@tracescout/browser 2.2.0-beta.0

package/CHANGELOG.md

@@ -0,0 +1,25 @@
+# Changelog
+
+## 2.2.0-beta.0 — 2026-07-15
+
+First public npm release (`@tracescout/browser`, beta). Published with an
+explicit `beta` dist-tag; `latest` is not assigned.
+
+### Fixed
+- **SSR-import safety:** the fetch interceptor no longer binds `window.fetch` at
+  module load, so `import '@tracescout/browser'` is safe in a Node/SSR context
+  (e.g. Next.js). Runtime behavior in the browser is unchanged. Required for
+  correct npm packaging; no other runtime change.
+
+### Included from 2.1.x
+- Same-origin-only trace/baggage propagation (third-party origins and the SDK's
+  own ingest endpoints receive neither; existing `traceparent` preserved).
+- Session replay, console/error capture, Web Vitals, fetch/XHR capture with
+  header sanitization; v1 project-scoped event contract.
+
+### Packaging
+- Distributed as compiled, minified bundles: `dist/tracescout.esm.min.js` (ESM)
+  and `dist/tracescout.min.js` (UMD). Function/class names preserved; no
+  property-name mangling; no source maps in the package; no TypeScript sources,
+  tests, or internal docs shipped. The npm package and the versioned CDN artifact
+  are built from the same release commit.

package/LICENSE

@@ -0,0 +1,85 @@
+TRACESCOUT BROWSER SDK LICENSE (BETA)
+
+Copyright 2026 TraceScout. All rights reserved.
+
+IMPORTANT: This is proprietary beta license language provided for use with the
+@tracescout/browser beta releases. It should receive review by qualified legal
+counsel before any general-availability release.
+
+1. DEFINITIONS
+   "SDK" means the @tracescout/browser software package, in object code /
+   compiled form, including its bundled files, type declarations, and
+   accompanying documentation.
+   "TraceScout Service" means the hosted observability services offered by
+   TraceScout, including its ingestion APIs and dashboards.
+   "You" means the individual or entity installing or using the SDK.
+
+2. LICENSE GRANT
+   Subject to your compliance with this license, TraceScout grants you a
+   limited, non-exclusive, non-transferable, non-sublicensable, revocable
+   right to install and use the SDK, in unmodified object code form only,
+   solely to integrate your applications with, and to use, the TraceScout
+   Service under a valid TraceScout account. No other rights are granted,
+   whether by implication, estoppel, or otherwise.
+
+3. RESTRICTIONS
+   Except as expressly permitted in Section 2, you shall not, and shall not
+   permit or assist any third party to:
+   (a) redistribute, publish, sublicense, rent, lease, sell, or otherwise
+       transfer the SDK or any part of it;
+   (b) modify, adapt, translate, or create derivative works of the SDK;
+   (c) disclose, publish, or otherwise make available the SDK's source code
+       or any non-public aspect of its design or implementation;
+   (d) use the SDK, or any knowledge of its operation, to build, train,
+       improve, or assist a product or service that competes with the
+       TraceScout Service;
+   (e) reverse engineer, decompile, or disassemble the SDK, except and only
+       to the extent that such restriction is prohibited or rendered
+       unenforceable by applicable law notwithstanding this limitation;
+   (f) remove, alter, or obscure any copyright, trademark, or other
+       proprietary notice included with the SDK; or
+   (g) use the SDK other than in connection with the TraceScout Service.
+
+4. OWNERSHIP
+   The SDK is licensed, not sold. TraceScout and its licensors retain all
+   right, title, and interest in and to the SDK, including all intellectual
+   property rights. All rights not expressly granted are reserved.
+
+5. BETA SOFTWARE
+   The SDK is provided as beta software. It may contain defects, may change
+   materially between releases without notice, and may be discontinued.
+   TraceScout may suspend or terminate this license at any time.
+
+6. FEEDBACK
+   If you provide feedback about the SDK, you grant TraceScout a perpetual,
+   irrevocable, worldwide, royalty-free right to use that feedback without
+   restriction or obligation to you.
+
+7. NO WARRANTY
+   THE SDK IS PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTY OF ANY
+   KIND, EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WITHOUT
+   LIMITATION ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+   PURPOSE, TITLE, NON-INFRINGEMENT, OR THAT THE SDK WILL BE UNINTERRUPTED,
+   ERROR-FREE, OR SECURE. YOU USE THE SDK AT YOUR OWN RISK.
+
+8. LIMITATION OF LIABILITY
+   TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL
+   TRACESCOUT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL,
+   EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, DATA,
+   OR GOODWILL, ARISING OUT OF OR RELATING TO THE SDK OR THIS LICENSE,
+   HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THE
+   POSSIBILITY OF SUCH DAMAGES. TRACESCOUT'S TOTAL AGGREGATE LIABILITY
+   ARISING OUT OF OR RELATING TO THE SDK OR THIS LICENSE WILL NOT EXCEED
+   ONE HUNDRED U.S. DOLLARS (US $100).
+
+9. TERMINATION
+   This license terminates automatically if you breach it. Upon termination
+   you must cease all use of the SDK and delete all copies. Sections 3, 4,
+   and 6 through 10 survive termination.
+
+10. GENERAL
+   If any provision of this license is held unenforceable, the remaining
+   provisions remain in full force. Failure to enforce a provision is not a
+   waiver. This license constitutes the entire agreement between you and
+   TraceScout concerning the SDK and supersedes any prior understanding
+   regarding its subject matter.

package/README.md

@@ -0,0 +1,82 @@
+# @tracescout/browser
+
+Browser SDK for TraceScout: session replay, error & console capture, Web Vitals,
+and automatic fetch/XHR network capture — with W3C trace-context correlation to
+your backend logs. **Beta.**
+
+Only a **public project ID** is required in the browser. **Never put a private
+ingest key, admin credential, or server secret in browser code** — the browser
+SDK does not use or accept one.
+
+## Install
+
+### npm (bundlers: React, Vite, Next.js, Vue, Angular)
+
+```bash
+npm install @tracescout/browser@beta
+```
+
+```js
+import TraceScout from '@tracescout/browser';
+
+TraceScout.init('YOUR_PROJECT_ID');
+```
+
+- ESM (`dist/tracescout.esm.min.js`) is used by bundlers; a UMD build
+  (`dist/tracescout.min.js`) covers CommonJS/`require` and `<script>`.
+- **SSR-safe import:** importing the package on the server does not touch
+  `window`. Call `init()` only in the browser (e.g. a Next.js client component
+  or inside `useEffect`).
+
+### Direct `<script>` / CDN (version-pinned)
+
+Pin an **immutable, versioned** URL in production — do not use an unversioned
+"latest" URL for production customers:
+
+```html
+<script src="https://cdn.tracescout.com/sdk/v2.2.0-beta.0/tracescout.min.js"></script>
+<script>TraceScout.init('YOUR_PROJECT_ID');</script>
+```
+
+The CDN artifact at a given version is built from the same release commit as the
+npm package of that version, so they never differ behaviorally.
+
+## What it captures
+
+- **Session replay** (rrweb), **console** and **JS errors**, **Web Vitals**,
+  and **fetch / XHR** requests (method, URL, status, timing, and — for API
+  calls — headers and bodies), shown in the TraceScout dashboard.
+- **Header sanitization:** credential-bearing request/response headers
+  (`authorization`, `cookie`, `x-api-key`, …) are redacted before capture.
+
+## Trace propagation (safe by default)
+
+- A W3C `traceparent` header is added to **same-origin** outbound `fetch`/`XHR`
+  requests so browser activity correlates with your backend traces.
+- **An existing valid `traceparent` is never overwritten.**
+- **Third-party origins receive no `traceparent` and no TraceScout baggage** —
+  your `sessionId`/`userId`/`projectId` are never sent to other hosts, and no
+  CORS preflight is added to cross-origin calls.
+- **Trusted cross-origin propagation is not enabled in this beta.** If your app
+  calls a different-origin backend and you need the trace linked across it, that
+  is a separate, explicit configuration (not yet available) — same-origin is the
+  default.
+- The SDK never instruments its own ingestion requests.
+
+## Public API
+
+```js
+TraceScout.init('YOUR_PROJECT_ID', { environment: 'production' });
+TraceScout.identify('user_123', { plan: 'pro' });
+TraceScout.track('checkout_completed', { total: 42 });
+TraceScout.setUserMetadata({ plan: 'pro' });
+```
+
+## Version / CDN alignment
+
+The npm version and the CDN `…/sdk/v<version>/…` path are produced from the same
+release commit. Pin the same version in both places.
+
+## Docs
+
+https://docs.tracescout.com/docs/getting-started/installation