@pendo/agent 2.345.0 → 2.347.0

package/dist/pendo.module.js

@@ -668,7 +668,7 @@ function loadStagingAgent(config, pendo, debuggingEnabled) {
         var altAgentUrl = getAlternateAgentUrl(config, true, debuggingEnabled);
         if (altAgentUrl) {
             setupMethodCapture(pendo);
-            includeScript(altAgentUrl, pendo);
+            includeScript(altAgentUrl, pendo, config.pendoGlobalKey);
             return true;
         }
     }
@@ -679,7 +679,7 @@ function loadUnminifiedAgent(config, pendo, debuggingEnabled) {
         var altAgentUrl = getAlternateAgentUrl(config, false, debuggingEnabled);
         if (altAgentUrl) {
             setupMethodCapture(pendo);
-            includeScript(altAgentUrl, pendo);
+            includeScript(altAgentUrl, pendo, config.pendoGlobalKey);
             return true;
         }
     }
@@ -688,11 +688,16 @@ function loadUnminifiedAgent(config, pendo, debuggingEnabled) {
 function loadAlternateAgent(config, pendo, debuggingEnabled) {
     return loadStagingAgent(config, pendo, debuggingEnabled) || loadUnminifiedAgent(config, pendo, debuggingEnabled);
 }
-function includeScript(scriptUrl, pendo) {
+function includeScript(scriptUrl, pendo, globalKey) {
     var scriptTagName = 'script';
     var stagingScriptTag = document.createElement(scriptTagName);
     stagingScriptTag.async = true;
     stagingScriptTag.src = getPolicy(pendo).createScriptURL(scriptUrl);
+    // The alternate agent reads its global key from its own script tag, and its
+    // bundled PendoConfig doesn't carry the key the snippet set.
+    if (globalKey) {
+        stagingScriptTag.setAttribute('data-pendo-global-key', globalKey);
+    }
     var otherScriptTag = document.getElementsByTagName(scriptTagName)[0];
     if (otherScriptTag && otherScriptTag.parentNode) {
         otherScriptTag.parentNode.insertBefore(stagingScriptTag, otherScriptTag);
@@ -3266,9 +3271,9 @@ var ConfigReader = (function () {
          */
         addOption('selfHostedWebSDKUrl', [SNIPPET_SRC, PENDO_CONFIG_SRC], undefined, undefined, ['selfHostedAgentUrl']);
         /**
-         * If this option is set to true, event data will only be transmitted using requests of type POST instead
-         * of first trying to use GET requests. This can result in fewer requests being sent each time that event data
-         * is transmitted.
+         * If this option is set to true, event data, guide requests, and segment flag requests will only be
+         * transmitted using requests of type POST instead of first trying to use GET requests. For event data, this
+         * can result in fewer requests being sent each time that event data is transmitted.
          *
          * @access public
          * @category Config/Core
@@ -4009,6 +4014,9 @@ function shouldWrapHashChange() {
 function isMobileUserAgent() {
     return (/Android|webOS|iPhone|iPod|BlackBerry|IEMobile|Opera Mini/i).test(getUA());
 }
+function supportsPopover() {
+    return !!window.HTMLElement && isNativeCode(window.HTMLElement.prototype.showPopover);
+}
 function isSafari(userAgent = getUA()) {
     return userAgent.indexOf('Safari') >= 0 && !isChromium(userAgent);
 }
@@ -4021,6 +4029,7 @@ function isChromium(userAgent = getUA()) {
 const sniffer = {
     supportsHistoryApi: shouldWrapNativeHistory,
     supportsHashChange: shouldWrapHashChange,
+    supportsPopover,
     hasEvent(event) {
         // IE9 implements 'input' event it's so fubared that we rather pretend that it doesn't have
         // it. In particular the event is not fired when backspace or delete key are pressed or
@@ -4129,8 +4138,8 @@ let SERVER = '';
 let ASSET_HOST = '';
 let ASSET_PATH = '';
 let DESIGNER_SERVER = '';
-let VERSION = '2.345.0_';
-let PACKAGE_VERSION = '2.345.0';
+let VERSION = '2.347.0_';
+let PACKAGE_VERSION = '2.347.0';
 let LOADER = 'xhr';
 /* eslint-enable web-sdk-eslint-rules/no-gulp-env-references */
 /**
@@ -13123,7 +13132,7 @@ function isDebuggingEnabled(asBoolean = true) {
     }
 }
 
-const PERFORMANCE_SEND_INTERVAL = 1000 * 60 * 10; // 10 minutes
+const PERFORMANCE_COLLECT_INTERVAL = 1000 * 60 * 10; // 10 minutes
 class PerformanceMonitor {
     constructor() {
         this._isPerformanceApiAvailable = this._checkPerformanceApi();
@@ -13131,6 +13140,8 @@ class PerformanceMonitor {
         this._measuringPerformance = false;
         this._debugging = false;
         this._setDebuggingBound = _.bind(this._setDebugging, this);
+        this._sendBound = _.bind(this.send, this);
+        this._totals = {};
         this.marks = new Set();
         this.measures = new Set();
     }
@@ -13141,12 +13152,13 @@ class PerformanceMonitor {
         this._markPerformance(INITIALIZE);
         this._setDebugging();
         Events.debuggerLaunched.on(this._setDebuggingBound);
+        Events.appUnloaded.on(this._sendBound);
         const shouldSend = Math.random() * 100 < ConfigReader.get('performanceMetricsSampleRate');
         this._setSending(shouldSend);
         // interval always runs to periodically free memory used by performance api
         this.interval = setInterval(() => {
-            this.send(); // includes call to _clearMarksAndMeasures()
-        }, PERFORMANCE_SEND_INTERVAL);
+            this._collect();
+        }, PERFORMANCE_COLLECT_INTERVAL);
         return () => {
             this.teardown();
         };
@@ -13157,6 +13169,7 @@ class PerformanceMonitor {
         this._measuringPerformance = false;
         this._setDebugging();
         Events.debuggerLaunched.off(this._setDebuggingBound);
+        Events.appUnloaded.off(this._sendBound);
         this._clearMarksAndMeasures();
         clearInterval(this.interval);
     }
@@ -13176,25 +13189,41 @@ class PerformanceMonitor {
         this._markPerformance(name, { detail });
     }
     send() {
-        const payload = _.reduce(METRICS, (acc, metric) => {
-            const { name, type, instrument } = metric;
-            if (!instrument)
-                return acc;
-            const entries = performance.getEntriesByName(name);
-            const value = instrument(entries);
-            if (value > 0) {
-                acc.push({
-                    name,
-                    type,
-                    value,
-                    timestamp: Date.now()
-                });
+        // runs in the appUnloaded handler ahead of the agent's event flush, so it must not throw
+        try {
+            this._collect();
+            const payload = _.map(this._totals, (value, name) => ({
+                name,
+                type: METRICS[name].type,
+                value,
+                timestamp: Date.now()
+            }));
+            this._totals = {};
+            if (_.size(payload) && this._sending) {
+                writeMetricsPOST(payload);
             }
-            return acc;
-        }, []);
-        this._clearMarksAndMeasures();
-        if (_.size(payload) && this._sending) {
-            writeMetricsPOST(payload);
+        }
+        catch (e) {
+            log.debug(`Failed to send performance metrics: ${e}`);
+        }
+    }
+    _collect() {
+        if (!this._isPerformanceApiAvailable)
+            return;
+        try {
+            if (!this._sending)
+                return;
+            _.each(METRICS, ({ name, instrument }) => {
+                if (!instrument)
+                    return;
+                const value = instrument(performance.getEntriesByName(name));
+                if (value > 0) {
+                    this._totals[name] = (this._totals[name] || 0) + value;
+                }
+            });
+        }
+        finally {
+            this._clearMarksAndMeasures();
         }
     }
     _checkPerformanceApi() {
@@ -13442,6 +13471,9 @@ function filterSiloCapacity(options) {
     };
 }
 var URL_MAX_LENGTH = 2000;
+function shouldLoadWithPost(url, jwtOptions) {
+    return url.length > URL_MAX_LENGTH || !_.isEmpty(jwtOptions) || !!ConfigReader.get('sendEventsWithPostOnly');
+}
 function shortenUrlFields(options) {
     options = _.defaults(options || {}, {
         fields: [],
@@ -23855,6 +23887,78 @@ var backdropVisibilityStep = {
     script: backdropVisibilityRuntimeScript
 };
 
+// ":modal" also matches a fullscreen element, which cannot take children
+const MODAL_DIALOG = 'dialog:modal';
+function queryModalDialogs() {
+    try {
+        return document.querySelectorAll(MODAL_DIALOG);
+    }
+    catch (e) {
+        return [];
+    }
+}
+function closestModalDialog(element) {
+    try {
+        return element && _.isFunction(element.closest) ? element.closest(MODAL_DIALOG) : null;
+    }
+    catch (e) {
+        return null;
+    }
+}
+function queryConfiguredSelector(step) {
+    const selector = _.get(step, 'attributes.popover.selector');
+    if (!selector)
+        return null;
+    try {
+        return dom(selector)[0] || null;
+    }
+    catch (e) {
+        log.info('Invalid popover selector', { contexts: ['error', 'guide', 'render'] });
+        return null;
+    }
+}
+function findHost(step) {
+    const host = queryConfiguredSelector(step) ||
+        closestModalDialog(step.targetElement) ||
+        _.last(queryModalDialogs());
+    // a host inside a shadow root would change the guide's root node
+    return host && host.getRootNode() === document ? host : null;
+}
+function promoteToPopover(element) {
+    element.setAttribute('popover', 'manual');
+    try {
+        element.showPopover();
+    }
+    catch (e) {
+        element.removeAttribute('popover');
+        log.info('Failed to render guide as popover', { contexts: ['error', 'guide', 'render'] });
+    }
+}
+// Registered ahead of backdrop-visibility-step and autofocus-step, which mark the siblings of the
+// guide's ancestors: the guide must already be inside the dialog or the dialog ends up hidden.
+function popoverRuntimeScript(step, guide, pendo) {
+    if (pendo.designer || !step.guideElement)
+        return;
+    if (!_.get(step, 'attributes.popover.enabled') || !sniffer.supportsPopover())
+        return;
+    if (_.get(guide, 'attributes.resourceCenter') || _.get(guide, 'attributes.embedConfig'))
+        return;
+    const guideContainer = step.guideElement.find(`#${step.containerId}`);
+    if (!guideContainer.length)
+        return;
+    // positioned in document coordinates, which a fixed root in the top layer breaks
+    if (guideContainer.attr('data-vertical-alignment') === 'Relative to Element')
+        return;
+    const host = findHost(step);
+    if (!host)
+        return;
+    host.appendChild(step.guideElement[0]);
+    promoteToPopover(step.guideElement[0]);
+}
+var popoverStep = {
+    script: popoverRuntimeScript
+};
+
 function isTooltip({ _ }, step) {
     const tooltip = 'tooltip';
     return _.get(step, 'attributes.calculatedType') === tooltip ||
@@ -24011,6 +24115,7 @@ function registerPostrenderScripts(runtime) {
     _.each([
         advanceOnElement,
         announcementMarkSeen,
+        popoverStep,
         autofocusStep,
         backdropVisibilityStep,
         repositionOnScroll,
@@ -25113,7 +25218,7 @@ var loadGuideJs = function (apiKey, params) {
         var url = buildBaseDataUrl(guideLoaderImpl.endpoint(), apiKey, queryString);
         var jwtOptions = JWT.get();
         let loadingPromise;
-        if (url.length > URL_MAX_LENGTH || !_.isEmpty(jwtOptions)) {
+        if (shouldLoadWithPost(url, jwtOptions)) {
             delete queryString.jzb;
             url = buildBaseDataUrl('guide.json', apiKey, queryString);
             var payload = _.extend({ events: jzb }, jwtOptions);
@@ -25966,8 +26071,14 @@ var MESSAGE_ENDED = 'pendo-live-preview::ended';
 var MESSAGE_END_ACK = 'pendo-live-preview::end-ack';
 var RELAY_END_MESSAGE_TIMEOUT = 2000;
 var activeRelay = null;
+// event.source alone is not enough: an ancestor page can navigate the relay frame to its own
+// document and keep the same window object, so the sender's origin has to be the relay's too.
+// An unknown relay origin ('*') cannot be matched, so it never authenticates a message.
 function isRelayMessage(event, relay) {
-    return event.source === relay.frame.contentWindow && !!event.data;
+    return relay.origin !== '*' &&
+        event.origin === relay.origin &&
+        event.source === relay.frame.contentWindow &&
+        !!event.data;
 }
 function sendConfig(relay) {
     if (!relay.frame.contentWindow)
@@ -28502,7 +28613,8 @@ class NetworkRequestIntercept {
                         return MAX_RESPONSE_SIZE_MESSAGE;
                     }
                 }
-                const text = yield config.text();
+                const canStream = config.body && _.isFunction(config.body.getReader) && typeof TextDecoder !== 'undefined';
+                const text = canStream ? yield this.readBodyStream(config.body) : yield config.text();
                 if (text.length > MAX_RESPONSE_SIZE) {
                     return MAX_RESPONSE_SIZE_MESSAGE;
                 }
@@ -28513,6 +28625,26 @@ class NetworkRequestIntercept {
             }
         });
     }
+    // Reads chunk by chunk so a long or never-ending stream stops buffering once it passes the cap
+    readBodyStream(body) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const reader = body.getReader();
+            const decoder = new TextDecoder();
+            let text = '';
+            let bytesRead = 0;
+            let chunk = yield reader.read();
+            while (!chunk.done) {
+                bytesRead += chunk.value.byteLength;
+                if (bytesRead > MAX_RESPONSE_SIZE) {
+                    reader.cancel().catch(_.noop);
+                    return MAX_RESPONSE_SIZE_MESSAGE;
+                }
+                text += decoder.decode(chunk.value, { stream: true });
+                chunk = yield reader.read();
+            }
+            return text + decoder.decode();
+        });
+    }
     extractConfigHeaders(config) {
         let headers = {};
         if (config.headers) {
@@ -28585,33 +28717,7 @@ class NetworkRequestIntercept {
                 // Make the actual fetch call and capture response
                 try {
                     const res = yield networkInterceptor._originalFetch.apply(this, args);
-                    // Clone the response to avoid consuming the body
-                    const responseClone = res.clone();
-                    try {
-                        // Capture response data
-                        const responseBody = yield networkInterceptor.safelyReadBody(responseClone, 'response');
-                        const { status, statusText } = res;
-                        const headers = networkInterceptor.extractConfigHeaders(res);
-                        _.each(networkInterceptor.callbackFns, ({ response }) => {
-                            if (_.isFunction(response)) {
-                                response({
-                                    requestId,
-                                    status,
-                                    statusText,
-                                    body: responseBody,
-                                    headers,
-                                    url: transformedUrl,
-                                    method
-                                });
-                            }
-                        });
-                    }
-                    catch (e) {
-                        _.each(networkInterceptor.callbackFns, ({ error }) => {
-                            if (_.isFunction(error))
-                                error({ context: 'fetchResponse', error: e });
-                        });
-                    }
+                    networkInterceptor.captureResponse(res, { requestId, url: transformedUrl, method });
                     return res;
                 }
                 catch (error) {
@@ -28635,6 +28741,29 @@ class NetworkRequestIntercept {
             });
         };
     }
+    // Not awaited by the fetch wrapper: the app gets its response before the body is read
+    captureResponse(res, { requestId, url, method }) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                // Clone synchronously, before the app can consume the body
+                const responseClone = res.clone();
+                const body = yield this.safelyReadBody(responseClone, 'response');
+                const { status, statusText } = res;
+                const headers = this.extractConfigHeaders(res);
+                _.each(this.callbackFns, ({ response }) => {
+                    if (_.isFunction(response)) {
+                        response({ requestId, status, statusText, body, headers, url, method });
+                    }
+                });
+            }
+            catch (e) {
+                _.each(this.callbackFns, ({ error }) => {
+                    if (_.isFunction(error))
+                        error({ context: 'fetchResponse', error: e });
+                });
+            }
+        });
+    }
     patchXHR() {
         const networkInterceptor = this;
         networkInterceptor._originalSetRequestHeader = XMLHttpRequest.prototype.setRequestHeader;
@@ -29638,7 +29767,8 @@ const PluginAPI = {
     transmit: {
         buildBaseDataUrl,
         fetchKeepalive,
-        sendBeacon
+        sendBeacon,
+        shouldLoadWithPost
     },
     log,
     NetworkRequest,
@@ -33817,10 +33947,12 @@ function Poll(guide) {
             _.each(responses, function (response, i) {
                 var curPoll = getPoll(response.pollId, guide);
                 var evt = createGuideEvent('pollResponse', step.guideId, step.id, get_visitor_id(), undefined, guide.language);
+                // A behavior that replaces show() outright (HTML guides) drops the after('show')
+                // hook above, so fall back to when the step was last seen.
                 _.extend(evt.props, {
                     poll_id: response.pollId,
                     poll_response: response.value,
-                    duration: (new Date().getTime() - shownTime)
+                    duration: (new Date().getTime() - (shownTime || step.lastSeenAt))
                 }, options);
                 if (curPoll &&
                     curPoll.attributes &&
@@ -37132,7 +37264,11 @@ var Branding = (function () {
             return;
         var guide = pendo.findGuideById(props.guide_id);
         var guideContainer = guide.steps[0].guideElement[0].lastElementChild;
-        var verticalAlignment = guideContainer.dataset.verticalAlignment;
+        var verticalAlignment = guideContainer && guideContainer.dataset.verticalAlignment;
+        // Only Visual Design Studio containers carry the alignment the badge is placed by;
+        // an HTML guide's container has none.
+        if (!verticalAlignment)
+            return;
         var isBottomAligned = verticalAlignment.indexOf('Bottom') > -1;
         var isSetWidth = guideContainer.style.width !== '';
         var link = document.createElement('a');
@@ -41066,7 +41202,7 @@ var buildLauncherItem = function (guide) {
     dom(guideContainer).attr('id', 'launcher-' + guide.id);
     var guideLink = document.createElement('a');
     guideLink.href = '#';
-    guideLink.innerHTML = guide.name;
+    guideLink.appendChild(document.createTextNode(guide.name));
     guideContainer.appendChild(guideLink);
     return guideContainer;
 };
@@ -41752,7 +41888,7 @@ function SegmentFlags() {
         const jwtOptions = pluginApi.agent.getJwtInfoCopy();
         let payload;
         try {
-            if (url.length > pluginApi.constants.URL_MAX_LENGTH || !globalPendo._.isEmpty(jwtOptions)) {
+            if (pluginApi.transmit.shouldLoadWithPost(url, jwtOptions)) {
                 delete queryString.jzb;
                 url = pluginApi.transmit.buildBaseDataUrl('segmentflag.json', globalPendo.apiKey, queryString);
                 payload = globalPendo._.extend({ events: jzb }, jwtOptions);
@@ -42167,7 +42303,7 @@ class PromptPlugin {
         });
         const currentlyActiveIds = this._.map(this._.filter(this.prompts, prompt => prompt.isActive), prompt => prompt.id);
         this._.each(allAgents, aiAgent => {
-            if (this.isConversationAgent(aiAgent)) {
+            if (this.isConversationAgent(aiAgent) || this.isNetworkAgent(aiAgent)) {
                 return;
             }
             const isCurrentlyActive = this._.contains(currentlyActiveIds, aiAgent.id);
@@ -42192,30 +42328,21 @@ class PromptPlugin {
     isConversationAgent(agent) {
         return agent.preset && agent.preset != 'chatgpt';
     }
+    // network tracking is not supported; these agents are ignored rather than falling back to DOM.
+    isNetworkAgent(agent) {
+        return agent.trackingMethod === 'network';
+    }
     onConfigLoaded(aiAgents = []) {
         if (!aiAgents || !this._.isArray(aiAgents) || aiAgents.length === 0) {
             return;
         }
-        const networkAgents = [];
         const domAgents = [];
         for (const agent of aiAgents) {
-            if (this.isConversationAgent(agent)) {
+            if (this.isConversationAgent(agent) || this.isNetworkAgent(agent)) {
                 continue;
             }
-            if (agent.trackingMethod === 'network') {
-                networkAgents.push(agent);
-            }
-            else if (agent.trackingMethod === 'dom') {
-                domAgents.push(agent);
-            }
-            else {
-                // Default to DOM if no trackingMethod specified
-                domAgents.push(agent);
-            }
-        }
-        if (networkAgents.length > 0) {
-            this.networkAgents = networkAgents;
-            this.api.NetworkRequest.on({ request: this.handleRequest, error: this.handleError });
+            // Default to DOM if no trackingMethod specified
+            domAgents.push(agent);
         }
         // Cache agents for fast lookup
         if (!this.agentsCache) {
@@ -42236,29 +42363,6 @@ class PromptPlugin {
             }
         });
     }
-    handleRequest({ method, url, body }) {
-        const currentUrl = getNormalizedUrl();
-        this._.each(this.networkAgents, aiAgent => {
-            if (!this.testPageRule(aiAgent.pageRule, currentUrl, aiAgent.id)) {
-                return;
-            }
-            const originalBody = body || '';
-            this.api.analytics.collectEvent('prompt', {
-                prompt: originalBody,
-                agentId: aiAgent.id,
-                promptType: method,
-                url
-            }, undefined, 'agentic');
-        });
-    }
-    handleError({ error, context }) {
-        if (context == 'fetch') {
-            this.api.log.debug('[PromptPlugin] Fetch tracking failed:', error);
-        }
-        if (context == 'xhr') {
-            this.api.log.debug('[PromptPlugin] XHR tracking failed:', error);
-        }
-    }
     observePrompt(config) {
         const { id, cssSelectors } = config;
         // Check if agent already exists
@@ -42297,7 +42401,6 @@ class PromptPlugin {
         if (this.agentsCache) {
             this.agentsCache.clear();
         }
-        this.api.NetworkRequest.off({ request: this.handleRequest, error: this.handleError });
     }
 }
 var PromptAnalytics = new PromptPlugin();
@@ -43650,6 +43753,13 @@ function encodeMetadataForUrl(value, urlBeforePlaceholder = '') {
     }
     return window.encodeURI(str);
 }
+// Resolve through the browser's own URL parser: it strips tabs/newlines inside the scheme
+// (e.g. "java\tscript:"), which a regex over the raw string would miss.
+function hasDangerousUrlScheme(url) {
+    const anchor = document.createElement('a');
+    anchor.href = url;
+    return DANGEROUS_URL_SCHEME.test(anchor.protocol);
+}
 
 const MetadataSubstitution = {
     name: 'MetadataSubstitution',
@@ -43736,27 +43846,37 @@ function processPlaceholder(placeholder, pendo) {
     let match;
     const { data, target } = placeholder;
     const subRegex = new RegExp(guideMarkdownUtil.substitutionRegex);
+    const isUrlTarget = target === 'href' || target === 'value';
+    const startedWithDangerousScheme = isUrlTarget && hasDangerousUrlScheme(getRawTargetValue(data, target));
     while ((match = matchPlaceholder(placeholder, subRegex))) {
         const usedArrayPath = Array.isArray(match) && match.length >= 2;
         const currentStr = target === 'textContent'
             ? data[target]
-            : decodeURI((data.getAttribute && (target === 'href' || target === 'value') ? (data.getAttribute(target) || '') : data[target]));
+            : decodeURI(getRawTargetValue(data, target));
         const matched = usedArrayPath ? match : subRegex.exec(currentStr);
         if (!matched)
             continue;
         const mdValue = getSubstituteValue(matched, pendo);
         substituteMetadataByTarget(data, target, mdValue, matched);
+        // Substituted values can carry new placeholders into the next pass, so a dangerous
+        // scheme can be assembled across passes. Check the whole URL, not each fragment.
+        if (isUrlTarget && !startedWithDangerousScheme && hasDangerousUrlScheme(getRawTargetValue(data, target))) {
+            data[target] = '';
+            return;
+        }
     }
 }
+function getRawTargetValue(data, target) {
+    return data.getAttribute && (target === 'href' || target === 'value')
+        ? (data.getAttribute(target) || '')
+        : data[target];
+}
 function matchPlaceholder(placeholder, regex) {
     if (placeholder.target === 'textContent') {
         return placeholder.data[placeholder.target].match(regex);
     }
     else {
-        const raw = placeholder.data.getAttribute && (placeholder.target === 'href' || placeholder.target === 'value')
-            ? (placeholder.data.getAttribute(placeholder.target) || '')
-            : placeholder.data[placeholder.target];
-        return decodeURI(raw).match(regex);
+        return decodeURI(getRawTargetValue(placeholder.data, placeholder.target)).match(regex);
     }
 }
 function getMetadataValueCaseInsensitive(metadata, type, property) {
@@ -48001,7 +48121,7 @@ function serializeNodeWithId(n, options) {
   if (parent && isShadowRoot(parent) && isNativeShadowDom(parent)) {
     serializedNode.isShadow = true;
   }
-  if (serializedNode.type === NodeType.Element && serializedNode.tagName === "iframe") {
+  if (serializedNode.type === NodeType.Element && serializedNode.tagName === "iframe" && !_isBlockedElement(n, blockClass, blockSelector)) {
     onceIframeLoaded(
       n,
       () => {
@@ -50151,11 +50271,15 @@ class IframeManager {
     __publicField(this, "pageHideListener");
     __publicField(this, "stylesheetManager");
     __publicField(this, "recordCrossOriginIframes");
+    __publicField(this, "blockClass");
+    __publicField(this, "blockSelector");
     this.mutationCb = options.mutationCb;
     this.wrappedEmit = options.wrappedEmit;
     this.takeFullSnapshot = options.takeFullSnapshot;
     this.stylesheetManager = options.stylesheetManager;
     this.recordCrossOriginIframes = options.recordCrossOriginIframes;
+    this.blockClass = options.blockClass;
+    this.blockSelector = options.blockSelector;
     this.crossOriginIframeStyleMirror = new CrossOriginIframeMirror(
       this.stylesheetManager.styleMirror.generateId.bind(
         this.stylesheetManager.styleMirror
@@ -50170,6 +50294,7 @@ class IframeManager {
     this.takeFullSnapshot = takeFullSnapshot2;
   }
   addIframe(iframeEl) {
+    if (isBlocked(iframeEl, this.blockClass, this.blockSelector, false)) return;
     this.iframes.set(iframeEl, true);
     if (iframeEl.contentWindow)
       this.crossOriginIframeMap.set(iframeEl.contentWindow, iframeEl);
@@ -51294,6 +51419,8 @@ function record(options = {}) {
     mutationCb: wrappedMutationEmit,
     stylesheetManager,
     recordCrossOriginIframes,
+    blockClass,
+    blockSelector,
     wrappedEmit,
     takeFullSnapshot
   });
@@ -53413,6 +53540,7 @@ function createReplayPlugin() {
 /**
  * limit of number of keys in an object
  * if an object contains more keys than this limit, we would call its toString function directly
+ * arrays longer than this limit are cut down to their first NUM_OF_KEYS_LIMIT elements
  */
 const NUM_OF_KEYS_LIMIT = 50;
 /**
@@ -53484,8 +53612,9 @@ function shouldIgnore(_obj) {
 /**
  * stringify any argument
  * @param arg - the arg to stringify
+ * @param maxLength - stop serializing once this many characters have been visited
  */
-function stringify(arg) {
+function stringify(arg, maxLength = Infinity) {
     if (arg === undefined)
         return 'undefined';
     // Handle primitives
@@ -53496,11 +53625,19 @@ function stringify(arg) {
             return arg.toString();
         return String(arg);
     }
+    let charsVisited = 0;
     return JSON.stringify(arg, function (key, value) {
+        if (charsVisited > maxLength)
+            return '';
+        const valueLength = typeof value === 'string' ? value.length : 0;
+        charsVisited += key.length + valueLength;
         if (value === null)
             return value;
         if (value === undefined)
             return 'undefined';
+        if (Array.isArray(value) && value.length > NUM_OF_KEYS_LIMIT) {
+            return value.slice(0, NUM_OF_KEYS_LIMIT);
+        }
         // Handle objects
         if (shouldIgnore(value)) {
             return value.toString ? value.toString() : '[object Object]';
@@ -54127,8 +54264,11 @@ function ConsoleCapture() {
     let isRecordingActive = false;
     const CAPTURE_CONSOLE_CONFIG = 'captureConsoleLogs';
     const ALWAYS_CAPTURE_ERRORS_CONFIG = 'alwaysCaptureDevLogErrors';
+    const CONSOLE_LOG_LEVELS_CONFIG = 'consoleLogLevels';
     const CONSOLE_METHODS = ['log', 'warn', 'error', 'info'];
     const DEV_LOG_SUB_TYPE = 'console';
+    const DEFAULT_CONSOLE_LOG_LEVELS = ['error', 'warn', 'info'];
+    let consoleLogLevels = DEFAULT_CONSOLE_LOG_LEVELS;
     // deduplicate logs
     let lastLogKey = '';
     return {
@@ -54147,6 +54287,8 @@ function ConsoleCapture() {
         onPtmPaused,
         onPtmUnpaused,
         securityPolicyViolationFn,
+        uncaughtErrorFn,
+        unhandledRejectionFn,
         get isCapturingConsoleLogs() {
             return isCapturingConsoleLogs;
         },
@@ -54166,10 +54308,12 @@ function ConsoleCapture() {
         const { ConfigReader } = pluginAPI;
         ConfigReader.addOption(CAPTURE_CONSOLE_CONFIG, [ConfigReader.sources.PENDO_CONFIG_SRC], false);
         ConfigReader.addOption(ALWAYS_CAPTURE_ERRORS_CONFIG, [ConfigReader.sources.PENDO_CONFIG_SRC], false);
+        ConfigReader.addOption(CONSOLE_LOG_LEVELS_CONFIG, [ConfigReader.sources.PENDO_CONFIG_SRC], DEFAULT_CONSOLE_LOG_LEVELS);
         const captureConsoleEnabled = ConfigReader.get(CAPTURE_CONSOLE_CONFIG);
         if (!captureConsoleEnabled)
             return;
         alwaysCaptureErrors = !!ConfigReader.get(ALWAYS_CAPTURE_ERRORS_CONFIG);
+        consoleLogLevels = ConfigReader.get(CONSOLE_LOG_LEVELS_CONFIG);
         globalPendo = pendo;
         buffer = new DevlogBuffer(pendo, pluginAPI);
         transport = new DevlogTransport(pendo, pluginAPI);
@@ -54230,6 +54374,8 @@ function ConsoleCapture() {
         try {
             addIntercepts();
             pluginAPI.attachEventInternal(window, 'securitypolicyviolation', securityPolicyViolationFn);
+            pluginAPI.attachEventInternal(window, 'error', uncaughtErrorFn);
+            pluginAPI.attachEventInternal(window, 'unhandledrejection', unhandledRejectionFn);
         }
         catch (error) {
             pluginAPI.log.error('Error setting up console capture intercepts: ', error);
@@ -54270,16 +54416,36 @@ function ConsoleCapture() {
             createConsoleEvent([message], 'error', { skipStackTrace: true, skipScrubPII: true });
         }
     }
+    function uncaughtErrorFn(evt) {
+        if (!evt || typeof evt !== 'object')
+            return;
+        const rawMessage = evt.message || (evt.error && String(evt.error));
+        if (!rawMessage)
+            return;
+        const message = rawMessage.indexOf('Uncaught') === 0 ? rawMessage : `Uncaught ${rawMessage}`;
+        const stackTrace = evt.error && evt.error.stack;
+        createConsoleEvent([stackTrace ? `${message}\n${stackTrace}` : message], 'error', { skipStackTrace: true });
+    }
+    function unhandledRejectionFn(evt) {
+        if (!evt || typeof evt !== 'object')
+            return;
+        const { reason } = evt;
+        const detail = reason && reason.stack ? reason.stack : reason;
+        createConsoleEvent(['Uncaught (in promise)', detail], 'error', { skipStackTrace: true });
+    }
     function createConsoleEvent(args, methodName, { skipStackTrace = false, skipScrubPII = false } = {}) {
         if (!isCapturingConsoleLogs || !args || args.length === 0 || !_.contains(CONSOLE_METHODS, methodName))
             return;
         if (isErrorOnlyCapture() && methodName !== 'error')
             return;
+        const devLogLevel = methodName === 'log' ? 'info' : methodName;
+        if (!_.contains(consoleLogLevels, devLogLevel))
+            return;
         // stringify args
         let message = _.compact(_.map(args, arg => {
             let stringifiedArg;
             try {
-                stringifiedArg = stringify(arg);
+                stringifiedArg = stringify(arg, MAX_LENGTH);
             }
             catch (error) {
                 pluginAPI.log.error('Error stringifying arg: ', error);
@@ -54303,10 +54469,10 @@ function ConsoleCapture() {
             buffer.lastEvent.devLogCount++;
             return;
         }
-        const devLogEnvelope = createDevLogEnvelope(pluginAPI, globalPendo);
-        const consoleEvent = Object.assign(Object.assign({}, devLogEnvelope), { subType: DEV_LOG_SUB_TYPE, devLogLevel: methodName === 'log' ? 'info' : methodName, devLogMessage: skipScrubPII ? message : scrubPII({ string: message, _ }), devLogTrace: stackTrace, devLogCount: 1 });
         if (!buffer.hasTokenAvailable())
-            return consoleEvent;
+            return;
+        const devLogEnvelope = createDevLogEnvelope(pluginAPI, globalPendo);
+        const consoleEvent = Object.assign(Object.assign({}, devLogEnvelope), { subType: DEV_LOG_SUB_TYPE, devLogLevel, devLogMessage: skipScrubPII ? message : scrubPII({ string: message, _ }), devLogTrace: stackTrace, devLogCount: 1 });
         if (!isPtmPaused) {
             pluginAPI.Events.eventCaptured.trigger(consoleEvent);
         }
@@ -54364,6 +54530,8 @@ function ConsoleCapture() {
         pluginAPI.Events['recording:unpaused'].off(recordingStarted);
         pluginAPI.Events['recording:paused'].off(recordingStopped);
         pluginAPI.detachEventInternal(window, 'securitypolicyviolation', securityPolicyViolationFn);
+        pluginAPI.detachEventInternal(window, 'error', uncaughtErrorFn);
+        pluginAPI.detachEventInternal(window, 'unhandledrejection', unhandledRejectionFn);
         _.each(CONSOLE_METHODS, function (methodName) {
             if (!console[methodName])
                 return _.noop;