@obsrviq/tracker 0.7.0 → 0.7.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@obsrviq/tracker",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "license": "MIT",
   "publishConfig": {
     "access": "public"

package/src/network.ts

@@ -2,7 +2,7 @@ import type { NetworkEvent, NetworkResourceType, NetworkTiming } from '@obsrviq/
 import type { InstrumentCtx, Teardown } from './context.js';
 import { maskString } from './mask.js';
 import { tokenBucket } from './ratelimit.js';
-import { injectFetchTrace, newTrace, traceTarget } from './trace.js';
+import { applyFetchTrace, newTrace, traceIdOf, traceTarget } from './trace.js';
 import { uuid } from './util.js';
 
 const BODY_CAP = 4 * 1024; // 4 KB body preview cap
@@ -345,11 +345,10 @@ function wrapFetch(ctx: InstrumentCtx, tr: TimingResolver, emitNet: EmitNet): Te
     let traceId: string | undefined;
     if (traceTarget(rawUrl, ctx.config)) {
       try {
-        const tr = newTrace();
-        const inj = injectFetchTrace(input, init, tr.header);
+        const inj = applyFetchTrace(input, init);
         input = inj.input;
         init = inj.init;
-        traceId = tr.traceId;
+        traceId = inj.traceId || undefined;
       } catch {
         /* never let propagation break the request */
       }
@@ -485,12 +484,19 @@ function wrapXhr(ctx: InstrumentCtx, tr: TimingResolver, emitNet: EmitNet): Tear
       if (ctx.config.captureNetworkBodies) meta.body = stringifyBody(body);
       // Trace-context propagation (first-party only). setRequestHeader is valid
       // here — after open(), before the real send() below. Our own setRequestHeader
-      // patch records it into meta.reqHeaders (traceparent is allowlisted).
+      // patch records it into meta.reqHeaders (traceparent is allowlisted), so a
+      // traceparent the APP already set is visible here: respect it (record its id,
+      // don't re-set — XHR COMBINES duplicate headers into an invalid "v1, v2").
       if (traceTarget(meta.rawUrl, ctx.config)) {
         try {
-          const tr = newTrace();
-          this.setRequestHeader('traceparent', tr.header);
-          meta.traceId = tr.traceId;
+          const appSet = meta.reqHeaders['traceparent'];
+          if (appSet) {
+            meta.traceId = traceIdOf(appSet) ?? undefined;
+          } else {
+            const tr = newTrace();
+            this.setRequestHeader('traceparent', tr.header);
+            meta.traceId = tr.traceId;
+          }
         } catch {
           /* header rejected (e.g. send already dispatched) — skip, never throw */
         }

package/src/trace.ts

@@ -77,24 +77,54 @@ function hostAllowed(hostname: string, hosts: string[]): boolean {
   return false;
 }
 
-/** Return the fetch args to call `orig` with, carrying `traceparent`. Never
- *  throws upward is the caller's job — but we keep this total and side-effect-free
- *  so a rebuild failure can fall back to the originals. */
-export function injectFetchTrace(
+/** The 32-hex trace id inside a `traceparent` value, or null if malformed. */
+export function traceIdOf(header: string | null | undefined): string | null {
+  if (!header) return null;
+  const parts = header.split('-');
+  return parts.length >= 2 && /^[0-9a-f]{32}$/.test(parts[1]!) ? parts[1]! : null;
+}
+
+/** The traceparent already on this fetch call, honoring fetch's header semantics:
+ *  init.headers (when present) REPLACE a Request's headers, so they win. */
+function existingFetchTraceparent(input: RequestInfo | URL, init: RequestInit | undefined): string | null {
+  const hasInitHeaders = !!init && 'headers' in init && init.headers != null;
+  const src = hasInitHeaders
+    ? (init!.headers as HeadersInit)
+    : input instanceof Request
+      ? input.headers
+      : undefined;
+  if (!src) return null;
+  try {
+    return new Headers(src).get('traceparent');
+  } catch {
+    return null;
+  }
+}
+
+/** Ensure a fetch call carries a `traceparent`, and report the trace id that will
+ *  actually be ON THE WIRE. If the app already set one, we DON'T overwrite it (and
+ *  return ITS id, so the recorded event matches what the backend sees); otherwise
+ *  we mint + inject ours. Total + side-effect-free so a caller can fall back to the
+ *  originals if it throws. */
+export function applyFetchTrace(
   input: RequestInfo | URL,
   init: RequestInit | undefined,
-  header: string,
-): { input: RequestInfo | URL; init: RequestInit | undefined } {
+): { input: RequestInfo | URL; init: RequestInit | undefined; traceId: string } {
+  const existing = existingFetchTraceparent(input, init);
+  if (existing) {
+    // Respect the app's own trace context — record its id, change nothing.
+    return { input, init, traceId: traceIdOf(existing) ?? '' };
+  }
+  const tr = newTrace();
   const hasInitHeaders = !!init && 'headers' in init && init.headers != null;
   // fetch(Request) with no override headers → rebuild the Request so we don't drop
-  // its own headers. When init.headers IS given, fetch uses THOSE (spec: they
-  // replace the Request's), so we inject there instead.
+  // its own headers. When init.headers IS given, fetch uses THOSE, so inject there.
   if (input instanceof Request && !hasInitHeaders) {
     const h = new Headers(input.headers);
-    if (!h.has('traceparent')) h.set('traceparent', header);
-    return { input: new Request(input, { headers: h }), init };
+    h.set('traceparent', tr.header);
+    return { input: new Request(input, { headers: h }), init, traceId: tr.traceId };
   }
   const h = new Headers((init?.headers as HeadersInit | undefined) ?? undefined);
-  if (!h.has('traceparent')) h.set('traceparent', header);
-  return { input, init: { ...(init || {}), headers: h } };
+  h.set('traceparent', tr.header);
+  return { input, init: { ...(init || {}), headers: h }, traceId: tr.traceId };
 }