@glasstrace/sdk 1.9.0 → 1.10.0

package/dist/middleware/index.d.cts

@@ -124,6 +124,14 @@ interface TracedRequestMiddlewareOptions {
  * Wrap a Next.js / generic-fetch request-middleware function in an
  * OTel span tagged with `glasstrace.causal.middleware_for_request`.
  *
+ * **Privacy:** the value of
+ * `glasstrace.causal.middleware_for_request` is the raw URL
+ * pathname. Pathnames can carry user-controlled data (IDs, emails,
+ * opaque keys). The SDK does NOT redact this attribute. Callers MUST
+ * NOT place secrets, tokens, or other sensitive data in URL paths;
+ * the same general HTTP best practice that keeps secrets out of
+ * server logs keeps them out of Glasstrace trace evidence.
+ *
  * Each call to the returned function:
  *
  *   1. Detects the SDK's registration state. When the OTel API is

package/dist/middleware/index.d.ts

@@ -124,6 +124,14 @@ interface TracedRequestMiddlewareOptions {
  * Wrap a Next.js / generic-fetch request-middleware function in an
  * OTel span tagged with `glasstrace.causal.middleware_for_request`.
  *
+ * **Privacy:** the value of
+ * `glasstrace.causal.middleware_for_request` is the raw URL
+ * pathname. Pathnames can carry user-controlled data (IDs, emails,
+ * opaque keys). The SDK does NOT redact this attribute. Callers MUST
+ * NOT place secrets, tokens, or other sensitive data in URL paths;
+ * the same general HTTP best practice that keeps secrets out of
+ * server logs keeps them out of Glasstrace trace evidence.
+ *
  * Each call to the returned function:
  *
  *   1. Detects the SDK's registration state. When the OTel API is

package/dist/middleware/index.js

@@ -1,10 +1,10 @@
 import {
   _resetForTesting,
   tracedRequestMiddleware
-} from "../chunk-QHV7NFON.js";
+} from "../chunk-D54FMQHF.js";
 import "../chunk-CL3OVHPO.js";
 import "../chunk-DQ25VOKK.js";
-import "../chunk-JHUNLPSS.js";
+import "../chunk-6RKS3DNA.js";
 import "../chunk-NSBPE2FW.js";
 export {
   _resetForTesting,

package/dist/node-entry.cjs

@@ -14638,6 +14638,21 @@ var init_dist = __esm({
       HTTP_METHOD: "glasstrace.http.method",
       HTTP_STATUS_CODE: "glasstrace.http.status_code",
       HTTP_DURATION_MS: "glasstrace.http.duration_ms",
+      /**
+       * Boolean audit attribute set to `true` only when the SDK's
+       * boundary-masked-error heuristic at `enriching-exporter.ts`
+       * fires (SDK-051 / DISC-1125 — same-span scope; descendant-traversal
+       * scope is tracked in a follow-up DISC).
+       *
+       * Strict additivity: backend ingestion ignores unknown attributes
+       * today; this attribute is for audit/observability. Downstream
+       * tooling MAY surface heuristic activation rates by querying for
+       * spans with this attribute set; the backend's status-handling
+       * pipeline does NOT depend on it.
+       *
+       * Absent on spans where the heuristic did not fire.
+       */
+      HTTP_BOUNDARY_MASKED: "glasstrace.http.boundary_masked",
       ERROR_MESSAGE: "glasstrace.error.message",
       ERROR_CODE: "glasstrace.error.code",
       ERROR_CATEGORY: "glasstrace.error.category",
@@ -14677,6 +14692,35 @@ var init_dist = __esm({
       SOURCE_LINE: "glasstrace.source.line",
       SOURCE_MAPPED: "glasstrace.source.mapped",
       TRPC_PROCEDURE: "glasstrace.trpc.procedure",
+      /**
+       * Zero-based positional index of the current member within a tRPC
+       * HTTP-batch dispatch (SDK-052 / DISC-1534 SDK-side slice). Set on
+       * member spans by `tracedMiddleware` when the SDK's
+       * `wrapBatchedHttpHandler` envelope is in scope. Numeric.
+       *
+       * Load-bearing for batches that include the same procedure name
+       * more than once — name-only matching cannot disambiguate, so the
+       * positional index is the canonical disambiguator. Absent on
+       * non-batched spans and on apps not using `wrapBatchedHttpHandler`.
+       */
+      TRPC_BATCH_MEMBER_INDEX: "glasstrace.trpc.batch.member_index",
+      /**
+       * Ordered list of all procedure names in the current tRPC HTTP
+       * batch (SDK-052 / DISC-1534 SDK-side slice). Stored as an OTel
+       * typed string array (`string[]`), NOT a JSON-encoded string —
+       * the typed-array form preserves first-class queryability in the
+       * OTel ingest pipeline.
+       *
+       * Set on each member span that `tracedMiddleware` produces when a
+       * `wrapBatchedHttpHandler` envelope is in scope. Absent on
+       * non-batched spans, on the root HTTP server span (today's
+       * release ships strict-additive scope only — per-root-span
+       * attribution is deferred to a follow-up wave because changing
+       * the root span's existing `glasstrace.trpc.procedure` shape from
+       * comma-joined to first-member representative is non-additive),
+       * and on apps not using `wrapBatchedHttpHandler`.
+       */
+      TRPC_BATCH_MEMBER_PROCEDURES: "glasstrace.trpc.batch.member_procedures",
       ERROR_RESPONSE_BODY: "glasstrace.error.response_body",
       NEXT_ACTION_DETECTED: "glasstrace.next.action.detected",
       // Client-side attributes
@@ -19604,6 +19648,15 @@ var GlasstraceExporter = class {
           } else {
             extra[ATTR2.HTTP_STATUS_CODE] = 500;
           }
+          extra[ATTR2.HTTP_BOUNDARY_MASKED] = true;
+          const inferredStatus = extra[ATTR2.HTTP_STATUS_CODE];
+          const eventDetails2 = getExceptionEventDetails(span);
+          const exceptionMessage = eventDetails2.message ?? (typeof attrs["exception.message"] === "string" ? attrs["exception.message"] : void 0);
+          emitLifecycleEvent("core:error_boundary_detected", {
+            spanId: span.spanContext().spanId,
+            inferredStatus,
+            ...exceptionMessage !== void 0 ? { exceptionMessage: exceptionMessage.slice(0, 256) } : {}
+          });
           if (this.verbose) {
             sdkLog(
               "info",
@@ -23559,11 +23612,11 @@ function registerGlasstrace(options) {
     setCoreState(CoreState.REGISTERING);
     maybeWarnStaleAgentInstructions({
       projectRoot: process.cwd(),
-      sdkVersion: "1.9.0"
+      sdkVersion: "1.10.0"
     });
     startRuntimeStateWriter({
       projectRoot: process.cwd(),
-      sdkVersion: "1.9.0"
+      sdkVersion: "1.10.0"
     });
     const config2 = resolveConfig(options);
     if (config2.verbose) {
@@ -23730,8 +23783,8 @@ async function backgroundInit(config2, anonKeyForInit, generation) {
   if (config2.verbose) {
     console.info("[glasstrace] Background init firing.");
   }
-  const healthReport = collectHealthReport("1.9.0");
-  const initResult = await performInit(config2, anonKeyForInit, "1.9.0", healthReport);
+  const healthReport = collectHealthReport("1.10.0");
+  const initResult = await performInit(config2, anonKeyForInit, "1.10.0", healthReport);
   if (generation !== registrationGeneration) return;
   const currentState = getCoreState();
   if (currentState === CoreState.SHUTTING_DOWN || currentState === CoreState.SHUTDOWN) {
@@ -23754,7 +23807,7 @@ async function backgroundInit(config2, anonKeyForInit, generation) {
   }
   maybeInstallConsoleCapture();
   if (didLastInitSucceed()) {
-    startHeartbeat(config2, anonKeyForInit, "1.9.0", generation, (newApiKey, accountId) => {
+    startHeartbeat(config2, anonKeyForInit, "1.10.0", generation, (newApiKey, accountId) => {
       setAuthState(AuthState.CLAIMING);
       emitLifecycleEvent("auth:claim_started", { accountId });
       setResolvedApiKey(newApiKey);