@pendo/agent 2.337.3 → 2.338.2

package/dist/pendo.module.js

@@ -430,6 +430,12 @@ function getPolicy(pendo) {
     return policy;
 }
 
+function escapeRegExp(string) {
+    if (!string)
+        return;
+    return string.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
 var STAGING_SERVER_HASHES = 'stagingServerHashes';
 var STAGING_DOMAINS = 'stagingDomains';
 var pendo$1;
@@ -515,7 +521,9 @@ function urlMatchesPatterns(url, patterns = [], hashes = []) {
                 }
             }
             if (typeof pattern === 'string') {
-                pattern = new RegExp('^' + pattern + '$');
+                // String entries are literal origins/hosts, not patterns. Escape
+                // them so a '.' can't act as a wildcard and match a look-alike domain.
+                pattern = new RegExp('^' + escapeRegExp(pattern) + '$');
             }
             if (pattern instanceof RegExp && pattern.test(url)) {
                 return true;
@@ -649,10 +657,13 @@ function getPendoConfigValue(key) {
 }
 
 // Resolve the global object without relying on a bare `window` identifier.
-// `window` is only a bound global in a normal browser realm; when the agent is
-// loaded via the npm `loadAsModule` path (or inside a Web Worker) the module is
-// evaluated in a realm where `window` is undeclared, so referencing it bare
-// throws a ReferenceError at module-load. `globalThis` resolves in every realm.
+// `window` is only a bound global in a normal browser realm; the compat builds
+// bind it via their `(function(window, document){...})` wrapper, but the npm
+// module build has no wrapper, so its module scope can be evaluated in realms
+// where `window` is undeclared (a Web Worker, or a customer bundler re-chunking
+// the module into worker-reachable code) and a bare reference throws a
+// ReferenceError at module-load. `globalThis` resolves in every realm; the
+// `self`/`window` fallbacks cover engines that predate it. APP-160669, APP-165809.
 function getGlobalScope() {
     if (typeof globalThis !== 'undefined') {
         return globalThis;
@@ -3916,7 +3927,13 @@ function isMobileUserAgent() {
     return (/Android|webOS|iPhone|iPod|BlackBerry|IEMobile|Opera Mini/i).test(getUA());
 }
 function isSafari(userAgent = getUA()) {
-    return userAgent.indexOf('Safari') >= 0 && !userAgent.indexOf('Chrome') >= 0;
+    return userAgent.indexOf('Safari') >= 0 && !isChromium(userAgent);
+}
+// Every Chromium UA carries a trailing Safari/ token, so Chrome, Edge, Opera,
+// Brave and Electron all have to be excluded from isSafari(). Chromium builds
+// report Chromium/ without a Chrome/ token, hence both checks.
+function isChromium(userAgent = getUA()) {
+    return userAgent.indexOf('Chrome') >= 0 || userAgent.indexOf('Chromium') >= 0;
 }
 const sniffer = {
     supportsHistoryApi: shouldWrapNativeHistory,
@@ -4029,8 +4046,8 @@ let SERVER = '';
 let ASSET_HOST = '';
 let ASSET_PATH = '';
 let DESIGNER_SERVER = '';
-let VERSION = '2.337.3_';
-let PACKAGE_VERSION = '2.337.3';
+let VERSION = '2.338.2_';
+let PACKAGE_VERSION = '2.338.2';
 let LOADER = 'xhr';
 /* eslint-enable web-sdk-eslint-rules/no-gulp-env-references */
 /**
@@ -4335,9 +4352,9 @@ function unwrapFirefoxObject(obj) {
     return obj;
 }
 
-var decodeURIComponent = _.isFunction(window.decodeURIComponent) ? window.decodeURIComponent : _.identity;
+var decodeURIComponent = _.isFunction(globalScope.decodeURIComponent) ? globalScope.decodeURIComponent : _.identity;
 
-var encodeURIComponent = _.isFunction(window.encodeURIComponent) ? window.encodeURIComponent : _.identity;
+var encodeURIComponent = _.isFunction(globalScope.encodeURIComponent) ? globalScope.encodeURIComponent : _.identity;
 
 class EventTarget {
     constructor() {
@@ -4447,12 +4464,6 @@ class LogEmitter extends EventTarget {
 }
 const log = new LogEmitter();
 
-function escapeRegExp(string) {
-    if (!string)
-        return;
-    return string.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-
 const allowKeys = function () {
     var allowKeys = ConfigReader.get('storage.allowKeys') || '*';
     return _.isArray(allowKeys) ? _.indexBy(allowKeys) : allowKeys;
@@ -4919,18 +4930,6 @@ var agentStorage = (function () {
     };
 })();
 
-/*
- * @license  MIT - https://github.com/taylorhakes/promise-polyfill
- */
-// Modified to not affect global environment: the `var` keeps the binding module-local
-// so the polyfill never assigns to the real global `Promise`.
-//
-// Main-thread only. Reading `window` here is safe because rollup's `inject` is skipped
-// for the nested worker build (see `skipPlugins` on webWorkerLoader in
-// rollup/web-sdk.config.mjs): a worker realm has a native Promise and no `window`, so
-// injecting this polyfill there was both unreachable and fatal — it threw
-// `ReferenceError: window is not defined` at worker startup and stopped session replay
-// with a WORKER_ERROR. APP-163474.
 var Promise$1;
 
 Promise$1 = (function (global, factory) {
@@ -4940,7 +4939,7 @@ Promise$1 = (function (global, factory) {
   }
 
   return nativePromise;
-}(window, (function () {
+}(globalScope, (function () {
 /**
  * @this {Promise}
  */
@@ -6269,6 +6268,7 @@ function wasSessionCleared(evt) {
 //
 // NOTE: This, for now, at least is identified as an instanceof HTMLAnchorElement
 
+
 function URLPolyfillFactory(doc) {
     return function URL(str) {
         var a = doc.createElement('a');
@@ -6300,11 +6300,11 @@ function URLPolyfillFactory(doc) {
 var URL = (function(global, factory) {
     var nativeURL = global.URL;
     if (typeof nativeURL !== 'function' || !/native/.test(nativeURL)) {
-        return factory(document);
+        return factory(global.document);
     }
 
     return nativeURL;
-})(window, URLPolyfillFactory);
+})(globalScope, URLPolyfillFactory);
 
 function hasComposedPath(evt) {
     return evt && typeof evt.composedPath === 'function';
@@ -10079,6 +10079,26 @@ var writeMessage = function (msg) {
     });
     return q.resolve(writeImgTag(url)).catch(_.noop);
 };
+/**
+ * Releases a fetch response body we are never going to read. An undrained body
+ * holds its stream, the underlying data pipe and the socket open until the
+ * {Response} is collected, which may never happen in a long-lived embedded
+ * renderer. Cancelling does not affect keepalive delivery.
+ *
+ * @access private
+ * @param {Response} response to discard the body of
+ * @returns {Response} the same response, for chaining
+ */
+function cancelResponseBody(response) {
+    try {
+        if (response && response.body && _.isFunction(response.body.cancel)) {
+            response.body.cancel().catch(_.noop);
+        }
+    }
+    catch (e) {
+    }
+    return response;
+}
 /**
  * @access private
  * @param {string} msg to send
@@ -10107,7 +10127,9 @@ function writeErrorPOST(msg) {
         else {
             promise = ajax.postJSON(url, errorData);
         }
-        return promise.then(function () { log.info('successfully wrote error'); }, function (err) { log.info('error writing error:' + err); });
+        return promise.then(function (response) {
+            cancelResponseBody(response);
+        }, function (err) { log.debug('error writing error:' + err); });
     }
     catch (e) {
         log.info('Failed to write error to server using POST endpoint: ' + e);
@@ -10129,6 +10151,10 @@ function writeMetricsPOST(payload) {
                 keepalive: true,
                 body: JSON.stringify(payload),
                 headers: { 'Content-Type': 'application/json' }
+            })
+                .then(cancelResponseBody)
+                .catch(function (err) {
+                log.debug(`Failed to write metrics payload to server: ${err}`);
             });
         }
         else {
@@ -10156,13 +10182,23 @@ function writeImgTag(src) {
     image.src = src;
     return deferred.promise;
 }
+/**
+ * Sends a fire-and-forget beacon request. The response body is cancelled before
+ * the promise resolves, so callers get {Response.status}, {Response.ok} and the
+ * headers but cannot read the body. Use {fetch} directly if you need to read one.
+ *
+ * @access private
+ * @param {string} url to request
+ * @param {Object} options passed to {fetch}, defaulting to a keepalive GET
+ * @returns {Promise<Response>} with its body already cancelled
+ */
 function fetchKeepalive(url, options = {}) {
     const defaults = {
         method: 'GET',
         keepalive: true
     };
     const fetchOptions = _.extend({}, defaults, options);
-    return fetch(url, fetchOptions);
+    return fetch(url, fetchOptions).then(cancelResponseBody);
 }
 fetchKeepalive.supported = function () {
     try {
@@ -11614,7 +11650,7 @@ var WeakRef = (function(global, factory) {
     }
 
     return nativeWeakRef;
-})(window, WeakRefFactory);
+})(globalScope, WeakRefFactory);
 
 const trimString = (str, limit) => {
     const len = str.length;
@@ -11788,6 +11824,13 @@ _.extend(dom, {
 });
 _.extend(dom.prototype, DomEvent.$, DomQuery.$);
 
+// Domains that Pendo owns, will be swapped in by build patches
+const pendoDomainPatterns = [
+        /^https:\/\/((adopt|oem)\.)?((us1)\.)?(app|via|adopt|cdn|oem|novus-api|novus)(\.(au|eu|gov|hsbc|jpn|tv))?\.pendo\.io$/,
+        /^https:\/\/([0-9]{8}t[0-9]{4}-dot-)(pendo-au|pendo-eu|pendo-govramp|pendo-hsbc|pendo-io|pendo-jp-prod|pendo-tv|pendo-us1)\.appspot\.com$/,
+        /^https:\/\/hotfix-(ops|app)-([0-9]+-dot-)(pendo-au|pendo-eu|pendo-govramp|pendo-hsbc|pendo-io|pendo-jp-prod|pendo-tv|pendo-us1)\.appspot\.com$/,
+        /^https:\/\/(pendo-au|pendo-eu|pendo-govramp|pendo-hsbc|pendo-io|pendo-jp-prod|pendo-tv|pendo-us1)-static\.storage\.googleapis\.com$/
+    ]; // eslint-disable-line web-sdk-eslint-rules/no-gulp-env-references
 function isTrustedOrigin(host) {
     if (!host)
         return false;
@@ -11801,13 +11844,6 @@ function isTrustedOrigin(host) {
         return true;
     if (host === getContentHost())
         return true;
-    // Domains that Pendo owns, will be swapped in by build patches
-    const patterns = [
-        /^https:\/\/((adopt|oem)\.)?((us1)\.)?(app|via|adopt|cdn|oem|novus-api|novus)(\.(au|eu|gov|hsbc|jpn|tv))?\.pendo\.io$/,
-        /^https:\/\/([0-9]{8}t[0-9]{4}-dot-)(pendo-au|pendo-eu|pendo-govramp|pendo-hsbc|pendo-io|pendo-jp-prod|pendo-tv|pendo-us1)\.appspot\.com$/,
-        /^https:\/\/hotfix-(ops|app)-([0-9]+-dot-)(pendo-au|pendo-eu|pendo-govramp|pendo-hsbc|pendo-io|pendo-jp-prod|pendo-tv|pendo-us1)\.appspot\.com$/,
-        /^https:\/\/(pendo-au|pendo-eu|pendo-govramp|pendo-hsbc|pendo-io|pendo-jp-prod|pendo-tv|pendo-us1)-static\.storage\.googleapis\.com$/
-    ]; // eslint-disable-line web-sdk-eslint-rules/no-gulp-env-references
     var adoptHost = ConfigReader.get('adoptHost');
     if (adoptHost) {
         var fullHostname = 'https://' + adoptHost;
@@ -11817,10 +11853,17 @@ function isTrustedOrigin(host) {
     }
     if (urlMatchesPatterns(host, ConfigReader.get('allowedOriginServers', []), ConfigReader.get('allowedOriginServerHashes', [])))
         return true;
-    return _.any(patterns, function (pattern) {
+    return _.any(pendoDomainPatterns, function (pattern) {
         return pattern.test(host);
     });
 }
+function isPendoDomain(origin) {
+    if (!origin)
+        return false;
+    return _.any(pendoDomainPatterns, function (pattern) {
+        return pattern.test(origin);
+    });
+}
 function hasAllowedOriginServers() {
     const allowedOriginServers = ConfigReader.get('allowedOriginServers', []);
     return allowedOriginServers && allowedOriginServers.length > 0;
@@ -13158,6 +13201,7 @@ function sendWithImg(apiKey, silo) {
     return writeImgTag(buildGetRequestUrl(apiKey, silo));
 }
 function handleFetchResponse(response) {
+    cancelResponseBody(response);
     if (response.status < 200 || response.status >= 300) {
         return q.reject(new Error(`received status code ${response.status}: ${response.statusText}`));
     }
@@ -26801,10 +26845,23 @@ var DesignerV2 = (function () {
         }
         return validTarget;
     }
+    function hasSameOriginOpener() {
+        if (!window.opener)
+            return false;
+        try {
+            return window.opener.location.origin === window.location.origin;
+        }
+        catch (e) {
+            return false;
+        }
+    }
     function launchOnToken(url) {
         if (isDesignerFrame(window.name)) {
             return;
         }
+        if (isPendoDomain(window.location.origin) && !hasSameOriginOpener()) {
+            return;
+        }
         var tokenParamTest = /pendo-designer=([A-Za-z0-9-]+)/;
         if (!tokenParamTest.test(url))
             return;
@@ -26817,7 +26874,7 @@ var DesignerV2 = (function () {
         // clear stored designer state if we're launching from a token
         window.localStorage.removeItem('pendo-navigation-state');
         window.localStorage.removeItem('pendo-designer-mode');
-        launchInAppDesigner({
+        DesignerV2.launchInAppDesigner({
             target: validTarget,
             host: validAssetHost,
             preloader: false,
@@ -29734,7 +29791,11 @@ var BuildingBlockGuides = (function () {
         // position and calculate its height before making it visible.
         // In the designer, changing visibility like this causes the guide to "flicker"
         // between re-renders
-        guideContainer.css({ visibility: 'hidden' });
+        // Only hide the first match. Resource center module previews nest the module's
+        // pendo-g- inside the home view's pendo-g- under the same id (via
+        // correctGuideContainerId), and imageNodeHandler only un-hides the first match,
+        // so hiding every match left the module content hidden forever.
+        dom(guideContainer[0]).css({ visibility: 'hidden' });
         guideToAppend.css({ visibility: 'hidden' });
         const embedConfig = _.get(guide, 'attributes.embedConfig', null);
         var watermark = BuildingBlockWatermark.buildWatermark({
@@ -42841,10 +42902,13 @@ function GuideMarkdown() {
 }
 
 // Resolve the global object without relying on a bare `window` identifier.
-// `window` is only a bound global in a normal browser realm; when the agent is
-// loaded via the npm `loadAsModule` path (or inside a Web Worker) the module is
-// evaluated in a realm where `window` is undeclared, so referencing it bare
-// throws a ReferenceError at module-load. `globalThis` resolves in every realm.
+// `window` is only a bound global in a normal browser realm; the compat builds
+// bind it via their `(function(window, document){...})` wrapper, but the npm
+// module build has no wrapper, so its module scope can be evaluated in realms
+// where `window` is undeclared (a Web Worker, or a customer bundler re-chunking
+// the module into worker-reachable code) and a bare reference throws a
+// ReferenceError at module-load. `globalThis` resolves in every realm; the
+// `self`/`window` fallbacks cover engines that predate it. APP-160669, APP-165809.
 function getGlobalScope() {
     if (typeof globalThis !== 'undefined') {
         return globalThis;
@@ -42892,6 +42956,7 @@ var setTimeout$1 = setTimeout;
 //
 // NOTE: This, for now, at least is identified as an instanceof HTMLAnchorElement
 
+
 function URLPolyfillFactory(doc) {
     return function URL(str) {
         var a = doc.createElement('a');
@@ -42923,24 +42988,12 @@ function URLPolyfillFactory(doc) {
 var URL$1 = (function(global, factory) {
     var nativeURL = global.URL;
     if (typeof nativeURL !== 'function' || !/native/.test(nativeURL)) {
-        return factory(document);
+        return factory(global.document);
     }
 
     return nativeURL;
-})(window, URLPolyfillFactory);
+})(globalScope, URLPolyfillFactory);
 
-/*
- * @license  MIT - https://github.com/taylorhakes/promise-polyfill
- */
-// Modified to not affect global environment: the `var` keeps the binding module-local
-// so the polyfill never assigns to the real global `Promise`.
-//
-// Main-thread only. Reading `window` here is safe because rollup's `inject` is skipped
-// for the nested worker build (see `skipPlugins` on webWorkerLoader in
-// rollup/web-sdk.config.mjs): a worker realm has a native Promise and no `window`, so
-// injecting this polyfill there was both unreachable and fatal — it threw
-// `ReferenceError: window is not defined` at worker startup and stopped session replay
-// with a WORKER_ERROR. APP-163474.
 var Promise$1;
 
 Promise$1 = (function (global, factory) {
@@ -42950,7 +43003,7 @@ Promise$1 = (function (global, factory) {
   }
 
   return nativePromise;
-}(window, (function () {
+}(globalScope, (function () {
 /**
  * @this {Promise}
  */
@@ -50694,6 +50747,7 @@ const RECORDING_CONFIG_ON_RECORDING_STOP = 'recording.onRecordingStop';
 const RECORDING_CONFIG_WORKER_OVERRIDE = 'recording.workerOverride';
 const RECORDING_CONFIG_TREAT_IFRAME_AS_ROOT = 'recording.treatIframeAsRoot';
 const RECORDING_CONFIG_DISABLE_UNLOAD = 'recording.disableUnload';
+const RECORDING_CONFIG_RECORD_CROSS_ORIGIN_IFRAMES = 'recording.recordCrossOriginIframes';
 const RESOURCE_CACHING = 'resourceCaching';
 const ONE_DAY_IN_MILLISECONDS = 24 * 60 * 60 * 1000;
 const ONE_MINUTE_IN_MILLISECONDS = 60 * 1000;
@@ -50805,6 +50859,26 @@ class SessionRecorder {
          * @type {boolean}
          */
         cf.addOption(RECORDING_CONFIG_TREAT_IFRAME_AS_ROOT, [cf.sources.SNIPPET_SRC], undefined);
+        /**
+         * Controls whether content embedded from another domain is included in replay. When enabled, the
+         * embedded content shows up as part of the page. When disabled, it appears as a blank box.
+         *
+         * This only applies to embedded content that also has Pendo installed. Embeds from other companies
+         * (Stripe, YouTube) are never captured either way — turning this off just stops Pendo from
+         * messaging those frames at all.
+         *
+         * To capture embedded content as its own separate replay instead of part of the page it sits in,
+         * see recording.treatIframeAsRoot.
+         *
+         * @access public
+         * @category Config/Replay
+         * @name recording.recordCrossOriginIframes
+         * @default true
+         * @type {boolean}
+         */
+        // Like recording.enabled, this defaults to undefined so that it only overrides the
+        // value returned by the backend when it is explicitly set to true/false
+        cf.addOption(RECORDING_CONFIG_RECORD_CROSS_ORIGIN_IFRAMES, [cf.sources.SNIPPET_SRC], undefined);
         cf.addOption(RESOURCE_CACHING, [cf.sources.PENDO_CONFIG_SRC], undefined);
     }
     initialize(pendo, PluginAPI) {
@@ -51024,6 +51098,9 @@ class SessionRecorder {
         });
         const blockedSelectors = ['.pendo-ignore', '.pendo-sr-ignore'].concat(recordingOptions.blockedSelectors || []);
         const hiddenSelectors = ['.pendo-sr-hide'].concat(recordingOptions.hiddenSelectors || []);
+        // The snippet config value should take precedence over the value from the visitor config
+        const snippetValue = this.api.ConfigReader.get(RECORDING_CONFIG_RECORD_CROSS_ORIGIN_IFRAMES);
+        const recordCrossOriginIframes = this.pendo._.isBoolean(snippetValue) ? snippetValue : recordingOptions.recordCrossOriginIframes;
         const config = {
             maskInputFn: this.pendo._.partial(maskInput, maskOptions),
             maskTextFn: this.pendo._.partial(maskText, maskOptions),
@@ -51034,7 +51111,7 @@ class SessionRecorder {
             // we need to concat hidden selectors to re-use block selector logic
             blockSelector: blockedSelectors.concat(hiddenSelectors).join(','),
             hideSelector: hiddenSelectors.join(','),
-            recordCrossOriginIframes: recordingOptions.recordCrossOriginIframes != null ? recordingOptions.recordCrossOriginIframes : true,
+            recordCrossOriginIframes: recordCrossOriginIframes != null ? recordCrossOriginIframes : true,
             emitFromIframe: !!this.api.ConfigReader.get(RECORDING_CONFIG_TREAT_IFRAME_AS_ROOT)
         };
         return config;
@@ -51790,6 +51867,20 @@ var WorkerFactory = /*#__PURE__*/createInlineWorkerFactory(/* rollup-plugin-web-
     }
 
     const ONE_HUNDRED_MB_IN_BYTES = 100 * 1024 * 1024;
+    // An undrained response body holds its stream, the underlying data pipe and the
+    // socket open until the response is collected, which in a worker that lives for
+    // the whole session may never happen. Deliberately duplicated from
+    // cancelResponseBody in src/transmit.js instead of imported: this is its own
+    // bundle, and importing transmit would pull the rest of its dependencies in.
+    function cancelResponseBody(response) {
+        try {
+            if (response && response.body && typeof response.body.cancel === 'function') {
+                response.body.cancel().catch(function () { });
+            }
+        }
+        catch (e) {
+        }
+    }
     function matchHostedResources(recordingEvent, stringifiedRecordingPayload) {
         const fontURLRegex = /https:\/\/[^"\\\s]+?\.(woff2?|ttf|otf|eot)(\?[^"\\\s]*)?\b/g;
         const matches = stringifiedRecordingPayload.match(fontURLRegex);
@@ -51864,6 +51955,7 @@ var WorkerFactory = /*#__PURE__*/createInlineWorkerFactory(/* rollup-plugin-web-
                     method: 'POST',
                     body
                 }).then(function (response) {
+                    cancelResponseBody(response);
                     if (response.status < 200 || response.status >= 300) {
                         postMessage({
                             error: new Error(`received status code ${response.status}: ${response.statusText}`),
@@ -52623,7 +52715,10 @@ function ConsoleCapture() {
     let transport;
     let isPtmPaused;
     let isCapturingConsoleLogs = false;
+    let alwaysCaptureErrors = false;
+    let isRecordingActive = false;
     const CAPTURE_CONSOLE_CONFIG = 'captureConsoleLogs';
+    const ALWAYS_CAPTURE_ERRORS_CONFIG = 'alwaysCaptureDevLogErrors';
     const CONSOLE_METHODS = ['log', 'warn', 'error', 'info'];
     const DEV_LOG_SUB_TYPE = 'console';
     // deduplicate logs
@@ -52662,9 +52757,11 @@ function ConsoleCapture() {
         pluginAPI = PluginAPI;
         const { ConfigReader } = pluginAPI;
         ConfigReader.addOption(CAPTURE_CONSOLE_CONFIG, [ConfigReader.sources.PENDO_CONFIG_SRC], false);
+        ConfigReader.addOption(ALWAYS_CAPTURE_ERRORS_CONFIG, [ConfigReader.sources.PENDO_CONFIG_SRC], false);
         const captureConsoleEnabled = ConfigReader.get(CAPTURE_CONSOLE_CONFIG);
         if (!captureConsoleEnabled)
             return;
+        alwaysCaptureErrors = !!ConfigReader.get(ALWAYS_CAPTURE_ERRORS_CONFIG);
         globalPendo = pendo;
         buffer = new DevlogBuffer(pendo, pluginAPI);
         transport = new DevlogTransport(pendo, pluginAPI);
@@ -52708,11 +52805,19 @@ function ConsoleCapture() {
         pluginAPI.log.info(`[ConsoleCapture] Console log capture ${shouldCapture ? 'started' : 'stopped'}${reason ? `: ${reason}` : ''}`);
     }
     function recordingStarted() {
+        isRecordingActive = true;
         setCaptureState({ shouldCapture: true, reason: 'recording started' });
     }
     function recordingStopped() {
+        isRecordingActive = false;
+        if (alwaysCaptureErrors)
+            return; // capture isn't tied to the recording lifecycle
         setCaptureState({ shouldCapture: false, reason: 'recording stopped' });
     }
+    // ingestion only keeps error logs when there's no recording, so don't send the rest
+    function isErrorOnlyCapture() {
+        return alwaysCaptureErrors && !isRecordingActive;
+    }
     function readyHandler() {
         try {
             addIntercepts();
@@ -52721,6 +52826,10 @@ function ConsoleCapture() {
         catch (error) {
             pluginAPI.log.error('Error setting up console capture intercepts: ', error);
             teardown();
+            return;
+        }
+        if (alwaysCaptureErrors) {
+            setCaptureState({ shouldCapture: true, reason: 'always capture dev log errors' });
         }
     }
     function addIntercepts() {
@@ -52756,6 +52865,8 @@ function ConsoleCapture() {
     function createConsoleEvent(args, methodName, { skipStackTrace = false, skipScrubPII = false } = {}) {
         if (!isCapturingConsoleLogs || !args || args.length === 0 || !_.contains(CONSOLE_METHODS, methodName))
             return;
+        if (isErrorOnlyCapture() && methodName !== 'error')
+            return;
         // stringify args
         let message = _.compact(_.map(args, arg => {
             let stringifiedArg;
@@ -52869,8 +52980,11 @@ function NetworkCapture() {
     let responseBodyCb;
     let pendoDevlogBaseUrl;
     let isCapturingNetworkLogs = false;
+    let alwaysCaptureErrors = false;
+    let isRecordingActive = false;
     let excludeRequestUrls = [];
     const CAPTURE_NETWORK_CONFIG = 'captureNetworkRequests';
+    const ALWAYS_CAPTURE_ERRORS_CONFIG = 'alwaysCaptureDevLogErrors';
     const NETWORK_SUB_TYPE = 'network';
     const NETWORK_LOGS_CONFIG = 'networkLogs';
     const NETWORK_LOGS_CONFIG_ALLOWED_REQUEST_HEADERS = 'networkLogs.allowedRequestHeaders';
@@ -52946,9 +53060,11 @@ function NetworkCapture() {
         globalPendo = pendo;
         const { ConfigReader } = pluginAPI;
         ConfigReader.addOption(CAPTURE_NETWORK_CONFIG, [ConfigReader.sources.PENDO_CONFIG_SRC], false);
+        ConfigReader.addOption(ALWAYS_CAPTURE_ERRORS_CONFIG, [ConfigReader.sources.PENDO_CONFIG_SRC], false);
         const captureNetworkEnabled = ConfigReader.get(CAPTURE_NETWORK_CONFIG);
         if (!captureNetworkEnabled)
             return;
+        alwaysCaptureErrors = !!ConfigReader.get(ALWAYS_CAPTURE_ERRORS_CONFIG);
         buffer = new DevlogBuffer(pendo, pluginAPI);
         transport = new DevlogTransport(pendo, pluginAPI);
         sendQueue = new pluginAPI.SendQueue(transport.sendRequest.bind(transport));
@@ -53008,7 +53124,9 @@ function NetworkCapture() {
          */
         ConfigReader.addOption(NETWORK_LOGS_CONFIG_CAPTURE_REQUEST_BODY, [ConfigReader.sources.SNIPPET_SRC], undefined);
         /**
-         * Callback function to process/modify response bodies before capturing them. If not provided, the response body will not be captured.
+         * Callback function to process/modify response bodies before capturing them. If not provided, the response body
+         * will not be captured, unless `alwaysCaptureDevLogErrors` is enabled: error response bodies are then captured
+         * as-is until a callback is provided.
          *
          * @access public
          * @category Config/Network Logs
@@ -53053,6 +53171,14 @@ function NetworkCapture() {
             responseBodyCb = config.captureResponseBody;
         }
     }
+    // error bodies are captured by default here; processBody still masks and truncates them
+    function getResponseBodyCb(response) {
+        if (responseBodyCb)
+            return responseBodyCb;
+        if (alwaysCaptureErrors && response.status >= 400)
+            return (body) => body;
+        return undefined;
+    }
     function buildExcludeRequestUrls() {
         const requestUrls = pluginAPI.ConfigReader.get(NETWORK_LOGS_CONFIG_EXCLUDE_REQUEST_URLS);
         if (!requestUrls || requestUrls.length === 0)
@@ -53100,13 +53226,24 @@ function NetworkCapture() {
         pluginAPI.log.info(`[NetworkCapture] Network request capture ${shouldCapture ? 'started' : 'stopped'}${reason ? `: ${reason}` : ''}`);
     }
     function recordingStarted() {
+        isRecordingActive = true;
         return setCaptureState({ shouldCapture: true, reason: 'recording started' });
     }
     function recordingStopped() {
+        isRecordingActive = false;
+        if (alwaysCaptureErrors)
+            return; // capture isn't tied to the recording lifecycle
         return setCaptureState({ shouldCapture: false, reason: 'recording stopped' });
     }
+    // ingestion only keeps error responses when there's no recording, so don't send the rest
+    function isErrorOnlyCapture() {
+        return alwaysCaptureErrors && !isRecordingActive;
+    }
     function startCapture() {
         pluginAPI.NetworkRequest.on({ request: handleRequest, response: handleResponse, error: handleError });
+        if (alwaysCaptureErrors) {
+            setCaptureState({ shouldCapture: true, reason: 'always capture dev log errors' });
+        }
     }
     function teardown() {
         if (sendInterval) {
@@ -53154,6 +53291,10 @@ function NetworkCapture() {
             delete requestMap[response.requestId];
             return;
         }
+        if (isErrorOnlyCapture() && !(response.status >= 400)) {
+            delete requestMap[response.requestId];
+            return;
+        }
         if (!buffer.hasTokenAvailable()) {
             delete requestMap[response.requestId];
             return;
@@ -53212,11 +53353,11 @@ function NetworkCapture() {
             return '[Failed to process request body]';
         }
     }
-    function processResponseBody({ response }) {
-        if (!response || !response.body || !responseBodyCb)
+    function processResponseBody({ response, bodyCb = responseBodyCb }) {
+        if (!response || !response.body || !bodyCb)
             return '';
         try {
-            const body = responseBodyCb(response.body, { response });
+            const body = bodyCb(response.body, { response });
             const contentType = globalPendo._.get(response, 'headers.content-type', '');
             return processBody(body, contentType);
         }
@@ -53233,8 +53374,9 @@ function NetworkCapture() {
         if (requestBodyCb) {
             networkEvent.devLogRequestBody = processRequestBody({ request });
         }
-        if (responseBodyCb) {
-            networkEvent.devLogResponseBody = processResponseBody({ response });
+        const effectiveResponseBodyCb = getResponseBodyCb(response);
+        if (effectiveResponseBodyCb) {
+            networkEvent.devLogResponseBody = processResponseBody({ response, bodyCb: effectiveResponseBodyCb });
         }
         return networkEvent;
     }
@@ -55309,18 +55451,24 @@ var underscore = {exports: {}};
 var underscoreExports = underscore.exports;
 var _ = /*@__PURE__*/getDefaultExportFromCjs(underscoreExports);
 
-var encodeURIComponent = _.isFunction(window.encodeURIComponent) ? window.encodeURIComponent : _.identity;
+var encodeURIComponent = _.isFunction(globalScope.encodeURIComponent) ? globalScope.encodeURIComponent : _.identity;
 
 const WIDGET_SETTINGS_API = '/external/widget/settings';
 class PredictApiService {
     constructor({ baseUrl, token }) {
         this.performRequest = (url, options) => __awaiter(this, void 0, void 0, function* () {
+            var _a;
             const response = yield fetch(url, options);
-            const body = response.ok ? yield response.json() : null;
-            return { ok: response.ok, status: response.status, body };
+            if (!response.ok) {
+                // nothing reads an error body, and leaving it undrained holds its
+                // stream and socket open until the response is collected
+                (_a = response.body) === null || _a === void 0 ? void 0 : _a.cancel().catch(() => { });
+                return { ok: false, status: response.status, body: null };
+            }
+            return { ok: true, status: response.status, body: yield response.json() };
         });
         this.getWidgetSettingsById = (id, log) => __awaiter(this, void 0, void 0, function* () {
-            var _a, _b;
+            var _b, _c;
             if (!id) {
                 log('[predict] no id provided');
                 return null;
@@ -55335,11 +55483,11 @@ class PredictApiService {
                     return null;
                 }
                 const data = body;
-                if ((_a = data === null || data === void 0 ? void 0 : data.errors) === null || _a === void 0 ? void 0 : _a.length) {
+                if ((_b = data === null || data === void 0 ? void 0 : data.errors) === null || _b === void 0 ? void 0 : _b.length) {
                     log(`[predict] error getting widget settings by id: ${data.errors}`);
                     return null;
                 }
-                return (_b = data === null || data === void 0 ? void 0 : data.data) !== null && _b !== void 0 ? _b : null;
+                return (_c = data === null || data === void 0 ? void 0 : data.data) !== null && _c !== void 0 ? _c : null;
             }
             catch (error) {
                 log(`[predict] error getting widget settings by id: ${error}`);