@glasstrace/sdk 1.3.2 → 1.3.3

package/dist/index.js

@@ -12,14 +12,14 @@ import {
   registerGlasstrace,
   waitForReady,
   withGlasstraceConfig
-} from "./chunk-DQGNUENK.js";
+} from "./chunk-XNKG4WNQ.js";
 import {
   GlasstraceSpanProcessor,
   SdkError,
   captureCorrelationId
-} from "./chunk-CRM3EYOL.js";
+} from "./chunk-WKOQJCFN.js";
 import "./chunk-DQ25VOKK.js";
-import "./chunk-3TU62WD6.js";
+import "./chunk-YG3X7TUI.js";
 import {
   getActiveConfig,
   getLinkedAccountId,
@@ -27,7 +27,7 @@ import {
   performInit,
   saveCachedConfig,
   sendInitRequest
-} from "./chunk-REEU6CNO.js";
+} from "./chunk-3HWBR7XM.js";
 import {
   isAnonymousMode,
   isProductionDisabled,
@@ -37,10 +37,10 @@ import {
 import {
   getOrCreateAnonKey,
   readAnonKey
-} from "./chunk-UFZEISZB.js";
+} from "./chunk-LQKJ27LO.js";
 import {
   deriveSessionId
-} from "./chunk-MQHLWSIX.js";
+} from "./chunk-M4ZI7J3N.js";
 import "./chunk-NSBPE2FW.js";
 export {
   GlasstraceExporter,

package/dist/node-entry.cjs

@@ -14566,7 +14566,7 @@ function deriveSessionId(apiKey, origin, date5, windowIndex) {
   const digest = sha256Hex(input).slice(0, 16);
   return SessionIdSchema.parse(digest);
 }
-var DevApiKeySchema, AnonApiKeySchema, SessionIdSchema, BuildHashSchema, SdkDiagnosticCodeSchema, CaptureConfigSchema, SdkCachedConfigSchema, GlasstraceOptionsSchema, GlasstraceEnvVarsSchema, ImportGraphPayloadSchema, SdkHealthReportSchema, TierLimitsSchema, SdkInitResponseSchema, DiscoveryResponseSchema, SourceMapUploadResponseSchema, PresignedUploadRequestSchema, PresignedUploadResponseSchema, SourceMapManifestRequestSchema, SourceMapManifestResponseSchema, GLASSTRACE_ATTRIBUTE_NAMES, DEFAULT_CAPTURE_CONFIG, K;
+var DevApiKeySchema, AnonApiKeySchema, SessionIdSchema, BuildHashSchema, SdkDiagnosticCodeSchema, CaptureConfigSchema, SdkCachedConfigSchema, GlasstraceOptionsSchema, GlasstraceEnvVarsSchema, GLASSTRACE_ATTRIBUTE_NAMES, DEFAULT_CAPTURE_CONFIG, MAX_SOURCE_MAP_FILE_PATH_LENGTH, MAX_SOURCE_MAP_FILE_SIZE, MAX_SOURCE_MAP_FILE_COUNT, MAX_PRESIGNED_CLIENT_TOKEN_LENGTH, MAX_PRESIGNED_PATHNAME_LENGTH, ImportGraphPayloadSchema, SdkHealthReportSchema, TierLimitsSchema, SdkInitResponseSchema, DiscoveryResponseSchema, SourceMapUploadResponseSchema, PresignedUploadRequestSchema, PresignedUploadResponseSchema, SourceMapManifestRequestSchema, SourceMapManifestResponseSchema, K;
 var init_dist = __esm({
   "../protocol/dist/index.js"() {
     "use strict";
@@ -14617,6 +14617,59 @@ var init_dist = __esm({
       NODE_ENV: external_exports.string().optional(),
       VERCEL_ENV: external_exports.string().optional()
     });
+    GLASSTRACE_ATTRIBUTE_NAMES = {
+      // Server-side attributes
+      TRACE_TYPE: "glasstrace.trace.type",
+      SESSION_ID: "glasstrace.session.id",
+      CORRELATION_ID: "glasstrace.correlation.id",
+      ENVIRONMENT: "glasstrace.environment",
+      ROUTE: "glasstrace.route",
+      HTTP_METHOD: "glasstrace.http.method",
+      HTTP_STATUS_CODE: "glasstrace.http.status_code",
+      HTTP_DURATION_MS: "glasstrace.http.duration_ms",
+      ERROR_MESSAGE: "glasstrace.error.message",
+      ERROR_CODE: "glasstrace.error.code",
+      ERROR_CATEGORY: "glasstrace.error.category",
+      ERROR_FIELD: "glasstrace.error.field",
+      ORM_PROVIDER: "glasstrace.orm.provider",
+      ORM_MODEL: "glasstrace.orm.model",
+      ORM_OPERATION: "glasstrace.orm.operation",
+      ORM_DURATION_MS: "glasstrace.orm.duration_ms",
+      FETCH_URL: "glasstrace.fetch.url",
+      FETCH_METHOD: "glasstrace.fetch.method",
+      FETCH_STATUS_CODE: "glasstrace.fetch.status_code",
+      FETCH_DURATION_MS: "glasstrace.fetch.duration_ms",
+      FETCH_TARGET: "glasstrace.fetch.target",
+      ENV_REFERENCED: "glasstrace.env.referenced",
+      BUILD_HASH: "glasstrace.build.hash",
+      SOURCE_FILE: "glasstrace.source.file",
+      SOURCE_LINE: "glasstrace.source.line",
+      SOURCE_MAPPED: "glasstrace.source.mapped",
+      TRPC_PROCEDURE: "glasstrace.trpc.procedure",
+      ERROR_RESPONSE_BODY: "glasstrace.error.response_body",
+      NEXT_ACTION_DETECTED: "glasstrace.next.action.detected",
+      // Client-side attributes
+      PLATFORM: "glasstrace.platform",
+      GESTURE_TYPE: "glasstrace.gesture.type",
+      TRIGGER_TYPE: "glasstrace.trigger.type",
+      ELEMENT_FINGERPRINT: "glasstrace.element.fingerprint",
+      ELEMENT_CONFIDENCE: "glasstrace.element.confidence",
+      TAB_ID: "glasstrace.tab.id"
+    };
+    DEFAULT_CAPTURE_CONFIG = {
+      requestBodies: false,
+      queryParamValues: false,
+      envVarValues: false,
+      fullConsoleOutput: false,
+      importGraph: false,
+      consoleErrors: false,
+      errorResponseBodies: false
+    };
+    MAX_SOURCE_MAP_FILE_PATH_LENGTH = 512;
+    MAX_SOURCE_MAP_FILE_SIZE = 50 * 1024 * 1024;
+    MAX_SOURCE_MAP_FILE_COUNT = 100;
+    MAX_PRESIGNED_CLIENT_TOKEN_LENGTH = 2048;
+    MAX_PRESIGNED_PATHNAME_LENGTH = 1024;
     ImportGraphPayloadSchema = external_exports.object({
       buildHash: BuildHashSchema,
       graph: external_exports.record(external_exports.string(), external_exports.array(external_exports.string()))
@@ -14663,35 +14716,68 @@ var init_dist = __esm({
       buildHash: BuildHashSchema,
       files: external_exports.array(
         external_exports.object({
-          filePath: external_exports.string().min(1),
-          sizeBytes: external_exports.number().int().positive()
+          filePath: external_exports.string().min(1).max(
+            MAX_SOURCE_MAP_FILE_PATH_LENGTH,
+            `filePath length exceeds maximum of ${MAX_SOURCE_MAP_FILE_PATH_LENGTH} characters`
+          ),
+          sizeBytes: external_exports.number().int().positive().max(
+            MAX_SOURCE_MAP_FILE_SIZE,
+            `sizeBytes exceeds maximum of ${MAX_SOURCE_MAP_FILE_SIZE} bytes (${MAX_SOURCE_MAP_FILE_SIZE / (1024 * 1024)} MiB)`
+          )
         })
-      ).min(1).max(100)
+      ).min(1).max(
+        MAX_SOURCE_MAP_FILE_COUNT,
+        `files array exceeds maximum of ${MAX_SOURCE_MAP_FILE_COUNT} entries`
+      )
     });
     PresignedUploadResponseSchema = external_exports.object({
       uploadId: external_exports.string().uuid(),
       expiresAt: external_exports.number().int().nonnegative(),
       files: external_exports.array(
         external_exports.object({
-          filePath: external_exports.string().min(1),
-          clientToken: external_exports.string().min(1),
-          pathname: external_exports.string().min(1),
-          maxBytes: external_exports.number().int().positive(),
+          filePath: external_exports.string().min(1).max(
+            MAX_SOURCE_MAP_FILE_PATH_LENGTH,
+            `filePath length exceeds maximum of ${MAX_SOURCE_MAP_FILE_PATH_LENGTH} characters`
+          ),
+          clientToken: external_exports.string().min(1).max(
+            MAX_PRESIGNED_CLIENT_TOKEN_LENGTH,
+            `clientToken length exceeds maximum of ${MAX_PRESIGNED_CLIENT_TOKEN_LENGTH} characters`
+          ),
+          pathname: external_exports.string().min(1).max(
+            MAX_PRESIGNED_PATHNAME_LENGTH,
+            `pathname length exceeds maximum of ${MAX_PRESIGNED_PATHNAME_LENGTH} characters`
+          ),
+          maxBytes: external_exports.number().int().positive().max(
+            MAX_SOURCE_MAP_FILE_SIZE,
+            `maxBytes exceeds maximum of ${MAX_SOURCE_MAP_FILE_SIZE} bytes (${MAX_SOURCE_MAP_FILE_SIZE / (1024 * 1024)} MiB)`
+          ),
           /** Vercel Blob access mode — explicit in the contract per DISC-756. */
           access: external_exports.enum(["public"])
         })
-      ).min(1).max(100)
+      ).min(1).max(
+        MAX_SOURCE_MAP_FILE_COUNT,
+        `files array exceeds maximum of ${MAX_SOURCE_MAP_FILE_COUNT} entries`
+      )
     });
     SourceMapManifestRequestSchema = external_exports.object({
       uploadId: external_exports.string().uuid(),
       buildHash: BuildHashSchema,
       files: external_exports.array(
         external_exports.object({
-          filePath: external_exports.string().min(1),
-          sizeBytes: external_exports.number().int().positive(),
+          filePath: external_exports.string().min(1).max(
+            MAX_SOURCE_MAP_FILE_PATH_LENGTH,
+            `filePath length exceeds maximum of ${MAX_SOURCE_MAP_FILE_PATH_LENGTH} characters`
+          ),
+          sizeBytes: external_exports.number().int().positive().max(
+            MAX_SOURCE_MAP_FILE_SIZE,
+            `sizeBytes exceeds maximum of ${MAX_SOURCE_MAP_FILE_SIZE} bytes (${MAX_SOURCE_MAP_FILE_SIZE / (1024 * 1024)} MiB)`
+          ),
           blobUrl: external_exports.string().url()
         })
-      ).min(1).max(100)
+      ).min(1).max(
+        MAX_SOURCE_MAP_FILE_COUNT,
+        `files array exceeds maximum of ${MAX_SOURCE_MAP_FILE_COUNT} entries`
+      )
     });
     SourceMapManifestResponseSchema = external_exports.object({
       success: external_exports.literal(true),
@@ -14700,54 +14786,6 @@ var init_dist = __esm({
       totalSizeBytes: external_exports.number().int().nonnegative(),
       activatedAt: external_exports.number().int().positive()
     });
-    GLASSTRACE_ATTRIBUTE_NAMES = {
-      // Server-side attributes
-      TRACE_TYPE: "glasstrace.trace.type",
-      SESSION_ID: "glasstrace.session.id",
-      CORRELATION_ID: "glasstrace.correlation.id",
-      ENVIRONMENT: "glasstrace.environment",
-      ROUTE: "glasstrace.route",
-      HTTP_METHOD: "glasstrace.http.method",
-      HTTP_STATUS_CODE: "glasstrace.http.status_code",
-      HTTP_DURATION_MS: "glasstrace.http.duration_ms",
-      ERROR_MESSAGE: "glasstrace.error.message",
-      ERROR_CODE: "glasstrace.error.code",
-      ERROR_CATEGORY: "glasstrace.error.category",
-      ERROR_FIELD: "glasstrace.error.field",
-      ORM_PROVIDER: "glasstrace.orm.provider",
-      ORM_MODEL: "glasstrace.orm.model",
-      ORM_OPERATION: "glasstrace.orm.operation",
-      ORM_DURATION_MS: "glasstrace.orm.duration_ms",
-      FETCH_URL: "glasstrace.fetch.url",
-      FETCH_METHOD: "glasstrace.fetch.method",
-      FETCH_STATUS_CODE: "glasstrace.fetch.status_code",
-      FETCH_DURATION_MS: "glasstrace.fetch.duration_ms",
-      FETCH_TARGET: "glasstrace.fetch.target",
-      ENV_REFERENCED: "glasstrace.env.referenced",
-      BUILD_HASH: "glasstrace.build.hash",
-      SOURCE_FILE: "glasstrace.source.file",
-      SOURCE_LINE: "glasstrace.source.line",
-      SOURCE_MAPPED: "glasstrace.source.mapped",
-      TRPC_PROCEDURE: "glasstrace.trpc.procedure",
-      ERROR_RESPONSE_BODY: "glasstrace.error.response_body",
-      NEXT_ACTION_DETECTED: "glasstrace.next.action.detected",
-      // Client-side attributes
-      PLATFORM: "glasstrace.platform",
-      GESTURE_TYPE: "glasstrace.gesture.type",
-      TRIGGER_TYPE: "glasstrace.trigger.type",
-      ELEMENT_FINGERPRINT: "glasstrace.element.fingerprint",
-      ELEMENT_CONFIDENCE: "glasstrace.element.confidence",
-      TAB_ID: "glasstrace.tab.id"
-    };
-    DEFAULT_CAPTURE_CONFIG = {
-      requestBodies: false,
-      queryParamValues: false,
-      envVarValues: false,
-      fullConsoleOutput: false,
-      importGraph: false,
-      consoleErrors: false,
-      errorResponseBodies: false
-    };
     K = new Uint32Array([
       1116352408,
       1899447441,
@@ -18432,15 +18470,32 @@ function prepareErrorResponseBody(body) {
 }
 
 // src/build-info.ts
+init_console_capture();
 var UNSET = "";
+var SHA_SHAPE = /^[0-9a-f]{7,64}$/i;
+function redactBuildHash(value) {
+  const sanitize2 = (s) => s.replace(/[\x00-\x1F\x7F]/g, "?");
+  if (value.length <= 12) return sanitize2(value.slice(0, 4)) + "...";
+  return sanitize2(value.slice(0, 8)) + "..." + sanitize2(value.slice(-4));
+}
 function readBuildHashFromEnv() {
   const raw = process.env.GLASSTRACE_BUILD_HASH;
   if (typeof raw !== "string") return UNSET;
   const trimmed = raw.trim();
-  return trimmed.length > 0 ? trimmed : UNSET;
+  if (trimmed.length === 0) return UNSET;
+  if (!SHA_SHAPE.test(trimmed)) {
+    sdkLog(
+      "warn",
+      `[glasstrace] warning: GLASSTRACE_BUILD_HASH=${redactBuildHash(trimmed)} does not match expected SHA shape (7-64 hex characters); source-map enrichment may not work as expected.`
+    );
+  }
+  return trimmed;
 }
-var cachedBuildHash = readBuildHashFromEnv();
+var cachedBuildHash = null;
 function getBuildHash() {
+  if (cachedBuildHash === null) {
+    cachedBuildHash = readBuildHashFromEnv();
+  }
   return cachedBuildHash === UNSET ? void 0 : cachedBuildHash;
 }
 
@@ -22599,7 +22654,7 @@ function registerGlasstrace(options) {
     setCoreState(CoreState.REGISTERING);
     startRuntimeStateWriter({
       projectRoot: process.cwd(),
-      sdkVersion: "1.3.2"
+      sdkVersion: "1.3.3"
     });
     const config2 = resolveConfig(options);
     if (config2.verbose) {
@@ -22765,8 +22820,8 @@ async function backgroundInit(config2, anonKeyForInit, generation) {
   if (config2.verbose) {
     console.info("[glasstrace] Background init firing.");
   }
-  const healthReport = collectHealthReport("1.3.2");
-  const initResult = await performInit(config2, anonKeyForInit, "1.3.2", healthReport);
+  const healthReport = collectHealthReport("1.3.3");
+  const initResult = await performInit(config2, anonKeyForInit, "1.3.3", healthReport);
   if (generation !== registrationGeneration) return;
   const currentState = getCoreState();
   if (currentState === CoreState.SHUTTING_DOWN || currentState === CoreState.SHUTDOWN) {
@@ -22789,7 +22844,7 @@ async function backgroundInit(config2, anonKeyForInit, generation) {
   }
   maybeInstallConsoleCapture();
   if (didLastInitSucceed()) {
-    startHeartbeat(config2, anonKeyForInit, "1.3.2", generation, (newApiKey, accountId) => {
+    startHeartbeat(config2, anonKeyForInit, "1.3.3", generation, (newApiKey, accountId) => {
       setAuthState(AuthState.CLAIMING);
       emitLifecycleEvent("auth:claim_started", { accountId });
       setResolvedApiKey(newApiKey);
@@ -22951,8 +23006,8 @@ init_dist();
 init_error_nudge();
 
 // src/stack-frame.ts
-var PAREN_FRAME = /^\s*at\s+(?:[^()]+\s+)?\(([^()\s]+):(\d+):(\d+)\)\s*$/;
-var BARE_FRAME = /^\s*at\s+(?:async\s+)?([^()\s]+):(\d+):(\d+)\s*$/;
+var PAREN_FRAME = /^\s*at\s+(?!eval\s+\(eval\s+at\b)(?:[^()]+\s+)?\(([^()\s]+(?:\([A-Za-z0-9_.-]+\)[^()\s]*)*):(\d+):(\d+)\)\s*$/;
+var BARE_FRAME = /^\s*at\s+(?:async\s+)?([^()\s]+(?:\([A-Za-z0-9_.-]+\)[^()\s]*)*):(\d+):(\d+)\s*$/;
 var INTERNAL_FRAME_PATTERNS = [
   /^node:/,
   /^node:internal\//,