@spotify-confidence/csr-common 0.18.9 → 0.18.11

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [0.18.11](https://github.com/spotify/confidence-sdk-js/compare/csr-common-v0.18.10...csr-common-v0.18.11) (2026-09-11)
+
+
+### ✨ New Features
+
+* **csr:** authenticate recording WebSockets with subprotocols ([#455](https://github.com/spotify/confidence-sdk-js/issues/455)) ([250342f](https://github.com/spotify/confidence-sdk-js/commit/250342f015a70ba12e92ff9725d3c48180047786))
+* **csr:** log version drift between SDK and worker ([#415](https://github.com/spotify/confidence-sdk-js/issues/415)) ([4ce14ee](https://github.com/spotify/confidence-sdk-js/commit/4ce14eee2704fef6e514b1b5a3b1976705ea22ba))
+
+## [0.18.10](https://github.com/spotify/confidence-sdk-js/compare/csr-common-v0.18.9...csr-common-v0.18.10) (2026-09-09)
+
+
+### 🐛 Bug Fixes
+
+* strip query and hash from recording URLs ([#452](https://github.com/spotify/confidence-sdk-js/issues/452)) ([1ce37f3](https://github.com/spotify/confidence-sdk-js/commit/1ce37f3f43c05bfea4a90839a6de42314096bb40))
+
 ## [0.18.9](https://github.com/spotify/confidence-sdk-js/compare/csr-common-v0.18.8...csr-common-v0.18.9) (2026-09-07)
 
 

package/dist/confidence-worker.js

@@ -1,3 +1,4 @@
+globalThis.__WORKER_HASH__ = '1774b236fa1eb46a';
 //#region src/uploader/worker/web-socket-transport.ts
 /**
 * WebSocket-backed Transport. Internal retry policy: clean server-initiated close after the
@@ -19,8 +20,10 @@ var WebSocketTransport = class {
 	/** Frames buffered while a (re)connect is in progress. */
 	pending = [];
 	readyPromise;
-	constructor(url) {
+	protocols;
+	constructor(url, protocols = []) {
 		this.url = url;
+		this.protocols = [...protocols];
 		this.readyPromise = new Promise((resolve, reject) => {
 			this.connect(false, resolve, reject);
 		});
@@ -45,10 +48,22 @@ var WebSocketTransport = class {
 		this.onStateChangeCb = cb;
 	}
 	connect(isReconnect, onReady, onReadyFail) {
-		const ws = new WebSocket(this.url);
+		let ws;
+		try {
+			ws = new WebSocket(this.url, [...this.protocols]);
+		} catch (_error) {
+			this.failConnection(isReconnect, onReadyFail);
+			return;
+		}
 		this.ws = ws;
 		let opened = false;
 		ws.onopen = () => {
+			const expectedProtocol = this.protocols[0];
+			if (expectedProtocol !== void 0 && ws.protocol !== expectedProtocol) {
+				this.failConnection(isReconnect, onReadyFail);
+				ws.close(1e3, "protocol-mismatch");
+				return;
+			}
 			opened = true;
 			onReady?.();
 			if (isReconnect) this.onStateChangeCb?.({ connected: true });
@@ -58,13 +73,9 @@ var WebSocketTransport = class {
 			}
 		};
 		ws.onclose = (event) => {
-			if (this.intentionallyClosed) return;
+			if (this.intentionallyClosed || this.dead) return;
 			if (!opened) {
-				const reason = `${isReconnect ? "reconnect" : "initial"}-failed code=${event.code}`;
-				if (onReadyFail) {
-					onReadyFail(new Error(reason));
-					this.dead = true;
-				} else this.die(reason);
+				this.failConnection(isReconnect, onReadyFail);
 				return;
 			}
 			if (event.wasClean && (event.code === 1e3 || event.code === 1001)) {
@@ -73,12 +84,29 @@ var WebSocketTransport = class {
 			} else this.die(`close code=${event.code} wasClean=${event.wasClean}`);
 		};
 	}
+	failConnection(isReconnect, onReadyFail) {
+		const reason = isReconnect ? "reconnect-failed" : "initial-failed";
+		if (onReadyFail) {
+			this.dead = true;
+			onReadyFail(new Error(reason));
+		} else this.die(reason);
+	}
 	die(reason) {
 		this.dead = true;
 		this.onCloseCb?.({ reason });
 	}
 };
 //#endregion
+//#region src/uploader/worker/websocket-auth.ts
+const RECORDING_PROTOCOL = "recording.v1";
+const AUTH_PROTOCOL_PREFIX = "auth.";
+const MAX_TOKEN_LENGTH = 4096;
+function recordingProtocols(sessionToken) {
+	if (sessionToken.length > MAX_TOKEN_LENGTH) throw new Error("Session token is too long for WebSocket authentication");
+	if (!sessionToken || /[^A-Za-z0-9._-]/.test(sessionToken)) throw new Error("Invalid session token for WebSocket authentication");
+	return [RECORDING_PROTOCOL, `${AUTH_PROTOCOL_PREFIX}${sessionToken}`];
+}
+//#endregion
 //#region src/uploader/worker/csr-client.ts
 /**
 * Single Client implementation that talks to the recording backend's REST + WS protocol.
@@ -122,9 +150,16 @@ var CsrClient = class {
 	}
 	async openTransport(sessionToken) {
 		const wsBase = this.websocketUrl ?? `${this.toWsScheme(this.trimSlash(this.apiUrl))}/sessions/stream`;
-		const url = `${wsBase}${wsBase.includes("?") ? "&" : "?"}session_token=${encodeURIComponent(sessionToken)}`;
-		this.log(`WebSocket connect ${url.replace(/session_token=[^&]*/, "session_token=[REDACTED]")}`);
-		const transport = new WebSocketTransport(url);
+		let parsedUrl;
+		try {
+			parsedUrl = new URL(wsBase);
+		} catch (_error) {
+			throw new Error("Invalid WebSocket URL");
+		}
+		if (parsedUrl.searchParams.has("session_token")) throw new Error("WebSocket URL must not include a session token");
+		const protocols = recordingProtocols(sessionToken);
+		this.log(`WebSocket connect ${wsBase}`);
+		const transport = new WebSocketTransport(wsBase, protocols);
 		await transport.ready();
 		return transport;
 	}
@@ -139,6 +174,7 @@ var CsrClient = class {
 };
 //#endregion
 //#region src/uploader/worker/core.ts
+const WORKER_HASH = globalThis.__WORKER_HASH__;
 const IDLE_GRACE_MS = 5e3;
 let state = { phase: "init" };
 const ports = [];
@@ -231,7 +267,7 @@ function onHello(handle) {
 				websocketUrl: handle.hello.websocketUrl,
 				clientSecret: handle.hello.clientSecret
 			};
-			log(`hello received apiUrl=${handle.hello.apiUrl} websocketUrl=${handle.hello.websocketUrl ?? "(derive)"} sessionIdHint=${handle.hello.sessionIdHint ?? "(none)"}`);
+			log(`hello received apiUrl=${handle.hello.apiUrl} websocketUrl=${handle.hello.websocketUrl ? "(configured)" : "(derive)"} sessionIdHint=${handle.hello.sessionIdHint ?? "(none)"}`);
 			state = { phase: "initializing" };
 			initializeSession(handle.hello).then(flushPendingWelcomes);
 			return;
@@ -254,7 +290,8 @@ function onHello(handle) {
 			}
 			handle.port.postMessage({
 				type: "welcome",
-				result: { skipRecording: true }
+				result: { skipRecording: true },
+				workerHash: WORKER_HASH
 			});
 			return;
 		case "dead":
@@ -370,7 +407,8 @@ function flushPendingWelcomes() {
 		if (state.phase === "active") sendActiveWelcome(handle, state.sessionId, state.sessionToken);
 		else if (state.phase === "skipping") handle.port.postMessage({
 			type: "welcome",
-			result: { skipRecording: true }
+			result: { skipRecording: true },
+			workerHash: WORKER_HASH
 		});
 		else if (state.phase === "dead") handle.port.postMessage({
 			type: "dead",
@@ -388,6 +426,7 @@ function sendActiveWelcome(handle, currentSessionId, currentSessionToken) {
 			sessionId: currentSessionId,
 			sessionToken: currentSessionToken
 		},
+		workerHash: WORKER_HASH,
 		adoptedFromSessionId: adopted ? hint : void 0,
 		newTabId,
 		resetCounter: adopted || newTabId !== void 0

package/dist/index.cjs

@@ -1,18 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_session_activity = require("./session-activity-HfuXKqGd.cjs");
-//#region src/url.ts
-/**
-* Extract only the pathname from a URL, stripping origin, query string, and
-* hash. Used across recorder and analyzer to avoid capturing PII in route data.
-*/
-function stripUrl(url) {
-	try {
-		return new URL(url).pathname;
-	} catch (_e) {
-		return url;
-	}
-}
-//#endregion
+const require_session_activity = require("./session-activity-B8swR5Wg.cjs");
 //#region src/custom-event-limits.ts
 const MAX_KEY_LENGTH = 128;
 const MAX_TAG_VALUE_LENGTH = 256;
@@ -51,7 +38,8 @@ exports.SerializedNodeType = require_session_activity.SerializedNodeType;
 exports.isSessionActivityEvent = require_session_activity.isSessionActivityEvent;
 exports.isUserInteractionEvent = require_session_activity.isUserInteractionEvent;
 exports.isUserInteractionMetric = require_session_activity.isUserInteractionMetric;
-exports.stripUrl = stripUrl;
+exports.stripUrl = require_session_activity.stripUrl;
+exports.stripUrlQueryAndHash = require_session_activity.stripUrlQueryAndHash;
 exports.validateKey = validateKey;
 exports.validateMeasureValue = validateMeasureValue;
 exports.validateTagValue = validateTagValue;

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { i as ClientContext, n as Frame, o as UserAgentContext } from "./types-Bg0UKTVQ.cjs";
+import { i as ClientContext, n as Frame, o as UserAgentContext } from "./types-CdvFpcEN.cjs";
 
 //#region src/events.d.ts
 /**
@@ -370,6 +370,8 @@ type RecordingEvent = {
 };
 //#endregion
 //#region src/url.d.ts
+/** Remove query strings and fragments, including from relative or malformed URLs. */
+declare function stripUrlQueryAndHash(url: string): string;
 /**
 * Extract only the pathname from a URL, stripping origin, query string, and
 * hash. Used across recorder and analyzer to avoid capturing PII in route data.
@@ -407,4 +409,4 @@ declare function validateKey(key: string): string | null;
 declare function validateTagValue(value: string | undefined): string | null;
 declare function validateMeasureValue(value: number | undefined): string | null;
 //#endregion
-export { type AwayGapCustomData, type ClickCustomData, type ClientContext, type ClipboardAction, type ClipboardPluginData, type ConsoleLogLevel, type ConsoleLogPluginData, type CustomEventData, type DeadClickCustomData, type DialogOpenedCustomData, type ElementDescriptor, type ErrorMessageCustomData, type FlagEvaluationPluginData, type FormFieldReEditCustomData, type Frame, type GraphQLRequestMetadata, type IdleGapCustomData, type IncrementalSnapshotData, IncrementalSource, type InputCustomData, MAX_DISTINCT_KEYS, MAX_KEY_LENGTH, MAX_TAG_VALUE_LENGTH, MAX_VALUES_PER_KEY, type MeasurePluginData, type MouseInteractionData, MouseInteractions, type NetworkRequestInitiator, type NetworkRequestPluginData, type OpaqueIncrementalData, type PluginEventData, type RageClickCustomData, RecordingCustomEventTag, type RecordingEvent, RecordingEventType, RecordingMetricKey, RecordingPluginName, type RouteChangeCustomData, type RouteChangePayload, type RouteChangePluginData, type RouteChangeTrigger, type ScrollBackCustomData, type SelectionData, type SelectionRange, SerializedNodeType, type TabRefocusCustomData, type TabUnfocusCustomData, type TabVisibilityPluginData, type TagPluginData, type UserAgentContext, isSessionActivityEvent, isUserInteractionEvent, isUserInteractionMetric, stripUrl, validateKey, validateMeasureValue, validateTagValue };
+export { type AwayGapCustomData, type ClickCustomData, type ClientContext, type ClipboardAction, type ClipboardPluginData, type ConsoleLogLevel, type ConsoleLogPluginData, type CustomEventData, type DeadClickCustomData, type DialogOpenedCustomData, type ElementDescriptor, type ErrorMessageCustomData, type FlagEvaluationPluginData, type FormFieldReEditCustomData, type Frame, type GraphQLRequestMetadata, type IdleGapCustomData, type IncrementalSnapshotData, IncrementalSource, type InputCustomData, MAX_DISTINCT_KEYS, MAX_KEY_LENGTH, MAX_TAG_VALUE_LENGTH, MAX_VALUES_PER_KEY, type MeasurePluginData, type MouseInteractionData, MouseInteractions, type NetworkRequestInitiator, type NetworkRequestPluginData, type OpaqueIncrementalData, type PluginEventData, type RageClickCustomData, RecordingCustomEventTag, type RecordingEvent, RecordingEventType, RecordingMetricKey, RecordingPluginName, type RouteChangeCustomData, type RouteChangePayload, type RouteChangePluginData, type RouteChangeTrigger, type ScrollBackCustomData, type SelectionData, type SelectionRange, SerializedNodeType, type TabRefocusCustomData, type TabUnfocusCustomData, type TabVisibilityPluginData, type TagPluginData, type UserAgentContext, isSessionActivityEvent, isUserInteractionEvent, isUserInteractionMetric, stripUrl, stripUrlQueryAndHash, validateKey, validateMeasureValue, validateTagValue };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { i as ClientContext, n as Frame, o as UserAgentContext } from "./types-Bg0UKTVQ.js";
+import { i as ClientContext, n as Frame, o as UserAgentContext } from "./types-CdvFpcEN.js";
 
 //#region src/events.d.ts
 /**
@@ -370,6 +370,8 @@ type RecordingEvent = {
 };
 //#endregion
 //#region src/url.d.ts
+/** Remove query strings and fragments, including from relative or malformed URLs. */
+declare function stripUrlQueryAndHash(url: string): string;
 /**
 * Extract only the pathname from a URL, stripping origin, query string, and
 * hash. Used across recorder and analyzer to avoid capturing PII in route data.
@@ -407,4 +409,4 @@ declare function validateKey(key: string): string | null;
 declare function validateTagValue(value: string | undefined): string | null;
 declare function validateMeasureValue(value: number | undefined): string | null;
 //#endregion
-export { type AwayGapCustomData, type ClickCustomData, type ClientContext, type ClipboardAction, type ClipboardPluginData, type ConsoleLogLevel, type ConsoleLogPluginData, type CustomEventData, type DeadClickCustomData, type DialogOpenedCustomData, type ElementDescriptor, type ErrorMessageCustomData, type FlagEvaluationPluginData, type FormFieldReEditCustomData, type Frame, type GraphQLRequestMetadata, type IdleGapCustomData, type IncrementalSnapshotData, IncrementalSource, type InputCustomData, MAX_DISTINCT_KEYS, MAX_KEY_LENGTH, MAX_TAG_VALUE_LENGTH, MAX_VALUES_PER_KEY, type MeasurePluginData, type MouseInteractionData, MouseInteractions, type NetworkRequestInitiator, type NetworkRequestPluginData, type OpaqueIncrementalData, type PluginEventData, type RageClickCustomData, RecordingCustomEventTag, type RecordingEvent, RecordingEventType, RecordingMetricKey, RecordingPluginName, type RouteChangeCustomData, type RouteChangePayload, type RouteChangePluginData, type RouteChangeTrigger, type ScrollBackCustomData, type SelectionData, type SelectionRange, SerializedNodeType, type TabRefocusCustomData, type TabUnfocusCustomData, type TabVisibilityPluginData, type TagPluginData, type UserAgentContext, isSessionActivityEvent, isUserInteractionEvent, isUserInteractionMetric, stripUrl, validateKey, validateMeasureValue, validateTagValue };
+export { type AwayGapCustomData, type ClickCustomData, type ClientContext, type ClipboardAction, type ClipboardPluginData, type ConsoleLogLevel, type ConsoleLogPluginData, type CustomEventData, type DeadClickCustomData, type DialogOpenedCustomData, type ElementDescriptor, type ErrorMessageCustomData, type FlagEvaluationPluginData, type FormFieldReEditCustomData, type Frame, type GraphQLRequestMetadata, type IdleGapCustomData, type IncrementalSnapshotData, IncrementalSource, type InputCustomData, MAX_DISTINCT_KEYS, MAX_KEY_LENGTH, MAX_TAG_VALUE_LENGTH, MAX_VALUES_PER_KEY, type MeasurePluginData, type MouseInteractionData, MouseInteractions, type NetworkRequestInitiator, type NetworkRequestPluginData, type OpaqueIncrementalData, type PluginEventData, type RageClickCustomData, RecordingCustomEventTag, type RecordingEvent, RecordingEventType, RecordingMetricKey, RecordingPluginName, type RouteChangeCustomData, type RouteChangePayload, type RouteChangePluginData, type RouteChangeTrigger, type ScrollBackCustomData, type SelectionData, type SelectionRange, SerializedNodeType, type TabRefocusCustomData, type TabUnfocusCustomData, type TabVisibilityPluginData, type TagPluginData, type UserAgentContext, isSessionActivityEvent, isUserInteractionEvent, isUserInteractionMetric, stripUrl, stripUrlQueryAndHash, validateKey, validateMeasureValue, validateTagValue };

package/dist/index.js

@@ -1,17 +1,4 @@
-import { a as IncrementalSource, c as RecordingEventType, i as RecordingMetricKey, l as RecordingPluginName, n as isUserInteractionEvent, o as MouseInteractions, r as isUserInteractionMetric, s as RecordingCustomEventTag, t as isSessionActivityEvent, u as SerializedNodeType } from "./session-activity-CJ1wae06.js";
-//#region src/url.ts
-/**
-* Extract only the pathname from a URL, stripping origin, query string, and
-* hash. Used across recorder and analyzer to avoid capturing PII in route data.
-*/
-function stripUrl(url) {
-	try {
-		return new URL(url).pathname;
-	} catch (_e) {
-		return url;
-	}
-}
-//#endregion
+import { a as stripUrl, c as MouseInteractions, d as RecordingPluginName, f as SerializedNodeType, i as RecordingMetricKey, l as RecordingCustomEventTag, n as isUserInteractionEvent, o as stripUrlQueryAndHash, r as isUserInteractionMetric, s as IncrementalSource, t as isSessionActivityEvent, u as RecordingEventType } from "./session-activity-tshS9Hua.js";
 //#region src/custom-event-limits.ts
 const MAX_KEY_LENGTH = 128;
 const MAX_TAG_VALUE_LENGTH = 256;
@@ -36,4 +23,4 @@ function validateMeasureValue(value) {
 	return null;
 }
 //#endregion
-export { IncrementalSource, MAX_DISTINCT_KEYS, MAX_KEY_LENGTH, MAX_TAG_VALUE_LENGTH, MAX_VALUES_PER_KEY, MouseInteractions, RecordingCustomEventTag, RecordingEventType, RecordingMetricKey, RecordingPluginName, SerializedNodeType, isSessionActivityEvent, isUserInteractionEvent, isUserInteractionMetric, stripUrl, validateKey, validateMeasureValue, validateTagValue };
+export { IncrementalSource, MAX_DISTINCT_KEYS, MAX_KEY_LENGTH, MAX_TAG_VALUE_LENGTH, MAX_VALUES_PER_KEY, MouseInteractions, RecordingCustomEventTag, RecordingEventType, RecordingMetricKey, RecordingPluginName, SerializedNodeType, isSessionActivityEvent, isUserInteractionEvent, isUserInteractionMetric, stripUrl, stripUrlQueryAndHash, validateKey, validateMeasureValue, validateTagValue };

package/dist/{session-activity-HfuXKqGd.cjs → session-activity-B8swR5Wg.cjs}

@@ -91,6 +91,23 @@ let MouseInteractions = /* @__PURE__ */ function(MouseInteractions) {
 	return MouseInteractions;
 }({});
 //#endregion
+//#region src/url.ts
+/** Remove query strings and fragments, including from relative or malformed URLs. */
+function stripUrlQueryAndHash(url) {
+	return url.split(/[?#]/, 1)[0];
+}
+/**
+* Extract only the pathname from a URL, stripping origin, query string, and
+* hash. Used across recorder and analyzer to avoid capturing PII in route data.
+*/
+function stripUrl(url) {
+	try {
+		return new URL(url).pathname;
+	} catch (_e) {
+		return url;
+	}
+}
+//#endregion
 //#region src/metrics.ts
 const RecordingMetricKey = {
 	Click: "clicks",
@@ -210,3 +227,15 @@ Object.defineProperty(exports, "isUserInteractionMetric", {
 		return isUserInteractionMetric;
 	}
 });
+Object.defineProperty(exports, "stripUrl", {
+	enumerable: true,
+	get: function() {
+		return stripUrl;
+	}
+});
+Object.defineProperty(exports, "stripUrlQueryAndHash", {
+	enumerable: true,
+	get: function() {
+		return stripUrlQueryAndHash;
+	}
+});

package/dist/{session-activity-CJ1wae06.js → session-activity-tshS9Hua.js}

@@ -91,6 +91,23 @@ let MouseInteractions = /* @__PURE__ */ function(MouseInteractions) {
 	return MouseInteractions;
 }({});
 //#endregion
+//#region src/url.ts
+/** Remove query strings and fragments, including from relative or malformed URLs. */
+function stripUrlQueryAndHash(url) {
+	return url.split(/[?#]/, 1)[0];
+}
+/**
+* Extract only the pathname from a URL, stripping origin, query string, and
+* hash. Used across recorder and analyzer to avoid capturing PII in route data.
+*/
+function stripUrl(url) {
+	try {
+		return new URL(url).pathname;
+	} catch (_e) {
+		return url;
+	}
+}
+//#endregion
 //#region src/metrics.ts
 const RecordingMetricKey = {
 	Click: "clicks",
@@ -150,4 +167,4 @@ const isUserInteractionEvent = (event) => {
 const isUserInteractionMetric = (metricKey) => USER_INTERACTION_METRIC_KEYS.has(metricKey);
 const isSessionActivityEvent = (event) => isObject(event) && event.type === 4 || isUserInteractionEvent(event);
 //#endregion
-export { IncrementalSource as a, RecordingEventType as c, RecordingMetricKey as i, RecordingPluginName as l, isUserInteractionEvent as n, MouseInteractions as o, isUserInteractionMetric as r, RecordingCustomEventTag as s, isSessionActivityEvent as t, SerializedNodeType as u };
+export { stripUrl as a, MouseInteractions as c, RecordingPluginName as d, SerializedNodeType as f, RecordingMetricKey as i, RecordingCustomEventTag as l, isUserInteractionEvent as n, stripUrlQueryAndHash as o, isUserInteractionMetric as r, IncrementalSource as s, isSessionActivityEvent as t, RecordingEventType as u };

package/dist/{types-Bg0UKTVQ.d.cts → types-CdvFpcEN.d.cts}

@@ -22,7 +22,7 @@ type UserAgentContext = {
   screenWidth?: number;
   screenHeight?: number;
   devicePixelRatio?: number; /** Initial document URI — without query/hash to avoid leaking PII. */
-  uri?: string;
+  uri?: string; /** Document referrer — without query/hash to avoid leaking PII. */
   referrer?: string;
 };
 interface ClientContext {
@@ -41,11 +41,12 @@ interface CreateUploaderOptions {
   apiUrl: string;
   /**
   * URL of the WebSocket ingest endpoint, including the path (e.g.
-  * `wss://recording-ws.confidence.dev/sessions/stream`) but **without** any query —
-  * the worker appends `?session_token=…`. Optional: when omitted the worker derives
-  * one from `apiUrl` by swapping `http(s)://` → `ws(s)://` and appending
-  * `/sessions/stream`. Set this when the init endpoint and the WS ingest live on
-  * different hosts (e.g. prod).
+  * `wss://recording-ws.confidence.dev/sessions/stream`). The worker sends the session
+  * token through the WebSocket subprotocol header. A `session_token` query parameter is
+  * rejected. Other query parameters are retained. Optional: when omitted the worker
+  * derives one from `apiUrl` by swapping `http(s)://` → `ws(s)://` and appending
+  * `/sessions/stream`. Set this when the init endpoint and the WS ingest live on different
+  * hosts (e.g. prod).
   */
   websocketUrl?: string;
   /** Per-tenant secret. Hashed to scope the SharedWorker so different secrets never share a session, and sent in the `initSession` request body. */
@@ -88,7 +89,7 @@ interface CreateUploaderOptions {
   }) => void;
   /**
   * Optional verbose tracer. Called on key tab- and worker-side events
-  * (hello/welcome, init-session URL, ws connect URL, retries, transitions).
+  * (hello/welcome, init-session URL, credential-free ws connect URL, retries, transitions).
   * Worker messages are forwarded over the port and tagged so you can tell them apart.
   */
   debugLogger?: (msg: string) => void;

package/dist/{types-Bg0UKTVQ.d.ts → types-CdvFpcEN.d.ts}

@@ -22,7 +22,7 @@ type UserAgentContext = {
   screenWidth?: number;
   screenHeight?: number;
   devicePixelRatio?: number; /** Initial document URI — without query/hash to avoid leaking PII. */
-  uri?: string;
+  uri?: string; /** Document referrer — without query/hash to avoid leaking PII. */
   referrer?: string;
 };
 interface ClientContext {
@@ -41,11 +41,12 @@ interface CreateUploaderOptions {
   apiUrl: string;
   /**
   * URL of the WebSocket ingest endpoint, including the path (e.g.
-  * `wss://recording-ws.confidence.dev/sessions/stream`) but **without** any query —
-  * the worker appends `?session_token=…`. Optional: when omitted the worker derives
-  * one from `apiUrl` by swapping `http(s)://` → `ws(s)://` and appending
-  * `/sessions/stream`. Set this when the init endpoint and the WS ingest live on
-  * different hosts (e.g. prod).
+  * `wss://recording-ws.confidence.dev/sessions/stream`). The worker sends the session
+  * token through the WebSocket subprotocol header. A `session_token` query parameter is
+  * rejected. Other query parameters are retained. Optional: when omitted the worker
+  * derives one from `apiUrl` by swapping `http(s)://` → `ws(s)://` and appending
+  * `/sessions/stream`. Set this when the init endpoint and the WS ingest live on different
+  * hosts (e.g. prod).
   */
   websocketUrl?: string;
   /** Per-tenant secret. Hashed to scope the SharedWorker so different secrets never share a session, and sent in the `initSession` request body. */
@@ -88,7 +89,7 @@ interface CreateUploaderOptions {
   }) => void;
   /**
   * Optional verbose tracer. Called on key tab- and worker-side events
-  * (hello/welcome, init-session URL, ws connect URL, retries, transitions).
+  * (hello/welcome, init-session URL, credential-free ws connect URL, retries, transitions).
   * Worker messages are forwarded over the port and tagged so you can tell them apart.
   */
   debugLogger?: (msg: string) => void;

package/dist/uploader/index.cjs

@@ -21,7 +21,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-const require_session_activity = require("../session-activity-HfuXKqGd.cjs");
+const require_session_activity = require("../session-activity-B8swR5Wg.cjs");
 let bowser = require("bowser");
 bowser = __toESM(bowser, 1);
 //#region src/uploader/client-context.ts
@@ -46,12 +46,15 @@ function collectUserAgentContext() {
 		screenHeight: window.screen.height,
 		devicePixelRatio: window.devicePixelRatio,
 		uri: `${window.location.origin}${window.location.pathname}`,
-		referrer: document.referrer
+		referrer: require_session_activity.stripUrlQueryAndHash(document.referrer)
 	};
 }
 //#endregion
 //#region src/uploader/worker/worker-script.ts
-const workerScript = "//#region src/uploader/worker/web-socket-transport.ts\n/**\n* WebSocket-backed Transport. Internal retry policy: clean server-initiated close after the\n* first successful open → reconnect and resume; abrupt close (or any close before the first\n* open) → fire `onClose` and stop. Frames received while a (re)connect is in progress are\n* buffered and flushed on open.\n*\n* `ready()` resolves on the first successful open and rejects on close-before-open. Callers\n* should await it before treating the Transport as live, so a failure to open can be caught\n* (e.g. 4404 unknown session) and recovered from.\n*/\nvar WebSocketTransport = class {\n	url;\n	ws = null;\n	onCloseCb = null;\n	onStateChangeCb = null;\n	intentionallyClosed = false;\n	dead = false;\n	/** Frames buffered while a (re)connect is in progress. */\n	pending = [];\n	readyPromise;\n	constructor(url) {\n		this.url = url;\n		this.readyPromise = new Promise((resolve, reject) => {\n			this.connect(false, resolve, reject);\n		});\n		this.readyPromise.catch(() => {});\n	}\n	ready() {\n		return this.readyPromise;\n	}\n	send(frame) {\n		if (this.dead || this.intentionallyClosed) return;\n		if (this.ws?.readyState === WebSocket.OPEN) this.ws.send(JSON.stringify(frame));\n		else this.pending.push(frame);\n	}\n	close(reason = \"transport-close\") {\n		this.intentionallyClosed = true;\n		this.ws?.close(1e3, reason);\n	}\n	onClose(cb) {\n		this.onCloseCb = cb;\n	}\n	onStateChange(cb) {\n		this.onStateChangeCb = cb;\n	}\n	connect(isReconnect, onReady, onReadyFail) {\n		const ws = new WebSocket(this.url);\n		this.ws = ws;\n		let opened = false;\n		ws.onopen = () => {\n			opened = true;\n			onReady?.();\n			if (isReconnect) this.onStateChangeCb?.({ connected: true });\n			while (this.pending.length > 0) {\n				const f = this.pending.shift();\n				ws.send(JSON.stringify(f));\n			}\n		};\n		ws.onclose = (event) => {\n			if (this.intentionallyClosed) return;\n			if (!opened) {\n				const reason = `${isReconnect ? \"reconnect\" : \"initial\"}-failed code=${event.code}`;\n				if (onReadyFail) {\n					onReadyFail(new Error(reason));\n					this.dead = true;\n				} else this.die(reason);\n				return;\n			}\n			if (event.wasClean && (event.code === 1e3 || event.code === 1001)) {\n				this.onStateChangeCb?.({ connected: false });\n				this.connect(true);\n			} else this.die(`close code=${event.code} wasClean=${event.wasClean}`);\n		};\n	}\n	die(reason) {\n		this.dead = true;\n		this.onCloseCb?.({ reason });\n	}\n};\n//#endregion\n//#region src/uploader/worker/csr-client.ts\n/**\n* Single Client implementation that talks to the recording backend's REST + WS protocol.\n* Both dev-server and prod implement the same protocol, so we don't need polymorphism here yet.\n*/\nvar CsrClient = class {\n	apiUrl;\n	clientSecret;\n	context;\n	websocketUrl;\n	log;\n	forceRecord;\n	constructor(apiUrl, clientSecret, context, websocketUrl, log = () => {}, forceRecord) {\n		this.apiUrl = apiUrl;\n		this.clientSecret = clientSecret;\n		this.context = context;\n		this.websocketUrl = websocketUrl;\n		this.log = log;\n		this.forceRecord = forceRecord;\n	}\n	async initSession() {\n		const url = `${this.trimSlash(this.apiUrl)}/v1/sessions:initSession`;\n		this.log(`fetch POST ${url}`);\n		const res = await fetch(url, {\n			method: \"POST\",\n			headers: { \"Content-Type\": \"application/json\" },\n			body: JSON.stringify({\n				clientSecret: this.clientSecret,\n				...this.context && Object.keys(this.context).length > 0 ? { context: this.context } : {},\n				...this.forceRecord ? { forceRecord: true } : {}\n			})\n		});\n		if (!res.ok) throw new Error(`init-session failed: HTTP ${res.status}`);\n		const data = await res.json();\n		if (data.skipRecording) return { skipRecording: true };\n		if (!data.sessionId || !data.sessionToken) throw new Error(\"init-session response missing sessionId or sessionToken\");\n		return {\n			sessionId: data.sessionId,\n			sessionToken: data.sessionToken\n		};\n	}\n	async openTransport(sessionToken) {\n		const wsBase = this.websocketUrl ?? `${this.toWsScheme(this.trimSlash(this.apiUrl))}/sessions/stream`;\n		const url = `${wsBase}${wsBase.includes(\"?\") ? \"&\" : \"?\"}session_token=${encodeURIComponent(sessionToken)}`;\n		this.log(`WebSocket connect ${url.replace(/session_token=[^&]*/, \"session_token=[REDACTED]\")}`);\n		const transport = new WebSocketTransport(url);\n		await transport.ready();\n		return transport;\n	}\n	trimSlash(s) {\n		return s.endsWith(\"/\") ? s.slice(0, -1) : s;\n	}\n	toWsScheme(base) {\n		if (base.startsWith(\"https://\")) return `wss://${base.slice(8)}`;\n		if (base.startsWith(\"http://\")) return `ws://${base.slice(7)}`;\n		return base;\n	}\n};\n//#endregion\n//#region src/uploader/worker/core.ts\nconst IDLE_GRACE_MS = 5e3;\nlet state = { phase: \"init\" };\nconst ports = [];\nlet idleTimer = null;\nfunction cancelIdleTimer() {\n	if (idleTimer !== null) {\n		clearTimeout(idleTimer);\n		idleTimer = null;\n	}\n}\nfunction log(msg) {\n	for (const handle of ports) if (handle.debugLogs) handle.port.postMessage({\n		type: \"log\",\n		msg\n	});\n}\n/**\n* The first hello \"locks in\" the session's apiUrl/clientSecret. Any later tab arriving\n* with different values is misconfigured — we reject it rather than silently using the\n* locked values. In SharedWorker mode the `name = hash(clientSecret)` scoping already\n* prevents secret-mismatch from sharing a worker, but this defends against the dedicated\n* path and against future bugs.\n*/\nlet lockedConfig = null;\nfunction registerPort(adapter) {\n	cancelIdleTimer();\n	const handle = {\n		port: adapter,\n		hello: null,\n		debugLogs: false\n	};\n	ports.push(handle);\n	adapter.onmessage((data) => {\n		handleMessage(handle, data);\n	});\n}\nfunction handleMessage(handle, message) {\n	switch (message.type) {\n		case \"hello\":\n			handle.hello = message;\n			handle.debugLogs = message.debugLogs ?? false;\n			if (rejectIfIncompatible(handle)) return;\n			if (state.phase !== \"dead\" && state.phase !== \"skipping\") detectDuplicateTab(handle);\n			onHello(handle);\n			return;\n		case \"frame\":\n			onFrame(message.frame);\n			return;\n		case \"bye\":\n			onBye(handle);\n			return;\n		default: break;\n	}\n}\n/**\n* Reject hellos whose `apiUrl`/`clientSecret` don't match the values established by the\n* first hello. Returns true if the port was rejected (caller should not continue\n* processing this hello).\n*/\nfunction rejectIfIncompatible(handle) {\n	if (lockedConfig === null) return false;\n	const incoming = handle.hello;\n	if (incoming.apiUrl === lockedConfig.apiUrl && incoming.websocketUrl === lockedConfig.websocketUrl && incoming.clientSecret === lockedConfig.clientSecret) return false;\n	handle.port.postMessage({\n		type: \"dead\",\n		reason: \"incompatible-options: apiUrl/websocketUrl/clientSecret differ from the worker session\"\n	});\n	const idx = ports.indexOf(handle);\n	if (idx >= 0) ports.splice(idx, 1);\n	return true;\n}\n/**\n* If another already-connected port has the same `tabId`, this hello is from a duplicate\n* tab (browser \"Duplicate\" command clones sessionStorage). Mint a fresh `tabId` so the two\n* tabs don't collide on the same `(sessionId, tabId)` Recording. The new tabId is returned\n* to the tab in `welcome` so it can update its own state and sessionStorage.\n*/\nfunction detectDuplicateTab(handle) {\n	const tabId = handle.hello.tabId;\n	if (!ports.some((p) => p !== handle && p.hello?.tabId === tabId)) return;\n	const fresh = crypto.randomUUID();\n	handle.newTabId = fresh;\n	handle.hello.tabId = fresh;\n}\nfunction onHello(handle) {\n	switch (state.phase) {\n		case \"init\":\n			lockedConfig = {\n				apiUrl: handle.hello.apiUrl,\n				websocketUrl: handle.hello.websocketUrl,\n				clientSecret: handle.hello.clientSecret\n			};\n			log(`hello received apiUrl=${handle.hello.apiUrl} websocketUrl=${handle.hello.websocketUrl ?? \"(derive)\"} sessionIdHint=${handle.hello.sessionIdHint ?? \"(none)\"}`);\n			state = { phase: \"initializing\" };\n			initializeSession(handle.hello).then(flushPendingWelcomes);\n			return;\n		case \"initializing\": return;\n		case \"active\":\n			sendActiveWelcome(handle, state.sessionId, state.sessionToken);\n			return;\n		case \"idle\": {\n			const { client, sessionId, sessionToken } = state;\n			state = { phase: \"initializing\" };\n			resumeTransport(client, sessionId, sessionToken).then(flushPendingWelcomes);\n			return;\n		}\n		case \"skipping\":\n			if (handle.hello.forceRecord) {\n				log(\"forceRecord set; re-initializing from skipping state\");\n				state = { phase: \"initializing\" };\n				initializeSession(handle.hello).then(flushPendingWelcomes);\n				return;\n			}\n			handle.port.postMessage({\n				type: \"welcome\",\n				result: { skipRecording: true }\n			});\n			return;\n		case \"dead\":\n			handle.port.postMessage({\n				type: \"dead\",\n				reason: state.reason\n			});\n			return;\n		default: break;\n	}\n}\nasync function initializeSession(firstHello) {\n	const client = new CsrClient(firstHello.apiUrl, firstHello.clientSecret, firstHello.context, firstHello.websocketUrl, log, firstHello.forceRecord);\n	if (firstHello.sessionIdHint && firstHello.sessionTokenHint) {\n		log(`adopting sessionIdHint=${firstHello.sessionIdHint}`);\n		try {\n			const transport = await client.openTransport(firstHello.sessionTokenHint);\n			wireTransport(transport);\n			state = {\n				phase: \"active\",\n				client,\n				transport,\n				sessionId: firstHello.sessionIdHint,\n				sessionToken: firstHello.sessionTokenHint\n			};\n			log(\"hint adopted; transport open\");\n			if (ports.length === 0) idleTimer = setTimeout(enterIdle, IDLE_GRACE_MS);\n			return;\n		} catch (err) {\n			log(`hint rejected (${String(err)}); falling back to fresh init`);\n		}\n	}\n	let result;\n	try {\n		result = await client.initSession();\n	} catch (err) {\n		log(`init-session threw: ${String(err)}`);\n		transitionToDead(`init-session-failed: ${String(err)}`);\n		return;\n	}\n	if (\"skipRecording\" in result) {\n		log(\"init-session: skipRecording\");\n		state = { phase: \"skipping\" };\n		return;\n	}\n	log(`init-session ok sessionId=${result.sessionId}`);\n	let transport;\n	try {\n		transport = await client.openTransport(result.sessionToken);\n	} catch (err) {\n		log(`openTransport threw: ${String(err)}`);\n		transitionToDead(`open-transport-failed: ${String(err)}`);\n		return;\n	}\n	wireTransport(transport);\n	log(\"transport open; session active\");\n	state = {\n		phase: \"active\",\n		client,\n		transport,\n		sessionId: result.sessionId,\n		sessionToken: result.sessionToken\n	};\n	if (ports.length === 0) idleTimer = setTimeout(enterIdle, IDLE_GRACE_MS);\n}\nasync function resumeTransport(client, sessionId, sessionToken) {\n	log(\"resuming transport from idle\");\n	let transport;\n	try {\n		transport = await client.openTransport(sessionToken);\n	} catch (err) {\n		log(`resume-transport threw: ${String(err)}`);\n		transitionToDead(`resume-transport-failed: ${String(err)}`);\n		return;\n	}\n	wireTransport(transport);\n	log(\"transport resumed\");\n	state = {\n		phase: \"active\",\n		client,\n		transport,\n		sessionId,\n		sessionToken\n	};\n	if (ports.length === 0) idleTimer = setTimeout(enterIdle, IDLE_GRACE_MS);\n}\nfunction wireTransport(transport) {\n	transport.onClose((info) => {\n		if (state.phase !== \"active\") return;\n		transitionToDead(info.reason);\n	});\n	transport.onStateChange((info) => {\n		if (state.phase !== \"active\") return;\n		for (const handle of ports) handle.port.postMessage({\n			type: \"state\",\n			connected: info.connected\n		});\n	});\n}\nfunction transitionToDead(reason) {\n	state = {\n		phase: \"dead\",\n		reason\n	};\n	for (const handle of ports) handle.port.postMessage({\n		type: \"dead\",\n		reason\n	});\n}\nfunction flushPendingWelcomes() {\n	for (const handle of ports) {\n		if (handle.hello === null) continue;\n		if (state.phase === \"active\") sendActiveWelcome(handle, state.sessionId, state.sessionToken);\n		else if (state.phase === \"skipping\") handle.port.postMessage({\n			type: \"welcome\",\n			result: { skipRecording: true }\n		});\n		else if (state.phase === \"dead\") handle.port.postMessage({\n			type: \"dead\",\n			reason: state.reason\n		});\n	}\n}\nfunction sendActiveWelcome(handle, currentSessionId, currentSessionToken) {\n	const hint = handle.hello?.sessionIdHint;\n	const adopted = hint !== void 0 && hint !== currentSessionId;\n	const newTabId = handle.newTabId;\n	handle.port.postMessage({\n		type: \"welcome\",\n		result: {\n			sessionId: currentSessionId,\n			sessionToken: currentSessionToken\n		},\n		adoptedFromSessionId: adopted ? hint : void 0,\n		newTabId,\n		resetCounter: adopted || newTabId !== void 0\n	});\n}\nfunction onFrame(frame) {\n	if (state.phase !== \"active\") return;\n	state.transport.send(frame);\n}\nfunction onBye(handle) {\n	const idx = ports.indexOf(handle);\n	if (idx >= 0) ports.splice(idx, 1);\n	if (ports.length === 0 && state.phase === \"active\") {\n		log(`last tab disconnected; closing transport in ${IDLE_GRACE_MS}ms`);\n		idleTimer = setTimeout(enterIdle, IDLE_GRACE_MS);\n	}\n}\nfunction enterIdle() {\n	idleTimer = null;\n	if (state.phase !== \"active\" || ports.length > 0) return;\n	log(\"idle timeout; closing transport\");\n	state.transport.close(\"idle\");\n	state = {\n		phase: \"idle\",\n		client: state.client,\n		sessionId: state.sessionId,\n		sessionToken: state.sessionToken\n	};\n}\n//#endregion\n//#region src/uploader/worker/entry.ts\nconst SharedWorkerScopeCtor = globalThis.SharedWorkerGlobalScope;\nif (typeof SharedWorkerScopeCtor === \"function\" && self instanceof SharedWorkerScopeCtor) self.onconnect = (event) => {\n	const port = event.ports[0];\n	port.start();\n	registerPort(adaptMessagePort(port));\n};\nelse registerPort(adaptDedicatedSelf());\nfunction adaptMessagePort(port) {\n	return {\n		postMessage: (message) => port.postMessage(message),\n		onmessage: (cb) => {\n			port.onmessage = (e) => cb(e.data);\n		}\n	};\n}\nfunction adaptDedicatedSelf() {\n	const ws = self;\n	return {\n		postMessage: (message) => ws.postMessage(message),\n		onmessage: (cb) => {\n			ws.onmessage = (e) => cb(e.data);\n		}\n	};\n}\n//#endregion\n";
+const workerScript = "//#region src/uploader/worker/web-socket-transport.ts\n/**\n* WebSocket-backed Transport. Internal retry policy: clean server-initiated close after the\n* first successful open → reconnect and resume; abrupt close (or any close before the first\n* open) → fire `onClose` and stop. Frames received while a (re)connect is in progress are\n* buffered and flushed on open.\n*\n* `ready()` resolves on the first successful open and rejects on close-before-open. Callers\n* should await it before treating the Transport as live, so a failure to open can be caught\n* (e.g. 4404 unknown session) and recovered from.\n*/\nvar WebSocketTransport = class {\n	url;\n	ws = null;\n	onCloseCb = null;\n	onStateChangeCb = null;\n	intentionallyClosed = false;\n	dead = false;\n	/** Frames buffered while a (re)connect is in progress. */\n	pending = [];\n	readyPromise;\n	protocols;\n	constructor(url, protocols = []) {\n		this.url = url;\n		this.protocols = [...protocols];\n		this.readyPromise = new Promise((resolve, reject) => {\n			this.connect(false, resolve, reject);\n		});\n		this.readyPromise.catch(() => {});\n	}\n	ready() {\n		return this.readyPromise;\n	}\n	send(frame) {\n		if (this.dead || this.intentionallyClosed) return;\n		if (this.ws?.readyState === WebSocket.OPEN) this.ws.send(JSON.stringify(frame));\n		else this.pending.push(frame);\n	}\n	close(reason = \"transport-close\") {\n		this.intentionallyClosed = true;\n		this.ws?.close(1e3, reason);\n	}\n	onClose(cb) {\n		this.onCloseCb = cb;\n	}\n	onStateChange(cb) {\n		this.onStateChangeCb = cb;\n	}\n	connect(isReconnect, onReady, onReadyFail) {\n		let ws;\n		try {\n			ws = new WebSocket(this.url, [...this.protocols]);\n		} catch (_error) {\n			this.failConnection(isReconnect, onReadyFail);\n			return;\n		}\n		this.ws = ws;\n		let opened = false;\n		ws.onopen = () => {\n			const expectedProtocol = this.protocols[0];\n			if (expectedProtocol !== void 0 && ws.protocol !== expectedProtocol) {\n				this.failConnection(isReconnect, onReadyFail);\n				ws.close(1e3, \"protocol-mismatch\");\n				return;\n			}\n			opened = true;\n			onReady?.();\n			if (isReconnect) this.onStateChangeCb?.({ connected: true });\n			while (this.pending.length > 0) {\n				const f = this.pending.shift();\n				ws.send(JSON.stringify(f));\n			}\n		};\n		ws.onclose = (event) => {\n			if (this.intentionallyClosed || this.dead) return;\n			if (!opened) {\n				this.failConnection(isReconnect, onReadyFail);\n				return;\n			}\n			if (event.wasClean && (event.code === 1e3 || event.code === 1001)) {\n				this.onStateChangeCb?.({ connected: false });\n				this.connect(true);\n			} else this.die(`close code=${event.code} wasClean=${event.wasClean}`);\n		};\n	}\n	failConnection(isReconnect, onReadyFail) {\n		const reason = isReconnect ? \"reconnect-failed\" : \"initial-failed\";\n		if (onReadyFail) {\n			this.dead = true;\n			onReadyFail(new Error(reason));\n		} else this.die(reason);\n	}\n	die(reason) {\n		this.dead = true;\n		this.onCloseCb?.({ reason });\n	}\n};\n//#endregion\n//#region src/uploader/worker/websocket-auth.ts\nconst RECORDING_PROTOCOL = \"recording.v1\";\nconst AUTH_PROTOCOL_PREFIX = \"auth.\";\nconst MAX_TOKEN_LENGTH = 4096;\nfunction recordingProtocols(sessionToken) {\n	if (sessionToken.length > MAX_TOKEN_LENGTH) throw new Error(\"Session token is too long for WebSocket authentication\");\n	if (!sessionToken || /[^A-Za-z0-9._-]/.test(sessionToken)) throw new Error(\"Invalid session token for WebSocket authentication\");\n	return [RECORDING_PROTOCOL, `${AUTH_PROTOCOL_PREFIX}${sessionToken}`];\n}\n//#endregion\n//#region src/uploader/worker/csr-client.ts\n/**\n* Single Client implementation that talks to the recording backend's REST + WS protocol.\n* Both dev-server and prod implement the same protocol, so we don't need polymorphism here yet.\n*/\nvar CsrClient = class {\n	apiUrl;\n	clientSecret;\n	context;\n	websocketUrl;\n	log;\n	forceRecord;\n	constructor(apiUrl, clientSecret, context, websocketUrl, log = () => {}, forceRecord) {\n		this.apiUrl = apiUrl;\n		this.clientSecret = clientSecret;\n		this.context = context;\n		this.websocketUrl = websocketUrl;\n		this.log = log;\n		this.forceRecord = forceRecord;\n	}\n	async initSession() {\n		const url = `${this.trimSlash(this.apiUrl)}/v1/sessions:initSession`;\n		this.log(`fetch POST ${url}`);\n		const res = await fetch(url, {\n			method: \"POST\",\n			headers: { \"Content-Type\": \"application/json\" },\n			body: JSON.stringify({\n				clientSecret: this.clientSecret,\n				...this.context && Object.keys(this.context).length > 0 ? { context: this.context } : {},\n				...this.forceRecord ? { forceRecord: true } : {}\n			})\n		});\n		if (!res.ok) throw new Error(`init-session failed: HTTP ${res.status}`);\n		const data = await res.json();\n		if (data.skipRecording) return { skipRecording: true };\n		if (!data.sessionId || !data.sessionToken) throw new Error(\"init-session response missing sessionId or sessionToken\");\n		return {\n			sessionId: data.sessionId,\n			sessionToken: data.sessionToken\n		};\n	}\n	async openTransport(sessionToken) {\n		const wsBase = this.websocketUrl ?? `${this.toWsScheme(this.trimSlash(this.apiUrl))}/sessions/stream`;\n		let parsedUrl;\n		try {\n			parsedUrl = new URL(wsBase);\n		} catch (_error) {\n			throw new Error(\"Invalid WebSocket URL\");\n		}\n		if (parsedUrl.searchParams.has(\"session_token\")) throw new Error(\"WebSocket URL must not include a session token\");\n		const protocols = recordingProtocols(sessionToken);\n		this.log(`WebSocket connect ${wsBase}`);\n		const transport = new WebSocketTransport(wsBase, protocols);\n		await transport.ready();\n		return transport;\n	}\n	trimSlash(s) {\n		return s.endsWith(\"/\") ? s.slice(0, -1) : s;\n	}\n	toWsScheme(base) {\n		if (base.startsWith(\"https://\")) return `wss://${base.slice(8)}`;\n		if (base.startsWith(\"http://\")) return `ws://${base.slice(7)}`;\n		return base;\n	}\n};\n//#endregion\n//#region src/uploader/worker/core.ts\nconst WORKER_HASH = globalThis.__WORKER_HASH__;\nconst IDLE_GRACE_MS = 5e3;\nlet state = { phase: \"init\" };\nconst ports = [];\nlet idleTimer = null;\nfunction cancelIdleTimer() {\n	if (idleTimer !== null) {\n		clearTimeout(idleTimer);\n		idleTimer = null;\n	}\n}\nfunction log(msg) {\n	for (const handle of ports) if (handle.debugLogs) handle.port.postMessage({\n		type: \"log\",\n		msg\n	});\n}\n/**\n* The first hello \"locks in\" the session's apiUrl/clientSecret. Any later tab arriving\n* with different values is misconfigured — we reject it rather than silently using the\n* locked values. In SharedWorker mode the `name = hash(clientSecret)` scoping already\n* prevents secret-mismatch from sharing a worker, but this defends against the dedicated\n* path and against future bugs.\n*/\nlet lockedConfig = null;\nfunction registerPort(adapter) {\n	cancelIdleTimer();\n	const handle = {\n		port: adapter,\n		hello: null,\n		debugLogs: false\n	};\n	ports.push(handle);\n	adapter.onmessage((data) => {\n		handleMessage(handle, data);\n	});\n}\nfunction handleMessage(handle, message) {\n	switch (message.type) {\n		case \"hello\":\n			handle.hello = message;\n			handle.debugLogs = message.debugLogs ?? false;\n			if (rejectIfIncompatible(handle)) return;\n			if (state.phase !== \"dead\" && state.phase !== \"skipping\") detectDuplicateTab(handle);\n			onHello(handle);\n			return;\n		case \"frame\":\n			onFrame(message.frame);\n			return;\n		case \"bye\":\n			onBye(handle);\n			return;\n		default: break;\n	}\n}\n/**\n* Reject hellos whose `apiUrl`/`clientSecret` don't match the values established by the\n* first hello. Returns true if the port was rejected (caller should not continue\n* processing this hello).\n*/\nfunction rejectIfIncompatible(handle) {\n	if (lockedConfig === null) return false;\n	const incoming = handle.hello;\n	if (incoming.apiUrl === lockedConfig.apiUrl && incoming.websocketUrl === lockedConfig.websocketUrl && incoming.clientSecret === lockedConfig.clientSecret) return false;\n	handle.port.postMessage({\n		type: \"dead\",\n		reason: \"incompatible-options: apiUrl/websocketUrl/clientSecret differ from the worker session\"\n	});\n	const idx = ports.indexOf(handle);\n	if (idx >= 0) ports.splice(idx, 1);\n	return true;\n}\n/**\n* If another already-connected port has the same `tabId`, this hello is from a duplicate\n* tab (browser \"Duplicate\" command clones sessionStorage). Mint a fresh `tabId` so the two\n* tabs don't collide on the same `(sessionId, tabId)` Recording. The new tabId is returned\n* to the tab in `welcome` so it can update its own state and sessionStorage.\n*/\nfunction detectDuplicateTab(handle) {\n	const tabId = handle.hello.tabId;\n	if (!ports.some((p) => p !== handle && p.hello?.tabId === tabId)) return;\n	const fresh = crypto.randomUUID();\n	handle.newTabId = fresh;\n	handle.hello.tabId = fresh;\n}\nfunction onHello(handle) {\n	switch (state.phase) {\n		case \"init\":\n			lockedConfig = {\n				apiUrl: handle.hello.apiUrl,\n				websocketUrl: handle.hello.websocketUrl,\n				clientSecret: handle.hello.clientSecret\n			};\n			log(`hello received apiUrl=${handle.hello.apiUrl} websocketUrl=${handle.hello.websocketUrl ? \"(configured)\" : \"(derive)\"} sessionIdHint=${handle.hello.sessionIdHint ?? \"(none)\"}`);\n			state = { phase: \"initializing\" };\n			initializeSession(handle.hello).then(flushPendingWelcomes);\n			return;\n		case \"initializing\": return;\n		case \"active\":\n			sendActiveWelcome(handle, state.sessionId, state.sessionToken);\n			return;\n		case \"idle\": {\n			const { client, sessionId, sessionToken } = state;\n			state = { phase: \"initializing\" };\n			resumeTransport(client, sessionId, sessionToken).then(flushPendingWelcomes);\n			return;\n		}\n		case \"skipping\":\n			if (handle.hello.forceRecord) {\n				log(\"forceRecord set; re-initializing from skipping state\");\n				state = { phase: \"initializing\" };\n				initializeSession(handle.hello).then(flushPendingWelcomes);\n				return;\n			}\n			handle.port.postMessage({\n				type: \"welcome\",\n				result: { skipRecording: true },\n				workerHash: WORKER_HASH\n			});\n			return;\n		case \"dead\":\n			handle.port.postMessage({\n				type: \"dead\",\n				reason: state.reason\n			});\n			return;\n		default: break;\n	}\n}\nasync function initializeSession(firstHello) {\n	const client = new CsrClient(firstHello.apiUrl, firstHello.clientSecret, firstHello.context, firstHello.websocketUrl, log, firstHello.forceRecord);\n	if (firstHello.sessionIdHint && firstHello.sessionTokenHint) {\n		log(`adopting sessionIdHint=${firstHello.sessionIdHint}`);\n		try {\n			const transport = await client.openTransport(firstHello.sessionTokenHint);\n			wireTransport(transport);\n			state = {\n				phase: \"active\",\n				client,\n				transport,\n				sessionId: firstHello.sessionIdHint,\n				sessionToken: firstHello.sessionTokenHint\n			};\n			log(\"hint adopted; transport open\");\n			if (ports.length === 0) idleTimer = setTimeout(enterIdle, IDLE_GRACE_MS);\n			return;\n		} catch (err) {\n			log(`hint rejected (${String(err)}); falling back to fresh init`);\n		}\n	}\n	let result;\n	try {\n		result = await client.initSession();\n	} catch (err) {\n		log(`init-session threw: ${String(err)}`);\n		transitionToDead(`init-session-failed: ${String(err)}`);\n		return;\n	}\n	if (\"skipRecording\" in result) {\n		log(\"init-session: skipRecording\");\n		state = { phase: \"skipping\" };\n		return;\n	}\n	log(`init-session ok sessionId=${result.sessionId}`);\n	let transport;\n	try {\n		transport = await client.openTransport(result.sessionToken);\n	} catch (err) {\n		log(`openTransport threw: ${String(err)}`);\n		transitionToDead(`open-transport-failed: ${String(err)}`);\n		return;\n	}\n	wireTransport(transport);\n	log(\"transport open; session active\");\n	state = {\n		phase: \"active\",\n		client,\n		transport,\n		sessionId: result.sessionId,\n		sessionToken: result.sessionToken\n	};\n	if (ports.length === 0) idleTimer = setTimeout(enterIdle, IDLE_GRACE_MS);\n}\nasync function resumeTransport(client, sessionId, sessionToken) {\n	log(\"resuming transport from idle\");\n	let transport;\n	try {\n		transport = await client.openTransport(sessionToken);\n	} catch (err) {\n		log(`resume-transport threw: ${String(err)}`);\n		transitionToDead(`resume-transport-failed: ${String(err)}`);\n		return;\n	}\n	wireTransport(transport);\n	log(\"transport resumed\");\n	state = {\n		phase: \"active\",\n		client,\n		transport,\n		sessionId,\n		sessionToken\n	};\n	if (ports.length === 0) idleTimer = setTimeout(enterIdle, IDLE_GRACE_MS);\n}\nfunction wireTransport(transport) {\n	transport.onClose((info) => {\n		if (state.phase !== \"active\") return;\n		transitionToDead(info.reason);\n	});\n	transport.onStateChange((info) => {\n		if (state.phase !== \"active\") return;\n		for (const handle of ports) handle.port.postMessage({\n			type: \"state\",\n			connected: info.connected\n		});\n	});\n}\nfunction transitionToDead(reason) {\n	state = {\n		phase: \"dead\",\n		reason\n	};\n	for (const handle of ports) handle.port.postMessage({\n		type: \"dead\",\n		reason\n	});\n}\nfunction flushPendingWelcomes() {\n	for (const handle of ports) {\n		if (handle.hello === null) continue;\n		if (state.phase === \"active\") sendActiveWelcome(handle, state.sessionId, state.sessionToken);\n		else if (state.phase === \"skipping\") handle.port.postMessage({\n			type: \"welcome\",\n			result: { skipRecording: true },\n			workerHash: WORKER_HASH\n		});\n		else if (state.phase === \"dead\") handle.port.postMessage({\n			type: \"dead\",\n			reason: state.reason\n		});\n	}\n}\nfunction sendActiveWelcome(handle, currentSessionId, currentSessionToken) {\n	const hint = handle.hello?.sessionIdHint;\n	const adopted = hint !== void 0 && hint !== currentSessionId;\n	const newTabId = handle.newTabId;\n	handle.port.postMessage({\n		type: \"welcome\",\n		result: {\n			sessionId: currentSessionId,\n			sessionToken: currentSessionToken\n		},\n		workerHash: WORKER_HASH,\n		adoptedFromSessionId: adopted ? hint : void 0,\n		newTabId,\n		resetCounter: adopted || newTabId !== void 0\n	});\n}\nfunction onFrame(frame) {\n	if (state.phase !== \"active\") return;\n	state.transport.send(frame);\n}\nfunction onBye(handle) {\n	const idx = ports.indexOf(handle);\n	if (idx >= 0) ports.splice(idx, 1);\n	if (ports.length === 0 && state.phase === \"active\") {\n		log(`last tab disconnected; closing transport in ${IDLE_GRACE_MS}ms`);\n		idleTimer = setTimeout(enterIdle, IDLE_GRACE_MS);\n	}\n}\nfunction enterIdle() {\n	idleTimer = null;\n	if (state.phase !== \"active\" || ports.length > 0) return;\n	log(\"idle timeout; closing transport\");\n	state.transport.close(\"idle\");\n	state = {\n		phase: \"idle\",\n		client: state.client,\n		sessionId: state.sessionId,\n		sessionToken: state.sessionToken\n	};\n}\n//#endregion\n//#region src/uploader/worker/entry.ts\nconst SharedWorkerScopeCtor = globalThis.SharedWorkerGlobalScope;\nif (typeof SharedWorkerScopeCtor === \"function\" && self instanceof SharedWorkerScopeCtor) self.onconnect = (event) => {\n	const port = event.ports[0];\n	port.start();\n	registerPort(adaptMessagePort(port));\n};\nelse registerPort(adaptDedicatedSelf());\nfunction adaptMessagePort(port) {\n	return {\n		postMessage: (message) => port.postMessage(message),\n		onmessage: (cb) => {\n			port.onmessage = (e) => cb(e.data);\n		}\n	};\n}\nfunction adaptDedicatedSelf() {\n	const ws = self;\n	return {\n		postMessage: (message) => ws.postMessage(message),\n		onmessage: (cb) => {\n			ws.onmessage = (e) => cb(e.data);\n		}\n	};\n}\n//#endregion\n";
+//#endregion
+//#region src/uploader/worker-hash.ts
+const WORKER_HASH = "1774b236fa1eb46a";
 //#endregion
 //#region src/uploader/create-uploader.ts
 const STORAGE_TAB_ID = "csr:tabId";
@@ -141,6 +144,7 @@ async function createUploader(opts) {
 		return msg;
 	}), welcomeDeadline]);
 	log?.(welcome.type === "welcome" ? `tab: welcome (${"sessionId" in welcome.result ? `sessionId=${welcome.result.sessionId}` : "skipRecording"})` : `tab: dead reason=${welcome.reason}`);
+	if (welcome.type === "welcome" && urlScheme === "custom" && welcome.workerHash !== "1774b236fa1eb46a") log?.("tab: WORKER MISMATCH — the self-hosted confidence-worker.js does not match the installed SDK. Copy the updated file from node_modules/@spotify-confidence/session-recording/dist/confidence-worker.js");
 	if (welcome.type === "dead") throw new Error(`uploader: ${welcome.reason}`);
 	if ("skipRecording" in welcome.result) {
 		if (opts.forceRecord) log?.("tab: forceRecord was set but backend still skipped — backend may not support forceRecord yet");
@@ -349,6 +353,7 @@ function writeCounter(counter) {
 	sessionStorage.setItem(STORAGE_COUNTER, String(counter));
 }
 //#endregion
+exports.WORKER_HASH = WORKER_HASH;
 exports.collectUserAgentContext = collectUserAgentContext;
 exports.createUploader = createUploader;
 exports.workerScript = workerScript;

package/dist/uploader/index.d.cts

@@ -1,4 +1,4 @@
-import { a as ContextValue, i as ClientContext, o as UserAgentContext, r as Uploader, s as collectUserAgentContext, t as CreateUploaderOptions } from "../types-Bg0UKTVQ.cjs";
+import { a as ContextValue, i as ClientContext, o as UserAgentContext, r as Uploader, s as collectUserAgentContext, t as CreateUploaderOptions } from "../types-CdvFpcEN.cjs";
 
 //#region src/uploader/create-uploader.d.ts
 declare function createUploader(opts: CreateUploaderOptions): Promise<Uploader | null>;
@@ -6,4 +6,7 @@ declare function createUploader(opts: CreateUploaderOptions): Promise<Uploader |
 //#region src/uploader/worker/worker-script.d.ts
 declare const workerScript: string;
 //#endregion
-export { type ClientContext, type ContextValue, type CreateUploaderOptions, type Uploader, type UserAgentContext, collectUserAgentContext, createUploader, workerScript };
+//#region src/uploader/worker-hash.d.ts
+declare const WORKER_HASH = "1774b236fa1eb46a";
+//#endregion
+export { type ClientContext, type ContextValue, type CreateUploaderOptions, type Uploader, type UserAgentContext, WORKER_HASH, collectUserAgentContext, createUploader, workerScript };

package/dist/uploader/index.d.ts

@@ -1,4 +1,4 @@
-import { a as ContextValue, i as ClientContext, o as UserAgentContext, r as Uploader, s as collectUserAgentContext, t as CreateUploaderOptions } from "../types-Bg0UKTVQ.js";
+import { a as ContextValue, i as ClientContext, o as UserAgentContext, r as Uploader, s as collectUserAgentContext, t as CreateUploaderOptions } from "../types-CdvFpcEN.js";
 
 //#region src/uploader/create-uploader.d.ts
 declare function createUploader(opts: CreateUploaderOptions): Promise<Uploader | null>;
@@ -6,4 +6,7 @@ declare function createUploader(opts: CreateUploaderOptions): Promise<Uploader |
 //#region src/uploader/worker/worker-script.d.ts
 declare const workerScript: string;
 //#endregion
-export { type ClientContext, type ContextValue, type CreateUploaderOptions, type Uploader, type UserAgentContext, collectUserAgentContext, createUploader, workerScript };
+//#region src/uploader/worker-hash.d.ts
+declare const WORKER_HASH = "1774b236fa1eb46a";
+//#endregion
+export { type ClientContext, type ContextValue, type CreateUploaderOptions, type Uploader, type UserAgentContext, WORKER_HASH, collectUserAgentContext, createUploader, workerScript };