@zuplo/cli 7.7.8 → 7.7.9

package/node_modules/@posthog/core/dist/utils/retry-after.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Longest `Retry-After` the SDK will wait. A rate-limit window can legitimately
+ * be long, but nothing upstream of the SDK bounds this header — it is as likely
+ * to come from a proxy or CDN as from PostHog — and an unbounded value would
+ * strand a queue for hours, so the wait is capped and the retry happens early.
+ */
+export declare const MAX_RETRY_AFTER_MS: number;
+/**
+ * `Retry-After` as milliseconds from now. The header is either delta-seconds or
+ * an HTTP-date; anything else, a date already in the past, or a non-positive
+ * delta yields `undefined` so the caller keeps its own backoff. The result is
+ * capped at `MAX_RETRY_AFTER_MS`.
+ */
+export declare function parseRetryAfterMs(value: unknown, now?: number): number | undefined;
+/** The part of an export outcome the window reads. */
+export type RetryAfterOutcome = {
+    kind: 'ok' | 'retry-later' | 'too-large' | 'fatal';
+    retryAfterMs?: number;
+};
+/**
+ * The wait an ingestion endpoint asked for, shared by the logs, metrics and
+ * traces export queues.
+ *
+ * Held as an absolute deadline rather than a duration, so a timer armed while
+ * the wait is already part-served counts down the remainder instead of
+ * restarting it.
+ */
+export declare class RetryAfterWindow {
+    private _until;
+    private _installedAt;
+    /**
+     * Folds one export outcome into the window.
+     *
+     * A refusal naming a longer wait than the one being served pushes the
+     * deadline out, but never past `MAX_RETRY_AFTER_MS` from where the window was
+     * first installed. That ceiling is the SDK's own policy rather than OTLP's,
+     * which asks for the header to be honoured and names no cap: a host flushing
+     * faster than the window is long would otherwise refresh the deadline forever
+     * and never recover, since logs gates its size trigger and `onReconnect` on
+     * the window and metrics re-arms its timer from it. The cost is that a wait
+     * longer than the ceiling is served short.
+     *
+     * The deadline is never pulled in, so a shorter header cannot cut a wait the
+     * endpoint already asked for.
+     */
+    record(outcome: RetryAfterOutcome): void;
+    /**
+     * Milliseconds left of the wait, `0` when none is open. Closes a window it
+     * finds spent, so a later backward clock step cannot bring it back.
+     */
+    remainingMs(): number;
+    isOpen(): boolean;
+    reset(): void;
+}
+//# sourceMappingURL=retry-after.d.ts.map

package/node_modules/@posthog/core/dist/utils/retry-after.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry-after.d.ts","sourceRoot":"","sources":["../../src/utils/retry-after.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QAAa,CAAA;AAS5C;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,GAAE,MAAmB,GAAG,MAAM,GAAG,SAAS,CAuB9F;AAED,sDAAsD;AACtD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,IAAI,GAAG,aAAa,GAAG,WAAW,GAAG,OAAO,CAAA;IAClD,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,MAAM,CAAI;IAClB,OAAO,CAAC,YAAY,CAAI;IAExB;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI;IA8BxC;;;OAGG;IACH,WAAW,IAAI,MAAM;IAarB,MAAM,IAAI,OAAO;IAIjB,KAAK,IAAI,IAAI;CAId"}

package/node_modules/@posthog/core/dist/utils/retry-after.js

@@ -0,0 +1,95 @@
+"use strict";
+var __webpack_require__ = {};
+(()=>{
+    __webpack_require__.d = (exports1, getters, values)=>{
+        var define = (defs, kind)=>{
+            for(var key in defs)if (__webpack_require__.o(defs, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
+                enumerable: true,
+                [kind]: defs[key]
+            });
+        };
+        define(getters, "get");
+        define(values, "value");
+    };
+})();
+(()=>{
+    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
+})();
+(()=>{
+    __webpack_require__.r = (exports1)=>{
+        if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
+            value: 'Module'
+        });
+        Object.defineProperty(exports1, '__esModule', {
+            value: true
+        });
+    };
+})();
+var __webpack_exports__ = {};
+__webpack_require__.r(__webpack_exports__);
+const MAX_RETRY_AFTER_MS = 300000;
+const CLOCK_STEP_TOLERANCE_MS = 5000;
+function parseRetryAfterMs(value, now = Date.now()) {
+    if ('string' != typeof value || !value) return;
+    const raw = value.trim();
+    const trimmed = /^\d+\s*,/.test(raw) ? raw.slice(0, raw.indexOf(',')).trim() : raw;
+    const seconds = /^\d+$/.test(trimmed) ? Number(trimmed) : 0 / 0;
+    if (!Number.isFinite(seconds) && /^[+-]?[\d.]+$/.test(trimmed)) return;
+    const ms = Number.isFinite(seconds) ? 1000 * seconds : Date.parse(trimmed) - now;
+    if (!Number.isFinite(ms) || ms <= 0) return;
+    return Math.min(ms, MAX_RETRY_AFTER_MS);
+}
+class RetryAfterWindow {
+    record(outcome) {
+        if ('too-large' === outcome.kind) return;
+        if ('retry-later' !== outcome.kind) return void this.reset();
+        if (!outcome.retryAfterMs) return;
+        const open = this.isOpen();
+        const now = Date.now();
+        const asked = Math.min(outcome.retryAfterMs, MAX_RETRY_AFTER_MS);
+        if (!open) {
+            this._installedAt = now;
+            this._until = now + asked;
+            return;
+        }
+        this._until = Math.max(this._until, Math.min(now + asked, this._installedAt + MAX_RETRY_AFTER_MS));
+    }
+    remainingMs() {
+        const now = Date.now();
+        if (now < this._installedAt - CLOCK_STEP_TOLERANCE_MS) {
+            this.reset();
+            return 0;
+        }
+        const remaining = Math.min(MAX_RETRY_AFTER_MS, Math.max(0, this._until - now));
+        if (0 === remaining) this.reset();
+        return remaining;
+    }
+    isOpen() {
+        return this.remainingMs() > 0;
+    }
+    reset() {
+        this._until = 0;
+        this._installedAt = 0;
+    }
+    constructor(){
+        this._until = 0;
+        this._installedAt = 0;
+    }
+}
+__webpack_require__.d(__webpack_exports__, {
+    RetryAfterWindow: ()=>RetryAfterWindow,
+    parseRetryAfterMs: ()=>parseRetryAfterMs
+}, {
+    MAX_RETRY_AFTER_MS: MAX_RETRY_AFTER_MS
+});
+exports.MAX_RETRY_AFTER_MS = __webpack_exports__.MAX_RETRY_AFTER_MS;
+exports.RetryAfterWindow = __webpack_exports__.RetryAfterWindow;
+exports.parseRetryAfterMs = __webpack_exports__.parseRetryAfterMs;
+for(var __rspack_i in __webpack_exports__)if (-1 === [
+    "MAX_RETRY_AFTER_MS",
+    "RetryAfterWindow",
+    "parseRetryAfterMs"
+].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
+Object.defineProperty(exports, '__esModule', {
+    value: true
+});

package/node_modules/@posthog/core/dist/utils/retry-after.mjs

@@ -0,0 +1,50 @@
+const MAX_RETRY_AFTER_MS = 300000;
+const CLOCK_STEP_TOLERANCE_MS = 5000;
+function parseRetryAfterMs(value, now = Date.now()) {
+    if ('string' != typeof value || !value) return;
+    const raw = value.trim();
+    const trimmed = /^\d+\s*,/.test(raw) ? raw.slice(0, raw.indexOf(',')).trim() : raw;
+    const seconds = /^\d+$/.test(trimmed) ? Number(trimmed) : 0 / 0;
+    if (!Number.isFinite(seconds) && /^[+-]?[\d.]+$/.test(trimmed)) return;
+    const ms = Number.isFinite(seconds) ? 1000 * seconds : Date.parse(trimmed) - now;
+    if (!Number.isFinite(ms) || ms <= 0) return;
+    return Math.min(ms, MAX_RETRY_AFTER_MS);
+}
+class RetryAfterWindow {
+    record(outcome) {
+        if ('too-large' === outcome.kind) return;
+        if ('retry-later' !== outcome.kind) return void this.reset();
+        if (!outcome.retryAfterMs) return;
+        const open = this.isOpen();
+        const now = Date.now();
+        const asked = Math.min(outcome.retryAfterMs, MAX_RETRY_AFTER_MS);
+        if (!open) {
+            this._installedAt = now;
+            this._until = now + asked;
+            return;
+        }
+        this._until = Math.max(this._until, Math.min(now + asked, this._installedAt + MAX_RETRY_AFTER_MS));
+    }
+    remainingMs() {
+        const now = Date.now();
+        if (now < this._installedAt - CLOCK_STEP_TOLERANCE_MS) {
+            this.reset();
+            return 0;
+        }
+        const remaining = Math.min(MAX_RETRY_AFTER_MS, Math.max(0, this._until - now));
+        if (0 === remaining) this.reset();
+        return remaining;
+    }
+    isOpen() {
+        return this.remainingMs() > 0;
+    }
+    reset() {
+        this._until = 0;
+        this._installedAt = 0;
+    }
+    constructor(){
+        this._until = 0;
+        this._installedAt = 0;
+    }
+}
+export { MAX_RETRY_AFTER_MS, RetryAfterWindow, parseRetryAfterMs };

package/node_modules/@posthog/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@posthog/core",
-  "version": "1.52.1",
+  "version": "1.53.0",
   "bugs": {
     "url": "https://github.com/PostHog/posthog-js/issues"
   },
@@ -70,7 +70,7 @@
     }
   },
   "dependencies": {
-    "@posthog/types": "^1.410.0"
+    "@posthog/types": "^1.411.0"
   },
   "devDependencies": {
     "@rslib/core": "0.23.2",
@@ -84,7 +84,7 @@
     "lint:fix": "oxlint --report-unused-disable-directives-severity error src --fix",
     "build": "rslib build",
     "dev": "rslib build -w",
-    "test:unit": "vitest run",
+    "test:unit": "NODE_OPTIONS=--expose-gc vitest run",
     "package": "pnpm pack --out $PACKAGE_DEST/%s.tgz"
   }
 }

package/node_modules/@posthog/core/src/error-tracking/parsers/base.spec.ts

@@ -1,21 +1,47 @@
 import { createFrame } from './base'
 import { createDefaultStackParser } from './index'
 
-describe('createFrame', () => {
-  const platform = 'web:javascript'
-
+describe.each(['web:javascript', 'hermes'] as const)('createFrame (%s)', (platform) => {
   it('marks ordinary browser frames as in_app', () => {
     const frame = createFrame(platform, 'https://example.com/app.js', 'doThing', 1, 2)
     expect(frame.in_app).toBe(true)
   })
 
-  it('does not mark frames Safari has masked as in_app', () => {
-    // Safari hides the origin of extension content scripts, and of blob:/eval'd code, behind
-    // this placeholder. None of it is the page's own code.
-    const frame = createFrame(platform, 'webkit-masked-url://hidden/', '_classCallCheck', 1, 2)
+  it.each([
+    ['Safari masking an extension content script', 'webkit-masked-url://hidden/'],
+    ['an Android in-app browser bridge', 'iabjs://navigation_performance_logger_android'],
+    ['a Chromium extension content script', 'chrome-extension://abcdef/content.js'],
+    ['a Firefox extension content script', 'moz-extension://abcdef/content.js'],
+    ['a Safari extension, which the parser prefixes with a bare scheme', 'safari-extension:abcdef/content.js'],
+    ['a Safari web extension', 'safari-web-extension:abcdef/content.js'],
+    ['an extension with a mixed-case scheme', 'CHROME-Extension://abcdef/content.js'],
+    ['an unknown container scheme', 'other-bridge://injected.js'],
+    ['an inline data URL', 'data:text/javascript,void 0'],
+  ])('does not mark a frame the container injected as in_app: %s', (_name, filename) => {
+    const frame = createFrame(platform, filename, 'doThing', 1, 2)
     expect(frame.in_app).toBe(false)
   })
 
+  it.each([
+    ['a script served over http', 'http://localhost:8000/app.js'],
+    ['a Cordova or Electron app served from disk', 'file:///android_asset/www/app.js'],
+    ['a worker the page created from a blob', 'blob:https://example.com/6b0b0e6a'],
+    ['a Capacitor webview', 'capacitor://localhost/app.js'],
+    ['an Ionic webview', 'ionic://localhost/app.js'],
+    ['a script with a mixed-case scheme', 'HTTPS://example.com/app.js'],
+    ['a webpack source frame', 'webpack:///./src/App.js'],
+    ['an Angular JIT component', 'ng:///CheckoutComponent.js'],
+    ['a custom app scheme, as an Electron or React Native shell serves', 'app://checkout.js'],
+    ['a bundler-rewritten dev frame', 'webpack-internal:///./src/App.js'],
+    ['a React Native release bundle, which has no scheme', 'index.android.bundle'],
+    ['an absolute path with no scheme', '/data/user/0/com.example/files/index.bundle'],
+    ['a Windows path with backslashes', 'C:\\app\\index.bundle'],
+    ['a Windows path with forward slashes', 'C:/app/index.bundle'],
+  ])("still marks the app's own code as in_app: %s", (_name, filename) => {
+    const frame = createFrame(platform, filename, 'doThing', 1, 2)
+    expect(frame.in_app).toBe(true)
+  })
+
   it('keeps the masked frame rather than discarding it', () => {
     const frame = createFrame(platform, 'webkit-masked-url://hidden/', 'someFn', 3, 4)
     expect(frame).toMatchObject({
@@ -70,6 +96,50 @@ describe('createDefaultStackParser in_app classification', () => {
     ])
   })
 
+  it('demotes the bridge frames an Android in-app browser serves from its own scheme', () => {
+    const frames = parse(
+      'Error: Error invoking postMessage: Java object is gone\n' +
+        '    at sendDataToNative (iabjs://navigation_performance_logger_android:1:10198)\n' +
+        '    at sendJsBlockingTimeMessage (iabjs://navigation_performance_logger_android:1:14668)'
+    )
+    expect(frames.map((f) => [f.function, f.in_app])).toEqual([
+      ['sendJsBlockingTimeMessage', false],
+      ['sendDataToNative', false],
+    ])
+  })
+
+  it.each([
+    '    at CheckoutComponent_Template (ng:///CheckoutComponent.js:10:5)',
+    'CheckoutComponent_Template@ng:///CheckoutComponent.js:10:5',
+  ])('keeps Angular JIT application frames as in_app: %s', (stackLine) => {
+    const frames = parse(`Error: template failed\n${stackLine}`)
+    expect(frames).toEqual([
+      expect.objectContaining({
+        filename: 'ng:///CheckoutComponent.js',
+        function: 'CheckoutComponent_Template',
+        lineno: 10,
+        colno: 5,
+        in_app: true,
+      }),
+    ])
+  })
+
+  it.each([
+    'webkit-masked-url://hidden/',
+    '<anonymous>',
+    'iabjs://navigation_performance_logger_android',
+    'chrome-extension://abcdef/content.js',
+    'moz-extension://abcdef/content.js',
+  ])('retains injected frames without demoting the calling app frame: %s', (filename) => {
+    const frames = parse(
+      `Error: boom\n    at injected (${filename}:1:2)\n    at checkout (https://example.com/app.js:10:5)`
+    )
+    expect(frames.map((frame) => [frame.filename, frame.in_app])).toEqual([
+      ['https://example.com/app.js', true],
+      [filename, false],
+    ])
+  })
+
   it("keeps the page's own eval'd code as in_app", () => {
     // V8 attributes eval'd code to the script that called eval; the chrome parser already
     // rewrites these frames to that URL, so they must not be caught by the <anonymous> rule.

package/node_modules/@posthog/core/src/error-tracking/parsers/base.ts

@@ -7,21 +7,47 @@ import { StackFrame } from '../types'
 
 export const UNKNOWN_FUNCTION = '?'
 
-// Safari replaces the URL of scripts it will not attribute to the page with this placeholder.
-// Web extension content scripts are the common source, but blob:, eval'd and injected code can
-// be masked the same way, so the filename alone cannot tell us which one we are looking at.
-// Either way it is not the page's own code, so keep the frame -- it is still useful context --
-// but do not let it count as in_app and pull the issue into the site's own stack.
-const MASKED_URL_PREFIX = 'webkit-masked-url://'
-
-// Chromium's counterpart: a script with no URL at all -- code injected by an extension
-// (`chrome.scripting.executeScript`), pasted into devtools, or evaluated from a string -- shows
-// up as a bare `<anonymous>:line:col` frame. The page's own eval'd code is *not* affected: V8
-// reports it as `eval at <anonymous> (https://site/app.js:1:2)` and the chrome parser already
-// rewrites that to the site URL. A bare `<anonymous>` can never be symbolicated, so treating it
-// as in_app only ever pulled an unresolvable frame into the site's own stack.
+// Chromium reports a script with no URL at all -- code injected by an extension
+// (`chrome.scripting.executeScript`), pasted into devtools, or evaluated from a string -- as a bare
+// `<anonymous>:line:col` frame. The page's own eval'd code is *not* affected: V8 reports it as
+// `eval at <anonymous> (https://site/app.js:1:2)` and the chrome parser already rewrites that to
+// the site URL. A bare `<anonymous>` can never be symbolicated.
 const ANONYMOUS_FILENAME = '<anonymous>'
 
+// A leading `scheme:` in a filename, needing two characters or more so that a Windows drive letter
+// such as `C:` does not read as one.
+const URL_SCHEME = /^([a-z][a-z0-9.+-]+):/i
+
+// The schemes an app is served over. Everything else names code the container put into the page
+// rather than code the app loaded: Safari masks extension content scripts as `webkit-masked-url://`,
+// Chromium serves them from `chrome-extension://`, and Android in-app browsers serve their native
+// bridge from schemes such as `iabjs://`. Listing every injector's scheme never keeps up with the
+// next one, so accept the schemes an app is served over and reject the rest.
+const APP_URL_SCHEMES = [
+  'http',
+  'https',
+  'file',
+  'blob',
+  'app',
+  'capacitor',
+  'ionic',
+  'webpack',
+  'webpack-internal',
+  'ng',
+]
+
+// Is this filename a script the app itself loaded? A filename with no scheme is one: React Native
+// names its own bundle `index.android.bundle`, and a bundler can report a bare path.
+function isAppFilename(filename: string): boolean {
+  if (!filename || filename === ANONYMOUS_FILENAME) {
+    return false
+  }
+
+  const scheme = URL_SCHEME.exec(filename)
+
+  return !scheme || APP_URL_SCHEMES.includes((scheme[1] as string).toLowerCase())
+}
+
 export function createFrame(
   platform: StackFrame['platform'],
   filename: string,
@@ -34,12 +60,9 @@ export function createFrame(
     platform,
     filename,
     function: func === '<anonymous>' ? UNKNOWN_FUNCTION : func,
-    // Browser frames are considered in_app unless the runtime has masked or dropped their origin.
-    // A frame with no filename at all is the third case: the runtime reports a function name, a
-    // line and a column, but no script URL. Android in-app browsers report their injected native
-    // bridge scripts this way. Such a frame can never be symbolicated either, so it must not
-    // count as the page's own code.
-    in_app: !!filename && !filename.startsWith(MASKED_URL_PREFIX) && filename !== ANONYMOUS_FILENAME,
+    // Keep a frame the app did not load -- it is still useful context -- but do not let it count as
+    // in_app and pull the issue into the app's own stack.
+    in_app: isAppFilename(filename),
   }
 
   if (!isUndefined(lineno)) {

package/node_modules/@posthog/core/src/index.ts

@@ -87,6 +87,24 @@ export type {
   Metrics,
   MetricsConfig,
 } from './metrics/types'
+export { PostHogTraces } from './traces'
+export { SyncSpanContextManager } from './traces/context'
+export { inertSpan, runWithActiveSpan } from './traces/span'
+export { resolveTracesConfig } from './traces/config'
+export type { ResolvedTracesConfig, SpanContextManager, TraceSdkContext } from './traces/types'
+// The `beforeSpanSend` shapes come straight from @posthog/types: hooks see the
+// public record, not core's internal one, which also carries `traceState`.
+export type { SpanRecord, BeforeSpanSendFn } from '@posthog/types'
+export type {
+  Span,
+  SpanAttributes,
+  SpanAttributeValue,
+  SpanKind,
+  SpanStatusCode,
+  SpanTimeInput,
+  StartSpanOptions,
+  TracesConfig,
+} from './traces/types'
 export { uuidv7 } from './vendor/uuidv7'
 export * from './cookie'
 export * from './posthog-core'