@hexclave/js 1.0.26 → 1.0.28

package/dist/lib/hexclave-app/apps/implementations/session-replay.test.js

@@ -56,20 +56,24 @@ let _hexclave_shared_dist_known_errors = require("@hexclave/shared/dist/known-er
 		}, {});
 		const warnSpy = vitest.vi.spyOn(console, "warn").mockImplementation(() => {});
 		try {
-			recorder._events = [{
+			const event1 = {
 				type: 2,
 				timestamp: Date.now(),
 				data: {}
-			}];
+			};
+			recorder._events = [event1];
+			recorder._eventSizes = [JSON.stringify(event1).length];
 			recorder._tick();
 			await vitest.vi.advanceTimersByTimeAsync(0);
 			(0, vitest.expect)(sentBodies).toHaveLength(1);
 			(0, vitest.expect)(warnSpy).not.toHaveBeenCalled();
-			recorder._events = [{
+			const event2 = {
 				type: 3,
 				timestamp: Date.now(),
 				data: {}
-			}];
+			};
+			recorder._events = [event2];
+			recorder._eventSizes = [JSON.stringify(event2).length];
 			recorder._tick();
 			await vitest.vi.advanceTimersByTimeAsync(0);
 			(0, vitest.expect)(sentBodies).toHaveLength(2);
@@ -81,6 +85,87 @@ let _hexclave_shared_dist_known_errors = require("@hexclave/shared/dist/known-er
 			vitest.vi.useRealTimers();
 		}
 	});
+	(0, vitest.it)("splits large batches into multiple requests to stay under server 1MB limit", async () => {
+		vitest.vi.useFakeTimers();
+		const storageKey = `hexclave:session-replay:v1:test-project`;
+		localStorage.setItem(storageKey, JSON.stringify({
+			session_id: "test-session",
+			created_at_ms: Date.now(),
+			last_activity_ms: Date.now()
+		}));
+		const sentBodies = [];
+		const recorder = new __session_replay_js.SessionRecorder({
+			projectId: "test-project",
+			sendBatch: async (body) => {
+				sentBodies.push(body);
+				return _hexclave_shared_dist_utils_results.Result.ok(new Response("ok", { status: 200 }));
+			}
+		}, {});
+		try {
+			const largeData = "x".repeat(5e5);
+			const event1 = {
+				type: 2,
+				timestamp: Date.now(),
+				data: largeData
+			};
+			const event2 = {
+				type: 3,
+				timestamp: Date.now(),
+				data: largeData
+			};
+			recorder._events = [event1, event2];
+			recorder._eventSizes = [JSON.stringify(event1).length, JSON.stringify(event2).length];
+			recorder._approxBytes = JSON.stringify(event1).length + JSON.stringify(event2).length;
+			recorder._tick();
+			await vitest.vi.advanceTimersByTimeAsync(0);
+			(0, vitest.expect)(sentBodies).toHaveLength(2);
+			const batch1 = JSON.parse(sentBodies[0]);
+			const batch2 = JSON.parse(sentBodies[1]);
+			(0, vitest.expect)(batch1.events).toHaveLength(1);
+			(0, vitest.expect)(batch2.events).toHaveLength(1);
+			(0, vitest.expect)(batch1.batch_id).not.toBe(batch2.batch_id);
+		} finally {
+			recorder.stop();
+			localStorage.removeItem(storageKey);
+			vitest.vi.useRealTimers();
+		}
+	});
+	(0, vitest.it)("sends a single oversized event alone without dropping it", async () => {
+		vitest.vi.useFakeTimers();
+		const storageKey = `hexclave:session-replay:v1:test-project`;
+		localStorage.setItem(storageKey, JSON.stringify({
+			session_id: "test-session",
+			created_at_ms: Date.now(),
+			last_activity_ms: Date.now()
+		}));
+		const sentBodies = [];
+		const recorder = new __session_replay_js.SessionRecorder({
+			projectId: "test-project",
+			sendBatch: async (body) => {
+				sentBodies.push(body);
+				return _hexclave_shared_dist_utils_results.Result.ok(new Response("ok", { status: 200 }));
+			}
+		}, {});
+		try {
+			const hugeData = "y".repeat(1e6);
+			const hugeEvent = {
+				type: 2,
+				timestamp: Date.now(),
+				data: hugeData
+			};
+			recorder._events = [hugeEvent];
+			recorder._eventSizes = [JSON.stringify(hugeEvent).length];
+			recorder._approxBytes = JSON.stringify(hugeEvent).length;
+			recorder._tick();
+			await vitest.vi.advanceTimersByTimeAsync(0);
+			(0, vitest.expect)(sentBodies).toHaveLength(1);
+			(0, vitest.expect)(JSON.parse(sentBodies[0]).events).toHaveLength(1);
+		} finally {
+			recorder.stop();
+			localStorage.removeItem(storageKey);
+			vitest.vi.useRealTimers();
+		}
+	});
 	(0, vitest.it)("silently disables when client interface returns ANALYTICS_NOT_ENABLED as an error", async () => {
 		vitest.vi.useFakeTimers();
 		const storageKey = `hexclave:session-replay:v1:test-project`;
@@ -99,20 +184,24 @@ let _hexclave_shared_dist_known_errors = require("@hexclave/shared/dist/known-er
 		}, {});
 		const warnSpy = vitest.vi.spyOn(console, "warn").mockImplementation(() => {});
 		try {
-			recorder._events = [{
+			const event1 = {
 				type: 2,
 				timestamp: Date.now(),
 				data: {}
-			}];
+			};
+			recorder._events = [event1];
+			recorder._eventSizes = [JSON.stringify(event1).length];
 			recorder._tick();
 			await vitest.vi.advanceTimersByTimeAsync(0);
 			(0, vitest.expect)(sentBodies).toHaveLength(1);
 			(0, vitest.expect)(warnSpy).not.toHaveBeenCalled();
-			recorder._events = [{
+			const event2 = {
 				type: 3,
 				timestamp: Date.now(),
 				data: {}
-			}];
+			};
+			recorder._events = [event2];
+			recorder._eventSizes = [JSON.stringify(event2).length];
 			recorder._tick();
 			await vitest.vi.advanceTimersByTimeAsync(0);
 			(0, vitest.expect)(sentBodies).toHaveLength(1);

package/dist/lib/hexclave-app/apps/implementations/session-replay.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-replay.test.js","names":["SessionRecorder","Result","vi","KnownErrors"],"sources":["../../../../../src/lib/hexclave-app/apps/implementations/session-replay.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\n// @vitest-environment jsdom\n\nimport { KnownErrors } from \"@hexclave/shared/dist/known-errors\";\nimport { describe, expect, it, vi } from \"vitest\";\nimport { Result } from \"@hexclave/shared/dist/utils/results\";\nimport { analyticsOptionsFromJson, analyticsOptionsToJson, getSessionReplayOptions, SessionRecorder } from \"./session-replay\";\n\ndescribe(\"session replay options\", () => {\n  it(\"enables replays by default\", () => {\n    expect(getSessionReplayOptions(undefined).enabled).toBe(true);\n    expect(getSessionReplayOptions({}).enabled).toBe(true);\n    expect(getSessionReplayOptions({ replays: {} }).enabled).toBe(true);\n  });\n\n  it(\"preserves explicit replay opt-out\", () => {\n    expect(getSessionReplayOptions({ replays: { enabled: false } }).enabled).toBe(false);\n  });\n});\n\ndescribe(\"analytics option JSON conversion\", () => {\n  it(\"preserves top-level analytics options when serializing replay block classes\", () => {\n    const json = analyticsOptionsToJson({\n      enabled: false,\n      replays: {\n        enabled: true,\n        blockClass: /stack-sensitive/u,\n      },\n    });\n\n    expect(json?.enabled).toBe(false);\n    expect(json?.replays?.enabled).toBe(true);\n  });\n\n  it(\"preserves top-level analytics options when deserializing replay block classes\", () => {\n    const roundTripped = analyticsOptionsFromJson(analyticsOptionsToJson({\n      enabled: false,\n      replays: {\n        blockClass: /stack-sensitive/u,\n      },\n    }));\n\n    expect(roundTripped?.enabled).toBe(false);\n    expect(roundTripped?.replays?.blockClass).toEqual(/stack-sensitive/u);\n  });\n});\n\ndescribe(\"SessionRecorder flush\", () => {\n  it(\"silently ignores network errors caused by ad blockers\", async () => {\n    vi.useFakeTimers();\n\n    const storageKey = `hexclave:session-replay:v1:test-project`;\n    localStorage.setItem(storageKey, JSON.stringify({\n      session_id: \"test-session\",\n      created_at_ms: Date.now(),\n      last_activity_ms: Date.now(),\n    }));\n\n    const sentBodies: string[] = [];\n    const recorder = new SessionRecorder(\n      {\n        projectId: \"test-project\",\n        sendBatch: async (body) => {\n          sentBodies.push(body);\n          return Result.error(new TypeError(\"Failed to fetch\"));\n        },\n      },\n      {},\n    );\n\n    const warnSpy = vi.spyOn(console, \"warn\").mockImplementation(() => {});\n\n    try {\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n      (recorder as any)._events = [{ type: 2, timestamp: Date.now(), data: {} }];\n\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call\n      (recorder as any)._tick();\n      await vi.advanceTimersByTimeAsync(0);\n\n      expect(sentBodies).toHaveLength(1);\n      expect(warnSpy).not.toHaveBeenCalled();\n\n      // Unlike ANALYTICS_NOT_ENABLED, ad blocker errors do NOT disable the\n      // recorder — subsequent flushes continue attempting delivery.\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n      (recorder as any)._events = [{ type: 3, timestamp: Date.now(), data: {} }];\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call\n      (recorder as any)._tick();\n      await vi.advanceTimersByTimeAsync(0);\n      expect(sentBodies).toHaveLength(2);\n      expect(warnSpy).not.toHaveBeenCalled();\n    } finally {\n      recorder.stop();\n      warnSpy.mockRestore();\n      localStorage.removeItem(storageKey);\n      vi.useRealTimers();\n    }\n  });\n\n  it(\"silently disables when client interface returns ANALYTICS_NOT_ENABLED as an error\", async () => {\n    vi.useFakeTimers();\n\n    const storageKey = `hexclave:session-replay:v1:test-project`;\n    localStorage.setItem(storageKey, JSON.stringify({\n      session_id: \"test-session\",\n      created_at_ms: Date.now(),\n      last_activity_ms: Date.now(),\n    }));\n\n    const sentBodies: string[] = [];\n    const recorder = new SessionRecorder(\n      {\n        projectId: \"test-project\",\n        sendBatch: async (body) => {\n          sentBodies.push(body);\n          return Result.error(new KnownErrors.AnalyticsNotEnabled());\n        },\n      },\n      {},\n    );\n\n    const warnSpy = vi.spyOn(console, \"warn\").mockImplementation(() => {});\n\n    try {\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n      (recorder as any)._events = [{ type: 2, timestamp: Date.now(), data: {} }];\n\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call\n      (recorder as any)._tick();\n      await vi.advanceTimersByTimeAsync(0);\n\n      expect(sentBodies).toHaveLength(1);\n      expect(warnSpy).not.toHaveBeenCalled();\n\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n      (recorder as any)._events = [{ type: 3, timestamp: Date.now(), data: {} }];\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call\n      (recorder as any)._tick();\n      await vi.advanceTimersByTimeAsync(0);\n      expect(sentBodies).toHaveLength(1);\n    } finally {\n      recorder.stop();\n      warnSpy.mockRestore();\n      localStorage.removeItem(storageKey);\n      vi.useRealTimers();\n    }\n  });\n});\n"],"mappings":";;;;;;;;qBAWS,gCAAgC;AACvC,gBAAG,oCAAoC;AACrC,sEAA+B,OAAU,CAAC,QAAQ,CAAC,KAAK,KAAK;AAC7D,sEAA+B,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK;AACtD,sEAA+B,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK;GACnE;AAEF,gBAAG,2CAA2C;AAC5C,sEAA+B,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,MAAM;GACpF;EACF;qBAEO,0CAA0C;AACjD,gBAAG,qFAAqF;EACtF,MAAM,uDAA8B;GAClC,SAAS;GACT,SAAS;IACP,SAAS;IACT,YAAY;IACb;GACF,CAAC;AAEF,qBAAO,MAAM,QAAQ,CAAC,KAAK,MAAM;AACjC,qBAAO,MAAM,SAAS,QAAQ,CAAC,KAAK,KAAK;GACzC;AAEF,gBAAG,uFAAuF;EACxF,MAAM,iHAA+D;GACnE,SAAS;GACT,SAAS,EACP,YAAY,oBACb;GACF,CAAC,CAAC;AAEH,qBAAO,cAAc,QAAQ,CAAC,KAAK,MAAM;AACzC,qBAAO,cAAc,SAAS,WAAW,CAAC,QAAQ,mBAAmB;GACrE;EACF;qBAEO,+BAA+B;AACtC,gBAAG,yDAAyD,YAAY;AACtE,YAAG,eAAe;EAElB,MAAM,aAAa;AACnB,eAAa,QAAQ,YAAY,KAAK,UAAU;GAC9C,YAAY;GACZ,eAAe,KAAK,KAAK;GACzB,kBAAkB,KAAK,KAAK;GAC7B,CAAC,CAAC;EAEH,MAAM,aAAuB,EAAE;EAC/B,MAAM,WAAW,IAAIA,oCACnB;GACE,WAAW;GACX,WAAW,OAAO,SAAS;AACzB,eAAW,KAAK,KAAK;AACrB,WAAOC,2CAAO,sBAAM,IAAI,UAAU,kBAAkB,CAAC;;GAExD,EACD,EAAE,CACH;EAED,MAAM,UAAUC,UAAG,MAAM,SAAS,OAAO,CAAC,yBAAyB,GAAG;AAEtE,MAAI;AAEF,GAAC,SAAiB,UAAU,CAAC;IAAE,MAAM;IAAG,WAAW,KAAK,KAAK;IAAE,MAAM,EAAE;IAAE,CAAC;AAG1E,GAAC,SAAiB,OAAO;AACzB,SAAMA,UAAG,yBAAyB,EAAE;AAEpC,sBAAO,WAAW,CAAC,aAAa,EAAE;AAClC,sBAAO,QAAQ,CAAC,IAAI,kBAAkB;AAKtC,GAAC,SAAiB,UAAU,CAAC;IAAE,MAAM;IAAG,WAAW,KAAK,KAAK;IAAE,MAAM,EAAE;IAAE,CAAC;AAE1E,GAAC,SAAiB,OAAO;AACzB,SAAMA,UAAG,yBAAyB,EAAE;AACpC,sBAAO,WAAW,CAAC,aAAa,EAAE;AAClC,sBAAO,QAAQ,CAAC,IAAI,kBAAkB;YAC9B;AACR,YAAS,MAAM;AACf,WAAQ,aAAa;AACrB,gBAAa,WAAW,WAAW;AACnC,aAAG,eAAe;;GAEpB;AAEF,gBAAG,qFAAqF,YAAY;AAClG,YAAG,eAAe;EAElB,MAAM,aAAa;AACnB,eAAa,QAAQ,YAAY,KAAK,UAAU;GAC9C,YAAY;GACZ,eAAe,KAAK,KAAK;GACzB,kBAAkB,KAAK,KAAK;GAC7B,CAAC,CAAC;EAEH,MAAM,aAAuB,EAAE;EAC/B,MAAM,WAAW,IAAIF,oCACnB;GACE,WAAW;GACX,WAAW,OAAO,SAAS;AACzB,eAAW,KAAK,KAAK;AACrB,WAAOC,2CAAO,MAAM,IAAIE,+CAAY,qBAAqB,CAAC;;GAE7D,EACD,EAAE,CACH;EAED,MAAM,UAAUD,UAAG,MAAM,SAAS,OAAO,CAAC,yBAAyB,GAAG;AAEtE,MAAI;AAEF,GAAC,SAAiB,UAAU,CAAC;IAAE,MAAM;IAAG,WAAW,KAAK,KAAK;IAAE,MAAM,EAAE;IAAE,CAAC;AAG1E,GAAC,SAAiB,OAAO;AACzB,SAAMA,UAAG,yBAAyB,EAAE;AAEpC,sBAAO,WAAW,CAAC,aAAa,EAAE;AAClC,sBAAO,QAAQ,CAAC,IAAI,kBAAkB;AAGtC,GAAC,SAAiB,UAAU,CAAC;IAAE,MAAM;IAAG,WAAW,KAAK,KAAK;IAAE,MAAM,EAAE;IAAE,CAAC;AAE1E,GAAC,SAAiB,OAAO;AACzB,SAAMA,UAAG,yBAAyB,EAAE;AACpC,sBAAO,WAAW,CAAC,aAAa,EAAE;YAC1B;AACR,YAAS,MAAM;AACf,WAAQ,aAAa;AACrB,gBAAa,WAAW,WAAW;AACnC,aAAG,eAAe;;GAEpB;EACF"}
+{"version":3,"file":"session-replay.test.js","names":["SessionRecorder","Result","vi","KnownErrors"],"sources":["../../../../../src/lib/hexclave-app/apps/implementations/session-replay.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\n// @vitest-environment jsdom\n\nimport { KnownErrors } from \"@hexclave/shared/dist/known-errors\";\nimport { describe, expect, it, vi } from \"vitest\";\nimport { Result } from \"@hexclave/shared/dist/utils/results\";\nimport { analyticsOptionsFromJson, analyticsOptionsToJson, getSessionReplayOptions, SessionRecorder } from \"./session-replay\";\n\ndescribe(\"session replay options\", () => {\n  it(\"enables replays by default\", () => {\n    expect(getSessionReplayOptions(undefined).enabled).toBe(true);\n    expect(getSessionReplayOptions({}).enabled).toBe(true);\n    expect(getSessionReplayOptions({ replays: {} }).enabled).toBe(true);\n  });\n\n  it(\"preserves explicit replay opt-out\", () => {\n    expect(getSessionReplayOptions({ replays: { enabled: false } }).enabled).toBe(false);\n  });\n});\n\ndescribe(\"analytics option JSON conversion\", () => {\n  it(\"preserves top-level analytics options when serializing replay block classes\", () => {\n    const json = analyticsOptionsToJson({\n      enabled: false,\n      replays: {\n        enabled: true,\n        blockClass: /stack-sensitive/u,\n      },\n    });\n\n    expect(json?.enabled).toBe(false);\n    expect(json?.replays?.enabled).toBe(true);\n  });\n\n  it(\"preserves top-level analytics options when deserializing replay block classes\", () => {\n    const roundTripped = analyticsOptionsFromJson(analyticsOptionsToJson({\n      enabled: false,\n      replays: {\n        blockClass: /stack-sensitive/u,\n      },\n    }));\n\n    expect(roundTripped?.enabled).toBe(false);\n    expect(roundTripped?.replays?.blockClass).toEqual(/stack-sensitive/u);\n  });\n});\n\ndescribe(\"SessionRecorder flush\", () => {\n  it(\"silently ignores network errors caused by ad blockers\", async () => {\n    vi.useFakeTimers();\n\n    const storageKey = `hexclave:session-replay:v1:test-project`;\n    localStorage.setItem(storageKey, JSON.stringify({\n      session_id: \"test-session\",\n      created_at_ms: Date.now(),\n      last_activity_ms: Date.now(),\n    }));\n\n    const sentBodies: string[] = [];\n    const recorder = new SessionRecorder(\n      {\n        projectId: \"test-project\",\n        sendBatch: async (body) => {\n          sentBodies.push(body);\n          return Result.error(new TypeError(\"Failed to fetch\"));\n        },\n      },\n      {},\n    );\n\n    const warnSpy = vi.spyOn(console, \"warn\").mockImplementation(() => {});\n\n    try {\n      const event1 = { type: 2, timestamp: Date.now(), data: {} };\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n      (recorder as any)._events = [event1];\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n      (recorder as any)._eventSizes = [JSON.stringify(event1).length];\n\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call\n      (recorder as any)._tick();\n      await vi.advanceTimersByTimeAsync(0);\n\n      expect(sentBodies).toHaveLength(1);\n      expect(warnSpy).not.toHaveBeenCalled();\n\n      // Unlike ANALYTICS_NOT_ENABLED, ad blocker errors do NOT disable the\n      // recorder — subsequent flushes continue attempting delivery.\n      const event2 = { type: 3, timestamp: Date.now(), data: {} };\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n      (recorder as any)._events = [event2];\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n      (recorder as any)._eventSizes = [JSON.stringify(event2).length];\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call\n      (recorder as any)._tick();\n      await vi.advanceTimersByTimeAsync(0);\n      expect(sentBodies).toHaveLength(2);\n      expect(warnSpy).not.toHaveBeenCalled();\n    } finally {\n      recorder.stop();\n      warnSpy.mockRestore();\n      localStorage.removeItem(storageKey);\n      vi.useRealTimers();\n    }\n  });\n\n  it(\"splits large batches into multiple requests to stay under server 1MB limit\", async () => {\n    vi.useFakeTimers();\n\n    const storageKey = `hexclave:session-replay:v1:test-project`;\n    localStorage.setItem(storageKey, JSON.stringify({\n      session_id: \"test-session\",\n      created_at_ms: Date.now(),\n      last_activity_ms: Date.now(),\n    }));\n\n    const sentBodies: string[] = [];\n    const recorder = new SessionRecorder(\n      {\n        projectId: \"test-project\",\n        sendBatch: async (body) => {\n          sentBodies.push(body);\n          return Result.ok(new Response(\"ok\", { status: 200 }));\n        },\n      },\n      {},\n    );\n\n    try {\n      // Create events that together exceed 900KB (the per-batch cap).\n      // Each event is ~500KB, so two events (~1MB) must be split into two batches.\n      const largeData = \"x\".repeat(500_000);\n      const event1 = { type: 2, timestamp: Date.now(), data: largeData };\n      const event2 = { type: 3, timestamp: Date.now(), data: largeData };\n\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n      (recorder as any)._events = [event1, event2];\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n      (recorder as any)._eventSizes = [JSON.stringify(event1).length, JSON.stringify(event2).length];\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n      (recorder as any)._approxBytes = JSON.stringify(event1).length + JSON.stringify(event2).length;\n\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call\n      (recorder as any)._tick();\n      await vi.advanceTimersByTimeAsync(0);\n\n      // Should have sent two separate batches\n      expect(sentBodies).toHaveLength(2);\n\n      // Each batch should contain exactly one event\n      const batch1 = JSON.parse(sentBodies[0]);\n      const batch2 = JSON.parse(sentBodies[1]);\n      expect(batch1.events).toHaveLength(1);\n      expect(batch2.events).toHaveLength(1);\n\n      // They should have different batch IDs\n      expect(batch1.batch_id).not.toBe(batch2.batch_id);\n    } finally {\n      recorder.stop();\n      localStorage.removeItem(storageKey);\n      vi.useRealTimers();\n    }\n  });\n\n  it(\"sends a single oversized event alone without dropping it\", async () => {\n    vi.useFakeTimers();\n\n    const storageKey = `hexclave:session-replay:v1:test-project`;\n    localStorage.setItem(storageKey, JSON.stringify({\n      session_id: \"test-session\",\n      created_at_ms: Date.now(),\n      last_activity_ms: Date.now(),\n    }));\n\n    const sentBodies: string[] = [];\n    const recorder = new SessionRecorder(\n      {\n        projectId: \"test-project\",\n        sendBatch: async (body) => {\n          sentBodies.push(body);\n          return Result.ok(new Response(\"ok\", { status: 200 }));\n        },\n      },\n      {},\n    );\n\n    try {\n      // A single event larger than 900KB — should still be sent (not dropped)\n      const hugeData = \"y\".repeat(1_000_000);\n      const hugeEvent = { type: 2, timestamp: Date.now(), data: hugeData };\n\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n      (recorder as any)._events = [hugeEvent];\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n      (recorder as any)._eventSizes = [JSON.stringify(hugeEvent).length];\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n      (recorder as any)._approxBytes = JSON.stringify(hugeEvent).length;\n\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call\n      (recorder as any)._tick();\n      await vi.advanceTimersByTimeAsync(0);\n\n      // Should still send the event (the server may reject it, but we don't drop it client-side)\n      expect(sentBodies).toHaveLength(1);\n      const batch = JSON.parse(sentBodies[0]);\n      expect(batch.events).toHaveLength(1);\n    } finally {\n      recorder.stop();\n      localStorage.removeItem(storageKey);\n      vi.useRealTimers();\n    }\n  });\n\n  it(\"silently disables when client interface returns ANALYTICS_NOT_ENABLED as an error\", async () => {\n    vi.useFakeTimers();\n\n    const storageKey = `hexclave:session-replay:v1:test-project`;\n    localStorage.setItem(storageKey, JSON.stringify({\n      session_id: \"test-session\",\n      created_at_ms: Date.now(),\n      last_activity_ms: Date.now(),\n    }));\n\n    const sentBodies: string[] = [];\n    const recorder = new SessionRecorder(\n      {\n        projectId: \"test-project\",\n        sendBatch: async (body) => {\n          sentBodies.push(body);\n          return Result.error(new KnownErrors.AnalyticsNotEnabled());\n        },\n      },\n      {},\n    );\n\n    const warnSpy = vi.spyOn(console, \"warn\").mockImplementation(() => {});\n\n    try {\n      const event1 = { type: 2, timestamp: Date.now(), data: {} };\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n      (recorder as any)._events = [event1];\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n      (recorder as any)._eventSizes = [JSON.stringify(event1).length];\n\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call\n      (recorder as any)._tick();\n      await vi.advanceTimersByTimeAsync(0);\n\n      expect(sentBodies).toHaveLength(1);\n      expect(warnSpy).not.toHaveBeenCalled();\n\n      const event2 = { type: 3, timestamp: Date.now(), data: {} };\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n      (recorder as any)._events = [event2];\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n      (recorder as any)._eventSizes = [JSON.stringify(event2).length];\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call\n      (recorder as any)._tick();\n      await vi.advanceTimersByTimeAsync(0);\n      expect(sentBodies).toHaveLength(1);\n    } finally {\n      recorder.stop();\n      warnSpy.mockRestore();\n      localStorage.removeItem(storageKey);\n      vi.useRealTimers();\n    }\n  });\n});\n"],"mappings":";;;;;;;;qBAWS,gCAAgC;AACvC,gBAAG,oCAAoC;AACrC,sEAA+B,OAAU,CAAC,QAAQ,CAAC,KAAK,KAAK;AAC7D,sEAA+B,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK;AACtD,sEAA+B,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK;GACnE;AAEF,gBAAG,2CAA2C;AAC5C,sEAA+B,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,MAAM;GACpF;EACF;qBAEO,0CAA0C;AACjD,gBAAG,qFAAqF;EACtF,MAAM,uDAA8B;GAClC,SAAS;GACT,SAAS;IACP,SAAS;IACT,YAAY;IACb;GACF,CAAC;AAEF,qBAAO,MAAM,QAAQ,CAAC,KAAK,MAAM;AACjC,qBAAO,MAAM,SAAS,QAAQ,CAAC,KAAK,KAAK;GACzC;AAEF,gBAAG,uFAAuF;EACxF,MAAM,iHAA+D;GACnE,SAAS;GACT,SAAS,EACP,YAAY,oBACb;GACF,CAAC,CAAC;AAEH,qBAAO,cAAc,QAAQ,CAAC,KAAK,MAAM;AACzC,qBAAO,cAAc,SAAS,WAAW,CAAC,QAAQ,mBAAmB;GACrE;EACF;qBAEO,+BAA+B;AACtC,gBAAG,yDAAyD,YAAY;AACtE,YAAG,eAAe;EAElB,MAAM,aAAa;AACnB,eAAa,QAAQ,YAAY,KAAK,UAAU;GAC9C,YAAY;GACZ,eAAe,KAAK,KAAK;GACzB,kBAAkB,KAAK,KAAK;GAC7B,CAAC,CAAC;EAEH,MAAM,aAAuB,EAAE;EAC/B,MAAM,WAAW,IAAIA,oCACnB;GACE,WAAW;GACX,WAAW,OAAO,SAAS;AACzB,eAAW,KAAK,KAAK;AACrB,WAAOC,2CAAO,sBAAM,IAAI,UAAU,kBAAkB,CAAC;;GAExD,EACD,EAAE,CACH;EAED,MAAM,UAAUC,UAAG,MAAM,SAAS,OAAO,CAAC,yBAAyB,GAAG;AAEtE,MAAI;GACF,MAAM,SAAS;IAAE,MAAM;IAAG,WAAW,KAAK,KAAK;IAAE,MAAM,EAAE;IAAE;AAE3D,GAAC,SAAiB,UAAU,CAAC,OAAO;AAEpC,GAAC,SAAiB,cAAc,CAAC,KAAK,UAAU,OAAO,CAAC,OAAO;AAG/D,GAAC,SAAiB,OAAO;AACzB,SAAMA,UAAG,yBAAyB,EAAE;AAEpC,sBAAO,WAAW,CAAC,aAAa,EAAE;AAClC,sBAAO,QAAQ,CAAC,IAAI,kBAAkB;GAItC,MAAM,SAAS;IAAE,MAAM;IAAG,WAAW,KAAK,KAAK;IAAE,MAAM,EAAE;IAAE;AAE3D,GAAC,SAAiB,UAAU,CAAC,OAAO;AAEpC,GAAC,SAAiB,cAAc,CAAC,KAAK,UAAU,OAAO,CAAC,OAAO;AAE/D,GAAC,SAAiB,OAAO;AACzB,SAAMA,UAAG,yBAAyB,EAAE;AACpC,sBAAO,WAAW,CAAC,aAAa,EAAE;AAClC,sBAAO,QAAQ,CAAC,IAAI,kBAAkB;YAC9B;AACR,YAAS,MAAM;AACf,WAAQ,aAAa;AACrB,gBAAa,WAAW,WAAW;AACnC,aAAG,eAAe;;GAEpB;AAEF,gBAAG,8EAA8E,YAAY;AAC3F,YAAG,eAAe;EAElB,MAAM,aAAa;AACnB,eAAa,QAAQ,YAAY,KAAK,UAAU;GAC9C,YAAY;GACZ,eAAe,KAAK,KAAK;GACzB,kBAAkB,KAAK,KAAK;GAC7B,CAAC,CAAC;EAEH,MAAM,aAAuB,EAAE;EAC/B,MAAM,WAAW,IAAIF,oCACnB;GACE,WAAW;GACX,WAAW,OAAO,SAAS;AACzB,eAAW,KAAK,KAAK;AACrB,WAAOC,2CAAO,GAAG,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,CAAC,CAAC;;GAExD,EACD,EAAE,CACH;AAED,MAAI;GAGF,MAAM,YAAY,IAAI,OAAO,IAAQ;GACrC,MAAM,SAAS;IAAE,MAAM;IAAG,WAAW,KAAK,KAAK;IAAE,MAAM;IAAW;GAClE,MAAM,SAAS;IAAE,MAAM;IAAG,WAAW,KAAK,KAAK;IAAE,MAAM;IAAW;AAGlE,GAAC,SAAiB,UAAU,CAAC,QAAQ,OAAO;AAE5C,GAAC,SAAiB,cAAc,CAAC,KAAK,UAAU,OAAO,CAAC,QAAQ,KAAK,UAAU,OAAO,CAAC,OAAO;AAE9F,GAAC,SAAiB,eAAe,KAAK,UAAU,OAAO,CAAC,SAAS,KAAK,UAAU,OAAO,CAAC;AAGxF,GAAC,SAAiB,OAAO;AACzB,SAAMC,UAAG,yBAAyB,EAAE;AAGpC,sBAAO,WAAW,CAAC,aAAa,EAAE;GAGlC,MAAM,SAAS,KAAK,MAAM,WAAW,GAAG;GACxC,MAAM,SAAS,KAAK,MAAM,WAAW,GAAG;AACxC,sBAAO,OAAO,OAAO,CAAC,aAAa,EAAE;AACrC,sBAAO,OAAO,OAAO,CAAC,aAAa,EAAE;AAGrC,sBAAO,OAAO,SAAS,CAAC,IAAI,KAAK,OAAO,SAAS;YACzC;AACR,YAAS,MAAM;AACf,gBAAa,WAAW,WAAW;AACnC,aAAG,eAAe;;GAEpB;AAEF,gBAAG,4DAA4D,YAAY;AACzE,YAAG,eAAe;EAElB,MAAM,aAAa;AACnB,eAAa,QAAQ,YAAY,KAAK,UAAU;GAC9C,YAAY;GACZ,eAAe,KAAK,KAAK;GACzB,kBAAkB,KAAK,KAAK;GAC7B,CAAC,CAAC;EAEH,MAAM,aAAuB,EAAE;EAC/B,MAAM,WAAW,IAAIF,oCACnB;GACE,WAAW;GACX,WAAW,OAAO,SAAS;AACzB,eAAW,KAAK,KAAK;AACrB,WAAOC,2CAAO,GAAG,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,CAAC,CAAC;;GAExD,EACD,EAAE,CACH;AAED,MAAI;GAEF,MAAM,WAAW,IAAI,OAAO,IAAU;GACtC,MAAM,YAAY;IAAE,MAAM;IAAG,WAAW,KAAK,KAAK;IAAE,MAAM;IAAU;AAGpE,GAAC,SAAiB,UAAU,CAAC,UAAU;AAEvC,GAAC,SAAiB,cAAc,CAAC,KAAK,UAAU,UAAU,CAAC,OAAO;AAElE,GAAC,SAAiB,eAAe,KAAK,UAAU,UAAU,CAAC;AAG3D,GAAC,SAAiB,OAAO;AACzB,SAAMC,UAAG,yBAAyB,EAAE;AAGpC,sBAAO,WAAW,CAAC,aAAa,EAAE;AAElC,sBADc,KAAK,MAAM,WAAW,GAAG,CAC1B,OAAO,CAAC,aAAa,EAAE;YAC5B;AACR,YAAS,MAAM;AACf,gBAAa,WAAW,WAAW;AACnC,aAAG,eAAe;;GAEpB;AAEF,gBAAG,qFAAqF,YAAY;AAClG,YAAG,eAAe;EAElB,MAAM,aAAa;AACnB,eAAa,QAAQ,YAAY,KAAK,UAAU;GAC9C,YAAY;GACZ,eAAe,KAAK,KAAK;GACzB,kBAAkB,KAAK,KAAK;GAC7B,CAAC,CAAC;EAEH,MAAM,aAAuB,EAAE;EAC/B,MAAM,WAAW,IAAIF,oCACnB;GACE,WAAW;GACX,WAAW,OAAO,SAAS;AACzB,eAAW,KAAK,KAAK;AACrB,WAAOC,2CAAO,MAAM,IAAIE,+CAAY,qBAAqB,CAAC;;GAE7D,EACD,EAAE,CACH;EAED,MAAM,UAAUD,UAAG,MAAM,SAAS,OAAO,CAAC,yBAAyB,GAAG;AAEtE,MAAI;GACF,MAAM,SAAS;IAAE,MAAM;IAAG,WAAW,KAAK,KAAK;IAAE,MAAM,EAAE;IAAE;AAE3D,GAAC,SAAiB,UAAU,CAAC,OAAO;AAEpC,GAAC,SAAiB,cAAc,CAAC,KAAK,UAAU,OAAO,CAAC,OAAO;AAG/D,GAAC,SAAiB,OAAO;AACzB,SAAMA,UAAG,yBAAyB,EAAE;AAEpC,sBAAO,WAAW,CAAC,aAAa,EAAE;AAClC,sBAAO,QAAQ,CAAC,IAAI,kBAAkB;GAEtC,MAAM,SAAS;IAAE,MAAM;IAAG,WAAW,KAAK,KAAK;IAAE,MAAM,EAAE;IAAE;AAE3D,GAAC,SAAiB,UAAU,CAAC,OAAO;AAEpC,GAAC,SAAiB,cAAc,CAAC,KAAK,UAAU,OAAO,CAAC,OAAO;AAE/D,GAAC,SAAiB,OAAO;AACzB,SAAMA,UAAG,yBAAyB,EAAE;AACpC,sBAAO,WAAW,CAAC,aAAa,EAAE;YAC1B;AACR,YAAS,MAAM;AACf,WAAQ,aAAa;AACrB,gBAAa,WAAW,WAAW;AACnC,aAAG,eAAe;;GAEpB;EACF"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template (FOR package.json FILES, PLEASE EDIT package-template.json)",
   "name": "@hexclave/js",
-  "version": "1.0.26",
+  "version": "1.0.28",
   "repository": "https://github.com/hexclave/hexclave",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -64,9 +64,8 @@
     "@oslojs/otp": "^1.1.0",
     "qrcode": "^1.5.4",
     "rrweb": "^1.1.3",
-    "tsx": "^4.21.0",
     "yup": "^1.7.1",
-    "@hexclave/shared": "1.0.26"
+    "@hexclave/shared": "1.0.28"
   },
   "devDependencies": {
     "@quetzallabs/i18n": "^0.1.19",
@@ -86,6 +85,7 @@
     "rimraf": "^6.1.2",
     "tailwindcss": "^3.4.4",
     "tsdown": "^0.20.3",
+    "tsx": "^4.21.0",
     "convex": "^1.27.0"
   },
   "scripts": {

package/src/dev-tool/dev-tool-core.ts

@@ -248,7 +248,7 @@ function generateRandomEmail(): string {
   for (let i = 0; i < 8; i++) {
     id += chars[Math.floor(Math.random() * chars.length)];
   }
-  return `dev-${id}@test.hexclave.com`;
+  return `dev-${id}@devtool-quick-sign-up.example.com`;
 }
 
 // ---------------------------------------------------------------------------

package/src/lib/hexclave-app/apps/implementations/admin-app-impl.ts

@@ -717,7 +717,8 @@ export class _HexclaveAdminAppImplIncomplete<HasTokenStore extends boolean, Proj
   }
 
   async getEmailPreview(options: { themeId?: string | null | false, themeTsxSource?: string, templateId?: string, templateTsxSource?: string }): Promise<string> {
-    return (await this._interface.renderEmailPreview(options)).html;
+    const result = Result.orThrow(await this._emailPreviewCache.getOrWait([options.themeId, options.themeTsxSource, options.templateId, options.templateTsxSource], "write-only"));
+    return result.html;
   }
   async getEmailPreviewWithEditableMarkers(options: { themeId?: string | null | false, themeTsxSource?: string, templateId?: string, templateTsxSource?: string, editableSource?: 'template' | 'theme' | 'both' }): Promise<{ html: string, editableRegions?: Record<string, unknown> }> {
     const result = await this._interface.renderEmailPreview({ ...options, editableMarkers: true, editableSource: options.editableSource });

package/src/lib/hexclave-app/apps/implementations/session-replay.test.ts

@@ -74,8 +74,11 @@ describe("SessionRecorder flush", () => {
     const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
 
     try {
+      const event1 = { type: 2, timestamp: Date.now(), data: {} };
       // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
-      (recorder as any)._events = [{ type: 2, timestamp: Date.now(), data: {} }];
+      (recorder as any)._events = [event1];
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+      (recorder as any)._eventSizes = [JSON.stringify(event1).length];
 
       // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call
       (recorder as any)._tick();
@@ -86,8 +89,11 @@ describe("SessionRecorder flush", () => {
 
       // Unlike ANALYTICS_NOT_ENABLED, ad blocker errors do NOT disable the
       // recorder — subsequent flushes continue attempting delivery.
+      const event2 = { type: 3, timestamp: Date.now(), data: {} };
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+      (recorder as any)._events = [event2];
       // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
-      (recorder as any)._events = [{ type: 3, timestamp: Date.now(), data: {} }];
+      (recorder as any)._eventSizes = [JSON.stringify(event2).length];
       // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call
       (recorder as any)._tick();
       await vi.advanceTimersByTimeAsync(0);
@@ -101,6 +107,113 @@ describe("SessionRecorder flush", () => {
     }
   });
 
+  it("splits large batches into multiple requests to stay under server 1MB limit", async () => {
+    vi.useFakeTimers();
+
+    const storageKey = `hexclave:session-replay:v1:test-project`;
+    localStorage.setItem(storageKey, JSON.stringify({
+      session_id: "test-session",
+      created_at_ms: Date.now(),
+      last_activity_ms: Date.now(),
+    }));
+
+    const sentBodies: string[] = [];
+    const recorder = new SessionRecorder(
+      {
+        projectId: "test-project",
+        sendBatch: async (body) => {
+          sentBodies.push(body);
+          return Result.ok(new Response("ok", { status: 200 }));
+        },
+      },
+      {},
+    );
+
+    try {
+      // Create events that together exceed 900KB (the per-batch cap).
+      // Each event is ~500KB, so two events (~1MB) must be split into two batches.
+      const largeData = "x".repeat(500_000);
+      const event1 = { type: 2, timestamp: Date.now(), data: largeData };
+      const event2 = { type: 3, timestamp: Date.now(), data: largeData };
+
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+      (recorder as any)._events = [event1, event2];
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+      (recorder as any)._eventSizes = [JSON.stringify(event1).length, JSON.stringify(event2).length];
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+      (recorder as any)._approxBytes = JSON.stringify(event1).length + JSON.stringify(event2).length;
+
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call
+      (recorder as any)._tick();
+      await vi.advanceTimersByTimeAsync(0);
+
+      // Should have sent two separate batches
+      expect(sentBodies).toHaveLength(2);
+
+      // Each batch should contain exactly one event
+      const batch1 = JSON.parse(sentBodies[0]);
+      const batch2 = JSON.parse(sentBodies[1]);
+      expect(batch1.events).toHaveLength(1);
+      expect(batch2.events).toHaveLength(1);
+
+      // They should have different batch IDs
+      expect(batch1.batch_id).not.toBe(batch2.batch_id);
+    } finally {
+      recorder.stop();
+      localStorage.removeItem(storageKey);
+      vi.useRealTimers();
+    }
+  });
+
+  it("sends a single oversized event alone without dropping it", async () => {
+    vi.useFakeTimers();
+
+    const storageKey = `hexclave:session-replay:v1:test-project`;
+    localStorage.setItem(storageKey, JSON.stringify({
+      session_id: "test-session",
+      created_at_ms: Date.now(),
+      last_activity_ms: Date.now(),
+    }));
+
+    const sentBodies: string[] = [];
+    const recorder = new SessionRecorder(
+      {
+        projectId: "test-project",
+        sendBatch: async (body) => {
+          sentBodies.push(body);
+          return Result.ok(new Response("ok", { status: 200 }));
+        },
+      },
+      {},
+    );
+
+    try {
+      // A single event larger than 900KB — should still be sent (not dropped)
+      const hugeData = "y".repeat(1_000_000);
+      const hugeEvent = { type: 2, timestamp: Date.now(), data: hugeData };
+
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+      (recorder as any)._events = [hugeEvent];
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+      (recorder as any)._eventSizes = [JSON.stringify(hugeEvent).length];
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+      (recorder as any)._approxBytes = JSON.stringify(hugeEvent).length;
+
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call
+      (recorder as any)._tick();
+      await vi.advanceTimersByTimeAsync(0);
+
+      // Should still send the event (the server may reject it, but we don't drop it client-side)
+      expect(sentBodies).toHaveLength(1);
+      const batch = JSON.parse(sentBodies[0]);
+      expect(batch.events).toHaveLength(1);
+    } finally {
+      recorder.stop();
+      localStorage.removeItem(storageKey);
+      vi.useRealTimers();
+    }
+  });
+
   it("silently disables when client interface returns ANALYTICS_NOT_ENABLED as an error", async () => {
     vi.useFakeTimers();
 
@@ -126,8 +239,11 @@ describe("SessionRecorder flush", () => {
     const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
 
     try {
+      const event1 = { type: 2, timestamp: Date.now(), data: {} };
       // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
-      (recorder as any)._events = [{ type: 2, timestamp: Date.now(), data: {} }];
+      (recorder as any)._events = [event1];
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+      (recorder as any)._eventSizes = [JSON.stringify(event1).length];
 
       // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call
       (recorder as any)._tick();
@@ -136,8 +252,11 @@ describe("SessionRecorder flush", () => {
       expect(sentBodies).toHaveLength(1);
       expect(warnSpy).not.toHaveBeenCalled();
 
+      const event2 = { type: 3, timestamp: Date.now(), data: {} };
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+      (recorder as any)._events = [event2];
       // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
-      (recorder as any)._events = [{ type: 3, timestamp: Date.now(), data: {} }];
+      (recorder as any)._eventSizes = [JSON.stringify(event2).length];
       // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call
       (recorder as any)._tick();
       await vi.advanceTimersByTimeAsync(0);

package/src/lib/hexclave-app/apps/implementations/session-replay.ts

@@ -4,7 +4,7 @@
 //===========================================
 import { KnownErrors } from "@hexclave/shared/dist/known-errors";
 import { isBrowserLike } from "@hexclave/shared/dist/utils/env";
-import { captureWarning } from "@hexclave/shared/dist/utils/errors";
+import { captureWarning, throwErr } from "@hexclave/shared/dist/utils/errors";
 import { runAsynchronously } from "@hexclave/shared/dist/utils/promises";
 import { Result } from "@hexclave/shared/dist/utils/results";
 
@@ -110,6 +110,9 @@ const IDLE_TTL_MS = 3 * 60 * 1000;
 const FLUSH_INTERVAL_MS = 5_000;
 const MAX_EVENTS_PER_BATCH = 200;
 const MAX_APPROX_BYTES_PER_BATCH = 512_000;
+// The server rejects payloads > 1MB. Stay well under to account for JSON
+// envelope overhead (browser_session_id, timestamps, wrapper keys, etc.).
+const MAX_FLUSH_PAYLOAD_BYTES = 900_000;
 
 export type StoredSession = {
   session_id: string,
@@ -193,6 +196,7 @@ export class SessionRecorder {
   private _detachListeners: (() => void) | null = null;
   private _flushTimer: ReturnType<typeof setInterval> | null = null;
   private _events: unknown[] = [];
+  private _eventSizes: number[] = [];
   private _approxBytes = 0;
   private _lastPersistActivity = 0;
   private _recording = false;
@@ -243,6 +247,7 @@ export class SessionRecorder {
 
   clearBuffer() {
     this._events = [];
+    this._eventSizes = [];
     this._approxBytes = 0;
   }
 
@@ -268,42 +273,68 @@ export class SessionRecorder {
     const nowMs = Date.now();
     const stored = getOrRotateSession({ key: this._storageKey, legacyKey: this._legacyStorageKey, nowMs });
 
-    const batchId = generateUuid();
-    const payload = {
-      browser_session_id: stored.session_id,
-      session_replay_segment_id: this._sessionReplaySegmentId,
-      batch_id: batchId,
-      started_at_ms: stored.created_at_ms,
-      sent_at_ms: nowMs,
-      events: this._events,
-    };
-
+    // Capture all buffered events upfront (before any await) so that
+    // stop() / _stopCurrentRecording() clearing this._events cannot race
+    // with the async send loop below and silently discard overflow batches.
+    const allEvents = this._events;
+    const allSizes = this._eventSizes;
     this._events = [];
+    this._eventSizes = [];
     this._approxBytes = 0;
 
     this._flushInProgress = true;
     try {
-      const res = await this._deps.sendBatch(
-        JSON.stringify(payload),
-        { keepalive: options.keepalive },
-      );
-
-      if (res.status === "error") {
-        if (isAnalyticsNotEnabledError(res.error)) {
-          this._disable();
-          return;
+      let offset = 0;
+      while (offset < allEvents.length) {
+        // Build a batch that fits under the server's payload limit.
+        // When _flushInProgress blocked earlier flushes, events can accumulate
+        // well past MAX_APPROX_BYTES_PER_BATCH; sending them all at once would
+        // exceed the server's 1MB body limit (413).
+        let batchBytes = 0;
+        let batchEnd = offset;
+        for (let i = offset; i < allEvents.length; i++) {
+          const nextSize = allSizes[i] ?? throwErr("_eventSizes out of sync with _events — this should never happen");
+          if (batchBytes + nextSize > MAX_FLUSH_PAYLOAD_BYTES && batchEnd > offset) break;
+          batchBytes += nextSize;
+          batchEnd = i + 1;
         }
-        // Ad blockers commonly block analytics endpoints, causing network
-        // errors. These are expected and should not pollute the console.
-        if (isAdBlockerNetworkError(res.error)) {
+
+        const batchEvents = allEvents.slice(offset, batchEnd);
+        offset = batchEnd;
+
+        const batchId = generateUuid();
+        const payload = {
+          browser_session_id: stored.session_id,
+          session_replay_segment_id: this._sessionReplaySegmentId,
+          batch_id: batchId,
+          started_at_ms: stored.created_at_ms,
+          sent_at_ms: nowMs,
+          events: batchEvents,
+        };
+
+        const res = await this._deps.sendBatch(
+          JSON.stringify(payload),
+          { keepalive: options.keepalive },
+        );
+
+        if (res.status === "error") {
+          if (isAnalyticsNotEnabledError(res.error)) {
+            this._disable();
+            return;
+          }
+          // Ad blockers commonly block analytics endpoints, causing network
+          // errors. These are expected and should not pollute the console.
+          if (isAdBlockerNetworkError(res.error)) {
+            return;
+          }
+          captureWarning("SessionRecorder.flush", res.error);
           return;
         }
-        captureWarning("SessionRecorder.flush", res.error);
-        return;
-      }
 
-      if (!res.data.ok) {
-        captureWarning("SessionRecorder.flush", new Error(`SessionRecorder flush failed: ${res.data.status} ${await res.data.text()}`));
+        if (!res.data.ok) {
+          captureWarning("SessionRecorder.flush", new Error(`SessionRecorder flush failed: ${res.data.status} ${await res.data.text()}`));
+          return;
+        }
       }
     } finally {
       this._flushInProgress = false;
@@ -357,8 +388,10 @@ export class SessionRecorder {
           }
         }
 
+        const eventSize = JSON.stringify(event).length;
         this._events.push(event);
-        this._approxBytes += JSON.stringify(event).length;
+        this._eventSizes.push(eventSize);
+        this._approxBytes += eventSize;
         if (this._events.length >= MAX_EVENTS_PER_BATCH || this._approxBytes >= MAX_APPROX_BYTES_PER_BATCH) {
           runAsynchronously(() => this._flush({ keepalive: false }));
         }
@@ -391,6 +424,7 @@ export class SessionRecorder {
       this._stopRecording = null;
     }
     this._events = [];
+    this._eventSizes = [];
     this._approxBytes = 0;
     this._recording = false;
   }