@amplitude/session-replay-browser 1.50.3 → 1.51.0

package/README.md

@@ -525,3 +525,18 @@ sessionReplay.init(AMPLITUDE_API_KEY, {
 })
 ```
 
+
+#### 5. Use data attributes
+
+Use `data-amp-block`, `data-amp-mask`, and `data-amp-unmask` as alternatives to
+`amp-block`, `amp-mask`, and `amp-unmask` classes. No configuration is required.
+
+```html
+<section data-amp-block>Excluded from replay</section>
+<p data-amp-mask>Masked text</p>
+<input data-amp-unmask />
+```
+
+Attribute presence enables the annotation, regardless of its value. Explicit
+masking on an element or ancestor takes precedence over unmasking, and blocked
+subtrees remain excluded.

package/lib/cjs/config/joined-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"joined-config.d.ts","sourceRoot":"","sources":["../../../src/config/joined-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAA4C,MAAM,2BAA2B,CAAC;AAEnH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,EACL,wBAAwB,IAAI,yBAAyB,EACrD,aAAa,EACb,oBAAoB,EAGrB,MAAM,SAAS,CAAC;AAajB,eAAO,MAAM,uCAAuC,kBAAmB,aAAa,kBAAkB,OAAO,kBA0B5G,CAAC;AACF,qBAAa,kCAAkC;IAC7C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4B;IACxD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;gBAE7C,kBAAkB,EAAE,mBAAmB,EAAE,WAAW,EAAE,yBAAyB;IAKrF,oBAAoB,IAAI,OAAO,CAAC,oBAAoB,CAAC;IA+L3D;;;;;;OAMG;IACH,OAAO,CAAC,4BAA4B;CAmBrC;AAED;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAElD,eAAO,MAAM,wCAAwC,WAAkB,MAAM,WAAW,oBAAoB,gDAc3G,CAAC"}
+{"version":3,"file":"joined-config.d.ts","sourceRoot":"","sources":["../../../src/config/joined-config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAA4C,MAAM,2BAA2B,CAAC;AAEnH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,EACL,wBAAwB,IAAI,yBAAyB,EACrD,aAAa,EACb,oBAAoB,EAGrB,MAAM,SAAS,CAAC;AAajB,eAAO,MAAM,uCAAuC,kBAAmB,aAAa,kBAAkB,OAAO,kBAW5G,CAAC;AACF,qBAAa,kCAAkC;IAC7C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4B;IACxD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;gBAE7C,kBAAkB,EAAE,mBAAmB,EAAE,WAAW,EAAE,yBAAyB;IAKrF,oBAAoB,IAAI,OAAO,CAAC,oBAAoB,CAAC;IA+L3D;;;;;;OAMG;IACH,OAAO,CAAC,4BAA4B;CAmBrC;AAED;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAElD,eAAO,MAAM,wCAAwC,WAAkB,MAAM,WAAW,oBAAoB,gDAc3G,CAAC"}

package/lib/cjs/config/joined-config.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createSessionReplayJoinedConfigGenerator = exports.MAX_MIN_SESSION_DURATION_MS = exports.SessionReplayJoinedConfigGenerator = exports.removeInvalidSelectorsFromPrivacyConfig = void 0;
 var tslib_1 = require("tslib");
+var session_replay_dom_privacy_1 = require("@amplitude/session-replay-dom-privacy");
 var analytics_core_1 = require("@amplitude/analytics-core");
 var helpers_1 = require("../helpers");
 var local_config_1 = require("./local-config");
@@ -16,32 +17,12 @@ var local_config_1 = require("./local-config");
 // otherwise win the synchronous race in 'all' mode.
 var REMOTE_CONFIG_TIMEOUT_MS = 1500;
 var removeInvalidSelectorsFromPrivacyConfig = function (privacyConfig, loggerProvider) {
-    // This allows us to not search the DOM.
     var fragment = document.createDocumentFragment();
-    var dropInvalidSelectors = function (selectors) {
-        if (selectors === void 0) { selectors = []; }
-        if (typeof selectors === 'string') {
-            selectors = [selectors];
-        }
-        selectors = selectors.filter(function (selector) {
-            try {
-                fragment.querySelector(selector);
-            }
-            catch (_a) {
-                loggerProvider.warn("[session-replay-browser] omitting selector \"".concat(selector, "\" because it is invalid"));
-                return false;
-            }
-            return true;
-        });
-        if (selectors.length === 0) {
-            return undefined;
-        }
-        return selectors;
-    };
-    privacyConfig.blockSelector = dropInvalidSelectors(privacyConfig.blockSelector);
-    privacyConfig.maskSelector = dropInvalidSelectors(privacyConfig.maskSelector);
-    privacyConfig.unmaskSelector = dropInvalidSelectors(privacyConfig.unmaskSelector);
-    return privacyConfig;
+    return (0, session_replay_dom_privacy_1.validatePrivacySelectors)(privacyConfig, function (selector) {
+        fragment.querySelector(selector);
+    }, function (selector) {
+        loggerProvider.warn("[session-replay-browser] omitting selector \"".concat(selector, "\" because it is invalid"));
+    });
 };
 exports.removeInvalidSelectorsFromPrivacyConfig = removeInvalidSelectorsFromPrivacyConfig;
 var SessionReplayJoinedConfigGenerator = /** @class */ (function () {

package/lib/cjs/config/joined-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"joined-config.js","sourceRoot":"","sources":["../../../src/config/joined-config.ts"],"names":[],"mappings":";;;;AAAA,4DAAmH;AACnH,sCAA4C;AAE5C,+CAA0D;AAS1D,2FAA2F;AAC3F,2FAA2F;AAC3F,wFAAwF;AACxF,yFAAyF;AACzF,yFAAyF;AACzF,sFAAsF;AACtF,yFAAyF;AACzF,kFAAkF;AAClF,oDAAoD;AACpD,IAAM,wBAAwB,GAAG,IAAI,CAAC;AAE/B,IAAM,uCAAuC,GAAG,UAAC,aAA4B,EAAE,cAAuB;IAC3G,wCAAwC;IACxC,IAAM,QAAQ,GAAG,QAAQ,CAAC,sBAAsB,EAAE,CAAC;IAEnD,IAAM,oBAAoB,GAAG,UAAC,SAAiC;QAAjC,0BAAA,EAAA,cAAiC;QAC7D,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE;YACjC,SAAS,GAAG,CAAC,SAAS,CAAC,CAAC;SACzB;QACD,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,UAAC,QAAgB;YAC5C,IAAI;gBACF,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;aAClC;YAAC,WAAM;gBACN,cAAc,CAAC,IAAI,CAAC,uDAA+C,QAAQ,6BAAyB,CAAC,CAAC;gBACtG,OAAO,KAAK,CAAC;aACd;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE;YAC1B,OAAO,SAAS,CAAC;SAClB;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,aAAa,CAAC,aAAa,GAAG,oBAAoB,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;IAChF,aAAa,CAAC,YAAY,GAAG,oBAAoB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IAC9E,aAAa,CAAC,cAAc,GAAG,oBAAoB,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;IAClF,OAAO,aAAa,CAAC;AACvB,CAAC,CAAC;AA1BW,QAAA,uCAAuC,2CA0BlD;AACF;IAIE,4CAAY,kBAAuC,EAAE,WAAsC;QACzF,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;IAC/C,CAAC;IAEK,iEAAoB,GAA1B;;;;;;;;;wBACQ,MAAM,wBAAmC,IAAI,CAAC,WAAW,CAAE,CAAC;wBAClE,+DAA+D;wBAC/D,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;wBACxC,uEAAuE;wBACvE,wBAAwB;wBACxB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;;;;wBAI3B,sFAAsF;wBACtF,oFAAoF;wBACpF,qFAAqF;wBACrF,4DAA4D;wBAC5D,qBAAM,IAAI,OAAO,CAAO,UAAC,OAAO,EAAE,MAAM;gCACtC,KAAI,CAAC,kBAAkB,CAAC,SAAS,CAC/B,uBAAuB,EACvB,EAAE,OAAO,EAAE,wBAAwB,EAAE,EACrC,UAAC,YAAiC,EAAE,MAAc;;oCAChD,KAAI,CAAC,WAAW,CAAC,cAAc,CAAC,KAAK,CACnC,4DAAqD,MAAM,MAAG,EAC9D,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CACtC,CAAC;oCAEF,IAAI,CAAC,YAAY,EAAE;wCACjB,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;wCAC/C,OAAO;qCACR;oCAED,wEAAwE;oCACxE,IAAM,eAAe,GAAG,YAAyC,CAAC;oCAClE,IAAM,cAAc,GAAG,eAAe,CAAC,kBAAkB,CAAC;oCAC1D,IAAM,aAAa,GAAG,eAAe,CAAC,iBAAiB,CAAC;oCACxD,IAAM,eAAe,GAAG,eAAe,CAAC,mBAAmB,CAAC;oCAE5D,IAAM,cAAc,GAAG,MAAA,MAAM,CAAC,iBAAiB,0CAAE,cAAc,CAAC;oCAChE,yEAAyE;oCACzE,MAAM,CAAC,iBAAiB,GAAG,eAAe,CAAC,qBAAqB,CAAC;oCACjE,IAAI,MAAM,CAAC,iBAAiB,IAAI,cAAc,EAAE;wCAC9C,MAAM,CAAC,iBAAiB,CAAC,cAAc,GAAG,cAAc,CAAC;qCAC1D;oCAED,yEAAyE;oCACzE,MAAM,CAAC,aAAa,GAAG,eAAe,CAAC,iBAAiB,CAAC;oCAEzD,IAAI,cAAc,IAAI,aAAa,IAAI,eAAe,EAAE;wCACtD,yBAAyB,GAAG,EAAE,CAAC;wCAC/B,IAAI,cAAc,EAAE;4CAClB,yBAAyB,CAAC,kBAAkB,GAAG,cAAc,CAAC;yCAC/D;wCACD,IAAI,aAAa,EAAE;4CACjB,yBAAyB,CAAC,iBAAiB,GAAG,aAAa,CAAC;yCAC7D;wCACD,IAAI,eAAe,EAAE;4CACnB,yBAAyB,CAAC,mBAAmB,GAAG,eAAe,CAAC;yCACjE;qCACF;oCAED,OAAO,EAAE,CAAC;gCACZ,CAAC,CACF,CAAC;4BACJ,CAAC,CAAC,EAAA;;wBAnDF,sFAAsF;wBACtF,oFAAoF;wBACpF,qFAAqF;wBACrF,4DAA4D;wBAC5D,SA+CE,CAAC;;;;wBAEH,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,oCAAoC,EAAE,OAAK,CAAC,CAAC;wBACnF,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;wBAC9B,sBAAO;gCACL,WAAW,EAAE,IAAI,CAAC,WAAW;gCAC7B,YAAY,EAAE,MAAM;gCACpB,YAAY,EAAE,SAAS;6BACxB,EAAC;;wBAGJ,IAAI,CAAC,yBAAyB,EAAE;4BAC9B,sBAAO;oCACL,WAAW,EAAE,IAAI,CAAC,WAAW;oCAC7B,YAAY,EAAE,MAAM;oCACpB,YAAY,EAAE,yBAAyB;iCACxC,EAAC;yBACH;wBAGqB,cAAc,GAGhC,yBAAyB,mBAHO,EACf,mBAAmB,GAEpC,yBAAyB,kBAFW,EACjB,eAAe,GAClC,yBAAyB,oBADS,CACR;wBAC9B,IAAI,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;4BAC5D,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,iBAAiB,CAAC,EAAE;gCAC3E,MAAM,CAAC,cAAc,GAAG,cAAc,CAAC,eAAe,CAAC;6BACxD;iCAAM;gCACL,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;6BAC/B;4BAED,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,EAAE;gCACvE,MAAM,CAAC,UAAU,GAAG,cAAc,CAAC,WAAW,CAAC;6BAChD;4BAED,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,yBAAyB,CAAC,EAAE;gCACnF,MAAM,CAAC,oBAAoB,GAAG,IAAI,CAAC,4BAA4B,CAAC,cAAc,CAAC,uBAAuB,CAAC,CAAC;6BACzG;yBACF;6BAAM;4BACL,iFAAiF;4BACjF,4EAA4E;4BAC5E,wCAAwC;4BACxC,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;4BAC7B,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,KAAK,CACnC,oGAAoG,CACrG,CAAC;yBACH;wBAED,qFAAqF;wBACrF,oFAAoF;wBACpF,8DAA8D;wBAC9D,mCAAmC;wBACnC,EAAE;wBACF,oEAAoE;wBACpE,0FAA0F;wBAC1F,EAAE;wBACF,0FAA0F;wBAC1F,2BAA2B;wBAC3B,qCAAqC;wBACrC,4BAA4B;wBAC5B,KAAK;wBAEL,IAAI,mBAAmB,EAAE;4BACjB,kBAAkB,GAAkB,MAAA,MAAM,CAAC,aAAa,mCAAI,EAAE,CAAC;4BAE/D,mBAAmB,GAA0D;gCACjF,gBAAgB,EAAE,MAAA,MAAA,mBAAmB,CAAC,gBAAgB,mCAAI,kBAAkB,CAAC,gBAAgB,mCAAI,QAAQ;gCACzG,aAAa,EAAE,EAAE;gCACjB,YAAY,EAAE,EAAE;gCAChB,cAAc,EAAE,EAAE;gCAClB,cAAc,2CACT,IAAI,GAAG,gEAAK,CAAC,MAAA,kBAAkB,CAAC,cAAc,mCAAI,EAAE,CAAC,0BAAK,CAAC,MAAA,mBAAmB,CAAC,cAAc,mCAAI,EAAE,CAAC,UAAE,SAC1G;gCACD,aAAa,iEAAM,CAAC,MAAA,mBAAmB,CAAC,aAAa,mCAAI,EAAE,CAAC,0BAAK,CAAC,MAAA,kBAAkB,CAAC,aAAa,mCAAI,EAAE,CAAC,SAAC;6BAC3G,CAAC;4BAEI,wBAAwB,GAAG,UAAC,aAA4B;;;gCAC5D,IAAM,WAAW,GAAgD,EAAE,CAAC;gCACpE,IAAI,OAAO,aAAa,CAAC,aAAa,KAAK,QAAQ,EAAE;oCACnD,aAAa,CAAC,aAAa,GAAG,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;iCAC7D;;oCAED,KAAuB,IAAA,KAAA,iBAAA,MAAA,aAAa,CAAC,aAAa,mCAAI,EAAE,CAAA,gBAAA,4BAAE;wCAArD,IAAM,QAAQ,WAAA;wCACjB,WAAW,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC;qCACjC;;;;;;;;;;oCACD,KAAuB,IAAA,KAAA,iBAAA,MAAA,aAAa,CAAC,YAAY,mCAAI,EAAE,CAAA,gBAAA,4BAAE;wCAApD,IAAM,QAAQ,WAAA;wCACjB,WAAW,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;qCAChC;;;;;;;;;;oCACD,KAAuB,IAAA,KAAA,iBAAA,MAAA,aAAa,CAAC,cAAc,mCAAI,EAAE,CAAA,gBAAA,4BAAE;wCAAtD,IAAM,QAAQ,WAAA;wCACjB,WAAW,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;qCAClC;;;;;;;;;gCACD,OAAO,WAAW,CAAC;4BACrB,CAAC,CAAC;4BAEI,WAAW,yCACZ,wBAAwB,CAAC,kBAAkB,CAAC,GAC5C,wBAAwB,CAAC,mBAAmB,CAAC,CACjD,CAAC;;gCAEF,KAAuC,KAAA,iBAAA,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA,4CAAE;oCAAzD,KAAA,2BAAwB,EAAvB,QAAQ,QAAA,EAAE,YAAY,QAAA;oCAChC,IAAI,YAAY,KAAK,MAAM,EAAE;wCAC3B,mBAAmB,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;qCACjD;yCAAM,IAAI,YAAY,KAAK,OAAO,EAAE;wCACnC,mBAAmB,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;qCAClD;yCAAM,IAAI,YAAY,KAAK,QAAQ,EAAE;wCACpC,mBAAmB,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;qCACnD;iCACF;;;;;;;;;4BAED,MAAM,CAAC,aAAa,GAAG,IAAA,+CAAuC,EAC5D,mBAAmB,EACnB,IAAI,CAAC,WAAW,CAAC,cAAc,CAChC,CAAC;yBACH;wBAED,IAAI,eAAe,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;4BAC9D,MAAM,CAAC,eAAe,GAAG,eAAe,CAAC;yBAC1C;wBAED,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,KAAK,CACnC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,MAAM,EAAE,IAAA,wBAAc,EAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAClG,CAAC;wBAEF,sBAAO;gCACL,WAAW,EAAE,IAAI,CAAC,WAAW;gCAC7B,YAAY,EAAE,MAAM;gCACpB,YAAY,EAAE,yBAAyB;6BACxC,EAAC;;;;KACH;IAED;;;;;;OAMG;IACK,yEAA4B,GAApC,UAAqC,GAAY;QAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;YACpD,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAClC,2EAAoE,MAAM,CAAC,GAAG,CAAC,iBAAc,CAC9F,CAAC;YACF,OAAO,SAAS,CAAC;SAClB;QACD,IAAI,GAAG,GAAG,CAAC,EAAE;YACX,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,4DAAqD,GAAG,iBAAc,CAAC,CAAC;YAC7G,OAAO,SAAS,CAAC;SAClB;QACD,IAAI,GAAG,GAAG,mCAA2B,EAAE;YACrC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAClC,+CAAwC,GAAG,sBAAY,mCAA2B,0BAAuB,CAC1G,CAAC;YACF,OAAO,mCAA2B,CAAC;SACpC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACH,yCAAC;AAAD,CAAC,AAlOD,IAkOC;AAlOY,gFAAkC;AAoO/C;;;;;GAKG;AACU,QAAA,2BAA2B,GAAG,KAAM,CAAC;AAE3C,IAAM,wCAAwC,GAAG,UAAO,MAAc,EAAE,OAA6B;;;QACpG,WAAW,GAAG,IAAI,uCAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAE5D,kBAAkB,GAAG,IAAI,mCAAkB,CAC/C,MAAM,EACN,WAAW,CAAC,cAAc,EAC1B,WAAW,CAAC,UAAU,EACtB,OAAO,CAAC,eAAe;QACvB,0FAA0F;QAC1F,wFAAwF;QACxF,OAAO,CAAC,iBAAiB,CAC1B,CAAC;QAEF,sBAAO,IAAI,kCAAkC,CAAC,kBAAkB,EAAE,WAAW,CAAC,EAAC;;KAChF,CAAC;AAdW,QAAA,wCAAwC,4CAcnD","sourcesContent":["import { ILogger, IRemoteConfigClient, RemoteConfigClient, RemoteConfig, Source } from '@amplitude/analytics-core';\nimport { getDebugConfig } from '../helpers';\nimport { SessionReplayOptions } from '../typings/session-replay';\nimport { SessionReplayLocalConfig } from './local-config';\nimport {\n  SessionReplayLocalConfig as ISessionReplayLocalConfig,\n  PrivacyConfig,\n  SessionReplayConfigs,\n  SessionReplayJoinedConfig,\n  SessionReplayRemoteConfig,\n} from './types';\n\n// Budget for waiting on the remote config response before falling back to the local cache.\n// The inner fetch in analytics-core uses a 1000ms per-attempt AbortController timeout with\n// up to 3 retries — but this outer timeout is the only thing the SR plugin waits on, so\n// only the first attempt can possibly complete in time (attempt 2 starts at ~1000-1333ms\n// after backoff jitter and runs to ~2000-2333ms, well past any reasonable outer budget).\n// 1500ms is set above the 1000ms inner abort to avoid a tie with the inner cutoff and\n// give the first attempt's resolution path room to finish; everything else falls through\n// to the cache fallback. See SR-4234: prefer remote over a stale cache that would\n// otherwise win the synchronous race in 'all' mode.\nconst REMOTE_CONFIG_TIMEOUT_MS = 1500;\n\nexport const removeInvalidSelectorsFromPrivacyConfig = (privacyConfig: PrivacyConfig, loggerProvider: ILogger) => {\n  // This allows us to not search the DOM.\n  const fragment = document.createDocumentFragment();\n\n  const dropInvalidSelectors = (selectors: string[] | string = []): string[] | undefined => {\n    if (typeof selectors === 'string') {\n      selectors = [selectors];\n    }\n    selectors = selectors.filter((selector: string) => {\n      try {\n        fragment.querySelector(selector);\n      } catch {\n        loggerProvider.warn(`[session-replay-browser] omitting selector \"${selector}\" because it is invalid`);\n        return false;\n      }\n      return true;\n    });\n    if (selectors.length === 0) {\n      return undefined;\n    }\n    return selectors;\n  };\n  privacyConfig.blockSelector = dropInvalidSelectors(privacyConfig.blockSelector);\n  privacyConfig.maskSelector = dropInvalidSelectors(privacyConfig.maskSelector);\n  privacyConfig.unmaskSelector = dropInvalidSelectors(privacyConfig.unmaskSelector);\n  return privacyConfig;\n};\nexport class SessionReplayJoinedConfigGenerator {\n  private readonly localConfig: ISessionReplayLocalConfig;\n  private readonly remoteConfigClient: IRemoteConfigClient;\n\n  constructor(remoteConfigClient: IRemoteConfigClient, localConfig: ISessionReplayLocalConfig) {\n    this.localConfig = localConfig;\n    this.remoteConfigClient = remoteConfigClient;\n  }\n\n  async generateJoinedConfig(): Promise<SessionReplayConfigs> {\n    const config: SessionReplayJoinedConfig = { ...this.localConfig };\n    // Special case here as optOut is implemented via getter/setter\n    config.optOut = this.localConfig.optOut;\n    // We always want captureEnabled to be true, unless there's an override\n    // in the remote config.\n    config.captureEnabled = true;\n    let sessionReplayRemoteConfig: SessionReplayRemoteConfig | undefined;\n\n    try {\n      // Subscribe with a timeout so the SDK prefers the remote response and only falls back\n      // to cache after the budget elapses. 'all' mode would race a synchronous cache read\n      // against the network and resolve on whichever fires first — cache always wins, so a\n      // stale cache silently overrides the live config (SR-4234).\n      await new Promise<void>((resolve, reject) => {\n        this.remoteConfigClient.subscribe(\n          'configs.sessionReplay',\n          { timeout: REMOTE_CONFIG_TIMEOUT_MS },\n          (remoteConfig: RemoteConfig | null, source: Source) => {\n            this.localConfig.loggerProvider.debug(\n              `Session Replay remote configuration received from ${source}:`,\n              JSON.stringify(remoteConfig, null, 2),\n            );\n\n            if (!remoteConfig) {\n              reject(new Error('No remote config received'));\n              return;\n            }\n\n            // remoteConfig is already filtered to 'configs.sessionReplay' namespace\n            const namespaceConfig = remoteConfig as SessionReplayRemoteConfig;\n            const samplingConfig = namespaceConfig.sr_sampling_config;\n            const privacyConfig = namespaceConfig.sr_privacy_config;\n            const targetingConfig = namespaceConfig.sr_targeting_config;\n\n            const ugcFilterRules = config.interactionConfig?.ugcFilterRules;\n            // This is intentionally forced to only be set through the remote config.\n            config.interactionConfig = namespaceConfig.sr_interaction_config;\n            if (config.interactionConfig && ugcFilterRules) {\n              config.interactionConfig.ugcFilterRules = ugcFilterRules;\n            }\n\n            // This is intentionally forced to only be set through the remote config.\n            config.loggingConfig = namespaceConfig.sr_logging_config;\n\n            if (samplingConfig || privacyConfig || targetingConfig) {\n              sessionReplayRemoteConfig = {};\n              if (samplingConfig) {\n                sessionReplayRemoteConfig.sr_sampling_config = samplingConfig;\n              }\n              if (privacyConfig) {\n                sessionReplayRemoteConfig.sr_privacy_config = privacyConfig;\n              }\n              if (targetingConfig) {\n                sessionReplayRemoteConfig.sr_targeting_config = targetingConfig;\n              }\n            }\n\n            resolve();\n          },\n        );\n      });\n    } catch (error) {\n      this.localConfig.loggerProvider.error('Failed to generate joined config: ', error);\n      config.captureEnabled = false;\n      return {\n        localConfig: this.localConfig,\n        joinedConfig: config,\n        remoteConfig: undefined,\n      };\n    }\n\n    if (!sessionReplayRemoteConfig) {\n      return {\n        localConfig: this.localConfig,\n        joinedConfig: config,\n        remoteConfig: sessionReplayRemoteConfig,\n      };\n    }\n\n    const {\n      sr_sampling_config: samplingConfig,\n      sr_privacy_config: remotePrivacyConfig,\n      sr_targeting_config: targetingConfig,\n    } = sessionReplayRemoteConfig;\n    if (samplingConfig && Object.keys(samplingConfig).length > 0) {\n      if (Object.prototype.hasOwnProperty.call(samplingConfig, 'capture_enabled')) {\n        config.captureEnabled = samplingConfig.capture_enabled;\n      } else {\n        config.captureEnabled = false;\n      }\n\n      if (Object.prototype.hasOwnProperty.call(samplingConfig, 'sample_rate')) {\n        config.sampleRate = samplingConfig.sample_rate;\n      }\n\n      if (Object.prototype.hasOwnProperty.call(samplingConfig, 'min_session_duration_ms')) {\n        config.minSessionDurationMs = this.sanitizeMinSessionDurationMs(samplingConfig.min_session_duration_ms);\n      }\n    } else {\n      // If config API response was valid (ie 200), but no config returned, assume that\n      // customer has not yet set up config, and use sample rate from SDK options,\n      // allowing for immediate replay capture\n      config.captureEnabled = true;\n      this.localConfig.loggerProvider.debug(\n        'Remote config successfully fetched, but no values set for project, Session Replay capture enabled.',\n      );\n    }\n\n    // Remote config join acts somewhat like a left join between the remote and the local\n    // config. That is, remote config has precedence over local values as with sampling.\n    // However, non conflicting values will be added to the lists.\n    // Here's an example to illustrate:\n    //\n    // Remote config:   {'.selector1': 'MASK',   '.selector2': 'UNMASK'}\n    // Local config:    {'.selector1': 'UNMASK',                         '.selector3': 'MASK'}\n    //\n    // Resolved config: {'.selector1': 'MASK',   '.selector2': 'UNMASK', '.selector3': 'MASK'}\n    // config.privacyConfig = {\n    //   ...(config.privacyConfig ?? {}),\n    //   ...remotePrivacyConfig,\n    // };\n\n    if (remotePrivacyConfig) {\n      const localPrivacyConfig: PrivacyConfig = config.privacyConfig ?? {};\n\n      const joinedPrivacyConfig: Required<PrivacyConfig> & { blockSelector: string[] } = {\n        defaultMaskLevel: remotePrivacyConfig.defaultMaskLevel ?? localPrivacyConfig.defaultMaskLevel ?? 'medium',\n        blockSelector: [],\n        maskSelector: [],\n        unmaskSelector: [],\n        maskAttributes: [\n          ...new Set([...(localPrivacyConfig.maskAttributes ?? []), ...(remotePrivacyConfig.maskAttributes ?? [])]),\n        ],\n        urlMaskLevels: [...(remotePrivacyConfig.urlMaskLevels ?? []), ...(localPrivacyConfig.urlMaskLevels ?? [])],\n      };\n\n      const privacyConfigSelectorMap = (privacyConfig: PrivacyConfig): Record<string, 'mask' | 'unmask' | 'block'> => {\n        const selectorMap: Record<string, 'mask' | 'unmask' | 'block'> = {};\n        if (typeof privacyConfig.blockSelector === 'string') {\n          privacyConfig.blockSelector = [privacyConfig.blockSelector];\n        }\n\n        for (const selector of privacyConfig.blockSelector ?? []) {\n          selectorMap[selector] = 'block';\n        }\n        for (const selector of privacyConfig.maskSelector ?? []) {\n          selectorMap[selector] = 'mask';\n        }\n        for (const selector of privacyConfig.unmaskSelector ?? []) {\n          selectorMap[selector] = 'unmask';\n        }\n        return selectorMap;\n      };\n\n      const selectorMap: Record<string, 'mask' | 'unmask' | 'block'> = {\n        ...privacyConfigSelectorMap(localPrivacyConfig),\n        ...privacyConfigSelectorMap(remotePrivacyConfig),\n      };\n\n      for (const [selector, selectorType] of Object.entries(selectorMap)) {\n        if (selectorType === 'mask') {\n          joinedPrivacyConfig.maskSelector.push(selector);\n        } else if (selectorType === 'block') {\n          joinedPrivacyConfig.blockSelector.push(selector);\n        } else if (selectorType === 'unmask') {\n          joinedPrivacyConfig.unmaskSelector.push(selector);\n        }\n      }\n\n      config.privacyConfig = removeInvalidSelectorsFromPrivacyConfig(\n        joinedPrivacyConfig,\n        this.localConfig.loggerProvider,\n      );\n    }\n\n    if (targetingConfig && Object.keys(targetingConfig).length > 0) {\n      config.targetingConfig = targetingConfig;\n    }\n\n    this.localConfig.loggerProvider.debug(\n      JSON.stringify({ name: 'session replay joined config', config: getDebugConfig(config) }, null, 2),\n    );\n\n    return {\n      localConfig: this.localConfig,\n      joinedConfig: config,\n      remoteConfig: sessionReplayRemoteConfig,\n    };\n  }\n\n  /**\n   * Defensive bounds for the remote-supplied min_session_duration_ms. A misconfigured\n   * value (e.g. 30_000_000) would silently suppress every replay until the config is\n   * pushed again, so we clamp to a sane ceiling and warn on out-of-range inputs.\n   * Returns undefined for clearly invalid values so the gate falls back to disabled\n   * rather than carrying a NaN through downstream comparisons.\n   */\n  private sanitizeMinSessionDurationMs(raw: unknown): number | undefined {\n    if (typeof raw !== 'number' || !Number.isFinite(raw)) {\n      this.localConfig.loggerProvider.warn(\n        `min_session_duration_ms remote value is not a finite number (got ${String(raw)}); ignoring.`,\n      );\n      return undefined;\n    }\n    if (raw < 0) {\n      this.localConfig.loggerProvider.warn(`min_session_duration_ms remote value is negative (${raw}); ignoring.`);\n      return undefined;\n    }\n    if (raw > MAX_MIN_SESSION_DURATION_MS) {\n      this.localConfig.loggerProvider.warn(\n        `min_session_duration_ms remote value ${raw} exceeds ${MAX_MIN_SESSION_DURATION_MS}ms ceiling; clamping.`,\n      );\n      return MAX_MIN_SESSION_DURATION_MS;\n    }\n    return raw;\n  }\n}\n\n/**\n * Upper bound for the remote-configured replay min duration. 60 seconds is well above\n * any reasonable bounce threshold; values higher than this are almost certainly typos\n * (e.g. seconds confused for milliseconds, or an extra zero) and would otherwise\n * suppress every replay until the config is corrected.\n */\nexport const MAX_MIN_SESSION_DURATION_MS = 60_000;\n\nexport const createSessionReplayJoinedConfigGenerator = async (apiKey: string, options: SessionReplayOptions) => {\n  const localConfig = new SessionReplayLocalConfig(apiKey, options);\n\n  const remoteConfigClient = new RemoteConfigClient(\n    apiKey,\n    localConfig.loggerProvider,\n    localConfig.serverZone,\n    options.configServerUrl,\n    // Custom transport for the config GET. SR's FetchConfigRequest is structurally compatible\n    // with RemoteConfigFetchRequest, so the customer's handleFetchConfig drops straight in.\n    options.handleFetchConfig,\n  );\n\n  return new SessionReplayJoinedConfigGenerator(remoteConfigClient, localConfig);\n};\n"]}
+{"version":3,"file":"joined-config.js","sourceRoot":"","sources":["../../../src/config/joined-config.ts"],"names":[],"mappings":";;;;AAAA,oFAAiF;AACjF,4DAAmH;AACnH,sCAA4C;AAE5C,+CAA0D;AAS1D,2FAA2F;AAC3F,2FAA2F;AAC3F,wFAAwF;AACxF,yFAAyF;AACzF,yFAAyF;AACzF,sFAAsF;AACtF,yFAAyF;AACzF,kFAAkF;AAClF,oDAAoD;AACpD,IAAM,wBAAwB,GAAG,IAAI,CAAC;AAE/B,IAAM,uCAAuC,GAAG,UAAC,aAA4B,EAAE,cAAuB;IAC3G,IAAM,QAAQ,GAAG,QAAQ,CAAC,sBAAsB,EAAE,CAAC;IACnD,OAAO,IAAA,qDAAwB,EAC7B,aAAa,EACb,UAAC,QAAQ;QACP,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC,EACD,UAAC,QAAQ;QACP,cAAc,CAAC,IAAI,CAAC,uDAA+C,QAAQ,6BAAyB,CAAC,CAAC;IACxG,CAAC,CACF,CAAC;AACJ,CAAC,CAAC;AAXW,QAAA,uCAAuC,2CAWlD;AACF;IAIE,4CAAY,kBAAuC,EAAE,WAAsC;QACzF,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;IAC/C,CAAC;IAEK,iEAAoB,GAA1B;;;;;;;;;wBACQ,MAAM,wBAAmC,IAAI,CAAC,WAAW,CAAE,CAAC;wBAClE,+DAA+D;wBAC/D,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;wBACxC,uEAAuE;wBACvE,wBAAwB;wBACxB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;;;;wBAI3B,sFAAsF;wBACtF,oFAAoF;wBACpF,qFAAqF;wBACrF,4DAA4D;wBAC5D,qBAAM,IAAI,OAAO,CAAO,UAAC,OAAO,EAAE,MAAM;gCACtC,KAAI,CAAC,kBAAkB,CAAC,SAAS,CAC/B,uBAAuB,EACvB,EAAE,OAAO,EAAE,wBAAwB,EAAE,EACrC,UAAC,YAAiC,EAAE,MAAc;;oCAChD,KAAI,CAAC,WAAW,CAAC,cAAc,CAAC,KAAK,CACnC,4DAAqD,MAAM,MAAG,EAC9D,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CACtC,CAAC;oCAEF,IAAI,CAAC,YAAY,EAAE;wCACjB,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;wCAC/C,OAAO;qCACR;oCAED,wEAAwE;oCACxE,IAAM,eAAe,GAAG,YAAyC,CAAC;oCAClE,IAAM,cAAc,GAAG,eAAe,CAAC,kBAAkB,CAAC;oCAC1D,IAAM,aAAa,GAAG,eAAe,CAAC,iBAAiB,CAAC;oCACxD,IAAM,eAAe,GAAG,eAAe,CAAC,mBAAmB,CAAC;oCAE5D,IAAM,cAAc,GAAG,MAAA,MAAM,CAAC,iBAAiB,0CAAE,cAAc,CAAC;oCAChE,yEAAyE;oCACzE,MAAM,CAAC,iBAAiB,GAAG,eAAe,CAAC,qBAAqB,CAAC;oCACjE,IAAI,MAAM,CAAC,iBAAiB,IAAI,cAAc,EAAE;wCAC9C,MAAM,CAAC,iBAAiB,CAAC,cAAc,GAAG,cAAc,CAAC;qCAC1D;oCAED,yEAAyE;oCACzE,MAAM,CAAC,aAAa,GAAG,eAAe,CAAC,iBAAiB,CAAC;oCAEzD,IAAI,cAAc,IAAI,aAAa,IAAI,eAAe,EAAE;wCACtD,yBAAyB,GAAG,EAAE,CAAC;wCAC/B,IAAI,cAAc,EAAE;4CAClB,yBAAyB,CAAC,kBAAkB,GAAG,cAAc,CAAC;yCAC/D;wCACD,IAAI,aAAa,EAAE;4CACjB,yBAAyB,CAAC,iBAAiB,GAAG,aAAa,CAAC;yCAC7D;wCACD,IAAI,eAAe,EAAE;4CACnB,yBAAyB,CAAC,mBAAmB,GAAG,eAAe,CAAC;yCACjE;qCACF;oCAED,OAAO,EAAE,CAAC;gCACZ,CAAC,CACF,CAAC;4BACJ,CAAC,CAAC,EAAA;;wBAnDF,sFAAsF;wBACtF,oFAAoF;wBACpF,qFAAqF;wBACrF,4DAA4D;wBAC5D,SA+CE,CAAC;;;;wBAEH,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,oCAAoC,EAAE,OAAK,CAAC,CAAC;wBACnF,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;wBAC9B,sBAAO;gCACL,WAAW,EAAE,IAAI,CAAC,WAAW;gCAC7B,YAAY,EAAE,MAAM;gCACpB,YAAY,EAAE,SAAS;6BACxB,EAAC;;wBAGJ,IAAI,CAAC,yBAAyB,EAAE;4BAC9B,sBAAO;oCACL,WAAW,EAAE,IAAI,CAAC,WAAW;oCAC7B,YAAY,EAAE,MAAM;oCACpB,YAAY,EAAE,yBAAyB;iCACxC,EAAC;yBACH;wBAGqB,cAAc,GAGhC,yBAAyB,mBAHO,EACf,mBAAmB,GAEpC,yBAAyB,kBAFW,EACjB,eAAe,GAClC,yBAAyB,oBADS,CACR;wBAC9B,IAAI,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;4BAC5D,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,iBAAiB,CAAC,EAAE;gCAC3E,MAAM,CAAC,cAAc,GAAG,cAAc,CAAC,eAAe,CAAC;6BACxD;iCAAM;gCACL,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;6BAC/B;4BAED,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,EAAE;gCACvE,MAAM,CAAC,UAAU,GAAG,cAAc,CAAC,WAAW,CAAC;6BAChD;4BAED,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,yBAAyB,CAAC,EAAE;gCACnF,MAAM,CAAC,oBAAoB,GAAG,IAAI,CAAC,4BAA4B,CAAC,cAAc,CAAC,uBAAuB,CAAC,CAAC;6BACzG;yBACF;6BAAM;4BACL,iFAAiF;4BACjF,4EAA4E;4BAC5E,wCAAwC;4BACxC,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;4BAC7B,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,KAAK,CACnC,oGAAoG,CACrG,CAAC;yBACH;wBAED,qFAAqF;wBACrF,oFAAoF;wBACpF,8DAA8D;wBAC9D,mCAAmC;wBACnC,EAAE;wBACF,oEAAoE;wBACpE,0FAA0F;wBAC1F,EAAE;wBACF,0FAA0F;wBAC1F,2BAA2B;wBAC3B,qCAAqC;wBACrC,4BAA4B;wBAC5B,KAAK;wBAEL,IAAI,mBAAmB,EAAE;4BACjB,kBAAkB,GAAkB,MAAA,MAAM,CAAC,aAAa,mCAAI,EAAE,CAAC;4BAE/D,mBAAmB,GAA0D;gCACjF,gBAAgB,EAAE,MAAA,MAAA,mBAAmB,CAAC,gBAAgB,mCAAI,kBAAkB,CAAC,gBAAgB,mCAAI,QAAQ;gCACzG,aAAa,EAAE,EAAE;gCACjB,YAAY,EAAE,EAAE;gCAChB,cAAc,EAAE,EAAE;gCAClB,cAAc,2CACT,IAAI,GAAG,gEAAK,CAAC,MAAA,kBAAkB,CAAC,cAAc,mCAAI,EAAE,CAAC,0BAAK,CAAC,MAAA,mBAAmB,CAAC,cAAc,mCAAI,EAAE,CAAC,UAAE,SAC1G;gCACD,aAAa,iEAAM,CAAC,MAAA,mBAAmB,CAAC,aAAa,mCAAI,EAAE,CAAC,0BAAK,CAAC,MAAA,kBAAkB,CAAC,aAAa,mCAAI,EAAE,CAAC,SAAC;6BAC3G,CAAC;4BAEI,wBAAwB,GAAG,UAAC,aAA4B;;;gCAC5D,IAAM,WAAW,GAAgD,EAAE,CAAC;gCACpE,IAAI,OAAO,aAAa,CAAC,aAAa,KAAK,QAAQ,EAAE;oCACnD,aAAa,CAAC,aAAa,GAAG,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;iCAC7D;;oCAED,KAAuB,IAAA,KAAA,iBAAA,MAAA,aAAa,CAAC,aAAa,mCAAI,EAAE,CAAA,gBAAA,4BAAE;wCAArD,IAAM,QAAQ,WAAA;wCACjB,WAAW,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC;qCACjC;;;;;;;;;;oCACD,KAAuB,IAAA,KAAA,iBAAA,MAAA,aAAa,CAAC,YAAY,mCAAI,EAAE,CAAA,gBAAA,4BAAE;wCAApD,IAAM,QAAQ,WAAA;wCACjB,WAAW,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;qCAChC;;;;;;;;;;oCACD,KAAuB,IAAA,KAAA,iBAAA,MAAA,aAAa,CAAC,cAAc,mCAAI,EAAE,CAAA,gBAAA,4BAAE;wCAAtD,IAAM,QAAQ,WAAA;wCACjB,WAAW,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;qCAClC;;;;;;;;;gCACD,OAAO,WAAW,CAAC;4BACrB,CAAC,CAAC;4BAEI,WAAW,yCACZ,wBAAwB,CAAC,kBAAkB,CAAC,GAC5C,wBAAwB,CAAC,mBAAmB,CAAC,CACjD,CAAC;;gCAEF,KAAuC,KAAA,iBAAA,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA,4CAAE;oCAAzD,KAAA,2BAAwB,EAAvB,QAAQ,QAAA,EAAE,YAAY,QAAA;oCAChC,IAAI,YAAY,KAAK,MAAM,EAAE;wCAC3B,mBAAmB,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;qCACjD;yCAAM,IAAI,YAAY,KAAK,OAAO,EAAE;wCACnC,mBAAmB,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;qCAClD;yCAAM,IAAI,YAAY,KAAK,QAAQ,EAAE;wCACpC,mBAAmB,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;qCACnD;iCACF;;;;;;;;;4BAED,MAAM,CAAC,aAAa,GAAG,IAAA,+CAAuC,EAC5D,mBAAmB,EACnB,IAAI,CAAC,WAAW,CAAC,cAAc,CAChC,CAAC;yBACH;wBAED,IAAI,eAAe,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;4BAC9D,MAAM,CAAC,eAAe,GAAG,eAAe,CAAC;yBAC1C;wBAED,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,KAAK,CACnC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,MAAM,EAAE,IAAA,wBAAc,EAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAClG,CAAC;wBAEF,sBAAO;gCACL,WAAW,EAAE,IAAI,CAAC,WAAW;gCAC7B,YAAY,EAAE,MAAM;gCACpB,YAAY,EAAE,yBAAyB;6BACxC,EAAC;;;;KACH;IAED;;;;;;OAMG;IACK,yEAA4B,GAApC,UAAqC,GAAY;QAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;YACpD,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAClC,2EAAoE,MAAM,CAAC,GAAG,CAAC,iBAAc,CAC9F,CAAC;YACF,OAAO,SAAS,CAAC;SAClB;QACD,IAAI,GAAG,GAAG,CAAC,EAAE;YACX,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,4DAAqD,GAAG,iBAAc,CAAC,CAAC;YAC7G,OAAO,SAAS,CAAC;SAClB;QACD,IAAI,GAAG,GAAG,mCAA2B,EAAE;YACrC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAClC,+CAAwC,GAAG,sBAAY,mCAA2B,0BAAuB,CAC1G,CAAC;YACF,OAAO,mCAA2B,CAAC;SACpC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACH,yCAAC;AAAD,CAAC,AAlOD,IAkOC;AAlOY,gFAAkC;AAoO/C;;;;;GAKG;AACU,QAAA,2BAA2B,GAAG,KAAM,CAAC;AAE3C,IAAM,wCAAwC,GAAG,UAAO,MAAc,EAAE,OAA6B;;;QACpG,WAAW,GAAG,IAAI,uCAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAE5D,kBAAkB,GAAG,IAAI,mCAAkB,CAC/C,MAAM,EACN,WAAW,CAAC,cAAc,EAC1B,WAAW,CAAC,UAAU,EACtB,OAAO,CAAC,eAAe;QACvB,0FAA0F;QAC1F,wFAAwF;QACxF,OAAO,CAAC,iBAAiB,CAC1B,CAAC;QAEF,sBAAO,IAAI,kCAAkC,CAAC,kBAAkB,EAAE,WAAW,CAAC,EAAC;;KAChF,CAAC;AAdW,QAAA,wCAAwC,4CAcnD","sourcesContent":["import { validatePrivacySelectors } from '@amplitude/session-replay-dom-privacy';\nimport { ILogger, IRemoteConfigClient, RemoteConfigClient, RemoteConfig, Source } from '@amplitude/analytics-core';\nimport { getDebugConfig } from '../helpers';\nimport { SessionReplayOptions } from '../typings/session-replay';\nimport { SessionReplayLocalConfig } from './local-config';\nimport {\n  SessionReplayLocalConfig as ISessionReplayLocalConfig,\n  PrivacyConfig,\n  SessionReplayConfigs,\n  SessionReplayJoinedConfig,\n  SessionReplayRemoteConfig,\n} from './types';\n\n// Budget for waiting on the remote config response before falling back to the local cache.\n// The inner fetch in analytics-core uses a 1000ms per-attempt AbortController timeout with\n// up to 3 retries — but this outer timeout is the only thing the SR plugin waits on, so\n// only the first attempt can possibly complete in time (attempt 2 starts at ~1000-1333ms\n// after backoff jitter and runs to ~2000-2333ms, well past any reasonable outer budget).\n// 1500ms is set above the 1000ms inner abort to avoid a tie with the inner cutoff and\n// give the first attempt's resolution path room to finish; everything else falls through\n// to the cache fallback. See SR-4234: prefer remote over a stale cache that would\n// otherwise win the synchronous race in 'all' mode.\nconst REMOTE_CONFIG_TIMEOUT_MS = 1500;\n\nexport const removeInvalidSelectorsFromPrivacyConfig = (privacyConfig: PrivacyConfig, loggerProvider: ILogger) => {\n  const fragment = document.createDocumentFragment();\n  return validatePrivacySelectors(\n    privacyConfig,\n    (selector) => {\n      fragment.querySelector(selector);\n    },\n    (selector) => {\n      loggerProvider.warn(`[session-replay-browser] omitting selector \"${selector}\" because it is invalid`);\n    },\n  );\n};\nexport class SessionReplayJoinedConfigGenerator {\n  private readonly localConfig: ISessionReplayLocalConfig;\n  private readonly remoteConfigClient: IRemoteConfigClient;\n\n  constructor(remoteConfigClient: IRemoteConfigClient, localConfig: ISessionReplayLocalConfig) {\n    this.localConfig = localConfig;\n    this.remoteConfigClient = remoteConfigClient;\n  }\n\n  async generateJoinedConfig(): Promise<SessionReplayConfigs> {\n    const config: SessionReplayJoinedConfig = { ...this.localConfig };\n    // Special case here as optOut is implemented via getter/setter\n    config.optOut = this.localConfig.optOut;\n    // We always want captureEnabled to be true, unless there's an override\n    // in the remote config.\n    config.captureEnabled = true;\n    let sessionReplayRemoteConfig: SessionReplayRemoteConfig | undefined;\n\n    try {\n      // Subscribe with a timeout so the SDK prefers the remote response and only falls back\n      // to cache after the budget elapses. 'all' mode would race a synchronous cache read\n      // against the network and resolve on whichever fires first — cache always wins, so a\n      // stale cache silently overrides the live config (SR-4234).\n      await new Promise<void>((resolve, reject) => {\n        this.remoteConfigClient.subscribe(\n          'configs.sessionReplay',\n          { timeout: REMOTE_CONFIG_TIMEOUT_MS },\n          (remoteConfig: RemoteConfig | null, source: Source) => {\n            this.localConfig.loggerProvider.debug(\n              `Session Replay remote configuration received from ${source}:`,\n              JSON.stringify(remoteConfig, null, 2),\n            );\n\n            if (!remoteConfig) {\n              reject(new Error('No remote config received'));\n              return;\n            }\n\n            // remoteConfig is already filtered to 'configs.sessionReplay' namespace\n            const namespaceConfig = remoteConfig as SessionReplayRemoteConfig;\n            const samplingConfig = namespaceConfig.sr_sampling_config;\n            const privacyConfig = namespaceConfig.sr_privacy_config;\n            const targetingConfig = namespaceConfig.sr_targeting_config;\n\n            const ugcFilterRules = config.interactionConfig?.ugcFilterRules;\n            // This is intentionally forced to only be set through the remote config.\n            config.interactionConfig = namespaceConfig.sr_interaction_config;\n            if (config.interactionConfig && ugcFilterRules) {\n              config.interactionConfig.ugcFilterRules = ugcFilterRules;\n            }\n\n            // This is intentionally forced to only be set through the remote config.\n            config.loggingConfig = namespaceConfig.sr_logging_config;\n\n            if (samplingConfig || privacyConfig || targetingConfig) {\n              sessionReplayRemoteConfig = {};\n              if (samplingConfig) {\n                sessionReplayRemoteConfig.sr_sampling_config = samplingConfig;\n              }\n              if (privacyConfig) {\n                sessionReplayRemoteConfig.sr_privacy_config = privacyConfig;\n              }\n              if (targetingConfig) {\n                sessionReplayRemoteConfig.sr_targeting_config = targetingConfig;\n              }\n            }\n\n            resolve();\n          },\n        );\n      });\n    } catch (error) {\n      this.localConfig.loggerProvider.error('Failed to generate joined config: ', error);\n      config.captureEnabled = false;\n      return {\n        localConfig: this.localConfig,\n        joinedConfig: config,\n        remoteConfig: undefined,\n      };\n    }\n\n    if (!sessionReplayRemoteConfig) {\n      return {\n        localConfig: this.localConfig,\n        joinedConfig: config,\n        remoteConfig: sessionReplayRemoteConfig,\n      };\n    }\n\n    const {\n      sr_sampling_config: samplingConfig,\n      sr_privacy_config: remotePrivacyConfig,\n      sr_targeting_config: targetingConfig,\n    } = sessionReplayRemoteConfig;\n    if (samplingConfig && Object.keys(samplingConfig).length > 0) {\n      if (Object.prototype.hasOwnProperty.call(samplingConfig, 'capture_enabled')) {\n        config.captureEnabled = samplingConfig.capture_enabled;\n      } else {\n        config.captureEnabled = false;\n      }\n\n      if (Object.prototype.hasOwnProperty.call(samplingConfig, 'sample_rate')) {\n        config.sampleRate = samplingConfig.sample_rate;\n      }\n\n      if (Object.prototype.hasOwnProperty.call(samplingConfig, 'min_session_duration_ms')) {\n        config.minSessionDurationMs = this.sanitizeMinSessionDurationMs(samplingConfig.min_session_duration_ms);\n      }\n    } else {\n      // If config API response was valid (ie 200), but no config returned, assume that\n      // customer has not yet set up config, and use sample rate from SDK options,\n      // allowing for immediate replay capture\n      config.captureEnabled = true;\n      this.localConfig.loggerProvider.debug(\n        'Remote config successfully fetched, but no values set for project, Session Replay capture enabled.',\n      );\n    }\n\n    // Remote config join acts somewhat like a left join between the remote and the local\n    // config. That is, remote config has precedence over local values as with sampling.\n    // However, non conflicting values will be added to the lists.\n    // Here's an example to illustrate:\n    //\n    // Remote config:   {'.selector1': 'MASK',   '.selector2': 'UNMASK'}\n    // Local config:    {'.selector1': 'UNMASK',                         '.selector3': 'MASK'}\n    //\n    // Resolved config: {'.selector1': 'MASK',   '.selector2': 'UNMASK', '.selector3': 'MASK'}\n    // config.privacyConfig = {\n    //   ...(config.privacyConfig ?? {}),\n    //   ...remotePrivacyConfig,\n    // };\n\n    if (remotePrivacyConfig) {\n      const localPrivacyConfig: PrivacyConfig = config.privacyConfig ?? {};\n\n      const joinedPrivacyConfig: Required<PrivacyConfig> & { blockSelector: string[] } = {\n        defaultMaskLevel: remotePrivacyConfig.defaultMaskLevel ?? localPrivacyConfig.defaultMaskLevel ?? 'medium',\n        blockSelector: [],\n        maskSelector: [],\n        unmaskSelector: [],\n        maskAttributes: [\n          ...new Set([...(localPrivacyConfig.maskAttributes ?? []), ...(remotePrivacyConfig.maskAttributes ?? [])]),\n        ],\n        urlMaskLevels: [...(remotePrivacyConfig.urlMaskLevels ?? []), ...(localPrivacyConfig.urlMaskLevels ?? [])],\n      };\n\n      const privacyConfigSelectorMap = (privacyConfig: PrivacyConfig): Record<string, 'mask' | 'unmask' | 'block'> => {\n        const selectorMap: Record<string, 'mask' | 'unmask' | 'block'> = {};\n        if (typeof privacyConfig.blockSelector === 'string') {\n          privacyConfig.blockSelector = [privacyConfig.blockSelector];\n        }\n\n        for (const selector of privacyConfig.blockSelector ?? []) {\n          selectorMap[selector] = 'block';\n        }\n        for (const selector of privacyConfig.maskSelector ?? []) {\n          selectorMap[selector] = 'mask';\n        }\n        for (const selector of privacyConfig.unmaskSelector ?? []) {\n          selectorMap[selector] = 'unmask';\n        }\n        return selectorMap;\n      };\n\n      const selectorMap: Record<string, 'mask' | 'unmask' | 'block'> = {\n        ...privacyConfigSelectorMap(localPrivacyConfig),\n        ...privacyConfigSelectorMap(remotePrivacyConfig),\n      };\n\n      for (const [selector, selectorType] of Object.entries(selectorMap)) {\n        if (selectorType === 'mask') {\n          joinedPrivacyConfig.maskSelector.push(selector);\n        } else if (selectorType === 'block') {\n          joinedPrivacyConfig.blockSelector.push(selector);\n        } else if (selectorType === 'unmask') {\n          joinedPrivacyConfig.unmaskSelector.push(selector);\n        }\n      }\n\n      config.privacyConfig = removeInvalidSelectorsFromPrivacyConfig(\n        joinedPrivacyConfig,\n        this.localConfig.loggerProvider,\n      );\n    }\n\n    if (targetingConfig && Object.keys(targetingConfig).length > 0) {\n      config.targetingConfig = targetingConfig;\n    }\n\n    this.localConfig.loggerProvider.debug(\n      JSON.stringify({ name: 'session replay joined config', config: getDebugConfig(config) }, null, 2),\n    );\n\n    return {\n      localConfig: this.localConfig,\n      joinedConfig: config,\n      remoteConfig: sessionReplayRemoteConfig,\n    };\n  }\n\n  /**\n   * Defensive bounds for the remote-supplied min_session_duration_ms. A misconfigured\n   * value (e.g. 30_000_000) would silently suppress every replay until the config is\n   * pushed again, so we clamp to a sane ceiling and warn on out-of-range inputs.\n   * Returns undefined for clearly invalid values so the gate falls back to disabled\n   * rather than carrying a NaN through downstream comparisons.\n   */\n  private sanitizeMinSessionDurationMs(raw: unknown): number | undefined {\n    if (typeof raw !== 'number' || !Number.isFinite(raw)) {\n      this.localConfig.loggerProvider.warn(\n        `min_session_duration_ms remote value is not a finite number (got ${String(raw)}); ignoring.`,\n      );\n      return undefined;\n    }\n    if (raw < 0) {\n      this.localConfig.loggerProvider.warn(`min_session_duration_ms remote value is negative (${raw}); ignoring.`);\n      return undefined;\n    }\n    if (raw > MAX_MIN_SESSION_DURATION_MS) {\n      this.localConfig.loggerProvider.warn(\n        `min_session_duration_ms remote value ${raw} exceeds ${MAX_MIN_SESSION_DURATION_MS}ms ceiling; clamping.`,\n      );\n      return MAX_MIN_SESSION_DURATION_MS;\n    }\n    return raw;\n  }\n}\n\n/**\n * Upper bound for the remote-configured replay min duration. 60 seconds is well above\n * any reasonable bounce threshold; values higher than this are almost certainly typos\n * (e.g. seconds confused for milliseconds, or an extra zero) and would otherwise\n * suppress every replay until the config is corrected.\n */\nexport const MAX_MIN_SESSION_DURATION_MS = 60_000;\n\nexport const createSessionReplayJoinedConfigGenerator = async (apiKey: string, options: SessionReplayOptions) => {\n  const localConfig = new SessionReplayLocalConfig(apiKey, options);\n\n  const remoteConfigClient = new RemoteConfigClient(\n    apiKey,\n    localConfig.loggerProvider,\n    localConfig.serverZone,\n    options.configServerUrl,\n    // Custom transport for the config GET. SR's FetchConfigRequest is structurally compatible\n    // with RemoteConfigFetchRequest, so the customer's handleFetchConfig drops straight in.\n    options.handleFetchConfig,\n  );\n\n  return new SessionReplayJoinedConfigGenerator(remoteConfigClient, localConfig);\n};\n"]}

package/lib/cjs/config/types.d.ts

@@ -1,3 +1,5 @@
+import type { PrivacyConfig } from '@amplitude/session-replay-dom-privacy';
+export type { PrivacyConfig, MaskLevel } from '@amplitude/session-replay-dom-privacy';
 import { IConfig, LogLevel, ILogger } from '@amplitude/analytics-core';
 import { StoreType, ConsoleLogLevel } from '../typings/session-replay';
 import { TargetingFlag } from '@amplitude/targeting';
@@ -43,31 +45,6 @@ export interface SessionReplayRemoteConfigAPIResponse {
         sessionReplay: SessionReplayRemoteConfig;
     };
 }
-export type MaskLevel = 'light' | 'medium' | 'conservative';
-export declare const DEFAULT_MASK_LEVEL = "medium";
-export type PrivacyConfig = {
-    blockSelector?: string | string[];
-    defaultMaskLevel?: MaskLevel;
-    maskSelector?: string[];
-    unmaskSelector?: string[];
-    maskAttributes?: string[];
-    /**
-     * Per-URL overrides for `defaultMaskLevel`. Each entry contains a glob pattern (`match`)
-     * and a `maskLevel` to apply when the current page URL matches that pattern.
-     * Rules are evaluated in order; the first match wins. Remote rules take precedence
-     * over local rules (remote entries are prepended before local entries).
-     *
-     * @example
-     * urlMaskLevels: [
-     *   { match: 'https://example.com/checkout/*', maskLevel: 'conservative' },
-     *   { match: 'https://example.com/public/*',   maskLevel: 'light' },
-     * ]
-     */
-    urlMaskLevels?: Array<{
-        match: string;
-        maskLevel: MaskLevel;
-    }>;
-};
 /**
  * UGC filter rule.
  */

package/lib/cjs/config/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf;;OAEG;IACH,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE;QACP,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,eAAe,EAAE,CAAC;KAC3B,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,EAAE,OAAO,CAAC;QACjB,IAAI,CAAC,EAAE;YACL,OAAO,CAAC,EAAE,qBAAqB,CAAC;YAChC,QAAQ,CAAC,EAAE,qBAAqB,CAAC;YACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;SAC3B,CAAC;KACH,CAAC;CACH;AAED,MAAM,MAAM,eAAe,GAAG,aAAa,CAAC;AAE5C,MAAM,MAAM,yBAAyB,GAAG;IACtC,kBAAkB,CAAC,EAAE,cAAc,CAAC;IACpC,iBAAiB,CAAC,EAAE,aAAa,CAAC;IAClC,qBAAqB,CAAC,EAAE,iBAAiB,CAAC;IAC1C,iBAAiB,CAAC,EAAE,aAAa,CAAC;IAClC,mBAAmB,CAAC,EAAE,eAAe,CAAC;CACvC,CAAC;AAEF,MAAM,WAAW,oCAAoC;IACnD,OAAO,EAAE;QACP,aAAa,EAAE,yBAAyB,CAAC;KAC1C,CAAC;CACH;AAED,MAAM,MAAM,SAAS,GACjB,OAAO,GACP,QAAQ,GACR,cAAc,CAAC;AAEnB,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAG3C,MAAM,MAAM,aAAa,GAAG;IAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,gBAAgB,CAAC,EAAE,SAAS,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,SAAS,CAAA;KAAE,CAAC,CAAC;CAChE,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;IAC1B;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,mFAAmF;IACnF,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,KAAK,CAAC;IACd,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,oGAAoG;IACpG,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE/F;;GAEG;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,OAAO,EAAE,kBAAkB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEjG,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAyB,SAAQ,OAAO;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;;;OAKG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;;;;;;OAQG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,8BAA8B,CAAC;IACnD;;;;;;;;OAQG;IACH,SAAS,EAAE,SAAS,CAAC;IAErB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB;;;;;;;;;;;;;;OAcG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IAErC;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,cAAc,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAE,CAAC;IAExC;;;OAGG;IACH,qCAAqC,CAAC,EAAE,OAAO,CAAC;IAChD;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;;;;;;OAWG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IAC9C,4JAA4J;IAC5J,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C;;;;;;;;;;;;OAYG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;;;;OAcG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC;;;;;;;;;;OAUG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,8BAA8B,CAAC;IAClD;;;OAGG;IACH,iBAAiB,CAAC,EAAE,+BAA+B,CAAC;CACrD;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,yBAA0B,SAAQ,wBAAwB;IACzE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,wBAAwB,CAAC;IACtC,YAAY,EAAE,yBAAyB,CAAC;IACxC,YAAY,EAAE,yBAAyB,GAAG,SAAS,CAAC;CACrD;AACD,MAAM,WAAW,kCAAkC;IACjD,oBAAoB,EAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,yBAAyB,GAAG,SAAS,CAAC;IACpD,WAAW,EAAE,wBAAwB,CAAC;IACtC,YAAY,EAAE,yBAAyB,CAAC;IACxC,SAAS,CAAC,EAAE;QACV,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,iBAAiB,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;OAEG;IACH,WAAW,CAAC,EAAE,4BAA4B,CAAC;CAC5C;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAC3E,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf;;OAEG;IACH,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE;QACP,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,eAAe,EAAE,CAAC;KAC3B,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,EAAE,OAAO,CAAC;QACjB,IAAI,CAAC,EAAE;YACL,OAAO,CAAC,EAAE,qBAAqB,CAAC;YAChC,QAAQ,CAAC,EAAE,qBAAqB,CAAC;YACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;SAC3B,CAAC;KACH,CAAC;CACH;AAED,MAAM,MAAM,eAAe,GAAG,aAAa,CAAC;AAE5C,MAAM,MAAM,yBAAyB,GAAG;IACtC,kBAAkB,CAAC,EAAE,cAAc,CAAC;IACpC,iBAAiB,CAAC,EAAE,aAAa,CAAC;IAClC,qBAAqB,CAAC,EAAE,iBAAiB,CAAC;IAC1C,iBAAiB,CAAC,EAAE,aAAa,CAAC;IAClC,mBAAmB,CAAC,EAAE,eAAe,CAAC;CACvC,CAAC;AAEF,MAAM,WAAW,oCAAoC;IACnD,OAAO,EAAE;QACP,aAAa,EAAE,yBAAyB,CAAC;KAC1C,CAAC;CACH;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;IAC1B;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,mFAAmF;IACnF,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,KAAK,CAAC;IACd,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,oGAAoG;IACpG,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE/F;;GAEG;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,OAAO,EAAE,kBAAkB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEjG,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAyB,SAAQ,OAAO;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;;;OAKG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;;;;;;OAQG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,8BAA8B,CAAC;IACnD;;;;;;;;OAQG;IACH,SAAS,EAAE,SAAS,CAAC;IAErB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB;;;;;;;;;;;;;;OAcG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IAErC;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,cAAc,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAE,CAAC;IAExC;;;OAGG;IACH,qCAAqC,CAAC,EAAE,OAAO,CAAC;IAChD;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;;;;;;OAWG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IAC9C,4JAA4J;IAC5J,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C;;;;;;;;;;;;OAYG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;;;;OAcG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC;;;;;;;;;;OAUG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,8BAA8B,CAAC;IAClD;;;OAGG;IACH,iBAAiB,CAAC,EAAE,+BAA+B,CAAC;CACrD;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,yBAA0B,SAAQ,wBAAwB;IACzE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,wBAAwB,CAAC;IACtC,YAAY,EAAE,yBAAyB,CAAC;IACxC,YAAY,EAAE,yBAAyB,GAAG,SAAS,CAAC;CACrD;AACD,MAAM,WAAW,kCAAkC;IACjD,oBAAoB,EAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,yBAAyB,GAAG,SAAS,CAAC;IACpD,WAAW,EAAE,wBAAwB,CAAC;IACtC,YAAY,EAAE,yBAAyB,CAAC;IACxC,SAAS,CAAC,EAAE;QACV,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,iBAAiB,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;OAEG;IACH,WAAW,CAAC,EAAE,4BAA4B,CAAC;CAC5C;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,CAAC"}

package/lib/cjs/config/types.js

@@ -1,5 +1,3 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_MASK_LEVEL = void 0;
-exports.DEFAULT_MASK_LEVEL = 'medium';
 //# sourceMappingURL=types.js.map

package/lib/cjs/config/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/config/types.ts"],"names":[],"mappings":";;;AAyDa,QAAA,kBAAkB,GAAG,QAAQ,CAAC","sourcesContent":["import { IConfig, LogLevel, ILogger } from '@amplitude/analytics-core';\nimport { StoreType, ConsoleLogLevel } from '../typings/session-replay';\nimport { TargetingFlag } from '@amplitude/targeting';\nimport type { BodyCaptureRuleConfig } from '../network-body-capture';\n\nexport interface SamplingConfig {\n  sample_rate: number;\n  capture_enabled: boolean;\n  min_session_duration_ms?: number;\n}\n\nexport interface InteractionConfig {\n  trackEveryNms?: number;\n  enabled: boolean; // defaults to false\n  batch: boolean; // defaults to false\n  /**\n   * UGC filter rules.\n   */\n  ugcFilterRules?: UGCFilterRule[];\n}\n\nexport interface LoggingConfig {\n  console: {\n    enabled: boolean;\n    levels: ConsoleLogLevel[];\n  };\n  network?: {\n    enabled: boolean;\n    body?: {\n      request?: BodyCaptureRuleConfig;\n      response?: BodyCaptureRuleConfig;\n      maxBodySizeBytes?: number;\n    };\n  };\n}\n\nexport type TargetingConfig = TargetingFlag;\n\nexport type SessionReplayRemoteConfig = {\n  sr_sampling_config?: SamplingConfig;\n  sr_privacy_config?: PrivacyConfig;\n  sr_interaction_config?: InteractionConfig;\n  sr_logging_config?: LoggingConfig;\n  sr_targeting_config?: TargetingConfig;\n};\n\nexport interface SessionReplayRemoteConfigAPIResponse {\n  configs: {\n    sessionReplay: SessionReplayRemoteConfig;\n  };\n}\n\nexport type MaskLevel =\n  | 'light' // only mask a subset of inputs that's deemed sensitive - password, credit card, telephone #, email. These are information we never want to capture.\n  | 'medium' // mask all form fields (inputs); page text is captured as-is\n  | 'conservative'; // mask all inputs and all texts\n\nexport const DEFAULT_MASK_LEVEL = 'medium';\n\n// err on the side of excluding more\nexport type PrivacyConfig = {\n  blockSelector?: string | string[]; // exclude in the UI\n  defaultMaskLevel?: MaskLevel;\n  maskSelector?: string[];\n  unmaskSelector?: string[];\n  maskAttributes?: string[]; // HTML attribute names to mask (e.g. [\"placeholder\", \"aria-label\"])\n  /**\n   * Per-URL overrides for `defaultMaskLevel`. Each entry contains a glob pattern (`match`)\n   * and a `maskLevel` to apply when the current page URL matches that pattern.\n   * Rules are evaluated in order; the first match wins. Remote rules take precedence\n   * over local rules (remote entries are prepended before local entries).\n   *\n   * @example\n   * urlMaskLevels: [\n   *   { match: 'https://example.com/checkout/*', maskLevel: 'conservative' },\n   *   { match: 'https://example.com/public/*',   maskLevel: 'light' },\n   * ]\n   */\n  urlMaskLevels?: Array<{ match: string; maskLevel: MaskLevel }>;\n};\n\n/**\n * UGC filter rule.\n */\nexport type UGCFilterRule = {\n  /**\n   * The selector of the UGC element.\n   */\n  selector: string;\n  /**\n   * The replacement text for the UGC element.\n   */\n  replacement: string;\n};\n\n/**\n * The fully-formed request the SDK hands to a custom `handleSendEvents` transport when\n * uploading recorded replay events. The callback's only job is to execute this request and\n * return the resulting `Response`; the SDK owns batching, retry, serialization and error\n * handling around it.\n */\nexport interface SendEventsRequest {\n  /** The resolved track URL (respects `trackServerUrl`) including query params. */\n  url: string;\n  method: 'POST';\n  /**\n   * SDK-supplied default headers. When the body was gzipped, this includes\n   * `Content-Encoding: gzip` — drop it only if you also stop forwarding the gzipped body,\n   * otherwise the payload will not decode server-side.\n   */\n  headers: Record<string, string>;\n  /**\n   * The serialized payload, ready to send. A gzipped `Uint8Array` when transport compression\n   * is active, otherwise the raw JSON string. Forward it unchanged — do not re-serialize.\n   *\n   * Typed as `string | Uint8Array` (not the broader `BodyInit`) because the body must be\n   * structured-cloneable to cross `postMessage` in web-worker mode; `Blob`/`FormData`/\n   * `ReadableStream` are not, and the SDK never produces them here.\n   */\n  body: string | Uint8Array;\n  /**\n   * Whether the built-in path would set `keepalive` on this request. `true` for page-exit\n   * sends (so the request survives unload) and for small in-session batches. Forward it to\n   * your `fetch` call — i.e. `fetch(url, { method, headers, body, keepalive })` — so exit-time\n   * batches are not dropped when the page is tearing down.\n   */\n  keepalive: boolean;\n}\n\n/**\n * The fully-formed request the SDK hands to a custom `handleFetchConfig` transport when\n * fetching remote configuration.\n */\nexport interface FetchConfigRequest {\n  /** The resolved config URL (respects `configServerUrl`) including query params. */\n  url: string;\n  method: 'GET';\n  /** SDK-supplied default headers. */\n  headers: Record<string, string>;\n  /** Abort signal the SDK uses to enforce the remote-config fetch timeout. Honor it in your fetch. */\n  signal?: AbortSignal;\n}\n\n/**\n * Custom transport for replay event uploads. Invoked by the SDK in place of its internal\n * `fetch`. Must return a `Response` (or Response-like with `ok`, `status`, `text()`). Called\n * once per logical request attempt — retry is handled by the SDK around the callback, so do\n * not implement your own retry. Thrown errors / rejected promises are surfaced to the SDK's\n * existing retry logic.\n */\nexport type SessionReplaySendEventsHandler = (request: SendEventsRequest) => Promise<Response>;\n\n/**\n * Custom transport for remote-config fetches. Same contract as {@link SessionReplaySendEventsHandler}.\n */\nexport type SessionReplayFetchConfigHandler = (request: FetchConfigRequest) => Promise<Response>;\n\nexport interface CrossOriginIframesConfig {\n  enabled: boolean;\n  /**\n   * When true (default), the parent SDK sends start/stop signals to child iframes via\n   * postMessage, keeping their recording lifecycle in sync with the parent.\n   *\n   * **Privacy note:** The child page's rrweb instance performs its own DOM serialization,\n   * so the parent's privacy config (mask levels, block selectors) does NOT automatically\n   * apply inside the iframe. Privacy settings must be configured independently on the child page.\n   *\n   * **Third-party iframes:** Cannot capture iframes you don't control (e.g. Stripe, Google\n   * Maps) — both parent and child pages must load the SDK with `crossOriginIframes.enabled: true`.\n   *\n   * Set to `false` to skip coordination and manage the child recording lifecycle yourself.\n   * @defaultValue true\n   */\n  coordinateChildren?: boolean;\n}\n\nexport interface SessionReplayLocalConfig extends IConfig {\n  apiKey: string;\n  loggerProvider: ILogger;\n  /**\n   * LogLevel.None or LogLevel.Error or LogLevel.Warn or LogLevel.Verbose or LogLevel.Debug.\n   * Sets the log level.\n   *\n   * @defaultValue LogLevel.Warn\n   */\n  logLevel: LogLevel;\n  /**\n   * The maximum number of retries allowed for sending replay events.\n   * Once this limit is reached, failed events will no longer be sent.\n   *\n   * @defaultValue 2\n   */\n  flushMaxRetries: number;\n  /**\n   * Use this option to control how many sessions to select for replay collection.\n   * The number should be a decimal between 0 and 1, for example 0.4, representing\n   * the fraction of sessions to have randomly selected for replay collection.\n   * Over a large number of sessions, 0.4 would select 40% of those sessions.\n   * Sample rates as small as six decimal places (0.000001) are supported.\n   *\n   * @defaultValue 0\n   */\n  sampleRate: number;\n  privacyConfig?: PrivacyConfig;\n  /**\n   * Adds additional debug event property to help debug instrumentation issues\n   * (such as mismatching apps). Only recommended for debugging initial setup,\n   * and not recommended for production.\n   */\n  debugMode?: boolean;\n  /**\n   * Specifies the endpoint URL to fetch remote configuration.\n   * If provided, it overrides the default server zone configuration.\n   */\n  configServerUrl?: string;\n  /**\n   * Specifies the endpoint URL for sending session replay data.\n   * If provided, it overrides the default server zone configuration.\n   */\n  trackServerUrl?: string;\n  /**\n   * If stylesheets are inlined, the contents of the stylesheet will be stored.\n   * During replay, the stored stylesheet will be used instead of attempting to fetch it remotely.\n   * This prevents replays from appearing broken due to missing stylesheets.\n   * Note: Inlining stylesheets may not work in all cases.\n   */\n  shouldInlineStylesheet?: boolean;\n  /**\n   * When true, image sources are inlined as data URLs in the rrweb snapshot so replays do not\n   * depend on fetching remote image assets at playback time. Increases snapshot payload size.\n   * Passed through to rrweb's `inlineImages` record option; when unset, rrweb defaults to false.\n   */\n  inlineImages?: boolean;\n  version?: SessionReplayVersion;\n  /**\n   * Performance configuration config. If enabled, we will defer compression\n   * to be done during the browser's idle periods.\n   */\n  performanceConfig?: SessionReplayPerformanceConfig;\n  /**\n   * Specifies how replay events should be stored. `idb` uses IndexedDB to persist replay events\n   * when all events cannot be sent during capture. `memory` stores replay events only in memory,\n   * meaning events are lost when the page is closed. If IndexedDB is unavailable, the system falls back to `memory`.\n   *\n   * @defaultValue 'memory' — reflects the validated amp-on-amp perf config (SR-4646). `memory`\n   * drops cross-navigation persistence (unsent events do not survive a full page reload), which\n   * is the intended trade-off for lower IDB overhead.\n   */\n  storeType: StoreType;\n\n  /**\n   * If true, the SDK will compress replay events using a web worker.\n   * This offloads compression to a separate thread, improving performance on the main thread.\n   * Set to `false` to keep compression on the main thread.\n   *\n   * @defaultValue true — reflects the validated amp-on-amp perf config (SR-4646). Was `false`\n   * prior to that change.\n   */\n  useWebWorker?: boolean;\n\n  /**\n   * Controls transport-layer gzip compression of session replay request bodies.\n   * When true (default), the SDK gzip-compresses the JSON request body via the browser's\n   * `CompressionStream` API and sets `Content-Encoding: gzip` on the POST. When false,\n   * the SDK sends the raw JSON body with no `Content-Encoding` header.\n   *\n   * Disabling is intended as a debugging / safety opt-out (e.g. for diagnosing\n   * server-side decompression issues); it increases egress bytes and is not\n   * recommended for production.\n   *\n   * Note: This is independent of `useWebWorker` / `performanceConfig`, which control\n   * per-event rrweb compression that runs before events are queued.\n   *\n   * @defaultValue true\n   */\n  enableTransportCompression?: boolean;\n\n  /**\n   * Milliseconds to wait for a send request before aborting it. `fetch()` has no native\n   * timeout, so a request stuck \"pending\" would block the serial flush loop indefinitely;\n   * the SDK aborts after this many ms and routes the abort as a retryable failure.\n   *\n   * Set to `0` (or a negative value) to disable the timeout entirely — note this\n   * reintroduces the head-of-line-blocking risk a wedged request can cause, so it is\n   * intended only as a diagnostic/experiment opt-out.\n   *\n   * Tuning this higher is useful when large, slow-but-succeeding uploads are being aborted\n   * at the default and counted as failures (which also triggers a retry, inflating request\n   * volume / throttle pressure).\n   *\n   * @defaultValue 10000\n   */\n  sendTimeoutMs?: number;\n\n  userProperties?: { [key: string]: any };\n\n  /**\n   * If true, applies a background color to blocked elements in the replay.\n   * This helps visualize which elements are blocked from being captured.\n   */\n  applyBackgroundColorToBlockedElements?: boolean;\n  /**\n   * Enables URL change polling as a fallback for SPA route tracking.\n   * When enabled, the SDK will periodically check for URL changes every second\n   * in addition to patching the History API. This is useful for edge cases where\n   * route changes might bypass the standard History API methods.\n   *\n   * @defaultValue false\n   */\n  enableUrlChangePolling?: boolean;\n  /**\n   * Specifies the interval in milliseconds for URL change polling when enableUrlChangePolling is true.\n   * The SDK will check for URL changes at this interval as a fallback for SPA route tracking.\n   *\n   * @defaultValue 1000\n   */\n  urlChangePollingInterval?: number;\n  /**\n   * Whether to capture document title in URL change events.\n   * When disabled, the title field will be empty in URL change events.\n   *\n   * @defaultValue false\n   */\n  captureDocumentTitle?: boolean;\n  interactionConfig?: InteractionConfig;\n  /**\n   * When true (default), the CSS rules of any `adoptedStyleSheets` on shadow roots and\n   * the document are serialized **inline** within the full snapshot. This makes the snapshot\n   * self-contained so that shadow DOM styles are replayed correctly even if subsequent\n   * incremental `AdoptedStyleSheet` events are dropped in transit.\n   *\n   * Set to `false` to revert to the legacy behavior where adopted stylesheet rules are\n   * emitted as separate incremental events (which may be lost if delivery is unreliable).\n   * Only consider opting out if snapshot payload size is a critical concern.\n   *\n   * @defaultValue true\n   */\n  captureAdoptedStyleSheets?: boolean;\n  /**\n   * Enables recording of cross-origin iframes. Both the parent page and each child iframe\n   * page must load the Amplitude Session Replay SDK with this option enabled.\n   *\n   * When enabled, rrweb uses `postMessage` to relay child DOM events to the parent, which\n   * merges them into a single unified event stream.\n   */\n  crossOriginIframes?: CrossOriginIframesConfig;\n  /** Interval in ms at which the SDK takes a full DOM snapshot. Disabled by default — periodic snapshots are expensive. Recommended value: 300000 (5 min). */\n  fullSnapshotIntervalMs?: number;\n  /**\n   * Controls how often the SDK splits buffered rrweb events into a sequence and dispatches\n   * the resulting batch to the server. The interval starts at `minIntervalMs` and grows by\n   * `minIntervalMs` after each split, capped at `maxIntervalMs`. Lowering values increases\n   * replay availability latency improvements at the cost of more requests; raising them\n   * reduces request volume (and 200+`X-Session-Replay-Event-Skipped` throttling responses)\n   * at the cost of slightly delayed replay availability.\n   *\n   * Defaults to `{ minIntervalMs: 1000, maxIntervalMs: 10_000 }`, reflecting the validated\n   * amp-on-amp perf config (SR-4646); the `minIntervalMs` default was `500` prior to that\n   * change. Tune up if the server is back-pressuring the SDK on session start.\n   */\n  flushIntervalConfig?: FlushIntervalConfig;\n  /**\n   * When true, every rrweb full snapshot is flushed to the server immediately so replays\n   * become playable as early as possible. When false (default), full-snapshot sends are\n   * deferred to the normal interval/size flush cadence instead. The snapshot is still\n   * compressed and buffered immediately either way (ordering and page-exit beacon coverage\n   * are preserved); only the eager network send is suppressed. The default-off behavior\n   * reduces request volume for pages that produce many full snapshots (e.g. focus-driven or\n   * `fullSnapshotIntervalMs` checkouts), especially when many SDK instances run on the same\n   * page.\n   *\n   * @defaultValue false — reflects the validated amp-on-amp perf config (SR-4646). Was `true`\n   * prior to that change.\n   */\n  eagerFullSnapshotSend?: boolean;\n  /**\n   * When true, the window `focus` listener forces a fresh rrweb full snapshot\n   * (`takeFullSnapshot`) every time the page regains focus, so the replay reflects any DOM\n   * changes that happened while the tab was backgrounded. When false (default), the on-focus\n   * full snapshot is skipped entirely (recording simply continues from the existing stream).\n   *\n   * On pages with heavy focus churn (e.g. embedded iframes, inline editors that repeatedly\n   * steal and return focus) this fires constantly, and when combined with\n   * `eagerFullSnapshotSend` each focus produces an immediate network send — the primary\n   * driver of focus-driven request storms. The default-off behavior removes the snapshot (and\n   * therefore the send) at the cost of slightly staler post-focus frames.\n   *\n   * @defaultValue false — reflects the validated amp-on-amp perf config (SR-4646). Was `true`\n   * prior to that change.\n   */\n  captureFullSnapshotOnFocus?: boolean;\n  /**\n   * Raw (uncompressed) UTF-8 byte cap for a single buffered events list before the store\n   * splits it into its own request. Larger values produce fewer, larger requests (the primary\n   * steady-state lever for request volume); smaller values split sooner. Payloads are gzipped\n   * on the wire, so several hundred KB of replay JSON compresses to well under 100 KB.\n   *\n   * Advanced/debug knob — the default already balances request volume against the server's\n   * decompressed-size split threshold. Clamped to a safe range; values outside it are clamped\n   * and logged. Defaults to the SDK's internal `DEFAULT_MAX_PERSISTED_EVENTS_SIZE_BYTES`.\n   *\n   * @defaultValue 6000000 — reflects the validated amp-on-amp perf config (SR-4646). Was\n   * `MAX_EVENT_LIST_SIZE` (2000000) prior to that change.\n   */\n  maxPersistedEventsSizeBytes?: number;\n  /**\n   * Raw (uncompressed) UTF-8 byte cap for a single rrweb event. Events larger than this are\n   * dropped (with a warning) both at capture time and as a pre-send backstop, because the SR\n   * ingest service rejects a single event above ~10 MB. Lower this to exercise drop behavior\n   * for large full snapshots while debugging.\n   *\n   * Advanced/debug knob. Clamped to a safe range; values outside it are clamped and logged.\n   * Defaults to the SDK's internal `MAX_SINGLE_EVENT_SIZE`.\n   *\n   * @defaultValue 9000000\n   */\n  maxSingleEventSizeBytes?: number;\n  /**\n   * Optional custom transport for replay event uploads. When provided, the SDK invokes this\n   * callback in place of its internal `fetch` for every event-upload attempt, passing a\n   * fully-formed {@link SendEventsRequest} (resolved URL, headers, serialized body). The SDK\n   * still owns batching, retry, serialization and error handling. Use it to attach custom\n   * auth (e.g. a JWT `Authorization` header) and route through an authenticated proxy.\n   *\n   * Works alongside `trackServerUrl`: the URL passed to the callback already respects it.\n   */\n  handleSendEvents?: SessionReplaySendEventsHandler;\n  /**\n   * Optional custom transport for the remote-config fetch. Same contract as `handleSendEvents`\n   * but for the config GET. The URL passed to the callback already respects `configServerUrl`.\n   */\n  handleFetchConfig?: SessionReplayFetchConfigHandler;\n}\n\nexport interface FlushIntervalConfig {\n  /**\n   * Lower bound on the rrweb event-split interval in milliseconds. Also the increment\n   * added to the interval after each split. Must be > 0; values are clamped to a 100ms floor.\n   *\n   * @defaultValue 1000 — reflects the validated amp-on-amp perf config (SR-4646). Was `500`\n   * prior to that change.\n   */\n  minIntervalMs?: number;\n  /**\n   * Upper bound on the rrweb event-split interval in milliseconds. Must be >= `minIntervalMs`.\n   *\n   * @defaultValue 10000\n   */\n  maxIntervalMs?: number;\n}\n\nexport interface SessionReplayJoinedConfig extends SessionReplayLocalConfig {\n  captureEnabled?: boolean;\n  interactionConfig?: InteractionConfig;\n  loggingConfig?: LoggingConfig;\n  targetingConfig?: TargetingConfig;\n  minSessionDurationMs?: number;\n}\n\nexport interface SessionReplayConfigs {\n  localConfig: SessionReplayLocalConfig;\n  joinedConfig: SessionReplayJoinedConfig;\n  remoteConfig: SessionReplayRemoteConfig | undefined;\n}\nexport interface SessionReplayJoinedConfigGenerator {\n  generateJoinedConfig: () => Promise<SessionReplayConfigs>;\n}\n\nexport interface SessionReplayMetadata {\n  remoteConfig: SessionReplayRemoteConfig | undefined;\n  localConfig: SessionReplayLocalConfig;\n  joinedConfig: SessionReplayJoinedConfig;\n  framework?: {\n    name: string;\n    version: string;\n  };\n  sessionId: string | number | undefined;\n  hashValue?: number;\n  sampleRate: number;\n  replaySDKType: string | null;\n  replaySDKVersion: string | undefined;\n  standaloneSDKType: string;\n  standaloneSDKVersion: string | undefined;\n}\n\nexport interface SessionReplayVersion {\n  version: string;\n  type: SessionReplayType;\n}\n\n/**\n * Configuration options for session replay performance.\n */\nexport interface SessionReplayPerformanceConfig {\n  /**\n   * If enabled, event compression will be deferred to occur during the browser's idle periods.\n   */\n  enabled: boolean;\n  /**\n   * Optional timeout in milliseconds for the `requestIdleCallback` API.\n   * If specified, this value will be used to set a maximum time for the browser to wait\n   * before executing the deferred compression task, even if the browser is not idle.\n   */\n  timeout?: number;\n  /**\n   * If enabled, consecutive mutation events will be merged into a single event before\n   * compression, reducing stored event count without changing replay semantics.\n   * Defaults to true, reflecting the validated amp-on-amp perf config (SR-4646); set to\n   * false to disable merging.\n   */\n  mergeMutations?: boolean;\n  /**\n   * Performance configuration for interaction tracking (clicks, scrolls).\n   */\n  interaction?: InteractionPerformanceConfig;\n}\n\n/**\n * Performance configuration for interaction tracking, specifically for CSS selector generation.\n */\nexport interface InteractionPerformanceConfig {\n  /**\n   * Maximum time in milliseconds allowed for CSS selector generation.\n   * If selector generation takes longer than this, it will throw a timeout error.\n   * Default: undefined (no timeout limit)\n   */\n  timeoutMs?: number;\n  /**\n   * Maximum number of attempts to optimize/simplify the CSS selector path.\n   * Higher values may produce shorter selectors but take longer to compute.\n   * Default: 10000\n   */\n  maxNumberOfTries?: number;\n  /**\n   * Maximum number of CSS selector combinations to test for uniqueness.\n   * If more combinations would be generated, falls back to a simpler strategy.\n   * Default: 1000\n   */\n  threshold?: number;\n}\n\nexport type SessionReplayType = 'standalone' | 'plugin' | 'segment';\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/config/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { PrivacyConfig } from '@amplitude/session-replay-dom-privacy';\nexport type { PrivacyConfig, MaskLevel } from '@amplitude/session-replay-dom-privacy';\nimport { IConfig, LogLevel, ILogger } from '@amplitude/analytics-core';\nimport { StoreType, ConsoleLogLevel } from '../typings/session-replay';\nimport { TargetingFlag } from '@amplitude/targeting';\nimport type { BodyCaptureRuleConfig } from '../network-body-capture';\n\nexport interface SamplingConfig {\n  sample_rate: number;\n  capture_enabled: boolean;\n  min_session_duration_ms?: number;\n}\n\nexport interface InteractionConfig {\n  trackEveryNms?: number;\n  enabled: boolean; // defaults to false\n  batch: boolean; // defaults to false\n  /**\n   * UGC filter rules.\n   */\n  ugcFilterRules?: UGCFilterRule[];\n}\n\nexport interface LoggingConfig {\n  console: {\n    enabled: boolean;\n    levels: ConsoleLogLevel[];\n  };\n  network?: {\n    enabled: boolean;\n    body?: {\n      request?: BodyCaptureRuleConfig;\n      response?: BodyCaptureRuleConfig;\n      maxBodySizeBytes?: number;\n    };\n  };\n}\n\nexport type TargetingConfig = TargetingFlag;\n\nexport type SessionReplayRemoteConfig = {\n  sr_sampling_config?: SamplingConfig;\n  sr_privacy_config?: PrivacyConfig;\n  sr_interaction_config?: InteractionConfig;\n  sr_logging_config?: LoggingConfig;\n  sr_targeting_config?: TargetingConfig;\n};\n\nexport interface SessionReplayRemoteConfigAPIResponse {\n  configs: {\n    sessionReplay: SessionReplayRemoteConfig;\n  };\n}\n\n/**\n * UGC filter rule.\n */\nexport type UGCFilterRule = {\n  /**\n   * The selector of the UGC element.\n   */\n  selector: string;\n  /**\n   * The replacement text for the UGC element.\n   */\n  replacement: string;\n};\n\n/**\n * The fully-formed request the SDK hands to a custom `handleSendEvents` transport when\n * uploading recorded replay events. The callback's only job is to execute this request and\n * return the resulting `Response`; the SDK owns batching, retry, serialization and error\n * handling around it.\n */\nexport interface SendEventsRequest {\n  /** The resolved track URL (respects `trackServerUrl`) including query params. */\n  url: string;\n  method: 'POST';\n  /**\n   * SDK-supplied default headers. When the body was gzipped, this includes\n   * `Content-Encoding: gzip` — drop it only if you also stop forwarding the gzipped body,\n   * otherwise the payload will not decode server-side.\n   */\n  headers: Record<string, string>;\n  /**\n   * The serialized payload, ready to send. A gzipped `Uint8Array` when transport compression\n   * is active, otherwise the raw JSON string. Forward it unchanged — do not re-serialize.\n   *\n   * Typed as `string | Uint8Array` (not the broader `BodyInit`) because the body must be\n   * structured-cloneable to cross `postMessage` in web-worker mode; `Blob`/`FormData`/\n   * `ReadableStream` are not, and the SDK never produces them here.\n   */\n  body: string | Uint8Array;\n  /**\n   * Whether the built-in path would set `keepalive` on this request. `true` for page-exit\n   * sends (so the request survives unload) and for small in-session batches. Forward it to\n   * your `fetch` call — i.e. `fetch(url, { method, headers, body, keepalive })` — so exit-time\n   * batches are not dropped when the page is tearing down.\n   */\n  keepalive: boolean;\n}\n\n/**\n * The fully-formed request the SDK hands to a custom `handleFetchConfig` transport when\n * fetching remote configuration.\n */\nexport interface FetchConfigRequest {\n  /** The resolved config URL (respects `configServerUrl`) including query params. */\n  url: string;\n  method: 'GET';\n  /** SDK-supplied default headers. */\n  headers: Record<string, string>;\n  /** Abort signal the SDK uses to enforce the remote-config fetch timeout. Honor it in your fetch. */\n  signal?: AbortSignal;\n}\n\n/**\n * Custom transport for replay event uploads. Invoked by the SDK in place of its internal\n * `fetch`. Must return a `Response` (or Response-like with `ok`, `status`, `text()`). Called\n * once per logical request attempt — retry is handled by the SDK around the callback, so do\n * not implement your own retry. Thrown errors / rejected promises are surfaced to the SDK's\n * existing retry logic.\n */\nexport type SessionReplaySendEventsHandler = (request: SendEventsRequest) => Promise<Response>;\n\n/**\n * Custom transport for remote-config fetches. Same contract as {@link SessionReplaySendEventsHandler}.\n */\nexport type SessionReplayFetchConfigHandler = (request: FetchConfigRequest) => Promise<Response>;\n\nexport interface CrossOriginIframesConfig {\n  enabled: boolean;\n  /**\n   * When true (default), the parent SDK sends start/stop signals to child iframes via\n   * postMessage, keeping their recording lifecycle in sync with the parent.\n   *\n   * **Privacy note:** The child page's rrweb instance performs its own DOM serialization,\n   * so the parent's privacy config (mask levels, block selectors) does NOT automatically\n   * apply inside the iframe. Privacy settings must be configured independently on the child page.\n   *\n   * **Third-party iframes:** Cannot capture iframes you don't control (e.g. Stripe, Google\n   * Maps) — both parent and child pages must load the SDK with `crossOriginIframes.enabled: true`.\n   *\n   * Set to `false` to skip coordination and manage the child recording lifecycle yourself.\n   * @defaultValue true\n   */\n  coordinateChildren?: boolean;\n}\n\nexport interface SessionReplayLocalConfig extends IConfig {\n  apiKey: string;\n  loggerProvider: ILogger;\n  /**\n   * LogLevel.None or LogLevel.Error or LogLevel.Warn or LogLevel.Verbose or LogLevel.Debug.\n   * Sets the log level.\n   *\n   * @defaultValue LogLevel.Warn\n   */\n  logLevel: LogLevel;\n  /**\n   * The maximum number of retries allowed for sending replay events.\n   * Once this limit is reached, failed events will no longer be sent.\n   *\n   * @defaultValue 2\n   */\n  flushMaxRetries: number;\n  /**\n   * Use this option to control how many sessions to select for replay collection.\n   * The number should be a decimal between 0 and 1, for example 0.4, representing\n   * the fraction of sessions to have randomly selected for replay collection.\n   * Over a large number of sessions, 0.4 would select 40% of those sessions.\n   * Sample rates as small as six decimal places (0.000001) are supported.\n   *\n   * @defaultValue 0\n   */\n  sampleRate: number;\n  privacyConfig?: PrivacyConfig;\n  /**\n   * Adds additional debug event property to help debug instrumentation issues\n   * (such as mismatching apps). Only recommended for debugging initial setup,\n   * and not recommended for production.\n   */\n  debugMode?: boolean;\n  /**\n   * Specifies the endpoint URL to fetch remote configuration.\n   * If provided, it overrides the default server zone configuration.\n   */\n  configServerUrl?: string;\n  /**\n   * Specifies the endpoint URL for sending session replay data.\n   * If provided, it overrides the default server zone configuration.\n   */\n  trackServerUrl?: string;\n  /**\n   * If stylesheets are inlined, the contents of the stylesheet will be stored.\n   * During replay, the stored stylesheet will be used instead of attempting to fetch it remotely.\n   * This prevents replays from appearing broken due to missing stylesheets.\n   * Note: Inlining stylesheets may not work in all cases.\n   */\n  shouldInlineStylesheet?: boolean;\n  /**\n   * When true, image sources are inlined as data URLs in the rrweb snapshot so replays do not\n   * depend on fetching remote image assets at playback time. Increases snapshot payload size.\n   * Passed through to rrweb's `inlineImages` record option; when unset, rrweb defaults to false.\n   */\n  inlineImages?: boolean;\n  version?: SessionReplayVersion;\n  /**\n   * Performance configuration config. If enabled, we will defer compression\n   * to be done during the browser's idle periods.\n   */\n  performanceConfig?: SessionReplayPerformanceConfig;\n  /**\n   * Specifies how replay events should be stored. `idb` uses IndexedDB to persist replay events\n   * when all events cannot be sent during capture. `memory` stores replay events only in memory,\n   * meaning events are lost when the page is closed. If IndexedDB is unavailable, the system falls back to `memory`.\n   *\n   * @defaultValue 'memory' — reflects the validated amp-on-amp perf config (SR-4646). `memory`\n   * drops cross-navigation persistence (unsent events do not survive a full page reload), which\n   * is the intended trade-off for lower IDB overhead.\n   */\n  storeType: StoreType;\n\n  /**\n   * If true, the SDK will compress replay events using a web worker.\n   * This offloads compression to a separate thread, improving performance on the main thread.\n   * Set to `false` to keep compression on the main thread.\n   *\n   * @defaultValue true — reflects the validated amp-on-amp perf config (SR-4646). Was `false`\n   * prior to that change.\n   */\n  useWebWorker?: boolean;\n\n  /**\n   * Controls transport-layer gzip compression of session replay request bodies.\n   * When true (default), the SDK gzip-compresses the JSON request body via the browser's\n   * `CompressionStream` API and sets `Content-Encoding: gzip` on the POST. When false,\n   * the SDK sends the raw JSON body with no `Content-Encoding` header.\n   *\n   * Disabling is intended as a debugging / safety opt-out (e.g. for diagnosing\n   * server-side decompression issues); it increases egress bytes and is not\n   * recommended for production.\n   *\n   * Note: This is independent of `useWebWorker` / `performanceConfig`, which control\n   * per-event rrweb compression that runs before events are queued.\n   *\n   * @defaultValue true\n   */\n  enableTransportCompression?: boolean;\n\n  /**\n   * Milliseconds to wait for a send request before aborting it. `fetch()` has no native\n   * timeout, so a request stuck \"pending\" would block the serial flush loop indefinitely;\n   * the SDK aborts after this many ms and routes the abort as a retryable failure.\n   *\n   * Set to `0` (or a negative value) to disable the timeout entirely — note this\n   * reintroduces the head-of-line-blocking risk a wedged request can cause, so it is\n   * intended only as a diagnostic/experiment opt-out.\n   *\n   * Tuning this higher is useful when large, slow-but-succeeding uploads are being aborted\n   * at the default and counted as failures (which also triggers a retry, inflating request\n   * volume / throttle pressure).\n   *\n   * @defaultValue 10000\n   */\n  sendTimeoutMs?: number;\n\n  userProperties?: { [key: string]: any };\n\n  /**\n   * If true, applies a background color to blocked elements in the replay.\n   * This helps visualize which elements are blocked from being captured.\n   */\n  applyBackgroundColorToBlockedElements?: boolean;\n  /**\n   * Enables URL change polling as a fallback for SPA route tracking.\n   * When enabled, the SDK will periodically check for URL changes every second\n   * in addition to patching the History API. This is useful for edge cases where\n   * route changes might bypass the standard History API methods.\n   *\n   * @defaultValue false\n   */\n  enableUrlChangePolling?: boolean;\n  /**\n   * Specifies the interval in milliseconds for URL change polling when enableUrlChangePolling is true.\n   * The SDK will check for URL changes at this interval as a fallback for SPA route tracking.\n   *\n   * @defaultValue 1000\n   */\n  urlChangePollingInterval?: number;\n  /**\n   * Whether to capture document title in URL change events.\n   * When disabled, the title field will be empty in URL change events.\n   *\n   * @defaultValue false\n   */\n  captureDocumentTitle?: boolean;\n  interactionConfig?: InteractionConfig;\n  /**\n   * When true (default), the CSS rules of any `adoptedStyleSheets` on shadow roots and\n   * the document are serialized **inline** within the full snapshot. This makes the snapshot\n   * self-contained so that shadow DOM styles are replayed correctly even if subsequent\n   * incremental `AdoptedStyleSheet` events are dropped in transit.\n   *\n   * Set to `false` to revert to the legacy behavior where adopted stylesheet rules are\n   * emitted as separate incremental events (which may be lost if delivery is unreliable).\n   * Only consider opting out if snapshot payload size is a critical concern.\n   *\n   * @defaultValue true\n   */\n  captureAdoptedStyleSheets?: boolean;\n  /**\n   * Enables recording of cross-origin iframes. Both the parent page and each child iframe\n   * page must load the Amplitude Session Replay SDK with this option enabled.\n   *\n   * When enabled, rrweb uses `postMessage` to relay child DOM events to the parent, which\n   * merges them into a single unified event stream.\n   */\n  crossOriginIframes?: CrossOriginIframesConfig;\n  /** Interval in ms at which the SDK takes a full DOM snapshot. Disabled by default — periodic snapshots are expensive. Recommended value: 300000 (5 min). */\n  fullSnapshotIntervalMs?: number;\n  /**\n   * Controls how often the SDK splits buffered rrweb events into a sequence and dispatches\n   * the resulting batch to the server. The interval starts at `minIntervalMs` and grows by\n   * `minIntervalMs` after each split, capped at `maxIntervalMs`. Lowering values increases\n   * replay availability latency improvements at the cost of more requests; raising them\n   * reduces request volume (and 200+`X-Session-Replay-Event-Skipped` throttling responses)\n   * at the cost of slightly delayed replay availability.\n   *\n   * Defaults to `{ minIntervalMs: 1000, maxIntervalMs: 10_000 }`, reflecting the validated\n   * amp-on-amp perf config (SR-4646); the `minIntervalMs` default was `500` prior to that\n   * change. Tune up if the server is back-pressuring the SDK on session start.\n   */\n  flushIntervalConfig?: FlushIntervalConfig;\n  /**\n   * When true, every rrweb full snapshot is flushed to the server immediately so replays\n   * become playable as early as possible. When false (default), full-snapshot sends are\n   * deferred to the normal interval/size flush cadence instead. The snapshot is still\n   * compressed and buffered immediately either way (ordering and page-exit beacon coverage\n   * are preserved); only the eager network send is suppressed. The default-off behavior\n   * reduces request volume for pages that produce many full snapshots (e.g. focus-driven or\n   * `fullSnapshotIntervalMs` checkouts), especially when many SDK instances run on the same\n   * page.\n   *\n   * @defaultValue false — reflects the validated amp-on-amp perf config (SR-4646). Was `true`\n   * prior to that change.\n   */\n  eagerFullSnapshotSend?: boolean;\n  /**\n   * When true, the window `focus` listener forces a fresh rrweb full snapshot\n   * (`takeFullSnapshot`) every time the page regains focus, so the replay reflects any DOM\n   * changes that happened while the tab was backgrounded. When false (default), the on-focus\n   * full snapshot is skipped entirely (recording simply continues from the existing stream).\n   *\n   * On pages with heavy focus churn (e.g. embedded iframes, inline editors that repeatedly\n   * steal and return focus) this fires constantly, and when combined with\n   * `eagerFullSnapshotSend` each focus produces an immediate network send — the primary\n   * driver of focus-driven request storms. The default-off behavior removes the snapshot (and\n   * therefore the send) at the cost of slightly staler post-focus frames.\n   *\n   * @defaultValue false — reflects the validated amp-on-amp perf config (SR-4646). Was `true`\n   * prior to that change.\n   */\n  captureFullSnapshotOnFocus?: boolean;\n  /**\n   * Raw (uncompressed) UTF-8 byte cap for a single buffered events list before the store\n   * splits it into its own request. Larger values produce fewer, larger requests (the primary\n   * steady-state lever for request volume); smaller values split sooner. Payloads are gzipped\n   * on the wire, so several hundred KB of replay JSON compresses to well under 100 KB.\n   *\n   * Advanced/debug knob — the default already balances request volume against the server's\n   * decompressed-size split threshold. Clamped to a safe range; values outside it are clamped\n   * and logged. Defaults to the SDK's internal `DEFAULT_MAX_PERSISTED_EVENTS_SIZE_BYTES`.\n   *\n   * @defaultValue 6000000 — reflects the validated amp-on-amp perf config (SR-4646). Was\n   * `MAX_EVENT_LIST_SIZE` (2000000) prior to that change.\n   */\n  maxPersistedEventsSizeBytes?: number;\n  /**\n   * Raw (uncompressed) UTF-8 byte cap for a single rrweb event. Events larger than this are\n   * dropped (with a warning) both at capture time and as a pre-send backstop, because the SR\n   * ingest service rejects a single event above ~10 MB. Lower this to exercise drop behavior\n   * for large full snapshots while debugging.\n   *\n   * Advanced/debug knob. Clamped to a safe range; values outside it are clamped and logged.\n   * Defaults to the SDK's internal `MAX_SINGLE_EVENT_SIZE`.\n   *\n   * @defaultValue 9000000\n   */\n  maxSingleEventSizeBytes?: number;\n  /**\n   * Optional custom transport for replay event uploads. When provided, the SDK invokes this\n   * callback in place of its internal `fetch` for every event-upload attempt, passing a\n   * fully-formed {@link SendEventsRequest} (resolved URL, headers, serialized body). The SDK\n   * still owns batching, retry, serialization and error handling. Use it to attach custom\n   * auth (e.g. a JWT `Authorization` header) and route through an authenticated proxy.\n   *\n   * Works alongside `trackServerUrl`: the URL passed to the callback already respects it.\n   */\n  handleSendEvents?: SessionReplaySendEventsHandler;\n  /**\n   * Optional custom transport for the remote-config fetch. Same contract as `handleSendEvents`\n   * but for the config GET. The URL passed to the callback already respects `configServerUrl`.\n   */\n  handleFetchConfig?: SessionReplayFetchConfigHandler;\n}\n\nexport interface FlushIntervalConfig {\n  /**\n   * Lower bound on the rrweb event-split interval in milliseconds. Also the increment\n   * added to the interval after each split. Must be > 0; values are clamped to a 100ms floor.\n   *\n   * @defaultValue 1000 — reflects the validated amp-on-amp perf config (SR-4646). Was `500`\n   * prior to that change.\n   */\n  minIntervalMs?: number;\n  /**\n   * Upper bound on the rrweb event-split interval in milliseconds. Must be >= `minIntervalMs`.\n   *\n   * @defaultValue 10000\n   */\n  maxIntervalMs?: number;\n}\n\nexport interface SessionReplayJoinedConfig extends SessionReplayLocalConfig {\n  captureEnabled?: boolean;\n  interactionConfig?: InteractionConfig;\n  loggingConfig?: LoggingConfig;\n  targetingConfig?: TargetingConfig;\n  minSessionDurationMs?: number;\n}\n\nexport interface SessionReplayConfigs {\n  localConfig: SessionReplayLocalConfig;\n  joinedConfig: SessionReplayJoinedConfig;\n  remoteConfig: SessionReplayRemoteConfig | undefined;\n}\nexport interface SessionReplayJoinedConfigGenerator {\n  generateJoinedConfig: () => Promise<SessionReplayConfigs>;\n}\n\nexport interface SessionReplayMetadata {\n  remoteConfig: SessionReplayRemoteConfig | undefined;\n  localConfig: SessionReplayLocalConfig;\n  joinedConfig: SessionReplayJoinedConfig;\n  framework?: {\n    name: string;\n    version: string;\n  };\n  sessionId: string | number | undefined;\n  hashValue?: number;\n  sampleRate: number;\n  replaySDKType: string | null;\n  replaySDKVersion: string | undefined;\n  standaloneSDKType: string;\n  standaloneSDKVersion: string | undefined;\n}\n\nexport interface SessionReplayVersion {\n  version: string;\n  type: SessionReplayType;\n}\n\n/**\n * Configuration options for session replay performance.\n */\nexport interface SessionReplayPerformanceConfig {\n  /**\n   * If enabled, event compression will be deferred to occur during the browser's idle periods.\n   */\n  enabled: boolean;\n  /**\n   * Optional timeout in milliseconds for the `requestIdleCallback` API.\n   * If specified, this value will be used to set a maximum time for the browser to wait\n   * before executing the deferred compression task, even if the browser is not idle.\n   */\n  timeout?: number;\n  /**\n   * If enabled, consecutive mutation events will be merged into a single event before\n   * compression, reducing stored event count without changing replay semantics.\n   * Defaults to true, reflecting the validated amp-on-amp perf config (SR-4646); set to\n   * false to disable merging.\n   */\n  mergeMutations?: boolean;\n  /**\n   * Performance configuration for interaction tracking (clicks, scrolls).\n   */\n  interaction?: InteractionPerformanceConfig;\n}\n\n/**\n * Performance configuration for interaction tracking, specifically for CSS selector generation.\n */\nexport interface InteractionPerformanceConfig {\n  /**\n   * Maximum time in milliseconds allowed for CSS selector generation.\n   * If selector generation takes longer than this, it will throw a timeout error.\n   * Default: undefined (no timeout limit)\n   */\n  timeoutMs?: number;\n  /**\n   * Maximum number of attempts to optimize/simplify the CSS selector path.\n   * Higher values may produce shorter selectors but take longer to compute.\n   * Default: 10000\n   */\n  maxNumberOfTries?: number;\n  /**\n   * Maximum number of CSS selector combinations to test for uniqueness.\n   * If more combinations would be generated, falls back to a simpler strategy.\n   * Default: 1000\n   */\n  threshold?: number;\n}\n\nexport type SessionReplayType = 'standalone' | 'plugin' | 'segment';\n"]}

package/lib/cjs/helpers.d.ts

@@ -1,21 +1,6 @@
-import { MaskLevel, PrivacyConfig, SessionReplayJoinedConfig, UGCFilterRule } from './config/types';
+import { SessionReplayJoinedConfig, UGCFilterRule } from './config/types';
 import { StorageData } from './typings/session-replay';
 export { getServerUrl } from './utils/server-url';
-/**
- * Returns the effective mask level for a given URL by checking `urlMaskLevels`
- * (first match wins) and falling back to `defaultMaskLevel`.
- */
-export declare const getEffectiveMaskLevel: (url: string | undefined, config: PrivacyConfig) => MaskLevel;
-/**
- * Checks if the given element set to be masked by rrweb
- *
- * Priority is:
- *  1. [In code] Element/class based masking/unmasking <> [Config based] Selector based masking/unmasking
- *  2. Use app defaults
- */
-export declare const isMasked: (elementType: 'input' | 'text', config: PrivacyConfig | undefined, element: HTMLElement | null, currentUrl?: string) => boolean;
-export declare const maskFn: (elementType: 'text' | 'input', config?: PrivacyConfig, getCurrentUrl?: () => string) => (text: string, element: HTMLElement | null) => string;
-export declare const maskAttributeFn: (config?: PrivacyConfig, getCurrentUrl?: () => string) => (key: string, value: string, element: HTMLElement) => string;
 export declare const getCurrentUrl: () => string;
 export declare const generateSessionReplayId: (sessionId: string | number, deviceId: string) => string;
 export declare const validateUGCFilterRules: (ugcFilterRules: UGCFilterRule[]) => void;

package/lib/cjs/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../src/helpers.ts"],"names":[],"mappings":"AACA,OAAO,EAAsB,SAAS,EAAE,aAAa,EAAE,yBAAyB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAExH,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AA6ClD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAAS,MAAM,GAAG,SAAS,UAAU,aAAa,KAAG,SAStF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,gBACN,OAAO,GAAG,MAAM,8CAEpB,WAAW,GAAG,IAAI,eACd,MAAM,KAClB,OA2BF,CAAC;AAEF,eAAO,MAAM,MAAM,gBACH,MAAM,GAAG,OAAO,WAAW,aAAa,kBAAkB,MAAM,MAAM,YAC7E,MAAM,WAAW,WAAW,GAAG,IAAI,KAAG,MAE5C,CAAC;AAEJ,eAAO,MAAM,eAAe,YAAa,aAAa,kBAAkB,MAAM,MAAM,WACrE,MAAM,SAAS,MAAM,WAAW,WAAW,KAAG,MAc5D,CAAC;AAEF,eAAO,MAAM,aAAa,cAGzB,CAAC;AAEF,eAAO,MAAM,uBAAuB,cAAe,MAAM,GAAG,MAAM,YAAY,MAAM,KAAG,MAEtF,CAAC;AAuDF,eAAO,MAAM,sBAAsB,mBAAoB,aAAa,EAAE,SAUrE,CAAC;AAEF,eAAO,MAAM,UAAU,YAAa,MAAM,kBAAkB,aAAa,EAAE,WAW1E,CAAC;AAEF,eAAO,MAAM,cAAc,QAAa,QAAQ,WAAW,CAa1D,CAAC;AAEF,eAAO,MAAM,cAAc,WAAY,yBAAyB,KAAG,yBAOlE,CAAC"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../src/helpers.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE1E,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAQlD,eAAO,MAAM,aAAa,cAGzB,CAAC;AAEF,eAAO,MAAM,uBAAuB,cAAe,MAAM,GAAG,MAAM,YAAY,MAAM,KAAG,MAEtF,CAAC;AASF,eAAO,MAAM,sBAAsB,mBAAoB,aAAa,EAAE,SAUrE,CAAC;AAEF,eAAO,MAAM,UAAU,YAAa,MAAM,kBAAkB,aAAa,EAAE,WAW1E,CAAC;AAEF,eAAO,MAAM,cAAc,QAAa,QAAQ,WAAW,CAa1D,CAAC;AAEF,eAAO,MAAM,cAAc,WAAY,yBAAyB,KAAG,yBAOlE,CAAC"}

package/lib/cjs/helpers.js

@@ -1,130 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getDebugConfig = exports.getStorageSize = exports.getPageUrl = exports.validateUGCFilterRules = exports.generateSessionReplayId = exports.getCurrentUrl = exports.maskAttributeFn = exports.maskFn = exports.isMasked = exports.getEffectiveMaskLevel = exports.getServerUrl = void 0;
+exports.getDebugConfig = exports.getStorageSize = exports.getPageUrl = exports.validateUGCFilterRules = exports.generateSessionReplayId = exports.getCurrentUrl = exports.getServerUrl = void 0;
 var tslib_1 = require("tslib");
 var analytics_core_1 = require("@amplitude/analytics-core");
-var types_1 = require("./config/types");
 var constants_1 = require("./constants");
-var get_input_type_1 = require("./utils/get-input-type");
+var session_replay_dom_privacy_1 = require("@amplitude/session-replay-dom-privacy");
 var server_url_1 = require("./utils/server-url");
 Object.defineProperty(exports, "getServerUrl", { enumerable: true, get: function () { return server_url_1.getServerUrl; } });
-/**
- * Light: Subset of inputs (sensitive types only — password, hidden, email, tel, cc-*)
- * Medium: All inputs (form fields), text is NOT masked
- * Conservative: All inputs and all texts
- */
-var isMaskedForLevel = function (elementType, level, element) {
-    switch (level) {
-        case 'light': {
-            if (elementType !== 'input') {
-                return false;
-            }
-            var inputType = element ? (0, get_input_type_1.getInputType)(element) : '';
-            /* istanbul ignore if */ // TODO(lew): For some reason it's impossible to test this.
-            if (!inputType) {
-                return false;
-            }
-            if (['password', 'hidden', 'email', 'tel'].includes(inputType)) {
-                return true;
-            }
-            if (element.autocomplete.startsWith('cc-')) {
-                return true;
-            }
-            return false;
-        }
-        case 'medium':
-            return elementType === 'input';
-        case 'conservative':
-            return true;
-        default:
-            return isMaskedForLevel(elementType, types_1.DEFAULT_MASK_LEVEL, element);
-    }
-};
-/**
- * Returns the effective mask level for a given URL by checking `urlMaskLevels`
- * (first match wins) and falling back to `defaultMaskLevel`.
- */
-var getEffectiveMaskLevel = function (url, config) {
-    var e_1, _a;
-    var _b;
-    if (url && config.urlMaskLevels) {
-        try {
-            for (var _c = tslib_1.__values(config.urlMaskLevels), _d = _c.next(); !_d.done; _d = _c.next()) {
-                var rule = _d.value;
-                if (globToRegex(rule.match).test(url)) {
-                    return rule.maskLevel;
-                }
-            }
-        }
-        catch (e_1_1) { e_1 = { error: e_1_1 }; }
-        finally {
-            try {
-                if (_d && !_d.done && (_a = _c.return)) _a.call(_c);
-            }
-            finally { if (e_1) throw e_1.error; }
-        }
-    }
-    return (_b = config.defaultMaskLevel) !== null && _b !== void 0 ? _b : types_1.DEFAULT_MASK_LEVEL;
-};
-exports.getEffectiveMaskLevel = getEffectiveMaskLevel;
-/**
- * Checks if the given element set to be masked by rrweb
- *
- * Priority is:
- *  1. [In code] Element/class based masking/unmasking <> [Config based] Selector based masking/unmasking
- *  2. Use app defaults
- */
-var isMasked = function (elementType, config, element, currentUrl) {
-    var _a, _b;
-    if (config === void 0) { config = { defaultMaskLevel: types_1.DEFAULT_MASK_LEVEL }; }
-    if (element) {
-        // Element or parent is explicitly instrumented in code to mask
-        if (element.closest('.' + constants_1.MASK_TEXT_CLASS)) {
-            return true;
-        }
-        // Config has override for mask
-        var shouldMask = ((_a = config.maskSelector) !== null && _a !== void 0 ? _a : []).some(function (selector) { return element.closest(selector); });
-        if (shouldMask) {
-            return true;
-        }
-        // Code or config has override to unmask
-        if (element.closest('.' + constants_1.UNMASK_TEXT_CLASS)) {
-            return false;
-        }
-        // Here we are probably sent an element, but we want to match if they have a
-        // parent with an unmask selector.
-        var shouldUnmask = ((_b = config.unmaskSelector) !== null && _b !== void 0 ? _b : []).some(function (selector) { return element.closest(selector); });
-        if (shouldUnmask) {
-            return false;
-        }
-    }
-    return isMaskedForLevel(elementType, (0, exports.getEffectiveMaskLevel)(currentUrl, config), element);
-};
-exports.isMasked = isMasked;
-var maskFn = function (elementType, config, getCurrentUrl) {
-    return function (text, element) {
-        return (0, exports.isMasked)(elementType, config, element, getCurrentUrl === null || getCurrentUrl === void 0 ? void 0 : getCurrentUrl()) ? text.replace(/[^\s]/g, '*') : text;
-    };
-};
-exports.maskFn = maskFn;
-var maskAttributeFn = function (config, getCurrentUrl) {
-    return function (key, value, element) {
-        var _a;
-        // Never mask style — rrweb has a separate styleDiff path for attribute mutations
-        // that reads directly from the DOM, bypassing maskAttributeFn.
-        if (key === 'style')
-            return value;
-        // Short-circuit: only proceed if this attribute is in the allowlist.
-        if (!((_a = config === null || config === void 0 ? void 0 : config.maskAttributes) !== null && _a !== void 0 ? _a : []).includes(key))
-            return value;
-        // Use 'input' for form elements so that `medium` (which masks inputs but not text)
-        // still masks attributes on inputs/selects/textareas. For non-form elements, use
-        // 'text' so medium leaves them visible.
-        var elementType = ['INPUT', 'SELECT', 'TEXTAREA'].includes(element.tagName) ? 'input' : 'text';
-        return (0, exports.isMasked)(elementType, config, element, getCurrentUrl === null || getCurrentUrl === void 0 ? void 0 : getCurrentUrl()) ? value.replace(/[^\s]/g, '*') : value;
-    };
-};
-exports.maskAttributeFn = maskAttributeFn;
 var getCurrentUrl = function () {
     var globalScope = (0, analytics_core_1.getGlobalScope)();
     return (globalScope === null || globalScope === void 0 ? void 0 : globalScope.location) ? globalScope.location.href : '';
@@ -142,46 +24,6 @@ var isValidGlobUrl = function (globUrl) {
         return false;
     return true;
 };
-var globRegexCache = new Map();
-var globToRegex = function (glob) {
-    var cached = globRegexCache.get(glob);
-    if (cached)
-        return cached;
-    // Glob → regex conversion. Glob substitution must happen BEFORE regex escaping so that
-    // the escaper does not corrupt the glob characters (e.g. turning `/**` into `/\*\*`).
-    // Placeholder tokens use null bytes, which are illegal in HTTP URLs and therefore can
-    // never collide with real pattern content.
-    //
-    // Substitution order (most-specific first):
-    //   trailing /**   → (/.*)?          — path with or without a trailing slash/subpath
-    //   middle  /**/   → /(.*\/)?        — zero-or-more path segments (including zero)
-    //   bare    **     → .*              — graceful fallback for ** not adjacent to /
-    //   single  *      → .*              — any characters (preserves existing behaviour)
-    //   ?              → .               — single character wildcard
-    var T_TRAILING = '\x00TRAIL\x00';
-    var T_MIDDLE = '\x00MID\x00';
-    var T_DSTAR = '\x00DS\x00';
-    var T_STAR = '\x00ST\x00';
-    var T_QUEST = '\x00QU\x00';
-    var s = glob;
-    s = s.replace(/\/\*\*$/, T_TRAILING); // trailing /**
-    s = s.replace(/\/\*\*\//g, T_MIDDLE); // /**/ in the middle
-    s = s.replace(/\*\*/g, T_DSTAR); // bare ** (e.g. **.example.com)
-    s = s.replace(/\*/g, T_STAR); // single *
-    s = s.replace(/\?/g, T_QUEST); // ?
-    // Escape all remaining regex special characters.
-    s = s.replace(/[.+^${}()|[\]\\]/g, '\\$&');
-    // Expand tokens into their regex equivalents.
-    // Use split/join (not regex) to avoid the no-control-regex lint rule on the token strings.
-    s = s.split(T_TRAILING).join('(/.*)?'); // /** → optional /anything
-    s = s.split(T_MIDDLE).join('/(.*\\/)?'); // /**/ → /zero-or-more-segments/
-    s = s.split(T_DSTAR).join('.*'); // bare ** → .*
-    s = s.split(T_STAR).join('.*'); // * → .*
-    s = s.split(T_QUEST).join('.'); // ? → .
-    var regex = new RegExp("^".concat(s, "$"));
-    globRegexCache.set(glob, regex);
-    return regex;
-};
 var validateUGCFilterRules = function (ugcFilterRules) {
     // validate ugcFilterRules
     if (!ugcFilterRules.every(function (rule) { return typeof rule.selector === 'string' && typeof rule.replacement === 'string'; })) {
@@ -194,29 +36,29 @@ var validateUGCFilterRules = function (ugcFilterRules) {
 };
 exports.validateUGCFilterRules = validateUGCFilterRules;
 var getPageUrl = function (pageUrl, ugcFilterRules) {
-    var e_2, _a;
+    var e_1, _a;
     try {
         // apply ugcFilterRules, order is important, first rule wins
         for (var ugcFilterRules_1 = tslib_1.__values(ugcFilterRules), ugcFilterRules_1_1 = ugcFilterRules_1.next(); !ugcFilterRules_1_1.done; ugcFilterRules_1_1 = ugcFilterRules_1.next()) {
             var rule = ugcFilterRules_1_1.value;
-            var regex = globToRegex(rule.selector);
+            var regex = (0, session_replay_dom_privacy_1.globToRegex)(rule.selector);
             if (regex.test(pageUrl)) {
                 return pageUrl.replace(regex, rule.replacement);
             }
         }
     }
-    catch (e_2_1) { e_2 = { error: e_2_1 }; }
+    catch (e_1_1) { e_1 = { error: e_1_1 }; }
     finally {
         try {
             if (ugcFilterRules_1_1 && !ugcFilterRules_1_1.done && (_a = ugcFilterRules_1.return)) _a.call(ugcFilterRules_1);
         }
-        finally { if (e_2) throw e_2.error; }
+        finally { if (e_1) throw e_1.error; }
     }
     return pageUrl;
 };
 exports.getPageUrl = getPageUrl;
 var getStorageSize = function () { return tslib_1.__awaiter(void 0, void 0, void 0, function () {
-    var globalScope, _a, usage, quota, usageDetails, totalStorageSize, percentOfQuota, e_3;
+    var globalScope, _a, usage, quota, usageDetails, totalStorageSize, percentOfQuota, e_2;
     return tslib_1.__generator(this, function (_b) {
         switch (_b.label) {
             case 0:
@@ -231,7 +73,7 @@ var getStorageSize = function () { return tslib_1.__awaiter(void 0, void 0, void
                 return [2 /*return*/, { totalStorageSize: totalStorageSize, percentOfQuota: percentOfQuota, usageDetails: JSON.stringify(usageDetails) }];
             case 2: return [3 /*break*/, 4];
             case 3:
-                e_3 = _b.sent();
+                e_2 = _b.sent();
                 return [3 /*break*/, 4];
             case 4: return [2 /*return*/, { totalStorageSize: 0, percentOfQuota: 0, usageDetails: '' }];
         }