@formo/analytics 1.31.0 → 1.33.0

package/dist/esm/src/event/constants.js

@@ -24,6 +24,22 @@ var CLICK_ID_PARAMS = [
     "rdt_cid", // Reddit Ads
     "ttclid", // TikTok Ads
 ];
+/**
+ * Query parameters that are ALWAYS stripped from forwarded and stored URLs,
+ * regardless of consumer configuration, because they carry high-sensitivity
+ * secrets that must never reach Formo:
+ * - privy_oauth_code:     Privy OAuth authorization code
+ * - privy_oauth_state:    Privy OAuth CSRF state token
+ * - privy_oauth_provider: Privy OAuth provider identifier
+ *
+ * Consumers can extend the denylist via `tracking.excludeQueryParams` but
+ * cannot remove these built-ins. Matched case-insensitively.
+ */
+var DEFAULT_EXCLUDED_QUERY_PARAMS = [
+    "privy_oauth_code",
+    "privy_oauth_state",
+    "privy_oauth_provider",
+];
 /**
  * Fields that should be excluded from page event properties parsing
  * These are either:
@@ -50,5 +66,5 @@ var PAGE_PROPERTIES_EXCLUDED_FIELDS = new Set(__spreadArray(__spreadArray([
     'hash',
     'query',
 ], false));
-export { CHANNEL, VERSION, CLICK_ID_PARAMS, PAGE_PROPERTIES_EXCLUDED_FIELDS };
+export { CHANNEL, VERSION, CLICK_ID_PARAMS, DEFAULT_EXCLUDED_QUERY_PARAMS, PAGE_PROPERTIES_EXCLUDED_FIELDS, };
 //# sourceMappingURL=constants.js.map

package/dist/esm/src/types/base.d.ts

@@ -72,6 +72,34 @@ export interface TrackingOptions {
     excludeHosts?: string[];
     excludePaths?: string[];
     excludeChains?: ChainID[];
+    /**
+     * IANA timezone names to opt out of tracking entirely. When the visitor's
+     * resolved timezone (via `Intl.DateTimeFormat().resolvedOptions().timeZone`)
+     * matches one of these, no events are enqueued or sent — including `identify`
+     * and `connect`. Matched case-insensitively against the full timezone string.
+     *
+     * Note: this is client-side, timezone-derived geolocation. It is best-effort
+     * and can be bypassed (a VPN does not change the browser timezone, and users
+     * can change their OS timezone). For authoritative jurisdiction blocking, use
+     * server-side IP geolocation at your ingest endpoint instead.
+     *
+     * @example ["Europe/London", "America/New_York"]
+     */
+    excludeTimezones?: string[];
+    /**
+     * Additional query parameter names to strip from forwarded and stored URLs,
+     * on top of a built-in always-on denylist (currently `privy_oauth_code`,
+     * `privy_oauth_state`, and `privy_oauth_provider`) that cannot be disabled.
+     * Matched case-insensitively. Excluded params are stripped from the captured
+     * page URL, query string, per-parameter page properties, and referrer before
+     * any event is sent. The URL hash/fragment is intentionally left untouched.
+     *
+     * Mirrors Mixpanel's `property_blacklist` and PostHog's `property_denylist`,
+     * scoped here to URL query parameters.
+     *
+     * @example ["token", "access_token", "email", "signature"]
+     */
+    excludeQueryParams?: string[];
 }
 /**
  * Configuration options for controlling wallet event autocapture

package/dist/esm/src/utils/index.d.ts

@@ -3,4 +3,5 @@ export * from "./base";
 export * from "./converter";
 export * from "./generate";
 export * from "./hash";
+export * from "./timezone";
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/src/utils/index.js

@@ -3,4 +3,5 @@ export * from "./base";
 export * from "./converter";
 export * from "./generate";
 export * from "./hash";
+export * from "./timezone";
 //# sourceMappingURL=index.js.map

package/dist/esm/src/utils/timezone.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Resolve the current IANA timezone (e.g. "Europe/London") via the Intl API.
+ * Returns "" when the timezone cannot be resolved (e.g. Intl unavailable).
+ */
+declare const getTimezone: () => string;
+export { getTimezone };
+//# sourceMappingURL=timezone.d.ts.map

package/dist/esm/src/utils/timezone.js

@@ -0,0 +1,16 @@
+import { logger } from "../logger";
+/**
+ * Resolve the current IANA timezone (e.g. "Europe/London") via the Intl API.
+ * Returns "" when the timezone cannot be resolved (e.g. Intl unavailable).
+ */
+var getTimezone = function () {
+    try {
+        return Intl.DateTimeFormat().resolvedOptions().timeZone || "";
+    }
+    catch (error) {
+        logger.error("Error resolving timezone:", error);
+        return "";
+    }
+};
+export { getTimezone };
+//# sourceMappingURL=timezone.js.map