@goliapkg/sentori-react-native 4.0.0 → 5.1.0

package/src/handlers/network.ts

@@ -1,27 +1,35 @@
-import { normalizeUrl, startSpan } from '@goliapkg/sentori-core';
+// Network instrumentation — v1 role: feed the signal ring (`http`
+// signals) and detect the slow_api warn scenario (design.md §3,
+// category C: 「转圈不完」server-side flavour). The span/breadcrumb
+// machinery this file used to drive is gone with the APM vocabulary.
+//
+// Mini-spec (slow_api): a completed request slower than 3 s emits
+// one `warn`, scenario `slow_api`, surface = current screen, with
+// method + scrubbed URL + duration. Per-endpoint cooldown of 60 s so
+// one slow backend doesn't flood ingest with identical warns.
+//
+// Everything here is wrapped so a bug in our patch can never break
+// the host's networking (failure isolation): on any internal error
+// the original fetch/XHR behaviour wins.
+
+import { normalizeUrl, pushSignal } from '@goliapkg/sentori-core';
 
-import { addBreadcrumb } from '../breadcrumbs';
 import { getConfig } from '../config';
-// v2.1 W2 — bytes counters drive the runtime.network.{sent,received}
-// metrics. Cheap two-add per request, no allocation.
-import {
-  estimateRequestBytes,
-  estimateResponseBytes,
-  recordNetworkBytes,
-} from '../runtime-metrics-network';
+import { currentScreen } from '../navigation';
+import { warnDetected } from '../verbs';
 
 let _installed = false;
 let _graphqlEnabled = true;
 
 const AUTH_PARAMS = ['token', 'key', 'password', 'secret', 'access_token'];
-
-// v0.9.0 #11 — cap on body size we'll parse for `operationName`.
-// 8 KB is generous for any sensible GraphQL request and keeps the
-// hot-path JSON.parse bounded.
 const GQL_BODY_MAX_BYTES = 8 * 1024;
+const SLOW_API_MS = 3_000;
+const SLOW_API_COOLDOWN_MS = 60_000;
+
+const _slowApiLastWarn = new Map<string, number>();
 
-// Requests to our own ingest endpoint shouldn't be traced — otherwise
-// every span upload spawns another http.client span, and so on.
+// Requests to our own ingest endpoint are never observed — otherwise
+// every batch upload would signal itself, and so on.
 const isIngestUrl = (url: string): boolean => {
   const base = getConfig()?.ingestUrl;
   return !!base && url.startsWith(base);
@@ -39,6 +47,35 @@ export const installNetworkHandler = (opts?: { graphql?: boolean }): void => {
 export const __resetNetworkHandlerForTests = (): void => {
   _installed = false;
   _graphqlEnabled = true;
+  _slowApiLastWarn.clear();
+};
+
+/** One completed (or failed) request: ring signal + slow_api check. */
+const observe = (
+  method: string,
+  url: string,
+  status: number | 'error',
+  durationMs: number,
+  gqlOp?: string,
+): void => {
+  try {
+    const endpoint = gqlOp ? `graphql/${gqlOp}` : normalizeUrl(url);
+    pushSignal('http', { method, url: endpoint, status, ms: durationMs });
+
+    if (durationMs <= SLOW_API_MS) return;
+    if (getConfig()?.detect.slowApi !== true) return;
+    const now = Date.now();
+    const last = _slowApiLastWarn.get(endpoint) ?? 0;
+    if (now - last < SLOW_API_COOLDOWN_MS) return;
+    _slowApiLastWarn.set(endpoint, now);
+    warnDetected(
+      'slow_api',
+      { screen: currentScreen(), element: endpoint },
+      { method, endpoint, durationMs, status },
+    );
+  } catch {
+    // Observation must never leak into the host's request path.
+  }
 };
 
 // ── fetch ──────────────────────────────────────────────────────────
@@ -48,123 +85,52 @@ function patchFetch(): void {
   const original = globalThis.fetch;
 
   globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
-    const start = Date.now();
     const url = extractUrl(input);
     if (isIngestUrl(url)) return original(input, init);
+    const start = Date.now();
     const scrubbed = scrubUrl(url);
-    const method = (init?.method ??
-      (typeof input !== 'string' && 'method' in (input as Request)
-        ? (input as Request).method
-        : 'GET')) as string;
-
-    // v0.9.0 #11 — GraphQL operation auto-naming. Inspect the request
-    // body cheaply (string only, < 8 KB) when the request looks like
-    // GraphQL (URL contains /graphql or content-type hints it). On
-    // success we override the span name to `graphql/<operationName>`
-    // and ride along `gql.operation` on the breadcrumb so the dashboard
-    // can group + filter by operation instead of by the useless
-    // `POST /graphql` line.
+    const method = (
+      (init?.method ??
+        (typeof input !== 'string' && 'method' in (input as Request)
+          ? (input as Request).method
+          : 'GET')) as string
+    ).toUpperCase();
     const gqlOp = _graphqlEnabled
       ? extractGraphqlOpFromInit(init, input, url)
       : undefined;
 
-    // Phase 35 sub-C: also open an http.client span so the request
-    // shows up in the trace waterfall. Breadcrumbs stay — they're
-    // attached to error events at capture time and serve a different
-    // surface (the "last 100 things" timeline on the issue page).
-    const span = startSpan('http.client', {
-      name: gqlOp
-        ? `graphql/${gqlOp}`
-        : `${method.toUpperCase()} ${normalizeUrl(scrubbed)}`,
-      tags: gqlOp
-        ? {
-            'http.method': method.toUpperCase(),
-            'http.url': scrubbed,
-            'gql.operation': gqlOp,
-          }
-        : { 'http.method': method.toUpperCase(), 'http.url': scrubbed },
-    });
-
-    // Inject traceparent header on outbound requests.
-    const reqInit: RequestInit = { ...(init ?? {}) };
-    const headers = mergeHeaders(input, init);
-    headers.set('traceparent', toTraceparent(span.traceId, span.spanId));
-    reqInit.headers = headers;
-
     try {
-      const resp = await original(input, reqInit);
-      span.setTag('http.status', String(resp.status));
-      span.finish({ status: resp.status >= 400 ? 'error' : 'ok' });
-      // v2.1 W2 — bytes accounting. Sent estimated from
-      // init.body; received read from response Content-Length
-      // header (0 when missing / chunked — undercount-safe).
-      recordNetworkBytes(estimateRequestBytes(init), estimateResponseBytes(resp.headers));
-      addBreadcrumb({
-        type: 'net',
-        data: gqlOp
-          ? {
-              method,
-              url: scrubbed,
-              status: resp.status,
-              durationMs: Date.now() - start,
-              'gql.operation': gqlOp,
-            }
-          : {
-              method,
-              url: scrubbed,
-              status: resp.status,
-              durationMs: Date.now() - start,
-            },
-      });
+      const resp = await original(input, init);
+      observe(method, scrubbed, resp.status, Date.now() - start, gqlOp);
       return resp;
     } catch (e) {
-      const isAbort = isAbortError(e);
-      if (e instanceof Error) span.setTag('error.message', e.message);
-      span.finish({ status: isAbort ? 'cancelled' : 'error' });
-      addBreadcrumb({
-        type: 'net',
-        data: {
-          method,
-          url: scrubbed,
-          status: 0,
-          durationMs: Date.now() - start,
-          error: String(e),
-          ...(gqlOp ? { 'gql.operation': gqlOp } : {}),
-        },
-      });
+      if (!isAbortError(e)) {
+        observe(method, scrubbed, 'error', Date.now() - start, gqlOp);
+      }
       throw e;
     }
   }) as typeof fetch;
 }
 
-// ── XMLHttpRequest ─────────────────────────────────────────────────
-//
-// React Native's XHR is a native polyfill, not built on fetch — so
-// patching `globalThis.fetch` alone misses every axios / older-style
-// request. axios on RN uses its `xhr` adapter by default. We patch
-// the prototype's `open` + `send` so the instance carries the span
-// from `send()` to `loadend`.
+// ── XHR ────────────────────────────────────────────────────────────
 
 type TracedXhr = XMLHttpRequest & {
   __sentoriMethod?: string;
   __sentoriUrl?: string;
-  __sentoriSpan?: ReturnType<typeof startSpan>;
   __sentoriStart?: number;
   __sentoriGqlOp?: string;
 };
 
 function patchXhr(): void {
-  const XHR = (globalThis as { XMLHttpRequest?: typeof XMLHttpRequest }).XMLHttpRequest;
+  const XHR = (globalThis as { XMLHttpRequest?: typeof XMLHttpRequest })
+    .XMLHttpRequest;
   if (typeof XHR !== 'function') return;
-  const proto = XHR.prototype as XMLHttpRequest & {
-    __sentoriPatched?: boolean;
-  };
+  const proto = XHR.prototype as XMLHttpRequest & { __sentoriPatched?: boolean };
   if (proto.__sentoriPatched) return;
   proto.__sentoriPatched = true;
 
   const originalOpen = proto.open;
   const originalSend = proto.send;
-  const originalSetHeader = proto.setRequestHeader;
 
   proto.open = function (
     this: TracedXhr,
@@ -178,106 +144,40 @@ function patchXhr(): void {
     return originalOpen.call(this, method, url, ...rest);
   };
 
-  proto.send = function (this: TracedXhr, body?: Document | XMLHttpRequestBodyInit | null): void {
+  proto.send = function (
+    this: TracedXhr,
+    body?: Document | XMLHttpRequestBodyInit | null,
+  ): void {
     if (isIngestUrl(this.__sentoriUrl ?? '')) return originalSend.call(this, body);
     const method = this.__sentoriMethod ?? 'GET';
     const url = scrubUrl(this.__sentoriUrl ?? '');
-    // v0.9.0 #11 — GraphQL operation auto-naming on XHR.
-    const gqlOp = _graphqlEnabled
+    this.__sentoriGqlOp = _graphqlEnabled
       ? extractGraphqlOpFromXhr(body, this.__sentoriUrl ?? '')
       : undefined;
-    this.__sentoriGqlOp = gqlOp;
-    const span = startSpan('http.client', {
-      name: gqlOp ? `graphql/${gqlOp}` : `${method} ${normalizeUrl(url)}`,
-      tags: gqlOp
-        ? {
-            'http.method': method,
-            'http.url': url,
-            'gql.operation': gqlOp,
-          }
-        : { 'http.method': method, 'http.url': url },
-    });
-    this.__sentoriSpan = span;
     this.__sentoriStart = Date.now();
 
-    // setRequestHeader must be called between open() and send(); we're
-    // inside send() before the underlying call, so this is legal.
-    try {
-      originalSetHeader.call(this, 'traceparent', toTraceparent(span.traceId, span.spanId));
-    } catch {
-      // Some XHR polyfills are strict about header timing; if it
-      // rejects, drop the header rather than fail the request.
-    }
-
-    const finish = () => {
-      const s = this.__sentoriSpan;
-      if (!s) return;
-      this.__sentoriSpan = undefined;
-      const status = this.status;
-      s.setTag('http.status', String(status));
-      // status 0 means network error / aborted / CORS block — treat
-      // as error. The `abort` event handler below downgrades aborts.
-      s.finish({ status: status === 0 || status >= 400 ? 'error' : 'ok' });
-      const op = this.__sentoriGqlOp;
-      addBreadcrumb({
-        type: 'net',
-        data: op
-          ? {
-              method,
-              url,
-              status,
-              durationMs: Date.now() - (this.__sentoriStart ?? Date.now()),
-              'gql.operation': op,
-            }
-          : {
-              method,
-              url,
-              status,
-              durationMs: Date.now() - (this.__sentoriStart ?? Date.now()),
-            },
-      });
+    const finish = (statusOverride?: 'error') => {
+      const start = this.__sentoriStart;
+      if (start === undefined) return;
+      this.__sentoriStart = undefined;
+      const status =
+        statusOverride ?? (this.status === 0 ? ('error' as const) : this.status);
+      observe(method, url, status, Date.now() - start, this.__sentoriGqlOp);
     };
 
-    this.addEventListener('loadend', finish);
+    this.addEventListener('load', () => finish());
+    this.addEventListener('error', () => finish('error'));
+    this.addEventListener('timeout', () => finish('error'));
     this.addEventListener('abort', () => {
-      const s = this.__sentoriSpan;
-      if (!s) return;
-      this.__sentoriSpan = undefined;
-      s.finish({ status: 'cancelled' });
-      const op = this.__sentoriGqlOp;
-      addBreadcrumb({
-        type: 'net',
-        data: {
-          method,
-          url,
-          status: 0,
-          durationMs: Date.now() - (this.__sentoriStart ?? Date.now()),
-          error: 'aborted',
-          ...(op ? { 'gql.operation': op } : {}),
-        },
-      });
+      // Deliberate cancellation is not a network event worth noting.
+      this.__sentoriStart = undefined;
     });
 
     return originalSend.call(this, body);
   };
 }
 
-function mergeHeaders(input: RequestInfo | URL, init?: RequestInit): Headers {
-  const out = new Headers();
-  if (typeof input !== 'string' && !(input instanceof URL)) {
-    (input as Request).headers.forEach((v, k) => out.set(k, v));
-  }
-  if (init?.headers) {
-    new Headers(init.headers).forEach((v, k) => out.set(k, v));
-  }
-  return out;
-}
-
-function toTraceparent(traceId: string, spanId: string): string {
-  const trace = traceId.replace(/-/g, '').toLowerCase();
-  const parent = spanId.replace(/-/g, '').toLowerCase().slice(0, 16);
-  return `00-${trace}-${parent}-01`;
-}
+// ── helpers ────────────────────────────────────────────────────────
 
 function isAbortError(err: unknown): boolean {
   if (typeof err !== 'object' || err === null) return false;
@@ -306,30 +206,19 @@ const scrubUrl = (url: string): string => {
   }
 };
 
-// ── v0.9.0 #11 — GraphQL operation extraction ─────────────────────
-//
-// Cheap, sync, never throws. Two callers (fetch + xhr) feed in
-// whatever they have on hand; both end up calling `parseGqlOpName`.
+// ── GraphQL operation extraction — cheap, sync, never throws ──────
 
 function lookGraphqlish(url: string, contentType?: string): boolean {
-  if (contentType) {
-    if (contentType.includes('graphql')) return true;
-    // application/json is too generic to gate on alone, but combined
-    // with a `/graphql` path it's a strong hint.
-  }
-  if (url.includes('/graphql')) return true;
-  return false;
+  if (contentType?.includes('graphql')) return true;
+  return url.includes('/graphql');
 }
 
-/** Pull `operationName` out of a JSON body or a raw query body. Returns
- *  `undefined` on any failure mode. Cap at GQL_BODY_MAX_BYTES so a
+/** Pull `operationName` out of a JSON body or a raw query body.
+ *  Returns `undefined` on any failure mode; body capped at 8 KB so a
  *  hostile / oversize body never lands in `JSON.parse`. */
 export function parseGqlOpName(body: string): string | undefined {
   if (typeof body !== 'string' || body.length === 0) return undefined;
   if (body.length > GQL_BODY_MAX_BYTES) return undefined;
-  // First char `{` or `[` → JSON path. Most clients (Apollo, urql,
-  // Relay) send `{"query":"…","operationName":"…","variables":{…}}`
-  // or an array of such objects (batched).
   const first = body.charCodeAt(0);
   if (first === 0x7b /* { */ || first === 0x5b /* [ */) {
     try {
@@ -340,8 +229,6 @@ export function parseGqlOpName(body: string): string | undefined {
         if (typeof name === 'string' && name.length > 0 && name.length <= 200) {
           return name;
         }
-        // No operationName — try to sniff the `query` string for
-        // `query Foo {…}` / `mutation Bar {…}` / `subscription Baz {…}`.
         const q = (candidate as { query?: unknown }).query;
         if (typeof q === 'string') return parseQueryStringOpName(q);
       }
@@ -350,17 +237,14 @@ export function parseGqlOpName(body: string): string | undefined {
     }
     return undefined;
   }
-  // `application/graphql` body is the bare query string — no JSON wrapper.
   return parseQueryStringOpName(body);
 }
 
 function parseQueryStringOpName(query: string): string | undefined {
-  // Skip leading whitespace + comments. We only need the first non-trivial
-  // top-level operation keyword to extract a name; nested operations are
-  // a non-issue because GraphQL forbids them.
-  const m = /^\s*(?:#[^\n]*\n\s*)*(query|mutation|subscription)\s+([A-Za-z_][A-Za-z0-9_]*)/.exec(
-    query,
-  );
+  const m =
+    /^\s*(?:#[^\n]*\n\s*)*(query|mutation|subscription)\s+([A-Za-z_][A-Za-z0-9_]*)/.exec(
+      query,
+    );
   return m?.[2];
 }
 

package/src/handlers/promise.ts

@@ -1,6 +1,6 @@
 import { coerceError } from '@goliapkg/sentori-core';
 
-import { captureError } from '../capture';
+import { error as captureError } from '../verbs';
 
 type RejectionTracker = (opts: {
   allRejections: boolean;

package/src/handlers/screenshot.ts

@@ -25,7 +25,6 @@
 //   - On any failure we silently return null. The error event still
 //     goes to the server; the user just doesn't see a thumbnail.
 
-import { getRegisteredMaskQuery } from '../mask';
 import { captureNativeScreenshotWithMask } from '../native';
 
 /** What `captureScreenshot()` hands back when it succeeds. */
@@ -51,16 +50,9 @@ export async function captureScreenshot(): Promise<ScreenshotBlob | null> {
   // the host never called `registerMaskQuery`, no mask is applied
   // and the full screenshot ships — sane default: SDK does nothing
   // unless told to.
-  const query = getRegisteredMaskQuery();
-  let maskedIds: string[] = [];
-  if (query) {
-    try {
-      maskedIds = query();
-    } catch {
-      // A throwing query is the host's bug, not ours; skip mask
-      // rather than skip the screenshot.
-      maskedIds = [];
-    }
+  // Masking will return with a v1 privacy pass; nothing masks today.
+  const maskedIds: string[] = [];
+  {
   }
 
   const result = await captureNativeScreenshotWithMask(maskedIds);