@pendo/agent 2.337.3 → 2.338.0

package/dist/pendo.module.js

@@ -430,6 +430,12 @@ function getPolicy(pendo) {
     return policy;
 }
 
+function escapeRegExp(string) {
+    if (!string)
+        return;
+    return string.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
 var STAGING_SERVER_HASHES = 'stagingServerHashes';
 var STAGING_DOMAINS = 'stagingDomains';
 var pendo$1;
@@ -515,7 +521,9 @@ function urlMatchesPatterns(url, patterns = [], hashes = []) {
                 }
             }
             if (typeof pattern === 'string') {
-                pattern = new RegExp('^' + pattern + '$');
+                // String entries are literal origins/hosts, not patterns. Escape
+                // them so a '.' can't act as a wildcard and match a look-alike domain.
+                pattern = new RegExp('^' + escapeRegExp(pattern) + '$');
             }
             if (pattern instanceof RegExp && pattern.test(url)) {
                 return true;
@@ -3916,7 +3924,13 @@ function isMobileUserAgent() {
     return (/Android|webOS|iPhone|iPod|BlackBerry|IEMobile|Opera Mini/i).test(getUA());
 }
 function isSafari(userAgent = getUA()) {
-    return userAgent.indexOf('Safari') >= 0 && !userAgent.indexOf('Chrome') >= 0;
+    return userAgent.indexOf('Safari') >= 0 && !isChromium(userAgent);
+}
+// Every Chromium UA carries a trailing Safari/ token, so Chrome, Edge, Opera,
+// Brave and Electron all have to be excluded from isSafari(). Chromium builds
+// report Chromium/ without a Chrome/ token, hence both checks.
+function isChromium(userAgent = getUA()) {
+    return userAgent.indexOf('Chrome') >= 0 || userAgent.indexOf('Chromium') >= 0;
 }
 const sniffer = {
     supportsHistoryApi: shouldWrapNativeHistory,
@@ -4029,8 +4043,8 @@ let SERVER = '';
 let ASSET_HOST = '';
 let ASSET_PATH = '';
 let DESIGNER_SERVER = '';
-let VERSION = '2.337.3_';
-let PACKAGE_VERSION = '2.337.3';
+let VERSION = '2.338.0_';
+let PACKAGE_VERSION = '2.338.0';
 let LOADER = 'xhr';
 /* eslint-enable web-sdk-eslint-rules/no-gulp-env-references */
 /**
@@ -4447,12 +4461,6 @@ class LogEmitter extends EventTarget {
 }
 const log = new LogEmitter();
 
-function escapeRegExp(string) {
-    if (!string)
-        return;
-    return string.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-
 const allowKeys = function () {
     var allowKeys = ConfigReader.get('storage.allowKeys') || '*';
     return _.isArray(allowKeys) ? _.indexBy(allowKeys) : allowKeys;
@@ -10079,6 +10087,26 @@ var writeMessage = function (msg) {
     });
     return q.resolve(writeImgTag(url)).catch(_.noop);
 };
+/**
+ * Releases a fetch response body we are never going to read. An undrained body
+ * holds its stream, the underlying data pipe and the socket open until the
+ * {Response} is collected, which may never happen in a long-lived embedded
+ * renderer. Cancelling does not affect keepalive delivery.
+ *
+ * @access private
+ * @param {Response} response to discard the body of
+ * @returns {Response} the same response, for chaining
+ */
+function cancelResponseBody(response) {
+    try {
+        if (response && response.body && _.isFunction(response.body.cancel)) {
+            response.body.cancel().catch(_.noop);
+        }
+    }
+    catch (e) {
+    }
+    return response;
+}
 /**
  * @access private
  * @param {string} msg to send
@@ -10107,7 +10135,9 @@ function writeErrorPOST(msg) {
         else {
             promise = ajax.postJSON(url, errorData);
         }
-        return promise.then(function () { log.info('successfully wrote error'); }, function (err) { log.info('error writing error:' + err); });
+        return promise.then(function (response) {
+            cancelResponseBody(response);
+        }, function (err) { log.debug('error writing error:' + err); });
     }
     catch (e) {
         log.info('Failed to write error to server using POST endpoint: ' + e);
@@ -10129,6 +10159,10 @@ function writeMetricsPOST(payload) {
                 keepalive: true,
                 body: JSON.stringify(payload),
                 headers: { 'Content-Type': 'application/json' }
+            })
+                .then(cancelResponseBody)
+                .catch(function (err) {
+                log.debug(`Failed to write metrics payload to server: ${err}`);
             });
         }
         else {
@@ -10156,13 +10190,23 @@ function writeImgTag(src) {
     image.src = src;
     return deferred.promise;
 }
+/**
+ * Sends a fire-and-forget beacon request. The response body is cancelled before
+ * the promise resolves, so callers get {Response.status}, {Response.ok} and the
+ * headers but cannot read the body. Use {fetch} directly if you need to read one.
+ *
+ * @access private
+ * @param {string} url to request
+ * @param {Object} options passed to {fetch}, defaulting to a keepalive GET
+ * @returns {Promise<Response>} with its body already cancelled
+ */
 function fetchKeepalive(url, options = {}) {
     const defaults = {
         method: 'GET',
         keepalive: true
     };
     const fetchOptions = _.extend({}, defaults, options);
-    return fetch(url, fetchOptions);
+    return fetch(url, fetchOptions).then(cancelResponseBody);
 }
 fetchKeepalive.supported = function () {
     try {
@@ -11788,6 +11832,13 @@ _.extend(dom, {
 });
 _.extend(dom.prototype, DomEvent.$, DomQuery.$);
 
+// Domains that Pendo owns, will be swapped in by build patches
+const pendoDomainPatterns = [
+        /^https:\/\/((adopt|oem)\.)?((us1)\.)?(app|via|adopt|cdn|oem|novus-api|novus)(\.(au|eu|gov|hsbc|jpn|tv))?\.pendo\.io$/,
+        /^https:\/\/([0-9]{8}t[0-9]{4}-dot-)(pendo-au|pendo-eu|pendo-govramp|pendo-hsbc|pendo-io|pendo-jp-prod|pendo-tv|pendo-us1)\.appspot\.com$/,
+        /^https:\/\/hotfix-(ops|app)-([0-9]+-dot-)(pendo-au|pendo-eu|pendo-govramp|pendo-hsbc|pendo-io|pendo-jp-prod|pendo-tv|pendo-us1)\.appspot\.com$/,
+        /^https:\/\/(pendo-au|pendo-eu|pendo-govramp|pendo-hsbc|pendo-io|pendo-jp-prod|pendo-tv|pendo-us1)-static\.storage\.googleapis\.com$/
+    ]; // eslint-disable-line web-sdk-eslint-rules/no-gulp-env-references
 function isTrustedOrigin(host) {
     if (!host)
         return false;
@@ -11801,13 +11852,6 @@ function isTrustedOrigin(host) {
         return true;
     if (host === getContentHost())
         return true;
-    // Domains that Pendo owns, will be swapped in by build patches
-    const patterns = [
-        /^https:\/\/((adopt|oem)\.)?((us1)\.)?(app|via|adopt|cdn|oem|novus-api|novus)(\.(au|eu|gov|hsbc|jpn|tv))?\.pendo\.io$/,
-        /^https:\/\/([0-9]{8}t[0-9]{4}-dot-)(pendo-au|pendo-eu|pendo-govramp|pendo-hsbc|pendo-io|pendo-jp-prod|pendo-tv|pendo-us1)\.appspot\.com$/,
-        /^https:\/\/hotfix-(ops|app)-([0-9]+-dot-)(pendo-au|pendo-eu|pendo-govramp|pendo-hsbc|pendo-io|pendo-jp-prod|pendo-tv|pendo-us1)\.appspot\.com$/,
-        /^https:\/\/(pendo-au|pendo-eu|pendo-govramp|pendo-hsbc|pendo-io|pendo-jp-prod|pendo-tv|pendo-us1)-static\.storage\.googleapis\.com$/
-    ]; // eslint-disable-line web-sdk-eslint-rules/no-gulp-env-references
     var adoptHost = ConfigReader.get('adoptHost');
     if (adoptHost) {
         var fullHostname = 'https://' + adoptHost;
@@ -11817,10 +11861,17 @@ function isTrustedOrigin(host) {
     }
     if (urlMatchesPatterns(host, ConfigReader.get('allowedOriginServers', []), ConfigReader.get('allowedOriginServerHashes', [])))
         return true;
-    return _.any(patterns, function (pattern) {
+    return _.any(pendoDomainPatterns, function (pattern) {
         return pattern.test(host);
     });
 }
+function isPendoDomain(origin) {
+    if (!origin)
+        return false;
+    return _.any(pendoDomainPatterns, function (pattern) {
+        return pattern.test(origin);
+    });
+}
 function hasAllowedOriginServers() {
     const allowedOriginServers = ConfigReader.get('allowedOriginServers', []);
     return allowedOriginServers && allowedOriginServers.length > 0;
@@ -13158,6 +13209,7 @@ function sendWithImg(apiKey, silo) {
     return writeImgTag(buildGetRequestUrl(apiKey, silo));
 }
 function handleFetchResponse(response) {
+    cancelResponseBody(response);
     if (response.status < 200 || response.status >= 300) {
         return q.reject(new Error(`received status code ${response.status}: ${response.statusText}`));
     }
@@ -26801,10 +26853,23 @@ var DesignerV2 = (function () {
         }
         return validTarget;
     }
+    function hasSameOriginOpener() {
+        if (!window.opener)
+            return false;
+        try {
+            return window.opener.location.origin === window.location.origin;
+        }
+        catch (e) {
+            return false;
+        }
+    }
     function launchOnToken(url) {
         if (isDesignerFrame(window.name)) {
             return;
         }
+        if (isPendoDomain(window.location.origin) && !hasSameOriginOpener()) {
+            return;
+        }
         var tokenParamTest = /pendo-designer=([A-Za-z0-9-]+)/;
         if (!tokenParamTest.test(url))
             return;
@@ -26817,7 +26882,7 @@ var DesignerV2 = (function () {
         // clear stored designer state if we're launching from a token
         window.localStorage.removeItem('pendo-navigation-state');
         window.localStorage.removeItem('pendo-designer-mode');
-        launchInAppDesigner({
+        DesignerV2.launchInAppDesigner({
             target: validTarget,
             host: validAssetHost,
             preloader: false,
@@ -29734,7 +29799,11 @@ var BuildingBlockGuides = (function () {
         // position and calculate its height before making it visible.
         // In the designer, changing visibility like this causes the guide to "flicker"
         // between re-renders
-        guideContainer.css({ visibility: 'hidden' });
+        // Only hide the first match. Resource center module previews nest the module's
+        // pendo-g- inside the home view's pendo-g- under the same id (via
+        // correctGuideContainerId), and imageNodeHandler only un-hides the first match,
+        // so hiding every match left the module content hidden forever.
+        dom(guideContainer[0]).css({ visibility: 'hidden' });
         guideToAppend.css({ visibility: 'hidden' });
         const embedConfig = _.get(guide, 'attributes.embedConfig', null);
         var watermark = BuildingBlockWatermark.buildWatermark({
@@ -50694,6 +50763,7 @@ const RECORDING_CONFIG_ON_RECORDING_STOP = 'recording.onRecordingStop';
 const RECORDING_CONFIG_WORKER_OVERRIDE = 'recording.workerOverride';
 const RECORDING_CONFIG_TREAT_IFRAME_AS_ROOT = 'recording.treatIframeAsRoot';
 const RECORDING_CONFIG_DISABLE_UNLOAD = 'recording.disableUnload';
+const RECORDING_CONFIG_RECORD_CROSS_ORIGIN_IFRAMES = 'recording.recordCrossOriginIframes';
 const RESOURCE_CACHING = 'resourceCaching';
 const ONE_DAY_IN_MILLISECONDS = 24 * 60 * 60 * 1000;
 const ONE_MINUTE_IN_MILLISECONDS = 60 * 1000;
@@ -50805,6 +50875,26 @@ class SessionRecorder {
          * @type {boolean}
          */
         cf.addOption(RECORDING_CONFIG_TREAT_IFRAME_AS_ROOT, [cf.sources.SNIPPET_SRC], undefined);
+        /**
+         * Controls whether content embedded from another domain is included in replay. When enabled, the
+         * embedded content shows up as part of the page. When disabled, it appears as a blank box.
+         *
+         * This only applies to embedded content that also has Pendo installed. Embeds from other companies
+         * (Stripe, YouTube) are never captured either way — turning this off just stops Pendo from
+         * messaging those frames at all.
+         *
+         * To capture embedded content as its own separate replay instead of part of the page it sits in,
+         * see recording.treatIframeAsRoot.
+         *
+         * @access public
+         * @category Config/Replay
+         * @name recording.recordCrossOriginIframes
+         * @default true
+         * @type {boolean}
+         */
+        // Like recording.enabled, this defaults to undefined so that it only overrides the
+        // value returned by the backend when it is explicitly set to true/false
+        cf.addOption(RECORDING_CONFIG_RECORD_CROSS_ORIGIN_IFRAMES, [cf.sources.SNIPPET_SRC], undefined);
         cf.addOption(RESOURCE_CACHING, [cf.sources.PENDO_CONFIG_SRC], undefined);
     }
     initialize(pendo, PluginAPI) {
@@ -51024,6 +51114,9 @@ class SessionRecorder {
         });
         const blockedSelectors = ['.pendo-ignore', '.pendo-sr-ignore'].concat(recordingOptions.blockedSelectors || []);
         const hiddenSelectors = ['.pendo-sr-hide'].concat(recordingOptions.hiddenSelectors || []);
+        // The snippet config value should take precedence over the value from the visitor config
+        const snippetValue = this.api.ConfigReader.get(RECORDING_CONFIG_RECORD_CROSS_ORIGIN_IFRAMES);
+        const recordCrossOriginIframes = this.pendo._.isBoolean(snippetValue) ? snippetValue : recordingOptions.recordCrossOriginIframes;
         const config = {
             maskInputFn: this.pendo._.partial(maskInput, maskOptions),
             maskTextFn: this.pendo._.partial(maskText, maskOptions),
@@ -51034,7 +51127,7 @@ class SessionRecorder {
             // we need to concat hidden selectors to re-use block selector logic
             blockSelector: blockedSelectors.concat(hiddenSelectors).join(','),
             hideSelector: hiddenSelectors.join(','),
-            recordCrossOriginIframes: recordingOptions.recordCrossOriginIframes != null ? recordingOptions.recordCrossOriginIframes : true,
+            recordCrossOriginIframes: recordCrossOriginIframes != null ? recordCrossOriginIframes : true,
             emitFromIframe: !!this.api.ConfigReader.get(RECORDING_CONFIG_TREAT_IFRAME_AS_ROOT)
         };
         return config;
@@ -51790,6 +51883,20 @@ var WorkerFactory = /*#__PURE__*/createInlineWorkerFactory(/* rollup-plugin-web-
     }
 
     const ONE_HUNDRED_MB_IN_BYTES = 100 * 1024 * 1024;
+    // An undrained response body holds its stream, the underlying data pipe and the
+    // socket open until the response is collected, which in a worker that lives for
+    // the whole session may never happen. Deliberately duplicated from
+    // cancelResponseBody in src/transmit.js instead of imported: this is its own
+    // bundle, and importing transmit would pull the rest of its dependencies in.
+    function cancelResponseBody(response) {
+        try {
+            if (response && response.body && typeof response.body.cancel === 'function') {
+                response.body.cancel().catch(function () { });
+            }
+        }
+        catch (e) {
+        }
+    }
     function matchHostedResources(recordingEvent, stringifiedRecordingPayload) {
         const fontURLRegex = /https:\/\/[^"\\\s]+?\.(woff2?|ttf|otf|eot)(\?[^"\\\s]*)?\b/g;
         const matches = stringifiedRecordingPayload.match(fontURLRegex);
@@ -51864,6 +51971,7 @@ var WorkerFactory = /*#__PURE__*/createInlineWorkerFactory(/* rollup-plugin-web-
                     method: 'POST',
                     body
                 }).then(function (response) {
+                    cancelResponseBody(response);
                     if (response.status < 200 || response.status >= 300) {
                         postMessage({
                             error: new Error(`received status code ${response.status}: ${response.statusText}`),
@@ -52623,7 +52731,10 @@ function ConsoleCapture() {
     let transport;
     let isPtmPaused;
     let isCapturingConsoleLogs = false;
+    let alwaysCaptureErrors = false;
+    let isRecordingActive = false;
     const CAPTURE_CONSOLE_CONFIG = 'captureConsoleLogs';
+    const ALWAYS_CAPTURE_ERRORS_CONFIG = 'alwaysCaptureDevLogErrors';
     const CONSOLE_METHODS = ['log', 'warn', 'error', 'info'];
     const DEV_LOG_SUB_TYPE = 'console';
     // deduplicate logs
@@ -52662,9 +52773,11 @@ function ConsoleCapture() {
         pluginAPI = PluginAPI;
         const { ConfigReader } = pluginAPI;
         ConfigReader.addOption(CAPTURE_CONSOLE_CONFIG, [ConfigReader.sources.PENDO_CONFIG_SRC], false);
+        ConfigReader.addOption(ALWAYS_CAPTURE_ERRORS_CONFIG, [ConfigReader.sources.PENDO_CONFIG_SRC], false);
         const captureConsoleEnabled = ConfigReader.get(CAPTURE_CONSOLE_CONFIG);
         if (!captureConsoleEnabled)
             return;
+        alwaysCaptureErrors = !!ConfigReader.get(ALWAYS_CAPTURE_ERRORS_CONFIG);
         globalPendo = pendo;
         buffer = new DevlogBuffer(pendo, pluginAPI);
         transport = new DevlogTransport(pendo, pluginAPI);
@@ -52708,11 +52821,19 @@ function ConsoleCapture() {
         pluginAPI.log.info(`[ConsoleCapture] Console log capture ${shouldCapture ? 'started' : 'stopped'}${reason ? `: ${reason}` : ''}`);
     }
     function recordingStarted() {
+        isRecordingActive = true;
         setCaptureState({ shouldCapture: true, reason: 'recording started' });
     }
     function recordingStopped() {
+        isRecordingActive = false;
+        if (alwaysCaptureErrors)
+            return; // capture isn't tied to the recording lifecycle
         setCaptureState({ shouldCapture: false, reason: 'recording stopped' });
     }
+    // ingestion only keeps error logs when there's no recording, so don't send the rest
+    function isErrorOnlyCapture() {
+        return alwaysCaptureErrors && !isRecordingActive;
+    }
     function readyHandler() {
         try {
             addIntercepts();
@@ -52721,6 +52842,10 @@ function ConsoleCapture() {
         catch (error) {
             pluginAPI.log.error('Error setting up console capture intercepts: ', error);
             teardown();
+            return;
+        }
+        if (alwaysCaptureErrors) {
+            setCaptureState({ shouldCapture: true, reason: 'always capture dev log errors' });
         }
     }
     function addIntercepts() {
@@ -52756,6 +52881,8 @@ function ConsoleCapture() {
     function createConsoleEvent(args, methodName, { skipStackTrace = false, skipScrubPII = false } = {}) {
         if (!isCapturingConsoleLogs || !args || args.length === 0 || !_.contains(CONSOLE_METHODS, methodName))
             return;
+        if (isErrorOnlyCapture() && methodName !== 'error')
+            return;
         // stringify args
         let message = _.compact(_.map(args, arg => {
             let stringifiedArg;
@@ -52869,8 +52996,11 @@ function NetworkCapture() {
     let responseBodyCb;
     let pendoDevlogBaseUrl;
     let isCapturingNetworkLogs = false;
+    let alwaysCaptureErrors = false;
+    let isRecordingActive = false;
     let excludeRequestUrls = [];
     const CAPTURE_NETWORK_CONFIG = 'captureNetworkRequests';
+    const ALWAYS_CAPTURE_ERRORS_CONFIG = 'alwaysCaptureDevLogErrors';
     const NETWORK_SUB_TYPE = 'network';
     const NETWORK_LOGS_CONFIG = 'networkLogs';
     const NETWORK_LOGS_CONFIG_ALLOWED_REQUEST_HEADERS = 'networkLogs.allowedRequestHeaders';
@@ -52946,9 +53076,11 @@ function NetworkCapture() {
         globalPendo = pendo;
         const { ConfigReader } = pluginAPI;
         ConfigReader.addOption(CAPTURE_NETWORK_CONFIG, [ConfigReader.sources.PENDO_CONFIG_SRC], false);
+        ConfigReader.addOption(ALWAYS_CAPTURE_ERRORS_CONFIG, [ConfigReader.sources.PENDO_CONFIG_SRC], false);
         const captureNetworkEnabled = ConfigReader.get(CAPTURE_NETWORK_CONFIG);
         if (!captureNetworkEnabled)
             return;
+        alwaysCaptureErrors = !!ConfigReader.get(ALWAYS_CAPTURE_ERRORS_CONFIG);
         buffer = new DevlogBuffer(pendo, pluginAPI);
         transport = new DevlogTransport(pendo, pluginAPI);
         sendQueue = new pluginAPI.SendQueue(transport.sendRequest.bind(transport));
@@ -53008,7 +53140,9 @@ function NetworkCapture() {
          */
         ConfigReader.addOption(NETWORK_LOGS_CONFIG_CAPTURE_REQUEST_BODY, [ConfigReader.sources.SNIPPET_SRC], undefined);
         /**
-         * Callback function to process/modify response bodies before capturing them. If not provided, the response body will not be captured.
+         * Callback function to process/modify response bodies before capturing them. If not provided, the response body
+         * will not be captured, unless `alwaysCaptureDevLogErrors` is enabled: error response bodies are then captured
+         * as-is until a callback is provided.
          *
          * @access public
          * @category Config/Network Logs
@@ -53053,6 +53187,14 @@ function NetworkCapture() {
             responseBodyCb = config.captureResponseBody;
         }
     }
+    // error bodies are captured by default here; processBody still masks and truncates them
+    function getResponseBodyCb(response) {
+        if (responseBodyCb)
+            return responseBodyCb;
+        if (alwaysCaptureErrors && response.status >= 400)
+            return (body) => body;
+        return undefined;
+    }
     function buildExcludeRequestUrls() {
         const requestUrls = pluginAPI.ConfigReader.get(NETWORK_LOGS_CONFIG_EXCLUDE_REQUEST_URLS);
         if (!requestUrls || requestUrls.length === 0)
@@ -53100,13 +53242,24 @@ function NetworkCapture() {
         pluginAPI.log.info(`[NetworkCapture] Network request capture ${shouldCapture ? 'started' : 'stopped'}${reason ? `: ${reason}` : ''}`);
     }
     function recordingStarted() {
+        isRecordingActive = true;
         return setCaptureState({ shouldCapture: true, reason: 'recording started' });
     }
     function recordingStopped() {
+        isRecordingActive = false;
+        if (alwaysCaptureErrors)
+            return; // capture isn't tied to the recording lifecycle
         return setCaptureState({ shouldCapture: false, reason: 'recording stopped' });
     }
+    // ingestion only keeps error responses when there's no recording, so don't send the rest
+    function isErrorOnlyCapture() {
+        return alwaysCaptureErrors && !isRecordingActive;
+    }
     function startCapture() {
         pluginAPI.NetworkRequest.on({ request: handleRequest, response: handleResponse, error: handleError });
+        if (alwaysCaptureErrors) {
+            setCaptureState({ shouldCapture: true, reason: 'always capture dev log errors' });
+        }
     }
     function teardown() {
         if (sendInterval) {
@@ -53154,6 +53307,10 @@ function NetworkCapture() {
             delete requestMap[response.requestId];
             return;
         }
+        if (isErrorOnlyCapture() && !(response.status >= 400)) {
+            delete requestMap[response.requestId];
+            return;
+        }
         if (!buffer.hasTokenAvailable()) {
             delete requestMap[response.requestId];
             return;
@@ -53212,11 +53369,11 @@ function NetworkCapture() {
             return '[Failed to process request body]';
         }
     }
-    function processResponseBody({ response }) {
-        if (!response || !response.body || !responseBodyCb)
+    function processResponseBody({ response, bodyCb = responseBodyCb }) {
+        if (!response || !response.body || !bodyCb)
             return '';
         try {
-            const body = responseBodyCb(response.body, { response });
+            const body = bodyCb(response.body, { response });
             const contentType = globalPendo._.get(response, 'headers.content-type', '');
             return processBody(body, contentType);
         }
@@ -53233,8 +53390,9 @@ function NetworkCapture() {
         if (requestBodyCb) {
             networkEvent.devLogRequestBody = processRequestBody({ request });
         }
-        if (responseBodyCb) {
-            networkEvent.devLogResponseBody = processResponseBody({ response });
+        const effectiveResponseBodyCb = getResponseBodyCb(response);
+        if (effectiveResponseBodyCb) {
+            networkEvent.devLogResponseBody = processResponseBody({ response, bodyCb: effectiveResponseBodyCb });
         }
         return networkEvent;
     }
@@ -55315,12 +55473,18 @@ const WIDGET_SETTINGS_API = '/external/widget/settings';
 class PredictApiService {
     constructor({ baseUrl, token }) {
         this.performRequest = (url, options) => __awaiter(this, void 0, void 0, function* () {
+            var _a;
             const response = yield fetch(url, options);
-            const body = response.ok ? yield response.json() : null;
-            return { ok: response.ok, status: response.status, body };
+            if (!response.ok) {
+                // nothing reads an error body, and leaving it undrained holds its
+                // stream and socket open until the response is collected
+                (_a = response.body) === null || _a === void 0 ? void 0 : _a.cancel().catch(() => { });
+                return { ok: false, status: response.status, body: null };
+            }
+            return { ok: true, status: response.status, body: yield response.json() };
         });
         this.getWidgetSettingsById = (id, log) => __awaiter(this, void 0, void 0, function* () {
-            var _a, _b;
+            var _b, _c;
             if (!id) {
                 log('[predict] no id provided');
                 return null;
@@ -55335,11 +55499,11 @@ class PredictApiService {
                     return null;
                 }
                 const data = body;
-                if ((_a = data === null || data === void 0 ? void 0 : data.errors) === null || _a === void 0 ? void 0 : _a.length) {
+                if ((_b = data === null || data === void 0 ? void 0 : data.errors) === null || _b === void 0 ? void 0 : _b.length) {
                     log(`[predict] error getting widget settings by id: ${data.errors}`);
                     return null;
                 }
-                return (_b = data === null || data === void 0 ? void 0 : data.data) !== null && _b !== void 0 ? _b : null;
+                return (_c = data === null || data === void 0 ? void 0 : data.data) !== null && _c !== void 0 ? _c : null;
             }
             catch (error) {
                 log(`[predict] error getting widget settings by id: ${error}`);