@genn-inc/cluebase-frontend-sdk 0.0.1 → 0.0.3

package/dist/instrumentation/network-span-attributes.d.ts

@@ -1,11 +1,4 @@
 import { type Span } from "@opentelemetry/api";
-/**
- * 属性を書き込む側が、span に実際に求めるもの。
- *
- * **`Span` 全体（11 member）を求めていました。** ここで使うのは 2 つだけなので、
- * 試験の作り物は残りを持てず `as unknown as Span` で嘘をつくしかない状態でした
- * （`tests/README.md` §10）。3 つ目を使い始めたら、ここが変わって作り物が落ちます。
- */
 export type AttributeWritableSpan = {
     [K in "setAttribute" | "setStatus"]: (...args: Parameters<Span[K]>) => unknown;
 };

package/dist/instrumentation/network-span-attributes.js

@@ -56,6 +56,7 @@ const setRequestSpanAttributes = (span, meta, eventName, status, observationCont
     span.setAttribute("cluebase.path_template", meta.pathTemplate);
     setOptionalString(span, "cluebase.target_service", meta.targetService);
     setOptionalString(span, "cluebase.parent_span_id", meta.parentSpanId);
+    setOptionalString(span, "cluebase.action.id", meta.actionId);
     setOptionalString(span, "cluebase.interaction.id", meta.interactionId);
     setOptionalString(span, "cluebase.interaction.initiator", meta.interactionInitiator);
     setOptionalString(span, "cluebase.interaction.start_event_kind", meta.interactionStartEventKind);
@@ -79,8 +80,6 @@ const setRequestSpanAttributes = (span, meta, eventName, status, observationCont
     setOptionalStringArray(span, cluebaseAuthoredPropertyAttribute("graphql_top_level_fields"), requestEvidence.graphqlTopLevelFields);
     setOptionalNumber(span, cluebaseAuthoredMetricAttribute("request_size_bytes"), meta.requestSizeBytes);
     span.setAttribute(cluebaseAuthoredPropertyAttribute("request_field_paths"), meta.queryKeys);
-    // 顧客の値が入る面。**値は入れ物の中で伏せられている。**顧客が画面で名指しした
-    // 項目だけが値を持ち、その項目名は下の控えに並ぶ。
     setJsonRecordAttribute(span, "cluebase.request_parameters_snapshot_json", meta.requestParametersSnapshot.snapshot);
     setJsonRecordAttribute(span, "cluebase.request_metadata_json", {
         ...meta.requestMetadataSummary,
@@ -142,7 +141,6 @@ export const setResponseSpanAttributes = (span, meta, input) => {
         deniedKeys: input.deniedKeys ?? [],
     });
     setJsonRecordAttribute(span, "cluebase.response_parameters_snapshot_json", responseParametersSnapshot.snapshot);
-    // 平文で残した項目の控え。面をまたいで 1 本にする。空なら属性を出さない。
     setOptionalStringArray(span, "cluebase.privacy.allowed_keys", [
         ...new Set([
             ...meta.requestParametersSnapshot.allowedValueKeys,

package/dist/instrumentation/network.js

@@ -18,7 +18,6 @@ let fetchInstrumentation = null;
 let xhrInstrumentation = null;
 let cluebaseNetworkPropagatorRegistered = false;
 const REQUEST_LIFECYCLE_ORPHAN_TIMEOUT_MS = 30000;
-// OTel fetch waits 300ms for browser resource timing before ending spans.
 const FETCH_SPAN_END_SETTLE_MS = 350;
 const pendingFetchSpanEndWaits = new Set();
 class ManagedFetchInstrumentation extends FetchInstrumentation {
@@ -70,6 +69,9 @@ const toTraceHeaders = (capture, traceContext) => {
     if (traceContext.parentSpanId) {
         headers["x-cluebase-parent-span-id"] = traceContext.parentSpanId;
     }
+    if (traceContext.actionId) {
+        headers["x-cluebase-action-id"] = traceContext.actionId;
+    }
     if (traceContext.interactionId) {
         headers["x-cluebase-interaction-id"] = traceContext.interactionId;
     }
@@ -99,6 +101,7 @@ const traceContextFromMeta = (meta) => ({
     parentSpanId: meta.parentSpanId,
     requestId: meta.requestId,
     requestSpanId: meta.requestSpanId,
+    actionId: meta.actionId,
     interactionId: meta.interactionId,
     interactionInitiator: meta.interactionInitiator,
     interactionStartEventKind: meta.interactionStartEventKind,
@@ -108,6 +111,7 @@ const CLUEBASE_NETWORK_PROPAGATION_FIELDS = [
     "x-cluebase-trace-id",
     "x-cluebase-request-id",
     "x-cluebase-request-span-id",
+    "x-cluebase-action-id",
     "x-cluebase-parent-span-id",
     "x-cluebase-interaction-id",
     "x-cluebase-origin-frontend-interaction-id",
@@ -471,6 +475,7 @@ export const startNetworkCapture = (context, options = {}) => {
                 parentSpanId: null,
                 requestId: generateRequestId(),
                 requestSpanId: generateRequestSpanId(),
+                actionId: null,
                 interactionId: generateInteractionId(),
                 interactionInitiator: null,
                 interactionStartEventKind: null,

package/dist/instrumentation/page.js

@@ -4,8 +4,6 @@ export const startPageCapture = (context) => {
         return { stop: () => undefined };
     }
     let pageEnteredAtMs = Date.now();
-    // Page-view events are emitted from OTel navigation/document-load signals.
-    // This module only keeps Cluebase-specific time-on-page evidence.
     const handlePageLeave = () => {
         if (context.getConsent() === "denied") {
             return;

package/dist/instrumentation/performance.js

@@ -92,7 +92,6 @@ const observeEntryType = (observers, entryType, callback) => {
         observers.push(observer);
     }
     catch {
-        // Some browsers expose an entry type but still reject buffered observation.
     }
 };
 const readPerformanceNavigation = () => {
@@ -233,9 +232,6 @@ export const startPerformanceCapture = (context) => {
             occurredAtMs: Date.now(),
             payload: {
                 viewId,
-                // must strip query string to avoid leaking OAuth
-                // callback / password-reset / magic-link tokens that may
-                // live in `window.location.href`. See `instrumentation/common.ts`.
                 pageUrl: currentPageUrl() ?? "",
                 collectorName: "performance_rum",
                 aggregationKind: "per_view_window",
@@ -305,9 +301,6 @@ export const startPerformanceCapture = (context) => {
     window.addEventListener("pointerdown", interactionHandler, true);
     window.addEventListener("pagehide", pageHideHandler, true);
     document.addEventListener("visibilitychange", visibilityHandler, true);
-    // Long tasks and resource load failures are retained as Cluebase summary-only
-    // UX evidence because the accepted browser OTel modules above cover
-    // document load and Web Vitals, not this per-view aggregate.
     observeEntryType(observers, "longtask", (list) => {
         for (const entry of list.getEntries()) {
             const nearInteraction = state.lastInteractionAtMs !== null &&

package/dist/integrations/react-router.js

@@ -18,9 +18,6 @@ export const attachReactRouterIntegration = (options) => {
         options.onRouteChange(lastPath, nextPath);
         lastPath = nextPath;
     };
-    // Idempotent guard for Cluebase-owned History API wrappers. OTel navigation
-    // instrumentation may patch history separately and remains the primary
-    // navigation source.
     const sentinelPushState = history.pushState;
     const sentinelReplaceState = history.replaceState;
     const alreadyWrapped = isHistoryAlreadyCluebaseWrapped(history);

package/dist/internal/internal-log.d.ts

@@ -1,10 +1,3 @@
-/**
- * SDK-internal diagnostic logger for the Frontend SDK.
- *
- * Mirror of Node SDK ``internal-log.ts`` and Python SDK ``_internal_log.py``.
- * Exposes a single configurable {@link InternalLogger}. Default is a no-op
- * so the SDK does not write to the host page's console.
- */
 export type InternalLogContext = {
     [key: string]: string | number | boolean | null;
 };

package/dist/internal/internal-log.js

@@ -1,10 +1,3 @@
-/**
- * SDK-internal diagnostic logger for the Frontend SDK.
- *
- * Mirror of Node SDK ``internal-log.ts`` and Python SDK ``_internal_log.py``.
- * Exposes a single configurable {@link InternalLogger}. Default is a no-op
- * so the SDK does not write to the host page's console.
- */
 const SAFE_CONTEXT_KEYS = new Set([
     "attempt",
     "code",
@@ -39,9 +32,5 @@ export function logSwallowed(operation, _cause, context = {}) {
             details[key] = value;
         }
     }
-    // Exception text and stacks may contain customer payloads, credentials, or
-    // source paths. The internal logger is an optional diagnostic sink, so it
-    // keeps only bounded caller-provided classification fields, matching the
-    // backend SDKs and the API/worker log contract.
     currentLogger.debug(`cluebase.sdk swallowed ${operation}`, details);
 }

package/dist/provider/_version.d.ts

@@ -1 +1 @@
-export declare const SDK_VERSION: "0.0.1";
+export declare const SDK_VERSION: "0.0.3";

package/dist/provider/_version.js

@@ -1,3 +1,3 @@
 // This file is generated by scripts/generate-version-module.mjs.
 // Do NOT edit by hand. The source of truth is `package.json` `version`.
-export const SDK_VERSION = "0.0.1";
+export const SDK_VERSION = "0.0.3";

package/dist/provider/config.d.ts

@@ -1,11 +1,4 @@
 import type { CluebaseInitOptions, ResolvedCluebaseConfig } from "./types.js";
-/**
- * Read an address Cluebase is able to send to, or `null` when it cannot.
- *
- * `cluebase.init` refuses such an endpoint loudly and `resolveConfig` drops it to
- * `""`; the two reactions differ but the question does not, so neither restates
- * the rule.
- */
 export declare const parseSendableUrl: (value: string) => URL | null;
 export declare const resolveConfig: (options: CluebaseInitOptions) => ResolvedCluebaseConfig;
 export declare const validateConfig: (config: ResolvedCluebaseConfig) => string[];

package/dist/provider/config.js

@@ -1,4 +1,4 @@
-import { ALWAYS_DENIED_KEYS, DEFAULT_CONFIG, DEFAULT_FRONTEND_SOURCE_IDENTIFIER, MAX_DIAGNOSTIC_TTL_MS, } from "./constants.js";
+import { ALWAYS_DENIED_KEYS, DEFAULT_API_BASE_URL, DEFAULT_CONFIG, DEFAULT_FRONTEND_SOURCE_IDENTIFIER, MAX_DIAGNOSTIC_TTL_MS, } from "./constants.js";
 import { SDK_COLLECTION_MODE } from "./contracts.js";
 const normalizeKeyList = (keys) => {
     if (!keys || keys.length === 0) {
@@ -64,17 +64,7 @@ const normalizeDiagnosticConfig = (value) => {
         enabledBy: value?.enabledBy?.trim() || null,
     };
 };
-// The protocols Cluebase can actually deliver over. Every place that rejects an
-// address reads this one set, so a browser-only scheme cannot be refused here
-// and accepted there.
 const SENDABLE_PROTOCOLS = new Set(["http:", "https:"]);
-/**
- * Read an address Cluebase is able to send to, or `null` when it cannot.
- *
- * `cluebase.init` refuses such an endpoint loudly and `resolveConfig` drops it to
- * `""`; the two reactions differ but the question does not, so neither restates
- * the rule.
- */
 export const parseSendableUrl = (value) => {
     try {
         const parsed = new URL(value.trim());
@@ -90,8 +80,6 @@ const normalizeTracePropagationOrigin = (value) => {
     if (!trimmed) {
         return null;
     }
-    // Unlike an endpoint, an origin that does not parse is kept as written: the
-    // caller matches these against request URLs itself.
     try {
         const parsed = new URL(trimmed);
         return SENDABLE_PROTOCOLS.has(parsed.protocol) ? parsed.origin : null;
@@ -100,10 +88,9 @@ const normalizeTracePropagationOrigin = (value) => {
         return trimmed;
     }
 };
-// The SDK does not emit a ProjectService environment. The server resolves
-// dev/prod from the `projectKey` prefix and ProjectService.
 export const resolveConfig = (options) => {
-    const originalEndpoint = normalizeConfiguredEndpoint(options.endpoint);
+    const configuredEndpoint = options.endpoint?.trim() || DEFAULT_API_BASE_URL;
+    const originalEndpoint = normalizeConfiguredEndpoint(configuredEndpoint);
     const customDenied = normalizeKeyList(options.privacy?.deniedKeys);
     const deniedKeys = [...new Set([...ALWAYS_DENIED_KEYS, ...customDenied])];
     const tracePropagationOrigins = [

package/dist/provider/constants.d.ts

@@ -7,6 +7,7 @@ export declare const EVENT_VERSION = 1;
 export declare const SOURCE_SCHEMA_VERSION = "1";
 export declare const SURFACE_TYPE: "web";
 export declare const DEFAULT_FRONTEND_SOURCE_IDENTIFIER = "frontend";
+export declare const DEFAULT_API_BASE_URL = "https://api.cluebase.io";
 export declare const MASKED_VALUE = "__cluebase_masked__";
 export declare const FORBIDDEN_PARAMETER_VALUE = "__forbidden__";
 export declare const TRUNCATED_PARAMETER_VALUE = "__truncated__";
@@ -32,23 +33,6 @@ export declare const STORAGE_KEYS: {
     readonly sessionStartedAt: "cluebase:session_started_at";
     readonly sessionLastActivityAt: "cluebase:session_last_activity_at";
 };
-/**
- * SDK-side denied keys. Stripped from event properties / metrics /
- * traits / headers / body fragments before the value is set as an OTel
- * span attribute or attached to a source-signal envelope.
- *
- * This list is a strict superset of the server-side hard-deny list
- * (`INGEST_HARD_DENY_KEYS`) **by construction**: both are emitted from the
- * same canonical data file,
- * `packages/cluebase-shared/src/ingest/ingest-privacy-policy.v1.json`.
- * It is not a hand-kept copy asserted by a parity test any more.
- *
- * `@cluebase/shared` is `private: true` and the published SDK is built with
- * `tsc` alone (no bundling), so the SDK cannot import it at customer
- * runtime. The shared-contract generator therefore writes the table into
- * this package instead; the generated file's banner names the command to
- * re-run. Do not re-declare the list, or the command, here.
- */
 export declare const ALWAYS_DENIED_KEYS: readonly string[];
 export declare const MAX_SCHEMA_DEPTH = 6;
 export declare const MAX_SCHEMA_KEYS = 512;

package/dist/provider/constants.js

@@ -1,9 +1,6 @@
 import { SDK_ALWAYS_DENIED_KEYS } from "../_generated/ingest-privacy-tables.js";
 import { SDK_RETRY_POLICY } from "../_generated/sdk-runtime-policy.js";
 import { SDK_VERSION } from "./_version.js";
-// SDK_VERSION SoT is `package.json` `version`, generated into
-// `_version.ts` by `scripts/generate-version-module.mjs` at build time.
-// Re-export it here so call sites keep the existing import path.
 export { SDK_VERSION };
 export const SDK_NAME = "@genn-inc/cluebase-frontend-sdk";
 export const EVENT_SOURCE = "frontend_sdk";
@@ -11,18 +8,11 @@ export const EVENT_VERSION = 1;
 export const SOURCE_SCHEMA_VERSION = "1";
 export const SURFACE_TYPE = "web";
 export const DEFAULT_FRONTEND_SOURCE_IDENTIFIER = "frontend";
-// Canonical mask sentinel — matches Node SDK / Python SDK / `@cluebase/shared`
-// (`__cluebase_masked__`). Aligning across the 3 SDKs lets downstream analytics
-// queries and redaction UIs detect masked values by a single string literal.
+export const DEFAULT_API_BASE_URL = "https://api.cluebase.io";
 export const MASKED_VALUE = "__cluebase_masked__";
 export const FORBIDDEN_PARAMETER_VALUE = "__forbidden__";
 export const TRUNCATED_PARAMETER_VALUE = "__truncated__";
 export const DEFAULT_CONSENT = "unknown";
-// 送信中の取りやめが「同意の取り消し」だったのかを、中断の理由で見分けます。
-// 立てる側 (`batch.ts`) と読む側 (`client.ts`) が別の module なので、字面を
-// 両方へ書くと片方だけずれても誰も気づきません。**ずれると取り消し後の束が
-// 破棄ではなく再送**になり、利用者が拒否した後の観測が顧客のサイトから出ます。
-// 正本を 1 つにして、両端がここを読みます (AGENTS §0.2)。
 export const CONSENT_DENIED_ABORT_REASON = "consent_denied";
 export const DEFAULT_SESSION_TIMEOUT_MS = 30 * 60 * 1000;
 export const DEFAULT_LIFECYCLE_INTERACTION_GRACE_WINDOW_MS = 30000;
@@ -30,9 +20,6 @@ export const DEFAULT_MAX_EVENT_PAYLOAD_BYTES = 48 * 1024;
 export const DEFAULT_BATCH_FLUSH_THRESHOLD_BYTES = 48 * 1024;
 export const DEFAULT_MAX_BATCH_PAYLOAD_BYTES = 60 * 1024;
 export const DEFAULT_MAX_BATCH_QUEUE_BYTES = 300 * 1024;
-// EventQueue の保持件数上限。 maxBytes (300KB) と二重にガードして OOM を防ぐ。
-// queueMaxBytes は payload size 起点で削るが、件数ベースの暴走 (極小 event の連射等)
-// を捕捉するために件数上限も併設する。
 export const DEFAULT_MAX_BATCH_QUEUE_ITEMS = 5000;
 export const DEFAULT_DIAGNOSTIC_TTL_MS = 600000;
 export const MAX_DIAGNOSTIC_TTL_MS = 1800000;
@@ -47,23 +34,6 @@ export const STORAGE_KEYS = {
     sessionStartedAt: "cluebase:session_started_at",
     sessionLastActivityAt: "cluebase:session_last_activity_at",
 };
-/**
- * SDK-side denied keys. Stripped from event properties / metrics /
- * traits / headers / body fragments before the value is set as an OTel
- * span attribute or attached to a source-signal envelope.
- *
- * This list is a strict superset of the server-side hard-deny list
- * (`INGEST_HARD_DENY_KEYS`) **by construction**: both are emitted from the
- * same canonical data file,
- * `packages/cluebase-shared/src/ingest/ingest-privacy-policy.v1.json`.
- * It is not a hand-kept copy asserted by a parity test any more.
- *
- * `@cluebase/shared` is `private: true` and the published SDK is built with
- * `tsc` alone (no bundling), so the SDK cannot import it at customer
- * runtime. The shared-contract generator therefore writes the table into
- * this package instead; the generated file's banner names the command to
- * re-run. Do not re-declare the list, or the command, here.
- */
 export const ALWAYS_DENIED_KEYS = SDK_ALWAYS_DENIED_KEYS;
 export const MAX_SCHEMA_DEPTH = 6;
 export const MAX_SCHEMA_KEYS = 512;

package/dist/provider/privacy-policy-store.d.ts

@@ -1,18 +1,6 @@
-/**
- * 届いた方針を適用する。**契約に合わない形は捨てて、伏せた側へ倒れます。**
- * 途中まで読めた分を活かすと、顧客が決めていない項目を平文にし得ます。
- */
 export declare const applyDeliveredPrivacyPolicy: (policy: unknown) => void;
-/** まだ何も適用していない状態へ戻す。= 全部伏せる。 */
 export declare const resetPrivacyPolicy: () => void;
-/** 塊の要求に載せる合印。持っていなければ載せない。 */
 export declare const appliedPrivacyPolicyToken: () => string | undefined;
-/**
- * この入口・この向きで、顧客が平文にした項目名。
- *
- * **入口が決まらない時は空を返します。**曖昧に当てると、顧客が 1 つの入口について
- * 決めたことが、関係のない通信まで平文にします。
- */
 export declare const allowedValuePathsFor: (input: {
     method: string | null | undefined;
     pathTemplate: string | null | undefined;

package/dist/provider/privacy-policy-store.js

@@ -2,10 +2,6 @@ import { ingestPrivacyPolicySchema, } from "../exporter/delivery-response-contra
 const policyKey = (input) => `${input.direction} ${input.method.toUpperCase()} ${input.pathTemplate}`;
 let appliedToken = null;
 let allowedPathsByEntrance = new Map();
-/**
- * 届いた方針を適用する。**契約に合わない形は捨てて、伏せた側へ倒れます。**
- * 途中まで読めた分を活かすと、顧客が決めていない項目を平文にし得ます。
- */
 export const applyDeliveredPrivacyPolicy = (policy) => {
     const parsed = ingestPrivacyPolicySchema.safeParse(policy);
     if (!parsed.success) {
@@ -32,19 +28,11 @@ const setPrivacyPolicy = (policy) => {
     allowedPathsByEntrance = next;
     appliedToken = policy.token;
 };
-/** まだ何も適用していない状態へ戻す。= 全部伏せる。 */
 export const resetPrivacyPolicy = () => {
     allowedPathsByEntrance = new Map();
     appliedToken = null;
 };
-/** 塊の要求に載せる合印。持っていなければ載せない。 */
 export const appliedPrivacyPolicyToken = () => appliedToken ?? undefined;
-/**
- * この入口・この向きで、顧客が平文にした項目名。
- *
- * **入口が決まらない時は空を返します。**曖昧に当てると、顧客が 1 つの入口について
- * 決めたことが、関係のない通信まで平文にします。
- */
 export const allowedValuePathsFor = (input) => {
     if (!input.method || !input.pathTemplate)
         return [];

package/dist/provider/sdk-error.d.ts

@@ -0,0 +1,7 @@
+export type SdkErrorDetails = {
+    error_name: string;
+    error_message: string;
+    error_stack?: string;
+};
+export declare const getSdkErrorDetails: (error: unknown) => SdkErrorDetails;
+export declare const reportSdkError: (operation: string, error: unknown) => SdkErrorDetails;

package/dist/provider/sdk-error.js

@@ -0,0 +1,48 @@
+const redactSensitiveText = (value) => value
+    .replace(/\bpk_[A-Za-z0-9_-]+\b/g, "[redacted-project-key]")
+    .replace(/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/-]+=*/gi, "$1 [redacted]")
+    .replace(/(https?:\/\/[^\s?]+)\?[^\s]*/gi, "$1?[redacted]")
+    .slice(0, 500);
+const readErrorField = (error, field) => {
+    try {
+        const value = error?.[field];
+        return typeof value === "string" ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+export const getSdkErrorDetails = (error) => {
+    let fallbackMessage;
+    try {
+        fallbackMessage = String(error);
+    }
+    catch {
+        fallbackMessage = "Unknown thrown value";
+    }
+    const stack = readErrorField(error, "stack");
+    return {
+        error_name: readErrorField(error, "name") || "UnknownError",
+        error_message: redactSensitiveText(readErrorField(error, "message") || fallbackMessage),
+        ...(stack
+            ? {
+                error_stack: stack
+                    .split(/\r?\n/)
+                    .slice(1, 9)
+                    .map(redactSensitiveText)
+                    .join("\n"),
+            }
+            : {}),
+    };
+};
+export const reportSdkError = (operation, error) => {
+    const details = getSdkErrorDetails(error);
+    try {
+        if (typeof console !== "undefined" && typeof console.error === "function") {
+            const stack = details.error_stack ? `\n${details.error_stack}` : "";
+            console.error(`[cluebase] ${operation} failed (${details.error_name}): ${details.error_message}${stack}`);
+        }
+    }
+    catch { }
+    return details;
+};

package/dist/provider/sdk-event-pipeline.d.ts

@@ -49,7 +49,7 @@ export declare class ProviderEventPipeline {
     enqueueRawEvent(event: RawCapturedEvent, skipSessionTouch?: boolean): void;
     applyUsageGovernorFeedback(feedback: IngestUsageGovernorFeedback | null | undefined): void;
     refreshSessionCaptureEligibility(): void;
-    buildContext(): CluebaseContext;
+    buildContext(event?: RawCapturedEvent): CluebaseContext;
     private attachInteractionContext;
     private attachCurrentLocation;
     private handleSessionLifecycle;

package/dist/provider/sdk-event-pipeline.js

@@ -4,7 +4,6 @@ import { rawEventToSourceSignalEvent } from "../exporter/raw-event-to-source-sig
 import { createFrontendResourceAttributes } from "../exporter/frontend-resource.js";
 import { sanitizeObject, } from "../exporter/sanitize.js";
 import { DEFAULT_INGEST_USAGE_GOVERNOR_FEEDBACK, hasUsageGovernorFeedbackChanged, isCostCapabilityDisabled, normalizeIngestUsageGovernorFeedback, } from "./usage-governor.js";
-import { DEFAULT_LIFECYCLE_INTERACTION_GRACE_WINDOW_MS, } from "./constants.js";
 import { FRONTEND_EVENT_NAME } from "./contracts.js";
 import { shouldSampleSession } from "./sampling.js";
 import { stripQueryAndHashFromUrl, toStringOrNull, toSubjectProfile, } from "./sdk-input-normalization.js";
@@ -20,13 +19,6 @@ const TRACE_ROOT_EVENTS = new Set([
     "drag_drop_completed",
     "custom_emitted",
 ]);
-const SUBJECT_PROFILE_TRAIT_KEYS = new Set([
-    "name",
-    "displayName",
-    "email",
-    "emailAddress",
-    "avatarUrl",
-]);
 export const OFFICIAL_CUSTOM_EVENT_NAME = {
     identityIdentified: "identity_identified",
     identityReset: "identity_reset",
@@ -146,7 +138,7 @@ export class ProviderEventPipeline {
             }
         }
         try {
-            const context = this.buildContext();
+            const context = this.buildContext(eventWithLocation);
             if (SUMMARY_EVENT_NAMES.has(eventWithLocation.type)) {
                 const summaryCount = eventWithLocation.payload.summaryCount;
                 const droppedCount = eventWithLocation.payload.droppedCount;
@@ -211,7 +203,7 @@ export class ProviderEventPipeline {
         const rate = config.sampling.sessionSampleRate;
         this.sessionCaptureEligible = shouldSampleSession(rate);
     }
-    buildContext() {
+    buildContext(event) {
         const runtime = this.runtime;
         if (!runtime) {
             throw new Error("SDK is not initialized");
@@ -221,6 +213,9 @@ export class ProviderEventPipeline {
         const organization = runtime.organizationManager.getContext();
         const environment = runtime.environmentManager.getContext();
         const trace = runtime.traceManager.getSnapshot();
+        const actionContext = runtime.traceManager.getBoundActionContext();
+        const eventActionId = toStringOrNull(event?.payload.actionId);
+        const eventInteractionId = toStringOrNull(event?.payload.interactionId);
         const requestContext = runtime.traceManager.createRequestContext() ??
             new TraceManager().createRequestContext();
         const privacySummary = {
@@ -228,9 +223,9 @@ export class ProviderEventPipeline {
             droppedFieldCount: 0,
             maskedFields: new Set(),
         };
-        const subjectTraits = sanitizeContextTraits(identity.traits, runtime.config.privacy.deniedKeys, SUBJECT_PROFILE_TRAIT_KEYS, privacySummary, "subject.trait");
-        const organizationTraits = sanitizeContextTraits(organization.traits, runtime.config.privacy.deniedKeys, new Set(), privacySummary, "organization.trait");
-        const contextTraits = sanitizeContextTraits(environment.contextTraits, runtime.config.privacy.deniedKeys, new Set(), privacySummary, "context.trait");
+        const subjectTraits = sanitizeContextTraits(identity.traits, runtime.config.privacy.deniedKeys, new Set(), privacySummary, "subject.trait", false, true);
+        const organizationTraits = sanitizeContextTraits(organization.traits, runtime.config.privacy.deniedKeys, new Set(), privacySummary, "organization.trait", false, true);
+        const contextTraits = sanitizeContextTraits(environment.contextTraits, runtime.config.privacy.deniedKeys, new Set(), privacySummary, "context.trait", false, true);
         return {
             producer_id: runtime.config.producerId,
             anonymous_id: identity.anonymousId,
@@ -239,10 +234,12 @@ export class ProviderEventPipeline {
             user_profile: toSubjectProfile(identity.traits),
             session_id: session.sessionId,
             tab_id: runtime.tabManager.getTabId(),
-            trace_id: trace.traceId ?? requestContext.traceId,
+            trace_id: actionContext?.traceId ?? trace.traceId ?? requestContext.traceId,
             request_id: requestContext.requestId,
             request_span_id: requestContext.requestSpanId,
-            interaction_id: runtime.traceManager.getActiveInteractionId() ??
+            action_id: eventActionId ?? actionContext?.actionId ?? requestContext.actionId,
+            interaction_id: eventInteractionId ??
+                actionContext?.interactionId ??
                 requestContext.interactionId,
             correlation_id: null,
             sdk_collection_mode: runtime.config.collection.mode,
@@ -283,49 +280,42 @@ export class ProviderEventPipeline {
     attachInteractionContext(event) {
         const traceManager = this.runtime?.traceManager;
         const nowMs = event.occurredAtMs ?? Date.now();
-        const payloadInteractionId = toStringOrNull(event.payload.interactionId);
+        const actionContext = traceManager?.getBoundActionContext();
+        const payloadInteractionId = toStringOrNull(event.payload.interactionId) ??
+            actionContext?.interactionId ??
+            null;
+        const payloadActionId = toStringOrNull(event.payload.actionId) ?? actionContext?.actionId ?? null;
         const occurrenceKind = "frontend_action";
         if (event.type === "page_view") {
-            const interactionId = traceManager?.startFrontendAction({
-                interactionId: payloadInteractionId,
-                interactionInitiator: toStringOrNull(event.payload.interactionInitiator) ?? "page_visit",
-                interactionStartEventKind: toStringOrNull(event.payload.interactionStartEventKind) ??
-                    "page_view",
-                viewId: toStringOrNull(event.payload.viewId),
-                nowMs,
-            }) ?? payloadInteractionId;
-            if (!interactionId)
+            if (!payloadActionId && !payloadInteractionId)
                 return event;
             return {
                 ...event,
                 payload: {
                     ...event.payload,
-                    interactionId,
-                    interactionInitiator: toStringOrNull(event.payload.interactionInitiator) ?? "page_visit",
-                    interactionStartEventKind: toStringOrNull(event.payload.interactionStartEventKind) ??
-                        "page_view",
-                    occurrenceKind,
+                    ...(payloadActionId ? { actionId: payloadActionId } : {}),
+                    ...(payloadInteractionId
+                        ? { interactionId: payloadInteractionId }
+                        : {}),
                 },
             };
         }
         if (event.type === "page_leave") {
-            const interactionId = payloadInteractionId ??
-                traceManager?.getActiveInteractionId() ??
-                null;
-            if (!interactionId)
+            if (!payloadActionId && !payloadInteractionId)
                 return event;
-            traceManager?.endFrontendAction(interactionId);
             return {
                 ...event,
                 payload: {
                     ...event.payload,
-                    interactionId,
-                    occurrenceKind,
+                    ...(payloadActionId ? { actionId: payloadActionId } : {}),
+                    ...(payloadInteractionId
+                        ? { interactionId: payloadInteractionId }
+                        : {}),
                 },
             };
         }
         if (isOfficialCustomLifecycleEvent(event)) {
-            const lifecycleInteraction = traceManager?.getRecentInteractionSnapshot(nowMs, DEFAULT_LIFECYCLE_INTERACTION_GRACE_WINDOW_MS) ?? null;
+            const lifecycleInteraction = traceManager?.getBoundActionContext() ?? null;
             const interactionId = payloadInteractionId ?? lifecycleInteraction?.interactionId ?? null;
             if (!interactionId)
                 return event;
@@ -333,6 +323,11 @@ export class ProviderEventPipeline {
                 ...event,
                 payload: {
                     ...event.payload,
+                    ...(lifecycleInteraction?.actionId
+                        ? { actionId: lifecycleInteraction.actionId }
+                        : payloadActionId
+                            ? { actionId: payloadActionId }
+                            : {}),
                     interactionId,
                     occurrenceKind,
                     interactionInitiator: toStringOrNull(event.payload.interactionInitiator) ??
@@ -364,6 +359,11 @@ export class ProviderEventPipeline {
                 ...event,
                 payload: {
                     ...event.payload,
+                    ...(traceManager?.getActiveActionId()
+                        ? { actionId: traceManager.getActiveActionId() }
+                        : payloadActionId
+                            ? { actionId: payloadActionId }
+                            : {}),
                     interactionId,
                     occurrenceKind,
                     interactionInitiator: toStringOrNull(event.payload.interactionInitiator) ??
@@ -373,20 +373,7 @@ export class ProviderEventPipeline {
                 },
             };
         }
-        const activeInteractionId = payloadInteractionId ??
-            traceManager?.getActiveInteractionId() ??
-            null;
-        if (!activeInteractionId || activeInteractionId === payloadInteractionId) {
-            return event;
-        }
-        return {
-            ...event,
-            payload: {
-                ...event.payload,
-                interactionId: activeInteractionId,
-                occurrenceKind,
-            },
-        };
+        return event;
     }
     attachCurrentLocation(event) {
         const payload = event.payload;
@@ -469,8 +456,8 @@ export class ProviderEventPipeline {
         traceManager.setActiveSpan(eventId);
     }
 }
-function sanitizeContextTraits(traits, deniedKeys, excludedKeys = new Set(), summary, pathPrefix = "") {
-    const sanitized = sanitizeObject(traits, deniedKeys, summary, pathPrefix);
+function sanitizeContextTraits(traits, deniedKeys, excludedKeys = new Set(), summary, pathPrefix = "", maskIdentityPii = true, preserveExplicitTraits = false) {
+    const sanitized = sanitizeObject(traits, deniedKeys, summary, pathPrefix, maskIdentityPii, preserveExplicitTraits);
     if (typeof sanitized !== "object" || sanitized === null || Array.isArray(sanitized)) {
         return {};
     }