@tracepanel/js 0.3.3 → 0.4.0

package/dist/request.js

@@ -0,0 +1,244 @@
+// What a request carried, as attributes of its trace: headers, query, cookies, the body the app read, the response's
+// headers; and the cookie that tells the widget which requests redirected to the page it is on.
+//
+// They stay on this machine (the agent keeps them out of what it sends anywhere), and the values under a sensitive
+// name are masked before they are recorded. A body is only what the app read itself, up to MAX_BODY characters: a
+// body parser's `req.body`, or the bytes the app's own reads took from the request's stream (body.ts). Tracepanel
+// never reads a request's stream for the app.
+/** How much of a body is kept, in characters. */
+export const MAX_BODY = 16_384;
+export const MASK = "********";
+const SENSITIVE = /pass(word|wd)?|secret|token|api_?key|auth|cookie|session|csrf|signature|private/i;
+/** A response's cookies are a session's keys, whatever their name. */
+const ALWAYS_MASKED = new Set(["set-cookie"]);
+/** A form as people read it: encoded, but its spaces, masks and file notes as they are. */
+const READABLE = /^[A-Za-z0-9_.~*<>,. /:@-]$/;
+/** A query's values: encoded as a form's, `+` for a space, masks and paths as they are. */
+const QUERY_SAFE = /^[A-Za-z0-9_.~*/:-]$/;
+/** A name as one segment of an attribute's key (content-type -> content_type), as the trace format has keys. */
+export function key(name) {
+    return name.toLowerCase().replace(/[^a-z0-9_]/g, "_") || "_";
+}
+/** Whether a secret goes under the name: x-api-key, csrftoken, sessionid, password. */
+export function sensitive(name) {
+    return SENSITIVE.test(name.replaceAll("-", "_"));
+}
+/** A header's value as one string: several values joined, as Node joins them. */
+export function headerValue(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    return Array.isArray(value) ? value.map(String).join(", ") : String(value);
+}
+function headers(prefix, entries) {
+    const found = {};
+    for (const [name, raw] of entries) {
+        const value = headerValue(raw);
+        if (!value)
+            continue;
+        const lowered = name.toLowerCase();
+        const attr = `${prefix}${key(lowered)}`;
+        if (ALWAYS_MASKED.has(lowered) || sensitive(lowered))
+            found[attr] = MASK;
+        else
+            found[attr] = attr in found ? `${found[attr]}, ${value}` : value;
+    }
+    return found;
+}
+/** http.request.header.<name>, the name as a key; Cookie is read as cookies instead. */
+export function requestHeaders(entries) {
+    return headers("http.request.header.", [...entries].filter(([name]) => name.toLowerCase() !== "cookie"));
+}
+/** http.response.header.<name>: several values joined, Set-Cookie masked. */
+export function responseHeaders(entries) {
+    return headers("http.response.header.", entries);
+}
+/** Percent-encoded but for the characters `safe` keeps; a space as `+` when `plus`. */
+function quote(text, safe, plus = false) {
+    let out = "";
+    for (const char of text) {
+        if (plus && char === " ")
+            out += "+";
+        else if (safe.test(char))
+            out += char;
+        else
+            for (const byte of Buffer.from(char))
+                out += `%${byte.toString(16).toUpperCase().padStart(2, "0")}`;
+    }
+    return out;
+}
+/** url.query: the query string, the values of sensitive parameters masked. */
+export function query(search) {
+    const raw = search.startsWith("?") ? search.slice(1) : search;
+    if (!raw)
+        return {};
+    const pairs = [...new URLSearchParams(raw)].map(([name, value]) => `${quote(name, QUERY_SAFE, true)}=${quote(sensitive(name) ? MASK : value, QUERY_SAFE, true)}`);
+    return { "url.query": pairs.join("&") };
+}
+/** The Cookie header's cookies by name, as they came. */
+export function parseCookies(header) {
+    const found = [];
+    for (const part of header.split(";")) {
+        const at = part.indexOf("=");
+        const name = part.slice(0, at).trim();
+        if (at >= 0 && name)
+            found.push([name, part.slice(at + 1).trim()]);
+    }
+    return found;
+}
+/** http.request.cookie.<name>, from the Cookie header; a session id or a CSRF token masked. */
+export function cookies(header) {
+    return Object.fromEntries(parseCookies(header).map(([name, value]) => [`http.request.cookie.${key(name)}`, sensitive(name) ? MASK : value]));
+}
+/** What the request carried before the app read it: its headers, query and cookies. */
+export function requestAttrs(requested, search) {
+    return {
+        ...requestHeaders(Object.entries(requested)),
+        ...query(search),
+        ...cookies(headerValue(requested.cookie) ?? ""),
+    };
+}
+/** The query string of a request's URL (/books?page=2 -> ?page=2). */
+export function searchOf(url) {
+    const at = url.indexOf("?");
+    return at < 0 ? "" : url.slice(at);
+}
+export function cut(text) {
+    if (text.length <= MAX_BODY)
+        return { "http.request.body": text };
+    return { "http.request.body": text.slice(0, MAX_BODY), "http.request.body.truncated": true };
+}
+/** A JSON value with the values under sensitive keys masked, at any depth. */
+export function masked(value) {
+    if (Array.isArray(value))
+        return value.map(masked);
+    if (value !== null && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([name, item]) => [name, sensitive(name) ? MASK : masked(item)]));
+    }
+    return value;
+}
+/** A form's fields as they would have been sent, sensitive values masked, then its files by name and size. */
+export function formText(fields, files = []) {
+    const pairs = [];
+    for (const [name, value] of fields) {
+        if (sensitive(name))
+            pairs.push([name, MASK]);
+        else if (Array.isArray(value))
+            for (const item of value)
+                pairs.push([name, plain(item)]);
+        else
+            pairs.push([name, plain(value)]);
+    }
+    for (const [field, name, size] of files)
+        pairs.push([field, `<file ${name}, ${size} bytes>`]);
+    return pairs.map(([name, value]) => `${quote(name, READABLE)}=${quote(value, READABLE)}`).join("&");
+}
+/** A form's value as text: a nested one (qs's `a[b]=c`) as JSON, its secrets masked. */
+function plain(value) {
+    return value !== null && typeof value === "object" ? JSON.stringify(masked(value)) : String(value ?? "");
+}
+export function kindOf(contentType) {
+    return (contentType.split(";", 1)[0] ?? "").trim().toLowerCase();
+}
+function isJson(kind) {
+    return kind === "application/json" || kind.endsWith("+json");
+}
+function isForm(kind) {
+    return kind === "application/x-www-form-urlencoded" || kind === "multipart/form-data";
+}
+/** A body read as text (a text or raw parser's): JSON and forms with secrets masked, text as it is, binary not. */
+function textBody(contentType, text) {
+    const kind = kindOf(contentType);
+    if (!text)
+        return {};
+    if (isJson(kind)) {
+        try {
+            return cut(JSON.stringify(masked(JSON.parse(text))));
+        }
+        catch {
+            return cut(text);
+        }
+    }
+    if (kind === "application/x-www-form-urlencoded")
+        return cut(formText(new URLSearchParams(text)));
+    if (kind.startsWith("text/") || kind === "application/xml" || kind === "application/graphql")
+        return cut(text);
+    return {};
+}
+/**
+ * http.request.body from the bytes the app read, as far as it read them: JSON and forms with secrets masked, text as
+ * it is, binary not. `complete` is false when only the start of the body is at hand: JSON or a form can't be read
+ * (nor its secrets masked) from a part of it.
+ */
+export function readBody(contentType, data, complete) {
+    const kind = kindOf(contentType);
+    if (data.length === 0 || (!complete && (isJson(kind) || isForm(kind))))
+        return {};
+    return textBody(contentType, Buffer.from(data.buffer, data.byteOffset, data.byteLength).toString("utf8"));
+}
+function uploads(file, files) {
+    const all = [];
+    if (file)
+        all.push(file);
+    if (Array.isArray(files))
+        all.push(...files);
+    else if (files && typeof files === "object")
+        for (const list of Object.values(files))
+            all.push(...[list].flat());
+    return all
+        .filter((item) => item !== null && typeof item === "object")
+        .map((item) => [String(item.fieldname ?? ""), String(item.originalname ?? ""), Number(item.size ?? 0)]);
+}
+/**
+ * http.request.body from what the app's body parser read: JSON and forms with secrets masked, text as it is, an
+ * upload's files by name and size. Nothing when no parser read it.
+ */
+export function parsedBody({ contentType, body, file, files }) {
+    const kind = kindOf(contentType);
+    const sent = uploads(file, files);
+    if (typeof body === "string")
+        return textBody(contentType, body);
+    if (body instanceof Uint8Array)
+        return textBody(contentType, Buffer.from(body).toString("utf8"));
+    if (body === undefined || body === null)
+        return sent.length > 0 ? cut(formText([], sent)) : {};
+    if (typeof body !== "object")
+        return cut(JSON.stringify(body));
+    if (isForm(kind)) {
+        const text = formText(Object.entries(body), sent);
+        return text ? cut(text) : {};
+    }
+    return cut(JSON.stringify(masked(body)));
+}
+/** Whether a request came with a body: one declared by its size, or sent in chunks. */
+export function hasBody(requested) {
+    const length = Number(headerValue(requested["content-length"]) ?? 0);
+    return length > 0 || (headerValue(requested["transfer-encoding"]) ?? "").toLowerCase().includes("chunked");
+}
+/**
+ * The requests that answered a page's navigation with a redirect, by id, on the way to the page the widget will see:
+ * its panel lists them before that page (a form's POST, then the page it redirected to).
+ */
+export const REDIRECTS = "tracepanel_redirect";
+/** How many redirects in a row are kept: a loop of them doesn't grow the cookie without end. */
+const MAX_REDIRECTS = 5;
+/** Whether the browser asked for a page to show (a link, a form): not fetch() or an image. */
+export function navigated(requested) {
+    const mode = headerValue(requested["sec-fetch-mode"]);
+    return mode !== undefined ? mode === "navigate" : (headerValue(requested.accept) ?? "").includes("text/html");
+}
+/** The Set-Cookie naming this request too, for a redirect that answers a page's navigation; undefined otherwise. */
+export function redirectCookie(id, status, requested) {
+    if (status < 300 || status >= 400 || !navigated(requested))
+        return undefined;
+    const sent = parseCookies(headerValue(requested.cookie) ?? "").find(([name]) => name === REDIRECTS)?.[1] ?? "";
+    let before;
+    try {
+        before = decodeURIComponent(sent).split(",").filter(Boolean);
+    }
+    catch {
+        before = [];
+    }
+    const value = encodeURIComponent([...before, id].slice(-MAX_REDIRECTS).join(","));
+    return `${REDIRECTS}=${value}; Max-Age=30; Path=/; SameSite=Lax`;
+}
+//# sourceMappingURL=request.js.map

package/dist/request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../src/request.ts"],"names":[],"mappings":"AAAA,qHAAqH;AACrH,gGAAgG;AAChG,EAAE;AACF,mHAAmH;AACnH,kHAAkH;AAClH,kHAAkH;AAClH,8CAA8C;AAI9C,iDAAiD;AACjD,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC;AAC/B,MAAM,CAAC,MAAM,IAAI,GAAG,UAAU,CAAC;AAC/B,MAAM,SAAS,GAAG,kFAAkF,CAAC;AACrG,sEAAsE;AACtE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;AAC9C,2FAA2F;AAC3F,MAAM,QAAQ,GAAG,4BAA4B,CAAC;AAC9C,2FAA2F;AAC3F,MAAM,UAAU,GAAG,sBAAsB,CAAC;AAE1C,gHAAgH;AAChH,MAAM,UAAU,GAAG,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC;AAC/D,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,OAAoC;IACnE,MAAM,KAAK,GAAU,EAAE,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;;YACpE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACxE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,cAAc,CAAC,OAAoC;IACjE,OAAO,OAAO,CACZ,sBAAsB,EACtB,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAC,OAAoC;IAClE,OAAO,OAAO,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC;AAED,uFAAuF;AACvF,SAAS,KAAK,CAAC,IAAY,EAAE,IAAY,EAAE,IAAI,GAAG,KAAK;IACrD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,IAAI,IAAI,KAAK,GAAG;YAAE,GAAG,IAAI,GAAG,CAAC;aAChC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,GAAG,IAAI,IAAI,CAAC;;YACjC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,GAAG,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IAC3G,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,KAAK,CAAC,MAAc;IAClC,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9D,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAC7C,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CACjH,CAAC;IACF,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,OAAO,CAAC,MAAc;IACpC,OAAO,MAAM,CAAC,WAAW,CACvB,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,uBAAuB,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAClH,CAAC;AACJ,CAAC;AAKD,uFAAuF;AACvF,MAAM,UAAU,YAAY,CAAC,SAAyB,EAAE,MAAc;IACpE,OAAO;QACL,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5C,GAAG,KAAK,CAAC,MAAM,CAAC;QAChB,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,IAAY;IAC9B,IAAI,IAAI,CAAC,MAAM,IAAI,QAAQ;QAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC;IAClE,OAAO,EAAE,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC;AAC/F,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,QAAQ,CAAC,MAAmC,EAAE,KAAK,GAA+B,EAAE;IAClG,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;aACzC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;YACpF,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,IAAI,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtG,CAAC;AAED,wFAAwF;AACxF,SAAS,KAAK,CAAC,KAAc;IAC3B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAC3G,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,WAAmB;IACxC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI,KAAK,mCAAmC,IAAI,IAAI,KAAK,qBAAqB,CAAC;AACxF,CAAC;AAED,mHAAmH;AACnH,SAAS,QAAQ,CAAC,WAAmB,EAAE,IAAY;IACjD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,mCAAmC;QAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClG,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,KAAK,iBAAiB,IAAI,IAAI,KAAK,qBAAqB;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/G,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,WAAmB,EAAE,IAAgB,EAAE,QAAiB;IAC/E,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACjC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClF,OAAO,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5G,CAAC;AASD,SAAS,OAAO,CAAC,IAAa,EAAE,KAAc;IAC5C,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;SACxC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjH,OAAO,GAAG;SACP,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC;SAC3E,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5G,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAc;IACvE,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACjE,IAAI,IAAI,YAAY,UAAU;QAAE,OAAO,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACjG,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,OAAO,CAAC,SAAyB;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC7G,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,qBAAqB,CAAC;AAC/C,gGAAgG;AAChG,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB,8FAA8F;AAC9F,MAAM,UAAU,SAAS,CAAC,SAAyB;IACjD,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtD,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAChH,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,MAAc,EAAE,SAAyB;IAClF,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7E,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/G,IAAI,MAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,EAAE,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,CAAC,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAClF,OAAO,GAAG,SAAS,IAAI,KAAK,oCAAoC,CAAC;AACnE,CAAC"}

package/dist/runtime.d.ts

@@ -1,4 +1,5 @@
 import { ConsoleUrl, Starter } from "./agent.js";
+import type { BrowserOptions } from "./browser.js";
 import { type Config } from "./config.js";
 import { TracepanelProcessor } from "./processor.js";
 import { type Badge, type BadgeRequest } from "./widget.js";
@@ -12,6 +13,14 @@ export interface Runtime {
      * OpenTelemetry (a Next.js layout) can read it without importing any of it.
      */
     badge(request: BadgeRequest): Badge | undefined;
+    /**
+     * The console on the app's own origin (Next.js serves it at /__tracepanel__/): where the widget loads from, and the
+     * page's recording as an inline script. Unset where the widget loads from the agent's own address.
+     */
+    onOrigin?: {
+        prefix: string;
+        recording(options: BrowserOptions): string;
+    };
 }
 /** The process's Tracepanel, made on first use; undefined outside development. */
 export declare function runtime(): Runtime | undefined;

package/dist/runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAE3F,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,EAAe,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAiC,KAAK,EAAE,MAAM,aAAa,CAAC;AAcnE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AAG7C,kFAAkF;AAClF,MAAM,UAAU,OAAO;IACrB,MAAM,MAAM,GAAG,UAAoB,CAAC;IACpC,IAAI,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,mBAAmB,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAY;QACpB,MAAM;QACN,SAAS;QACT,OAAO;QACP,OAAO,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;QACxC,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC;KACzC,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IACnB,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAE3F,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAEzD,OAAO,EAAe,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAiC,KAAK,EAAE,MAAM,aAAa,CAAC;AAmBnE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AAG7C,kFAAkF;AAClF,MAAM,UAAU,OAAO;IACrB,MAAM,MAAM,GAAG,UAAoB,CAAC;IACpC,IAAI,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,mBAAmB,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAY;QACpB,MAAM;QACN,SAAS;QACT,OAAO;QACP,OAAO,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;QACxC,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC;KACzC,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IACnB,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/session.d.ts

@@ -0,0 +1,10 @@
+import type { Attrs } from "./model.js";
+/** session.<key> of a session's entries, under a prefix of its own when there are several (session.<name>.<key>). */
+export declare function sessionAttrs(entries: Iterable<[string, unknown]>, prefix?: string): Attrs;
+/**
+ * The session express-session or cookie-session put on an Express request, as the handler left it; none without one.
+ * express-session's `cookie` is the session cookie's settings, not what the app keeps in it.
+ */
+export declare function expressSession(session: unknown): Attrs;
+/** h3's sessions as the request left them (`event.context.sessions`), by name: those `useSession()` read. */
+export declare function h3Sessions(sessions: unknown): Attrs;

package/dist/session.js

@@ -0,0 +1,45 @@
+// The request's session as the app left it, for the panel's Request tab, as the Python SDK records it: session.<key>,
+// each value as text, cut as an error's locals are, masked under a sensitive name and at any depth below one.
+//
+// Only a session the app already read is recorded, from where its framework keeps it decoded: express-session's and
+// cookie-session's `req.session` in Express and Nest, h3's `useSession()` in Nuxt. Nothing here decodes a cookie: a
+// sealed one (iron-session, Auth.js, h3's own) takes the app's secret.
+import { repr } from "./locals.js";
+import { key, MASK, masked } from "./request.js";
+// Keys that say who is signed in, kept as they are: Passport's `{ user }`, under a name that reads as a password's.
+const PLAIN = new Set(["passport"]);
+// Keys that hold what only the server may see, whatever is inside: nuxt-auth-utils' `secure`.
+const MASKED = new Set(["secure"]);
+function value(name, item) {
+    if (MASKED.has(name))
+        return MASK;
+    return repr(PLAIN.has(name) ? "" : name, masked(item));
+}
+/** session.<key> of a session's entries, under a prefix of its own when there are several (session.<name>.<key>). */
+export function sessionAttrs(entries, prefix = "session.") {
+    const found = {};
+    for (const [name, item] of entries) {
+        if (typeof item !== "function")
+            found[`${prefix}${key(name)}`] = value(name, item);
+    }
+    return found;
+}
+/**
+ * The session express-session or cookie-session put on an Express request, as the handler left it; none without one.
+ * express-session's `cookie` is the session cookie's settings, not what the app keeps in it.
+ */
+export function expressSession(session) {
+    if (session === null || typeof session !== "object")
+        return {};
+    const own = typeof session.regenerate === "function";
+    return sessionAttrs(Object.entries(session).filter(([name]) => !(own && name === "cookie")));
+}
+/** h3's sessions as the request left them (`event.context.sessions`), by name: those `useSession()` read. */
+export function h3Sessions(sessions) {
+    if (sessions === null || typeof sessions !== "object")
+        return {};
+    const read = Object.entries(sessions).filter((entry) => typeof entry[1]?.data === "object" && entry[1].data !== null);
+    const named = read.length > 1;
+    return Object.assign({}, ...read.map(([name, session]) => sessionAttrs(Object.entries(session.data), named ? `session.${key(name)}.` : "session.")));
+}
+//# sourceMappingURL=session.js.map

package/dist/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,sHAAsH;AACtH,8GAA8G;AAC9G,EAAE;AACF,oHAAoH;AACpH,oHAAoH;AACpH,uEAAuE;AAEvE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEjD,oHAAoH;AACpH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;AACpC,8FAA8F;AAC9F,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;AAEnC,SAAS,KAAK,CAAC,IAAY,EAAE,IAAa;IACxC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,YAAY,CAAC,OAAoC,EAAE,MAAM,GAAG,UAAU;IACpF,MAAM,KAAK,GAAU,EAAE,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,IAAI,OAAO,IAAI,KAAK,UAAU;YAAE,KAAK,CAAC,GAAG,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC/D,MAAM,GAAG,GAAG,OAAQ,OAAoC,CAAC,UAAU,KAAK,UAAU,CAAC;IACnF,OAAO,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,UAAU,CAAC,QAAiB;IAC1C,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAC1C,CAAC,KAAK,EAAuC,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAC7G,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC,MAAM,CAClB,EAAE,EACF,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAC9B,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CACzF,CACF,CAAC;AACJ,CAAC"}

package/dist/setup.js

@@ -20,8 +20,10 @@ import { BullMQInstrumentation } from "./bullmq.js";
 import { captureConsole } from "./console.js";
 import { DatabasesInstrumentation } from "./explain.js";
 import { traceFetch } from "./fetch.js";
+import { PinoLogs, WinstonLogs } from "./loggers.js";
 import { NestLogs } from "./logs.js";
 import { traceBunCalls } from "./outgoing.js";
+import { ATTRIBUTE as PROFILE, requested } from "./profile.js";
 import { runtime } from "./runtime.js";
 import { TransactionsInstrumentation } from "./transactions.js";
 const STARTED = Symbol.for("tracepanel.started");
@@ -80,6 +82,8 @@ export function start(options = {}) {
         // A Nest app runs on Express: Nest's spans name the controller and method that handled the request.
         nest(),
         new NestLogs(tracepanel.processor),
+        new PinoLogs(tracepanel.processor),
+        new WinstonLogs(tracepanel.processor),
         new PgInstrumentation({ enhancedDatabaseReporting: true }),
         new MySQL2Instrumentation(),
         new IORedisInstrumentation(),
@@ -89,7 +93,8 @@ export function start(options = {}) {
         new PrismaInstrumentation(),
         // BEGIN … COMMIT on a connection as a transaction span: after pg's and mysql2's, so its statements are inside.
         new TransactionsInstrumentation(),
-        new BullMQInstrumentation(),
+        // Its jobs' task events too, for the console's Live list.
+        new BullMQInstrumentation(tracepanel.processor),
         // The databases the app queries, for the console's EXPLAIN.
         new DatabasesInstrumentation(),
         // fetch(): Node's own, through undici (Bun's: traceBunCalls() below).
@@ -101,6 +106,10 @@ export function start(options = {}) {
             // A CORS preflight (the browser asking before a call with a traceparent) is the browser's, not the app's work.
             ignoreIncomingRequestHook: (request) => options.httpServer === false ||
                 (request.method === "OPTIONS" && request.headers["access-control-request-method"] !== undefined),
+            // A request that asks to be profiled says so on its span, as it starts.
+            startIncomingSpanHook: (request) => tracepanel.config.profileEnabled && "headers" in request && requested(request.headers)
+                ? { [PROFILE]: true }
+                : {},
         }),
     ];
     registerInstrumentations({ instrumentations });

package/dist/setup.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup.js","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":"AAAA,sHAAsH;AACtH,mGAAmG;AAEnG,OAAO,UAAU,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAwB,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAChG,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,QAAQ,IAAI,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAC3G,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAgB,OAAO,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAUhE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AAEjD;;;;GAIG;AACH,SAAS,IAAI;IACX,MAAM,eAAe,GAAG,IAAI,mBAAmB,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,eAAgF,CAAC;IAChG,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,MAAM,CAAC,gBAAgB,GAAG,CAAC,aAAa,EAAE,EAAE;QAC1C,IAAI,CAAC;YACH,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;gBACvE,KAAK,MAAM,IAAI,IAAI,CAAC,8BAA8B,EAAE,iDAAiD,CAAC,EAAE,CAAC;oBACvG,WAAW,CAAC,IAAI,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;YAClD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY;IACnB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,YAAY,IAAI,6CAA6C,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACpH,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,KAAK,CAAC,OAAO,GAAY,EAAE;IACzC,MAAM,UAAU,GAAG,OAAO,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,UAAqC,CAAC;IACrD,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,YAAY,EAAE;QAAE,OAAO,UAAU,CAAC;IACxE,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IACvB,kHAAkH;IAClH,+FAA+F;IAC/F,IAAI,iBAAiB,EAAE,IAAI,OAAO,UAAU,CAAC,aAAa,KAAK,UAAU;QAAE,iBAAiB,EAAE,CAAC;;QAC1F,QAAQ,CAAC,yCAAyC,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1E,IAAI,kBAAkB,CAAC,EAAE,cAAc,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC9E,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,KAAK,SAAS,CAAC;IAC/C,MAAM,gBAAgB,GAAsB;QAC1C,IAAI,sBAAsB,EAAE;QAC5B,oGAAoG;QACpG,IAAI,EAAE;QACN,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAClC,IAAI,iBAAiB,CAAC,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC;QAC1D,IAAI,qBAAqB,EAAE;QAC3B,IAAI,sBAAsB,EAAE;QAC5B,IAAI,oBAAoB,EAAE;QAC1B,4GAA4G;QAC5G,IAAI,sBAAsB,CAAC,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC;QAC/D,IAAI,qBAAqB,EAAE;QAC3B,+GAA+G;QAC/G,IAAI,2BAA2B,EAAE;QACjC,IAAI,qBAAqB,EAAE;QAC3B,4DAA4D;QAC5D,IAAI,wBAAwB,EAAE;QAC9B,sEAAsE;QACtE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC;QAC7C,gHAAgH;QAChH,IAAI,mBAAmB,CAAC;YACtB,+CAA+C;YAC/C,yBAAyB,EAAE,GAAG,EAAE,CAAC,GAAG;YACpC,+GAA+G;YAC/G,yBAAyB,EAAE,CAAC,OAAO,EAAE,EAAE,CACrC,OAAO,CAAC,UAAU,KAAK,KAAK;gBAC5B,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,+BAA+B,CAAC,KAAK,SAAS,CAAC;SACnG,CAAC;KACH,CAAC;IACF,wBAAwB,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC/C,8GAA8G;IAC9G,2FAA2F;IAC3F,IAAI,GAAG;QAAE,aAAa,EAAE,CAAC;;QACpB,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACrC,OAAO,UAAU,CAAC;AACpB,CAAC"}
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":"AAAA,sHAAsH;AACtH,mGAAmG;AAEnG,OAAO,UAAU,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAwB,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAChG,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,QAAQ,IAAI,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAC3G,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,SAAS,IAAI,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAgB,OAAO,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAUhE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AAEjD;;;;GAIG;AACH,SAAS,IAAI;IACX,MAAM,eAAe,GAAG,IAAI,mBAAmB,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,eAAgF,CAAC;IAChG,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,MAAM,CAAC,gBAAgB,GAAG,CAAC,aAAa,EAAE,EAAE;QAC1C,IAAI,CAAC;YACH,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;gBACvE,KAAK,MAAM,IAAI,IAAI,CAAC,8BAA8B,EAAE,iDAAiD,CAAC,EAAE,CAAC;oBACvG,WAAW,CAAC,IAAI,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;YAClD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY;IACnB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,YAAY,IAAI,6CAA6C,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACpH,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,KAAK,CAAC,OAAO,GAAY,EAAE;IACzC,MAAM,UAAU,GAAG,OAAO,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,UAAqC,CAAC;IACrD,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,YAAY,EAAE;QAAE,OAAO,UAAU,CAAC;IACxE,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IACvB,kHAAkH;IAClH,+FAA+F;IAC/F,IAAI,iBAAiB,EAAE,IAAI,OAAO,UAAU,CAAC,aAAa,KAAK,UAAU;QAAE,iBAAiB,EAAE,CAAC;;QAC1F,QAAQ,CAAC,yCAAyC,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1E,IAAI,kBAAkB,CAAC,EAAE,cAAc,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC9E,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,KAAK,SAAS,CAAC;IAC/C,MAAM,gBAAgB,GAAsB;QAC1C,IAAI,sBAAsB,EAAE;QAC5B,oGAAoG;QACpG,IAAI,EAAE;QACN,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAClC,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAClC,IAAI,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC;QACrC,IAAI,iBAAiB,CAAC,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC;QAC1D,IAAI,qBAAqB,EAAE;QAC3B,IAAI,sBAAsB,EAAE;QAC5B,IAAI,oBAAoB,EAAE;QAC1B,4GAA4G;QAC5G,IAAI,sBAAsB,CAAC,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC;QAC/D,IAAI,qBAAqB,EAAE;QAC3B,+GAA+G;QAC/G,IAAI,2BAA2B,EAAE;QACjC,0DAA0D;QAC1D,IAAI,qBAAqB,CAAC,UAAU,CAAC,SAAS,CAAC;QAC/C,4DAA4D;QAC5D,IAAI,wBAAwB,EAAE;QAC9B,sEAAsE;QACtE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC;QAC7C,gHAAgH;QAChH,IAAI,mBAAmB,CAAC;YACtB,+CAA+C;YAC/C,yBAAyB,EAAE,GAAG,EAAE,CAAC,GAAG;YACpC,+GAA+G;YAC/G,yBAAyB,EAAE,CAAC,OAAO,EAAE,EAAE,CACrC,OAAO,CAAC,UAAU,KAAK,KAAK;gBAC5B,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,+BAA+B,CAAC,KAAK,SAAS,CAAC;YAClG,wEAAwE;YACxE,qBAAqB,EAAE,CAAC,OAAO,EAAE,EAAE,CACjC,UAAU,CAAC,MAAM,CAAC,cAAc,IAAI,SAAS,IAAI,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC;gBACpF,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE;gBACrB,CAAC,CAAC,EAAE;SACT,CAAC;KACH,CAAC;IACF,wBAAwB,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC/C,8GAA8G;IAC9G,2FAA2F;IAC3F,IAAI,GAAG;QAAE,aAAa,EAAE,CAAC;;QACpB,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACrC,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/stack.d.ts

@@ -1,13 +1,37 @@
 import type { Frame } from "./model.js";
+/** Whether a file is this package's own. */
+export declare function ownFile(file: string): boolean;
 export interface StackFrame {
     function: string;
     file: string;
     line: number;
 }
-export declare function parseStack(stack: string | undefined): StackFrame[];
+/**
+ * The frames of a V8 stack, innermost first. `mapped`: a bundle's frames as the app's sources, through its source
+ * map; without it, where the code that ran is, as the debugger sees it.
+ */
+export declare function parseStack(stack: string | undefined, mapped?: boolean): StackFrame[];
+/** Whether a line of a V8 stack is an `async` one: a caller waiting for the frame above, not running under it. */
+export declare function asyncFrames(stack: string | undefined): boolean[];
+/** Where a function is in the app's source: a file URL or path and a line and column (1-based) of the code that ran. */
+export declare function place(url: string, line: number, column: number): StackFrame;
 /** The project's own code: under the root, not a dependency, not a bundle, not Node's, not Tracepanel's. */
 export declare function inApp(file: string, root: string): boolean;
 /** `file:line in function` of the innermost frame of the app's own code on the current stack, or null. */
 export declare function origin(root: string): string | null;
-/** An error's frames, outermost first as the console shows every SDK's, with the source of the app's own. */
-export declare function frames(stack: string | undefined, root: string): Frame[];
+/**
+ * Where the call being made now was made. `origin`: `file:line in function` of the innermost frame of the app's own
+ * code. Without one, `caller`: the library code that asked for it, the first frame past the driver, its ORM and
+ * Tracepanel (`connect-pg-simple/index.js:… in PGStore.get`), as the Python SDK's code.caller names it.
+ */
+export declare function madeAt(root: string): {
+    origin: string | null;
+    caller: string | null;
+};
+/**
+ * An error's frames, outermost first as the console shows every SDK's, with the source of the app's own. `locals`:
+ * the local variables of the app's frames, by the frame's place in the stack (innermost first), when they were read.
+ */
+export declare function frames(stack: string | undefined, root: string, locals?: readonly (Record<string, string> | undefined)[]): Frame[];
+/** A library's file as its package names it (express/lib/router/index.js), Node's own as Node names them. */
+export declare function libraryPath(file: string): string;

package/dist/stack.js

@@ -1,4 +1,5 @@
-// The app's own code in a V8 stack: where a query was made (code.origin), and an error's frames with their source.
+// The app's own code in a V8 stack: where a query was made (code.origin), or the library code that asked for one
+// none of the app's code made (code.caller); and an error's frames with their source.
 import { readFileSync } from "node:fs";
 import nodeModule, {} from "node:module";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
@@ -8,7 +9,15 @@ const CONTEXT_LINES = 5;
 const FRAME = /^\s*at (?:async )?(?:(.+?) \()?(.+?):(\d+):(\d+)\)?$/;
 // This package's own files are never the app's.
 const OWN = fileURLToPath(new URL(".", import.meta.url));
-export function parseStack(stack) {
+/** Whether a file is this package's own. */
+export function ownFile(file) {
+    return file.startsWith(OWN);
+}
+/**
+ * The frames of a V8 stack, innermost first. `mapped`: a bundle's frames as the app's sources, through its source
+ * map; without it, where the code that ran is, as the debugger sees it.
+ */
+export function parseStack(stack, mapped = true) {
     const frames = [];
     for (const line of (stack ?? "").split("\n").slice(1)) {
         const match = FRAME.exec(line);
@@ -16,10 +25,19 @@ export function parseStack(stack) {
             continue;
         const [, fn, location, lineno, column] = match;
         const file = location?.startsWith("file://") ? fileURLToPath(location) : (location ?? "");
-        frames.push(original({ function: fn ?? "<anonymous>", file, line: Number(lineno) }, Number(column)));
+        const frame = { function: fn ?? "<anonymous>", file, line: Number(lineno) };
+        frames.push(mapped ? original(frame, Number(column)) : frame);
     }
     return frames;
 }
+/** Whether a line of a V8 stack is an `async` one: a caller waiting for the frame above, not running under it. */
+export function asyncFrames(stack) {
+    return (stack ?? "")
+        .split("\n")
+        .slice(1)
+        .filter((line) => FRAME.test(line))
+        .map((line) => /^\s*at async /.test(line));
+}
 // A dev server's bundle (`next dev`'s .next/dev/server/chunks/*.js, `nuxt dev`'s .nuxt/dev/index.mjs) runs the app's
 // code: its frames are mapped back to the app's sources through the bundle's source map. The frames of a bundle
 // without one are the bundler's glue, never the app's.
@@ -75,6 +93,12 @@ function sourcePath(source, mapFile, sourceRoot) {
         return resolve(process.cwd(), webpack[1] ?? "");
     return isAbsolute(source) ? source : resolve(dirname(mapFile), sourceRoot, source);
 }
+/** Where a function is in the app's source: a file URL or path and a line and column (1-based) of the code that ran. */
+export function place(url, line, column) {
+    const file = url.startsWith("file://") ? fileURLToPath(url) : url;
+    // This package's own code stays where it is: its source map leads out of it, to its TypeScript.
+    return ownFile(file) ? { function: "", file, line } : original({ function: "", file, line }, column);
+}
 /** The frame in the app's source, when its file is a bundle with a source map. */
 function original(frame, column) {
     if (!frame.file || !isAbsolute(frame.file) || frame.file.includes(`${sep}node_modules${sep}`))
@@ -121,8 +145,73 @@ function deepStack() {
 }
 /** `file:line in function` of the innermost frame of the app's own code on the current stack, or null. */
 export function origin(root) {
-    const frame = parseStack(deepStack()).find((candidate) => inApp(candidate.file, root));
-    return frame ? `${relative(root, frame.file)}:${frame.line} in ${shortName(frame.function)}` : null;
+    return madeAt(root).origin;
+}
+// What makes a call rather than asks for one: the drivers, the ORMs and query builders on them, their pools, the
+// instrumentation around them and the hooks that load it. Past these is the library code that wanted the call made
+// (a session store, an admin panel, a job queue).
+const CALL_LAYERS = new Set([
+    "@opentelemetry",
+    "@prisma",
+    "@mikro-orm",
+    "@redis",
+    "@tracepanel",
+    "drizzle-orm",
+    "generic-pool",
+    "import-in-the-middle",
+    "ioredis",
+    "knex",
+    "kysely",
+    "mongodb",
+    "mongoose",
+    "mysql",
+    "mysql2",
+    "objection",
+    "pg",
+    "pg-cursor",
+    "pg-pool",
+    "pg-protocol",
+    "prisma",
+    "redis",
+    "require-in-the-middle",
+    "sequelize",
+    "shimmer",
+    "tarn",
+    "tslib",
+    "typeorm",
+]);
+/** The installed package a file is in (pg, @prisma/client's scope @prisma), or null for a file in none. */
+function packageOf(file) {
+    const at = file.lastIndexOf(`${sep}node_modules${sep}`);
+    if (at < 0)
+        return null;
+    return file.slice(at + `${sep}node_modules${sep}`.length).split(sep)[0] ?? null;
+}
+/** Whether a frame is library code that may have asked for a call: not a driver's, Node's, Tracepanel's or glue. */
+function asks(file, root) {
+    if (!isAbsolute(file) || ownFile(file))
+        return false;
+    const name = packageOf(file);
+    if (name !== null)
+        return !CALL_LAYERS.has(name);
+    // A bundle's frame that no source map led out of is the bundler's glue.
+    return !BUNDLES.some((dir) => file.startsWith(root + dir));
+}
+/**
+ * Where the call being made now was made. `origin`: `file:line in function` of the innermost frame of the app's own
+ * code. Without one, `caller`: the library code that asked for it, the first frame past the driver, its ORM and
+ * Tracepanel (`connect-pg-simple/index.js:… in PGStore.get`), as the Python SDK's code.caller names it.
+ */
+export function madeAt(root) {
+    const stack = parseStack(deepStack());
+    const own = stack.find((frame) => inApp(frame.file, root));
+    if (own)
+        return { origin: `${relative(root, own.file)}:${own.line} in ${shortName(own.function)}`, caller: null };
+    const asked = stack.find((frame) => asks(frame.file, root));
+    return {
+        origin: null,
+        caller: asked ? `${libraryPath(asked.file)}:${asked.line} in ${shortName(asked.function)}` : null,
+    };
 }
 function shortName(fn) {
     return fn.replace(/^Object\.|^Module\./, "");
@@ -137,10 +226,13 @@ function sourceAround(file, line) {
         return { start: null, context: [] };
     }
 }
-/** An error's frames, outermost first as the console shows every SDK's, with the source of the app's own. */
-export function frames(stack, root) {
+/**
+ * An error's frames, outermost first as the console shows every SDK's, with the source of the app's own. `locals`:
+ * the local variables of the app's frames, by the frame's place in the stack (innermost first), when they were read.
+ */
+export function frames(stack, root, locals) {
     return parseStack(stack)
-        .map((frame) => {
+        .map((frame, index) => {
         const own = inApp(frame.file, root);
         const { start, context } = own ? sourceAround(frame.file, frame.line) : { start: null, context: [] };
         return {
@@ -151,9 +243,14 @@ export function frames(stack, root) {
             in_app: own,
             context_start: start,
             context,
-            locals: {},
+            locals: (own && locals?.[index]) || null,
         };
     })
         .reverse();
 }
+/** A library's file as its package names it (express/lib/router/index.js), Node's own as Node names them. */
+export function libraryPath(file) {
+    const at = file.lastIndexOf(`${sep}node_modules${sep}`);
+    return at >= 0 ? file.slice(at + `${sep}node_modules${sep}`.length) : file;
+}
 //# sourceMappingURL=stack.js.map