npm - @bugspotter/sdk - Versions diffs - 0.3.1 → 1.1.0 - Mend

@bugspotter/sdk 0.3.1 → 1.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (33) hide show

package/.husky/pre-commit +1 -0
package/CHANGELOG.md +15 -0
package/CONTRIBUTING.md +200 -0
package/README.md +18 -16
package/SECURITY.md +65 -0
package/dist/bugspotter.min.js +2 -1
package/dist/bugspotter.min.js.map +1 -0
package/dist/capture/console.js +2 -2
package/dist/capture/network.js +2 -2
package/dist/core/offline-queue.d.ts +13 -0
package/dist/core/offline-queue.js +49 -4
package/dist/core/transport.js +20 -8
package/dist/index.d.ts +1 -0
package/dist/index.esm.js +1460 -1178
package/dist/index.esm.js.map +1 -1
package/dist/index.js +2 -0
package/dist/utils/config-validator.js +6 -0
package/dist/utils/sanitize-patterns.d.ts +3 -76
package/dist/utils/sanitize-patterns.js +18 -216
package/dist/utils/url-helpers.d.ts +2 -25
package/dist/utils/url-helpers.js +10 -61
package/dist/version.d.ts +1 -1
package/dist/version.js +1 -1
package/dist/widget/button.d.ts +10 -0
package/dist/widget/button.js +200 -3
package/docs/CDN.md +5 -5
package/eslint.config.js +10 -0
package/package.json +15 -4
package/release_notes.md +4 -0
package/rollup.config.js +1 -1
package/tsconfig.cjs.json +1 -1
package/dist/core/circular-buffer.d.ts +0 -42
package/dist/core/circular-buffer.js +0 -80

package/dist/index.esm.js CHANGED Viewed

@@ -1,3 +1,47 @@
+/******************************************************************************
+Copyright (c) Microsoft Corporation.
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+***************************************************************************** */
+/* global Reflect, Promise, SuppressedError, Symbol, Iterator */
+function __rest$1(s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+}
+function __awaiter$1(thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+}
+typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+};
 // Professional bug report icon SVG
 const DEFAULT_SVG_ICON = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
 <path d="M8 2v4"/>
@@ -34,6 +78,104 @@ const BUTTON_STYLES = {
         active: 'scale(0.95)',
     },
 };
+// SVG sanitization whitelists (module-level for performance)
+const SAFE_SVG_TAGS = new Set([
+    'svg',
+    'g',
+    'path',
+    'circle',
+    'rect',
+    'line',
+    'polyline',
+    'polygon',
+    'ellipse',
+    'text',
+    'tspan',
+    // SECURITY: 'use' deliberately excluded - requires href/xlink:href attributes which pose XSS risks
+    // and are not in the attribute whitelist, making <use> non-functional anyway
+    'symbol',
+    'defs',
+    'marker',
+    'lineargradient', // lowercase to match tagName.toLowerCase() in sanitizeSVGElement (parser preserves camelCase)
+    'radialgradient', // lowercase to match tagName.toLowerCase() in sanitizeSVGElement (parser preserves camelCase)
+    'stop',
+    'clippath', // lowercase to match tagName.toLowerCase() in sanitizeSVGElement (parser preserves camelCase)
+    'mask',
+    // SECURITY: 'image' deliberately excluded - requires href/xlink:href attributes which pose XSS risks
+    // and are not in the attribute whitelist, making <image> non-functional anyway
+    // SECURITY: foreignObject deliberately excluded - allows embedding arbitrary HTML/XML
+    // and can bypass SVG sanitization (e.g., <foreignObject><body><script>...</script></body></foreignObject>)
+]);
+const SAFE_SVG_ATTRIBUTES = new Set([
+    'id',
+    'class',
+    // SECURITY: 'style' deliberately excluded - can enable CSS-based attacks:
+    // - expression() in older browsers
+    // - url() with javascript:/data: URIs
+    // - @import with malicious stylesheets
+    // - CSS data exfiltration
+    // Use specific styling attributes (fill, stroke, opacity, etc.) instead
+    'd',
+    'cx',
+    'cy',
+    'r',
+    'rx',
+    'ry',
+    'x',
+    'y',
+    'x1',
+    'y1',
+    'x2',
+    'y2',
+    'width',
+    'height',
+    'viewbox', // lowercase to match attrName.toLowerCase() in sanitizeSVGElement (parser preserves camelCase)
+    'xmlns',
+    'fill',
+    'stroke',
+    'stroke-width',
+    'stroke-linecap',
+    'stroke-linejoin',
+    'opacity',
+    'fill-opacity',
+    'stroke-opacity',
+    'transform',
+    'points',
+    'text-anchor',
+    'font-size',
+    'font-family',
+    'font-weight',
+    'offset',
+    'stop-color',
+    'stop-opacity',
+    'clip-path',
+    'mask', // Used to reference mask definitions: mask="url(#maskId)"
+]);
+/**
+ * Check if an attribute value contains dangerous patterns
+ * Uses simple string matching instead of regex for better performance and clarity
+ */
+const isDangerousAttributeValue = (value) => {
+    const lowerValue = value.toLowerCase();
+    // Dangerous protocol checks
+    if (lowerValue.includes('javascript:'))
+        return true;
+    if (lowerValue.includes('vbscript:'))
+        return true;
+    // SECURITY: Block ALL data: URIs by default
+    // data:text/html, data:application/javascript, data:image/svg+xml can all execute scripts
+    // Even data:text/javascript or data URIs with embedded scripts are dangerous
+    if (lowerValue.includes('data:'))
+        return true;
+    // CSS-based attack patterns
+    if (lowerValue.includes('expression('))
+        return true; // IE CSS expressions
+    if (lowerValue.includes('@import'))
+        return true; // CSS imports
+    if (lowerValue.includes('-moz-binding'))
+        return true; // Firefox XBL binding
+    return false;
+};
 class FloatingButton {
     constructor(options = {}) {
         var _a, _b, _c, _d, _e, _f, _g, _h;
@@ -77,10 +219,12 @@ class FloatingButton {
         const btn = document.createElement('button');
         // Set button content (SVG or text)
         if (this.options.customSvg) {
-            btn.innerHTML = this.options.customSvg;
+            // Safely inject custom SVG by parsing and validating it
+            this.setSafeHTMLContent(btn, this.options.customSvg);
         }
         else if (this.options.icon === 'svg') {
-            btn.innerHTML = DEFAULT_SVG_ICON;
+            // Safely inject default SVG
+            this.setSafeHTMLContent(btn, DEFAULT_SVG_ICON);
         }
         else {
             btn.textContent = this.options.icon;
@@ -92,6 +236,103 @@ class FloatingButton {
         this.addHoverEffects(btn);
         return btn;
     }
+    /**
+     * Safely inject HTML content by parsing and validating SVG elements
+     * Prevents XSS attacks by only allowing safe SVG elements and attributes
+     */
+    setSafeHTMLContent(element, htmlContent) {
+        try {
+            if (typeof window === 'undefined' ||
+                typeof window.DOMParser === 'undefined') {
+                element.textContent = htmlContent;
+                return;
+            }
+            // SECURITY: Use DOMParser with image/svg+xml MIME type for strict SVG parsing
+            // This prevents HTML-specific parsing quirks from being exploited
+            const parser = new window.DOMParser();
+            const doc = parser.parseFromString(htmlContent, 'image/svg+xml');
+            // Check for parse errors
+            const parserError = doc.querySelector('parsererror');
+            if (parserError) {
+                element.textContent = htmlContent;
+                return;
+            }
+            if (doc.documentElement &&
+                doc.documentElement.nodeType === Node.ELEMENT_NODE) {
+                const rootElement = doc.documentElement;
+                // SECURITY: Root element MUST be SVG - prevents wrapper element injection
+                // Reject structures like <div><svg>...</svg></div>
+                if (rootElement.tagName.toLowerCase() === 'svg') {
+                    // SECURITY: Only proceed if there's exactly one root element
+                    // This prevents attacks like: <svg></svg><script>alert('XSS')</script>
+                    if (doc.children.length === 1) {
+                        // Remove potentially dangerous attributes and event handlers
+                        this.sanitizeSVGElement(rootElement);
+                        // Clear the target element and append only the validated SVG element
+                        element.innerHTML = '';
+                        element.appendChild(rootElement);
+                        return;
+                    }
+                }
+            }
+            // If not valid SVG, fall back to text content to prevent XSS
+            element.textContent = htmlContent;
+        }
+        catch (error) {
+            // On any error, use text content for safety
+            // eslint-disable-next-line no-console
+            console.warn('[BugSpotter] Failed to inject custom SVG content:', error);
+            element.textContent = htmlContent;
+        }
+    }
+    /**
+     * Recursively sanitize SVG elements by removing dangerous tags and attributes
+     * Uses whitelists to ensure only safe SVG content is preserved
+     */
+    sanitizeSVGElement(element) {
+        // Process all elements in the tree
+        const elementsToProcess = [element];
+        const processedElements = new WeakSet();
+        while (elementsToProcess.length > 0) {
+            const current = elementsToProcess.pop();
+            if (!current || processedElements.has(current))
+                continue;
+            processedElements.add(current);
+            // SECURITY: First, sanitize the current element's attributes (including root)
+            // This prevents attacks like <svg onload="alert('XSS')">
+            Array.from(current.attributes || []).forEach((attr) => {
+                const attrName = attr.name.toLowerCase();
+                // SECURITY: Explicitly reject all event handler attributes (on*)
+                // This provides defense-in-depth and prevents accidental whitelisting
+                if (attrName.startsWith('on')) {
+                    current.removeAttribute(attr.name);
+                    return;
+                }
+                // Only keep whitelisted attributes
+                if (!SAFE_SVG_ATTRIBUTES.has(attrName)) {
+                    current.removeAttribute(attr.name);
+                    return;
+                }
+                // Check attribute values for dangerous patterns
+                if (isDangerousAttributeValue(attr.value)) {
+                    current.removeAttribute(attr.name);
+                    return;
+                }
+            });
+            // Then, process children elements
+            const children = Array.from(current.children || []);
+            children.forEach((child) => {
+                const tagName = child.tagName.toLowerCase();
+                // SECURITY: Remove tags not in whitelist (blocks <script>, <style>, <iframe>, etc.)
+                if (!SAFE_SVG_TAGS.has(tagName)) {
+                    child.remove();
+                    return;
+                }
+                // Add to processing queue for recursive sanitization
+                elementsToProcess.push(child);
+            });
+        }
+    }
     getButtonStyles() {
         const { position, size, offset, backgroundColor, zIndex } = this.options;
         const positionStyles = this.getPositionStyles(position, offset);
@@ -156,7 +397,7 @@ class FloatingButton {
     setIcon(icon) {
         this.options.icon = icon;
         if (icon === 'svg') {
-            this.button.innerHTML = DEFAULT_SVG_ICON;
+            this.setSafeHTMLContent(this.button, DEFAULT_SVG_ICON);
         }
         else {
             this.button.textContent = icon;
@@ -1510,158 +1751,168 @@ class ScreenshotProcessor {
     /**
      * Merge redaction canvas with original screenshot
      */
-    async mergeRedactions(originalDataUrl, redactionCanvas) {
-        return new Promise((resolve, reject) => {
-            const img = new Image();
-            img.onload = () => {
-                try {
-                    const mergedCanvas = document.createElement('canvas');
-                    mergedCanvas.width = img.naturalWidth || img.width;
-                    mergedCanvas.height = img.naturalHeight || img.height;
-                    const ctx = mergedCanvas.getContext('2d');
-                    if (!ctx) {
-                        reject(new Error('Failed to get canvas context'));
-                        return;
+    mergeRedactions(originalDataUrl, redactionCanvas) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            return new Promise((resolve, reject) => {
+                const img = new Image();
+                img.onload = () => {
+                    try {
+                        const mergedCanvas = document.createElement('canvas');
+                        mergedCanvas.width = img.naturalWidth || img.width;
+                        mergedCanvas.height = img.naturalHeight || img.height;
+                        const ctx = mergedCanvas.getContext('2d');
+                        if (!ctx) {
+                            reject(new Error('Failed to get canvas context'));
+                            return;
+                        }
+                        // Draw original image
+                        ctx.drawImage(img, 0, 0);
+                        // Draw redaction canvas on top
+                        ctx.drawImage(redactionCanvas, 0, 0);
+                        resolve(mergedCanvas.toDataURL());
                     }
-                    // Draw original image
-                    ctx.drawImage(img, 0, 0);
-                    // Draw redaction canvas on top
-                    ctx.drawImage(redactionCanvas, 0, 0);
-                    resolve(mergedCanvas.toDataURL());
-                }
-                catch (error) {
-                    reject(error);
-                }
-            };
-            img.onerror = () => {
-                reject(new Error('Failed to load screenshot image'));
-            };
-            img.src = originalDataUrl;
+                    catch (error) {
+                        reject(error);
+                    }
+                };
+                img.onerror = () => {
+                    reject(new Error('Failed to load screenshot image'));
+                };
+                img.src = originalDataUrl;
+            });
         });
     }
     /**
      * Apply redaction rectangles directly to an image data URL
      */
-    async applyRedactions(imageDataUrl, redactions, redactionColor = '#000000') {
-        return new Promise((resolve, reject) => {
-            const img = new Image();
-            img.onload = () => {
-                try {
-                    const canvas = document.createElement('canvas');
-                    canvas.width = img.naturalWidth || img.width;
-                    canvas.height = img.naturalHeight || img.height;
-                    const ctx = canvas.getContext('2d');
-                    if (!ctx) {
-                        reject(new Error('Failed to get canvas context'));
-                        return;
+    applyRedactions(imageDataUrl_1, redactions_1) {
+        return __awaiter$1(this, arguments, void 0, function* (imageDataUrl, redactions, redactionColor = '#000000') {
+            return new Promise((resolve, reject) => {
+                const img = new Image();
+                img.onload = () => {
+                    try {
+                        const canvas = document.createElement('canvas');
+                        canvas.width = img.naturalWidth || img.width;
+                        canvas.height = img.naturalHeight || img.height;
+                        const ctx = canvas.getContext('2d');
+                        if (!ctx) {
+                            reject(new Error('Failed to get canvas context'));
+                            return;
+                        }
+                        // Draw original image
+                        ctx.drawImage(img, 0, 0);
+                        // Apply redactions
+                        ctx.fillStyle = redactionColor;
+                        for (const rect of redactions) {
+                            ctx.fillRect(rect.x, rect.y, rect.width, rect.height);
+                        }
+                        resolve(canvas.toDataURL());
                     }
-                    // Draw original image
-                    ctx.drawImage(img, 0, 0);
-                    // Apply redactions
-                    ctx.fillStyle = redactionColor;
-                    for (const rect of redactions) {
-                        ctx.fillRect(rect.x, rect.y, rect.width, rect.height);
+                    catch (error) {
+                        reject(error);
                     }
-                    resolve(canvas.toDataURL());
-                }
-                catch (error) {
-                    reject(error);
-                }
-            };
-            img.onerror = () => {
-                reject(new Error('Failed to load image'));
-            };
-            img.src = imageDataUrl;
+                };
+                img.onerror = () => {
+                    reject(new Error('Failed to load image'));
+                };
+                img.src = imageDataUrl;
+            });
         });
     }
     /**
      * Resize an image to maximum dimensions while maintaining aspect ratio
      */
-    async resize(imageDataUrl, maxWidth, maxHeight) {
-        return new Promise((resolve, reject) => {
-            const img = new Image();
-            img.onload = () => {
-                try {
-                    let width = img.naturalWidth || img.width;
-                    let height = img.naturalHeight || img.height;
-                    // Calculate new dimensions maintaining aspect ratio
-                    if (width > maxWidth || height > maxHeight) {
-                        const aspectRatio = width / height;
-                        if (width > height) {
-                            width = maxWidth;
-                            height = width / aspectRatio;
+    resize(imageDataUrl, maxWidth, maxHeight) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            return new Promise((resolve, reject) => {
+                const img = new Image();
+                img.onload = () => {
+                    try {
+                        let width = img.naturalWidth || img.width;
+                        let height = img.naturalHeight || img.height;
+                        // Calculate new dimensions maintaining aspect ratio
+                        if (width > maxWidth || height > maxHeight) {
+                            const aspectRatio = width / height;
+                            if (width > height) {
+                                width = maxWidth;
+                                height = width / aspectRatio;
+                            }
+                            else {
+                                height = maxHeight;
+                                width = height * aspectRatio;
+                            }
                         }
-                        else {
-                            height = maxHeight;
-                            width = height * aspectRatio;
+                        const canvas = document.createElement('canvas');
+                        canvas.width = width;
+                        canvas.height = height;
+                        const ctx = canvas.getContext('2d');
+                        if (!ctx) {
+                            reject(new Error('Failed to get canvas context'));
+                            return;
                         }
+                        ctx.drawImage(img, 0, 0, width, height);
+                        resolve(canvas.toDataURL());
                     }
-                    const canvas = document.createElement('canvas');
-                    canvas.width = width;
-                    canvas.height = height;
-                    const ctx = canvas.getContext('2d');
-                    if (!ctx) {
-                        reject(new Error('Failed to get canvas context'));
-                        return;
+                    catch (error) {
+                        reject(error);
                     }
-                    ctx.drawImage(img, 0, 0, width, height);
-                    resolve(canvas.toDataURL());
-                }
-                catch (error) {
-                    reject(error);
-                }
-            };
-            img.onerror = () => {
-                reject(new Error('Failed to load image'));
-            };
-            img.src = imageDataUrl;
+                };
+                img.onerror = () => {
+                    reject(new Error('Failed to load image'));
+                };
+                img.src = imageDataUrl;
+            });
         });
     }
     /**
      * Convert image to different format
      */
-    async convert(imageDataUrl, format, quality = 0.92) {
-        return new Promise((resolve, reject) => {
-            const img = new Image();
-            img.onload = () => {
-                try {
-                    const canvas = document.createElement('canvas');
-                    canvas.width = img.naturalWidth || img.width;
-                    canvas.height = img.naturalHeight || img.height;
-                    const ctx = canvas.getContext('2d');
-                    if (!ctx) {
-                        reject(new Error('Failed to get canvas context'));
-                        return;
+    convert(imageDataUrl_1, format_1) {
+        return __awaiter$1(this, arguments, void 0, function* (imageDataUrl, format, quality = 0.92) {
+            return new Promise((resolve, reject) => {
+                const img = new Image();
+                img.onload = () => {
+                    try {
+                        const canvas = document.createElement('canvas');
+                        canvas.width = img.naturalWidth || img.width;
+                        canvas.height = img.naturalHeight || img.height;
+                        const ctx = canvas.getContext('2d');
+                        if (!ctx) {
+                            reject(new Error('Failed to get canvas context'));
+                            return;
+                        }
+                        ctx.drawImage(img, 0, 0);
+                        resolve(canvas.toDataURL(format, quality));
                     }
-                    ctx.drawImage(img, 0, 0);
-                    resolve(canvas.toDataURL(format, quality));
-                }
-                catch (error) {
-                    reject(error);
-                }
-            };
-            img.onerror = () => {
-                reject(new Error('Failed to load image'));
-            };
-            img.src = imageDataUrl;
+                    catch (error) {
+                        reject(error);
+                    }
+                };
+                img.onerror = () => {
+                    reject(new Error('Failed to load image'));
+                };
+                img.src = imageDataUrl;
+            });
         });
     }
     /**
      * Get image dimensions from data URL
      */
-    async getDimensions(imageDataUrl) {
-        return new Promise((resolve, reject) => {
-            const img = new Image();
-            img.onload = () => {
-                resolve({
-                    width: img.naturalWidth || img.width,
-                    height: img.naturalHeight || img.height,
-                });
-            };
-            img.onerror = () => {
-                reject(new Error('Failed to load image'));
-            };
-            img.src = imageDataUrl;
+    getDimensions(imageDataUrl) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            return new Promise((resolve, reject) => {
+                const img = new Image();
+                img.onload = () => {
+                    resolve({
+                        width: img.naturalWidth || img.width,
+                        height: img.naturalHeight || img.height,
+                    });
+                };
+                img.onerror = () => {
+                    reject(new Error('Failed to load image'));
+                };
+                img.src = imageDataUrl;
+            });
         });
     }
     /**
@@ -1689,106 +1940,124 @@ class ScreenshotProcessor {
 }
 /**
- * PII Pattern Definitions
- * Configurable regex patterns for detecting sensitive data (PII + credentials)
+ * Generic circular buffer — fixed-size FIFO that overwrites oldest items.
+ *
+ * @template T The type of items stored in the buffer
  */
+let CircularBuffer$1 = class CircularBuffer {
+    constructor(maxSize) {
+        this.maxSize = maxSize;
+        this.items = [];
+        this.index = 0;
+        this.count = 0;
+        if (maxSize <= 0) {
+            throw new Error('CircularBuffer maxSize must be greater than 0');
+        }
+    }
+    /**
+     * Add an item to the buffer. If full, the oldest item is overwritten.
+     */
+    add(item) {
+        if (this.count < this.maxSize) {
+            this.items.push(item);
+            this.count++;
+        }
+        else {
+            this.items[this.index] = item;
+        }
+        this.index = (this.index + 1) % this.maxSize;
+    }
+    /**
+     * Get all items in chronological order (oldest to newest).
+     * Returns a copy of the internal array.
+     */
+    getAll() {
+        if (this.count < this.maxSize) {
+            return [...this.items];
+        }
+        return [
+            ...this.items.slice(this.index),
+            ...this.items.slice(0, this.index),
+        ];
+    }
+    /**
+     * Clear all items from the buffer.
+     */
+    clear() {
+        this.items = [];
+        this.index = 0;
+        this.count = 0;
+    }
+    get size() {
+        return this.count;
+    }
+    get capacity() {
+        return this.maxSize;
+    }
+    get isEmpty() {
+        return this.count === 0;
+    }
+    get isFull() {
+        return this.count >= this.maxSize;
+    }
+};
 /**
- * Default built-in patterns
+ * PII pattern definitions for data sanitization.
  */
 const DEFAULT_PATTERNS = {
     email: {
         name: 'email',
         regex: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/g,
         description: 'Email addresses',
-        examples: [
-            'user@example.com',
-            'john.doe+tag@company.co.uk',
-            'test_user@sub.domain.com',
-        ],
-        priority: 1, // Highest priority - most specific
+        priority: 1,
     },
     creditcard: {
         name: 'creditcard',
         regex: /\b(?:\d{4}[-\s]){3}\d{4}\b|\b\d{4}[-\s]\d{6}[-\s]\d{5}\b|\b\d{13,19}\b/g,
-        description: 'Credit card numbers (Visa, MC, Amex, Discover, etc.)',
-        examples: [
-            '4532-1488-0343-6467',
-            '4532148803436467',
-            '5425 2334 3010 9903',
-            '3782 822463 10005',
-        ],
+        description: 'Credit card numbers',
         priority: 2,
     },
     ssn: {
         name: 'ssn',
         regex: /\b\d{3}-\d{2}-\d{4}\b|\b(?<!\d)\d{9}(?!\d)\b/g,
         description: 'US Social Security Numbers',
-        examples: ['123-45-6789', '987654321'],
         priority: 3,
     },
     iin: {
         name: 'iin',
         regex: /\b[0-9]{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12][0-9]|3[01])\d{6}\b/g,
-        description: 'Kazakhstan IIN/BIN (12 digits with date validation)',
-        examples: ['950315300123', '880612500456', '021225123456'],
+        description: 'Kazakhstan IIN/BIN',
         priority: 4,
     },
     ip: {
         name: 'ip',
         regex: /\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b|(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\b/g,
         description: 'IPv4 and IPv6 addresses',
-        examples: [
-            '192.168.1.100',
-            '127.0.0.1',
-            '2001:0db8:85a3:0000:0000:8a2e:0370:7334',
-        ],
         priority: 5,
     },
     phone: {
         name: 'phone',
         regex: /\+\d{1,3}[-.\s]\d{3}[-.\s]\d{4}\b|\+\d{1,3}[-.\s]\d{3}[-.\s]\d{3}[-.\s]\d{4}\b|\(\d{3}\)\s*\d{3}[-.\s]\d{4}\b|\b\d{3}[-.\s]\d{3}[-.\s]\d{4}\b/g,
-        description: 'International phone numbers',
-        examples: [
-            '+1-555-1234',
-            '+1-555-123-4567',
-            '(555) 123-4567',
-            '555-123-4567',
-            '+7 777 123 4567',
-        ],
+        description: 'Phone numbers',
         priority: 6,
     },
     apikey: {
         name: 'apikey',
         regex: /\b(?:sk|pk)_(?:live|test)_[a-zA-Z0-9]{24,}\b|AIza[a-zA-Z0-9_-]{35}|ya29\.[a-zA-Z0-9_-]+|AKIA[a-zA-Z0-9]{16}\b/g,
-        description: 'API keys (Stripe, Google, AWS, etc.)',
-        examples: [
-            'sk_live_abc123def456ghi789jkl',
-            'pk_test_xyz789abc123def456',
-            'AIzaSyD1234567890abcdefghijklmnopqrst',
-            'AKIAIOSFODNN7EXAMPLE',
-        ],
+        description: 'API keys (Stripe, Google, AWS)',
         priority: 7,
     },
     token: {
         name: 'token',
         regex: /\b(?:Bearer\s+)?[a-zA-Z0-9_-]{32,}\b|ghp_[a-zA-Z0-9]{36}|gho_[a-zA-Z0-9]{36}|github_pat_[a-zA-Z0-9_]{82}/g,
-        description: 'Authentication tokens (Bearer, GitHub, JWT-like)',
-        examples: [
-            'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9',
-            'ghp_abc123def456ghi789jkl012mno345pqr',
-            'gho_xyz789abc123def456ghi789jkl012mno',
-        ],
+        description: 'Auth tokens (Bearer, GitHub, JWT-like)',
         priority: 8,
     },
     password: {
         name: 'password',
         regex: /(?:password|passwd|pwd)[\s:=]+[^\s]{6,}|(?:password|passwd|pwd)["']?\s*[:=]\s*["']?[^\s"']{6,}/gi,
-        description: 'Password fields in text (password=..., pwd:...)',
-        examples: [
-            'password: MySecret123!',
-            'passwd=SecurePass456',
-            'pwd: "MyP@ssw0rd"',
-        ],
+        description: 'Password fields in text',
         priority: 9,
     },
 };
@@ -1804,32 +2073,160 @@ const PATTERN_CATEGORIES = {
     kazakhstan: ['iin'],
 };
 /**
- * Get patterns sorted by priority
+ * Pre-configured pattern sets for common compliance/use cases
  */
+const PATTERN_PRESETS = {
+    all: Object.keys(DEFAULT_PATTERNS),
+    minimal: ['email', 'creditcard', 'ssn'],
+    financial: ['creditcard', 'ssn'],
+    contact: ['email', 'phone'],
+    identification: ['ssn', 'iin'],
+    credentials: ['apikey', 'token', 'password'],
+    kazakhstan: ['email', 'phone', 'iin'],
+    gdpr: ['email', 'phone', 'ip'],
+    pci: ['creditcard'],
+    security: [
+        'email',
+        'phone',
+        'creditcard',
+        'ssn',
+        'apikey',
+        'token',
+        'password',
+    ],
+};
 function getPatternsByPriority(patterns) {
-    return [...patterns].sort((a, b) => {
-        return a.priority - b.priority;
-    });
+    return [...patterns].sort((a, b) => a.priority - b.priority);
+}
+function createPatternConfig(preset) {
+    const names = typeof preset === 'string' ? PATTERN_PRESETS[preset] : preset;
+    return names.map((name) => DEFAULT_PATTERNS[name]);
 }
 /**
- * Get pattern by name
+ * Validate a custom pattern regex for performance issues
  */
-function getPattern(name) {
-    return DEFAULT_PATTERNS[name];
+function validatePattern(pattern) {
+    const errors = [];
+    if (!pattern.name)
+        errors.push('Pattern must have a name');
+    if (!pattern.regex) {
+        errors.push('Pattern must have a regex');
+    }
+    else {
+        if (!pattern.regex.global)
+            errors.push('Pattern regex must have global flag');
+        try {
+            const testString = 'a'.repeat(1000);
+            const start = Date.now();
+            testString.match(pattern.regex);
+            if (Date.now() - start > 100) {
+                errors.push('Pattern regex may cause performance issues');
+            }
+        }
+        catch (e) {
+            errors.push(`Pattern regex error: ${e.message}`);
+        }
+    }
+    return { valid: errors.length === 0, errors };
 }
 /**
- * Get patterns by category
+ * URL helper utilities for endpoint validation and parsing.
  */
-function getPatternsByCategory(category) {
-    return PATTERN_CATEGORIES[category].map((name) => {
-        return DEFAULT_PATTERNS[name];
-    });
+/**
+ * Custom error for invalid endpoint URLs
+ */
+class InvalidEndpointError extends Error {
+    constructor(endpoint, reason) {
+        super(`Invalid endpoint URL: ${endpoint}. ${reason}`);
+        this.endpoint = endpoint;
+        this.reason = reason;
+        this.name = 'InvalidEndpointError';
+    }
+}
+/**
+ * Custom error for insecure endpoints
+ */
+class InsecureEndpointError extends Error {
+    constructor(endpoint) {
+        super(`Secure HTTPS connection required. Attempted to connect to insecure endpoint: "${endpoint}"`);
+        this.endpoint = endpoint;
+        this.name = 'InsecureEndpointError';
+    }
+}
+/**
+ * Strip known endpoint suffixes from path.
+ * Removes /api/v1/reports path.
+ */
+function stripEndpointSuffix(path) {
+    const reportsIndex = path.lastIndexOf('/api/v1/reports');
+    if (reportsIndex !== -1) {
+        return path.substring(0, reportsIndex);
+    }
+    return path.replace(/\/$/, '') || '';
+}
+/**
+ * Extract base API URL from endpoint.
+ * Returns scheme + host + base path (without /api/v1/reports suffix).
+ *
+ * @example
+ * getApiBaseUrl('https://api.example.com/api/v1/reports')
+ * // Returns: 'https://api.example.com'
+ *
+ * @throws InvalidEndpointError if endpoint is not a valid absolute URL
+ */
+function getApiBaseUrl(endpoint) {
+    if (!endpoint) {
+        throw new InvalidEndpointError('', 'No endpoint configured');
+    }
+    try {
+        const url = new URL(endpoint);
+        const basePath = stripEndpointSuffix(url.pathname);
+        return url.origin + basePath;
+    }
+    catch {
+        throw new InvalidEndpointError(endpoint, 'Must be a valid absolute URL (e.g., https://api.example.com/api/v1/reports)');
+    }
+}
+/**
+ * Checks if the endpoint uses a secure protocol.
+ * Uses the URL API for robust parsing.
+ *
+ * Allows HTTPS in production, HTTP only on localhost/127.0.0.1 for development.
+ */
+function isSecureEndpoint(endpoint) {
+    if (!endpoint)
+        return false;
+    try {
+        const url = new URL(endpoint.trim());
+        return (url.protocol === 'https:' ||
+            (url.protocol === 'http:' &&
+                (url.hostname === 'localhost' || url.hostname === '127.0.0.1')));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * PII Pattern Definitions
+ * Re-exports from @bugspotter/common + SDK-specific extensions
+ */
+// Re-export everything from @bugspotter/common
+// SDK-specific extensions
+/**
+ * Get pattern by name
+ */
+function getPattern(name) {
+    return DEFAULT_PATTERNS[name];
 }
 /**
- * Get all pattern names
+ * Get patterns by category
  */
-function getAllPatternNames() {
-    return Object.keys(DEFAULT_PATTERNS);
+function getPatternsByCategory(category) {
+    return PATTERN_CATEGORIES[category].map((name) => {
+        return DEFAULT_PATTERNS[name];
+    });
 }
 /**
  * Custom pattern builder for advanced use cases
@@ -1843,7 +2240,6 @@ class PatternBuilder {
         return this;
     }
     regex(regex) {
-        // Ensure global flag
         if (!regex.global) {
             const flags = regex.flags.includes('g') ? regex.flags : regex.flags + 'g';
             this.pattern.regex = new RegExp(regex.source, flags);
@@ -1879,85 +2275,6 @@ class PatternBuilder {
         };
     }
 }
-/**
- * Pre-configured pattern sets for common use cases
- */
-const PATTERN_PRESETS = {
-    /** All patterns enabled (PII + credentials) - default */
-    all: getAllPatternNames(),
-    /** Minimal - only most critical PII */
-    minimal: ['email', 'creditcard', 'ssn'],
-    /** Financial data only */
-    financial: PATTERN_CATEGORIES.financial,
-    /** Contact information only */
-    contact: PATTERN_CATEGORIES.contact,
-    /** Identification numbers only */
-    identification: PATTERN_CATEGORIES.identification,
-    /** Credentials and secrets only */
-    credentials: PATTERN_CATEGORIES.credentials,
-    /** Kazakhstan-specific patterns */
-    kazakhstan: ['email', 'phone', 'iin'],
-    /** GDPR compliance recommended set */
-    gdpr: ['email', 'phone', 'ip'],
-    /** PCI DSS compliance required */
-    pci: ['creditcard'],
-    /** Security-focused: PII + credentials */
-    security: [
-        'email',
-        'phone',
-        'creditcard',
-        'ssn',
-        'apikey',
-        'token',
-        'password',
-    ],
-};
-/**
- * Create custom pattern configuration
- */
-function createPatternConfig(preset) {
-    const names = typeof preset === 'string' ? PATTERN_PRESETS[preset] : preset;
-    return names.map((name) => {
-        return DEFAULT_PATTERNS[name];
-    });
-}
-/**
- * Validate pattern regex
- */
-function validatePattern(pattern) {
-    const errors = [];
-    if (!pattern.name) {
-        errors.push('Pattern must have a name');
-    }
-    if (!pattern.regex) {
-        errors.push('Pattern must have a regex');
-    }
-    else {
-        if (!pattern.regex.global) {
-            errors.push('Pattern regex must have global flag');
-        }
-        // Test regex doesn't cause catastrophic backtracking
-        try {
-            const testString = 'a'.repeat(1000);
-            const start = Date.now();
-            testString.match(pattern.regex);
-            const duration = Date.now() - start;
-            if (duration > 100) {
-                errors.push(`Pattern regex may cause performance issues (took ${duration}ms on test)`);
-            }
-        }
-        catch (error) {
-            errors.push(`Pattern regex error: ${error.message}`);
-        }
-    }
-    if (pattern.priority < 0) {
-        errors.push('Pattern priority must be non-negative');
-    }
-    return {
-        valid: errors.length === 0,
-        errors,
-    };
-}
 /**
  * PII Detection and Sanitization Utility - REFACTORED
@@ -2279,7 +2596,7 @@ function createLogger(config) {
     return new BugSpotterLogger(config);
 }
-const logger$8 = getLogger();
+const logger$7 = getLogger();
 /**
  * BugReportModal
  *
@@ -2494,99 +2811,101 @@ class BugReportModal {
             this.redactionCanvas.clearRedactions();
         }
     }
-    async handleSubmit(e) {
-        var _a;
-        e.preventDefault();
-        const elements = this.domCache.get();
-        // Prevent double submission
-        if (elements.submitButton.disabled) {
-            return;
-        }
-        const formData = {
-            title: elements.titleInput.value,
-            description: elements.descriptionTextarea.value,
-            piiDetected: this.piiDetections.length > 0,
-            piiConfirmed: elements.piiConfirmCheckbox.checked,
-        };
-        const validation = this.validator.validate(formData);
-        if (!validation.isValid) {
-            // Display errors
-            if (validation.errors.title) {
-                elements.titleError.textContent = validation.errors.title;
-                elements.titleError.style.display = 'block';
-            }
-            else {
-                elements.titleError.textContent = '';
-                elements.titleError.style.display = 'none';
-            }
-            if (validation.errors.description) {
-                elements.descriptionError.textContent = validation.errors.description;
-                elements.descriptionError.style.display = 'block';
-            }
-            else {
-                elements.descriptionError.textContent = '';
-                elements.descriptionError.style.display = 'none';
+    handleSubmit(e) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            var _a;
+            e.preventDefault();
+            const elements = this.domCache.get();
+            // Prevent double submission
+            if (elements.submitButton.disabled) {
+                return;
             }
-            if (validation.errors.piiConfirmation) {
-                alert(validation.errors.piiConfirmation);
+            const formData = {
+                title: elements.titleInput.value,
+                description: elements.descriptionTextarea.value,
+                piiDetected: this.piiDetections.length > 0,
+                piiConfirmed: elements.piiConfirmCheckbox.checked,
+            };
+            const validation = this.validator.validate(formData);
+            if (!validation.isValid) {
+                // Display errors
+                if (validation.errors.title) {
+                    elements.titleError.textContent = validation.errors.title;
+                    elements.titleError.style.display = 'block';
+                }
+                else {
+                    elements.titleError.textContent = '';
+                    elements.titleError.style.display = 'none';
+                }
+                if (validation.errors.description) {
+                    elements.descriptionError.textContent = validation.errors.description;
+                    elements.descriptionError.style.display = 'block';
+                }
+                else {
+                    elements.descriptionError.textContent = '';
+                    elements.descriptionError.style.display = 'none';
+                }
+                if (validation.errors.piiConfirmation) {
+                    alert(validation.errors.piiConfirmation);
+                }
+                return;
             }
-            return;
-        }
-        // Clear any previous error messages on successful validation
-        elements.titleError.style.display = 'none';
-        elements.descriptionError.style.display = 'none';
-        elements.submitError.style.display = 'none';
-        // Disable submit button and show loading state
-        const originalButtonText = elements.submitButton.textContent || 'Submit Bug Report';
-        elements.submitButton.disabled = true;
-        elements.submitButton.textContent = 'Preparing...';
-        elements.submitButton.classList.add('loading');
-        // Helper to update progress
-        const updateProgress = (message) => {
-            elements.submitButton.textContent = message;
-            elements.progressStatus.textContent = message; // Announce to screen readers
-            if (this.options.onProgress) {
-                this.options.onProgress(message);
+            // Clear any previous error messages on successful validation
+            elements.titleError.style.display = 'none';
+            elements.descriptionError.style.display = 'none';
+            elements.submitError.style.display = 'none';
+            // Disable submit button and show loading state
+            const originalButtonText = elements.submitButton.textContent || 'Submit Bug Report';
+            elements.submitButton.disabled = true;
+            elements.submitButton.textContent = 'Preparing...';
+            elements.submitButton.classList.add('loading');
+            // Helper to update progress
+            const updateProgress = (message) => {
+                elements.submitButton.textContent = message;
+                elements.progressStatus.textContent = message; // Announce to screen readers
+                if (this.options.onProgress) {
+                    this.options.onProgress(message);
+                }
+            };
+            updateProgress('Preparing screenshot...');
+            // Prepare screenshot with redactions
+            let finalScreenshot = this.originalScreenshot;
+            if (this.redactionCanvas &&
+                this.redactionCanvas.getRedactions().length > 0) {
+                try {
+                    finalScreenshot = yield this.screenshotProcessor.mergeRedactions(this.originalScreenshot, this.redactionCanvas.getCanvas());
+                }
+                catch (mergeError) {
+                    logger$7.error('Failed to merge redactions:', mergeError);
+                    finalScreenshot = this.originalScreenshot;
+                }
             }
-        };
-        updateProgress('Preparing screenshot...');
-        // Prepare screenshot with redactions
-        let finalScreenshot = this.originalScreenshot;
-        if (this.redactionCanvas &&
-            this.redactionCanvas.getRedactions().length > 0) {
+            // Update original screenshot for submission
+            this.originalScreenshot = finalScreenshot;
+            // Submit
+            const bugReportData = {
+                title: formData.title.trim(),
+                description: (_a = formData.description) === null || _a === void 0 ? void 0 : _a.trim(),
+            };
             try {
-                finalScreenshot = await this.screenshotProcessor.mergeRedactions(this.originalScreenshot, this.redactionCanvas.getCanvas());
+                updateProgress('Uploading report...');
+                yield this.options.onSubmit(bugReportData);
+                this.close();
             }
-            catch (mergeError) {
-                logger$8.error('Failed to merge redactions:', mergeError);
-                finalScreenshot = this.originalScreenshot;
+            catch (error) {
+                getLogger().error('Error submitting bug report:', error);
+                // Show error message in modal instead of blocking alert
+                elements.submitError.textContent =
+                    'Failed to submit bug report. Please try again.';
+                elements.submitError.style.display = 'block';
+                // Clear stale progress status for screen readers
+                elements.progressStatus.textContent = '';
+                // Re-enable submit button on error
+                elements.submitButton.disabled = false;
+                elements.submitButton.textContent = originalButtonText;
+                elements.submitButton.classList.remove('loading');
             }
-        }
-        // Update original screenshot for submission
-        this.originalScreenshot = finalScreenshot;
-        // Submit
-        const bugReportData = {
-            title: formData.title.trim(),
-            description: (_a = formData.description) === null || _a === void 0 ? void 0 : _a.trim(),
-        };
-        try {
-            updateProgress('Uploading report...');
-            await this.options.onSubmit(bugReportData);
-            this.close();
-        }
-        catch (error) {
-            getLogger().error('Error submitting bug report:', error);
-            // Show error message in modal instead of blocking alert
-            elements.submitError.textContent =
-                'Failed to submit bug report. Please try again.';
-            elements.submitError.style.display = 'block';
-            // Clear stale progress status for screen readers
-            elements.progressStatus.textContent = '';
-            // Re-enable submit button on error
-            elements.submitButton.disabled = false;
-            elements.submitButton.textContent = originalButtonText;
-            elements.submitButton.classList.remove('loading');
-        }
+        });
     }
     /**
      * Get the final screenshot (with redactions applied)
@@ -2618,64 +2937,6 @@ const DEFAULT_REPLAY_DURATION_SECONDS = 15;
  */
 const MAX_RECOMMENDED_REPLAY_DURATION_SECONDS = 30;
-/**
- * URL Helper Utilities
- * Extract base API URL from endpoint configuration
- */
-const logger$7 = getLogger();
-/**
- * Custom error for invalid endpoint URLs
- */
-class InvalidEndpointError extends Error {
-    constructor(endpoint, reason) {
-        super(`Invalid endpoint URL: ${endpoint}. ${reason}`);
-        this.endpoint = endpoint;
-        this.reason = reason;
-        this.name = 'InvalidEndpointError';
-    }
-}
-/**
- * Strip known endpoint suffixes from path
- * Removes /api/v1/reports path
- */
-function stripEndpointSuffix(path) {
-    // Use lastIndexOf to handle paths like '/prefix/api/v1/reports'
-    const reportsIndex = path.lastIndexOf('/api/v1/reports');
-    if (reportsIndex !== -1) {
-        return path.substring(0, reportsIndex);
-    }
-    // Remove trailing slash
-    return path.replace(/\/$/, '') || '';
-}
-/**
- * Extract base API URL from endpoint
- * Returns scheme + host + base path (without /api/v1/reports suffix)
- *
- * @example
- * getApiBaseUrl('https://api.example.com/api/v1/reports')
- * // Returns: 'https://api.example.com'
- *
- * @throws InvalidEndpointError if endpoint is not a valid absolute URL
- */
-function getApiBaseUrl(endpoint) {
-    if (!endpoint) {
-        throw new InvalidEndpointError('', 'No endpoint configured');
-    }
-    try {
-        const url = new URL(endpoint);
-        const basePath = stripEndpointSuffix(url.pathname);
-        return url.origin + basePath;
-    }
-    catch (error) {
-        const errorMessage = error instanceof Error ? error.message : String(error);
-        logger$7.error('Invalid endpoint URL - must be a valid absolute URL', {
-            endpoint,
-            error: errorMessage,
-        });
-        throw new InvalidEndpointError(endpoint, 'Must be a valid absolute URL (e.g., https://api.example.com/api/v1/reports)');
-    }
-}
 /**
  * SDK version - auto-generated from package.json
  * DO NOT EDIT THIS FILE MANUALLY
@@ -2683,7 +2944,7 @@ function getApiBaseUrl(endpoint) {
  * This file is automatically generated during the build process.
  * To update the version, modify package.json
  */
-const VERSION = '0.3.1';
+const VERSION = '1.1.0';
 /**
  * Configuration Validation Utilities
@@ -2697,6 +2958,11 @@ function validateAuthConfig(context) {
     if (!context.endpoint) {
         throw new Error('No endpoint configured for bug report submission');
     }
+    // SECURITY: Ensure endpoint uses HTTPS
+    // This prevents credentials and sensitive data from being sent over plain HTTP
+    if (!isSecureEndpoint(context.endpoint)) {
+        throw new InsecureEndpointError(context.endpoint);
+    }
     if (!context.auth) {
         throw new Error('API key authentication is required');
     }
@@ -10564,21 +10830,23 @@ function dataToString(data) {
  * @param config - Optional compression configuration
  * @returns Compressed data as Uint8Array
  */
-async function compressData(data, config) {
-    var _a;
-    try {
-        const jsonString = dataToString(data);
-        const encoder = getTextEncoder();
-        const uint8Data = encoder.encode(jsonString);
-        const gzipLevel = (_a = config === null || config === void 0 ? void 0 : config.gzipLevel) !== null && _a !== void 0 ? _a : COMPRESSION_DEFAULTS.GZIP_LEVEL;
-        // pako.gzip already returns Uint8Array, no need to wrap it
-        const compressed = pako.gzip(uint8Data, { level: gzipLevel });
-        return compressed;
-    }
-    catch (error) {
-        logger$5.error('Compression failed:', error);
-        throw error;
-    }
+function compressData(data, config) {
+    return __awaiter$1(this, void 0, void 0, function* () {
+        var _a;
+        try {
+            const jsonString = dataToString(data);
+            const encoder = getTextEncoder();
+            const uint8Data = encoder.encode(jsonString);
+            const gzipLevel = (_a = config === null || config === void 0 ? void 0 : config.gzipLevel) !== null && _a !== void 0 ? _a : COMPRESSION_DEFAULTS.GZIP_LEVEL;
+            // pako.gzip already returns Uint8Array, no need to wrap it
+            const compressed = pako.gzip(uint8Data, { level: gzipLevel });
+            return compressed;
+        }
+        catch (error) {
+            logger$5.error('Compression failed:', error);
+            throw error;
+        }
+    });
 }
 /**
  * Try to parse string as JSON, return string if not valid JSON
@@ -10684,43 +10952,45 @@ function calculateResizedDimensions(width, height, maxWidth, maxHeight) {
  * @param config - Optional compression configuration
  * @returns Optimized base64 image string
  */
-async function compressImage(base64, config) {
-    var _a, _b, _c, _d;
-    try {
-        if (!isBrowserEnvironment()) {
-            return base64;
-        }
-        const maxWidth = (_a = config === null || config === void 0 ? void 0 : config.imageMaxWidth) !== null && _a !== void 0 ? _a : COMPRESSION_DEFAULTS.IMAGE_MAX_WIDTH;
-        const maxHeight = (_b = config === null || config === void 0 ? void 0 : config.imageMaxHeight) !== null && _b !== void 0 ? _b : COMPRESSION_DEFAULTS.IMAGE_MAX_HEIGHT;
-        const webpQuality = (_c = config === null || config === void 0 ? void 0 : config.webpQuality) !== null && _c !== void 0 ? _c : COMPRESSION_DEFAULTS.IMAGE_WEBP_QUALITY;
-        const jpegQuality = (_d = config === null || config === void 0 ? void 0 : config.jpegQuality) !== null && _d !== void 0 ? _d : COMPRESSION_DEFAULTS.IMAGE_JPEG_QUALITY;
-        const timeout = COMPRESSION_DEFAULTS.IMAGE_LOAD_TIMEOUT;
-        const img = await loadImage(base64, timeout);
-        const canvas = document.createElement('canvas');
-        const ctx = canvas.getContext('2d');
-        if (!ctx) {
-            throw new Error('Failed to get 2D canvas context');
-        }
-        const { width, height } = calculateResizedDimensions(img.width, img.height, maxWidth, maxHeight);
-        canvas.width = width;
-        canvas.height = height;
-        // Enable high-quality image smoothing for better resize quality
-        ctx.imageSmoothingEnabled = true;
-        ctx.imageSmoothingQuality = 'high';
-        ctx.drawImage(img, 0, 0, width, height);
-        if (supportsWebP()) {
-            return canvas.toDataURL('image/webp', webpQuality);
-        }
-        else {
-            return canvas.toDataURL('image/jpeg', jpegQuality);
+function compressImage(base64, config) {
+    return __awaiter$1(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d;
+        try {
+            if (!isBrowserEnvironment()) {
+                return base64;
+            }
+            const maxWidth = (_a = config === null || config === void 0 ? void 0 : config.imageMaxWidth) !== null && _a !== void 0 ? _a : COMPRESSION_DEFAULTS.IMAGE_MAX_WIDTH;
+            const maxHeight = (_b = config === null || config === void 0 ? void 0 : config.imageMaxHeight) !== null && _b !== void 0 ? _b : COMPRESSION_DEFAULTS.IMAGE_MAX_HEIGHT;
+            const webpQuality = (_c = config === null || config === void 0 ? void 0 : config.webpQuality) !== null && _c !== void 0 ? _c : COMPRESSION_DEFAULTS.IMAGE_WEBP_QUALITY;
+            const jpegQuality = (_d = config === null || config === void 0 ? void 0 : config.jpegQuality) !== null && _d !== void 0 ? _d : COMPRESSION_DEFAULTS.IMAGE_JPEG_QUALITY;
+            const timeout = COMPRESSION_DEFAULTS.IMAGE_LOAD_TIMEOUT;
+            const img = yield loadImage(base64, timeout);
+            const canvas = document.createElement('canvas');
+            const ctx = canvas.getContext('2d');
+            if (!ctx) {
+                throw new Error('Failed to get 2D canvas context');
+            }
+            const { width, height } = calculateResizedDimensions(img.width, img.height, maxWidth, maxHeight);
+            canvas.width = width;
+            canvas.height = height;
+            // Enable high-quality image smoothing for better resize quality
+            ctx.imageSmoothingEnabled = true;
+            ctx.imageSmoothingQuality = 'high';
+            ctx.drawImage(img, 0, 0, width, height);
+            if (supportsWebP()) {
+                return canvas.toDataURL('image/webp', webpQuality);
+            }
+            else {
+                return canvas.toDataURL('image/jpeg', jpegQuality);
+            }
         }
-    }
-    catch (error) {
-        if ((config === null || config === void 0 ? void 0 : config.verbose) !== false) {
-            getLogger().error('Image compression failed:', error);
+        catch (error) {
+            if ((config === null || config === void 0 ? void 0 : config.verbose) !== false) {
+                getLogger().error('Image compression failed:', error);
+            }
+            return base64;
         }
-        return base64;
-    }
+    });
 }
 /**
  * Calculate compression ratio for analytics
@@ -10774,100 +11044,25 @@ class ScreenshotCapture extends BaseCapture {
                 return this.shouldIncludeNode(node);
             } });
     }
-    async capture(targetElement) {
-        try {
-            const element = targetElement || this.options.targetElement || document.body;
-            const options = this.buildCaptureOptions();
-            const dataUrl = await toPng(element, options);
-            // Compress the screenshot to reduce payload size
-            // Converts to WebP if supported, resizes if too large
-            const compressed = await compressImage(dataUrl);
-            return compressed;
-        }
-        catch (error) {
-            this.handleError('capturing screenshot', error);
-            return this.getErrorPlaceholder();
-        }
+    capture(targetElement) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            try {
+                const element = targetElement || this.options.targetElement || document.body;
+                const options = this.buildCaptureOptions();
+                const dataUrl = yield toPng(element, options);
+                // Compress the screenshot to reduce payload size
+                // Converts to WebP if supported, resizes if too large
+                const compressed = yield compressImage(dataUrl);
+                return compressed;
+            }
+            catch (error) {
+                this.handleError('capturing screenshot', error);
+                return this.getErrorPlaceholder();
+            }
+        });
     }
 }
-/**
- * A generic circular buffer implementation for storing a fixed number of items.
- * When the buffer is full, new items overwrite the oldest items.
- *
- * @template T The type of items stored in the buffer
- */
-let CircularBuffer$1 = class CircularBuffer {
-    constructor(maxSize) {
-        this.maxSize = maxSize;
-        this.items = [];
-        this.index = 0;
-        this.count = 0;
-        if (maxSize <= 0) {
-            throw new Error('CircularBuffer maxSize must be greater than 0');
-        }
-    }
-    /**
-     * Add an item to the buffer. If the buffer is full, the oldest item is overwritten.
-     */
-    add(item) {
-        if (this.count < this.maxSize) {
-            this.items.push(item);
-            this.count++;
-        }
-        else {
-            this.items[this.index] = item;
-        }
-        this.index = (this.index + 1) % this.maxSize;
-    }
-    /**
-     * Get all items in chronological order (oldest to newest).
-     * Returns a copy of the internal array.
-     */
-    getAll() {
-        if (this.count < this.maxSize) {
-            return [...this.items];
-        }
-        // Return items in chronological order when buffer is full
-        return [
-            ...this.items.slice(this.index),
-            ...this.items.slice(0, this.index),
-        ];
-    }
-    /**
-     * Clear all items from the buffer.
-     */
-    clear() {
-        this.items = [];
-        this.index = 0;
-        this.count = 0;
-    }
-    /**
-     * Get the current number of items in the buffer.
-     */
-    get size() {
-        return this.count;
-    }
-    /**
-     * Get the maximum capacity of the buffer.
-     */
-    get capacity() {
-        return this.maxSize;
-    }
-    /**
-     * Check if the buffer is empty.
-     */
-    get isEmpty() {
-        return this.count === 0;
-    }
-    /**
-     * Check if the buffer is full.
-     */
-    get isFull() {
-        return this.count >= this.maxSize;
-    }
-};
 const CONSOLE_METHODS = [
     'log',
     'warn',
@@ -11072,7 +11267,7 @@ class NetworkCapture extends BaseCapture {
     }
     interceptFetch() {
         const originalFetch = this.originalFetch;
-        window.fetch = async (...args) => {
+        window.fetch = (...args) => __awaiter$1(this, void 0, void 0, function* () {
             const startTime = Date.now();
             let url = '';
             let method = 'GET';
@@ -11083,7 +11278,7 @@ class NetworkCapture extends BaseCapture {
                 this.handleError('parsing fetch arguments', error);
             }
             try {
-                const response = await originalFetch(...args);
+                const response = yield originalFetch(...args);
                 // Only log if response is valid (handles mocked data URLs that return undefined)
                 if (response && typeof response.status === 'number') {
                     const request = this.createNetworkRequest(url, method, response.status, startTime);
@@ -11096,7 +11291,7 @@ class NetworkCapture extends BaseCapture {
                 this.addRequest(request);
                 throw error;
             }
-        };
+        });
     }
     interceptXHR() {
         const originalOpen = this.originalXHR.open;
@@ -14122,7 +14317,7 @@ OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 PERFORMANCE OF THIS SOFTWARE.
 ***************************************************************************** */
-function __rest$1(s, e) {
+function __rest(s, e) {
     var t = {};
     for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
         t[p] = s[p];
@@ -14644,7 +14839,7 @@ class CanvasManager {
         if (!valuesWithType || id === -1)
             return;
         const values = valuesWithType.map((value) => {
-            const rest = __rest$1(value, ["type"]);
+            const rest = __rest(value, ["type"]);
             return rest;
         });
         const { type } = valuesWithType[0];
@@ -15439,28 +15634,32 @@ class CaptureManager {
     /**
      * Capture all data for bug report
      */
-    async captureAll() {
-        var _a, _b;
-        // Call synchronous methods directly
-        const consoleLogs = this.console.getLogs();
-        const networkRequests = this.network.getRequests();
-        const metadata = this.metadata.capture();
-        const replay = (_b = (_a = this.domCollector) === null || _a === void 0 ? void 0 : _a.getEvents()) !== null && _b !== void 0 ? _b : [];
-        // Await async screenshot capture
-        const screenshotPreview = await this.screenshot.capture();
-        return {
-            console: consoleLogs,
-            network: networkRequests,
-            metadata,
-            replay,
-            _screenshotPreview: screenshotPreview,
-        };
+    captureAll() {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            var _a, _b;
+            // Call synchronous methods directly
+            const consoleLogs = this.console.getLogs();
+            const networkRequests = this.network.getRequests();
+            const metadata = this.metadata.capture();
+            const replay = (_b = (_a = this.domCollector) === null || _a === void 0 ? void 0 : _a.getEvents()) !== null && _b !== void 0 ? _b : [];
+            // Await async screenshot capture
+            const screenshotPreview = yield this.screenshot.capture();
+            return {
+                console: consoleLogs,
+                network: networkRequests,
+                metadata,
+                replay,
+                _screenshotPreview: screenshotPreview,
+            };
+        });
     }
     /**
      * Get screenshot only
      */
-    async captureScreenshot() {
-        return await this.screenshot.capture();
+    captureScreenshot() {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            return yield this.screenshot.capture();
+        });
     }
     /**
      * Cleanup resources
@@ -15473,40 +15672,6 @@ class CaptureManager {
     }
 }
-/******************************************************************************
-Copyright (c) Microsoft Corporation.
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted.
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-PERFORMANCE OF THIS SOFTWARE.
-***************************************************************************** */
-/* global Reflect, Promise, SuppressedError, Symbol, Iterator */
-function __rest(s, e) {
-    var t = {};
-    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
-        t[p] = s[p];
-    if (s != null && typeof Object.getOwnPropertySymbols === "function")
-        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
-            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
-                t[p[i]] = s[p[i]];
-        }
-    return t;
-}
-typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
-    var e = new Error(message);
-    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
-};
 const logger$3 = getLogger();
 /**
  * Handles file upload operations using presigned URLs
@@ -15525,111 +15690,119 @@ class FileUploadHandler {
      * Orchestrates the complete file upload flow
      * @throws Error if any step fails
      */
-    async uploadFiles(bugId, report, presignedUrls) {
-        const filesToUpload = await this.prepareFiles(report, presignedUrls);
-        if (filesToUpload.length === 0) {
-            return; // No files to upload
-        }
-        await this.uploadToStorage(filesToUpload);
-        await this.confirmUploads(filesToUpload, bugId);
+    uploadFiles(bugId, report, presignedUrls) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            const filesToUpload = yield this.prepareFiles(report, presignedUrls);
+            if (filesToUpload.length === 0) {
+                return; // No files to upload
+            }
+            yield this.uploadToStorage(filesToUpload);
+            yield this.confirmUploads(filesToUpload, bugId);
+        });
     }
     /**
      * Prepare file blobs and validate presigned URLs
      */
-    async prepareFiles(report, presignedUrls) {
-        const files = [];
-        // Prepare screenshot
-        if (report._screenshotPreview &&
-            report._screenshotPreview.startsWith('data:image/')) {
-            const screenshotUrl = this.getPresignedUrl('screenshot', presignedUrls);
-            const screenshotBlob = await this.dataUrlToBlob(report._screenshotPreview);
-            files.push({
-                type: 'screenshot',
-                url: screenshotUrl.uploadUrl,
-                key: screenshotUrl.storageKey,
-                blob: screenshotBlob,
-            });
-        }
-        // Prepare replay
-        if (report.replay && report.replay.length > 0) {
-            const replayUrl = this.getPresignedUrl('replay', presignedUrls);
-            const compressed = await compressData(report.replay);
-            const replayBlob = new Blob([compressed], {
-                type: 'application/gzip',
-            });
-            files.push({
-                type: 'replay',
-                url: replayUrl.uploadUrl,
-                key: replayUrl.storageKey,
-                blob: replayBlob,
-            });
-        }
-        return files;
+    prepareFiles(report, presignedUrls) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            const files = [];
+            // Prepare screenshot
+            if (report._screenshotPreview &&
+                report._screenshotPreview.startsWith('data:image/')) {
+                const screenshotUrl = this.getPresignedUrl('screenshot', presignedUrls);
+                const screenshotBlob = yield this.dataUrlToBlob(report._screenshotPreview);
+                files.push({
+                    type: 'screenshot',
+                    url: screenshotUrl.uploadUrl,
+                    key: screenshotUrl.storageKey,
+                    blob: screenshotBlob,
+                });
+            }
+            // Prepare replay
+            if (report.replay && report.replay.length > 0) {
+                const replayUrl = this.getPresignedUrl('replay', presignedUrls);
+                const compressed = yield compressData(report.replay);
+                const replayBlob = new Blob([compressed], {
+                    type: 'application/gzip',
+                });
+                files.push({
+                    type: 'replay',
+                    url: replayUrl.uploadUrl,
+                    key: replayUrl.storageKey,
+                    blob: replayBlob,
+                });
+            }
+            return files;
+        });
     }
     /**
      * Upload files to storage using presigned URLs (parallel execution)
      * Note: No custom headers should be added - presigned URLs are pre-signed with specific headers.
      * Adding headers like Content-Type that weren't included in the signature will cause 403 errors.
      */
-    async uploadToStorage(files) {
-        const uploadPromises = files.map(async (file) => {
-            const controller = new AbortController();
-            const timeoutId = setTimeout(() => controller.abort(), FileUploadHandler.UPLOAD_TIMEOUT_MS);
-            try {
-                // Do NOT add Content-Type header - it's already included in the presigned URL signature
-                // Adding it here will cause a signature mismatch and 403 Forbidden error
-                const response = await fetch(file.url, {
-                    method: 'PUT',
-                    body: file.blob,
-                    signal: controller.signal,
-                });
-                clearTimeout(timeoutId);
-                return { success: response.ok, type: file.type };
-            }
-            catch (error) {
-                clearTimeout(timeoutId);
-                logger$3.error(`Upload failed for ${file.type}:`, error);
-                return { success: false, type: file.type };
+    uploadToStorage(files) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            const uploadPromises = files.map((file) => __awaiter$1(this, void 0, void 0, function* () {
+                const controller = new AbortController();
+                const timeoutId = setTimeout(() => controller.abort(), FileUploadHandler.UPLOAD_TIMEOUT_MS);
+                try {
+                    // Do NOT add Content-Type header - it's already included in the presigned URL signature
+                    // Adding it here will cause a signature mismatch and 403 Forbidden error
+                    const response = yield fetch(file.url, {
+                        method: 'PUT',
+                        body: file.blob,
+                        signal: controller.signal,
+                    });
+                    clearTimeout(timeoutId);
+                    return { success: response.ok, type: file.type };
+                }
+                catch (error) {
+                    clearTimeout(timeoutId);
+                    logger$3.error(`Upload failed for ${file.type}:`, error);
+                    return { success: false, type: file.type };
+                }
+            }));
+            const results = yield Promise.all(uploadPromises);
+            // Check for upload failures
+            for (const result of results) {
+                if (!result.success) {
+                    throw new Error(`${this.formatFileType(result.type)} upload failed: Upload to storage failed`);
+                }
             }
         });
-        const results = await Promise.all(uploadPromises);
-        // Check for upload failures
-        for (const result of results) {
-            if (!result.success) {
-                throw new Error(`${this.formatFileType(result.type)} upload failed: Upload to storage failed`);
-            }
-        }
     }
     /**
      * Confirm uploads with backend (parallel execution)
      */
-    async confirmUploads(files, bugId) {
-        const confirmPromises = files.map(async (file) => {
-            try {
-                const response = await fetch(`${this.apiEndpoint}/api/v1/reports/${bugId}/confirm-upload`, {
-                    method: 'POST',
-                    headers: {
-                        'Content-Type': 'application/json',
-                        'X-API-Key': this.apiKey,
-                    },
-                    body: JSON.stringify({
-                        fileType: file.type,
-                    }),
-                });
-                return { success: response.ok, type: file.type };
-            }
-            catch (error) {
-                logger$3.error(`Confirmation failed for ${file.type}:`, error);
-                return { success: false, type: file.type };
+    confirmUploads(files, bugId) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            const confirmPromises = files.map((file) => __awaiter$1(this, void 0, void 0, function* () {
+                try {
+                    const response = yield fetch(`${this.apiEndpoint}/api/v1/reports/${bugId}/confirm-upload`, {
+                        method: 'POST',
+                        headers: {
+                            'Content-Type': 'application/json',
+                            'X-API-Key': this.apiKey,
+                        },
+                        body: JSON.stringify({
+                            fileType: file.type,
+                        }),
+                    });
+                    return { success: response.ok, type: file.type };
+                }
+                catch (error) {
+                    logger$3.error(`Confirmation failed for ${file.type}:`, error);
+                    return { success: false, type: file.type };
+                }
+            }));
+            const results = yield Promise.all(confirmPromises);
+            // Check for confirmation failures
+            for (const result of results) {
+                if (!result.success) {
+                    throw new Error(`${this.formatFileType(result.type)} confirmation failed: Backend did not acknowledge upload`);
+                }
             }
         });
-        const results = await Promise.all(confirmPromises);
-        // Check for confirmation failures
-        for (const result of results) {
-            if (!result.success) {
-                throw new Error(`${this.formatFileType(result.type)} confirmation failed: Backend did not acknowledge upload`);
-            }
-        }
     }
     /**
      * Get presigned URL with validation
@@ -15644,15 +15817,17 @@ class FileUploadHandler {
     /**
      * Convert data URL to Blob
      */
-    async dataUrlToBlob(dataUrl) {
-        if (!dataUrl || !dataUrl.startsWith('data:')) {
-            throw new Error('Invalid data URL');
-        }
-        const response = await fetch(dataUrl);
-        if (!response || !response.blob) {
-            throw new Error('Failed to convert data URL to Blob');
-        }
-        return await response.blob();
+    dataUrlToBlob(dataUrl) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            if (!dataUrl || !dataUrl.startsWith('data:')) {
+                throw new Error('Invalid data URL');
+            }
+            const response = yield fetch(dataUrl);
+            if (!response || !response.blob) {
+                throw new Error('Failed to convert data URL to Blob');
+            }
+            return yield response.blob();
+        });
     }
     /**
      * Format file type for error messages (capitalize first letter)
@@ -15904,6 +16079,18 @@ const DEFAULT_OFFLINE_CONFIG$1 = {
     enabled: false,
     maxQueueSize: 10,
 };
+/**
+ * Set of sensitive header names that should be stripped before localStorage storage
+ * SECURITY: Using Set for O(1) lookup performance
+ */
+const SENSITIVE_HEADERS = new Set([
+    'authorization',
+    'x-api-key',
+    'x-auth-token',
+    'x-access-token',
+    'cookie',
+    'set-cookie',
+]);
 // ============================================================================
 // OFFLINE QUEUE CLASS
 // ============================================================================
@@ -15916,6 +16103,7 @@ class OfflineQueue {
     }
     /**
      * Queue a request for offline retry
+     * SECURITY: Strips sensitive authentication headers before storage
      */
     enqueue(endpoint, body, headers) {
         try {
@@ -15929,7 +16117,9 @@ class OfflineQueue {
                 this.logger.warn(`Offline queue is full (${this.config.maxQueueSize}), removing oldest request`);
                 queue.shift();
             }
-            queue.push(this.createQueuedRequest(endpoint, serializedBody, headers));
+            // SECURITY: Strip sensitive headers before storing in localStorage
+            const sanitizedHeaders = this.stripSensitiveHeaders(headers);
+            queue.push(this.createQueuedRequest(endpoint, serializedBody, sanitizedHeaders));
             this.saveQueue(queue);
             this.logger.log(`Request queued for offline retry (queue size: ${queue.length})`);
         }
@@ -15939,62 +16129,88 @@ class OfflineQueue {
     }
     /**
      * Process offline queue
+     * @deprecated Use processWithAuth() instead to properly handle authentication
      */
-    async process(retryableStatusCodes) {
-        const queue = this.getQueue();
-        if (queue.length === 0) {
-            return;
-        }
-        this.logger.log(`Processing offline queue (${queue.length} requests)`);
-        const successfulIds = [];
-        const failedRequests = [];
-        for (const request of queue) {
-            // Check if request has exceeded max retry attempts
-            if (request.attempts >= MAX_RETRY_ATTEMPTS) {
-                this.logger.warn(`Max retry attempts (${MAX_RETRY_ATTEMPTS}) reached for request (id: ${request.id}), removing`);
-                continue;
-            }
-            // Check if request has expired
-            const age = Date.now() - request.timestamp;
-            const maxAge = QUEUE_EXPIRY_DAYS * 24 * 60 * 60 * 1000;
-            if (age > maxAge) {
-                this.logger.warn(`Removing expired queued request (id: ${request.id})`);
-                continue;
+    process(retryableStatusCodes) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            return this.processWithAuth(retryableStatusCodes, {});
+        });
+    }
+    /**
+     * Process offline queue with authentication headers
+     * @param retryableStatusCodes - HTTP status codes that should be retried
+     * @param authHeaders - Authentication headers to merge with stored headers
+     */
+    processWithAuth(retryableStatusCodes, authHeaders) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            const queue = this.getQueue();
+            if (queue.length === 0) {
+                return;
             }
-            try {
-                // Attempt to send
-                const response = await fetch(request.endpoint, {
-                    method: 'POST',
-                    headers: request.headers,
-                    body: request.body,
-                });
-                if (response.ok) {
-                    this.logger.log(`Successfully sent queued request (id: ${request.id})`);
-                    successfulIds.push(request.id);
+            this.logger.log(`Processing offline queue (${queue.length} requests)`);
+            const successfulIds = [];
+            const rejectedIds = [];
+            const failedRequests = [];
+            for (const request of queue) {
+                // Check if request has exceeded max retry attempts
+                if (request.attempts >= MAX_RETRY_ATTEMPTS) {
+                    this.logger.warn(`Max retry attempts (${MAX_RETRY_ATTEMPTS}) reached for request (id: ${request.id}), removing`);
+                    continue;
+                }
+                // Check if request has expired
+                const age = Date.now() - request.timestamp;
+                const maxAge = QUEUE_EXPIRY_DAYS * 24 * 60 * 60 * 1000;
+                if (age > maxAge) {
+                    this.logger.warn(`Removing expired queued request (id: ${request.id})`);
+                    continue;
                 }
-                else if (retryableStatusCodes.includes(response.status)) {
-                    // Keep in queue for next attempt
+                try {
+                    // SECURITY: Verify endpoint is secure (HTTPS) before sending
+                    // This prevents downgrade attacks and ensures data confidentiality
+                    if (!isSecureEndpoint(request.endpoint)) {
+                        this.logger.error(`Refusing to send offline request to insecure endpoint: ${request.endpoint}`);
+                        rejectedIds.push(request.id);
+                        // Don't retry insecure requests
+                        continue;
+                    }
+                    // Merge auth headers with stored headers (auth headers take precedence)
+                    const headers = Object.assign(Object.assign({}, request.headers), authHeaders);
+                    // Attempt to send
+                    const response = yield fetch(request.endpoint, {
+                        method: 'POST',
+                        headers,
+                        body: request.body,
+                    });
+                    if (response.ok) {
+                        this.logger.log(`Successfully sent queued request (id: ${request.id})`);
+                        successfulIds.push(request.id);
+                    }
+                    else if (retryableStatusCodes.includes(response.status)) {
+                        // Keep in queue for next attempt
+                        request.attempts++;
+                        failedRequests.push(request);
+                        this.logger.warn(`Queued request failed with status ${response.status}, will retry later (id: ${request.id})`);
+                    }
+                    else {
+                        // Non-retryable error, remove from queue
+                        this.logger.warn(`Queued request failed with non-retryable status ${response.status}, removing (id: ${request.id})`);
+                    }
+                }
+                catch (error) {
+                    // Network error, keep in queue
                     request.attempts++;
                     failedRequests.push(request);
-                    this.logger.warn(`Queued request failed with status ${response.status}, will retry later (id: ${request.id})`);
-                }
-                else {
-                    // Non-retryable error, remove from queue
-                    this.logger.warn(`Queued request failed with non-retryable status ${response.status}, removing (id: ${request.id})`);
+                    this.logger.warn(`Queued request failed with network error, will retry later (id: ${request.id}):`, error);
                 }
             }
-            catch (error) {
-                // Network error, keep in queue
-                request.attempts++;
-                failedRequests.push(request);
-                this.logger.warn(`Queued request failed with network error, will retry later (id: ${request.id}):`, error);
+            // Update queue (remove successful and expired, keep failed)
+            this.saveQueue(failedRequests);
+            if (successfulIds.length > 0 ||
+                rejectedIds.length > 0 ||
+                failedRequests.length < queue.length) {
+                this.logger.log(`Offline queue processed: ${successfulIds.length} successful, ${rejectedIds.length} rejected (insecure), ${failedRequests.length} remaining`);
             }
-        }
-        // Update queue (remove successful and expired, keep failed)
-        this.saveQueue(failedRequests);
-        if (successfulIds.length > 0 || failedRequests.length < queue.length) {
-            this.logger.log(`Offline queue processed: ${successfulIds.length} successful, ${failedRequests.length} remaining`);
-        }
+        });
     }
     /**
      * Clear offline queue
@@ -16016,6 +16232,13 @@ class OfflineQueue {
     // ============================================================================
     // PRIVATE METHODS
     // ============================================================================
+    /**
+     * Strip sensitive authentication headers before storing in localStorage
+     * SECURITY: Prevents API keys and tokens from being stored in plain text
+     */
+    stripSensitiveHeaders(headers) {
+        return Object.fromEntries(Object.entries(headers).filter(([key]) => !SENSITIVE_HEADERS.has(key.toLowerCase())));
+    }
     /**
      * Serialize body to string format
      */
@@ -16206,39 +16429,41 @@ class RetryHandler {
     /**
      * Execute operation with exponential backoff retry
      */
-    async executeWithRetry(operation, shouldRetryStatus) {
-        let lastError = null;
-        for (let attempt = 0; attempt <= this.config.maxRetries; attempt++) {
-            try {
-                const response = await operation();
-                // Check if we should retry based on status code
-                if (shouldRetryStatus(response.status) &&
-                    attempt < this.config.maxRetries) {
-                    const delay = this.calculateDelay(attempt, response);
-                    this.logger.warn(`Request failed with status ${response.status}, retrying in ${delay}ms (attempt ${attempt + 1}/${this.config.maxRetries})`);
-                    await sleep(delay);
-                    continue;
-                }
-                // Success or non-retryable status
-                return response;
-            }
-            catch (error) {
-                lastError = error;
-                // Don't retry authentication errors - they won't succeed on retry
-                if (error instanceof AuthenticationError) {
-                    throw error;
+    executeWithRetry(operation, shouldRetryStatus) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            let lastError = null;
+            for (let attempt = 0; attempt <= this.config.maxRetries; attempt++) {
+                try {
+                    const response = yield operation();
+                    // Check if we should retry based on status code
+                    if (shouldRetryStatus(response.status) &&
+                        attempt < this.config.maxRetries) {
+                        const delay = this.calculateDelay(attempt, response);
+                        this.logger.warn(`Request failed with status ${response.status}, retrying in ${delay}ms (attempt ${attempt + 1}/${this.config.maxRetries})`);
+                        yield sleep(delay);
+                        continue;
+                    }
+                    // Success or non-retryable status
+                    return response;
                 }
-                // Retry on network errors
-                if (attempt < this.config.maxRetries) {
-                    const delay = this.calculateDelay(attempt);
-                    this.logger.warn(`Network error, retrying in ${delay}ms (attempt ${attempt + 1}/${this.config.maxRetries}):`, error);
-                    await sleep(delay);
-                    continue;
+                catch (error) {
+                    lastError = error;
+                    // Don't retry authentication errors - they won't succeed on retry
+                    if (error instanceof AuthenticationError) {
+                        throw error;
+                    }
+                    // Retry on network errors
+                    if (attempt < this.config.maxRetries) {
+                        const delay = this.calculateDelay(attempt);
+                        this.logger.warn(`Network error, retrying in ${delay}ms (attempt ${attempt + 1}/${this.config.maxRetries}):`, error);
+                        yield sleep(delay);
+                        continue;
+                    }
                 }
             }
-        }
-        // All retries exhausted
-        throw lastError || new Error('Request failed after all retry attempts');
+            // All retries exhausted
+            throw lastError || new Error('Request failed after all retry attempts');
+        });
     }
     /**
      * Calculate retry delay with exponential backoff and jitter
@@ -16246,8 +16471,8 @@ class RetryHandler {
     calculateDelay(attempt, response) {
         var _a, _b;
         // Check for Retry-After header
-        if ((_b = (_a = response === null || response === void 0 ? void 0 : response.headers) === null || _a === void 0 ? void 0 : _a.has) === null || _b === void 0 ? void 0 : _b.call(_a, 'Retry-After')) {
-            const retryAfter = response.headers.get('Retry-After');
+        const retryAfter = (_b = (_a = response === null || response === void 0 ? void 0 : response.headers) === null || _a === void 0 ? void 0 : _a.get) === null || _b === void 0 ? void 0 : _b.call(_a, 'Retry-After');
+        if (retryAfter) {
             const retryAfterSeconds = parseInt(retryAfter, 10);
             if (!isNaN(retryAfterSeconds)) {
                 return Math.min(retryAfterSeconds * 1000, this.config.maxDelay);
@@ -16268,26 +16493,34 @@ class RetryHandler {
 /**
  * Process offline queue in background
  */
-async function processQueueInBackground(offlineConfig, retryConfig, logger) {
-    if (!offlineConfig.enabled) {
-        return;
-    }
-    const queue = new OfflineQueue(offlineConfig, logger);
-    queue.process(retryConfig.retryOn).catch((error) => {
-        logger.warn('Failed to process offline queue:', error);
+function processQueueInBackground(offlineConfig, retryConfig, auth, logger) {
+    return __awaiter$1(this, void 0, void 0, function* () {
+        if (!offlineConfig.enabled) {
+            return;
+        }
+        const queue = new OfflineQueue(offlineConfig, logger);
+        const authHeaders = generateAuthHeaders(auth);
+        queue
+            .processWithAuth(retryConfig.retryOn, authHeaders)
+            .catch((error) => {
+            logger.warn('Failed to process offline queue:', error);
+        });
     });
 }
 /**
  * Handle offline failure by queueing request
+ * SECURITY: Does not pass auth headers to queue - they will be regenerated when processing
  */
-async function handleOfflineFailure(error, endpoint, body, contentHeaders, auth, offlineConfig, logger) {
-    if (!offlineConfig.enabled || !isNetworkError(error)) {
-        return;
-    }
-    logger.warn('Network error detected, queueing request for offline retry');
-    const queue = new OfflineQueue(offlineConfig, logger);
-    const authHeaders = generateAuthHeaders(auth);
-    await queue.enqueue(endpoint, body, Object.assign(Object.assign({}, contentHeaders), authHeaders));
+function handleOfflineFailure(error, endpoint, body, contentHeaders, _auth, offlineConfig, logger) {
+    return __awaiter$1(this, void 0, void 0, function* () {
+        if (!offlineConfig.enabled || !isNetworkError(error)) {
+            return;
+        }
+        logger.warn('Network error detected, queueing request for offline retry');
+        const queue = new OfflineQueue(offlineConfig, logger);
+        // SECURITY: Only pass content headers, not auth headers - auth will be regenerated when processing
+        yield queue.enqueue(endpoint, body, contentHeaders);
+    });
 }
 // ============================================================================
 // PUBLIC API
@@ -16309,22 +16542,28 @@ function getAuthHeaders(auth) {
  * @param authOrOptions - Auth config or TransportOptions
  * @returns Response from the server
  */
-async function submitWithAuth(endpoint, body, contentHeaders = {}, options) {
-    const logger = options.logger || getLogger();
-    const retryConfig = Object.assign(Object.assign({}, DEFAULT_RETRY_CONFIG), options.retry);
-    const offlineConfig = Object.assign(Object.assign({}, DEFAULT_OFFLINE_CONFIG), options.offline);
-    // Process offline queue on each request (run in background without awaiting)
-    processQueueInBackground(offlineConfig, retryConfig, logger);
-    try {
-        // Send with retry logic
-        const response = await sendWithRetry(endpoint, body, contentHeaders, options.auth, retryConfig, logger);
-        return response;
-    }
-    catch (error) {
-        // Queue for offline retry if enabled
-        await handleOfflineFailure(error, endpoint, body, contentHeaders, options.auth, offlineConfig, logger);
-        throw error;
-    }
+function submitWithAuth(endpoint_1, body_1) {
+    return __awaiter$1(this, arguments, void 0, function* (endpoint, body, contentHeaders = {}, options) {
+        const logger = options.logger || getLogger();
+        const retryConfig = Object.assign(Object.assign({}, DEFAULT_RETRY_CONFIG), options.retry);
+        const offlineConfig = Object.assign(Object.assign({}, DEFAULT_OFFLINE_CONFIG), options.offline);
+        // Security: Enforce HTTPS
+        if (!isSecureEndpoint(endpoint)) {
+            throw new InsecureEndpointError(endpoint);
+        }
+        // Process offline queue on each request (run in background without awaiting)
+        processQueueInBackground(offlineConfig, retryConfig, options.auth, logger);
+        try {
+            // Send with retry logic
+            const response = yield sendWithRetry(endpoint, body, contentHeaders, options.auth, retryConfig, logger);
+            return response;
+        }
+        catch (error) {
+            // Queue for offline retry if enabled
+            yield handleOfflineFailure(error, endpoint, body, contentHeaders, options.auth, offlineConfig, logger);
+            throw error;
+        }
+    });
 }
 // ============================================================================
 // INTERNAL HELPERS
@@ -16332,21 +16571,28 @@ async function submitWithAuth(endpoint, body, contentHeaders = {}, options) {
 /**
  * Make HTTP request with auth headers
  */
-async function makeRequest(endpoint, body, contentHeaders, auth) {
-    const authHeaders = generateAuthHeaders(auth);
-    const headers = Object.assign(Object.assign({}, contentHeaders), authHeaders);
-    return fetch(endpoint, {
-        method: 'POST',
-        headers,
-        body,
+function makeRequest(endpoint, body, contentHeaders, auth) {
+    return __awaiter$1(this, void 0, void 0, function* () {
+        if (!isSecureEndpoint(endpoint)) {
+            throw new InsecureEndpointError(endpoint);
+        }
+        const authHeaders = generateAuthHeaders(auth);
+        const headers = Object.assign(Object.assign({}, contentHeaders), authHeaders);
+        return fetch(endpoint, {
+            method: 'POST',
+            headers,
+            body,
+        });
     });
 }
 /**
  * Send request with exponential backoff retry
  */
-async function sendWithRetry(endpoint, body, contentHeaders, auth, retryConfig, logger) {
-    const retryHandler = new RetryHandler(retryConfig, logger);
-    return retryHandler.executeWithRetry(async () => makeRequest(endpoint, body, contentHeaders, auth), (status) => retryConfig.retryOn.includes(status));
+function sendWithRetry(endpoint, body, contentHeaders, auth, retryConfig, logger) {
+    return __awaiter$1(this, void 0, void 0, function* () {
+        const retryHandler = new RetryHandler(retryConfig, logger);
+        return retryHandler.executeWithRetry(() => __awaiter$1(this, void 0, void 0, function* () { return makeRequest(endpoint, body, contentHeaders, auth); }), (status) => retryConfig.retryOn.includes(status));
+    });
 }
 /**
  * Sleep for specified milliseconds
@@ -16480,17 +16726,19 @@ class BugReporter {
     /**
      * Submit a bug report with file uploads via presigned URLs
      */
-    async submit(payload) {
-        const dedupContext = this.validateAndExtractErrors(payload);
-        try {
-            logger$1.debug(`Submitting bug report to ${this.config.endpoint}`);
-            const bugReportData = await this.createBugReport(payload);
-            await this.handleFileUploads(bugReportData, payload, dedupContext);
-        }
-        finally {
-            // Mark this specific report submission as complete
-            this.deduplicator.markComplete(dedupContext.title, dedupContext.description, dedupContext.errorStacks);
-        }
+    submit(payload) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            const dedupContext = this.validateAndExtractErrors(payload);
+            try {
+                logger$1.debug(`Submitting bug report to ${this.config.endpoint}`);
+                const bugReportData = yield this.createBugReport(payload);
+                yield this.handleFileUploads(bugReportData, payload, dedupContext);
+            }
+            finally {
+                // Mark this specific report submission as complete
+                this.deduplicator.markComplete(dedupContext.title, dedupContext.description, dedupContext.errorStacks);
+            }
+        });
     }
     /**
      * Validate submission and extract deduplication context
@@ -16519,81 +16767,85 @@ class BugReporter {
      * Create bug report on server and get bug ID with presigned URLs
      * @private
      */
-    async createBugReport(payload) {
-        const { report } = payload, metadata = __rest(payload, ["report"]);
-        const fileAnalysis = analyzeReportFiles(report);
-        logger$1.debug('File upload detection', fileAnalysis);
-        const createPayload = Object.assign(Object.assign({}, metadata), { report: {
-                console: report.console,
-                network: report.network,
-                metadata: report.metadata,
-            }, hasScreenshot: fileAnalysis.hasScreenshot, hasReplay: fileAnalysis.hasReplay });
-        const response = await submitWithAuth(this.config.endpoint, JSON.stringify(createPayload), { 'Content-Type': 'application/json' }, {
-            auth: this.config.auth,
-            retry: this.config.retry,
-            offline: this.config.offline,
-        });
-        if (!response.ok) {
-            const errorText = await response.text().catch(() => 'Unknown error');
-            throw new Error(`Failed to submit bug report: ${response.status} ${response.statusText}. ${errorText}`);
-        }
-        const result = await response.json();
-        if (!isBugReportResponse(result)) {
-            throw new Error('Invalid server response format');
-        }
-        if (!result.success) {
-            throw new Error('Bug report creation failed on server');
-        }
-        // TypeScript now knows result.success is true, so result.data exists (validated by type guard)
-        const bugData = result.data;
-        logger$1.debug('Bug report creation response', {
-            success: result.success,
-            bugId: bugData.id,
-            hasPresignedUrls: !!bugData.presignedUrls,
-            presignedUrlKeys: bugData.presignedUrls
-                ? Object.keys(bugData.presignedUrls)
-                : [],
+    createBugReport(payload) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            const { report } = payload, metadata = __rest$1(payload, ["report"]);
+            const fileAnalysis = analyzeReportFiles(report);
+            logger$1.debug('File upload detection', fileAnalysis);
+            const createPayload = Object.assign(Object.assign({}, metadata), { report: {
+                    console: report.console,
+                    network: report.network,
+                    metadata: report.metadata,
+                }, hasScreenshot: fileAnalysis.hasScreenshot, hasReplay: fileAnalysis.hasReplay });
+            const response = yield submitWithAuth(this.config.endpoint, JSON.stringify(createPayload), { 'Content-Type': 'application/json' }, {
+                auth: this.config.auth,
+                retry: this.config.retry,
+                offline: this.config.offline,
+            });
+            if (!response.ok) {
+                const errorText = yield response.text().catch(() => 'Unknown error');
+                throw new Error(`Failed to submit bug report: ${response.status} ${response.statusText}. ${errorText}`);
+            }
+            const result = yield response.json();
+            if (!isBugReportResponse(result)) {
+                throw new Error('Invalid server response format');
+            }
+            if (!result.success) {
+                throw new Error('Bug report creation failed on server');
+            }
+            // TypeScript now knows result.success is true, so result.data exists (validated by type guard)
+            const bugData = result.data;
+            logger$1.debug('Bug report creation response', {
+                success: result.success,
+                bugId: bugData.id,
+                hasPresignedUrls: !!bugData.presignedUrls,
+                presignedUrlKeys: bugData.presignedUrls
+                    ? Object.keys(bugData.presignedUrls)
+                    : [],
+            });
+            return bugData;
         });
-        return bugData;
     }
     /**
      * Handle file uploads using presigned URLs
      * @private
      */
-    async handleFileUploads(bugReportData, payload, dedupContext) {
-        // bugReportData.id is guaranteed to exist by type guard validation in createBugReport
-        const bugId = bugReportData.id;
-        const { report } = payload;
-        const fileAnalysis = analyzeReportFiles(report);
-        if (!fileAnalysis.hasScreenshot && !fileAnalysis.hasReplay) {
-            logger$1.debug('No files to upload, bug report created successfully', {
-                bugId,
-            });
-            this.deduplicator.recordSubmission(dedupContext.title, dedupContext.description, dedupContext.errorStacks);
-            return;
-        }
-        if (!bugReportData.presignedUrls) {
-            logger$1.error('Presigned URLs not returned despite requesting file uploads', {
-                bugId,
-                hasScreenshot: fileAnalysis.hasScreenshot,
-                hasReplay: fileAnalysis.hasReplay,
-            });
-            throw new Error('Server did not provide presigned URLs for file uploads. Check backend configuration.');
-        }
-        const apiEndpoint = getApiBaseUrl(this.config.endpoint);
-        const uploadHandler = new FileUploadHandler(apiEndpoint, this.config.auth.apiKey);
-        try {
-            await uploadHandler.uploadFiles(bugId, report, bugReportData.presignedUrls);
-            logger$1.debug('File uploads completed successfully', { bugId });
-            this.deduplicator.recordSubmission(dedupContext.title, dedupContext.description, dedupContext.errorStacks);
-        }
-        catch (error) {
-            logger$1.error('File upload failed', {
-                bugId,
-                error: formatSubmissionError('Upload', error),
-            });
-            throw new Error(formatSubmissionError(`Bug report created (ID: ${bugId}) but file upload failed`, error));
-        }
+    handleFileUploads(bugReportData, payload, dedupContext) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            // bugReportData.id is guaranteed to exist by type guard validation in createBugReport
+            const bugId = bugReportData.id;
+            const { report } = payload;
+            const fileAnalysis = analyzeReportFiles(report);
+            if (!fileAnalysis.hasScreenshot && !fileAnalysis.hasReplay) {
+                logger$1.debug('No files to upload, bug report created successfully', {
+                    bugId,
+                });
+                this.deduplicator.recordSubmission(dedupContext.title, dedupContext.description, dedupContext.errorStacks);
+                return;
+            }
+            if (!bugReportData.presignedUrls) {
+                logger$1.error('Presigned URLs not returned despite requesting file uploads', {
+                    bugId,
+                    hasScreenshot: fileAnalysis.hasScreenshot,
+                    hasReplay: fileAnalysis.hasReplay,
+                });
+                throw new Error('Server did not provide presigned URLs for file uploads. Check backend configuration.');
+            }
+            const apiEndpoint = getApiBaseUrl(this.config.endpoint);
+            const uploadHandler = new FileUploadHandler(apiEndpoint, this.config.auth.apiKey);
+            try {
+                yield uploadHandler.uploadFiles(bugId, report, bugReportData.presignedUrls);
+                logger$1.debug('File uploads completed successfully', { bugId });
+                this.deduplicator.recordSubmission(dedupContext.title, dedupContext.description, dedupContext.errorStacks);
+            }
+            catch (error) {
+                logger$1.error('File upload failed', {
+                    bugId,
+                    error: formatSubmissionError('Upload', error),
+                });
+                throw new Error(formatSubmissionError(`Bug report created (ID: ${bugId}) but file upload failed`, error));
+            }
+        });
     }
     /**
      * Cleanup resources
@@ -16621,8 +16873,10 @@ class DirectUploader {
      * @param onProgress - Optional progress callback
      * @returns Upload result with storage key
      */
-    async uploadScreenshot(file, onProgress) {
-        return this.uploadFile(file, 'screenshot', 'screenshot.png', onProgress);
+    uploadScreenshot(file, onProgress) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            return this.uploadFile(file, 'screenshot', 'screenshot.png', onProgress);
+        });
     }
     /**
      * Upload a compressed session replay directly to storage
@@ -16630,8 +16884,10 @@ class DirectUploader {
      * @param onProgress - Optional progress callback
      * @returns Upload result with storage key
      */
-    async uploadReplay(compressedData, onProgress) {
-        return this.uploadFile(compressedData, 'replay', 'replay.gz', onProgress);
+    uploadReplay(compressedData, onProgress) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            return this.uploadFile(compressedData, 'replay', 'replay.gz', onProgress);
+        });
     }
     /**
      * Upload an attachment file directly to storage
@@ -16639,8 +16895,10 @@ class DirectUploader {
      * @param onProgress - Optional progress callback
      * @returns Upload result with storage key
      */
-    async uploadAttachment(file, onProgress) {
-        return this.uploadFile(file, 'attachment', file.name, onProgress);
+    uploadAttachment(file, onProgress) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            return this.uploadFile(file, 'attachment', file.name, onProgress);
+        });
     }
     /**
      * Generic file upload method
@@ -16648,121 +16906,127 @@ class DirectUploader {
      * 2. Upload file directly to storage using presigned URL
      * 3. Confirm upload with API
      */
-    async uploadFile(file, fileType, filename, onProgress) {
-        try {
-            // Step 1: Get presigned upload URL
-            const presignedUrlResponse = await this.requestPresignedUrl(fileType, filename);
-            if (!presignedUrlResponse.success) {
-                return {
-                    success: false,
-                    error: presignedUrlResponse.error || 'Failed to get presigned URL',
-                };
-            }
-            const { uploadUrl, storageKey } = presignedUrlResponse.data;
-            // Step 2: Upload file to storage using presigned URL
-            const uploadSuccess = await this.uploadToStorage(uploadUrl, file, onProgress);
-            if (!uploadSuccess) {
+    uploadFile(file, fileType, filename, onProgress) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            try {
+                // Step 1: Get presigned upload URL
+                const presignedUrlResponse = yield this.requestPresignedUrl(fileType, filename);
+                if (!presignedUrlResponse.success) {
+                    return {
+                        success: false,
+                        error: presignedUrlResponse.error || 'Failed to get presigned URL',
+                    };
+                }
+                const { uploadUrl, storageKey } = presignedUrlResponse.data;
+                // Step 2: Upload file to storage using presigned URL
+                const uploadSuccess = yield this.uploadToStorage(uploadUrl, file, onProgress);
+                if (!uploadSuccess) {
+                    return {
+                        success: false,
+                        error: 'Failed to upload file to storage',
+                    };
+                }
+                // Step 3: Confirm upload with API
+                const confirmSuccess = yield this.confirmUpload(fileType);
+                if (!confirmSuccess) {
+                    return {
+                        success: false,
+                        error: 'Failed to confirm upload',
+                    };
+                }
                 return {
-                    success: false,
-                    error: 'Failed to upload file to storage',
+                    success: true,
+                    storageKey,
                 };
             }
-            // Step 3: Confirm upload with API
-            const confirmSuccess = await this.confirmUpload(fileType);
-            if (!confirmSuccess) {
+            catch (error) {
                 return {
                     success: false,
-                    error: 'Failed to confirm upload',
+                    error: error instanceof Error ? error.message : 'Unknown error',
                 };
             }
-            return {
-                success: true,
-                storageKey,
-            };
-        }
-        catch (error) {
-            return {
-                success: false,
-                error: error instanceof Error ? error.message : 'Unknown error',
-            };
-        }
+        });
     }
     /**
      * Request a presigned URL from the API
      */
-    async requestPresignedUrl(fileType, filename) {
-        try {
-            const response = await fetch(`${this.config.apiEndpoint}/api/v1/uploads/presigned-url`, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    'x-api-key': this.config.apiKey,
-                },
-                body: JSON.stringify({
-                    projectId: this.config.projectId,
-                    bugId: this.config.bugId,
-                    fileType,
-                    filename,
-                }),
-            });
-            if (!response.ok) {
-                const errorText = await response.text();
+    requestPresignedUrl(fileType, filename) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            try {
+                const response = yield fetch(`${this.config.apiEndpoint}/api/v1/uploads/presigned-url`, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                        'x-api-key': this.config.apiKey,
+                    },
+                    body: JSON.stringify({
+                        projectId: this.config.projectId,
+                        bugId: this.config.bugId,
+                        fileType,
+                        filename,
+                    }),
+                });
+                if (!response.ok) {
+                    const errorText = yield response.text();
+                    return {
+                        success: false,
+                        error: `HTTP ${response.status}: ${errorText}`,
+                    };
+                }
+                const result = yield response.json();
+                return {
+                    success: result.success,
+                    data: result.data,
+                    error: result.error,
+                };
+            }
+            catch (error) {
                 return {
                     success: false,
-                    error: `HTTP ${response.status}: ${errorText}`,
+                    error: error instanceof Error ? error.message : 'Network error',
                 };
             }
-            const result = await response.json();
-            return {
-                success: result.success,
-                data: result.data,
-                error: result.error,
-            };
-        }
-        catch (error) {
-            return {
-                success: false,
-                error: error instanceof Error ? error.message : 'Network error',
-            };
-        }
+        });
     }
     /**
      * Upload file to storage using presigned URL
      * Uses XMLHttpRequest for progress tracking
      */
-    async uploadToStorage(uploadUrl, file, onProgress) {
-        // Convert File/Blob to ArrayBuffer to prevent browser from auto-setting Content-Type header
-        // This is critical for CORS compatibility with B2/S3 presigned URLs
-        const arrayBuffer = await this.fileToArrayBuffer(file);
-        return new Promise((resolve) => {
-            const xhr = new XMLHttpRequest();
-            // Track upload progress
-            if (onProgress) {
-                xhr.upload.addEventListener('progress', (event) => {
-                    if (event.lengthComputable) {
-                        onProgress({
-                            loaded: event.loaded,
-                            total: event.total,
-                            percentage: Math.round((event.loaded / event.total) * 100),
-                        });
-                    }
+    uploadToStorage(uploadUrl, file, onProgress) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            // Convert File/Blob to ArrayBuffer to prevent browser from auto-setting Content-Type header
+            // This is critical for CORS compatibility with B2/S3 presigned URLs
+            const arrayBuffer = yield this.fileToArrayBuffer(file);
+            return new Promise((resolve) => {
+                const xhr = new XMLHttpRequest();
+                // Track upload progress
+                if (onProgress) {
+                    xhr.upload.addEventListener('progress', (event) => {
+                        if (event.lengthComputable) {
+                            onProgress({
+                                loaded: event.loaded,
+                                total: event.total,
+                                percentage: Math.round((event.loaded / event.total) * 100),
+                            });
+                        }
+                    });
+                }
+                // Handle completion
+                xhr.addEventListener('load', () => {
+                    resolve(xhr.status >= 200 && xhr.status < 300);
                 });
-            }
-            // Handle completion
-            xhr.addEventListener('load', () => {
-                resolve(xhr.status >= 200 && xhr.status < 300);
-            });
-            // Handle errors
-            xhr.addEventListener('error', () => {
-                resolve(false);
-            });
-            xhr.addEventListener('abort', () => {
-                resolve(false);
+                // Handle errors
+                xhr.addEventListener('error', () => {
+                    resolve(false);
+                });
+                xhr.addEventListener('abort', () => {
+                    resolve(false);
+                });
+                // Send file as ArrayBuffer (no Content-Type header)
+                // The presigned URL signature does NOT include Content-Type
+                xhr.open('PUT', uploadUrl);
+                xhr.send(arrayBuffer);
             });
-            // Send file as ArrayBuffer (no Content-Type header)
-            // The presigned URL signature does NOT include Content-Type
-            xhr.open('PUT', uploadUrl);
-            xhr.send(arrayBuffer);
         });
     }
     /**
@@ -16783,23 +17047,25 @@ class DirectUploader {
     /**
      * Confirm successful upload with the API
      */
-    async confirmUpload(fileType) {
-        try {
-            const response = await fetch(`${this.config.apiEndpoint}/api/v1/reports/${this.config.bugId}/confirm-upload`, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    'x-api-key': this.config.apiKey,
-                },
-                body: JSON.stringify({
-                    fileType,
-                }),
-            });
-            return response.ok;
-        }
-        catch (_a) {
-            return false;
-        }
+    confirmUpload(fileType) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            try {
+                const response = yield fetch(`${this.config.apiEndpoint}/api/v1/reports/${this.config.bugId}/confirm-upload`, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                        'x-api-key': this.config.apiKey,
+                    },
+                    body: JSON.stringify({
+                        fileType,
+                    }),
+                });
+                return response.ok;
+            }
+            catch (_a) {
+                return false;
+            }
+        });
     }
 }
@@ -16813,30 +17079,32 @@ class DirectUploader {
  * @param events - Session replay events array
  * @returns Compressed Blob (gzip)
  */
-async function compressReplayEvents(events) {
-    // Convert events to JSON string
-    const jsonString = JSON.stringify(events);
-    const textEncoder = new TextEncoder();
-    const data = textEncoder.encode(jsonString);
-    // Check if CompressionStream is supported (Chrome 80+, Firefox 113+, Safari 16.4+)
-    if (typeof CompressionStream === 'undefined') {
-        console.warn('CompressionStream not supported, uploading uncompressed replay data');
-        return new Blob([data], { type: 'application/json' });
-    }
-    try {
-        // Use modern streaming API: Blob → ReadableStream → CompressionStream → Response → Blob
-        const blob = new Blob([data]);
-        const compressedStream = blob
-            .stream()
-            .pipeThrough(new CompressionStream('gzip'));
-        return await new Response(compressedStream, {
-            headers: { 'Content-Type': 'application/gzip' },
-        }).blob();
-    }
-    catch (error) {
-        console.error('Compression failed, uploading uncompressed:', error);
-        return new Blob([data], { type: 'application/json' });
-    }
+function compressReplayEvents(events) {
+    return __awaiter$1(this, void 0, void 0, function* () {
+        // Convert events to JSON string
+        const jsonString = JSON.stringify(events);
+        const textEncoder = new TextEncoder();
+        const data = textEncoder.encode(jsonString);
+        // Check if CompressionStream is supported (Chrome 80+, Firefox 113+, Safari 16.4+)
+        if (typeof CompressionStream === 'undefined') {
+            console.warn('CompressionStream not supported, uploading uncompressed replay data');
+            return new Blob([data], { type: 'application/json' });
+        }
+        try {
+            // Use modern streaming API: Blob → ReadableStream → CompressionStream → Response → Blob
+            const blob = new Blob([data]);
+            const compressedStream = blob
+                .stream()
+                .pipeThrough(new CompressionStream('gzip'));
+            return yield new Response(compressedStream, {
+                headers: { 'Content-Type': 'application/gzip' },
+            }).blob();
+        }
+        catch (error) {
+            console.error('Compression failed, uploading uncompressed:', error);
+            return new Blob([data], { type: 'application/json' });
+        }
+    });
 }
 /**
  * Convert screenshot canvas to Blob
@@ -16844,16 +17112,18 @@ async function compressReplayEvents(events) {
  * @param quality - JPEG quality (0-1), default 0.9
  * @returns Screenshot Blob
  */
-async function canvasToBlob(canvas, quality = 0.9) {
-    return new Promise((resolve, reject) => {
-        canvas.toBlob((blob) => {
-            if (blob) {
-                resolve(blob);
-            }
-            else {
-                reject(new Error('Failed to convert canvas to Blob'));
-            }
-        }, 'image/png', quality);
+function canvasToBlob(canvas_1) {
+    return __awaiter$1(this, arguments, void 0, function* (canvas, quality = 0.9) {
+        return new Promise((resolve, reject) => {
+            canvas.toBlob((blob) => {
+                if (blob) {
+                    resolve(blob);
+                }
+                else {
+                    reject(new Error('Failed to convert canvas to Blob'));
+                }
+            }, 'image/png', quality);
+        });
     });
 }
 /**
@@ -16910,51 +17180,53 @@ function mergeReplayConfig(userConfig, backendSettings) {
  * @param apiKey - Optional API key for authentication
  * @returns Replay quality settings with defaults applied
  */
-async function fetchReplaySettings(endpoint, apiKey) {
-    var _a, _b, _c, _d, _e, _f, _g, _h;
-    const defaults = {
-        duration: DEFAULT_REPLAY_DURATION_SECONDS,
-        inline_stylesheets: true,
-        inline_images: false,
-        collect_fonts: true,
-        record_canvas: false,
-        record_cross_origin_iframes: false,
-        sampling_mousemove: DEFAULT_MOUSEMOVE_SAMPLING,
-        sampling_scroll: DEFAULT_SCROLL_SAMPLING,
-    };
-    try {
-        const apiBaseUrl = getApiBaseUrl(endpoint);
-        const headers = {};
-        if (apiKey) {
-            headers['x-api-key'] = apiKey;
-        }
-        const response = await fetch(`${apiBaseUrl}/api/v1/settings/replay`, {
-            headers,
-        });
-        if (!response.ok) {
-            logger.warn(`Failed to fetch replay settings: ${response.status}. Using defaults.`);
-            return defaults;
+function fetchReplaySettings(endpoint, apiKey) {
+    return __awaiter$1(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d, _e, _f, _g, _h;
+        const defaults = {
+            duration: DEFAULT_REPLAY_DURATION_SECONDS,
+            inline_stylesheets: true,
+            inline_images: false,
+            collect_fonts: true,
+            record_canvas: false,
+            record_cross_origin_iframes: false,
+            sampling_mousemove: DEFAULT_MOUSEMOVE_SAMPLING,
+            sampling_scroll: DEFAULT_SCROLL_SAMPLING,
+        };
+        try {
+            const apiBaseUrl = getApiBaseUrl(endpoint);
+            const headers = {};
+            if (apiKey) {
+                headers['x-api-key'] = apiKey;
+            }
+            const response = yield fetch(`${apiBaseUrl}/api/v1/settings/replay`, {
+                headers,
+            });
+            if (!response.ok) {
+                logger.warn(`Failed to fetch replay settings: ${response.status}. Using defaults.`);
+                return defaults;
+            }
+            const result = yield response.json();
+            if (!result.success || !result.data) {
+                logger.warn('Invalid replay settings response. Using defaults.');
+                return defaults;
+            }
+            return {
+                duration: (_a = result.data.duration) !== null && _a !== void 0 ? _a : defaults.duration,
+                inline_stylesheets: (_b = result.data.inline_stylesheets) !== null && _b !== void 0 ? _b : defaults.inline_stylesheets,
+                inline_images: (_c = result.data.inline_images) !== null && _c !== void 0 ? _c : defaults.inline_images,
+                collect_fonts: (_d = result.data.collect_fonts) !== null && _d !== void 0 ? _d : defaults.collect_fonts,
+                record_canvas: (_e = result.data.record_canvas) !== null && _e !== void 0 ? _e : defaults.record_canvas,
+                record_cross_origin_iframes: (_f = result.data.record_cross_origin_iframes) !== null && _f !== void 0 ? _f : defaults.record_cross_origin_iframes,
+                sampling_mousemove: (_g = result.data.sampling_mousemove) !== null && _g !== void 0 ? _g : defaults.sampling_mousemove,
+                sampling_scroll: (_h = result.data.sampling_scroll) !== null && _h !== void 0 ? _h : defaults.sampling_scroll,
+            };
         }
-        const result = await response.json();
-        if (!result.success || !result.data) {
-            logger.warn('Invalid replay settings response. Using defaults.');
+        catch (error) {
+            logger.warn('Failed to fetch replay settings from backend. Using defaults.', error);
             return defaults;
         }
-        return {
-            duration: (_a = result.data.duration) !== null && _a !== void 0 ? _a : defaults.duration,
-            inline_stylesheets: (_b = result.data.inline_stylesheets) !== null && _b !== void 0 ? _b : defaults.inline_stylesheets,
-            inline_images: (_c = result.data.inline_images) !== null && _c !== void 0 ? _c : defaults.inline_images,
-            collect_fonts: (_d = result.data.collect_fonts) !== null && _d !== void 0 ? _d : defaults.collect_fonts,
-            record_canvas: (_e = result.data.record_canvas) !== null && _e !== void 0 ? _e : defaults.record_canvas,
-            record_cross_origin_iframes: (_f = result.data.record_cross_origin_iframes) !== null && _f !== void 0 ? _f : defaults.record_cross_origin_iframes,
-            sampling_mousemove: (_g = result.data.sampling_mousemove) !== null && _g !== void 0 ? _g : defaults.sampling_mousemove,
-            sampling_scroll: (_h = result.data.sampling_scroll) !== null && _h !== void 0 ? _h : defaults.sampling_scroll,
-        };
-    }
-    catch (error) {
-        logger.warn('Failed to fetch replay settings from backend. Using defaults.', error);
-        return defaults;
-    }
+    });
 }
 class BugSpotter {
     constructor(config) {
@@ -16982,55 +17254,59 @@ class BugSpotter {
         const widgetEnabled = (_f = config.showWidget) !== null && _f !== void 0 ? _f : true;
         if (widgetEnabled) {
             this.widget = new FloatingButton(config.widgetOptions);
-            this.widget.onClick(async () => {
-                await this.handleBugReport();
-            });
-        }
-    }
-    static async init(config) {
-        // If instance exists, warn about singleton behavior
-        if (BugSpotter.instance) {
-            logger.warn('BugSpotter.init() called multiple times. Returning existing instance. ' +
-                'Call destroy() first to reinitialize with new config.');
-            return BugSpotter.instance;
-        }
-        // If initialization is already in progress, wait for it
-        if (BugSpotter.initPromise) {
-            logger.warn('BugSpotter.init() called while initialization in progress. Waiting...');
-            return BugSpotter.initPromise;
-        }
-        // Start initialization and cache the promise
-        BugSpotter.initPromise = BugSpotter.createInstance(config);
-        try {
-            BugSpotter.instance = await BugSpotter.initPromise;
-            return BugSpotter.instance;
-        }
-        finally {
-            // Clear the promise once initialization completes (success or failure)
-            BugSpotter.initPromise = undefined;
-        }
+            this.widget.onClick(() => __awaiter$1(this, void 0, void 0, function* () {
+                yield this.handleBugReport();
+            }));
+        }
+    }
+    static init(config) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            // If instance exists, warn about singleton behavior
+            if (BugSpotter.instance) {
+                logger.warn('BugSpotter.init() called multiple times. Returning existing instance. ' +
+                    'Call destroy() first to reinitialize with new config.');
+                return BugSpotter.instance;
+            }
+            // If initialization is already in progress, wait for it
+            if (BugSpotter.initPromise) {
+                logger.warn('BugSpotter.init() called while initialization in progress. Waiting...');
+                return BugSpotter.initPromise;
+            }
+            // Start initialization and cache the promise
+            BugSpotter.initPromise = BugSpotter.createInstance(config);
+            try {
+                BugSpotter.instance = yield BugSpotter.initPromise;
+                return BugSpotter.instance;
+            }
+            finally {
+                // Clear the promise once initialization completes (success or failure)
+                BugSpotter.initPromise = undefined;
+            }
+        });
     }
     /**
      * Internal factory method to create a new BugSpotter instance
      * Fetches replay settings from backend before initialization
      */
-    static async createInstance(config) {
-        var _a, _b, _c;
-        // Fetch replay quality settings from backend if replay is enabled
-        let backendSettings = null;
-        const replayEnabled = (_b = (_a = config.replay) === null || _a === void 0 ? void 0 : _a.enabled) !== null && _b !== void 0 ? _b : true;
-        if (replayEnabled && config.endpoint) {
-            // Validate auth is configured before attempting fetch
-            if (!((_c = config.auth) === null || _c === void 0 ? void 0 : _c.apiKey)) {
-                logger.warn('Endpoint provided but no API key configured. Skipping backend settings fetch.');
-            }
-            else {
-                backendSettings = await fetchReplaySettings(config.endpoint, config.auth.apiKey);
+    static createInstance(config) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            // Fetch replay quality settings from backend if replay is enabled
+            let backendSettings = null;
+            const replayEnabled = (_b = (_a = config.replay) === null || _a === void 0 ? void 0 : _a.enabled) !== null && _b !== void 0 ? _b : true;
+            if (replayEnabled && config.endpoint) {
+                // Validate auth is configured before attempting fetch
+                if (!((_c = config.auth) === null || _c === void 0 ? void 0 : _c.apiKey)) {
+                    logger.warn('Endpoint provided but no API key configured. Skipping backend settings fetch.');
+                }
+                else {
+                    backendSettings = yield fetchReplaySettings(config.endpoint, config.auth.apiKey);
+                }
             }
-        }
-        // Merge backend settings with user config (user config takes precedence)
-        const mergedConfig = Object.assign(Object.assign({}, config), { replay: mergeReplayConfig(config.replay, backendSettings) });
-        return new BugSpotter(mergedConfig);
+            // Merge backend settings with user config (user config takes precedence)
+            const mergedConfig = Object.assign(Object.assign({}, config), { replay: mergeReplayConfig(config.replay, backendSettings) });
+            return new BugSpotter(mergedConfig);
+        });
     }
     static getInstance() {
         return BugSpotter.instance || null;
@@ -17040,40 +17316,46 @@ class BugSpotter {
      * Note: Screenshot is captured for modal preview only (_screenshotPreview)
      * File uploads use presigned URLs returned from the backend
      */
-    async capture() {
-        return await this.captureManager.captureAll();
-    }
-    async handleBugReport() {
-        const report = await this.capture();
-        const modal = new BugReportModal({
-            onSubmit: async (data) => {
-                logger.log('Submitting bug:', Object.assign(Object.assign({}, data), { report }));
-                // Send to endpoint if configured
-                if (this.config.endpoint) {
-                    try {
-                        await this.submit(Object.assign(Object.assign({}, data), { report }));
-                        logger.log('Bug report submitted successfully');
-                    }
-                    catch (error) {
-                        logger.error('Failed to submit bug report:', error);
-                        // Re-throw to allow UI to handle errors if needed
-                        throw error;
+    capture() {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            return yield this.captureManager.captureAll();
+        });
+    }
+    handleBugReport() {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            const report = yield this.capture();
+            const modal = new BugReportModal({
+                onSubmit: (data) => __awaiter$1(this, void 0, void 0, function* () {
+                    logger.log('Submitting bug:', Object.assign(Object.assign({}, data), { report }));
+                    // Send to endpoint if configured
+                    if (this.config.endpoint) {
+                        try {
+                            yield this.submit(Object.assign(Object.assign({}, data), { report }));
+                            logger.log('Bug report submitted successfully');
+                        }
+                        catch (error) {
+                            logger.error('Failed to submit bug report:', error);
+                            // Re-throw to allow UI to handle errors if needed
+                            throw error;
+                        }
                     }
-                }
-            },
-            onProgress: (message) => {
-                logger.debug('Upload progress:', message);
-            },
+                }),
+                onProgress: (message) => {
+                    logger.debug('Upload progress:', message);
+                },
+            });
+            modal.show(report._screenshotPreview || '');
         });
-        modal.show(report._screenshotPreview || '');
     }
     /**
      * Submit a bug report with file uploads via presigned URLs
      * @param payload - Bug report payload with title, description, and report data
      * @public - Exposed for programmatic submission (bypassing modal)
      */
-    async submit(payload) {
-        await this.bugReporter.submit(payload);
+    submit(payload) {
+        return __awaiter$1(this, void 0, void 0, function* () {
+            yield this.bugReporter.submit(payload);
+        });
     }
     getConfig() {
         return Object.assign({}, this.config);
@@ -17110,5 +17392,5 @@ function sanitize(text) {
     return sanitizer.sanitize(text);
 }
-export { BugReportModal, BugSpotter, CircularBuffer, ConsoleCapture, DEFAULT_PATTERNS, DEFAULT_REPLAY_DURATION_SECONDS, DOMCollector, DirectUploader, FloatingButton, InvalidEndpointError, MAX_RECOMMENDED_REPLAY_DURATION_SECONDS, MetadataCapture, NetworkCapture, PATTERN_CATEGORIES, PATTERN_PRESETS, PatternBuilder, Sanitizer, ScreenshotCapture, VERSION, canvasToBlob, clearOfflineQueue, compressData, compressImage, compressReplayEvents, configureLogger, createLogger, createPatternConfig, createSanitizer, decompressData, estimateCompressedReplaySize, estimateSize, getApiBaseUrl, getAuthHeaders, getCompressionRatio, getLogger, getPattern, getPatternsByCategory, isWithinSizeLimit, sanitize, stripEndpointSuffix, submitWithAuth, validateAuthConfig, validatePattern };
+export { BugReportModal, BugSpotter, CircularBuffer, ConsoleCapture, DEFAULT_PATTERNS, DEFAULT_REPLAY_DURATION_SECONDS, DOMCollector, DirectUploader, FloatingButton, InvalidEndpointError, MAX_RECOMMENDED_REPLAY_DURATION_SECONDS, MetadataCapture, NetworkCapture, PATTERN_CATEGORIES, PATTERN_PRESETS, PatternBuilder, Sanitizer, ScreenshotCapture, VERSION, canvasToBlob, clearOfflineQueue, compressData, compressImage, compressReplayEvents, configureLogger, createLogger, createPatternConfig, createSanitizer, decompressData, BugSpotter as default, estimateCompressedReplaySize, estimateSize, getApiBaseUrl, getAuthHeaders, getCompressionRatio, getLogger, getPattern, getPatternsByCategory, isWithinSizeLimit, sanitize, stripEndpointSuffix, submitWithAuth, validateAuthConfig, validatePattern };
 //# sourceMappingURL=index.esm.js.map