@cross-deck/web 1.2.0 → 1.3.1

package/dist/error-codes.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "generatedAt": "2026-05-22T10:34:42.191Z",
+  "generatedAt": "2026-05-24T15:50:15.563Z",
   "sdk": "@cross-deck/web",
   "codes": [
     {

package/dist/index.cjs

@@ -97,9 +97,11 @@ function typeMapForStatus(status) {
   return "internal_error";
 }
 
-// src/http.ts
+// src/_version.ts
+var SDK_VERSION = "1.3.0";
 var SDK_NAME = "@cross-deck/web";
-var SDK_VERSION = "1.1.0";
+
+// src/http.ts
 var DEFAULT_BASE_URL = "https://api.cross-deck.com/v1";
 var DEFAULT_TIMEOUT_MS = 15e3;
 var HttpClient = class {
@@ -530,8 +532,10 @@ function computeNextDelay(attempts, retryAfterMs, options = {}, random = Math.ra
   const safeAttempts = Math.min(attempts, 30);
   const ceiling = Math.min(max, base * Math.pow(factor, safeAttempts));
   const jittered = ceiling * random();
-  if (retryAfterMs !== void 0 && retryAfterMs > jittered) {
-    return Math.min(max, retryAfterMs);
+  if (retryAfterMs !== void 0) {
+    const ABSOLUTE_MAX_MS = 24 * 60 * 60 * 1e3;
+    const honoured = Math.min(ABSOLUTE_MAX_MS, retryAfterMs);
+    if (honoured > jittered) return honoured;
   }
   return Math.max(0, Math.round(jittered));
 }
@@ -566,6 +570,27 @@ var EventQueue = class {
   constructor(cfg) {
     this.cfg = cfg;
     this.buffer = [];
+    /**
+     * In-flight events that have been spliced from `buffer` for the
+     * current batch but haven't yet been confirmed (success or permanent
+     * failure). On a retry-driven re-flush we re-use this slot alongside
+     * `pendingBatchId` so the Stripe-style Idempotency-Key is preserved
+     * across retries of the SAME logical batch.
+     *
+     * Pre-fix the splice cleared the buffer AND we immediately
+     * `persistent.save(empty)` BEFORE awaiting the network call — a
+     * crash mid-flight wiped the persisted blob and the batch was lost
+     * with no replay on next boot. Now the persisted blob always carries
+     * `[...pendingBatch, ...buffer]` so the in-flight events survive
+     * until the server confirms them.
+     *
+     * Pre-fix every retry attempt also minted a NEW batchId via
+     * `splice + mintBatchId`, defeating the backend's
+     * `Idempotency-Key` dedup. Reuse via this slot brings web in
+     * lockstep with node (which already had the field).
+     */
+    this.pendingBatch = null;
+    this.pendingBatchId = null;
     this.dropped = 0;
     this.inFlight = 0;
     this.lastFlushAt = 0;
@@ -598,7 +623,7 @@ var EventQueue = class {
       this.cfg.onDrop?.(overflow);
     }
     this.cfg.onBufferChange?.(this.buffer.length);
-    this.persistent?.save(this.buffer);
+    this.persistAll();
     if (this.buffer.length >= this.cfg.batchSize) {
       void this.flush();
     } else {
@@ -607,22 +632,44 @@ var EventQueue = class {
   }
   /**
    * Flush the buffer to /v1/events. Resolves when the network call
-   * completes (success or failure). On failure, events stay in the
-   * buffer for the next scheduled retry.
+   * completes (success or failure). On a retryable failure the batch
+   * stays in `pendingBatch` for the next scheduled retry — the SAME
+   * batch with the SAME `Idempotency-Key` is re-sent (Stripe pattern).
+   *
+   * Three terminal states from one call:
+   *   - 2xx success: pendingBatch cleared, persisted state collapses to
+   *     just `buffer` (any new events that arrived during in-flight).
+   *   - 4xx permanent (except 408/429): pendingBatch DROPPED, `dropped`
+   *     counter increments, a `permanent_failure` signal fires. The
+   *     server is telling us our request is malformed / our key is
+   *     revoked / we lack permission — retrying with the same key
+   *     forever just grows the queue while the customer thinks events
+   *     are landing.
+   *   - 5xx / network / 408 / 429: pendingBatch + batchId stay; backoff
+   *     schedules a retry; the next `flush()` re-uses both.
    *
    * `options.keepalive` marks the underlying fetch as keepalive so the
-   * browser keeps the request alive past page unload. Use this for
-   * terminal flushes (pagehide / visibilitychange→hidden / beforeunload).
+   * browser keeps the request alive past page unload. Use for terminal
+   * flushes (pagehide / visibilitychange→hidden / beforeunload).
    */
   async flush(options = {}) {
-    if (this.buffer.length === 0) return null;
+    let batch;
+    let batchId;
+    if (this.pendingBatch !== null && this.pendingBatchId !== null) {
+      batch = this.pendingBatch;
+      batchId = this.pendingBatchId;
+    } else {
+      if (this.buffer.length === 0) return null;
+      batch = this.buffer.splice(0);
+      batchId = this.mintBatchId();
+      this.pendingBatch = batch;
+      this.pendingBatchId = batchId;
+      this.inFlight += batch.length;
+      this.cfg.onBufferChange?.(this.buffer.length);
+      this.persistAll();
+    }
     this.cancelTimerIfSet();
     this.nextRetryAt = null;
-    const batch = this.buffer.splice(0);
-    const batchId = this.mintBatchId();
-    this.inFlight += batch.length;
-    this.persistent?.save(this.buffer);
-    this.cfg.onBufferChange?.(this.buffer.length);
     try {
       const env = this.cfg.envelope();
       const result = await this.cfg.http.request("POST", "/events", {
@@ -641,20 +688,33 @@ var EventQueue = class {
       this.lastFlushAt = Date.now();
       this.lastError = null;
       this.inFlight -= batch.length;
+      this.pendingBatch = null;
+      this.pendingBatchId = null;
       this.retry.recordSuccess();
-      this.persistent?.save(this.buffer);
+      this.persistAll();
       if (!this.firstFlushFired) {
         this.firstFlushFired = true;
         this.cfg.onFirstFlushSuccess?.();
       }
       return result;
     } catch (err) {
-      this.buffer.unshift(...batch);
-      this.inFlight -= batch.length;
       const message = err instanceof Error ? err.message : String(err);
       this.lastError = message;
-      this.persistent?.save(this.buffer);
-      this.cfg.onBufferChange?.(this.buffer.length);
+      if (isPermanent4xx(err)) {
+        const droppedCount = batch.length;
+        this.pendingBatch = null;
+        this.pendingBatchId = null;
+        this.inFlight -= droppedCount;
+        this.dropped += droppedCount;
+        this.persistAll();
+        this.cfg.onDrop?.(droppedCount);
+        this.cfg.onPermanentFailure?.({
+          status: err.status ?? 0,
+          droppedCount,
+          lastError: message
+        });
+        return null;
+      }
       const retryAfterMs = extractRetryAfterMs(err);
       const delay = this.retry.nextDelay(retryAfterMs);
       this.scheduleRetry(delay);
@@ -672,6 +732,8 @@ var EventQueue = class {
     this.cancelTimerIfSet();
     this.nextRetryAt = null;
     this.buffer = [];
+    this.pendingBatch = null;
+    this.pendingBatchId = null;
     this.dropped = 0;
     this.inFlight = 0;
     this.lastError = null;
@@ -681,6 +743,10 @@ var EventQueue = class {
   }
   getStats() {
     return {
+      // `buffered` counts events waiting for their FIRST flush. The
+      // in-flight pendingBatch (retrying) is tracked separately via
+      // `inFlight` — surfacing both lets diagnostics show "we have
+      // events stuck retrying" distinct from "new events arriving".
       buffered: this.buffer.length,
       dropped: this.dropped,
       inFlight: this.inFlight,
@@ -690,6 +756,29 @@ var EventQueue = class {
       nextRetryAt: this.nextRetryAt
     };
   }
+  /**
+   * The Idempotency-Key of the in-flight pending batch (if any).
+   * Exposed for testing the Stripe-style retry-reuse contract.
+   * Production callers don't need this.
+   */
+  get pendingIdempotencyKey() {
+    return this.pendingBatchId;
+  }
+  /**
+   * Persist `[...pendingBatch, ...buffer]` — the full set of
+   * not-yet-confirmed events. The next boot rehydrates this exact set
+   * into `buffer` and replays. The server dedups via eventId
+   * (ReplacingMergeTree on the warehouse side), so re-sending an event
+   * that may have already landed is safe.
+   */
+  persistAll() {
+    if (!this.persistent) return;
+    if (this.pendingBatch === null) {
+      this.persistent.save(this.buffer);
+      return;
+    }
+    this.persistent.save([...this.pendingBatch, ...this.buffer]);
+  }
   // ---------- internal scheduling ----------
   scheduleIdleFlush() {
     this.cancelTimerIfSet();
@@ -723,6 +812,14 @@ function extractRetryAfterMs(err) {
   }
   return void 0;
 }
+function isPermanent4xx(err) {
+  if (!err || typeof err !== "object") return false;
+  const status = err.status;
+  if (typeof status !== "number" || !Number.isFinite(status)) return false;
+  if (status < 400 || status >= 500) return false;
+  if (status === 408 || status === 429) return false;
+  return true;
+}
 function defaultScheduler(fn, ms) {
   const id = setTimeout(fn, ms);
   if (typeof id.unref === "function") {
@@ -1064,6 +1161,7 @@ var AutoTracker = class {
   /** Exposed for tests + consumers that want to reset the session manually. */
   resetSession() {
     if (this.session && !this.session.endedSent) this.emitSessionEnd();
+    this.pageviewId = null;
     this.session = this.startNewSession();
     this.emitSessionStart();
   }
@@ -1100,6 +1198,7 @@ var AutoTracker = class {
         const hiddenFor = this.session.hiddenAt ? Date.now() - this.session.hiddenAt : 0;
         if (hiddenFor >= SESSION_RESUME_THRESHOLD_MS) {
           this.emitSessionEnd();
+          this.pageviewId = null;
           this.session = this.startNewSession();
           this.emitSessionStart();
         } else {
@@ -1473,7 +1572,7 @@ function validateEventProperties(input, options = {}) {
   const maxStringLength = options.maxStringLength ?? DEFAULT_MAX_STRING;
   const maxBatchPropertyBytes = options.maxBatchPropertyBytes ?? DEFAULT_MAX_BYTES;
   const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;
-  const seen = /* @__PURE__ */ new WeakSet();
+  const seen = /* @__PURE__ */ new Set();
   const visit = (value, key, depth) => {
     if (depth > maxDepth) {
       warnings.push({ kind: "depth_exceeded", key });
@@ -1561,6 +1660,7 @@ function validateEventProperties(input, options = {}) {
         const result = visit(value[i], `${key}[${i}]`, depth + 1);
         if (result.keep) out.push(result.value);
       }
+      seen.delete(value);
       return { keep: true, value: out };
     }
     if (t === "object") {
@@ -1575,6 +1675,7 @@ function validateEventProperties(input, options = {}) {
         const result = visit(obj[k], `${key}.${k}`, depth + 1);
         if (result.keep) out[k] = result.value;
       }
+      seen.delete(obj);
       return { keep: true, value: out };
     }
     warnings.push({ kind: "non_serialisable", key });
@@ -1917,35 +2018,27 @@ var ConsentManager = class {
 };
 var EMAIL_PATTERN = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
 var CARD_PATTERN = /\b\d(?:[ -]?\d){12,18}\b/g;
-var REPLACEMENT_EMAIL = "[email]";
-var REPLACEMENT_CARD = "[card]";
+var REPLACEMENT_EMAIL = "<email>";
+var REPLACEMENT_CARD = "<card>";
 function scrubPii(value) {
   if (!value) return value;
-  let out = value;
-  if (EMAIL_PATTERN.test(out)) {
-    out = out.replace(EMAIL_PATTERN, REPLACEMENT_EMAIL);
-  }
-  EMAIL_PATTERN.lastIndex = 0;
-  if (CARD_PATTERN.test(out)) {
-    out = out.replace(CARD_PATTERN, REPLACEMENT_CARD);
-  }
-  CARD_PATTERN.lastIndex = 0;
-  return out;
+  return value.replace(EMAIL_PATTERN, REPLACEMENT_EMAIL).replace(CARD_PATTERN, REPLACEMENT_CARD);
 }
 function scrubPiiFromProperties(properties) {
   const out = {};
   for (const k of Object.keys(properties)) {
-    const v = properties[k];
-    if (typeof v === "string") {
-      out[k] = scrubPii(v);
-    } else if (Array.isArray(v)) {
-      out[k] = v.map((item) => typeof item === "string" ? scrubPii(item) : item);
-    } else {
-      out[k] = v;
-    }
+    out[k] = scrubValue(properties[k]);
   }
   return out;
 }
+function scrubValue(v) {
+  if (typeof v === "string") return scrubPii(v);
+  if (Array.isArray(v)) return v.map(scrubValue);
+  if (v && typeof v === "object" && v.constructor === Object) {
+    return scrubPiiFromProperties(v);
+  }
+  return v;
+}
 
 // src/breadcrumbs.ts
 var BreadcrumbBuffer = class {
@@ -2235,16 +2328,18 @@ var ErrorTracker = class {
       const url = typeof input === "string" ? input : input?.url ?? "";
       const method = (init.method || "GET").toUpperCase();
       const start = Date.now();
-      this.opts.breadcrumbs.add({
-        timestamp: start,
-        category: "http",
-        message: `${method} ${url}`,
-        data: { url, method }
-      });
+      if (!isSelfRequest(url, this.opts.selfHostname)) {
+        this.opts.breadcrumbs.add({
+          timestamp: start,
+          category: "http",
+          message: `${method} ${url}`,
+          data: { url, method }
+        });
+      }
       try {
         const response = await origFetch(...args);
         if (response.status >= 500 && this.opts.isConsented()) {
-          if (!url.includes("api.cross-deck.com")) {
+          if (!isSelfRequest(url, this.opts.selfHostname)) {
             this.captureHttp({
               url,
               method,
@@ -2293,7 +2388,7 @@ var ErrorTracker = class {
         try {
           if (xhr.status >= 500 && tracker.opts.isConsented()) {
             const url = xhr._cdUrl ?? "";
-            if (!url.includes("api.cross-deck.com")) {
+            if (!isSelfRequest(url, tracker.opts.selfHostname)) {
               tracker.captureHttp({
                 url,
                 method: (xhr._cdMethod ?? "GET").toUpperCase(),
@@ -2453,9 +2548,10 @@ var ErrorTracker = class {
     if (!this.passesSample(err)) return;
     if (!this.passesRateLimit(err)) return;
     let finalErr = err;
-    if (this.opts.beforeSend) {
+    const hook = this.opts.beforeSend?.();
+    if (hook) {
       try {
-        finalErr = this.opts.beforeSend(err);
+        finalErr = hook(err);
       } catch {
         finalErr = err;
       }
@@ -2637,6 +2733,22 @@ function safeClone(v) {
 function safeStringify2(v) {
   return coerceErrorPayload(v).message;
 }
+function extractSelfHostname(baseUrl) {
+  if (!baseUrl || typeof baseUrl !== "string") return null;
+  try {
+    return new URL(baseUrl).hostname.toLowerCase();
+  } catch {
+    return null;
+  }
+}
+function isSelfRequest(requestUrl, selfHostname) {
+  if (!selfHostname || !requestUrl) return false;
+  try {
+    return new URL(requestUrl).hostname.toLowerCase() === selfHostname;
+  } catch {
+    return false;
+  }
+}
 
 // src/crossdeck.ts
 var CrossdeckClient = class {
@@ -2653,6 +2765,24 @@ var CrossdeckClient = class {
    * mismatched env fails fast at boot rather than at first event-flush.
    */
   init(options) {
+    if (this.state) {
+      try {
+        this.state.uninstallUnloadFlush?.();
+      } catch {
+      }
+      try {
+        this.state.autoTracker?.uninstall();
+      } catch {
+      }
+      try {
+        this.state.webVitals?.uninstall();
+      } catch {
+      }
+      try {
+        this.state.errors?.uninstall();
+      } catch {
+      }
+    }
     if (!options.publicKey || !options.publicKey.startsWith("cd_pub_")) {
       throw new CrossdeckError({
         type: "configuration_error",
@@ -2760,6 +2890,15 @@ var CrossdeckClient = class {
           `Event flush failed (${info.lastError}). Retrying in ${info.delayMs}ms (attempt ${info.consecutiveFailures}).`,
           { ...info }
         );
+      },
+      onPermanentFailure: (info) => {
+        const headline = `[crossdeck] Event batch DROPPED (status ${info.status}): ${info.lastError}. ${info.droppedCount} event(s) lost \u2014 check your publishable key + app config.`;
+        console.error(headline);
+        debug.emit(
+          "sdk.flush_permanent_failure",
+          headline,
+          { ...info }
+        );
       }
     });
     const deviceInfo = autoTrack.deviceInfo ? collectDeviceInfo({ appVersion: opts.appVersion ?? void 0 }) : opts.appVersion ? { appVersion: opts.appVersion } : {};
@@ -2826,8 +2965,20 @@ var CrossdeckClient = class {
         report: (err) => this.reportError(err),
         getContext: () => ({ ...this.state.errorContext }),
         getTags: () => ({ ...this.state.errorTags }),
-        beforeSend: this.state.errorBeforeSend,
-        isConsented: () => this.state.consent.errors
+        // GETTER, not a captured value — `setErrorBeforeSend()` mutates
+        // `state.errorBeforeSend` after init() and the tracker MUST
+        // pick up the new hook on the next error. The pre-fix shape
+        // (`beforeSend: this.state!.errorBeforeSend`) snapshotted
+        // `null` at construction and made the customer's PII scrubber
+        // silently inert. See error-capture.ts:ErrorTrackerOptions.beforeSend.
+        beforeSend: () => this.state.errorBeforeSend,
+        isConsented: () => this.state.consent.errors,
+        // Derived from the configured baseUrl at init() time. Used by
+        // the fetch / XHR wrappers to skip captureHttp on Crossdeck's
+        // own requests — pre-fix the skip was hardcoded to
+        // `api.cross-deck.com` and broke for customers on staging /
+        // regional / self-hosted base URLs (recursive capture loop).
+        selfHostname: extractSelfHostname(opts.baseUrl)
       });
       this.state.errors = tracker;
       tracker.install();
@@ -2910,7 +3061,8 @@ var CrossdeckClient = class {
       body
     });
     const priorCdcust = s.identity.crossdeckCustomerId;
-    if (priorCdcust && result.crossdeckCustomerId && priorCdcust !== result.crossdeckCustomerId) {
+    const cacheHasEntries = s.entitlements.list().length > 0;
+    if (priorCdcust && result.crossdeckCustomerId && priorCdcust !== result.crossdeckCustomerId || !priorCdcust && cacheHasEntries) {
       s.entitlements.clear();
     }
     s.identity.setCrossdeckCustomerId(result.crossdeckCustomerId);
@@ -3352,8 +3504,9 @@ var CrossdeckClient = class {
         message: "syncPurchases requires a signedTransactionInfo string from StoreKit 2."
       });
     }
+    const rail = input.rail ?? "apple";
     const result = await s.http.request("POST", "/purchases/sync", {
-      body: { rail: input.rail ?? "apple", ...input }
+      body: { ...input, rail }
     });
     s.identity.setCrossdeckCustomerId(result.crossdeckCustomerId);
     s.entitlements.setFromList(result.entitlements);
@@ -3419,6 +3572,8 @@ var CrossdeckClient = class {
     this.state.errorContext = {};
     this.state.errorTags = {};
     this.state.developerUserId = null;
+    this.state.lastServerTime = null;
+    this.state.lastClientTime = null;
     if (this.state.autoTracker) {
       const tracker = new AutoTracker(
         this.state.options.autoTrack,
@@ -3547,7 +3702,9 @@ function isLocalHostname() {
   const hostname = w?.location?.hostname;
   if (!hostname) return false;
   if (hostname === "localhost" || hostname === "127.0.0.1") return true;
+  if (hostname === "0.0.0.0") return true;
   if (hostname === "::1" || hostname === "[::1]") return true;
+  if (/^\[?fe80::/i.test(hostname)) return true;
   if (hostname.endsWith(".local")) return true;
   if (/^10\./.test(hostname)) return true;
   if (/^192\.168\./.test(hostname)) return true;