@posthog/browser-common 0.2.5 → 0.3.1

package/README.md

@@ -56,14 +56,15 @@ What an extension is given in `setup` — the adapter shared by extensions on th
 
 - **identity and session**: `distinctId`, `anonymousId`, `groups`, `session`
 - **events**: `capture(...)`, `registerDynamicEventProperties(...)`, `onEvent(...)`
-- **server config**: `getRemoteConfig()` and `onRemoteConfig(...)`
+- **server config**: `onRemoteConfig(...)`
 - **transport**: `projectToken`, `sendRequest(path, init?)`
 - **storage and logging**: `kv`, `logger`
 
 Identity, session, and the public project token are always-ready synchronous
 reads. Operations that may perform I/O, including `capture`, `sendRequest`,
-`kv`, and `getRemoteConfig`, are awaitable. Extensions that want a named log
-prefix can create a child with `client.logger.createLogger('[myExtension]')`.
+and `kv`, are awaitable. `onRemoteConfig` immediately replays the latest known
+success or failure and then reports subsequent outcomes. Extensions that want a
+named log prefix can create a child with `client.logger.createLogger('[myExtension]')`.
 
 ### Host runtime
 

package/dist/client.d.ts

@@ -3,7 +3,7 @@ import type { Properties } from '@posthog/types';
 import type { Disposable } from './disposable';
 import type { KeyValueStore } from './persistence';
 import type { Listener } from './pubsub';
-import type { RemoteConfig } from './types/remote-config';
+import type { RemoteConfigResult } from './types/remote-config';
 /** Recursively marks object properties as readonly while preserving callable values. */
 export type DeepReadonly<T> = T extends (...args: never[]) => unknown ? T : T extends object ? {
     readonly [K in keyof T]: DeepReadonly<T[K]>;
@@ -87,10 +87,8 @@ export interface Client {
     registerDynamicEventProperties(producer: () => Record<string, unknown>): Disposable;
     /** Fires for every captured event through a deeply readonly view. */
     readonly onEvent: Listener<CapturedEventInfo>;
-    /** Resolves with the current remote config, awaiting the first outcome when necessary. */
-    getRemoteConfig(): Promise<DeepReadonly<RemoteConfig> | undefined>;
-    /** Fires when server-provided config arrives or changes successfully. */
-    readonly onRemoteConfig: Listener<DeepReadonly<RemoteConfig>>;
+    /** Replays the latest remote-config outcome on subscription and fires for subsequent outcomes. */
+    readonly onRemoteConfig: Listener<DeepReadonly<RemoteConfigResult>>;
     /** Public project token used to authenticate endpoint-specific requests. */
     readonly projectToken: string;
     /** Sends a request through the host SDK's transport. */

package/dist/config.js

@@ -26,7 +26,7 @@ __webpack_require__.r(__webpack_exports__);
 __webpack_require__.d(__webpack_exports__, {
     default: ()=>__WEBPACK_DEFAULT_EXPORT__
 });
-const packageVersion = "0.2.5";
+const packageVersion = "0.3.1";
 const Config = {
     DEBUG: false,
     LIB_VERSION: packageVersion,

package/dist/config.mjs

@@ -1,4 +1,4 @@
-const packageVersion = "0.2.5";
+const packageVersion = "0.3.1";
 const Config = {
     DEBUG: false,
     LIB_VERSION: packageVersion,

package/dist/pubsub.d.ts

@@ -2,8 +2,9 @@ import { type Disposable } from './disposable';
 /**
  * Call it with a handler to start listening; dispose the returned
  * {@link Disposable} to stop. There is one `Listener` per event type, so every
- * event carries its own payload type. The handler is called synchronously for
- * each future payload, and the returned disposable unregisters it.
+ * event carries its own payload type. The handler is called synchronously, and
+ * stateful listeners may replay their current value during registration when
+ * documented. The returned disposable unregisters it from future payloads.
  */
 export type Listener<T> = (handler: (payload: T) => void) => Disposable;
 /**

package/dist/types/remote-config.d.ts

@@ -178,3 +178,10 @@ export interface RemoteConfig {
     /** Conversations widget configuration. */
     conversations?: boolean | ConversationsRemoteConfig;
 }
+/** The latest outcome of loading remote configuration from PostHog. */
+export type RemoteConfigResult = {
+    ok: true;
+    config: RemoteConfig;
+} | {
+    ok: false;
+};

package/dist/utils/autocapture-utils.js

@@ -334,18 +334,68 @@ function isSensitiveElement(el) {
 }
 const coreCCPattern = "(4[0-9]{12}(?:[0-9]{3})?)|(5[1-5][0-9]{14})|(6(?:011|5[0-9]{2})[0-9]{12})|(3[47][0-9]{13})|(3(?:0[0-5]|[68][0-9])[0-9]{11})|((?:2131|1800|35[0-9]{3})[0-9]{11})";
 const anchoredCCRegex = new RegExp(`^(?:${coreCCPattern})$`);
-const unanchoredCCRegex = new RegExp(coreCCPattern);
+const networkCCCandidateRegex = /(^|[^0-9A-Za-z_])([0-9][0-9 -]*[0-9])(?=$|[^0-9A-Za-z_])/g;
+const networkCCLengths = [
+    16,
+    15,
+    14,
+    13
+];
 const coreSSNPattern = "\\d{3}-?\\d{2}-?\\d{4}";
 const anchoredSSNRegex = new RegExp(`^(${coreSSNPattern})$`);
-const unanchoredSSNRegex = new RegExp(`(${coreSSNPattern})`);
+const networkSSNPattern = "(?!000|666)[0-9]{3}-?(?!00)[0-9]{2}-?(?!0000)[0-9]{4}";
+const networkSSNCandidateRegex = new RegExp(`(^|[^0-9])(${networkSSNPattern})(?=$|([^0-9]))`, 'g');
+const identifierCharacterRegex = /[0-9A-Za-z_]/;
+function passesLuhnCheck(value) {
+    let sum = 0;
+    let shouldDouble = false;
+    for(let i = value.length - 1; i >= 0; i--){
+        let digit = value.charCodeAt(i) - 48;
+        if (shouldDouble) {
+            digit *= 2;
+            if (digit > 9) digit -= 9;
+        }
+        sum += digit;
+        shouldDouble = !shouldDouble;
+    }
+    return sum % 10 === 0;
+}
+function containsCreditCardNumber(value) {
+    networkCCCandidateRegex.lastIndex = 0;
+    let match;
+    while(match = networkCCCandidateRegex.exec(value)){
+        const matchedCandidate = match[2];
+        if (!matchedCandidate) continue;
+        const candidate = matchedCandidate.replace(/[- ]/g, '');
+        for(let start = 0; start < candidate.length; start++)for (const length of networkCCLengths){
+            const end = start + length;
+            if (end <= candidate.length) {
+                const possibleCardNumber = candidate.slice(start, end);
+                if (anchoredCCRegex.test(possibleCardNumber) && passesLuhnCheck(possibleCardNumber)) return true;
+            }
+        }
+    }
+    return false;
+}
+function containsSSN(value) {
+    networkSSNCandidateRegex.lastIndex = 0;
+    let match;
+    while(match = networkSSNCandidateRegex.exec(value)){
+        const characterBefore = match[1];
+        const characterAfter = match[3];
+        if (characterBefore && characterAfter && identifierCharacterRegex.test(characterBefore) && identifierCharacterRegex.test(characterAfter)) continue;
+        return true;
+    }
+    return false;
+}
 function shouldCaptureValue(value, anchorRegexes = true) {
     if ((0, core_namespaceObject.isNullish)(value)) return false;
     if ((0, core_namespaceObject.isString)(value)) {
         value = (0, core_namespaceObject.trim)(value);
-        const ccRegex = anchorRegexes ? anchoredCCRegex : unanchoredCCRegex;
-        if (ccRegex.test((value || '').replace(/[- ]/g, ''))) return false;
-        const ssnRegex = anchorRegexes ? anchoredSSNRegex : unanchoredSSNRegex;
-        if (ssnRegex.test(value)) return false;
+        const containsCreditCard = anchorRegexes ? anchoredCCRegex.test((value || '').replace(/[- ]/g, '')) : containsCreditCardNumber(value);
+        if (containsCreditCard) return false;
+        const containsSocialSecurityNumber = anchorRegexes ? anchoredSSNRegex.test(value) : containsSSN(value);
+        if (containsSocialSecurityNumber) return false;
     }
     return true;
 }

package/dist/utils/autocapture-utils.mjs

@@ -286,18 +286,68 @@ function isSensitiveElement(el) {
 }
 const coreCCPattern = "(4[0-9]{12}(?:[0-9]{3})?)|(5[1-5][0-9]{14})|(6(?:011|5[0-9]{2})[0-9]{12})|(3[47][0-9]{13})|(3(?:0[0-5]|[68][0-9])[0-9]{11})|((?:2131|1800|35[0-9]{3})[0-9]{11})";
 const anchoredCCRegex = new RegExp(`^(?:${coreCCPattern})$`);
-const unanchoredCCRegex = new RegExp(coreCCPattern);
+const networkCCCandidateRegex = /(^|[^0-9A-Za-z_])([0-9][0-9 -]*[0-9])(?=$|[^0-9A-Za-z_])/g;
+const networkCCLengths = [
+    16,
+    15,
+    14,
+    13
+];
 const coreSSNPattern = "\\d{3}-?\\d{2}-?\\d{4}";
 const anchoredSSNRegex = new RegExp(`^(${coreSSNPattern})$`);
-const unanchoredSSNRegex = new RegExp(`(${coreSSNPattern})`);
+const networkSSNPattern = "(?!000|666)[0-9]{3}-?(?!00)[0-9]{2}-?(?!0000)[0-9]{4}";
+const networkSSNCandidateRegex = new RegExp(`(^|[^0-9])(${networkSSNPattern})(?=$|([^0-9]))`, 'g');
+const identifierCharacterRegex = /[0-9A-Za-z_]/;
+function passesLuhnCheck(value) {
+    let sum = 0;
+    let shouldDouble = false;
+    for(let i = value.length - 1; i >= 0; i--){
+        let digit = value.charCodeAt(i) - 48;
+        if (shouldDouble) {
+            digit *= 2;
+            if (digit > 9) digit -= 9;
+        }
+        sum += digit;
+        shouldDouble = !shouldDouble;
+    }
+    return sum % 10 === 0;
+}
+function containsCreditCardNumber(value) {
+    networkCCCandidateRegex.lastIndex = 0;
+    let match;
+    while(match = networkCCCandidateRegex.exec(value)){
+        const matchedCandidate = match[2];
+        if (!matchedCandidate) continue;
+        const candidate = matchedCandidate.replace(/[- ]/g, '');
+        for(let start = 0; start < candidate.length; start++)for (const length of networkCCLengths){
+            const end = start + length;
+            if (end <= candidate.length) {
+                const possibleCardNumber = candidate.slice(start, end);
+                if (anchoredCCRegex.test(possibleCardNumber) && passesLuhnCheck(possibleCardNumber)) return true;
+            }
+        }
+    }
+    return false;
+}
+function containsSSN(value) {
+    networkSSNCandidateRegex.lastIndex = 0;
+    let match;
+    while(match = networkSSNCandidateRegex.exec(value)){
+        const characterBefore = match[1];
+        const characterAfter = match[3];
+        if (characterBefore && characterAfter && identifierCharacterRegex.test(characterBefore) && identifierCharacterRegex.test(characterAfter)) continue;
+        return true;
+    }
+    return false;
+}
 function shouldCaptureValue(value, anchorRegexes = true) {
     if (isNullish(value)) return false;
     if (isString(value)) {
         value = trim(value);
-        const ccRegex = anchorRegexes ? anchoredCCRegex : unanchoredCCRegex;
-        if (ccRegex.test((value || '').replace(/[- ]/g, ''))) return false;
-        const ssnRegex = anchorRegexes ? anchoredSSNRegex : unanchoredSSNRegex;
-        if (ssnRegex.test(value)) return false;
+        const containsCreditCard = anchorRegexes ? anchoredCCRegex.test((value || '').replace(/[- ]/g, '')) : containsCreditCardNumber(value);
+        if (containsCreditCard) return false;
+        const containsSocialSecurityNumber = anchorRegexes ? anchoredSSNRegex.test(value) : containsSSN(value);
+        if (containsSocialSecurityNumber) return false;
     }
     return true;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@posthog/browser-common",
-  "version": "0.2.5",
+  "version": "0.3.1",
   "description": "Internal shared browser utilities and extension primitives for PostHog Browser SDKs",
   "license": "MIT",
   "repository": {
@@ -65,8 +65,8 @@
     }
   },
   "dependencies": {
-    "@posthog/core": "^1.45.3",
-    "@posthog/types": "^1.399.0"
+    "@posthog/types": "^1.399.0",
+    "@posthog/core": "^1.46.0"
   },
   "devDependencies": {
     "@rslib/core": "0.10.6",