@scalebun/react-native 1.13.0 → 2.0.1

package/lib/commonjs/features/journey/touchTarget.js

@@ -5,6 +5,7 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.describeTouchTarget = describeTouchTarget;
 exports.resolveTouchTarget = resolveTouchTarget;
+exports.targetIdentity = targetIdentity;
 /**
  * Resolve WHAT was tapped, from a React Native touch event.
  *
@@ -16,19 +17,70 @@ exports.resolveTouchTarget = resolveTouchTarget;
  * WHY THE FIBER. There is no DOM. The only place a tapped view's identity exists in JS is the React
  * fiber hanging off the touch event (`_targetInst`), which carries `memoizedProps` — where
  * `accessibilityLabel` and `testID` live. This is a React internal, so every access is defensive and
- * the whole thing degrades to `null` rather than throwing: a analytics label is never worth a crash.
+ * the whole thing degrades to `null` rather than throwing: an analytics label is never worth a crash.
  *
- * IDENTITY PREFERENCE, strongest first:
- *   1. `accessibilityLabel` — authored to describe the control, and already required for a11y.
- *   2. `testID` — authored to identify the control, stable across copy changes.
- *   3. a literal string child — the button's visible caption.
- *   4. the nearest named component — coarse, but far better than nothing.
+ * ─────────────────────────────────────────────────────────────────────────────────────────────
+ * RN-2 — THE IDENTITY LADDER USED TO CAPTURE USER TEXT, AND THAT IS A PRIVACY DEFECT, NOT A
+ * TRADE-OFF.
+ *
+ * The previous preference order was:
+ *
+ *   1. accessibilityLabel   2. testID   3. a literal string child   4. nearest component
+ *
+ * Ranks 1 and 3 are FREE TEXT authored for humans, and in a real app they routinely contain user
+ * data. An accessible order row is labelled "Order 1042 for mohamed@scalebun.com". A pay button
+ * reads "Pay EGP 1,442". A contact row's caption is a person's name. Rank 1 was preferred over
+ * `testID`, so the leakiest source won whenever it existed.
+ *
+ * Two separate harms, and the second is easy to miss:
+ *
+ *   PRIVACY. `describeTouchTarget`'s output is persisted as the interaction's `target`. So names,
+ *   email addresses and amounts were being written into an analytics store, under a field nobody
+ *   would think to audit for PII. The same product already found 27 rows in `replay_events`
+ *   carrying email addresses through a different route; this was a second one.
+ *
+ *   CORRECTNESS. `target` is an AGGREGATION KEY. Keyed on text that varies per user, a single
+ *   button produces one bucket per person — so the grouping this feature exists to provide is
+ *   destroyed precisely in the screens that matter most. A leaky key is also a useless key.
+ *
+ * SO THE LADDER IS NOW DERIVED FROM CODE, NEVER FROM CONTENT:
+ *
+ *   1. `testID`     — authored to identify, stable across copy edits, and by convention never
+ *                     user data. The strongest signal and now the first.
+ *   2. `path`       — the component-name chain from the tapped node upward, e.g.
+ *                     `CartScreen>OrderRow>Pressable`. Structural: it changes when the code
+ *                     changes, not when the data does. This is what makes the ladder useful in
+ *                     the overwhelming majority of apps, which have no testIDs — without it,
+ *                     removing free text would have meant removing identity.
+ *   3. `component`  — the nearest named component alone. Coarse, but a code identifier.
+ *
+ * Free text is still RESOLVABLE, because a team that has audited its own labels may legitimately
+ * want them, but it is opt-in per call (`includeText`) and it is NEVER what
+ * `describeTouchTarget` returns. Default-off matters more than the option: a default that leaks
+ * is a leak, whatever the documentation says.
+ *
+ * WHY THIS SHIPS WITH RN-1 (persistence) RATHER THAN AFTER IT. RN-1 makes the resolved target
+ * actually reach the backend. Landing that first would persist the leaky ladder and create a
+ * historical PII problem to clean up; landing the sanitised ladder first and persistence second
+ * leaves a window where the feature looks broken. They are one change.
+ * ─────────────────────────────────────────────────────────────────────────────────────────────
  */
 
+/** Where a resolved identity came from — so a consumer can tell an authored id from a guess. */
+
 /** How far up the tree to look before giving up. Deep enough for a wrapped button, cheap enough to run on every tap. */
 const MAX_DEPTH = 12;
 /** Labels longer than this are truncated — a caption, not a paragraph. */
 const MAX_LEN = 60;
+/**
+ * How many component names the structural path may hold.
+ *
+ * Four is enough to separate two same-named controls in different containers
+ * (`Pressable<OrderRow<CartScreen` vs `Pressable<SuggestionRow<CartScreen`) without letting the
+ * key drift every time someone adds a wrapper view higher up. A path that changes on unrelated
+ * refactors is a key that silently splits its own history.
+ */
+const MAX_PATH_SEGMENTS = 4;
 function str(v) {
   if (typeof v !== 'string') return undefined;
   const s = v.trim();
@@ -48,7 +100,7 @@ function componentName(f) {
   return n.slice(0, MAX_LEN);
 }
 
-/** First literal string child, e.g. <Text>Buy now</Text>. */
+/** First literal string child, e.g. <Text>Buy now</Text>. FREE TEXT — see the header. */
 function textChild(props) {
   if (!props) return undefined;
   const c = props.children;
@@ -68,10 +120,9 @@ function fiberOf(event) {
   const e = event;
   const direct = e._targetInst;
   if (direct && typeof direct === 'object') return direct;
-  // Newer RN exposes the instance handle on the target node instead.
-  const target = e.target;
-  if (target && typeof target === 'object') {
-    const handle = target._internalFiberInstanceHandleDEV ?? target._internalInstanceHandle;
+  const target = e.target ?? e.nativeEvent?.target;
+  if (target) {
+    const handle = target._internalInstanceHandle ?? target._targetInst;
     if (handle && typeof handle === 'object') return handle;
   }
   return null;
@@ -80,42 +131,119 @@ function fiberOf(event) {
 /**
  * Walk up from the touched fiber collecting the best identity available.
  *
- * Keeps walking after a hit so a wrapper's `testID` can still be picked up when the leaf only had text,
- * but stops as soon as BOTH an accessibilityLabel and a testID are known — nothing above can improve on
- * that pair.
+ * Keeps walking after a hit so a wrapper's `testID` can still be picked up when the leaf had none,
+ * and stops as soon as a `testID` is known AND the path is full — nothing above can improve on that.
  */
-function resolveTouchTarget(event, maxDepth = MAX_DEPTH) {
+function resolveTouchTarget(event, optsOrMaxDepth = {}) {
+  /* Number form kept for the previous signature `resolveTouchTarget(event, maxDepth)`. */
+  const opts = typeof optsOrMaxDepth === 'number' ? {
+    maxDepth: optsOrMaxDepth
+  } : optsOrMaxDepth;
+  const maxDepth = opts.maxDepth ?? MAX_DEPTH;
   let f = fiberOf(event);
   if (!f) return null;
   const out = {};
+  const segments = [];
+  const ancestors = [];
   let depth = 0;
   try {
     while (f && depth < maxDepth) {
       const props = f.memoizedProps;
       if (props) {
-        out.accessibilityLabel ??= str(props.accessibilityLabel);
+        const beforeTestId = out.testID;
         out.testID ??= str(props.testID);
-        out.text ??= textChild(props);
+        /* The node is pinned to the fiber that supplied the testID — the CONTROL, not the
+           deepest node hit. A Text inside a Pressable is a tap on the Pressable, so the rect
+           has to be the Pressable's or the containment test would be run against the caption. */
+        if (!beforeTestId && out.testID) out.node = f.stateNode;
+        /* The nearest enclosing cell wins: nested lists mean a row can sit inside another
+           row, and the innermost is the one the finger is actually in. `??=` keeps the first
+           seen while walking outward, which is the innermost. */
+        if (typeof props.cellKey === 'string' && props.cellKey) {
+          out.itemKey ??= str(props.cellKey);
+          if (typeof props.index === 'number' && Number.isFinite(props.index)) {
+            out.itemIndex ??= props.index;
+          }
+        }
+        if (opts.includeText) {
+          out.accessibilityLabel ??= str(props.accessibilityLabel);
+          out.text ??= textChild(props);
+        }
       }
-      out.component ??= componentName(f);
-      if (out.accessibilityLabel && out.testID) break;
+      /* Host instances only — a composite fiber has no native tag, so keeping them would pad
+         the chain with entries no scroller could ever match. */
+      if (f.stateNode) ancestors.push(f.stateNode);
+      const name = componentName(f);
+      if (name) {
+        out.component ??= name;
+        /* Consecutive duplicates collapse: a component that renders itself through a memo or a
+           forwardRef appears twice in the fiber chain and would otherwise pad the path with a
+           repetition that carries no information. */
+        if (segments[segments.length - 1] !== name && segments.length < MAX_PATH_SEGMENTS) {
+          segments.push(name);
+        }
+      }
+      if (out.testID && segments.length >= MAX_PATH_SEGMENTS) break;
       f = f.return ?? null;
       depth++;
     }
   } catch {
     /* React internals shifted under us — return whatever was gathered so far */
   }
-  return out.accessibilityLabel || out.testID || out.text || out.component ? out : null;
+
+  /* Tapped node first, so the most specific segment leads and a truncated path is still anchored
+     to the thing actually touched. */
+  if (segments.length) out.path = segments.join('<');
+
+  /* No authored testID anywhere, so identity came from the structural path. Anchor the rect to
+     the node that was actually touched — imperfect (it may be the caption rather than the
+     control) but honest, and better than no geometry for the majority of apps, which author no
+     testIDs. `targetSource` records which case this was, so a consumer can weight it. */
+  if (!out.node) out.node = fiberOf(event)?.stateNode;
+  if (ancestors.length) out.ancestors = ancestors;
+  return out.testID || out.path || out.component || out.accessibilityLabel || out.text || out.itemKey ? out : null;
 }
 
 /**
- * One short human label for the tapped thing, or undefined when nothing identified it.
+ * One short, STABLE, non-identifying label for the tapped thing.
  *
- * This is what ends up grouping the Events explorer, so it must be STABLE: a11y label and testID are
- * authored and rarely change, whereas visible text moves with copy edits — hence the ordering.
+ * This is what ends up grouping the Events explorer and what gets persisted as the interaction's
+ * target, so it must satisfy two constraints at once: stable across copy edits, and free of user
+ * data. Both rule out visible text, which is why the free-text fields are not consulted here even
+ * when they have been resolved — see the RN-2 note in the header.
  */
 function describeTouchTarget(t) {
   if (!t) return undefined;
-  return t.accessibilityLabel || t.testID || t.text || t.component;
+  return t.testID || t.path || t.component;
+}
+
+/**
+ * The identity plus WHERE IT CAME FROM.
+ *
+ * A consumer cannot treat an authored `testID` and a structural `path` as equally trustworthy: the
+ * first is a promise from the app's authors that this control is this control, the second is an
+ * inference that breaks when the tree is refactored. Returning the source lets the accounting lane
+ * say WHY a tap could not be attributed, instead of reporting a missing target and leaving the
+ * reader to guess whether the control had no identity or the walk failed.
+ */
+function targetIdentity(t) {
+  if (!t) return {
+    source: 'none'
+  };
+  if (t.testID) return {
+    id: t.testID,
+    source: 'testID'
+  };
+  if (t.path) return {
+    id: t.path,
+    source: 'path'
+  };
+  if (t.component) return {
+    id: t.component,
+    source: 'component'
+  };
+  return {
+    source: 'none'
+  };
 }
 //# sourceMappingURL=touchTarget.js.map

package/lib/commonjs/features/journey/uiState.js

@@ -4,7 +4,10 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.clearUiState = clearUiState;
+exports.onUiStateChange = onUiStateChange;
+exports.resetUiStateListeners = resetUiStateListeners;
 exports.setUiState = setUiState;
+exports.uiStateListenerCount = uiStateListenerCount;
 exports.uiStateSignature = uiStateSignature;
 /**
  * UI STATE AT INTERACTION TIME — React Native.
@@ -57,7 +60,10 @@ const clean = s => typeof s === 'string' ? s.replace(/[;:|]/g, '').trim().slice(
 function setUiState(name, value) {
   const n = clean(name);
   const v = clean(value);
-  if (n && v) declared.set(n, v);
+  if (!n || !v) return;
+  if (declared.get(n) === v) return;
+  declared.set(n, v);
+  notifyChanged();
 }
 
 /**
@@ -69,7 +75,9 @@ function setUiState(name, value) {
  * screen.
  */
 function clearUiState(name) {
+  const before = declared.size;
   if (name === undefined) declared.clear();else declared.delete(clean(name));
+  if (declared.size !== before) notifyChanged();
 }
 
 /**
@@ -91,4 +99,76 @@ function uiStateSignature() {
   }
   return signature || undefined;
 }
+
+/**
+ * RN-11 — TELL SOMEONE THE STATE CHANGED, so a frame can exist for it.
+ *
+ * THE GAP. Declaring a state used to mutate a Map and nothing else. Nothing captured a frame, so
+ * the visual for a declared state existed only if a screenshot happened to be taken for some other
+ * reason — a navigation, a timer, or the interaction capture that fires AFTER the touch and
+ * photographs the outcome. A state could therefore be recorded as a fact with no picture of it
+ * anywhere, or with a picture of the state that replaced it.
+ *
+ * The native capture reasons are NAVIGATION, MANUAL, INTERACTION and TIMER. None of them is "the
+ * UI changed shape", which is exactly the moment a heatmap needs a frame.
+ *
+ * FIRING ON A REAL CHANGE ONLY, AND WHY THAT IS THE SDK'S JOB. The advice above says to call
+ * `setUiState` when the state changes rather than on every render — but that is advice to the
+ * host, not a guarantee. A component that declares its state inside render is ordinary React, and
+ * trusting the caller would mean a screenshot per render: a performance disaster in exactly the
+ * apps that instrument most carefully. So a redundant set — same dimension, same value — is now a
+ * no-op, and the change test lives here where it cannot be got wrong by a host.
+ *
+ * COALESCED, because a transition usually declares several dimensions in one tick ("drawer:open"
+ * and "overlay:visible" belong to one visual change). Notifying per call would capture the
+ * intermediate shapes, which are states the user never saw.
+ *
+ * The listener is deliberately NOT given the signature. A subscriber that wants it calls
+ * `uiStateSignature()` at the moment it acts, which is the value that will actually be attached
+ * to the next tap; handing over a snapshot invites acting on a state that has already moved on.
+ */
+
+const listeners = new Set();
+let pending = null;
+
+/**
+ * Subscribe to declared-state changes. Returns an unsubscribe.
+ *
+ * Registration is idempotent per function reference, so a component that re-subscribes on every
+ * render does not accumulate listeners — a leak that would only show up in long sessions.
+ */
+function onUiStateChange(listener) {
+  listeners.add(listener);
+  return () => {
+    listeners.delete(listener);
+  };
+}
+
+/** Drop every listener and any pending notification. For teardown between sessions. */
+function resetUiStateListeners() {
+  listeners.clear();
+  if (pending !== null) {
+    clearTimeout(pending);
+    pending = null;
+  }
+}
+
+/** For assertions that a re-subscribing caller has not leaked. */
+function uiStateListenerCount() {
+  return listeners.size;
+}
+function notifyChanged() {
+  if (pending !== null) return;
+  pending = setTimeout(() => {
+    pending = null;
+    for (const listener of listeners) {
+      try {
+        listener();
+      } catch {
+        /* One bad subscriber must not stop the others, and must never surface to the host: a
+           screenshot is not worth an app crash. */
+      }
+    }
+  }, 0);
+}
 //# sourceMappingURL=uiState.js.map

package/lib/commonjs/features/navigation/AutoScreenDetector.js

@@ -41,6 +41,15 @@ class AutoScreenDetector {
   _manualScreen = null;
   _manualScreenTs = 0;
   _autoScreen = null;
+  /**
+   * When `_autoScreen` was last written.
+   *
+   * Needed so `getCurrentScreen()` can prefer whichever source spoke MOST RECENTLY.
+   * Without a timestamp the only comparison available was "is the manual value still
+   * fresh", which is a different question and gave the wrong answer — see the note on
+   * `_currentScreen()`.
+   */
+  _autoScreenTs = 0;
   /** `name#key` of the last auto-detected screen VISIT — see _extractActiveVisit. */
   _autoVisitSig = null;
   _navigationRef = null;
@@ -115,6 +124,7 @@ class AutoScreenDetector {
       if (this.isManualScreenActive()) return;
       if (name !== this._autoScreen) {
         this._autoScreen = name;
+        this._autoScreenTs = Date.now();
         this._autoVisitSig = name; // native lifecycle carries no route key — name-only visit
         this._emitScreenChange(name, 'heuristic');
       }
@@ -122,8 +132,19 @@ class AutoScreenDetector {
   }
 
   /**
-   * Check if a manual screen is currently active.
-   * Used by auto-detection to yield to manual overrides.
+   * Should a WRITER defer to the manual screen right now?
+   *
+   * THIS IS A PRECEDENCE GATE, NOT A VALIDITY TEST, and conflating the two was a real
+   * bug. Its job is what the cooldown constant says: for a short window after a manual
+   * beacon fires, an auto source must not overwrite it — the poller runs every 1500 ms
+   * and would otherwise clobber a fresh declaration with whatever it inferred.
+   *
+   * `getCurrentScreen()` used to reuse this as "is the manual screen still the current
+   * screen", which made a declared screen READABLE for only 2000 ms. Nothing called
+   * `setManualScreen` in production, so the effect was latent — but the moment the
+   * `<ScaleBunScreen>` beacon was wired to it (RN-8), every tap more than two seconds
+   * after a screen mounted would have lost its name, which is very nearly every tap. A
+   * fix that introduced that would have been worse than the gap it closed.
    */
   isManualScreenActive() {
     if (!this._manualScreen) return false;
@@ -183,6 +204,7 @@ class AutoScreenDetector {
                   const visit = this._extractActiveVisit(state);
                   if (visit && this._visitSig(visit) !== this._autoVisitSig) {
                     this._autoScreen = visit.name;
+                    this._autoScreenTs = Date.now();
                     this._autoVisitSig = this._visitSig(visit);
                     this._emitScreenChange(visit.name, 'navRef');
                   }
@@ -201,6 +223,7 @@ class AutoScreenDetector {
           const visit = this._extractActiveVisit(state);
           if (visit) {
             this._autoScreen = visit.name;
+            this._autoScreenTs = Date.now();
             this._autoVisitSig = this._visitSig(visit);
             this._emitScreenChange(visit.name, 'navRef');
           }
@@ -244,6 +267,7 @@ class AutoScreenDetector {
             const visit = this._extractActiveVisit(state);
             if (visit && this._visitSig(visit) !== this._autoVisitSig) {
               this._autoScreen = visit.name;
+              this._autoScreenTs = Date.now();
               this._autoVisitSig = this._visitSig(visit);
               this._emitScreenChange(visit.name, 'heuristic');
             }
@@ -500,16 +524,61 @@ class AutoScreenDetector {
     this._listeners = [];
     this._manualScreen = null;
     this._autoScreen = null;
+    this._autoScreenTs = 0;
     this._navigationRef = null;
     _instance = null;
   }
 
   /** Get the current best-known screen name */
   getCurrentScreen() {
-    if (this._manualScreen && this.isManualScreenActive()) {
-      return this._manualScreen;
+    return this._currentScreen().name;
+  }
+
+  /**
+   * WHERE the current screen name came from, or 'none'.
+   *
+   * Recorded on every interaction (RN-8) so low screen coverage is DIAGNOSABLE rather
+   * than merely visible. Production shows 13.8% of Android interactions carrying a
+   * screen and 0.5% on iOS, and those numbers cannot today distinguish three different
+   * causes: the app never instrumented anything, the app instrumented manually and the
+   * value never reached interactions, or auto-detection ran and failed. Those have
+   * different owners and different fixes, and guessing between them is how a P0 stays
+   * open.
+   */
+  getCurrentScreenSource() {
+    return this._currentScreen().source;
+  }
+
+  /**
+   * LAST WRITER WINS between the manual beacon and auto-detection.
+   *
+   * A screen declared by `<ScaleBunScreen name>` stays current until something else
+   * declares a different one — that is what mounting a screen means. It does not
+   * expire, which is the correction here: the previous rule returned the manual name
+   * only while it was under 2000 ms old and then silently fell back to the auto value,
+   * which in a manually-instrumented app is `null`.
+   *
+   * Comparing timestamps rather than hard-coding a priority also handles the real
+   * interleaving: an app can use React Navigation for most screens AND drop a manual
+   * beacon on one modal, and whichever spoke last is the truth.
+   */
+  _currentScreen() {
+    const manual = this._manualScreen;
+    const auto = this._autoScreen;
+    if (manual && (!auto || this._manualScreenTs >= this._autoScreenTs)) {
+      return {
+        name: manual,
+        source: 'manual'
+      };
     }
-    return this._autoScreen;
+    if (auto) return {
+      name: auto,
+      source: 'navigation'
+    };
+    return {
+      name: null,
+      source: 'none'
+    };
   }
 
   // ─── Internal ───────────────────────────────────────────────────────

package/lib/commonjs/features/network/NetworkFeature.js

@@ -5,6 +5,7 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.NetworkFeature = void 0;
 var _index = require("./index");
+var _thirdParty = require("./thirdParty");
 var _networkAdapter = require("../replay/integrations/network/networkAdapter");
 var _SessionManager = require("../session/SessionManager");
 var _screenTracking = require("../../debug/screenTracking");
@@ -50,12 +51,28 @@ class NetworkFeature {
       // self-capture loop. Apply the SAME isSdkInternalUrl filter the replay
       // branch below already uses so genuine app requests still flow through.
       const isInternal = isSdkInternalUrl(data.url, this.options.sdkBaseUrl);
-      if (!isInternal) {
+      /**
+       * Beacons and denied URLs leave NO trace, in any lane.
+       *
+       * A network request reaches three places from here: the analytics echo
+       * (`$network_request`), the local replay pipeline, and the backend network endpoint
+       * that becomes the `network_requests` row the session panel renders. Filtering one
+       * and not the others is how a request half-disappears and two counts of the same
+       * call stop agreeing -- so this is applied to all three.
+       *
+       * Kept separate from `isInternal` rather than folded into it: the SDK's own uploads
+       * are already excluded from two of the three lanes and DELIBERATELY still reach the
+       * local replay pipeline. Widening that here would be an unrelated behaviour change
+       * riding along on a filter.
+       */
+      const isBeaconOrDenied = this.options.captureThirdParty !== true && (0, _thirdParty.isThirdPartyBeacon)(data.url, this.options.thirdPartyHosts) || matchesDenyUrl(data.url, this.options.denyUrls);
+      const isExcluded = isInternal || isBeaconOrDenied;
+      if (!isExcluded) {
         this.trackFn('$network_request', data);
       }
 
       // Bridge the raw network event into the Session Replay pipeline
-      if (data.type === 'network') {
+      if (data.type === 'network' && !isBeaconOrDenied) {
         (0, _networkAdapter.reportNetworkRequest)({
           method: data.method,
           url: data.url,
@@ -78,8 +95,10 @@ class NetworkFeature {
         // (correlated by sessionId+timestamp), so we no longer emit
         // NETWORK_REQUEST_* replay events here (that produced duplicate rows
         // and count divergence between replay_events and network_requests).
-        // Skip SDK's own upload calls to prevent recursive event spam.
-        if (!isInternal) {
+        // Skip SDK's own upload calls to prevent recursive event spam, and anything the
+        // beacon/denyUrls filter excluded -- this is the lane that becomes the
+        // network_requests row a person sees on the session panel.
+        if (!isExcluded) {
           const sessionManager = _SessionManager.SessionManager.getExistingInstance();
           if (sessionManager) {
             const backendTransport = sessionManager.getBackendTransport();
@@ -113,9 +132,24 @@ class NetworkFeature {
   }
 }
 
+/**
+ * Substring or RegExp, the same rule as the web SDK's `matchUrl`.
+ *
+ * Spelled out rather than shared because the two SDKs have no common runtime package, and the
+ * rule is two lines. What must NOT differ is the beacon list, which is why that one is a
+ * byte-identical vendored copy with a hash gate rather than a retyped constant.
+ */
+exports.NetworkFeature = NetworkFeature;
+function matchesDenyUrl(url, patterns) {
+  if (!patterns || !patterns.length || !url) return false;
+  for (const p of patterns) {
+    if (typeof p === 'string' ? url.includes(p) : p.test(url)) return true;
+  }
+  return false;
+}
+
 // Returns true if the URL is a ScaleBun SDK internal endpoint that must not be
 // captured — doing so would cause recursive network event spam.
-exports.NetworkFeature = NetworkFeature;
 function isSdkInternalUrl(url, sdkBaseUrl) {
   if (!url) return false;
   try {

package/lib/commonjs/features/network/thirdParty.js

@@ -0,0 +1,90 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.THIRD_PARTY_BEACON_HOSTS = void 0;
+exports.isThirdPartyBeacon = isThirdPartyBeacon;
+/**
+ * THIRD-PARTY BEACON HOSTS — the one list, and the one matcher, for every layer that drops them.
+ *
+ * WHAT THIS IS FOR
+ * A session on an instrumented site spends most of its network tab on traffic the app did not
+ * meaningfully make: analytics collectors, ad pixels, IP-enrichment calls, tag managers. It is
+ * captured, uploaded, stored and rendered, and none of it answers a question anyone asks a session
+ * replay. One real sign-in screen was 27 requests, most of them beacons.
+ *
+ * It is not only clutter. Session health scores `failedRequests` and `slowRequests`, so a tracker
+ * killed by an ad blocker (a transport error) or one that is simply slow moves a number that is
+ * supposed to describe the APP. That is the part that makes this a correctness fix rather than a
+ * tidy-up.
+ *
+ * WHY HOSTS ONLY, NEVER PATHS
+ * The obvious rules from looking at a network tab are `/collect`, `/p`, `/api/v2/pixel`. Every one
+ * of them is a path that a customer's own API is allowed to have, and dropping a real API call is
+ * far worse than keeping a beacon: the noise is visible and annoying, the missing request is
+ * invisible and misleading. So matching is on the HOSTNAME, with a dot boundary, and a request to
+ * `/collect` on the app's own origin is kept — correctly.
+ *
+ * WHY IT IS A SUFFIX LIST AND NOT A REGEX
+ * Two reasons, both practical. It is applied inside an SDK whose eager bundle is measured in bytes,
+ * and a comma-joined string of suffixes compresses to almost nothing next to an equivalent pattern
+ * source. And it has to be COPIED, byte for byte, into the React Native SDK and into the backend's
+ * ingest path — a list with no syntax is a list that cannot drift in meaning between three
+ * languages' worth of tooling. `third-party:parity` hashes all three copies.
+ *
+ * ZERO IMPORTS, DELIBERATELY. That is what makes the byte-identical copy possible. If an edit here
+ * ever needs an import, the parity gate is the thing that will say so — keep the module pure rather
+ * than weakening the gate.
+ *
+ * WHAT IS DELIBERATELY NOT ON THE LIST
+ * The rule is: a host whose ONLY purpose is to receive telemetry. Everything else stays, because a
+ * dropped request is invisible and a kept one is merely noisy.
+ *
+ *   - Feature-flag and experiment services (LaunchDarkly, Optimizely, Split). Their RESPONSES
+ *     change what the app does, so a failed flag fetch is an application incident and the single
+ *     most useful request in the session.
+ *   - Chat and support widgets (Intercom, Zendesk, Drift). A broken widget is a broken feature the
+ *     user can see.
+ *   - `facebook.com` as a whole. `graph.facebook.com` is an API real apps call; only the pixel
+ *     delivery hosts are listed.
+ *   - CDNs of any kind, even ones that mostly serve tags: they also serve application assets, and
+ *     dropping them would hide a real asset failure.
+ *
+ * When in doubt, leave it out. `denyUrls` stays the per-app escape hatch in both SDKs, and it can
+ * do what this list will not.
+ */
+
+/**
+ * Known telemetry, advertising and enrichment endpoints, as hostname suffixes.
+ *
+ * One comma-joined string rather than an array: identical meaning, materially smaller once gzipped,
+ * and it keeps the copy in three repos a single line to compare by eye.
+ */
+const THIRD_PARTY_BEACON_HOSTS = exports.THIRD_PARTY_BEACON_HOSTS = 'google-analytics.com,googletagmanager.com,analytics.google.com,doubleclick.net,googlesyndication.com,' + 'googleadservices.com,app-measurement.com,facebook.net,analytics.tiktok.com,' + 'ads-twitter.com,analytics.twitter.com,ct.pinterest.com,bat.bing.com,px.ads.linkedin.com,tr.snapchat.com,' + 'criteo.com,criteo.net,taboola.com,outbrain.com,adroll.com,adsrvr.org,quantserve.com,scorecardresearch.com,' + 'hotjar.com,hotjar.io,clarity.ms,fullstory.com,mouseflow.com,crazyegg.com,luckyorange.com,inspectlet.com,' + 'segment.io,mixpanel.com,amplitude.com,heap.io,heapanalytics.com,rudderstack.com,posthog.com,' + 'matomo.cloud,plausible.io,simpleanalytics.com,statcounter.com,' + 'appsflyer.com,adjust.com,branch.io,' + 'ipify.org,ipinfo.io,ipapi.co,ip-api.com,geolocation-db.com,cloudflareinsights.com,' + 'nr-data.net,browser-intake-datadoghq.com,sentry.io,bugsnag.com,rollbar.com';
+
+/**
+ * True when `url` is addressed to a known beacon host.
+ *
+ * Deliberately total: an unparseable or relative URL is NOT third party. A relative URL is
+ * same-origin by definition — the app's own call — and guessing on garbage input would drop real
+ * requests for no benefit.
+ */
+function isThirdPartyBeacon(url, hosts) {
+  if (!url) return false;
+  let host = '';
+  try {
+    // A relative URL throws here, which is the answer we want: it is first-party.
+    host = new URL(url).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  if (!host) return false;
+  for (const suffix of (hosts ?? THIRD_PARTY_BEACON_HOSTS).split(',')) {
+    // Dot boundary, so `notevil-facebook.com` does not match `facebook.com` while
+    // `connect.facebook.com` does. The bare-equality arm covers the apex domain itself.
+    if (host === suffix || host.endsWith('.' + suffix)) return true;
+  }
+  return false;
+}
+//# sourceMappingURL=thirdParty.js.map