@formo/analytics 1.30.1 → 1.32.0

package/dist/esm/src/event/constants.d.ts

@@ -6,6 +6,18 @@ declare const VERSION = "0";
  * in src/types/events.ts derived from this array.
  */
 declare const CLICK_ID_PARAMS: readonly ["gclid", "gad_source", "fbclid", "msclkid", "twclid", "li_fat_id", "rdt_cid", "ttclid"];
+/**
+ * Query parameters that are ALWAYS stripped from forwarded and stored URLs,
+ * regardless of consumer configuration, because they carry high-sensitivity
+ * secrets that must never reach Formo:
+ * - privy_oauth_code:     Privy OAuth authorization code
+ * - privy_oauth_state:    Privy OAuth CSRF state token
+ * - privy_oauth_provider: Privy OAuth provider identifier
+ *
+ * Consumers can extend the denylist via `tracking.excludeQueryParams` but
+ * cannot remove these built-ins. Matched case-insensitively.
+ */
+declare const DEFAULT_EXCLUDED_QUERY_PARAMS: readonly ["privy_oauth_code", "privy_oauth_state", "privy_oauth_provider"];
 /**
  * Fields that should be excluded from page event properties parsing
  * These are either:
@@ -13,5 +25,5 @@ declare const CLICK_ID_PARAMS: readonly ["gclid", "gad_source", "fbclid", "msclk
  * - Semantic event properties that should not be overridden by URL params
  */
 declare const PAGE_PROPERTIES_EXCLUDED_FIELDS: Set<string>;
-export { CHANNEL, VERSION, CLICK_ID_PARAMS, PAGE_PROPERTIES_EXCLUDED_FIELDS };
+export { CHANNEL, VERSION, CLICK_ID_PARAMS, DEFAULT_EXCLUDED_QUERY_PARAMS, PAGE_PROPERTIES_EXCLUDED_FIELDS, };
 //# sourceMappingURL=constants.d.ts.map

package/dist/esm/src/event/constants.js

@@ -24,6 +24,22 @@ var CLICK_ID_PARAMS = [
     "rdt_cid", // Reddit Ads
     "ttclid", // TikTok Ads
 ];
+/**
+ * Query parameters that are ALWAYS stripped from forwarded and stored URLs,
+ * regardless of consumer configuration, because they carry high-sensitivity
+ * secrets that must never reach Formo:
+ * - privy_oauth_code:     Privy OAuth authorization code
+ * - privy_oauth_state:    Privy OAuth CSRF state token
+ * - privy_oauth_provider: Privy OAuth provider identifier
+ *
+ * Consumers can extend the denylist via `tracking.excludeQueryParams` but
+ * cannot remove these built-ins. Matched case-insensitively.
+ */
+var DEFAULT_EXCLUDED_QUERY_PARAMS = [
+    "privy_oauth_code",
+    "privy_oauth_state",
+    "privy_oauth_provider",
+];
 /**
  * Fields that should be excluded from page event properties parsing
  * These are either:
@@ -50,5 +66,5 @@ var PAGE_PROPERTIES_EXCLUDED_FIELDS = new Set(__spreadArray(__spreadArray([
     'hash',
     'query',
 ], false));
-export { CHANNEL, VERSION, CLICK_ID_PARAMS, PAGE_PROPERTIES_EXCLUDED_FIELDS };
+export { CHANNEL, VERSION, CLICK_ID_PARAMS, DEFAULT_EXCLUDED_QUERY_PARAMS, PAGE_PROPERTIES_EXCLUDED_FIELDS, };
 //# sourceMappingURL=constants.js.map

package/dist/esm/src/types/base.d.ts

@@ -72,6 +72,20 @@ export interface TrackingOptions {
     excludeHosts?: string[];
     excludePaths?: string[];
     excludeChains?: ChainID[];
+    /**
+     * Additional query parameter names to strip from forwarded and stored URLs,
+     * on top of a built-in always-on denylist (currently `privy_oauth_code`,
+     * `privy_oauth_state`, and `privy_oauth_provider`) that cannot be disabled.
+     * Matched case-insensitively. Excluded params are stripped from the captured
+     * page URL, query string, per-parameter page properties, and referrer before
+     * any event is sent. The URL hash/fragment is intentionally left untouched.
+     *
+     * Mirrors Mixpanel's `property_blacklist` and PostHog's `property_denylist`,
+     * scoped here to URL query parameters.
+     *
+     * @example ["token", "access_token", "email", "signature"]
+     */
+    excludeQueryParams?: string[];
 }
 /**
  * Configuration options for controlling wallet event autocapture