@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/entity-picker-context.js

@@ -0,0 +1,93 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ // Same placement rationale as screen-link-context.ts: lives in
+// @aglyn/aglyn without a 'use client' banner so canvas-rendering surfaces
+// share one module graph.
+import { createContext } from "react";
+/**
+ * How many documents a picker BROWSES.
+ *
+ * A picker is not a catalog viewer. It is a dropdown on a besigner surface
+ * where the author is placing one element, and no table in the console offers
+ * a page past `TABLE_PAGE_SIZE_OPTIONS` — a dropdown is the smaller surface of
+ * the two, not the larger.
+ *
+ * The middle of that range rather than its floor: a table has a pager under it
+ * and a dropdown does not, so the page a reader cannot advance is worth more
+ * rows than the one they can.
+ *
+ * What makes this size SAFE is that browsing is the only job it does. A stored
+ * value is named by {@link EntityPickerContextValue.resolve} — one keyed read
+ * for the one document, exact at any catalog size — so nothing here has to be
+ * wide enough to contain whatever an author picked last month. A window that
+ * carried both jobs would have to be, and would still render a bound element
+ * as unbound past its own width; widening this cannot fix that, only make it
+ * rarer and more expensive.
+ */ export const ENTITY_PICKER_BROWSE_LIMIT = 25;
+/**
+ * How many documents a server-side name search may return.
+ *
+ * The same size as the browse window, for the same reason: a reader who has
+ * typed a query and still faces 25 rows narrows it further rather than
+ * scrolling. Only the kinds in {@link EntityPickerContextValue.searchable}
+ * spend this at all.
+ */ export const ENTITY_PICKER_SEARCH_LIMIT = 25;
+/**
+ * What the picker for `kind` should believe about its own emptiness.
+ *
+ * `request` is the "a provider is mounted" signal — it is the one member the
+ * contract already says is absent wherever nothing lists entities — so a
+ * surface with no provider resolves to `unavailable` rather than passing an
+ * empty list off as the site's answer.
+ */ export function entityListState(context, kind) {
+    var _ref;
+    var _context_status;
+    if (!(context == null ? void 0 : context.request)) return 'unavailable';
+    return (_ref = (_context_status = context.status) == null ? void 0 : _context_status[kind]) != null ? _ref : 'loading';
+}
+/**
+ * The id whose label a picker still needs a keyed read to learn, if any.
+ *
+ * Part of the contract rather than of one screen, because two surfaces ask
+ * it — the attributes panel about a node's picker value, and the insert-token
+ * menu about the dataset a repeat is bound to — and an answer that differed
+ * between them would be a second keyed read for a document one of them
+ * already had.
+ *
+ * Four cases resolve to "ask nobody", and each is a read not spent: there is
+ * no value; the browse window already carries it, which is the common case on
+ * a small site; a resolution has already answered, including the answer that
+ * the document is gone; or the browse read has not settled, so the window may
+ * be about to supply it for free.
+ *
+ * The last is the one worth stating. Asking while the listener is still
+ * loading would spend a keyed read on nearly every picker on every site,
+ * which is the cost splitting these two jobs exists to remove rather than to
+ * move.
+ */ export function entityValueNeedsResolution(context, kind, value) {
+    var _context_kind, _ref;
+    var _context_resolved;
+    const id = typeof value === 'string' ? value.trim() : '';
+    if (!id || !(context == null ? void 0 : context.resolve)) return undefined;
+    if (((_context_kind = context[kind]) != null ? _context_kind : []).some((entity)=>entity.id === id)) return undefined;
+    if (id in ((_ref = (_context_resolved = context.resolved) == null ? void 0 : _context_resolved[kind]) != null ? _ref : {})) return undefined;
+    if (entityListState(context, kind) !== 'ready') return undefined;
+    return id;
+}
+export const EntityPickerContext = createContext({});
+EntityPickerContext.displayName = 'EntityPickerContext';
+
+//# sourceMappingURL=entity-picker-context.js.map

package/src/lib/app-utils/entity-picker-context.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/entity-picker-context.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n// Same placement rationale as screen-link-context.ts: lives in\n// @aglyn/aglyn without a 'use client' banner so canvas-rendering surfaces\n// share one module graph.\nimport { createContext } from 'react'\n\nexport interface EntityOption {\n  /** Stable document id — the persisted reference (AGL-343/344). */\n  id: string\n  /** Current display name, resolved at edit time. */\n  label: string\n}\n\n/**\n * Edit-time option lists for id-based entity pickers in component\n * attributes (products, collections, categories, datasets, forms). Names are\n * display-only; nodes persist the id, so renames never break references —\n * the same contract as {@link ScreenLinkContext}. Provided by the\n * console's besigner/preview surfaces; absent on the tenant (the tenant\n * only resolves ids, never lists them).\n */\n/** The lists a picker can ask for. */\nexport type EntityPickerKind =\n  | 'products'\n  | 'collections'\n  | 'categories'\n  | 'datasets'\n  | 'forms'\n\n/**\n * How much an empty list is worth believing.\n *\n * Every one of these renders as a dropdown with no entries, and an author\n * looking at four identical empty dropdowns cannot tell \"this site has no\n * forms yet\" from \"the read failed\" from \"this editor never lists forms at\n * all\". Only the first of those is a fact about their site; the other two\n * are the picker being broken, and a picker that cannot say which it is\n * sends the author looking for a form they already made.\n *\n * - `unavailable` — no provider is mounted, so nothing on this surface can\n *   list entities. The tenant, and any editor outside a host.\n * - `loading` — a read is open or about to be, and no answer has arrived.\n *   Also the state of a list nothing has asked for yet: demand is declared\n *   on the same commit that would display it, so \"not asked\" and \"asked,\n *   unanswered\" are the same beat.\n * - `ready` — the read settled. An empty list here IS the site's answer.\n * - `error` — the read failed. Empty means nothing.\n */\nexport type EntityListState = 'unavailable' | 'loading' | 'ready' | 'error'\n\n/**\n * How many documents a picker BROWSES.\n *\n * A picker is not a catalog viewer. It is a dropdown on a besigner surface\n * where the author is placing one element, and no table in the console offers\n * a page past `TABLE_PAGE_SIZE_OPTIONS` — a dropdown is the smaller surface of\n * the two, not the larger.\n *\n * The middle of that range rather than its floor: a table has a pager under it\n * and a dropdown does not, so the page a reader cannot advance is worth more\n * rows than the one they can.\n *\n * What makes this size SAFE is that browsing is the only job it does. A stored\n * value is named by {@link EntityPickerContextValue.resolve} — one keyed read\n * for the one document, exact at any catalog size — so nothing here has to be\n * wide enough to contain whatever an author picked last month. A window that\n * carried both jobs would have to be, and would still render a bound element\n * as unbound past its own width; widening this cannot fix that, only make it\n * rarer and more expensive.\n */\nexport const ENTITY_PICKER_BROWSE_LIMIT = 25\n\n/**\n * How many documents a server-side name search may return.\n *\n * The same size as the browse window, for the same reason: a reader who has\n * typed a query and still faces 25 rows narrows it further rather than\n * scrolling. Only the kinds in {@link EntityPickerContextValue.searchable}\n * spend this at all.\n */\nexport const ENTITY_PICKER_SEARCH_LIMIT = 25\n\nexport interface EntityPickerContextValue {\n  products?: EntityOption[]\n  collections?: EntityOption[]\n  categories?: EntityOption[]\n  datasets?: EntityOption[]\n  /** The host's form entities, id-first, feeding FORM_SELECT attributes. */\n  forms?: EntityOption[]\n  /**\n   * Per-dataset model fields (AGL-556), keyed by dataset id, in model\n   * order: id = stable model fieldId, label = current display name. Feeds\n   * DATASET_FIELD_SELECT attributes (e.g. a form field's \"Maps to schema\n   * field\" picker).\n   */\n  datasetFields?: Record<string, EntityOption[]>\n  /**\n   * Declare that a picker of this kind is on screen (AGL-703).\n   *\n   * The provider reads these lists from Firestore, and it used to read ALL of\n   * them the moment the besigner opened — up to 300 products, 200 catalog\n   * collections, 200 categories and 200 datasets, on a site with a real\n   * catalog, for pickers most editing sessions never open. Nothing about\n   * moving a heading needs the product list.\n   *\n   * So the lists are demand-driven now, and the demand signal is the thing\n   * that would DISPLAY one: a selected node whose schema declares a\n   * `PRODUCT_SELECT`, a repeat bound to a dataset. Call this when that is\n   * true and read the list on the render after; until then the list is\n   * absent, exactly as it is for the beat before any listener syncs.\n   *\n   * Optional, and absent on the tenant — which resolves ids and never lists\n   * them, so nothing there has a picker to ask for.\n   */\n  request?: (kind: EntityPickerKind) => void\n  /**\n   * Per-kind read state, so a picker can say WHY it has nothing to offer.\n   * A kind the provider omits reads as `loading`; see {@link entityListState}.\n   */\n  status?: Partial<Record<EntityPickerKind, EntityListState>>\n  /**\n   * The browse window came back FULL for this kind, so the list above is a\n   * page of the site's catalog and not the whole of it.\n   *\n   * Measured with a probe — the read asks for one document past\n   * {@link ENTITY_PICKER_BROWSE_LIMIT} and the extra one is never offered —\n   * so this is a fact about the collection rather than a guess from the\n   * window being exactly full.\n   *\n   * A picker owes the reader this sentence for the same reason the inbox's\n   * form filter does: \"not in the picker\" and \"does not exist\" are the same\n   * empty dropdown, and only one of them is a fact about their site.\n   */\n  truncated?: Partial<Record<EntityPickerKind, boolean>>\n  /**\n   * This kind's documents carry the name-search keys, so a typed query\n   * reaches the WHOLE collection rather than only the browse window.\n   *\n   * True for products alone today: `nameTokens`/`nameLower` are stamped by\n   * the catalog's own write path, and `hosts/{host}/resources` deliberately\n   * does not stamp them on the other four kinds. A picker for a kind that is\n   * absent here must say its search covers the window only — claiming\n   * otherwise would let an unfound entity read as a nonexistent one.\n   */\n  searchable?: Partial<Record<EntityPickerKind, boolean>>\n  /**\n   * Narrow this kind's offered list to what somebody typed.\n   *\n   * Matching is the provider's, not the dropdown's: it is the only side that\n   * can merge the window's own matches with the ones a server query found\n   * past it, and it uses `scoreMatch` so a query matches a word ANYWHERE in a\n   * name — the same rule the switchers and global search follow.\n   *\n   * Passing an empty string restores the browse window.\n   */\n  search?: (kind: EntityPickerKind, text: string) => void\n  /**\n   * Resolve ONE stored id to its current name, whatever the browse window\n   * holds.\n   *\n   * Deliberately NOT a job for the browse list, though a bulk read could do\n   * both. Sharing one read makes the list's width the limit on which stored\n   * values can be named, and past that width a picker renders a bound element\n   * as UNBOUND rather than as its label — an empty control on an element that\n   * is set, which an author repairs by picking again. That is how a correct\n   * reference gets replaced with a different one.\n   *\n   * One keyed `getDoc` for one document instead: exact at any catalog size,\n   * and asked for only when a node actually carries a value. Results land in\n   * {@link resolved} and are never re-read.\n   */\n  resolve?: (kind: EntityPickerKind, id: string) => void\n  /**\n   * What {@link resolve} found, keyed by kind and then by id.\n   *\n   * Three states, and the picker renders a different label for each: an\n   * `EntityOption` is the resolved name, `null` is a settled read that found\n   * NO such document, and an absent key is a resolution still in flight.\n   * Absent must never render as missing — a picker that flashed \"unavailable\"\n   * over every live reference for the beat before its read landed would teach\n   * authors to ignore the one warning that matters.\n   */\n  resolved?: Partial<\n    Record<EntityPickerKind, Readonly<Record<string, EntityOption | null>>>\n  >\n}\n\n/**\n * What the picker for `kind` should believe about its own emptiness.\n *\n * `request` is the \"a provider is mounted\" signal — it is the one member the\n * contract already says is absent wherever nothing lists entities — so a\n * surface with no provider resolves to `unavailable` rather than passing an\n * empty list off as the site's answer.\n */\nexport function entityListState(\n  context: EntityPickerContextValue | undefined,\n  kind: EntityPickerKind,\n): EntityListState {\n  if (!context?.request) return 'unavailable'\n  return context.status?.[kind] ?? 'loading'\n}\n\n/**\n * The id whose label a picker still needs a keyed read to learn, if any.\n *\n * Part of the contract rather than of one screen, because two surfaces ask\n * it — the attributes panel about a node's picker value, and the insert-token\n * menu about the dataset a repeat is bound to — and an answer that differed\n * between them would be a second keyed read for a document one of them\n * already had.\n *\n * Four cases resolve to \"ask nobody\", and each is a read not spent: there is\n * no value; the browse window already carries it, which is the common case on\n * a small site; a resolution has already answered, including the answer that\n * the document is gone; or the browse read has not settled, so the window may\n * be about to supply it for free.\n *\n * The last is the one worth stating. Asking while the listener is still\n * loading would spend a keyed read on nearly every picker on every site,\n * which is the cost splitting these two jobs exists to remove rather than to\n * move.\n */\nexport function entityValueNeedsResolution(\n  context: EntityPickerContextValue | undefined,\n  kind: EntityPickerKind,\n  value: unknown,\n): string | undefined {\n  const id = typeof value === 'string' ? value.trim() : ''\n  if (!id || !context?.resolve) return undefined\n  if ((context[kind] ?? []).some((entity) => entity.id === id)) return undefined\n  if (id in (context.resolved?.[kind] ?? {})) return undefined\n  if (entityListState(context, kind) !== 'ready') return undefined\n  return id\n}\n\nexport const EntityPickerContext = createContext<EntityPickerContextValue>({})\nEntityPickerContext.displayName = 'EntityPickerContext'\n"],"names":["createContext","ENTITY_PICKER_BROWSE_LIMIT","ENTITY_PICKER_SEARCH_LIMIT","entityListState","context","kind","request","status","entityValueNeedsResolution","value","id","trim","resolve","undefined","some","entity","resolved","EntityPickerContext","displayName"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GACD,+DAA+D;AAC/D,0EAA0E;AAC1E,0BAA0B;AAC1B,SAASA,aAAa,QAAQ,QAAO;AA8CrC;;;;;;;;;;;;;;;;;;;CAmBC,GACD,OAAO,MAAMC,6BAA6B,GAAE;AAE5C;;;;;;;CAOC,GACD,OAAO,MAAMC,6BAA6B,GAAE;AA2G5C;;;;;;;CAOC,GACD,OAAO,SAASC,gBACdC,OAA6C,EAC7CC,IAAsB;;QAGfD;IADP,IAAI,EAACA,2BAAAA,QAASE,OAAO,GAAE,OAAO;IAC9B,gBAAOF,kBAAAA,QAAQG,MAAM,qBAAdH,eAAgB,CAACC,KAAK,mBAAI;AACnC;AAEA;;;;;;;;;;;;;;;;;;;CAmBC,GACD,OAAO,SAASG,2BACdJ,OAA6C,EAC7CC,IAAsB,EACtBI,KAAc;QAITL;QACMA;IAHX,MAAMM,KAAK,OAAOD,UAAU,WAAWA,MAAME,IAAI,KAAK;IACtD,IAAI,CAACD,MAAM,EAACN,2BAAAA,QAASQ,OAAO,GAAE,OAAOC;IACrC,IAAI,EAACT,gBAAAA,OAAO,CAACC,KAAK,YAAbD,gBAAiB,EAAE,EAAEU,IAAI,CAAC,CAACC,SAAWA,OAAOL,EAAE,KAAKA,KAAK,OAAOG;IACrE,IAAIH,gBAAON,oBAAAA,QAAQY,QAAQ,qBAAhBZ,iBAAkB,CAACC,KAAK,mBAAI,CAAC,IAAI,OAAOQ;IACnD,IAAIV,gBAAgBC,SAASC,UAAU,SAAS,OAAOQ;IACvD,OAAOH;AACT;AAEA,OAAO,MAAMO,sBAAsBjB,cAAwC,CAAC,GAAE;AAC9EiB,oBAAoBC,WAAW,GAAG"}

package/src/lib/app-utils/error-beacon.d.ts

@@ -0,0 +1,107 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export interface ErrorBeaconEvent {
+    /** 'error' | 'unhandledrejection' — which handler caught it. */
+    kind: string;
+    /** Error message, clamped. */
+    message: string;
+    /** Stack trace when the thrown value carried one, clamped. */
+    stack?: string;
+    /** Script URL for stackless `window.onerror` events, scrubbed. */
+    source?: string;
+    line?: number;
+    col?: number;
+    /** Page URL, scrubbed to origin + pathname. */
+    url: string;
+}
+export interface ErrorBeaconOptions {
+    /** POST target; same-origin. Default `/api/errors`. */
+    endpoint?: string;
+    /** 0..1 — fraction of pageviews that report at all. Default 1. */
+    sampleRate?: number;
+    /** Max events reported per pageview before the beacon disarms. */
+    maxPerPage?: number;
+}
+/**
+ * Was this thrown by a script somebody ELSE evaluated into our page?
+ *
+ * Two tells, both read off the frames' URLs and neither off a function name —
+ * a name would be a denylist needing a new entry per vendor.
+ *
+ * **Every frame is the DOCUMENT.** Measured 2026-09-02 (AGL-2523) on
+ * aglyn.com/pricing, reported as an error of ours:
+ *
+ *     sendDataToNative@https://aglyn.com/pricing:1:1325
+ *     sendPageHideMessage@https://aglyn.com/pricing:1:4139
+ *     @https://aglyn.com/pricing:1:6257
+ *
+ * `sendDataToNative` is the Meta in-app browser's native bridge, injected by
+ * the Facebook/Instagram webview. In WebKit's format the code was evaluated
+ * inline, so every frame is the document rather than a script we served.
+ *
+ * **Every frame is under a FOREIGN scheme.** Measured 2026-09-10 (AGL-2786) on
+ * aglyn.com, the same bridge in the Android webview:
+ *
+ *     at sendDataToNative (iabjs://navigation_performance_logger_android:1:10632)
+ *
+ * That webview names its scripts under its own `iabjs://` scheme, and
+ * extensions do the same under theirs — see `FOREIGN_SCRIPT_SCHEMES`. A frame
+ * may carry either tell. Nothing we ship can be fixed in response to any of
+ * them, which is the same test the opaque `Script error.` cut already applies.
+ *
+ * ⚑ Deliberately `every`, and deliberately compared against the document
+ * rather than against our asset path. A rule like "no frame under
+ * `/_next/static/`" would delete EVERY error from a self-hosted deployment
+ * that serves its assets from a CDN, because none of its frames would match.
+ * Comparing to the document cannot fail that way: a CDN frame is not the
+ * document either, so it keeps the report.
+ *
+ * The cost is honest and small: a throw from one of our own inline
+ * bootstrap scripts looks the same and is dropped with it. That trade buys a
+ * rule that needs no maintenance as new webviews and extensions appear.
+ */
+export declare function isInjectedThirdPartyFrame(stack: string, documentUrl: string): boolean;
+export declare function isHydrationMismatch(message: string): boolean;
+/**
+ * Re-export so `error-beacon` stays the one name a caller has to know for
+ * browser error reporting. The definition lives in its own module because a
+ * boundary that imports it must not pull the installer below into a chunk
+ * every visitor downloads.
+ */
+export { redispatchCaughtError } from './redispatch-caught-error';
+/**
+ * Report an error the code ALREADY CAUGHT.
+ *
+ * The two window handlers below see only what nothing caught. A `catch` that
+ * swallows its error is invisible to them by construction, which is the whole
+ * failure mode this exists for: a background write that can only fail
+ * silently is one that stays broken for as long as nobody thinks to look.
+ *
+ * It rides the same queue as an uncaught error, which is the point — the
+ * dedupe collapses a failure that repeats on every edit into one report, and
+ * `maxPerPage` bounds it, so a call site in a loop cannot turn a broken
+ * feature into a flood. Reporting is never worth an exception of its own, so
+ * every path here returns rather than throws.
+ */
+export declare function reportHandledError(error: unknown, options?: {
+    kind?: string;
+}): void;
+/**
+ * Installs the handlers once per page. Safe to call from module scope of a
+ * client bundle: it no-ops during SSR and on repeat calls.
+ */
+export declare function installErrorBeacon(options?: ErrorBeaconOptions): void;

package/src/lib/app-utils/error-beacon.js

@@ -0,0 +1,296 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * First-party browser error beacon (AGL-1538).
+ *
+ * Crashlytics does not exist for web, and adding a third-party error vendor
+ * is a subprocessor-list decision that was explicitly deferred. This is the
+ * first-party alternative: `window.onerror` / `unhandledrejection` handlers
+ * that batch uncaught failures to the app's own `/api/errors` route, which
+ * forwards them to Google Cloud Error Reporting — a processor already on the
+ * list, alerting through the GCP stack that already pages (AGL-1502).
+ *
+ * Design constraints, in order:
+ *
+ * - **It must never become the outage.** Everything is wrapped; a failure to
+ *   report is silence, not a thrown error. Batches are capped per page so an
+ *   error thrown in a loop cannot DDoS our own API — after `maxPerPage`
+ *   events the beacon disarms for the rest of the pageview.
+ * - **No PII.** URLs are scrubbed to origin + pathname (query strings and
+ *   fragments carry tokens and search terms), no user id, no cookies —
+ *   the payload is the error text and where in the CODE it happened.
+ *   Cross-origin scripts surface as the browser's opaque "Script error."
+ *   with no stack; those are dropped since they cannot be acted on.
+ * - **Dedupe.** One page throwing the same error on every frame reports it
+ *   once.
+ *
+ * Framework-free on purpose: the console mounts it from its root layout, the
+ * tenant runtime from its own, and neither needs React here. Deliberately NO
+ * 'use client' directive — inside this shared lib the directive forks the
+ * module graph (AGL-52); every importer is already a client module.
+ */ import { isForeignScriptUrl, stackFrameUrls } from "./foreign-script.js";
+const MAX_MESSAGE = 1024;
+const MAX_STACK = 8192;
+const FLUSH_DELAY_MS = 2000;
+/** Origin + pathname only — query strings and fragments never leave. */ function scrubUrl(raw) {
+    if (!raw) return '';
+    try {
+        const url = new URL(String(raw), window.location.href);
+        return `${url.origin}${url.pathname}`;
+    } catch (unused) {
+        return '';
+    }
+}
+function clamp(value, max) {
+    return String(value != null ? value : '').slice(0, max);
+}
+/**
+ * Was this thrown by a script somebody ELSE evaluated into our page?
+ *
+ * Two tells, both read off the frames' URLs and neither off a function name —
+ * a name would be a denylist needing a new entry per vendor.
+ *
+ * **Every frame is the DOCUMENT.** Measured 2026-09-02 (AGL-2523) on
+ * aglyn.com/pricing, reported as an error of ours:
+ *
+ *     sendDataToNative@https://aglyn.com/pricing:1:1325
+ *     sendPageHideMessage@https://aglyn.com/pricing:1:4139
+ *     @https://aglyn.com/pricing:1:6257
+ *
+ * `sendDataToNative` is the Meta in-app browser's native bridge, injected by
+ * the Facebook/Instagram webview. In WebKit's format the code was evaluated
+ * inline, so every frame is the document rather than a script we served.
+ *
+ * **Every frame is under a FOREIGN scheme.** Measured 2026-09-10 (AGL-2786) on
+ * aglyn.com, the same bridge in the Android webview:
+ *
+ *     at sendDataToNative (iabjs://navigation_performance_logger_android:1:10632)
+ *
+ * That webview names its scripts under its own `iabjs://` scheme, and
+ * extensions do the same under theirs — see `FOREIGN_SCRIPT_SCHEMES`. A frame
+ * may carry either tell. Nothing we ship can be fixed in response to any of
+ * them, which is the same test the opaque `Script error.` cut already applies.
+ *
+ * ⚑ Deliberately `every`, and deliberately compared against the document
+ * rather than against our asset path. A rule like "no frame under
+ * `/_next/static/`" would delete EVERY error from a self-hosted deployment
+ * that serves its assets from a CDN, because none of its frames would match.
+ * Comparing to the document cannot fail that way: a CDN frame is not the
+ * document either, so it keeps the report.
+ *
+ * The cost is honest and small: a throw from one of our own inline
+ * bootstrap scripts looks the same and is dropped with it. That trade buys a
+ * rule that needs no maintenance as new webviews and extensions appear.
+ */ export function isInjectedThirdPartyFrame(stack, documentUrl) {
+    const urls = stackFrameUrls(stack);
+    // No frames parsed is not evidence of anything — keep the report.
+    if (!urls.length) return false;
+    return urls.every((url)=>isForeignScriptUrl(url) || scrubUrl(url) === documentUrl);
+}
+/**
+ * React's hydration-mismatch family, which a page TRANSLATOR causes and a
+ * real render divergence also causes.
+ *
+ * These are `onRecoverableError` reports, not crashes: React has already
+ * re-rendered on the client and the visitor has a working page. They arrive
+ * here as uncaught errors only because React re-throws them to `reportError`.
+ *
+ * They are marked rather than dropped, and the distinction is the whole
+ * design. Dropping would hide a real hydration regression, which is a genuine
+ * and expensive bug; the entries stay in `client-errors` at full severity and
+ * still group in Error Reporting. What the mark buys is that the log-match
+ * policy can stop paging on a single report, while a rate-based policy on the
+ * same mark still catches a systemic one.
+ *
+ * ⚠️ THE MARK IS NOT A VERDICT, and the one cluster this repo has measured is
+ * why. Eight #418 reports arrived inside a nine-minute window on 2026-09-01,
+ * on one build, and the three pages they came from were exactly the three
+ * carrying a form — `/`, `/pricing` and the solutions pages reported nothing
+ * in the same window, which no browser-side rewrite would respect. A placed
+ * form was expanding inside its own grafted subtree, so every page carrying
+ * one shipped six nested `<form>` elements; nested forms are invalid HTML, the
+ * parser dropped the inner ones, and the client tree disagreed with the server
+ * tree. The visible cost was a submission the route never received, because
+ * the native submit came from an unhandled ancestor and the browser fell back
+ * to a GET with the visitor's name, email and message in the address bar. The
+ * reports stopped because the nesting was fixed, roughly a quarter of an hour
+ * after the last one.
+ *
+ * So a rate low enough not to page is a reason to READ the entry — the page
+ * it names, and whether the set of pages has a shape — never a reason to
+ * assume somebody's extension.
+ */ const HYDRATION_MINIFIED = /Minified React error #(?:418|423|425)\b/;
+const HYDRATION_TEXT = /Hydration failed because|Text content does not match server-rendered HTML|There was an error while hydrating/;
+export function isHydrationMismatch(message) {
+    return HYDRATION_MINIFIED.test(message) || HYDRATION_TEXT.test(message);
+}
+let installed = false;
+/**
+ * The live beacon's `enqueue`, published for {@link reportHandledError}.
+ *
+ * Null until `installErrorBeacon` runs, and null forever on a surface that
+ * never installs one — so a caught error reported from a page with no beacon
+ * is silently dropped rather than throwing inside somebody's error handler.
+ */ let publishEvent = null;
+/**
+ * Re-export so `error-beacon` stays the one name a caller has to know for
+ * browser error reporting. The definition lives in its own module because a
+ * boundary that imports it must not pull the installer below into a chunk
+ * every visitor downloads.
+ */ export { redispatchCaughtError } from "./redispatch-caught-error.js";
+/**
+ * Report an error the code ALREADY CAUGHT.
+ *
+ * The two window handlers below see only what nothing caught. A `catch` that
+ * swallows its error is invisible to them by construction, which is the whole
+ * failure mode this exists for: a background write that can only fail
+ * silently is one that stays broken for as long as nobody thinks to look.
+ *
+ * It rides the same queue as an uncaught error, which is the point — the
+ * dedupe collapses a failure that repeats on every edit into one report, and
+ * `maxPerPage` bounds it, so a call site in a loop cannot turn a broken
+ * feature into a flood. Reporting is never worth an exception of its own, so
+ * every path here returns rather than throws.
+ */ export function reportHandledError(error, options) {
+    try {
+        var _ref, _ref1;
+        if (!publishEvent) return;
+        const thrown = error;
+        const message = clamp((_ref = thrown == null ? void 0 : thrown.message) != null ? _ref : typeof error === 'string' ? error : '', MAX_MESSAGE);
+        if (!message) return;
+        publishEvent({
+            kind: clamp((_ref1 = options == null ? void 0 : options.kind) != null ? _ref1 : 'handled', 32),
+            message,
+            stack: (thrown == null ? void 0 : thrown.stack) ? clamp(thrown.stack, MAX_STACK) : undefined,
+            url: scrubUrl(window.location.href)
+        });
+    } catch (unused) {
+    // An observer that throws is worse than one that misses an event.
+    }
+}
+/**
+ * Installs the handlers once per page. Safe to call from module scope of a
+ * client bundle: it no-ops during SSR and on repeat calls.
+ */ export function installErrorBeacon(options) {
+    var _ref, _ref1, _ref2;
+    if (typeof window === 'undefined' || installed) return;
+    installed = true;
+    const endpoint = (_ref = options == null ? void 0 : options.endpoint) != null ? _ref : '/api/errors';
+    const sampleRate = (_ref1 = options == null ? void 0 : options.sampleRate) != null ? _ref1 : 1;
+    const maxPerPage = (_ref2 = options == null ? void 0 : options.maxPerPage) != null ? _ref2 : 10;
+    if (Math.random() >= sampleRate) return;
+    const seen = new Set();
+    let queued = [];
+    let sent = 0;
+    let timer = null;
+    const flush = ()=>{
+        timer = null;
+        if (!queued.length) return;
+        const batch = queued;
+        queued = [];
+        try {
+            const body = JSON.stringify({
+                events: batch
+            });
+            // sendBeacon survives unloads and never blocks; keepalive fetch is the
+            // fallback for browsers that refuse the payload.
+            if (!(navigator.sendBeacon == null ? void 0 : navigator.sendBeacon.call(navigator, endpoint, body))) {
+                void fetch(endpoint, {
+                    method: 'POST',
+                    body,
+                    keepalive: true,
+                    headers: {
+                        'Content-Type': 'application/json'
+                    }
+                }).catch(()=>undefined);
+            }
+        } catch (unused) {
+        // Reporting never breaks the page.
+        }
+    };
+    const enqueue = (event)=>{
+        var _event_stack;
+        if (sent >= maxPerPage) return;
+        // Message + first stack line: enough identity to collapse a render loop
+        // without collapsing distinct errors that share a message.
+        const key = `${event.message}\x00${((_event_stack = event.stack) != null ? _event_stack : '').split('\n', 2).join('\n')}`;
+        if (seen.has(key)) return;
+        seen.add(key);
+        sent += 1;
+        queued.push(event);
+        if (!timer) timer = setTimeout(flush, FLUSH_DELAY_MS);
+    };
+    // Published AFTER the sample-rate return above, so an unsampled pageview
+    // reports nothing by either door rather than one by one and none by the
+    // other.
+    publishEvent = enqueue;
+    window.addEventListener('error', (event)=>{
+        try {
+            var _ref;
+            const error = event.error;
+            const message = clamp((_ref = error == null ? void 0 : error.message) != null ? _ref : event.message, MAX_MESSAGE);
+            // Cross-origin scripts yield an opaque "Script error." with nothing
+            // actionable attached; reporting it would only create a noisy group.
+            if (!message || message === 'Script error.') return;
+            const pageUrl = scrubUrl(window.location.href);
+            const fullStack = (error == null ? void 0 : error.stack) ? String(error.stack) : undefined;
+            // A webview or extension that evaluated its own code into our page —
+            // see `isInjectedThirdPartyFrame`. Nothing we ship can be changed in
+            // response, so it is dropped on the same test as `Script error.`.
+            // Judged on the WHOLE stack, before the clamp: a frame of ours past the
+            // clamp still makes the error ours.
+            if (fullStack && isInjectedThirdPartyFrame(fullStack, pageUrl)) return;
+            const stack = fullStack ? clamp(fullStack, MAX_STACK) : undefined;
+            enqueue({
+                // MARKED, not dropped: a translator causes these and so does a real
+                // render divergence, and only a rate tells them apart.
+                kind: isHydrationMismatch(message) ? 'hydration' : 'error',
+                message,
+                stack,
+                source: scrubUrl(event.filename) || undefined,
+                line: typeof event.lineno === 'number' ? event.lineno : undefined,
+                col: typeof event.colno === 'number' ? event.colno : undefined,
+                url: pageUrl
+            });
+        } catch (unused) {
+        // Never rethrow from an error handler.
+        }
+    });
+    window.addEventListener('unhandledrejection', (event)=>{
+        try {
+            var _ref;
+            const reason = event.reason;
+            const message = clamp((_ref = reason == null ? void 0 : reason.message) != null ? _ref : typeof event.reason === 'string' ? event.reason : 'Unhandled promise rejection', MAX_MESSAGE);
+            if (!message) return;
+            enqueue({
+                kind: 'unhandledrejection',
+                message,
+                stack: (reason == null ? void 0 : reason.stack) ? clamp(reason.stack, MAX_STACK) : undefined,
+                url: scrubUrl(window.location.href)
+            });
+        } catch (unused) {
+        // Never rethrow from an error handler.
+        }
+    });
+    // A batch waiting out its debounce when the page hides would be lost;
+    // `pagehide`/`visibilitychange` are the last reliable moments to send.
+    window.addEventListener('pagehide', flush);
+    document.addEventListener('visibilitychange', ()=>{
+        if (document.visibilityState === 'hidden') flush();
+    });
+}
+
+//# sourceMappingURL=error-beacon.js.map

package/src/lib/app-utils/error-beacon.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/error-beacon.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * First-party browser error beacon (AGL-1538).\n *\n * Crashlytics does not exist for web, and adding a third-party error vendor\n * is a subprocessor-list decision that was explicitly deferred. This is the\n * first-party alternative: `window.onerror` / `unhandledrejection` handlers\n * that batch uncaught failures to the app's own `/api/errors` route, which\n * forwards them to Google Cloud Error Reporting — a processor already on the\n * list, alerting through the GCP stack that already pages (AGL-1502).\n *\n * Design constraints, in order:\n *\n * - **It must never become the outage.** Everything is wrapped; a failure to\n *   report is silence, not a thrown error. Batches are capped per page so an\n *   error thrown in a loop cannot DDoS our own API — after `maxPerPage`\n *   events the beacon disarms for the rest of the pageview.\n * - **No PII.** URLs are scrubbed to origin + pathname (query strings and\n *   fragments carry tokens and search terms), no user id, no cookies —\n *   the payload is the error text and where in the CODE it happened.\n *   Cross-origin scripts surface as the browser's opaque \"Script error.\"\n *   with no stack; those are dropped since they cannot be acted on.\n * - **Dedupe.** One page throwing the same error on every frame reports it\n *   once.\n *\n * Framework-free on purpose: the console mounts it from its root layout, the\n * tenant runtime from its own, and neither needs React here. Deliberately NO\n * 'use client' directive — inside this shared lib the directive forks the\n * module graph (AGL-52); every importer is already a client module.\n */\n\nimport { isForeignScriptUrl, stackFrameUrls } from './foreign-script'\n\nexport interface ErrorBeaconEvent {\n  /** 'error' | 'unhandledrejection' — which handler caught it. */\n  kind: string\n  /** Error message, clamped. */\n  message: string\n  /** Stack trace when the thrown value carried one, clamped. */\n  stack?: string\n  /** Script URL for stackless `window.onerror` events, scrubbed. */\n  source?: string\n  line?: number\n  col?: number\n  /** Page URL, scrubbed to origin + pathname. */\n  url: string\n}\n\nexport interface ErrorBeaconOptions {\n  /** POST target; same-origin. Default `/api/errors`. */\n  endpoint?: string\n  /** 0..1 — fraction of pageviews that report at all. Default 1. */\n  sampleRate?: number\n  /** Max events reported per pageview before the beacon disarms. */\n  maxPerPage?: number\n}\n\nconst MAX_MESSAGE = 1_024\nconst MAX_STACK = 8_192\nconst FLUSH_DELAY_MS = 2_000\n\n/** Origin + pathname only — query strings and fragments never leave. */\nfunction scrubUrl(raw: string | null | undefined): string {\n  if (!raw) return ''\n  try {\n    const url = new URL(String(raw), window.location.href)\n    return `${url.origin}${url.pathname}`\n  } catch {\n    return ''\n  }\n}\n\nfunction clamp(value: unknown, max: number): string {\n  return String(value ?? '').slice(0, max)\n}\n\n/**\n * Was this thrown by a script somebody ELSE evaluated into our page?\n *\n * Two tells, both read off the frames' URLs and neither off a function name —\n * a name would be a denylist needing a new entry per vendor.\n *\n * **Every frame is the DOCUMENT.** Measured 2026-09-02 (AGL-2523) on\n * aglyn.com/pricing, reported as an error of ours:\n *\n *     sendDataToNative@https://aglyn.com/pricing:1:1325\n *     sendPageHideMessage@https://aglyn.com/pricing:1:4139\n *     @https://aglyn.com/pricing:1:6257\n *\n * `sendDataToNative` is the Meta in-app browser's native bridge, injected by\n * the Facebook/Instagram webview. In WebKit's format the code was evaluated\n * inline, so every frame is the document rather than a script we served.\n *\n * **Every frame is under a FOREIGN scheme.** Measured 2026-09-10 (AGL-2786) on\n * aglyn.com, the same bridge in the Android webview:\n *\n *     at sendDataToNative (iabjs://navigation_performance_logger_android:1:10632)\n *\n * That webview names its scripts under its own `iabjs://` scheme, and\n * extensions do the same under theirs — see `FOREIGN_SCRIPT_SCHEMES`. A frame\n * may carry either tell. Nothing we ship can be fixed in response to any of\n * them, which is the same test the opaque `Script error.` cut already applies.\n *\n * ⚑ Deliberately `every`, and deliberately compared against the document\n * rather than against our asset path. A rule like \"no frame under\n * `/_next/static/`\" would delete EVERY error from a self-hosted deployment\n * that serves its assets from a CDN, because none of its frames would match.\n * Comparing to the document cannot fail that way: a CDN frame is not the\n * document either, so it keeps the report.\n *\n * The cost is honest and small: a throw from one of our own inline\n * bootstrap scripts looks the same and is dropped with it. That trade buys a\n * rule that needs no maintenance as new webviews and extensions appear.\n */\nexport function isInjectedThirdPartyFrame(\n  stack: string,\n  documentUrl: string,\n): boolean {\n  const urls = stackFrameUrls(stack)\n  // No frames parsed is not evidence of anything — keep the report.\n  if (!urls.length) return false\n  return urls.every(\n    (url) => isForeignScriptUrl(url) || scrubUrl(url) === documentUrl,\n  )\n}\n\n/**\n * React's hydration-mismatch family, which a page TRANSLATOR causes and a\n * real render divergence also causes.\n *\n * These are `onRecoverableError` reports, not crashes: React has already\n * re-rendered on the client and the visitor has a working page. They arrive\n * here as uncaught errors only because React re-throws them to `reportError`.\n *\n * They are marked rather than dropped, and the distinction is the whole\n * design. Dropping would hide a real hydration regression, which is a genuine\n * and expensive bug; the entries stay in `client-errors` at full severity and\n * still group in Error Reporting. What the mark buys is that the log-match\n * policy can stop paging on a single report, while a rate-based policy on the\n * same mark still catches a systemic one.\n *\n * ⚠️ THE MARK IS NOT A VERDICT, and the one cluster this repo has measured is\n * why. Eight #418 reports arrived inside a nine-minute window on 2026-09-01,\n * on one build, and the three pages they came from were exactly the three\n * carrying a form — `/`, `/pricing` and the solutions pages reported nothing\n * in the same window, which no browser-side rewrite would respect. A placed\n * form was expanding inside its own grafted subtree, so every page carrying\n * one shipped six nested `<form>` elements; nested forms are invalid HTML, the\n * parser dropped the inner ones, and the client tree disagreed with the server\n * tree. The visible cost was a submission the route never received, because\n * the native submit came from an unhandled ancestor and the browser fell back\n * to a GET with the visitor's name, email and message in the address bar. The\n * reports stopped because the nesting was fixed, roughly a quarter of an hour\n * after the last one.\n *\n * So a rate low enough not to page is a reason to READ the entry — the page\n * it names, and whether the set of pages has a shape — never a reason to\n * assume somebody's extension.\n */\nconst HYDRATION_MINIFIED = /Minified React error #(?:418|423|425)\\b/\nconst HYDRATION_TEXT =\n  /Hydration failed because|Text content does not match server-rendered HTML|There was an error while hydrating/\n\nexport function isHydrationMismatch(message: string): boolean {\n  return HYDRATION_MINIFIED.test(message) || HYDRATION_TEXT.test(message)\n}\n\nlet installed = false\n\n/**\n * The live beacon's `enqueue`, published for {@link reportHandledError}.\n *\n * Null until `installErrorBeacon` runs, and null forever on a surface that\n * never installs one — so a caught error reported from a page with no beacon\n * is silently dropped rather than throwing inside somebody's error handler.\n */\nlet publishEvent: ((event: ErrorBeaconEvent) => void) | null = null\n\n/**\n * Re-export so `error-beacon` stays the one name a caller has to know for\n * browser error reporting. The definition lives in its own module because a\n * boundary that imports it must not pull the installer below into a chunk\n * every visitor downloads.\n */\nexport { redispatchCaughtError } from './redispatch-caught-error'\n\n/**\n * Report an error the code ALREADY CAUGHT.\n *\n * The two window handlers below see only what nothing caught. A `catch` that\n * swallows its error is invisible to them by construction, which is the whole\n * failure mode this exists for: a background write that can only fail\n * silently is one that stays broken for as long as nobody thinks to look.\n *\n * It rides the same queue as an uncaught error, which is the point — the\n * dedupe collapses a failure that repeats on every edit into one report, and\n * `maxPerPage` bounds it, so a call site in a loop cannot turn a broken\n * feature into a flood. Reporting is never worth an exception of its own, so\n * every path here returns rather than throws.\n */\nexport function reportHandledError(\n  error: unknown,\n  options?: { kind?: string },\n): void {\n  try {\n    if (!publishEvent) return\n    const thrown = error as Error | undefined\n    const message = clamp(\n      thrown?.message ?? (typeof error === 'string' ? error : ''),\n      MAX_MESSAGE,\n    )\n    if (!message) return\n    publishEvent({\n      kind: clamp(options?.kind ?? 'handled', 32),\n      message,\n      stack: thrown?.stack ? clamp(thrown.stack, MAX_STACK) : undefined,\n      url: scrubUrl(window.location.href),\n    })\n  } catch {\n    // An observer that throws is worse than one that misses an event.\n  }\n}\n\n/**\n * Installs the handlers once per page. Safe to call from module scope of a\n * client bundle: it no-ops during SSR and on repeat calls.\n */\nexport function installErrorBeacon(options?: ErrorBeaconOptions): void {\n  if (typeof window === 'undefined' || installed) return\n  installed = true\n\n  const endpoint = options?.endpoint ?? '/api/errors'\n  const sampleRate = options?.sampleRate ?? 1\n  const maxPerPage = options?.maxPerPage ?? 10\n  if (Math.random() >= sampleRate) return\n\n  const seen = new Set<string>()\n  let queued: ErrorBeaconEvent[] = []\n  let sent = 0\n  let timer: ReturnType<typeof setTimeout> | null = null\n\n  const flush = () => {\n    timer = null\n    if (!queued.length) return\n    const batch = queued\n    queued = []\n    try {\n      const body = JSON.stringify({ events: batch })\n      // sendBeacon survives unloads and never blocks; keepalive fetch is the\n      // fallback for browsers that refuse the payload.\n      if (!navigator.sendBeacon?.(endpoint, body)) {\n        void fetch(endpoint, {\n          method: 'POST',\n          body,\n          keepalive: true,\n          headers: { 'Content-Type': 'application/json' },\n        }).catch((): undefined => undefined)\n      }\n    } catch {\n      // Reporting never breaks the page.\n    }\n  }\n\n  const enqueue = (event: ErrorBeaconEvent) => {\n    if (sent >= maxPerPage) return\n    // Message + first stack line: enough identity to collapse a render loop\n    // without collapsing distinct errors that share a message.\n    const key = `${event.message}\\x00${(event.stack ?? '').split('\\n', 2).join('\\n')}`\n    if (seen.has(key)) return\n    seen.add(key)\n    sent += 1\n    queued.push(event)\n    if (!timer) timer = setTimeout(flush, FLUSH_DELAY_MS)\n  }\n  // Published AFTER the sample-rate return above, so an unsampled pageview\n  // reports nothing by either door rather than one by one and none by the\n  // other.\n  publishEvent = enqueue\n\n  window.addEventListener('error', (event) => {\n    try {\n      const error = event.error as Error | undefined\n      const message = clamp(error?.message ?? event.message, MAX_MESSAGE)\n      // Cross-origin scripts yield an opaque \"Script error.\" with nothing\n      // actionable attached; reporting it would only create a noisy group.\n      if (!message || message === 'Script error.') return\n      const pageUrl = scrubUrl(window.location.href)\n      const fullStack = error?.stack ? String(error.stack) : undefined\n      // A webview or extension that evaluated its own code into our page —\n      // see `isInjectedThirdPartyFrame`. Nothing we ship can be changed in\n      // response, so it is dropped on the same test as `Script error.`.\n      // Judged on the WHOLE stack, before the clamp: a frame of ours past the\n      // clamp still makes the error ours.\n      if (fullStack && isInjectedThirdPartyFrame(fullStack, pageUrl)) return\n      const stack = fullStack ? clamp(fullStack, MAX_STACK) : undefined\n      enqueue({\n        // MARKED, not dropped: a translator causes these and so does a real\n        // render divergence, and only a rate tells them apart.\n        kind: isHydrationMismatch(message) ? 'hydration' : 'error',\n        message,\n        stack,\n        source: scrubUrl(event.filename) || undefined,\n        line: typeof event.lineno === 'number' ? event.lineno : undefined,\n        col: typeof event.colno === 'number' ? event.colno : undefined,\n        url: pageUrl,\n      })\n    } catch {\n      // Never rethrow from an error handler.\n    }\n  })\n\n  window.addEventListener('unhandledrejection', (event) => {\n    try {\n      const reason = event.reason as Error | undefined\n      const message = clamp(\n        reason?.message ?? (typeof event.reason === 'string' ? event.reason : 'Unhandled promise rejection'),\n        MAX_MESSAGE,\n      )\n      if (!message) return\n      enqueue({\n        kind: 'unhandledrejection',\n        message,\n        stack: reason?.stack ? clamp(reason.stack, MAX_STACK) : undefined,\n        url: scrubUrl(window.location.href),\n      })\n    } catch {\n      // Never rethrow from an error handler.\n    }\n  })\n\n  // A batch waiting out its debounce when the page hides would be lost;\n  // `pagehide`/`visibilitychange` are the last reliable moments to send.\n  window.addEventListener('pagehide', flush)\n  document.addEventListener('visibilitychange', () => {\n    if (document.visibilityState === 'hidden') flush()\n  })\n}\n"],"names":["isForeignScriptUrl","stackFrameUrls","MAX_MESSAGE","MAX_STACK","FLUSH_DELAY_MS","scrubUrl","raw","url","URL","String","window","location","href","origin","pathname","clamp","value","max","slice","isInjectedThirdPartyFrame","stack","documentUrl","urls","length","every","HYDRATION_MINIFIED","HYDRATION_TEXT","isHydrationMismatch","message","test","installed","publishEvent","redispatchCaughtError","reportHandledError","error","options","thrown","kind","undefined","installErrorBeacon","endpoint","sampleRate","maxPerPage","Math","random","seen","Set","queued","sent","timer","flush","batch","body","JSON","stringify","events","navigator","sendBeacon","fetch","method","keepalive","headers","catch","enqueue","event","key","split","join","has","add","push","setTimeout","addEventListener","pageUrl","fullStack","source","filename","line","lineno","col","colno","reason","document","visibilityState"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BC,GAED,SAASA,kBAAkB,EAAEC,cAAc,QAAQ,sBAAkB;AA0BrE,MAAMC,cAAc;AACpB,MAAMC,YAAY;AAClB,MAAMC,iBAAiB;AAEvB,sEAAsE,GACtE,SAASC,SAASC,GAA8B;IAC9C,IAAI,CAACA,KAAK,OAAO;IACjB,IAAI;QACF,MAAMC,MAAM,IAAIC,IAAIC,OAAOH,MAAMI,OAAOC,QAAQ,CAACC,IAAI;QACrD,OAAO,GAAGL,IAAIM,MAAM,GAAGN,IAAIO,QAAQ,EAAE;IACvC,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA,SAASC,MAAMC,KAAc,EAAEC,GAAW;IACxC,OAAOR,OAAOO,gBAAAA,QAAS,IAAIE,KAAK,CAAC,GAAGD;AACtC;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCC,GACD,OAAO,SAASE,0BACdC,KAAa,EACbC,WAAmB;IAEnB,MAAMC,OAAOrB,eAAemB;IAC5B,kEAAkE;IAClE,IAAI,CAACE,KAAKC,MAAM,EAAE,OAAO;IACzB,OAAOD,KAAKE,KAAK,CACf,CAACjB,MAAQP,mBAAmBO,QAAQF,SAASE,SAASc;AAE1D;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCC,GACD,MAAMI,qBAAqB;AAC3B,MAAMC,iBACJ;AAEF,OAAO,SAASC,oBAAoBC,OAAe;IACjD,OAAOH,mBAAmBI,IAAI,CAACD,YAAYF,eAAeG,IAAI,CAACD;AACjE;AAEA,IAAIE,YAAY;AAEhB;;;;;;CAMC,GACD,IAAIC,eAA2D;AAE/D;;;;;CAKC,GACD,SAASC,qBAAqB,QAAQ,+BAA2B;AAEjE;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASC,mBACdC,KAAc,EACdC,OAA2B;IAE3B,IAAI;;QACF,IAAI,CAACJ,cAAc;QACnB,MAAMK,SAASF;QACf,MAAMN,UAAUb,cACdqB,0BAAAA,OAAQR,OAAO,mBAAK,OAAOM,UAAU,WAAWA,QAAQ,IACxDhC;QAEF,IAAI,CAAC0B,SAAS;QACdG,aAAa;YACXM,MAAMtB,eAAMoB,2BAAAA,QAASE,IAAI,oBAAI,WAAW;YACxCT;YACAR,OAAOgB,CAAAA,0BAAAA,OAAQhB,KAAK,IAAGL,MAAMqB,OAAOhB,KAAK,EAAEjB,aAAamC;YACxD/B,KAAKF,SAASK,OAAOC,QAAQ,CAACC,IAAI;QACpC;IACF,EAAE,eAAM;IACN,kEAAkE;IACpE;AACF;AAEA;;;CAGC,GACD,OAAO,SAAS2B,mBAAmBJ,OAA4B;;IAC7D,IAAI,OAAOzB,WAAW,eAAeoB,WAAW;IAChDA,YAAY;IAEZ,MAAMU,mBAAWL,2BAAAA,QAASK,QAAQ,mBAAI;IACtC,MAAMC,sBAAaN,2BAAAA,QAASM,UAAU,oBAAI;IAC1C,MAAMC,sBAAaP,2BAAAA,QAASO,UAAU,oBAAI;IAC1C,IAAIC,KAAKC,MAAM,MAAMH,YAAY;IAEjC,MAAMI,OAAO,IAAIC;IACjB,IAAIC,SAA6B,EAAE;IACnC,IAAIC,OAAO;IACX,IAAIC,QAA8C;IAElD,MAAMC,QAAQ;QACZD,QAAQ;QACR,IAAI,CAACF,OAAOxB,MAAM,EAAE;QACpB,MAAM4B,QAAQJ;QACdA,SAAS,EAAE;QACX,IAAI;YACF,MAAMK,OAAOC,KAAKC,SAAS,CAAC;gBAAEC,QAAQJ;YAAM;YAC5C,uEAAuE;YACvE,iDAAiD;YACjD,IAAI,EAACK,UAAUC,UAAU,oBAApBD,UAAUC,UAAU,MAApBD,WAAuBhB,UAAUY,QAAO;gBAC3C,KAAKM,MAAMlB,UAAU;oBACnBmB,QAAQ;oBACRP;oBACAQ,WAAW;oBACXC,SAAS;wBAAE,gBAAgB;oBAAmB;gBAChD,GAAGC,KAAK,CAAC,IAAiBxB;YAC5B;QACF,EAAE,eAAM;QACN,mCAAmC;QACrC;IACF;IAEA,MAAMyB,UAAU,CAACC;YAIqBA;QAHpC,IAAIhB,QAAQN,YAAY;QACxB,wEAAwE;QACxE,2DAA2D;QAC3D,MAAMuB,MAAM,GAAGD,MAAMpC,OAAO,CAAC,IAAI,EAAE,EAACoC,eAAAA,MAAM5C,KAAK,YAAX4C,eAAe,IAAIE,KAAK,CAAC,MAAM,GAAGC,IAAI,CAAC,OAAO;QAClF,IAAItB,KAAKuB,GAAG,CAACH,MAAM;QACnBpB,KAAKwB,GAAG,CAACJ;QACTjB,QAAQ;QACRD,OAAOuB,IAAI,CAACN;QACZ,IAAI,CAACf,OAAOA,QAAQsB,WAAWrB,OAAO9C;IACxC;IACA,yEAAyE;IACzE,wEAAwE;IACxE,SAAS;IACT2B,eAAegC;IAEfrD,OAAO8D,gBAAgB,CAAC,SAAS,CAACR;QAChC,IAAI;;YACF,MAAM9B,QAAQ8B,MAAM9B,KAAK;YACzB,MAAMN,UAAUb,cAAMmB,yBAAAA,MAAON,OAAO,mBAAIoC,MAAMpC,OAAO,EAAE1B;YACvD,oEAAoE;YACpE,qEAAqE;YACrE,IAAI,CAAC0B,WAAWA,YAAY,iBAAiB;YAC7C,MAAM6C,UAAUpE,SAASK,OAAOC,QAAQ,CAACC,IAAI;YAC7C,MAAM8D,YAAYxC,CAAAA,yBAAAA,MAAOd,KAAK,IAAGX,OAAOyB,MAAMd,KAAK,IAAIkB;YACvD,qEAAqE;YACrE,qEAAqE;YACrE,kEAAkE;YAClE,wEAAwE;YACxE,oCAAoC;YACpC,IAAIoC,aAAavD,0BAA0BuD,WAAWD,UAAU;YAChE,MAAMrD,QAAQsD,YAAY3D,MAAM2D,WAAWvE,aAAamC;YACxDyB,QAAQ;gBACN,oEAAoE;gBACpE,uDAAuD;gBACvD1B,MAAMV,oBAAoBC,WAAW,cAAc;gBACnDA;gBACAR;gBACAuD,QAAQtE,SAAS2D,MAAMY,QAAQ,KAAKtC;gBACpCuC,MAAM,OAAOb,MAAMc,MAAM,KAAK,WAAWd,MAAMc,MAAM,GAAGxC;gBACxDyC,KAAK,OAAOf,MAAMgB,KAAK,KAAK,WAAWhB,MAAMgB,KAAK,GAAG1C;gBACrD/B,KAAKkE;YACP;QACF,EAAE,eAAM;QACN,uCAAuC;QACzC;IACF;IAEA/D,OAAO8D,gBAAgB,CAAC,sBAAsB,CAACR;QAC7C,IAAI;;YACF,MAAMiB,SAASjB,MAAMiB,MAAM;YAC3B,MAAMrD,UAAUb,cACdkE,0BAAAA,OAAQrD,OAAO,mBAAK,OAAOoC,MAAMiB,MAAM,KAAK,WAAWjB,MAAMiB,MAAM,GAAG,+BACtE/E;YAEF,IAAI,CAAC0B,SAAS;YACdmC,QAAQ;gBACN1B,MAAM;gBACNT;gBACAR,OAAO6D,CAAAA,0BAAAA,OAAQ7D,KAAK,IAAGL,MAAMkE,OAAO7D,KAAK,EAAEjB,aAAamC;gBACxD/B,KAAKF,SAASK,OAAOC,QAAQ,CAACC,IAAI;YACpC;QACF,EAAE,eAAM;QACN,uCAAuC;QACzC;IACF;IAEA,sEAAsE;IACtE,uEAAuE;IACvEF,OAAO8D,gBAAgB,CAAC,YAAYtB;IACpCgC,SAASV,gBAAgB,CAAC,oBAAoB;QAC5C,IAAIU,SAASC,eAAe,KAAK,UAAUjC;IAC7C;AACF"}