@glasstrace/sdk 1.3.2 → 1.3.4

package/dist/index.d.cts

@@ -351,6 +351,25 @@ declare function waitForReady(timeoutMs?: number): Promise<void>;
 /**
  * Simplified public state query for external consumers.
  * Hides implementation details like coexistence scenarios.
+ *
+ * The returned `tracing` field is the canonical user-observable signal
+ * for OTel coexistence outcomes:
+ *
+ * - `"active"` — the SDK owns the OTel provider and is exporting spans.
+ * - `"coexistence"` — another OTel provider was detected and the SDK
+ *   either auto-attached its span processor or found one already
+ *   present. Spans are exported through the existing pipeline.
+ * - `"degraded"` — the SDK is exporting but the core lifecycle entered
+ *   `ACTIVE_DEGRADED` (e.g., a non-fatal export failure).
+ * - `"not-configured"` — the SDK could not configure tracing. Covers
+ *   `OtelState.UNCONFIGURED`, `OtelState.CONFIGURING`, and
+ *   `OtelState.COEXISTENCE_FAILED` (the DISC-1556 Next 16 production
+ *   "auto-attach returned null" path). When the value is
+ *   `"not-configured"` after `registerGlasstrace()` has resolved,
+ *   spans are NOT reaching the Glasstrace exporter and the manual
+ *   `createGlasstraceSpanProcessor()` workaround should be applied.
+ *   See `runtime-state.json`'s `lastError` field for the structured
+ *   failure record.
  */
 declare function getStatus(): {
     ready: boolean;

package/dist/index.d.ts

@@ -351,6 +351,25 @@ declare function waitForReady(timeoutMs?: number): Promise<void>;
 /**
  * Simplified public state query for external consumers.
  * Hides implementation details like coexistence scenarios.
+ *
+ * The returned `tracing` field is the canonical user-observable signal
+ * for OTel coexistence outcomes:
+ *
+ * - `"active"` — the SDK owns the OTel provider and is exporting spans.
+ * - `"coexistence"` — another OTel provider was detected and the SDK
+ *   either auto-attached its span processor or found one already
+ *   present. Spans are exported through the existing pipeline.
+ * - `"degraded"` — the SDK is exporting but the core lifecycle entered
+ *   `ACTIVE_DEGRADED` (e.g., a non-fatal export failure).
+ * - `"not-configured"` — the SDK could not configure tracing. Covers
+ *   `OtelState.UNCONFIGURED`, `OtelState.CONFIGURING`, and
+ *   `OtelState.COEXISTENCE_FAILED` (the DISC-1556 Next 16 production
+ *   "auto-attach returned null" path). When the value is
+ *   `"not-configured"` after `registerGlasstrace()` has resolved,
+ *   spans are NOT reaching the Glasstrace exporter and the manual
+ *   `createGlasstraceSpanProcessor()` workaround should be applied.
+ *   See `runtime-state.json`'s `lastError` field for the structured
+ *   failure record.
  */
 declare function getStatus(): {
     ready: boolean;

package/dist/index.js

@@ -12,14 +12,14 @@ import {
   registerGlasstrace,
   waitForReady,
   withGlasstraceConfig
-} from "./chunk-DQGNUENK.js";
+} from "./chunk-XFNK4YEW.js";
 import {
   GlasstraceSpanProcessor,
   SdkError,
   captureCorrelationId
-} from "./chunk-CRM3EYOL.js";
+} from "./chunk-WKOQJCFN.js";
 import "./chunk-DQ25VOKK.js";
-import "./chunk-3TU62WD6.js";
+import "./chunk-YG3X7TUI.js";
 import {
   getActiveConfig,
   getLinkedAccountId,
@@ -27,7 +27,7 @@ import {
   performInit,
   saveCachedConfig,
   sendInitRequest
-} from "./chunk-REEU6CNO.js";
+} from "./chunk-3HWBR7XM.js";
 import {
   isAnonymousMode,
   isProductionDisabled,
@@ -37,10 +37,10 @@ import {
 import {
   getOrCreateAnonKey,
   readAnonKey
-} from "./chunk-UFZEISZB.js";
+} from "./chunk-LQKJ27LO.js";
 import {
   deriveSessionId
-} from "./chunk-MQHLWSIX.js";
+} from "./chunk-M4ZI7J3N.js";
 import "./chunk-NSBPE2FW.js";
 export {
   GlasstraceExporter,

package/dist/node-entry.cjs

@@ -14566,7 +14566,7 @@ function deriveSessionId(apiKey, origin, date5, windowIndex) {
   const digest = sha256Hex(input).slice(0, 16);
   return SessionIdSchema.parse(digest);
 }
-var DevApiKeySchema, AnonApiKeySchema, SessionIdSchema, BuildHashSchema, SdkDiagnosticCodeSchema, CaptureConfigSchema, SdkCachedConfigSchema, GlasstraceOptionsSchema, GlasstraceEnvVarsSchema, ImportGraphPayloadSchema, SdkHealthReportSchema, TierLimitsSchema, SdkInitResponseSchema, DiscoveryResponseSchema, SourceMapUploadResponseSchema, PresignedUploadRequestSchema, PresignedUploadResponseSchema, SourceMapManifestRequestSchema, SourceMapManifestResponseSchema, GLASSTRACE_ATTRIBUTE_NAMES, DEFAULT_CAPTURE_CONFIG, K;
+var DevApiKeySchema, AnonApiKeySchema, SessionIdSchema, BuildHashSchema, SdkDiagnosticCodeSchema, CaptureConfigSchema, SdkCachedConfigSchema, GlasstraceOptionsSchema, GlasstraceEnvVarsSchema, GLASSTRACE_ATTRIBUTE_NAMES, DEFAULT_CAPTURE_CONFIG, MAX_SOURCE_MAP_FILE_PATH_LENGTH, MAX_SOURCE_MAP_FILE_SIZE, MAX_SOURCE_MAP_FILE_COUNT, MAX_PRESIGNED_CLIENT_TOKEN_LENGTH, MAX_PRESIGNED_PATHNAME_LENGTH, ImportGraphPayloadSchema, SdkHealthReportSchema, TierLimitsSchema, SdkInitResponseSchema, DiscoveryResponseSchema, SourceMapUploadResponseSchema, PresignedUploadRequestSchema, PresignedUploadResponseSchema, SourceMapManifestRequestSchema, SourceMapManifestResponseSchema, K;
 var init_dist = __esm({
   "../protocol/dist/index.js"() {
     "use strict";
@@ -14617,6 +14617,59 @@ var init_dist = __esm({
       NODE_ENV: external_exports.string().optional(),
       VERCEL_ENV: external_exports.string().optional()
     });
+    GLASSTRACE_ATTRIBUTE_NAMES = {
+      // Server-side attributes
+      TRACE_TYPE: "glasstrace.trace.type",
+      SESSION_ID: "glasstrace.session.id",
+      CORRELATION_ID: "glasstrace.correlation.id",
+      ENVIRONMENT: "glasstrace.environment",
+      ROUTE: "glasstrace.route",
+      HTTP_METHOD: "glasstrace.http.method",
+      HTTP_STATUS_CODE: "glasstrace.http.status_code",
+      HTTP_DURATION_MS: "glasstrace.http.duration_ms",
+      ERROR_MESSAGE: "glasstrace.error.message",
+      ERROR_CODE: "glasstrace.error.code",
+      ERROR_CATEGORY: "glasstrace.error.category",
+      ERROR_FIELD: "glasstrace.error.field",
+      ORM_PROVIDER: "glasstrace.orm.provider",
+      ORM_MODEL: "glasstrace.orm.model",
+      ORM_OPERATION: "glasstrace.orm.operation",
+      ORM_DURATION_MS: "glasstrace.orm.duration_ms",
+      FETCH_URL: "glasstrace.fetch.url",
+      FETCH_METHOD: "glasstrace.fetch.method",
+      FETCH_STATUS_CODE: "glasstrace.fetch.status_code",
+      FETCH_DURATION_MS: "glasstrace.fetch.duration_ms",
+      FETCH_TARGET: "glasstrace.fetch.target",
+      ENV_REFERENCED: "glasstrace.env.referenced",
+      BUILD_HASH: "glasstrace.build.hash",
+      SOURCE_FILE: "glasstrace.source.file",
+      SOURCE_LINE: "glasstrace.source.line",
+      SOURCE_MAPPED: "glasstrace.source.mapped",
+      TRPC_PROCEDURE: "glasstrace.trpc.procedure",
+      ERROR_RESPONSE_BODY: "glasstrace.error.response_body",
+      NEXT_ACTION_DETECTED: "glasstrace.next.action.detected",
+      // Client-side attributes
+      PLATFORM: "glasstrace.platform",
+      GESTURE_TYPE: "glasstrace.gesture.type",
+      TRIGGER_TYPE: "glasstrace.trigger.type",
+      ELEMENT_FINGERPRINT: "glasstrace.element.fingerprint",
+      ELEMENT_CONFIDENCE: "glasstrace.element.confidence",
+      TAB_ID: "glasstrace.tab.id"
+    };
+    DEFAULT_CAPTURE_CONFIG = {
+      requestBodies: false,
+      queryParamValues: false,
+      envVarValues: false,
+      fullConsoleOutput: false,
+      importGraph: false,
+      consoleErrors: false,
+      errorResponseBodies: false
+    };
+    MAX_SOURCE_MAP_FILE_PATH_LENGTH = 512;
+    MAX_SOURCE_MAP_FILE_SIZE = 50 * 1024 * 1024;
+    MAX_SOURCE_MAP_FILE_COUNT = 100;
+    MAX_PRESIGNED_CLIENT_TOKEN_LENGTH = 2048;
+    MAX_PRESIGNED_PATHNAME_LENGTH = 1024;
     ImportGraphPayloadSchema = external_exports.object({
       buildHash: BuildHashSchema,
       graph: external_exports.record(external_exports.string(), external_exports.array(external_exports.string()))
@@ -14663,35 +14716,68 @@ var init_dist = __esm({
       buildHash: BuildHashSchema,
       files: external_exports.array(
         external_exports.object({
-          filePath: external_exports.string().min(1),
-          sizeBytes: external_exports.number().int().positive()
+          filePath: external_exports.string().min(1).max(
+            MAX_SOURCE_MAP_FILE_PATH_LENGTH,
+            `filePath length exceeds maximum of ${MAX_SOURCE_MAP_FILE_PATH_LENGTH} characters`
+          ),
+          sizeBytes: external_exports.number().int().positive().max(
+            MAX_SOURCE_MAP_FILE_SIZE,
+            `sizeBytes exceeds maximum of ${MAX_SOURCE_MAP_FILE_SIZE} bytes (${MAX_SOURCE_MAP_FILE_SIZE / (1024 * 1024)} MiB)`
+          )
         })
-      ).min(1).max(100)
+      ).min(1).max(
+        MAX_SOURCE_MAP_FILE_COUNT,
+        `files array exceeds maximum of ${MAX_SOURCE_MAP_FILE_COUNT} entries`
+      )
     });
     PresignedUploadResponseSchema = external_exports.object({
       uploadId: external_exports.string().uuid(),
       expiresAt: external_exports.number().int().nonnegative(),
       files: external_exports.array(
         external_exports.object({
-          filePath: external_exports.string().min(1),
-          clientToken: external_exports.string().min(1),
-          pathname: external_exports.string().min(1),
-          maxBytes: external_exports.number().int().positive(),
+          filePath: external_exports.string().min(1).max(
+            MAX_SOURCE_MAP_FILE_PATH_LENGTH,
+            `filePath length exceeds maximum of ${MAX_SOURCE_MAP_FILE_PATH_LENGTH} characters`
+          ),
+          clientToken: external_exports.string().min(1).max(
+            MAX_PRESIGNED_CLIENT_TOKEN_LENGTH,
+            `clientToken length exceeds maximum of ${MAX_PRESIGNED_CLIENT_TOKEN_LENGTH} characters`
+          ),
+          pathname: external_exports.string().min(1).max(
+            MAX_PRESIGNED_PATHNAME_LENGTH,
+            `pathname length exceeds maximum of ${MAX_PRESIGNED_PATHNAME_LENGTH} characters`
+          ),
+          maxBytes: external_exports.number().int().positive().max(
+            MAX_SOURCE_MAP_FILE_SIZE,
+            `maxBytes exceeds maximum of ${MAX_SOURCE_MAP_FILE_SIZE} bytes (${MAX_SOURCE_MAP_FILE_SIZE / (1024 * 1024)} MiB)`
+          ),
           /** Vercel Blob access mode — explicit in the contract per DISC-756. */
           access: external_exports.enum(["public"])
         })
-      ).min(1).max(100)
+      ).min(1).max(
+        MAX_SOURCE_MAP_FILE_COUNT,
+        `files array exceeds maximum of ${MAX_SOURCE_MAP_FILE_COUNT} entries`
+      )
     });
     SourceMapManifestRequestSchema = external_exports.object({
       uploadId: external_exports.string().uuid(),
       buildHash: BuildHashSchema,
       files: external_exports.array(
         external_exports.object({
-          filePath: external_exports.string().min(1),
-          sizeBytes: external_exports.number().int().positive(),
+          filePath: external_exports.string().min(1).max(
+            MAX_SOURCE_MAP_FILE_PATH_LENGTH,
+            `filePath length exceeds maximum of ${MAX_SOURCE_MAP_FILE_PATH_LENGTH} characters`
+          ),
+          sizeBytes: external_exports.number().int().positive().max(
+            MAX_SOURCE_MAP_FILE_SIZE,
+            `sizeBytes exceeds maximum of ${MAX_SOURCE_MAP_FILE_SIZE} bytes (${MAX_SOURCE_MAP_FILE_SIZE / (1024 * 1024)} MiB)`
+          ),
           blobUrl: external_exports.string().url()
         })
-      ).min(1).max(100)
+      ).min(1).max(
+        MAX_SOURCE_MAP_FILE_COUNT,
+        `files array exceeds maximum of ${MAX_SOURCE_MAP_FILE_COUNT} entries`
+      )
     });
     SourceMapManifestResponseSchema = external_exports.object({
       success: external_exports.literal(true),
@@ -14700,54 +14786,6 @@ var init_dist = __esm({
       totalSizeBytes: external_exports.number().int().nonnegative(),
       activatedAt: external_exports.number().int().positive()
     });
-    GLASSTRACE_ATTRIBUTE_NAMES = {
-      // Server-side attributes
-      TRACE_TYPE: "glasstrace.trace.type",
-      SESSION_ID: "glasstrace.session.id",
-      CORRELATION_ID: "glasstrace.correlation.id",
-      ENVIRONMENT: "glasstrace.environment",
-      ROUTE: "glasstrace.route",
-      HTTP_METHOD: "glasstrace.http.method",
-      HTTP_STATUS_CODE: "glasstrace.http.status_code",
-      HTTP_DURATION_MS: "glasstrace.http.duration_ms",
-      ERROR_MESSAGE: "glasstrace.error.message",
-      ERROR_CODE: "glasstrace.error.code",
-      ERROR_CATEGORY: "glasstrace.error.category",
-      ERROR_FIELD: "glasstrace.error.field",
-      ORM_PROVIDER: "glasstrace.orm.provider",
-      ORM_MODEL: "glasstrace.orm.model",
-      ORM_OPERATION: "glasstrace.orm.operation",
-      ORM_DURATION_MS: "glasstrace.orm.duration_ms",
-      FETCH_URL: "glasstrace.fetch.url",
-      FETCH_METHOD: "glasstrace.fetch.method",
-      FETCH_STATUS_CODE: "glasstrace.fetch.status_code",
-      FETCH_DURATION_MS: "glasstrace.fetch.duration_ms",
-      FETCH_TARGET: "glasstrace.fetch.target",
-      ENV_REFERENCED: "glasstrace.env.referenced",
-      BUILD_HASH: "glasstrace.build.hash",
-      SOURCE_FILE: "glasstrace.source.file",
-      SOURCE_LINE: "glasstrace.source.line",
-      SOURCE_MAPPED: "glasstrace.source.mapped",
-      TRPC_PROCEDURE: "glasstrace.trpc.procedure",
-      ERROR_RESPONSE_BODY: "glasstrace.error.response_body",
-      NEXT_ACTION_DETECTED: "glasstrace.next.action.detected",
-      // Client-side attributes
-      PLATFORM: "glasstrace.platform",
-      GESTURE_TYPE: "glasstrace.gesture.type",
-      TRIGGER_TYPE: "glasstrace.trigger.type",
-      ELEMENT_FINGERPRINT: "glasstrace.element.fingerprint",
-      ELEMENT_CONFIDENCE: "glasstrace.element.confidence",
-      TAB_ID: "glasstrace.tab.id"
-    };
-    DEFAULT_CAPTURE_CONFIG = {
-      requestBodies: false,
-      queryParamValues: false,
-      envVarValues: false,
-      fullConsoleOutput: false,
-      importGraph: false,
-      consoleErrors: false,
-      errorResponseBodies: false
-    };
     K = new Uint32Array([
       1116352408,
       1899447441,
@@ -18432,15 +18470,32 @@ function prepareErrorResponseBody(body) {
 }
 
 // src/build-info.ts
+init_console_capture();
 var UNSET = "";
+var SHA_SHAPE = /^[0-9a-f]{7,64}$/i;
+function redactBuildHash(value) {
+  const sanitize2 = (s) => s.replace(/[\x00-\x1F\x7F]/g, "?");
+  if (value.length <= 12) return sanitize2(value.slice(0, 4)) + "...";
+  return sanitize2(value.slice(0, 8)) + "..." + sanitize2(value.slice(-4));
+}
 function readBuildHashFromEnv() {
   const raw = process.env.GLASSTRACE_BUILD_HASH;
   if (typeof raw !== "string") return UNSET;
   const trimmed = raw.trim();
-  return trimmed.length > 0 ? trimmed : UNSET;
+  if (trimmed.length === 0) return UNSET;
+  if (!SHA_SHAPE.test(trimmed)) {
+    sdkLog(
+      "warn",
+      `[glasstrace] warning: GLASSTRACE_BUILD_HASH=${redactBuildHash(trimmed)} does not match expected SHA shape (7-64 hex characters); source-map enrichment may not work as expected.`
+    );
+  }
+  return trimmed;
 }
-var cachedBuildHash = readBuildHashFromEnv();
+var cachedBuildHash = null;
 function getBuildHash() {
+  if (cachedBuildHash === null) {
+    cachedBuildHash = readBuildHashFromEnv();
+  }
   return cachedBuildHash === UNSET ? void 0 : cachedBuildHash;
 }
 
@@ -22057,9 +22112,11 @@ This message will not appear once Glasstrace is added to your provider config.`
 }
 function emitGuidanceMessage() {
   const isSentry = detectSentry();
+  const isProduction = typeof process !== "undefined" && process.env?.NODE_ENV === "production";
+  const level = isProduction ? "error" : "warn";
   if (isSentry) {
     sdkLog(
-      "warn",
+      level,
       `[glasstrace] An existing OTel TracerProvider is registered but Glasstrace could not auto-attach its span processor.
 Add Glasstrace to your Sentry config:
 
@@ -22072,7 +22129,7 @@ Add Glasstrace to your Sentry config:
     );
   } else {
     sdkLog(
-      "warn",
+      level,
       `[glasstrace] An existing OTel TracerProvider is registered but Glasstrace could not auto-attach its span processor.
 Add Glasstrace to your provider configuration:
 
@@ -22199,11 +22256,27 @@ async function runCoexistencePath(existingProvider, config2) {
   setOtelState(OtelState.COEXISTENCE_FAILED);
   emitLifecycleEvent("otel:configured", { state: OtelState.COEXISTENCE_FAILED, scenario: "C/F" });
   emitLifecycleEvent("otel:injection_failed", { reason: "provider internals inaccessible" });
+  emitLifecycleEvent("otel:failed", {
+    category: "auto-attach-returned-null",
+    message: "tryAutoAttachGlasstraceProcessor returned null \u2014 the existing OTel TracerProvider exposed no injection point. Spans are not reaching the Glasstrace exporter. Apply the manual createGlasstraceSpanProcessor() workaround documented in the SDK README.",
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    providerClass: readProviderClass(existingProvider)
+  });
   const coreState = getCoreState();
   if (coreState === CoreState.ACTIVE || coreState === CoreState.KEY_RESOLVED) {
     setCoreState(CoreState.ACTIVE_DEGRADED);
   }
 }
+function readProviderClass(tracerProvider) {
+  try {
+    const proxy = tracerProvider;
+    const delegate = typeof proxy.getDelegate === "function" ? proxy.getDelegate() : tracerProvider;
+    const name = delegate?.constructor?.name;
+    return typeof name === "string" && name.length > 0 ? name : void 0;
+  } catch {
+    return void 0;
+  }
+}
 async function runRegistrationPath(config2, sessionManager) {
   const exporterUrl = `${config2.endpoint}/v1/traces`;
   const createOtlpExporter = (url2, headers) => new OTLPTraceExporter({ url: url2, headers });
@@ -22506,6 +22579,7 @@ init_console_capture();
 var _projectRoot = null;
 var _sdkVersion = "unknown";
 var _lastScenario;
+var _lastError;
 var _debounceTimer = null;
 var _started = false;
 function startRuntimeStateWriter(options) {
@@ -22528,6 +22602,10 @@ function startRuntimeStateWriter(options) {
     _lastScenario = scenario;
     debouncedWrite();
   });
+  onLifecycleEvent("otel:failed", (payload) => {
+    _lastError = { ...payload };
+    debouncedWrite();
+  });
   onLifecycleEvent("auth:key_resolved", () => debouncedWrite());
   onLifecycleEvent("auth:claim_started", () => debouncedWrite());
   onLifecycleEvent("auth:claim_completed", () => debouncedWrite());
@@ -22555,6 +22633,9 @@ function writeStateNow() {
       auth: { state: state.auth },
       otel: { state: state.otel, scenario: _lastScenario }
     };
+    if (_lastError) {
+      runtimeState.lastError = _lastError;
+    }
     const dir = (0, import_node_path.join)(_projectRoot, ".glasstrace");
     const filePath = (0, import_node_path.join)(dir, "runtime-state.json");
     (0, import_node_fs.mkdirSync)(dir, { recursive: true, mode: 448 });
@@ -22599,7 +22680,7 @@ function registerGlasstrace(options) {
     setCoreState(CoreState.REGISTERING);
     startRuntimeStateWriter({
       projectRoot: process.cwd(),
-      sdkVersion: "1.3.2"
+      sdkVersion: "1.3.4"
     });
     const config2 = resolveConfig(options);
     if (config2.verbose) {
@@ -22765,8 +22846,8 @@ async function backgroundInit(config2, anonKeyForInit, generation) {
   if (config2.verbose) {
     console.info("[glasstrace] Background init firing.");
   }
-  const healthReport = collectHealthReport("1.3.2");
-  const initResult = await performInit(config2, anonKeyForInit, "1.3.2", healthReport);
+  const healthReport = collectHealthReport("1.3.4");
+  const initResult = await performInit(config2, anonKeyForInit, "1.3.4", healthReport);
   if (generation !== registrationGeneration) return;
   const currentState = getCoreState();
   if (currentState === CoreState.SHUTTING_DOWN || currentState === CoreState.SHUTDOWN) {
@@ -22789,7 +22870,7 @@ async function backgroundInit(config2, anonKeyForInit, generation) {
   }
   maybeInstallConsoleCapture();
   if (didLastInitSucceed()) {
-    startHeartbeat(config2, anonKeyForInit, "1.3.2", generation, (newApiKey, accountId) => {
+    startHeartbeat(config2, anonKeyForInit, "1.3.4", generation, (newApiKey, accountId) => {
       setAuthState(AuthState.CLAIMING);
       emitLifecycleEvent("auth:claim_started", { accountId });
       setResolvedApiKey(newApiKey);
@@ -22951,8 +23032,8 @@ init_dist();
 init_error_nudge();
 
 // src/stack-frame.ts
-var PAREN_FRAME = /^\s*at\s+(?:[^()]+\s+)?\(([^()\s]+):(\d+):(\d+)\)\s*$/;
-var BARE_FRAME = /^\s*at\s+(?:async\s+)?([^()\s]+):(\d+):(\d+)\s*$/;
+var PAREN_FRAME = /^\s*at\s+(?!eval\s+\(eval\s+at\b)(?:[^()]+\s+)?\(([^()\s]+(?:\([A-Za-z0-9_.-]+\)[^()\s]*)*):(\d+):(\d+)\)\s*$/;
+var BARE_FRAME = /^\s*at\s+(?:async\s+)?([^()\s]+(?:\([A-Za-z0-9_.-]+\)[^()\s]*)*):(\d+):(\d+)\s*$/;
 var INTERNAL_FRAME_PATTERNS = [
   /^node:/,
   /^node:internal\//,