@oxvo/browser 7.3.4 → 7.4.15

package/dist/lib/entry.js

@@ -2588,6 +2588,220 @@ function parseCrossDomainIframeBatch(messages) {
     return { messages: messages, bytes };
 }
 
+const REDACTED_DEBUG_VALUE = '[REDACTED]';
+const TRUNCATED_DEBUG_VALUE = '[TRUNCATED]';
+const MAX_DEBUG_TEXT_LENGTH = 2048;
+const MAX_DEBUG_CREDENTIAL_LOOKAHEAD = 512;
+const MAX_DEBUG_REDACTION_DEPTH = 5;
+const MAX_DEBUG_REDACTION_ITEMS = 50;
+const DEBUG_FIELD_VALUE_PATTERN = /(["']?)([ \t]*[a-z0-9_-]{1,64}[ \t]*)\1(\s*[:=]\s*)("[^"\r\n]*"|'[^'\r\n]*'|[^\s,;&{}\[\]()\r\n]+)/gim;
+const DEBUG_AUTHORIZATION_FIELD_PATTERN = /(["']?)((?:proxy[-_]?authorization|authorization)(?:[-_]?header)?)\1(\s*[:=]\s*)("[^"\r\n]*"|'[^'\r\n]*'|\[(?:REDACTED|TRUNCATED)\]|[^,;&}\]\)\r\n]+)/gi;
+const DEBUG_COOKIE_FIELD_PATTERN = /(["']?)((?:set[-_]?cookie|cookies?)(?:[-_]?header)?)\1(\s*[:=]\s*)("[^"\r\n]*"|'[^'\r\n]*'|\[(?:REDACTED|TRUNCATED)\]|[^\r\n]+)/gi;
+const DEBUG_AUTH_SCHEME_VALUE_PATTERN = /(\b(?:ApiKey|Basic|Bearer|Digest|Negotiate)\s+)[a-z0-9._~+/=-]+/gi;
+const DEBUG_TOKEN_AUTH_SCHEME_VALUE_PATTERN = /(\bToken\s+)[a-z0-9._~+/=-]+/g;
+const DEBUG_JWT_VALUE_PATTERN = /\beyJ[a-z0-9_-]{5,}\.[a-z0-9_-]{5,}\.[a-z0-9_-]{5,}\b/gi;
+const DEBUG_URL_CREDENTIAL_PATTERN = /(\bhttps?:\/\/)([^\s/:@]+):([^\s/@]+)@/gi;
+const DEBUG_ENCODED_FIELD_VALUE_PATTERN = /([a-z0-9_-]{0,48}(?:token|secret|grant|credential|api[-_]?key|private[-_]?key|signing[-_]?key|authorization|cookie))(%3a|%3d)(?:%22|%27)?[a-z0-9._~+/%=-]+/gi;
+const DEBUG_PROVIDER_CREDENTIAL_PATTERNS = [
+    /sk-(?:(?:proj|svcacct|ant)-)?[a-z0-9_-]{8,}/gi,
+    /AIza[a-z0-9_-]{20,}/gi,
+    /(?:AKIA|ASIA)[A-Z0-9]{16}/g,
+    /gh[pousr]_[a-z0-9]{20,}/gi,
+    /xox[a-z]-[a-z0-9-]{10,}/gi,
+];
+const DEBUG_PRIVATE_KEY_PATTERN = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)/g;
+const PROVIDER_KEY_PREFIXES = [
+    'anthropic',
+    'azureopenai',
+    'cohere',
+    'deepseek',
+    'elevenlabs',
+    'gemini',
+    'google',
+    'groq',
+    'mistral',
+    'openai',
+    'openrouter',
+    'perplexity',
+];
+const isSensitiveDebugField = (key) => {
+    const normalized = key.replace(/[^a-z0-9]/gi, '').toLowerCase();
+    return (normalized === 'auth' ||
+        normalized.includes('authorization') ||
+        normalized.includes('bearer') ||
+        normalized.includes('cookie') ||
+        normalized === 'sessionhash' ||
+        normalized === 'oxvolinkageassertion' ||
+        normalized === 'xoxvosessionstrace' ||
+        normalized.includes('password') ||
+        normalized === 'privatekey' ||
+        normalized === 'privatekeyid' ||
+        normalized === 'signingkey' ||
+        normalized === 'jwt' ||
+        normalized.endsWith('jwt') ||
+        normalized.endsWith('token') ||
+        normalized.endsWith('grant') ||
+        normalized.includes('secret') ||
+        normalized.endsWith('apikey') ||
+        normalized.endsWith('accesskey') ||
+        normalized.endsWith('accesskeyid') ||
+        normalized.endsWith('subscriptionkey') ||
+        normalized.endsWith('credential') ||
+        normalized.endsWith('credentials') ||
+        (normalized.includes('provider') && normalized.endsWith('key')) ||
+        (normalized.endsWith('key') &&
+            PROVIDER_KEY_PREFIXES.some((provider) => normalized.startsWith(provider))));
+};
+const redactedFieldValue = (rawValue) => {
+    const valueQuote = rawValue[0];
+    return valueQuote === '"' || valueQuote === "'"
+        ? `${valueQuote}${REDACTED_DEBUG_VALUE}${valueQuote}`
+        : REDACTED_DEBUG_VALUE;
+};
+const redactDebugTextToLength = (value, maxOutputLength) => {
+    const truncated = value.length > maxOutputLength;
+    let redacted = value
+        .slice(0, maxOutputLength + MAX_DEBUG_CREDENTIAL_LOOKAHEAD)
+        .replace(DEBUG_AUTHORIZATION_FIELD_PATTERN, (_match, keyQuote, key, separator, rawValue) => `${keyQuote}${key}${keyQuote}${separator}${redactedFieldValue(rawValue)}`)
+        .replace(DEBUG_COOKIE_FIELD_PATTERN, (_match, keyQuote, key, separator, rawValue) => `${keyQuote}${key}${keyQuote}${separator}${redactedFieldValue(rawValue)}`)
+        .replace(DEBUG_AUTH_SCHEME_VALUE_PATTERN, `$1${REDACTED_DEBUG_VALUE}`)
+        .replace(DEBUG_TOKEN_AUTH_SCHEME_VALUE_PATTERN, `$1${REDACTED_DEBUG_VALUE}`)
+        .replace(DEBUG_FIELD_VALUE_PATTERN, (match, keyQuote, key, separator, rawValue) => {
+        if (!isSensitiveDebugField(key)) {
+            return match;
+        }
+        return `${keyQuote}${key}${keyQuote}${separator}${redactedFieldValue(rawValue)}`;
+    })
+        .replace(DEBUG_ENCODED_FIELD_VALUE_PATTERN, (_match, key, separator) => `${key}${separator}${REDACTED_DEBUG_VALUE}`)
+        .replace(DEBUG_URL_CREDENTIAL_PATTERN, `$1${REDACTED_DEBUG_VALUE}:${REDACTED_DEBUG_VALUE}@`)
+        .replace(DEBUG_JWT_VALUE_PATTERN, REDACTED_DEBUG_VALUE)
+        .replace(DEBUG_PRIVATE_KEY_PATTERN, REDACTED_DEBUG_VALUE);
+    for (const credentialPattern of DEBUG_PROVIDER_CREDENTIAL_PATTERNS) {
+        redacted = redacted.replace(credentialPattern, REDACTED_DEBUG_VALUE);
+    }
+    const bounded = redacted.slice(0, maxOutputLength);
+    return truncated ? `${bounded} ${TRUNCATED_DEBUG_VALUE}` : bounded;
+};
+const redactDebugText = (value) => redactDebugTextToLength(value, MAX_DEBUG_TEXT_LENGTH);
+const createDebugRedactionState = () => ({
+    seen: new WeakSet(),
+    remainingItems: MAX_DEBUG_REDACTION_ITEMS,
+    remainingText: MAX_DEBUG_TEXT_LENGTH,
+});
+const redactDebugTextWithBudget = (value, state) => {
+    if (state.remainingText <= 0) {
+        return TRUNCATED_DEBUG_VALUE;
+    }
+    const permittedLength = Math.min(value.length, state.remainingText);
+    state.remainingText -= permittedLength;
+    return redactDebugTextToLength(value, permittedLength);
+};
+const redactDebugValue = (value, state = createDebugRedactionState(), depth = 0) => {
+    if (typeof value === 'string') {
+        return redactDebugTextWithBudget(value, state);
+    }
+    if (value instanceof Error) {
+        const redacted = new Error(redactDebugTextWithBudget(value.message, state));
+        redacted.name = redactDebugTextWithBudget(value.name, state);
+        if (value.stack) {
+            redacted.stack = redactDebugTextWithBudget(value.stack, state);
+        }
+        return redacted;
+    }
+    if (value === null || typeof value === 'number' || typeof value === 'boolean') {
+        return value;
+    }
+    if (typeof value === 'undefined') {
+        return undefined;
+    }
+    if (typeof value === 'bigint' || typeof value === 'symbol') {
+        return String(value);
+    }
+    if (typeof value === 'function') {
+        return '[Function]';
+    }
+    const objectValue = value;
+    if (depth >= MAX_DEBUG_REDACTION_DEPTH || state.remainingItems <= 0) {
+        return TRUNCATED_DEBUG_VALUE;
+    }
+    if (state.seen.has(objectValue)) {
+        return '[Circular]';
+    }
+    state.seen.add(objectValue);
+    if (Array.isArray(value)) {
+        const count = Math.min(value.length, state.remainingItems);
+        state.remainingItems -= count;
+        const redacted = value.slice(0, count).map((entry) => redactDebugValue(entry, state, depth + 1));
+        if (count < value.length) {
+            redacted.push(TRUNCATED_DEBUG_VALUE);
+        }
+        return redacted;
+    }
+    const redacted = {};
+    let allKeys;
+    try {
+        allKeys = Object.keys(objectValue);
+    }
+    catch {
+        return '[Unavailable]';
+    }
+    const keys = allKeys.slice(0, state.remainingItems);
+    state.remainingItems -= keys.length;
+    for (const key of keys) {
+        if (isSensitiveDebugField(key)) {
+            redacted[key] = REDACTED_DEBUG_VALUE;
+            continue;
+        }
+        try {
+            redacted[key] = redactDebugValue(value[key], state, depth + 1);
+        }
+        catch {
+            redacted[key] = '[Unavailable]';
+        }
+    }
+    if (keys.length < allKeys.length) {
+        redacted.__truncated__ = TRUNCATED_DEBUG_VALUE;
+    }
+    return redacted;
+};
+const redactDebugArgs = (values) => {
+    const state = createDebugRedactionState();
+    return values.map((value) => redactDebugValue(value, state));
+};
+const debugValueText = (value) => {
+    if (value instanceof Error) {
+        return `${value.name}: ${value.message}`;
+    }
+    if (typeof value === 'string') {
+        return value;
+    }
+    let serialized;
+    try {
+        serialized = JSON.stringify(value);
+    }
+    catch {
+        return '[Unavailable]';
+    }
+    if (serialized === undefined) {
+        return String(value);
+    }
+    return serialized.length > MAX_DEBUG_TEXT_LENGTH
+        ? `${serialized.slice(0, MAX_DEBUG_TEXT_LENGTH)} ${TRUNCATED_DEBUG_VALUE}`
+        : serialized;
+};
+const redactedErrorFrom = (value, fallback, knownSecrets = []) => {
+    const uniqueKnownSecrets = [
+        ...new Set(knownSecrets.filter((secret) => !!secret)),
+    ].sort((left, right) => right.length - left.length);
+    const redacted = value instanceof Error || typeof value === 'string' ? value : redactDebugValue(value);
+    let message = redacted instanceof Error ? redacted.message.trim() : debugValueText(redacted).trim();
+    for (const secret of uniqueKnownSecrets) {
+        message = message.split(secret).join(REDACTED_DEBUG_VALUE);
+    }
+    message = redactDebugText(message);
+    return new Error(message.length > 0 ? message : fallback);
+};
+
 const LogLevel = {
     Verbose: 5,
     Log: 4,
@@ -2602,26 +2816,22 @@ class Logger {
         };
         this.info = (...args) => {
             if (this.shouldLog(LogLevel.Verbose)) {
-                // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
-                console.info(...args);
+                console.info(...redactDebugArgs(args));
             }
         };
         this.log = (...args) => {
             if (this.shouldLog(LogLevel.Log)) {
-                // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
-                console.log(...args);
+                console.log(...redactDebugArgs(args));
             }
         };
         this.warn = (...args) => {
             if (this.shouldLog(LogLevel.Warnings)) {
-                // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
-                console.warn(...args);
+                console.warn(...redactDebugArgs(args));
             }
         };
         this.error = (...args) => {
             if (this.shouldLog(LogLevel.Errors)) {
-                // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
-                console.error(...args);
+                console.error(...redactDebugArgs(args));
             }
         };
         this.level = debugLevel;
@@ -4555,6 +4765,61 @@ const bufferStorageKey = 'or_buffer_1';
 const PROTO_VERSION = '2';
 const BOOTSTRAP_ATTEMPT_TTL_MS = 24 * 60 * 60 * 1000;
 const MAX_BOOTSTRAP_ATTEMPT_STORAGE_LENGTH = 1024 * 1024;
+const MAX_SESSION_TOKEN_LENGTH = 4096;
+const MAX_ASSIST_SESSION_GRANT_LENGTH = 4096;
+const LINKAGE_ASSERTION_METADATA_KEY = 'oxvo_linkage_assertion';
+const MESSENGER_LINKAGE_CHALLENGE_PATTERN = /^[a-f0-9]{64}$/;
+const MIN_MESSENGER_LINKAGE_CHALLENGE_TTL_SECONDS = 5;
+const MAX_MESSENGER_LINKAGE_CHALLENGE_TTL_SECONDS = 120;
+const asRecord = (value) => value !== null && typeof value === 'object' && !Array.isArray(value)
+    ? value
+    : {};
+const isValidBootstrapCredential = (value, maxLength) => typeof value === 'string' &&
+    value.length > 0 &&
+    value.length <= maxLength &&
+    value.trim() === value;
+const parseMessengerLinkageChallenge = (value, expectedSessionId) => {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        return null;
+    }
+    const record = value;
+    const keys = Object.keys(record).sort();
+    if (keys.length !== 3 ||
+        keys[0] !== 'challenge' ||
+        keys[1] !== 'expiresIn' ||
+        keys[2] !== 'sessionId' ||
+        typeof record.challenge !== 'string' ||
+        !MESSENGER_LINKAGE_CHALLENGE_PATTERN.test(record.challenge) ||
+        record.sessionId !== expectedSessionId ||
+        !Number.isInteger(record.expiresIn) ||
+        record.expiresIn < MIN_MESSENGER_LINKAGE_CHALLENGE_TTL_SECONDS ||
+        record.expiresIn > MAX_MESSENGER_LINKAGE_CHALLENGE_TTL_SECONDS) {
+        return null;
+    }
+    return {
+        challenge: record.challenge,
+        sessionId: expectedSessionId,
+        expiresIn: record.expiresIn,
+    };
+};
+const bootstrapHttpError = async (response, responseText, knownSecrets = []) => {
+    let body;
+    try {
+        body = responseText ?? (await response.text());
+    }
+    catch (error) {
+        return redactedErrorFrom(error, `Server error: ${response.status}.`, knownSecrets);
+    }
+    return redactedErrorFrom(`Server error: ${response.status}. ${body}`, `Server error: ${response.status}.`, knownSecrets);
+};
+const bootstrapJson = async (response, knownSecrets = []) => {
+    try {
+        return asRecord(await response.json());
+    }
+    catch (error) {
+        throw redactedErrorFrom(error, 'Incorrect server response (invalid JSON)', knownSecrets);
+    }
+};
 const UnsuccessfulStart = (reason) => ({ reason, success: false });
 const SuccessfulStart = (body) => ({ ...body, success: true });
 var ActivityState;
@@ -4624,13 +4889,14 @@ class App {
         this.stopCallbacks = [];
         this.commitCallbacks = [];
         this.activityState = ActivityState.NotActive;
-        this.version = '7.3.4'; // TODO: version compatability check inside each plugin.
+        this.version = '7.4.15'; // TODO: version compatability check inside each plugin.
         this.socketMode = false;
         this.compressionThreshold = 24 * 1000;
         this.bc = null;
         this.canvasRecorder = null;
         this.conditionsManager = null;
         this.bootstrapAttempts = {};
+        this.assistSessionGrant = null;
         this.canStart = false;
         this.rootId = null;
         this.pageFrames = [];
@@ -4730,7 +4996,7 @@ class App {
                     this.startCrossDomainFrame(this.prevOpts);
                 }
                 catch (e) {
-                    console.error('children frame restart failed:', e);
+                    console.error('children frame restart failed:', redactDebugValue(e));
                 }
                 return;
             }
@@ -4889,10 +5155,10 @@ class App {
                 this.allowAppStart();
                 this.start(this.prevOpts, true)
                     .then((r) => {
-                    this.debug.info('Session restart', r);
+                    this.debug.info('Session restart', redactDebugValue(r));
                 })
                     .catch((e) => {
-                    this.debug.error('Session restart failed', e);
+                    this.debug.error('Session restart failed', redactDebugValue(e));
                 });
             });
         };
@@ -5074,7 +5340,7 @@ class App {
         });
         this.markerWatcher = new MarkerWatcher({
             sessionStorage: this.sessionStorage,
-            errLog: this.debug.error,
+            errLog: (...args) => this.debug.error(...args.map((arg) => redactDebugValue(arg))),
             onMarkerHit: (markerId) => this.send(TagTrigger(markerId)),
         });
         this.session.attachUpdateCallback(({ userID, metadata }) => {
@@ -5140,10 +5406,10 @@ class App {
             }, 250);
             this.bc.onmessage = (ev) => {
                 if (ev.data.context === this.contextId || this.projectKey !== ev.data.projectKey) {
-                    this.debug.log('same ctx event', ev);
+                    this.debug.log('same ctx event', redactDebugValue(ev.data));
                     return;
                 }
-                this.debug.log(ev);
+                this.debug.log('broadcast event', redactDebugValue(ev.data));
                 if (ev.data.line === proto.resp) {
                     const sessionToken = ev.data.token;
                     this.session.setSessionSecret(sessionToken, this.projectKey);
@@ -5572,10 +5838,10 @@ class App {
                 this.allowAppStart();
                 this.start(this.prevOpts, true)
                     .then((r) => {
-                    this.debug.info('Worker restart, session too long', r);
+                    this.debug.info('Worker restart, session too long', redactDebugValue(r));
                 })
                     .catch((e) => {
-                    this.debug.error('Worker restart failed', e);
+                    this.debug.error('Worker restart failed', redactDebugValue(e));
                 });
             });
         }
@@ -5584,7 +5850,7 @@ class App {
         }
         else if (data.type === 'failure') {
             this.stop(false);
-            this.debug.error('worker_failed', data.reason);
+            this.debug.error('worker_failed', redactDebugValue(data.reason));
             this._debug('worker_failed', data.reason);
         }
         else if (data.type === 'compress') {
@@ -5605,7 +5871,7 @@ class App {
                     });
                 })
                     .catch((err) => {
-                    this.debug.error('OxvoSessions compression error:', err);
+                    this.debug.error('OxvoSessions compression error:', redactDebugValue(err));
                     this.worker?.postMessage({ type: 'uncompressed', batch: batch, dataType });
                 });
             }
@@ -5627,18 +5893,18 @@ class App {
         }
     }
     _debug(context, e) {
+        const redactedError = redactDebugValue(e);
         if (this.options.__debug_report_edp !== null) {
             void fetch(this.options.__debug_report_edp, {
                 method: 'POST',
                 headers: { 'Content-Type': 'application/json' },
                 body: JSON.stringify({
                     context,
-                    // @ts-ignore
-                    error: `${e}`,
+                    error: debugValueText(redactedError),
                 }),
             });
         }
-        this.debug.error('OxvoSessions error: ', context, e);
+        this.debug.error('OxvoSessions error: ', context, redactedError);
     }
     /**
      * Normal workflow: add timestamp and tab data to batch, then commit it
@@ -5962,11 +6228,76 @@ class App {
             (current.userUUID === '' || existing.userUUID === current.userUUID));
     }
     getSessionMeta() {
+        const sessionInfo = this.session.getInfo();
+        const metadata = { ...sessionInfo.metadata };
+        Object.keys(metadata).forEach((key) => {
+            if (key.trim().toLowerCase() === LINKAGE_ASSERTION_METADATA_KEY) {
+                delete metadata[key];
+            }
+        });
         return {
-            ...this.session.getInfo(),
+            ...sessionInfo,
+            metadata,
             ...this.getTrackerInfo(),
         };
     }
+    async requestMessengerLinkageChallenge() {
+        const sessionId = this.session.getInfo().sessionID;
+        const grantLineage = this.assistSessionGrant;
+        const grant = this.getAssistSessionGrant();
+        if (!sessionId || !grantLineage || !grant || grant.sessionId !== sessionId) {
+            return null;
+        }
+        const tabId = this.session.getTabId();
+        try {
+            const response = await fetch(`${normalizeEndpoint(this.options.endpoint)}/v1/linkage-challenge`, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${grant.token}`,
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({ tabId }),
+                cache: 'no-store',
+                credentials: 'omit',
+                referrerPolicy: 'no-referrer',
+            });
+            if (response.status !== 200) {
+                return null;
+            }
+            const challenge = parseMessengerLinkageChallenge(await response.json(), sessionId);
+            if (!challenge) {
+                return null;
+            }
+            const currentGrant = this.getAssistSessionGrant();
+            if (!currentGrant ||
+                this.assistSessionGrant !== grantLineage ||
+                currentGrant.sessionId !== grant.sessionId ||
+                currentGrant.token !== grant.token ||
+                this.session.getInfo().sessionID !== sessionId ||
+                this.session.getTabId() !== tabId) {
+                return null;
+            }
+            return challenge;
+        }
+        catch {
+            return null;
+        }
+    }
+    getAssistSessionGrant() {
+        return this.assistSessionGrant ? { ...this.assistSessionGrant } : null;
+    }
+    setAssistSessionGrant(sessionId, token) {
+        this.assistSessionGrant =
+            typeof token === 'string' &&
+                token.length > 0 &&
+                token.length <= MAX_ASSIST_SESSION_GRANT_LENGTH &&
+                token.trim() === token
+                ? { sessionId, token }
+                : null;
+    }
+    clearAssistSessionGrant() {
+        this.assistSessionGrant = null;
+    }
     getSessionSecret() {
         return this.session.getSessionSecret(this.projectKey);
     }
@@ -6099,23 +6430,48 @@ class App {
     async setupConditionalStart(startOpts) {
         this.conditionsManager = new ConditionsManager(this, startOpts);
         const ingestPoint = normalizeEndpoint(this.options.endpoint);
-        const r = await fetch(ingestPoint + '/v1/bootstrap', {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-            },
-            body: JSON.stringify(this.buildStartPayload({
-                timestamp: now(),
-                dry: true,
-                bufferMs: 0,
-                token: '',
-                width: window.screen.width,
-                height: window.screen.height,
-                referrer: document.referrer,
-            })),
-        });
-        const { session = {}, client = {}, device = {} } = await r.json();
+        let r;
+        try {
+            r = await fetch(ingestPoint + '/v1/bootstrap', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify(this.buildStartPayload({
+                    timestamp: now(),
+                    dry: true,
+                    bufferMs: 0,
+                    token: '',
+                    width: window.screen.width,
+                    height: window.screen.height,
+                    referrer: document.referrer,
+                })),
+            });
+        }
+        catch (error) {
+            throw redactedErrorFrom(error, 'Conditional bootstrap request failed.');
+        }
+        if (r.status !== 200) {
+            throw await bootstrapHttpError(r);
+        }
+        const response = await bootstrapJson(r);
+        const session = asRecord(response.session);
+        const client = asRecord(response.client);
+        const device = asRecord(response.device);
         const { token, projectId, assistToken } = session;
+        const invalidResponseFields = [
+            !isValidBootstrapCredential(token, MAX_SESSION_TOKEN_LENGTH) ? 'session.token' : null,
+            typeof assistToken !== 'undefined' &&
+                !isValidBootstrapCredential(assistToken, MAX_ASSIST_SESSION_GRANT_LENGTH)
+                ? 'session.assistToken'
+                : null,
+            typeof session.id !== 'string' ? 'session.id' : null,
+            typeof projectId !== 'string' ? 'session.projectId' : null,
+            typeof device.id !== 'string' ? 'device.id' : null,
+        ].filter((field) => field !== null);
+        if (invalidResponseFields.length > 0) {
+            throw new Error(`Incorrect server response (status ${r.status}; invalid fields: ${invalidResponseFields.join(', ')})`);
+        }
         const { browser: userBrowser, city: userCity, country: userCountry, device: userDevice, os: userOS, state: userState, } = client;
         this.session.assign({ projectID: projectId });
         this.session.setUserInfo({
@@ -6128,13 +6484,18 @@ class App {
         });
         const onStartInfo = {
             sessionToken: token,
-            assistToken: typeof assistToken === 'string' ? assistToken : undefined,
-            userUUID: device?.id || '',
-            sessionID: session?.id || '',
+            assistToken,
+            userUUID: device.id,
+            sessionID: session.id,
         };
-        this.startCallbacks.forEach((cb) => cb(onStartInfo));
-        await this.conditionsManager?.fetchConditions(projectId, token);
-        await this.markerWatcher.fetchTags(normalizeEndpoint(this.options.endpoint), token);
+        try {
+            this.startCallbacks.forEach((cb) => cb(onStartInfo));
+            await this.conditionsManager?.fetchConditions(projectId, token);
+            await this.markerWatcher.fetchTags(normalizeEndpoint(this.options.endpoint), token);
+        }
+        catch (error) {
+            throw redactedErrorFrom(error, 'Conditional bootstrap failed.', [token, assistToken]);
+        }
     }
     /**
      * Starts offline session recording
@@ -6142,6 +6503,7 @@ class App {
      * @param {Function} onSessionSent - callback that will be called once session is fully sent
      * */
     offlineRecording(startOpts = {}, onSessionSent) {
+        this.clearAssistSessionGrant();
         this.onSessionSent = onSessionSent;
         this.singleBuffer = true;
         adjustTimeOrigin();
@@ -6248,22 +6610,37 @@ class App {
             'Content-Type': 'application/json',
             'Idempotency-Key': bootstrapAttempt.idempotencyKey,
         };
-        const r = await fetch(ingestPoint + '/v1/bootstrap', {
-            method: 'POST',
-            headers,
-            body: bootstrapAttempt.requestBody,
-        });
+        let r;
+        try {
+            r = await fetch(ingestPoint + '/v1/bootstrap', {
+                method: 'POST',
+                headers,
+                body: bootstrapAttempt.requestBody,
+            });
+        }
+        catch (error) {
+            throw redactedErrorFrom(error, 'Offline bootstrap request failed.', [bootstrapToken]);
+        }
         if (r.status !== 200) {
-            throw new Error(`Server error: ${r.status}. ${await r.text()}`);
+            throw await bootstrapHttpError(r, undefined, [bootstrapToken]);
         }
-        const { session = {}, client = {}, limits = {}, protocolVersion: offlineProtocolVersion, } = await r.json();
+        const response = await bootstrapJson(r, [bootstrapToken]);
+        const session = asRecord(response.session);
+        const client = asRecord(response.client);
+        const limits = asRecord(response.limits);
+        const offlineProtocolVersion = response.protocolVersion;
         const { token, projectId } = session;
         const { browser: userBrowser, city: userCity, country: userCountry, device: userDevice, os: userOS, state: userState, } = client;
         const { beacon: beaconSizeLimit } = limits;
-        if (typeof token !== 'string' ||
-            token.length === 0 ||
-            (typeof beaconSizeLimit !== 'number' && typeof beaconSizeLimit !== 'undefined')) {
-            throw new Error('Incorrect server response for offline recording bootstrap');
+        const invalidResponseFields = [
+            !isValidBootstrapCredential(token, MAX_SESSION_TOKEN_LENGTH) ? 'session.token' : null,
+            typeof projectId !== 'string' ? 'session.projectId' : null,
+            typeof beaconSizeLimit !== 'number' && typeof beaconSizeLimit !== 'undefined'
+                ? 'limits.beacon'
+                : null,
+        ].filter((field) => field !== null);
+        if (invalidResponseFields.length > 0) {
+            throw new Error(`Incorrect server response (status ${r.status}; invalid fields: ${invalidResponseFields.join(', ')})`);
         }
         this.session.setSessionSecret(token, this.projectKey);
         this.clearBootstrapAttempt('offline');
@@ -6283,8 +6660,13 @@ class App {
             beaconSizeLimit,
             protocolVersion: offlineProtocolVersion,
         });
-        while (this.bufferedMessages1.length > 0) {
-            await this.flushBuffer(this.bufferedMessages1);
+        try {
+            while (this.bufferedMessages1.length > 0) {
+                await this.flushBuffer(this.bufferedMessages1);
+            }
+        }
+        catch (error) {
+            throw redactedErrorFrom(error, 'Offline recording upload failed.', [token, bootstrapToken]);
         }
         this.postToWorker([[-1]]);
         this.clearBuffers();
@@ -6300,6 +6682,7 @@ class App {
             this.rootId === null) {
             return UnsuccessfulStart('Cross-domain iframe handshake was not established.');
         }
+        this.clearAssistSessionGrant();
         if (Object.keys(startOpts).length !== 0) {
             this.prevOpts = startOpts;
         }
@@ -6369,6 +6752,7 @@ class App {
             const reason = 'OxvoSessions: trying to call `start()` on the instance that has been started already.';
             return Promise.resolve(UnsuccessfulStart(reason));
         }
+        this.clearAssistSessionGrant();
         this.activityState = ActivityState.Starting;
         if (!isColdStart) {
             adjustTimeOrigin();
@@ -6422,7 +6806,8 @@ class App {
             tabId: this.session.getTabId(),
             localDebug: this.options.__local_debug,
         });
-        this.debug.log('OxvoSessions: starting session; need new session id?', isNewSession, 'session token: ', sessionToken);
+        this.debug.log('OxvoSessions: starting session; need new session id?', isNewSession, 'has existing session token:', Boolean(sessionToken));
+        const bootstrapSecrets = [sessionToken, bootstrapToken];
         try {
             const ingestPoint = normalizeEndpoint(this.options.endpoint);
             const headers = {
@@ -6436,30 +6821,52 @@ class App {
             });
             if (r.status !== 200) {
                 const error = await r.text();
-                const reason = error === CANCELED ? CANCELED : `Server error: ${r.status}. ${error}`;
-                throw reason;
+                if (error === CANCELED) {
+                    this.stop();
+                    this.signalError(CANCELED, []);
+                    return UnsuccessfulStart(CANCELED);
+                }
+                throw await bootstrapHttpError(r, error, bootstrapSecrets);
             }
             if (!this.worker && !this.insideIframe) {
                 const reason = 'no worker found after start request (this should not happen in real world)';
                 throw new Error(reason);
             }
-            const { session = {}, device = {}, client = {}, limits = {}, canvas = {}, flags = {}, protocolVersion, } = await r.json();
+            const response = await bootstrapJson(r, bootstrapSecrets);
+            const session = asRecord(response.session);
+            const device = asRecord(response.device);
+            const client = asRecord(response.client);
+            const limits = asRecord(response.limits);
+            const canvas = asRecord(response.canvas);
+            const flags = asRecord(response.flags);
+            const protocolVersion = response.protocolVersion;
             const { token, assistToken, id: sessionID, projectId: projectID, delayMs: delay, startedAt: startTimestamp, } = session;
             const { id: userUUID } = device;
             const { browser: userBrowser, city: userCity, country: userCountry, device: userDevice, os: userOS, state: userState, } = client;
             const { beacon: beaconSizeLimit, compressAt: compressionThreshold } = limits;
             const { enabled: canvasEnabled, quality: canvasQuality, fps: canvasFPS, framesSupport, } = canvas;
             const socketOnly = flags?.socketOnly;
-            if (typeof token !== 'string' ||
-                (typeof assistToken !== 'string' && typeof assistToken !== 'undefined') ||
-                typeof userUUID !== 'string' ||
-                (typeof startTimestamp !== 'number' && typeof startTimestamp !== 'undefined') ||
-                typeof sessionID !== 'string' ||
-                typeof delay !== 'number' ||
-                (typeof beaconSizeLimit !== 'number' && typeof beaconSizeLimit !== 'undefined')) {
-                const reason = `Incorrect server response: ${JSON.stringify(r)}`;
-                throw new Error(reason);
-            }
+            const invalidResponseFields = [
+                !isValidBootstrapCredential(token, MAX_SESSION_TOKEN_LENGTH) ? 'session.token' : null,
+                typeof assistToken !== 'undefined' &&
+                    !isValidBootstrapCredential(assistToken, MAX_ASSIST_SESSION_GRANT_LENGTH)
+                    ? 'session.assistToken'
+                    : null,
+                typeof userUUID !== 'string' ? 'device.id' : null,
+                typeof startTimestamp !== 'number' && typeof startTimestamp !== 'undefined'
+                    ? 'session.startedAt'
+                    : null,
+                typeof sessionID !== 'string' ? 'session.id' : null,
+                typeof projectID !== 'string' ? 'session.projectId' : null,
+                typeof delay !== 'number' ? 'session.delayMs' : null,
+                typeof beaconSizeLimit !== 'number' && typeof beaconSizeLimit !== 'undefined'
+                    ? 'limits.beacon'
+                    : null,
+            ].filter((field) => field !== null);
+            if (invalidResponseFields.length > 0) {
+                throw new Error(`Incorrect server response (status ${r.status}; invalid fields: ${invalidResponseFields.join(', ')})`);
+            }
+            bootstrapSecrets.push(token, assistToken);
             this.crossDomainCanvasConfig = {
                 enabled: canvasEnabled === true,
                 ...(['low', 'medium', 'high'].includes(canvasQuality) ? { quality: canvasQuality } : {}),
@@ -6488,6 +6895,7 @@ class App {
                 timestamp: startTimestamp || timestamp,
                 projectID,
             });
+            this.setAssistSessionGrant(sessionID, assistToken);
             if (socketOnly) {
                 this.socketMode = true;
                 this.worker?.postMessage('stop');
@@ -6566,8 +6974,9 @@ class App {
                 this.signalError(CANCELED, []);
                 return UnsuccessfulStart(CANCELED);
             }
-            this._debug('session_start', reason);
-            const errorMessage = reason instanceof Error ? reason.message : reason.toString();
+            const redactedError = redactedErrorFrom(reason, 'Session start failed.', bootstrapSecrets);
+            this._debug('session_start', redactedError);
+            const errorMessage = redactedError.message;
             this.signalError(errorMessage, []);
             return UnsuccessfulStart(errorMessage);
         }
@@ -6690,6 +7099,7 @@ class App {
         };
     }
     stop(stopWorker = true) {
+        this.clearAssistSessionGrant();
         if (this.activityState !== ActivityState.NotActive) {
             try {
                 if (this.options.crossdomain?.enabled) {
@@ -8370,10 +8780,14 @@ function Fonts (app) {
 }
 
 function axiosSpy (app, instance, opts, sanitize, stringify) {
-    app.debug.log('OxvoSessions: attaching axios spy to instance', instance);
+    app.debug.log('OxvoSessions: attaching axios spy to configured instance');
     function captureResponseData(axiosResponseObj) {
-        app.debug.log('OxvoSessions: capturing axios response data', axiosResponseObj);
-        const { headers: reqHs, data: reqData, method, url, baseURL } = axiosResponseObj.config;
+        app.debug.log('OxvoSessions: capturing axios response data', {
+            method: axiosResponseObj.config.method,
+            status: axiosResponseObj.status,
+            url: axiosResponseObj.config.url,
+        });
+        const { headers: reqHs, data: reqData, method, url } = axiosResponseObj.config;
         const { data: rData, headers: rHs, status: globStatus, response } = axiosResponseObj;
         const { data: resData, headers: resHs, status: resStatus } = response || {};
         const ihOpt = opts.ignoreHeaders;
@@ -8432,11 +8846,18 @@ function axiosSpy (app, instance, opts, sanitize, stringify) {
         }
         const requestStart = axiosResponseObj.config.__oxvosessions_timing;
         const duration = performance.now() - requestStart;
-        app.debug.log('OxvoSessions: final req object', reqResInfo);
+        app.debug.log('OxvoSessions: sanitized axios request is ready', {
+            method: reqResInfo.method,
+            status: reqResInfo.status,
+            url: reqResInfo.url,
+        });
         app.send(NetworkRequest('xhr', String(method), String(reqResInfo.url), stringify(reqResInfo.request), stringify(reqResInfo.response), reqResInfo.status, requestStart + getTimeOrigin(), duration, 0));
     }
     function getStartTime(config) {
-        app.debug.log('OxvoSessions: capturing API request', config);
+        app.debug.log('OxvoSessions: capturing axios request', {
+            method: config.method,
+            url: config.url,
+        });
         config.__oxvosessions_timing = performance.now();
         if (opts.sessionTokenHeader) {
             const header = typeof opts.sessionTokenHeader === 'string'
@@ -8456,17 +8877,23 @@ function axiosSpy (app, instance, opts, sanitize, stringify) {
         return response;
     }
     function captureNetworkError(error) {
-        app.debug.log('OxvoSessions: capturing API request error', error);
+        app.debug.log('OxvoSessions: capturing axios request error', {
+            hasResponse: Boolean(error.response),
+            isAxiosError: isAxiosError(error),
+            message: typeof error.message === 'string' ? error.message : undefined,
+        });
         if (isAxiosError(error) && Boolean(error.response)) {
             captureResponseData(error.response);
         }
         else if (error instanceof Error) {
             app.send(getExceptionMessage(error, []));
         }
+        // Axios rejection handlers must preserve the original Axios error object for downstream code.
+        // eslint-disable-next-line @typescript-eslint/prefer-promise-reject-errors
         return Promise.reject(error);
     }
-    function logRequestError(ev) {
-        app.debug.log('OxvoSessions: failed API request, skipping', ev);
+    function logRequestError() {
+        app.debug.log('OxvoSessions: failed axios request, skipping');
     }
     const reqInt = instance.interceptors.request.use(getStartTime, logRequestError, {
         synchronous: true,
@@ -10279,7 +10706,7 @@ class ConstantProperties {
             user_id: this.user_id,
             distinct_id: this.deviceId,
             sdk_edition: 'web',
-            sdk_version: '7.3.4',
+            sdk_version: '7.4.15',
             timezone: getUTCOffsetString(),
             search_engine: this.searchEngine,
         };
@@ -11144,7 +11571,7 @@ class API {
         this.signalStartIssue = (reason, missingApi) => {
             const doNotTrack = this.checkDoNotTrack();
             console.log("Tracker couldn't start due to:", JSON.stringify({
-                trackerVersion: '7.3.4',
+                trackerVersion: '7.4.15',
                 siteKey: this.options.siteKey,
                 doNotTrack,
                 reason: missingApi.length ? `missing api: ${missingApi.join(',')}` : reason,
@@ -11510,6 +11937,12 @@ class API {
         }
         return this.app.getSessionSecret();
     }
+    requestMessengerLinkageChallenge() {
+        if (this.app === null) {
+            return Promise.resolve(null);
+        }
+        return this.app.requestMessengerLinkageChallenge();
+    }
     getSessionMeta() {
         if (this.app === null) {
             return null;
@@ -11668,6 +12101,12 @@ class BrowserSingleton {
         }
         return this.instance.getSessionSecret();
     }
+    requestMessengerLinkageChallenge() {
+        if (!IN_BROWSER || !this.ensureConfigured() || !this.instance) {
+            return Promise.resolve(null);
+        }
+        return this.instance.requestMessengerLinkageChallenge();
+    }
     track(key, payload = null, issue = false) {
         if (!IN_BROWSER || !this.ensureConfigured() || !this.instance) {
             return;