@hanzo/event 0.3.12 → 0.3.14

package/dist/index.mjs

@@ -195,7 +195,47 @@ function redactPAN(s2) {
 var RE_EMAIL = /[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9.-]{1,255}\.[A-Za-z]{2,24}/g;
 var RE_IPV4 = /\b(?:\d{1,3}\.){3}\d{1,3}\b/g;
 var RE_IPV6 = /\b(?:[0-9A-Fa-f]{1,4}:){2,7}[0-9A-Fa-f]{1,4}\b/g;
+var CREDENTIAL_PARAMS = [
+  "code",
+  "state",
+  "token",
+  "access_token",
+  "id_token",
+  "refresh_token",
+  "auth",
+  "authorization",
+  "secret",
+  "client_secret",
+  "password",
+  "passwd",
+  "pwd",
+  "api_key",
+  "apikey",
+  "key",
+  "session",
+  "session_id",
+  "sid",
+  "sig",
+  "signature",
+  "nonce",
+  "otp",
+  "invite",
+  "invitation",
+  "reset_token",
+  "confirmation_token",
+  "magic",
+  "ticket",
+  "assertion"
+];
+var RE_CREDENTIAL_PARAM = new RegExp(
+  "([?&#;](?:" + CREDENTIAL_PARAMS.join("|") + ")=)[^&#;\\s]{1,4096}",
+  "gi"
+);
+function redactCredentialParams(s2) {
+  return s2.replace(RE_CREDENTIAL_PARAM, (_m, prefix) => prefix + REDACTED);
+}
 function redactSecrets(s2) {
+  s2 = redactCredentialParams(s2);
   for (const re of SECRET_PATTERNS) s2 = s2.replace(re, REDACTED);
   return redactPAN(s2);
 }
@@ -244,7 +284,7 @@ function uuidv7Time(id) {
 }
 
 // src/version.ts
-var VERSION = "0.3.12";
+var VERSION = "0.3.14";
 
 // src/sentry.ts
 var MAX_FRAMES = 50;
@@ -445,6 +485,8 @@ var KEY = {
   cohort: "hz_cohort"
 };
 var SESSION_TTL_MS = 30 * 60 * 1e3;
+var ANON_DOMAIN = "hanzo.ai";
+var ANON_MAX_AGE_S = 2 * 365 * 24 * 60 * 60;
 function ls() {
   try {
     if (typeof window === "undefined" || !window.localStorage) return void 0;
@@ -453,15 +495,69 @@ function ls() {
     return void 0;
   }
 }
+function jar() {
+  try {
+    if (typeof document === "undefined" || typeof document.cookie !== "string") return void 0;
+    return document;
+  } catch {
+    return void 0;
+  }
+}
+function getCookie(name) {
+  const d = jar();
+  if (!d) return void 0;
+  for (const part of d.cookie.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq < 0 || part.slice(0, eq).trim() !== name) continue;
+    const v = part.slice(eq + 1).trim();
+    if (!v) continue;
+    try {
+      return decodeURIComponent(v);
+    } catch {
+      return v;
+    }
+  }
+  return void 0;
+}
+function setCookie(name, value) {
+  const d = jar();
+  if (!d) return;
+  let host = "";
+  let secure = false;
+  try {
+    if (typeof window !== "undefined" && window.location) {
+      host = window.location.hostname || "";
+      secure = window.location.protocol === "https:";
+    }
+  } catch {
+  }
+  const attrs = [
+    // encodeURIComponent leaves a UUID byte-identical while making any value that
+    // is not one unable to forge a `;` and inject an attribute.
+    `${name}=${encodeURIComponent(value)}`,
+    "Path=/",
+    `Max-Age=${ANON_MAX_AGE_S}`,
+    "SameSite=Lax"
+  ];
+  if (host === ANON_DOMAIN || host.endsWith(`.${ANON_DOMAIN}`)) attrs.push(`Domain=${ANON_DOMAIN}`);
+  if (secure) attrs.push("Secure");
+  try {
+    d.cookie = attrs.join("; ");
+  } catch {
+  }
+}
+var memAnon;
 function anonId() {
+  if (typeof window === "undefined") return void 0;
   const s2 = ls();
-  if (!s2) return void 0;
-  let v = s2.getItem(KEY.anon);
-  if (!v) {
-    v = uuidv7();
-    s2.setItem(KEY.anon, v);
+  const id = getCookie(KEY.anon) || s2?.getItem(KEY.anon) || memAnon || uuidv7();
+  memAnon = id;
+  setCookie(KEY.anon, id);
+  try {
+    if (s2 && s2.getItem(KEY.anon) !== id) s2.setItem(KEY.anon, id);
+  } catch {
   }
-  return v;
+  return id;
 }
 function sessionId(now = Date.now()) {
   const s2 = ls();