@zuplo/cli 7.7.8 → 7.7.9

package/node_modules/@posthog/core/src/traces/traceparent.spec.ts

@@ -0,0 +1,184 @@
+import { formatTraceparent, normalizeTraceparent, parseTraceparent, sanitizeTracestate } from './traceparent'
+
+const TRACE_ID = '4bf92f3577b34da6a3ce929d0e0e4736'
+const SPAN_ID = '00f067aa0ba902b7'
+
+describe('traceparent', () => {
+  describe('parseTraceparent', () => {
+    it('parses a sampled header', () => {
+      expect(parseTraceparent(`00-${TRACE_ID}-${SPAN_ID}-01`)).toEqual({
+        traceId: TRACE_ID,
+        spanId: SPAN_ID,
+        flags: '01',
+      })
+    })
+
+    it('continues the trace even when the caller sampled it out, and keeps the flag', () => {
+      // Every captured span is recorded, so honouring an inbound `00` by
+      // dropping the parentage would orphan our own spans. The flag itself is
+      // kept, so what we propagate onward still says what the caller decided.
+      expect(parseTraceparent(`00-${TRACE_ID}-${SPAN_ID}-00`)).toEqual({
+        traceId: TRACE_ID,
+        spanId: SPAN_ID,
+        flags: '00',
+      })
+    })
+
+    it.each([
+      ['a reserved bit alongside sampled', '05', '01'],
+      ['reserved bits with sampled unset', '04', '00'],
+      ['every bit set', 'ff', '01'],
+    ])('zeroes %s, which version 00 does not define', (_label, inbound, expected) => {
+      // We re-emit under version `00`, and W3C requires a vendor to zero every
+      // flag that version does not define rather than forward it.
+      expect(parseTraceparent(`00-${TRACE_ID}-${SPAN_ID}-${inbound}`)?.flags).toBe(expected)
+    })
+
+    it('accepts a future version with extra fields', () => {
+      expect(parseTraceparent(`01-${TRACE_ID}-${SPAN_ID}-01-something`)).toEqual({
+        traceId: TRACE_ID,
+        spanId: SPAN_ID,
+        flags: '01',
+      })
+    })
+
+    it('rejects version 00 with extra fields, which only a higher version may carry', () => {
+      expect(parseTraceparent(`00-${TRACE_ID}-${SPAN_ID}-01-something`)).toBeUndefined()
+      expect(parseTraceparent(`00-${TRACE_ID}-${SPAN_ID}-01-`)).toBeUndefined()
+    })
+
+    it('trims surrounding whitespace', () => {
+      expect(parseTraceparent(`  00-${TRACE_ID}-${SPAN_ID}-01 `)).toEqual({
+        traceId: TRACE_ID,
+        spanId: SPAN_ID,
+        flags: '01',
+      })
+    })
+
+    it('rejects uppercase hex, which W3C requires a vendor to ignore', () => {
+      expect(parseTraceparent(`00-${TRACE_ID.toUpperCase()}-${SPAN_ID}-01`)).toBeUndefined()
+      expect(parseTraceparent(`00-${TRACE_ID}-${SPAN_ID.toUpperCase()}-01`)).toBeUndefined()
+    })
+
+    it.each([
+      ['garbage', 'garbage'],
+      ['an empty string', ''],
+      ['version ff', `ff-${TRACE_ID}-${SPAN_ID}-01`],
+      ['an all-zero trace id', `00-${'0'.repeat(32)}-${SPAN_ID}-01`],
+      ['an all-zero span id', `00-${TRACE_ID}-${'0'.repeat(16)}-01`],
+      ['a short trace id', `00-abc-${SPAN_ID}-01`],
+      ['a missing field', `00-${TRACE_ID}-${SPAN_ID}`],
+      ['a non-string', 42],
+      ['undefined', undefined],
+    ])('returns undefined for %s', (_name, value) => {
+      expect(parseTraceparent(value)).toBeUndefined()
+    })
+  })
+
+  describe('formatTraceparent', () => {
+    it('sets the sampled flag on a trace started here', () => {
+      expect(formatTraceparent(TRACE_ID, SPAN_ID)).toBe(`00-${TRACE_ID}-${SPAN_ID}-01`)
+    })
+
+    it('propagates the flags byte it was given', () => {
+      expect(formatTraceparent(TRACE_ID, SPAN_ID, '00')).toBe(`00-${TRACE_ID}-${SPAN_ID}-00`)
+    })
+
+    it('round-trips through the parser', () => {
+      expect(parseTraceparent(formatTraceparent(TRACE_ID, SPAN_ID))).toEqual({
+        traceId: TRACE_ID,
+        spanId: SPAN_ID,
+        flags: '01',
+      })
+    })
+  })
+
+  describe('sanitizeTracestate', () => {
+    it('preserves a valid vendor list unchanged', () => {
+      expect(sanitizeTracestate('vendor=abc,other=def')).toBe('vendor=abc,other=def')
+    })
+
+    it('trims surrounding whitespace', () => {
+      expect(sanitizeTracestate('  vendor=abc  ')).toBe('vendor=abc')
+    })
+
+    it.each([
+      ['an empty string', ''],
+      ['a member without a value', 'vendor'],
+      ['a non-string', 42],
+      ['undefined', undefined],
+      [
+        'more than 32 members, which the list grammar does not admit',
+        Array.from({ length: 33 }, (_v, i) => `k${i}=v`).join(','),
+      ],
+      ['a single member longer than the whole limit', `vendor=${'a'.repeat(600)}`],
+    ])('discards %s', (_name, value) => {
+      expect(sanitizeTracestate(value)).toBeUndefined()
+    })
+
+    it('drops the largest members first when a valid list is too long', () => {
+      // W3C names members over 128 characters as the ones to drop first, so the
+      // small entries survive even though they sit to the right of the big one.
+      const big = `big=${'a'.repeat(200)}`
+      const small = Array.from({ length: 4 }, (_v, i) => `k${i}=${'b'.repeat(80)}`)
+
+      expect(sanitizeTracestate([big, ...small].join(','))).toBe(small.join(','))
+    })
+
+    it('drops from the right once no member is oversized', () => {
+      // 102 characters each, so the fifth crosses 512 and the first four stay.
+      const members = Array.from({ length: 6 }, (_v, i) => `k${i}=${'a'.repeat(100)}`)
+      expect(sanitizeTracestate(members.join(','))).toBe(members.slice(0, 4).join(','))
+    })
+
+    it('leaves a valid header inside the limit exactly as received', () => {
+      const members = Array.from({ length: 32 }, (_v, i) => `k${i}=v`)
+      expect(sanitizeTracestate(members.join(','))).toBe(members.join(','))
+    })
+  })
+})
+
+describe('tracestate character safety', () => {
+  it('discards a value carrying CRLF or a lone surrogate', () => {
+    expect(sanitizeTracestate('vendor=abc\r\nx-injected: 1')).toBeUndefined()
+    expect(sanitizeTracestate('vendor=\ud800')).toBeUndefined()
+  })
+
+  it('keeps a tab-separated vendor list, which W3C allows', () => {
+    expect(sanitizeTracestate('rojo=00f067aa0ba902b7,\tcongo=t61rcWkgMzE')).toBe(
+      'rojo=00f067aa0ba902b7,\tcongo=t61rcWkgMzE'
+    )
+  })
+
+  it('keeps an ordinary vendor list', () => {
+    expect(sanitizeTracestate('rojo=00f067aa0ba902b7,congo=t61rcWkgMzE')).toBe(
+      'rojo=00f067aa0ba902b7,congo=t61rcWkgMzE'
+    )
+  })
+})
+
+describe('normalizeTraceparent', () => {
+  it('carries version and flags through as received', () => {
+    expect(normalizeTraceparent(`00-${TRACE_ID}-${SPAN_ID}-00`)).toBe(`00-${TRACE_ID}-${SPAN_ID}-00`)
+    expect(normalizeTraceparent(`01-${TRACE_ID}-${SPAN_ID}-01`)).toBe(`01-${TRACE_ID}-${SPAN_ID}-01`)
+  })
+
+  it("keeps a higher version's trailing fields, so a peer that reads them still can", () => {
+    expect(normalizeTraceparent(`01-${TRACE_ID}-${SPAN_ID}-01-extra`)).toBe(`01-${TRACE_ID}-${SPAN_ID}-01-extra`)
+  })
+
+  it('trims surrounding whitespace', () => {
+    expect(normalizeTraceparent(`  00-${TRACE_ID}-${SPAN_ID}-01 `)).toBe(`00-${TRACE_ID}-${SPAN_ID}-01`)
+  })
+
+  it.each([
+    ['a malformed header', 'not-a-traceparent'],
+    ['the invalid ff version', `ff-${TRACE_ID}-${SPAN_ID}-01`],
+    ['an all-zero trace id', `00-${'0'.repeat(32)}-${SPAN_ID}-01`],
+    ['version 00 with trailing fields', `00-${TRACE_ID}-${SPAN_ID}-01-extra`],
+    ['an uppercase trace id', `00-${TRACE_ID.toUpperCase()}-${SPAN_ID}-01`],
+    ['a non-string', ['a', 'b']],
+  ])('rejects %s', (_name, value) => {
+    expect(normalizeTraceparent(value)).toBeUndefined()
+  })
+})

package/node_modules/@posthog/core/src/traces/traceparent.ts

@@ -0,0 +1,172 @@
+import { isValidSpanId, isValidTraceId } from './ids'
+
+export interface RemoteSpanContext {
+  traceId: string
+  spanId: string
+  /** The inbound trace-flags byte, e.g. `01` sampled, `00` sampled out. */
+  flags: string
+}
+
+// Version `ff` is invalid per the spec, and a higher version may append fields
+// after the first four, so the trailing group captures them rather than failing
+// the match.
+const TRACEPARENT_RE = /^([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})(-.*)?$/
+
+/**
+ * Parses an incoming `traceparent` header value, returning `undefined` for
+ * anything malformed so a bad header starts a fresh root rather than throwing.
+ *
+ * A trace the caller sampled out (`00`) is still continued — PostHog records
+ * every captured span — but the inbound flag rides along, so what this SDK
+ * propagates onward says what the caller decided rather than overriding it.
+ */
+export function parseTraceparent(value: unknown): RemoteSpanContext | undefined {
+  const fields = matchTraceparent(value)
+  return fields && { traceId: fields.traceId, spanId: fields.spanId, flags: definedFlags(fields.flags) }
+}
+
+/**
+ * Keeps only the flags version `00` defines — the sampled bit. A span continuing
+ * this trace re-emits the byte under version `00`, and W3C requires a vendor to
+ * zero every flag that version does not define rather than forward one it cannot
+ * interpret.
+ */
+function definedFlags(flags: string): string {
+  return parseInt(flags, 16) & 0x01 ? TRACE_FLAGS_SAMPLED : TRACE_FLAGS_UNSAMPLED
+}
+
+interface TraceparentFields {
+  version: string
+  traceId: string
+  spanId: string
+  flags: string
+}
+
+function matchTraceparent(value: unknown): TraceparentFields | undefined {
+  if (typeof value !== 'string') {
+    return undefined
+  }
+  // W3C spells every field lowercase hex and requires a vendor to ignore a
+  // `traceparent` whose ids are not, so folding the case here would continue a
+  // trace that a conformant peer restarts.
+  const match = TRACEPARENT_RE.exec(value.trim())
+  if (!match) {
+    return undefined
+  }
+  const [, version, traceId, spanId, flags, trailing] = match
+  if (version === 'ff') {
+    return undefined
+  }
+  // Version `00` is defined as exactly `trace-id "-" parent-id "-" trace-flags`.
+  // W3C scopes the tolerate-what-you-don't-know rule to a *higher* version, so a
+  // version `00` header with anything appended is malformed.
+  if (version === '00' && trailing) {
+    return undefined
+  }
+  if (!isValidTraceId(traceId) || !isValidSpanId(spanId)) {
+    return undefined
+  }
+  return { version, traceId, spanId, flags }
+}
+
+/**
+ * The inbound `traceparent` as received, or `undefined` when it is malformed.
+ *
+ * Returned whole rather than rebuilt: a version above `00` may append fields
+ * this SDK does not read, and rebuilding would forward a header still labelled
+ * with that version but missing what the version defines.
+ */
+export function normalizeTraceparent(value: unknown): string | undefined {
+  return matchTraceparent(value) && (value as string).trim()
+}
+
+/**
+ * A `traceparent` as the string it is, unwrapping the one-element array Node's
+ * `headersDistinct` hands over. A longer array is two different inbound values,
+ * and picking either would be a guess.
+ */
+export function traceparentHeader(value: unknown): unknown {
+  return Array.isArray(value) && value.length === 1 ? value[0] : value
+}
+
+/** The W3C sampled bit, set on a trace this SDK started. */
+export const TRACE_FLAGS_SAMPLED = '01'
+
+/** The same byte with the sampled bit clear, for a trace the caller sampled out. */
+const TRACE_FLAGS_UNSAMPLED = '00'
+
+/**
+ * Builds the `traceparent` header value for a span. A span continuing a remote
+ * trace propagates the flags byte it was handed: a downstream parent-based
+ * sampler must see the decision the head sampler actually made, not one this
+ * SDK invented. A trace started here is sampled, because it is recorded.
+ */
+export function formatTraceparent(traceId: string, spanId: string, flags: string = TRACE_FLAGS_SAMPLED): string {
+  return `00-${traceId}-${spanId}-${flags}`
+}
+
+// tracestate is a comma-separated list of at most 32 `key=value` members, and
+// is carried opaquely — we never interpret the vendor entries.
+const TRACESTATE_MAX_MEMBERS = 32
+const TRACESTATE_MAX_LENGTH = 512
+
+/**
+ * Validates an incoming `tracestate` far enough to know it is safe to echo back.
+ * A malformed one is discarded without invalidating its traceparent, so a bad
+ * vendor entry never costs us the trace continuation. More than 32 members is
+ * malformed: W3C's list grammar admits no more.
+ *
+ * A valid header over the length W3C asks us to propagate is trimmed instead,
+ * by whole members. Members over 128 characters go first — W3C names those as
+ * the ones to drop — and the rest from the right, so the entries nearest the
+ * caller survive.
+ */
+export function sanitizeTracestate(value: unknown): string | undefined {
+  if (typeof value !== 'string') {
+    return undefined
+  }
+  const trimmed = value.trim()
+  if (!trimmed) {
+    return undefined
+  }
+  // W3C restricts tracestate to printable ASCII plus HTAB as optional whitespace.
+  // A CRLF would make the caller's own propagation throw, and a lone surrogate
+  // refuses the whole OTLP request.
+  if (/[^\x20-\x7e\t]/.test(trimmed)) {
+    return undefined
+  }
+  const members = trimmed.split(',')
+  if (members.length > TRACESTATE_MAX_MEMBERS) {
+    return undefined
+  }
+  for (const member of members) {
+    // An empty member is tolerated by the spec (list optional-white-space), but
+    // a member without a `=` is not a key/value pair at all.
+    if (member.trim() && !member.includes('=')) {
+      return undefined
+    }
+  }
+  if (trimmed.length <= TRACESTATE_MAX_LENGTH) {
+    return trimmed
+  }
+  return trimToLength(members)
+}
+
+// W3C's own guidance for which members to drop when a list is too long.
+const TRACESTATE_LARGE_MEMBER_LENGTH = 128
+
+/** The members that fit, dropping the largest first and then from the right. */
+function trimToLength(members: string[]): string | undefined {
+  const kept = [...members]
+  const joinedLength = (): number => kept.reduce((total, member) => total + member.length, 0) + kept.length - 1
+
+  for (let index = kept.length - 1; index >= 0 && joinedLength() > TRACESTATE_MAX_LENGTH; index--) {
+    if (kept[index].length > TRACESTATE_LARGE_MEMBER_LENGTH) {
+      kept.splice(index, 1)
+    }
+  }
+  while (kept.length && joinedLength() > TRACESTATE_MAX_LENGTH) {
+    kept.pop()
+  }
+  return kept.length ? kept.join(',') : undefined
+}

package/node_modules/@posthog/core/src/traces/types.ts

@@ -0,0 +1,140 @@
+export type {
+  Span,
+  SpanAttributes,
+  SpanAttributeValue,
+  SpanKind,
+  SpanStatusCode,
+  SpanTimeInput,
+  StartSpanOptions,
+  TracesConfig,
+  BeforeSpanSendFn,
+  OtlpSpan,
+  OtlpSpanEvent,
+  OtlpSpanKeyValue,
+  OtlpSpanStatus,
+  OtlpTracesPayload,
+} from '@posthog/types'
+
+import type {
+  BeforeSpanSendFn,
+  OtlpTracesPayload,
+  Span,
+  SpanAttributes,
+  SpanKind,
+  SpanRecord as HookSpanRecord,
+  SpanStatusCode,
+  TracesConfig,
+} from '@posthog/types'
+
+/** Same tagged outcome shape as `SendLogsBatchOutcome` — one policy for all three signals. */
+export type SendTracesBatchOutcome =
+  | { kind: 'ok' }
+  | { kind: 'retry-later'; error: unknown; retryAfterMs?: number }
+  | {
+      kind: 'too-large'
+      /**
+       * True when the SDK measured the body itself rather than the endpoint
+       * refusing it, so the caller can split this drain without lowering the
+       * batch size it keeps between them.
+       */
+      measuredLocally?: boolean
+    }
+  | { kind: 'fatal'; error: unknown }
+
+/** The minimal host surface `PostHogTraces` depends on; `PostHogCoreStateless` satisfies it structurally. */
+export interface TracesHost {
+  readonly isDisabled: boolean
+  readonly optedOut: boolean
+  _sendTracesBatch(payload: OtlpTracesPayload): Promise<SendTracesBatchOutcome>
+  getLibraryId(): string
+  getLibraryVersion(): string
+}
+
+/**
+ * PostHog context snapshotted onto every span at start, so traces join back to
+ * persons and sessions. Each SDK fills the fields that apply to it; absent
+ * fields add no attribute. Internal to `@posthog/core`.
+ *
+ * @internal Exposed for cross-package use within this SDK; not part of the stable public API.
+ */
+export interface TraceSdkContext {
+  distinctId?: string
+  sessionId?: string
+  /** Web-only — current page URL. */
+  currentUrl?: string
+  /** Mobile-only — current screen / view name. */
+  screenName?: string
+  /** Mobile-only — app foreground/background state. */
+  appState?: 'foreground' | 'background'
+}
+
+export interface SpanEventRecord {
+  name: string
+  /** ms epoch. */
+  timestamp: number
+  attributes?: SpanAttributes
+  /**
+   * How many of this event's attributes the cap discarded.
+   *
+   * Unlike the span-level counts, this one is carried on an object a
+   * `beforeSpanSend` hook holds: the public event type omits it, so a hook that
+   * rebuilds its events returns them without it. Events have no identity to
+   * match a rebuilt array back against, so what a hook drops here stays dropped.
+   */
+  droppedAttributesCount?: number
+}
+
+/**
+ * A finished span as the SDK carries it, which is the hook-visible record plus
+ * the fields no hook may rewrite. Declaring only the additions keeps the shared
+ * half from drifting; a field added here rather than to the public record is a
+ * field `beforeSpanSend` cannot see, and so cannot corrupt.
+ */
+export interface SpanRecord extends HookSpanRecord {
+  /** The hook-visible event plus the SDK's own per-event drop count. */
+  events: SpanEventRecord[]
+  traceState?: string
+  /** The W3C trace-flags byte this span propagates, e.g. `01` sampled. */
+  traceFlags: string
+  /** True when the parent came from a `traceparent` header rather than a local handle. */
+  parentIsRemote: boolean
+  droppedAttributesCount?: number
+  droppedEventsCount?: number
+}
+
+/**
+ * Tracks which span is active, so spans nest without manual parent plumbing. The
+ * mechanism is platform-specific and stays out of core: node injects an
+ * `AsyncLocalStorage` implementation over the synchronous default.
+ */
+export interface SpanContextManager {
+  /** The active span, or `undefined` when none is active. */
+  active(): Span | undefined
+  /** Run `fn` with `span` active for its (synchronous and async) duration. */
+  with<T>(span: Span, fn: () => T): T
+}
+
+/**
+ * Fields `PostHogTraces` needs resolved at runtime. The host SDK applies its own
+ * defaults and hands the resolved config to the constructor.
+ *
+ * @internal Exposed for cross-package use within this SDK; not part of the stable public API.
+ */
+export interface ResolvedTracesConfig extends TracesConfig {
+  flushIntervalMs: number
+  maxExportBatchSize: number
+  /**
+   * Bound on the in-memory export queue. On overflow the *incoming* span is
+   * dropped rather than queued ones, whose children may already have shipped.
+   */
+  maxQueueSize: number
+  beforeSpanSend: BeforeSpanSendFn[]
+  maxAttributesPerSpan: number
+  maxEventsPerSpan: number
+  maxAttributesPerEvent: number
+  maxAttributeValueLength: number
+  /** Bound on spans started but not yet ended. At the bound `startSpan` returns a no-op handle. */
+  maxLiveSpans: number
+  /** How long a span may stay live before it stops being accounted for and can never export. */
+  maxSpanAgeMs: number
+}

package/node_modules/@posthog/core/src/utils/backoff.ts

@@ -0,0 +1,44 @@
+/** Doublings the retry delay may grow by before it stops growing. */
+export const MAX_FLUSH_BACKOFF_EXPONENT = 6
+
+/**
+ * Ceiling on the SDK's own retry delay, which the logs and traces contracts
+ * both state as "exponential backoff capped at ~30s". A host that configured a
+ * longer flush interval keeps it: the cap is there to stop the doubling running
+ * away, not to flush more often than asked.
+ */
+export const MAX_FLUSH_BACKOFF_MS = 30_000
+
+/**
+ * How far a delay may be moved either side of its computed value. Clients that
+ * fail together otherwise retry together, and arrive at the endpoint as one
+ * burst each time it comes back — which is what OTel asks jitter to prevent.
+ *
+ * A quarter is enough to spread a fleet without a retry landing so early that
+ * it beats the interval the host configured, or so late that a recovered
+ * endpoint sits idle.
+ */
+const JITTER = 0.25
+
+/** A multiplier in `[1 - JITTER, 1 + JITTER]`, drawn once per failure by the caller. */
+export function drawJitter(): number {
+  return 1 - JITTER + Math.random() * JITTER * 2
+}
+
+/** No jitter, for the delay a queue uses when nothing has failed. */
+export const NO_JITTER = 1
+
+/**
+ * The delay before retrying an export, `baseMs` doubled once per failure past
+ * the first and capped at `maxMs`.
+ *
+ * `jitter` is applied to the SDK's own delay only. A `Retry-After` the endpoint
+ * sent is a floor underneath it, applied by the caller: spreading a fleet must
+ * never move a retry earlier than the endpoint asked for.
+ */
+export function backoffDelayMs(baseMs: number, failures: number, jitter: number, maxMs?: number): number {
+  const exponent = Math.min(Math.max(0, failures - 1), MAX_FLUSH_BACKOFF_EXPONENT)
+  const delay = baseMs * 2 ** exponent
+  const capped = maxMs === undefined ? delay : Math.min(delay, Math.max(maxMs, baseMs))
+  return Math.round(capped * jitter)
+}

package/node_modules/@posthog/core/src/utils/flush-timer.ts

@@ -0,0 +1,50 @@
+import { safeSetTimeout } from './index'
+
+/**
+ * The pending flush timer of an export queue, and when it is due.
+ *
+ * The queues arm this from two kinds of place: one that must not push a pending
+ * flush further out (every capture reaches it), and one that must not pull a
+ * flush back in front of a wait the endpoint asked for. Holding the deadline
+ * next to the handle is what lets the second kind compare against the first.
+ */
+export class FlushTimer {
+  private _timer?: ReturnType<typeof safeSetTimeout>
+  private _firesAt = 0
+
+  /** @param _onFire runs when the timer elapses, after the handle is released. */
+  constructor(private readonly _onFire: () => void) {}
+
+  /** Whether a flush is already scheduled. */
+  get pending(): boolean {
+    return !!this._timer
+  }
+
+  /** Schedules a flush in `delayMs`, replacing any timer already pending. */
+  arm(delayMs: number): void {
+    this.clear()
+    this._firesAt = Date.now() + delayMs
+    this._timer = safeSetTimeout(() => {
+      this._timer = undefined
+      this._onFire()
+    }, delayMs)
+  }
+
+  /**
+   * Arms only if it moves the flush later, so a timer armed for a longer wait
+   * survives a caller asking for a shorter one.
+   */
+  armNoEarlierThan(delayMs: number): void {
+    if (this._timer && Date.now() + delayMs <= this._firesAt) {
+      return
+    }
+    this.arm(delayMs)
+  }
+
+  clear(): void {
+    if (this._timer) {
+      clearTimeout(this._timer)
+      this._timer = undefined
+    }
+  }
+}

package/node_modules/@posthog/core/src/utils/json-utils.ts

@@ -153,3 +153,36 @@ export function toJsonSafeValue(value: unknown): unknown {
 
   return convert(value, 0)
 }
+
+/**
+ * Copies caller-supplied attributes onto `target`, own enumerable keys only.
+ *
+ * Read key by key rather than spread: a getter over a disposed resource or a
+ * revoked proxy throws on the read itself, before the encoder's guards see it.
+ */
+export function assignUserAttributes<T extends Record<string, any>>(
+  target: T,
+  source: Record<string, unknown> | undefined
+): T {
+  if (!source) {
+    return target
+  }
+  let keys: string[] = []
+  try {
+    keys = Object.keys(source)
+  } catch {
+    keys = []
+  }
+  for (const key of keys) {
+    let value: unknown
+    try {
+      value = source[key]
+    } catch {
+      value = UNSERIALIZABLE_VALUE
+    }
+    // defineProperty, not assignment: `attributes['__proto__'] = v` hits the
+    // prototype setter and the attribute vanishes.
+    Object.defineProperty(target, key, { value, enumerable: true, writable: true, configurable: true })
+  }
+  return target
+}