@polishd/next 0.2.2-dev.4 → 0.2.3-dev.0

package/dist/shared/error-noise.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Polishd — browser-extension error noise.
+ *
+ * A page's `error` and `unhandledrejection` handlers hear everything that
+ * throws in the tab, not just the site's own code. Extensions inject scripts
+ * into the page context, and when they fail — a wallet that can't reach its
+ * background worker, a content script whose port closed on navigation — the
+ * throw surfaces on `window` exactly like a real bug would. "Failed to connect
+ * to MetaMask" is the canonical one: nothing on the site can cause it, nothing
+ * on the site can fix it, and left unfiltered it can be the loudest error the
+ * dashboard shows.
+ *
+ * These are pure predicates, shared rather than client-local, so the browser
+ * capture layer and the ingest endpoint apply the same rule — a cached bundle
+ * can lag a config change by a full session, so the server keeps its own copy
+ * of the decision (the same reasoning as the dashboard-path exclusion).
+ */
+/** True when `url` was served by an extension or the browser, not the site. */
+export declare function isExtensionUrl(url: string): boolean;
+/** The shape of an error, reduced to what both the client and ingest can see. */
+export interface ErrorSignature {
+    /** The thrown message, already stringified. */
+    message: string;
+    /** The failing script's URL, if the browser gave one. */
+    source?: string;
+    /** The stack, when available. Only the client has this. */
+    stack?: string;
+    /** Extra ignore patterns from the host app's config. */
+    ignore?: readonly (string | RegExp)[];
+}
+/**
+ * True when this error is noise the site's owner cannot act on.
+ *
+ * Checked in order of confidence: where the script came from, then what the
+ * stack blames, then the small set of messages extension messaging emits, then
+ * the opaque cross-origin case, then whatever the host app chose to ignore.
+ */
+export declare function isIgnorableError({ message, source, stack, ignore }: ErrorSignature): boolean;
+//# sourceMappingURL=error-noise.d.ts.map

package/dist/shared/error-noise.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-noise.d.ts","sourceRoot":"","sources":["../../src/shared/error-noise.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA8CH,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOnD;AAED,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,MAAM,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;CACvC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAW,EAAE,KAAU,EAAE,MAAM,EAAE,EAAE,cAAc,GAAG,OAAO,CAiBtG"}

package/dist/shared/error-noise.js

@@ -0,0 +1,101 @@
+/**
+ * Polishd — browser-extension error noise.
+ *
+ * A page's `error` and `unhandledrejection` handlers hear everything that
+ * throws in the tab, not just the site's own code. Extensions inject scripts
+ * into the page context, and when they fail — a wallet that can't reach its
+ * background worker, a content script whose port closed on navigation — the
+ * throw surfaces on `window` exactly like a real bug would. "Failed to connect
+ * to MetaMask" is the canonical one: nothing on the site can cause it, nothing
+ * on the site can fix it, and left unfiltered it can be the loudest error the
+ * dashboard shows.
+ *
+ * These are pure predicates, shared rather than client-local, so the browser
+ * capture layer and the ingest endpoint apply the same rule — a cached bundle
+ * can lag a config change by a full session, so the server keeps its own copy
+ * of the decision (the same reasoning as the dashboard-path exclusion).
+ */
+/**
+ * URL schemes that only ever belong to an extension or the browser itself.
+ * If the failing script came from one of these, the site did not load it.
+ */
+const EXTENSION_SCHEMES = [
+    "chrome-extension://",
+    "moz-extension://",
+    "safari-extension://",
+    "safari-web-extension://",
+    "ms-browser-extension://",
+    "extension://", // unknown vendors, and the bare form some builds report
+    "webkit-masked-url://", // Safari's opaque stand-in for injected scripts
+    "resource://", // Firefox internals and legacy add-ons
+    "chrome://", // browser-internal pages and resources
+];
+/**
+ * Messages produced by extension plumbing running *in page context*, where the
+ * filename is the page's own URL and the scheme check above can't help.
+ *
+ * Deliberately narrow: each of these is a string the extension messaging layer
+ * itself emits, not something a site's code would produce. Broad matching here
+ * (say, anything mentioning MetaMask) would swallow a dapp's genuine wallet
+ * errors, which are real bugs worth seeing.
+ */
+const EXTENSION_MESSAGE_PATTERNS = [
+    /failed to connect to metamask/i,
+    /could not establish connection\.\s*receiving end does not exist/i,
+    /the message port closed before a response was received/i,
+    /extension context invalidated/i,
+    /^chrome\.runtime\b/i,
+];
+/**
+ * The browser's placeholder for an error thrown by a cross-origin script it
+ * won't describe: no message, no file, no line. Extensions and third-party
+ * embeds are the usual sources, and either way there is nothing here to act
+ * on — the event is a report that *something* failed, with every detail
+ * stripped.
+ */
+function isOpaqueError(message, source) {
+    return /^script error\.?$/i.test(message.trim()) && !source;
+}
+/** True when `url` was served by an extension or the browser, not the site. */
+export function isExtensionUrl(url) {
+    // `blob:` and `filesystem:` wrap the origin that minted them, so an
+    // extension's blob reads as `blob:chrome-extension://…` — unwrap before
+    // testing the scheme, or code an extension generated at runtime slips past.
+    const u = url.trim().toLowerCase().replace(/^(?:blob|filesystem):/, "");
+    if (!u)
+        return false;
+    return EXTENSION_SCHEMES.some((scheme) => u.startsWith(scheme));
+}
+/**
+ * True when this error is noise the site's owner cannot act on.
+ *
+ * Checked in order of confidence: where the script came from, then what the
+ * stack blames, then the small set of messages extension messaging emits, then
+ * the opaque cross-origin case, then whatever the host app chose to ignore.
+ */
+export function isIgnorableError({ message, source = "", stack = "", ignore }) {
+    if (isExtensionUrl(source))
+        return true;
+    // A stack is a list of frames, not a single URL, so this looks anywhere in
+    // it: injected code often has the page as its top frame and the extension
+    // further down.
+    const lowerStack = stack.toLowerCase();
+    if (lowerStack && EXTENSION_SCHEMES.some((scheme) => lowerStack.includes(scheme)))
+        return true;
+    if (EXTENSION_MESSAGE_PATTERNS.some((re) => re.test(message)))
+        return true;
+    if (isOpaqueError(message, source))
+        return true;
+    if (ignore?.length) {
+        for (const pattern of ignore) {
+            if (typeof pattern === "string") {
+                if (pattern && message.toLowerCase().includes(pattern.toLowerCase()))
+                    return true;
+            }
+            else if (pattern.test(message))
+                return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=error-noise.js.map

package/dist/shared/error-noise.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-noise.js","sourceRoot":"","sources":["../../src/shared/error-noise.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;GAGG;AACH,MAAM,iBAAiB,GAAG;IACxB,qBAAqB;IACrB,kBAAkB;IAClB,qBAAqB;IACrB,yBAAyB;IACzB,yBAAyB;IACzB,cAAc,EAAE,wDAAwD;IACxE,sBAAsB,EAAE,gDAAgD;IACxE,aAAa,EAAE,uCAAuC;IACtD,WAAW,EAAE,uCAAuC;CACrD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,0BAA0B,GAAa;IAC3C,gCAAgC;IAChC,kEAAkE;IAClE,yDAAyD;IACzD,gCAAgC;IAChC,qBAAqB;CACtB,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,OAAe,EAAE,MAAc;IACpD,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;AAC9D,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,oEAAoE;IACpE,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;IACxE,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAClE,CAAC;AAcD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG,EAAE,EAAE,MAAM,EAAkB;IAC3F,IAAI,cAAc,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,2EAA2E;IAC3E,0EAA0E;IAC1E,gBAAgB;IAChB,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,UAAU,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/F,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,IAAI,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;QACnB,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;YAC7B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChC,IAAI,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;oBAAE,OAAO,IAAI,CAAC;YACpF,CAAC;iBAAM,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;QAChD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/docs/SETUP.md

@@ -476,9 +476,34 @@ export default definePolishdConfig({
   rageClick: { count: 3, windowMs: 500 },     // N clicks on one element
   flushIntervalMs: 10_000,
   dashboardRoute: "/polishd",                 // never captured; see below
+  ignoreErrors: [],                           // extra error messages to drop
 });
 ```
 
+Errors thrown by **browser extensions are dropped automatically**. Your page's
+`error` handler hears every throw in the tab, not just your code's, so a wallet
+extension failing to reach its background worker ("Failed to connect to
+MetaMask") would otherwise land in your dashboard as one of your site's loudest
+bugs.
+
+This isn't a list of known extensions — it's worked out per error. The browser
+records every script your document actually fetched (Resource Timing), and
+extension code is never in it: the browser injects content scripts, your page
+never asked for them. So an error is classified by where its stack points:
+
+| Verdict | Meaning | What happens |
+| --- | --- | --- |
+| `site` | every frame is code you shipped — including third-party scripts your page loads, like Stripe | recorded normally |
+| `extension` | a frame names an extension URL | dropped |
+| `foreign` | a frame names a script your document never loaded | recorded, marked *not your code* |
+| `unknown` | nothing attributable — an opaque cross-origin `Script error.`, an empty stack | recorded, marked *unattributable* |
+
+Only `extension` is dropped, because only it is certain. The other two are
+shown dimmed in Recent errors rather than hidden — a filter that quietly
+discards what it can't identify is how a real bug goes missing. `ignoreErrors`
+is the escape hatch if you want them gone anyway: strings match
+case-insensitively anywhere in the message, regexes are tested as-is.
+
 The dashboard's own traffic is **never captured**. Reading your analytics is
 browsing too, and left alone it would rank "Refresh summary" as your site's
 most-used feature. Nothing on `dashboardRoute` (or below it) is collected, and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polishd/next",
-  "version": "0.2.2-dev.4",
+  "version": "0.2.3-dev.0",
   "description": "Drop-in product analytics for Next.js — capture real user behavioral signals (rage/dead clicks, scroll depth, errors, web vitals) and explore them on a built-in dashboard. What gets measured gets improved.",
   "type": "module",
   "license": "MIT",
@@ -75,6 +75,7 @@
   "scripts": {
     "build": "tsc -p tsconfig.build.json && npm run build:css",
     "typecheck": "tsc -p tsconfig.json",
+    "test": "node --experimental-strip-types --test \"src/**/*.test.ts\"",
     "clean": "rm -rf dist",
     "prepublishOnly": "npm run clean && npm run build",
     "build:css": "node scripts/build-css.mjs"
@@ -84,6 +85,10 @@
     "react": ">=18",
     "react-dom": ">=18"
   },
+  "dependencies": {
+    "allpages": "^0.3.3",
+    "playwright-core": "^1.62.1"
+  },
   "optionalDependencies": {
     "pg": "^8.0.0"
   },