tracebck-sdk 0.2.0 → 0.3.0

package/README.md

@@ -65,6 +65,8 @@ init({
 | `apiKey` | `string` | **required** | Your project API key |
 | `maskAllInputs` | `boolean` | `false` | Replace all input values with `*` for privacy |
 | `captureNetwork` | `boolean` | `true` | Capture fetch and XHR requests |
+| `networkDenyUrls` | `array` | `[]` | URL patterns to exclude from network capture (strings or RegExp) |
+| `sanitizeRequest` | `function` | `null` | Callback to modify or drop captured network events |
 | `flushInterval` | `number` | `5000` | Interval in ms between event flushes |
 | `options` | `object` | `{}` | Additional [rrweb options](#rrweb-options) |
 
@@ -95,11 +97,11 @@ Browser metadata (URL, referrer, userAgent, language, resolution) is captured au
 
 ### `stopSession()`
 
-Stops recording, flushes remaining events, and closes the session. Events are also flushed automatically when the user leaves or hides the page.
+Stops recording, flushes remaining events, and closes the session. Sessions are also automatically stopped and flushed when the page is closed via `pagehide`.
 
 ## rrweb Options
 
-Pass rrweb `record()` options via the `options` field in `init()` to customize recording behavior.
+Pass additional recording options via the `options` field in `init()` to customize recording behavior.
 
 ### Privacy
 
@@ -107,7 +109,7 @@ Block elements entirely (rendered as grey placeholders in replay):
 
 ```javascript
 options: {
-  blockClass: 'no-record',       // default: 'rr-block'
+  blockClass: 'tracebck-block',  // default: 'tracebck-block'
   blockSelector: '.secret-panel'
 }
 ```
@@ -116,11 +118,19 @@ Mask text content (replaced with `*`):
 
 ```javascript
 options: {
-  maskTextClass: 'rr-mask',
+  maskTextClass: 'tracebck-mask',
   maskTextSelector: '.sensitive'
 }
 ```
 
+Ignore DOM mutations:
+
+```javascript
+options: {
+  ignoreClass: 'tracebck-ignore'
+}
+```
+
 Granular input masking:
 
 ```javascript
@@ -152,6 +162,36 @@ When `captureNetwork` is enabled (default), the SDK intercepts `fetch` and `XMLH
 
 Captured per request: method, URL, status code, headers, body (text content types only, max 100KB), and duration.
 
+**Sensitive headers** (`Authorization`, `Cookie`, `Set-Cookie`, `Proxy-Authorization`, `X-Api-Key`, `X-CSRF-Token`, `X-XSRF-Token`) are automatically stripped from captured requests for security.
+
+Exclude URLs from capture:
+
+```javascript
+init({
+  captureNetwork: true,
+  networkDenyUrls: [
+    /analytics\.example\.com/,  // RegExp pattern
+    'https://tracking.service'  // String pattern
+  ]
+});
+```
+
+Customize network events before capture:
+
+```javascript
+init({
+  captureNetwork: true,
+  sanitizeRequest: (event) => {
+    // Modify event if needed
+    if (event.request?.url.includes('sensitive')) {
+      event.request.body = '[REDACTED]';
+    }
+    // Return modified event, or null to drop it entirely
+    return event.request?.url.includes('drop-me') ? null : event;
+  }
+});
+```
+
 ## Distribution
 
 | Format | File | Usage |