@zuplo/cli 7.7.10 → 7.7.12

package/node_modules/@posthog/core/src/error-tracking/error-properties-builder.metadata.spec.ts

@@ -0,0 +1,318 @@
+import { ErrorCoercer, ErrorEventCoercer, ObjectCoercer, PrimitiveCoercer, StringCoercer } from './coercers'
+import { ErrorPropertiesBuilder } from './error-properties-builder'
+import { chromeStackLineParser, createStackParser } from './parsers'
+
+// Canonical nested_cause and aggregate examples from the exception-event-metadata specification.
+describe('ErrorPropertiesBuilder relationship metadata', () => {
+  const builder = new ErrorPropertiesBuilder(
+    [new ErrorEventCoercer(), new ErrorCoercer(), new ObjectCoercer(), new StringCoercer(), new PrimitiveCoercer()],
+    createStackParser('web:javascript', chromeStackLineParser)
+  )
+  function error(type: string, value: string, cause?: unknown): Error {
+    const result = new Error(value, { cause })
+    result.name = type
+    result.stack = undefined
+    return result
+  }
+
+  it('matches the canonical cause example without inventing nested handled state', () => {
+    expect(
+      builder.buildFromUnknown(error('CheckoutError', 'Checkout failed', error('DatabaseError', 'Connection failed')))
+    ).toEqual({
+      $exception_level: 'error',
+      $exception_list: [
+        {
+          type: 'CheckoutError',
+          value: 'Checkout failed',
+          mechanism: { type: 'generic', handled: true, synthetic: false, exception_id: 0 },
+        },
+        {
+          type: 'DatabaseError',
+          value: 'Connection failed',
+          mechanism: { type: 'chained', source: 'cause', synthetic: false, exception_id: 1, parent_id: 0 },
+        },
+      ],
+    })
+  })
+
+  it('matches the canonical aggregate example including the second member cause', () => {
+    const root = new AggregateError(
+      [
+        error('NetworkError', 'Network failed'),
+        error('ValidationError', 'Validation failed', error('ParseError', 'Invalid value')),
+      ],
+      'Two operations failed'
+    )
+    root.stack = undefined
+    expect(builder.buildFromUnknown(root, { mechanism: { type: 'task', handled: false } }).$exception_list).toEqual([
+      {
+        type: 'AggregateError',
+        value: 'Two operations failed',
+        mechanism: { type: 'task', handled: false, synthetic: false, exception_id: 0 },
+      },
+      {
+        type: 'NetworkError',
+        value: 'Network failed',
+        mechanism: { type: 'chained', source: 'member', synthetic: false, exception_id: 1, parent_id: 0 },
+      },
+      {
+        type: 'ValidationError',
+        value: 'Validation failed',
+        mechanism: { type: 'chained', source: 'member', synthetic: false, exception_id: 2, parent_id: 0 },
+      },
+      {
+        type: 'ParseError',
+        value: 'Invalid value',
+        mechanism: { type: 'chained', source: 'cause', synthetic: false, exception_id: 3, parent_id: 2 },
+      },
+    ])
+  })
+
+  it('retains the first 50 entries of a deep cause chain with deterministic valid IDs', () => {
+    let root = error('Error', '60')
+    for (let index = 59; index >= 0; index--) root = error('Error', String(index), root)
+    const first = builder.buildFromUnknown(root).$exception_list
+    expect(first).toEqual(builder.buildFromUnknown(root).$exception_list)
+    expect(first.map((entry) => entry.value)).toEqual(Array.from({ length: 50 }, (_, index) => String(index)))
+    first.forEach((entry, index) => {
+      expect(entry.mechanism?.exception_id).toBe(index)
+      if (index) expect(entry.mechanism?.parent_id).toBe(index - 1)
+    })
+  })
+
+  it('skips cycles and shared objects globally without spending the emission budget', () => {
+    const shared = error('Error', 'shared')
+    const root = new AggregateError([], 'root', { cause: shared })
+    shared.cause = root
+    root.errors = [
+      ...Array(150).fill(root),
+      ...Array(150).fill(shared),
+      ...Array.from({ length: 60 }, (_, index) => error('Error', String(index))),
+    ]
+    expect(builder.buildFromUnknown(root).$exception_list.map((entry) => entry.value)).toEqual([
+      'root',
+      'shared',
+      ...Array.from({ length: 48 }, (_, index) => String(index)),
+    ])
+  })
+
+  it('does not read handled properties from user errors or inherit root provenance', () => {
+    const child = error('Error', 'native')
+    Object.defineProperty(child, 'handled', {
+      get() {
+        throw new Error('untrusted')
+      },
+    })
+    const root = new AggregateError([child, 'converted'], 'root')
+    root.stack = undefined
+    const entries = builder.buildFromUnknown(root, {
+      syntheticException: new Error('capture'),
+      mechanism: { handled: false, type: 'middleware' },
+    }).$exception_list
+    expect(entries.map((entry) => entry.mechanism)).toEqual([
+      { type: 'middleware', handled: false, synthetic: true, exception_id: 0 },
+      { type: 'chained', source: 'member', synthetic: false, exception_id: 1, parent_id: 0 },
+      { type: 'chained', source: 'member', synthetic: true, exception_id: 2, parent_id: 0 },
+    ])
+  })
+
+  it('preserves typed capture metadata but assigns root linkage at final assembly', () => {
+    const root = error('Error', 'root', error('Error', 'child'))
+    const entries = builder.buildFromUnknown(root, {
+      mechanism: {
+        type: 'custom.integration',
+        handled: false,
+        synthetic: true,
+        exception_id: 81,
+        parent_id: 80,
+        source: 'cause',
+      },
+    }).$exception_list
+    expect(entries[0].mechanism).toEqual({
+      type: 'custom.integration',
+      handled: false,
+      synthetic: true,
+      exception_id: 0,
+    })
+    expect(entries[1].mechanism).toEqual({
+      type: 'chained',
+      source: 'cause',
+      synthetic: false,
+      exception_id: 1,
+      parent_id: 0,
+    })
+  })
+  it.each([undefined, '', 123])('keeps a native child without a usable stack non-synthetic: %s', (stack) => {
+    const child = error('Error', 'child')
+    child.stack = stack as string | undefined
+    const entries = builder.buildFromUnknown(new Error('root', { cause: child })).$exception_list
+    expect(entries[1].mechanism?.synthetic).toBe(false)
+    expect(entries[1].stacktrace).toBeUndefined()
+  })
+
+  it('keeps a native child with a throwing stack accessor non-synthetic', () => {
+    const child = error('Error', 'child')
+    Object.defineProperty(child, 'stack', {
+      get() {
+        throw new Error('unreadable')
+      },
+    })
+    const entries = builder.buildFromUnknown(new Error('root', { cause: child })).$exception_list
+    expect(entries[1]).toEqual({
+      type: 'Error',
+      value: 'child',
+      mechanism: { type: 'chained', source: 'cause', synthetic: false, exception_id: 1, parent_id: 0 },
+    })
+  })
+
+  it.each(['yes', null, 0, {}, []])('omits invalid handled metadata: %j', (handled) => {
+    const entries = builder.buildFromUnknown(error('Error', 'root'), {
+      mechanism: { type: '', handled, synthetic: true } as any,
+    }).$exception_list
+    expect(entries[0].mechanism).toEqual({ type: 'generic', synthetic: true, exception_id: 0 })
+    expect(entries[0].mechanism).not.toHaveProperty('handled')
+  })
+
+  it.each([undefined, true, false])(
+    'preserves the manual capture default and boolean handled metadata: %s',
+    (handled) => {
+      const entries = builder.buildFromUnknown(error('Error', 'root'), { mechanism: { handled } }).$exception_list
+      expect(entries[0].mechanism.handled).toBe(handled === undefined ? true : handled)
+    }
+  )
+
+  it('preserves all supplied mechanism fields in the low-level coercion context', () => {
+    const mechanism = {
+      type: 'custom',
+      handled: false,
+      synthetic: true,
+      source: 'inner',
+      exception_id: 7,
+      parent_id: 6,
+    }
+    const context = builder.buildCoercingContext(mechanism, { mechanism })
+    expect(context.mechanism).toEqual(mechanism)
+    context.apply(error('Error', 'root'))
+    expect(context.mechanism).toEqual(mechanism)
+  })
+
+  it('deduplicates shared exceptions reached through distinct wrappers', () => {
+    const shared = error('Error', 'shared')
+    const root = new AggregateError([shared, { error: shared }, { error: shared }, error('Error', 'last')], 'root')
+    const entries = builder.buildFromUnknown(root).$exception_list
+    expect(entries.map((entry) => entry.value)).toEqual(['root', 'shared', 'last'])
+    expect(entries.map((entry) => entry.mechanism?.exception_id)).toEqual([0, 1, 2])
+  })
+
+  it('resets the wrapper limit on real cause edges', () => {
+    let root = error('Error', '8')
+    for (let index = 7; index >= 0; index--) root = error('Error', String(index), { error: root })
+    expect(builder.buildFromUnknown(root).$exception_list.map((entry) => entry.value)).toEqual(
+      Array.from({ length: 9 }, (_, index) => String(index))
+    )
+  })
+
+  it('bounds consecutive forwarding wrappers without discarding the next member', () => {
+    let wrapper: unknown = error('Error', 'unreachable')
+    for (let index = 0; index < 10; index++) wrapper = { [Symbol.toStringTag]: 'ErrorEvent', error: wrapper }
+    const entries = builder.buildFromUnknown(
+      new AggregateError([wrapper, error('Error', 'last')], 'root')
+    ).$exception_list
+    expect(entries.map((entry) => entry.value)).toEqual(['root', 'Unknown error', 'last'])
+    expect(entries.map((entry) => entry.mechanism?.exception_id)).toEqual([0, 1, 2])
+  })
+
+  it.each([NaN, Infinity, -1, 1.5, 0x100000000, '2'])('ignores invalid proxy collection lengths: %s', (length) => {
+    const root = new AggregateError([], 'root')
+    const readMember = vi.fn()
+    root.errors = new Proxy([], { get: (_target, key) => (key === 'length' ? length : readMember(key)) })
+    expect(builder.buildFromUnknown(root).$exception_list.map((entry) => entry.value)).toEqual(['root'])
+    expect(readMember).not.toHaveBeenCalled()
+  })
+
+  it('reads array length once and ignores later growth', () => {
+    const members = [error('Error', 'first')]
+    const getLength = vi.fn(() => members.length)
+    const root = new AggregateError([], 'root')
+    root.errors = new Proxy(members, {
+      get: (target, key) => {
+        if (key === 'length') return getLength()
+        if (key === '0') members.push(error('Error', 'not in snapshot'))
+        return Reflect.get(target, key)
+      },
+    })
+    expect(builder.buildFromUnknown(root).$exception_list.map((entry) => entry.value)).toEqual(['root', 'first'])
+    expect(getLength).toHaveBeenCalledTimes(1)
+  })
+
+  it('preserves root and cause when reading the collection length throws', () => {
+    const root = new AggregateError([], 'root', { cause: error('Error', 'cause') })
+    root.errors = new Proxy([], {
+      get() {
+        throw new Error('unreadable length')
+      },
+    })
+    expect(builder.buildFromUnknown(root).$exception_list.map((entry) => entry.value)).toEqual(['root', 'cause'])
+  })
+  it('caps huge proxy member collections before reading beyond 1000 attempts and resets between captures', () => {
+    const root = new AggregateError([], 'root')
+    const readMember = vi.fn((index: number) => {
+      // The old implementation also terminates safely: after 1000 duplicate reads,
+      // fallback entries fill its emission budget rather than scanning the huge length.
+      if (index >= 1000) throw new Error('past the inspection budget')
+      return root
+    })
+    root.errors = new Proxy([], {
+      get: (_target, key) => (key === 'length' ? 0xffffffff : readMember(Number(key))),
+    })
+    for (let capture = 0; capture < 2; capture++) {
+      readMember.mockClear()
+      expect(builder.buildFromUnknown(root).$exception_list.map((entry) => entry.value)).toEqual(['root'])
+      expect(readMember).toHaveBeenCalledTimes(1000)
+      expect(readMember).toHaveBeenLastCalledWith(999)
+    }
+    expect(
+      builder
+        .buildFromUnknown(new AggregateError([error('Error', 'fresh child')], 'fresh root'))
+        .$exception_list.map((entry) => entry.value)
+    ).toEqual(['fresh root', 'fresh child'])
+  })
+
+  it('shares attempted member inspections across groups, including throwing getters, without limiting cause edges', () => {
+    const root = new AggregateError([], 'root')
+    const first = new AggregateError(Array(600).fill(root), 'first group')
+    Object.defineProperty(first.errors, '0', {
+      get() {
+        throw new Error('unreadable member')
+      },
+    })
+    let cause = error('Error', 'cause 8')
+    for (let index = 7; index >= 0; index--) cause = error('Error', `cause ${index}`, cause)
+    const second = new AggregateError([...Array(397).fill(root), cause, error('Error', 'past budget')], 'second group')
+    const readLastRootMember = vi.fn(() => error('Error', 'unread root member'))
+    root.errors = [first, second]
+    Object.defineProperty(root.errors, '2', { get: readLastRootMember })
+    const entries = builder.buildFromUnknown(root).$exception_list
+    // 1 first-group access + 600 members + 1 second-group access + 398 members.
+    expect(entries.map((entry) => entry.value)).toEqual([
+      'root',
+      'first group',
+      'Unknown error',
+      'second group',
+      ...Array.from({ length: 9 }, (_, index) => `cause ${index}`),
+    ])
+    expect(readLastRootMember).not.toHaveBeenCalled()
+    entries.forEach((entry, index) => {
+      expect(entry.mechanism?.exception_id).toBe(index)
+      if (index > 0) {
+        expect(entry.mechanism).toEqual({
+          type: 'chained',
+          source: index > 4 ? 'cause' : 'member',
+          synthetic: index === 2,
+          exception_id: index,
+          parent_id: index === 1 || index === 3 ? 0 : index - 1,
+        })
+      }
+    })
+  })
+})

package/node_modules/@posthog/core/src/error-tracking/error-properties-builder.ts

@@ -1,4 +1,4 @@
-import { isArray } from '@/utils'
+import { isArray, isError } from '@/utils'
 import { getFilenameToChunkIdMap } from './chunk-ids'
 import {
   ErrorProperties,
@@ -17,7 +17,20 @@ import {
   Exception,
 } from './types'
 
-const MAX_CAUSE_RECURSION = 4
+const MAX_EXCEPTIONS = 50
+const MAX_AGGREGATE_MEMBER_INSPECTIONS = 1000
+const MAX_ERROR_PROTOTYPE_DEPTH = 100
+// Forwarding wrappers do not represent tree edges or consume exception slots.
+const MAX_WRAPPER_RECURSION = 4
+
+// Internal collections only: the event remains a flat ExceptionList.
+interface ExceptionWithChildren extends ExceptionLike {
+  errors?: ExceptionWithChildren[]
+}
+
+interface ParsedExceptionWithChildren extends ParsedException {
+  errors?: ParsedExceptionWithChildren[]
+}
 
 export class ErrorPropertiesBuilder {
   constructor(
@@ -61,16 +74,20 @@ export class ErrorPropertiesBuilder {
     }
   }
 
-  private parseStacktrace(err: ExceptionLike, ctx: ParsingContext): ParsedException {
+  private parseStacktrace(err: ExceptionWithChildren, ctx: ParsingContext): ParsedExceptionWithChildren {
     let cause: ParsedException | undefined = undefined
     if (err.cause != null) {
       cause = this.parseStacktrace(err.cause, ctx)
     }
     let stack: StackFrame[] | undefined = undefined
     if (err.stack != '' && err.stack != null) {
-      stack = this.applyChunkIds(this.stackParser(err.stack, err.synthetic ? ctx.skipFirstLines : 0), ctx.chunkIdMap)
+      try {
+        stack = this.applyChunkIds(this.stackParser(err.stack, err.synthetic ? ctx.skipFirstLines : 0), ctx.chunkIdMap)
+      } catch {
+        // A malformed stack must not discard this exception or its relatives.
+      }
     }
-    return { ...err, cause, stack }
+    return { ...err, cause, stack, errors: err.errors?.map((child) => this.parseStacktrace(child, ctx)) }
   }
 
   private applyChunkIds(frames: StackFrame[], chunkIdMap?: ChunkIdMapType): StackFrame[] {
@@ -99,32 +116,46 @@ export class ErrorPropertiesBuilder {
     return newFrames
   }
 
-  private convertToExceptionList(exceptionWithStack: ParsedException, mechanism: Mechanism): ExceptionList {
-    const currentException: Exception = {
-      type: exceptionWithStack.type,
-      value: exceptionWithStack.value,
-      mechanism: {
-        type: mechanism.type ?? 'generic',
-        handled: mechanism.handled ?? true,
-        synthetic: exceptionWithStack.synthetic ?? false,
-      },
-    }
-    if (exceptionWithStack.stack) {
-      currentException.stacktrace = {
-        type: 'raw',
-        frames: exceptionWithStack.stack,
+  private convertToExceptionList(exceptionWithStack: ParsedExceptionWithChildren, mechanism: Mechanism): ExceptionList {
+    const exceptionList: ExceptionList = []
+    const append = (exception: ParsedExceptionWithChildren, parentId?: number, source?: string): void => {
+      const exceptionId = exceptionList.length
+      const entryMechanism: Mechanism =
+        parentId === undefined
+          ? {
+              type: typeof mechanism.type === 'string' && mechanism.type.length > 0 ? mechanism.type : 'generic',
+              ...(typeof mechanism.handled === 'boolean'
+                ? { handled: mechanism.handled }
+                : mechanism.handled === undefined
+                  ? { handled: true }
+                  : {}),
+              synthetic: typeof mechanism.synthetic === 'boolean' ? mechanism.synthetic : exception.synthetic,
+              exception_id: exceptionId,
+            }
+          : {
+              type: 'chained',
+              source,
+              synthetic: exception.synthetic,
+              exception_id: exceptionId,
+              parent_id: parentId,
+            }
+      const currentException: Exception = {
+        type: exception.type,
+        value: exception.value,
+        mechanism: entryMechanism,
+      }
+      if (exception.stack) {
+        currentException.stacktrace = { type: 'raw', frames: exception.stack }
+      }
+      exceptionList.push(currentException)
+      if (exception.cause) {
+        append(exception.cause, exceptionId, 'cause')
+      }
+      for (const child of exception.errors ?? []) {
+        append(child, exceptionId, 'member')
       }
     }
-    const exceptionList: ExceptionList = [currentException]
-    if (exceptionWithStack.cause != null) {
-      // Cause errors are necessarily handled
-      exceptionList.push(
-        ...this.convertToExceptionList(exceptionWithStack.cause, {
-          ...mechanism,
-          handled: true,
-        })
-      )
-    }
+    append(exceptionWithStack)
     return exceptionList
   }
 
@@ -136,29 +167,126 @@ export class ErrorPropertiesBuilder {
     return context
   }
 
+  private getAggregateErrors(input: unknown): unknown[] | undefined {
+    try {
+      if (isError(input)) {
+        // AggregateError shares Error's toString tag; instanceof misses other realms.
+        let prototype = Object.getPrototypeOf(input)
+        for (let depth = 0; prototype && depth < MAX_ERROR_PROTOTYPE_DEPTH; depth++) {
+          const constructor = Object.getOwnPropertyDescriptor(prototype, 'constructor')?.value
+          if (typeof constructor === 'function' && constructor.name === 'AggregateError') {
+            const errors = (input as Error & { errors?: unknown }).errors
+            return isArray(errors) ? errors : undefined
+          }
+          prototype = Object.getPrototypeOf(prototype)
+        }
+      }
+    } catch {
+      // Malformed prototypes or accessors must not discard the root exception.
+    }
+    return undefined
+  }
+
   public buildCoercingContext(mechanism: Mechanism, hint: EventHint, depth: number = 0): CoercingContext {
-    const coerce = (input: unknown, depth: number) => {
-      if (depth <= MAX_CAUSE_RECURSION) {
-        const ctx = this.buildCoercingContext(mechanism, hint, depth)
-        return this.applyCoercers(input, ctx)
-      } else {
+    let count = 0
+    let memberInspections = 0
+    let hasAggregate = false
+    const seen = new Set<unknown>()
+    const wrappers: unknown[] = []
+    const skipped = {}
+    const coerce = (input: unknown, depth: number, wrapperDepth = 0): ExceptionWithChildren | undefined => {
+      const ctx = createContext(depth, wrapperDepth)
+      const forward = ctx.apply
+      ctx.apply = (nextInput) => {
+        wrappers.push(input)
+        try {
+          return forward(nextInput)
+        } finally {
+          wrappers.pop()
+        }
+      }
+      if (wrapperDepth > MAX_WRAPPER_RECURSION || (wrapperDepth > 0 && wrappers.indexOf(input) !== -1)) {
+        return this.coerceFallback(ctx)
+      }
+      const isReference = (typeof input === 'object' && input !== null) || typeof input === 'function'
+      if ((wrapperDepth === 0 && count >= MAX_EXCEPTIONS) || (isReference && seen.has(input))) {
         return undefined
       }
+      if (isReference) {
+        seen.add(input)
+      }
+      if (wrapperDepth === 0) {
+        count++
+      }
+      const errors = this.getAggregateErrors(input)
+      hasAggregate ||= !!errors
+      let exception: ExceptionLike | undefined
+      try {
+        exception = this.applyCoercers(input, ctx)
+        if (!exception) {
+          throw skipped
+        }
+      } catch (error) {
+        if (error === skipped) {
+          if (wrapperDepth === 0) {
+            count--
+          }
+          return undefined
+        }
+        if (!hasAggregate) {
+          throw error
+        }
+        exception = this.coerceFallback(ctx)
+      }
+      if (!errors || count >= MAX_EXCEPTIONS) {
+        return exception
+      }
+      // Snapshot finite array length. A separate inspection budget bounds duplicate
+      // and cyclic members, which can truncate pathological inputs before 50 entries.
+      let length: number
+      try {
+        length = errors.length
+      } catch {
+        return exception
+      }
+      if (!Number.isInteger(length) || length < 0 || length > 0xffffffff) {
+        return exception
+      }
+      const children: ExceptionWithChildren[] = []
+      for (
+        let index = 0;
+        count < MAX_EXCEPTIONS && memberInspections < MAX_AGGREGATE_MEMBER_INSPECTIONS && index < length;
+        index++
+      ) {
+        memberInspections++
+        let child: ExceptionWithChildren | undefined
+        try {
+          child = ctx.next(errors[index])
+        } catch {
+          count++
+          child = this.coerceFallback(createContext(depth + 1))
+        }
+        if (child) {
+          children.push(child)
+        }
+      }
+      return { ...exception, errors: children }
     }
-    const context: CoercingContext = {
+    const createContext = (depth: number, wrapperDepth = 0): CoercingContext => ({
       ...hint,
-      // Do not propagate synthetic exception as it doesn't make sense
+      // Capture-boundary metadata and replacement stacks belong only to the root.
       syntheticException: depth == 0 ? hint.syntheticException : undefined,
-      mechanism,
-      // `coerce` only widens to `undefined` past MAX_CAUSE_RECURSION; `apply` reuses this
-      // context's depth, which was already validated when the context was built
+      mechanism: depth == 0 ? mechanism : {},
       apply: (input: unknown) => {
-        return coerce(input, depth) as ExceptionLike
-      },
-      next: (input: unknown) => {
-        return coerce(input, depth + 1)
+        const exception = coerce(input, depth, wrapperDepth + 1)
+        if (!exception) {
+          throw skipped
+        }
+        return exception
       },
-    }
-    return context
+      next: (input: unknown) => coerce(input, depth + 1),
+    })
+    const context = createContext(depth)
+    return { ...context, apply: (input) => coerce(input, depth) ?? this.coerceFallback(context) }
   }
 }

package/node_modules/@posthog/core/src/error-tracking/types.ts

@@ -44,8 +44,10 @@ export interface Exception {
 export type ExceptionList = Exception[]
 
 export interface Mechanism {
+  exception_id?: number
+  parent_id?: number
   handled?: boolean
-  type?: 'generic' | 'onunhandledrejection' | 'onuncaughtexception' | 'onconsole' | 'middleware'
+  type?: string
   source?: string
   synthetic?: boolean
 }

package/node_modules/@posthog/core/src/posthog-core-stateless.ts

@@ -404,6 +404,15 @@ export abstract class PostHogCoreStateless {
   abstract getLibraryVersion(): string
   abstract getCustomUserAgent(): string | void
 
+  /**
+   * The runtime this client evaluates flags in, sent as `evaluation_runtime` on `/flags`
+   * requests so the server filters by a declared runtime instead of inferring one from
+   * request headers. Undefined leaves the server's inference in place.
+   */
+  protected getEvaluationRuntime(): 'all' | 'client' | 'server' | undefined {
+    return undefined
+  }
+
   // This is our abstracted storage. Each implementation should handle its own
   abstract getPersistedProperty<T>(key: PostHogPersistedProperty): T | undefined
   abstract setPersistedProperty<T>(key: PostHogPersistedProperty, value: T | null): void
@@ -806,6 +815,16 @@ export abstract class PostHogCoreStateless {
       requestData.evaluation_contexts = this.evaluationContexts
     }
 
+    // State the runtime explicitly so the server doesn't have to infer it from the request.
+    // Without it, `/flags` reads the User-Agent first and falls back to browser headers such as
+    // `sec-fetch-mode`, which Node's fetch always sends. An unrecognized User-Agent therefore
+    // resolves to the client runtime rather than to "unknown", and `server` flags are dropped.
+    // Flags marked `all`, and flags with no runtime, are returned either way.
+    const evaluationRuntime = this.getEvaluationRuntime()
+    if (evaluationRuntime) {
+      requestData.evaluation_runtime = evaluationRuntime
+    }
+
     const fetchOptions: PostHogFetchOptions = {
       method: 'POST',
       headers: { ...this.getCustomHeaders(), 'Content-Type': 'application/json' },
@@ -1935,7 +1954,8 @@ export abstract class PostHogCoreStateless {
           // We only throw on HTTP errors if we're not in no-cors mode.
           // https://developer.mozilla.org/en-US/docs/Web/API/Request/mode#no-cors
           const isNoCors = options.mode === 'no-cors'
-          if (!isNoCors && (res.status < 200 || res.status >= 400)) {
+          const maxSuccessStatus = responseHandling.type === 'successful-write' ? 300 : 400
+          if (!isNoCors && (res.status < 200 || res.status >= maxSuccessStatus)) {
             // Read error bodies lazily so retryable statuses are retried immediately. The
             // getter still uses this attempt's deadline when diagnostics request the body.
             throw new PostHogFetchHttpError(res, reqByteLength, requestDeadline, ctrl)

package/node_modules/@posthog/core/src/utils/index.ts

@@ -7,6 +7,7 @@ export * from './bucketed-rate-limiter'
 // Named rather than `export *`: the budgets, markers and `sanitizeString` are
 // shared with the OTLP encoder but are not public API.
 export { toJsonSafeValue } from './json-utils'
+export { parseRetryAfterMs } from './retry-after'
 export * from './number-utils'
 export * from './string-utils'
 export * from './type-utils'

package/node_modules/@posthog/core/src/utils/retry-after.ts

@@ -30,14 +30,19 @@ export function parseRetryAfterMs(value: unknown, now: number = Date.now()): num
   // a comma of its own ("Wed, 21 Oct 2015 07:28:00 GMT").
   const trimmed = /^\d+\s*,/.test(raw) ? raw.slice(0, raw.indexOf(',')).trim() : raw
   // Integer seconds. Not parseFloat: "10 minutes" must not read as 10 seconds.
-  const seconds = /^\d+$/.test(trimmed) ? Number(trimmed) : Number.NaN
-  if (!Number.isFinite(seconds) && /^[+-]?[\d.]+$/.test(trimmed)) {
-    // Numeric but not delta-seconds, so it is malformed. `Date.parse` reads
-    // "-5", "+5" and "5.5" as dates in 2001 rather than rejecting them, which
-    // on a device whose clock predates that would surface as a real wait.
+  if (/^\d+$/.test(trimmed)) {
+    // Cap before multiplication: even a valid integer can overflow to Infinity.
+    const ms = Math.min(Number(trimmed), MAX_RETRY_AFTER_MS / 1000) * 1000
+    return ms > 0 ? ms : undefined
+  }
+  // HTTP dates start with a weekday. Do not let Date.parse guess a date from
+  // malformed seconds, ISO timestamps or month-first dates.
+  if (!/^(Mon|Tue|Wed|Thu|Fri|Sat|Sun)[a-z]*[ ,]/.test(trimmed)) {
     return undefined
   }
-  const ms = Number.isFinite(seconds) ? seconds * 1000 : Date.parse(trimmed) - now
+  // The obsolete asctime HTTP-date omits the timezone, but is still GMT.
+  const date = /^\w{3} \w{3} /.test(trimmed) ? trimmed + ' GMT' : trimmed
+  const ms = Date.parse(date) - now
   if (!Number.isFinite(ms) || ms <= 0) {
     return undefined
   }