@spotify-confidence/csr-common 0.18.9 → 0.18.10

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.18.10](https://github.com/spotify/confidence-sdk-js/compare/csr-common-v0.18.9...csr-common-v0.18.10) (2026-09-09)
+
+
+### 🐛 Bug Fixes
+
+* strip query and hash from recording URLs ([#452](https://github.com/spotify/confidence-sdk-js/issues/452)) ([1ce37f3](https://github.com/spotify/confidence-sdk-js/commit/1ce37f3f43c05bfea4a90839a6de42314096bb40))
+
 ## [0.18.9](https://github.com/spotify/confidence-sdk-js/compare/csr-common-v0.18.8...csr-common-v0.18.9) (2026-09-07)
 
 

package/dist/index.cjs

@@ -1,18 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_session_activity = require("./session-activity-HfuXKqGd.cjs");
-//#region src/url.ts
-/**
-* Extract only the pathname from a URL, stripping origin, query string, and
-* hash. Used across recorder and analyzer to avoid capturing PII in route data.
-*/
-function stripUrl(url) {
-	try {
-		return new URL(url).pathname;
-	} catch (_e) {
-		return url;
-	}
-}
-//#endregion
+const require_session_activity = require("./session-activity-B8swR5Wg.cjs");
 //#region src/custom-event-limits.ts
 const MAX_KEY_LENGTH = 128;
 const MAX_TAG_VALUE_LENGTH = 256;
@@ -51,7 +38,8 @@ exports.SerializedNodeType = require_session_activity.SerializedNodeType;
 exports.isSessionActivityEvent = require_session_activity.isSessionActivityEvent;
 exports.isUserInteractionEvent = require_session_activity.isUserInteractionEvent;
 exports.isUserInteractionMetric = require_session_activity.isUserInteractionMetric;
-exports.stripUrl = stripUrl;
+exports.stripUrl = require_session_activity.stripUrl;
+exports.stripUrlQueryAndHash = require_session_activity.stripUrlQueryAndHash;
 exports.validateKey = validateKey;
 exports.validateMeasureValue = validateMeasureValue;
 exports.validateTagValue = validateTagValue;

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { i as ClientContext, n as Frame, o as UserAgentContext } from "./types-Bg0UKTVQ.cjs";
+import { i as ClientContext, n as Frame, o as UserAgentContext } from "./types-C3mO_2YH.cjs";
 
 //#region src/events.d.ts
 /**
@@ -370,6 +370,8 @@ type RecordingEvent = {
 };
 //#endregion
 //#region src/url.d.ts
+/** Remove query strings and fragments, including from relative or malformed URLs. */
+declare function stripUrlQueryAndHash(url: string): string;
 /**
 * Extract only the pathname from a URL, stripping origin, query string, and
 * hash. Used across recorder and analyzer to avoid capturing PII in route data.
@@ -407,4 +409,4 @@ declare function validateKey(key: string): string | null;
 declare function validateTagValue(value: string | undefined): string | null;
 declare function validateMeasureValue(value: number | undefined): string | null;
 //#endregion
-export { type AwayGapCustomData, type ClickCustomData, type ClientContext, type ClipboardAction, type ClipboardPluginData, type ConsoleLogLevel, type ConsoleLogPluginData, type CustomEventData, type DeadClickCustomData, type DialogOpenedCustomData, type ElementDescriptor, type ErrorMessageCustomData, type FlagEvaluationPluginData, type FormFieldReEditCustomData, type Frame, type GraphQLRequestMetadata, type IdleGapCustomData, type IncrementalSnapshotData, IncrementalSource, type InputCustomData, MAX_DISTINCT_KEYS, MAX_KEY_LENGTH, MAX_TAG_VALUE_LENGTH, MAX_VALUES_PER_KEY, type MeasurePluginData, type MouseInteractionData, MouseInteractions, type NetworkRequestInitiator, type NetworkRequestPluginData, type OpaqueIncrementalData, type PluginEventData, type RageClickCustomData, RecordingCustomEventTag, type RecordingEvent, RecordingEventType, RecordingMetricKey, RecordingPluginName, type RouteChangeCustomData, type RouteChangePayload, type RouteChangePluginData, type RouteChangeTrigger, type ScrollBackCustomData, type SelectionData, type SelectionRange, SerializedNodeType, type TabRefocusCustomData, type TabUnfocusCustomData, type TabVisibilityPluginData, type TagPluginData, type UserAgentContext, isSessionActivityEvent, isUserInteractionEvent, isUserInteractionMetric, stripUrl, validateKey, validateMeasureValue, validateTagValue };
+export { type AwayGapCustomData, type ClickCustomData, type ClientContext, type ClipboardAction, type ClipboardPluginData, type ConsoleLogLevel, type ConsoleLogPluginData, type CustomEventData, type DeadClickCustomData, type DialogOpenedCustomData, type ElementDescriptor, type ErrorMessageCustomData, type FlagEvaluationPluginData, type FormFieldReEditCustomData, type Frame, type GraphQLRequestMetadata, type IdleGapCustomData, type IncrementalSnapshotData, IncrementalSource, type InputCustomData, MAX_DISTINCT_KEYS, MAX_KEY_LENGTH, MAX_TAG_VALUE_LENGTH, MAX_VALUES_PER_KEY, type MeasurePluginData, type MouseInteractionData, MouseInteractions, type NetworkRequestInitiator, type NetworkRequestPluginData, type OpaqueIncrementalData, type PluginEventData, type RageClickCustomData, RecordingCustomEventTag, type RecordingEvent, RecordingEventType, RecordingMetricKey, RecordingPluginName, type RouteChangeCustomData, type RouteChangePayload, type RouteChangePluginData, type RouteChangeTrigger, type ScrollBackCustomData, type SelectionData, type SelectionRange, SerializedNodeType, type TabRefocusCustomData, type TabUnfocusCustomData, type TabVisibilityPluginData, type TagPluginData, type UserAgentContext, isSessionActivityEvent, isUserInteractionEvent, isUserInteractionMetric, stripUrl, stripUrlQueryAndHash, validateKey, validateMeasureValue, validateTagValue };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { i as ClientContext, n as Frame, o as UserAgentContext } from "./types-Bg0UKTVQ.js";
+import { i as ClientContext, n as Frame, o as UserAgentContext } from "./types-C3mO_2YH.js";
 
 //#region src/events.d.ts
 /**
@@ -370,6 +370,8 @@ type RecordingEvent = {
 };
 //#endregion
 //#region src/url.d.ts
+/** Remove query strings and fragments, including from relative or malformed URLs. */
+declare function stripUrlQueryAndHash(url: string): string;
 /**
 * Extract only the pathname from a URL, stripping origin, query string, and
 * hash. Used across recorder and analyzer to avoid capturing PII in route data.
@@ -407,4 +409,4 @@ declare function validateKey(key: string): string | null;
 declare function validateTagValue(value: string | undefined): string | null;
 declare function validateMeasureValue(value: number | undefined): string | null;
 //#endregion
-export { type AwayGapCustomData, type ClickCustomData, type ClientContext, type ClipboardAction, type ClipboardPluginData, type ConsoleLogLevel, type ConsoleLogPluginData, type CustomEventData, type DeadClickCustomData, type DialogOpenedCustomData, type ElementDescriptor, type ErrorMessageCustomData, type FlagEvaluationPluginData, type FormFieldReEditCustomData, type Frame, type GraphQLRequestMetadata, type IdleGapCustomData, type IncrementalSnapshotData, IncrementalSource, type InputCustomData, MAX_DISTINCT_KEYS, MAX_KEY_LENGTH, MAX_TAG_VALUE_LENGTH, MAX_VALUES_PER_KEY, type MeasurePluginData, type MouseInteractionData, MouseInteractions, type NetworkRequestInitiator, type NetworkRequestPluginData, type OpaqueIncrementalData, type PluginEventData, type RageClickCustomData, RecordingCustomEventTag, type RecordingEvent, RecordingEventType, RecordingMetricKey, RecordingPluginName, type RouteChangeCustomData, type RouteChangePayload, type RouteChangePluginData, type RouteChangeTrigger, type ScrollBackCustomData, type SelectionData, type SelectionRange, SerializedNodeType, type TabRefocusCustomData, type TabUnfocusCustomData, type TabVisibilityPluginData, type TagPluginData, type UserAgentContext, isSessionActivityEvent, isUserInteractionEvent, isUserInteractionMetric, stripUrl, validateKey, validateMeasureValue, validateTagValue };
+export { type AwayGapCustomData, type ClickCustomData, type ClientContext, type ClipboardAction, type ClipboardPluginData, type ConsoleLogLevel, type ConsoleLogPluginData, type CustomEventData, type DeadClickCustomData, type DialogOpenedCustomData, type ElementDescriptor, type ErrorMessageCustomData, type FlagEvaluationPluginData, type FormFieldReEditCustomData, type Frame, type GraphQLRequestMetadata, type IdleGapCustomData, type IncrementalSnapshotData, IncrementalSource, type InputCustomData, MAX_DISTINCT_KEYS, MAX_KEY_LENGTH, MAX_TAG_VALUE_LENGTH, MAX_VALUES_PER_KEY, type MeasurePluginData, type MouseInteractionData, MouseInteractions, type NetworkRequestInitiator, type NetworkRequestPluginData, type OpaqueIncrementalData, type PluginEventData, type RageClickCustomData, RecordingCustomEventTag, type RecordingEvent, RecordingEventType, RecordingMetricKey, RecordingPluginName, type RouteChangeCustomData, type RouteChangePayload, type RouteChangePluginData, type RouteChangeTrigger, type ScrollBackCustomData, type SelectionData, type SelectionRange, SerializedNodeType, type TabRefocusCustomData, type TabUnfocusCustomData, type TabVisibilityPluginData, type TagPluginData, type UserAgentContext, isSessionActivityEvent, isUserInteractionEvent, isUserInteractionMetric, stripUrl, stripUrlQueryAndHash, validateKey, validateMeasureValue, validateTagValue };

package/dist/index.js

@@ -1,17 +1,4 @@
-import { a as IncrementalSource, c as RecordingEventType, i as RecordingMetricKey, l as RecordingPluginName, n as isUserInteractionEvent, o as MouseInteractions, r as isUserInteractionMetric, s as RecordingCustomEventTag, t as isSessionActivityEvent, u as SerializedNodeType } from "./session-activity-CJ1wae06.js";
-//#region src/url.ts
-/**
-* Extract only the pathname from a URL, stripping origin, query string, and
-* hash. Used across recorder and analyzer to avoid capturing PII in route data.
-*/
-function stripUrl(url) {
-	try {
-		return new URL(url).pathname;
-	} catch (_e) {
-		return url;
-	}
-}
-//#endregion
+import { a as stripUrl, c as MouseInteractions, d as RecordingPluginName, f as SerializedNodeType, i as RecordingMetricKey, l as RecordingCustomEventTag, n as isUserInteractionEvent, o as stripUrlQueryAndHash, r as isUserInteractionMetric, s as IncrementalSource, t as isSessionActivityEvent, u as RecordingEventType } from "./session-activity-tshS9Hua.js";
 //#region src/custom-event-limits.ts
 const MAX_KEY_LENGTH = 128;
 const MAX_TAG_VALUE_LENGTH = 256;
@@ -36,4 +23,4 @@ function validateMeasureValue(value) {
 	return null;
 }
 //#endregion
-export { IncrementalSource, MAX_DISTINCT_KEYS, MAX_KEY_LENGTH, MAX_TAG_VALUE_LENGTH, MAX_VALUES_PER_KEY, MouseInteractions, RecordingCustomEventTag, RecordingEventType, RecordingMetricKey, RecordingPluginName, SerializedNodeType, isSessionActivityEvent, isUserInteractionEvent, isUserInteractionMetric, stripUrl, validateKey, validateMeasureValue, validateTagValue };
+export { IncrementalSource, MAX_DISTINCT_KEYS, MAX_KEY_LENGTH, MAX_TAG_VALUE_LENGTH, MAX_VALUES_PER_KEY, MouseInteractions, RecordingCustomEventTag, RecordingEventType, RecordingMetricKey, RecordingPluginName, SerializedNodeType, isSessionActivityEvent, isUserInteractionEvent, isUserInteractionMetric, stripUrl, stripUrlQueryAndHash, validateKey, validateMeasureValue, validateTagValue };

package/dist/{session-activity-HfuXKqGd.cjs → session-activity-B8swR5Wg.cjs}

@@ -91,6 +91,23 @@ let MouseInteractions = /* @__PURE__ */ function(MouseInteractions) {
 	return MouseInteractions;
 }({});
 //#endregion
+//#region src/url.ts
+/** Remove query strings and fragments, including from relative or malformed URLs. */
+function stripUrlQueryAndHash(url) {
+	return url.split(/[?#]/, 1)[0];
+}
+/**
+* Extract only the pathname from a URL, stripping origin, query string, and
+* hash. Used across recorder and analyzer to avoid capturing PII in route data.
+*/
+function stripUrl(url) {
+	try {
+		return new URL(url).pathname;
+	} catch (_e) {
+		return url;
+	}
+}
+//#endregion
 //#region src/metrics.ts
 const RecordingMetricKey = {
 	Click: "clicks",
@@ -210,3 +227,15 @@ Object.defineProperty(exports, "isUserInteractionMetric", {
 		return isUserInteractionMetric;
 	}
 });
+Object.defineProperty(exports, "stripUrl", {
+	enumerable: true,
+	get: function() {
+		return stripUrl;
+	}
+});
+Object.defineProperty(exports, "stripUrlQueryAndHash", {
+	enumerable: true,
+	get: function() {
+		return stripUrlQueryAndHash;
+	}
+});

package/dist/{session-activity-CJ1wae06.js → session-activity-tshS9Hua.js}

@@ -91,6 +91,23 @@ let MouseInteractions = /* @__PURE__ */ function(MouseInteractions) {
 	return MouseInteractions;
 }({});
 //#endregion
+//#region src/url.ts
+/** Remove query strings and fragments, including from relative or malformed URLs. */
+function stripUrlQueryAndHash(url) {
+	return url.split(/[?#]/, 1)[0];
+}
+/**
+* Extract only the pathname from a URL, stripping origin, query string, and
+* hash. Used across recorder and analyzer to avoid capturing PII in route data.
+*/
+function stripUrl(url) {
+	try {
+		return new URL(url).pathname;
+	} catch (_e) {
+		return url;
+	}
+}
+//#endregion
 //#region src/metrics.ts
 const RecordingMetricKey = {
 	Click: "clicks",
@@ -150,4 +167,4 @@ const isUserInteractionEvent = (event) => {
 const isUserInteractionMetric = (metricKey) => USER_INTERACTION_METRIC_KEYS.has(metricKey);
 const isSessionActivityEvent = (event) => isObject(event) && event.type === 4 || isUserInteractionEvent(event);
 //#endregion
-export { IncrementalSource as a, RecordingEventType as c, RecordingMetricKey as i, RecordingPluginName as l, isUserInteractionEvent as n, MouseInteractions as o, isUserInteractionMetric as r, RecordingCustomEventTag as s, isSessionActivityEvent as t, SerializedNodeType as u };
+export { stripUrl as a, MouseInteractions as c, RecordingPluginName as d, SerializedNodeType as f, RecordingMetricKey as i, RecordingCustomEventTag as l, isUserInteractionEvent as n, stripUrlQueryAndHash as o, isUserInteractionMetric as r, IncrementalSource as s, isSessionActivityEvent as t, RecordingEventType as u };

package/dist/{types-Bg0UKTVQ.d.cts → types-C3mO_2YH.d.cts}

@@ -22,7 +22,7 @@ type UserAgentContext = {
   screenWidth?: number;
   screenHeight?: number;
   devicePixelRatio?: number; /** Initial document URI — without query/hash to avoid leaking PII. */
-  uri?: string;
+  uri?: string; /** Document referrer — without query/hash to avoid leaking PII. */
   referrer?: string;
 };
 interface ClientContext {

package/dist/{types-Bg0UKTVQ.d.ts → types-C3mO_2YH.d.ts}

@@ -22,7 +22,7 @@ type UserAgentContext = {
   screenWidth?: number;
   screenHeight?: number;
   devicePixelRatio?: number; /** Initial document URI — without query/hash to avoid leaking PII. */
-  uri?: string;
+  uri?: string; /** Document referrer — without query/hash to avoid leaking PII. */
   referrer?: string;
 };
 interface ClientContext {

package/dist/uploader/index.cjs

@@ -21,7 +21,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-const require_session_activity = require("../session-activity-HfuXKqGd.cjs");
+const require_session_activity = require("../session-activity-B8swR5Wg.cjs");
 let bowser = require("bowser");
 bowser = __toESM(bowser, 1);
 //#region src/uploader/client-context.ts
@@ -46,7 +46,7 @@ function collectUserAgentContext() {
 		screenHeight: window.screen.height,
 		devicePixelRatio: window.devicePixelRatio,
 		uri: `${window.location.origin}${window.location.pathname}`,
-		referrer: document.referrer
+		referrer: require_session_activity.stripUrlQueryAndHash(document.referrer)
 	};
 }
 //#endregion

package/dist/uploader/index.d.cts

@@ -1,4 +1,4 @@
-import { a as ContextValue, i as ClientContext, o as UserAgentContext, r as Uploader, s as collectUserAgentContext, t as CreateUploaderOptions } from "../types-Bg0UKTVQ.cjs";
+import { a as ContextValue, i as ClientContext, o as UserAgentContext, r as Uploader, s as collectUserAgentContext, t as CreateUploaderOptions } from "../types-C3mO_2YH.cjs";
 
 //#region src/uploader/create-uploader.d.ts
 declare function createUploader(opts: CreateUploaderOptions): Promise<Uploader | null>;

package/dist/uploader/index.d.ts

@@ -1,4 +1,4 @@
-import { a as ContextValue, i as ClientContext, o as UserAgentContext, r as Uploader, s as collectUserAgentContext, t as CreateUploaderOptions } from "../types-Bg0UKTVQ.js";
+import { a as ContextValue, i as ClientContext, o as UserAgentContext, r as Uploader, s as collectUserAgentContext, t as CreateUploaderOptions } from "../types-C3mO_2YH.js";
 
 //#region src/uploader/create-uploader.d.ts
 declare function createUploader(opts: CreateUploaderOptions): Promise<Uploader | null>;

package/dist/uploader/index.js

@@ -1,4 +1,4 @@
-import { t as isSessionActivityEvent } from "../session-activity-CJ1wae06.js";
+import { o as stripUrlQueryAndHash, t as isSessionActivityEvent } from "../session-activity-tshS9Hua.js";
 import Bowser from "bowser";
 //#region src/uploader/client-context.ts
 function collectUserAgentContext() {
@@ -22,7 +22,7 @@ function collectUserAgentContext() {
 		screenHeight: window.screen.height,
 		devicePixelRatio: window.devicePixelRatio,
 		uri: `${window.location.origin}${window.location.pathname}`,
-		referrer: document.referrer
+		referrer: stripUrlQueryAndHash(document.referrer)
 	};
 }
 //#endregion

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@spotify-confidence/csr-common",
   "license": "Apache-2.0",
-  "version": "0.18.9",
+  "version": "0.18.10",
   "repository": {
     "type": "git",
     "url": "https://github.com/spotify/confidence-sdk-js.git",

package/src/index.ts

@@ -43,7 +43,7 @@ export {
   type FlagEvaluationPluginData,
 } from './events';
 
-export { stripUrl } from './url';
+export { stripUrl, stripUrlQueryAndHash } from './url';
 
 export { RecordingMetricKey } from './metrics';
 

package/src/uploader/client-context.test.ts

@@ -84,6 +84,33 @@ describe('collectUserAgentContext', () => {
     });
   });
 
+  it.each([
+    ['https://referrer.example/path?email=alice@example.com#token', 'https://referrer.example/path'],
+    ['https://referrer.example/path#token?email=alice@example.com', 'https://referrer.example/path'],
+    ['https://referrer.example/path?email=alice@example.com', 'https://referrer.example/path'],
+    ['https://referrer.example/path#token', 'https://referrer.example/path'],
+    ['', ''],
+    ['invalid-url?email=alice@example.com#token', 'invalid-url'],
+  ])('strips query/hash from referrer %s', (referrer, expected) => {
+    stubBrowser({ document: { referrer } });
+    expect(collectUserAgentContext()?.referrer).toBe(expected);
+  });
+
+  it('excludes query/hash from the initial document URI', () => {
+    stubBrowser({
+      window: {
+        location: {
+          origin: 'https://example.com',
+          pathname: '/path',
+          search: '?email=alice@example.com',
+          hash: '#token',
+          href: 'https://example.com/path?email=alice@example.com#token',
+        },
+      },
+    });
+    expect(collectUserAgentContext()?.uri).toBe('https://example.com/path');
+  });
+
   it('flags `mobile` platform type as mobile=true', () => {
     parse.mockReturnValueOnce({
       os: {},

package/src/uploader/client-context.ts

@@ -1,4 +1,5 @@
 import Bowser from 'bowser';
+import { stripUrlQueryAndHash } from '../url';
 
 /**
  * JSON-shaped values accepted in a Context — matches `google.protobuf.Struct`.
@@ -31,6 +32,7 @@ export type UserAgentContext = {
   devicePixelRatio?: number;
   /** Initial document URI — without query/hash to avoid leaking PII. */
   uri?: string;
+  /** Document referrer — without query/hash to avoid leaking PII. */
   referrer?: string;
 };
 
@@ -65,6 +67,6 @@ export function collectUserAgentContext(): UserAgentContext | undefined {
     screenHeight: window.screen.height,
     devicePixelRatio: window.devicePixelRatio,
     uri: `${window.location.origin}${window.location.pathname}`,
-    referrer: document.referrer,
+    referrer: stripUrlQueryAndHash(document.referrer),
   };
 }

package/src/url.ts

@@ -1,3 +1,8 @@
+/** Remove query strings and fragments, including from relative or malformed URLs. */
+export function stripUrlQueryAndHash(url: string): string {
+  return url.split(/[?#]/, 1)[0];
+}
+
 /**
  * Extract only the pathname from a URL, stripping origin, query string, and
  * hash. Used across recorder and analyzer to avoid capturing PII in route data.