@flareapp/node 0.10.0 → 0.12.0

package/dist/index.cjs

@@ -34,24 +34,8 @@ let node_fs_promises = require("node:fs/promises");
 let node_url = require("node:url");
 
 //#region src/context/body.ts
-/** `^` plus `\b` accepts a `; charset=utf-8` suffix while still rejecting `...-urlencoded-foo`. */
 const DEFAULT_BODY_CONTENT_TYPES = /^application\/(json|x-www-form-urlencoded)\b/i;
-/** Reuses core's URL denylist, so credentials are caught by the same regex everywhere. */
 const DEFAULT_BODY_KEY_DENYLIST = _flareapp_core.DEFAULT_URL_DENYLIST;
-/**
-* Normalize, redact, serialize, and size-cap a request body for a Flare report. Returns the JSON string,
-* or `null` when the body should not be reported (unknown shape, content-type miss, serialization fail).
-*
-* Accepts four runtime shapes:
-* - `string`: must match `contentType` per `bodyAllowedContentTypes`, else dropped.
-* - `Buffer`: decoded UTF-8 then treated as a string.
-* - `URLSearchParams`: flattened to a plain record. No content-type gate (shape is unambiguous).
-* - Other `object`/array: used as-is, no gate. The common middleware path (Express/Fastify `req.body`).
-* Anything else returns `null`.
-*
-* Then: redact (denylisted keys become `'[redacted]'`, cycles become `'[Circular]'`), `JSON.stringify`
-* (drop body if it throws on BigInt/Symbol/etc), and truncate to `bodyMaxBytes` including the suffix.
-*/
 function captureBody(body, contentType, opts) {
 	if (body === void 0 || body === null) return null;
 	let parsed;
@@ -77,7 +61,6 @@ function captureBody(body, contentType, opts) {
 }
 const TRUNCATION_SUFFIX = "…[truncated]";
 const TRUNCATION_SUFFIX_BYTES = Buffer.byteLength(TRUNCATION_SUFFIX, "utf8");
-/** Walks back over continuation bytes (`10xxxxxx`) to a codepoint boundary, so the result still decodes. */
 function truncateToByteLimit(serialized, maxBytes) {
 	const buf = Buffer.from(serialized, "utf8");
 	if (buf.length <= maxBytes) return serialized;
@@ -91,15 +74,12 @@ function truncateToByteLimit(serialized, maxBytes) {
 	while (cut > 0 && (buf[cut] & 192) === 128) cut--;
 	return buf.subarray(0, cut).toString("utf8") + TRUNCATION_SUFFIX;
 }
-/** Normalizes to the bare media type first, so a strict custom regex like `/^application\/json$/` still
-*  matches `application/json; charset=utf-8`. */
 function matchesContentType(ct, allowed) {
 	if (!ct) return false;
 	const mediaType = ct.split(";")[0].trim().toLowerCase();
 	if (!mediaType) return false;
 	return allowed.test(mediaType);
 }
-/** Returns `undefined` rather than `null` on failure, since `null` is itself a valid JSON value. */
 function parseString(text, contentType) {
 	if (contentType && /x-www-form-urlencoded/i.test(contentType)) return Object.fromEntries(new URLSearchParams(text).entries());
 	try {
@@ -108,13 +88,11 @@ function parseString(text, contentType) {
 		return;
 	}
 }
-/** Excludes class instances, streams, FormData, ArrayBuffer views, Buffer and URLSearchParams. */
 function isPlainObject(value) {
 	if (value === null || typeof value !== "object") return false;
 	const proto = Object.getPrototypeOf(value);
 	return proto === null || proto === Object.prototype;
 }
-/** `seen` is a parameter rather than a closure to avoid allocating a WeakSet per recursion. */
 function redact(value, denylist, seen = /* @__PURE__ */ new WeakSet()) {
 	if (value === null || typeof value !== "object") return value;
 	if (seen.has(value)) return "[Circular]";
@@ -125,9 +103,26 @@ function redact(value, denylist, seen = /* @__PURE__ */ new WeakSet()) {
 	return out;
 }
 
+//#endregion
+//#region src/context/deviceInfo.ts
+var NodeDeviceInfoProvider = class {
+	collect() {
+		return {
+			os: {
+				name: node_os.default.type(),
+				version: node_os.default.release()
+			},
+			runtime: {
+				name: "nodejs",
+				version: process.version
+			}
+		};
+	}
+};
+const nodeDeviceInfoProvider = new NodeDeviceInfoProvider();
+
 //#endregion
 //#region src/context/headers.ts
-/** Case-insensitive. An array value collapses to its first element; callers here want a single value. */
 function findHeader(headers, name) {
 	if (!headers) return;
 	const target = name.toLowerCase();
@@ -137,20 +132,12 @@ function findHeader(headers, name) {
 		return Array.isArray(value) ? value[0] : value;
 	}
 }
-/** The `^` and `$` matter: without them, `cookie` would also match a header like `X-Some-Cookie-Hint`. */
 const DEFAULT_HEADER_DENYLIST = /^(authorization|proxy-authorization|cookie|set-cookie|x-api-key|x-csrf-token|x-xsrf-token|x-auth-token|forwarded|x-forwarded-(?:for|user))$/i;
-/** `g`/`y` are stripped from a custom pattern: those carry lastIndex, which makes `.test()` stateful. */
 function resolveHeaderDenylist(custom, replaceDefault = false) {
 	if (!custom) return DEFAULT_HEADER_DENYLIST;
 	if (replaceDefault) return new RegExp(custom.source, custom.flags.replace(/[gy]/g, ""));
 	return new RegExp(`(?:${DEFAULT_HEADER_DENYLIST.source})|(?:${custom.source})`, "i");
 }
-/**
-* Turns headers into `http.request.header.<name>` attributes. The two lists differ on purpose: an
-* allowlist drops a header entirely, for apps that may only send named headers, while the denylist
-* keeps the name and replaces the value, so you can still see the header was there. `undefined` is
-* how `node:http` says "not sent", so those are dropped.
-*/
 function projectHeaders(headers, options) {
 	const out = {};
 	if (!headers) return out;
@@ -166,38 +153,23 @@ function projectHeaders(headers, options) {
 
 //#endregion
 //#region src/context/process.ts
-/**
-* Snapshot the Node runtime + host environment at report time as OTel resource attributes. Called
-* per-report rather than cached so `process.uptime()` stays accurate and `os.hostname()` tracks mid-run
-* changes; cheap enough (property reads plus a couple `os` syscalls).
-*/
 function collectProcessAttributes() {
 	return {
-		"process.runtime.name": "nodejs",
-		"process.runtime.version": process.version,
 		"process.pid": process.pid,
 		"process.uptime": process.uptime(),
 		"host.name": node_os.default.hostname(),
-		"host.arch": process.arch,
-		"os.type": node_os.default.type(),
-		"os.version": node_os.default.release()
+		"host.arch": process.arch
 	};
 }
 
 //#endregion
 //#region src/context/collectNode.ts
-/**
-* Turns process info (always) and the active request scope (only inside `runWithContext`) into
-* OTel-style attributes. User identity is not handled here: `Flare.setUser` writes straight to
-* `pendingAttributes`.
-*
-* `getOptions` is a getter so `configureNode(...)` shows up on later reports without rebuilding this.
-*/
 function makeNodeContextCollector(provider, getOptions) {
 	return (config) => {
 		const attrs = {
 			"flare.entry_point.type": "web",
-			...collectProcessAttributes()
+			...collectProcessAttributes(),
+			...(0, _flareapp_core.deviceInfoToAttributes)(nodeDeviceInfoProvider.collect())
 		};
 		const { request } = provider.active();
 		if (request.method) attrs["http.request.method"] = request.method;
@@ -268,23 +240,12 @@ function buildFatalCallbacks(flare, getOpts, exit = process.exit.bind(process))
 
 //#endregion
 //#region src/process/handlers.ts
-/**
-* Owns the `uncaughtException` and `unhandledRejection` listeners that feed fatal failures to Flare.
-* Separate from `NodeFlare` because it is pure `process`-event plumbing with no Flare semantics, which
-* keeps it trivially testable.
-*
-* Deliberately kept separate from electron's ProcessHandlerManager, not a shared module. @flareapp/electron
-* does not depend on @flareapp/node, and the only package both import is @flareapp/core, which ships in
-* every browser bundle and touches `process` only behind a typeof guard. A shared manager belongs in a new
-* package, not in core, and one method does not pay for one.
-*/
 var ProcessHandlerManager = class {
 	uncaughtHandler = null;
 	rejectionHandler = null;
 	constructor(cbs) {
 		this.cbs = cbs;
 	}
-	/** Idempotent: a no-op when the attached listeners already match the supplied modes. */
 	reconcile(opts) {
 		this.reconcileOne("uncaughtException", opts.uncaughtExceptionMode, () => this.uncaughtHandler, (h) => {
 			this.uncaughtHandler = h;
@@ -293,7 +254,6 @@ var ProcessHandlerManager = class {
 			this.rejectionHandler = h;
 		}, (reason) => this.cbs.onRejection(reason));
 	}
-	/** Remove both listeners regardless of intent. Safe when nothing is attached. */
 	detach() {
 		if (this.uncaughtHandler) {
 			process.off("uncaughtException", this.uncaughtHandler);
@@ -304,11 +264,6 @@ var ProcessHandlerManager = class {
 			this.rejectionHandler = null;
 		}
 	}
-	/**
-	* Generic attach/detach for one event. The `get`/`set` closures share this body across both events
-	* while mutating distinct fields (`uncaughtHandler` vs `rejectionHandler`). Attaches when wanted and
-	* absent, detaches when unwanted and present, else no-op.
-	*/
 	reconcileOne(event, mode, get, set, impl) {
 		const current = get();
 		const wants = mode !== "off";
@@ -331,25 +286,15 @@ var NodeScope = class extends _flareapp_core.Scope {
 
 //#endregion
 //#region src/scope/AsyncLocalStorageScopeProvider.ts
-/**
-* Gives every in-flight request its own `NodeScope`, isolated from concurrent requests.
-*
-* The `fallback` scope catches work outside any request (process-level reports, startup errors,
-* scheduled jobs). It is per-instance rather than fresh per read, so outside-scope writes persist for a
-* later outside report.
-*/
 var AsyncLocalStorageScopeProvider = class {
 	als = new node_async_hooks.AsyncLocalStorage();
 	fallback = new NodeScope();
-	/** Never null: falls back to the shared scope outside `runWithContext`. */
 	active() {
 		return this.als.getStore() ?? this.fallback;
 	}
-	/** Null outside `runWithContext`, so callers can tell "inside a request" from "not". */
 	getContext() {
 		return this.als.getStore() ?? null;
 	}
-	/** `request` is shallow-cloned so later edits to the caller's object do not leak into the scope. */
 	runWithContext(request, fn) {
 		const scope = new NodeScope();
 		scope.request = { ...request };
@@ -366,11 +311,6 @@ var AsyncLocalStorageScopeProvider = class {
 
 //#endregion
 //#region src/stacktrace/DiskFileReader.ts
-/**
-* Reads snippet sources off disk: on the server a frame's "URL" is usually a local path or a `file://`
-* URL from `import.meta.url`. Only unambiguously local paths are read, which rules out traversal,
-* following an http frame in a server build, and cwd-relative ambiguity. Never throws.
-*/
 var DiskFileReader = class {
 	async read(url) {
 		if (!isLocalFileUrl(url)) return null;
@@ -381,7 +321,6 @@ var DiskFileReader = class {
 		}
 	}
 };
-/** `file://` (any casing), POSIX absolute, Windows drive-letter (`C:\foo`), Windows UNC (`\\`). */
 function isLocalFileUrl(url) {
 	return /^file:\/\//i.test(url) || url.startsWith("/") || /^[a-z]:[\\/]/i.test(url) || url.startsWith("\\\\");
 }
@@ -389,9 +328,7 @@ function isLocalFileUrl(url) {
 //#endregion
 //#region src/Flare.ts
 const NODE_SDK_NAME = "@flareapp/node";
-const NODE_SDK_VERSION = typeof process !== "undefined" && true ? "0.10.0" : "?";
-/** `g`/`y` make `.test()` keep `lastIndex` state, so reusing the regex across keys skips every other
-*  match. All other flags are preserved. */
+const NODE_SDK_VERSION = typeof process !== "undefined" && true ? "0.12.0" : "?";
 function sanitizeRegex(re) {
 	const safeFlags = re.flags.replace(/[gy]/g, "");
 	return new RegExp(re.source, safeFlags);
@@ -409,18 +346,12 @@ const DEFAULT_NODE_OPTIONS = {
 	bodyKeyDenylist: DEFAULT_BODY_KEY_DENYLIST
 };
 /**
-* Node.js-specific `Flare` singleton, exposed from `@flareapp/node` as `flare`.
-*
-* Subclasses core's `Flare` and wires the Node-only seams in its constructor:
-* - `AsyncLocalStorageScopeProvider` so each `runWithContext(...)` callback gets its own `NodeScope`,
-*   isolated from concurrent requests.
-* - `makeNodeContextCollector(...)` turns the current `NodeScope` + process info into report attributes.
-* - `DiskFileReader` reads source for stack-trace snippets via `node:fs/promises`, not `fetch`.
-* - `ProcessHandlerManager` attaches/detaches the fatal process listeners per `NodeOptions`.
+* Node.js `Flare` singleton, exported from `@flareapp/node` as `flare`.
 *
-* Adds Node-only API on top of core: `configureNode`, `runWithContext`, `mergeContext`, `getContext`,
-* `removeProcessListeners`. Inherited core methods return `this`, so chaining keeps the `NodeFlare`
-* type and `configureNode(...)` stays callable mid-chain.
+* Subclasses core's `Flare` and wires the Node-only seams: per-request scope via
+* `AsyncLocalStorageScopeProvider`, a Node context collector, `DiskFileReader` for stack snippets,
+* and `ProcessHandlerManager` for the fatal listeners. Adds `configureNode`, `runWithContext`,
+* `mergeContext`, `getContext`, and `removeProcessListeners` on top of the core API.
 */
 var NodeFlare = class extends _flareapp_core.Flare {
 	nodeOptions = { ...DEFAULT_NODE_OPTIONS };

package/dist/index.d.cts

@@ -29,18 +29,12 @@ declare class NodeScope extends Scope$1 {
 //#endregion
 //#region src/Flare.d.ts
 /**
- * Node.js-specific `Flare` singleton, exposed from `@flareapp/node` as `flare`.
+ * Node.js `Flare` singleton, exported from `@flareapp/node` as `flare`.
  *
- * Subclasses core's `Flare` and wires the Node-only seams in its constructor:
- * - `AsyncLocalStorageScopeProvider` so each `runWithContext(...)` callback gets its own `NodeScope`,
- *   isolated from concurrent requests.
- * - `makeNodeContextCollector(...)` turns the current `NodeScope` + process info into report attributes.
- * - `DiskFileReader` reads source for stack-trace snippets via `node:fs/promises`, not `fetch`.
- * - `ProcessHandlerManager` attaches/detaches the fatal process listeners per `NodeOptions`.
- *
- * Adds Node-only API on top of core: `configureNode`, `runWithContext`, `mergeContext`, `getContext`,
- * `removeProcessListeners`. Inherited core methods return `this`, so chaining keeps the `NodeFlare`
- * type and `configureNode(...)` stays callable mid-chain.
+ * Subclasses core's `Flare` and wires the Node-only seams: per-request scope via
+ * `AsyncLocalStorageScopeProvider`, a Node context collector, `DiskFileReader` for stack snippets,
+ * and `ProcessHandlerManager` for the fatal listeners. Adds `configureNode`, `runWithContext`,
+ * `mergeContext`, `getContext`, and `removeProcessListeners` on top of the core API.
  */
 declare class NodeFlare extends Flare$1 {
   private nodeOptions;

package/dist/index.d.mts

@@ -29,18 +29,12 @@ declare class NodeScope extends Scope$1 {
 //#endregion
 //#region src/Flare.d.ts
 /**
- * Node.js-specific `Flare` singleton, exposed from `@flareapp/node` as `flare`.
+ * Node.js `Flare` singleton, exported from `@flareapp/node` as `flare`.
  *
- * Subclasses core's `Flare` and wires the Node-only seams in its constructor:
- * - `AsyncLocalStorageScopeProvider` so each `runWithContext(...)` callback gets its own `NodeScope`,
- *   isolated from concurrent requests.
- * - `makeNodeContextCollector(...)` turns the current `NodeScope` + process info into report attributes.
- * - `DiskFileReader` reads source for stack-trace snippets via `node:fs/promises`, not `fetch`.
- * - `ProcessHandlerManager` attaches/detaches the fatal process listeners per `NodeOptions`.
- *
- * Adds Node-only API on top of core: `configureNode`, `runWithContext`, `mergeContext`, `getContext`,
- * `removeProcessListeners`. Inherited core methods return `this`, so chaining keeps the `NodeFlare`
- * type and `configureNode(...)` stays callable mid-chain.
+ * Subclasses core's `Flare` and wires the Node-only seams: per-request scope via
+ * `AsyncLocalStorageScopeProvider`, a Node context collector, `DiskFileReader` for stack snippets,
+ * and `ProcessHandlerManager` for the fatal listeners. Adds `configureNode`, `runWithContext`,
+ * `mergeContext`, `getContext`, and `removeProcessListeners` on top of the core API.
  */
 declare class NodeFlare extends Flare$1 {
   private nodeOptions;

package/dist/index.mjs

@@ -1,28 +1,12 @@
-import { Api, DEFAULT_URL_DENYLIST, DEFAULT_URL_DENYLIST as DEFAULT_URL_DENYLIST$1, Flare, Flare as Flare$1, FrameworkName, GlobalScopeProvider, Logger, NullFileReader, Scope, Scope as Scope$1, convertToError, redactUrlQuery, redactUrlQuery as redactUrlQuery$1, resolveDenylist, urlAttributes } from "@flareapp/core";
+import { Api, DEFAULT_URL_DENYLIST, DEFAULT_URL_DENYLIST as DEFAULT_URL_DENYLIST$1, Flare, Flare as Flare$1, FrameworkName, GlobalScopeProvider, Logger, NullFileReader, Scope, Scope as Scope$1, convertToError, deviceInfoToAttributes, redactUrlQuery, redactUrlQuery as redactUrlQuery$1, resolveDenylist, urlAttributes } from "@flareapp/core";
 import os from "node:os";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { readFile } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 
 //#region src/context/body.ts
-/** `^` plus `\b` accepts a `; charset=utf-8` suffix while still rejecting `...-urlencoded-foo`. */
 const DEFAULT_BODY_CONTENT_TYPES = /^application\/(json|x-www-form-urlencoded)\b/i;
-/** Reuses core's URL denylist, so credentials are caught by the same regex everywhere. */
 const DEFAULT_BODY_KEY_DENYLIST = DEFAULT_URL_DENYLIST$1;
-/**
-* Normalize, redact, serialize, and size-cap a request body for a Flare report. Returns the JSON string,
-* or `null` when the body should not be reported (unknown shape, content-type miss, serialization fail).
-*
-* Accepts four runtime shapes:
-* - `string`: must match `contentType` per `bodyAllowedContentTypes`, else dropped.
-* - `Buffer`: decoded UTF-8 then treated as a string.
-* - `URLSearchParams`: flattened to a plain record. No content-type gate (shape is unambiguous).
-* - Other `object`/array: used as-is, no gate. The common middleware path (Express/Fastify `req.body`).
-* Anything else returns `null`.
-*
-* Then: redact (denylisted keys become `'[redacted]'`, cycles become `'[Circular]'`), `JSON.stringify`
-* (drop body if it throws on BigInt/Symbol/etc), and truncate to `bodyMaxBytes` including the suffix.
-*/
 function captureBody(body, contentType, opts) {
 	if (body === void 0 || body === null) return null;
 	let parsed;
@@ -48,7 +32,6 @@ function captureBody(body, contentType, opts) {
 }
 const TRUNCATION_SUFFIX = "…[truncated]";
 const TRUNCATION_SUFFIX_BYTES = Buffer.byteLength(TRUNCATION_SUFFIX, "utf8");
-/** Walks back over continuation bytes (`10xxxxxx`) to a codepoint boundary, so the result still decodes. */
 function truncateToByteLimit(serialized, maxBytes) {
 	const buf = Buffer.from(serialized, "utf8");
 	if (buf.length <= maxBytes) return serialized;
@@ -62,15 +45,12 @@ function truncateToByteLimit(serialized, maxBytes) {
 	while (cut > 0 && (buf[cut] & 192) === 128) cut--;
 	return buf.subarray(0, cut).toString("utf8") + TRUNCATION_SUFFIX;
 }
-/** Normalizes to the bare media type first, so a strict custom regex like `/^application\/json$/` still
-*  matches `application/json; charset=utf-8`. */
 function matchesContentType(ct, allowed) {
 	if (!ct) return false;
 	const mediaType = ct.split(";")[0].trim().toLowerCase();
 	if (!mediaType) return false;
 	return allowed.test(mediaType);
 }
-/** Returns `undefined` rather than `null` on failure, since `null` is itself a valid JSON value. */
 function parseString(text, contentType) {
 	if (contentType && /x-www-form-urlencoded/i.test(contentType)) return Object.fromEntries(new URLSearchParams(text).entries());
 	try {
@@ -79,13 +59,11 @@ function parseString(text, contentType) {
 		return;
 	}
 }
-/** Excludes class instances, streams, FormData, ArrayBuffer views, Buffer and URLSearchParams. */
 function isPlainObject(value) {
 	if (value === null || typeof value !== "object") return false;
 	const proto = Object.getPrototypeOf(value);
 	return proto === null || proto === Object.prototype;
 }
-/** `seen` is a parameter rather than a closure to avoid allocating a WeakSet per recursion. */
 function redact(value, denylist, seen = /* @__PURE__ */ new WeakSet()) {
 	if (value === null || typeof value !== "object") return value;
 	if (seen.has(value)) return "[Circular]";
@@ -96,9 +74,26 @@ function redact(value, denylist, seen = /* @__PURE__ */ new WeakSet()) {
 	return out;
 }
 
+//#endregion
+//#region src/context/deviceInfo.ts
+var NodeDeviceInfoProvider = class {
+	collect() {
+		return {
+			os: {
+				name: os.type(),
+				version: os.release()
+			},
+			runtime: {
+				name: "nodejs",
+				version: process.version
+			}
+		};
+	}
+};
+const nodeDeviceInfoProvider = new NodeDeviceInfoProvider();
+
 //#endregion
 //#region src/context/headers.ts
-/** Case-insensitive. An array value collapses to its first element; callers here want a single value. */
 function findHeader(headers, name) {
 	if (!headers) return;
 	const target = name.toLowerCase();
@@ -108,20 +103,12 @@ function findHeader(headers, name) {
 		return Array.isArray(value) ? value[0] : value;
 	}
 }
-/** The `^` and `$` matter: without them, `cookie` would also match a header like `X-Some-Cookie-Hint`. */
 const DEFAULT_HEADER_DENYLIST = /^(authorization|proxy-authorization|cookie|set-cookie|x-api-key|x-csrf-token|x-xsrf-token|x-auth-token|forwarded|x-forwarded-(?:for|user))$/i;
-/** `g`/`y` are stripped from a custom pattern: those carry lastIndex, which makes `.test()` stateful. */
 function resolveHeaderDenylist(custom, replaceDefault = false) {
 	if (!custom) return DEFAULT_HEADER_DENYLIST;
 	if (replaceDefault) return new RegExp(custom.source, custom.flags.replace(/[gy]/g, ""));
 	return new RegExp(`(?:${DEFAULT_HEADER_DENYLIST.source})|(?:${custom.source})`, "i");
 }
-/**
-* Turns headers into `http.request.header.<name>` attributes. The two lists differ on purpose: an
-* allowlist drops a header entirely, for apps that may only send named headers, while the denylist
-* keeps the name and replaces the value, so you can still see the header was there. `undefined` is
-* how `node:http` says "not sent", so those are dropped.
-*/
 function projectHeaders(headers, options) {
 	const out = {};
 	if (!headers) return out;
@@ -137,38 +124,23 @@ function projectHeaders(headers, options) {
 
 //#endregion
 //#region src/context/process.ts
-/**
-* Snapshot the Node runtime + host environment at report time as OTel resource attributes. Called
-* per-report rather than cached so `process.uptime()` stays accurate and `os.hostname()` tracks mid-run
-* changes; cheap enough (property reads plus a couple `os` syscalls).
-*/
 function collectProcessAttributes() {
 	return {
-		"process.runtime.name": "nodejs",
-		"process.runtime.version": process.version,
 		"process.pid": process.pid,
 		"process.uptime": process.uptime(),
 		"host.name": os.hostname(),
-		"host.arch": process.arch,
-		"os.type": os.type(),
-		"os.version": os.release()
+		"host.arch": process.arch
 	};
 }
 
 //#endregion
 //#region src/context/collectNode.ts
-/**
-* Turns process info (always) and the active request scope (only inside `runWithContext`) into
-* OTel-style attributes. User identity is not handled here: `Flare.setUser` writes straight to
-* `pendingAttributes`.
-*
-* `getOptions` is a getter so `configureNode(...)` shows up on later reports without rebuilding this.
-*/
 function makeNodeContextCollector(provider, getOptions) {
 	return (config) => {
 		const attrs = {
 			"flare.entry_point.type": "web",
-			...collectProcessAttributes()
+			...collectProcessAttributes(),
+			...deviceInfoToAttributes(nodeDeviceInfoProvider.collect())
 		};
 		const { request } = provider.active();
 		if (request.method) attrs["http.request.method"] = request.method;
@@ -239,23 +211,12 @@ function buildFatalCallbacks(flare, getOpts, exit = process.exit.bind(process))
 
 //#endregion
 //#region src/process/handlers.ts
-/**
-* Owns the `uncaughtException` and `unhandledRejection` listeners that feed fatal failures to Flare.
-* Separate from `NodeFlare` because it is pure `process`-event plumbing with no Flare semantics, which
-* keeps it trivially testable.
-*
-* Deliberately kept separate from electron's ProcessHandlerManager, not a shared module. @flareapp/electron
-* does not depend on @flareapp/node, and the only package both import is @flareapp/core, which ships in
-* every browser bundle and touches `process` only behind a typeof guard. A shared manager belongs in a new
-* package, not in core, and one method does not pay for one.
-*/
 var ProcessHandlerManager = class {
 	uncaughtHandler = null;
 	rejectionHandler = null;
 	constructor(cbs) {
 		this.cbs = cbs;
 	}
-	/** Idempotent: a no-op when the attached listeners already match the supplied modes. */
 	reconcile(opts) {
 		this.reconcileOne("uncaughtException", opts.uncaughtExceptionMode, () => this.uncaughtHandler, (h) => {
 			this.uncaughtHandler = h;
@@ -264,7 +225,6 @@ var ProcessHandlerManager = class {
 			this.rejectionHandler = h;
 		}, (reason) => this.cbs.onRejection(reason));
 	}
-	/** Remove both listeners regardless of intent. Safe when nothing is attached. */
 	detach() {
 		if (this.uncaughtHandler) {
 			process.off("uncaughtException", this.uncaughtHandler);
@@ -275,11 +235,6 @@ var ProcessHandlerManager = class {
 			this.rejectionHandler = null;
 		}
 	}
-	/**
-	* Generic attach/detach for one event. The `get`/`set` closures share this body across both events
-	* while mutating distinct fields (`uncaughtHandler` vs `rejectionHandler`). Attaches when wanted and
-	* absent, detaches when unwanted and present, else no-op.
-	*/
 	reconcileOne(event, mode, get, set, impl) {
 		const current = get();
 		const wants = mode !== "off";
@@ -302,25 +257,15 @@ var NodeScope = class extends Scope$1 {
 
 //#endregion
 //#region src/scope/AsyncLocalStorageScopeProvider.ts
-/**
-* Gives every in-flight request its own `NodeScope`, isolated from concurrent requests.
-*
-* The `fallback` scope catches work outside any request (process-level reports, startup errors,
-* scheduled jobs). It is per-instance rather than fresh per read, so outside-scope writes persist for a
-* later outside report.
-*/
 var AsyncLocalStorageScopeProvider = class {
 	als = new AsyncLocalStorage();
 	fallback = new NodeScope();
-	/** Never null: falls back to the shared scope outside `runWithContext`. */
 	active() {
 		return this.als.getStore() ?? this.fallback;
 	}
-	/** Null outside `runWithContext`, so callers can tell "inside a request" from "not". */
 	getContext() {
 		return this.als.getStore() ?? null;
 	}
-	/** `request` is shallow-cloned so later edits to the caller's object do not leak into the scope. */
 	runWithContext(request, fn) {
 		const scope = new NodeScope();
 		scope.request = { ...request };
@@ -337,11 +282,6 @@ var AsyncLocalStorageScopeProvider = class {
 
 //#endregion
 //#region src/stacktrace/DiskFileReader.ts
-/**
-* Reads snippet sources off disk: on the server a frame's "URL" is usually a local path or a `file://`
-* URL from `import.meta.url`. Only unambiguously local paths are read, which rules out traversal,
-* following an http frame in a server build, and cwd-relative ambiguity. Never throws.
-*/
 var DiskFileReader = class {
 	async read(url) {
 		if (!isLocalFileUrl(url)) return null;
@@ -352,7 +292,6 @@ var DiskFileReader = class {
 		}
 	}
 };
-/** `file://` (any casing), POSIX absolute, Windows drive-letter (`C:\foo`), Windows UNC (`\\`). */
 function isLocalFileUrl(url) {
 	return /^file:\/\//i.test(url) || url.startsWith("/") || /^[a-z]:[\\/]/i.test(url) || url.startsWith("\\\\");
 }
@@ -360,9 +299,7 @@ function isLocalFileUrl(url) {
 //#endregion
 //#region src/Flare.ts
 const NODE_SDK_NAME = "@flareapp/node";
-const NODE_SDK_VERSION = typeof process !== "undefined" && true ? "0.10.0" : "?";
-/** `g`/`y` make `.test()` keep `lastIndex` state, so reusing the regex across keys skips every other
-*  match. All other flags are preserved. */
+const NODE_SDK_VERSION = typeof process !== "undefined" && true ? "0.12.0" : "?";
 function sanitizeRegex(re) {
 	const safeFlags = re.flags.replace(/[gy]/g, "");
 	return new RegExp(re.source, safeFlags);
@@ -380,18 +317,12 @@ const DEFAULT_NODE_OPTIONS = {
 	bodyKeyDenylist: DEFAULT_BODY_KEY_DENYLIST
 };
 /**
-* Node.js-specific `Flare` singleton, exposed from `@flareapp/node` as `flare`.
-*
-* Subclasses core's `Flare` and wires the Node-only seams in its constructor:
-* - `AsyncLocalStorageScopeProvider` so each `runWithContext(...)` callback gets its own `NodeScope`,
-*   isolated from concurrent requests.
-* - `makeNodeContextCollector(...)` turns the current `NodeScope` + process info into report attributes.
-* - `DiskFileReader` reads source for stack-trace snippets via `node:fs/promises`, not `fetch`.
-* - `ProcessHandlerManager` attaches/detaches the fatal process listeners per `NodeOptions`.
+* Node.js `Flare` singleton, exported from `@flareapp/node` as `flare`.
 *
-* Adds Node-only API on top of core: `configureNode`, `runWithContext`, `mergeContext`, `getContext`,
-* `removeProcessListeners`. Inherited core methods return `this`, so chaining keeps the `NodeFlare`
-* type and `configureNode(...)` stays callable mid-chain.
+* Subclasses core's `Flare` and wires the Node-only seams: per-request scope via
+* `AsyncLocalStorageScopeProvider`, a Node context collector, `DiskFileReader` for stack snippets,
+* and `ProcessHandlerManager` for the fatal listeners. Adds `configureNode`, `runWithContext`,
+* `mergeContext`, `getContext`, and `removeProcessListeners` on top of the core API.
 */
 var NodeFlare = class extends Flare$1 {
 	nodeOptions = { ...DEFAULT_NODE_OPTIONS };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@flareapp/node",
-    "version": "0.10.0",
+    "version": "0.12.0",
     "description": "Node.js SDK for flareapp.io",
     "homepage": "https://flareapp.io",
     "bugs": {
@@ -44,7 +44,7 @@
         "release": "release-it"
     },
     "dependencies": {
-        "@flareapp/core": "2.10.0"
+        "@flareapp/core": "2.12.0"
     },
     "devDependencies": {
         "@flareapp/test-helpers": "*",