@posthog/core 1.48.6 → 1.48.7

package/dist/utils/index.js

@@ -89,13 +89,15 @@ var __webpack_exports__ = {};
         removeTrailingSlash: ()=>removeTrailingSlash,
         retriable: ()=>retriable,
         safeSetTimeout: ()=>safeSetTimeout,
-        stripUrlHash: ()=>stripUrlHash
+        stripUrlHash: ()=>stripUrlHash,
+        toJsonSafeValue: ()=>_json_utils__WEBPACK_IMPORTED_MODULE_3__.toJsonSafeValue
     });
     var _bot_detection__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__("./bot-detection");
     var __WEBPACK_REEXPORT_OBJECT__ = {};
     for(var __WEBPACK_IMPORT_KEY__ in _bot_detection__WEBPACK_IMPORTED_MODULE_0__)if ([
         "removeTrailingSlash",
         "isValidUUID",
+        "toJsonSafeValue",
         "currentISOTime",
         "safeSetTimeout",
         "UUID_REGEX",
@@ -119,6 +121,7 @@ var __webpack_exports__ = {};
     for(var __WEBPACK_IMPORT_KEY__ in _browser_utils__WEBPACK_IMPORTED_MODULE_1__)if ([
         "removeTrailingSlash",
         "isValidUUID",
+        "toJsonSafeValue",
         "currentISOTime",
         "safeSetTimeout",
         "UUID_REGEX",
@@ -142,6 +145,7 @@ var __webpack_exports__ = {};
     for(var __WEBPACK_IMPORT_KEY__ in _bucketed_rate_limiter__WEBPACK_IMPORTED_MODULE_2__)if ([
         "removeTrailingSlash",
         "isValidUUID",
+        "toJsonSafeValue",
         "currentISOTime",
         "safeSetTimeout",
         "UUID_REGEX",
@@ -161,33 +165,12 @@ var __webpack_exports__ = {};
     }).bind(0, __WEBPACK_IMPORT_KEY__);
     __webpack_require__.d(__webpack_exports__, __WEBPACK_REEXPORT_OBJECT__);
     var _json_utils__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__("./json-utils");
-    var __WEBPACK_REEXPORT_OBJECT__ = {};
-    for(var __WEBPACK_IMPORT_KEY__ in _json_utils__WEBPACK_IMPORTED_MODULE_3__)if ([
-        "removeTrailingSlash",
-        "isValidUUID",
-        "currentISOTime",
-        "safeSetTimeout",
-        "UUID_REGEX",
-        "assert",
-        "allSettled",
-        "retriable",
-        "default",
-        "stripUrlHash",
-        "STRING_FORMAT",
-        "currentTimestamp",
-        "raceWithTimeout",
-        "getFetch",
-        "getEventUuid",
-        "isPromise"
-    ].indexOf(__WEBPACK_IMPORT_KEY__) < 0) __WEBPACK_REEXPORT_OBJECT__[__WEBPACK_IMPORT_KEY__] = (function(key) {
-        return _json_utils__WEBPACK_IMPORTED_MODULE_3__[key];
-    }).bind(0, __WEBPACK_IMPORT_KEY__);
-    __webpack_require__.d(__webpack_exports__, __WEBPACK_REEXPORT_OBJECT__);
     var _number_utils__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__("./number-utils");
     var __WEBPACK_REEXPORT_OBJECT__ = {};
     for(var __WEBPACK_IMPORT_KEY__ in _number_utils__WEBPACK_IMPORTED_MODULE_4__)if ([
         "removeTrailingSlash",
         "isValidUUID",
+        "toJsonSafeValue",
         "currentISOTime",
         "safeSetTimeout",
         "UUID_REGEX",
@@ -211,6 +194,7 @@ var __webpack_exports__ = {};
     for(var __WEBPACK_IMPORT_KEY__ in _string_utils__WEBPACK_IMPORTED_MODULE_5__)if ([
         "removeTrailingSlash",
         "isValidUUID",
+        "toJsonSafeValue",
         "currentISOTime",
         "safeSetTimeout",
         "UUID_REGEX",
@@ -234,6 +218,7 @@ var __webpack_exports__ = {};
     for(var __WEBPACK_IMPORT_KEY__ in _type_utils__WEBPACK_IMPORTED_MODULE_6__)if ([
         "removeTrailingSlash",
         "isValidUUID",
+        "toJsonSafeValue",
         "currentISOTime",
         "safeSetTimeout",
         "UUID_REGEX",
@@ -257,6 +242,7 @@ var __webpack_exports__ = {};
     for(var __WEBPACK_IMPORT_KEY__ in _promise_queue__WEBPACK_IMPORTED_MODULE_7__)if ([
         "removeTrailingSlash",
         "isValidUUID",
+        "toJsonSafeValue",
         "currentISOTime",
         "safeSetTimeout",
         "UUID_REGEX",
@@ -280,6 +266,7 @@ var __webpack_exports__ = {};
     for(var __WEBPACK_IMPORT_KEY__ in _logger__WEBPACK_IMPORTED_MODULE_8__)if ([
         "removeTrailingSlash",
         "isValidUUID",
+        "toJsonSafeValue",
         "currentISOTime",
         "safeSetTimeout",
         "UUID_REGEX",
@@ -303,6 +290,7 @@ var __webpack_exports__ = {};
     for(var __WEBPACK_IMPORT_KEY__ in _user_agent_utils__WEBPACK_IMPORTED_MODULE_9__)if ([
         "removeTrailingSlash",
         "isValidUUID",
+        "toJsonSafeValue",
         "currentISOTime",
         "safeSetTimeout",
         "UUID_REGEX",
@@ -417,6 +405,7 @@ exports.removeTrailingSlash = __webpack_exports__.removeTrailingSlash;
 exports.retriable = __webpack_exports__.retriable;
 exports.safeSetTimeout = __webpack_exports__.safeSetTimeout;
 exports.stripUrlHash = __webpack_exports__.stripUrlHash;
+exports.toJsonSafeValue = __webpack_exports__.toJsonSafeValue;
 for(var __webpack_i__ in __webpack_exports__)if (-1 === [
     "STRING_FORMAT",
     "UUID_REGEX",
@@ -432,7 +421,8 @@ for(var __webpack_i__ in __webpack_exports__)if (-1 === [
     "removeTrailingSlash",
     "retriable",
     "safeSetTimeout",
-    "stripUrlHash"
+    "stripUrlHash",
+    "toJsonSafeValue"
 ].indexOf(__webpack_i__)) exports[__webpack_i__] = __webpack_exports__[__webpack_i__];
 Object.defineProperty(exports, '__esModule', {
     value: true

package/dist/utils/index.mjs

@@ -1,7 +1,7 @@
+import { toJsonSafeValue } from "./json-utils.mjs";
 export * from "./bot-detection.mjs";
 export * from "./browser-utils.mjs";
 export * from "./bucketed-rate-limiter.mjs";
-export * from "./json-utils.mjs";
 export * from "./number-utils.mjs";
 export * from "./string-utils.mjs";
 export * from "./type-utils.mjs";
@@ -88,4 +88,4 @@ function allSettled(promises) {
                 reason
             }))));
 }
-export { STRING_FORMAT, UUID_REGEX, allSettled, assert, currentISOTime, currentTimestamp, getEventUuid, getFetch, isPromise, isValidUUID, raceWithTimeout, removeTrailingSlash, retriable, safeSetTimeout, stripUrlHash };
+export { STRING_FORMAT, UUID_REGEX, allSettled, assert, currentISOTime, currentTimestamp, getEventUuid, getFetch, isPromise, isValidUUID, raceWithTimeout, removeTrailingSlash, retriable, safeSetTimeout, stripUrlHash, toJsonSafeValue };

package/dist/utils/json-utils.d.ts

@@ -1,3 +1,18 @@
+/** Traversal budgets and markers, shared with the OTLP attribute encoder. Not
+ * public API — `utils/index.ts` re-exports `toJsonSafeValue` only. */
+export declare const MAX_JSON_SAFE_VALUE_DEPTH = 20;
+export declare const MAX_JSON_SAFE_VALUE_ITEMS = 1000;
+export declare const MAX_JSON_SAFE_VALUE_NODES = 10000;
+export declare const CIRCULAR_VALUE = "[Circular]";
+export declare const TRUNCATED_VALUE = "[Truncated]";
+export declare const UNSERIALIZABLE_VALUE = "[Unserializable]";
+export declare const FUNCTION_VALUE = "[Function]";
+/**
+ * Replaces unpaired surrogates with U+FFFD. A lone surrogate survives
+ * `JSON.stringify` as a `\uD800`-style escape, which strict JSON parsers
+ * reject — for OTLP that means the whole request is refused.
+ */
+export declare function sanitizeString(value: string): string;
 /**
  * Converts an arbitrary value, sanitizing `toJSON` results when available.
  * The limits keep pathological values from causing unbounded recursion or traversal.

package/dist/utils/json-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json-utils.d.ts","sourceRoot":"","sources":["../../src/utils/json-utils.ts"],"names":[],"mappings":"AAoCA;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CA2GvD"}
+{"version":3,"file":"json-utils.d.ts","sourceRoot":"","sources":["../../src/utils/json-utils.ts"],"names":[],"mappings":"AAAA;sEACsE;AACtE,eAAO,MAAM,yBAAyB,KAAK,CAAA;AAC3C,eAAO,MAAM,yBAAyB,OAAQ,CAAA;AAC9C,eAAO,MAAM,yBAAyB,QAAS,CAAA;AAC/C,eAAO,MAAM,cAAc,eAAe,CAAA;AAC1C,eAAO,MAAM,eAAe,gBAAgB,CAAA;AAC5C,eAAO,MAAM,oBAAoB,qBAAqB,CAAA;AACtD,eAAO,MAAM,cAAc,eAAe,CAAA;AAW1C;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAiBpD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CA2GvD"}

package/dist/utils/json-utils.js

@@ -24,6 +24,14 @@ var __webpack_require__ = {};
 var __webpack_exports__ = {};
 __webpack_require__.r(__webpack_exports__);
 __webpack_require__.d(__webpack_exports__, {
+    CIRCULAR_VALUE: ()=>CIRCULAR_VALUE,
+    FUNCTION_VALUE: ()=>FUNCTION_VALUE,
+    MAX_JSON_SAFE_VALUE_DEPTH: ()=>MAX_JSON_SAFE_VALUE_DEPTH,
+    MAX_JSON_SAFE_VALUE_ITEMS: ()=>MAX_JSON_SAFE_VALUE_ITEMS,
+    MAX_JSON_SAFE_VALUE_NODES: ()=>MAX_JSON_SAFE_VALUE_NODES,
+    TRUNCATED_VALUE: ()=>TRUNCATED_VALUE,
+    UNSERIALIZABLE_VALUE: ()=>UNSERIALIZABLE_VALUE,
+    sanitizeString: ()=>sanitizeString,
     toJsonSafeValue: ()=>toJsonSafeValue
 });
 const MAX_JSON_SAFE_VALUE_DEPTH = 20;
@@ -119,8 +127,24 @@ function toJsonSafeValue(value) {
     };
     return convert(value, 0);
 }
+exports.CIRCULAR_VALUE = __webpack_exports__.CIRCULAR_VALUE;
+exports.FUNCTION_VALUE = __webpack_exports__.FUNCTION_VALUE;
+exports.MAX_JSON_SAFE_VALUE_DEPTH = __webpack_exports__.MAX_JSON_SAFE_VALUE_DEPTH;
+exports.MAX_JSON_SAFE_VALUE_ITEMS = __webpack_exports__.MAX_JSON_SAFE_VALUE_ITEMS;
+exports.MAX_JSON_SAFE_VALUE_NODES = __webpack_exports__.MAX_JSON_SAFE_VALUE_NODES;
+exports.TRUNCATED_VALUE = __webpack_exports__.TRUNCATED_VALUE;
+exports.UNSERIALIZABLE_VALUE = __webpack_exports__.UNSERIALIZABLE_VALUE;
+exports.sanitizeString = __webpack_exports__.sanitizeString;
 exports.toJsonSafeValue = __webpack_exports__.toJsonSafeValue;
 for(var __webpack_i__ in __webpack_exports__)if (-1 === [
+    "CIRCULAR_VALUE",
+    "FUNCTION_VALUE",
+    "MAX_JSON_SAFE_VALUE_DEPTH",
+    "MAX_JSON_SAFE_VALUE_ITEMS",
+    "MAX_JSON_SAFE_VALUE_NODES",
+    "TRUNCATED_VALUE",
+    "UNSERIALIZABLE_VALUE",
+    "sanitizeString",
     "toJsonSafeValue"
 ].indexOf(__webpack_i__)) exports[__webpack_i__] = __webpack_exports__[__webpack_i__];
 Object.defineProperty(exports, '__esModule', {

package/dist/utils/json-utils.mjs

@@ -91,4 +91,4 @@ function toJsonSafeValue(value) {
     };
     return convert(value, 0);
 }
-export { toJsonSafeValue };
+export { CIRCULAR_VALUE, FUNCTION_VALUE, MAX_JSON_SAFE_VALUE_DEPTH, MAX_JSON_SAFE_VALUE_ITEMS, MAX_JSON_SAFE_VALUE_NODES, TRUNCATED_VALUE, UNSERIALIZABLE_VALUE, sanitizeString, toJsonSafeValue };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@posthog/core",
-  "version": "1.48.6",
+  "version": "1.48.7",
   "bugs": {
     "url": "https://github.com/PostHog/posthog-js/issues"
   },
@@ -70,7 +70,7 @@
     }
   },
   "dependencies": {
-    "@posthog/types": "^1.405.0"
+    "@posthog/types": "^1.405.1"
   },
   "devDependencies": {
     "@rslib/core": "0.10.6",

package/src/logs/index.ts

@@ -119,7 +119,7 @@ export class PostHogLogs {
     // Build before deferring so attributes reflect state at capture time, not
     // at drain time (identity/session changes between capture and drain must
     // not corrupt recorded attributes).
-    const record = buildOtlpLogRecord(filtered, this._getContext())
+    const record = buildOtlpLogRecord(filtered, this._getContext(), this._logger)
     const entry: BufferedLogEntry = { record }
 
     this._onReady(() => this._enqueue(entry))

package/src/logs/logs-utils.spec.ts

@@ -1,4 +1,4 @@
-import type { CaptureLogOptions, LogSeverityLevel } from '@posthog/types'
+import type { CaptureLogOptions, LogAttributeValue, LogSeverityLevel } from '@posthog/types'
 import type { LogSdkContext } from './types'
 import {
   buildOtlpLogRecord,
@@ -69,10 +69,36 @@ describe('logs-utils', () => {
       expect(toOtlpAnyValue('hello')).toEqual({ stringValue: 'hello' })
     })
 
-    it('converts integers', () => {
-      expect(toOtlpAnyValue(42)).toEqual({ intValue: 42 })
-      expect(toOtlpAnyValue(0)).toEqual({ intValue: 0 })
-      expect(toOtlpAnyValue(-7)).toEqual({ intValue: -7 })
+    it('converts integers to decimal strings', () => {
+      expect(toOtlpAnyValue(42)).toEqual({ intValue: '42' })
+      expect(toOtlpAnyValue(0)).toEqual({ intValue: '0' })
+      expect(toOtlpAnyValue(-7)).toEqual({ intValue: '-7' })
+    })
+
+    // Spec: outside int64 it is a stringValue, never an intValue.
+    it('converts integers outside int64 to stringValue', () => {
+      expect(toOtlpAnyValue(2 ** 63)).toEqual({ stringValue: '9223372036854775808' })
+      expect(toOtlpAnyValue(-(2 ** 64))).toEqual({ stringValue: '-18446744073709551616' })
+      expect(toOtlpAnyValue(1e21)).toEqual({ stringValue: '1000000000000000000000' })
+    })
+
+    it('logs a debug line when an integer falls outside int64', () => {
+      const logger = { debug: jest.fn(), info: jest.fn(), warn: jest.fn(), error: jest.fn(), critical: jest.fn() }
+      toOtlpAnyValue(2 ** 63, logger as any)
+      expect(logger.debug).toHaveBeenCalledWith(expect.stringContaining('outside the int64 range'))
+    })
+
+    it('keeps int64 min as intValue', () => {
+      // In range, but `String` renders it 192 below int64 min, so the decimal
+      // has to come from BigInt.
+      expect(toOtlpAnyValue(-(2 ** 63))).toEqual({ intValue: '-9223372036854775808' })
+    })
+
+    it('keeps large in-range integers exact', () => {
+      expect(toOtlpAnyValue(Number.MAX_SAFE_INTEGER)).toEqual({ intValue: '9007199254740991' })
+      // The largest double below 2^63 — no double exists between the two.
+      expect(toOtlpAnyValue(9223372036854774784)).toEqual({ intValue: '9223372036854774784' })
+      expect(toOtlpAnyValue(2 ** 62)).toEqual({ intValue: '4611686018427387904' })
     })
 
     it('converts floats to doubleValue', () => {
@@ -108,16 +134,295 @@ describe('logs-utils', () => {
     it('converts mixed primitive arrays recursively', () => {
       expect(toOtlpAnyValue([1, 'x', true])).toEqual({
         arrayValue: {
-          values: [{ intValue: 1 }, { stringValue: 'x' }, { boolValue: true }],
+          values: [{ intValue: '1' }, { stringValue: 'x' }, { boolValue: true }],
         },
       })
     })
 
-    it('JSON-stringifies plain objects', () => {
+    it('converts plain objects to kvlistValue', () => {
       expect(toOtlpAnyValue({ a: 1, b: 'two' })).toEqual({
-        stringValue: '{"a":1,"b":"two"}',
+        kvlistValue: {
+          values: [
+            { key: 'a', value: { intValue: '1' } },
+            { key: 'b', value: { stringValue: 'two' } },
+          ],
+        },
+      })
+    })
+
+    it('converts nested objects recursively', () => {
+      expect(toOtlpAnyValue({ outer: { inner: 1 } })).toEqual({
+        kvlistValue: {
+          values: [
+            {
+              key: 'outer',
+              value: { kvlistValue: { values: [{ key: 'inner', value: { intValue: '1' } }] } },
+            },
+          ],
+        },
+      })
+    })
+
+    it('drops null and undefined keys inside objects', () => {
+      expect(toOtlpAnyValue({ kept: 1, gone: null, alsoGone: undefined })).toEqual({
+        kvlistValue: { values: [{ key: 'kept', value: { intValue: '1' } }] },
+      })
+    })
+
+    // Not in LogAttributeValue, but reachable at runtime from untyped callers.
+    it('encodes Dates as ISO strings', () => {
+      expect(toOtlpAnyValue(new Date('2026-08-20T10:00:00.000Z') as unknown as LogAttributeValue)).toEqual({
+        stringValue: '2026-08-20T10:00:00.000Z',
+      })
+    })
+
+    it('marks circular references instead of recursing', () => {
+      const cyclic: Record<string, unknown> = { name: 'root' }
+      cyclic.self = cyclic
+      expect(toOtlpAnyValue(cyclic)).toEqual({
+        kvlistValue: {
+          values: [
+            { key: 'name', value: { stringValue: 'root' } },
+            { key: 'self', value: { stringValue: '[Circular]' } },
+          ],
+        },
+      })
+    })
+
+    // An escaping error would surface in the caller's application code.
+    it('does not throw on an object nested past the depth cap', () => {
+      let deep: Record<string, unknown> = { end: true }
+      for (let i = 0; i < 25000; i++) {
+        deep = { next: deep }
+      }
+      expect(() => toOtlpAnyValue(deep)).not.toThrow()
+    })
+
+    it('truncates at exactly 20 levels instead of recursing', () => {
+      let deep: Record<string, unknown> = { end: true }
+      for (let i = 0; i < 25; i++) {
+        deep = { next: deep }
+      }
+      const encoded = JSON.stringify(toOtlpAnyValue(deep))
+      expect(encoded).toContain('[Truncated]')
+      expect(encoded.split('"next"').length - 1).toBe(20)
+    })
+
+    it('marks a throwing getter without losing the rest of the object', () => {
+      const attrs = {
+        ok: 1,
+        get bad(): number {
+          throw new Error('getter blew up')
+        },
+      }
+      expect(() => toOtlpKeyValueList(attrs)).not.toThrow()
+      expect(toOtlpKeyValueList(attrs)).toEqual([
+        { key: 'ok', value: { intValue: '1' } },
+        { key: 'bad', value: { stringValue: '[Unserializable]' } },
+      ])
+    })
+
+    // for...in walks the prototype chain once own keys are exhausted.
+    it('ignores inherited enumerable properties', () => {
+      const inherited: Record<string, unknown> = Object.create({ fromPrototype: 'leaked' })
+      inherited.own = 1
+      expect(toOtlpAnyValue(inherited)).toEqual({
+        kvlistValue: { values: [{ key: 'own', value: { intValue: '1' } }] },
       })
     })
+
+    // `String(fn)` would put the function's source text on the wire.
+    it('marks function and symbol values instead of stringifying them', () => {
+      expect(toOtlpAnyValue({ handler: () => 1, retries: 2 } as unknown as LogAttributeValue)).toEqual({
+        kvlistValue: {
+          values: [
+            { key: 'handler', value: { stringValue: '[Function]' } },
+            { key: 'retries', value: { intValue: '2' } },
+          ],
+        },
+      })
+      expect(toOtlpAnyValue({ sym: Symbol('x') } as unknown as LogAttributeValue)).toEqual({
+        kvlistValue: { values: [{ key: 'sym', value: { stringValue: 'Symbol(x)' } }] },
+      })
+    })
+
+    // dayjs, Decimal, ORM documents.
+    it('honours toJSON', () => {
+      const wrapped = { toJSON: () => ({ amount: 5 }) }
+      expect(toOtlpAnyValue(wrapped as unknown as LogAttributeValue)).toEqual({
+        kvlistValue: { values: [{ key: 'amount', value: { intValue: '5' } }] },
+      })
+    })
+
+    it('falls back to the plain walk when toJSON throws', () => {
+      const wrapped = {
+        kept: 1,
+        toJSON: () => {
+          throw new Error('nope')
+        },
+      }
+      expect(toOtlpAnyValue(wrapped as unknown as LogAttributeValue)).toEqual({
+        kvlistValue: {
+          values: [
+            { key: 'kept', value: { intValue: '1' } },
+            { key: 'toJSON', value: { stringValue: '[Function]' } },
+          ],
+        },
+      })
+    })
+
+    // A toJSON returning its own object is a cycle like any other.
+    it('marks a cycle that runs through toJSON', () => {
+      const cyclic: Record<string, unknown> = {}
+      cyclic.toJSON = () => ({ inner: cyclic })
+      expect(toOtlpAnyValue(cyclic)).toEqual({
+        kvlistValue: { values: [{ key: 'inner', value: { stringValue: '[Circular]' } }] },
+      })
+    })
+
+    // Both `null` and `{}` here are rejected for the whole request; iOS and
+    // Android drop them too.
+    it('drops holes and nullish elements from arrays', () => {
+      // eslint-disable-next-line no-sparse-arrays
+      expect(toOtlpAnyValue([1, , 3])).toEqual({
+        arrayValue: { values: [{ intValue: '1' }, { intValue: '3' }] },
+      })
+      expect(toOtlpAnyValue([1, null, undefined, 3])).toEqual({
+        arrayValue: { values: [{ intValue: '1' }, { intValue: '3' }] },
+      })
+    })
+
+    it('stops encoding array items once the node budget is spent', () => {
+      const row: Record<string, number> = {}
+      for (let i = 0; i < 20; i++) {
+        row[`k${i}`] = i
+      }
+      const wide = Array.from({ length: 1000 }, () => ({ ...row }))
+      const values = toOtlpAnyValue(wide).arrayValue!.values
+      expect(values[values.length - 1]).toEqual({ stringValue: '[Truncated]' })
+      // One marker, not one per unencodable item.
+      expect(values.filter((v) => v.stringValue === '[Truncated]')).toHaveLength(1)
+    })
+
+    it('caps a shared object graph instead of expanding it', () => {
+      let graph: Record<string, unknown> = { leaf: true }
+      for (let i = 0; i < 20; i++) {
+        graph = { a: graph, b: graph }
+      }
+      const encoded = JSON.stringify(toOtlpAnyValue(graph))
+      expect(encoded).toContain('[Truncated]')
+      expect(encoded.length).toBeLessThan(1_000_000)
+    })
+
+    it('caps a very wide object without inventing an attribute key', () => {
+      const wide: Record<string, number> = {}
+      for (let i = 0; i < 5000; i++) {
+        wide[`k${i}`] = i
+      }
+      const logger = { debug: jest.fn(), info: jest.fn(), warn: jest.fn(), error: jest.fn(), critical: jest.fn() }
+      const values = toOtlpAnyValue(wide, logger as any).kvlistValue!.values
+      expect(values).toHaveLength(1000)
+      expect(values.every((v) => v.key.startsWith('k'))).toBe(true)
+      expect(logger.debug).toHaveBeenCalledWith(expect.stringContaining('truncated'))
+    })
+
+    // Why the encoder does not delegate to toJsonSafeValue: that maps them to null.
+    it('keeps non-finite floats as strings inside nested objects', () => {
+      expect(toOtlpAnyValue({ nested: { ratio: NaN } })).toEqual({
+        kvlistValue: {
+          values: [
+            {
+              key: 'nested',
+              value: { kvlistValue: { values: [{ key: 'ratio', value: { stringValue: 'NaN' } }] } },
+            },
+          ],
+        },
+      })
+    })
+
+    // A lone surrogate survives JSON.stringify as a \uD800 escape, which the
+    // server rejects for the whole request.
+    it('replaces unpaired surrogates in values and keys', () => {
+      expect(toOtlpAnyValue('ok\ud83d')).toEqual({ stringValue: 'ok\ufffd' })
+      expect(toOtlpAnyValue({ nested: 'ok\ud83d' })).toEqual({
+        kvlistValue: { values: [{ key: 'nested', value: { stringValue: 'ok\ufffd' } }] },
+      })
+      expect(toOtlpKeyValueList({ 'key\ud83d': 1 })).toEqual([{ key: 'key\ufffd', value: { intValue: '1' } }])
+    })
+
+    it('encodes empty containers with an explicit values array', () => {
+      expect(toOtlpAnyValue({})).toEqual({ kvlistValue: { values: [] } })
+      expect(toOtlpAnyValue([])).toEqual({ arrayValue: { values: [] } })
+    })
+
+    it('keeps a Date whose toISOString is overridden out of the wire format', () => {
+      const broken = new Date('2026-08-20T10:00:00.000Z')
+
+      ;(broken as any).toISOString = () => ({})
+      expect(typeof toOtlpAnyValue(broken as unknown as LogAttributeValue).stringValue).toBe('string')
+    })
+
+    it('encodes sibling references to one object twice, not as circular', () => {
+      const shared = { id: 1 }
+      expect(toOtlpAnyValue({ a: shared, b: shared })).toEqual({
+        kvlistValue: {
+          values: [
+            { key: 'a', value: { kvlistValue: { values: [{ key: 'id', value: { intValue: '1' } }] } } },
+            { key: 'b', value: { kvlistValue: { values: [{ key: 'id', value: { intValue: '1' } }] } } },
+          ],
+        },
+      })
+    })
+  })
+
+  describe('buildOtlpLogRecord attribute reads', () => {
+    // Reading `options.attributes` happens before the encoder's per-key guard.
+    it('marks an attribute whose getter throws without dropping the record', () => {
+      const attributes = {
+        ok: 1,
+        get bad(): number {
+          throw new Error('disposed store')
+        },
+      }
+      const record = buildOtlpLogRecord({ body: 'x', attributes }, {})
+      expect(record.attributes).toContainEqual({ key: 'ok', value: { intValue: '1' } })
+      expect(record.attributes).toContainEqual({ key: 'bad', value: { stringValue: '[Unserializable]' } })
+    })
+
+    // Plain assignment hits the prototype setter and the attribute vanishes.
+    it('keeps an attribute literally named __proto__', () => {
+      const attributes = JSON.parse('{"__proto__": {"a": 1}, "normal": "n"}')
+      const record = buildOtlpLogRecord({ body: 'x', attributes }, {})
+      expect(record.attributes.map((a) => a.key)).toContain('__proto__')
+    })
+
+    it('coerces a non-string body', () => {
+      // A non-string stringValue is refused for the whole request.
+      const record = buildOtlpLogRecord({ body: 12345 as unknown as string }, {})
+      expect(record.body).toEqual({ stringValue: '12345' })
+    })
+
+    // `String()` throws on these, and buildOtlpLogRecord is called straight from
+    // captureLog — beforeSend can also hand back any body.
+    it('marks a body that cannot be coerced to a string', () => {
+      const throwing = {
+        toString() {
+          throw new Error('boom')
+        },
+      } as unknown as string
+      expect(() => buildOtlpLogRecord({ body: throwing }, {})).not.toThrow()
+      expect(buildOtlpLogRecord({ body: throwing }, {}).body).toEqual({ stringValue: '[Unserializable]' })
+      expect(buildOtlpLogRecord({ body: Object.create(null) }, {}).body).toEqual({
+        stringValue: '[Unserializable]',
+      })
+    })
+
+    it('keeps the record when the attributes object itself cannot be read', () => {
+      const revocable = Proxy.revocable({ a: 1 }, {})
+      revocable.revoke()
+
+      expect(buildOtlpLogRecord({ body: 'x', attributes: revocable.proxy }, {}).body).toEqual({ stringValue: 'x' })
+    })
   })
 
   describe('toOtlpKeyValueList', () => {
@@ -130,7 +435,7 @@ describe('logs-utils', () => {
         })
       ).toEqual([
         { key: 'name', value: { stringValue: 'test' } },
-        { key: 'count', value: { intValue: 5 } },
+        { key: 'count', value: { intValue: '5' } },
         { key: 'active', value: { boolValue: true } },
       ])
     })