@maple-dev/browser 0.8.0 → 0.9.0

package/dist/{sink-D9w1kg0Q.mjs → sink-DHPiMgU0.mjs}

@@ -1,3 +1,87 @@
+//#region ../browser-session/src/platform/url-privacy.ts
+const REDACTED = "REDACTED";
+const SENSITIVE_PARAM = /^(access_token|id_token|refresh_token|token|token_hash|auth|authorization|code|oobcode|state|password|passwd|pwd|pass|secret|client_secret|api_key|apikey|key|signature|sig|otp|jwt|session|sessionid|session_id|ticket|__clerk_ticket|reset_token|magic|nonce|x-amz-signature|x-amz-credential|x-amz-security-token|x-goog-signature|x-goog-credential)$/i;
+/** Sanitizers live on `globalThis`, like consent: one page, one policy, however many SDK copies. */
+const SANITIZERS_KEY = "__MAPLE_URL_SANITIZERS__";
+function sanitizers() {
+	const owner = globalThis;
+	const existing = owner[SANITIZERS_KEY];
+	if (existing instanceof Set) return existing;
+	const fresh = /* @__PURE__ */ new Set();
+	owner[SANITIZERS_KEY] = fresh;
+	return fresh;
+}
+/**
+* Register a host-app sanitizer. Additive, like the consent gates: an SDK
+* initialized without one must not remove the one another SDK was given.
+*/
+function addUrlSanitizer(sanitizer) {
+	sanitizers().add(sanitizer);
+}
+function redactParams(params) {
+	let changed = false;
+	for (const name of new Set(params.keys())) {
+		if (!SENSITIVE_PARAM.test(name)) continue;
+		params.set(name, REDACTED);
+		changed = true;
+	}
+	return changed;
+}
+/**
+* Implicit-flow tokens ride the fragment as `#access_token=…&…`; a hash-routed
+* app carries them in the route's own query, `#/reset?token=…`. The route path
+* is kept either way.
+*/
+function redactFragment(fragment) {
+	if (fragment.startsWith("/") || fragment.startsWith("!/")) {
+		const queryAt = fragment.indexOf("?");
+		if (queryAt === -1) return fragment;
+		const params = new URLSearchParams(fragment.slice(queryAt + 1));
+		return redactParams(params) ? `${fragment.slice(0, queryAt)}?${params.toString()}` : fragment;
+	}
+	if (!fragment.includes("=")) return fragment;
+	const params = new URLSearchParams(fragment);
+	return redactParams(params) ? params.toString() : fragment;
+}
+const ABSOLUTE = /^[a-z][a-z0-9+.-]*:/i;
+const RELATIVE_BASE = "http://relative.invalid";
+/** Redact credential-shaped query and fragment parameters, keeping the URL's form. */
+function redactUrl(url) {
+	if (!url || !url.includes("?") && !url.includes("#")) return url;
+	const absolute = ABSOLUTE.test(url);
+	let parsed;
+	try {
+		parsed = new URL(url, absolute ? void 0 : RELATIVE_BASE);
+	} catch {
+		return url;
+	}
+	let changed = redactParams(parsed.searchParams);
+	const fragment = parsed.hash.slice(1);
+	const redactedFragment = redactFragment(fragment);
+	if (redactedFragment !== fragment) {
+		parsed.hash = redactedFragment;
+		changed = true;
+	}
+	if (!changed) return url;
+	if (absolute) return parsed.href;
+	if (url.startsWith("//")) return parsed.href.slice(parsed.protocol.length);
+	const tail = `${parsed.pathname}${parsed.search}${parsed.hash}`;
+	return url.startsWith("/") ? tail : tail.replace(/^\//, "");
+}
+/**
+* The URL as it may leave the page: default redaction, then every registered
+* host sanitizer. A sanitizer that throws or returns a non-string yields the
+* default-redacted URL rather than the raw one.
+*/
+function scrubUrl(url) {
+	let out = redactUrl(url);
+	for (const sanitizer of sanitizers()) try {
+		const next = sanitizer(out);
+		if (typeof next === "string") out = next;
+	} catch {}
+	return out;
+}
+//#endregion
 //#region ../browser-session/src/platform/json.ts
 /**
 * Minimal structural guards for records read back out of browser storage.
@@ -316,6 +400,26 @@ function activeTraceId() {
 	const id = traceIdProvider();
 	return id && id !== ZERO_TRACE_ID ? id : void 0;
 }
+const slots = [];
+/** Report a span that just started. Fills the innermost open slot, first span wins. */
+function noteStartedTraceId(traceId) {
+	const slot = slots.at(-1);
+	if (slot && slot.traceId === void 0 && traceId !== ZERO_TRACE_ID) slot.traceId = traceId;
+}
+/** Run `fn`, returning its result and the trace id of the first span started during it. */
+function withStartedTraceId(fn) {
+	const slot = { traceId: void 0 };
+	slots.push(slot);
+	try {
+		return {
+			result: fn(),
+			traceId: slot.traceId
+		};
+	} finally {
+		const index = slots.lastIndexOf(slot);
+		if (index !== -1) slots.splice(index, 1);
+	}
+}
 //#endregion
 //#region ../browser-session/src/capture/shared.ts
 /** Emit best-effort: capture must never throw into the host app's call site. */
@@ -359,6 +463,21 @@ function truncate(stack) {
 	if (!stack) return void 0;
 	return stack.length > MAX_STACK ? `${stack.slice(0, MAX_STACK)}…` : stack;
 }
+const BLOCK_SELECTOR = `[data-rr-block]`;
+/**
+* Whether `el` sits inside a blocked subtree. Mirrors rrweb's own ancestor
+* check so the two capture paths agree on what is hidden.
+*
+* Walks parents rather than using `closest()`: no string reaches a selector
+* parser, so a malformed marker cannot throw into the host app's event handler.
+*/
+const isBlocked = (el) => {
+	for (let node = el; node !== null; node = node.parentElement) {
+		if (node.classList?.contains("rr-block")) return true;
+		if (node.hasAttribute?.("data-rr-block")) return true;
+	}
+	return false;
+};
 //#endregion
 //#region ../browser-session/src/capture/interactions.ts
 const MAX_TEXT = 120;
@@ -366,7 +485,8 @@ const MAX_TEXT = 120;
 * Capture clicks and input events as session events. Listens in the capture
 * phase so it sees interactions even when the host app calls
 * `stopPropagation()`. Input *values* are never recorded; only the target
-* element. Click target text is omitted when `maskAllText` is set.
+* element. Click target text is omitted when `maskAllText` is set, and when the
+* target sits inside a blocked (`.rr-block` / `data-rr-block`) subtree.
 */
 function installInteractionCapture(emit, maskAllText) {
 	const onClick = (event) => {
@@ -375,7 +495,7 @@ function installInteractionCapture(emit, maskAllText) {
 		safeEmit(emit, {
 			type: "click",
 			targetSelector: selectorOf(target),
-			targetText: maskAllText ? void 0 : textOf(target)
+			targetText: maskAllText || isBlocked(target) ? void 0 : textOf(target)
 		});
 	};
 	const onInput = (event) => {
@@ -463,40 +583,107 @@ function warnDropped(what, error) {
 	console.warn(`[maple] session replay ${what} failed (dropping; will retry on next chunk):`, error);
 }
 /**
-* Largest body we will hand to a `keepalive` fetch.
+* Combined budget for this SDK's in-flight `keepalive` bodies.
+*
+* The Fetch spec caps the *combined* in-flight keepalive body at 64 KiB per
+* page, and the browser rejects a request that would cross it. On the way out
+* up to three of our writes go at once (metadata row, final events batch, last
+* replay chunk), so the budget has to be shared rather than checked per
+* request. It stops short of 64 KiB because the OTLP trace exporter spends
+* from the same page-wide allowance under its own accounting.
 *
-* The Fetch spec caps the *combined* inflight keepalive body at 64 KiB, and on
-* the way out we issue up to three of these at once (metadata row, final events
-* batch, last replay chunk). Over the budget the browser rejects the request
-* outright, so a normal request — which the page may or may not survive long
-* enough to finish — is strictly the better bet than a guaranteed rejection.
+* Over the budget a write goes out as a normal request, which the page may or
+* may not survive long enough to finish: strictly better than a guaranteed
+* rejection.
 */
-const MAX_KEEPALIVE_BYTES = 49152;
-/** Whether a body of `bytes` may still ride the keepalive budget. */
-function keepaliveFor(requested, bytes) {
-	return requested && bytes <= MAX_KEEPALIVE_BYTES;
+const KEEPALIVE_BUDGET_BYTES = 49152;
+/** On `globalThis`: two bundled SDK copies still share one page-wide allowance. */
+const KEEPALIVE_KEY = "__MAPLE_KEEPALIVE_INFLIGHT__";
+function keepaliveInflight() {
+	const owner = globalThis;
+	const existing = owner[KEEPALIVE_KEY];
+	if (existing) return existing;
+	const fresh = { bytes: 0 };
+	owner[KEEPALIVE_KEY] = fresh;
+	return fresh;
+}
+/**
+* Reserve `bytes` of the shared keepalive budget. Returns the release function
+* when the request may use `keepalive`, `undefined` when it must not.
+*/
+function reserveKeepalive(requested, bytes) {
+	if (!requested) return void 0;
+	const inflight = keepaliveInflight();
+	if (inflight.bytes + bytes > KEEPALIVE_BUDGET_BYTES) return void 0;
+	inflight.bytes += bytes;
+	let released = false;
+	return () => {
+		if (released) return;
+		released = true;
+		inflight.bytes = Math.max(0, inflight.bytes - bytes);
+	};
+}
+/** Body size in bytes: the keepalive limit counts bytes, and `string.length` counts UTF-16 units. */
+function byteLength(body) {
+	return typeof body === "string" ? new TextEncoder().encode(body).byteLength : body.byteLength;
+}
+/**
+* POST to ingest, spending the shared keepalive budget when `keepalive` is
+* requested. Resolves with the status only: the response body is cancelled
+* before the reservation is released, because the browser counts a keepalive
+* request against the page-wide limit until its response body ends, not
+* until headers arrive. Rejects exactly as `fetch` does; callers own the
+* error policy.
+*/
+async function postToIngest(url, headers, body, keepalive) {
+	const release = reserveKeepalive(keepalive, byteLength(body));
+	try {
+		const response = await fetch(url, {
+			method: "POST",
+			headers,
+			body,
+			keepalive: release !== void 0
+		});
+		await response.body?.cancel().catch(() => {});
+		return {
+			ok: response.ok,
+			status: response.status
+		};
+	} finally {
+		release?.();
+	}
 }
-/** gzip a byte buffer using the native CompressionStream (no library). */
+/**
+* Smallest well-formed gzip stream: a 10-byte header plus an 8-byte trailer.
+* Anything shorter cannot carry a complete member, whatever it contains.
+*/
+const GZIP_MIN_BYTES = 18;
+/**
+* gzip a byte buffer using the native CompressionStream (no library).
+*
+* Throws rather than returning a partial stream. The write and close promises
+* used to be discarded, so a page torn down mid-compression still resolved
+* `arrayBuffer()` — with only the bytes already flushed — and the caller posted
+* a 3-byte header stub as if it were a complete chunk. Ingest rejected those as
+* corrupt gzip; they were 82% of all replay-blob failures, overwhelmingly from
+* crawlers, which tear the page down on nearly every session.
+*/
 async function gzip(bytes) {
 	const stream = new CompressionStream("gzip");
 	const writer = stream.writable.getWriter();
-	writer.write(bytes);
-	writer.close();
-	const buffer = await new Response(stream.readable).arrayBuffer();
-	return new Uint8Array(buffer);
+	const written = writer.write(bytes).then(() => writer.close());
+	const [buffer] = await Promise.all([new Response(stream.readable).arrayBuffer(), written]);
+	const out = new Uint8Array(buffer);
+	if (out.length < GZIP_MIN_BYTES || out[0] !== 31 || out[1] !== 139 || out[2] !== 8) throw new Error(`gzip produced ${out.length} bytes, not a complete gzip stream`);
+	return out;
 }
 /** POST session metadata (NDJSON, single row). `keepalive` for the final unload write. */
 async function postSessionMeta(config, row, keepalive = false) {
 	const body = `${JSON.stringify(row)}\n`;
-	await fetch(`${config.endpoint}/v1/sessionReplays/meta`, {
-		method: "POST",
-		headers: {
-			...ingestHeaders(config),
-			"content-type": "application/x-ndjson"
-		},
-		body,
-		keepalive: keepaliveFor(keepalive, body.length)
-	}).catch((error) => {
+	await postToIngest(`${config.endpoint}/v1/sessionReplays/meta`, {
+		...ingestHeaders(config),
+		"content-type": "application/x-ndjson"
+	}, body, keepalive).catch((error) => {
 		warnDropped("metadata POST", error);
 	});
 }
@@ -504,15 +691,10 @@ async function postSessionMeta(config, row, keepalive = false) {
 async function postSessionEvents(config, rows, keepalive = false) {
 	if (rows.length === 0) return;
 	const body = `${rows.map((row) => JSON.stringify(row)).join("\n")}\n`;
-	await fetch(`${config.endpoint}/v1/sessionEvents`, {
-		method: "POST",
-		headers: {
-			...ingestHeaders(config),
-			"content-type": "application/x-ndjson"
-		},
-		body,
-		keepalive: keepaliveFor(keepalive, body.length)
-	}).catch((error) => {
+	await postToIngest(`${config.endpoint}/v1/sessionEvents`, {
+		...ingestHeaders(config),
+		"content-type": "application/x-ndjson"
+	}, body, keepalive).catch((error) => {
 		warnDropped("events POST", error);
 	});
 }
@@ -520,20 +702,15 @@ const SESSION_EXHAUSTED_STATUS = 413;
 /** POST a gzipped rrweb event chunk. */
 async function postSessionBlob(config, meta, gzipped, keepalive = false) {
 	try {
-		const response = await fetch(`${config.endpoint}/v1/sessionReplays/blob`, {
-			method: "POST",
-			headers: {
-				...ingestHeaders(config),
-				"content-type": "application/octet-stream",
-				"x-maple-session-id": meta.sessionId,
-				"x-maple-chunk-seq": String(meta.chunkSeq),
-				"x-maple-is-checkpoint": meta.isCheckpoint ? "1" : "0",
-				"x-maple-event-count": String(meta.eventCount),
-				"x-maple-duration-ms": String(meta.durationMs)
-			},
-			body: gzipped,
-			keepalive: keepaliveFor(keepalive, gzipped.byteLength)
-		});
+		const response = await postToIngest(`${config.endpoint}/v1/sessionReplays/blob`, {
+			...ingestHeaders(config),
+			"content-type": "application/octet-stream",
+			"x-maple-session-id": meta.sessionId,
+			"x-maple-chunk-seq": String(meta.chunkSeq),
+			"x-maple-is-checkpoint": meta.isCheckpoint ? "1" : "0",
+			"x-maple-event-count": String(meta.eventCount),
+			"x-maple-duration-ms": String(meta.durationMs)
+		}, gzipped, keepalive);
 		if (response.ok) return "accepted";
 		return response.status === SESSION_EXHAUSTED_STATUS ? "exhausted" : "rejected";
 	} catch (error) {
@@ -558,9 +735,51 @@ function parse(ua) {
 	return {
 		browserName: /edg/i.test(ua) ? "Edge" : /opr|opera/i.test(ua) ? "Opera" : /chrome|crios/i.test(ua) ? "Chrome" : /firefox|fxios/i.test(ua) ? "Firefox" : /safari/i.test(ua) ? "Safari" : "Unknown",
 		osName: /windows/i.test(ua) ? "Windows" : /iphone|ipad|ios/i.test(ua) ? "iOS" : /mac os|macintosh/i.test(ua) ? "macOS" : /android/i.test(ua) ? "Android" : /linux/i.test(ua) ? "Linux" : "Unknown",
-		deviceType: /mobile|iphone|android.*mobile/i.test(ua) ? "mobile" : /ipad|tablet/i.test(ua) ? "tablet" : "desktop"
+		deviceType: /mobile|iphone/i.test(ua) ? "mobile" : /ipad|tablet/i.test(ua) ? "tablet" : "desktop"
 	};
 }
+/**
+* Crawler tokens, every one carrying a delimiter or a scheme on purpose.
+*
+* A bare `bot` substring matches `CUBOT`, an Android phone brand that appears in
+* ordinary mobile UAs, and would file those visitors as crawlers. Requiring
+* `bot/`, `bot;` or `bot)` keeps the `Name/version` and `(compatible; Name;
+* +url)` conventions real crawlers follow while missing the phone. This mirrors
+* the generic tail of the server-side classifier in
+* `@maple/query-engine`'s `user-agent.ts`, deliberately without the ~50 named
+* signatures: every one of those ends in a token already listed here, and the
+* list ships in a size-budgeted bundle to customers.
+*/
+const BOT_TOKENS = [
+	"bot/",
+	"bot;",
+	"bot)",
+	"crawler",
+	"spider",
+	"+http",
+	"headless"
+];
+/**
+* Whether the UA is a crawler rather than a person.
+*
+* Used to route crawlers to a metadata-only session: they still appear in Web
+* Analytics — the server-side classifier is what labels them there — but they do
+* not download rrweb or upload replay chunks. Crawlers execute the beacon and
+* then tear the page down mid-flush, which produced the large majority of all
+* corrupt replay-chunk uploads, and every chunk they did manage to upload spent
+* a customer's replay quota on a session nobody will ever watch.
+*
+* Deliberately does not consult `navigator.webdriver`: it is set by every
+* Playwright and Puppeteer run, headed or not. The `headless` token does match
+* the old headless shell's `HeadlessChrome` UA, which production crawlers use
+* too (see the test cases), so an e2e suite that wants replay recorded runs
+* headed, or sets an explicit `userAgent` without `headless` in it. Chrome's
+* new headless mode can still report `HeadlessChrome/`, so it is not enough.
+*/
+function isLikelyBot(ua) {
+	const lower = ua.toLowerCase();
+	return BOT_TOKENS.some((token) => lower.includes(token));
+}
 //#endregion
 //#region ../browser-session/src/events/meta-row.ts
 /** ClickHouse-style `YYYY-MM-DD HH:MM:SS.mmm` in UTC (matches the ingest gateway). */
@@ -580,8 +799,8 @@ function buildSessionMetaRow(input) {
 	const now = /* @__PURE__ */ new Date();
 	const location = browserLocation();
 	const identity = input.identity;
-	const entryUrl = input.entry?.entryUrl ?? location?.href ?? "";
-	const referrer = input.entry?.referrer ?? "";
+	const entryUrl = scrubUrl(input.entry?.entryUrl || location?.href || "");
+	const referrer = scrubUrl(input.entry?.referrer ?? "");
 	const utm = input.entry?.utm ?? {};
 	const row = {
 		session_id: input.sessionId,
@@ -589,7 +808,7 @@ function buildSessionMetaRow(input) {
 		status: input.status,
 		version: input.version,
 		user_id: identity?.id ?? input.userId ?? "",
-		url_initial: location?.href ?? "",
+		url_initial: entryUrl,
 		user_agent: userAgent,
 		browser_name: ua.browserName,
 		os_name: ua.osName,
@@ -603,7 +822,7 @@ function buildSessionMetaRow(input) {
 				"deployment.environment": input.environment,
 				"deployment.environment.name": input.environment
 			} : void 0,
-			...input.serviceVersion ? { "deployment.commit_sha": input.serviceVersion } : void 0
+			...input.serviceVersion && /^[0-9a-f]{7,40}$/i.test(input.serviceVersion) ? { "vcs.ref.head.revision": input.serviceVersion } : void 0
 		},
 		visitor_id: input.visitorId ?? "",
 		visitor_is_new: input.visitorIsNew ? 1 : 0,
@@ -652,15 +871,10 @@ function pathOf(url) {
 /** POST one session metadata row (NDJSON). Best-effort — never throws. */
 async function postSessionMetaRow(target, row, keepalive = false) {
 	const body = `${JSON.stringify(row)}\n`;
-	await fetch(`${target.endpoint.replace(/\/$/, "")}/v1/sessionReplays/meta`, {
-		method: "POST",
-		headers: {
-			...ingestHeaders(target),
-			"content-type": "application/x-ndjson"
-		},
-		body,
-		keepalive: keepaliveFor(keepalive, body.length)
-	}).catch(() => {});
+	await postToIngest(`${target.endpoint.replace(/\/$/, "")}/v1/sessionReplays/meta`, {
+		...ingestHeaders(target),
+		"content-type": "application/x-ndjson"
+	}, body, keepalive).catch(() => {});
 }
 //#endregion
 //#region ../browser-session/src/platform/approximate-size.ts
@@ -735,6 +949,10 @@ function parseSessionRecord(raw) {
 		if (typeof value.visitorIsNew !== "boolean") return void 0;
 		record.visitorIsNew = value.visitorIsNew;
 	}
+	if (value.replaySampled !== void 0) {
+		if (typeof value.replaySampled !== "boolean") return void 0;
+		record.replaySampled = value.replaySampled;
+	}
 	if (value.utm !== void 0) {
 		if (!isStringRecord(value.utm)) return void 0;
 		record.utm = value.utm;
@@ -768,11 +986,12 @@ function readEntryContext() {
 			if (value) utm[key] = value.slice(0, 128);
 		}
 	} catch {}
+	const href = scrubUrl(location.href);
 	return {
-		entryUrl: location.href,
-		entryReferrer: typeof document !== "undefined" ? document.referrer : "",
+		entryUrl: href,
+		entryReferrer: typeof document !== "undefined" ? scrubUrl(document.referrer) : "",
 		utm,
-		lastUrl: location.href,
+		lastUrl: href,
 		pageViews: 0,
 		clickCount: 0,
 		errorCount: 0
@@ -803,6 +1022,105 @@ function writeRecord(record) {
 	try {
 		window.sessionStorage.setItem(STORAGE_KEY, JSON.stringify(record));
 	} catch {}
+	claimTab(record.id);
+}
+const TAB_LEASE_PREFIX = "maple.session.tab.";
+const TAB_LEASE_TTL_MS = 12e4;
+const TAB_LEASE_REFRESH_MS = 5e3;
+const TAB_NONCE_KEY = "__MAPLE_TAB_NONCE__";
+/** The session id this tab has checked (or minted) and may keep using. */
+let verifiedSessionId;
+let leaseWrittenAt = 0;
+let releaseInstalled = false;
+/**
+* Set from `pagehide` until the page is shown again. The lifecycle's own
+* `pagehide` handler posts an `ended` row after ours runs, which writes the
+* record; re-leasing there would make the next load of this tab look like a
+* duplicate and rotate on every reload.
+*/
+let leaseReleased = false;
+function tabNonce() {
+	const owner = globalThis;
+	const existing = owner[TAB_NONCE_KEY];
+	if (typeof existing === "string") return existing;
+	const fresh = crypto.randomUUID();
+	owner[TAB_NONCE_KEY] = fresh;
+	return fresh;
+}
+function leaseStorage() {
+	try {
+		return typeof window !== "undefined" ? window.localStorage : void 0;
+	} catch {
+		return;
+	}
+}
+function readLease(storage, sessionId) {
+	const raw = storage.getItem(`${TAB_LEASE_PREFIX}${sessionId}`);
+	if (!raw) return void 0;
+	const split = raw.lastIndexOf(":");
+	const at = Number(raw.slice(split + 1));
+	return split > 0 && Number.isFinite(at) ? {
+		nonce: raw.slice(0, split),
+		at
+	} : void 0;
+}
+function claimTab(sessionId) {
+	const now = Date.now();
+	if (verifiedSessionId === sessionId && now - leaseWrittenAt < TAB_LEASE_REFRESH_MS) return;
+	if (verifiedSessionId !== void 0 && verifiedSessionId !== sessionId) releaseTab(verifiedSessionId);
+	verifiedSessionId = sessionId;
+	if (leaseReleased) return;
+	leaseWrittenAt = now;
+	const storage = leaseStorage();
+	if (!storage) return;
+	try {
+		storage.setItem(`${TAB_LEASE_PREFIX}${sessionId}`, `${tabNonce()}:${now}`);
+	} catch {}
+	installLeaseRelease();
+}
+function releaseTab(sessionId) {
+	const storage = leaseStorage();
+	if (!storage) return;
+	try {
+		if (readLease(storage, sessionId)?.nonce === tabNonce()) storage.removeItem(`${TAB_LEASE_PREFIX}${sessionId}`);
+	} catch {}
+}
+function installLeaseRelease() {
+	if (releaseInstalled || typeof globalThis.addEventListener !== "function") return;
+	releaseInstalled = true;
+	globalThis.addEventListener("pagehide", () => {
+		leaseReleased = true;
+		if (verifiedSessionId !== void 0) releaseTab(verifiedSessionId);
+	});
+	globalThis.addEventListener("pageshow", () => {
+		leaseReleased = false;
+		leaseWrittenAt = 0;
+	});
+}
+/** Drop leases a crashed tab never released. */
+function pruneLeases(storage, now) {
+	for (let i = storage.length - 1; i >= 0; i--) {
+		const key = storage.key(i);
+		if (!key?.startsWith(TAB_LEASE_PREFIX)) continue;
+		const lease = readLease(storage, key.slice(18));
+		if (!lease || now - lease.at > TAB_LEASE_TTL_MS) storage.removeItem(key);
+	}
+}
+/**
+* Whether another live tab holds `record`'s session. Checked once per session
+* id per tab; after that this tab has claimed it.
+*/
+function ownedByAnotherTab(record, now) {
+	if (verifiedSessionId === record.id) return false;
+	const storage = leaseStorage();
+	if (!storage) return false;
+	try {
+		pruneLeases(storage, now);
+		const lease = readLease(storage, record.id);
+		return lease !== void 0 && lease.nonce !== tabNonce() && now - lease.at <= TAB_LEASE_TTL_MS;
+	} catch {
+		return false;
+	}
 }
 function isSessionExpired(record, now = Date.now()) {
 	return now - record.lastActivityAt > IDLE_TIMEOUT_MS || now - record.startedAt > MAX_SESSION_MS;
@@ -839,7 +1157,7 @@ function installRotatedRecord(previous, next) {
 function getSession() {
 	const now = Date.now();
 	const existing = readRecord();
-	if (existing && !isSessionExpired(existing, now)) {
+	if (existing && !isSessionExpired(existing, now) && !ownedByAnotherTab(existing, now)) {
 		const record = {
 			...migrateRecord(existing),
 			lastActivityAt: now
@@ -867,13 +1185,13 @@ function rotateSession() {
 */
 function touchSession(now) {
 	const existing = readRecord();
-	if (existing && !isSessionExpired(existing, now)) {
+	if (existing && !isSessionExpired(existing, now) && !ownedByAnotherTab(existing, now)) {
 		const migrated = migrateRecord(existing);
 		const touched = {
 			...migrated,
 			lastActivityAt: now
 		};
-		if (migrated !== existing || now - existing.lastActivityAt > ACTIVITY_TOUCH_THROTTLE_MS) writeRecord(touched);
+		if (migrated !== existing || verifiedSessionId !== existing.id || now - existing.lastActivityAt > ACTIVITY_TOUCH_THROTTLE_MS) writeRecord(touched);
 		return touched;
 	}
 	const record = freshRecord(now);
@@ -900,7 +1218,7 @@ function noteNavigation(url) {
 	const record = touchSession(now);
 	writeRecord({
 		...record,
-		lastUrl: url,
+		lastUrl: scrubUrl(url),
 		pageViews: (record.pageViews ?? 0) + 1,
 		lastActivityAt: now
 	});
@@ -966,6 +1284,40 @@ function nextMetaVersion() {
 	});
 	return version;
 }
+/** A uniform draw in [0, 1) from Web Crypto, the same source session ids use. */
+function uniformRandom() {
+	const values = /* @__PURE__ */ new Uint32Array(1);
+	crypto.getRandomValues(values);
+	return (values[0] ?? 0) / 4294967296;
+}
+/**
+* This session's replay sampling decision, rolled against `sampleRate` the
+* first time it is asked and then persisted, so every page load of the session
+* agrees. Call after `getSession()` has resolved the session.
+*/
+function claimReplaySample(sampleRate) {
+	const record = readRecord() ?? getSession();
+	if (record.replaySampled !== void 0) return record.replaySampled;
+	const sampled = uniformRandom() < sampleRate;
+	writeRecord({
+		...record,
+		replaySampled: sampled
+	});
+	return sampled;
+}
+/**
+* Pin a session to the capture mode a running page is already in. A session
+* minted by idle rotation mid-page inherits that page's mode rather than
+* rolling again, and later loads of it honour the same answer.
+*/
+function adoptReplayDecision(sessionId, recorded) {
+	const record = readRecord();
+	if (!record || record.id !== sessionId || record.replaySampled !== void 0) return;
+	writeRecord({
+		...record,
+		replaySampled: recorded
+	});
+}
 //#endregion
 //#region ../browser-session/src/events/events-sink.ts
 const FLUSH_INTERVAL_MS = 5e3;
@@ -1014,7 +1366,7 @@ function startEventSink(config, sessionId) {
 		const batch = buffer;
 		buffer = [];
 		bufferBytes = 0;
-		await postSessionEvents(config, batch.map(({ ev, seq }) => toRow(sessionId, ev, seq)), keepalive);
+		await postSessionEvents(config, batch.map(({ ev, seq }) => toRow(config, sessionId, ev, seq)), keepalive);
 	};
 	const emit = (ev) => {
 		const session = markActivity();
@@ -1081,13 +1433,14 @@ function installNavigationObserver(onNavigate) {
 	emitNav();
 	const origPush = history.pushState;
 	const origReplace = history.replaceState;
+	const receiver = (self) => self instanceof History ? self : history;
 	history.pushState = function(...args) {
-		const result = origPush.apply(this, args);
+		const result = origPush.apply(receiver(this), args);
 		emitNav();
 		return result;
 	};
 	history.replaceState = function(...args) {
-		const result = origReplace.apply(this, args);
+		const result = origReplace.apply(receiver(this), args);
 		emitNav();
 		return result;
 	};
@@ -1150,21 +1503,33 @@ function drainPending(sink) {
 	state.bytes = 0;
 	for (const ev of queued) sink.emit(ev);
 }
-/** Map an internal event to the snake_case ingest row (org_id is added server-side). */
-function toRow(sessionId, ev, seq) {
+/**
+* Map an internal event to the snake_case ingest row (org_id is added server-side).
+*
+* Identity is resolved here, at flush time, alongside the trace id: it is the
+* person key funnels group on, and reading it late means an `identify()` that
+* lands shortly after init still stamps the initial page view. `visitor_id` is
+* `""` whenever the visitor cookie is off (consent, GPC, `persistVisitorId:
+* false`) — the same rule the metadata row applies.
+*/
+function toRow(config, sessionId, ev, seq) {
+	const identity = config.getIdentity?.();
 	return {
 		session_id: sessionId,
+		visitor_id: getVisitorId() ?? "",
+		user_id: identity?.id ?? "",
+		group_id: identity?.groupId ?? "",
 		timestamp: formatCHDateTime(new Date(ev.timestamp ?? Date.now())),
 		seq,
 		type: ev.type,
-		url: ev.url ?? (typeof location !== "undefined" ? location.href : ""),
+		url: scrubUrl(ev.url ?? (typeof location !== "undefined" ? location.href : "")),
 		trace_id: ev.traceId ?? activeTraceId() ?? "",
 		level: ev.level ?? "",
 		message: ev.message ?? "",
 		target_selector: ev.targetSelector ?? "",
 		target_text: ev.targetText ?? "",
 		net_method: ev.net?.method ?? "",
-		net_url: ev.net?.url ?? "",
+		net_url: ev.net ? scrubUrl(ev.net.url) : "",
 		net_status: ev.net?.status ?? 0,
 		net_duration_ms: ev.net?.durationMs ?? 0,
 		error_stack: ev.errorStack ?? "",
@@ -1278,6 +1643,7 @@ function startSessionLifecycle(options, hooks) {
 		if (stopped || running) return;
 		running = true;
 		const record = liveRecord();
+		adoptReplayDecision(record.id, hooks.recorded);
 		rebaseCounts(record);
 		hooks.onStart?.(record);
 		post("active", false);
@@ -1374,6 +1740,7 @@ const observedTraceIdsBySession = /* @__PURE__ */ new Map();
 const MAX_TRACE_IDS_PER_SESSION = 200;
 /** Record a trace id seen during the session. Idempotent per id. */
 function recordTraceId(traceId, sessionId = readSessionSink()?.sessionId) {
+	noteStartedTraceId(traceId);
 	if (!sessionId) return;
 	let ids = observedTraceIdsBySession.get(sessionId);
 	if (!ids) {
@@ -1421,4 +1788,4 @@ function readSessionSink() {
 	return globalThis[SESSION_SINK_KEY];
 }
 //#endregion
-export { setActiveTraceIdProvider as C, activeTraceId as S, setVisitorTracking as T, gzip as _, recordTraceId as a, sdkHint as b, getActiveSink as c, getSession as d, markActivity as f, SDK_HINT_HEADER as g, postSessionMetaRow as h, readSessionSink as i, queuePending as l, rotateSession as m, getObservedTraceIds as n, startSessionLifecycle as o, nextChunkSeq as p, publishSessionSink as r, clearPendingEvents as s, clearSessionSink as t, startEventSink as u, postSessionBlob as v, configureVisitorCookie as w, safeEmit as x, postSessionMeta as y };
+export { setVisitorTracking as A, warnDropped as C, setActiveTraceIdProvider as D, activeTraceId as E, scrubUrl as M, withStartedTraceId as O, sdkHint as S, safeEmit as T, isLikelyBot as _, recordTraceId as a, postSessionBlob as b, getActiveSink as c, claimReplaySample as d, getSession as f, postSessionMetaRow as g, rotateSession as h, readSessionSink as i, addUrlSanitizer as j, configureVisitorCookie as k, queuePending as l, nextChunkSeq as m, getObservedTraceIds as n, startSessionLifecycle as o, markActivity as p, publishSessionSink as r, clearPendingEvents as s, clearSessionSink as t, startEventSink as u, SDK_HINT_HEADER as v, BLOCK_SELECTOR as w, postSessionMeta as x, gzip as y };