@maple-dev/browser 0.8.0 → 0.10.0

package/dist/{sink-D9w1kg0Q.mjs → sink-BOR9_z4b.mjs}

@@ -1,3 +1,185 @@
+//#region ../browser-session/src/platform/url-privacy.ts
+const REDACTED = "REDACTED";
+const SENSITIVE_PARAM = /^(access_token|id_token|refresh_token|token|token_hash|auth|authorization|code|oobcode|state|password|passwd|pwd|pass|secret|client_secret|api_key|apikey|key|signature|sig|otp|jwt|session|sessionid|session_id|ticket|__clerk_ticket|reset_token|magic|nonce|x-amz-signature|x-amz-credential|x-amz-security-token|x-goog-signature|x-goog-credential)$/i;
+/** Sanitizers live on `globalThis`, like consent: one page, one policy, however many SDK copies. */
+const SANITIZERS_KEY = "__MAPLE_URL_SANITIZERS__";
+function sanitizers() {
+	const owner = globalThis;
+	const existing = owner[SANITIZERS_KEY];
+	if (existing instanceof Set) return existing;
+	const fresh = /* @__PURE__ */ new Set();
+	owner[SANITIZERS_KEY] = fresh;
+	return fresh;
+}
+/**
+* Register a host-app sanitizer. Additive, like the consent gates: an SDK
+* initialized without one must not remove the one another SDK was given.
+*/
+function addUrlSanitizer(sanitizer) {
+	sanitizers().add(sanitizer);
+}
+function redactParams(params) {
+	let changed = false;
+	for (const name of new Set(params.keys())) {
+		if (!SENSITIVE_PARAM.test(name)) continue;
+		params.set(name, REDACTED);
+		changed = true;
+	}
+	return changed;
+}
+/**
+* Implicit-flow tokens ride the fragment as `#access_token=…&…`; a hash-routed
+* app carries them in the route's own query, `#/reset?token=…`. The route path
+* is kept either way.
+*/
+function redactFragment(fragment) {
+	if (fragment.startsWith("/") || fragment.startsWith("!/")) {
+		const queryAt = fragment.indexOf("?");
+		if (queryAt === -1) return fragment;
+		const params = new URLSearchParams(fragment.slice(queryAt + 1));
+		return redactParams(params) ? `${fragment.slice(0, queryAt)}?${params.toString()}` : fragment;
+	}
+	if (!fragment.includes("=")) return fragment;
+	const params = new URLSearchParams(fragment);
+	return redactParams(params) ? params.toString() : fragment;
+}
+const ABSOLUTE = /^[a-z][a-z0-9+.-]*:/i;
+const RELATIVE_BASE = "http://relative.invalid";
+/** Redact credential-shaped query and fragment parameters, keeping the URL's form. */
+function redactUrl(url) {
+	if (!url || !url.includes("?") && !url.includes("#")) return url;
+	const absolute = ABSOLUTE.test(url);
+	let parsed;
+	try {
+		parsed = new URL(url, absolute ? void 0 : RELATIVE_BASE);
+	} catch {
+		return url;
+	}
+	let changed = redactParams(parsed.searchParams);
+	const fragment = parsed.hash.slice(1);
+	const redactedFragment = redactFragment(fragment);
+	if (redactedFragment !== fragment) {
+		parsed.hash = redactedFragment;
+		changed = true;
+	}
+	if (!changed) return url;
+	if (absolute) return parsed.href;
+	if (url.startsWith("//")) return parsed.href.slice(parsed.protocol.length);
+	const tail = `${parsed.pathname}${parsed.search}${parsed.hash}`;
+	return url.startsWith("/") ? tail : tail.replace(/^\//, "");
+}
+/**
+* The URL as it may leave the page: default redaction, then every registered
+* host sanitizer. A sanitizer that throws or returns a non-string yields the
+* default-redacted URL rather than the raw one.
+*/
+function scrubUrl(url) {
+	let out = redactUrl(url);
+	for (const sanitizer of sanitizers()) try {
+		const next = sanitizer(out);
+		if (typeof next === "string") out = next;
+	} catch {}
+	return out;
+}
+//#endregion
+//#region ../browser-session/src/platform/cookie.ts
+/** Scope cookies to the registered domain so subdomains share them. */
+let crossSubdomainCookie = true;
+/** Explicit `Domain=` override; `""` forces a host-only cookie. */
+let cookieDomainOverride;
+/** Memoized probe result. `undefined` = not resolved yet. */
+let probedCookieDomain;
+/**
+* Apply the host app's cookie configuration. Called from `configurePrivacy`, so
+* both SDKs get it from the single call they already make.
+*
+* Like the consent gates, this only ever *tightens*: an app that initializes two
+* SDKs, only one of which passes a `privacy` block, must not have the other's
+* absent option widen the cookie back out to every subdomain.
+*
+* "Tighter" for `cookieDomain` means *narrower scope*, which is why this is not
+* first-write-wins: `""` (host-only) is the tightest value there is, and a
+* second SDK asking for it has to win over an earlier `"example.com"`. Between
+* two non-empty domains the shorter one is the broader (`example.com` covers
+* `app.example.com`, not the reverse), so the longer string wins.
+*/
+function configureCookieScope(options) {
+	if (options.crossSubdomainCookie === false) crossSubdomainCookie = false;
+	if (options.cookieDomain !== void 0) cookieDomainOverride = tighterCookieDomain(cookieDomainOverride, options.cookieDomain);
+	probedCookieDomain = void 0;
+}
+/** The narrower of two `Domain=` values, treating `undefined` as "unset". */
+function tighterCookieDomain(current, next) {
+	if (current === void 0) return next;
+	if (current === "" || next === "") return "";
+	return next.length > current.length ? next : current;
+}
+function readRawCookie(name) {
+	if (typeof document === "undefined") return void 0;
+	try {
+		for (const part of document.cookie.split(";")) {
+			const raw = part.trim();
+			if (!raw.startsWith(`${name}=`)) continue;
+			return decodeURIComponent(raw.slice(name.length + 1));
+		}
+	} catch {}
+}
+function setRawCookie(name, value, domain, maxAgeSeconds) {
+	if (typeof document === "undefined") return false;
+	const attributes = [
+		`${name}=${encodeURIComponent(value)}`,
+		"path=/",
+		`max-age=${Math.max(0, Math.floor(maxAgeSeconds))}`,
+		"SameSite=Lax"
+	];
+	if (domain) attributes.push(`domain=.${domain}`);
+	if (typeof location !== "undefined" && location.protocol === "https:") attributes.push("Secure");
+	try {
+		document.cookie = attributes.join("; ");
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** Expire `name` on the shared domain and host-only: it may predate a narrowed scope. */
+function deleteRawCookie(name) {
+	const domain = cookieDomain();
+	setRawCookie(name, "", domain, 0);
+	if (domain) setRawCookie(name, "", "", 0);
+}
+/**
+* The broadest domain this browser will actually accept a cookie for, found by
+* probing rather than by carrying a public-suffix list, the same trick
+* posthog-js uses. Candidates start at the broadest (the last two labels) and
+* narrow a label at a time, with the first that sticks winning, so
+* `app.example.co.uk` tries the rejected `co.uk`, then lands on `example.co.uk`.
+*
+* Returns `""` (host-only cookie) for single-label hosts like `localhost` and
+* for bare IPs, neither of which can carry a `Domain=` attribute.
+*/
+function probeCookieDomain() {
+	if (typeof document === "undefined" || typeof location === "undefined") return "";
+	const hostname = location.hostname;
+	if (!hostname || /^[\d.]+$/.test(hostname) || hostname.includes(":")) return "";
+	const parts = hostname.split(".");
+	if (parts.length < 2) return "";
+	for (let i = parts.length - 2; i >= 0; i--) {
+		const candidate = parts.slice(i).join(".");
+		const probe = "__maple_probe";
+		if (setRawCookie(probe, "1", candidate, 60) && readRawCookie(probe) === "1") {
+			setRawCookie(probe, "", candidate, 0);
+			return candidate;
+		}
+	}
+	return "";
+}
+function cookieDomain() {
+	if (cookieDomainOverride !== void 0) return cookieDomainOverride;
+	if (!crossSubdomainCookie) return "";
+	if (probedCookieDomain === void 0) probedCookieDomain = probeCookieDomain();
+	return probedCookieDomain;
+}
+//#endregion
 //#region ../browser-session/src/platform/json.ts
 /**
 * Minimal structural guards for records read back out of browser storage.
@@ -42,6 +224,88 @@ function isStringRecord(value) {
 	return isJsonObject(value) && Object.values(value).every((entry) => typeof entry === "string");
 }
 //#endregion
+//#region ../browser-session/src/session/idle.ts
+/**
+* Rotate the session after this much inactivity (PostHog's default). The visit
+* claim uses the same window: longer and a rotated session goes unbilled,
+* shorter and one continuous visit is billed twice.
+*/
+const IDLE_TIMEOUT_MS = 18e5;
+//#endregion
+//#region ../browser-session/src/identity/visit.ts
+/**
+* The billable unit: one visit per visitor per idle window, across every tab and
+* subdomain. `SessionId` cannot be that unit: sessionStorage scopes it to one
+* tab and one origin, and it must stay that way because `session_replays`
+* resolves each `(OrgId, SessionId)` by `argMax(field, Version)` over the whole
+* row, so two tabs sharing an id would overwrite each other.
+*
+* The marker is the visit's latest activity, not the moment it was claimed:
+* active tabs keep extending it, so a tab opened an hour into a busy visit is
+* not a second charge, and 30 idle minutes (a session rotation) start a new one.
+*/
+const STORAGE_KEY$2 = "maple.visit";
+/** Cookie names cannot contain `.` per RFC 6265's token grammar. */
+const COOKIE_NAME$1 = "maple_visit";
+/** In-memory copy: all a page load has when persistence is off or blocked. */
+let ephemeral$1;
+function parseMarker(raw) {
+	if (!raw) return void 0;
+	const parsed = Number.parseInt(raw, 10);
+	return Number.isFinite(parsed) ? parsed : void 0;
+}
+function readMarker(persist) {
+	if (!persist) return ephemeral$1;
+	const fromCookie = parseMarker(readRawCookie(COOKIE_NAME$1));
+	if (fromCookie !== void 0) return fromCookie;
+	try {
+		const fromStorage = parseMarker(window.localStorage.getItem(STORAGE_KEY$2));
+		if (fromStorage !== void 0) return fromStorage;
+	} catch {}
+	return ephemeral$1;
+}
+function writeMarker(at, persist) {
+	ephemeral$1 = at;
+	if (!persist) return;
+	const value = String(at);
+	try {
+		window.localStorage.setItem(STORAGE_KEY$2, value);
+	} catch {}
+	setRawCookie(COOKIE_NAME$1, value, cookieDomain(), (IDLE_TIMEOUT_MS - (Date.now() - at)) / 1e3);
+}
+function withinVisit(marker, at) {
+	return marker !== void 0 && Math.abs(at - marker) < 18e5;
+}
+/**
+* Claim the visit `at` belongs to, returning whether this caller is the one
+* charged for it. `persist` is false when visitor tracking is off, which keeps
+* the claim in memory: no identifier-adjacent cookie the host app opted out of.
+*/
+function claimVisit(at, persist) {
+	if (typeof window === "undefined") return false;
+	const marker = readMarker(persist);
+	if (withinVisit(marker, at)) {
+		if (at > marker) writeMarker(at, persist);
+		return false;
+	}
+	writeMarker(at, persist);
+	return true;
+}
+/** Extend the current visit to `at`. Never opens one: only `claimVisit` does. */
+function touchVisit(at, persist) {
+	if (typeof window === "undefined") return;
+	const marker = readMarker(persist);
+	if (withinVisit(marker, at) && at > marker) writeMarker(at, persist);
+}
+/** Drop the claim from every store, for a visitor-tracking opt-out. */
+function clearVisitClaim() {
+	ephemeral$1 = void 0;
+	try {
+		window.localStorage.removeItem(STORAGE_KEY$2);
+	} catch {}
+	deleteRawCookie(COOKIE_NAME$1);
+}
+//#endregion
 //#region ../browser-session/src/identity/visitor.ts
 /**
 * A persistent per-browser visitor id.
@@ -99,96 +363,11 @@ let enabled = true;
 let cached;
 let persisted = false;
 let mintedThisLoad = false;
-/** Scope the cookie to the registered domain so subdomains share the id. */
-let crossSubdomainCookie = true;
-/** Explicit `Domain=` override; `""` forces a host-only cookie. */
-let cookieDomainOverride;
-/** Memoized probe result. `undefined` = not resolved yet. */
-let probedCookieDomain;
 /**
-* Apply the host app's cookie configuration. Called from `configurePrivacy`, so
-* both SDKs get it from the single call they already make.
-*
-* Like the consent gates, this only ever *tightens*: an app that initializes two
-* SDKs, only one of which passes a `privacy` block, must not have the other's
-* absent option widen the cookie back out to every subdomain.
-*
-* "Tighter" for `cookieDomain` means *narrower scope*, which is why this is not
-* first-write-wins: `""` (host-only) is the tightest value there is, and a
-* second SDK asking for it has to win over an earlier `"example.com"`. Between
-* two non-empty domains the shorter one is the broader — `example.com` covers
-* `app.example.com` and not the reverse — so the longer string wins.
+* Kept under this name because `configurePrivacy` and the SDK tests call it;
+* the domain decision lives in `platform/cookie.ts`, shared with the visit claim.
 */
-function configureVisitorCookie(options) {
-	if (options.crossSubdomainCookie === false) crossSubdomainCookie = false;
-	if (options.cookieDomain !== void 0) cookieDomainOverride = tighterCookieDomain(cookieDomainOverride, options.cookieDomain);
-	probedCookieDomain = void 0;
-}
-/** The narrower of two `Domain=` values, treating `undefined` as "unset". */
-function tighterCookieDomain(current, next) {
-	if (current === void 0) return next;
-	if (current === "" || next === "") return "";
-	return next.length > current.length ? next : current;
-}
-function readRawCookie(name) {
-	if (typeof document === "undefined") return void 0;
-	try {
-		for (const part of document.cookie.split(";")) {
-			const raw = part.trim();
-			if (!raw.startsWith(`${name}=`)) continue;
-			return decodeURIComponent(raw.slice(name.length + 1));
-		}
-	} catch {}
-}
-function setRawCookie(name, value, domain, maxAgeSeconds) {
-	if (typeof document === "undefined") return false;
-	const attributes = [
-		`${name}=${encodeURIComponent(value)}`,
-		"path=/",
-		`max-age=${Math.max(0, Math.floor(maxAgeSeconds))}`,
-		"SameSite=Lax"
-	];
-	if (domain) attributes.push(`domain=.${domain}`);
-	if (typeof location !== "undefined" && location.protocol === "https:") attributes.push("Secure");
-	try {
-		document.cookie = attributes.join("; ");
-		return true;
-	} catch {
-		return false;
-	}
-}
-/**
-* The broadest domain this browser will actually accept a cookie for, found by
-* probing rather than by carrying a public-suffix list — the same trick
-* posthog-js uses. Candidates start at the broadest (the last two labels) and
-* narrow a label at a time, with the first that sticks winning — so
-* `app.example.co.uk` tries the rejected `co.uk`, then lands on `example.co.uk`.
-*
-* Returns `""` (host-only cookie) for single-label hosts like `localhost` and
-* for bare IPs, neither of which can carry a `Domain=` attribute.
-*/
-function probeCookieDomain() {
-	if (typeof document === "undefined" || typeof location === "undefined") return "";
-	const hostname = location.hostname;
-	if (!hostname || /^[\d.]+$/.test(hostname) || hostname.includes(":")) return "";
-	const parts = hostname.split(".");
-	if (parts.length < 2) return "";
-	for (let i = parts.length - 2; i >= 0; i--) {
-		const candidate = parts.slice(i).join(".");
-		const probe = "__maple_probe";
-		if (setRawCookie(probe, "1", candidate, 60) && readRawCookie(probe) === "1") {
-			setRawCookie(probe, "", candidate, 0);
-			return candidate;
-		}
-	}
-	return "";
-}
-function cookieDomain() {
-	if (cookieDomainOverride !== void 0) return cookieDomainOverride;
-	if (!crossSubdomainCookie) return "";
-	if (probedCookieDomain === void 0) probedCookieDomain = probeCookieDomain();
-	return probedCookieDomain;
-}
+const configureVisitorCookie = configureCookieScope;
 function parseRecord(raw) {
 	if (!raw) return void 0;
 	const value = parseJsonObject(raw);
@@ -299,9 +478,8 @@ function setVisitorTracking(nextEnabled) {
 	try {
 		window.localStorage.removeItem(STORAGE_KEY$1);
 	} catch {}
-	const domain = cookieDomain();
-	setRawCookie(COOKIE_NAME, "", domain, 0);
-	if (domain) setRawCookie(COOKIE_NAME, "", "", 0);
+	deleteRawCookie(COOKIE_NAME);
+	clearVisitClaim();
 }
 //#endregion
 //#region ../browser-session/src/events/trace-id.ts
@@ -316,6 +494,26 @@ function activeTraceId() {
 	const id = traceIdProvider();
 	return id && id !== ZERO_TRACE_ID ? id : void 0;
 }
+const slots = [];
+/** Report a span that just started. Fills the innermost open slot, first span wins. */
+function noteStartedTraceId(traceId) {
+	const slot = slots.at(-1);
+	if (slot && slot.traceId === void 0 && traceId !== ZERO_TRACE_ID) slot.traceId = traceId;
+}
+/** Run `fn`, returning its result and the trace id of the first span started during it. */
+function withStartedTraceId(fn) {
+	const slot = { traceId: void 0 };
+	slots.push(slot);
+	try {
+		return {
+			result: fn(),
+			traceId: slot.traceId
+		};
+	} finally {
+		const index = slots.lastIndexOf(slot);
+		if (index !== -1) slots.splice(index, 1);
+	}
+}
 //#endregion
 //#region ../browser-session/src/capture/shared.ts
 /** Emit best-effort: capture must never throw into the host app's call site. */
@@ -359,6 +557,21 @@ function truncate(stack) {
 	if (!stack) return void 0;
 	return stack.length > MAX_STACK ? `${stack.slice(0, MAX_STACK)}…` : stack;
 }
+const BLOCK_SELECTOR = `[data-rr-block]`;
+/**
+* Whether `el` sits inside a blocked subtree. Mirrors rrweb's own ancestor
+* check so the two capture paths agree on what is hidden.
+*
+* Walks parents rather than using `closest()`: no string reaches a selector
+* parser, so a malformed marker cannot throw into the host app's event handler.
+*/
+const isBlocked = (el) => {
+	for (let node = el; node !== null; node = node.parentElement) {
+		if (node.classList?.contains("rr-block")) return true;
+		if (node.hasAttribute?.("data-rr-block")) return true;
+	}
+	return false;
+};
 //#endregion
 //#region ../browser-session/src/capture/interactions.ts
 const MAX_TEXT = 120;
@@ -366,7 +579,8 @@ const MAX_TEXT = 120;
 * Capture clicks and input events as session events. Listens in the capture
 * phase so it sees interactions even when the host app calls
 * `stopPropagation()`. Input *values* are never recorded; only the target
-* element. Click target text is omitted when `maskAllText` is set.
+* element. Click target text is omitted when `maskAllText` is set, and when the
+* target sits inside a blocked (`.rr-block` / `data-rr-block`) subtree.
 */
 function installInteractionCapture(emit, maskAllText) {
 	const onClick = (event) => {
@@ -375,7 +589,7 @@ function installInteractionCapture(emit, maskAllText) {
 		safeEmit(emit, {
 			type: "click",
 			targetSelector: selectorOf(target),
-			targetText: maskAllText ? void 0 : textOf(target)
+			targetText: maskAllText || isBlocked(target) ? void 0 : textOf(target)
 		});
 	};
 	const onInput = (event) => {
@@ -448,11 +662,13 @@ const browserDocument = () => globalThis.document;
 const SDK_HINT_HEADER = "x-maple-sdk";
 /** `<name>/<version>` — the one shape ingest expects in `x-maple-sdk`. */
 const sdkHint = (name, version) => `${name}/${version}`;
-/** Auth + identity headers shared by every ingest request. */
+/** Auth + identity headers shared by every ingest request. No key, no `Authorization`. */
 function ingestHeaders(config) {
+	const identity = { [SDK_HINT_HEADER]: config.sdk };
+	if (!config.ingestKey) return identity;
 	return {
 		Authorization: `Bearer ${config.ingestKey}`,
-		[SDK_HINT_HEADER]: config.sdk
+		...identity
 	};
 }
 const lastWarnAt = /* @__PURE__ */ new Map();
@@ -463,40 +679,107 @@ function warnDropped(what, error) {
 	console.warn(`[maple] session replay ${what} failed (dropping; will retry on next chunk):`, error);
 }
 /**
-* Largest body we will hand to a `keepalive` fetch.
+* Combined budget for this SDK's in-flight `keepalive` bodies.
+*
+* The Fetch spec caps the *combined* in-flight keepalive body at 64 KiB per
+* page, and the browser rejects a request that would cross it. On the way out
+* up to three of our writes go at once (metadata row, final events batch, last
+* replay chunk), so the budget has to be shared rather than checked per
+* request. It stops short of 64 KiB because the OTLP trace exporter spends
+* from the same page-wide allowance under its own accounting.
 *
-* The Fetch spec caps the *combined* inflight keepalive body at 64 KiB, and on
-* the way out we issue up to three of these at once (metadata row, final events
-* batch, last replay chunk). Over the budget the browser rejects the request
-* outright, so a normal request — which the page may or may not survive long
-* enough to finish — is strictly the better bet than a guaranteed rejection.
+* Over the budget a write goes out as a normal request, which the page may or
+* may not survive long enough to finish: strictly better than a guaranteed
+* rejection.
+*/
+const KEEPALIVE_BUDGET_BYTES = 49152;
+/** On `globalThis`: two bundled SDK copies still share one page-wide allowance. */
+const KEEPALIVE_KEY = "__MAPLE_KEEPALIVE_INFLIGHT__";
+function keepaliveInflight() {
+	const owner = globalThis;
+	const existing = owner[KEEPALIVE_KEY];
+	if (existing) return existing;
+	const fresh = { bytes: 0 };
+	owner[KEEPALIVE_KEY] = fresh;
+	return fresh;
+}
+/**
+* Reserve `bytes` of the shared keepalive budget. Returns the release function
+* when the request may use `keepalive`, `undefined` when it must not.
+*/
+function reserveKeepalive(requested, bytes) {
+	if (!requested) return void 0;
+	const inflight = keepaliveInflight();
+	if (inflight.bytes + bytes > KEEPALIVE_BUDGET_BYTES) return void 0;
+	inflight.bytes += bytes;
+	let released = false;
+	return () => {
+		if (released) return;
+		released = true;
+		inflight.bytes = Math.max(0, inflight.bytes - bytes);
+	};
+}
+/** Body size in bytes: the keepalive limit counts bytes, and `string.length` counts UTF-16 units. */
+function byteLength(body) {
+	return typeof body === "string" ? new TextEncoder().encode(body).byteLength : body.byteLength;
+}
+/**
+* POST to ingest, spending the shared keepalive budget when `keepalive` is
+* requested. Resolves with the status only: the response body is cancelled
+* before the reservation is released, because the browser counts a keepalive
+* request against the page-wide limit until its response body ends, not
+* until headers arrive. Rejects exactly as `fetch` does; callers own the
+* error policy.
 */
-const MAX_KEEPALIVE_BYTES = 49152;
-/** Whether a body of `bytes` may still ride the keepalive budget. */
-function keepaliveFor(requested, bytes) {
-	return requested && bytes <= MAX_KEEPALIVE_BYTES;
+async function postToIngest(url, headers, body, keepalive) {
+	const release = reserveKeepalive(keepalive, byteLength(body));
+	try {
+		const response = await fetch(url, {
+			method: "POST",
+			headers,
+			body,
+			keepalive: release !== void 0
+		});
+		await response.body?.cancel().catch(() => {});
+		return {
+			ok: response.ok,
+			status: response.status
+		};
+	} finally {
+		release?.();
+	}
 }
-/** gzip a byte buffer using the native CompressionStream (no library). */
+/**
+* Smallest well-formed gzip stream: a 10-byte header plus an 8-byte trailer.
+* Anything shorter cannot carry a complete member, whatever it contains.
+*/
+const GZIP_MIN_BYTES = 18;
+/**
+* gzip a byte buffer using the native CompressionStream (no library).
+*
+* Throws rather than returning a partial stream. The write and close promises
+* used to be discarded, so a page torn down mid-compression still resolved
+* `arrayBuffer()` — with only the bytes already flushed — and the caller posted
+* a 3-byte header stub as if it were a complete chunk. Ingest rejected those as
+* corrupt gzip; they were 82% of all replay-blob failures, overwhelmingly from
+* crawlers, which tear the page down on nearly every session.
+*/
 async function gzip(bytes) {
 	const stream = new CompressionStream("gzip");
 	const writer = stream.writable.getWriter();
-	writer.write(bytes);
-	writer.close();
-	const buffer = await new Response(stream.readable).arrayBuffer();
-	return new Uint8Array(buffer);
+	const written = writer.write(bytes).then(() => writer.close());
+	const [buffer] = await Promise.all([new Response(stream.readable).arrayBuffer(), written]);
+	const out = new Uint8Array(buffer);
+	if (out.length < GZIP_MIN_BYTES || out[0] !== 31 || out[1] !== 139 || out[2] !== 8) throw new Error(`gzip produced ${out.length} bytes, not a complete gzip stream`);
+	return out;
 }
 /** POST session metadata (NDJSON, single row). `keepalive` for the final unload write. */
 async function postSessionMeta(config, row, keepalive = false) {
 	const body = `${JSON.stringify(row)}\n`;
-	await fetch(`${config.endpoint}/v1/sessionReplays/meta`, {
-		method: "POST",
-		headers: {
-			...ingestHeaders(config),
-			"content-type": "application/x-ndjson"
-		},
-		body,
-		keepalive: keepaliveFor(keepalive, body.length)
-	}).catch((error) => {
+	await postToIngest(`${config.endpoint}/v1/sessionReplays/meta`, {
+		...ingestHeaders(config),
+		"content-type": "application/x-ndjson"
+	}, body, keepalive).catch((error) => {
 		warnDropped("metadata POST", error);
 	});
 }
@@ -504,15 +787,10 @@ async function postSessionMeta(config, row, keepalive = false) {
 async function postSessionEvents(config, rows, keepalive = false) {
 	if (rows.length === 0) return;
 	const body = `${rows.map((row) => JSON.stringify(row)).join("\n")}\n`;
-	await fetch(`${config.endpoint}/v1/sessionEvents`, {
-		method: "POST",
-		headers: {
-			...ingestHeaders(config),
-			"content-type": "application/x-ndjson"
-		},
-		body,
-		keepalive: keepaliveFor(keepalive, body.length)
-	}).catch((error) => {
+	await postToIngest(`${config.endpoint}/v1/sessionEvents`, {
+		...ingestHeaders(config),
+		"content-type": "application/x-ndjson"
+	}, body, keepalive).catch((error) => {
 		warnDropped("events POST", error);
 	});
 }
@@ -520,20 +798,15 @@ const SESSION_EXHAUSTED_STATUS = 413;
 /** POST a gzipped rrweb event chunk. */
 async function postSessionBlob(config, meta, gzipped, keepalive = false) {
 	try {
-		const response = await fetch(`${config.endpoint}/v1/sessionReplays/blob`, {
-			method: "POST",
-			headers: {
-				...ingestHeaders(config),
-				"content-type": "application/octet-stream",
-				"x-maple-session-id": meta.sessionId,
-				"x-maple-chunk-seq": String(meta.chunkSeq),
-				"x-maple-is-checkpoint": meta.isCheckpoint ? "1" : "0",
-				"x-maple-event-count": String(meta.eventCount),
-				"x-maple-duration-ms": String(meta.durationMs)
-			},
-			body: gzipped,
-			keepalive: keepaliveFor(keepalive, gzipped.byteLength)
-		});
+		const response = await postToIngest(`${config.endpoint}/v1/sessionReplays/blob`, {
+			...ingestHeaders(config),
+			"content-type": "application/octet-stream",
+			"x-maple-session-id": meta.sessionId,
+			"x-maple-chunk-seq": String(meta.chunkSeq),
+			"x-maple-is-checkpoint": meta.isCheckpoint ? "1" : "0",
+			"x-maple-event-count": String(meta.eventCount),
+			"x-maple-duration-ms": String(meta.durationMs)
+		}, gzipped, keepalive);
 		if (response.ok) return "accepted";
 		return response.status === SESSION_EXHAUSTED_STATUS ? "exhausted" : "rejected";
 	} catch (error) {
@@ -558,9 +831,51 @@ function parse(ua) {
 	return {
 		browserName: /edg/i.test(ua) ? "Edge" : /opr|opera/i.test(ua) ? "Opera" : /chrome|crios/i.test(ua) ? "Chrome" : /firefox|fxios/i.test(ua) ? "Firefox" : /safari/i.test(ua) ? "Safari" : "Unknown",
 		osName: /windows/i.test(ua) ? "Windows" : /iphone|ipad|ios/i.test(ua) ? "iOS" : /mac os|macintosh/i.test(ua) ? "macOS" : /android/i.test(ua) ? "Android" : /linux/i.test(ua) ? "Linux" : "Unknown",
-		deviceType: /mobile|iphone|android.*mobile/i.test(ua) ? "mobile" : /ipad|tablet/i.test(ua) ? "tablet" : "desktop"
+		deviceType: /mobile|iphone/i.test(ua) ? "mobile" : /ipad|tablet/i.test(ua) ? "tablet" : "desktop"
 	};
 }
+/**
+* Crawler tokens, every one carrying a delimiter or a scheme on purpose.
+*
+* A bare `bot` substring matches `CUBOT`, an Android phone brand that appears in
+* ordinary mobile UAs, and would file those visitors as crawlers. Requiring
+* `bot/`, `bot;` or `bot)` keeps the `Name/version` and `(compatible; Name;
+* +url)` conventions real crawlers follow while missing the phone. This mirrors
+* the generic tail of the server-side classifier in
+* `@maple/query-engine`'s `user-agent.ts`, deliberately without the ~50 named
+* signatures: every one of those ends in a token already listed here, and the
+* list ships in a size-budgeted bundle to customers.
+*/
+const BOT_TOKENS = [
+	"bot/",
+	"bot;",
+	"bot)",
+	"crawler",
+	"spider",
+	"+http",
+	"headless"
+];
+/**
+* Whether the UA is a crawler rather than a person.
+*
+* Used to route crawlers to a metadata-only session: they still appear in Web
+* Analytics — the server-side classifier is what labels them there — but they do
+* not download rrweb or upload replay chunks. Crawlers execute the beacon and
+* then tear the page down mid-flush, which produced the large majority of all
+* corrupt replay-chunk uploads, and every chunk they did manage to upload spent
+* a customer's replay quota on a session nobody will ever watch.
+*
+* Deliberately does not consult `navigator.webdriver`: it is set by every
+* Playwright and Puppeteer run, headed or not. The `headless` token does match
+* the old headless shell's `HeadlessChrome` UA, which production crawlers use
+* too (see the test cases), so an e2e suite that wants replay recorded runs
+* headed, or sets an explicit `userAgent` without `headless` in it. Chrome's
+* new headless mode can still report `HeadlessChrome/`, so it is not enough.
+*/
+function isLikelyBot(ua) {
+	const lower = ua.toLowerCase();
+	return BOT_TOKENS.some((token) => lower.includes(token));
+}
 //#endregion
 //#region ../browser-session/src/events/meta-row.ts
 /** ClickHouse-style `YYYY-MM-DD HH:MM:SS.mmm` in UTC (matches the ingest gateway). */
@@ -580,8 +895,8 @@ function buildSessionMetaRow(input) {
 	const now = /* @__PURE__ */ new Date();
 	const location = browserLocation();
 	const identity = input.identity;
-	const entryUrl = input.entry?.entryUrl ?? location?.href ?? "";
-	const referrer = input.entry?.referrer ?? "";
+	const entryUrl = scrubUrl(input.entry?.entryUrl || location?.href || "");
+	const referrer = scrubUrl(input.entry?.referrer ?? "");
 	const utm = input.entry?.utm ?? {};
 	const row = {
 		session_id: input.sessionId,
@@ -589,7 +904,7 @@ function buildSessionMetaRow(input) {
 		status: input.status,
 		version: input.version,
 		user_id: identity?.id ?? input.userId ?? "",
-		url_initial: location?.href ?? "",
+		url_initial: entryUrl,
 		user_agent: userAgent,
 		browser_name: ua.browserName,
 		os_name: ua.osName,
@@ -598,15 +913,17 @@ function buildSessionMetaRow(input) {
 		resource_attributes: {
 			"maple.session.recorded": input.recorded ? "true" : "false",
 			"maple.session.replay_format": "rrweb",
+			...input.recorded && input.replayTrigger ? { "maple.session.replay_trigger": input.replayTrigger } : void 0,
 			...input.visitorId && input.visitorIdPersisted === false ? { "maple.visitor.persisted": "false" } : void 0,
 			...input.environment ? {
 				"deployment.environment": input.environment,
 				"deployment.environment.name": input.environment
 			} : void 0,
-			...input.serviceVersion ? { "deployment.commit_sha": input.serviceVersion } : void 0
+			...input.serviceVersion && /^[0-9a-f]{7,40}$/i.test(input.serviceVersion) ? { "vcs.ref.head.revision": input.serviceVersion } : void 0
 		},
 		visitor_id: input.visitorId ?? "",
 		visitor_is_new: input.visitorIsNew ? 1 : 0,
+		billable_start: input.billableStart ? 1 : 0,
 		user_email: (input.captureUserEmail === false ? void 0 : identity?.email) ?? "",
 		user_name: identity?.username ?? "",
 		group_id: identity?.groupId ?? "",
@@ -652,15 +969,10 @@ function pathOf(url) {
 /** POST one session metadata row (NDJSON). Best-effort — never throws. */
 async function postSessionMetaRow(target, row, keepalive = false) {
 	const body = `${JSON.stringify(row)}\n`;
-	await fetch(`${target.endpoint.replace(/\/$/, "")}/v1/sessionReplays/meta`, {
-		method: "POST",
-		headers: {
-			...ingestHeaders(target),
-			"content-type": "application/x-ndjson"
-		},
-		body,
-		keepalive: keepaliveFor(keepalive, body.length)
-	}).catch(() => {});
+	await postToIngest(`${target.endpoint.replace(/\/$/, "")}/v1/sessionReplays/meta`, {
+		...ingestHeaders(target),
+		"content-type": "application/x-ndjson"
+	}, body, keepalive).catch(() => {});
 }
 //#endregion
 //#region ../browser-session/src/platform/approximate-size.ts
@@ -676,8 +988,6 @@ function approximateSize(value) {
 //#endregion
 //#region ../browser-session/src/session/session.ts
 const STORAGE_KEY = "maple.session";
-/** Rotate the session after this much inactivity (PostHog's default). */
-const IDLE_TIMEOUT_MS = 18e5;
 /** Hard cap on a single session's lifetime regardless of activity. */
 const MAX_SESSION_MS = 864e5;
 /**
@@ -735,6 +1045,19 @@ function parseSessionRecord(raw) {
 		if (typeof value.visitorIsNew !== "boolean") return void 0;
 		record.visitorIsNew = value.visitorIsNew;
 	}
+	if (value.billable !== void 0) {
+		if (typeof value.billable !== "boolean") return void 0;
+		record.billable = value.billable;
+	}
+	if (value.replaySampled !== void 0) {
+		if (typeof value.replaySampled !== "boolean") return void 0;
+		record.replaySampled = value.replaySampled;
+	}
+	if (value.replayBuffered !== void 0) {
+		if (typeof value.replayBuffered !== "boolean") return void 0;
+		record.replayBuffered = value.replayBuffered;
+	}
+	if (value.replayTrigger === "error") record.replayTrigger = value.replayTrigger;
 	if (value.utm !== void 0) {
 		if (!isStringRecord(value.utm)) return void 0;
 		record.utm = value.utm;
@@ -750,6 +1073,12 @@ const UTM_KEYS = [
 ];
 /** In-memory fallback when sessionStorage is unavailable (private mode). */
 let ephemeral;
+/**
+* Set while sessionStorage writes throw. On quota exhaustion reads still work,
+* so the stored copy is a frozen snapshot: `metaVersion` pinned at 1 billed
+* every heartbeat as a new session. Keep this separate from the read try/catch.
+*/
+let writesFailed = false;
 const rotationListeners = /* @__PURE__ */ new Set();
 /**
 * Read the entry URL/referrer/UTM of the current page.
@@ -768,11 +1097,12 @@ function readEntryContext() {
 			if (value) utm[key] = value.slice(0, 128);
 		}
 	} catch {}
+	const href = scrubUrl(location.href);
 	return {
-		entryUrl: location.href,
-		entryReferrer: typeof document !== "undefined" ? document.referrer : "",
+		entryUrl: href,
+		entryReferrer: typeof document !== "undefined" ? scrubUrl(document.referrer) : "",
 		utm,
-		lastUrl: location.href,
+		lastUrl: href,
 		pageViews: 0,
 		clickCount: 0,
 		errorCount: 0
@@ -790,6 +1120,7 @@ function freshRecord(now) {
 	};
 }
 function readRecord() {
+	if (writesFailed && ephemeral) return ephemeral;
 	try {
 		const raw = window.sessionStorage.getItem(STORAGE_KEY);
 		if (!raw) return void 0;
@@ -802,10 +1133,112 @@ function writeRecord(record) {
 	ephemeral = record;
 	try {
 		window.sessionStorage.setItem(STORAGE_KEY, JSON.stringify(record));
+		writesFailed = false;
+	} catch {
+		writesFailed = true;
+	}
+	claimTab(record.id);
+}
+const TAB_LEASE_PREFIX = "maple.session.tab.";
+const TAB_LEASE_TTL_MS = 12e4;
+const TAB_LEASE_REFRESH_MS = 5e3;
+const TAB_NONCE_KEY = "__MAPLE_TAB_NONCE__";
+/** The session id this tab has checked (or minted) and may keep using. */
+let verifiedSessionId;
+let leaseWrittenAt = 0;
+let releaseInstalled = false;
+/**
+* Set from `pagehide` until the page is shown again. The lifecycle's own
+* `pagehide` handler posts an `ended` row after ours runs, which writes the
+* record; re-leasing there would make the next load of this tab look like a
+* duplicate and rotate on every reload.
+*/
+let leaseReleased = false;
+function tabNonce() {
+	const owner = globalThis;
+	const existing = owner[TAB_NONCE_KEY];
+	if (typeof existing === "string") return existing;
+	const fresh = crypto.randomUUID();
+	owner[TAB_NONCE_KEY] = fresh;
+	return fresh;
+}
+function leaseStorage() {
+	try {
+		return typeof window !== "undefined" ? window.localStorage : void 0;
+	} catch {
+		return;
+	}
+}
+function readLease(storage, sessionId) {
+	const raw = storage.getItem(`${TAB_LEASE_PREFIX}${sessionId}`);
+	if (!raw) return void 0;
+	const split = raw.lastIndexOf(":");
+	const at = Number(raw.slice(split + 1));
+	return split > 0 && Number.isFinite(at) ? {
+		nonce: raw.slice(0, split),
+		at
+	} : void 0;
+}
+function claimTab(sessionId) {
+	const now = Date.now();
+	if (verifiedSessionId === sessionId && now - leaseWrittenAt < TAB_LEASE_REFRESH_MS) return;
+	if (verifiedSessionId !== void 0 && verifiedSessionId !== sessionId) releaseTab(verifiedSessionId);
+	verifiedSessionId = sessionId;
+	if (leaseReleased) return;
+	leaseWrittenAt = now;
+	const storage = leaseStorage();
+	if (!storage) return;
+	try {
+		storage.setItem(`${TAB_LEASE_PREFIX}${sessionId}`, `${tabNonce()}:${now}`);
+	} catch {}
+	installLeaseRelease();
+}
+function releaseTab(sessionId) {
+	const storage = leaseStorage();
+	if (!storage) return;
+	try {
+		if (readLease(storage, sessionId)?.nonce === tabNonce()) storage.removeItem(`${TAB_LEASE_PREFIX}${sessionId}`);
 	} catch {}
 }
+function installLeaseRelease() {
+	if (releaseInstalled || typeof globalThis.addEventListener !== "function") return;
+	releaseInstalled = true;
+	globalThis.addEventListener("pagehide", () => {
+		leaseReleased = true;
+		if (verifiedSessionId !== void 0) releaseTab(verifiedSessionId);
+	});
+	globalThis.addEventListener("pageshow", () => {
+		leaseReleased = false;
+		leaseWrittenAt = 0;
+	});
+}
+/** Drop leases a crashed tab never released. */
+function pruneLeases(storage, now) {
+	for (let i = storage.length - 1; i >= 0; i--) {
+		const key = storage.key(i);
+		if (!key?.startsWith(TAB_LEASE_PREFIX)) continue;
+		const lease = readLease(storage, key.slice(18));
+		if (!lease || now - lease.at > TAB_LEASE_TTL_MS) storage.removeItem(key);
+	}
+}
+/**
+* Whether another live tab holds `record`'s session. Checked once per session
+* id per tab; after that this tab has claimed it.
+*/
+function ownedByAnotherTab(record, now) {
+	if (verifiedSessionId === record.id) return false;
+	const storage = leaseStorage();
+	if (!storage) return false;
+	try {
+		pruneLeases(storage, now);
+		const lease = readLease(storage, record.id);
+		return lease !== void 0 && lease.nonce !== tabNonce() && now - lease.at <= TAB_LEASE_TTL_MS;
+	} catch {
+		return false;
+	}
+}
 function isSessionExpired(record, now = Date.now()) {
-	return now - record.lastActivityAt > IDLE_TIMEOUT_MS || now - record.startedAt > MAX_SESSION_MS;
+	return now - record.lastActivityAt > 18e5 || now - record.startedAt > MAX_SESSION_MS;
 }
 /** Observe genuine idle/lifetime rotation. Invoked before the new record is installed. */
 function onSessionRotate(listener) {
@@ -839,7 +1272,7 @@ function installRotatedRecord(previous, next) {
 function getSession() {
 	const now = Date.now();
 	const existing = readRecord();
-	if (existing && !isSessionExpired(existing, now)) {
+	if (existing && !isSessionExpired(existing, now) && !ownedByAnotherTab(existing, now)) {
 		const record = {
 			...migrateRecord(existing),
 			lastActivityAt: now
@@ -867,13 +1300,13 @@ function rotateSession() {
 */
 function touchSession(now) {
 	const existing = readRecord();
-	if (existing && !isSessionExpired(existing, now)) {
+	if (existing && !isSessionExpired(existing, now) && !ownedByAnotherTab(existing, now)) {
 		const migrated = migrateRecord(existing);
 		const touched = {
 			...migrated,
 			lastActivityAt: now
 		};
-		if (migrated !== existing || now - existing.lastActivityAt > ACTIVITY_TOUCH_THROTTLE_MS) writeRecord(touched);
+		if (migrated !== existing || verifiedSessionId !== existing.id || now - existing.lastActivityAt > ACTIVITY_TOUCH_THROTTLE_MS) writeRecord(touched);
 		return touched;
 	}
 	const record = freshRecord(now);
@@ -900,7 +1333,7 @@ function noteNavigation(url) {
 	const record = touchSession(now);
 	writeRecord({
 		...record,
-		lastUrl: url,
+		lastUrl: scrubUrl(url),
 		pageViews: (record.pageViews ?? 0) + 1,
 		lastActivityAt: now
 	});
@@ -916,6 +1349,22 @@ function noteCounts(counts) {
 	});
 }
 /**
+* Whether `sessionId` is the session charged for its visit. `claim` runs once,
+* on the first row, and the answer is persisted so heartbeats, reloads and the
+* `ended` row all agree with it.
+*/
+function resolveBillable(sessionId, claim) {
+	const record = readRecord();
+	if (!record || record.id !== sessionId) return false;
+	if (record.billable !== void 0) return record.billable;
+	const billable = claim();
+	writeRecord({
+		...record,
+		billable
+	});
+	return billable;
+}
+/**
 * The persisted session record as-is — no activity touch, no rotation. Use
 * this to read counters when posting a metadata row; `getSession()` would
 * rotate an idle session out from under the row being written.
@@ -966,8 +1415,87 @@ function nextMetaVersion() {
 	});
 	return version;
 }
+/** A uniform draw in [0, 1) from Web Crypto, the same source session ids use. */
+function uniformRandom() {
+	const values = /* @__PURE__ */ new Uint32Array(1);
+	crypto.getRandomValues(values);
+	return (values[0] ?? 0) / 4294967296;
+}
+/**
+* This session's replay sampling decision, rolled against `sampleRate` the
+* first time it is asked and then persisted, so every page load of the session
+* agrees. Call after `getSession()` has resolved the session.
+*/
+function claimReplaySample(sampleRate) {
+	const record = readRecord() ?? getSession();
+	if (record.replaySampled !== void 0) return record.replaySampled;
+	const sampled = uniformRandom() < sampleRate;
+	writeRecord({
+		...record,
+		replaySampled: sampled
+	});
+	return sampled;
+}
+/**
+* This session's replay mode: recorded at `sampleRate`, otherwise buffered for
+* errors at `onErrorSampleRate`. Rolled once per session and persisted, like
+* `claimReplaySample`.
+*/
+function claimReplayMode(sampleRate, onErrorSampleRate) {
+	if (claimReplaySample(sampleRate)) return "record";
+	const record = readRecord() ?? getSession();
+	if (record.replayBuffered === void 0) {
+		const buffered = onErrorSampleRate > 0 && uniformRandom() < onErrorSampleRate;
+		writeRecord({
+			...record,
+			replayBuffered: buffered
+		});
+		return buffered ? "buffer" : "off";
+	}
+	return record.replayBuffered ? "buffer" : "off";
+}
+/** An error made this buffered session a recorded one: later loads record it from the start. */
+function markReplayTriggered(sessionId) {
+	const record = readRecord();
+	if (!record || record.id !== sessionId) return;
+	writeRecord({
+		...record,
+		replaySampled: true,
+		replayTrigger: "error"
+	});
+}
+/**
+* Pin a session to the capture mode a running page is already in. A session
+* minted by idle rotation mid-page inherits that page's mode rather than
+* rolling again, and later loads of it honour the same answer.
+*/
+function adoptReplayDecision(sessionId, recorded, buffered) {
+	const record = readRecord();
+	if (!record || record.id !== sessionId || record.replaySampled !== void 0) return;
+	writeRecord({
+		...record,
+		replaySampled: recorded,
+		...buffered !== void 0 && !recorded ? { replayBuffered: buffered } : void 0
+	});
+}
 //#endregion
 //#region ../browser-session/src/events/events-sink.ts
+/** On `globalThis` like the sink: every bundled copy of this module must see the same listeners. */
+const LISTENERS_KEY = "__MAPLE_SESSION_EVENT_LISTENERS__";
+function listeners() {
+	const global = globalThis;
+	let set = global[LISTENERS_KEY];
+	if (!set) {
+		set = /* @__PURE__ */ new Set();
+		global[LISTENERS_KEY] = set;
+	}
+	return set;
+}
+/** Observe every event the live sink records, e.g. for an error's breadcrumb trail. Returns an unsubscribe. */
+function onSessionEvent(listener) {
+	listeners().add(listener);
+	return () => listeners().delete(listener);
+}
 const FLUSH_INTERVAL_MS = 5e3;
 const FLUSH_BYTES = 65536;
 /**
@@ -1014,7 +1542,7 @@ function startEventSink(config, sessionId) {
 		const batch = buffer;
 		buffer = [];
 		bufferBytes = 0;
-		await postSessionEvents(config, batch.map(({ ev, seq }) => toRow(sessionId, ev, seq)), keepalive);
+		await postSessionEvents(config, batch.map(({ ev, seq }) => toRow(config, sessionId, ev, seq)), keepalive);
 	};
 	const emit = (ev) => {
 		const session = markActivity();
@@ -1034,6 +1562,9 @@ function startEventSink(config, sessionId) {
 		});
 		bufferBytes += approximateSize(ev);
 		if (bufferBytes >= FLUSH_BYTES) flush();
+		for (const listener of listeners()) try {
+			listener(ev);
+		} catch {}
 	};
 	const stopNavigation = installNavigationObserver((url) => {
 		emit({
@@ -1081,13 +1612,14 @@ function installNavigationObserver(onNavigate) {
 	emitNav();
 	const origPush = history.pushState;
 	const origReplace = history.replaceState;
+	const receiver = (self) => self instanceof History ? self : history;
 	history.pushState = function(...args) {
-		const result = origPush.apply(this, args);
+		const result = origPush.apply(receiver(this), args);
 		emitNav();
 		return result;
 	};
 	history.replaceState = function(...args) {
-		const result = origReplace.apply(this, args);
+		const result = origReplace.apply(receiver(this), args);
 		emitNav();
 		return result;
 	};
@@ -1150,21 +1682,33 @@ function drainPending(sink) {
 	state.bytes = 0;
 	for (const ev of queued) sink.emit(ev);
 }
-/** Map an internal event to the snake_case ingest row (org_id is added server-side). */
-function toRow(sessionId, ev, seq) {
+/**
+* Map an internal event to the snake_case ingest row (org_id is added server-side).
+*
+* Identity is resolved here, at flush time, alongside the trace id: it is the
+* person key funnels group on, and reading it late means an `identify()` that
+* lands shortly after init still stamps the initial page view. `visitor_id` is
+* `""` whenever the visitor cookie is off (consent, GPC, `persistVisitorId:
+* false`) — the same rule the metadata row applies.
+*/
+function toRow(config, sessionId, ev, seq) {
+	const identity = config.getIdentity?.();
 	return {
 		session_id: sessionId,
+		visitor_id: getVisitorId() ?? "",
+		user_id: identity?.id ?? "",
+		group_id: identity?.groupId ?? "",
 		timestamp: formatCHDateTime(new Date(ev.timestamp ?? Date.now())),
 		seq,
 		type: ev.type,
-		url: ev.url ?? (typeof location !== "undefined" ? location.href : ""),
+		url: scrubUrl(ev.url ?? (typeof location !== "undefined" ? location.href : "")),
 		trace_id: ev.traceId ?? activeTraceId() ?? "",
 		level: ev.level ?? "",
 		message: ev.message ?? "",
 		target_selector: ev.targetSelector ?? "",
 		target_text: ev.targetText ?? "",
 		net_method: ev.net?.method ?? "",
-		net_url: ev.net?.url ?? "",
+		net_url: ev.net ? scrubUrl(ev.net.url) : "",
 		net_status: ev.net?.status ?? 0,
 		net_duration_ms: ev.net?.durationMs ?? 0,
 		error_stack: ev.errorStack ?? "",
@@ -1181,7 +1725,7 @@ function toRow(sessionId, ev, seq) {
 * posted at session start, whose counters are all zero and therefore read as a
 * bounce. 60s is the floor worth using: the table is a ReplacingMergeTree, so
 * every heartbeat is an unmerged part until the next merge. Billing meters only
-* `version == 1` rows, so heartbeats do not double-bill.
+* `billable_start == 1 && version == 1` rows, so heartbeats do not double-bill.
 */
 const HEARTBEAT_INTERVAL_MS = 6e4;
 /**
@@ -1199,6 +1743,7 @@ function startSessionLifecycle(options, hooks) {
 	let errorCountBase = 0;
 	let sinkClickCountAtStart = 0;
 	let sinkErrorCountAtStart = 0;
+	const isRecorded = () => typeof hooks.recorded === "function" ? hooks.recorded() : hooks.recorded;
 	/**
 	* The persisted record of the session this lifecycle owns.
 	*
@@ -1247,6 +1792,10 @@ function startSessionLifecycle(options, hooks) {
 	const post = (status, keepalive) => {
 		const record = liveRecord();
 		const counts = countsFor(record);
+		const visitorId = getVisitorId();
+		const persistVisit = visitorId !== void 0;
+		const billableStart = resolveBillable(record.id, () => claimVisit(Date.now(), persistVisit));
+		touchVisit(record.lastActivityAt, persistVisit);
 		hooks.post(buildSessionMetaRow({
 			sessionId: record.id,
 			startedAt: new Date(record.startedAt),
@@ -1257,7 +1806,7 @@ function startSessionLifecycle(options, hooks) {
 			captureUserEmail: options.captureUserEmail,
 			environment: options.environment,
 			serviceVersion: options.serviceVersion,
-			visitorId: getVisitorId(),
+			visitorId,
 			visitorIsNew: record.visitorIsNew === true,
 			visitorIdPersisted: isVisitorIdPersisted(),
 			entry: entryContextOf(record),
@@ -1266,7 +1815,9 @@ function startSessionLifecycle(options, hooks) {
 			pageViews: counts.pageViews,
 			errorCount: counts.errorCount,
 			traceIds: status === "ended" ? options.getTraceIds?.(record.id) : void 0,
-			recorded: hooks.recorded
+			recorded: isRecorded(),
+			replayTrigger: record.replayTrigger,
+			billableStart
 		}), keepalive);
 	};
 	const stopHeartbeat = () => {
@@ -1278,6 +1829,7 @@ function startSessionLifecycle(options, hooks) {
 		if (stopped || running) return;
 		running = true;
 		const record = liveRecord();
+		adoptReplayDecision(record.id, isRecorded(), hooks.buffered?.());
 		rebaseCounts(record);
 		hooks.onStart?.(record);
 		post("active", false);
@@ -1339,6 +1891,9 @@ function startSessionLifecycle(options, hooks) {
 		get sessionId() {
 			return current.id;
 		},
+		announce: () => {
+			if (running) post("active", false);
+		},
 		shutdown: async (shutdownOptions) => {
 			if (stopped) return;
 			stopped = true;
@@ -1374,6 +1929,7 @@ const observedTraceIdsBySession = /* @__PURE__ */ new Map();
 const MAX_TRACE_IDS_PER_SESSION = 200;
 /** Record a trace id seen during the session. Idempotent per id. */
 function recordTraceId(traceId, sessionId = readSessionSink()?.sessionId) {
+	noteStartedTraceId(traceId);
 	if (!sessionId) return;
 	let ids = observedTraceIdsBySession.get(sessionId);
 	if (!ids) {
@@ -1421,4 +1977,4 @@ function readSessionSink() {
 	return globalThis[SESSION_SINK_KEY];
 }
 //#endregion
-export { setActiveTraceIdProvider as C, activeTraceId as S, setVisitorTracking as T, gzip as _, recordTraceId as a, sdkHint as b, getActiveSink as c, getSession as d, markActivity as f, SDK_HINT_HEADER as g, postSessionMetaRow as h, readSessionSink as i, queuePending as l, rotateSession as m, getObservedTraceIds as n, startSessionLifecycle as o, nextChunkSeq as p, publishSessionSink as r, clearPendingEvents as s, clearSessionSink as t, startEventSink as u, postSessionBlob as v, configureVisitorCookie as w, safeEmit as x, postSessionMeta as y };
+export { setActiveTraceIdProvider as A, postSessionMeta as C, BLOCK_SELECTOR as D, selectorOf as E, scrubUrl as F, configureVisitorCookie as M, setVisitorTracking as N, safeEmit as O, addUrlSanitizer as P, postSessionBlob as S, warnDropped as T, rotateSession as _, recordTraceId as a, gzip as b, getActiveSink as c, startEventSink as d, claimReplayMode as f, nextChunkSeq as g, markReplayTriggered as h, readSessionSink as i, withStartedTraceId as j, activeTraceId as k, onSessionEvent as l, markActivity as m, getObservedTraceIds as n, startSessionLifecycle as o, getSession as p, publishSessionSink as r, clearPendingEvents as s, clearSessionSink as t, queuePending as u, postSessionMetaRow as v, sdkHint as w, ingestHeaders as x, isLikelyBot as y };