@groundcover/browser 2.0.0-rc.0 → 2.0.0

package/CHANGELOG.md

@@ -4,6 +4,58 @@ All notable changes to `@groundcover/browser` are documented here. This project
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html) and the
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) format.
 
+## [2.0.0] — 2026-10-06
+
+Stable release of the `2.0.0-rc.0` and `2.0.0-rc.1` line. **Contains breaking changes from `1.x`** —
+see [Migrating from 1.x to 2.0.0](./README.md#migrating-from-1x-to-200).
+
+The shipped `dist/` is byte-for-byte rc.1's — nothing landed after it, in the browser package or in
+the shared core it bundles; the version field, this entry and the migration guide's install command
+are the only differences in the package. Network and exception shaping now live in the core shared
+with `@groundcover/react-native`; the `/json/rum` envelope keeps its shape, and what changes on the
+wire is listed below.
+
+Against `1.0.9`, the exported `EventTypes`, `PrivacyOptions`, `Redactor`, `RedactField`, `RedactKind`
+and `PrivacyLevel` are structurally identical. `SDKOptions` drops `eventSampleRate`, `init()` requires
+`appId`, and `updateConfig()` no longer types `appId`. TypeScript enforces `appId` on every `init()`
+call, but flags the two removed fields only where they are written directly in an object literal: a
+variable or spread that also carries valid fields still compiles (an initialization config spread
+into `updateConfig()`, say) and reaches the runtime handling below.
+
+### Changed (breaking)
+
+- **Event-level sampling is removed.** `options.eventSampleRate` warns and is ignored, on `init` and
+  on `updateConfig`; use `options.sessionSampleRate` to select whole sessions. Rates are not
+  converted.
+- **`appId` is required and fixed per SDK instance.** It must be a non-blank string, its value is
+  preserved exactly, the first successful `init` wins (later calls are ignored; a failed init may be
+  retried), and `updateConfig` rejects any update that contains `appId`.
+
+### Changed
+
+- **`span_name` carries the upper-cased method**, like `operation.name`: `fetch(url, { method: "post" })`
+  is the span `POST /path`, not a separate `post /path`. A missing method reads `UNKNOWN`.
+- **An opaque host object passed without a key is labelled `opaque_node`** (was `dom_node`) by the
+  enricher's placeholder. Keyed placeholders are unchanged.
+
+### Fixed
+
+- **`tracing.propagationUrls` treats only `*` as a wildcard.** Every other character kept its regex
+  meaning, so `https://api.example.com/*` also matched `https://api-example.com/…` and trace headers
+  (plus any `tracing.origin` header) were sent to lookalike hosts.
+- **A path pattern such as `"/api/*"` matches same-origin requests only, whether they are written as
+  relative or absolute URLs.** XHR requests opened with a relative URL were never matched (XHR stores
+  the resolved URL), and a protocol-relative `//other-host/api/…` was. Patterns are matched against
+  the URL the browser actually requests, so `https://app/api/../private` no longer matches
+  `https://app/api/*`.
+- **`fetch` events keep their trace ids when a configured header name has capitals.** `fetch` stores
+  request headers lowercased, so `traceIdHeaderName: "X-Trace-Id"` or
+  `propagationHeaders: ["X-Custom"]` never matched on read-back.
+- **A read-only `fetch` no longer costs the XHR capture** (and no longer throws out of
+  initialization); the two transports are instrumented independently.
+- **Navigation instrumentation wraps the history methods present at initialization**, keeping a
+  router that wrapped them after the SDK was constructed.
+
 ## [1.0.9]
 
 Stable release of `1.0.9-rc.0`. The shipped `dist/` is byte-for-byte the RC's — nothing landed after

package/README.md

@@ -145,7 +145,7 @@ Distributed-tracing header propagation for outgoing requests.
 
 | Option | Type | Default | Description |
 |---|---|---|---|
-| `propagationUrls` | `string[]` | `[]` | Request URLs (prefix/`*`-glob match) that receive injected tracing headers. |
+| `propagationUrls` | `string[]` | `[]` | Request URLs that receive injected tracing headers. Each pattern must match the whole URL; only `*` is a wildcard. A path pattern such as `"/api/*"` matches same-origin requests only. |
 | `propagationHeaders` | `string[]` | `[]` | Header names to read/propagate onto traced requests. |
 | `traceIdHeaderName` | `string` | `""` | Header carrying the trace id. |
 | `spanIdHeaderName` | `string` | `""` | Header carrying the span id. |
@@ -521,7 +521,7 @@ successful initialization. These are breaking changes; review your initializatio
 updates before upgrading:
 
 ```bash
-npm install @groundcover/browser@2.0.0-rc.0
+npm install @groundcover/browser@^2.0.0
 ```
 
 | Change | Migration |

package/dist/index.d.mts

@@ -1,14 +1,9 @@
-/**
- * The event kinds the browser SDK ships today. This is the DEFAULT vocabulary,
- * not the only permitted one — see `BaseEvent`.
- */
-type KnownEventType = "dom.event" | "exception" | "network" | "log" | "pageload" | "navigation" | "custom" | "performance" | "replay";
 /**
  * `TType` lets a platform name its own event kinds without editing core, and every core class
- * flows it through. Defaults to `KnownEventType`, so callers dealing only in browser kinds need
- * not spell it out. Shared shapes stay shared — the set of NAMES is open, not the envelope.
+ * flows it through. Defaults to `string`, because the set of NAMES is open — a platform that
+ * wants a closed union passes its own. Shared shapes stay shared; only the vocabulary is open.
  */
-type BaseEvent<TType extends string = KnownEventType> = {
+type BaseEvent<TType extends string = string> = {
     type: TType;
     timestamp?: number;
     end_timestamp?: number;
@@ -28,30 +23,6 @@ type UserIdentifiers = {
     organization: string;
     properties: Record<string, unknown>;
 };
-type DomEventAttributes = {
-    dom_event_type: string;
-    dom_event_coordinates: {
-        clientX: number;
-        clientY: number;
-    };
-    dom_event_target: {
-        tagName: string;
-        id: string;
-        className: string;
-        text: string;
-        role: string;
-        accessibleName: string;
-        ariaLabel: string;
-        title: string;
-        alt: string;
-        placeholder: string;
-        name: string;
-        inputType: string;
-        href: string;
-    };
-    dom_event_selector: string;
-    dom_event_key_code: string;
-};
 type NetworkEventAttributes = {
     type: "HTTP";
     resource_name: string;
@@ -114,31 +85,6 @@ type LogEventAttributes = {
     message: string;
     level: string;
 } & Record<string, unknown>;
-type PageLoadEventAttributes = {
-    page_url: string;
-    page_resources: {
-        count: number;
-        totalSize: number;
-        totalDuration: number;
-        byType: {
-            [key: string]: {
-                count: number;
-                size: number;
-                duration: number;
-            };
-        };
-    };
-    page_referrer: string;
-    page_load_time: number;
-};
-type NavigationEventAttributes = {
-    page_url: string;
-    from_url?: string;
-    metadata?: Record<string, unknown>;
-    duration_ms: number;
-    start_timestamp: number;
-    end_timestamp: number;
-};
 type UserDefinedEventAttributes = {
     custom_event_name: string;
     custom_event_attributes?: Record<string, unknown>;
@@ -149,44 +95,9 @@ type PerformanceEventAttributes = {
     performance_metric_id: string;
     performance_metric_navigation_type: string;
 };
-type ReplayEventAttributes = {
-    /**
-     * Groundcover session replay payload.
-     *
-     * NOTE: This key is intentionally prefixed to avoid collisions with customer attributes.
-     */
-    _gc_replay_data: {
-        events: string[];
-    };
-    /**
-     * Indicates this batch starts with a full DOM snapshot.
-     * Full snapshots are taken at regular intervals to allow seeking directly to any point.
-     * Queryable for filtering/indexing purposes.
-     */
-    replay_is_full_snapshot?: boolean;
-    /**
-     * Timestamp when the full snapshot was taken (if replay_is_full_snapshot is true).
-     */
-    replay_full_snapshot_timestamp?: number;
-};
 
-type Event$1<T extends string, A> = Omit<BaseEvent<T>, "attributes"> & {
-    type: T;
-    attributes: A;
-};
-type EventTypes$1 = {
-    "dom.event": Event$1<"dom.event", DomEventAttributes>;
-    exception: Event$1<"exception", ErrorEventAttributes>;
-    network: Event$1<"network", NetworkEventAttributes>;
-    log: Event$1<"log", LogEventAttributes>;
-    pageload: Event$1<"pageload", PageLoadEventAttributes>;
-    navigation: Event$1<"navigation", NavigationEventAttributes>;
-    custom: Event$1<"custom", UserDefinedEventAttributes>;
-    performance: Event$1<"performance", PerformanceEventAttributes>;
-    replay: Event$1<"replay", ReplayEventAttributes>;
-};
 type PrivacyLevel = "mask-sensitive" | "mask-all" | "allow";
-/** The non-replay event surface a redactor field belongs to. */
+/** The event surface a redactor field belongs to. */
 type RedactKind = "request-body" | "response-body" | "query" | "header" | "log" | "error";
 interface RedactField {
     /** Immediate key of the value; `""` for whole-string fields (log/error message). */
@@ -228,23 +139,19 @@ interface PrivacyOptions$1 {
     /** Extra case-insensitive key substrings treated as sensitive, merged with the built-in patterns. */
     sensitiveKeys?: string[];
     /**
-     * Per-field custom redaction hook for non-replay events. Called on each leaf
+     * Per-field custom redaction hook for captured events. Called on each leaf
      * value during the redaction walk with the original typed value; see
      * {@link Redactor}. For arbitrary whole-event changes use `enrichEvent`.
      */
     redact?: Redactor;
-    /**
-     * Session-recording masking — replay is a platform feature (rrweb on the
-     * browser), so its masking surface is typed by the platform package: the
-     * browser SDK narrows this to `{ maskTextFn?, maskInputFn? }` over
-     * HTMLElement (see the browser package's `config/types.ts`). Core never
-     * reads it — it is resolved platform-side at record() time.
-     */
-    replay?: unknown;
 }
 /** Distributed-tracing header propagation for outgoing network requests. */
 interface TracingOptions {
-    /** Request URLs (prefix match) that receive injected tracing headers. */
+    /**
+     * Request URLs that receive injected tracing headers: whole-URL matches where
+     * only `*` is a wildcard. Which strings a pattern is matched against is the
+     * platform's (the browser adds a same-origin request's path).
+     */
     propagationUrls?: string[];
     /** Inbound header names to read/propagate onto traced requests. */
     propagationHeaders?: string[];
@@ -264,24 +171,23 @@ interface TransportOptions {
     batchSize?: number;
     /** Max ms a batch waits before flushing regardless of size (default 10000). */
     batchTimeout?: number;
-    /** Gzip-compress outgoing batches; offloaded to the Web Worker when available (default true). */
+    /** Gzip-compress outgoing batches; offloaded to the platform's async encoder when it has one (default true). */
     compression?: boolean;
 }
-interface SDKOptions$1<TEvent extends BaseEvent<string> = EventTypes$1[keyof EventTypes$1]> {
+interface SDKOptions$1<TEvent extends BaseEvent<string> = BaseEvent<string>> {
     /**
      * Which signal listeners to enable, by name. Empty array = all. The NAMES
      * are platform-defined (each platform ships its own listener set) — the
-     * platform package narrows this to its literal union (see the browser
-     * package's `config/types.ts`).
+     * platform package narrows this to its literal union.
      */
     enabledEvents: string[];
     sessionSampleRate: number;
     debug: boolean;
     excludedUrls?: Array<string | RegExp>;
-    beforeSend?: (event: TEvent) => boolean;
-    enrichEvent?: (event: TEvent) => TEvent;
+    beforeSend?(event: TEvent): boolean;
+    enrichEvent?(event: TEvent): TEvent;
     /**
-     * Unified privacy / data-masking config driving replay + non-replay masking.
+     * Unified privacy / data-masking config for every captured surface.
      * ON by default (`level: 'mask-sensitive'`); see {@link PrivacyOptions}.
      */
     privacy?: PrivacyOptions$1;
@@ -289,15 +195,9 @@ interface SDKOptions$1<TEvent extends BaseEvent<string> = EventTypes$1[keyof Eve
     tracing?: TracingOptions;
     /** Batching & delivery of outgoing events; see {@link TransportOptions}. */
     transport?: TransportOptions;
-    /**
-     * Session-recording controls — a platform feature slot core never reads.
-     * The platform package types it (the browser SDK narrows this to its
-     * rrweb `ReplayOptions`; platforms without recording ignore it).
-     */
-    replay?: unknown;
     /**
      * Target maximum wall-clock duration of a session, in ms. Enforced LAZILY on activity, so NOT
-     * a hard bound — an idle tab keeps its id past the cap, which deliberately avoids minting
+     * a hard bound — an idle session keeps its id past the cap, which deliberately avoids minting
      * phantom sessions. Also bounded by a 30-minute inactivity gap, counting raw input as
      * presence so passive reading does not end a session.
      *
@@ -305,7 +205,7 @@ interface SDKOptions$1<TEvent extends BaseEvent<string> = EventTypes$1[keyof Eve
      */
     sessionMaxDuration?: number;
 }
-interface SDKConfigInput$1<TEvent extends BaseEvent<string> = EventTypes$1[keyof EventTypes$1]> {
+interface SDKConfigInput$1<TEvent extends BaseEvent<string> = BaseEvent<string>> {
     apiKey: string;
     cluster: string;
     environment: string;
@@ -318,6 +218,76 @@ interface SDKConfigInput$1<TEvent extends BaseEvent<string> = EventTypes$1[keyof
     sessionId?: string;
 }
 
+type DomEventAttributes = {
+    dom_event_type: string;
+    dom_event_coordinates: {
+        clientX: number;
+        clientY: number;
+    };
+    dom_event_target: {
+        tagName: string;
+        id: string;
+        className: string;
+        text: string;
+        role: string;
+        accessibleName: string;
+        ariaLabel: string;
+        title: string;
+        alt: string;
+        placeholder: string;
+        name: string;
+        inputType: string;
+        href: string;
+    };
+    dom_event_selector: string;
+    dom_event_key_code: string;
+};
+type PageLoadEventAttributes = {
+    page_url: string;
+    page_resources: {
+        count: number;
+        totalSize: number;
+        totalDuration: number;
+        byType: {
+            [key: string]: {
+                count: number;
+                size: number;
+                duration: number;
+            };
+        };
+    };
+    page_referrer: string;
+    page_load_time: number;
+};
+type NavigationEventAttributes = {
+    page_url: string;
+    from_url?: string;
+    metadata?: Record<string, unknown>;
+    duration_ms: number;
+    start_timestamp: number;
+    end_timestamp: number;
+};
+type ReplayEventAttributes = {
+    /**
+     * Groundcover session replay payload.
+     *
+     * NOTE: This key is intentionally prefixed to avoid collisions with customer attributes.
+     */
+    _gc_replay_data: {
+        events: string[];
+    };
+    /**
+     * Indicates this batch starts with a full DOM snapshot.
+     * Full snapshots are taken at regular intervals to allow seeking directly to any point.
+     * Queryable for filtering/indexing purposes.
+     */
+    replay_is_full_snapshot?: boolean;
+    /**
+     * Timestamp when the full snapshot was taken (if replay_is_full_snapshot is true).
+     */
+    replay_full_snapshot_timestamp?: number;
+};
+
 /**
  * The view an event was captured on. Browser-owned: core has no notion of a
  * "current view" — it merges whatever the platform's `enrichAttributes`
@@ -377,13 +347,13 @@ interface ReplayMaskingOptions {
     /** rrweb `maskInputFn` pass-through. */
     maskInputFn?: (text: string, el: HTMLElement) => string;
 }
-interface PrivacyOptions extends Omit<PrivacyOptions$1, "replay"> {
+interface PrivacyOptions extends PrivacyOptions$1 {
     /** CSS selectors whose text/inputs are always masked (replay + DOM), regardless of `level` except `'allow'`. */
     maskSelectors?: string[];
     /** Session-recording (rrweb replay) masking — the only place replay can be masked. */
     replay?: ReplayMaskingOptions;
 }
-interface SDKOptions extends Omit<SDKOptions$1, "privacy" | "replay" | "enabledEvents" | "beforeSend" | "enrichEvent"> {
+interface SDKOptions extends Omit<SDKOptions$1, "privacy" | "enabledEvents" | "beforeSend" | "enrichEvent"> {
     /**
      * Inspect each event before it is queued; return false to drop it. Typed
      * over the BROWSER event map, so `attributes.location` is visible here.

package/dist/index.d.ts

@@ -1,14 +1,9 @@
-/**
- * The event kinds the browser SDK ships today. This is the DEFAULT vocabulary,
- * not the only permitted one — see `BaseEvent`.
- */
-type KnownEventType = "dom.event" | "exception" | "network" | "log" | "pageload" | "navigation" | "custom" | "performance" | "replay";
 /**
  * `TType` lets a platform name its own event kinds without editing core, and every core class
- * flows it through. Defaults to `KnownEventType`, so callers dealing only in browser kinds need
- * not spell it out. Shared shapes stay shared — the set of NAMES is open, not the envelope.
+ * flows it through. Defaults to `string`, because the set of NAMES is open — a platform that
+ * wants a closed union passes its own. Shared shapes stay shared; only the vocabulary is open.
  */
-type BaseEvent<TType extends string = KnownEventType> = {
+type BaseEvent<TType extends string = string> = {
     type: TType;
     timestamp?: number;
     end_timestamp?: number;
@@ -28,30 +23,6 @@ type UserIdentifiers = {
     organization: string;
     properties: Record<string, unknown>;
 };
-type DomEventAttributes = {
-    dom_event_type: string;
-    dom_event_coordinates: {
-        clientX: number;
-        clientY: number;
-    };
-    dom_event_target: {
-        tagName: string;
-        id: string;
-        className: string;
-        text: string;
-        role: string;
-        accessibleName: string;
-        ariaLabel: string;
-        title: string;
-        alt: string;
-        placeholder: string;
-        name: string;
-        inputType: string;
-        href: string;
-    };
-    dom_event_selector: string;
-    dom_event_key_code: string;
-};
 type NetworkEventAttributes = {
     type: "HTTP";
     resource_name: string;
@@ -114,31 +85,6 @@ type LogEventAttributes = {
     message: string;
     level: string;
 } & Record<string, unknown>;
-type PageLoadEventAttributes = {
-    page_url: string;
-    page_resources: {
-        count: number;
-        totalSize: number;
-        totalDuration: number;
-        byType: {
-            [key: string]: {
-                count: number;
-                size: number;
-                duration: number;
-            };
-        };
-    };
-    page_referrer: string;
-    page_load_time: number;
-};
-type NavigationEventAttributes = {
-    page_url: string;
-    from_url?: string;
-    metadata?: Record<string, unknown>;
-    duration_ms: number;
-    start_timestamp: number;
-    end_timestamp: number;
-};
 type UserDefinedEventAttributes = {
     custom_event_name: string;
     custom_event_attributes?: Record<string, unknown>;
@@ -149,44 +95,9 @@ type PerformanceEventAttributes = {
     performance_metric_id: string;
     performance_metric_navigation_type: string;
 };
-type ReplayEventAttributes = {
-    /**
-     * Groundcover session replay payload.
-     *
-     * NOTE: This key is intentionally prefixed to avoid collisions with customer attributes.
-     */
-    _gc_replay_data: {
-        events: string[];
-    };
-    /**
-     * Indicates this batch starts with a full DOM snapshot.
-     * Full snapshots are taken at regular intervals to allow seeking directly to any point.
-     * Queryable for filtering/indexing purposes.
-     */
-    replay_is_full_snapshot?: boolean;
-    /**
-     * Timestamp when the full snapshot was taken (if replay_is_full_snapshot is true).
-     */
-    replay_full_snapshot_timestamp?: number;
-};
 
-type Event$1<T extends string, A> = Omit<BaseEvent<T>, "attributes"> & {
-    type: T;
-    attributes: A;
-};
-type EventTypes$1 = {
-    "dom.event": Event$1<"dom.event", DomEventAttributes>;
-    exception: Event$1<"exception", ErrorEventAttributes>;
-    network: Event$1<"network", NetworkEventAttributes>;
-    log: Event$1<"log", LogEventAttributes>;
-    pageload: Event$1<"pageload", PageLoadEventAttributes>;
-    navigation: Event$1<"navigation", NavigationEventAttributes>;
-    custom: Event$1<"custom", UserDefinedEventAttributes>;
-    performance: Event$1<"performance", PerformanceEventAttributes>;
-    replay: Event$1<"replay", ReplayEventAttributes>;
-};
 type PrivacyLevel = "mask-sensitive" | "mask-all" | "allow";
-/** The non-replay event surface a redactor field belongs to. */
+/** The event surface a redactor field belongs to. */
 type RedactKind = "request-body" | "response-body" | "query" | "header" | "log" | "error";
 interface RedactField {
     /** Immediate key of the value; `""` for whole-string fields (log/error message). */
@@ -228,23 +139,19 @@ interface PrivacyOptions$1 {
     /** Extra case-insensitive key substrings treated as sensitive, merged with the built-in patterns. */
     sensitiveKeys?: string[];
     /**
-     * Per-field custom redaction hook for non-replay events. Called on each leaf
+     * Per-field custom redaction hook for captured events. Called on each leaf
      * value during the redaction walk with the original typed value; see
      * {@link Redactor}. For arbitrary whole-event changes use `enrichEvent`.
      */
     redact?: Redactor;
-    /**
-     * Session-recording masking — replay is a platform feature (rrweb on the
-     * browser), so its masking surface is typed by the platform package: the
-     * browser SDK narrows this to `{ maskTextFn?, maskInputFn? }` over
-     * HTMLElement (see the browser package's `config/types.ts`). Core never
-     * reads it — it is resolved platform-side at record() time.
-     */
-    replay?: unknown;
 }
 /** Distributed-tracing header propagation for outgoing network requests. */
 interface TracingOptions {
-    /** Request URLs (prefix match) that receive injected tracing headers. */
+    /**
+     * Request URLs that receive injected tracing headers: whole-URL matches where
+     * only `*` is a wildcard. Which strings a pattern is matched against is the
+     * platform's (the browser adds a same-origin request's path).
+     */
     propagationUrls?: string[];
     /** Inbound header names to read/propagate onto traced requests. */
     propagationHeaders?: string[];
@@ -264,24 +171,23 @@ interface TransportOptions {
     batchSize?: number;
     /** Max ms a batch waits before flushing regardless of size (default 10000). */
     batchTimeout?: number;
-    /** Gzip-compress outgoing batches; offloaded to the Web Worker when available (default true). */
+    /** Gzip-compress outgoing batches; offloaded to the platform's async encoder when it has one (default true). */
     compression?: boolean;
 }
-interface SDKOptions$1<TEvent extends BaseEvent<string> = EventTypes$1[keyof EventTypes$1]> {
+interface SDKOptions$1<TEvent extends BaseEvent<string> = BaseEvent<string>> {
     /**
      * Which signal listeners to enable, by name. Empty array = all. The NAMES
      * are platform-defined (each platform ships its own listener set) — the
-     * platform package narrows this to its literal union (see the browser
-     * package's `config/types.ts`).
+     * platform package narrows this to its literal union.
      */
     enabledEvents: string[];
     sessionSampleRate: number;
     debug: boolean;
     excludedUrls?: Array<string | RegExp>;
-    beforeSend?: (event: TEvent) => boolean;
-    enrichEvent?: (event: TEvent) => TEvent;
+    beforeSend?(event: TEvent): boolean;
+    enrichEvent?(event: TEvent): TEvent;
     /**
-     * Unified privacy / data-masking config driving replay + non-replay masking.
+     * Unified privacy / data-masking config for every captured surface.
      * ON by default (`level: 'mask-sensitive'`); see {@link PrivacyOptions}.
      */
     privacy?: PrivacyOptions$1;
@@ -289,15 +195,9 @@ interface SDKOptions$1<TEvent extends BaseEvent<string> = EventTypes$1[keyof Eve
     tracing?: TracingOptions;
     /** Batching & delivery of outgoing events; see {@link TransportOptions}. */
     transport?: TransportOptions;
-    /**
-     * Session-recording controls — a platform feature slot core never reads.
-     * The platform package types it (the browser SDK narrows this to its
-     * rrweb `ReplayOptions`; platforms without recording ignore it).
-     */
-    replay?: unknown;
     /**
      * Target maximum wall-clock duration of a session, in ms. Enforced LAZILY on activity, so NOT
-     * a hard bound — an idle tab keeps its id past the cap, which deliberately avoids minting
+     * a hard bound — an idle session keeps its id past the cap, which deliberately avoids minting
      * phantom sessions. Also bounded by a 30-minute inactivity gap, counting raw input as
      * presence so passive reading does not end a session.
      *
@@ -305,7 +205,7 @@ interface SDKOptions$1<TEvent extends BaseEvent<string> = EventTypes$1[keyof Eve
      */
     sessionMaxDuration?: number;
 }
-interface SDKConfigInput$1<TEvent extends BaseEvent<string> = EventTypes$1[keyof EventTypes$1]> {
+interface SDKConfigInput$1<TEvent extends BaseEvent<string> = BaseEvent<string>> {
     apiKey: string;
     cluster: string;
     environment: string;
@@ -318,6 +218,76 @@ interface SDKConfigInput$1<TEvent extends BaseEvent<string> = EventTypes$1[keyof
     sessionId?: string;
 }
 
+type DomEventAttributes = {
+    dom_event_type: string;
+    dom_event_coordinates: {
+        clientX: number;
+        clientY: number;
+    };
+    dom_event_target: {
+        tagName: string;
+        id: string;
+        className: string;
+        text: string;
+        role: string;
+        accessibleName: string;
+        ariaLabel: string;
+        title: string;
+        alt: string;
+        placeholder: string;
+        name: string;
+        inputType: string;
+        href: string;
+    };
+    dom_event_selector: string;
+    dom_event_key_code: string;
+};
+type PageLoadEventAttributes = {
+    page_url: string;
+    page_resources: {
+        count: number;
+        totalSize: number;
+        totalDuration: number;
+        byType: {
+            [key: string]: {
+                count: number;
+                size: number;
+                duration: number;
+            };
+        };
+    };
+    page_referrer: string;
+    page_load_time: number;
+};
+type NavigationEventAttributes = {
+    page_url: string;
+    from_url?: string;
+    metadata?: Record<string, unknown>;
+    duration_ms: number;
+    start_timestamp: number;
+    end_timestamp: number;
+};
+type ReplayEventAttributes = {
+    /**
+     * Groundcover session replay payload.
+     *
+     * NOTE: This key is intentionally prefixed to avoid collisions with customer attributes.
+     */
+    _gc_replay_data: {
+        events: string[];
+    };
+    /**
+     * Indicates this batch starts with a full DOM snapshot.
+     * Full snapshots are taken at regular intervals to allow seeking directly to any point.
+     * Queryable for filtering/indexing purposes.
+     */
+    replay_is_full_snapshot?: boolean;
+    /**
+     * Timestamp when the full snapshot was taken (if replay_is_full_snapshot is true).
+     */
+    replay_full_snapshot_timestamp?: number;
+};
+
 /**
  * The view an event was captured on. Browser-owned: core has no notion of a
  * "current view" — it merges whatever the platform's `enrichAttributes`
@@ -377,13 +347,13 @@ interface ReplayMaskingOptions {
     /** rrweb `maskInputFn` pass-through. */
     maskInputFn?: (text: string, el: HTMLElement) => string;
 }
-interface PrivacyOptions extends Omit<PrivacyOptions$1, "replay"> {
+interface PrivacyOptions extends PrivacyOptions$1 {
     /** CSS selectors whose text/inputs are always masked (replay + DOM), regardless of `level` except `'allow'`. */
     maskSelectors?: string[];
     /** Session-recording (rrweb replay) masking — the only place replay can be masked. */
     replay?: ReplayMaskingOptions;
 }
-interface SDKOptions extends Omit<SDKOptions$1, "privacy" | "replay" | "enabledEvents" | "beforeSend" | "enrichEvent"> {
+interface SDKOptions extends Omit<SDKOptions$1, "privacy" | "enabledEvents" | "beforeSend" | "enrichEvent"> {
     /**
      * Inspect each event before it is queued; return false to drop it. Typed
      * over the BROWSER event map, so `attributes.location` is visible here.