STRATCONN-6922 - [Mixpanel Web] harden session replay config + add masking controls

[joe-ayoub-segment]

Summary

Hardens how the Mixpanel Web (device-mode) destination builds the config passed to mixpanel.init, and adds first-class session-replay text/input masking controls. Motivated by STRATCONN-6922 (Farmers session-replay work).

Config building

• Replace the persistence: ..., ...remainingSettings spread with an explicit config literal. The old spread pushed every non-destructured setting into the SDK config, including Segment-internal keys (subscriptions, versionSettings) that leaked into the live mixpanel.config.
• Add asString / asNumber / asBoolean coercers and a defined() filter so only correctly-typed, present values reach mixpanel.init. Settings arrive from the CDN as strings (e.g. record_min_ms: "8000", record_sessions_percent: "2"), so numeric coercion is retained.

Session replay masking

• Add record_mask_all_text and record_mask_all_inputs parent toggles (default true, matching the Mixpanel SDK default), plus mask/unmask selector fields, each depends_on-gated by its parent toggle. Previously record_mask_text_selector was effectively a no-op because record_mask_all_text (SDK default true) was never exposed.
• Fix record_mask_text_selectors → record_mask_text_selector to match the Mixpanel SDK key.
• Add api_host to the Config type.
• Fix record_idle_timeout_ms default 180000 → 1800000 (30 min, matches Mixpanel docs).

Compatibility

Additive and non-breaking. The safe default (mask all text/inputs) is preserved. Regenerated generated-types.ts and metadata.json.

Testing

• yarn browser typecheck passes.
• Verified via a local static page loading the production snippet + DevTools that the built config is delivered to mixpanel.init with correctly-typed values and no leaked Segment-internal keys.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

This PR hardens Mixpanel Web (device-mode) destination configuration passed to mixpanel.init by switching from a broad settings spread to an explicit, typed/coerced config object, and adds first-class session replay text/input masking controls.

Changes:

• Build mixpanel.init config via explicit keys with asString/asNumber/asBoolean coercion and an undefined filter to prevent leaking Segment-internal settings into Mixpanel.
• Add session replay masking toggles/selectors (mask/unmask for text and inputs) and align config keys with Mixpanel SDK (record_mask_text_selector).
• Update defaults/metadata (notably record_idle_timeout_ms to 30 minutes) and regenerate types/metadata.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
packages/browser-destinations/destinations/mixpanel-web/src/types.ts	Extends Config with api_host and new session replay masking options/renames.
packages/browser-destinations/destinations/mixpanel-web/src/setting-fields.ts	Adds new masking settings with depends_on gating; updates replay idle timeout default.
packages/browser-destinations/destinations/mixpanel-web/src/index.ts	Replaces ...rest spread with explicit, coerced config construction to avoid leaking internal keys.
packages/browser-destinations/destinations/mixpanel-web/src/generated-types.ts	Regenerates settings types/docs for new masking controls.
packages/browser-destinations/destinations/mixpanel-web/metadata.json	Regenerates metadata (new fields, gating, updated defaults).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.