*         () => undefined,   // on rejection, ALSO resolve with undefined
-	*     )
-	*
-	*   Providing the second argument means we have "handled" any rejection
-	*   from `p`. The shadow always resolves with `undefined`, and `p`'s
-	*   rejection is consumed at the boundary. From the runtime's point of
-	*   view, the shadow is well-behaved.
-	*
-	* Problem 2: self-cleaning entry.
-	*
-	*   `tracked.finally(() => this.inflight.delete(tracked))`. `finally`
-	*   fires whether the shadow resolves or rejects, but the shadow can no
-	*   longer reject (problem 1 normalized it), so this is effectively
-	*   "when the underlying report has settled, remove me from the Set."
-	*   No GC magic, no external cleanup, no race window.
+	* Register an in-flight report so `flush()` can wait for it. Every entry point wraps its whole async
+	* pipeline, from beforeEvaluate through api.report, so flush() waits on all of it.
 	*
-	*   Note that `.finally` itself returns a new promise that we drop on
-	*   the floor. If the cleanup callback ever throws, that would surface
-	*   as an unhandled rejection on the dropped promise; `delete` does not
-	*   throw so we are safe today, but anything more elaborate added here
-	*   should be wrapped in try/catch.
-	*
-	* The return value is the ORIGINAL `p`. The caller awaits real success
-	* or failure; the tracking is completely invisible to them. This is why
-	* `await flare.report(err)` inside a fatal handler observes network
-	* errors the same as before tracking was added.
+	* What goes in the Set is a shadow promise that mirrors `p`'s timing but cannot reject, so a failed
+	* report never surfaces as an unhandled rejection warning. `p` itself is returned untouched, so the
+	* caller still observes real success or failure.
 	*/
 	track(p) {
 		const tracked = p.then(() => void 0, () => void 0);
@@ -875,86 +1502,16 @@ var Flare = class {
 		return p;
 	}
 	/**
-	* Wait until every in-flight report settles, or until `timeoutMs`
-	* elapses, whichever comes first. Always resolves; never rejects.
-	*
-	* The main consumer is `@flareapp/node`'s fatal handler:
-	*
-	*     process.on('uncaughtException', async (err) => {
-	*         process.exitCode = 1;
-	*         try { await flare.report(err); } catch {}
-	*         await flare.flush(shutdownTimeoutMs);
-	*         process.exit(1);
-	*     });
-	*
-	* The fatal `report` is awaited explicitly; `flush` then drains any
-	* OTHER reports that were already in flight (a request handler that
-	* fired `flare.report(...)` concurrently with the crash). The timeout
-	* caps the wait so a hung HTTP request cannot indefinitely block
-	* shutdown.
-	*
-	* Walking the implementation:
-	*
-	*   const pending = [...this.inflight];
-	*
-	*     Spread takes a SNAPSHOT of the Set at this instant. Reports that
-	*     start AFTER this line are not included in `pending`, so they are
-	*     not awaited by THIS flush call. This is intentional: it bounds
-	*     the wait. Without the snapshot, a handler that kept emitting
-	*     reports during shutdown could keep flush alive forever and block
-	*     the process from exiting.
-	*
-	*   if (pending.length === 0) return Promise.resolve();
-	*
-	*     Fast path. No timer scheduled, no promise constructor needed.
-	*     Resolves on the microtask queue. Cheap.
-	*
-	*   return new Promise<void>((resolve) => {
-	*       const timer = setTimeout(resolve, timeoutMs);
-	*       Promise.allSettled(pending).then(() => {
-	*           clearTimeout(timer);
-	*           resolve();
-	*       });
-	*   });
-	*
-	*     The race between two outcomes, both calling the same `resolve`:
-	*
-	*     1. `setTimeout(resolve, timeoutMs)` schedules a "give up" call.
-	*        After `timeoutMs` it fires, calling `resolve()` from the
-	*        timer-queue side. The outer promise resolves immediately,
-	*        even if reports are still pending. Those reports are abandoned
-	*        (they continue running but the process is about to die).
-	*
-	*     2. `Promise.allSettled(pending)` returns a promise that resolves
-	*        when every promise in `pending` has either fulfilled or
-	*        rejected. It NEVER rejects on its own. We use `allSettled`
-	*        rather than `Promise.all` because `all` short-circuits on the
-	*        first rejection -- we want to wait for everyone regardless of
-	*        whether their HTTP calls succeed or fail. (Our shadows cannot
-	*        reject anyway because `track` normalized them, but using
-	*        `allSettled` documents the intent and survives future changes
-	*        to shadow construction.) When it resolves, we call
-	*        `clearTimeout(timer)` to cancel the pending timer (so it does
-	*        not fire later and call `resolve` a second time -- a no-op,
-	*        but wasted work) and then `resolve()` ourselves.
-	*
-	*   Resolve can only meaningfully fire once. Subsequent calls to the
-	*   same `resolve` are silently ignored by the Promise spec, so the
-	*   race is safe even if for some reason both branches fired together.
+	* Wait until every in-flight report settles or `timeoutMs` elapses. Always resolves, never rejects.
+	* Written for `@flareapp/node`'s fatal handler, which awaits the fatal report itself then flushes to
+	* drain any other concurrent reports before `process.exit`.
 	*
-	* Things flush() deliberately does NOT do:
-	*
-	*   - It does not reject. Even if every report failed, allSettled
-	*     resolves. Callers do not need a `.catch`.
-	*   - It does not retry. One pipeline attempt per report, then move on.
-	*   - It does not stop new reports from starting. The Flare instance
-	*     is still usable after flush resolves. flush is "wait for what is
-	*     in flight," not "freeze the SDK."
-	*   - It does not drain reports started after the snapshot. Call flush
-	*     again if you need to wait for those too.
+	* Snapshotting the Set bounds the wait: reports started after this line are not awaited, so a handler
+	* that keeps emitting during shutdown cannot block the process forever. Call flush again for those.
 	*/
 	flush(timeoutMs = 2e3) {
 		this._logger.flush();
+		this._tracer.flush();
 		const pending = [...this.inflight];
 		if (pending.length === 0) return Promise.resolve();
 		return new Promise((resolve) => {
@@ -974,22 +1531,44 @@ var Flare = class {
 	get logger() {
 		return this._logger;
 	}
+	get tracer() {
+		return this._tracer;
+	}
+	/** Starts a span the caller must end. Unlike `withSpan`, it does not become the active span,
+	*  so spans started after it do not auto-parent to it. */
+	startSpan(name, opts) {
+		return this._tracer.startSpan(name, opts);
+	}
+	/**
+	* Runs `fn` with the span active, so spans started inside auto-parent to it, then ends it.
+	* Records an error status first if `fn` throws or its returned promise rejects.
+	*/
+	withSpan(name, fn, opts) {
+		return this._tracer.withSpan(name, fn, opts);
+	}
 	light(key = KEY, debug) {
 		this._config.key = key;
 		if (debug !== void 0) this._config.debug = debug;
 		this._logger.flush();
+		this._tracer.flush();
 		return this;
 	}
 	configure(config) {
 		const wasLogsEnabled = this._config.enableLogs;
+		const wasTracingEnabled = this._config.enableTracing;
+		const wasBreadcrumbsEnabled = this._config.enableBreadcrumbs;
 		this._config = {
 			...this._config,
 			...config
 		};
 		if (config.sampleRate !== void 0) this._config.sampleRate = Math.max(0, Math.min(1, config.sampleRate));
-		this._config.urlDenylist = resolveDenylist(config.urlDenylist, config.replaceDefaultUrlDenylist ?? this._config.replaceDefaultUrlDenylist);
+		if (config.tracesSampleRate !== void 0) this._config.tracesSampleRate = Math.max(0, Math.min(1, config.tracesSampleRate));
+		if (config.urlDenylist !== void 0 || config.replaceDefaultUrlDenylist !== void 0) this._config.urlDenylist = resolveDenylist(config.urlDenylist, config.replaceDefaultUrlDenylist ?? this._config.replaceDefaultUrlDenylist);
 		if (wasLogsEnabled && this._config.enableLogs === false) this._logger.clear();
 		if (config.key !== void 0) this._logger.flush();
+		if (wasBreadcrumbsEnabled && this._config.enableBreadcrumbs === false) this.scopeProvider.active().clearBreadcrumbs();
+		if (wasTracingEnabled && this._config.enableTracing === false) this._tracer.clear();
+		if (config.key !== void 0) this._tracer.flush();
 		return this;
 	}
 	test() {
@@ -1011,6 +1590,9 @@ var Flare = class {
 		}, this._config.maxGlowsPerReport);
 		return this;
 	}
+	addBreadcrumb(type, attributes, startTimeUnixNano) {
+		recordBreadcrumb(this.scopeProvider, this._config, type, attributes, startTimeUnixNano);
+	}
 	clearGlows() {
 		this.scopeProvider.active().clearGlows();
 		return this;
@@ -1029,11 +1611,8 @@ var Flare = class {
 		return this;
 	}
 	/**
-	* Attach an identified user to the active scope. Fields are projected to the
-	* keys the Flare backend reads: `user.id`, `user.email`, `user.full_name`,
-	* and `client.address`. Any extra keys are bundled into `user.attributes`.
-	* Pass `null` to clear the user. Scope-aware: in Node this targets the
-	* per-request scope via the scope provider.
+	* Maps the known fields onto the keys the Flare backend reads (see `USER_FIELD_KEYS`) and bundles
+	* anything else into `user.attributes`. Pass `null` to clear. In Node this targets the per-request scope.
 	*/
 	setUser(user) {
 		const scope = this.scopeProvider.active();
@@ -1066,7 +1645,7 @@ var Flare = class {
 	async reportInternal(error, attributes = {}) {
 		if (this._config.sampleRate < 1 && Math.random() >= this._config.sampleRate) return;
 		const seenAtUnixNano = Date.now() * 1e6;
-		const coerced = error instanceof Error ? error : new Error(typeof error === "string" ? error : String(error));
+		const coerced = error instanceof Error ? error : new Error(String(error));
 		const errorToReport = await this._config.beforeEvaluate(coerced);
 		if (!errorToReport) return;
 		const report = await this.createReportFromError(errorToReport, attributes, seenAtUnixNano);
@@ -1148,7 +1727,10 @@ var Flare = class {
 		const baseAttributes = includeBase ? this.buildBaseAttributes() : {};
 		const entryPoint = activeScope.entryPoint;
 		const entryPointOverrides = {};
-		if (entryPoint?.identifier !== void 0) entryPointOverrides["flare.entry_point.handler.identifier"] = entryPoint.identifier;
+		if (entryPoint?.identifier !== void 0) {
+			entryPointOverrides["flare.entry_point.handler.identifier"] = entryPoint.identifier;
+			entryPointOverrides["http.route"] = entryPoint.identifier;
+		}
 		if (entryPoint?.type !== void 0) entryPointOverrides["flare.entry_point.handler.type"] = entryPoint.type;
 		if (entryPoint?.name !== void 0) entryPointOverrides["flare.entry_point.handler.name"] = entryPoint.name;
 		const attributes = {
@@ -1177,6 +1759,23 @@ var Flare = class {
 			record: this.assembleAttributes(collectorRecord, userAttributes, false)
 		};
 	}
+	/**
+	* Local roots only, snapshotted by the Tracer at span START so a long-lived root does not drift into
+	* the next page's scope. Children get none, and no span ever runs the DOM collector.
+	*
+	* Everything assembled is inherited except user identity (excluding the opaque `user.id`): a root span
+	* goes out for every page view, so email, full name, IP and `user.attributes` would turn normal
+	* browsing into PII traffic. The rest — `context.custom`, `addContextGroup` bags — stays in, because
+	* the trace viewer renders any span attribute whose key does not start with `flare.`.
+	*/
+	getScopeAttributes() {
+		const scoped = { ...this.assembleAttributes({}, {}, false) };
+		for (const key of SPAN_SCOPE_EXCLUDED_KEYS) delete scoped[key];
+		return scoped;
+	}
+	spanResourceAttributes() {
+		return partitionAttributes(this.contextCollector(this._config)).resource;
+	}
 	buildReport(input) {
 		const activeScope = this.scopeProvider.active();
 		const attributes = this.assembleAttributes(this.contextCollector(this._config), input.extraAttributes, true);
@@ -1185,7 +1784,7 @@ var Flare = class {
 			message: input.message,
 			seenAtUnixNano: input.seenAtUnixNano,
 			stacktrace: input.stacktrace,
-			events: glowsToEvents(activeScope.glows),
+			events: timelineEvents(activeScope.glows, activeScope.breadcrumbs),
 			attributes
 		};
 		if (input.isLog) report.isLog = true;
@@ -1203,4 +1802,4 @@ var Flare = class {
 };
 
 //#endregion
-export { Api, DEFAULT_URL_DENYLIST, Flare, GlobalScopeProvider, Logger, NoopFlushScheduler, NullFileReader, Scope, USER_IDENTITY_KEYS, assert, assertKey, convertToError, createStackTrace, describeRejectionReason, extractCode, flatJsonStringify, getCodeSnippet, glowsToEvents, now, readLinesFromFile, redactUrlQuery, resolveDenylist, routeRejection, userIdentityAttributes };
+export { Api, BrowserSpanEventType, BrowserSpanType, DEFAULT_MAX_LIVE_TRACES, DEFAULT_URL_DENYLIST, Flare, FrameworkName, GlobalScopeProvider, InMemoryActiveSpanHolder, Logger, MAX_BREADCRUMB_URL_LENGTH, NoopFlushScheduler, NullFileReader, Scope, SpanStatusCode, Tracer, USER_IDENTITY_KEYS, assert, assertKey, breadcrumbUrl, buildTraceparent, buildTracesEnvelope, convertToError, createIdentityTagger, createStackTrace, defaultNowNano, describeRejectionReason, extractCode, flatJsonStringify, getCodeSnippet, glowsToEvents, now, parseTraceparent, readLinesFromFile, recordBreadcrumb, redactObjectValues, redactUrlQuery, resolveDenylist, routeRejection, safeClone, safeDecode, spanId, toCustomContext, urlAttributes, userIdentityAttributes };