@newtalaria/browser 0.1.17 → 0.1.18

package/README.md

@@ -2,6 +2,8 @@
 
 Browser SDK for [Talaria](https://github.com/) — error capture and **session replay** (rrweb event streams, not video).
 
+Network calls (`fetch` / XHR) are instrumented as replay breadcrumbs; **only first-party (same-origin) or allowlisted origins** promote failed requests to error events — see [Failed HTTP / network requests](#failed-http--network-requests--events).
+
 ## Install
 
 ```bash
@@ -187,15 +189,24 @@ Set `inlineStylesheet: true` so same-origin stylesheet rules are embedded while
 
 ### Failed HTTP / network requests → events
 
-By default, completed `fetch` / XHR responses with status **500–599** are sent as Talaria events (message like `HTTP 500: GET /api/...`).
+All instrumented `fetch` / XHR calls are recorded as replay breadcrumbs (`talaria-network`). **Error events are promoted only for first-party (same-origin) or explicitly allowlisted origins.**
 
-Transport failures (CORS, offline, DNS — browser `TypeError: Failed to fetch`) are also promoted by default as:
+| Request | HTTP 5xx | Transport failure / timeout | Abort |
+| --- | --- | --- | --- |
+| Same-origin | Error event | Error event | Breadcrumb only |
+| Allowlisted third-party (`networkErrorOrigins`) | Error event | Error event | Breadcrumb only |
+| Other third-party (analytics, ads, widgets, …) | Breadcrumb only | Breadcrumb only | Breadcrumb only |
 
-`Network error: POST https://www.google-analytics.com/g/collect — TypeError: Failed to fetch`
+This avoids Issue spam from Google Analytics, ad pixels, privacy blockers, and similar third-party noise—without a hardcoded domain denylist. Add origins you intentionally depend on (payments, CMS APIs, widgets):
 
-**URL privacy:** network telemetry stores `origin + pathname` only (plus `hostname` / `pathname`). Query strings and fragments are stripped by default — analytics/ads URLs often carry `cid`, `sid`, `dl`, etc. Set `captureRequestQueryParameters: true` to keep query params after sensitive-key redaction (`token`, `api_key`, …).
+```ts
+networkErrorOrigins: ['https://api.stripe.com', 'https://widget.yonder.example'],
+// Escape hatch (not recommended): networkErrorOrigins: ['*']
+```
 
-Both **`fetch`** and **`XMLHttpRequest`** are instrumented (`http.transport`: `fetch` | `xhr`). Failure kinds are only claimed when detectable:
+**URL privacy:** network telemetry stores `origin + pathname` only (plus `hostname` / `pathname`). Query strings and fragments are stripped by default. Set `captureRequestQueryParameters: true` to keep query params after redaction of secrets **and** common tracking keys (`token`, `api_key`, `gclid`, `fbclid`, `_ga`, `cid`, `sid`, …). Bodies and auth headers are never captured.
+
+Both **`fetch`** and **`XMLHttpRequest`** are instrumented (`network.transport`: `fetch` | `xhr`). Failure kinds are only claimed when detectable:
 
 | `failure.kind` | Meaning |
 | --- | --- |
@@ -204,16 +215,24 @@ Both **`fetch`** and **`XMLHttpRequest`** are instrumented (`http.transport`: `f
 | `timeout` | `TimeoutError` or XHR `timeout` event |
 | `abort` | `AbortError` / XHR abort — recorded in breadcrumbs, **not** promoted as events |
 
-We **do not** classify status 0 as `cors` — browsers do not expose that reliably.
+We **do not** classify status 0 as `cors` — browsers do not expose that reliably. Tags include `network.party` (`first_party` \| `third_party`).
 
-Promoted events use structured `extra`:
+Promoted events use structured `extra` (server groups on method + host + path + kind + status):
 
 ```json
 {
-  "http": { "method": "GET", "url": "https://ct.pinterest.com/user/", "hostname": "ct.pinterest.com", "pathname": "/user/", "transport": "xhr" },
-  "failure": { "kind": "network", "name": "NetworkError", "message": "XMLHttpRequest failed (status 0)" },
-  "durationMs": 158,
-  "aborted": false
+  "http": {
+    "method": "POST",
+    "url": "https://app.example.com/api/orders",
+    "origin": "https://app.example.com",
+    "hostname": "app.example.com",
+    "pathname": "/api/orders",
+    "transport": "fetch"
+  },
+  "failure": { "kind": "network", "name": "TypeError", "message": "Failed to fetch" },
+  "network": { "party": "first_party", "durationMs": 842, "aborted": false, "ok": false },
+  "exception_class": "NetworkError",
+  "status_code": null
 }
 ```
 
@@ -224,10 +243,12 @@ Talaria.init({
   dsn: 'https://api.example.com',
   apiKey: 'tal_live_…',
   environment: 'production',
-  // Default true — HTTP status promotion
+  // Default true — HTTP status promotion (first-party / allowlisted only)
   captureFailedRequests: true,
-  // Default true — transport failures (fetch + XHR)
+  // Default true — transport failures (first-party / allowlisted only)
   captureNetworkErrors: true,
+  // Extra origins to treat like first-party for promotion
+  networkErrorOrigins: ['https://api.stripe.com'],
   // Default false — do not store ?query on network URLs
   captureRequestQueryParameters: false,
   // Default [[500, 599]]. CMS admin often wants 4xx too:
@@ -237,7 +258,24 @@ Talaria.init({
 });
 ```
 
-`AbortError` is never promoted and is ignored by the global `unhandledrejection` handler. If a fetch failure is left unhandled after network-error promotion, the duplicate bare `TypeError` event is suppressed; if promotion is off, the exception is kept and correlated with the recent request URL/method/duration.
+`AbortError` is never promoted and is ignored by the global `unhandledrejection` handler. Bare `TypeError: Failed to fetch` / `TimeoutError` rejections are correlated with recent network breadcrumbs: promoted failures and third-party noise are suppressed; first-party failures with promotion off keep the exception and merge request context.
+
+#### Network event tags (low cardinality)
+
+| Tag | Values | Notes |
+| --- | --- | --- |
+| `http.method` | `GET`, `POST`, … | |
+| `http.status_code` | e.g. `500` | Present on HTTP promotions only |
+| `network.failure_kind` | `http` \| `network` \| `timeout` | |
+| `network.transport` | `fetch` \| `xhr` | |
+| `network.party` | `first_party` \| `third_party` | Same-origin vs cross-origin (allowlist does not change this tag) |
+| `network.error_name` | e.g. `TypeError`, `TimeoutError` | When available |
+
+Hostname, pathname, full sanitized URL, and duration live in `extra` — not tags — to avoid high-cardinality facets.
+
+#### Issue grouping (server)
+
+Promoted network events set `extra.exception_class` (`HttpError` \| `NetworkError` \| `TimeoutError`) and `extra.status_code`. The server fingerprints them on **method + hostname + pathname + failure kind + status** (not the human message), so query strings and volatile error text do not fragment Issues. See [`planning/fingerprints.md`](../../../planning/fingerprints.md) §6.4.
 
 ### Event timestamps
 
@@ -248,11 +286,35 @@ Talaria.init({
 
 If replay upload runs before event ingest, `extra.sdk.queuedMs` records how long capture waited (ms). A large `createdAt - timestamp` gap is usually flush/queue delay or clock skew — not a wrong failure classification.
 
+## Init options reference
+
+| Option | Default | Description |
+| --- | --- | --- |
+| `dsn` / `baseUrl` | *(required)* | Serverpod host, e.g. `https://api.example.com` |
+| `apiKey` | *(required)* | Project API key (`tal_live_…`) |
+| `environment` | *(required)* | `production` \| `staging` \| `development` (aliases accepted) |
+| `release` | — | Optional release string on every event |
+| `userId` | — | Optional app user id |
+| `tags` | — | Tags merged into every event |
+| `replaysSessionSampleRate` | `0` | Fraction of sessions that upload continuously |
+| `replaysOnErrorSampleRate` | `1` | Fraction of errors that promote the ring buffer |
+| `replaysErrorAfterMs` | `15000` | Post-error upload window; `0` = continue to 5 min cap |
+| `maskAllInputs` | `true` | rrweb input masking |
+| `inlineStylesheet` | `false` | Embed same-origin CSS (CMS/admin) |
+| `blockSelector` | — | Extra CSS selectors blocked from the DOM snapshot |
+| `disableDefaultIntegrations` | `false` | Skip `window.onerror` / `unhandledrejection` |
+| `captureFailedRequests` | `true` | Promote HTTP status failures (**first-party / allowlisted only**) |
+| `captureNetworkErrors` | `true` | Promote transport/timeout failures (**first-party / allowlisted only**) |
+| `networkErrorOrigins` | `[]` | Extra origins eligible for promotion; same-origin always eligible; `['*']` = all (not recommended) |
+| `failedRequestStatusCodes` | `[[500, 599]]` | Status codes/ranges to promote when origin is eligible |
+| `failedRequestIgnoreUrls` | `[]` | URL substrings never promoted (Talaria `/events` + `/replays` always ignored) |
+| `captureRequestQueryParameters` | `false` | Keep `?query` on network URLs after redaction (`includeNetworkUrlQuery` alias) |
+
 ## Public API
 
 | API | Description |
 | --- | --- |
-| `Talaria.init(options)` | Configure + start recording |
+| `Talaria.init(options)` | Configure + start recording + install network/console hooks |
 | `Talaria.captureException(error)` | Ingest error (+ replay link when sampled) |
 | `Talaria.captureMessage(message, level?)` | Ingest message |
 | `Talaria.getReplayId()` | Active upload replay id, or `null` |

package/dist/client.d.ts

@@ -107,7 +107,7 @@ export declare class TalariaClient {
     private pruneRecentNetworkFailures;
     private rememberNetworkFailure;
     /**
-     * Find a recent transport failure for a bare fetch TypeError.
+     * Find a recent transport failure for a bare fetch TypeError / TimeoutError.
      * Consumes the entry so a later duplicate path cannot reuse it.
      */
     private consumeCorrelatedNetworkFailure;

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EAEd,aAAa,EACb,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAgEpB,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,0BAA0B,EAC1B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,uBAAuB,EACvB,+BAA+B,EAC/B,+BAA+B,EAC/B,4BAA4B,GAC7B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AA8JrC,qBAAa,aAAa;IACxB,OAAO,CAAC,OAAO,CAAgC;IAC/C,OAAO,CAAC,SAAS,CAAmC;IACpD,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,QAAQ,CAA+B;IAC/C,OAAO,CAAC,MAAM,CAAuB;IACrC,yEAAyE;IACzE,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,uBAAuB,CAAK;IACpC,0EAA0E;IAC1E,OAAO,CAAC,iBAAiB,CAAuB;IAChD,4EAA4E;IAC5E,OAAO,CAAC,mBAAmB,CAAuB;IAClD,OAAO,CAAC,UAAU,CAA+C;IACjE,OAAO,CAAC,cAAc,CAA8C;IACpE,OAAO,CAAC,gBAAgB,CAA8C;IACtE,OAAO,CAAC,WAAW,CAAoC;IACvD,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,SAAS,CAAkB;IACnC;;;OAGG;IACH,OAAO,CAAC,gBAAgB,CAAuB;IAC/C,8EAA8E;IAC9E,OAAO,CAAC,wBAAwB,CAAqC;IACrE,iDAAiD;IACjD,OAAO,CAAC,cAAc,CAA+B;IACrD,oFAAoF;IACpF,OAAO,CAAC,SAAS,CAAS;IAC1B;;;OAGG;IACH,OAAO,CAAC,cAAc,CAAS;IAC/B,oEAAoE;IACpE,OAAO,CAAC,qBAAqB,CAA8B;IAE3D,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI;IAwIvC,WAAW,IAAI,MAAM,GAAG,IAAI;IAKtB,gBAAgB,CACpB,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,IAAI,CAAC;IAoDV,cAAc,CAClB,OAAO,EAAE,MAAM,EACf,KAAK,GAAE,aAAsB,EAC7B,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,IAAI,CAAC;IAUV,KAAK,CAAC,IAAI,CAAC,EAAE;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC;IA0CjB;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAsD5B,OAAO,CAAC,YAAY;YAwBN,OAAO;IAoKrB;;;OAGG;IACH,OAAO,CAAC,gCAAgC;IAyBxC,OAAO,CAAC,iBAAiB;IAkBzB,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,uBAAuB;IAK/B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,uBAAuB;IAiB/B,OAAO,CAAC,qBAAqB;YAOf,qBAAqB;IAsBnC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAmB5B,OAAO,CAAC,mBAAmB;IAO3B,8EAA8E;YAChE,YAAY;YAgBZ,eAAe;IAW7B,oFAAoF;IACpF,OAAO,CAAC,iBAAiB;IAiBzB,+EAA+E;IAC/E,OAAO,CAAC,oBAAoB;IAI5B;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;;;OAIG;IACH,OAAO,CAAC,yBAAyB;IAcjC;;;OAGG;YACW,iBAAiB;IAkC/B,OAAO,CAAC,uBAAuB;IAc/B,OAAO,CAAC,0BAA0B;IAMlC,OAAO,CAAC,sBAAsB;IA+B9B;;;OAGG;IACH,OAAO,CAAC,+BAA+B;IA+BvC,OAAO,CAAC,qBAAqB;IA+D7B,OAAO,CAAC,aAAa;YAKP,aAAa;YAkBb,qBAAqB;IAwLnC,OAAO,CAAC,kBAAkB;IAQ1B;;;;;OAKG;YACW,iBAAiB;YAkEjB,cAAc;CAuB7B"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EAEd,aAAa,EACb,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAmEpB,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,0BAA0B,EAC1B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,uBAAuB,EACvB,+BAA+B,EAC/B,+BAA+B,EAC/B,4BAA4B,GAC7B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AAqLrC,qBAAa,aAAa;IACxB,OAAO,CAAC,OAAO,CAAgC;IAC/C,OAAO,CAAC,SAAS,CAAmC;IACpD,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,QAAQ,CAA+B;IAC/C,OAAO,CAAC,MAAM,CAAuB;IACrC,yEAAyE;IACzE,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,uBAAuB,CAAK;IACpC,0EAA0E;IAC1E,OAAO,CAAC,iBAAiB,CAAuB;IAChD,4EAA4E;IAC5E,OAAO,CAAC,mBAAmB,CAAuB;IAClD,OAAO,CAAC,UAAU,CAA+C;IACjE,OAAO,CAAC,cAAc,CAA8C;IACpE,OAAO,CAAC,gBAAgB,CAA8C;IACtE,OAAO,CAAC,WAAW,CAAoC;IACvD,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,SAAS,CAAkB;IACnC;;;OAGG;IACH,OAAO,CAAC,gBAAgB,CAAuB;IAC/C,8EAA8E;IAC9E,OAAO,CAAC,wBAAwB,CAAqC;IACrE,iDAAiD;IACjD,OAAO,CAAC,cAAc,CAA+B;IACrD,oFAAoF;IACpF,OAAO,CAAC,SAAS,CAAS;IAC1B;;;OAGG;IACH,OAAO,CAAC,cAAc,CAAS;IAC/B,oEAAoE;IACpE,OAAO,CAAC,qBAAqB,CAA8B;IAE3D,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI;IA2IvC,WAAW,IAAI,MAAM,GAAG,IAAI;IAKtB,gBAAgB,CACpB,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,IAAI,CAAC;IAsDV,cAAc,CAClB,OAAO,EAAE,MAAM,EACf,KAAK,GAAE,aAAsB,EAC7B,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,IAAI,CAAC;IAUV,KAAK,CAAC,IAAI,CAAC,EAAE;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC;IA0CjB;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAsD5B,OAAO,CAAC,YAAY;YAwBN,OAAO;IAoKrB;;;OAGG;IACH,OAAO,CAAC,gCAAgC;IAyBxC,OAAO,CAAC,iBAAiB;IAkBzB,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,uBAAuB;IAK/B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,uBAAuB;IAiB/B,OAAO,CAAC,qBAAqB;YAOf,qBAAqB;IAsBnC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAmB5B,OAAO,CAAC,mBAAmB;IAO3B,8EAA8E;YAChE,YAAY;YAgBZ,eAAe;IAW7B,oFAAoF;IACpF,OAAO,CAAC,iBAAiB;IAiBzB,+EAA+E;IAC/E,OAAO,CAAC,oBAAoB;IAI5B;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;;;OAIG;IACH,OAAO,CAAC,yBAAyB;IAcjC;;;OAGG;YACW,iBAAiB;IAkC/B,OAAO,CAAC,uBAAuB;IAc/B,OAAO,CAAC,0BAA0B;IAMlC,OAAO,CAAC,sBAAsB;IA0C9B;;;OAGG;IACH,OAAO,CAAC,+BAA+B;IAgCvC,OAAO,CAAC,qBAAqB;IA+D7B,OAAO,CAAC,aAAa;YAKP,aAAa;YAkBb,qBAAqB;IAwLnC,OAAO,CAAC,kBAAkB;IAQ1B;;;;;OAKG;YACW,iBAAiB;YAkEjB,cAAc;CAuB7B"}

package/dist/index.js

@@ -272,7 +272,7 @@ async function collectBrowserContext() {
 
 // src/sdk_meta.ts
 var SDK_NAME = "@newtalaria/browser";
-var SDK_VERSION = "0.1.17";
+var SDK_VERSION = "0.1.18";
 
 // src/transport/serverpod.ts
 var ServerpodTransport = class {
@@ -13482,18 +13482,22 @@ var { freezePage } = record;
 var { takeFullSnapshot } = record;
 
 // src/replay/privacy.ts
-var SENSITIVE_QUERY = /(?:^|[?&])(token|secret|password|auth|api[_-]?key|access[_-]?token)=([^&#]*)/gi;
+var SENSITIVE_QUERY_KEY = /^(?:token|secret|password|auth|api[_-]?key|access[_-]?token|gclid|fbclid|gcl_au|msclkid|_ga(?:_.*)?|cid|sid)$/i;
+var SENSITIVE_QUERY_LEGACY = /(?:^|[?&])(token|secret|password|auth|api[_-]?key|access[_-]?token|gclid|fbclid|gcl_au|msclkid|_ga(?:_[^=&#]*)?|cid|sid)=([^&#]*)/gi;
+function isSensitiveQueryKey(key) {
+  return SENSITIVE_QUERY_KEY.test(key);
+}
 function redactUrl(raw) {
   try {
     const url = new URL(raw, typeof location !== "undefined" ? location.href : void 0);
     for (const key of [...url.searchParams.keys()]) {
-      if (/token|secret|password|auth|api[_-]?key|access[_-]?token/i.test(key)) {
+      if (isSensitiveQueryKey(key)) {
         url.searchParams.set(key, "[Filtered]");
       }
     }
     return url.toString();
   } catch {
-    return raw.replace(SENSITIVE_QUERY, (_m, name) => `${name}=[Filtered]`);
+    return raw.replace(SENSITIVE_QUERY_LEGACY, (_m, name) => `${name}=[Filtered]`);
   }
 }
 function sanitizeNetworkUrl(raw, opts) {
@@ -13590,6 +13594,9 @@ function startRecorder(options) {
 function isAbortError(error) {
   return error instanceof Error && error.name === "AbortError";
 }
+function isTimeoutError(error) {
+  return error instanceof Error && error.name === "TimeoutError";
+}
 function isLikelyNetworkFetchError(error) {
   if (!(error instanceof Error)) return false;
   if (error.name === "AbortError" || error.name === "TimeoutError") return false;
@@ -13597,6 +13604,9 @@ function isLikelyNetworkFetchError(error) {
   const msg = error.message.toLowerCase().trim();
   return msg === "failed to fetch" || msg === "load failed" || msg === "networkerror when attempting to fetch resource." || msg.startsWith("networkerror") || msg.includes("failed to fetch");
 }
+function isCorrelatableTransportError(error) {
+  return isLikelyNetworkFetchError(error) || isTimeoutError(error);
+}
 function describeUnknownError(error) {
   if (error instanceof Error) {
     return {
@@ -13744,6 +13754,56 @@ function urlMatchesIgnoreList(url, ignoreUrls) {
   }
   return false;
 }
+function normalizeNetworkOrigin(raw) {
+  const trimmed = (raw || "").trim();
+  if (!trimmed || trimmed === "*") return trimmed;
+  try {
+    return new URL(trimmed).origin;
+  } catch {
+    try {
+      return new URL(`https://${trimmed}`).origin;
+    } catch {
+      return trimmed.replace(/\/+$/, "");
+    }
+  }
+}
+function resolvePageOrigin(pageOrigin) {
+  if (pageOrigin) {
+    try {
+      return new URL(pageOrigin).origin;
+    } catch {
+      return pageOrigin.replace(/\/+$/, "");
+    }
+  }
+  if (typeof location !== "undefined" && location.origin) {
+    return location.origin;
+  }
+  return "";
+}
+function resolveRequestOrigin(rawUrl, pageOrigin) {
+  const base = pageOrigin || (typeof location !== "undefined" ? location.href : void 0);
+  try {
+    return new URL(rawUrl, base).origin;
+  } catch {
+    return "";
+  }
+}
+function isAllowedNetworkOrigin(requestOrigin, opts) {
+  if (!requestOrigin) return false;
+  const allow = opts.networkErrorOrigins.map(normalizeNetworkOrigin);
+  if (allow.includes("*")) return true;
+  const page = resolvePageOrigin(opts.pageOrigin);
+  if (page && requestOrigin === page) return true;
+  return allow.includes(requestOrigin);
+}
+function classifyNetworkParty(requestOrigin, pageOrigin) {
+  const page = resolvePageOrigin(pageOrigin);
+  if (page && requestOrigin && requestOrigin === page) return "first_party";
+  return "third_party";
+}
+function isHttpOkStatus(status) {
+  return status >= 200 && status < 300;
+}
 function shouldPromoteFailedRequest(meta, opts) {
   if (!opts.captureFailedRequests) return false;
   if (typeof meta.status !== "number" || Number.isNaN(meta.status)) return false;
@@ -13754,6 +13814,13 @@ function shouldPromoteFailedRequest(meta, opts) {
     opts.talariaBaseUrl
   );
   if (urlMatchesIgnoreList(meta.url || "", ignore)) return false;
+  const requestOrigin = meta.origin || resolveRequestOrigin(meta.url || "", opts.pageOrigin);
+  if (!isAllowedNetworkOrigin(requestOrigin, {
+    networkErrorOrigins: opts.networkErrorOrigins ?? [],
+    pageOrigin: opts.pageOrigin
+  })) {
+    return false;
+  }
   return true;
 }
 function shouldPromoteNetworkError(meta, opts) {
@@ -13767,6 +13834,13 @@ function shouldPromoteNetworkError(meta, opts) {
     opts.talariaBaseUrl
   );
   if (urlMatchesIgnoreList(meta.url || "", ignore)) return false;
+  const requestOrigin = meta.origin || resolveRequestOrigin(meta.url || "", opts.pageOrigin);
+  if (!isAllowedNetworkOrigin(requestOrigin, {
+    networkErrorOrigins: opts.networkErrorOrigins ?? [],
+    pageOrigin: opts.pageOrigin
+  })) {
+    return false;
+  }
   return true;
 }
 function enrichNetworkMeta(meta) {
@@ -13777,7 +13851,8 @@ function enrichNetworkMeta(meta) {
       failureKind: meta.ok === false ? "http" : meta.failureKind
     };
   }
-  if (meta.ok === false || meta.errorName || meta.errorMessage || meta.aborted) {
+  const hasTransportSignal = !!meta.errorName || !!meta.errorMessage || !!meta.aborted || meta.failureKind === "abort" || meta.failureKind === "timeout" || meta.failureKind === "network";
+  if (hasTransportSignal) {
     const failureKind = meta.failureKind === "abort" || meta.failureKind === "timeout" || meta.failureKind === "network" ? meta.failureKind : classifyTransportFailure({
       aborted: meta.aborted,
       errorName: meta.errorName
@@ -13790,10 +13865,13 @@ function enrichNetworkMeta(meta) {
   }
   return meta;
 }
-function networkUrlParts(rawUrl, includeQuery) {
-  const parts = sanitizeNetworkUrl(rawUrl, { includeQuery });
+function networkUrlParts(rawUrl, includeQuery, pageOrigin) {
+  const baseHref = pageOrigin || (typeof location !== "undefined" ? location.href : void 0);
+  const parts = sanitizeNetworkUrl(rawUrl, { includeQuery, baseHref });
+  const origin = resolveRequestOrigin(rawUrl, pageOrigin);
   return {
     url: parts.url,
+    origin: origin || void 0,
     hostname: parts.hostname,
     pathname: parts.pathname,
     ...parts.search ? { search: parts.search } : {}
@@ -13809,14 +13887,22 @@ function installNetworkHook(options = {}) {
     captureNetworkErrors: options.captureNetworkErrors ?? true,
     failedRequestStatusCodes: options.failedRequestStatusCodes ?? [[500, 599]],
     failedRequestIgnoreUrls: options.failedRequestIgnoreUrls ?? [],
+    networkErrorOrigins: options.networkErrorOrigins ?? [],
+    pageOrigin: options.pageOrigin,
     talariaBaseUrl: options.talariaBaseUrl
   };
   const includeQuery = options.captureRequestQueryParameters ?? options.includeNetworkUrlQuery ?? false;
   const handleMeta = (meta) => {
     const { rawUrl, ...rest } = meta;
+    const parts = networkUrlParts(rawUrl, includeQuery, matchOpts.pageOrigin);
+    const party = classifyNetworkParty(
+      parts.origin || "",
+      matchOpts.pageOrigin
+    );
     const enriched = enrichNetworkMeta({
       ...rest,
-      ...networkUrlParts(rawUrl, includeQuery)
+      ...parts,
+      party
     });
     try {
       emitNetwork(enriched);
@@ -13836,6 +13922,7 @@ function installNetworkHook(options = {}) {
       const rawUrl = typeof input2 === "string" ? input2 : input2 instanceof URL ? input2.toString() : input2.url;
       try {
         const response = await originalFetch(input2, init);
+        const opaque = response.type === "opaque" || response.type === "opaqueredirect";
         handleMeta({
           method,
           rawUrl,
@@ -13843,7 +13930,8 @@ function installNetworkHook(options = {}) {
           transport: "fetch",
           status: response.status,
           durationMs: Date.now() - started,
-          ok: response.ok
+          // Opaque responses resolve successfully with status 0 — not a failure.
+          ok: opaque ? true : response.ok
         });
         return response;
       } catch (error) {
@@ -13905,7 +13993,7 @@ function installNetworkHook(options = {}) {
           transport: "xhr",
           status,
           durationMs: Date.now() - (this.__talariaStarted ?? Date.now()),
-          ok: status >= 200 && status < 400,
+          ok: isHttpOkStatus(status),
           ...transportFail ? {
             failureKind,
             errorName,
@@ -13914,7 +14002,7 @@ function installNetworkHook(options = {}) {
           } : {}
         });
       };
-      this.addEventListener("loadend", onDone);
+      this.addEventListener("loadend", onDone, { once: true });
       return originalSend.call(this, body);
     };
   }
@@ -13926,10 +14014,16 @@ function installNetworkHook(options = {}) {
 }
 
 // src/client.ts
+function networkExceptionClass(failure) {
+  if (failure.failureKind === "http") return "HttpError";
+  if (failure.failureKind === "timeout") return "TimeoutError";
+  return "NetworkError";
+}
 function networkFailureTags(failure) {
   return {
     "http.method": failure.method || "GET",
     "network.failure_kind": failure.failureKind ?? "network",
+    ...failure.party ? { "network.party": failure.party } : {},
     ...failure.transport ? { "network.transport": failure.transport } : {},
     ...failure.errorName ? { "network.error_name": failure.errorName } : {}
   };
@@ -13939,6 +14033,7 @@ function networkFailureExtra(failure) {
     method: failure.method || "GET",
     url: failure.url || "(unknown url)"
   };
+  if (failure.origin) http.origin = failure.origin;
   if (failure.hostname) http.hostname = failure.hostname;
   if (failure.pathname) http.pathname = failure.pathname;
   if (failure.search) http.search = failure.search;
@@ -13951,9 +14046,19 @@ function networkFailureExtra(failure) {
   };
   if (failure.errorName) fail.name = failure.errorName;
   if (failure.errorMessage) fail.message = failure.errorMessage;
+  const statusCode = typeof failure.status === "number" && failure.status > 0 ? failure.status : null;
   return {
     http,
     failure: fail,
+    network: {
+      party: failure.party ?? "third_party",
+      durationMs: failure.durationMs,
+      aborted: failure.aborted ?? false,
+      ok: failure.ok ?? false
+    },
+    // Top-level for server fingerprint compatibility.
+    status_code: statusCode,
+    exception_class: networkExceptionClass(failure),
     durationMs: failure.durationMs,
     aborted: failure.aborted ?? false,
     ok: failure.ok ?? false
@@ -13999,6 +14104,7 @@ function resolveOptions(options) {
     disableDefaultIntegrations: options.disableDefaultIntegrations ?? false,
     captureFailedRequests: options.captureFailedRequests ?? true,
     captureNetworkErrors: options.captureNetworkErrors ?? true,
+    networkErrorOrigins: options.networkErrorOrigins ?? [],
     includeNetworkUrlQuery: options.captureRequestQueryParameters ?? options.includeNetworkUrlQuery ?? false,
     failedRequestStatusCodes: options.failedRequestStatusCodes ?? [[500, 599]],
     failedRequestIgnoreUrls: options.failedRequestIgnoreUrls ?? []
@@ -14128,6 +14234,8 @@ var TalariaClient = class {
       installNetworkHook({
         captureFailedRequests: this.options.captureFailedRequests,
         captureNetworkErrors: this.options.captureNetworkErrors,
+        networkErrorOrigins: this.options.networkErrorOrigins,
+        pageOrigin: typeof location !== "undefined" ? location.origin : void 0,
         includeNetworkUrlQuery: this.options.includeNetworkUrlQuery,
         failedRequestStatusCodes: this.options.failedRequestStatusCodes,
         failedRequestIgnoreUrls: this.options.failedRequestIgnoreUrls,
@@ -14221,6 +14329,7 @@ var TalariaClient = class {
     }
     const correlated = this.consumeCorrelatedNetworkFailure(err);
     if (correlated?.promoted) return;
+    if (correlated && correlated.party === "third_party") return;
     const mergedContext = correlated ? mergeNetworkFailureContext(context, correlated) : context;
     this.capturing = true;
     try {
@@ -14703,6 +14812,13 @@ var TalariaClient = class {
     );
   }
   rememberNetworkFailure(meta, opts) {
+    if (this.options) {
+      const ignore = buildFailedRequestIgnoreUrls(
+        this.options.failedRequestIgnoreUrls,
+        this.options.baseUrl
+      );
+      if (urlMatchesIgnoreList(meta.url || "", ignore)) return;
+    }
     const now = Date.now();
     this.pruneRecentNetworkFailures(now);
     for (let i = this.recentNetworkFailures.length - 1; i >= 0; i--) {
@@ -14713,6 +14829,8 @@ var TalariaClient = class {
         existing.errorName = meta.errorName ?? existing.errorName;
         existing.aborted = meta.aborted ?? existing.aborted;
         existing.failureKind = meta.failureKind ?? existing.failureKind;
+        existing.party = meta.party ?? existing.party;
+        existing.origin = meta.origin ?? existing.origin;
         return;
       }
     }
@@ -14723,11 +14841,12 @@ var TalariaClient = class {
     });
   }
   /**
-   * Find a recent transport failure for a bare fetch TypeError.
+   * Find a recent transport failure for a bare fetch TypeError / TimeoutError.
    * Consumes the entry so a later duplicate path cannot reuse it.
    */
   consumeCorrelatedNetworkFailure(error) {
-    if (!isLikelyNetworkFetchError(error)) return null;
+    if (!isCorrelatableTransportError(error)) return null;
+    const wantKind = isTimeoutError(error) ? "timeout" : "network";
     const now = Date.now();
     this.pruneRecentNetworkFailures(now);
     const takeAt = (index2) => {
@@ -14736,14 +14855,14 @@ var TalariaClient = class {
     };
     for (let i = this.recentNetworkFailures.length - 1; i >= 0; i--) {
       const failure = this.recentNetworkFailures[i];
-      if (failure.aborted || failure.failureKind !== "network") continue;
+      if (failure.aborted || failure.failureKind !== wantKind) continue;
       if (failure.errorMessage && failure.errorMessage === error.message) {
         return takeAt(i);
       }
     }
     for (let i = this.recentNetworkFailures.length - 1; i >= 0; i--) {
       const failure = this.recentNetworkFailures[i];
-      if (failure.aborted || failure.failureKind !== "network") continue;
+      if (failure.aborted || failure.failureKind !== wantKind) continue;
       return takeAt(i);
     }
     return null;