@glasstrace/sdk 1.15.0 → 1.16.0

package/dist/index.cjs

@@ -15338,7 +15338,11 @@ function isSideEffectSemanticFieldKey(key) {
     key
   ) || SIDE_EFFECT_SEMANTIC_FIELD_OPEN_PATTERN.test(key);
 }
-var DevApiKeySchema, AnonApiKeySchema, SessionIdSchema, BuildHashSchema, SdkDiagnosticCodeSchema, CaptureConfigSchema, SdkCachedConfigSchema, GlasstraceOptionsSchema, GlasstraceEnvVarsSchema, GLASSTRACE_ATTRIBUTE_NAMES, DEFAULT_CAPTURE_CONFIG, MAX_SOURCE_MAP_FILE_PATH_LENGTH, MAX_SOURCE_MAP_FILE_SIZE, MAX_SOURCE_MAP_FILE_COUNT, MAX_PRESIGNED_CLIENT_TOKEN_LENGTH, MAX_PRESIGNED_PATHNAME_LENGTH, ImportGraphPayloadSchema, SdkHealthReportSchema, TierLimitsSchema, SdkInitResponseSchema, DiscoveryResponseSchema, SourceMapUploadResponseSchema, PresignedUploadRequestSchema, PresignedUploadResponseSchema, SourceMapManifestRequestSchema, SourceMapManifestResponseSchema, K, SIDE_EFFECT_OPERATION_KINDS, SIDE_EFFECT_SEMANTIC_FIELD_STABLE_CORE_KEYS, SIDE_EFFECT_SEMANTIC_FIELD_OPEN_PATTERN, MAX_SIDE_EFFECT_SEMANTIC_FIELD_KEY_LENGTH, SIDE_EFFECT_OMISSION_REASONS, SIDE_EFFECT_OPERATION_STATUSES, SIDE_EFFECT_OPERATION_PHASES;
+function isSideEffectScalarKey(key) {
+  if (key.length > MAX_SIDE_EFFECT_SEMANTIC_FIELD_KEY_LENGTH) return false;
+  return SIDE_EFFECT_SCALAR_KEY_PATTERN.test(key);
+}
+var DevApiKeySchema, AnonApiKeySchema, SessionIdSchema, BuildHashSchema, SdkDiagnosticCodeSchema, CaptureConfigSchema, SdkCachedConfigSchema, GlasstraceOptionsSchema, GlasstraceEnvVarsSchema, GLASSTRACE_ATTRIBUTE_NAMES, DEFAULT_CAPTURE_CONFIG, MAX_SOURCE_MAP_FILE_PATH_LENGTH, MAX_SOURCE_MAP_FILE_SIZE, MAX_SOURCE_MAP_FILE_COUNT, MAX_PRESIGNED_CLIENT_TOKEN_LENGTH, MAX_PRESIGNED_PATHNAME_LENGTH, ImportGraphPayloadSchema, SdkHealthReportSchema, TierLimitsSchema, SdkInitResponseSchema, DiscoveryResponseSchema, SourceMapUploadResponseSchema, PresignedUploadRequestSchema, PresignedUploadResponseSchema, SourceMapManifestRequestSchema, SourceMapManifestResponseSchema, K, SIDE_EFFECT_OPERATION_KINDS, SIDE_EFFECT_SEMANTIC_FIELD_STABLE_CORE_KEYS, SIDE_EFFECT_SEMANTIC_FIELD_OPEN_PATTERN, MAX_SIDE_EFFECT_SEMANTIC_FIELD_KEY_LENGTH, SIDE_EFFECT_OMISSION_REASONS, SIDE_EFFECT_SCALAR_KEY_PATTERN, SIDE_EFFECT_SCALAR_PREFIX, MAX_SIDE_EFFECT_SCALARS_PER_OPERATION, SIDE_EFFECT_HASHED_ID_PREFIX, SIDE_EFFECT_HASHED_ID_HEX_LENGTH, SIDE_EFFECT_OPERATION_STATUSES, SIDE_EFFECT_OPERATION_PHASES;
 var init_dist = __esm({
   "../protocol/dist/index.js"() {
     "use strict";
@@ -15377,7 +15381,20 @@ var init_dist = __esm({
        * client-side allowlist enforcement layered with the product's
        * storage-time filter as defense-in-depth.
        */
-      sideEffectEvidence: external_exports.boolean().optional().default(false)
+      sideEffectEvidence: external_exports.boolean().optional().default(false),
+      /**
+       * Per-account value-fidelity capture posture (server-pushed).
+       *
+       * `strict` (default) is fail-closed: the SDK rejects raw wall-clock
+       * timestamps and unhashed identifiers from the `scalar.*` channel at
+       * emit time. `full` relaxes those rejections so raw magnitudes can be
+       * surfaced — but only in conjunction with an explicit producer opt-in
+       * (so a `full`-configured account still emits strict-shaped scalars
+       * unless the producer also opts in). The operator owns this flag; it
+       * is never derived from producer or request input. Absent on the wire
+       * ⇒ `strict`.
+       */
+      captureFidelity: external_exports.enum(["strict", "full"]).optional().default("strict")
     });
     SdkCachedConfigSchema = external_exports.object({
       response: external_exports.record(external_exports.string(), external_exports.unknown()),
@@ -15568,7 +15585,13 @@ var init_dist = __esm({
       SIDE_EFFECT_OMITTED_UNSUPPORTED_KEY: "glasstrace.side_effect.omitted.unsupported_key",
       SIDE_EFFECT_OMITTED_VALUE_TOO_LONG: "glasstrace.side_effect.omitted.value_too_long",
       SIDE_EFFECT_OMITTED_NOT_EMITTED: "glasstrace.side_effect.omitted.not_emitted",
-      SIDE_EFFECT_OMITTED_CAPTURE_DISABLED: "glasstrace.side_effect.omitted.capture_disabled"
+      SIDE_EFFECT_OMITTED_CAPTURE_DISABLED: "glasstrace.side_effect.omitted.capture_disabled",
+      // Value-fidelity scalar-channel omission reasons. Counts only; the
+      // rejected raw value (timestamp, unhashed id, non-finite number) is
+      // never echoed. Mirror the product omission enum verbatim.
+      SIDE_EFFECT_OMITTED_RAW_TIMESTAMP: "glasstrace.side_effect.omitted.raw_timestamp",
+      SIDE_EFFECT_OMITTED_UNHASHED_ID: "glasstrace.side_effect.omitted.unhashed_id",
+      SIDE_EFFECT_OMITTED_NON_FINITE: "glasstrace.side_effect.omitted.non_finite"
     };
     DEFAULT_CAPTURE_CONFIG = {
       requestBodies: false,
@@ -15578,7 +15601,8 @@ var init_dist = __esm({
       importGraph: false,
       consoleErrors: false,
       errorResponseBodies: false,
-      sideEffectEvidence: false
+      sideEffectEvidence: false,
+      captureFidelity: "strict"
     };
     MAX_SOURCE_MAP_FILE_PATH_LENGTH = 512;
     MAX_SOURCE_MAP_FILE_SIZE = 50 * 1024 * 1024;
@@ -15793,8 +15817,28 @@ var init_dist = __esm({
       "unsupported_key",
       "value_too_long",
       "not_emitted",
-      "capture_disabled"
+      "capture_disabled",
+      // Value-fidelity scalar channel reasons. A scalar is dropped under
+      // `raw_timestamp` when a wall-clock value (a `Date` instance, or a
+      // numeric epoch on a `*Ms` key) is rejected in favor of a bounded
+      // delta; `unhashed_id` when an `*Id` scalar is not the `gthid_<hex>`
+      // output of `hashId`; `non_finite` when a number is NaN/±Infinity.
+      // (A type-mismatched value — e.g. a date *string* on a numeric key —
+      // is dropped under `raw_payload`, not `raw_timestamp`, since the
+      // scalar channel only carries native numbers/booleans plus `gthid_`
+      // ids.) These mirror the product `SideEffectOmissionReasonSchema`
+      // tuple verbatim (hand-maintained on both sides; see @drift-check
+      // above). `non_finite` is SDK-emit-time only — JSON cannot carry
+      // NaN/Infinity to the wire.
+      "raw_timestamp",
+      "unhashed_id",
+      "non_finite"
     ];
+    SIDE_EFFECT_SCALAR_KEY_PATTERN = /^[a-z][A-Za-z0-9]*(Ms|Amount|Bytes|Ratio|Id|Value|Flag)$/;
+    SIDE_EFFECT_SCALAR_PREFIX = "glasstrace.side_effect.scalar.";
+    MAX_SIDE_EFFECT_SCALARS_PER_OPERATION = 16;
+    SIDE_EFFECT_HASHED_ID_PREFIX = "gthid_";
+    SIDE_EFFECT_HASHED_ID_HEX_LENGTH = 32;
     SIDE_EFFECT_OPERATION_STATUSES = [
       "scheduled",
       "started",
@@ -23685,6 +23729,13 @@ async function tryImport(moduleId) {
     return null;
   }
 }
+function warnPrismaInstrumentationUnavailable(verbose, detail) {
+  if (!verbose) return;
+  sdkLog(
+    "warn",
+    `[glasstrace] @prisma/instrumentation ${detail}; Prisma query spans will not be captured. If you use Prisma and expect database spans, add @prisma/instrumentation as a direct dependency (some package managers, e.g. pnpm, do not expose transitive copies).`
+  );
+}
 async function configureOtel(config2, sessionManager) {
   setOtelState(OtelState.CONFIGURING);
   await new Promise((resolve3) => {
@@ -23792,7 +23843,14 @@ async function runRegistrationPath(config2, sessionManager) {
       const PrismaInstrumentation = prismaModule2.PrismaInstrumentation;
       if (PrismaInstrumentation) {
         otelConfig.instrumentations = [new PrismaInstrumentation()];
+      } else {
+        warnPrismaInstrumentationUnavailable(
+          config2.verbose,
+          "was loaded but did not export PrismaInstrumentation"
+        );
       }
+    } else {
+      warnPrismaInstrumentationUnavailable(config2.verbose, "could not be loaded");
     }
     vercelOtel.registerOTel(otelConfig);
     const vercelProxy = trace.getTracerProvider();
@@ -23847,9 +23905,22 @@ async function runRegistrationPath(config2, sessionManager) {
         const inst = new PrismaInstrumentation();
         inst.setTracerProvider(provider);
         inst.enable();
-      } catch {
+      } catch (err) {
+        if (config2.verbose) {
+          sdkLog(
+            "warn",
+            `[glasstrace] @prisma/instrumentation failed to initialize: ${err instanceof Error ? err.message : String(err)}. Prisma query spans will not be captured.`
+          );
+        }
       }
+    } else {
+      warnPrismaInstrumentationUnavailable(
+        config2.verbose,
+        "was loaded but did not export PrismaInstrumentation"
+      );
     }
+  } else {
+    warnPrismaInstrumentationUnavailable(config2.verbose, "could not be loaded");
   }
   setOtelState(OtelState.OWNS_PROVIDER);
   emitLifecycleEvent("otel:configured", { state: OtelState.OWNS_PROVIDER, scenario: "A" });
@@ -24063,6 +24134,9 @@ function registerHeartbeatShutdownHook(config2, anonKey, sdkVersion) {
   });
 }
 
+// src/side-effect/index.ts
+init_dist();
+
 // src/side-effect/allowlist.ts
 init_dist();
 var MAX_SIDE_EFFECT_OPERATION_LABEL_LENGTH = 96;
@@ -24154,6 +24228,59 @@ function checkSemanticFieldValue(key, value) {
   }
   return { accepted: true, value };
 }
+var GTHID_STRICT_REGEX = new RegExp(
+  `^${SIDE_EFFECT_HASHED_ID_PREFIX}[0-9a-f]{${SIDE_EFFECT_HASHED_ID_HEX_LENGTH}}$`
+);
+var SCALAR_EPOCH_MS_MIN = 1e12;
+function isTimestampShapedScalarKey(key) {
+  return key.endsWith("Ms");
+}
+function checkScalarField(key, value, mode = "strict") {
+  if (typeof key !== "string" || !isSideEffectScalarKey(key)) {
+    return { accepted: false, reason: "unsupported_key" };
+  }
+  if (value instanceof Date) {
+    return { accepted: false, reason: "raw_timestamp" };
+  }
+  if (key.endsWith("Id")) {
+    if (typeof value !== "string") {
+      return { accepted: false, reason: "unhashed_id" };
+    }
+    if (mode === "strict") {
+      if (!GTHID_STRICT_REGEX.test(value)) {
+        return { accepted: false, reason: "unhashed_id" };
+      }
+      return { accepted: true, value };
+    }
+    if (value.length === 0) {
+      return { accepted: false, reason: "raw_payload" };
+    }
+    const unsafe = detectUnsafePattern(value);
+    if (unsafe) {
+      return { accepted: false, reason: unsafe };
+    }
+    if (value.length > MAX_SIDE_EFFECT_FIELD_VALUE_LENGTH) {
+      return { accepted: false, reason: "value_too_long" };
+    }
+    return { accepted: true, value };
+  }
+  if (key.endsWith("Flag")) {
+    if (typeof value !== "boolean") {
+      return { accepted: false, reason: "raw_payload" };
+    }
+    return { accepted: true, value };
+  }
+  if (typeof value !== "number") {
+    return { accepted: false, reason: "raw_payload" };
+  }
+  if (!Number.isFinite(value)) {
+    return { accepted: false, reason: "non_finite" };
+  }
+  if (mode === "strict" && isTimestampShapedScalarKey(key) && value >= SCALAR_EPOCH_MS_MIN) {
+    return { accepted: false, reason: "raw_timestamp" };
+  }
+  return { accepted: true, value };
+}
 function checkSemanticFieldKey(key) {
   return typeof key === "string" && isSideEffectSemanticFieldKey(key);
 }
@@ -24219,7 +24346,10 @@ var OMISSION_ATTRIBUTE_BY_REASON = {
   unsupported_key: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_OMITTED_UNSUPPORTED_KEY,
   value_too_long: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_OMITTED_VALUE_TOO_LONG,
   not_emitted: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_OMITTED_NOT_EMITTED,
-  capture_disabled: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_OMITTED_CAPTURE_DISABLED
+  capture_disabled: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_OMITTED_CAPTURE_DISABLED,
+  raw_timestamp: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_OMITTED_RAW_TIMESTAMP,
+  unhashed_id: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_OMITTED_UNHASHED_ID,
+  non_finite: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_OMITTED_NON_FINITE
 };
 var FIELD_ATTRIBUTE_BY_KEY = {
   templateKey: GLASSTRACE_ATTRIBUTE_NAMES.SIDE_EFFECT_FIELD_TEMPLATE_KEY,
@@ -24278,6 +24408,12 @@ function attachField(span, key, value) {
   } catch {
   }
 }
+function attachScalar(span, key, value) {
+  try {
+    span.setAttribute(`${SIDE_EFFECT_SCALAR_PREFIX}${key}`, value);
+  } catch {
+  }
+}
 function recordOmission(span, reason) {
   recordOmissionOnSpan(span, reason);
 }
@@ -24408,6 +24544,23 @@ function runRecordSideEffect(input) {
       attachField(outcome.span, rawKey, valueOutcome.value);
     }
   }
+  const scalars = candidate.scalars;
+  if (scalars && typeof scalars === "object") {
+    let scalarCount = 0;
+    for (const [rawKey, rawValue] of Object.entries(scalars)) {
+      if (scalarCount >= MAX_SIDE_EFFECT_SCALARS_PER_OPERATION) {
+        recordOmission(outcome.span, "value_too_long");
+        break;
+      }
+      scalarCount += 1;
+      const scalarOutcome = checkScalarField(rawKey, rawValue);
+      if (!scalarOutcome.accepted) {
+        recordOmission(outcome.span, scalarOutcome.reason);
+        continue;
+      }
+      attachScalar(outcome.span, rawKey, scalarOutcome.value);
+    }
+  }
 }
 
 // src/runtime-state.ts
@@ -24710,11 +24863,11 @@ function registerGlasstrace(options) {
     setCoreState(CoreState.REGISTERING);
     maybeWarnStaleAgentInstructions({
       projectRoot: process.cwd(),
-      sdkVersion: "1.15.0"
+      sdkVersion: "1.16.0"
     });
     startRuntimeStateWriter({
       projectRoot: process.cwd(),
-      sdkVersion: "1.15.0"
+      sdkVersion: "1.16.0"
     });
     const config2 = resolveConfig(options);
     setSideEffectVerboseFlag(config2.verbose);
@@ -24882,8 +25035,8 @@ async function backgroundInit(config2, anonKeyForInit, generation) {
   if (config2.verbose) {
     console.info("[glasstrace] Background init firing.");
   }
-  const healthReport = collectHealthReport("1.15.0");
-  const initResult = await performInit(config2, anonKeyForInit, "1.15.0", healthReport);
+  const healthReport = collectHealthReport("1.16.0");
+  const initResult = await performInit(config2, anonKeyForInit, "1.16.0", healthReport);
   if (generation !== registrationGeneration) return;
   const currentState = getCoreState();
   if (currentState === CoreState.SHUTTING_DOWN || currentState === CoreState.SHUTDOWN) {
@@ -24906,7 +25059,7 @@ async function backgroundInit(config2, anonKeyForInit, generation) {
   }
   maybeInstallConsoleCapture();
   if (didLastInitSucceed()) {
-    startHeartbeat(config2, anonKeyForInit, "1.15.0", generation, (newApiKey, accountId) => {
+    startHeartbeat(config2, anonKeyForInit, "1.16.0", generation, (newApiKey, accountId) => {
       setAuthState(AuthState.CLAIMING);
       emitLifecycleEvent("auth:claim_started", { accountId });
       setResolvedApiKey(newApiKey);