@obsrviq/tracker 0.5.0 → 0.7.0

package/dist/index.js

@@ -88,24 +88,23 @@ function redactBatchSensitiveKeys(events) {
     }
   }
 }
-function maskValue(value, depth = 0) {
-  if (depth > 6) return "\xABdepth\xBB";
-  if (typeof value === "string") return maskString(value);
-  if (value === null || typeof value !== "object") return value;
-  if (Array.isArray(value)) return value.map((v) => maskValue(v, depth + 1));
-  const out = {};
-  for (const [k, v] of Object.entries(value)) {
-    out[k] = isSensitiveKeyName(k) ? "\xABredacted\xBB" : maskValue(v, depth + 1);
-  }
-  return out;
-}
 
 // src/transport.ts
 var MAX_BUFFER_EVENTS = 5e3;
+var MAX_BATCH_JSON_BYTES = 4 * 1024 * 1024;
+var BEACON_PIECE_BYTES = 56 * 1024;
+var SPILL_KEY = "obsrviq.spill";
+var SPILL_MAX_BYTES = 15e5;
+var SPILL_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+var RR_FULL_SNAPSHOT = 2;
+var RR_META = 4;
 var Transport = class {
   constructor(opts) {
     this.opts = opts;
     this.buffer = [];
+    /** Floor set by an unload flush that consumed seqs out-of-band (beacon pieces),
+     *  so the normal path can never re-use one of them. */
+    this.seqFloor = 0;
     this.sending = false;
     this.retryDelay = 1e3;
     this.stopped = false;
@@ -121,29 +120,107 @@ var Transport = class {
     this.timer = setInterval(() => void this.flush("timer"), this.opts.flushIntervalMs);
     document.addEventListener("visibilitychange", this.onVisibility, { capture: true });
     window.addEventListener("pagehide", this.onPageHide, { capture: true });
+    this.resendSpill();
   }
   enqueue(event) {
     if (this.stopped) return;
     this.buffer.push(event);
     if (this.buffer.length >= MAX_BUFFER_EVENTS) {
       void this.flush("backpressure");
-      if (this.buffer.length >= MAX_BUFFER_EVENTS) {
-        this.buffer = this.buffer.filter((e, i) => e.type !== "dom" || i % 2 === 0);
+      if (this.buffer.length >= MAX_BUFFER_EVENTS) this.shedDomBacklog();
+    }
+  }
+  /** Drop buffered DOM events WITHOUT breaking rrweb's delta chain. Deltas only
+   *  apply on top of everything before them, so arbitrary dropping corrupts the
+   *  replay until the next 30s checkpoint. Instead: if the buffer holds a
+   *  FullSnapshot, drop only the DOM events BEFORE it (the snapshot re-anchors
+   *  everything after). Otherwise drop ALL buffered DOM and ask the recorder for
+   *  a fresh FullSnapshot so the stream re-anchors immediately. Non-DOM events
+   *  (console/network/errors/…) are independent and kept. */
+  shedDomBacklog() {
+    let snapIdx = -1;
+    for (let i = this.buffer.length - 1; i >= 0; i--) {
+      const e = this.buffer[i];
+      if (e?.type === "dom" && e.data?.type === RR_FULL_SNAPSHOT) {
+        snapIdx = i;
+        break;
       }
     }
+    if (snapIdx > 0) {
+      let keepFrom = snapIdx;
+      const prev = this.buffer[snapIdx - 1];
+      if (prev?.type === "dom" && prev.data?.type === RR_META) {
+        keepFrom = snapIdx - 1;
+      }
+      const kept = this.buffer.filter((e, i) => e.type !== "dom" || i >= keepFrom);
+      if (kept.length < this.buffer.length) {
+        this.buffer = kept;
+        if (this.buffer.length < MAX_BUFFER_EVENTS) return;
+      }
+    }
+    this.buffer = this.buffer.filter((e) => e.type !== "dom");
+    if (this.buffer.length >= MAX_BUFFER_EVENTS) {
+      this.buffer = this.buffer.slice(-Math.floor(MAX_BUFFER_EVENTS / 2));
+    }
+    this.opts.onDomDrop?.();
   }
   /** Build, compress, and send the current buffer. Returns true on success. */
   async flush(reason) {
+    if (reason === "pagehide" || reason === "hidden") return this.flushUnload();
     if (this.sending || this.buffer.length === 0) return true;
-    const unloading = reason === "pagehide" || reason === "hidden";
-    if (!unloading && isMaskConfigPending()) {
-      if (!this.stopped) setTimeout(() => void this.flush("timer"), 200);
+    if (isMaskConfigPending() && !this.stopped) {
+      setTimeout(() => void this.flush("timer"), 200);
       return true;
     }
     this.sending = true;
     const events = this.buffer;
     this.buffer = [];
     redactBatchSensitiveKeys(events);
+    let ok;
+    try {
+      ok = await this.sendEvents(events);
+    } finally {
+      this.sending = false;
+    }
+    if (ok && this.stopped && this.buffer.length > 0) void this.flush("manual");
+    return ok;
+  }
+  /** Send events as one or more seq-stamped batches: oversized batches split in
+   *  half (byte cap here, or a server 413), poison batches (other 4xx) are dropped
+   *  instead of retried forever, and transient failures re-buffer + back off. */
+  async sendEvents(events) {
+    const queue = [events];
+    while (queue.length > 0) {
+      const slice = queue[0];
+      const result = await this.dispatch(slice);
+      if (result === "ok") {
+        queue.shift();
+        continue;
+      }
+      if (result === "too_large" && slice.length > 1) {
+        const mid = Math.ceil(slice.length / 2);
+        queue.splice(0, 1, slice.slice(0, mid), slice.slice(mid));
+        continue;
+      }
+      if (result === "fatal" || result === "too_large") {
+        queue.shift();
+        continue;
+      }
+      this.buffer = [].concat(...queue, this.buffer);
+      if (this.buffer.length >= MAX_BUFFER_EVENTS) this.shedDomBacklog();
+      if (!this.stopped) {
+        const jitter = this.retryDelay * (0.5 + Math.random());
+        this.retryDelay = Math.min(this.retryDelay * 2, 3e4);
+        setTimeout(() => void this.flush("timer"), jitter);
+      }
+      return false;
+    }
+    this.retryDelay = 1e3;
+    return true;
+  }
+  /** One batch → one network attempt. Owns seq assignment/advance. */
+  async dispatch(events) {
+    if (this.seqFloor > this.seq) this.seq = this.seqFloor;
     let batch = {
       siteKey: this.opts.siteKey,
       sessionId: this.opts.sessionId,
@@ -158,73 +235,165 @@ var Transport = class {
         batch = null;
       }
     }
-    if (!batch) {
-      this.sending = false;
-      return true;
-    }
-    this.opts.onSeqDispatch?.(this.seq + 1);
+    if (!batch) return "ok";
     const json = JSON.stringify(batch);
-    const gz = gzipSync(new TextEncoder().encode(json));
-    const ok = await this.send(gz, reason === "pagehide" || reason === "hidden");
-    this.opts.onFlush?.({ bytes: gz.byteLength, events: events.length, ok });
-    if (ok) {
-      this.seq++;
-      this.retryDelay = 1e3;
-      this.sending = false;
-      return true;
-    }
-    this.buffer = events.slice(-MAX_BUFFER_EVENTS).concat(this.buffer);
-    this.sending = false;
-    if (!this.stopped) {
-      const jitter = this.retryDelay * (0.5 + Math.random());
-      this.retryDelay = Math.min(this.retryDelay * 2, 3e4);
-      setTimeout(() => void this.flush("timer"), jitter);
-    }
-    return false;
+    if (json.length > MAX_BATCH_JSON_BYTES && events.length > 1) return "too_large";
+    this.opts.onSeqDispatch?.(this.seq + 1);
+    const gz = await gzipBytes(new TextEncoder().encode(json));
+    const result = await this.send(gz);
+    this.opts.onFlush?.({ bytes: gz.byteLength, events: events.length, ok: result === "ok" });
+    if (result === "ok") this.seq = Math.max(this.seq + 1, this.seqFloor);
+    return result;
   }
-  async send(bytes, unloading) {
+  async send(bytes) {
     const url = `${this.opts.endpoint.replace(/\/$/, "")}/v1/batch`;
-    const headers = {
-      "content-type": "application/octet-stream",
-      "x-obsrviq-key": this.opts.siteKey
-    };
-    const body = bytes;
-    if (unloading) {
-      const blob = new Blob([bytes], { type: "application/octet-stream" });
-      if (typeof navigator.sendBeacon === "function") {
+    const ctrl = new AbortController();
+    const timeout = setTimeout(() => ctrl.abort(), 15e3);
+    try {
+      const res = await fetch(url, {
+        method: "POST",
+        body: bytes,
+        headers: {
+          "content-type": "application/octet-stream",
+          "x-obsrviq-key": this.opts.siteKey
+        },
+        credentials: "omit",
+        mode: "cors",
+        signal: ctrl.signal
+      });
+      if (res.ok) return "ok";
+      if (res.status === 413) return "too_large";
+      if (res.status >= 400 && res.status < 500 && res.status !== 408 && res.status !== 429) return "fatal";
+      return "retry";
+    } catch {
+      return "retry";
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+  /** Unload flush (pagehide / tab hidden). Fully synchronous — the page may be
+   *  gone before any await resolves. Ignores the `sending` guard (that in-flight
+   *  fetch is about to be cancelled; its seq is skipped via seqFloor), chunks the
+   *  tail into beacon-sized pieces (sendBeacon caps bodies at ~64KB — one big
+   *  batch would be rejected whole), and spills anything the beacon queue refuses
+   *  to localStorage for the next page load to resend. */
+  flushUnload() {
+    if (this.buffer.length === 0) return true;
+    const events = this.buffer;
+    this.buffer = [];
+    redactBatchSensitiveKeys(events);
+    let seq = Math.max(this.sending ? this.seq + 1 : this.seq, this.seqFloor);
+    const pieces = [];
+    const stack = [events];
+    while (stack.length > 0) {
+      const slice = stack.shift();
+      let batch = {
+        siteKey: this.opts.siteKey,
+        sessionId: this.opts.sessionId,
+        seq,
+        meta: this.opts.getMeta(),
+        events: slice
+      };
+      if (this.opts.beforeSend) {
         try {
-          if (navigator.sendBeacon(url, blob)) return true;
+          batch = this.opts.beforeSend(batch);
         } catch {
+          batch = null;
         }
       }
+      if (!batch) continue;
+      const gz = gzipSync(new TextEncoder().encode(JSON.stringify(batch)));
+      if (gz.byteLength > BEACON_PIECE_BYTES && slice.length > 1) {
+        const mid = Math.ceil(slice.length / 2);
+        stack.unshift(slice.slice(0, mid), slice.slice(mid));
+        continue;
+      }
+      pieces.push({ gz, count: slice.length });
+      seq++;
+    }
+    this.seqFloor = seq;
+    this.opts.onSeqDispatch?.(seq);
+    for (const { gz, count } of pieces) {
+      const sent = gz.byteLength <= BEACON_PIECE_BYTES && this.sendUnload(gz);
+      if (!sent) this.spill(gz);
+      this.opts.onFlush?.({ bytes: gz.byteLength, events: count, ok: sent });
+    }
+    return true;
+  }
+  /** Fire-and-forget delivery that survives navigation. True = queued. */
+  sendUnload(bytes) {
+    const url = `${this.opts.endpoint.replace(/\/$/, "")}/v1/batch`;
+    const blob = new Blob([bytes], { type: "application/octet-stream" });
+    if (typeof navigator.sendBeacon === "function") {
       try {
-        void fetch(url, { method: "POST", body, headers, keepalive: true, credentials: "omit", mode: "cors" }).catch(
-          () => {
-          }
-        );
-        return true;
+        if (navigator.sendBeacon(url, blob)) return true;
       } catch {
-        return false;
       }
     }
-    const ctrl = new AbortController();
-    const timeout = setTimeout(() => ctrl.abort(), 15e3);
     try {
-      const res = await fetch(url, {
+      void fetch(url, {
         method: "POST",
-        body,
-        headers,
+        body: bytes,
+        headers: {
+          "content-type": "application/octet-stream",
+          "x-obsrviq-key": this.opts.siteKey
+        },
+        keepalive: true,
         credentials: "omit",
-        mode: "cors",
-        signal: ctrl.signal
+        mode: "cors"
+      }).catch(() => {
       });
-      return res.ok;
+      return true;
     } catch {
       return false;
-    } finally {
-      clearTimeout(timeout);
     }
   }
+  /** Append one gzipped batch to the localStorage spill (bounded, oldest-first
+   *  eviction). Quota/private-mode failures mean the tail is lost — same as
+   *  before spilling existed. */
+  spill(gz) {
+    try {
+      const raw = window.localStorage.getItem(SPILL_KEY);
+      const entries = raw ? JSON.parse(raw) : [];
+      entries.push({ k: this.opts.siteKey, b: b64encode(gz), ts: Date.now() });
+      let total = entries.reduce((n, e) => n + e.b.length, 0);
+      while (entries.length > 0 && total > SPILL_MAX_BYTES) {
+        total -= entries[0].b.length;
+        entries.shift();
+      }
+      window.localStorage.setItem(SPILL_KEY, JSON.stringify(entries));
+    } catch {
+    }
+  }
+  /** Resend batches a previous page's unload spilled. Entries are claimed
+   *  (removed) up front so two tabs can't double-send; still-transient failures
+   *  are re-spilled for the next load. Fire-and-forget. */
+  resendSpill() {
+    let mine = [];
+    try {
+      const raw = window.localStorage.getItem(SPILL_KEY);
+      if (!raw) return;
+      const entries = JSON.parse(raw);
+      const now = Date.now();
+      const fresh = entries.filter((e) => e && typeof e.b === "string" && now - e.ts < SPILL_MAX_AGE_MS);
+      mine = fresh.filter((e) => e.k === this.opts.siteKey);
+      const others = fresh.filter((e) => e.k !== this.opts.siteKey);
+      if (others.length > 0) window.localStorage.setItem(SPILL_KEY, JSON.stringify(others));
+      else window.localStorage.removeItem(SPILL_KEY);
+    } catch {
+      return;
+    }
+    if (mine.length === 0) return;
+    void (async () => {
+      for (const entry of mine) {
+        try {
+          const result = await this.send(b64decode(entry.b));
+          if (result === "retry") this.spill(b64decode(entry.b));
+        } catch {
+        }
+      }
+    })();
+  }
   stop() {
     this.stopped = true;
     if (this.timer) clearInterval(this.timer);
@@ -233,6 +402,29 @@ var Transport = class {
     void this.flush("manual");
   }
 };
+async function gzipBytes(bytes) {
+  if (typeof CompressionStream !== "undefined") {
+    try {
+      const stream = new Blob([bytes]).stream().pipeThrough(new CompressionStream("gzip"));
+      return new Uint8Array(await new Response(stream).arrayBuffer());
+    } catch {
+    }
+  }
+  return gzipSync(bytes);
+}
+function b64encode(bytes) {
+  let bin = "";
+  for (let i = 0; i < bytes.length; i += 32768) {
+    bin += String.fromCharCode(...bytes.subarray(i, i + 32768));
+  }
+  return btoa(bin);
+}
+function b64decode(s) {
+  const bin = atob(s);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
 
 // src/util.ts
 function uuid() {
@@ -283,6 +475,13 @@ async function sha256Hex(input) {
 function detectDevice() {
   const ua = navigator.userAgent;
   const viewport = { w: window.innerWidth, h: window.innerHeight };
+  let tz;
+  let tzOffset;
+  try {
+    tz = Intl.DateTimeFormat().resolvedOptions().timeZone || void 0;
+    tzOffset = -(/* @__PURE__ */ new Date()).getTimezoneOffset();
+  } catch {
+  }
   let type = "desktop";
   if (/iPad|Tablet/i.test(ua)) type = "tablet";
   else if (/Mobi|Android|iPhone/i.test(ua)) type = "mobile";
@@ -297,7 +496,7 @@ function detectDevice() {
   else if (/Chrome\//.test(ua)) browser = "Chrome";
   else if (/Firefox\//.test(ua)) browser = "Firefox";
   else if (/Safari\//.test(ua)) browser = "Safari";
-  return { type, os, browser, viewport };
+  return { type, os, browser, viewport, tz, tzOffset };
 }
 function privacySignalsOptOut() {
   const nav = navigator;
@@ -311,11 +510,13 @@ var INCREMENTAL = 3;
 function instrumentDom(ctx) {
   const stop = record({
     emit(event) {
+      const t = ctx.clock.fromPerf(performanceNow());
+      event.timestamp = ctx.clock.startedAt + t;
       const dom = {
         id: uuid(),
         sessionId: ctx.sessionId,
         type: "dom",
-        t: ctx.clock.fromPerf(performanceNow()),
+        t,
         ts: ctx.clock.wall(),
         data: event
       };
@@ -346,12 +547,19 @@ function instrumentDom(ctx) {
     }
   };
 }
+function takeFullSnapshot() {
+  try {
+    record.takeFullSnapshot(true);
+  } catch {
+  }
+}
 function performanceNow() {
   return typeof performance !== "undefined" ? performance.now() : Date.now();
 }
 
 // src/serialize.ts
 var DEFAULT_MAX_BYTES = 8 * 1024;
+var MAX_WALK_NODES = 2e3;
 function byteLen(s) {
   return new Blob([s]).size;
 }
@@ -367,9 +575,11 @@ function serializeArg(arg, maxBytes = DEFAULT_MAX_BYTES) {
     return { kind: "primitive", value: arg };
   }
   if (type === "string") {
-    const masked = maskString(arg);
+    const s = arg;
+    const cut = s.length > maxBytes * 2 ? s.slice(0, maxBytes * 2) : s;
+    const masked = maskString(cut);
     const { value, truncated } = truncate(masked, maxBytes);
-    return { kind: "string", value, truncated };
+    return { kind: "string", value, truncated: truncated || cut !== s };
   }
   if (arg instanceof Error) {
     return {
@@ -383,21 +593,56 @@ function serializeArg(arg, maxBytes = DEFAULT_MAX_BYTES) {
     return { kind: "dom", selector: cssPath(arg) };
   }
   if (type === "object" || type === "function" || type === "symbol" || type === "bigint") {
-    const masked = maskValue(arg);
+    const budget = { nodes: MAX_WALK_NODES, bytes: maxBytes * 2, exhausted: false };
+    const masked = maskValueBudgeted(arg, budget);
     let json;
-    let truncated = false;
+    let truncated = budget.exhausted;
     try {
       const full = JSON.stringify(masked, safeReplacer());
       const cut = truncate(full ?? "undefined", maxBytes);
       json = cut.value;
-      truncated = cut.truncated;
+      truncated = truncated || cut.truncated;
     } catch {
       json = void 0;
     }
-    return { kind: "object", preview: previewOf(masked), json, truncated };
+    return { kind: "object", preview: previewOf(arg), json, truncated };
   }
   return { kind: "primitive", value: String(arg) };
 }
+function maskValueBudgeted(value, budget, depth = 0) {
+  if (budget.exhausted) return "\xABtruncated\xBB";
+  if (depth > 6) return "\xABdepth\xBB";
+  if (--budget.nodes <= 0) budget.exhausted = true;
+  if (typeof value === "string") {
+    const cut = value.length > budget.bytes ? value.slice(0, Math.max(0, budget.bytes)) : value;
+    if (cut !== value) budget.exhausted = true;
+    const masked = maskString(cut);
+    if ((budget.bytes -= masked.length + 2) <= 0) budget.exhausted = true;
+    return masked;
+  }
+  if (value === null || typeof value !== "object") return value;
+  if (Array.isArray(value)) {
+    const out2 = [];
+    for (const v of value) {
+      if (budget.exhausted) {
+        out2.push("\xABtruncated\xBB");
+        break;
+      }
+      out2.push(maskValueBudgeted(v, budget, depth + 1));
+    }
+    return out2;
+  }
+  const out = {};
+  for (const k of Object.keys(value)) {
+    if (budget.exhausted) {
+      out["\u2026"] = "\xABtruncated\xBB";
+      break;
+    }
+    if ((budget.bytes -= k.length + 4) <= 0) budget.exhausted = true;
+    out[k] = isSensitiveKeyName(k) ? "\xABredacted\xBB" : maskValueBudgeted(value[k], budget, depth + 1);
+  }
+  return out;
+}
 function safeReplacer() {
   const seen = /* @__PURE__ */ new WeakSet();
   return (_key, value) => {
@@ -531,8 +776,83 @@ function errorToConsoleEvent(ctx, err) {
   };
 }
 
+// src/ratelimit.ts
+function tokenBucket(rate2, burst) {
+  let tokens = burst;
+  let last = Date.now();
+  return {
+    take() {
+      const now = Date.now();
+      tokens = Math.min(burst, tokens + (now - last) / 1e3 * rate2);
+      last = now;
+      if (tokens < 1) return false;
+      tokens -= 1;
+      return true;
+    }
+  };
+}
+
+// src/trace.ts
+function randomHex(bytes) {
+  const arr = new Uint8Array(bytes);
+  if (typeof crypto !== "undefined" && typeof crypto.getRandomValues === "function") {
+    crypto.getRandomValues(arr);
+  } else {
+    for (let i = 0; i < bytes; i++) arr[i] = Math.random() * 256 | 0;
+  }
+  let s = "";
+  for (let i = 0; i < bytes; i++) s += arr[i].toString(16).padStart(2, "0");
+  return s;
+}
+function newTrace() {
+  const traceId = randomHex(16);
+  const spanId = randomHex(8);
+  return { traceId, spanId, header: `00-${traceId}-${spanId}-01` };
+}
+function traceTarget(rawUrl, cfg) {
+  if (!cfg.tracePropagation) return false;
+  let u;
+  try {
+    u = new URL(rawUrl, typeof location !== "undefined" ? location.href : void 0);
+  } catch {
+    return false;
+  }
+  if (u.protocol !== "http:" && u.protocol !== "https:") return false;
+  if (typeof location !== "undefined" && u.origin === location.origin) return true;
+  return hostAllowed(u.hostname, cfg.traceHosts);
+}
+function hostAllowed(hostname, hosts) {
+  const h = hostname.toLowerCase();
+  for (const raw of hosts) {
+    let entry = String(raw).trim().toLowerCase();
+    if (!entry) continue;
+    if (entry.includes("://")) {
+      try {
+        entry = new URL(entry).hostname;
+      } catch {
+      }
+    }
+    entry = entry.replace(/^\*?\./, "");
+    if (h === entry || h.endsWith("." + entry)) return true;
+  }
+  return false;
+}
+function injectFetchTrace(input, init, header) {
+  const hasInitHeaders = !!init && "headers" in init && init.headers != null;
+  if (input instanceof Request && !hasInitHeaders) {
+    const h2 = new Headers(input.headers);
+    if (!h2.has("traceparent")) h2.set("traceparent", header);
+    return { input: new Request(input, { headers: h2 }), init };
+  }
+  const h = new Headers(init?.headers ?? void 0);
+  if (!h.has("traceparent")) h.set("traceparent", header);
+  return { input, init: { ...init || {}, headers: h } };
+}
+
 // src/network.ts
 var BODY_CAP = 4 * 1024;
+var NET_RATE = 50;
+var NET_BURST = 100;
 var HEADER_ALLOW = /* @__PURE__ */ new Set([
   "content-type",
   "content-length",
@@ -544,6 +864,7 @@ var HEADER_ALLOW = /* @__PURE__ */ new Set([
   "content-encoding",
   "x-request-id",
   "x-correlation-id",
+  "traceparent",
   "server",
   "vary"
 ]);
@@ -574,15 +895,48 @@ function pickHeaders(redact, entries) {
 }
 function bodyPreview(text, contentType) {
   if (text == null) return void 0;
-  const masked = maskString(text);
-  const truncated = masked.length > BODY_CAP;
+  const cut = text.length > BODY_CAP * 2 ? text.slice(0, BODY_CAP * 2) : text;
+  const masked = maskString(cut);
+  const truncated = cut !== text || masked.length > BODY_CAP;
   return {
     contentType,
     preview: truncated ? masked.slice(0, BODY_CAP) : masked,
     truncated,
-    redacted: masked !== text
+    redacted: masked !== cut
   };
 }
+async function readTextCapped(res, cap) {
+  const body = res.body;
+  if (!body || typeof body.getReader !== "function") {
+    return { text: await res.text(), overflow: false };
+  }
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let text = "";
+  let bytes = 0;
+  let overflow = false;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done || !value) {
+        text += decoder.decode();
+        break;
+      }
+      const remaining = cap + 1 - bytes;
+      if (value.byteLength >= remaining) {
+        text += decoder.decode(value.subarray(0, remaining), { stream: true });
+        overflow = true;
+        break;
+      }
+      text += decoder.decode(value, { stream: true });
+      bytes += value.byteLength;
+    }
+  } finally {
+    void reader.cancel().catch(() => {
+    });
+  }
+  return { text, overflow };
+}
 function perfNow() {
   return typeof performance !== "undefined" ? performance.now() : 0;
 }
@@ -702,6 +1056,19 @@ function createTimingResolver() {
 }
 function instrumentNetwork(ctx) {
   const timing = createTimingResolver();
+  const bucket = tokenBucket(NET_RATE, NET_BURST);
+  let dropped = 0;
+  const emitNet = (ev) => {
+    if (!bucket.take()) {
+      dropped++;
+      return;
+    }
+    if (dropped > 0) {
+      ev.droppedEvents = dropped;
+      dropped = 0;
+    }
+    ctx.emit(ev);
+  };
   const onPageHide = () => timing.flushPending();
   const onVisibility = () => {
     if (typeof document !== "undefined" && document.visibilityState === "hidden") timing.flushPending();
@@ -709,10 +1076,10 @@ function instrumentNetwork(ctx) {
   if (typeof window !== "undefined") window.addEventListener("pagehide", onPageHide);
   if (typeof document !== "undefined") document.addEventListener("visibilitychange", onVisibility);
   const teardowns = [];
-  teardowns.push(wrapFetch(ctx, timing));
-  teardowns.push(wrapXhr(ctx, timing));
-  teardowns.push(wrapBeacon(ctx));
-  teardowns.push(observeResources(ctx));
+  teardowns.push(wrapFetch(ctx, timing, emitNet));
+  teardowns.push(wrapXhr(ctx, timing, emitNet));
+  teardowns.push(wrapBeacon(ctx, emitNet));
+  teardowns.push(observeResources(ctx, emitNet));
   teardowns.push(() => {
     if (typeof window !== "undefined") window.removeEventListener("pagehide", onPageHide);
     if (typeof document !== "undefined") document.removeEventListener("visibilitychange", onVisibility);
@@ -720,7 +1087,7 @@ function instrumentNetwork(ctx) {
   });
   return () => teardowns.forEach((t) => t());
 }
-function wrapFetch(ctx, tr) {
+function wrapFetch(ctx, tr, emitNet) {
   const orig = window.fetch;
   if (!orig) return () => {
   };
@@ -732,6 +1099,17 @@ function wrapFetch(ctx, tr) {
     const perfStart = perfNow();
     const method = (init?.method || (input instanceof Request ? input.method : "GET")).toUpperCase();
     const url = redactUrl(rawUrl);
+    let traceId;
+    if (traceTarget(rawUrl, ctx.config)) {
+      try {
+        const tr2 = newTrace();
+        const inj = injectFetchTrace(input, init, tr2.header);
+        input = inj.input;
+        init = inj.init;
+        traceId = tr2.traceId;
+      } catch {
+      }
+    }
     const reqHeaders = pickHeaders(
       ctx.config.redactHeaders,
       headerEntries(init?.headers ?? (input instanceof Request ? input.headers : void 0))
@@ -754,10 +1132,11 @@ function wrapFetch(ctx, tr) {
           ok: false,
           resourceType: "fetch",
           requestHeaders: reqHeaders,
+          traceId,
           timing,
           ...partial
         };
-        ctx.emit(ev);
+        emitNet(ev);
       });
     };
     try {
@@ -768,8 +1147,9 @@ function wrapFetch(ctx, tr) {
       let responseBody;
       if (ctx.config.captureNetworkBodies && isTexty(res.headers.get("content-type"))) {
         try {
-          const text = await res.clone().text();
+          const { text, overflow } = await readTextCapped(res.clone(), BODY_CAP);
           responseBody = bodyPreview(text, res.headers.get("content-type") || void 0);
+          if (responseBody && overflow) responseBody.truncated = true;
         } catch {
         }
       }
@@ -800,7 +1180,7 @@ function classifyFetchError(err) {
   if (msg.includes("timeout")) return "timeout";
   return "network";
 }
-function wrapXhr(ctx, tr) {
+function wrapXhr(ctx, tr, emitNet) {
   const XHR = XMLHttpRequest.prototype;
   const origOpen = XHR.open;
   const origSend = XHR.send;
@@ -834,6 +1214,14 @@ function wrapXhr(ctx, tr) {
       meta.startT = ctx.clock.now();
       meta.perfStart = perfNow();
       if (ctx.config.captureNetworkBodies) meta.body = stringifyBody(body);
+      if (traceTarget(meta.rawUrl, ctx.config)) {
+        try {
+          const tr2 = newTrace();
+          this.setRequestHeader("traceparent", tr2.header);
+          meta.traceId = tr2.traceId;
+        } catch {
+        }
+      }
       const finish = (error) => {
         const endT = ctx.clock.now();
         const base = {
@@ -868,6 +1256,7 @@ function wrapXhr(ctx, tr) {
             ok: status >= 200 && status < 400,
             resourceType: "xhr",
             requestHeaders: meta.reqHeaders,
+            traceId: meta.traceId,
             responseHeaders: respHeaders,
             responseSize,
             requestBody: ctx.config.captureNetworkBodies ? bodyPreview(meta.body, void 0) : void 0,
@@ -875,7 +1264,7 @@ function wrapXhr(ctx, tr) {
             timing,
             error: error || classifyHttp(status)
           };
-          ctx.emit(ev);
+          emitNet(ev);
         });
       };
       this.addEventListener("loadend", () => finish());
@@ -908,7 +1297,7 @@ function parseRawHeaders(ctx, raw) {
   }
   return pickHeaders(ctx.config.redactHeaders, entries);
 }
-function wrapBeacon(ctx) {
+function wrapBeacon(ctx, emitNet) {
   const orig = navigator.sendBeacon;
   if (!orig) return () => {
   };
@@ -935,7 +1324,7 @@ function wrapBeacon(ctx) {
           timing: { startT, endT: ctx.clock.now(), duration: 0 },
           error: ok ? void 0 : "network"
         };
-        ctx.emit(ev);
+        emitNet(ev);
       }
     }
     return ok;
@@ -955,7 +1344,7 @@ var RESOURCE_TYPE_MAP = {
   video: "media",
   track: "media"
 };
-function observeResources(ctx) {
+function observeResources(ctx, emitNet) {
   if (typeof PerformanceObserver === "undefined") return () => {
   };
   let obs;
@@ -992,7 +1381,7 @@ function observeResources(ctx) {
           responseSize: entry.transferSize || entry.encodedBodySize || void 0,
           timing
         };
-        ctx.emit(ev);
+        emitNet(ev);
       }
     });
     obs.observe({ type: "resource", buffered: true });
@@ -1033,6 +1422,8 @@ function headerEntries(headers) {
 
 // src/websocket.ts
 var FRAME_CAP = 4 * 1024;
+var MSG_RATE = 20;
+var MSG_BURST = 40;
 function redactUrl2(raw) {
   try {
     const u = new URL(raw, location.href);
@@ -1053,12 +1444,13 @@ function frameInfo(data, capture) {
   if (typeof data === "string") {
     const info = { encoding: "text", size: byteLen2(data) };
     if (capture) {
-      const masked = maskString(data);
-      const truncated = masked.length > FRAME_CAP;
+      const cut = data.length > FRAME_CAP * 2 ? data.slice(0, FRAME_CAP * 2) : data;
+      const masked = maskString(cut);
+      const truncated = cut !== data || masked.length > FRAME_CAP;
       info.body = {
         preview: truncated ? masked.slice(0, FRAME_CAP) : masked,
         truncated,
-        redacted: masked !== data
+        redacted: masked !== cut
       };
     }
     return info;
@@ -1095,24 +1487,39 @@ function instrumentWebSocket(ctx) {
         const redUrl = redactUrl2(String(url));
         const protos = protocols ? Array.isArray(protocols) ? protocols : [protocols] : void 0;
         const capture = ctx.config.captureNetworkBodies;
+        const bucket = tokenBucket(MSG_RATE, MSG_BURST);
+        let droppedFrames = 0;
+        const emitFrame = (dir, data) => {
+          ctx.markActivity();
+          if (!bucket.take()) {
+            droppedFrames++;
+            return;
+          }
+          const info = frameInfo(data, capture);
+          const dropped = droppedFrames;
+          droppedFrames = 0;
+          emit({ connId, url: redUrl, kind: "message", dir, ...info, droppedFrames: dropped || void 0 });
+        };
         this.addEventListener("open", () => emit({ connId, url: redUrl, kind: "open", protocols: protos }));
         this.addEventListener(
           "close",
-          (e) => emit({ connId, url: redUrl, kind: "close", code: e.code, reason: e.reason || void 0, wasClean: e.wasClean })
+          (e) => emit({
+            connId,
+            url: redUrl,
+            kind: "close",
+            code: e.code,
+            reason: e.reason || void 0,
+            wasClean: e.wasClean,
+            droppedFrames: droppedFrames || void 0
+          })
         );
         this.addEventListener("error", () => emit({ connId, url: redUrl, kind: "error" }));
-        this.addEventListener("message", (e) => {
-          const info = frameInfo(e.data, capture);
-          emit({ connId, url: redUrl, kind: "message", dir: "recv", ...info });
-          ctx.markActivity();
-        });
+        this.addEventListener("message", (e) => emitFrame("recv", e.data));
         const origSend = super.send.bind(this);
         this.send = (data) => {
           origSend(data);
           try {
-            const info = frameInfo(data, capture);
-            emit({ connId, url: redUrl, kind: "message", dir: "send", ...info });
-            ctx.markActivity();
+            emitFrame("send", data);
           } catch {
           }
         };
@@ -1851,6 +2258,8 @@ var DEFAULTS = {
   noPrivacy: false,
   captureNetworkBodies: false,
   redactHeaders: ["authorization", "cookie", "set-cookie"],
+  tracePropagation: false,
+  traceHosts: [],
   sampleRate: 1,
   recordCanvas: false,
   endpoint: "https://in.lumera.app",
@@ -1998,6 +2407,10 @@ var ObsrviqClient = class {
         this.nextSeq = next;
         this.persistSession();
       },
+      // Backpressure dropped DOM deltas → re-anchor the rrweb stream immediately
+      // so replay stays coherent (a delta stream with a hole is corrupt until
+      // the next 30s checkout).
+      onDomDrop: () => takeFullSnapshot(),
       onFlush: ({ bytes, events, ok }) => {
         if (ok) {
           this.diag.flushes++;