@zuplo/cli 7.4.4 → 7.4.5

package/node_modules/@posthog/core/src/logs/logs-utils.spec.ts

@@ -1,4 +1,4 @@
-import type { CaptureLogOptions, LogSeverityLevel } from '@posthog/types'
+import type { CaptureLogOptions, LogAttributeValue, LogSeverityLevel } from '@posthog/types'
 import type { LogSdkContext } from './types'
 import {
   buildOtlpLogRecord,
@@ -69,10 +69,36 @@ describe('logs-utils', () => {
       expect(toOtlpAnyValue('hello')).toEqual({ stringValue: 'hello' })
     })
 
-    it('converts integers', () => {
-      expect(toOtlpAnyValue(42)).toEqual({ intValue: 42 })
-      expect(toOtlpAnyValue(0)).toEqual({ intValue: 0 })
-      expect(toOtlpAnyValue(-7)).toEqual({ intValue: -7 })
+    it('converts integers to decimal strings', () => {
+      expect(toOtlpAnyValue(42)).toEqual({ intValue: '42' })
+      expect(toOtlpAnyValue(0)).toEqual({ intValue: '0' })
+      expect(toOtlpAnyValue(-7)).toEqual({ intValue: '-7' })
+    })
+
+    // Spec: outside int64 it is a stringValue, never an intValue.
+    it('converts integers outside int64 to stringValue', () => {
+      expect(toOtlpAnyValue(2 ** 63)).toEqual({ stringValue: '9223372036854775808' })
+      expect(toOtlpAnyValue(-(2 ** 64))).toEqual({ stringValue: '-18446744073709551616' })
+      expect(toOtlpAnyValue(1e21)).toEqual({ stringValue: '1000000000000000000000' })
+    })
+
+    it('logs a debug line when an integer falls outside int64', () => {
+      const logger = { debug: jest.fn(), info: jest.fn(), warn: jest.fn(), error: jest.fn(), critical: jest.fn() }
+      toOtlpAnyValue(2 ** 63, logger as any)
+      expect(logger.debug).toHaveBeenCalledWith(expect.stringContaining('outside the int64 range'))
+    })
+
+    it('keeps int64 min as intValue', () => {
+      // In range, but `String` renders it 192 below int64 min, so the decimal
+      // has to come from BigInt.
+      expect(toOtlpAnyValue(-(2 ** 63))).toEqual({ intValue: '-9223372036854775808' })
+    })
+
+    it('keeps large in-range integers exact', () => {
+      expect(toOtlpAnyValue(Number.MAX_SAFE_INTEGER)).toEqual({ intValue: '9007199254740991' })
+      // The largest double below 2^63 — no double exists between the two.
+      expect(toOtlpAnyValue(9223372036854774784)).toEqual({ intValue: '9223372036854774784' })
+      expect(toOtlpAnyValue(2 ** 62)).toEqual({ intValue: '4611686018427387904' })
     })
 
     it('converts floats to doubleValue', () => {
@@ -108,16 +134,295 @@ describe('logs-utils', () => {
     it('converts mixed primitive arrays recursively', () => {
       expect(toOtlpAnyValue([1, 'x', true])).toEqual({
         arrayValue: {
-          values: [{ intValue: 1 }, { stringValue: 'x' }, { boolValue: true }],
+          values: [{ intValue: '1' }, { stringValue: 'x' }, { boolValue: true }],
         },
       })
     })
 
-    it('JSON-stringifies plain objects', () => {
+    it('converts plain objects to kvlistValue', () => {
       expect(toOtlpAnyValue({ a: 1, b: 'two' })).toEqual({
-        stringValue: '{"a":1,"b":"two"}',
+        kvlistValue: {
+          values: [
+            { key: 'a', value: { intValue: '1' } },
+            { key: 'b', value: { stringValue: 'two' } },
+          ],
+        },
+      })
+    })
+
+    it('converts nested objects recursively', () => {
+      expect(toOtlpAnyValue({ outer: { inner: 1 } })).toEqual({
+        kvlistValue: {
+          values: [
+            {
+              key: 'outer',
+              value: { kvlistValue: { values: [{ key: 'inner', value: { intValue: '1' } }] } },
+            },
+          ],
+        },
+      })
+    })
+
+    it('drops null and undefined keys inside objects', () => {
+      expect(toOtlpAnyValue({ kept: 1, gone: null, alsoGone: undefined })).toEqual({
+        kvlistValue: { values: [{ key: 'kept', value: { intValue: '1' } }] },
+      })
+    })
+
+    // Not in LogAttributeValue, but reachable at runtime from untyped callers.
+    it('encodes Dates as ISO strings', () => {
+      expect(toOtlpAnyValue(new Date('2026-08-20T10:00:00.000Z') as unknown as LogAttributeValue)).toEqual({
+        stringValue: '2026-08-20T10:00:00.000Z',
+      })
+    })
+
+    it('marks circular references instead of recursing', () => {
+      const cyclic: Record<string, unknown> = { name: 'root' }
+      cyclic.self = cyclic
+      expect(toOtlpAnyValue(cyclic)).toEqual({
+        kvlistValue: {
+          values: [
+            { key: 'name', value: { stringValue: 'root' } },
+            { key: 'self', value: { stringValue: '[Circular]' } },
+          ],
+        },
+      })
+    })
+
+    // An escaping error would surface in the caller's application code.
+    it('does not throw on an object nested past the depth cap', () => {
+      let deep: Record<string, unknown> = { end: true }
+      for (let i = 0; i < 25000; i++) {
+        deep = { next: deep }
+      }
+      expect(() => toOtlpAnyValue(deep)).not.toThrow()
+    })
+
+    it('truncates at exactly 20 levels instead of recursing', () => {
+      let deep: Record<string, unknown> = { end: true }
+      for (let i = 0; i < 25; i++) {
+        deep = { next: deep }
+      }
+      const encoded = JSON.stringify(toOtlpAnyValue(deep))
+      expect(encoded).toContain('[Truncated]')
+      expect(encoded.split('"next"').length - 1).toBe(20)
+    })
+
+    it('marks a throwing getter without losing the rest of the object', () => {
+      const attrs = {
+        ok: 1,
+        get bad(): number {
+          throw new Error('getter blew up')
+        },
+      }
+      expect(() => toOtlpKeyValueList(attrs)).not.toThrow()
+      expect(toOtlpKeyValueList(attrs)).toEqual([
+        { key: 'ok', value: { intValue: '1' } },
+        { key: 'bad', value: { stringValue: '[Unserializable]' } },
+      ])
+    })
+
+    // for...in walks the prototype chain once own keys are exhausted.
+    it('ignores inherited enumerable properties', () => {
+      const inherited: Record<string, unknown> = Object.create({ fromPrototype: 'leaked' })
+      inherited.own = 1
+      expect(toOtlpAnyValue(inherited)).toEqual({
+        kvlistValue: { values: [{ key: 'own', value: { intValue: '1' } }] },
       })
     })
+
+    // `String(fn)` would put the function's source text on the wire.
+    it('marks function and symbol values instead of stringifying them', () => {
+      expect(toOtlpAnyValue({ handler: () => 1, retries: 2 } as unknown as LogAttributeValue)).toEqual({
+        kvlistValue: {
+          values: [
+            { key: 'handler', value: { stringValue: '[Function]' } },
+            { key: 'retries', value: { intValue: '2' } },
+          ],
+        },
+      })
+      expect(toOtlpAnyValue({ sym: Symbol('x') } as unknown as LogAttributeValue)).toEqual({
+        kvlistValue: { values: [{ key: 'sym', value: { stringValue: 'Symbol(x)' } }] },
+      })
+    })
+
+    // dayjs, Decimal, ORM documents.
+    it('honours toJSON', () => {
+      const wrapped = { toJSON: () => ({ amount: 5 }) }
+      expect(toOtlpAnyValue(wrapped as unknown as LogAttributeValue)).toEqual({
+        kvlistValue: { values: [{ key: 'amount', value: { intValue: '5' } }] },
+      })
+    })
+
+    it('falls back to the plain walk when toJSON throws', () => {
+      const wrapped = {
+        kept: 1,
+        toJSON: () => {
+          throw new Error('nope')
+        },
+      }
+      expect(toOtlpAnyValue(wrapped as unknown as LogAttributeValue)).toEqual({
+        kvlistValue: {
+          values: [
+            { key: 'kept', value: { intValue: '1' } },
+            { key: 'toJSON', value: { stringValue: '[Function]' } },
+          ],
+        },
+      })
+    })
+
+    // A toJSON returning its own object is a cycle like any other.
+    it('marks a cycle that runs through toJSON', () => {
+      const cyclic: Record<string, unknown> = {}
+      cyclic.toJSON = () => ({ inner: cyclic })
+      expect(toOtlpAnyValue(cyclic)).toEqual({
+        kvlistValue: { values: [{ key: 'inner', value: { stringValue: '[Circular]' } }] },
+      })
+    })
+
+    // Both `null` and `{}` here are rejected for the whole request; iOS and
+    // Android drop them too.
+    it('drops holes and nullish elements from arrays', () => {
+      // eslint-disable-next-line no-sparse-arrays
+      expect(toOtlpAnyValue([1, , 3])).toEqual({
+        arrayValue: { values: [{ intValue: '1' }, { intValue: '3' }] },
+      })
+      expect(toOtlpAnyValue([1, null, undefined, 3])).toEqual({
+        arrayValue: { values: [{ intValue: '1' }, { intValue: '3' }] },
+      })
+    })
+
+    it('stops encoding array items once the node budget is spent', () => {
+      const row: Record<string, number> = {}
+      for (let i = 0; i < 20; i++) {
+        row[`k${i}`] = i
+      }
+      const wide = Array.from({ length: 1000 }, () => ({ ...row }))
+      const values = toOtlpAnyValue(wide).arrayValue!.values
+      expect(values[values.length - 1]).toEqual({ stringValue: '[Truncated]' })
+      // One marker, not one per unencodable item.
+      expect(values.filter((v) => v.stringValue === '[Truncated]')).toHaveLength(1)
+    })
+
+    it('caps a shared object graph instead of expanding it', () => {
+      let graph: Record<string, unknown> = { leaf: true }
+      for (let i = 0; i < 20; i++) {
+        graph = { a: graph, b: graph }
+      }
+      const encoded = JSON.stringify(toOtlpAnyValue(graph))
+      expect(encoded).toContain('[Truncated]')
+      expect(encoded.length).toBeLessThan(1_000_000)
+    })
+
+    it('caps a very wide object without inventing an attribute key', () => {
+      const wide: Record<string, number> = {}
+      for (let i = 0; i < 5000; i++) {
+        wide[`k${i}`] = i
+      }
+      const logger = { debug: jest.fn(), info: jest.fn(), warn: jest.fn(), error: jest.fn(), critical: jest.fn() }
+      const values = toOtlpAnyValue(wide, logger as any).kvlistValue!.values
+      expect(values).toHaveLength(1000)
+      expect(values.every((v) => v.key.startsWith('k'))).toBe(true)
+      expect(logger.debug).toHaveBeenCalledWith(expect.stringContaining('truncated'))
+    })
+
+    // Why the encoder does not delegate to toJsonSafeValue: that maps them to null.
+    it('keeps non-finite floats as strings inside nested objects', () => {
+      expect(toOtlpAnyValue({ nested: { ratio: NaN } })).toEqual({
+        kvlistValue: {
+          values: [
+            {
+              key: 'nested',
+              value: { kvlistValue: { values: [{ key: 'ratio', value: { stringValue: 'NaN' } }] } },
+            },
+          ],
+        },
+      })
+    })
+
+    // A lone surrogate survives JSON.stringify as a \uD800 escape, which the
+    // server rejects for the whole request.
+    it('replaces unpaired surrogates in values and keys', () => {
+      expect(toOtlpAnyValue('ok\ud83d')).toEqual({ stringValue: 'ok\ufffd' })
+      expect(toOtlpAnyValue({ nested: 'ok\ud83d' })).toEqual({
+        kvlistValue: { values: [{ key: 'nested', value: { stringValue: 'ok\ufffd' } }] },
+      })
+      expect(toOtlpKeyValueList({ 'key\ud83d': 1 })).toEqual([{ key: 'key\ufffd', value: { intValue: '1' } }])
+    })
+
+    it('encodes empty containers with an explicit values array', () => {
+      expect(toOtlpAnyValue({})).toEqual({ kvlistValue: { values: [] } })
+      expect(toOtlpAnyValue([])).toEqual({ arrayValue: { values: [] } })
+    })
+
+    it('keeps a Date whose toISOString is overridden out of the wire format', () => {
+      const broken = new Date('2026-08-20T10:00:00.000Z')
+
+      ;(broken as any).toISOString = () => ({})
+      expect(typeof toOtlpAnyValue(broken as unknown as LogAttributeValue).stringValue).toBe('string')
+    })
+
+    it('encodes sibling references to one object twice, not as circular', () => {
+      const shared = { id: 1 }
+      expect(toOtlpAnyValue({ a: shared, b: shared })).toEqual({
+        kvlistValue: {
+          values: [
+            { key: 'a', value: { kvlistValue: { values: [{ key: 'id', value: { intValue: '1' } }] } } },
+            { key: 'b', value: { kvlistValue: { values: [{ key: 'id', value: { intValue: '1' } }] } } },
+          ],
+        },
+      })
+    })
+  })
+
+  describe('buildOtlpLogRecord attribute reads', () => {
+    // Reading `options.attributes` happens before the encoder's per-key guard.
+    it('marks an attribute whose getter throws without dropping the record', () => {
+      const attributes = {
+        ok: 1,
+        get bad(): number {
+          throw new Error('disposed store')
+        },
+      }
+      const record = buildOtlpLogRecord({ body: 'x', attributes }, {})
+      expect(record.attributes).toContainEqual({ key: 'ok', value: { intValue: '1' } })
+      expect(record.attributes).toContainEqual({ key: 'bad', value: { stringValue: '[Unserializable]' } })
+    })
+
+    // Plain assignment hits the prototype setter and the attribute vanishes.
+    it('keeps an attribute literally named __proto__', () => {
+      const attributes = JSON.parse('{"__proto__": {"a": 1}, "normal": "n"}')
+      const record = buildOtlpLogRecord({ body: 'x', attributes }, {})
+      expect(record.attributes.map((a) => a.key)).toContain('__proto__')
+    })
+
+    it('coerces a non-string body', () => {
+      // A non-string stringValue is refused for the whole request.
+      const record = buildOtlpLogRecord({ body: 12345 as unknown as string }, {})
+      expect(record.body).toEqual({ stringValue: '12345' })
+    })
+
+    // `String()` throws on these, and buildOtlpLogRecord is called straight from
+    // captureLog — beforeSend can also hand back any body.
+    it('marks a body that cannot be coerced to a string', () => {
+      const throwing = {
+        toString() {
+          throw new Error('boom')
+        },
+      } as unknown as string
+      expect(() => buildOtlpLogRecord({ body: throwing }, {})).not.toThrow()
+      expect(buildOtlpLogRecord({ body: throwing }, {}).body).toEqual({ stringValue: '[Unserializable]' })
+      expect(buildOtlpLogRecord({ body: Object.create(null) }, {}).body).toEqual({
+        stringValue: '[Unserializable]',
+      })
+    })
+
+    it('keeps the record when the attributes object itself cannot be read', () => {
+      const revocable = Proxy.revocable({ a: 1 }, {})
+      revocable.revoke()
+
+      expect(buildOtlpLogRecord({ body: 'x', attributes: revocable.proxy }, {}).body).toEqual({ stringValue: 'x' })
+    })
   })
 
   describe('toOtlpKeyValueList', () => {
@@ -130,7 +435,7 @@ describe('logs-utils', () => {
         })
       ).toEqual([
         { key: 'name', value: { stringValue: 'test' } },
-        { key: 'count', value: { intValue: 5 } },
+        { key: 'count', value: { intValue: '5' } },
         { key: 'active', value: { boolValue: true } },
       ])
     })

package/node_modules/@posthog/core/src/logs/logs-utils.ts

@@ -9,8 +9,19 @@ import type {
   OtlpSeverityEntry,
   OtlpSeverityText,
 } from '@posthog/types'
+import type { Logger } from '../types'
 import type { LogSdkContext, ResolvedPostHogLogsConfig } from './types'
 import { isArray, isBoolean, isNull, isNullish, isUndefined } from '../utils'
+import {
+  CIRCULAR_VALUE,
+  FUNCTION_VALUE,
+  MAX_JSON_SAFE_VALUE_DEPTH,
+  MAX_JSON_SAFE_VALUE_ITEMS,
+  MAX_JSON_SAFE_VALUE_NODES,
+  sanitizeString,
+  TRUNCATED_VALUE,
+  UNSERIALIZABLE_VALUE,
+} from '../utils/json-utils'
 
 // ============================================================================
 // Severity mapping
@@ -39,49 +50,192 @@ export function getOtlpSeverityNumber(level: LogSeverityLevel): number {
 // OTLP AnyValue conversion
 // ============================================================================
 
-export function toOtlpAnyValue(value: LogAttributeValue): OtlpAnyValue {
+// 2^63 — one past int64 max.
+const INT64_RANGE_LIMIT = 9223372036854775808
+
+const propertyIsEnumerable = Object.prototype.propertyIsEnumerable
+
+interface EncodeState {
+  /** Containers on the current path, so a back-reference becomes a marker. */
+  ancestors: WeakSet<object>
+  remainingNodes: number
+}
+
+function newState(): EncodeState {
+  return { ancestors: new WeakSet(), remainingNodes: MAX_JSON_SAFE_VALUE_NODES }
+}
+
+export function toOtlpAnyValue(value: LogAttributeValue, logger?: Logger): OtlpAnyValue {
+  try {
+    return encodeAnyValue(value, logger, newState(), 0)
+  } catch {
+    // Runs inside `captureLog` and the metrics flush: an error escaping here
+    // surfaces in the caller's own code.
+    return { stringValue: UNSERIALIZABLE_VALUE }
+  }
+}
+
+export function toOtlpKeyValueList(attrs: Record<string, LogAttributeValue>, logger?: Logger): OtlpKeyValue[] {
+  try {
+    return encodeKeyValueList(attrs, logger, newState(), 0)
+  } catch {
+    return []
+  }
+}
+
+function encodeAnyValue(
+  value: LogAttributeValue,
+  logger: Logger | undefined,
+  state: EncodeState,
+  depth: number
+): OtlpAnyValue {
+  if (state.remainingNodes <= 0) {
+    return { stringValue: TRUNCATED_VALUE }
+  }
+  state.remainingNodes--
+
   if (isBoolean(value)) {
     return { boolValue: value }
   }
-  // NOTE: typeof check (not core's isNumber) so NaN is included. core's
-  // isNumber explicitly excludes NaN via the `x === x` guard, which would
-  // route NaN through the JSON.stringify branch below — JSON has no
-  // representation for non-finite floats and JSON.stringify turns them into
-  // `null`, losing the value server-side. proto3 JSON mapping (which OTLP/HTTP
-  // rides) requires the literal strings; we encode them as stringValue to keep
-  // the human-readable signal regardless of which downstream parser sees them.
+  // typeof, not core's isNumber, which excludes NaN — proto3 JSON distinguishes
+  // a non-finite float from an ordinary string.
   if (typeof value === 'number') {
     if (!Number.isFinite(value)) {
       return { stringValue: String(value) }
     }
     if (Number.isInteger(value)) {
-      return { intValue: value }
+      if (Number.isSafeInteger(value)) {
+        return { intValue: String(value) }
+      }
+      // Past MAX_SAFE_INTEGER only BigInt gives the double's exact decimal:
+      // `String(-(2**63))` lands 192 below int64 min, outside the field it is
+      // about to be parsed into. Without BigInt the value rides as a string,
+      // which is never range-checked.
+      if (typeof BigInt === 'undefined') {
+        return { stringValue: String(value) }
+      }
+      const decimal = BigInt(value).toString()
+      if (value >= INT64_RANGE_LIMIT || value < -INT64_RANGE_LIMIT) {
+        // An out-of-range intValue 400s the whole logs request; on the metrics
+        // path it is swallowed server-side and the metric just disappears.
+        logger?.debug(`Attribute ${decimal} is outside the int64 range; encoding it as a string`)
+        return { stringValue: decimal }
+      }
+      return { intValue: decimal }
     }
     return { doubleValue: value }
   }
   if (typeof value === 'string') {
-    return { stringValue: value }
+    return { stringValue: sanitizeString(value) }
   }
-  if (isArray(value)) {
-    return { arrayValue: { values: value.map((v) => toOtlpAnyValue(v as LogAttributeValue)) } }
+  // `String(value)` would put a function's source text on the wire.
+  if (typeof value === 'function') {
+    return { stringValue: FUNCTION_VALUE }
   }
-  // Objects fall back to JSON. OTLP supports kvlistValue but the encoder
-  // stays flat for simplicity.
-  try {
-    return { stringValue: JSON.stringify(value) }
-  } catch {
+  if (typeof value === 'symbol') {
     return { stringValue: String(value) }
   }
+  if (typeof value === 'object' && value !== null) {
+    if (state.ancestors.has(value)) {
+      return { stringValue: CIRCULAR_VALUE }
+    }
+    if (depth >= MAX_JSON_SAFE_VALUE_DEPTH) {
+      return { stringValue: TRUNCATED_VALUE }
+    }
+    if (value instanceof Date) {
+      const time = value.getTime()
+      const iso = Number.isFinite(time) ? value.toISOString() : String(value)
+      // An overridden toISOString can return a non-string, which the server
+      // refuses for the whole request.
+      return { stringValue: typeof iso === 'string' ? sanitizeString(iso) : String(iso) }
+    }
+    // Registered before the toJSON probe: a toJSON returning a structure that
+    // references its own object is a cycle like any other.
+    state.ancestors.add(value)
+    try {
+      // The representation a value defines for itself — dayjs, Decimal, an ORM
+      // document, and a cross-realm Date that fails the `instanceof` above.
+      try {
+        const toJSON = (value as { toJSON?: unknown }).toJSON
+        if (typeof toJSON === 'function') {
+          return encodeAnyValue(toJSON.call(value) as LogAttributeValue, logger, state, depth + 1)
+        }
+      } catch {
+        // A throwing toJSON falls through to the plain walk.
+      }
+      if (isArray(value)) {
+        return { arrayValue: { values: encodeArrayValues(value, logger, state, depth + 1) } }
+      }
+      return {
+        kvlistValue: {
+          values: encodeKeyValueList(value as Record<string, LogAttributeValue>, logger, state, depth + 1),
+        },
+      }
+    } finally {
+      // Siblings that reference the same object are duplication, not a cycle.
+      state.ancestors.delete(value)
+    }
+  }
+  return { stringValue: sanitizeString(String(value)) }
+}
+
+function encodeArrayValues(
+  values: unknown[],
+  logger: Logger | undefined,
+  state: EncodeState,
+  depth: number
+): OtlpAnyValue[] {
+  const result: OtlpAnyValue[] = []
+  const itemCount = Math.min(values.length, MAX_JSON_SAFE_VALUE_ITEMS)
+  let index = 0
+  for (; index < itemCount && state.remainingNodes > 0; index++) {
+    try {
+      const element = index in values ? values[index] : undefined
+      // Dropped, as iOS and Android do: proto3 JSON has no null AnyValue, and
+      // both `null` and `{}` here are rejected for the whole request.
+      if (isNullish(element)) {
+        continue
+      }
+      result.push(encodeAnyValue(element as LogAttributeValue, logger, state, depth))
+    } catch {
+      result.push({ stringValue: UNSERIALIZABLE_VALUE })
+    }
+  }
+  if (values.length > index) {
+    result.push({ stringValue: TRUNCATED_VALUE })
+  }
+  return result
 }
 
-export function toOtlpKeyValueList(attrs: Record<string, LogAttributeValue>): OtlpKeyValue[] {
+function encodeKeyValueList(
+  attrs: Record<string, LogAttributeValue>,
+  logger: Logger | undefined,
+  state: EncodeState,
+  depth: number
+): OtlpKeyValue[] {
   const result: OtlpKeyValue[] = []
   for (const key in attrs) {
-    const value = attrs[key]
-    if (isNull(value) || isUndefined(value)) {
+    // for...in walks the prototype chain once own keys are exhausted. Skipped
+    // rather than broken out of: a proxy can yield keys in any order.
+    if (!propertyIsEnumerable.call(attrs, key)) {
       continue
     }
-    result.push({ key, value: toOtlpAnyValue(value) })
+    if (result.length >= MAX_JSON_SAFE_VALUE_ITEMS || state.remainingNodes <= 0) {
+      // Reported rather than written into the attributes: a synthetic key would
+      // land in the user's own namespace and could collide with a real one.
+      logger?.debug('Attributes truncated: the value exceeds the OTLP encoder budget')
+      break
+    }
+    try {
+      const value = attrs[key]
+      if (isNull(value) || isUndefined(value)) {
+        continue
+      }
+      result.push({ key: sanitizeString(key), value: encodeAnyValue(value, logger, state, depth) })
+    } catch {
+      // A getter that throws costs its own key, not the whole record.
+      result.push({ key: sanitizeString(key), value: { stringValue: UNSERIALIZABLE_VALUE } })
+    }
   }
   return result
 }
@@ -111,7 +265,22 @@ function timestampToUnixNano(): string {
  *
  * User-provided `options.attributes` always wins on conflicts.
  */
-export function buildOtlpLogRecord(options: CaptureLogOptions, sdkContext: LogSdkContext): OtlpLogRecord {
+// `body` is only typed as a string. An untyped caller — or a `beforeSend` that
+// rewrites it — can pass anything, and `String()` throws on a value whose
+// `toString` does, or on a null-prototype object.
+function encodeBody(body: string): string {
+  try {
+    return sanitizeString(String(body))
+  } catch {
+    return UNSERIALIZABLE_VALUE
+  }
+}
+
+export function buildOtlpLogRecord(
+  options: CaptureLogOptions,
+  sdkContext: LogSdkContext,
+  logger?: Logger
+): OtlpLogRecord {
   const level: LogSeverityLevel = options.level || 'info'
   const { text: severityText, number: severityNumber } = OTLP_SEVERITY_MAP[level] || DEFAULT_OTLP_SEVERITY
   const now = timestampToUnixNano()
@@ -146,9 +315,28 @@ export function buildOtlpLogRecord(options: CaptureLogOptions, sdkContext: LogSd
     autoAttributes.feature_flags = sdkContext.activeFeatureFlags
   }
 
-  const mergedAttributes = {
-    ...autoAttributes,
-    ...(options.attributes || {}),
+  // Read key by key rather than spreading: a getter over a disposed store or a
+  // revoked proxy throws on the read itself, before the encoder's guards see it.
+  const mergedAttributes: Record<string, LogAttributeValue> = { ...autoAttributes }
+  const userAttributes = options.attributes
+  if (userAttributes) {
+    let keys: string[] = []
+    try {
+      keys = Object.keys(userAttributes)
+    } catch {
+      keys = []
+    }
+    for (const key of keys) {
+      let value: LogAttributeValue
+      try {
+        value = userAttributes[key]
+      } catch {
+        value = UNSERIALIZABLE_VALUE
+      }
+      // defineProperty, not assignment: `attributes['__proto__'] = v` hits the
+      // prototype setter and the attribute vanishes.
+      Object.defineProperty(mergedAttributes, key, { value, enumerable: true, writable: true, configurable: true })
+    }
   }
 
   const record: OtlpLogRecord = {
@@ -156,8 +344,8 @@ export function buildOtlpLogRecord(options: CaptureLogOptions, sdkContext: LogSd
     observedTimeUnixNano: now,
     severityNumber,
     severityText,
-    body: { stringValue: options.body },
-    attributes: toOtlpKeyValueList(mergedAttributes),
+    body: { stringValue: encodeBody(options.body) },
+    attributes: toOtlpKeyValueList(mergedAttributes, logger),
   }
 
   if (options.trace_id) {

package/node_modules/@posthog/core/src/metrics/index.spec.ts

@@ -169,10 +169,24 @@ describe('PostHogMetrics', () => {
 
       const attrs = sentMetrics()[0].sum!.dataPoints[0].attributes
       expect(attrs).toContainEqual({ key: 'route', value: { stringValue: '/home' } })
-      expect(attrs).toContainEqual({ key: 'retries', value: { intValue: 2 } })
+      expect(attrs).toContainEqual({ key: 'retries', value: { intValue: '2' } })
       expect(attrs).toContainEqual({ key: 'cached', value: { boolValue: true } })
     })
 
+    // The encoder is shared with logs, so the debug line it emits on the
+    // out-of-range path only reaches anyone if metrics passes its logger down.
+    it('encodes an out-of-int64 attribute as a string and reports it through the logger', async () => {
+      const metrics = createMetrics()
+      metrics.count('api_calls', 1, { attributes: { huge: 2 ** 63 } as any })
+      await metrics.flush()
+
+      const attrs = sentMetrics()[0].sum!.dataPoints[0].attributes
+      expect(attrs).toContainEqual({ key: 'huge', value: { stringValue: '9223372036854775808' } })
+      expect((logger.debug as jest.Mock).mock.calls.some((c) => String(c[0]).includes('outside the int64 range'))).toBe(
+        true
+      )
+    })
+
     it('stamps delta data points with a window: startTimeUnixNano <= timeUnixNano, both nano strings', async () => {
       const metrics = createMetrics()
       metrics.count('orders_created', 1)