@hanzo/event 0.3.23 → 0.3.25

package/hz.js

@@ -55,7 +55,7 @@
   }
 
   var LIB = 'hz.js'
-  var VERSION = '0.3.23'
+  var VERSION = '0.3.25'
   var host = (s.getAttribute('data-host') || 'https://api.hanzo.ai').replace(/\/+$/, '')
   var product = s.getAttribute('data-product') || location.hostname
   var capture = s.getAttribute('data-capture') !== '0'
@@ -288,12 +288,17 @@ function hzAnonId() {
     // same pair core.ts uses, so the door cannot tell the distributions apart:
     // a headerless sendBeacon puts it in the query, a fetch puts it in the
     // Authorization header.
+    //
+    // The beacon body is text/plain because that type is CORS-safelisted, which
+    // makes the POST a SIMPLE request: no preflight, and an unloading document
+    // gets no second round trip. The door reads the raw body and dispatches on
+    // its first non-space byte, so the type names the CORS class and nothing else.
     try {
       if (
         navigator.sendBeacon &&
         navigator.sendBeacon(
           key ? url + '?ingest_key=' + encodeURIComponent(key) : url,
-          new Blob([body], { type: 'application/json' }),
+          new Blob([body], { type: 'text/plain' }),
         )
       )
         return
@@ -466,11 +471,25 @@ function hzAnonId() {
       })
     }).observe({ type: 'layout-shift', buffered: true })
   } catch (e) {}
-  addEventListener('visibilitychange', function () {
-    if (document.visibilityState !== 'hidden') return
-    if (vitals.lcp != null || vitals.cls != null) send('event', '$vitals', vitals)
+  // A document can be taken away on either signal, and neither one alone covers
+  // every browser: visibilitychange is what fires when a tab is backgrounded or
+  // discarded, pagehide is what fires on the navigation path where it does not.
+  // core.ts listens for both; this listens for both. flush() returns on an empty
+  // queue, so whichever arrives second finds nothing left to send.
+  var vitalsSent = false
+  function leaving() {
+    // The web vitals are one measurement of one page view. Hiding a tab twice
+    // does not make two of them.
+    if (!vitalsSent && (vitals.lcp != null || vitals.cls != null)) {
+      vitalsSent = true
+      send('event', '$vitals', vitals)
+    }
     flush()
+  }
+  addEventListener('visibilitychange', function () {
+    if (document.visibilityState === 'hidden') leaving()
   })
+  addEventListener('pagehide', leaving)
 
   // ── public API (manual funnel/identify) + GA/Meta fan-out ─────────────────
   function assign(a, b) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hanzo/event",
-  "version": "0.3.23",
-  "description": "Hanzo Event — the ONE telemetry client. Emits pageview/event/identify/group to the Hanzo Cloud event stream (POST /v1/event), AND reports errors to Sentry as real Sentry envelopes — the error plane needs a DSN, without one nothing reaches Sentry. First-touch attribution, beacon-on-unload, auto error capture, client-side secret/PII scrubbing, a shared event + goal vocabulary. Subsumes @sentry.",
+  "version": "0.3.25",
+  "description": "Hanzo Event \u2014 the ONE telemetry client. Emits pageview/event/identify/group to the Hanzo Cloud event stream (POST /v1/event), AND reports errors to Sentry as real Sentry envelopes \u2014 the error plane needs a DSN, without one nothing reaches Sentry. First-touch attribution, beacon-on-unload, auto error capture, client-side secret/PII scrubbing, a shared event + goal vocabulary. Subsumes @sentry.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public",
@@ -37,6 +37,13 @@
     "funnel",
     "hanzo"
   ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist"
+  },
   "exports": {
     ".": {
       "import": {
@@ -77,12 +84,5 @@
   },
   "dependencies": {
     "@hanzo/events": "^0.2.1"
-  },
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit",
-    "clean": "rm -rf dist"
   }
-}
+}

package/src/core.ts

@@ -81,6 +81,13 @@ export { VERSION }
 const EVENT_PATH = '/v1/event' // the ONE canonical ingestion front door
 const DEFAULT_HOST = 'https://api.hanzo.ai' // the one edge; cookie apps pass host:''
 const ENVELOPE_CONTENT_TYPE = 'application/x-sentry-envelope'
+// The beacon body's type. text/plain is CORS-SAFELISTED, which is the whole
+// property: a safelisted type makes the POST a SIMPLE request, and a simple
+// request needs no preflight. An unloading document does not get a second round
+// trip, so cross-origin a preflighted beacon is never sent at all. The door reads
+// the raw body and dispatches on its first non-space byte, so the type names the
+// CORS class and nothing else.
+const BEACON_CONTENT_TYPE = 'text/plain'
 
 /** readEnvDsn resolves a DSN from the public env when config omits one, so an app
  *  gets the error plane by setting ONE build-time variable and nothing else.
@@ -165,7 +172,12 @@ function serializeBatch(batch: WireEvent[]): string | null {
 /** DefaultTransport: fetch(keepalive) for authenticated/normal sends;
  *  navigator.sendBeacon for headerless page-unload beacons. A bearer (a JWT or a
  *  publishable pk_ key) rides Authorization on fetch; on a beacon — which cannot
- *  set headers — a publishable key rides the ?ingest_key query instead. */
+ *  set headers — a publishable key rides the ?ingest_key query instead.
+ *
+ *  `contentType` names the FETCH request's Content-Type (the error plane sets the
+ *  envelope type there). The beacon body is always BEACON_CONTENT_TYPE: its type
+ *  is a CORS class, not a payload description, and a beacon that is not a simple
+ *  request is a beacon that is never sent. */
 class DefaultTransport implements Transport {
   send(
     url: string,
@@ -178,18 +190,26 @@ class DefaultTransport implements Transport {
       debug?: boolean
     },
   ): void {
-    const contentType = opts.contentType ?? 'application/json'
     if (opts.beacon && isBrowser() && typeof navigator.sendBeacon === 'function') {
       const beaconUrl = opts.ingestKey ? appendQuery(url, 'ingest_key', opts.ingestKey) : url
       try {
-        navigator.sendBeacon(beaconUrl, new Blob([body], { type: contentType }))
-        return
+        // The answer is whether the agent QUEUED the batch — false for a body past
+        // the beacon size limit, or a full queue. Only a queued batch ends the
+        // send; a refused one falls through to the keepalive fetch below.
+        const queued = navigator.sendBeacon(
+          beaconUrl,
+          new Blob([body], { type: BEACON_CONTENT_TYPE }),
+        )
+        if (queued) return
+        if (opts.debug) console.warn('[event] beacon refused, falling back to fetch')
       } catch {
         /* fall through to fetch */
       }
     }
     if (typeof fetch !== 'function') return
-    const headers: Record<string, string> = { 'Content-Type': contentType }
+    const headers: Record<string, string> = {
+      'Content-Type': opts.contentType ?? 'application/json',
+    }
     const bearer = opts.ingestKey ?? opts.token
     if (bearer) headers.Authorization = `Bearer ${bearer}`
     void fetch(url, {

package/src/hz.test.ts

@@ -27,14 +27,27 @@ interface WireEvent {
   libraryVersion: string
 }
 
-/** One recorded transmission: which transport carried it, where, under what headers. */
+/** One recorded transmission: which transport carried it, where, under what headers
+ *  and — the fact that decides whether a cross-origin unload beacon is sent at all
+ *  — the content type its body was labelled with. */
 interface Post {
   via: 'beacon' | 'fetch'
   url: string
   headers: Record<string, string>
+  contentType: string
   batch: WireEvent[]
 }
 
+// The three CORS-safelisted request content types. A POST whose body carries one
+// is a SIMPLE request and goes immediately; anything else is PREFLIGHTED, and an
+// unloading document never gets the preflight's second round trip. This tag runs
+// on a customer's own domain, so its beacon is always cross-origin.
+const CORS_SAFELISTED = new Set([
+  'text/plain',
+  'application/x-www-form-urlencoded',
+  'multipart/form-data',
+])
+
 interface StubOptions {
   /** data-* attributes on the <script> tag. */
   attrs?: Record<string, string>
@@ -62,8 +75,11 @@ function runSnippet(opts: StubOptions = {}): {
   api: Api | undefined
   local: Map<string, string>
   jar: Map<string, string>
+  fire: (type: string) => void
+  hide: () => void
 } {
   const posts: Post[] = []
+  const listeners = new Map<string, (() => void)[]>()
   const local = new Map<string, string>(Object.entries(opts.storage ?? {}))
   const jar = opts.jar ?? new Map<string, string>()
   const store = (m: Map<string, string>) => ({
@@ -106,8 +122,14 @@ function runSnippet(opts: StubOptions = {}): {
     doNotTrack: '0',
     ...opts.navigator,
     sendBeacon: opts.beacon
-      ? (url: string, blob: { body: string }) => {
-          posts.push({ via: 'beacon', url, headers: {}, batch: JSON.parse(blob.body).batch })
+      ? (url: string, blob: { body: string; type: string }) => {
+          posts.push({
+            via: 'beacon',
+            url,
+            headers: {},
+            contentType: blob.type,
+            batch: JSON.parse(blob.body).batch,
+          })
           return true
         }
       : undefined,
@@ -116,15 +138,23 @@ function runSnippet(opts: StubOptions = {}): {
     'Blob',
     class {
       body: string
-      constructor(parts: string[]) {
+      type: string
+      constructor(parts: string[], opts?: { type?: string }) {
         this.body = parts.join('')
+        this.type = opts?.type ?? ''
       }
     },
   )
   define('localStorage', store(local))
   define('sessionStorage', store(new Map()))
   define('history', { pushState: () => {}, replaceState: () => {} })
-  define('addEventListener', () => {})
+  // Listeners are kept, not discarded: the unload flush IS a listener, so a stub
+  // that drops them leaves the only path the drop-off signal travels unexecuted.
+  define('addEventListener', (type: string, fn: () => void) => {
+    const seen = listeners.get(type)
+    if (seen) seen.push(fn)
+    else listeners.set(type, [fn])
+  })
   define('PerformanceObserver', undefined)
   define('hzDNT', undefined)
   define('doNotTrack', undefined)
@@ -133,13 +163,28 @@ function runSnippet(opts: StubOptions = {}): {
   // "the previous run's API answered".
   define('hanzo', undefined)
   define('fetch', (url: string, init: { body: string; headers: Record<string, string> }) => {
-    posts.push({ via: 'fetch', url, headers: init.headers, batch: JSON.parse(init.body).batch })
+    posts.push({
+      via: 'fetch',
+      url,
+      headers: init.headers,
+      contentType: init.headers['content-type'] ?? '',
+      batch: JSON.parse(init.body).batch,
+    })
     return Promise.resolve()
   })
   define('window', g)
 
   new Function(SRC)()
-  return { posts, api: (g.window as { hanzo?: Api }).hanzo, local, jar }
+  /** Raise an event the page would raise, so its listeners actually run. */
+  const fire = (type: string) => {
+    for (const fn of listeners.get(type) ?? []) fn()
+  }
+  /** Hide the document, as a browser does before it takes one away. */
+  const hide = () => {
+    ;(g.document as { visibilityState: string }).visibilityState = 'hidden'
+    fire('visibilitychange')
+  }
+  return { posts, api: (g.window as { hanzo?: Api }).hanzo, local, jar, fire, hide }
 }
 
 /** Every event across every transmission, in order. */
@@ -151,6 +196,29 @@ describe('hz.js', () => {
     run = runSnippet()
   })
 
+  // A visitor who leaves mid-funnel is the drop-off signal, and hz.js only gets
+  // to report it from a teardown listener. Neither signal fires in every browser
+  // on every path, so the tag listens for both.
+  it('flushes what is queued when the tab is hidden', () => {
+    run.api!.track('plan_clicked')
+    run.hide()
+    expect(sentOf(run).map((e) => e.event)).toContain('plan_clicked')
+  })
+
+  it('flushes what is queued on pagehide, which visibilitychange need not precede', () => {
+    run.api!.track('checkout_started')
+    run.fire('pagehide')
+    expect(sentOf(run).map((e) => e.event)).toContain('checkout_started')
+  })
+
+  it('sends nothing a second time when both teardown signals arrive', () => {
+    run.api!.track('plan_clicked')
+    run.hide()
+    run.fire('pagehide')
+    const clicks = sentOf(run).filter((e) => e.event === 'plan_clicked')
+    expect(clicks).toHaveLength(1)
+  })
+
   it('mints session ids the plane admits', () => {
     run.api!.track('checkout_started')
     run.api!.flush()
@@ -247,6 +315,19 @@ describe('hz.js', () => {
     expect(post.url).toBe('https://api.hanzo.ai/v1/event?ingest_key=pk-abc123')
   })
 
+  it('labels the beacon body a CORS-simple type, so the unload POST is sent', () => {
+    // The tag is installed on a customer's own domain, so every send here is
+    // cross-origin. A non-safelisted body type preflights, and an unloading
+    // document gets no second round trip — the batch would simply never leave.
+    // The credential is in the query for the same reason: a beacon sets no
+    // headers, and an Authorization header preflights whatever the type is.
+    const r = runSnippet({ attrs: { 'data-ingest-key': 'pk-abc123' }, beacon: true })
+    r.api!.flush()
+    const post = r.posts.at(-1)!
+    expect(post.via).toBe('beacon')
+    expect(CORS_SAFELISTED.has(post.contentType)).toBe(true)
+  })
+
   it('sends no credential when no key is declared — no baked literal', () => {
     // The key is the surface's own, stamped into the tag by its deploy from KMS;
     // a bare tag carries nothing, so it is honestly keyless rather than borrowing

package/src/stack.ts

@@ -0,0 +1,144 @@
+// Pure error parsing: coerce an unknown throwable into {name, message, stack},
+// and parse a browser stack string into structured frames. No I/O, no globals —
+// core.ts wires these to identity and transport.
+//
+// These frames ride the error Event to POST /v1/event so the warehouse stores
+// WHERE a crash happened, not just that one did. Nothing here talks to Sentry:
+// the client has one door and one credential. The frame shape is deliberately the
+// conventional one (function/filename/abs_path/lineno/colno/in_app) because it is
+// what every stack tool already speaks — including a future grouper built over
+// the warehouse.
+
+/** Max frames kept — well under the server's cap, plenty to identify a crash. */
+const MAX_FRAMES = 50
+/** Max stack lines examined, and max length of a line worth examining. Guards the
+ *  frame regexes against a hostile `stack` string (see framesFromStack). */
+const MAX_LINES = 500
+const MAX_LINE_LEN = 2048
+
+/** One parsed stack frame. */
+export interface Frame {
+  filename?: string
+  function?: string
+  abs_path?: string
+  lineno?: number
+  colno?: number
+  /** The app's own code, as opposed to vendor/runtime — the useful default filter. */
+  in_app?: boolean
+}
+
+const V8_FRAME = /^\s*at\s+(?:(.+?)\s+\()?(?:(.+?):(\d+):(\d+)|([^)]+))\)?\s*$/
+const MOZ_FRAME = /^\s*(?:(.*?)@)?(.+?):(\d+):(\d+)\s*$/
+
+/** inApp marks a frame as the app's own code (vs vendor/runtime). */
+function inApp(file: string): boolean {
+  if (!file) return false
+  return !(
+    file.includes('node_modules') ||
+    file.startsWith('webpack-internal') ||
+    file.startsWith('webpack://') ||
+    file.startsWith('chrome-extension://') ||
+    file.startsWith('moz-extension://')
+  )
+}
+
+/**
+ * framesFromStack parses a browser Error.stack into frames, OLDEST-FIRST (caller
+ * → callee, so the crash site is LAST). Handles both V8 ("at fn (file:li:co)")
+ * and Firefox/Safari ("fn@file:li:co"). Unparseable lines are skipped.
+ */
+export function framesFromStack(stack: string | undefined): Frame[] {
+  if (!stack) return []
+  // Both frame regexes use lazy nested quantifiers, which backtrack badly on a
+  // long line that never matches. A stack is attacker-influenced (a thrown value
+  // can carry any `stack` string), so bound the work: skip absurd lines and stop
+  // after MAX_LINES. Only the innermost MAX_FRAMES are kept anyway.
+  const lines = stack.split('\n', MAX_LINES)
+  const frames: Frame[] = []
+  for (const raw of lines) {
+    if (raw.length > MAX_LINE_LEN) continue
+    const line = raw.trimEnd()
+    if (!line) continue
+    // Header lines like "TypeError: x is not a function" match neither frame
+    // regex (no "at " prefix, no trailing :line:col) and are skipped naturally.
+    let fn: string | undefined
+    let file = ''
+    let lineno = 0
+    let colno = 0
+    const v = V8_FRAME.exec(line)
+    if (v) {
+      fn = v[1]
+      if (v[2]) {
+        file = v[2]
+        lineno = Number(v[3]) || 0
+        colno = Number(v[4]) || 0
+      } else {
+        file = (v[5] || '').trim()
+      }
+    } else {
+      const f = MOZ_FRAME.exec(line)
+      if (!f) continue
+      fn = f[1]
+      file = f[2]
+      lineno = Number(f[3]) || 0
+      colno = Number(f[4]) || 0
+    }
+    if (!file && !fn) continue
+    frames.push({
+      function: fn || '<anonymous>',
+      filename: file,
+      abs_path: file,
+      lineno,
+      colno,
+      in_app: inApp(file),
+    })
+  }
+  // Reverse to oldest-first and cap to the innermost MAX_FRAMES.
+  frames.reverse()
+  if (frames.length > MAX_FRAMES) return frames.slice(frames.length - MAX_FRAMES)
+  return frames
+}
+
+/** read pulls a property off a value that may be hostile — `name`, `message` and
+ *  `stack` are ordinary getters that a thrown object is free to define as
+ *  throwing. The thrown value is the least trustworthy input this library
+ *  handles; losing the whole report to one of them is not acceptable. */
+function read(o: unknown, k: string): unknown {
+  try {
+    return (o as Record<string, unknown>)[k]
+  } catch {
+    return undefined
+  }
+}
+
+/** str coerces to a string without letting a throwing toString/Symbol.toPrimitive
+ *  escape. */
+function str(v: unknown): string {
+  try {
+    return String(v)
+  } catch {
+    return '[unstringifiable]'
+  }
+}
+
+/** normalizeError coerces an unknown throwable into {name, message, stack}.
+ *  TOTAL: it returns a usable record for ANY input, including an object
+ *  engineered to throw on property access. */
+export function normalizeError(err: unknown): { name: string; message: string; stack?: string } {
+  if (err instanceof Error) {
+    const name = read(err, 'name')
+    const message = read(err, 'message')
+    const stack = read(err, 'stack')
+    return {
+      name: typeof name === 'string' && name ? name : 'Error',
+      message: typeof message === 'string' && message ? message : str(err),
+      stack: typeof stack === 'string' ? stack : undefined,
+    }
+  }
+  if (typeof err === 'string') return { name: 'Error', message: err }
+  try {
+    return { name: 'Error', message: JSON.stringify(err) ?? str(err) }
+  } catch {
+    return { name: 'Error', message: str(err) }
+  }
+}

package/src/transport.test.ts

@@ -0,0 +1,139 @@
+// The DEFAULT transport — what every surface that does not supply its own gets,
+// exercised through the real `Analytics` rather than a stub, because the two
+// properties below are properties of the shipped object and nothing else.
+//
+// Both are invisible to a test that reads the batch: the body is identical either
+// way. What decides whether the batch ARRIVES is the beacon's content type (which
+// decides whether the browser sends it at all) and what the code does with
+// sendBeacon's answer (which decides whether a refusal is retried or dropped).
+
+import { describe, it, expect } from 'vitest'
+import { Analytics } from './core'
+
+/** One thing navigator.sendBeacon was handed. */
+interface Beaconed {
+  url: string
+  type: string
+  body: string
+}
+
+/** One thing fetch was handed. */
+interface Fetched {
+  url: string
+  headers: Record<string, string>
+  body: string
+  /** Whether the request may outlive the document that made it. A fetch without
+   *  it is cancelled on teardown, which is the whole failure this file guards. */
+  keepalive?: boolean
+}
+
+// The three CORS-safelisted request content types. A POST whose body carries one
+// of these is a SIMPLE request and is sent immediately; anything else is
+// PREFLIGHTED, and an unloading document never gets the preflight's second round
+// trip — so cross-origin, a non-safelisted beacon is not delayed, it is lost.
+const CORS_SAFELISTED = new Set([
+  'text/plain',
+  'application/x-www-form-urlencoded',
+  'multipart/form-data',
+])
+
+/** Runs ONE unload flush of the real DefaultTransport against a stub browser.
+ *  `queued` is what navigator.sendBeacon answers — true when the agent accepts the
+ *  batch, false when it refuses (a body past the beacon size limit, or a full
+ *  queue). Globals are DEFINED and restored: Node ships a real `navigator` whose
+ *  descriptor has no setter, so a plain assignment throws. */
+function unloadFlush(queued: boolean): { beacons: Beaconed[]; fetches: Fetched[] } {
+  const beacons: Beaconed[] = []
+  const fetches: Fetched[] = []
+  const g = globalThis as Record<string, unknown>
+  const names = ['window', 'document', 'navigator', 'Blob', 'fetch']
+  const saved = names.map((n) => [n, Object.getOwnPropertyDescriptor(g, n)] as const)
+  const define = (name: string, value: unknown) =>
+    Object.defineProperty(g, name, { value, configurable: true, writable: true })
+
+  define('window', {
+    location: { href: 'https://acme.test/checkout', pathname: '/checkout', search: '' },
+    addEventListener: () => {},
+  })
+  define('document', { referrer: '', visibilityState: 'visible' })
+  define('navigator', {
+    sendBeacon: (url: string, blob: { type: string; body: string }) => {
+      beacons.push({ url, type: blob.type, body: blob.body })
+      return queued
+    },
+  })
+  define(
+    'Blob',
+    class {
+      type: string
+      body: string
+      constructor(parts: string[], opts?: { type?: string }) {
+        this.body = parts.join('')
+        this.type = opts?.type ?? ''
+      }
+    },
+  )
+  define(
+    'fetch',
+    (
+      url: string,
+      init: { headers: Record<string, string>; body: string; keepalive?: boolean },
+    ) => {
+      fetches.push({ url, headers: init.headers, body: init.body, keepalive: init.keepalive })
+      return Promise.resolve({ ok: true, status: 200 })
+    },
+  )
+
+  try {
+    // No `transport`, so the client builds the real DefaultTransport. The key is
+    // explicit rather than inherited from the build env, so the assertions below
+    // are about this batch and not about the machine running them.
+    const a = new Analytics({ product: 'test', ingestKey: 'pk-abc123', captureErrors: false })
+    a.capture('checkout_started')
+    a.flush(true)
+  } finally {
+    for (const [n, d] of saved) {
+      if (d) Object.defineProperty(g, n, d)
+      else delete g[n]
+    }
+  }
+  return { beacons, fetches }
+}
+
+describe('the unload beacon', () => {
+  it('is a CORS-simple request, so an unloading document actually sends it', () => {
+    const { beacons, fetches } = unloadFlush(true)
+    expect(beacons).toHaveLength(1)
+
+    // The load-bearing assertion. A non-safelisted type preflights, and there is
+    // no second round trip during unload.
+    expect(CORS_SAFELISTED.has(beacons[0].type)).toBe(true)
+
+    // The other half of what makes it simple: a beacon can set no headers, so the
+    // credential rides the query. An Authorization header would preflight whatever
+    // the body's type is.
+    expect(beacons[0].url).toBe('https://api.hanzo.ai/v1/event?ingest_key=pk-abc123')
+
+    // A queued batch is sent ONCE. Falling through here would double-count every
+    // unload event in the warehouse.
+    expect(fetches).toHaveLength(0)
+  })
+
+  it('falls through to the keepalive fetch when the agent refuses to queue it', () => {
+    const { beacons, fetches } = unloadFlush(false)
+
+    // Offered to the beacon first...
+    expect(beacons).toHaveLength(1)
+
+    // ...and, refused, carried by the fetch sitting behind it rather than dropped.
+    expect(fetches).toHaveLength(1)
+    const batch = (JSON.parse(fetches[0].body) as { batch: { event?: string }[] }).batch
+    expect(batch.map((e) => e.event)).toContain('checkout_started')
+    expect(fetches[0].headers.Authorization).toBe('Bearer pk-abc123')
+
+    // The fallback is only a fallback if it survives the teardown that the beacon
+    // was there for. Without this the batch is cancelled mid-flight and the
+    // refusal was merely traded for a quieter loss.
+    expect(fetches[0].keepalive).toBe(true)
+  })
+})

package/src/types.ts

@@ -139,8 +139,10 @@ export interface WireEvent {
  *  ?ingest_key query. */
 export interface Transport {
   /** Durable POST usable during page unload (fetch keepalive / sendBeacon).
-   *  `contentType` defaults to application/json; the error plane overrides it with
-   *  application/x-sentry-envelope. */
+   *  `contentType` names the FETCH request's Content-Type — it defaults to
+   *  application/json, and the error plane sets application/x-sentry-envelope. A
+   *  beacon body carries a CORS-safelisted type so the POST stays a simple request;
+   *  that is a property of the transport, not a caller's choice. */
   send(
     url: string,
     body: string,

package/src/version.ts

@@ -1,4 +1,4 @@
 // The library version, stamped on every event (`libraryVersion`) and on the
 // Sentry `sdk` block. It lives alone so `sentry.ts` can read it without importing
 // `core.ts` — core imports sentry, so the reverse would be an import cycle.
-export const VERSION = '0.3.23'
+export const VERSION = '0.3.25'

package/LICENSE.md

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2023 hanzo
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.