@sailfish-ai/recorder 1.8.21 → 1.8.22

package/dist/index.js

@@ -39,6 +39,8 @@ const INCLUDE = "include";
 const SAME_ORIGIN = "same-origin";
 const ALLOWED_HEADERS_HEADER = "access-control-allow-headers";
 const OPTIONS = "OPTIONS";
+const AUTHORIZATION_HEADER_KEY_LOWER = "authorization";
+const AUTHORIZATION_HEADER_KEY = "Authorization";
 const ActionType = {
     PROPAGATE: "propagate",
     IGNORE: "ignore",
@@ -83,6 +85,41 @@ export const DEFAULT_CONSOLE_RECORDING_SETTINGS = {
 //   recordBody: true,
 //   recordInitialRequests: false,
 // };
+function maskAuthorizationHeader(requestHeaders) {
+    const authKey = requestHeaders[AUTHORIZATION_HEADER_KEY_LOWER]
+        ? AUTHORIZATION_HEADER_KEY_LOWER
+        : requestHeaders[AUTHORIZATION_HEADER_KEY]
+            ? AUTHORIZATION_HEADER_KEY
+            : null;
+    if (!authKey) {
+        return;
+    }
+    const authValue = requestHeaders[authKey];
+    const spaceIndex = authValue.indexOf(" ");
+    if (spaceIndex !== -1) {
+        const scheme = authValue.slice(0, spaceIndex + 1); // "Bearer "
+        const token = authValue.slice(spaceIndex + 1);
+        if (token.length > 8) {
+            requestHeaders[authKey] =
+                scheme +
+                    token.slice(0, 4) +
+                    "*".repeat(token.length - 8) +
+                    token.slice(-4);
+        }
+        else {
+            requestHeaders[authKey] = scheme + "*".repeat(token.length);
+        }
+    }
+    else if (authValue.length > 8) {
+        requestHeaders[authKey] =
+            authValue.slice(0, 4) +
+                "*".repeat(authValue.length - 8) +
+                authValue.slice(-4);
+    }
+    else {
+        requestHeaders[authKey] = "*".repeat(authValue.length);
+    }
+}
 function trackDomainChangesOnce() {
     const g = (window.__sailfish_recorder ||= {});
     if (g.routeWatcherIntervalId) {
@@ -403,12 +440,11 @@ function setupXMLHttpRequestInterceptor(domainsToNotPropagateHeaderTo = []) {
         const startTime = Date.now();
         let finished = false;
         const requestBody = args[0]; // Capture the request body/payload
-        const requestHeaders = { ...this._capturedRequestHeaders }; // Capture request headers
-        // Filter out internal Sailfish headers from the captured headers
-        delete requestHeaders[xSf3RidHeader];
-        if (funcSpanHeader) {
-            delete requestHeaders[funcSpanHeader.name];
-        }
+        // Note: _capturedRequestHeaders already includes x-sf3-rid and funcSpan headers
+        // because setRequestHeader() above goes through our intercepted version
+        const requestHeaders = { ...this._capturedRequestHeaders };
+        // Mask authorization header for privacy (preserve scheme like "Bearer", mask the token)
+        maskAuthorizationHeader(requestHeaders);
         // 4️⃣ Helper to emit networkRequestFinished
         const emitFinished = (success, status, errorMsg, responseData, responseHeaders) => {
             if (finished)
@@ -576,20 +612,28 @@ function setupFetchInterceptor(domainsToNotPropagateHeadersTo = []) {
                 console.warn("[Sailfish] Failed to capture request data:", e);
             }
         }
-        // Filter out internal Sailfish headers from captured headers
+        // Remove any existing Sailfish headers (in case app already set them)
         delete requestHeaders[xSf3RidHeader];
-        const funcSpanHeaderName = getFuncSpanHeader()?.name;
-        if (funcSpanHeaderName) {
-            delete requestHeaders[funcSpanHeaderName];
+        const funcSpanHeader = getFuncSpanHeader();
+        if (funcSpanHeader) {
+            delete requestHeaders[funcSpanHeader.name];
+        }
+        // Add Sailfish headers with correct values
+        const xSf3RidValue = `${sessionId}/${urlAndStoredUuids.page_visit_uuid}/${networkUUID}`;
+        requestHeaders[xSf3RidHeader] = xSf3RidValue;
+        if (funcSpanHeader) {
+            requestHeaders[funcSpanHeader.name] = funcSpanHeader.value;
         }
+        // Mask authorization header for privacy (preserve scheme like "Bearer", mask the token)
+        maskAuthorizationHeader(requestHeaders);
         try {
             let response = await injectHeader(target, thisArg, input, init, sessionId, urlAndStoredUuids.page_visit_uuid, networkUUID);
             let isRetry = false;
             // Retry logic for 400/403 before logging finished event
             if (BAD_HTTP_STATUS.includes(response.status)) {
                 DEBUG && console.log("Perform retry as status was fail:", response);
-                // Generate a NEW UUID for the retry request so each request has a unique ID
-                networkUUID = uuidv4();
+                // Remove x-sf3-rid from captured headers since retry doesn't include it
+                delete requestHeaders[xSf3RidHeader];
                 response = await retryWithoutPropagateHeaders(target, thisArg, args, url);
                 isRetry = true;
             }

package/dist/recorder.cjs

@@ -465,7 +465,7 @@ function initializeWebSocket(e, a, u, m2) {
     const a2 = document.createElement("a");
     return a2.href = e2, `${a2.hostname}${a2.port ? `:${a2.port}` : ""}`;
   })(e);
-  let b2 = `${"https:" === new URL(e).protocol ? "wss" : "ws"}://${w2}/ws/notify/?apiKey=${a}&sessionId=${u}&sender=JS%2FTS&version=1.8.21`;
+  let b2 = `${"https:" === new URL(e).protocol ? "wss" : "ws"}://${w2}/ws/notify/?apiKey=${a}&sessionId=${u}&sender=JS%2FTS&version=1.8.22`;
   m2 && (b2 += `&envValue=${encodeURIComponent(m2)}`);
   return oe = new U(b2, [], { connectionTimeout: 3e4 }), oe.addEventListener("open", () => {
     ne && (console.log("[Sailfish] WebSocket connection opened"), console.log("[Sailfish] Function span tracking state: " + (ce ? "ENABLED" : "DISABLED"))), (async () => {
@@ -7791,7 +7791,16 @@ async function initializeRecording(e, a, u, m2, w2) {
   return b2;
 }
 let wd = null, Sd = null;
-const bd = readDebugFlag(), vd = ["t.co", "*.twitter.com", "*.gravatar.com", "*.googleapis.com", "*.amazonaws.com", "*.smooch.io", "*.zendesk.com", "*.zdassets.com"], kd = [400, 403], xd = "CORS", Cd = { recordCanvas: false, recordCrossOriginIframes: false, collectFonts: false, inlineImages: false, recordPassword: false, recordRealName: true, recordCreditCardInfo: false, recordSsn: false, recordDob: false, sampling: {} }, Id = { level: ["info", "log", "warn", "error"], lengthThreshold: 1e4, stringifyOptions: { stringLengthLimit: 1e3, numOfKeysLimit: 20, depthOfLimit: 4 }, logger: "console" };
+const bd = readDebugFlag(), vd = ["t.co", "*.twitter.com", "*.gravatar.com", "*.googleapis.com", "*.amazonaws.com", "*.smooch.io", "*.zendesk.com", "*.zdassets.com"], kd = [400, 403], xd = "CORS", Cd = "authorization", Id = "Authorization", Md = { recordCanvas: false, recordCrossOriginIframes: false, collectFonts: false, inlineImages: false, recordPassword: false, recordRealName: true, recordCreditCardInfo: false, recordSsn: false, recordDob: false, sampling: {} }, Ed = { level: ["info", "log", "warn", "error"], lengthThreshold: 1e4, stringifyOptions: { stringLengthLimit: 1e3, numOfKeysLimit: 20, depthOfLimit: 4 }, logger: "console" };
+function maskAuthorizationHeader(e) {
+  const a = e[Cd] ? Cd : e[Id] ? Id : null;
+  if (!a) return;
+  const u = e[a], m2 = u.indexOf(" ");
+  if (-1 !== m2) {
+    const w2 = u.slice(0, m2 + 1), b2 = u.slice(m2 + 1);
+    b2.length > 8 ? e[a] = w2 + b2.slice(0, 4) + "*".repeat(b2.length - 8) + b2.slice(-4) : e[a] = w2 + "*".repeat(b2.length);
+  } else u.length > 8 ? e[a] = u.slice(0, 4) + "*".repeat(u.length - 8) + u.slice(-4) : e[a] = "*".repeat(u.length);
+}
 function trackDomainChangesOnce() {
   const e = window.__sailfish_recorder || (window.__sailfish_recorder = {});
   if (e.routeWatcherIntervalId) return;
@@ -7871,7 +7880,7 @@ function setupFetchInterceptor(e = []) {
       x2 = C2.href;
     }
     return shouldSkipHeadersPropagation(x2, e) ? a2.apply(m2, w2) : (async function injectHeaderWrapper(e2, a3, u2, m3, w3, x3, C3) {
-      var _a2, _b, _c2;
+      var _a2, _b;
       if (!x3) return e2.apply(a3, u2);
       let I3 = v4();
       const E2 = getUrlAndStoredUuids(), _2 = w3.method || "GET", O2 = Date.now();
@@ -7896,8 +7905,11 @@ function setupFetchInterceptor(e = []) {
         bd && console.warn("[Sailfish] Failed to capture request data:", e3);
       }
       delete D2[b];
-      const $2 = (_a2 = getFuncSpanHeader()) == null ? void 0 : _a2.name;
-      $2 && delete D2[$2];
+      const $2 = getFuncSpanHeader();
+      $2 && delete D2[$2.name];
+      const B2 = `${x3}/${E2.page_visit_uuid}/${I3}`;
+      D2[b] = B2, $2 && (D2[$2.name] = $2.value);
+      maskAuthorizationHeader(D2);
       try {
         let $3 = await (async function injectHeader(e3, a4, u3, m4, w4, x4, C4) {
           const I4 = getFuncSpanHeader();
@@ -7911,8 +7923,8 @@ function setupFetchInterceptor(e = []) {
             const E3 = { ...m4 }, _3 = new Headers(m4.headers || {});
             return _3.set(b, `${w4}/${x4}/${C4}`), I4 && (_3.set(I4.name, I4.value), bd && console.log("[Sailfish] Added funcspan header to HTTP fetch:", { url: "string" == typeof u3 ? u3 : u3.href, header: I4.name })), E3.headers = _3, await e3.call(a4, u3, E3);
           }
-        })(e2, a3, m3, w3, x3, E2.page_visit_uuid, I3), B2 = false;
-        kd.includes($3.status) && (bd && console.log("Perform retry as status was fail:", $3), I3 = v4(), $3 = await (async function retryWithoutPropagateHeaders(e3, a4, u3, m4) {
+        })(e2, a3, m3, w3, x3, E2.page_visit_uuid, I3), B3 = false;
+        kd.includes($3.status) && (bd && console.log("Perform retry as status was fail:", $3), delete D2[b], $3 = await (async function retryWithoutPropagateHeaders(e3, a4, u3, m4) {
           try {
             let m5 = u3[0], w4 = u3[1] || {};
             if ("string" == typeof m5 || m5 instanceof URL) {
@@ -7930,7 +7942,7 @@ function setupFetchInterceptor(e = []) {
           } catch (e4) {
             throw bd && console.log(`Retry without ${b} for ${m4} also failed:`, e4), e4;
           }
-        })(e2, a3, u2, C3), B2 = true);
+        })(e2, a3, u2, C3), B3 = true);
         const U2 = Date.now(), j2 = $3.status, z2 = $3.ok, q2 = z2 ? "" : `Request Error: ${$3.statusText}`;
         let V2;
         try {
@@ -7947,11 +7959,11 @@ function setupFetchInterceptor(e = []) {
         } catch (e3) {
           bd && console.warn("[Sailfish] Failed to capture response headers:", e3), H2 = null;
         }
-        return sendEvent({ type: 27, timestamp: U2, sessionId: x3, data: { request_id: I3, session_id: x3, timestamp_start: O2, timestamp_end: U2, response_code: j2, success: z2, error: q2, method: _2, url: C3, retry_without_trace_id: B2, request_headers: D2, request_body: F2, response_headers: H2, response_body: V2 }, ...E2 }), $3;
+        return sendEvent({ type: 27, timestamp: U2, sessionId: x3, data: { request_id: I3, session_id: x3, timestamp_start: O2, timestamp_end: U2, response_code: j2, success: z2, error: q2, method: _2, url: C3, retry_without_trace_id: B3, request_headers: D2, request_body: F2, response_headers: H2, response_body: V2 }, ...E2 }), $3;
       } catch (m4) {
-        const w4 = Date.now(), b2 = false, $3 = ((_b = m4.response) == null ? void 0 : _b.status) || 500, B2 = m4.message || "Fetch request failed";
-        if (m4 instanceof TypeError && ((_c2 = m4 == null ? void 0 : m4.message) == null ? void 0 : _c2.toLowerCase().includes(xd.toLowerCase()))) return e2.apply(a3, u2);
-        throw sendEvent({ type: 27, timestamp: w4, sessionId: x3, data: { request_id: I3, session_id: x3, timestamp_start: O2, timestamp_end: w4, response_code: $3, success: b2, error: B2, method: _2, url: C3, request_headers: D2, request_body: F2, response_body: null }, ...E2 }), m4;
+        const w4 = Date.now(), b2 = false, $3 = ((_a2 = m4.response) == null ? void 0 : _a2.status) || 500, B3 = m4.message || "Fetch request failed";
+        if (m4 instanceof TypeError && ((_b = m4 == null ? void 0 : m4.message) == null ? void 0 : _b.toLowerCase().includes(xd.toLowerCase()))) return e2.apply(a3, u2);
+        throw sendEvent({ type: 27, timestamp: w4, sessionId: x3, data: { request_id: I3, session_id: x3, timestamp_start: O2, timestamp_end: w4, response_code: $3, success: b2, error: B3, method: _2, url: C3, request_headers: D2, request_body: F2, response_body: null }, ...E2 }), m4;
       }
     })(a2, m2, w2, C2, I2, u, x2);
   } });
@@ -7984,7 +7996,7 @@ async function startRecording({ apiKey: e, backendApi: a = "https://api-service.
   })(), D2 = getOrSetSessionId(), $2 = window.__sailfish_recorder || (window.__sailfish_recorder = {});
   if ($2.sessionId = D2, $2.apiKey = e, $2.backendApi = a, $2.serviceAdditionalMetadata = I2, $2.initialized && $2.sessionId === D2 && $2.ws && 1 === $2.ws.readyState) trackDomainChangesOnce();
   else {
-    $2.domEventsInit || (initializeDomContentEvents(D2), $2.domEventsInit = true), $2.consoleInit || (initializeConsolePlugin(Id, D2), $2.consoleInit = true), $2.errorInit || (!(function initializeErrorInterceptor() {
+    $2.domEventsInit || (initializeDomContentEvents(D2), $2.domEventsInit = true), $2.consoleInit || (initializeConsolePlugin(Ed, D2), $2.consoleInit = true), $2.errorInit || (!(function initializeErrorInterceptor() {
       window.addEventListener("error", (e2) => {
         captureError(e2.error || e2.message);
       }), window.addEventListener("unhandledrejection", (e2) => {
@@ -8022,7 +8034,7 @@ async function startRecording({ apiKey: e, backendApi: a = "https://api-service.
         const _3 = Date.now();
         let O3 = false;
         const F3 = a3[0], D3 = { ...this._capturedRequestHeaders };
-        delete D3[b], E3 && delete D3[E3.name];
+        maskAuthorizationHeader(D3);
         const emitFinished = (e3, a4, u3, b2, x4) => {
           if (O3) return;
           O3 = true;
@@ -8061,7 +8073,7 @@ async function startRecording({ apiKey: e, backendApi: a = "https://api-service.
       sendMessage({ type: "deviceInfo", data: { deviceInfo: { language: navigator.language, userAgent: navigator.userAgent } } });
     })();
     try {
-      const u2 = await fetchCaptureSettings(e, a), m3 = ((_a2 = u2.data) == null ? void 0 : _a2.captureSettingsFromApiKey) || Cd;
+      const u2 = await fetchCaptureSettings(e, a), m3 = ((_a2 = u2.data) == null ? void 0 : _a2.captureSettingsFromApiKey) || Md;
       if ($2.ws && 1 === $2.ws.readyState) return;
       const b2 = withAppUrlMetadata(I2), C3 = await startRecordingSession(e, D2, a, _2, O2, F2, E2, "JS/TS", b2);
       if ((_b = C3.data) == null ? void 0 : _b.startRecordingSession) {
@@ -8105,7 +8117,7 @@ H && (!(function sendUserDeviceUuid() {
 }), H && window.addEventListener("beforeunload", () => {
   clearPageVisitDataFromSessionStorage();
 });
-exports.DEFAULT_CAPTURE_SETTINGS = Cd, exports.DEFAULT_CONSOLE_RECORDING_SETTINGS = Id, exports.STORAGE_VERSION = 1, exports.addOrUpdateMetadata = function addOrUpdateMetadata(e) {
+exports.DEFAULT_CAPTURE_SETTINGS = Md, exports.DEFAULT_CONSOLE_RECORDING_SETTINGS = Ed, exports.STORAGE_VERSION = 1, exports.addOrUpdateMetadata = function addOrUpdateMetadata(e) {
   const a = { type: "addOrUpdateMetadata", metadata: e };
   Sd && JSON.stringify(Sd) === JSON.stringify(e) || (Sd = e, sendMessage(a));
 }, exports.buildBatches = buildBatches, exports.clearStaleFuncSpanState = clearStaleFuncSpanState, exports.createTriageAndIssueFromRecorder = createTriageAndIssueFromRecorder, exports.createTriageFromRecorder = createTriageFromRecorder, exports.disableFunctionSpanTracking = disableFunctionSpanTracking, exports.enableFunctionSpanTracking = enableFunctionSpanTracking, exports.eventSize = eventSize, exports.fetchCaptureSettings = fetchCaptureSettings, exports.fetchEngineeringTicketPlatformIntegrations = fetchEngineeringTicketPlatformIntegrations, exports.fetchFunctionSpanTrackingEnabled = fetchFunctionSpanTrackingEnabled, exports.flushBufferedEvents = flushBufferedEvents, exports.getFuncSpanHeader = getFuncSpanHeader, exports.getOrSetSessionId = getOrSetSessionId, exports.getUrlAndStoredUuids = getUrlAndStoredUuids, exports.identify = function identify(e, a = {}, u = false) {

package/dist/recorder.js

@@ -465,7 +465,7 @@ function initializeWebSocket(e, a, u, m2) {
     const a2 = document.createElement("a");
     return a2.href = e2, `${a2.hostname}${a2.port ? `:${a2.port}` : ""}`;
   })(e);
-  let b2 = `${"https:" === new URL(e).protocol ? "wss" : "ws"}://${w2}/ws/notify/?apiKey=${a}&sessionId=${u}&sender=JS%2FTS&version=1.8.21`;
+  let b2 = `${"https:" === new URL(e).protocol ? "wss" : "ws"}://${w2}/ws/notify/?apiKey=${a}&sessionId=${u}&sender=JS%2FTS&version=1.8.22`;
   m2 && (b2 += `&envValue=${encodeURIComponent(m2)}`);
   return se = new U(b2, [], { connectionTimeout: 3e4 }), se.addEventListener("open", () => {
     re && (console.log("[Sailfish] WebSocket connection opened"), console.log("[Sailfish] Function span tracking state: " + (de ? "ENABLED" : "DISABLED"))), (async () => {
@@ -1490,7 +1490,7 @@ function renderDynamicFields(e, a) {
   })();
   if (!m2 || 0 === m2.length) return void (u.innerHTML = "");
   const b2 = m2.map((e2) => (function renderDynamicField(e3, a2, u2 = []) {
-    var _a2, _b, _c2, _d;
+    var _a2, _b, _c2, _d2;
     const m3 = e3.fieldId || e3.key, w3 = e3.name, b3 = (_a2 = e3.schema) == null ? void 0 : _a2.type, C2 = (_b = e3.schema) == null ? void 0 : _b.system, x2 = (_c2 = e3.schema) == null ? void 0 : _c2.custom, I2 = e3.required || false, E2 = e3.allowedValues, _2 = ["summary", "description", "project", "issuetype", "priority"];
     if (_2.includes(m3) || _2.includes(C2)) return null;
     const O2 = I2 ? '<span style="color:#ef4444;">*</span>' : "", F2 = "width:100%; padding:8px 12px; font-size:14px; border:1px solid #cbd5e1; border-radius:6px; outline:none;";
@@ -1635,7 +1635,7 @@ function renderDynamicFields(e, a) {
         </div>
       `;
       default:
-        return ((_d = e3.operations) == null ? void 0 : _d.includes("set")) ? `
+        return ((_d2 = e3.operations) == null ? void 0 : _d2.includes("set")) ? `
           <div>
             <label for="${m3}" style="display:block; font-size:14px; font-weight:500; margin-bottom:6px;">
               ${w3} ${O2}
@@ -7805,7 +7805,16 @@ function addOrUpdateMetadata(e) {
 function trackingEvent(e) {
   sendMessage({ type: "trackingEvent", trackingData: e, timestamp: ne() });
 }
-const vd = readDebugFlag(), kd = ["t.co", "*.twitter.com", "*.gravatar.com", "*.googleapis.com", "*.amazonaws.com", "*.smooch.io", "*.zendesk.com", "*.zdassets.com"], Cd = [400, 403], xd = "CORS", Id = 1, Md = { recordCanvas: false, recordCrossOriginIframes: false, collectFonts: false, inlineImages: false, recordPassword: false, recordRealName: true, recordCreditCardInfo: false, recordSsn: false, recordDob: false, sampling: {} }, Ed = { level: ["info", "log", "warn", "error"], lengthThreshold: 1e4, stringifyOptions: { stringLengthLimit: 1e3, numOfKeysLimit: 20, depthOfLimit: 4 }, logger: "console" };
+const vd = readDebugFlag(), kd = ["t.co", "*.twitter.com", "*.gravatar.com", "*.googleapis.com", "*.amazonaws.com", "*.smooch.io", "*.zendesk.com", "*.zdassets.com"], Cd = [400, 403], xd = "CORS", Id = 1, Md = "authorization", Ed = "Authorization", _d = { recordCanvas: false, recordCrossOriginIframes: false, collectFonts: false, inlineImages: false, recordPassword: false, recordRealName: true, recordCreditCardInfo: false, recordSsn: false, recordDob: false, sampling: {} }, Od = { level: ["info", "log", "warn", "error"], lengthThreshold: 1e4, stringifyOptions: { stringLengthLimit: 1e3, numOfKeysLimit: 20, depthOfLimit: 4 }, logger: "console" };
+function maskAuthorizationHeader(e) {
+  const a = e[Md] ? Md : e[Ed] ? Ed : null;
+  if (!a) return;
+  const u = e[a], m2 = u.indexOf(" ");
+  if (-1 !== m2) {
+    const w2 = u.slice(0, m2 + 1), b2 = u.slice(m2 + 1);
+    b2.length > 8 ? e[a] = w2 + b2.slice(0, 4) + "*".repeat(b2.length - 8) + b2.slice(-4) : e[a] = w2 + "*".repeat(b2.length);
+  } else u.length > 8 ? e[a] = u.slice(0, 4) + "*".repeat(u.length - 8) + u.slice(-4) : e[a] = "*".repeat(u.length);
+}
 function trackDomainChangesOnce() {
   const e = window.__sailfish_recorder || (window.__sailfish_recorder = {});
   if (e.routeWatcherIntervalId) return;
@@ -7885,7 +7894,7 @@ function setupFetchInterceptor(e = []) {
       C2 = x2.href;
     }
     return shouldSkipHeadersPropagation(C2, e) ? a2.apply(m2, w2) : (async function injectHeaderWrapper(e2, a3, u2, m3, w3, C3, x3) {
-      var _a2, _b, _c2;
+      var _a2, _b;
       if (!C3) return e2.apply(a3, u2);
       let I3 = v4();
       const E2 = getUrlAndStoredUuids(), _2 = w3.method || "GET", O2 = Date.now();
@@ -7910,8 +7919,11 @@ function setupFetchInterceptor(e = []) {
         vd && console.warn("[Sailfish] Failed to capture request data:", e3);
       }
       delete D2[b];
-      const $2 = (_a2 = getFuncSpanHeader()) == null ? void 0 : _a2.name;
-      $2 && delete D2[$2];
+      const $2 = getFuncSpanHeader();
+      $2 && delete D2[$2.name];
+      const B2 = `${C3}/${E2.page_visit_uuid}/${I3}`;
+      D2[b] = B2, $2 && (D2[$2.name] = $2.value);
+      maskAuthorizationHeader(D2);
       try {
         let $3 = await (async function injectHeader(e3, a4, u3, m4, w4, C4, x4) {
           const I4 = getFuncSpanHeader();
@@ -7925,8 +7937,8 @@ function setupFetchInterceptor(e = []) {
             const E3 = { ...m4 }, _3 = new Headers(m4.headers || {});
             return _3.set(b, `${w4}/${C4}/${x4}`), I4 && (_3.set(I4.name, I4.value), vd && console.log("[Sailfish] Added funcspan header to HTTP fetch:", { url: "string" == typeof u3 ? u3 : u3.href, header: I4.name })), E3.headers = _3, await e3.call(a4, u3, E3);
           }
-        })(e2, a3, m3, w3, C3, E2.page_visit_uuid, I3), B2 = false;
-        Cd.includes($3.status) && (vd && console.log("Perform retry as status was fail:", $3), I3 = v4(), $3 = await (async function retryWithoutPropagateHeaders(e3, a4, u3, m4) {
+        })(e2, a3, m3, w3, C3, E2.page_visit_uuid, I3), B3 = false;
+        Cd.includes($3.status) && (vd && console.log("Perform retry as status was fail:", $3), delete D2[b], $3 = await (async function retryWithoutPropagateHeaders(e3, a4, u3, m4) {
           try {
             let m5 = u3[0], w4 = u3[1] || {};
             if ("string" == typeof m5 || m5 instanceof URL) {
@@ -7944,7 +7956,7 @@ function setupFetchInterceptor(e = []) {
           } catch (e4) {
             throw vd && console.log(`Retry without ${b} for ${m4} also failed:`, e4), e4;
           }
-        })(e2, a3, u2, x3), B2 = true);
+        })(e2, a3, u2, x3), B3 = true);
         const U2 = Date.now(), j2 = $3.status, z2 = $3.ok, q2 = z2 ? "" : `Request Error: ${$3.statusText}`;
         let V2;
         try {
@@ -7961,11 +7973,11 @@ function setupFetchInterceptor(e = []) {
         } catch (e3) {
           vd && console.warn("[Sailfish] Failed to capture response headers:", e3), H2 = null;
         }
-        return sendEvent({ type: 27, timestamp: U2, sessionId: C3, data: { request_id: I3, session_id: C3, timestamp_start: O2, timestamp_end: U2, response_code: j2, success: z2, error: q2, method: _2, url: x3, retry_without_trace_id: B2, request_headers: D2, request_body: F2, response_headers: H2, response_body: V2 }, ...E2 }), $3;
+        return sendEvent({ type: 27, timestamp: U2, sessionId: C3, data: { request_id: I3, session_id: C3, timestamp_start: O2, timestamp_end: U2, response_code: j2, success: z2, error: q2, method: _2, url: x3, retry_without_trace_id: B3, request_headers: D2, request_body: F2, response_headers: H2, response_body: V2 }, ...E2 }), $3;
       } catch (m4) {
-        const w4 = Date.now(), b2 = false, $3 = ((_b = m4.response) == null ? void 0 : _b.status) || 500, B2 = m4.message || "Fetch request failed";
-        if (m4 instanceof TypeError && ((_c2 = m4 == null ? void 0 : m4.message) == null ? void 0 : _c2.toLowerCase().includes(xd.toLowerCase()))) return e2.apply(a3, u2);
-        throw sendEvent({ type: 27, timestamp: w4, sessionId: C3, data: { request_id: I3, session_id: C3, timestamp_start: O2, timestamp_end: w4, response_code: $3, success: b2, error: B2, method: _2, url: x3, request_headers: D2, request_body: F2, response_body: null }, ...E2 }), m4;
+        const w4 = Date.now(), b2 = false, $3 = ((_a2 = m4.response) == null ? void 0 : _a2.status) || 500, B3 = m4.message || "Fetch request failed";
+        if (m4 instanceof TypeError && ((_b = m4 == null ? void 0 : m4.message) == null ? void 0 : _b.toLowerCase().includes(xd.toLowerCase()))) return e2.apply(a3, u2);
+        throw sendEvent({ type: 27, timestamp: w4, sessionId: C3, data: { request_id: I3, session_id: C3, timestamp_start: O2, timestamp_end: w4, response_code: $3, success: b2, error: B3, method: _2, url: x3, request_headers: D2, request_body: F2, response_body: null }, ...E2 }), m4;
       }
     })(a2, m2, w2, x2, I2, u, C2);
   } });
@@ -7998,7 +8010,7 @@ async function startRecording({ apiKey: e, backendApi: a = "https://api-service.
   })(), D2 = getOrSetSessionId(), $2 = window.__sailfish_recorder || (window.__sailfish_recorder = {});
   if ($2.sessionId = D2, $2.apiKey = e, $2.backendApi = a, $2.serviceAdditionalMetadata = I2, $2.initialized && $2.sessionId === D2 && $2.ws && 1 === $2.ws.readyState) trackDomainChangesOnce();
   else {
-    $2.domEventsInit || (initializeDomContentEvents(D2), $2.domEventsInit = true), $2.consoleInit || (initializeConsolePlugin(Ed, D2), $2.consoleInit = true), $2.errorInit || (!(function initializeErrorInterceptor() {
+    $2.domEventsInit || (initializeDomContentEvents(D2), $2.domEventsInit = true), $2.consoleInit || (initializeConsolePlugin(Od, D2), $2.consoleInit = true), $2.errorInit || (!(function initializeErrorInterceptor() {
       window.addEventListener("error", (e2) => {
         captureError(e2.error || e2.message);
       }), window.addEventListener("unhandledrejection", (e2) => {
@@ -8036,7 +8048,7 @@ async function startRecording({ apiKey: e, backendApi: a = "https://api-service.
         const _3 = Date.now();
         let O3 = false;
         const F3 = a3[0], D3 = { ...this._capturedRequestHeaders };
-        delete D3[b], E3 && delete D3[E3.name];
+        maskAuthorizationHeader(D3);
         const emitFinished = (e3, a4, u3, b2, C4) => {
           if (O3) return;
           O3 = true;
@@ -8075,7 +8087,7 @@ async function startRecording({ apiKey: e, backendApi: a = "https://api-service.
       sendMessage({ type: "deviceInfo", data: { deviceInfo: { language: navigator.language, userAgent: navigator.userAgent } } });
     })();
     try {
-      const u2 = await fetchCaptureSettings(e, a), m3 = ((_a2 = u2.data) == null ? void 0 : _a2.captureSettingsFromApiKey) || Md;
+      const u2 = await fetchCaptureSettings(e, a), m3 = ((_a2 = u2.data) == null ? void 0 : _a2.captureSettingsFromApiKey) || _d;
       if ($2.ws && 1 === $2.ws.readyState) return;
       const b2 = withAppUrlMetadata(I2), x3 = await startRecordingSession(e, D2, a, _2, O2, F2, E2, "JS/TS", b2);
       if ((_b = x3.data) == null ? void 0 : _b.startRecordingSession) {
@@ -8138,8 +8150,8 @@ const initRecorder = async (e) => {
   })), a.initPromise);
 };
 export {
-  Md as DEFAULT_CAPTURE_SETTINGS,
-  Ed as DEFAULT_CONSOLE_RECORDING_SETTINGS,
+  _d as DEFAULT_CAPTURE_SETTINGS,
+  Od as DEFAULT_CONSOLE_RECORDING_SETTINGS,
   Id as STORAGE_VERSION,
   addOrUpdateMetadata,
   buildBatches,

package/dist/recorder.umd.cjs

@@ -467,7 +467,7 @@
       const a3 = document.createElement("a");
       return a3.href = e3, `${a3.hostname}${a3.port ? `:${a3.port}` : ""}`;
     })(e2);
-    let b2 = `${"https:" === new URL(e2).protocol ? "wss" : "ws"}://${w2}/ws/notify/?apiKey=${a2}&sessionId=${u2}&sender=JS%2FTS&version=1.8.21`;
+    let b2 = `${"https:" === new URL(e2).protocol ? "wss" : "ws"}://${w2}/ws/notify/?apiKey=${a2}&sessionId=${u2}&sender=JS%2FTS&version=1.8.22`;
     m2 && (b2 += `&envValue=${encodeURIComponent(m2)}`);
     return se = new j(b2, [], { connectionTimeout: 3e4 }), se.addEventListener("open", () => {
       re && (console.log("[Sailfish] WebSocket connection opened"), console.log("[Sailfish] Function span tracking state: " + (de ? "ENABLED" : "DISABLED"))), (async () => {
@@ -1492,7 +1492,7 @@
     })();
     if (!m2 || 0 === m2.length) return void (u2.innerHTML = "");
     const b2 = m2.map((e3) => (function renderDynamicField(e4, a3, u3 = []) {
-      var _a2, _b, _c2, _d;
+      var _a2, _b, _c2, _d2;
       const m3 = e4.fieldId || e4.key, w3 = e4.name, b3 = (_a2 = e4.schema) == null ? void 0 : _a2.type, C2 = (_b = e4.schema) == null ? void 0 : _b.system, x2 = (_c2 = e4.schema) == null ? void 0 : _c2.custom, I2 = e4.required || false, E2 = e4.allowedValues, _2 = ["summary", "description", "project", "issuetype", "priority"];
       if (_2.includes(m3) || _2.includes(C2)) return null;
       const O2 = I2 ? '<span style="color:#ef4444;">*</span>' : "", F2 = "width:100%; padding:8px 12px; font-size:14px; border:1px solid #cbd5e1; border-radius:6px; outline:none;";
@@ -1637,7 +1637,7 @@
         </div>
       `;
         default:
-          return ((_d = e4.operations) == null ? void 0 : _d.includes("set")) ? `
+          return ((_d2 = e4.operations) == null ? void 0 : _d2.includes("set")) ? `
           <div>
             <label for="${m3}" style="display:block; font-size:14px; font-weight:500; margin-bottom:6px;">
               ${w3} ${O2}
@@ -7793,7 +7793,16 @@
     return b2;
   }
   let bd = null, Sd = null;
-  const vd = readDebugFlag(), kd = ["t.co", "*.twitter.com", "*.gravatar.com", "*.googleapis.com", "*.amazonaws.com", "*.smooch.io", "*.zendesk.com", "*.zdassets.com"], Cd = [400, 403], xd = "CORS", Id = { recordCanvas: false, recordCrossOriginIframes: false, collectFonts: false, inlineImages: false, recordPassword: false, recordRealName: true, recordCreditCardInfo: false, recordSsn: false, recordDob: false, sampling: {} }, Md = { level: ["info", "log", "warn", "error"], lengthThreshold: 1e4, stringifyOptions: { stringLengthLimit: 1e3, numOfKeysLimit: 20, depthOfLimit: 4 }, logger: "console" };
+  const vd = readDebugFlag(), kd = ["t.co", "*.twitter.com", "*.gravatar.com", "*.googleapis.com", "*.amazonaws.com", "*.smooch.io", "*.zendesk.com", "*.zdassets.com"], Cd = [400, 403], xd = "CORS", Id = "authorization", Md = "Authorization", Ed = { recordCanvas: false, recordCrossOriginIframes: false, collectFonts: false, inlineImages: false, recordPassword: false, recordRealName: true, recordCreditCardInfo: false, recordSsn: false, recordDob: false, sampling: {} }, _d = { level: ["info", "log", "warn", "error"], lengthThreshold: 1e4, stringifyOptions: { stringLengthLimit: 1e3, numOfKeysLimit: 20, depthOfLimit: 4 }, logger: "console" };
+  function maskAuthorizationHeader(e2) {
+    const a2 = e2[Id] ? Id : e2[Md] ? Md : null;
+    if (!a2) return;
+    const u2 = e2[a2], m2 = u2.indexOf(" ");
+    if (-1 !== m2) {
+      const w2 = u2.slice(0, m2 + 1), b2 = u2.slice(m2 + 1);
+      b2.length > 8 ? e2[a2] = w2 + b2.slice(0, 4) + "*".repeat(b2.length - 8) + b2.slice(-4) : e2[a2] = w2 + "*".repeat(b2.length);
+    } else u2.length > 8 ? e2[a2] = u2.slice(0, 4) + "*".repeat(u2.length - 8) + u2.slice(-4) : e2[a2] = "*".repeat(u2.length);
+  }
   function trackDomainChangesOnce() {
     const e2 = window.__sailfish_recorder || (window.__sailfish_recorder = {});
     if (e2.routeWatcherIntervalId) return;
@@ -7873,7 +7882,7 @@
         b2 = x2.href;
       }
       return shouldSkipHeadersPropagation(b2, e2) ? a3.apply(m2, w2) : (async function injectHeaderWrapper(e3, a4, u3, m3, w3, b3, x3) {
-        var _a2, _b, _c2;
+        var _a2, _b;
         if (!b3) return e3.apply(a4, u3);
         let I3 = v4();
         const E2 = getUrlAndStoredUuids(), _2 = w3.method || "GET", O2 = Date.now();
@@ -7898,8 +7907,11 @@
           vd && console.warn("[Sailfish] Failed to capture request data:", e4);
         }
         delete D2[C];
-        const $2 = (_a2 = getFuncSpanHeader()) == null ? void 0 : _a2.name;
-        $2 && delete D2[$2];
+        const $2 = getFuncSpanHeader();
+        $2 && delete D2[$2.name];
+        const B2 = `${b3}/${E2.page_visit_uuid}/${I3}`;
+        D2[C] = B2, $2 && (D2[$2.name] = $2.value);
+        maskAuthorizationHeader(D2);
         try {
           let $3 = await (async function injectHeader(e4, a5, u4, m4, w4, b4, x4) {
             const I4 = getFuncSpanHeader();
@@ -7913,8 +7925,8 @@
               const E3 = { ...m4 }, _3 = new Headers(m4.headers || {});
               return _3.set(C, `${w4}/${b4}/${x4}`), I4 && (_3.set(I4.name, I4.value), vd && console.log("[Sailfish] Added funcspan header to HTTP fetch:", { url: "string" == typeof u4 ? u4 : u4.href, header: I4.name })), E3.headers = _3, await e4.call(a5, u4, E3);
             }
-          })(e3, a4, m3, w3, b3, E2.page_visit_uuid, I3), B2 = false;
-          Cd.includes($3.status) && (vd && console.log("Perform retry as status was fail:", $3), I3 = v4(), $3 = await (async function retryWithoutPropagateHeaders(e4, a5, u4, m4) {
+          })(e3, a4, m3, w3, b3, E2.page_visit_uuid, I3), B3 = false;
+          Cd.includes($3.status) && (vd && console.log("Perform retry as status was fail:", $3), delete D2[C], $3 = await (async function retryWithoutPropagateHeaders(e4, a5, u4, m4) {
             try {
               let m5 = u4[0], w4 = u4[1] || {};
               if ("string" == typeof m5 || m5 instanceof URL) {
@@ -7932,7 +7944,7 @@
             } catch (e5) {
               throw vd && console.log(`Retry without ${C} for ${m4} also failed:`, e5), e5;
             }
-          })(e3, a4, u3, x3), B2 = true);
+          })(e3, a4, u3, x3), B3 = true);
           const U2 = Date.now(), j2 = $3.status, z2 = $3.ok, q2 = z2 ? "" : `Request Error: ${$3.statusText}`;
           let V2;
           try {
@@ -7949,11 +7961,11 @@
           } catch (e4) {
             vd && console.warn("[Sailfish] Failed to capture response headers:", e4), H2 = null;
           }
-          return sendEvent({ type: 27, timestamp: U2, sessionId: b3, data: { request_id: I3, session_id: b3, timestamp_start: O2, timestamp_end: U2, response_code: j2, success: z2, error: q2, method: _2, url: x3, retry_without_trace_id: B2, request_headers: D2, request_body: F2, response_headers: H2, response_body: V2 }, ...E2 }), $3;
+          return sendEvent({ type: 27, timestamp: U2, sessionId: b3, data: { request_id: I3, session_id: b3, timestamp_start: O2, timestamp_end: U2, response_code: j2, success: z2, error: q2, method: _2, url: x3, retry_without_trace_id: B3, request_headers: D2, request_body: F2, response_headers: H2, response_body: V2 }, ...E2 }), $3;
         } catch (m4) {
-          const w4 = Date.now(), C2 = false, $3 = ((_b = m4.response) == null ? void 0 : _b.status) || 500, B2 = m4.message || "Fetch request failed";
-          if (m4 instanceof TypeError && ((_c2 = m4 == null ? void 0 : m4.message) == null ? void 0 : _c2.toLowerCase().includes(xd.toLowerCase()))) return e3.apply(a4, u3);
-          throw sendEvent({ type: 27, timestamp: w4, sessionId: b3, data: { request_id: I3, session_id: b3, timestamp_start: O2, timestamp_end: w4, response_code: $3, success: C2, error: B2, method: _2, url: x3, request_headers: D2, request_body: F2, response_body: null }, ...E2 }), m4;
+          const w4 = Date.now(), C2 = false, $3 = ((_a2 = m4.response) == null ? void 0 : _a2.status) || 500, B3 = m4.message || "Fetch request failed";
+          if (m4 instanceof TypeError && ((_b = m4 == null ? void 0 : m4.message) == null ? void 0 : _b.toLowerCase().includes(xd.toLowerCase()))) return e3.apply(a4, u3);
+          throw sendEvent({ type: 27, timestamp: w4, sessionId: b3, data: { request_id: I3, session_id: b3, timestamp_start: O2, timestamp_end: w4, response_code: $3, success: C2, error: B3, method: _2, url: x3, request_headers: D2, request_body: F2, response_body: null }, ...E2 }), m4;
         }
       })(a3, m2, w2, x2, I2, u2, b2);
     } });
@@ -7986,7 +7998,7 @@
     })(), D2 = getOrSetSessionId(), $2 = window.__sailfish_recorder || (window.__sailfish_recorder = {});
     if ($2.sessionId = D2, $2.apiKey = e2, $2.backendApi = a2, $2.serviceAdditionalMetadata = I2, $2.initialized && $2.sessionId === D2 && $2.ws && 1 === $2.ws.readyState) trackDomainChangesOnce();
     else {
-      $2.domEventsInit || (initializeDomContentEvents(D2), $2.domEventsInit = true), $2.consoleInit || (initializeConsolePlugin(Md, D2), $2.consoleInit = true), $2.errorInit || (!(function initializeErrorInterceptor() {
+      $2.domEventsInit || (initializeDomContentEvents(D2), $2.domEventsInit = true), $2.consoleInit || (initializeConsolePlugin(_d, D2), $2.consoleInit = true), $2.errorInit || (!(function initializeErrorInterceptor() {
         window.addEventListener("error", (e3) => {
           captureError(e3.error || e3.message);
         }), window.addEventListener("unhandledrejection", (e3) => {
@@ -8024,7 +8036,7 @@
           const _3 = Date.now();
           let O3 = false;
           const F3 = a4[0], D3 = { ...this._capturedRequestHeaders };
-          delete D3[C], E3 && delete D3[E3.name];
+          maskAuthorizationHeader(D3);
           const emitFinished = (e4, a5, u4, b4, C2) => {
             if (O3) return;
             O3 = true;
@@ -8063,7 +8075,7 @@
         sendMessage({ type: "deviceInfo", data: { deviceInfo: { language: navigator.language, userAgent: navigator.userAgent } } });
       })();
       try {
-        const u3 = await fetchCaptureSettings(e2, a2), m3 = ((_a2 = u3.data) == null ? void 0 : _a2.captureSettingsFromApiKey) || Id;
+        const u3 = await fetchCaptureSettings(e2, a2), m3 = ((_a2 = u3.data) == null ? void 0 : _a2.captureSettingsFromApiKey) || Ed;
         if ($2.ws && 1 === $2.ws.readyState) return;
         const C2 = withAppUrlMetadata(I2), x3 = await startRecordingSession(e2, D2, a2, _2, O2, F2, E2, "JS/TS", C2);
         if ((_b = x3.data) == null ? void 0 : _b.startRecordingSession) {
@@ -8107,7 +8119,7 @@
   }), J && window.addEventListener("beforeunload", () => {
     clearPageVisitDataFromSessionStorage();
   });
-  e.DEFAULT_CAPTURE_SETTINGS = Id, e.DEFAULT_CONSOLE_RECORDING_SETTINGS = Md, e.STORAGE_VERSION = 1, e.addOrUpdateMetadata = function addOrUpdateMetadata(e2) {
+  e.DEFAULT_CAPTURE_SETTINGS = Ed, e.DEFAULT_CONSOLE_RECORDING_SETTINGS = _d, e.STORAGE_VERSION = 1, e.addOrUpdateMetadata = function addOrUpdateMetadata(e2) {
     const a2 = { type: "addOrUpdateMetadata", metadata: e2 };
     Sd && JSON.stringify(Sd) === JSON.stringify(e2) || (Sd = e2, sendMessage(a2));
   }, e.buildBatches = buildBatches, e.clearStaleFuncSpanState = clearStaleFuncSpanState, e.createTriageAndIssueFromRecorder = createTriageAndIssueFromRecorder, e.createTriageFromRecorder = createTriageFromRecorder, e.disableFunctionSpanTracking = disableFunctionSpanTracking, e.enableFunctionSpanTracking = enableFunctionSpanTracking, e.eventSize = eventSize, e.fetchCaptureSettings = fetchCaptureSettings, e.fetchEngineeringTicketPlatformIntegrations = fetchEngineeringTicketPlatformIntegrations, e.fetchFunctionSpanTrackingEnabled = fetchFunctionSpanTrackingEnabled, e.flushBufferedEvents = flushBufferedEvents, e.getFuncSpanHeader = getFuncSpanHeader, e.getOrSetSessionId = getOrSetSessionId, e.getUrlAndStoredUuids = getUrlAndStoredUuids, e.identify = function identify(e2, a2 = {}, u2 = false) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sailfish-ai/recorder",
-  "version": "1.8.21",
+  "version": "1.8.22",
   "publishPublicly": true,
   "type": "module",
   "main": "dist/recorder.cjs",