@maple-dev/browser 0.10.0 → 0.11.0

package/README.md

@@ -68,8 +68,9 @@ fingerprint to one contentless issue that buries the real ones. Add
 
 ### Failed HTTP requests
 
-`errors: { captureHttpStatus: [[500, 599]] }` makes those `fetch`/XHR responses errors, typed by
-status. By default a response status alone is not an error; a network failure always is.
+`fetch`/XHR responses with a 4xx or 5xx status are errors, typed by status, as the HTTP semantic
+conventions say for client spans. Narrow that with `errors: { captureHttpStatus: [[500, 599]] }`.
+A network failure is always an error.
 
 ### Breadcrumbs
 

package/dist/{console-BrjBnOiX.mjs → console-Bkd3hBGp.mjs}

@@ -1,4 +1,4 @@
-import { O as safeEmit } from "./sink-BOR9_z4b.mjs";
+import { M as safeEmit } from "./sink-DbEuphC-.mjs";
 //#region ../browser-session/src/replay/capture/console.ts
 const LEVELS = [
 	"log",

package/dist/{deferred-CdtlxG0Q.mjs → deferred-Bv2SmnTY.mjs}

@@ -1,11 +1,10 @@
-import { E as selectorOf, F as scrubUrl, l as onSessionEvent, w as sdkHint, x as ingestHeaders } from "./sink-BOR9_z4b.mjs";
-import { _ as consentRevokedAt, a as detachLogSink, c as resourceAttributes, d as attachSpanStash, f as claimPageSignal, g as consentAllowedSince, h as severityOf, i as attachLogSink, l as SDK_NAME, m as Severity, n as navigationSpanAt, o as emitLog, p as onErrorRecorded, r as onDocumentPageload, s as liveMapleTracer, u as SDK_VERSION, v as hasConsent, y as onConsentChange } from "./src-Bzmp8rVr.mjs";
-import { t as installConsoleCapture } from "./console-BrjBnOiX.mjs";
+import { A as selectorOf, G as scrubUrl, K as mayUseStorage, L as consentAllowedSince, O as sdkHint, R as consentRevokedAt, S as ingestHeaders, V as onConsentChange, l as onSessionEvent, z as hasConsent } from "./sink-DbEuphC-.mjs";
+import { _ as severityOf, a as detachLogSink, c as resourceAttributes, d as OtlpExporter, f as newestFirstOnExit, g as Severity, h as onErrorRecorded, i as attachLogSink, l as SDK_NAME, m as claimPageSignal, n as navigationSpanAt, o as emitLog, p as attachSpanStash, r as onDocumentPageload, s as liveMapleTracer, u as SDK_VERSION } from "./src-BiHeZJ9l.mjs";
+import { t as installConsoleCapture } from "./console-Bkd3hBGp.mjs";
 import { ROOT_CONTEXT, TraceFlags, context, trace } from "@opentelemetry/api";
+import { JsonLogsSerializer, JsonTraceSerializer } from "@opentelemetry/otlp-transformer";
 import { resourceFromAttributes } from "@opentelemetry/resources";
 import { onCLS, onFCP, onINP, onLCP, onTTFB } from "web-vitals";
-import { JsonLogsSerializer, JsonTraceSerializer } from "@opentelemetry/otlp-transformer";
-import { OTLPLogExporter } from "@opentelemetry/exporter-logs-otlp-http";
 import { BatchLogRecordProcessor, LoggerProvider } from "@opentelemetry/sdk-logs";
 //#region ../sdk-core/src/browser/breadcrumbs.ts
 const MAX_CRUMBS = 50;
@@ -203,6 +202,11 @@ function fingerprint(value) {
 	return (hash >>> 0).toString(16);
 }
 function startOfflineQueue(config) {
+	if (!mayUseStorage()) return {
+		stash: () => {},
+		resend: () => Promise.resolve(),
+		stop: () => {}
+	};
 	const db = openDb();
 	const headers = {
 		...config.headers,
@@ -587,14 +591,11 @@ var OfflineLogExporter = class {
 };
 /** Start the OTel logs pipeline and drain the eager queue into it. Returns a shutdown. */
 function startLogs(config, stashOffline) {
-	const otlp = new OTLPLogExporter({
-		url: `${config.endpoint}/v1/logs`,
-		headers: ingestHeaders({
-			ingestKey: config.ingestKey,
-			sdk: sdkHint(SDK_NAME, SDK_VERSION)
-		})
-	});
-	const exporter = new ConsentLogExporter(stashOffline ? new OfflineLogExporter(otlp, stashOffline) : otlp);
+	const otlp = new OtlpExporter(`${config.endpoint}/v1/logs`, ingestHeaders({
+		ingestKey: config.ingestKey,
+		sdk: sdkHint(SDK_NAME, SDK_VERSION)
+	}), JsonLogsSerializer);
+	const exporter = new ConsentLogExporter(newestFirstOnExit(stashOffline ? new OfflineLogExporter(otlp, stashOffline) : otlp, JsonLogsSerializer));
 	const provider = new LoggerProvider({
 		resource: resourceFromAttributes(resourceAttributes(config)),
 		processors: [new BatchLogRecordProcessor({

package/dist/index.d.mts

@@ -1,4 +1,7 @@
 import "@opentelemetry/api";
+//#region ../browser-session/src/platform/persistence.d.ts
+type Persistence = "browser" | "memory";
+//#endregion
 //#region ../browser-session/src/identity/identity.d.ts
 /**
  * Who the current visitor is.
@@ -57,8 +60,9 @@ interface ErrorFilterOptions {
   readonly beforeCapture?: (error: Error, hint: ErrorFilterHint) => boolean;
   /**
    * HTTP response statuses that make a client request span an error (and so an
-   * issue), e.g. `[[500, 599]]`. Default none: a response status alone is not
-   * an error, and a network failure always is.
+   * issue). Default `[[400, 599]]`, as the HTTP semantic conventions say for
+   * client spans; narrow it, e.g. `[[500, 599]]`, to count fewer. A network
+   * failure is always an error.
    */
   readonly captureHttpStatus?: ReadonlyArray<HttpStatusRange>;
   /**
@@ -232,6 +236,13 @@ interface MapleBrowserConfig extends SignalOptions {
      * purges any id already stored.
      */
     readonly persistVisitorId?: boolean;
+    /**
+     * `"memory"` keeps everything in memory: no cookies, localStorage,
+     * sessionStorage or IndexedDB, and no visitor id. Each page load is a new
+     * session, so a reload splits a replay, and `transport.offline` keeps
+     * nothing. Default `"browser"`.
+     */
+    readonly persistence?: Persistence;
     /**
      * Scope the visitor-id cookie to the registered domain, so a marketing site
      * and an app on sibling subdomains (`example.com` and `app.example.com`)

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { t as MapleBrowser } from "./src-Bzmp8rVr.mjs";
+import { t as MapleBrowser } from "./src-BiHeZJ9l.mjs";
 export { MapleBrowser };

package/dist/react.mjs

@@ -1,4 +1,4 @@
-import { t as MapleBrowser } from "./src-Bzmp8rVr.mjs";
+import { t as MapleBrowser } from "./src-BiHeZJ9l.mjs";
 import { Component } from "react";
 //#region src/react.ts
 /** Component stacks can run to hundreds of lines; the top of it names the failing tree. */

package/dist/{replay-session-DdVYdHc_.mjs → replay-session-2uaCw3AU.mjs}

@@ -1,5 +1,6 @@
-import { C as postSessionMeta, D as BLOCK_SELECTOR, F as scrubUrl, O as safeEmit, S as postSessionBlob, T as warnDropped, b as gzip, d as startEventSink, g as nextChunkSeq, h as markReplayTriggered, j as withStartedTraceId, k as activeTraceId, m as markActivity, n as getObservedTraceIds, o as startSessionLifecycle, r as publishSessionSink } from "./sink-BOR9_z4b.mjs";
-import { t as installConsoleCapture } from "./console-BrjBnOiX.mjs";
+import { D as reserveKeepalive, F as withStartedTraceId, G as scrubUrl, K as mayUseStorage, M as safeEmit, N as activeTraceId, R as consentRevokedAt, T as postSessionMeta, W as isJsonObject, d as startEventSink, g as nextChunkSeq, h as markReplayTriggered, j as BLOCK_SELECTOR, k as warnDropped, m as markActivity, n as getObservedTraceIds, o as startSessionLifecycle, r as publishSessionSink, w as postSessionBlob, x as gzip } from "./sink-DbEuphC-.mjs";
+import { v as PENDING_CHUNK_KEY, y as clearPendingChunk } from "./src-BiHeZJ9l.mjs";
+import { t as installConsoleCapture } from "./console-Bkd3hBGp.mjs";
 import { record } from "rrweb";
 //#region ../browser-session/src/replay/capture/network.ts
 /** Only text is worth keeping; a body that is an image or a stream is not read. */
@@ -209,13 +210,76 @@ function warnBufferDropped(bytes) {
 	lastDropWarnAt = now;
 	console.warn(`[maple] session replay buffer exceeded ${MAX_BUFFER_BYTES} bytes (dropping ${bytes} buffered bytes; recording continues from the next full snapshot)`);
 }
+const MAX_PENDING_AGE_MS = 6e5;
+const PAGE_STARTED_AT = Date.now();
+/** How long a stored chunk that found the keepalive budget full waits before its one re-attempt. */
+const KEEPALIVE_RETRY_MS = 1e3;
+function isPendingChunk(value) {
+	return isJsonObject(value) && typeof value.sessionId === "string" && typeof value.chunkSeq === "number" && typeof value.isCheckpoint === "boolean" && typeof value.eventCount === "number" && typeof value.durationMs === "number" && typeof value.body === "string" && typeof value.createdAt === "number" && typeof value.target === "string";
+}
+/** Endpoint plus an FNV-1a hash of the key, so the key itself is not stored. */
+function targetOf(config) {
+	let hash = 2166136261;
+	for (const char of config.ingestKey ?? "") hash = Math.imul(hash ^ char.charCodeAt(0), 16777619);
+	return `${config.endpoint}|${hash >>> 0}`;
+}
+function readPending() {
+	if (!mayUseStorage()) return void 0;
+	try {
+		const parsed = JSON.parse(window.sessionStorage.getItem("maple.replay.pending") ?? "null");
+		return isPendingChunk(parsed) ? parsed : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Keep `chunk` unless one is already waiting. False when it was not kept
+* (storage blocked or full): it is then only as durable as its upload.
+*/
+function storePending(chunk) {
+	if (!mayUseStorage()) return false;
+	try {
+		if (readPending()) return false;
+		window.sessionStorage.setItem(PENDING_CHUNK_KEY, JSON.stringify(chunk));
+		return true;
+	} catch {
+		return false;
+	}
+}
 /**
-* gzip and POST one chunk. `seq` is claimed here, monotonic across reloads
+* Remove the stored chunk if it is `meta`'s, reporting whether it was. Whoever
+* removes it sends it, so a seq is posted once: ingest appends an index row per POST.
+*/
+function takePending(meta) {
+	const chunk = readPending();
+	return chunk?.sessionId === meta.sessionId && chunk.chunkSeq === meta.chunkSeq && clearPendingChunk();
+}
+/** Send the chunk an earlier flush left behind, if it is still this recorder's to send; otherwise drop it. */
+function sendPendingChunk(config, sessionId) {
+	const chunk = readPending();
+	if (!chunk) return;
+	if (chunk.target === targetOf(config) && chunk.createdAt > consentRevokedAt() && (chunk.createdAt >= PAGE_STARTED_AT || chunk.sessionId === sessionId && Date.now() - chunk.createdAt <= MAX_PENDING_AGE_MS)) compressAndPost(config, chunk, chunk.body, false, true);
+	else clearPendingChunk();
+}
+/**
+* Claim a seq and upload one chunk. The seq is monotonic across reloads
 * (persisted on the session record), so a refresh continues the sequence
 * instead of overwriting the previous load's blobs.
 */
-async function uploadChunk(config, sessionId, body, chunk, keepalive) {
-	const chunkSeq = nextChunkSeq();
+function uploadChunk(config, sessionId, body, chunk, keepalive) {
+	const meta = {
+		sessionId,
+		chunkSeq: nextChunkSeq(),
+		...chunk
+	};
+	return compressAndPost(config, meta, body, keepalive, keepalive && storePending({
+		...meta,
+		body,
+		createdAt: Date.now(),
+		target: targetOf(config)
+	}));
+}
+async function compressAndPost(config, meta, body, keepalive, stored) {
 	let gzipped;
 	try {
 		gzipped = await gzip(new TextEncoder().encode(body));
@@ -223,13 +287,18 @@ async function uploadChunk(config, sessionId, body, chunk, keepalive) {
 		warnDropped("chunk compression", error);
 		return;
 	}
-	return postSessionBlob(config, {
-		sessionId,
-		chunkSeq,
-		...chunk
-	}, gzipped, keepalive);
+	if (stored) {
+		if (keepalive) {
+			const release = reserveKeepalive(true, gzipped.byteLength);
+			if (release) release();
+			else await new Promise((resolve) => setTimeout(resolve, KEEPALIVE_RETRY_MS));
+		}
+		if (!takePending(meta)) return void 0;
+	}
+	return postSessionBlob(config, meta, gzipped, keepalive);
 }
 function startRecording(config, sessionId) {
+	sendPendingChunk(config, sessionId);
 	let parts = [];
 	let bufferBytes = 0;
 	let bufferHasCheckpoint = false;

package/dist/{sink-BOR9_z4b.mjs → sink-DbEuphC-.mjs}

@@ -1,3 +1,13 @@
+//#region ../browser-session/src/platform/persistence.ts
+const MEMORY_ONLY_KEY = "__MAPLE_BROWSER_MEMORY_ONLY__";
+function configurePersistence(persistence) {
+	if (persistence === "memory") globalThis[MEMORY_ONLY_KEY] = true;
+}
+/** Whether the SDK may write anything to the device. */
+function mayUseStorage() {
+	return globalThis[MEMORY_ONLY_KEY] !== true;
+}
+//#endregion
 //#region ../browser-session/src/platform/url-privacy.ts
 const REDACTED = "REDACTED";
 const SENSITIVE_PARAM = /^(access_token|id_token|refresh_token|token|token_hash|auth|authorization|code|oobcode|state|password|passwd|pwd|pass|secret|client_secret|api_key|apikey|key|signature|sig|otp|jwt|session|sessionid|session_id|ticket|__clerk_ticket|reset_token|magic|nonce|x-amz-signature|x-amz-credential|x-amz-security-token|x-goog-signature|x-goog-credential)$/i;
@@ -141,11 +151,25 @@ function setRawCookie(name, value, domain, maxAgeSeconds) {
 		return false;
 	}
 }
-/** Expire `name` on the shared domain and host-only: it may predate a narrowed scope. */
+/**
+* Expire `name` host-only and on every parent domain it could have been scoped
+* to: it may predate a narrowed scope. Expiring a cookie that does not exist
+* stores nothing, unlike the domain probe, so a memory-only opt-out stays clean.
+*/
 function deleteRawCookie(name) {
-	const domain = cookieDomain();
-	setRawCookie(name, "", domain, 0);
-	if (domain) setRawCookie(name, "", "", 0);
+	setRawCookie(name, "", "", 0);
+	for (const domain of candidateDomains()) setRawCookie(name, "", domain, 0);
+	if (cookieDomainOverride) setRawCookie(name, "", cookieDomainOverride, 0);
+}
+/** Parent domains of this host, broadest first. Empty for single-label hosts and IPs. */
+function candidateDomains() {
+	if (typeof location === "undefined") return [];
+	const hostname = location.hostname;
+	if (!hostname || /^[\d.]+$/.test(hostname) || hostname.includes(":")) return [];
+	const parts = hostname.split(".");
+	const candidates = [];
+	for (let i = parts.length - 2; i >= 0; i--) candidates.push(parts.slice(i).join("."));
+	return candidates;
 }
 /**
 * The broadest domain this browser will actually accept a cookie for, found by
@@ -158,13 +182,8 @@ function deleteRawCookie(name) {
 * for bare IPs, neither of which can carry a `Domain=` attribute.
 */
 function probeCookieDomain() {
-	if (typeof document === "undefined" || typeof location === "undefined") return "";
-	const hostname = location.hostname;
-	if (!hostname || /^[\d.]+$/.test(hostname) || hostname.includes(":")) return "";
-	const parts = hostname.split(".");
-	if (parts.length < 2) return "";
-	for (let i = parts.length - 2; i >= 0; i--) {
-		const candidate = parts.slice(i).join(".");
+	if (typeof document === "undefined") return "";
+	for (const candidate of candidateDomains()) {
 		const probe = "__maple_probe";
 		if (setRawCookie(probe, "1", candidate, 60) && readRawCookie(probe) === "1") {
 			setRawCookie(probe, "", candidate, 0);
@@ -482,6 +501,146 @@ function setVisitorTracking(nextEnabled) {
 	clearVisitClaim();
 }
 //#endregion
+//#region ../browser-session/src/identity/consent.ts
+/**
+* Consent gating for session capture.
+*
+* The posture, deliberately:
+*
+* - `requireConsent` defaults to **false**. Flipping that default would
+*   silently stop telemetry for every existing install — an availability
+*   incident dressed up as a privacy win. Apps that need a consent gate opt in.
+* - Global Privacy Control **is** honored by default, but only against the
+*   persistent visitor id, not the session itself. GPC is a legally recognized
+*   signal in several US states and it maps exactly onto the one cross-session
+*   identifier this SDK stores; the session-scoped capture that powers replay
+*   and error triage is unaffected.
+* - `doNotTrack` is **not** honored by default. It is deprecated, removed from
+*   Safari, and ignored across the industry, so respecting it would mostly mean
+*   dropping data from users who never intended to opt out. Apps can turn it on.
+*/
+/**
+* Consent lives on `globalThis`, for the same reason the event sink does
+* (`events/events-sink.ts`): an app that bundles both `@maple-dev/browser` and the
+* Effect SDK gets **two copies** of this module, and per-copy state would mean
+* `setConsent(true)` on one never releases the other copy's exporters — or, the
+* other way round, one copy capturing while the other believes consent is
+* required. There is one user and one decision, so there is one state.
+*/
+const CONSENT_KEY = "__MAPLE_BROWSER_CONSENT__";
+function consentState() {
+	const owner = globalThis;
+	const existing = owner[CONSENT_KEY];
+	if (existing) {
+		existing.revokedAt ||= 0;
+		return existing;
+	}
+	const fresh = {
+		allowedSince: 0,
+		granted: false,
+		listeners: /* @__PURE__ */ new Set(),
+		requireConsent: false,
+		respectDoNotTrack: false,
+		revokedAt: 0
+	};
+	owner[CONSENT_KEY] = fresh;
+	return fresh;
+}
+/** When consent was last withdrawn, on any page of this origin. Persisted: the grant time resets every load. */
+const REVOKED_AT_KEY = "maple-consent-revoked-at";
+function writeRevokedAt(at) {
+	consentState().revokedAt = at;
+	if (!mayUseStorage()) return;
+	try {
+		localStorage.setItem(REVOKED_AT_KEY, String(at));
+	} catch {}
+}
+/** Epoch ms of the last consent withdrawal on this origin, 0 if never. Data kept from before it must not be sent. */
+function consentRevokedAt() {
+	const inMemory = consentState().revokedAt;
+	if (!mayUseStorage()) return inMemory;
+	try {
+		return Math.max(inMemory, Number(localStorage.getItem(REVOKED_AT_KEY)) || 0);
+	} catch {
+		return inMemory;
+	}
+}
+function updateEffectiveConsent(previous) {
+	const state = consentState();
+	const allowed = hasConsent();
+	if (allowed === previous) return;
+	state.allowedSince = allowed ? Date.now() : Number.POSITIVE_INFINITY;
+	for (const listener of state.listeners) try {
+		listener(allowed);
+	} catch {}
+}
+/**
+* Apply the host app's privacy config. Call before anything captures.
+*
+* Both SDKs call this at startup, and an app can init one of them without a
+* `privacy` block — so the gates only ever **tighten**. Letting the second
+* caller's absent option reset `requireConsent` back to false would silently
+* disable a gate the first caller asked for, and the resulting
+* denied→allowed transition would start capture on a user who never consented.
+* To genuinely relax a gate, reload without it.
+*/
+function configurePrivacy(options) {
+	const state = consentState();
+	const previous = hasConsent();
+	state.requireConsent = state.requireConsent || (options?.requireConsent ?? false);
+	state.respectDoNotTrack = state.respectDoNotTrack || (options?.respectDoNotTrack ?? false);
+	configurePersistence(options?.persistence);
+	configureVisitorCookie({
+		crossSubdomainCookie: options?.crossSubdomainCookie,
+		cookieDomain: options?.cookieDomain
+	});
+	if (options?.sanitizeUrl) addUrlSanitizer(options.sanitizeUrl);
+	updateEffectiveConsent(previous);
+}
+/** Record the user's consent decision. No-op unless `requireConsent` is set. */
+function setConsent(nextGranted) {
+	const previous = hasConsent();
+	const state = consentState();
+	if (state.granted && !nextGranted) writeRevokedAt(Date.now());
+	state.granted = nextGranted;
+	updateEffectiveConsent(previous);
+}
+/** Whether capture may proceed at all. */
+function hasConsent() {
+	const state = consentState();
+	return !state.requireConsent || state.granted;
+}
+/**
+* Subscribe to effective capture permission changes. The listener is invoked
+* only when capture actually transitions between allowed and denied; changing
+* the stored decision while `requireConsent` is off is deliberately silent.
+*/
+function onConsentChange(listener) {
+	const { listeners } = consentState();
+	listeners.add(listener);
+	return () => listeners.delete(listener);
+}
+/**
+* Earliest epoch-ms timestamp telemetry may export for the current grant.
+* `Infinity` means capture is denied. Exporters use this to discard anything
+* buffered before a late grant or across a revoke/re-grant cycle.
+*/
+function consentAllowedSince() {
+	return hasConsent() ? consentState().allowedSince : Number.POSITIVE_INFINITY;
+}
+/**
+* Whether a *persistent* identifier may be stored. Separate from `hasConsent`
+* because GPC/DNT suppress the cross-session id without suppressing capture.
+*/
+function mayPersistIdentifier() {
+	if (!hasConsent() || !mayUseStorage()) return false;
+	if (typeof navigator === "undefined") return true;
+	const nav = navigator;
+	if (nav.globalPrivacyControl === true) return false;
+	if (consentState().respectDoNotTrack && nav.doNotTrack === "1") return false;
+	return true;
+}
+//#endregion
 //#region ../browser-session/src/events/trace-id.ts
 const ZERO_TRACE_ID = "00000000000000000000000000000000";
 let traceIdProvider = () => void 0;
@@ -676,25 +835,38 @@ function warnDropped(what, error) {
 	const now = Date.now();
 	if (now - (lastWarnAt.get(what) ?? 0) < 3e4) return;
 	lastWarnAt.set(what, now);
-	console.warn(`[maple] session replay ${what} failed (dropping; will retry on next chunk):`, error);
+	console.warn(`[maple] session ${what} failed:`, error);
 }
 /**
 * Combined budget for this SDK's in-flight `keepalive` bodies.
 *
 * The Fetch spec caps the *combined* in-flight keepalive body at 64 KiB per
-* page, and the browser rejects a request that would cross it. On the way out
-* up to three of our writes go at once (metadata row, final events batch, last
-* replay chunk), so the budget has to be shared rather than checked per
-* request. It stops short of 64 KiB because the OTLP trace exporter spends
-* from the same page-wide allowance under its own accounting.
+* document, and the browser rejects a request that would cross it. On the way
+* out several of our writes go at once (the session's final metadata row and
+* events batch, a replay chunk, either SDK's OTLP export), so the budget has
+* to be shared rather than checked per request. OTLP's own share is capped
+* ({@link OTLP_KEEPALIVE_BYTES}), which keeps room for the session rows
+* whichever is issued first.
 *
-* Over the budget a write goes out as a normal request, which the page may or
-* may not survive long enough to finish: strictly better than a guaranteed
+* The budget stops short of 64 KiB for keepalive requests it cannot count,
+* the host page's own among them. That is headroom, not a guarantee.
+*
+* Over the budget a write goes out as a normal request, which the browser
+* terminates if the document unloads first: still better than a guaranteed
 * rejection.
 */
 const KEEPALIVE_BUDGET_BYTES = 49152;
-/** On `globalThis`: two bundled SDK copies still share one page-wide allowance. */
+/** The most of the budget that OTLP requests hold between them. */
+const OTLP_KEEPALIVE_BYTES = 32768;
+/**
+* Largest body of newest items an OTLP flush sends first from a hidden or
+* unloading document. Two signals' worth leaves about 4 KiB of OTLP's share
+* for a metrics snapshot.
+*/
+const OTLP_UNLOAD_TAIL_BYTES = 14336;
+/** On `globalThis`: two bundled SDK copies still share one per-document allowance. */
 const KEEPALIVE_KEY = "__MAPLE_KEEPALIVE_INFLIGHT__";
+/** `otlpBytes` is absent on a holder created by an SDK copy that predates it. */
 function keepaliveInflight() {
 	const owner = globalThis;
 	const existing = owner[KEEPALIVE_KEY];
@@ -703,20 +875,28 @@ function keepaliveInflight() {
 	owner[KEEPALIVE_KEY] = fresh;
 	return fresh;
 }
+/** Keepalive bytes an OTLP request could reserve right now: its own share and the total both apply. */
+function otlpKeepaliveRoom() {
+	const inflight = keepaliveInflight();
+	return Math.max(0, Math.min(OTLP_KEEPALIVE_BYTES - (inflight.otlpBytes ?? 0), KEEPALIVE_BUDGET_BYTES - inflight.bytes));
+}
 /**
 * Reserve `bytes` of the shared keepalive budget. Returns the release function
-* when the request may use `keepalive`, `undefined` when it must not.
+* when the request may use `keepalive`, `undefined` when it must not. `otlp`
+* marks an OTLP request, which also counts against {@link OTLP_KEEPALIVE_BYTES}.
 */
-function reserveKeepalive(requested, bytes) {
+function reserveKeepalive(requested, bytes, otlp = false) {
 	if (!requested) return void 0;
 	const inflight = keepaliveInflight();
-	if (inflight.bytes + bytes > KEEPALIVE_BUDGET_BYTES) return void 0;
+	if (bytes > (otlp ? otlpKeepaliveRoom() : KEEPALIVE_BUDGET_BYTES - inflight.bytes)) return void 0;
 	inflight.bytes += bytes;
+	if (otlp) inflight.otlpBytes = (inflight.otlpBytes ?? 0) + bytes;
 	let released = false;
 	return () => {
 		if (released) return;
 		released = true;
 		inflight.bytes = Math.max(0, inflight.bytes - bytes);
+		if (otlp) inflight.otlpBytes = Math.max(0, (inflight.otlpBytes ?? 0) - bytes);
 	};
 }
 /** Body size in bytes: the keepalive limit counts bytes, and `string.length` counts UTF-16 units. */
@@ -727,18 +907,19 @@ function byteLength(body) {
 * POST to ingest, spending the shared keepalive budget when `keepalive` is
 * requested. Resolves with the status only: the response body is cancelled
 * before the reservation is released, because the browser counts a keepalive
-* request against the page-wide limit until its response body ends, not
-* until headers arrive. Rejects exactly as `fetch` does; callers own the
-* error policy.
+* request against the per-document limit until its response body ends, not
+* until headers arrive. Rejects exactly as `fetch` does, including when
+* `signal` aborts; callers own the error policy.
 */
-async function postToIngest(url, headers, body, keepalive) {
-	const release = reserveKeepalive(keepalive, byteLength(body));
+async function postToIngest(url, headers, body, keepalive, options = {}) {
+	const release = body.length > KEEPALIVE_BUDGET_BYTES ? void 0 : reserveKeepalive(keepalive, byteLength(body), options.otlp);
 	try {
 		const response = await fetch(url, {
 			method: "POST",
 			headers,
 			body,
-			keepalive: release !== void 0
+			keepalive: release !== void 0,
+			signal: options.signal
 		});
 		await response.body?.cancel().catch(() => {});
 		return {
@@ -783,16 +964,23 @@ async function postSessionMeta(config, row, keepalive = false) {
 		warnDropped("metadata POST", error);
 	});
 }
-/** POST distilled session events (NDJSON, one row per event). Best-effort. */
+/**
+* POST distilled session events (NDJSON, one row per event). Never throws.
+* `"failed"` means no response came back, so the rows may or may not have
+* reached ingest.
+*/
 async function postSessionEvents(config, rows, keepalive = false) {
-	if (rows.length === 0) return;
+	if (rows.length === 0) return "accepted";
 	const body = `${rows.map((row) => JSON.stringify(row)).join("\n")}\n`;
-	await postToIngest(`${config.endpoint}/v1/sessionEvents`, {
-		...ingestHeaders(config),
-		"content-type": "application/x-ndjson"
-	}, body, keepalive).catch((error) => {
+	try {
+		return (await postToIngest(`${config.endpoint}/v1/sessionEvents`, {
+			...ingestHeaders(config),
+			"content-type": "application/x-ndjson"
+		}, body, keepalive)).ok ? "accepted" : "rejected";
+	} catch (error) {
 		warnDropped("events POST", error);
-	});
+		return "failed";
+	}
 }
 const SESSION_EXHAUSTED_STATUS = 413;
 /** POST a gzipped rrweb event chunk. */
@@ -881,7 +1069,7 @@ function isLikelyBot(ua) {
 /** ClickHouse-style `YYYY-MM-DD HH:MM:SS.mmm` in UTC (matches the ingest gateway). */
 function formatCHDateTime(date) {
 	const pad = (n, width = 2) => String(n).padStart(width, "0");
-	return `${date.getUTCFullYear()}-${pad(date.getUTCMonth() + 1)}-${pad(date.getUTCDate())} ${pad(date.getUTCHours())}:${pad(date.getUTCMinutes())}:${pad(date.getUTCSeconds())}.${pad(date.getUTCMilliseconds(), 3)}`;
+	return `${date.getUTCFullYear()}-${pad(date.getUTCMonth() + 1)}-${pad(date.getUTCDate())} ${pad(date.getUTCHours())}:${pad(date.getUTCMinutes())}:${pad(date.getUTCSeconds())}.` + pad(date.getUTCMilliseconds(), 3);
 }
 /**
 * Build one `/v1/sessionReplays/meta` NDJSON row. Shared by `@maple-dev/browser`
@@ -1120,7 +1308,7 @@ function freshRecord(now) {
 	};
 }
 function readRecord() {
-	if (writesFailed && ephemeral) return ephemeral;
+	if (!mayUseStorage() || writesFailed && ephemeral) return ephemeral;
 	try {
 		const raw = window.sessionStorage.getItem(STORAGE_KEY);
 		if (!raw) return void 0;
@@ -1131,6 +1319,7 @@ function readRecord() {
 }
 function writeRecord(record) {
 	ephemeral = record;
+	if (!mayUseStorage()) return;
 	try {
 		window.sessionStorage.setItem(STORAGE_KEY, JSON.stringify(record));
 		writesFailed = false;
@@ -1163,6 +1352,7 @@ function tabNonce() {
 	return fresh;
 }
 function leaseStorage() {
+	if (!mayUseStorage()) return void 0;
 	try {
 		return typeof window !== "undefined" ? window.localStorage : void 0;
 	} catch {
@@ -1498,6 +1688,12 @@ function onSessionEvent(listener) {
 }
 const FLUSH_INTERVAL_MS = 5e3;
 const FLUSH_BYTES = 65536;
+/** Events across which an in-flight POST can fail although ingest stored it. */
+const PAGE_TRANSITIONS = [
+	"beforeunload",
+	"pagehide",
+	"visibilitychange"
+];
 /**
 * The sink is a per-session singleton, published on `globalThis` rather than a
 * module-level variable.
@@ -1533,16 +1729,28 @@ function startEventSink(config, sessionId) {
 	}
 	let buffer = [];
 	let bufferBytes = 0;
+	let retry = [];
 	let seq = 0;
 	let pageViews = 0;
 	let clickCount = 0;
 	let errorCount = 0;
+	let pageTransitions = 0;
+	const onPageTransition = (event) => {
+		pageTransitions++;
+		if (event.type === "pagehide") retry = [];
+	};
+	const pageTarget = typeof globalThis.addEventListener === "function" ? globalThis : void 0;
+	for (const type of PAGE_TRANSITIONS) pageTarget?.addEventListener(type, onPageTransition);
 	const flush = async (keepalive = false) => {
-		if (buffer.length === 0) return;
-		const batch = buffer;
+		const fresh = buffer.map(({ ev, seq }) => toRow(config, sessionId, ev, seq));
+		const rows = keepalive ? fresh : [...retry, ...fresh];
+		if (rows.length === 0) return;
+		if (!keepalive) retry = [];
 		buffer = [];
 		bufferBytes = 0;
-		await postSessionEvents(config, batch.map(({ ev, seq }) => toRow(config, sessionId, ev, seq)), keepalive);
+		const transitionsAtSend = pageTransitions;
+		if (await postSessionEvents(config, rows, keepalive) !== "failed" || keepalive || pageTransitions !== transitionsAtSend) return;
+		retry = [...fresh, ...retry];
 	};
 	const emit = (ev) => {
 		const session = markActivity();
@@ -1580,6 +1788,7 @@ function startEventSink(config, sessionId) {
 		flush,
 		stop: () => {
 			clearInterval(flushTimer);
+			for (const type of PAGE_TRANSITIONS) pageTarget?.removeEventListener(type, onPageTransition);
 			stopNavigation();
 			stopBaselineCapture();
 			if (holder()[SINK_KEY]?.sink === sink) holder()[SINK_KEY] = void 0;
@@ -1919,8 +2128,9 @@ const observedTraceIdsBySession = /* @__PURE__ */ new Map();
 * unbounded — and the whole set is serialized into the `ended` metadata row,
 * which is written with `keepalive` on the way out. The Fetch spec caps the
 * *combined* keepalive body across in-flight requests at 64 KiB, shared here
-* with the final events flush and the last replay chunk, so an app emitting a
-* span a second would silently lose its entire session row after ~30 minutes.
+* with the final events flush, a replay chunk and either SDK's OTLP
+* export, so an app emitting a span a second would silently lose its entire
+* session row after ~30 minutes.
 *
 * Keep-first rather than keep-last: the ids are a join key for "show me this
 * session's traces", the UI paginates them anyway, and dropping the tail of a
@@ -1977,4 +2187,4 @@ function readSessionSink() {
 	return globalThis[SESSION_SINK_KEY];
 }
 //#endregion
-export { setActiveTraceIdProvider as A, postSessionMeta as C, BLOCK_SELECTOR as D, selectorOf as E, scrubUrl as F, configureVisitorCookie as M, setVisitorTracking as N, safeEmit as O, addUrlSanitizer as P, postSessionBlob as S, warnDropped as T, rotateSession as _, recordTraceId as a, gzip as b, getActiveSink as c, startEventSink as d, claimReplayMode as f, nextChunkSeq as g, markReplayTriggered as h, readSessionSink as i, withStartedTraceId as j, activeTraceId as k, onSessionEvent as l, markActivity as m, getObservedTraceIds as n, startSessionLifecycle as o, getSession as p, publishSessionSink as r, clearPendingEvents as s, clearSessionSink as t, queuePending as u, postSessionMetaRow as v, sdkHint as w, ingestHeaders as x, isLikelyBot as y };
+export { selectorOf as A, mayPersistIdentifier as B, otlpKeepaliveRoom as C, reserveKeepalive as D, postToIngest as E, withStartedTraceId as F, scrubUrl as G, setConsent as H, configurePrivacy as I, mayUseStorage as K, consentAllowedSince as L, safeEmit as M, activeTraceId as N, sdkHint as O, setActiveTraceIdProvider as P, consentRevokedAt as R, ingestHeaders as S, postSessionMeta as T, setVisitorTracking as U, onConsentChange as V, isJsonObject as W, rotateSession as _, recordTraceId as a, OTLP_UNLOAD_TAIL_BYTES as b, getActiveSink as c, startEventSink as d, claimReplayMode as f, nextChunkSeq as g, markReplayTriggered as h, readSessionSink as i, BLOCK_SELECTOR as j, warnDropped as k, onSessionEvent as l, markActivity as m, getObservedTraceIds as n, startSessionLifecycle as o, getSession as p, publishSessionSink as r, clearPendingEvents as s, clearSessionSink as t, queuePending as u, postSessionMetaRow as v, postSessionBlob as w, gzip as x, isLikelyBot as y, hasConsent as z };

package/dist/{src-Bzmp8rVr.mjs → src-BiHeZJ9l.mjs}

@@ -1,144 +1,13 @@
-import { A as setActiveTraceIdProvider, F as scrubUrl, M as configureVisitorCookie, N as setVisitorTracking, P as addUrlSanitizer, _ as rotateSession, a as recordTraceId, c as getActiveSink, d as startEventSink, f as claimReplayMode, i as readSessionSink, n as getObservedTraceIds, o as startSessionLifecycle, p as getSession, r as publishSessionSink, s as clearPendingEvents, t as clearSessionSink, u as queuePending, v as postSessionMetaRow, w as sdkHint, x as ingestHeaders, y as isLikelyBot } from "./sink-BOR9_z4b.mjs";
+import { B as mayPersistIdentifier, C as otlpKeepaliveRoom, E as postToIngest, G as scrubUrl, H as setConsent, I as configurePrivacy, L as consentAllowedSince, O as sdkHint, P as setActiveTraceIdProvider, S as ingestHeaders, U as setVisitorTracking, V as onConsentChange, _ as rotateSession, a as recordTraceId, b as OTLP_UNLOAD_TAIL_BYTES, c as getActiveSink, d as startEventSink, f as claimReplayMode, i as readSessionSink, n as getObservedTraceIds, o as startSessionLifecycle, p as getSession, r as publishSessionSink, s as clearPendingEvents, t as clearSessionSink, u as queuePending, v as postSessionMetaRow, y as isLikelyBot, z as hasConsent } from "./sink-DbEuphC-.mjs";
 import { ProxyTracerProvider, SpanKind, SpanStatusCode, TraceFlags, context, createContextKey, createTraceState, isSpanContextValid, propagation, trace } from "@opentelemetry/api";
 import { BatchSpanProcessor, SamplingDecision } from "@opentelemetry/sdk-trace-base";
-import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";
 import { registerInstrumentations } from "@opentelemetry/instrumentation";
 import { FetchInstrumentation } from "@opentelemetry/instrumentation-fetch";
 import { XMLHttpRequestInstrumentation } from "@opentelemetry/instrumentation-xml-http-request";
+import { JsonTraceSerializer } from "@opentelemetry/otlp-transformer";
 import { resourceFromAttributes } from "@opentelemetry/resources";
 import { WebTracerProvider } from "@opentelemetry/sdk-trace-web";
 import { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION } from "@opentelemetry/semantic-conventions";
-//#region ../browser-session/src/identity/consent.ts
-/**
-* Consent gating for session capture.
-*
-* The posture, deliberately:
-*
-* - `requireConsent` defaults to **false**. Flipping that default would
-*   silently stop telemetry for every existing install — an availability
-*   incident dressed up as a privacy win. Apps that need a consent gate opt in.
-* - Global Privacy Control **is** honored by default, but only against the
-*   persistent visitor id, not the session itself. GPC is a legally recognized
-*   signal in several US states and it maps exactly onto the one cross-session
-*   identifier this SDK stores; the session-scoped capture that powers replay
-*   and error triage is unaffected.
-* - `doNotTrack` is **not** honored by default. It is deprecated, removed from
-*   Safari, and ignored across the industry, so respecting it would mostly mean
-*   dropping data from users who never intended to opt out. Apps can turn it on.
-*/
-/**
-* Consent lives on `globalThis`, for the same reason the event sink does
-* (`events/events-sink.ts`): an app that bundles both `@maple-dev/browser` and the
-* Effect SDK gets **two copies** of this module, and per-copy state would mean
-* `setConsent(true)` on one never releases the other copy's exporters — or, the
-* other way round, one copy capturing while the other believes consent is
-* required. There is one user and one decision, so there is one state.
-*/
-const CONSENT_KEY = "__MAPLE_BROWSER_CONSENT__";
-function consentState() {
-	const owner = globalThis;
-	const existing = owner[CONSENT_KEY];
-	if (existing) return existing;
-	const fresh = {
-		allowedSince: 0,
-		granted: false,
-		listeners: /* @__PURE__ */ new Set(),
-		requireConsent: false,
-		respectDoNotTrack: false
-	};
-	owner[CONSENT_KEY] = fresh;
-	return fresh;
-}
-/** When consent was last withdrawn, on any page of this origin. Persisted: the grant time resets every load. */
-const REVOKED_AT_KEY = "maple-consent-revoked-at";
-function writeRevokedAt(at) {
-	try {
-		localStorage.setItem(REVOKED_AT_KEY, String(at));
-	} catch {}
-}
-/** Epoch ms of the last consent withdrawal on this origin, 0 if never. Data kept from before it must not be sent. */
-function consentRevokedAt() {
-	try {
-		return Number(localStorage.getItem(REVOKED_AT_KEY)) || 0;
-	} catch {
-		return 0;
-	}
-}
-function updateEffectiveConsent(previous) {
-	const state = consentState();
-	const allowed = hasConsent();
-	if (allowed === previous) return;
-	state.allowedSince = allowed ? Date.now() : Number.POSITIVE_INFINITY;
-	for (const listener of state.listeners) try {
-		listener(allowed);
-	} catch {}
-}
-/**
-* Apply the host app's privacy config. Call before anything captures.
-*
-* Both SDKs call this at startup, and an app can init one of them without a
-* `privacy` block — so the gates only ever **tighten**. Letting the second
-* caller's absent option reset `requireConsent` back to false would silently
-* disable a gate the first caller asked for, and the resulting
-* denied→allowed transition would start capture on a user who never consented.
-* To genuinely relax a gate, reload without it.
-*/
-function configurePrivacy(options) {
-	const state = consentState();
-	const previous = hasConsent();
-	state.requireConsent = state.requireConsent || (options?.requireConsent ?? false);
-	state.respectDoNotTrack = state.respectDoNotTrack || (options?.respectDoNotTrack ?? false);
-	configureVisitorCookie({
-		crossSubdomainCookie: options?.crossSubdomainCookie,
-		cookieDomain: options?.cookieDomain
-	});
-	if (options?.sanitizeUrl) addUrlSanitizer(options.sanitizeUrl);
-	updateEffectiveConsent(previous);
-}
-/** Record the user's consent decision. No-op unless `requireConsent` is set. */
-function setConsent(nextGranted) {
-	const previous = hasConsent();
-	const state = consentState();
-	if (state.granted && !nextGranted) writeRevokedAt(Date.now());
-	state.granted = nextGranted;
-	updateEffectiveConsent(previous);
-}
-/** Whether capture may proceed at all. */
-function hasConsent() {
-	const state = consentState();
-	return !state.requireConsent || state.granted;
-}
-/**
-* Subscribe to effective capture permission changes. The listener is invoked
-* only when capture actually transitions between allowed and denied; changing
-* the stored decision while `requireConsent` is off is deliberately silent.
-*/
-function onConsentChange(listener) {
-	const { listeners } = consentState();
-	listeners.add(listener);
-	return () => listeners.delete(listener);
-}
-/**
-* Earliest epoch-ms timestamp telemetry may export for the current grant.
-* `Infinity` means capture is denied. Exporters use this to discard anything
-* buffered before a late grant or across a revoke/re-grant cycle.
-*/
-function consentAllowedSince() {
-	return hasConsent() ? consentState().allowedSince : Number.POSITIVE_INFINITY;
-}
-/**
-* Whether a *persistent* identifier may be stored. Separate from `hasConsent`
-* because GPC/DNT suppress the cross-session id without suppressing capture.
-*/
-function mayPersistIdentifier() {
-	if (!hasConsent()) return false;
-	if (typeof navigator === "undefined") return true;
-	const nav = navigator;
-	if (nav.globalPrivacyControl === true) return false;
-	if (consentState().respectDoNotTrack && nav.doNotTrack === "1") return false;
-	return true;
-}
-//#endregion
 //#region ../browser-session/src/identity/identity.ts
 /**
 * Trait caps. The warehouse column is `Map(String, String)` — plain keys
@@ -228,6 +97,18 @@ function startMetadataSession(options) {
 	});
 }
 //#endregion
+//#region ../browser-session/src/session/pending-chunk.ts
+const PENDING_CHUNK_KEY = "maple.replay.pending";
+/** Remove the stored chunk. False when storage is blocked: nothing is known to be removed. */
+function clearPendingChunk() {
+	try {
+		window.sessionStorage.removeItem(PENDING_CHUNK_KEY);
+		return true;
+	} catch {
+		return false;
+	}
+}
+//#endregion
 //#region ../browser-session/src/events/props.ts
 const MAX_PROPS = 32;
 const MAX_PROP_KEY_LENGTH = 64;
@@ -542,6 +423,8 @@ function resolveHeaderCapture(raw) {
 }
 //#endregion
 //#region ../sdk-core/src/http-status.ts
+/** The statuses the HTTP semantic conventions make a client span Error for: every 4xx and 5xx. */
+const DEFAULT_ERROR_STATUS = [[400, 599]];
 const inStatusRanges = (status, ranges) => ranges.some((range) => typeof range === "number" ? range === status : status >= range[0] && status <= range[1]);
 /** The status on a span's attributes, current or pre-1.23 semconv key. */
 function responseStatus(read) {
@@ -550,17 +433,12 @@ function responseStatus(read) {
 	if (typeof value === "string" && /^\d{3}$/.test(value)) return Number(value);
 }
 /**
-* The `error.type` / `error.message` pair for a listed status or a network
-* failure (`TypeError`, `timeout`), e.g. `POST https://api.example.com/users/42 -> 503`.
-* The query is dropped; ids in the path are redacted by the issue fingerprint.
+* The `error.type` for a counted status or a network failure (`TypeError`,
+* `timeout`), per the HTTP semantic conventions. No message: `error.message` is
+* deprecated, and the status code already says what went wrong.
 */
-function httpStatusError(read, status) {
-	const method = read("http.request.method") ?? read("http.method") ?? "GET";
-	const url = String(read("url.full") ?? read("http.url") ?? "").replace(/[?#].*$/, "");
-	return {
-		"error.type": String(status),
-		"error.message": `${String(method)} ${url} -> ${status}`
-	};
+function httpErrorType(status) {
+	return { "error.type": String(status) };
 }
 //#endregion
 //#region ../sdk-core/src/log-record.ts
@@ -842,7 +720,7 @@ function withStatus(span, status, attributes) {
 var HttpStatusExporter = class {
 	inner;
 	captureStatus;
-	constructor(inner, captureStatus = []) {
+	constructor(inner, captureStatus = DEFAULT_ERROR_STATUS) {
 		this.inner = inner;
 		this.captureStatus = captureStatus;
 	}
@@ -853,14 +731,9 @@ var HttpStatusExporter = class {
 			if (span.events.some((event) => event.name === "exception")) return span;
 			return withStatus(span, { code: SpanStatusCode.ERROR }, {
 				...span.attributes,
-				...httpStatusError(read, status)
+				...httpErrorType(status)
 			});
 		}
-		const errorType = span.attributes["error.type"];
-		if (span.kind === SpanKind.CLIENT && span.status.code === SpanStatusCode.ERROR && typeof errorType === "string" && !HTTP_STATUS.test(errorType) && span.attributes["error.message"] === void 0 && !span.events.some((event) => event.name === "exception")) return withStatus(span, span.status, {
-			...span.attributes,
-			"error.message": httpStatusError(read, errorType)["error.message"]
-		});
 		if (!isStatusOnlyError(span)) return span;
 		const { "error.type": _errorType, ...attributes } = span.attributes;
 		return withStatus(span, { code: SpanStatusCode.UNSET }, attributes);
@@ -913,8 +786,144 @@ var OfflineSpanExporter = class {
 	}
 };
 //#endregion
+//#region src/otlp.ts
+const EXPORT_TIMEOUT_MS = 1e4;
+const RETRYABLE_STATUS = [
+	429,
+	502,
+	503,
+	504
+];
+/** Keepalive room the export being handed over must leave free; set for the older part of a split. */
+let reserve = 0;
+/**
+* Send one body, retrying with a jittered backoff (1s, growing 1.5x) until the
+* next wait would pass the deadline. The first request is issued before this
+* returns, which an unload flush needs. Keepalive is asked for only while
+* `leaveFree` bytes of OTLP's room would remain after the body.
+*/
+async function send(url, headers, body, leaveFree) {
+	const deadline = Date.now() + EXPORT_TIMEOUT_MS;
+	let timeoutMs = EXPORT_TIMEOUT_MS;
+	let backoff = 1e3;
+	for (;;) {
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), timeoutMs);
+		const keepalive = body.byteLength + leaveFree <= otlpKeepaliveRoom();
+		const failure = await postToIngest(url, headers, body, keepalive, {
+			signal: controller.signal,
+			otlp: true
+		}).then((response) => response.ok ? void 0 : {
+			error: /* @__PURE__ */ new Error(`OTLP export failed: ${response.status}`),
+			retryable: RETRYABLE_STATUS.includes(response.status)
+		}, (cause) => ({
+			error: new Error("OTLP export failed", { cause }),
+			retryable: cause instanceof TypeError
+		})).finally(() => clearTimeout(timer));
+		if (!failure) return { code: 0 };
+		const wait = backoff * (.8 + Math.random() * .4);
+		timeoutMs = deadline - Date.now();
+		if (!failure.retryable || wait > timeoutMs) return {
+			code: 1,
+			error: failure.error
+		};
+		backoff *= 1.5;
+		await new Promise((resolve) => setTimeout(resolve, wait));
+	}
+}
+/** Exports each batch as one OTLP/JSON request to `url`. */
+var OtlpExporter = class {
+	url;
+	headers;
+	serializer;
+	inflight = /* @__PURE__ */ new Set();
+	constructor(url, headers, serializer) {
+		this.url = url;
+		this.headers = headers;
+		this.serializer = serializer;
+	}
+	export(items, callback) {
+		const body = this.serializer.serializeRequest(items);
+		if (!body) {
+			callback({ code: 1 });
+			return;
+		}
+		const headers = {
+			...this.headers,
+			"content-type": "application/json"
+		};
+		const sent = send(this.url, headers, body, reserve).then(callback).catch(() => {});
+		this.inflight.add(sent);
+		sent.finally(() => this.inflight.delete(sent));
+	}
+	/** Resolves once every export in flight has reported its result. */
+	async forceFlush() {
+		await Promise.all(this.inflight);
+	}
+	shutdown() {
+		return this.forceFlush();
+	}
+};
+let unloading = false;
+/**
+* Run a `pagehide` flush. The document still reads as visible there, so the
+* flush says it is leaving; `flush` must issue its exports before it returns.
+*/
+function flushUnloading(flush) {
+	unloading = true;
+	try {
+		flush();
+	} finally {
+		unloading = false;
+	}
+}
+/**
+* The newest items whose body fits what keepalive has room for right now, at
+* most `OTLP_UNLOAD_TAIL_BYTES`, then everything older. No split when nothing
+* or everything fits.
+*/
+function newestFirst(items, serializer) {
+	const limit = Math.min(OTLP_UNLOAD_TAIL_BYTES, otlpKeepaliveRoom());
+	const size = (from) => serializer.serializeRequest(items.slice(from))?.byteLength ?? 0;
+	let start = items.length;
+	while (start > 0 && size(start - 1) <= limit) start -= 1;
+	return start > 0 && start < items.length ? [items.slice(start), items.slice(0, start)] : [items];
+}
+/**
+* A hidden or unloading document may not live to see a response, and a plain
+* request is terminated with it. There each batch becomes two exports: its
+* newest items first, in a body small enough for keepalive, then the rest,
+* which keeps keepalive while it fits and leaves `olderReserve` bytes of room
+* for what is flushed after it. Each goes through `inner` on its own, so only
+* the part that failed is queued.
+*/
+function newestFirstOnExit(inner, serializer, olderReserve = 0) {
+	return {
+		export(items, callback) {
+			const hidden = globalThis.document?.visibilityState === "hidden";
+			const parts = unloading || hidden ? newestFirst(items, serializer) : [items];
+			let pending = parts.length;
+			let failed;
+			for (const [index, part] of parts.entries()) {
+				reserve = index > 0 ? olderReserve : 0;
+				try {
+					inner.export(part, (result) => {
+						if (result.code !== 0) failed = result;
+						pending -= 1;
+						if (pending === 0) callback(failed ?? result);
+					});
+				} finally {
+					reserve = 0;
+				}
+			}
+		},
+		forceFlush: () => inner.forceFlush(),
+		shutdown: () => inner.shutdown()
+	};
+}
+//#endregion
 //#region src/version.ts
-const SDK_VERSION = "0.9.0";
+const SDK_VERSION = "0.10.1";
 /** The `x-maple-sdk` value this build sends. */
 const SDK_NAME = "maple-browser";
 //#endregion
@@ -990,6 +999,8 @@ var ConsentSpanExporter = class {
 * requests for a materially smaller loss window.
 */
 const EXPORT_INTERVAL_MS = 2e3;
+/** Keepalive room the older spans of an exit batch leave for the logs, which are flushed after them. */
+const EXIT_LOGS_RESERVE_BYTES = 8192;
 /**
 * The provider this SDK registered, while it is live. Everything Maple spans
 * goes through it directly: the global provider may belong to the host app,
@@ -1032,14 +1043,11 @@ function resourceAttributes(config) {
 * live id per span instead.
 */
 function setupTracing(config) {
-	const otlp = new OTLPTraceExporter({
-		url: `${config.endpoint}/v1/traces`,
-		headers: ingestHeaders({
-			ingestKey: config.ingestKey,
-			sdk: sdkHint(SDK_NAME, SDK_VERSION)
-		})
-	});
-	const exporter = new ConsentSpanExporter(new HttpStatusExporter(config.offlineQueue ? new OfflineSpanExporter(otlp) : otlp, config.errorFilters.captureHttpStatus));
+	const otlp = new OtlpExporter(`${config.endpoint}/v1/traces`, ingestHeaders({
+		ingestKey: config.ingestKey,
+		sdk: sdkHint(SDK_NAME, SDK_VERSION)
+	}), JsonTraceSerializer);
+	const exporter = new ConsentSpanExporter(new HttpStatusExporter(newestFirstOnExit(config.offlineQueue ? new OfflineSpanExporter(otlp) : otlp, JsonTraceSerializer, EXIT_LOGS_RESERVE_BYTES), config.errorFilters.captureHttpStatus));
 	const provider = new WebTracerProvider({
 		resource: resourceFromAttributes(resourceAttributes(config)),
 		sampler: new SessionSampler(config.tracingSampleRate),
@@ -1056,11 +1064,11 @@ function setupTracing(config) {
 		if (document.visibilityState === "hidden") onExit();
 	};
 	const settledRequests = /* @__PURE__ */ new Map();
-	const onPageHide = () => {
+	const onPageHide = () => flushUnloading(() => {
 		for (const [span, endTime] of settledRequests) if (span.isRecording()) span.end(endTime);
 		settledRequests.clear();
 		onExit();
-	};
+	});
 	const noteSettled = (span) => {
 		for (const settled of settledRequests.keys()) if (!settled.isRecording()) settledRequests.delete(settled);
 		settledRequests.set(span, Date.now());
@@ -1082,7 +1090,7 @@ function setupTracing(config) {
 			const sent = request instanceof Request ? request.headers : new Headers(request.headers);
 			setHeaderAttributes(span, "request", headers.request, (name) => sent.get(name));
 			if (result instanceof Response) setHeaderAttributes(span, "response", headers.response, (name) => result.headers.get(name));
-			else if (result instanceof Error && result.name !== "AbortError" && !request.signal?.aborted) {
+			else if (result instanceof Error && (isTimeout(result, request.signal) || result.name !== "AbortError" && !request.signal?.aborted)) {
 				span.setStatus({
 					code: SpanStatusCode.ERROR,
 					message: result.message
@@ -1118,6 +1126,11 @@ function setupTracing(config) {
 		}
 	};
 }
+/** `AbortSignal.timeout()` aborts with, and rejects the fetch with, a `TimeoutError` DOMException. */
+function isTimeout(error, signal) {
+	const reason = signal?.reason;
+	return error.name === "TimeoutError" || reason instanceof DOMException && reason.name === "TimeoutError";
+}
 function escapeRegExp(value) {
 	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -1268,6 +1281,7 @@ function resolveConfig(config) {
 		maskAllInputs: config.privacy?.maskAllInputs ?? true,
 		maskAllText: config.privacy?.maskAllText ?? false,
 		persistVisitorId: config.privacy?.persistVisitorId ?? true,
+		persistence: config.privacy?.persistence ?? "browser",
 		crossSubdomainCookie: config.privacy?.crossSubdomainCookie ?? true,
 		cookieDomain: config.privacy?.cookieDomain,
 		requireConsent: config.privacy?.requireConsent ?? false,
@@ -1533,7 +1547,7 @@ function init(rawConfig) {
 		if (config.tracingEnabled && config.tracingCaptureErrors && !stopErrorCapture) stopErrorCapture = setupErrorCapture();
 		if (!deferredPending) {
 			setLogIdentity(() => activeConfig?.identity?.id);
-			deferredPending = import("./deferred-CdtlxG0Q.mjs").then(({ startDeferred }) => {
+			deferredPending = import("./deferred-Bv2SmnTY.mjs").then(({ startDeferred }) => {
 				stopDeferred = startDeferred(config);
 			}).catch(() => {});
 		}
@@ -1567,7 +1581,7 @@ function init(rawConfig) {
 		runtime = next;
 		const ownGeneration = ++generation;
 		const stale = () => stopped || !hasConsent() || generation !== ownGeneration || runtime !== next;
-		next.replayPending = import("./replay-session-DdVYdHc_.mjs").then(({ startReplaySession }) => {
+		next.replayPending = import("./replay-session-2uaCw3AU.mjs").then(({ startReplaySession }) => {
 			if (stale()) return;
 			next.replay = startReplaySession({
 				...shared,
@@ -1613,6 +1627,7 @@ function init(rawConfig) {
 		}
 		rotateOnNextStart = runtime !== void 0;
 		clearPendingEvents();
+		clearPendingChunk();
 		setVisitorTracking(false);
 		stopRuntime(false);
 	}) : () => {};
@@ -1682,6 +1697,12 @@ const method = (level) => (message, attributes) => {
 		});
 	} catch {}
 };
+const logger = {
+	debug: method("DEBUG"),
+	info: method("INFO"),
+	warn: method("WARN"),
+	error: method("ERROR")
+};
 //#endregion
 //#region src/index.ts
 /**
@@ -1711,12 +1732,7 @@ const MapleBrowser = {
 	startNavigation,
 	endNavigation,
 	traced,
-	logger: {
-		debug: method("DEBUG"),
-		info: method("INFO"),
-		warn: method("WARN"),
-		error: method("ERROR")
-	}
+	logger
 };
 //#endregion
-export { consentRevokedAt as _, detachLogSink as a, resourceAttributes as c, attachSpanStash as d, claimPageSignal as f, consentAllowedSince as g, severityOf as h, attachLogSink as i, SDK_NAME as l, Severity as m, navigationSpanAt as n, emitLog as o, onErrorRecorded as p, onDocumentPageload as r, liveMapleTracer as s, MapleBrowser as t, SDK_VERSION as u, hasConsent as v, onConsentChange as y };
+export { severityOf as _, detachLogSink as a, resourceAttributes as c, OtlpExporter as d, newestFirstOnExit as f, Severity as g, onErrorRecorded as h, attachLogSink as i, SDK_NAME as l, claimPageSignal as m, navigationSpanAt as n, emitLog as o, attachSpanStash as p, onDocumentPageload as r, liveMapleTracer as s, MapleBrowser as t, SDK_VERSION as u, PENDING_CHUNK_KEY as v, clearPendingChunk as y };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@maple-dev/browser",
-	"version": "0.10.0",
+	"version": "0.11.0",
 	"description": "Maple browser SDK — OpenTelemetry tracing and rrweb session replay in one package. Every span and replay event shares a session id for trace↔replay correlation.",
 	"keywords": [
 		"maple",
@@ -41,14 +41,12 @@
 	},
 	"scripts": {
 		"build": "tsdown",
-		"typecheck": "tsc --noEmit",
+		"typecheck": "tsrs --noEmit",
 		"test": "vitest run",
 		"size": "bun scripts/size.ts"
 	},
 	"dependencies": {
 		"@opentelemetry/api": "^1.9.0",
-		"@opentelemetry/exporter-logs-otlp-http": "^0.222.0",
-		"@opentelemetry/exporter-trace-otlp-http": "^0.222.0",
 		"@opentelemetry/instrumentation": "^0.222.0",
 		"@opentelemetry/instrumentation-fetch": "^0.222.0",
 		"@opentelemetry/instrumentation-xml-http-request": "^0.222.0",
@@ -66,13 +64,13 @@
 		"@maple/sdk-core": "0.1.0",
 		"@types/react": "^19.3.0",
 		"@types/react-dom": "^19.3.0",
-		"@vitest/browser-playwright": "^5.0.2",
+		"@vitest/browser-playwright": "^5.0.3",
 		"playwright": "^1.63.0",
 		"react": "^19.3.0",
 		"react-dom": "^19.3.0",
 		"tsdown": "^0.23.0",
 		"typescript": "^7.0.2",
-		"vitest": "^5.0.2"
+		"vitest": "^5.0.3"
 	},
 	"peerDependencies": {
 		"react": ">=18"
@@ -82,4 +80,4 @@
 			"optional": true
 		}
 	}
-}
+}