@glasstrace/sdk 1.12.0 → 1.14.0

package/dist/{chunk-CZQN6G4I.js → chunk-E2F4S5IJ.js}

@@ -54,7 +54,7 @@ import {
   performInit,
   recordSpansDropped,
   recordSpansExported
-} from "./chunk-6NKMAKMI.js";
+} from "./chunk-6ST4QV7T.js";
 import {
   isAnonymousMode,
   isProductionDisabled,
@@ -65,11 +65,16 @@ import {
   getOrCreateAnonKey,
   isSyncFsAvailable,
   readAnonKey
-} from "./chunk-J3ZCVE67.js";
+} from "./chunk-F7A3QXCT.js";
 import {
   GLASSTRACE_ATTRIBUTE_NAMES,
-  deriveSessionId
-} from "./chunk-BN5DVIUO.js";
+  SIDE_EFFECT_OMISSION_REASONS,
+  SIDE_EFFECT_OPERATION_KINDS,
+  SIDE_EFFECT_OPERATION_PHASES,
+  SIDE_EFFECT_OPERATION_STATUSES,
+  deriveSessionId,
+  isSideEffectSemanticFieldKey
+} from "./chunk-7LE2O4ZJ.js";
 import {
   isEndMarkerLine,
   parseStartMarkerLine
@@ -4348,6 +4353,350 @@ function registerHeartbeatShutdownHook(config, anonKey, sdkVersion) {
   });
 }
 
+// src/side-effect/allowlist.ts
+var MAX_SIDE_EFFECT_OPERATION_LABEL_LENGTH = 96;
+var MAX_SIDE_EFFECT_FIELD_VALUE_LENGTH = 80;
+var MAX_SIDE_EFFECT_FIELD_COUNT_VALUE_LENGTH = 16;
+var MAX_SIDE_EFFECT_OPERATIONS_PER_SPAN = 5;
+var OPERATION_KIND_SET = new Set(
+  SIDE_EFFECT_OPERATION_KINDS
+);
+var OPERATION_STATUS_SET = new Set(
+  SIDE_EFFECT_OPERATION_STATUSES
+);
+var OPERATION_PHASE_SET = new Set(
+  SIDE_EFFECT_OPERATION_PHASES
+);
+var OMISSION_REASON_SET = new Set(
+  SIDE_EFFECT_OMISSION_REASONS
+);
+var TOKEN_REGEX = /^[A-Za-z0-9][A-Za-z0-9_.:-]*$/;
+var LOCALE_REGEX = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8}){0,3}$/;
+var TIMEZONE_REGEX = /^(?:UTC|GMT|[A-Za-z][A-Za-z0-9_+-]*(?:\/[A-Za-z0-9_+-]+){1,3})$/;
+var DIGIT_REGEX = /^[0-9]+$/;
+var URL_SCHEME = /:\/\//;
+var URL_SCHEME_RELATIVE = /^\/\//;
+var EMAIL_LIKE = /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/i;
+var QUERY_LIKE = /\?/;
+var FRAGMENT_LIKE = /#/;
+var HEADER_LIKE = /\b(authorization|set-cookie|cookie)\b\s*[:=]/i;
+var HEADER_TOKEN_LIKE = /\b(authorization|set-cookie|cookie)\b\s+\S+=/i;
+var BEARER_LIKE = /bearer\s+\S+/i;
+var TOKEN_KV_LIKE = /["']?(password|passwd|token|api[_-]?key|secret|client_secret)["']?\s*[:=]/i;
+var PROSE_LIKE = /[\r\n\t]|\s{2,}/;
+var UUID_LIKE = /[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/i;
+var GT_KEY_LIKE = /gt_(dev|anon|live)_[A-Za-z0-9_-]+/;
+function detectUnsafePattern(value) {
+  if (value.trim() !== value) return "raw_payload";
+  if (PROSE_LIKE.test(value)) return "raw_payload";
+  if (URL_SCHEME.test(value)) return "raw_payload";
+  if (URL_SCHEME_RELATIVE.test(value)) return "raw_payload";
+  if (QUERY_LIKE.test(value)) return "raw_payload";
+  if (FRAGMENT_LIKE.test(value)) return "raw_payload";
+  if (BEARER_LIKE.test(value)) return "secret";
+  if (HEADER_TOKEN_LIKE.test(value)) return "secret";
+  if (TOKEN_KV_LIKE.test(value)) return "secret";
+  if (HEADER_LIKE.test(value)) return "secret";
+  if (UUID_LIKE.test(value)) return "secret";
+  if (GT_KEY_LIKE.test(value)) return "secret";
+  if (EMAIL_LIKE.test(value)) return "pii";
+  return null;
+}
+function passesFieldValidator(key, value) {
+  if (key === "locale") return LOCALE_REGEX.test(value);
+  if (key === "timezone") return TIMEZONE_REGEX.test(value);
+  if (typeof key === "string" && key.endsWith("Count")) {
+    return DIGIT_REGEX.test(value);
+  }
+  return TOKEN_REGEX.test(value);
+}
+function checkOperationLabel(value) {
+  if (typeof value !== "string" || value.length === 0) {
+    return { accepted: false, reason: "raw_payload" };
+  }
+  if (value.length > MAX_SIDE_EFFECT_OPERATION_LABEL_LENGTH) {
+    return { accepted: false, reason: "value_too_long" };
+  }
+  const unsafe = detectUnsafePattern(value);
+  if (unsafe) {
+    return { accepted: false, reason: unsafe };
+  }
+  if (!TOKEN_REGEX.test(value)) {
+    return { accepted: false, reason: "raw_payload" };
+  }
+  return { accepted: true, value };
+}
+function checkSemanticFieldValue(key, value) {
+  if (typeof value !== "string" || value.length === 0) {
+    return { accepted: false, reason: "raw_payload" };
+  }
+  const maxLength = typeof key === "string" && key.endsWith("Count") ? MAX_SIDE_EFFECT_FIELD_COUNT_VALUE_LENGTH : MAX_SIDE_EFFECT_FIELD_VALUE_LENGTH;
+  if (value.length > maxLength) {
+    return { accepted: false, reason: "value_too_long" };
+  }
+  const unsafe = detectUnsafePattern(value);
+  if (unsafe) {
+    return { accepted: false, reason: unsafe };
+  }
+  if (!passesFieldValidator(key, value)) {
+    return { accepted: false, reason: "raw_payload" };
+  }
+  return { accepted: true, value };
+}
+function checkSemanticFieldKey(key) {
+  return typeof key === "string" && isSideEffectSemanticFieldKey(key);
+}
+function checkOperationKind(kind) {
+  return typeof kind === "string" && OPERATION_KIND_SET.has(kind);
+}
+function checkOperationStatus(status) {
+  return typeof status === "string" && OPERATION_STATUS_SET.has(status);
+}
+function checkOperationPhase(phase) {
+  return typeof phase === "string" && OPERATION_PHASE_SET.has(phase);
+}
+
+// src/side-effect/emit.ts
+var spanState = /* @__PURE__ */ new WeakMap();
+function getOrCreateState(span) {
+  let state = spanState.get(span);
+  if (!state) {
+    state = { operationsRecorded: 0, omissions: /* @__PURE__ */ new Map() };
+    spanState.set(span, state);
+  }
+  return state;
+}
+function getRecordingActiveSpan() {
+  let span;
+  try {
+    span = trace.getActiveSpan();
+  } catch {
+    return void 0;
+  }
+  if (!span) return void 0;
+  try {
+    if (typeof span.isRecording === "function" && !span.isRecording()) {
+      return void 0;
+    }
+  } catch {
+    return void 0;
+  }
+  return span;
+}
+function recordOmissionOnActiveSpan(reason) {
+  const span = getRecordingActiveSpan();
+  if (!span) return;
+  recordOmissionOnSpan(span, reason);
+}
+function recordOmissionOnSpan(span, reason) {
+  const state = getOrCreateState(span);
+  const previous = state.omissions.get(reason) ?? 0;
+  const next = previous + 1;
+  state.omissions.set(reason, next);
+  const attribute = OMISSION_ATTRIBUTE_BY_REASON[reason];
+  try {
+    span.setAttribute(attribute, next);
+  } catch {
+  }
+}
+var OMISSION_ATTRIBUTE_BY_REASON = {
+  pii: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_OMITTED_PII,
+  secret: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_OMITTED_SECRET,
+  raw_payload: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_OMITTED_RAW_PAYLOAD,
+  unsupported_key: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_OMITTED_UNSUPPORTED_KEY,
+  value_too_long: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_OMITTED_VALUE_TOO_LONG,
+  not_emitted: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_OMITTED_NOT_EMITTED,
+  capture_disabled: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_OMITTED_CAPTURE_DISABLED
+};
+var FIELD_ATTRIBUTE_BY_KEY = {
+  templateKey: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_FIELD_TEMPLATE_KEY,
+  providerOperation: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_FIELD_PROVIDER_OPERATION,
+  role: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_FIELD_ROLE,
+  locale: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_FIELD_LOCALE,
+  timezone: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_FIELD_TIMEZONE,
+  status: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_FIELD_STATUS,
+  phase: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_FIELD_PHASE,
+  recipientClass: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_FIELD_RECIPIENT_CLASS,
+  participantCount: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_FIELD_PARTICIPANT_COUNT,
+  activeParticipantCount: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_FIELD_ACTIVE_PARTICIPANT_COUNT
+};
+function resolveFieldAttribute(key) {
+  const explicit = FIELD_ATTRIBUTE_BY_KEY[key];
+  if (explicit !== void 0) return explicit;
+  return `glasstrace.side_effect.field.${key}`;
+}
+function hasExplicitFieldAttribute(key) {
+  return FIELD_ATTRIBUTE_BY_KEY[key] !== void 0;
+}
+function attachOperation(input) {
+  const span = getRecordingActiveSpan();
+  if (!span) return { kind: "no_active_span" };
+  const state = getOrCreateState(span);
+  if (state.operationsRecorded >= MAX_SIDE_EFFECT_OPERATIONS_PER_SPAN) {
+    return { kind: "over_budget", span };
+  }
+  state.operationsRecorded += 1;
+  try {
+    span.setAttribute(GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_KIND, input.kind);
+    span.setAttribute(
+      GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_OPERATION,
+      input.operation
+    );
+    if (input.status !== void 0) {
+      span.setAttribute(
+        GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_STATUS,
+        input.status
+      );
+    }
+    if (input.phase !== void 0) {
+      span.setAttribute(
+        GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_PHASE,
+        input.phase
+      );
+    }
+  } catch {
+  }
+  return { kind: "attached", span };
+}
+function attachField(span, key, value) {
+  const attribute = resolveFieldAttribute(key);
+  try {
+    span.setAttribute(attribute, value);
+  } catch {
+  }
+}
+function recordOmission(span, reason) {
+  recordOmissionOnSpan(span, reason);
+}
+
+// src/side-effect/index.ts
+var _verbose = false;
+function setSideEffectVerboseFlag(verbose) {
+  _verbose = verbose;
+}
+var _casingWarnSeen = /* @__PURE__ */ new Map();
+var _CASING_DEDUP_MAX_KEYS = 100;
+var _patternKeysSeen = /* @__PURE__ */ new Set();
+var _recentPatternKeys = [];
+var _proliferationWarned = false;
+var _PROLIFERATION_THRESHOLD = 50;
+var _RECENT_KEYS_IN_WARN = 5;
+function shouldCheckCasingConvention(key) {
+  return key.endsWith("Class") || key.endsWith("Role");
+}
+function casingPattern(value) {
+  return value === value.toUpperCase() ? "uppercase" : "mixed";
+}
+function maybeWarnMixedCasing(key, value) {
+  if (!shouldCheckCasingConvention(key)) return;
+  if (value === value.toLowerCase()) return;
+  const pattern = casingPattern(value);
+  let seenPatterns = _casingWarnSeen.get(key);
+  if (!seenPatterns) {
+    if (_casingWarnSeen.size >= _CASING_DEDUP_MAX_KEYS) return;
+    seenPatterns = /* @__PURE__ */ new Set();
+    _casingWarnSeen.set(key, seenPatterns);
+  }
+  if (seenPatterns.has(pattern)) return;
+  seenPatterns.add(pattern);
+  console.warn(
+    `[glasstrace] side-effect field "${key}" value has ${pattern} casing; convention is lowercase-kebab. Producer should normalize.`
+  );
+}
+function maybeWarnPatternKeyProliferation(key) {
+  if (!_verbose) return;
+  if (_proliferationWarned) return;
+  if (hasExplicitFieldAttribute(key)) return;
+  if (_patternKeysSeen.has(key)) return;
+  _patternKeysSeen.add(key);
+  _recentPatternKeys.push(key);
+  if (_recentPatternKeys.length > _RECENT_KEYS_IN_WARN) {
+    _recentPatternKeys.shift();
+  }
+  if (_patternKeysSeen.size >= _PROLIFERATION_THRESHOLD) {
+    _proliferationWarned = true;
+    console.warn(
+      `[glasstrace] side-effect emission has used ${_patternKeysSeen.size} distinct pattern-admitted field keys this process; recent: ${_recentPatternKeys.join(", ")}. Consider producer-side vocabulary review (lowercase-kebab convention; Class/Count/Kind/Role suffixes).`
+    );
+  }
+}
+function recordSideEffect(input) {
+  try {
+    runRecordSideEffect(input);
+  } catch {
+  }
+}
+function runRecordSideEffect(input) {
+  if (!input || typeof input !== "object") return;
+  let captureEnabled;
+  try {
+    captureEnabled = getActiveConfig().sideEffectEvidence === true;
+  } catch {
+    captureEnabled = false;
+  }
+  if (!captureEnabled) {
+    return;
+  }
+  const candidate = input;
+  if (!checkOperationKind(candidate.kind)) {
+    return;
+  }
+  const labelOutcome = checkOperationLabel(candidate.operation);
+  if (!labelOutcome.accepted) {
+    recordOmissionOnActiveSpan(labelOutcome.reason);
+    return;
+  }
+  let acceptedStatus;
+  if (candidate.status !== void 0) {
+    if (checkOperationStatus(candidate.status)) {
+      acceptedStatus = candidate.status;
+    } else {
+      recordOmissionOnActiveSpan("unsupported_key");
+    }
+  }
+  let acceptedPhase;
+  if (candidate.phase !== void 0) {
+    if (checkOperationPhase(candidate.phase)) {
+      acceptedPhase = candidate.phase;
+    } else {
+      recordOmissionOnActiveSpan("unsupported_key");
+    }
+  }
+  const outcome = attachOperation({
+    kind: candidate.kind,
+    operation: labelOutcome.value,
+    status: acceptedStatus,
+    phase: acceptedPhase
+  });
+  if (outcome.kind === "no_active_span") {
+    return;
+  }
+  if (outcome.kind === "over_budget") {
+    recordOmission(outcome.span, "value_too_long");
+    return;
+  }
+  const fields = candidate.fields;
+  if (fields && typeof fields === "object") {
+    for (const [rawKey, rawValue] of Object.entries(fields)) {
+      if (!checkSemanticFieldKey(rawKey)) {
+        recordOmission(outcome.span, "unsupported_key");
+        continue;
+      }
+      const valueOutcome = checkSemanticFieldValue(rawKey, rawValue);
+      if (!valueOutcome.accepted) {
+        recordOmission(outcome.span, valueOutcome.reason);
+        continue;
+      }
+      try {
+        maybeWarnMixedCasing(rawKey, valueOutcome.value);
+        maybeWarnPatternKeyProliferation(rawKey);
+      } catch {
+      }
+      attachField(outcome.span, rawKey, valueOutcome.value);
+    }
+  }
+}
+
 // src/runtime-state.ts
 var fsSync = null;
 var pathSync = null;
@@ -4620,13 +4969,14 @@ function registerGlasstrace(options) {
     setCoreState(CoreState.REGISTERING);
     maybeWarnStaleAgentInstructions({
       projectRoot: process.cwd(),
-      sdkVersion: "1.12.0"
+      sdkVersion: "1.14.0"
     });
     startRuntimeStateWriter({
       projectRoot: process.cwd(),
-      sdkVersion: "1.12.0"
+      sdkVersion: "1.14.0"
     });
     const config = resolveConfig(options);
+    setSideEffectVerboseFlag(config.verbose);
     if (config.verbose) {
       console.info("[glasstrace] Config resolved.");
     }
@@ -4791,8 +5141,8 @@ async function backgroundInit(config, anonKeyForInit, generation) {
   if (config.verbose) {
     console.info("[glasstrace] Background init firing.");
   }
-  const healthReport = collectHealthReport("1.12.0");
-  const initResult = await performInit(config, anonKeyForInit, "1.12.0", healthReport);
+  const healthReport = collectHealthReport("1.14.0");
+  const initResult = await performInit(config, anonKeyForInit, "1.14.0", healthReport);
   if (generation !== registrationGeneration) return;
   const currentState = getCoreState();
   if (currentState === CoreState.SHUTTING_DOWN || currentState === CoreState.SHUTDOWN) {
@@ -4815,7 +5165,7 @@ async function backgroundInit(config, anonKeyForInit, generation) {
   }
   maybeInstallConsoleCapture();
   if (didLastInitSucceed()) {
-    startHeartbeat(config, anonKeyForInit, "1.12.0", generation, (newApiKey, accountId) => {
+    startHeartbeat(config, anonKeyForInit, "1.14.0", generation, (newApiKey, accountId) => {
       setAuthState(AuthState.CLAIMING);
       emitLifecycleEvent("auth:claim_started", { accountId });
       setResolvedApiKey(newApiKey);
@@ -5112,7 +5462,7 @@ async function handleSourceMapUpload(distDir) {
       );
       return;
     }
-    const { discoverSourceMapFiles, computeBuildHash, uploadSourceMaps } = await import("./source-map-uploader-K67LTPBG.js");
+    const { discoverSourceMapFiles, computeBuildHash, uploadSourceMaps } = await import("./source-map-uploader-NUONOEJG.js");
     const files = await discoverSourceMapFiles(distDir);
     if (files.length === 0) {
       console.info("[glasstrace] No source map files found. Skipping upload.");
@@ -5207,9 +5557,10 @@ export {
   classifyFetchTarget,
   GlasstraceExporter,
   createGlasstraceSpanProcessor,
+  recordSideEffect,
   registerGlasstrace,
   getDiscoveryHandler,
   withGlasstraceConfig,
   captureError
 };
-//# sourceMappingURL=chunk-CZQN6G4I.js.map
+//# sourceMappingURL=chunk-E2F4S5IJ.js.map