midline-agent 0.3.0 → 0.4.1

package/test/agent.test.js

@@ -4,8 +4,8 @@ const test = require("node:test");
 const assert = require("node:assert/strict");
 const tls = require("tls");
 const { MidlineAgent } = require("../dist");
-const { ConfigError, loadCa, resolveIngestUrl, trustStore } = require("../dist/config");
-const { makeCerts, startCollector, closedPort, diagnostics } = require("./helpers");
+const { ConfigError, loadCa, resolveEndpointOrigin, trustStore } = require("../dist/config");
+const { makeCerts, startSocketCollector, closedPort, diagnostics } = require("./helpers");
 
 const certs = makeCerts();
 const needsOpenssl = certs ? {} : { skip: "openssl not available" };
@@ -22,27 +22,27 @@ function agentFor(endpoint, extra = {}) {
   });
 }
 
-test("endpoint: a base URL gets the ingest path, a full URL is kept", () => {
-  assert.equal(resolveIngestUrl("https://api.usemidline.com").href, "https://api.usemidline.com/api/api-monitor/events");
-  assert.equal(resolveIngestUrl("https://api.usemidline.com/").href, "https://api.usemidline.com/api/api-monitor/events");
+test("endpoint: only the origin matters, an old-style ingest path is tolerated", () => {
+  assert.equal(resolveEndpointOrigin("https://api.usemidline.com").href, "https://api.usemidline.com/");
+  assert.equal(resolveEndpointOrigin("https://api.usemidline.com/").href, "https://api.usemidline.com/");
   assert.equal(
-    resolveIngestUrl("https://api.usemidline.com/api/api-monitor/events").href,
-    "https://api.usemidline.com/api/api-monitor/events",
+    resolveEndpointOrigin("https://api.usemidline.com/api/api-monitor/events").href,
+    "https://api.usemidline.com/",
   );
   assert.equal(
-    resolveIngestUrl("https://api.usemidline.com/api/api-monitor/events/batch").href,
-    "https://api.usemidline.com/api/api-monitor/events",
+    resolveEndpointOrigin("https://api.usemidline.com/api/api-monitor/events/batch").href,
+    "https://api.usemidline.com/",
   );
-  assert.equal(resolveIngestUrl("https://gw.internal/midline").href, "https://gw.internal/midline/api/api-monitor/events");
-  assert.equal(resolveIngestUrl("http://localhost:8000").href, "http://localhost:8000/api/api-monitor/events");
-  assert.equal(resolveIngestUrl("http://127.0.0.1:8000").href, "http://127.0.0.1:8000/api/api-monitor/events");
+  assert.equal(resolveEndpointOrigin("https://gw.internal/midline").href, "https://gw.internal/");
+  assert.equal(resolveEndpointOrigin("http://localhost:8000").href, "http://localhost:8000/");
+  assert.equal(resolveEndpointOrigin("http://127.0.0.1:8000").href, "http://127.0.0.1:8000/");
 });
 
 test("endpoint: plain http to a non-loopback host is refused, so the key never travels in cleartext", () => {
-  assert.throws(() => resolveIngestUrl("http://api.usemidline.com"), ConfigError);
-  assert.throws(() => resolveIngestUrl("http://10.0.0.5:8000"), /cleartext/);
-  assert.throws(() => resolveIngestUrl("ftp://api.usemidline.com"), ConfigError);
-  assert.throws(() => resolveIngestUrl("https://user:pass@api.usemidline.com"), /credentials/);
+  assert.throws(() => resolveEndpointOrigin("http://api.usemidline.com"), ConfigError);
+  assert.throws(() => resolveEndpointOrigin("http://10.0.0.5:8000"), /cleartext/);
+  assert.throws(() => resolveEndpointOrigin("ftp://api.usemidline.com"), ConfigError);
+  assert.throws(() => resolveEndpointOrigin("https://user:pass@api.usemidline.com"), /credentials/);
 
   const { messages, onError } = diagnostics();
   const agent = new MidlineAgent({ apiKey: "ak_x", endpoint: "http://api.usemidline.com", onError });
@@ -73,7 +73,7 @@ test("custom CA: appended to the default trust store, bad input fails loudly", n
 });
 
 test("TLS: a self-signed Midline server is refused, events stay buffered, the app is unaffected", needsOpenssl, async () => {
-  const collector = await startCollector({ tls: certs.selfSigned });
+  const collector = await startSocketCollector({ tls: certs.selfSigned });
   const { messages, onError } = diagnostics();
   const agent = agentFor(collector.url, { onError });
   try {
@@ -93,13 +93,12 @@ test("TLS: a self-signed Midline server is refused, events stay buffered, the ap
 });
 
 test("TLS: a private CA passed via `ca` is trusted for the Midline server", needsOpenssl, async () => {
-  const collector = await startCollector({ tls: certs.trusted });
+  const collector = await startSocketCollector({ tls: certs.trusted });
   const agent = agentFor(collector.url, { ca: certs.ca });
   try {
     agent.addEvent({ type: "request", path: "/hello", method: "GET", statusCode: 200 });
     await agent.flush();
     assert.equal(collector.requests.length, 1);
-    assert.equal(collector.requests[0].url, "/api/api-monitor/events/batch");
     assert.equal(collector.requests[0].headers["x-api-key"], "ak_test_key");
     assert.equal(agent.queued, 0);
   } finally {
@@ -109,7 +108,7 @@ test("TLS: a private CA passed via `ca` is trusted for the Midline server", need
 });
 
 test("TLS: a trusted CA still does not excuse a certificate for the wrong hostname", needsOpenssl, async () => {
-  const collector = await startCollector({ tls: certs.wrongHost });
+  const collector = await startSocketCollector({ tls: certs.wrongHost });
   const { messages, onError } = diagnostics();
   const agent = agentFor(collector.url, { ca: certs.ca, onError });
   try {
@@ -124,7 +123,7 @@ test("TLS: a trusted CA still does not excuse a certificate for the wrong hostna
 });
 
 test("MIDLINE_CUSTOM_CA (file path) is honoured", needsOpenssl, async () => {
-  const collector = await startCollector({ tls: certs.trusted });
+  const collector = await startSocketCollector({ tls: certs.trusted });
   process.env.MIDLINE_CUSTOM_CA = certs.caPath;
   const agent = agentFor(collector.url);
   try {
@@ -139,7 +138,7 @@ test("MIDLINE_CUSTOM_CA (file path) is honoured", needsOpenssl, async () => {
 });
 
 test("wire format stays inside the long-standing ingest schema", async () => {
-  const collector = await startCollector();
+  const collector = await startSocketCollector();
   const agent = agentFor(collector.url, { environment: "test", release: "v1" });
   try {
     agent.addEvent({
@@ -176,9 +175,9 @@ test("wire format stays inside the long-standing ingest schema", async () => {
   }
 });
 
-test("5xx and 429 are retried with backoff and keep the events", async () => {
-  const collector = await startCollector({
-    respond: () => ({ status: 503, body: { message: "down" }, headers: { "retry-after": "1" } }),
+test("rate-limited acks are retried with backoff and keep the events", async () => {
+  const collector = await startSocketCollector({
+    respond: () => ({ ok: false, code: "rate_limited", message: "rate limited", retryAfterMs: 1000 }),
   });
   const { messages, onError } = diagnostics();
   const agent = agentFor(collector.url, { onError });
@@ -189,7 +188,7 @@ test("5xx and 429 are retried with backoff and keep the events", async () => {
     assert.equal(agent.queued, 2);
     assert.equal(collector.requests.length, 1, "one attempt per drain, not one per event");
 
-    collector.setResponder(() => ({ status: 201, body: { success: 2, failed: 0 } }));
+    collector.setResponder(() => ({ ok: true, accepted: 2, rejected: 0 }));
     await agent.flush();
     assert.equal(agent.queued, 0);
     assert.match(messages.at(-1), /recovered/);
@@ -199,8 +198,8 @@ test("5xx and 429 are retried with backoff and keep the events", async () => {
   }
 });
 
-test("401 turns the agent off instead of retrying forever", async () => {
-  const collector = await startCollector({ respond: () => ({ status: 401, body: { message: "Invalid API key" } }) });
+test("unauthorized turns the agent off instead of retrying forever", async () => {
+  const collector = await startSocketCollector({ respond: () => ({ ok: false, code: "unauthorized", message: "Invalid API key" }) });
   const { onError } = diagnostics();
   const agent = agentFor(collector.url, { onError });
   try {
@@ -215,8 +214,10 @@ test("401 turns the agent off instead of retrying forever", async () => {
   }
 });
 
-test("an older server's 201 with every event failed is treated as a rejected key", async () => {
-  const collector = await startCollector({ respond: (req) => ({ status: 201, body: { success: 0, failed: req.body.events.length } }) });
+test("an ack with every event rejected is treated as a rejected key", async () => {
+  const collector = await startSocketCollector({
+    respond: (record) => ({ ok: true, accepted: 0, rejected: record.body.events.length }),
+  });
   const { onError } = diagnostics();
   const agent = agentFor(collector.url, { onError });
   try {
@@ -229,14 +230,14 @@ test("an older server's 201 with every event failed is treated as a rejected key
   }
 });
 
-test("one malformed event costs only itself: a 400 batch is re-sent one by one", async () => {
-  const collector = await startCollector({
-    respond: (req) => {
-      const events = req.body.events;
+test("one malformed event costs only itself: a bad_request batch is re-sent one by one", async () => {
+  const collector = await startSocketCollector({
+    respond: (record) => {
+      const events = record.body.events;
       if (events.some((event) => event.route === "/bad")) {
-        return { status: 400, body: { message: ["route must be shorter"] } };
+        return { ok: false, code: "bad_request", message: "route must be shorter" };
       }
-      return { status: 201, body: { success: events.length, failed: 0 } };
+      return { ok: true, accepted: events.length, rejected: 0 };
     },
   });
   const { messages, onError } = diagnostics();
@@ -259,10 +260,10 @@ test("one malformed event costs only itself: a 400 batch is re-sent one by one",
   }
 });
 
-test("413 halves the batch instead of dropping it", async () => {
-  const collector = await startCollector({
-    respond: (req) =>
-      req.body.events.length > 1 ? { status: 413, body: {} } : { status: 201, body: { success: 1, failed: 0 } },
+test("too_large halves the batch instead of dropping it", async () => {
+  const collector = await startSocketCollector({
+    respond: (record) =>
+      record.body.events.length > 1 ? { ok: false, code: "too_large", message: "too large" } : { ok: true, accepted: 1, rejected: 0 },
   });
   const agent = agentFor(collector.url, { onError: () => {} });
   try {
@@ -295,14 +296,10 @@ test("unreachable Midline server: bounded queue, oldest dropped, nothing thrown"
   }
 });
 
-test("timeouts: a server that never answers does not stall delivery", async () => {
-  const http = require("http");
-  const sockets = new Set();
-  const server = http.createServer(() => {});
-  server.on("connection", (socket) => sockets.add(socket));
-  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+test("timeouts: a server that connects but never acks does not stall delivery", async () => {
+  const collector = await startSocketCollector({ noAck: true });
   const { messages, onError } = diagnostics();
-  const agent = agentFor(`http://127.0.0.1:${server.address().port}`, { onError, timeoutMs: 200 });
+  const agent = agentFor(collector.url, { onError, timeoutMs: 200 });
   try {
     agent.addEvent({ type: "request", path: "/slow" });
     const started = Date.now();
@@ -312,13 +309,12 @@ test("timeouts: a server that never answers does not stall delivery", async () =
     assert.match(messages[0], /did not answer within 200ms/);
   } finally {
     agent.close();
-    for (const socket of sockets) socket.destroy();
-    await new Promise((resolve) => server.close(resolve));
+    await collector.close();
   }
 });
 
 test("oversized events lose their captured bodies before they are dropped", async () => {
-  const collector = await startCollector();
+  const collector = await startSocketCollector();
   const agent = agentFor(collector.url, { maxEventBytes: 2048 });
   try {
     agent.addEvent({
@@ -338,7 +334,7 @@ test("oversized events lose their captured bodies before they are dropped", asyn
 });
 
 test("static facade keeps working for existing integrations", async () => {
-  const collector = await startCollector();
+  const collector = await startSocketCollector();
   try {
     const agent = MidlineAgent.init({ apiKey: "ak_static", endpoint: collector.url, flushIntervalMs: 60_000 });
     assert.equal(MidlineAgent.current, agent);

package/test/browser.test.js

@@ -0,0 +1,328 @@
+"use strict";
+
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const Midline = require("../dist/browser");
+const { BROWSER_SDK_VERSION, resolveBatchUrl } = Midline;
+
+const PAGE = "https://app.example.com/checkout";
+const INGEST = "https://api.usemidline.com/api/api-monitor/events/batch";
+const KEY = "pk_0123456789abcdef";
+
+/**
+ * A window made of Node's own web globals (EventTarget, fetch types, performance),
+ * with a fetch that answers from a table instead of the network.
+ */
+function fakeWindow({ ingestStatus = 201, ingestBody = '{"success":1}' } = {}) {
+  const win = new EventTarget();
+  const location = new URL(PAGE);
+  const calls = [];
+  const warnings = [];
+
+  Object.assign(win, {
+    location: {
+      get href() { return location.href; },
+      get origin() { return location.origin; },
+      get pathname() { return location.pathname; },
+      get hash() { return location.hash; },
+      get search() { return location.search; },
+    },
+    document: Object.assign(new EventTarget(), { visibilityState: "visible" }),
+    navigator: { userAgent: "node-test" },
+    console: {
+      warn: (...args) => warnings.push(args.join(" ")),
+      log: () => {},
+      error: () => {},
+      info: () => {},
+      debug: () => {},
+    },
+    history: {
+      pushState(_state, _title, url) { location.href = new URL(url, location.href).href; },
+      replaceState(_state, _title, url) { location.href = new URL(url, location.href).href; },
+    },
+    performance,
+  });
+
+  win.fetch = async (input, init) => {
+    const url = String(input instanceof Request ? input.url : input);
+    calls.push({ url, init });
+    if (url === INGEST) return new Response(ingestBody, { status: ingestStatus });
+    if (url.endsWith("/offline")) throw new TypeError("Failed to fetch");
+    if (url.endsWith("/aborted")) throw Object.assign(new Error("aborted"), { name: "AbortError" });
+    const status = Number(new URL(url, PAGE).searchParams.get("status") || 200);
+    return new Response(status === 204 ? null : "{}", { status });
+  };
+
+  globalThis.window = win;
+  return {
+    win,
+    calls,
+    warnings,
+    sent: () =>
+      calls
+        .filter((call) => call.url === INGEST)
+        .flatMap((call) => JSON.parse(call.init.body).events),
+  };
+}
+
+function uncaught(win, error, extra = {}) {
+  const event = new Event("error");
+  for (const [key, value] of Object.entries({ error, message: error?.message, ...extra })) {
+    Object.defineProperty(event, key, { value });
+  }
+  win.dispatchEvent(event);
+}
+
+async function withSdk(config, run, windowOptions) {
+  const env = fakeWindow(windowOptions);
+  Midline.init({ apiKey: KEY, flushIntervalMs: 60_000, captureWebVitals: false, ...config });
+  try {
+    await run(env);
+  } finally {
+    await Midline.close();
+    delete globalThis.window;
+  }
+}
+
+test("browser: the version constant matches package.json", () => {
+  assert.equal(BROWSER_SDK_VERSION, require("../package.json").version);
+});
+
+test("browser: endpoint accepts a base or ingest URL, https only except localhost", () => {
+  assert.equal(resolveBatchUrl(), INGEST);
+  assert.equal(resolveBatchUrl("https://midline.internal/"), "https://midline.internal/api/api-monitor/events/batch");
+  assert.equal(resolveBatchUrl("https://midline.internal/api/api-monitor/events"), "https://midline.internal/api/api-monitor/events/batch");
+  assert.equal(resolveBatchUrl("http://localhost:8076"), "http://localhost:8076/api/api-monitor/events/batch");
+  assert.throws(() => resolveBatchUrl("http://midline.internal"), /https/);
+  assert.throws(() => resolveBatchUrl("https://user:pw@midline.internal"), /credentials/);
+});
+
+test("browser: does nothing without a window, as during server-side rendering", async () => {
+  delete globalThis.window;
+  assert.doesNotThrow(() => Midline.init({ apiKey: KEY }));
+  assert.doesNotThrow(() => Midline.captureException(new Error("ssr")));
+  await Midline.close();
+});
+
+test("browser: refuses a server key and leaves the page untouched", async () => {
+  const env = fakeWindow();
+  const originalFetch = env.win.fetch;
+  Midline.init({ apiKey: "ak_secret_server_key" });
+  assert.equal(env.win.fetch, originalFetch);
+  assert.match(env.warnings.join("\n"), /server key \(ak_/);
+  Midline.captureException(new Error("nope"));
+  await Midline.flush();
+  assert.equal(env.calls.length, 0);
+  await Midline.close();
+  delete globalThis.window;
+});
+
+test("browser: uncaught errors and rejections become redacted error events", async () => {
+  await withSdk({ service: "checkout-web", release: "1.2.3" }, async ({ win, calls, sent }) => {
+    uncaught(win, new TypeError("cannot read password=hunter2 of undefined"), {
+      filename: "https://app.example.com/assets/app.js?token=abc",
+      lineno: 12,
+      colno: 7,
+    });
+    const rejection = new Event("unhandledrejection");
+    Object.defineProperty(rejection, "reason", { value: "plain string reason" });
+    win.dispatchEvent(rejection);
+    await Midline.flush();
+
+    const [error, rejected] = sent();
+    assert.equal(error.eventType, "error");
+    assert.equal(error.route, "/checkout");
+    assert.equal(error.payload.type, "TypeError");
+    assert.equal(error.payload.mechanism, "onerror");
+    assert.equal(error.payload.error, "cannot read password=[REDACTED] of undefined");
+    assert.equal(error.payload.context.filename, "https://app.example.com/assets/app.js");
+    assert.equal(error.service, "checkout-web");
+    assert.equal(error.release, "1.2.3");
+    assert.equal(error.metadata.sdk, "midline-agent/browser");
+    assert.equal(error.metadata.runtime, "browser");
+    assert.match(error.traceId, /^[a-f0-9]{32}$/);
+    assert.equal(error.statusCode, undefined, "a browser error is not an HTTP 500");
+
+    assert.equal(rejected.payload.error, "plain string reason");
+    assert.equal(rejected.payload.mechanism, "unhandledrejection");
+
+    const delivery = calls.find((call) => call.url === INGEST);
+    assert.equal(delivery.init.headers["X-API-Key"], KEY);
+    assert.equal(delivery.init.credentials, "omit");
+    assert.doesNotMatch(delivery.init.body, /hunter2/);
+  });
+});
+
+test("browser: the same error twice in quick succession is sent once; cross-origin 'Script error.' is skipped", async () => {
+  await withSdk({}, async ({ win, sent }) => {
+    const boom = new Error("render loop");
+    uncaught(win, boom);
+    uncaught(win, boom);
+    uncaught(win, undefined, { message: "Script error." });
+    await Midline.flush();
+    assert.equal(sent().length, 1);
+  });
+});
+
+test("browser: fetch gets a traceparent on same-origin calls only, and failures become events", async () => {
+  await withSdk({}, async ({ win, calls, sent }) => {
+    await win.fetch("/api/charges?status=500&card=4242", { method: "post" });
+    await win.fetch("https://third-party.example/pixel?status=200");
+    await win.fetch(new Request("https://app.example.com/api/cart?status=200", { headers: { "x-custom": "kept" } }));
+    await assert.rejects(win.fetch("/api/offline"));
+    await assert.rejects(win.fetch("/api/aborted"));
+    await Midline.flush();
+
+    const sameOrigin = calls.find((call) => call.url.includes("/api/charges"));
+    const traceparent = sameOrigin.init.headers.get("traceparent");
+    assert.match(traceparent, /^00-[a-f0-9]{32}-[a-f0-9]{16}-01$/);
+    assert.equal(calls.find((call) => call.url.includes("third-party")).init, undefined, "cross-origin calls are untouched");
+    const fromRequest = calls.find((call) => call.url.includes("/api/cart"));
+    assert.equal(fromRequest.init.headers.get("x-custom"), "kept", "a Request's own headers survive");
+
+    const events = sent();
+    assert.equal(events.length, 2, "only the 500 and the network failure are events; the 200s and the abort are not");
+    const [failed, offline] = events;
+    assert.equal(failed.eventType, "request");
+    assert.equal(failed.route, "/api/charges");
+    assert.equal(failed.method, "POST");
+    assert.equal(failed.statusCode, 500);
+    assert.equal(failed.severity, "high");
+    assert.equal(failed.traceId, traceparent.split("-")[1]);
+    assert.equal(failed.spanId, traceparent.split("-")[2]);
+    assert.equal(failed.payload.request.query.card, "4242");
+
+    assert.equal(offline.eventType, "error");
+    assert.equal(offline.payload.code, "NETWORK_ERROR");
+    assert.equal(offline.statusCode, undefined);
+    assert.ok(offline.payload.breadcrumbs.some((crumb) => crumb.message === "POST /api/charges 500"));
+
+    assert.ok(!events.some((event) => event.route.includes("api-monitor")), "Midline's own delivery is never recorded");
+  });
+});
+
+test("browser: captureRequests 'all' records successful calls too", async () => {
+  await withSdk({ captureRequests: "all" }, async ({ win, sent }) => {
+    await win.fetch("/api/ok?status=204");
+    await Midline.flush();
+    assert.equal(sent()[0].statusCode, 204);
+    assert.equal(sent()[0].severity, "low");
+  });
+});
+
+test("browser: a refused key switches the SDK off after one warning", async () => {
+  await withSdk(
+    {},
+    async ({ win, warnings, sent, calls }) => {
+      Midline.captureMessage("first");
+      await Midline.flush();
+      assert.match(warnings.join("\n"), /HTTP 403: This browser key isn't allowed from this origin/);
+      assert.equal(sent().length, 1);
+
+      Midline.captureMessage("second");
+      uncaught(win, new Error("after stop"));
+      await Midline.flush();
+      assert.equal(calls.filter((call) => call.url === INGEST).length, 1);
+    },
+    { ingestStatus: 403, ingestBody: JSON.stringify({ message: "This browser key isn't allowed from this origin." }) },
+  );
+});
+
+test("browser: server errors are retried rather than dropped", async () => {
+  await withSdk(
+    {},
+    async ({ calls }) => {
+      Midline.captureMessage("kept");
+      await Midline.flush();
+      assert.equal(calls.filter((call) => call.url === INGEST).length, 1);
+      // Backing off: an immediate second flush does not hammer the server.
+      await Midline.flush();
+      assert.equal(calls.filter((call) => call.url === INGEST).length, 1);
+    },
+    { ingestStatus: 503, ingestBody: "" },
+  );
+});
+
+test("browser: beforeSend can drop events and can't add fields the server would reject", async () => {
+  await withSdk(
+    {
+      beforeSend(event) {
+        if (event.payload?.message === "drop me") return null;
+        return { ...event, organisationId: "someone-else", payload: { ...event.payload, extra: "ok" } };
+      },
+    },
+    async ({ sent }) => {
+      Midline.captureMessage("drop me");
+      Midline.captureMessage("keep me", "medium");
+      await Midline.flush();
+      const events = sent();
+      assert.equal(events.length, 1);
+      assert.equal(events[0].organisationId, undefined);
+      assert.equal(events[0].payload.extra, "ok");
+      assert.equal(events[0].severity, "medium");
+    },
+  );
+});
+
+test("browser: user, tags and a rate limit", async () => {
+  await withSdk({ maxEventsPerMinute: 2 }, async ({ sent }) => {
+    Midline.setUser({ id: 42, email: "not kept" });
+    Midline.setTag("plan", "pro");
+    for (let i = 0; i < 5; i++) Midline.captureMessage(`message ${i}`);
+    await Midline.flush();
+    const events = sent();
+    assert.equal(events.length, 2);
+    assert.deepEqual(events[0].metadata.user, { id: "42" });
+    assert.deepEqual(events[0].metadata.tags, { plan: "pro" });
+  });
+});
+
+test("browser: console capture is opt-in and never loops", async () => {
+  await withSdk({ captureConsole: true }, async ({ win, sent }) => {
+    win.console.error("payment failed", { token: "secret-token", amount: 5 });
+    win.console.info("not captured");
+    await Midline.flush();
+    const [line] = sent();
+    assert.equal(sent().length, 1);
+    assert.equal(line.eventType, "console");
+    assert.equal(line.severity, "high");
+    assert.equal(line.metadata.level, "error");
+    assert.doesNotMatch(line.payload.message, /secret-token/);
+  });
+});
+
+test("browser: navigation starts a new trace; close restores everything it wrapped", async () => {
+  const env = fakeWindow();
+  const { win } = env;
+  const originalFetch = win.fetch;
+  const originalPush = win.history.pushState;
+  const originalError = win.console.error;
+
+  Midline.init({ apiKey: KEY, flushIntervalMs: 60_000, captureWebVitals: false, captureConsole: true });
+  assert.notEqual(win.fetch, originalFetch);
+
+  Midline.captureMessage("before");
+  win.history.pushState({}, "", "/orders/7");
+  Midline.captureMessage("after");
+  await Midline.flush();
+  const [before, after] = env.sent();
+  assert.equal(after.route, "/orders/7");
+  assert.notEqual(before.traceId, after.traceId);
+
+  await Midline.close();
+  assert.equal(win.fetch, originalFetch);
+  assert.equal(win.history.pushState, originalPush);
+  assert.equal(win.console.error, originalError);
+  delete globalThis.window;
+});
+
+test("browser: pending events go out with keepalive when the page is hidden", async () => {
+  await withSdk({}, async ({ win, calls }) => {
+    Midline.captureMessage("leaving");
+    win.document.visibilityState = "hidden";
+    win.document.dispatchEvent(new Event("visibilitychange"));
+    await new Promise((resolve) => setImmediate(resolve));
+    const delivery = calls.find((call) => call.url === INGEST);
+    assert.equal(delivery.init.keepalive, true);
+  });
+});

package/test/console.test.js

@@ -3,7 +3,7 @@
 const test = require("node:test");
 const assert = require("node:assert/strict");
 const { MidlineAgent } = require("../dist");
-const { startCollector, diagnostics } = require("./helpers");
+const { startSocketCollector, diagnostics } = require("./helpers");
 
 function agentFor(endpoint, extra = {}) {
   return new MidlineAgent({
@@ -47,7 +47,7 @@ const consoleEvents = (collector) => collector.events().filter((event) => event.
 
 test("console capture: printed lines become console events and the output itself is untouched", async () => {
   const streams = recordStreams();
-  const collector = await startCollector();
+  const collector = await startSocketCollector();
   const agent = agentFor(collector.url);
   try {
     const coloured = "\x1b[32m[Nest] 4242  - LOG [NestApplication] Nest application successfully started\x1b[39m\n";
@@ -95,7 +95,7 @@ test("console capture: printed lines become console events and the output itself
 
 test("console capture: the agent's own warnings are not captured, and close() puts the streams back", async () => {
   const streams = recordStreams();
-  const collector = await startCollector({ respond: () => ({ status: 503, body: { message: "down" } }) });
+  const collector = await startSocketCollector({ respond: () => ({ ok: false, code: "rate_limited", message: "down" }) });
   // No onError: the agent's diagnostics go to the console, where capture could see them.
   const agent = agentFor(collector.url);
   try {
@@ -104,7 +104,7 @@ test("console capture: the agent's own warnings are not captured, and close() pu
     await agent.flush();
     assert.ok(streams.written.stderr.some((chunk) => chunk.includes("midline:")), "the warning was printed");
 
-    collector.setResponder((req) => ({ status: 201, body: { success: req.body.events.length, failed: 0 } }));
+    collector.setResponder((record) => ({ ok: true, accepted: record.body.events.length, rejected: 0 }));
     await agent.flush();
     const messages = consoleEvents(collector).map((event) => event.payload.message);
     assert.ok(messages.includes("before the outage"));
@@ -122,16 +122,17 @@ test("console capture: the agent's own warnings are not captured, and close() pu
 
 test("console capture: a server without console events turns capture off and requests keep flowing", async () => {
   const streams = recordStreams();
-  const collector = await startCollector({
-    respond: (req) => {
-      const events = req.body.events;
+  const collector = await startSocketCollector({
+    respond: (record) => {
+      const events = record.body.events;
       if (events.some((event) => event.eventType === "console")) {
         return {
-          status: 400,
-          body: { message: ["events.1.eventType must be one of the following values: request, error, security, performance, custom"] },
+          ok: false,
+          code: "bad_request",
+          message: "events.1.eventType must be one of the following values: request, error, security, performance, custom",
         };
       }
-      return { status: 201, body: { success: events.length, failed: 0 } };
+      return { ok: true, accepted: events.length, rejected: 0 };
     },
   });
   const { messages, onError } = diagnostics();