@jovid1242/appready 0.1.0

package/dist/index.cjs

@@ -0,0 +1,438 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  AppReady: () => AppReady,
+  SDK_VERSION: () => SDK_VERSION
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/scrub.ts
+var SENSITIVE_KEYS = [
+  "token",
+  "access_token",
+  "refresh_token",
+  "id_token",
+  "apikey",
+  "api_key",
+  "key",
+  "secret",
+  "password",
+  "passwd",
+  "pwd",
+  "auth",
+  "authorization",
+  "session",
+  "sid",
+  "signature",
+  "sig",
+  "credential",
+  "code"
+];
+var REDACTED = "[redacted]";
+var PATTERNS = [
+  // Email addresses. Common in "user X not found" messages.
+  [/\b[\w.+-]+@[\w-]+\.[\w.-]+\b/g, "[email]"],
+  // Bearer and similar header values that ended up in a message.
+  [/\b(bearer|basic|token)\s+[A-Za-z0-9._~+/-]{12,}=*/gi, "$1 [redacted]"],
+  // JWTs, which are three base64url segments and unmistakable.
+  [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, "[jwt]"],
+  // Known key shapes. Not exhaustive, and not meant to be — the generic
+  // high-entropy rule below is the net underneath.
+  [/\bsk_(live|test)_[A-Za-z0-9]{8,}\b/g, "[stripe-key]"],
+  [/\b(gh[pousr]|github_pat)_[A-Za-z0-9_]{20,}\b/g, "[github-token]"],
+  [/\bAKIA[0-9A-Z]{16}\b/g, "[aws-key]"],
+  [/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, "[slack-token]"],
+  // Card-shaped digit runs, spaced or not.
+  [/\b(?:\d[ -]*?){13,19}\b/g, "[redacted-number]"]
+];
+var ASSIGNED_SECRET = /\b([\w.-]{2,40})\s*[=:]\s*["']?([A-Za-z0-9_\-+/]{24,})["']?/g;
+function scrubText(input, maxLength = 2e3) {
+  if (!input) return "";
+  let out = String(input).slice(0, maxLength * 2);
+  for (const [pattern, replacement] of PATTERNS) {
+    out = out.replace(pattern, replacement);
+  }
+  out = out.replace(
+    ASSIGNED_SECRET,
+    (whole, name) => SENSITIVE_KEYS.some((key) => name.toLowerCase().includes(key)) ? `${name}=${REDACTED}` : whole
+  );
+  return out.replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/g, "").slice(0, maxLength);
+}
+function scrubUrl(raw) {
+  try {
+    const url = new URL(raw, "http://localhost");
+    url.username = "";
+    url.password = "";
+    url.hash = "";
+    for (const key of Array.from(url.searchParams.keys())) {
+      const lower = key.toLowerCase();
+      if (SENSITIVE_KEYS.some((sensitive) => lower === sensitive || lower.includes(sensitive))) {
+        url.searchParams.set(key, REDACTED);
+      }
+    }
+    return url.toString().slice(0, 500);
+  } catch {
+    return String(raw).split("?")[0].slice(0, 500);
+  }
+}
+function scrubStack(stack, maxFrames = 25) {
+  if (!stack) return "";
+  const lines = String(stack).split("\n").slice(0, maxFrames + 1);
+  return scrubText(lines.map((line) => scrubFrame(line)).join("\n"), 4e3);
+}
+var scrubFrame = (line) => line.replace(/https?:\/\/[^\s)]+/g, (url) => scrubUrl(url));
+
+// src/context.ts
+function collectContext() {
+  const nav = safeNavigator();
+  const agent = nav?.userAgent ?? "";
+  const { name, version } = parseBrowser(agent);
+  return {
+    url: scrubUrl(safeLocation()?.href ?? ""),
+    route: routeOf(safeLocation()?.pathname ?? "/"),
+    browser: name,
+    browserVersion: version,
+    os: parseOs(agent),
+    viewport: viewport()
+  };
+}
+function routeOf(pathname) {
+  if (!pathname) return "/";
+  const collapsed = pathname.split("/").map((segment) => {
+    if (!segment) return segment;
+    if (/^\d+$/.test(segment)) return ":id";
+    if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(segment)) {
+      return ":uuid";
+    }
+    if (/^[0-9A-HJKMNP-TV-Z]{26}$/i.test(segment)) return ":id";
+    if (segment.length > 24 && !/[.\-_]/.test(segment)) return ":id";
+    return segment;
+  }).join("/");
+  return collapsed.slice(0, 200) || "/";
+}
+var safeNavigator = () => typeof navigator === "undefined" ? void 0 : navigator;
+var safeLocation = () => typeof location === "undefined" ? void 0 : location;
+function viewport() {
+  if (typeof window === "undefined") return "";
+  const width = window.innerWidth || 0;
+  const height = window.innerHeight || 0;
+  return width && height ? `${width}x${height}` : "";
+}
+function parseBrowser(agent) {
+  const checks = [
+    ["Edge", /Edg(?:e|A|iOS)?\/([\d.]+)/],
+    ["Opera", /OPR\/([\d.]+)/],
+    ["Samsung Internet", /SamsungBrowser\/([\d.]+)/],
+    ["Firefox", /(?:Firefox|FxiOS)\/([\d.]+)/],
+    ["Chrome", /(?:Chrome|CriOS)\/([\d.]+)/],
+    ["Safari", /Version\/([\d.]+).*Safari/]
+  ];
+  for (const [name, pattern] of checks) {
+    const match = pattern.exec(agent);
+    if (match) return { name, version: (match[1] ?? "").split(".")[0] ?? "" };
+  }
+  return { name: "Unknown", version: "" };
+}
+function parseOs(agent) {
+  if (/iPhone|iPad|iPod/.test(agent)) return "iOS";
+  if (/Android/.test(agent)) return "Android";
+  if (/Mac OS X|Macintosh/.test(agent)) return "macOS";
+  if (/Windows/.test(agent)) return "Windows";
+  if (/CrOS/.test(agent)) return "ChromeOS";
+  if (/Linux/.test(agent)) return "Linux";
+  return "Unknown";
+}
+
+// src/transport.ts
+var Transport = class {
+  constructor(options) {
+    this.options = options;
+    this.queue = [];
+    this.timer = null;
+    this.dropped = 0;
+    /** Set after a 4xx that will not improve — stop talking rather than hammer. */
+    this.disabled = false;
+    this.installUnloadFlush();
+  }
+  /** Queues an event. Returns false when it was dropped. */
+  enqueue(event, immediate = false) {
+    if (this.disabled) return false;
+    if (this.queue.length >= this.options.maxBatchSize * 4) {
+      this.dropped += 1;
+      return false;
+    }
+    this.queue.push(event);
+    if (immediate || this.queue.length >= this.options.maxBatchSize) {
+      this.flush();
+      return true;
+    }
+    this.schedule();
+    return true;
+  }
+  schedule() {
+    if (this.timer !== null) return;
+    this.timer = setTimeout(() => {
+      this.timer = null;
+      this.flush();
+    }, this.options.flushIntervalMs);
+    this.timer.unref?.();
+  }
+  flush() {
+    if (this.timer !== null) {
+      clearTimeout(this.timer);
+      this.timer = null;
+    }
+    if (this.queue.length === 0 || this.disabled) return;
+    const batch = this.queue.splice(0, this.options.maxBatchSize);
+    const dropped = this.dropped;
+    this.dropped = 0;
+    void this.send({
+      projectKey: this.options.projectKey,
+      events: batch,
+      ...dropped > 0 ? { dropped } : {}
+    });
+  }
+  async send(body) {
+    try {
+      if (typeof fetch !== "function") return;
+      const controller = typeof AbortController === "function" ? new AbortController() : null;
+      const timer = controller ? setTimeout(() => controller.abort(), this.options.timeoutMs) : null;
+      const response = await fetch(this.options.endpoint, {
+        method: "POST",
+        // `text/plain` avoids a CORS preflight on every batch. The endpoint
+        // parses the body itself; it never trusts the content type.
+        headers: { "content-type": "text/plain;charset=UTF-8" },
+        body: JSON.stringify(body),
+        // Survives the page being closed mid-request, which is exactly when the
+        // interesting errors happen.
+        keepalive: true,
+        mode: "cors",
+        // No cookies, ever. The endpoint answers `Allow-Origin: *`, and sending
+        // credentials to a wildcard origin is both refused and wrong.
+        credentials: "omit",
+        ...controller ? { signal: controller.signal } : {}
+      });
+      if (timer) clearTimeout(timer);
+      if (response.status === 401 || response.status === 403 || response.status === 404) {
+        this.disabled = true;
+      }
+    } catch {
+    }
+  }
+  /**
+   * A last flush when the page goes away.
+   *
+   * `visibilitychange` rather than `unload`: mobile browsers frequently never
+   * fire `unload`, and `pagehide` is not reliable on iOS either.
+   */
+  installUnloadFlush() {
+    try {
+      if (typeof document === "undefined" || typeof addEventListener !== "function") return;
+      addEventListener(
+        "visibilitychange",
+        () => {
+          if (document.visibilityState === "hidden") this.flush();
+        },
+        { capture: true }
+      );
+      addEventListener("pagehide", () => this.flush(), { capture: true });
+    } catch {
+    }
+  }
+};
+
+// src/client.ts
+var SDK_VERSION = "0.1.0";
+var DEFAULT_ENDPOINT = "https://appready.tech/api/runtime/v1/events";
+var DEDUPE_WINDOW_MS = 5e3;
+var MAX_EVENTS_PER_MINUTE = 60;
+var AppReadyClient = class {
+  constructor() {
+    this.transport = null;
+    this.options = {
+      projectKey: "",
+      environment: "production",
+      enabled: true
+    };
+    this.started = false;
+    this.seen = /* @__PURE__ */ new Map();
+    this.minuteBucket = { startedAt: 0, count: 0 };
+  }
+  init(options) {
+    try {
+      if (this.started) return;
+      if (!options?.projectKey) return;
+      if (options.enabled === false) return;
+      if (typeof window === "undefined") return;
+      this.options = { environment: "production", enabled: true, ...options };
+      this.transport = new Transport({
+        endpoint: options.endpoint ?? DEFAULT_ENDPOINT,
+        projectKey: options.projectKey,
+        flushIntervalMs: 3e3,
+        maxBatchSize: 20,
+        timeoutMs: 8e3
+      });
+      this.installHandlers();
+      this.started = true;
+      this.capture("integration_check", "AppReadyIntegration", "SDK initialised", "", true);
+    } catch {
+    }
+  }
+  captureException(error) {
+    try {
+      const { name, message, stack } = describe(error);
+      this.capture("error", name, message, stack, true);
+    } catch {
+    }
+  }
+  captureMessage(message) {
+    try {
+      this.capture("message", "Message", String(message), "");
+    } catch {
+    }
+  }
+  /**
+   * Associates events with one of the customer's users.
+   *
+   * Optional, and takes an opaque id only. Anything that looks like an email is
+   * refused rather than scrubbed later — the SDK should not be the reason a
+   * customer's user list ends up on our servers.
+   */
+  setUser(user) {
+    try {
+      if (!user?.id) {
+        this.userId = void 0;
+        return;
+      }
+      const id = String(user.id).slice(0, 64);
+      this.userId = /@|\s/.test(id) ? void 0 : id;
+    } catch {
+    }
+  }
+  /** Sends anything queued. Useful right before a deliberate navigation. */
+  flush() {
+    try {
+      this.transport?.flush();
+    } catch {
+    }
+  }
+  capture(kind, errorType, message, stack, immediate = false) {
+    if (!this.started && kind !== "integration_check") return;
+    if (!this.transport) return;
+    const cleanMessage = scrubText(message, 500);
+    const cleanStack = scrubStack(stack);
+    const key = `${kind}|${errorType}|${cleanMessage}`;
+    const now = Date.now();
+    const previous = this.seen.get(key);
+    if (previous && now - previous.firstAt < DEDUPE_WINDOW_MS) {
+      previous.count += 1;
+      return;
+    }
+    const carriedCount = previous && previous.sent ? previous.count : 1;
+    this.seen.set(key, { firstAt: now, count: 1, sent: true });
+    this.pruneSeen(now);
+    if (!this.withinRateLimit(now)) return;
+    const context = collectContext();
+    const event = {
+      kind,
+      timestamp: new Date(now).toISOString(),
+      errorType: scrubText(errorType, 120) || "Error",
+      message: cleanMessage,
+      stack: cleanStack,
+      sdkVersion: SDK_VERSION,
+      environment: this.options.environment ?? "production",
+      ...this.options.release ? { release: String(this.options.release).slice(0, 80) } : {},
+      ...this.userId ? { userId: this.userId } : {},
+      ...carriedCount > 1 ? { count: carriedCount } : {},
+      ...context
+    };
+    const final = this.options.beforeSend ? safeBeforeSend(this.options.beforeSend, event) : event;
+    if (!final) return;
+    this.transport.enqueue(final, immediate);
+  }
+  /** A hard ceiling, independent of dedupe — different errors also loop. */
+  withinRateLimit(now) {
+    if (now - this.minuteBucket.startedAt > 6e4) {
+      this.minuteBucket = { startedAt: now, count: 0 };
+    }
+    if (this.minuteBucket.count >= MAX_EVENTS_PER_MINUTE) return false;
+    this.minuteBucket.count += 1;
+    return true;
+  }
+  /** The dedupe map is unbounded otherwise, and this runs in someone's tab. */
+  pruneSeen(now) {
+    if (this.seen.size < 200) return;
+    for (const [key, entry] of this.seen) {
+      if (now - entry.firstAt > DEDUPE_WINDOW_MS * 4) this.seen.delete(key);
+    }
+    if (this.seen.size >= 500) this.seen.clear();
+  }
+  installHandlers() {
+    try {
+      addEventListener(
+        "error",
+        (event) => {
+          if (!event.error && event.target && event.target !== window) return;
+          const { name, message, stack } = describe(event.error ?? event.message);
+          this.capture("error", name, message, stack, true);
+        },
+        // Capture phase, so an app's own handler cannot swallow it first.
+        true
+      );
+      addEventListener("unhandledrejection", (event) => {
+        const { name, message, stack } = describe(event.reason);
+        this.capture("unhandled_rejection", name, message, stack, true);
+      });
+    } catch {
+    }
+  }
+};
+function describe(value) {
+  if (value instanceof Error) {
+    return { name: value.name || "Error", message: value.message || "", stack: value.stack ?? "" };
+  }
+  if (typeof value === "string") return { name: "Error", message: value, stack: "" };
+  if (value && typeof value === "object") {
+    const record = value;
+    return {
+      name: typeof record.name === "string" ? record.name : "Error",
+      message: typeof record.message === "string" ? record.message : safeStringify(value),
+      stack: typeof record.stack === "string" ? record.stack : ""
+    };
+  }
+  return { name: "Error", message: String(value), stack: "" };
+}
+function safeStringify(value) {
+  try {
+    return JSON.stringify(value)?.slice(0, 500) ?? String(value);
+  } catch {
+    return "[unserializable]";
+  }
+}
+function safeBeforeSend(hook, event) {
+  try {
+    return hook(event);
+  } catch {
+    return event;
+  }
+}
+var AppReady = new AppReadyClient();

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { AppReady, SDK_VERSION } from './client';
+export type { AppReadyOptions, RuntimeEventPayload, RuntimeEventKind } from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACjD,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC"}