@reliantlabs/forge-web-runtime 0.4.0 → 0.5.0

package/dist/telemetry.js

@@ -38,13 +38,27 @@
 // front of such a collector must strip the header or replace it with the real
 // key. The local ClickStack collector does not enforce, and ignores it.
 //
-// ── Replay: shipped, off, masked ─────────────────────────────────────────
+// ── Replay: shipped, off, masked, media blocked ─────────────────────────
 //
 // The SDK bundles an rrweb recorder. It is DISABLED unless `replay: true`.
-// When enabled, masking is forced on — every input and all text — because a
-// replay records the DOM, which for most apps is the most sensitive data they
-// have. There is deliberately no option to turn masking off while replay is
-// on; an app that needs unmasked replay passes its own SDK options.
+// Privacy is forced, not offered: every input and all text is masked, canvas is
+// never recorded, and images, video, audio, iframes and embeds are BLOCKED
+// (replaced by a same-size placeholder; their pixels never leave the browser).
+// Images are not inlined and web fonts are not collected. There is deliberately
+// no option to turn any of that off while replay is on; an app that needs
+// unmasked replay passes its own SDK options.
+//
+// `replaySampleRate` (0..1, default 1) records only that share of SESSIONS. The
+// SDK has no session sampler, so the decision is made here, once, and held in
+// sessionStorage for the tab's session.
+//
+// ── Network URLs carry no query string ───────────────────────────────────
+//
+// fetch/XHR spans record the request URL, and a query string is where tokens,
+// OAuth codes and search terms live. The runtime rewrites `http.url` and
+// `url.full` on every fetch/XHR span to the URL without query or fragment.
+// The SDK's own `location.href` attribute (the page URL, stamped on every span)
+// has no client-side hook; the ingest side scrubs it.
 //
 // ── Loading ──────────────────────────────────────────────────────────────
 //
@@ -57,6 +71,8 @@
 // endpoint, and it never throws.
 import { trace } from "@opentelemetry/api";
 import { setExceptionReporter } from "./error-reporter.js";
+import { registerTelemetryStartup } from "./telemetry-gate.js";
+import { isTelemetryDisabled, setTelemetrySink, } from "./track.js";
 /** Where the browser ships telemetry: this origin's `/_otel`. */
 export const DEFAULT_INGEST_PATH = "/_otel";
 /**
@@ -77,20 +93,28 @@ export function initBrowserTelemetry(config) {
     if (started) {
         return started;
     }
+    if (isTelemetryDisabled()) {
+        return Promise.resolve(false);
+    }
     const ingest = resolveIngestUrl(config.endpoint, window.location.origin);
     if (!ingest) {
+        // Nothing will ever drain track() calls held for the SDK; let them go.
+        setTelemetrySink(null);
         return Promise.resolve(false);
     }
     started = start(config, ingest);
+    registerTelemetryStartup(started);
     return started;
 }
 async function start(config, ingest) {
     try {
         const hdx = resolveClient(await import("@hyperdx/browser"));
-        if (!hdx) {
+        if (!hdx || isTelemetryDisabled()) {
+            setTelemetrySink(null);
             return false;
         }
-        hdx.init(buildSdkOptions(config, ingest, window.location.origin));
+        const replay = decideReplay(config, sessionStorageOrNull(), Math.random);
+        hdx.init(buildSdkOptions({ ...config, replay }, ingest, window.location.origin));
         tapSdkInputs();
         setExceptionReporter((error, attributes) => {
             if (alreadyRecorded(error)) {
@@ -98,11 +122,22 @@ async function start(config, ingest) {
             }
             hdx.recordException(error, attributes);
         });
+        setTelemetrySink({
+            track: (name, attributes) => hdx.addAction?.(name, attributes),
+            setUser: (id) => hdx.setGlobalAttributes?.({ userId: id }),
+            disable: () => {
+                // Back to "no SDK": reportException returns false, so a caller falls
+                // back to console.error and the error does not vanish.
+                setExceptionReporter(null);
+                hdx.stopSessionRecorder?.();
+            },
+        });
         return true;
     }
     catch (err) {
         // Blocked chunk, ad-blocker, SDK throw: telemetry must never break the app.
         console.debug("[telemetry] disabled:", err);
+        setTelemetrySink(null);
         return false;
     }
 }
@@ -159,6 +194,8 @@ function alreadyRecorded(error) {
  * want to see exactly what is configured — it is pure.
  */
 export function buildSdkOptions(config, ingestUrl, pageOrigin) {
+    // `config.replay` is the FINAL decision here. initBrowserTelemetry resolves
+    // replaySampleRate into it (decideReplay) before calling this.
     const replay = config.replay === true;
     const resourceAttributes = {};
     if (config.serviceVersion) {
@@ -167,35 +204,136 @@ export function buildSdkOptions(config, ingestUrl, pageOrigin) {
     if (config.serviceNamespace) {
         resourceAttributes["service.namespace"] = config.serviceNamespace;
     }
+    if (config.frontend) {
+        resourceAttributes["forge.frontend"] = config.frontend;
+    }
     if (config.environment) {
         resourceAttributes["deployment.environment.name"] = config.environment;
         resourceAttributes["deployment.environment"] = config.environment;
     }
+    const targets = propagationTargets(pageOrigin, config.apiOrigins);
+    const advancedNetworkCapture = config.advancedNetworkCapture ?? false;
     const options = {
         apiKey: PLACEHOLDER_API_KEY,
         service: config.serviceName,
         url: ingestUrl,
-        tracePropagationTargets: propagationTargets(pageOrigin, config.apiOrigins),
+        tracePropagationTargets: targets,
         // The SDK would otherwise trace its own exports, and it must never
         // observe the route it ships through.
         ignoreUrls: [new RegExp(`^${escapeRegExp(ingestUrl)}`)],
         consoleCapture: config.consoleCapture ?? true,
-        advancedNetworkCapture: config.advancedNetworkCapture ?? false,
+        advancedNetworkCapture,
+        // The SDK spreads this over ITS fetch/xhr config as whole keys, so
+        // everything it would have set (propagation targets, the capture switch)
+        // must be restated here or it is lost.
+        instrumentations: {
+            fetch: {
+                propagateTraceHeaderCorsUrls: targets,
+                advancedNetworkCapture: () => advancedNetworkCapture,
+                applyCustomAttributesOnSpan: stripNetworkQuery,
+            },
+            xhr: {
+                propagateTraceHeaderCorsUrls: targets,
+                advancedNetworkCapture: () => advancedNetworkCapture,
+                applyCustomAttributesOnSpan: stripNetworkQuery,
+            },
+        },
         // Polls for window.Intercom on a timer; nothing here uses Intercom.
         disableIntercom: true,
         disableReplay: !replay,
         otelResourceAttributes: resourceAttributes,
         debug: config.debug ?? false,
+        // Privacy is forced and unconditional: no path through this function
+        // yields an unmasked or media-recording replay. The SDK's own default
+        // masks inputs but NOT text, and text is where chat content and records
+        // live.
+        maskAllInputs: true,
+        maskAllText: true,
+        recordCanvas: false,
+        blockSelector: REPLAY_BLOCK_SELECTOR,
+        replay: { inlineImages: false, collectFonts: false },
     };
-    if (replay) {
-        // The SDK's own default masks inputs but NOT text; text is where chat
-        // content and records live. Force both.
-        options.maskAllInputs = true;
-        options.maskAllText = true;
-        options.recordCanvas = false;
-    }
     return options;
 }
+/** Elements a replay never records: their pixels stay in the browser. */
+export const REPLAY_BLOCK_SELECTOR = "img, picture, video, audio, iframe, object, embed";
+/** Where a replay sampling decision is held for the tab's session. */
+export const REPLAY_SAMPLE_KEY = "forge.replay.sampled";
+/**
+ * Whether this session records a replay: config.replay, then the sample rate,
+ * drawn once and remembered in `store` so a reload (or a route change that
+ * re-runs init) never re-rolls into a session that only half-recorded. With no
+ * usable store the draw is made each load. Pure given its inputs; exported for
+ * tests.
+ */
+export function decideReplay(config, store, random) {
+    if (config.replay !== true) {
+        return false;
+    }
+    const rate = clampRate(config.replaySampleRate);
+    if (rate >= 1) {
+        return true;
+    }
+    if (rate <= 0) {
+        return false;
+    }
+    try {
+        const held = store?.getItem(REPLAY_SAMPLE_KEY);
+        if (held === "1" || held === "0") {
+            return held === "1";
+        }
+    }
+    catch {
+        // Storage blocked: fall through to a fresh draw.
+    }
+    const sampled = random() < rate;
+    try {
+        store?.setItem(REPLAY_SAMPLE_KEY, sampled ? "1" : "0");
+    }
+    catch {
+        // Not persisted: the next load draws again.
+    }
+    return sampled;
+}
+// Unset is "every session"; anything that is not a number is a bug, and a bug
+// must not start recording people.
+function clampRate(rate) {
+    if (rate === undefined) {
+        return 1;
+    }
+    if (typeof rate !== "number" || Number.isNaN(rate)) {
+        return 0;
+    }
+    return Math.min(1, Math.max(0, rate));
+}
+function sessionStorageOrNull() {
+    try {
+        return window.sessionStorage;
+    }
+    catch {
+        return null;
+    }
+}
+/** The span attributes that hold a request URL. */
+const URL_ATTRIBUTES = ["http.url", "url.full"];
+/** `url` without its query string and fragment. */
+export function stripUrlQuery(url) {
+    const cut = url.search(/[?#]/);
+    return cut === -1 ? url : url.slice(0, cut);
+}
+// applyCustomAttributesOnSpan for both instrumentations: it runs before the
+// span ends, so the rewritten value is the one exported.
+function stripNetworkQuery(span) {
+    for (const key of URL_ATTRIBUTES) {
+        const value = span.attributes?.[key];
+        if (typeof value === "string") {
+            const stripped = stripUrlQuery(value);
+            if (stripped !== value) {
+                span.setAttribute(key, stripped);
+            }
+        }
+    }
+}
 /**
  * resolveIngestUrl turns the configured endpoint into the absolute URL the SDK
  * is given, or null when telemetry is off. A path resolves against the page

package/dist/telemetry.js.map

@@ -1 +1 @@
-{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,yEAAyE;AACzE,EAAE;AACF,6EAA6E;AAC7E,yEAAyE;AACzE,iEAAiE;AACjE,EAAE;AACF,4EAA4E;AAC5E,EAAE;AACF,iEAAiE;AACjE,sEAAsE;AACtE,2EAA2E;AAC3E,8EAA8E;AAC9E,wEAAwE;AACxE,4EAA4E;AAC5E,4EAA4E;AAC5E,mDAAmD;AACnD,EAAE;AACF,6EAA6E;AAC7E,wEAAwE;AACxE,8EAA8E;AAC9E,2EAA2E;AAC3E,0EAA0E;AAC1E,+CAA+C;AAC/C,EAAE;AACF,4EAA4E;AAC5E,EAAE;AACF,yEAAyE;AACzE,8EAA8E;AAC9E,+EAA+E;AAC/E,2EAA2E;AAC3E,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,+EAA+E;AAC/E,0EAA0E;AAC1E,8EAA8E;AAC9E,wEAAwE;AACxE,EAAE;AACF,4EAA4E;AAC5E,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,8EAA8E;AAC9E,4EAA4E;AAC5E,oEAAoE;AACpE,EAAE;AACF,4EAA4E;AAC5E,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,6EAA6E;AAC7E,+EAA+E;AAC/E,4EAA4E;AAC5E,iCAAiC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAE5C;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AA+C1D,IAAI,OAAO,GAA4B,IAAI,CAAC;AAE5C;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAA8B;IAE9B,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,KAAK,CAClB,MAA8B,EAC9B,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,KAAK,CAAC;QACf,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAClE,YAAY,EAAE,CAAC;QACf,oBAAoB,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;YACzC,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YACD,GAAG,CAAC,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4EAA4E;QAC5E,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,EAAE;AACF,+DAA+D;AAC/D,8EAA8E;AAC9E,uEAAuE;AACvE,yEAAyE;AACzE,8EAA8E;AAC9E,wEAAwE;AACxE,kDAAkD;AAClD,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,0EAA0E;AAC1E,+EAA+E;AAC/E,2EAA2E;AAC3E,aAAa;AACb,EAAE;AACF,+EAA+E;AAC/E,yEAAyE;AACzE,2EAA2E;AAC3E,uCAAuC;AACvC,MAAM,SAAS,GAAG,IAAI,OAAO,EAAU,CAAC;AACxC,IAAI,MAAM,GAAG,KAAK,CAAC;AAEnB,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;IACT,CAAC;IACD,MAAM,GAAG,IAAI,CAAC;IACd,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;IAC9B,OAAO,CAAC,KAAK,GAAG,UAAyB,GAAG,IAAe;QACzD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;gBACzB,QAAQ,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC;IACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,CAAC,gBAAgB,CACrB,oBAAoB,EACpB,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EACzB,IAAI,CACL,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA8B,EAC9B,SAAiB,EACjB,UAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC;IACtC,MAAM,kBAAkB,GAA2B,EAAE,CAAC;IACtD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,kBAAkB,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC;IAChE,CAAC;IACD,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,kBAAkB,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,kBAAkB,CAAC,6BAA6B,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;QACvE,kBAAkB,CAAC,wBAAwB,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;IACpE,CAAC;IAED,MAAM,OAAO,GAA4B;QACvC,MAAM,EAAE,mBAAmB;QAC3B,OAAO,EAAE,MAAM,CAAC,WAAW;QAC3B,GAAG,EAAE,SAAS;QACd,uBAAuB,EAAE,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;QAC1E,mEAAmE;QACnE,sCAAsC;QACtC,UAAU,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACvD,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,IAAI;QAC7C,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,IAAI,KAAK;QAC9D,oEAAoE;QACpE,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,CAAC,MAAM;QACtB,sBAAsB,EAAE,kBAAkB;QAC1C,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,KAAK;KAC7B,CAAC;IACF,IAAI,MAAM,EAAE,CAAC;QACX,sEAAsE;QACtE,wCAAwC;QACxC,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;QAC7B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;QAC3B,OAAO,CAAC,YAAY,GAAG,KAAK,CAAC;IAC/B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAA4B,EAC5B,UAAkB;IAElB,MAAM,KAAK,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,UAAkB,EAClB,aAAwC,EAAE;IAE1C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,iFAAiF;AACjF,+EAA+E;AAC/E,0EAA0E;AAC1E,gFAAgF;AAChF,SAAS,aAAa,CAAC,GAAY;IACjC,IAAI,GAAG,GAAY,GAAG,CAAC;IACvB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM;QACR,CAAC;QACD,GAAG,GAAG,IAAI,CAAC;IACb,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACpC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,CACL,OAAO,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,UAAU;QACrC,OAAO,IAAI,CAAC,CAAC,EAAE,iBAAiB,CAAC,KAAK,UAAU,CACjD,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,sEAAsE;AACtE,SAAS,IAAI,CAAC,GAAY,EAAE,GAAW;IACrC,IAAI,CAAC;QACH,OAAQ,GAA+B,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,SAAS,CAAC,IAAI,GAAG,SAAS;IACxC,OAAO,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC","sourcesContent":["// Part of @reliantlabs/forge-web-runtime — the web twin of forge/pkg.\n//\n// Browser telemetry: the HyperDX browser SDK, initialised the forge way.\n//\n// Captures errors (uncaught, unhandled rejections, boundary-caught), console\n// output, fetch/XHR spans, document load, long tasks and web vitals, and\n// ships them to ClickStack through a SAME-ORIGIN `/_otel` route.\n//\n// ── Why HyperDX REPLACES the old OTel web wiring, not joins it ───────────\n//\n// @hyperdx/browser wraps @hyperdx/otel-web, which builds its own\n// WebTracerProvider and calls provider.register() — the global tracer\n// provider, context manager and propagator. A second registration (the old\n// `./otel` subpath did exactly that) is rejected by @opentelemetry/api with a\n// \"duplicate registration\" diagnostic and silently loses: whichever ran\n// second would simply never see a span. Two tracer providers cannot coexist\n// in one page, so there is one, and it is HyperDX's. `./otel` and its eight\n// @opentelemetry/* SDK peer dependencies are gone.\n//\n// traceparent on RPCs is unaffected. traceInterceptor (trace.ts) injects the\n// active span's context into every Connect call, or synthesises a valid\n// traceparent when none is active — with no SDK at all. With the SDK running,\n// the fetch span HyperDX opens for the call carries the same trace id, and\n// `apiOrigins` below makes that hold for a cross-origin API too (which is\n// every dev loop: the API binds its own port).\n//\n// ── The browser holds no secret ──────────────────────────────────────────\n//\n// `url` is `${location.origin}/_otel`. The browser talks only to its own\n// origin; a dev-server proxy (next.config.ts rewrites / Vite server.proxy) or\n// the deployment's ingress forwards `/_otel/v1/{traces,logs}` to the OTLP/HTTP\n// port of a collector, and that hop — never the bundle — owns credentials.\n//\n// The SDK nevertheless wants an `apiKey` and sends it as an `authorization`\n// header. We pass PLACEHOLDER_API_KEY, a constant that grants nothing and is\n// public by construction. A collector that enforces ingestion auth (ClickStack\n// `collectorAuthenticationEnforced`) rejects it with 401, so the proxy in\n// front of such a collector must strip the header or replace it with the real\n// key. The local ClickStack collector does not enforce, and ignores it.\n//\n// ── Replay: shipped, off, masked ─────────────────────────────────────────\n//\n// The SDK bundles an rrweb recorder. It is DISABLED unless `replay: true`.\n// When enabled, masking is forced on — every input and all text — because a\n// replay records the DOM, which for most apps is the most sensitive data they\n// have. There is deliberately no option to turn masking off while replay is\n// on; an app that needs unmasked replay passes its own SDK options.\n//\n// ── Loading ──────────────────────────────────────────────────────────────\n//\n// The SDK is ~600 KB minified (rrweb and the OTel web stack are bundled in\n// it), so it is imported lazily: bundlers split it into its own chunk that\n// loads after the app is interactive and costs the first paint nothing.\n// initBrowserTelemetry is therefore async and idempotent — every caller gets\n// the same promise, which is what survives React StrictMode's double mount and\n// Fast Refresh. It is a no-op without a DOM (SSR, prerender) and without an\n// endpoint, and it never throws.\nimport { trace } from \"@opentelemetry/api\";\n\nimport { setExceptionReporter } from \"./error-reporter.js\";\n\n/** Where the browser ships telemetry: this origin's `/_otel`. */\nexport const DEFAULT_INGEST_PATH = \"/_otel\";\n\n/**\n * The apiKey handed to the SDK. Public by construction: it identifies\n * nothing and authorises nothing. See the header — the proxy or collector\n * owns the real credential.\n */\nexport const PLACEHOLDER_API_KEY = \"forge-browser-public\";\n\nexport interface BrowserTelemetryConfig {\n  /** `service.name` on everything this page emits. */\n  serviceName: string;\n  /** `service.version`. Omit for none. */\n  serviceVersion?: string;\n  /**\n   * The forge environment name. Emitted as BOTH `deployment.environment.name`\n   * (current semconv) and `deployment.environment` (the legacy key HyperDX's\n   * default sources still key on).\n   */\n  environment?: string;\n  /** `service.namespace`, conventionally the project name. */\n  serviceNamespace?: string;\n  /**\n   * Ingest base: a path on this origin (`/_otel`) or, as an escape hatch, an\n   * absolute URL. Unset, empty, or `off` disables telemetry — the app runs\n   * untraced rather than throwing, which is what makes it safe to call\n   * unconditionally from the app shell.\n   */\n  endpoint?: string;\n  /**\n   * Origins (or URLs — only the origin is used) of the app's own backend.\n   * Requests to them always get a `traceparent` from the SDK's fetch/XHR\n   * spans. This page's own origin is always included.\n   */\n  apiOrigins?: Array<string | undefined>;\n  /** Mirror console.* into telemetry. Default true. */\n  consoleCapture?: boolean;\n  /**\n   * Capture full request/response headers AND BODIES on fetch/XHR spans.\n   * Default false, and it should stay false: bodies are user data.\n   */\n  advancedNetworkCapture?: boolean;\n  /** Session replay (rrweb). Default false. When true, all text and inputs are masked. */\n  replay?: boolean;\n  /** Verbose SDK diagnostics to the console. Default false. */\n  debug?: boolean;\n}\n\n/** The slice of the SDK this module calls. Typed here, not imported, so the module loads without it. */\ninterface HyperDXClient {\n  init(config: Record<string, unknown>): void;\n  recordException(error: unknown, attributes?: Record<string, unknown>): void;\n}\n\nlet started: Promise<boolean> | null = null;\n\n/**\n * initBrowserTelemetry starts the HyperDX browser SDK once per page load and\n * resolves to whether it is running. See the module header for the contract.\n */\nexport function initBrowserTelemetry(\n  config: BrowserTelemetryConfig,\n): Promise<boolean> {\n  if (typeof window === \"undefined\") {\n    return Promise.resolve(false);\n  }\n  if (started) {\n    return started;\n  }\n  const ingest = resolveIngestUrl(config.endpoint, window.location.origin);\n  if (!ingest) {\n    return Promise.resolve(false);\n  }\n  started = start(config, ingest);\n  return started;\n}\n\nasync function start(\n  config: BrowserTelemetryConfig,\n  ingest: string,\n): Promise<boolean> {\n  try {\n    const hdx = resolveClient(await import(\"@hyperdx/browser\"));\n    if (!hdx) {\n      return false;\n    }\n    hdx.init(buildSdkOptions(config, ingest, window.location.origin));\n    tapSdkInputs();\n    setExceptionReporter((error, attributes) => {\n      if (alreadyRecorded(error)) {\n        return;\n      }\n      hdx.recordException(error, attributes);\n    });\n    return true;\n  } catch (err) {\n    // Blocked chunk, ad-blocker, SDK throw: telemetry must never break the app.\n    console.debug(\"[telemetry] disabled:\", err);\n    return false;\n  }\n}\n\n// ── One failure, one record ──────────────────────────────────────────────\n//\n// The SDK records an Error that reaches window \"error\", window\n// \"unhandledrejection\", or console.error. React (18 and 19) console.errors an\n// error a boundary catches BEFORE it calls componentDidCatch, and Next\n// dispatches an uncaught render error to window \"error\" — so by the time\n// reportException runs, the SDK has usually recorded that very error already.\n// Recording it again would count one failure twice, and the issue layer\n// (which groups by fingerprint) would report two.\n//\n// So the taps below remember which Error OBJECTS the SDK was shown, and the\n// installed recorder skips those. Whatever the SDK did not see — a custom\n// onCaughtError that silences React's logging, an error rethrown as a new\n// object — is still recorded. The console tap is installed after the SDK's own\n// wrapper, so it sits outermost and only observes; every call is forwarded\n// untouched.\n//\n// The cost is the React component stack: the SDK's record of a boundary-caught\n// error comes from console.error(error), which carries the error and its\n// stack but not React's componentStack, and attributes passed to a skipped\n// reportException are dropped with it.\nconst seenBySdk = new WeakSet<object>();\nlet tapped = false;\n\nfunction noteSeen(value: unknown): void {\n  if (typeof value === \"object\" && value !== null) {\n    seenBySdk.add(value);\n  }\n}\n\nfunction tapSdkInputs(): void {\n  if (tapped) {\n    return;\n  }\n  tapped = true;\n  const wrapped = console.error;\n  console.error = function (this: unknown, ...args: unknown[]) {\n    for (const arg of args) {\n      if (arg instanceof Error) {\n        noteSeen(arg);\n      }\n    }\n    return wrapped.apply(this, args);\n  };\n  window.addEventListener(\"error\", (e) => noteSeen(e.error), true);\n  window.addEventListener(\n    \"unhandledrejection\",\n    (e) => noteSeen(e.reason),\n    true,\n  );\n}\n\nfunction alreadyRecorded(error: unknown): boolean {\n  return typeof error === \"object\" && error !== null && seenBySdk.has(error);\n}\n\n/**\n * The options passed to HyperDX.init. Exported for tests and for apps that\n * want to see exactly what is configured — it is pure.\n */\nexport function buildSdkOptions(\n  config: BrowserTelemetryConfig,\n  ingestUrl: string,\n  pageOrigin: string,\n): Record<string, unknown> {\n  const replay = config.replay === true;\n  const resourceAttributes: Record<string, string> = {};\n  if (config.serviceVersion) {\n    resourceAttributes[\"service.version\"] = config.serviceVersion;\n  }\n  if (config.serviceNamespace) {\n    resourceAttributes[\"service.namespace\"] = config.serviceNamespace;\n  }\n  if (config.environment) {\n    resourceAttributes[\"deployment.environment.name\"] = config.environment;\n    resourceAttributes[\"deployment.environment\"] = config.environment;\n  }\n\n  const options: Record<string, unknown> = {\n    apiKey: PLACEHOLDER_API_KEY,\n    service: config.serviceName,\n    url: ingestUrl,\n    tracePropagationTargets: propagationTargets(pageOrigin, config.apiOrigins),\n    // The SDK would otherwise trace its own exports, and it must never\n    // observe the route it ships through.\n    ignoreUrls: [new RegExp(`^${escapeRegExp(ingestUrl)}`)],\n    consoleCapture: config.consoleCapture ?? true,\n    advancedNetworkCapture: config.advancedNetworkCapture ?? false,\n    // Polls for window.Intercom on a timer; nothing here uses Intercom.\n    disableIntercom: true,\n    disableReplay: !replay,\n    otelResourceAttributes: resourceAttributes,\n    debug: config.debug ?? false,\n  };\n  if (replay) {\n    // The SDK's own default masks inputs but NOT text; text is where chat\n    // content and records live. Force both.\n    options.maskAllInputs = true;\n    options.maskAllText = true;\n    options.recordCanvas = false;\n  }\n  return options;\n}\n\n/**\n * resolveIngestUrl turns the configured endpoint into the absolute URL the SDK\n * is given, or null when telemetry is off. A path resolves against the page\n * origin, so the default is same-origin by construction.\n */\nexport function resolveIngestUrl(\n  endpoint: string | undefined,\n  pageOrigin: string,\n): string | null {\n  const value = (endpoint ?? \"\").trim();\n  if (value === \"\" || value.toLowerCase() === \"off\") {\n    return null;\n  }\n  try {\n    return new URL(value, pageOrigin).toString().replace(/\\/+$/, \"\");\n  } catch {\n    return null;\n  }\n}\n\nfunction propagationTargets(\n  pageOrigin: string,\n  apiOrigins: Array<string | undefined> = [],\n): RegExp[] {\n  const origins = new Set<string>([pageOrigin]);\n  for (const raw of apiOrigins) {\n    if (!raw) {\n      continue;\n    }\n    try {\n      origins.add(new URL(raw, pageOrigin).origin);\n    } catch {\n      // An unparsable origin is not a target.\n    }\n  }\n  return [...origins].map((o) => new RegExp(`^${escapeRegExp(o)}(?:[/?#]|$)`));\n}\n\nfunction escapeRegExp(s: string): string {\n  return s.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\n\n// @hyperdx/browser is a UMD/CJS bundle whose module.exports IS the client, and\n// its methods use `this`. A bundler hands back a module NAMESPACE that exposes\n// both the client's members at the top level (as read-only getters) and the\n// client itself as `default`. Calling init on the namespace binds `this` to that\n// frozen object and the SDK throws on its first property write, which disabled\n// telemetry silently. So descend to the deepest `default` that is still a\n// client, the real instance, and never settle for the namespace in front of it.\nfunction resolveClient(mod: unknown): HyperDXClient | null {\n  let cur: unknown = mod;\n  for (let depth = 0; depth < 4; depth++) {\n    const next = peek(cur, \"default\");\n    if (!isClient(next)) {\n      break;\n    }\n    cur = next;\n  }\n  return isClient(cur) ? cur : null;\n}\n\nfunction isClient(v: unknown): v is HyperDXClient {\n  return (\n    typeof peek(v, \"init\") === \"function\" &&\n    typeof peek(v, \"recordException\") === \"function\"\n  );\n}\n\n// A module namespace object may throw on an absent key (strict ESM\n// interop shims and test doubles do), and \"absent\" is an answer here.\nfunction peek(obj: unknown, key: string): unknown {\n  try {\n    return (obj as Record<string, unknown>)[key];\n  } catch {\n    return undefined;\n  }\n}\n\n/** The tracer to open manual spans on. Resolves HyperDX's provider once it is running. */\nexport function getTracer(name = \"default\") {\n  return trace.getTracer(name);\n}\n\nexport { context, propagation, trace } from \"@opentelemetry/api\";\n"]}
+{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,yEAAyE;AACzE,EAAE;AACF,6EAA6E;AAC7E,yEAAyE;AACzE,iEAAiE;AACjE,EAAE;AACF,4EAA4E;AAC5E,EAAE;AACF,iEAAiE;AACjE,sEAAsE;AACtE,2EAA2E;AAC3E,8EAA8E;AAC9E,wEAAwE;AACxE,4EAA4E;AAC5E,4EAA4E;AAC5E,mDAAmD;AACnD,EAAE;AACF,6EAA6E;AAC7E,wEAAwE;AACxE,8EAA8E;AAC9E,2EAA2E;AAC3E,0EAA0E;AAC1E,+CAA+C;AAC/C,EAAE;AACF,4EAA4E;AAC5E,EAAE;AACF,yEAAyE;AACzE,8EAA8E;AAC9E,+EAA+E;AAC/E,2EAA2E;AAC3E,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,+EAA+E;AAC/E,0EAA0E;AAC1E,8EAA8E;AAC9E,wEAAwE;AACxE,EAAE;AACF,2EAA2E;AAC3E,EAAE;AACF,2EAA2E;AAC3E,gFAAgF;AAChF,2EAA2E;AAC3E,+EAA+E;AAC/E,gFAAgF;AAChF,0EAA0E;AAC1E,8CAA8C;AAC9C,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,EAAE;AACF,8EAA8E;AAC9E,yEAAyE;AACzE,2EAA2E;AAC3E,gFAAgF;AAChF,sDAAsD;AACtD,EAAE;AACF,4EAA4E;AAC5E,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,6EAA6E;AAC7E,+EAA+E;AAC/E,4EAA4E;AAC5E,iCAAiC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EACL,mBAAmB,EACnB,gBAAgB,GAEjB,MAAM,YAAY,CAAC;AAEpB,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAE5C;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAyE1D,IAAI,OAAO,GAA4B,IAAI,CAAC;AAE5C;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAA8B;IAE9B,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,mBAAmB,EAAE,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,uEAAuE;QACvE,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvB,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,KAAK,CAClB,MAA8B,EAC9B,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,GAAG,IAAI,mBAAmB,EAAE,EAAE,CAAC;YAClC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACzE,GAAG,CAAC,IAAI,CACN,eAAe,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CACvE,CAAC;QACF,YAAY,EAAE,CAAC;QACf,oBAAoB,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;YACzC,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YACD,GAAG,CAAC,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,gBAAgB,CAAC;YACf,KAAK,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC;YAC9D,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC1D,OAAO,EAAE,GAAG,EAAE;gBACZ,qEAAqE;gBACrE,uDAAuD;gBACvD,oBAAoB,CAAC,IAAI,CAAC,CAAC;gBAC3B,GAAG,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC9B,CAAC;SACF,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4EAA4E;QAC5E,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QAC5C,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,EAAE;AACF,+DAA+D;AAC/D,8EAA8E;AAC9E,uEAAuE;AACvE,yEAAyE;AACzE,8EAA8E;AAC9E,wEAAwE;AACxE,kDAAkD;AAClD,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,0EAA0E;AAC1E,+EAA+E;AAC/E,2EAA2E;AAC3E,aAAa;AACb,EAAE;AACF,+EAA+E;AAC/E,yEAAyE;AACzE,2EAA2E;AAC3E,uCAAuC;AACvC,MAAM,SAAS,GAAG,IAAI,OAAO,EAAU,CAAC;AACxC,IAAI,MAAM,GAAG,KAAK,CAAC;AAEnB,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;IACT,CAAC;IACD,MAAM,GAAG,IAAI,CAAC;IACd,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;IAC9B,OAAO,CAAC,KAAK,GAAG,UAAyB,GAAG,IAAe;QACzD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;gBACzB,QAAQ,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC;IACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,CAAC,gBAAgB,CACrB,oBAAoB,EACpB,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EACzB,IAAI,CACL,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA8B,EAC9B,SAAiB,EACjB,UAAkB;IAElB,4EAA4E;IAC5E,+DAA+D;IAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC;IACtC,MAAM,kBAAkB,GAA2B,EAAE,CAAC;IACtD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,kBAAkB,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC;IAChE,CAAC;IACD,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,kBAAkB,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,kBAAkB,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;IACzD,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,kBAAkB,CAAC,6BAA6B,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;QACvE,kBAAkB,CAAC,wBAAwB,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;IACpE,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAClE,MAAM,sBAAsB,GAAG,MAAM,CAAC,sBAAsB,IAAI,KAAK,CAAC;IACtE,MAAM,OAAO,GAA4B;QACvC,MAAM,EAAE,mBAAmB;QAC3B,OAAO,EAAE,MAAM,CAAC,WAAW;QAC3B,GAAG,EAAE,SAAS;QACd,uBAAuB,EAAE,OAAO;QAChC,mEAAmE;QACnE,sCAAsC;QACtC,UAAU,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACvD,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,IAAI;QAC7C,sBAAsB;QACtB,mEAAmE;QACnE,yEAAyE;QACzE,uCAAuC;QACvC,gBAAgB,EAAE;YAChB,KAAK,EAAE;gBACL,4BAA4B,EAAE,OAAO;gBACrC,sBAAsB,EAAE,GAAG,EAAE,CAAC,sBAAsB;gBACpD,2BAA2B,EAAE,iBAAiB;aAC/C;YACD,GAAG,EAAE;gBACH,4BAA4B,EAAE,OAAO;gBACrC,sBAAsB,EAAE,GAAG,EAAE,CAAC,sBAAsB;gBACpD,2BAA2B,EAAE,iBAAiB;aAC/C;SACF;QACD,oEAAoE;QACpE,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,CAAC,MAAM;QACtB,sBAAsB,EAAE,kBAAkB;QAC1C,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,KAAK;QAC5B,qEAAqE;QACrE,sEAAsE;QACtE,wEAAwE;QACxE,QAAQ;QACR,aAAa,EAAE,IAAI;QACnB,WAAW,EAAE,IAAI;QACjB,YAAY,EAAE,KAAK;QACnB,aAAa,EAAE,qBAAqB;QACpC,MAAM,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE;KACrD,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,qBAAqB,GAChC,mDAAmD,CAAC;AAEtD,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AAQxD;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAmE,EACnE,KAA2B,EAC3B,MAAoB;IAEpB,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAChD,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,KAAK,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC/C,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,OAAO,IAAI,KAAK,GAAG,CAAC;QACtB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,KAAK,EAAE,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,mCAAmC;AACnC,SAAS,SAAS,CAAC,IAAwB;IACzC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,oBAAoB;IAC3B,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,cAAc,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,mDAAmD;AACnD,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,UAAU,CAAU,CAAC;AAEzD,mDAAmD;AACnD,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC;AAOD,4EAA4E;AAC5E,yDAAyD;AACzD,SAAS,iBAAiB,CAAC,IAAa;IACtC,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;gBACvB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAA4B,EAC5B,UAAkB;IAElB,MAAM,KAAK,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,UAAkB,EAClB,aAAwC,EAAE;IAE1C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,iFAAiF;AACjF,+EAA+E;AAC/E,0EAA0E;AAC1E,gFAAgF;AAChF,SAAS,aAAa,CAAC,GAAY;IACjC,IAAI,GAAG,GAAY,GAAG,CAAC;IACvB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM;QACR,CAAC;QACD,GAAG,GAAG,IAAI,CAAC;IACb,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACpC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,CACL,OAAO,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,UAAU;QACrC,OAAO,IAAI,CAAC,CAAC,EAAE,iBAAiB,CAAC,KAAK,UAAU,CACjD,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,sEAAsE;AACtE,SAAS,IAAI,CAAC,GAAY,EAAE,GAAW;IACrC,IAAI,CAAC;QACH,OAAQ,GAA+B,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,SAAS,CAAC,IAAI,GAAG,SAAS;IACxC,OAAO,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC","sourcesContent":["// Part of @reliantlabs/forge-web-runtime — the web twin of forge/pkg.\n//\n// Browser telemetry: the HyperDX browser SDK, initialised the forge way.\n//\n// Captures errors (uncaught, unhandled rejections, boundary-caught), console\n// output, fetch/XHR spans, document load, long tasks and web vitals, and\n// ships them to ClickStack through a SAME-ORIGIN `/_otel` route.\n//\n// ── Why HyperDX REPLACES the old OTel web wiring, not joins it ───────────\n//\n// @hyperdx/browser wraps @hyperdx/otel-web, which builds its own\n// WebTracerProvider and calls provider.register() — the global tracer\n// provider, context manager and propagator. A second registration (the old\n// `./otel` subpath did exactly that) is rejected by @opentelemetry/api with a\n// \"duplicate registration\" diagnostic and silently loses: whichever ran\n// second would simply never see a span. Two tracer providers cannot coexist\n// in one page, so there is one, and it is HyperDX's. `./otel` and its eight\n// @opentelemetry/* SDK peer dependencies are gone.\n//\n// traceparent on RPCs is unaffected. traceInterceptor (trace.ts) injects the\n// active span's context into every Connect call, or synthesises a valid\n// traceparent when none is active — with no SDK at all. With the SDK running,\n// the fetch span HyperDX opens for the call carries the same trace id, and\n// `apiOrigins` below makes that hold for a cross-origin API too (which is\n// every dev loop: the API binds its own port).\n//\n// ── The browser holds no secret ──────────────────────────────────────────\n//\n// `url` is `${location.origin}/_otel`. The browser talks only to its own\n// origin; a dev-server proxy (next.config.ts rewrites / Vite server.proxy) or\n// the deployment's ingress forwards `/_otel/v1/{traces,logs}` to the OTLP/HTTP\n// port of a collector, and that hop — never the bundle — owns credentials.\n//\n// The SDK nevertheless wants an `apiKey` and sends it as an `authorization`\n// header. We pass PLACEHOLDER_API_KEY, a constant that grants nothing and is\n// public by construction. A collector that enforces ingestion auth (ClickStack\n// `collectorAuthenticationEnforced`) rejects it with 401, so the proxy in\n// front of such a collector must strip the header or replace it with the real\n// key. The local ClickStack collector does not enforce, and ignores it.\n//\n// ── Replay: shipped, off, masked, media blocked ─────────────────────────\n//\n// The SDK bundles an rrweb recorder. It is DISABLED unless `replay: true`.\n// Privacy is forced, not offered: every input and all text is masked, canvas is\n// never recorded, and images, video, audio, iframes and embeds are BLOCKED\n// (replaced by a same-size placeholder; their pixels never leave the browser).\n// Images are not inlined and web fonts are not collected. There is deliberately\n// no option to turn any of that off while replay is on; an app that needs\n// unmasked replay passes its own SDK options.\n//\n// `replaySampleRate` (0..1, default 1) records only that share of SESSIONS. The\n// SDK has no session sampler, so the decision is made here, once, and held in\n// sessionStorage for the tab's session.\n//\n// ── Network URLs carry no query string ───────────────────────────────────\n//\n// fetch/XHR spans record the request URL, and a query string is where tokens,\n// OAuth codes and search terms live. The runtime rewrites `http.url` and\n// `url.full` on every fetch/XHR span to the URL without query or fragment.\n// The SDK's own `location.href` attribute (the page URL, stamped on every span)\n// has no client-side hook; the ingest side scrubs it.\n//\n// ── Loading ──────────────────────────────────────────────────────────────\n//\n// The SDK is ~600 KB minified (rrweb and the OTel web stack are bundled in\n// it), so it is imported lazily: bundlers split it into its own chunk that\n// loads after the app is interactive and costs the first paint nothing.\n// initBrowserTelemetry is therefore async and idempotent — every caller gets\n// the same promise, which is what survives React StrictMode's double mount and\n// Fast Refresh. It is a no-op without a DOM (SSR, prerender) and without an\n// endpoint, and it never throws.\nimport { trace } from \"@opentelemetry/api\";\n\nimport { setExceptionReporter } from \"./error-reporter.js\";\nimport { registerTelemetryStartup } from \"./telemetry-gate.js\";\nimport {\n  isTelemetryDisabled,\n  setTelemetrySink,\n  type TrackValue,\n} from \"./track.js\";\n\n/** Where the browser ships telemetry: this origin's `/_otel`. */\nexport const DEFAULT_INGEST_PATH = \"/_otel\";\n\n/**\n * The apiKey handed to the SDK. Public by construction: it identifies\n * nothing and authorises nothing. See the header — the proxy or collector\n * owns the real credential.\n */\nexport const PLACEHOLDER_API_KEY = \"forge-browser-public\";\n\nexport interface BrowserTelemetryConfig {\n  /** `service.name` on everything this page emits. */\n  serviceName: string;\n  /** `service.version`. Omit for none. */\n  serviceVersion?: string;\n  /**\n   * The forge environment name. Emitted as BOTH `deployment.environment.name`\n   * (current semconv) and `deployment.environment` (the legacy key HyperDX's\n   * default sources still key on).\n   */\n  environment?: string;\n  /** `service.namespace`, conventionally the project name. */\n  serviceNamespace?: string;\n  /**\n   * The forge frontend's name, emitted as the `forge.frontend` resource\n   * attribute. Unlike `serviceName` (which an app may override to anything) it\n   * is the stable key that joins this page's telemetry to the frontend and its\n   * source maps. Omit for none.\n   */\n  frontend?: string;\n  /**\n   * Ingest base: a path on this origin (`/_otel`) or, as an escape hatch, an\n   * absolute URL. Unset, empty, or `off` disables telemetry — the app runs\n   * untraced rather than throwing, which is what makes it safe to call\n   * unconditionally from the app shell.\n   */\n  endpoint?: string;\n  /**\n   * Origins (or URLs — only the origin is used) of the app's own backend.\n   * Requests to them always get a `traceparent` from the SDK's fetch/XHR\n   * spans. This page's own origin is always included.\n   */\n  apiOrigins?: Array<string | undefined>;\n  /**\n   * Mirror console.log/info/warn/debug into telemetry spans. Default true;\n   * pass false when console output can hold user content. It does NOT stop\n   * `console.error(err)` from being recorded as an error: the SDK's error\n   * instrumentation is separate and always on.\n   */\n  consoleCapture?: boolean;\n  /**\n   * Capture full request/response headers AND BODIES on fetch/XHR spans.\n   * Default false, and it should stay false: bodies are user data.\n   */\n  advancedNetworkCapture?: boolean;\n  /**\n   * Session replay (rrweb). Default false. When true, all text and inputs are\n   * masked, media is blocked and canvas is not recorded (see the header).\n   */\n  replay?: boolean;\n  /**\n   * The share of sessions to record when `replay` is true, 0..1. Default 1\n   * (every session). Decided once per session and held in sessionStorage. A\n   * value that is not a number records nothing. An app with its own policy\n   * (every session of a new user, a fraction of the rest) computes the rate\n   * it wants for this session and passes it here.\n   */\n  replaySampleRate?: number;\n  /** Verbose SDK diagnostics to the console. Default false. */\n  debug?: boolean;\n}\n\n/** The slice of the SDK this module calls. Typed here, not imported, so the module loads without it. */\ninterface HyperDXClient {\n  init(config: Record<string, unknown>): void;\n  recordException(error: unknown, attributes?: Record<string, unknown>): void;\n  addAction?(name: string, attributes?: Record<string, TrackValue>): void;\n  setGlobalAttributes?(attributes: Record<string, string>): void;\n  stopSessionRecorder?(): void;\n}\n\nlet started: Promise<boolean> | null = null;\n\n/**\n * initBrowserTelemetry starts the HyperDX browser SDK once per page load and\n * resolves to whether it is running. See the module header for the contract.\n */\nexport function initBrowserTelemetry(\n  config: BrowserTelemetryConfig,\n): Promise<boolean> {\n  if (typeof window === \"undefined\") {\n    return Promise.resolve(false);\n  }\n  if (started) {\n    return started;\n  }\n  if (isTelemetryDisabled()) {\n    return Promise.resolve(false);\n  }\n  const ingest = resolveIngestUrl(config.endpoint, window.location.origin);\n  if (!ingest) {\n    // Nothing will ever drain track() calls held for the SDK; let them go.\n    setTelemetrySink(null);\n    return Promise.resolve(false);\n  }\n  started = start(config, ingest);\n  registerTelemetryStartup(started);\n  return started;\n}\n\nasync function start(\n  config: BrowserTelemetryConfig,\n  ingest: string,\n): Promise<boolean> {\n  try {\n    const hdx = resolveClient(await import(\"@hyperdx/browser\"));\n    if (!hdx || isTelemetryDisabled()) {\n      setTelemetrySink(null);\n      return false;\n    }\n    const replay = decideReplay(config, sessionStorageOrNull(), Math.random);\n    hdx.init(\n      buildSdkOptions({ ...config, replay }, ingest, window.location.origin),\n    );\n    tapSdkInputs();\n    setExceptionReporter((error, attributes) => {\n      if (alreadyRecorded(error)) {\n        return;\n      }\n      hdx.recordException(error, attributes);\n    });\n    setTelemetrySink({\n      track: (name, attributes) => hdx.addAction?.(name, attributes),\n      setUser: (id) => hdx.setGlobalAttributes?.({ userId: id }),\n      disable: () => {\n        // Back to \"no SDK\": reportException returns false, so a caller falls\n        // back to console.error and the error does not vanish.\n        setExceptionReporter(null);\n        hdx.stopSessionRecorder?.();\n      },\n    });\n    return true;\n  } catch (err) {\n    // Blocked chunk, ad-blocker, SDK throw: telemetry must never break the app.\n    console.debug(\"[telemetry] disabled:\", err);\n    setTelemetrySink(null);\n    return false;\n  }\n}\n\n// ── One failure, one record ──────────────────────────────────────────────\n//\n// The SDK records an Error that reaches window \"error\", window\n// \"unhandledrejection\", or console.error. React (18 and 19) console.errors an\n// error a boundary catches BEFORE it calls componentDidCatch, and Next\n// dispatches an uncaught render error to window \"error\" — so by the time\n// reportException runs, the SDK has usually recorded that very error already.\n// Recording it again would count one failure twice, and the issue layer\n// (which groups by fingerprint) would report two.\n//\n// So the taps below remember which Error OBJECTS the SDK was shown, and the\n// installed recorder skips those. Whatever the SDK did not see — a custom\n// onCaughtError that silences React's logging, an error rethrown as a new\n// object — is still recorded. The console tap is installed after the SDK's own\n// wrapper, so it sits outermost and only observes; every call is forwarded\n// untouched.\n//\n// The cost is the React component stack: the SDK's record of a boundary-caught\n// error comes from console.error(error), which carries the error and its\n// stack but not React's componentStack, and attributes passed to a skipped\n// reportException are dropped with it.\nconst seenBySdk = new WeakSet<object>();\nlet tapped = false;\n\nfunction noteSeen(value: unknown): void {\n  if (typeof value === \"object\" && value !== null) {\n    seenBySdk.add(value);\n  }\n}\n\nfunction tapSdkInputs(): void {\n  if (tapped) {\n    return;\n  }\n  tapped = true;\n  const wrapped = console.error;\n  console.error = function (this: unknown, ...args: unknown[]) {\n    for (const arg of args) {\n      if (arg instanceof Error) {\n        noteSeen(arg);\n      }\n    }\n    return wrapped.apply(this, args);\n  };\n  window.addEventListener(\"error\", (e) => noteSeen(e.error), true);\n  window.addEventListener(\n    \"unhandledrejection\",\n    (e) => noteSeen(e.reason),\n    true,\n  );\n}\n\nfunction alreadyRecorded(error: unknown): boolean {\n  return typeof error === \"object\" && error !== null && seenBySdk.has(error);\n}\n\n/**\n * The options passed to HyperDX.init. Exported for tests and for apps that\n * want to see exactly what is configured — it is pure.\n */\nexport function buildSdkOptions(\n  config: BrowserTelemetryConfig,\n  ingestUrl: string,\n  pageOrigin: string,\n): Record<string, unknown> {\n  // `config.replay` is the FINAL decision here. initBrowserTelemetry resolves\n  // replaySampleRate into it (decideReplay) before calling this.\n  const replay = config.replay === true;\n  const resourceAttributes: Record<string, string> = {};\n  if (config.serviceVersion) {\n    resourceAttributes[\"service.version\"] = config.serviceVersion;\n  }\n  if (config.serviceNamespace) {\n    resourceAttributes[\"service.namespace\"] = config.serviceNamespace;\n  }\n  if (config.frontend) {\n    resourceAttributes[\"forge.frontend\"] = config.frontend;\n  }\n  if (config.environment) {\n    resourceAttributes[\"deployment.environment.name\"] = config.environment;\n    resourceAttributes[\"deployment.environment\"] = config.environment;\n  }\n\n  const targets = propagationTargets(pageOrigin, config.apiOrigins);\n  const advancedNetworkCapture = config.advancedNetworkCapture ?? false;\n  const options: Record<string, unknown> = {\n    apiKey: PLACEHOLDER_API_KEY,\n    service: config.serviceName,\n    url: ingestUrl,\n    tracePropagationTargets: targets,\n    // The SDK would otherwise trace its own exports, and it must never\n    // observe the route it ships through.\n    ignoreUrls: [new RegExp(`^${escapeRegExp(ingestUrl)}`)],\n    consoleCapture: config.consoleCapture ?? true,\n    advancedNetworkCapture,\n    // The SDK spreads this over ITS fetch/xhr config as whole keys, so\n    // everything it would have set (propagation targets, the capture switch)\n    // must be restated here or it is lost.\n    instrumentations: {\n      fetch: {\n        propagateTraceHeaderCorsUrls: targets,\n        advancedNetworkCapture: () => advancedNetworkCapture,\n        applyCustomAttributesOnSpan: stripNetworkQuery,\n      },\n      xhr: {\n        propagateTraceHeaderCorsUrls: targets,\n        advancedNetworkCapture: () => advancedNetworkCapture,\n        applyCustomAttributesOnSpan: stripNetworkQuery,\n      },\n    },\n    // Polls for window.Intercom on a timer; nothing here uses Intercom.\n    disableIntercom: true,\n    disableReplay: !replay,\n    otelResourceAttributes: resourceAttributes,\n    debug: config.debug ?? false,\n    // Privacy is forced and unconditional: no path through this function\n    // yields an unmasked or media-recording replay. The SDK's own default\n    // masks inputs but NOT text, and text is where chat content and records\n    // live.\n    maskAllInputs: true,\n    maskAllText: true,\n    recordCanvas: false,\n    blockSelector: REPLAY_BLOCK_SELECTOR,\n    replay: { inlineImages: false, collectFonts: false },\n  };\n  return options;\n}\n\n/** Elements a replay never records: their pixels stay in the browser. */\nexport const REPLAY_BLOCK_SELECTOR =\n  \"img, picture, video, audio, iframe, object, embed\";\n\n/** Where a replay sampling decision is held for the tab's session. */\nexport const REPLAY_SAMPLE_KEY = \"forge.replay.sampled\";\n\n/** The slice of Storage the sampling decision needs. */\ninterface DecisionStore {\n  getItem(key: string): string | null;\n  setItem(key: string, value: string): void;\n}\n\n/**\n * Whether this session records a replay: config.replay, then the sample rate,\n * drawn once and remembered in `store` so a reload (or a route change that\n * re-runs init) never re-rolls into a session that only half-recorded. With no\n * usable store the draw is made each load. Pure given its inputs; exported for\n * tests.\n */\nexport function decideReplay(\n  config: Pick<BrowserTelemetryConfig, \"replay\" | \"replaySampleRate\">,\n  store: DecisionStore | null,\n  random: () => number,\n): boolean {\n  if (config.replay !== true) {\n    return false;\n  }\n  const rate = clampRate(config.replaySampleRate);\n  if (rate >= 1) {\n    return true;\n  }\n  if (rate <= 0) {\n    return false;\n  }\n  try {\n    const held = store?.getItem(REPLAY_SAMPLE_KEY);\n    if (held === \"1\" || held === \"0\") {\n      return held === \"1\";\n    }\n  } catch {\n    // Storage blocked: fall through to a fresh draw.\n  }\n  const sampled = random() < rate;\n  try {\n    store?.setItem(REPLAY_SAMPLE_KEY, sampled ? \"1\" : \"0\");\n  } catch {\n    // Not persisted: the next load draws again.\n  }\n  return sampled;\n}\n\n// Unset is \"every session\"; anything that is not a number is a bug, and a bug\n// must not start recording people.\nfunction clampRate(rate: number | undefined): number {\n  if (rate === undefined) {\n    return 1;\n  }\n  if (typeof rate !== \"number\" || Number.isNaN(rate)) {\n    return 0;\n  }\n  return Math.min(1, Math.max(0, rate));\n}\n\nfunction sessionStorageOrNull(): DecisionStore | null {\n  try {\n    return window.sessionStorage;\n  } catch {\n    return null;\n  }\n}\n\n/** The span attributes that hold a request URL. */\nconst URL_ATTRIBUTES = [\"http.url\", \"url.full\"] as const;\n\n/** `url` without its query string and fragment. */\nexport function stripUrlQuery(url: string): string {\n  const cut = url.search(/[?#]/);\n  return cut === -1 ? url : url.slice(0, cut);\n}\n\ninterface UrlSpan {\n  attributes?: Record<string, unknown>;\n  setAttribute(key: string, value: string): unknown;\n}\n\n// applyCustomAttributesOnSpan for both instrumentations: it runs before the\n// span ends, so the rewritten value is the one exported.\nfunction stripNetworkQuery(span: UrlSpan): void {\n  for (const key of URL_ATTRIBUTES) {\n    const value = span.attributes?.[key];\n    if (typeof value === \"string\") {\n      const stripped = stripUrlQuery(value);\n      if (stripped !== value) {\n        span.setAttribute(key, stripped);\n      }\n    }\n  }\n}\n\n/**\n * resolveIngestUrl turns the configured endpoint into the absolute URL the SDK\n * is given, or null when telemetry is off. A path resolves against the page\n * origin, so the default is same-origin by construction.\n */\nexport function resolveIngestUrl(\n  endpoint: string | undefined,\n  pageOrigin: string,\n): string | null {\n  const value = (endpoint ?? \"\").trim();\n  if (value === \"\" || value.toLowerCase() === \"off\") {\n    return null;\n  }\n  try {\n    return new URL(value, pageOrigin).toString().replace(/\\/+$/, \"\");\n  } catch {\n    return null;\n  }\n}\n\nfunction propagationTargets(\n  pageOrigin: string,\n  apiOrigins: Array<string | undefined> = [],\n): RegExp[] {\n  const origins = new Set<string>([pageOrigin]);\n  for (const raw of apiOrigins) {\n    if (!raw) {\n      continue;\n    }\n    try {\n      origins.add(new URL(raw, pageOrigin).origin);\n    } catch {\n      // An unparsable origin is not a target.\n    }\n  }\n  return [...origins].map((o) => new RegExp(`^${escapeRegExp(o)}(?:[/?#]|$)`));\n}\n\nfunction escapeRegExp(s: string): string {\n  return s.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\n\n// @hyperdx/browser is a UMD/CJS bundle whose module.exports IS the client, and\n// its methods use `this`. A bundler hands back a module NAMESPACE that exposes\n// both the client's members at the top level (as read-only getters) and the\n// client itself as `default`. Calling init on the namespace binds `this` to that\n// frozen object and the SDK throws on its first property write, which disabled\n// telemetry silently. So descend to the deepest `default` that is still a\n// client, the real instance, and never settle for the namespace in front of it.\nfunction resolveClient(mod: unknown): HyperDXClient | null {\n  let cur: unknown = mod;\n  for (let depth = 0; depth < 4; depth++) {\n    const next = peek(cur, \"default\");\n    if (!isClient(next)) {\n      break;\n    }\n    cur = next;\n  }\n  return isClient(cur) ? cur : null;\n}\n\nfunction isClient(v: unknown): v is HyperDXClient {\n  return (\n    typeof peek(v, \"init\") === \"function\" &&\n    typeof peek(v, \"recordException\") === \"function\"\n  );\n}\n\n// A module namespace object may throw on an absent key (strict ESM\n// interop shims and test doubles do), and \"absent\" is an answer here.\nfunction peek(obj: unknown, key: string): unknown {\n  try {\n    return (obj as Record<string, unknown>)[key];\n  } catch {\n    return undefined;\n  }\n}\n\n/** The tracer to open manual spans on. Resolves HyperDX's provider once it is running. */\nexport function getTracer(name = \"default\") {\n  return trace.getTracer(name);\n}\n\nexport { context, propagation, trace } from \"@opentelemetry/api\";\n"]}

package/dist/track.d.ts

@@ -0,0 +1,72 @@
+/** Most events held while the SDK is still loading. Later calls are dropped. */
+export declare const MAX_QUEUED_EVENTS = 100;
+/** Most props kept on one event; the rest are dropped in insertion order. */
+export declare const MAX_PROP_KEYS = 20;
+/** Longest string prop value, after redaction. */
+export declare const MAX_PROP_VALUE_CHARS = 256;
+/** Longest event name. */
+export declare const MAX_EVENT_NAME_CHARS = 128;
+/** Longest user id. */
+export declare const MAX_USER_ID_CHARS = 128;
+/** A prop key is a dotted lowercase identifier. */
+export declare const PROP_KEY_RE: RegExp;
+/** What a redacted credential becomes. */
+export declare const REDACTED = "[redacted]";
+/** A prop value an event may carry. Anything else is dropped. */
+export type TrackValue = string | number | boolean;
+/** Props accepted by track(); non-conforming entries are dropped, not thrown on. */
+export type TrackProps = Record<string, unknown>;
+/** What the `/telemetry` subpath installs once the SDK is running. */
+export interface TelemetrySink {
+    track(name: string, attributes: Record<string, TrackValue>): void;
+    setUser(id: string): void;
+    disable(): void;
+}
+/** Redact credential shapes from a string. Exported for tests. */
+export declare function redactSecrets(value: string): string;
+/**
+ * Reduce caller props to what an event may carry: bounded, typed, redacted.
+ * Pure; exported for tests.
+ */
+export declare function sanitizeProps(props: TrackProps | undefined): Record<string, TrackValue>;
+/**
+ * Record a product event — a funnel step, a feature used — as a span on the
+ * current session. Never throws, and is a no-op on the server, after
+ * disableTelemetry(), and (once the SDK has started) whenever telemetry is
+ * off. Calls made while the SDK is still loading are held, up to
+ * MAX_QUEUED_EVENTS, and replayed in order.
+ *
+ * `name` is a stable, low-cardinality event name ("onboarding_completed"),
+ * not a sentence. `props` is bounded and redacted as described in the module
+ * header; do not put user content in it.
+ */
+export declare function track(name: string, props?: TrackProps): void;
+/**
+ * Attach the signed-in user's id to every span and replay from here on, so an
+ * error, a funnel step and a replay can be joined to a user. Pass an opaque
+ * id — never an email, a name or anything else a person would recognise. Pass
+ * null (sign-out) to clear it.
+ *
+ * The id is carried as the `userId` global attribute. The SDK has no way to
+ * delete an attribute, so clearing writes an empty `userId`. Held until the
+ * SDK has started; the last call wins.
+ */
+export declare function setTelemetryUser(id: string | null | undefined): void;
+/**
+ * Turn browser telemetry off for the rest of this page load: stop the replay
+ * recorder, drop anything held, and make track(), setTelemetryUser() and
+ * reportException() no-ops. For when the user withdraws consent mid-session.
+ * See the module header for what it cannot undo.
+ */
+export declare function disableTelemetry(): void;
+/** Whether disableTelemetry() has been called. Read by the installed recorder. */
+export declare function isTelemetryDisabled(): boolean;
+/**
+ * Install (or clear, with null) the sink track() forwards to, replaying
+ * whatever was held. Called by initBrowserTelemetry; an app has no reason to
+ * call it directly. Clearing also drops what was held, so a start that failed
+ * does not keep a queue nobody will drain.
+ */
+export declare function setTelemetrySink(next: TelemetrySink | null): void;
+/** Test seam. */
+export declare function resetTrackState(): void;