@buoy-gg/network 7.0.35 → 7.0.36

package/lib/commonjs/network/sync/networkSyncAdapter.js

@@ -311,13 +311,116 @@ base) {
     headers: rule.headers && typeof rule.headers === "object" ? rule.headers : base?.headers,
     // Objects are accepted and serialized so a caller can send JSON directly
     // instead of pre-stringifying it, which is the mistake everyone makes once.
-    body: typeof rule.body === "string" ? rule.body : rule.body != null ? JSON.stringify(rule.body, null, 2) : base?.body,
+    body: patchedBody(rule, base),
     failKind: rule.failKind === "timeout" ? "timeout" : undefined,
     delayMs: typeof rule.delayMs === "number" ? rule.delayMs : undefined,
     times: typeof rule.times === "number" ? rule.times : null,
     alternate: rule.alternate === true
   };
 }
+const isPlainObject = v => !!v && typeof v === "object" && !Array.isArray(v);
+/**
+ * Objects merge key by key; arrays and primitives are replaced. Collects two
+ * dangers instead of writing them: `shrunk` (a non-empty array shorter than
+ * the one it replaces) and `breaks` (an array/object field overwritten by null
+ * or a primitive — the shape the app renders, changed out from under it). The
+ * handler refuses either unless forced.
+ *
+ * This stays local while the typed-edit RULE is shared: it is the merge itself,
+ * not the check, and it reports network-specific dangers the store surfaces do
+ * not have. `shapeKind` comes from the shared module so both agree on what
+ * counts as an array.
+ */
+function deepMerge(base, patch, path = "", issues = {
+  shrunk: [],
+  breaks: []
+}) {
+  if (Array.isArray(base) && Array.isArray(patch)) {
+    if (patch.length > 0 && patch.length < base.length) {
+      issues.shrunk.push({
+        path: path || "(root)",
+        have: base.length,
+        sent: patch.length
+      });
+    }
+    return patch;
+  }
+  if (!isPlainObject(base) || !isPlainObject(patch)) return patch;
+  const out = {
+    ...base
+  };
+  for (const [k, v] of Object.entries(patch)) {
+    const p = path ? `${path}.${k}` : k;
+    if (k in base) {
+      const from = (0, _sharedUi.shapeKind)(base[k]);
+      const to = (0, _sharedUi.shapeKind)(v);
+      if ((from === "array" || from === "object") && from !== to) {
+        issues.breaks.push({
+          path: p,
+          from,
+          to
+        });
+      }
+      out[k] = deepMerge(base[k], v, p, issues);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+
+/** Typed-edit violations a bodyPatch would cause against the seed body, or []. */
+function patchViolations(rule, seed) {
+  if (rule.body != null || !isPlainObject(rule.bodyPatch) || typeof seed !== "string") return [];
+  try {
+    return (0, _sharedUi.typedEditViolations)(JSON.parse(seed), rule.bodyPatch, {
+      noun: "response body"
+    });
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * The rule's body: explicit `body` wins, else `bodyPatch` deep-merged into the
+ * seeded body (from `fromRequestId`, or the rule being replaced), else the seed.
+ *
+ * `bodyPatch` exists for the same reason `setQueryData` has `merge`: a remote
+ * caller reads the real response through a wire that truncates big payloads,
+ * edits one field, and pastes the torn object back as `body`. The app then
+ * renders a response missing half its fields. With a patch the caller sends
+ * `{ stats: [...] }` and the other 30KB stay exactly as the server sent them.
+ */
+function patchedBody(rule, base) {
+  if (typeof rule.body === "string") return rule.body;
+  if (rule.body != null) return JSON.stringify(rule.body, null, 2);
+  const seed = base?.body ?? (typeof rule.id === "string" ? _overrideRulesStore.overrideRulesStore.getState().rules.find(r => r.id === rule.id)?.body : undefined);
+  if (isPlainObject(rule.bodyPatch) && typeof seed === "string") {
+    try {
+      return JSON.stringify(deepMerge(JSON.parse(seed), rule.bodyPatch), null, 2);
+    } catch {
+      return seed;
+    }
+  }
+  return seed;
+}
+
+/**
+ * Replacing a rule by id inherits every field the caller did not send, so a
+ * remote driver can flip one thing — `{ id, bodyPatch }`, `{ id, status: 500 }`
+ * — without re-sending the urlPattern it never had to know.
+ */
+function existingRule(params) {
+  if (!params || typeof params !== "object") return null;
+  const raw = params.rule ?? params;
+  if (!raw || typeof raw !== "object") return null;
+  const id = raw.id;
+  if (typeof id !== "string") return null;
+  const existing = _overrideRulesStore.overrideRulesStore.getState().rules.find(r => r.id === id);
+  return existing ? {
+    ...existing
+  } : null;
+}
 
 /**
  * The body a remote surface never received, when it says so.
@@ -511,7 +614,89 @@ const networkSyncAdapter = exports.networkSyncAdapter = {
     },
     /** Create a rule, or replace one by id. */
     upsertOverrideRule: params => {
-      const base = baseFromRequest(params) ?? preservedBody(params);
+      const base = baseFromRequest(params) ?? preservedBody(params) ?? existingRule(params);
+      const rawRule = params?.rule ?? params;
+      // `bodyPath` + `bodyValue` are sugar over `bodyPatch`, resolved against the
+      // real response before anything else looks at the rule — so the keyed
+      // expansion, the typed-edit guard and the merge below all run on an
+      // ordinary patch and gain no special cases. This is the same form the
+      // state tools take; it exists here because a response body is the surface
+      // where the caller is LEAST likely to have seen the shape (it read the
+      // body over a wire that truncates at 24,000 characters), and therefore
+      // most likely to get the nesting wrong.
+      if (rawRule && typeof rawRule.bodyPath === "string" && rawRule.body == null) {
+        const seed = base?.body ?? (typeof rawRule.id === "string" ? _overrideRulesStore.overrideRulesStore.getState().rules.find(r => r.id === rawRule.id)?.body : undefined);
+        if (typeof seed !== "string") {
+          return {
+            ok: false,
+            error: "bodyPath needs something to patch: send fromRequestId (the captured request whose real response it addresses) or the id of an existing rule."
+          };
+        }
+        if (rawRule.bodyValue === undefined) {
+          return {
+            ok: false,
+            error: `Refused: sent \`bodyPath\` without \`bodyValue\`. Say what to set "${rawRule.bodyPath}" to.`
+          };
+        }
+        let parsed;
+        try {
+          parsed = JSON.parse(seed);
+        } catch {
+          return {
+            ok: false,
+            error: "The captured response body is not JSON, so it cannot be addressed by path. Send a whole `body` instead."
+          };
+        }
+        const built = (0, _sharedUi.patchFromPath)(parsed, rawRule.bodyPath, rawRule.bodyValue);
+        if (!built.ok) return {
+          ok: false,
+          error: `Refused: ${built.error}`
+        };
+        rawRule.bodyPatch = built.patch;
+        delete rawRule.bodyPath;
+        delete rawRule.bodyValue;
+      }
+      if (rawRule && isPlainObject(rawRule.bodyPatch) && rawRule.body == null) {
+        const seed = base?.body ?? (typeof rawRule.id === "string" ? _overrideRulesStore.overrideRulesStore.getState().rules.find(r => r.id === rawRule.id)?.body : undefined);
+        if (typeof seed !== "string") {
+          return {
+            ok: false,
+            error: "bodyPatch needs something to patch: send fromRequestId (the captured request whose real response the patch is merged into) or the id of an existing rule."
+          };
+        }
+        if (rawRule.force !== true) {
+          // Address list items in the real response by their own id rather than
+          // resending the array: {results:{pikachu:{name:"test123"}}}. Expanded
+          // against the seed BEFORE the guard and before the merge, so the
+          // typed-edit rule still holds over the result. This is the only form
+          // that is correct when the caller read the response through a wire
+          // that truncated it — see packages/shared/src/sync/keyedArrays.ts.
+          let keyedError;
+          try {
+            const expanded = (0, _sharedUi.expandKeyedArrays)(JSON.parse(seed), rawRule.bodyPatch);
+            keyedError = expanded.error;
+            if (expanded.notes.length) rawRule.bodyPatch = expanded.patch;
+          } catch {
+            /* a non-JSON seed has no lists to address; leave the patch alone */
+          }
+          // See keyedArrays.ts: an added item whose id disagrees with the key
+          // it was sent under is ambiguous, and only this layer can say so.
+          if (keyedError) {
+            return {
+              ok: false,
+              error: `Refused: ${keyedError}`
+            };
+          }
+          const violations = patchViolations(rawRule, seed);
+          if (violations.length > 0) {
+            return {
+              ok: false,
+              error: (0, _sharedUi.refusalText)(violations, "response body", (0, _sharedUi.suggestedPatch)(rawRule.bodyPatch, violations)),
+              violations
+            };
+          }
+        }
+      }
       const draft = readRuleDraft(params, base);
       if (!draft) {
         const wanted = params?.fromRequestId;
@@ -541,8 +726,19 @@ const networkSyncAdapter = exports.networkSyncAdapter = {
           enabled: rule.enabled,
           kind: rule.kind,
           status: rule.status,
+          times: rule.times,
           bodySize: rule.body ? rule.body.length : 0
         },
+        // A rule with no budget overrides EVERY matching request until someone
+        // deletes it, and that is rarely what a one-off ask meant. Measured on
+        // `api-sim/next-call-fails-once` ("just the next one, then let it work
+        // again"): ten of fourteen attempts left the budget off and got a rule
+        // that never expires. Saying so is not a nag — it is the difference
+        // between a caller that adds `times` on its next turn and one that walks
+        // away leaving the app permanently broken.
+        ...(rule.times === undefined || rule.times === null ? {
+          lingers: `This rule has no \`times\` budget, so it overrides EVERY matching request until it is disabled or deleted (id \`${rule.id}\`). If you meant only the next one, set times:1.`
+        } : {}),
         ...inactiveStamp()
       };
     },

package/lib/commonjs/network/utils/networkListener.js

@@ -71,6 +71,46 @@ const BUOY_XHR_INTERCEPTOR_FLAG = exports.BUOY_XHR_INTERCEPTOR_FLAG = "__buoyNet
  * @performance Uses lazy singleton pattern to minimize memory footprint
  * @performance Includes URL filtering to ignore development traffic
  */
+/**
+ * Hosts another Buoy package has claimed as its own traffic.
+ *
+ * A GLOBAL, not an import: `@buoy-gg/network` cannot depend on `agent-core`
+ * (Ask Buoy is optional and this package is older), and `agent-core` ships
+ * with no dependencies at all. `registerSelfEndpoint` in agent-core writes the
+ * set; this reads it. Absent, undefined or the wrong shape all mean "nothing
+ * to exclude", so nothing breaks in an app without Ask Buoy.
+ *
+ * WHY IT IS NOT ENOUGH TO FILTER LATER. The interceptor reads the response
+ * body — `await processResponseBody(response.clone())` — BEFORE handing the
+ * response back. On a streamed reply that resolves only at EOF, so an
+ * intercepted model endpoint delivers its whole answer at once and Ask Buoy
+ * cannot stream a word. Ignoring the URL is what keeps the socket the
+ * caller's. It also keeps override rules off model traffic, which a broad
+ * user-authored rule would otherwise rewrite.
+ */
+/**
+ * Content types whose body arrives over time rather than all at once.
+ *
+ * These are the ones where reading the clone before returning the response
+ * changes the CALLER's behaviour instead of merely observing it.
+ */
+const STREAMED_CONTENT_TYPES = ["text/event-stream", "application/x-ndjson", "application/stream+json"];
+const STREAMING_PLACEHOLDER = "[streaming\u2026]";
+function isStreamedContentType(contentType) {
+  if (!contentType) return false;
+  const lower = contentType.toLowerCase();
+  return STREAMED_CONTENT_TYPES.some(t => lower.includes(t));
+}
+const INTERNAL_HOSTS_KEY = "__BUOY_INTERNAL_HOSTS__";
+function isInternalBuoyHost(url) {
+  const hosts = globalThis[INTERNAL_HOSTS_KEY];
+  if (!(hosts instanceof Set) || hosts.size === 0) return false;
+  const lower = url.toLowerCase();
+  for (const host of hosts) {
+    if (typeof host === "string" && host && lower.includes(host)) return true;
+  }
+  return false;
+}
 class NetworkListener {
   listeners = [];
   isListening = false;
@@ -121,7 +161,8 @@ class NetworkListener {
    * @returns True if the URL should be ignored
    */
   shouldIgnoreUrl(url) {
-    return this.ignoredUrls.some(pattern => pattern.test(url));
+    if (this.ignoredUrls.some(pattern => pattern.test(url))) return true;
+    return isInternalBuoyHost(url);
   }
 
   // Emit event to all listeners
@@ -167,6 +208,70 @@ class NetworkListener {
    * @param maxSize - Maximum body size in bytes (default: 1MB)
    * @returns Object containing body, size, and truncation status
    */
+  /**
+   * Read a streamed body in the background, with a hard ceiling.
+   *
+   * Deliberately not `processResponseBody`: that one calls `.text()`, which
+   * accumulates the WHOLE body before it checks the size, so a long-lived SSE
+   * stream would grow unbounded in memory with nothing to stop it. This stops
+   * at the cap and cancels the reader, and a runtime with no `body` (React
+   * Native's own fetch) falls back to `.text()` — that response was never
+   * streaming there in the first place.
+   */
+  async readStreamedBody(response, maxSize = 256 * 1024) {
+    const body = response.body;
+    if (!body || typeof body.getReader !== "function") {
+      const text = await response.text();
+      return text.length > maxSize ? {
+        body: `${text.slice(0, maxSize)}\n\n... [truncated]`,
+        size: text.length
+      } : {
+        body: text,
+        size: text.length
+      };
+    }
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let out = "";
+    let size = 0;
+    let capped = false;
+    try {
+      for (;;) {
+        const {
+          done,
+          value
+        } = await reader.read();
+        if (done) break;
+        size += value?.byteLength ?? 0;
+        if (!capped) {
+          out += decoder.decode(value, {
+            stream: true
+          });
+          if (out.length >= maxSize) {
+            out = `${out.slice(0, maxSize)}\n\n... [truncated]`;
+            capped = true;
+            break;
+          }
+        }
+      }
+      if (!capped) out += decoder.decode();
+    } finally {
+      try {
+        void Promise.resolve(reader.cancel()).catch(() => {});
+      } catch {
+        /* already gone */
+      }
+      try {
+        reader.releaseLock();
+      } catch {
+        /* already released */
+      }
+    }
+    return {
+      body: out,
+      size
+    };
+  }
   async processResponseBody(response, maxSize = 1024 * 1024 // 1MB default
   ) {
     try {
@@ -544,6 +649,8 @@ class NetworkListener {
       }
 
       // Parse request body
+      // Explicitly typed: the late emit for a streamed reply reads this from
+      // inside a callback, which defeats the inference it used to rely on.
       let requestData;
       if (init?.body) {
         if (typeof init.body === "string") {
@@ -612,12 +719,29 @@ class NetworkListener {
         // look faster through fetch than through XHR.
         const ttfb = Date.now() - startTime;
 
+        /**
+         * A STREAMED reply is never awaited here.
+         *
+         * `processResponseBody` reads the clone to the end, and for
+         * `text/event-stream` the end is when the server finishes — seconds
+         * later, for an LLM. Awaiting it made the interceptor hold the
+         * response back until then, so every consumer of a streaming endpoint
+         * inside an app with capture on received the whole thing at once and
+         * could not stream a word of it. The row is emitted now with what is
+         * known, and the body is filled in when the stream closes: the store
+         * merges a second `response` event onto the same request id.
+         */
+        const streamed = isStreamedContentType(response.headers?.get?.("content-type"));
+
         // Clone response to read body with size limits
         const responseClone = response.clone();
         const {
           body,
           size: responseSize
-        } = await self.processResponseBody(responseClone);
+        } = streamed ? {
+          body: STREAMING_PLACEHOLDER,
+          size: 0
+        } : await self.processResponseBody(responseClone);
 
         // Now the body is in — this is the comparable, total number.
         const duration = Date.now() - startTime;
@@ -676,6 +800,36 @@ class NetworkListener {
           },
           override
         });
+        if (streamed) {
+          // Bounded, cancelled at the cap, and never awaited by the caller.
+          void self.readStreamedBody(responseClone).then(late => {
+            self.emit({
+              type: "response",
+              timestamp: new Date(),
+              duration: Date.now() - startTime,
+              timings,
+              request: {
+                id: requestId || "unknown",
+                url: cleanUrl,
+                method,
+                headers: requestHeaders,
+                data: requestData,
+                params: params || undefined,
+                client: clientType
+              },
+              response: {
+                status: response.status,
+                statusText: response.statusText,
+                headers: responseHeaders,
+                body: late.body,
+                size: late.size
+              },
+              override
+            });
+          }).catch(() => {
+            /* the caller's response is unaffected either way */
+          });
+        }
         return response;
       } catch (error) {
         const duration = Date.now() - startTime;

package/lib/module/network/sync/networkSyncAdapter.js

@@ -7,6 +7,7 @@ import { draftFromEvent } from "../overrides/presets";
 import { inspectEngine, overridesCanApply, OVERRIDES_INACTIVE_REASON } from "../overrides/engine";
 import { getNetworkListenerCount, isNetworkInterceptionLive, isNetworkListening } from "../utils/networkListener";
 import { approxJsonSize, isOverWireBudget } from "@buoy-gg/shared-ui";
+import { expandKeyedArrays, patchFromPath, refusalText, shapeKind, suggestedPatch, typedEditViolations } from "@buoy-gg/shared-ui";
 
 /**
  * Request/response bodies larger than this are NOT streamed in the list
@@ -308,13 +309,116 @@ base) {
     headers: rule.headers && typeof rule.headers === "object" ? rule.headers : base?.headers,
     // Objects are accepted and serialized so a caller can send JSON directly
     // instead of pre-stringifying it, which is the mistake everyone makes once.
-    body: typeof rule.body === "string" ? rule.body : rule.body != null ? JSON.stringify(rule.body, null, 2) : base?.body,
+    body: patchedBody(rule, base),
     failKind: rule.failKind === "timeout" ? "timeout" : undefined,
     delayMs: typeof rule.delayMs === "number" ? rule.delayMs : undefined,
     times: typeof rule.times === "number" ? rule.times : null,
     alternate: rule.alternate === true
   };
 }
+const isPlainObject = v => !!v && typeof v === "object" && !Array.isArray(v);
+/**
+ * Objects merge key by key; arrays and primitives are replaced. Collects two
+ * dangers instead of writing them: `shrunk` (a non-empty array shorter than
+ * the one it replaces) and `breaks` (an array/object field overwritten by null
+ * or a primitive — the shape the app renders, changed out from under it). The
+ * handler refuses either unless forced.
+ *
+ * This stays local while the typed-edit RULE is shared: it is the merge itself,
+ * not the check, and it reports network-specific dangers the store surfaces do
+ * not have. `shapeKind` comes from the shared module so both agree on what
+ * counts as an array.
+ */
+function deepMerge(base, patch, path = "", issues = {
+  shrunk: [],
+  breaks: []
+}) {
+  if (Array.isArray(base) && Array.isArray(patch)) {
+    if (patch.length > 0 && patch.length < base.length) {
+      issues.shrunk.push({
+        path: path || "(root)",
+        have: base.length,
+        sent: patch.length
+      });
+    }
+    return patch;
+  }
+  if (!isPlainObject(base) || !isPlainObject(patch)) return patch;
+  const out = {
+    ...base
+  };
+  for (const [k, v] of Object.entries(patch)) {
+    const p = path ? `${path}.${k}` : k;
+    if (k in base) {
+      const from = shapeKind(base[k]);
+      const to = shapeKind(v);
+      if ((from === "array" || from === "object") && from !== to) {
+        issues.breaks.push({
+          path: p,
+          from,
+          to
+        });
+      }
+      out[k] = deepMerge(base[k], v, p, issues);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+
+/** Typed-edit violations a bodyPatch would cause against the seed body, or []. */
+function patchViolations(rule, seed) {
+  if (rule.body != null || !isPlainObject(rule.bodyPatch) || typeof seed !== "string") return [];
+  try {
+    return typedEditViolations(JSON.parse(seed), rule.bodyPatch, {
+      noun: "response body"
+    });
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * The rule's body: explicit `body` wins, else `bodyPatch` deep-merged into the
+ * seeded body (from `fromRequestId`, or the rule being replaced), else the seed.
+ *
+ * `bodyPatch` exists for the same reason `setQueryData` has `merge`: a remote
+ * caller reads the real response through a wire that truncates big payloads,
+ * edits one field, and pastes the torn object back as `body`. The app then
+ * renders a response missing half its fields. With a patch the caller sends
+ * `{ stats: [...] }` and the other 30KB stay exactly as the server sent them.
+ */
+function patchedBody(rule, base) {
+  if (typeof rule.body === "string") return rule.body;
+  if (rule.body != null) return JSON.stringify(rule.body, null, 2);
+  const seed = base?.body ?? (typeof rule.id === "string" ? overrideRulesStore.getState().rules.find(r => r.id === rule.id)?.body : undefined);
+  if (isPlainObject(rule.bodyPatch) && typeof seed === "string") {
+    try {
+      return JSON.stringify(deepMerge(JSON.parse(seed), rule.bodyPatch), null, 2);
+    } catch {
+      return seed;
+    }
+  }
+  return seed;
+}
+
+/**
+ * Replacing a rule by id inherits every field the caller did not send, so a
+ * remote driver can flip one thing — `{ id, bodyPatch }`, `{ id, status: 500 }`
+ * — without re-sending the urlPattern it never had to know.
+ */
+function existingRule(params) {
+  if (!params || typeof params !== "object") return null;
+  const raw = params.rule ?? params;
+  if (!raw || typeof raw !== "object") return null;
+  const id = raw.id;
+  if (typeof id !== "string") return null;
+  const existing = overrideRulesStore.getState().rules.find(r => r.id === id);
+  return existing ? {
+    ...existing
+  } : null;
+}
 
 /**
  * The body a remote surface never received, when it says so.
@@ -508,7 +612,89 @@ export const networkSyncAdapter = {
     },
     /** Create a rule, or replace one by id. */
     upsertOverrideRule: params => {
-      const base = baseFromRequest(params) ?? preservedBody(params);
+      const base = baseFromRequest(params) ?? preservedBody(params) ?? existingRule(params);
+      const rawRule = params?.rule ?? params;
+      // `bodyPath` + `bodyValue` are sugar over `bodyPatch`, resolved against the
+      // real response before anything else looks at the rule — so the keyed
+      // expansion, the typed-edit guard and the merge below all run on an
+      // ordinary patch and gain no special cases. This is the same form the
+      // state tools take; it exists here because a response body is the surface
+      // where the caller is LEAST likely to have seen the shape (it read the
+      // body over a wire that truncates at 24,000 characters), and therefore
+      // most likely to get the nesting wrong.
+      if (rawRule && typeof rawRule.bodyPath === "string" && rawRule.body == null) {
+        const seed = base?.body ?? (typeof rawRule.id === "string" ? overrideRulesStore.getState().rules.find(r => r.id === rawRule.id)?.body : undefined);
+        if (typeof seed !== "string") {
+          return {
+            ok: false,
+            error: "bodyPath needs something to patch: send fromRequestId (the captured request whose real response it addresses) or the id of an existing rule."
+          };
+        }
+        if (rawRule.bodyValue === undefined) {
+          return {
+            ok: false,
+            error: `Refused: sent \`bodyPath\` without \`bodyValue\`. Say what to set "${rawRule.bodyPath}" to.`
+          };
+        }
+        let parsed;
+        try {
+          parsed = JSON.parse(seed);
+        } catch {
+          return {
+            ok: false,
+            error: "The captured response body is not JSON, so it cannot be addressed by path. Send a whole `body` instead."
+          };
+        }
+        const built = patchFromPath(parsed, rawRule.bodyPath, rawRule.bodyValue);
+        if (!built.ok) return {
+          ok: false,
+          error: `Refused: ${built.error}`
+        };
+        rawRule.bodyPatch = built.patch;
+        delete rawRule.bodyPath;
+        delete rawRule.bodyValue;
+      }
+      if (rawRule && isPlainObject(rawRule.bodyPatch) && rawRule.body == null) {
+        const seed = base?.body ?? (typeof rawRule.id === "string" ? overrideRulesStore.getState().rules.find(r => r.id === rawRule.id)?.body : undefined);
+        if (typeof seed !== "string") {
+          return {
+            ok: false,
+            error: "bodyPatch needs something to patch: send fromRequestId (the captured request whose real response the patch is merged into) or the id of an existing rule."
+          };
+        }
+        if (rawRule.force !== true) {
+          // Address list items in the real response by their own id rather than
+          // resending the array: {results:{pikachu:{name:"test123"}}}. Expanded
+          // against the seed BEFORE the guard and before the merge, so the
+          // typed-edit rule still holds over the result. This is the only form
+          // that is correct when the caller read the response through a wire
+          // that truncated it — see packages/shared/src/sync/keyedArrays.ts.
+          let keyedError;
+          try {
+            const expanded = expandKeyedArrays(JSON.parse(seed), rawRule.bodyPatch);
+            keyedError = expanded.error;
+            if (expanded.notes.length) rawRule.bodyPatch = expanded.patch;
+          } catch {
+            /* a non-JSON seed has no lists to address; leave the patch alone */
+          }
+          // See keyedArrays.ts: an added item whose id disagrees with the key
+          // it was sent under is ambiguous, and only this layer can say so.
+          if (keyedError) {
+            return {
+              ok: false,
+              error: `Refused: ${keyedError}`
+            };
+          }
+          const violations = patchViolations(rawRule, seed);
+          if (violations.length > 0) {
+            return {
+              ok: false,
+              error: refusalText(violations, "response body", suggestedPatch(rawRule.bodyPatch, violations)),
+              violations
+            };
+          }
+        }
+      }
       const draft = readRuleDraft(params, base);
       if (!draft) {
         const wanted = params?.fromRequestId;
@@ -538,8 +724,19 @@ export const networkSyncAdapter = {
           enabled: rule.enabled,
           kind: rule.kind,
           status: rule.status,
+          times: rule.times,
           bodySize: rule.body ? rule.body.length : 0
         },
+        // A rule with no budget overrides EVERY matching request until someone
+        // deletes it, and that is rarely what a one-off ask meant. Measured on
+        // `api-sim/next-call-fails-once` ("just the next one, then let it work
+        // again"): ten of fourteen attempts left the budget off and got a rule
+        // that never expires. Saying so is not a nag — it is the difference
+        // between a caller that adds `times` on its next turn and one that walks
+        // away leaving the app permanently broken.
+        ...(rule.times === undefined || rule.times === null ? {
+          lingers: `This rule has no \`times\` budget, so it overrides EVERY matching request until it is disabled or deleted (id \`${rule.id}\`). If you meant only the next one, set times:1.`
+        } : {}),
         ...inactiveStamp()
       };
     },

package/lib/module/network/utils/networkListener.js

@@ -68,6 +68,46 @@ export const BUOY_XHR_INTERCEPTOR_FLAG = "__buoyNetworkXhrIntercepted";
  * @performance Uses lazy singleton pattern to minimize memory footprint
  * @performance Includes URL filtering to ignore development traffic
  */
+/**
+ * Hosts another Buoy package has claimed as its own traffic.
+ *
+ * A GLOBAL, not an import: `@buoy-gg/network` cannot depend on `agent-core`
+ * (Ask Buoy is optional and this package is older), and `agent-core` ships
+ * with no dependencies at all. `registerSelfEndpoint` in agent-core writes the
+ * set; this reads it. Absent, undefined or the wrong shape all mean "nothing
+ * to exclude", so nothing breaks in an app without Ask Buoy.
+ *
+ * WHY IT IS NOT ENOUGH TO FILTER LATER. The interceptor reads the response
+ * body — `await processResponseBody(response.clone())` — BEFORE handing the
+ * response back. On a streamed reply that resolves only at EOF, so an
+ * intercepted model endpoint delivers its whole answer at once and Ask Buoy
+ * cannot stream a word. Ignoring the URL is what keeps the socket the
+ * caller's. It also keeps override rules off model traffic, which a broad
+ * user-authored rule would otherwise rewrite.
+ */
+/**
+ * Content types whose body arrives over time rather than all at once.
+ *
+ * These are the ones where reading the clone before returning the response
+ * changes the CALLER's behaviour instead of merely observing it.
+ */
+const STREAMED_CONTENT_TYPES = ["text/event-stream", "application/x-ndjson", "application/stream+json"];
+const STREAMING_PLACEHOLDER = "[streaming\u2026]";
+function isStreamedContentType(contentType) {
+  if (!contentType) return false;
+  const lower = contentType.toLowerCase();
+  return STREAMED_CONTENT_TYPES.some(t => lower.includes(t));
+}
+const INTERNAL_HOSTS_KEY = "__BUOY_INTERNAL_HOSTS__";
+function isInternalBuoyHost(url) {
+  const hosts = globalThis[INTERNAL_HOSTS_KEY];
+  if (!(hosts instanceof Set) || hosts.size === 0) return false;
+  const lower = url.toLowerCase();
+  for (const host of hosts) {
+    if (typeof host === "string" && host && lower.includes(host)) return true;
+  }
+  return false;
+}
 class NetworkListener {
   listeners = [];
   isListening = false;
@@ -118,7 +158,8 @@ class NetworkListener {
    * @returns True if the URL should be ignored
    */
   shouldIgnoreUrl(url) {
-    return this.ignoredUrls.some(pattern => pattern.test(url));
+    if (this.ignoredUrls.some(pattern => pattern.test(url))) return true;
+    return isInternalBuoyHost(url);
   }
 
   // Emit event to all listeners
@@ -164,6 +205,70 @@ class NetworkListener {
    * @param maxSize - Maximum body size in bytes (default: 1MB)
    * @returns Object containing body, size, and truncation status
    */
+  /**
+   * Read a streamed body in the background, with a hard ceiling.
+   *
+   * Deliberately not `processResponseBody`: that one calls `.text()`, which
+   * accumulates the WHOLE body before it checks the size, so a long-lived SSE
+   * stream would grow unbounded in memory with nothing to stop it. This stops
+   * at the cap and cancels the reader, and a runtime with no `body` (React
+   * Native's own fetch) falls back to `.text()` — that response was never
+   * streaming there in the first place.
+   */
+  async readStreamedBody(response, maxSize = 256 * 1024) {
+    const body = response.body;
+    if (!body || typeof body.getReader !== "function") {
+      const text = await response.text();
+      return text.length > maxSize ? {
+        body: `${text.slice(0, maxSize)}\n\n... [truncated]`,
+        size: text.length
+      } : {
+        body: text,
+        size: text.length
+      };
+    }
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let out = "";
+    let size = 0;
+    let capped = false;
+    try {
+      for (;;) {
+        const {
+          done,
+          value
+        } = await reader.read();
+        if (done) break;
+        size += value?.byteLength ?? 0;
+        if (!capped) {
+          out += decoder.decode(value, {
+            stream: true
+          });
+          if (out.length >= maxSize) {
+            out = `${out.slice(0, maxSize)}\n\n... [truncated]`;
+            capped = true;
+            break;
+          }
+        }
+      }
+      if (!capped) out += decoder.decode();
+    } finally {
+      try {
+        void Promise.resolve(reader.cancel()).catch(() => {});
+      } catch {
+        /* already gone */
+      }
+      try {
+        reader.releaseLock();
+      } catch {
+        /* already released */
+      }
+    }
+    return {
+      body: out,
+      size
+    };
+  }
   async processResponseBody(response, maxSize = 1024 * 1024 // 1MB default
   ) {
     try {
@@ -541,6 +646,8 @@ class NetworkListener {
       }
 
       // Parse request body
+      // Explicitly typed: the late emit for a streamed reply reads this from
+      // inside a callback, which defeats the inference it used to rely on.
       let requestData;
       if (init?.body) {
         if (typeof init.body === "string") {
@@ -609,12 +716,29 @@ class NetworkListener {
         // look faster through fetch than through XHR.
         const ttfb = Date.now() - startTime;
 
+        /**
+         * A STREAMED reply is never awaited here.
+         *
+         * `processResponseBody` reads the clone to the end, and for
+         * `text/event-stream` the end is when the server finishes — seconds
+         * later, for an LLM. Awaiting it made the interceptor hold the
+         * response back until then, so every consumer of a streaming endpoint
+         * inside an app with capture on received the whole thing at once and
+         * could not stream a word of it. The row is emitted now with what is
+         * known, and the body is filled in when the stream closes: the store
+         * merges a second `response` event onto the same request id.
+         */
+        const streamed = isStreamedContentType(response.headers?.get?.("content-type"));
+
         // Clone response to read body with size limits
         const responseClone = response.clone();
         const {
           body,
           size: responseSize
-        } = await self.processResponseBody(responseClone);
+        } = streamed ? {
+          body: STREAMING_PLACEHOLDER,
+          size: 0
+        } : await self.processResponseBody(responseClone);
 
         // Now the body is in — this is the comparable, total number.
         const duration = Date.now() - startTime;
@@ -673,6 +797,36 @@ class NetworkListener {
           },
           override
         });
+        if (streamed) {
+          // Bounded, cancelled at the cap, and never awaited by the caller.
+          void self.readStreamedBody(responseClone).then(late => {
+            self.emit({
+              type: "response",
+              timestamp: new Date(),
+              duration: Date.now() - startTime,
+              timings,
+              request: {
+                id: requestId || "unknown",
+                url: cleanUrl,
+                method,
+                headers: requestHeaders,
+                data: requestData,
+                params: params || undefined,
+                client: clientType
+              },
+              response: {
+                status: response.status,
+                statusText: response.statusText,
+                headers: responseHeaders,
+                body: late.body,
+                size: late.size
+              },
+              override
+            });
+          }).catch(() => {
+            /* the caller's response is unaffected either way */
+          });
+        }
         return response;
       } catch (error) {
         const duration = Date.now() - startTime;

package/lib/typescript/network/sync/networkSyncAdapter.d.ts

@@ -1,6 +1,7 @@
 import type { OverrideRulesState } from "../overrides/overrideRulesStore";
 import type { OverrideRuleKind } from "../overrides/types";
 import type { NetworkEvent } from "../types";
+import { type EditViolation } from "@buoy-gg/shared-ui";
 /**
  * Request/response bodies larger than this are NOT streamed in the list
  * snapshot. Prefer the cached size proxy already on the event (free); if that
@@ -132,9 +133,15 @@ export declare const networkSyncAdapter: {
         upsertOverrideRule: (params?: unknown) => {
             ok: boolean;
             error: string;
+            violations?: undefined;
+        } | {
+            ok: boolean;
+            error: string;
+            violations: EditViolation[];
         } | {
             active: false;
             inactiveReason: string;
+            lingers?: string | undefined;
             ok: boolean;
             rule: {
                 id: string;
@@ -142,10 +149,13 @@ export declare const networkSyncAdapter: {
                 enabled: boolean;
                 kind: OverrideRuleKind;
                 status: number | undefined;
+                times: number | null | undefined;
                 bodySize: number;
             };
             error?: undefined;
+            violations?: undefined;
         } | {
+            lingers?: string | undefined;
             ok: boolean;
             rule: {
                 id: string;
@@ -153,9 +163,11 @@ export declare const networkSyncAdapter: {
                 enabled: boolean;
                 kind: OverrideRuleKind;
                 status: number | undefined;
+                times: number | null | undefined;
                 bodySize: number;
             };
             error?: undefined;
+            violations?: undefined;
         };
         setOverrideRuleEnabled: (params?: unknown) => {
             ok: boolean;

package/lib/typescript/network/sync/networkSyncAdapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"networkSyncAdapter.d.ts","sourceRoot":"","sources":["../../../../src/network/sync/networkSyncAdapter.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAEV,kBAAkB,EACnB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAG7C;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,QAAY,CAAC;AAEpD;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,QAAqB,CAAC;AA2LzD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,KAAK,CAAC;AA8K9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,kBAAkB;;;;QAczB;;;;WAIG;;;;;;;;;;;;;0BAWe,MAAM,IAAI;;;QAkB9B;;;;;WAKG;gCACqB,OAAO;;;;;;;;;;QAoB/B,8CAA8C;6BACzB,OAAO;;;;;;;;;QAY5B,gDAAgD;4BAC5B,OAAO;;;;;;;;;QAU3B,sDAAsD;qCACzB,OAAO;;;;;;;;;QAsBpC,uEAAuE;uCACxC,OAAO;oBAvP5B,KAAK;4BAAkB,MAAM;;;;;;;QAkQvC,2CAA2C;sCACb,OAAO;;;;oBAnQ3B,KAAK;4BAAkB,MAAM;;;;;;;;;;;;;;;;;;;;;;;0CAuSL,OAAO;;;;oBAvS/B,KAAK;4BAAkB,MAAM;;;;;;;sCA8ST,OAAO;;;;;;;;;;QAYrC,+EAA+E;;QAG/E;;;;WAIG;uCAC4B,OAAO;;;QAYtC,4EAA4E;QAC5E;;;;;;;WAOG;;;;;;;;;kCA2CuB,OAAO;;;;;;;;;;;;;;;;CAiBpC,CAAC"}
+{"version":3,"file":"networkSyncAdapter.d.ts","sourceRoot":"","sources":["../../../../src/network/sync/networkSyncAdapter.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAEV,kBAAkB,EACnB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAE7C,OAAO,EAAiG,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEvJ;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,QAAY,CAAC;AAEpD;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,QAAqB,CAAC;AA2LzD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,KAAK,CAAC;AA0R9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,kBAAkB;;;;QAczB;;;;WAIG;;;;;;;;;;;;;0BAWe,MAAM,IAAI;;;QAkB9B;;;;;WAKG;gCACqB,OAAO;;;;;;;;;;QAoB/B,8CAA8C;6BACzB,OAAO;;;;;;;;;QAY5B,gDAAgD;4BAC5B,OAAO;;;;;;;;;QAU3B,sDAAsD;qCACzB,OAAO;;;;;;;;;QAsBpC,uEAAuE;uCACxC,OAAO;oBAnW5B,KAAK;4BAAkB,MAAM;;;;;;;QA8WvC,2CAA2C;sCACb,OAAO;;;;;;;;;oBA/W3B,KAAK;4BAAkB,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0CAgfL,OAAO;;;;oBAhf/B,KAAK;4BAAkB,MAAM;;;;;;;sCAufT,OAAO;;;;;;;;;;QAYrC,+EAA+E;;QAG/E;;;;WAIG;uCAC4B,OAAO;;;QAYtC,4EAA4E;QAC5E;;;;;;;WAOG;;;;;;;;;kCA2CuB,OAAO;;;;;;;;;;;;;;;;CAiBpC,CAAC"}

package/lib/typescript/network/utils/networkListener.d.ts

@@ -47,33 +47,6 @@ export type NetworkingEventListener = (event: NetworkingEvent) => void;
  */
 export declare const BUOY_FETCH_INTERCEPTOR_FLAG = "__buoyNetworkFetchIntercepted";
 export declare const BUOY_XHR_INTERCEPTOR_FLAG = "__buoyNetworkXhrIntercepted";
-/**
- * Network traffic interceptor for React Native applications
- *
- * This class intercepts both fetch and XMLHttpRequest operations to provide
- * comprehensive network monitoring capabilities. It uses method swizzling to
- * wrap native networking APIs while preserving their original functionality.
- *
- * @example
- * ```typescript
- * // Start monitoring network traffic
- * startNetworkListener();
- *
- * // Add a listener for network events
- * const unsubscribe = addNetworkListener((event) => {
- *   if (event.type === 'response') {
- *     console.log(`${event.request.method} ${event.request.url}: ${event.response?.status}`);
- *   }
- * });
- *
- * // Stop monitoring and cleanup
- * unsubscribe();
- * stopNetworkListener();
- * ```
- *
- * @performance Uses lazy singleton pattern to minimize memory footprint
- * @performance Includes URL filtering to ignore development traffic
- */
 declare class NetworkListener {
     private listeners;
     private isListening;
@@ -128,6 +101,17 @@ declare class NetworkListener {
      * @param maxSize - Maximum body size in bytes (default: 1MB)
      * @returns Object containing body, size, and truncation status
      */
+    /**
+     * Read a streamed body in the background, with a hard ceiling.
+     *
+     * Deliberately not `processResponseBody`: that one calls `.text()`, which
+     * accumulates the WHOLE body before it checks the size, so a long-lived SSE
+     * stream would grow unbounded in memory with nothing to stop it. This stops
+     * at the cap and cancels the reader, and a runtime with no `body` (React
+     * Native's own fetch) falls back to `.text()` — that response was never
+     * streaming there in the first place.
+     */
+    private readStreamedBody;
     private processResponseBody;
     /**
      * Format bytes into human-readable format

package/lib/typescript/network/utils/networkListener.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"networkListener.d.ts","sourceRoot":"","sources":["../../../../src/network/utils/networkListener.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAS/C,OAAO,EAAkB,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AA+B9E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,SAAS,GAAG,UAAU,GAAG,OAAO,CAAC;IACvC,SAAS,EAAE,IAAI,CAAC;IAChB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,OAAO,EAAE;QACP,EAAE,EAAE,MAAM,CAAC;QACX,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,KAAK,GAAG,SAAS,GAAG,UAAU,CAAC;KAC7D,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,KAAK,CAAC,EAAE;QACN,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC;AAED,MAAM,MAAM,uBAAuB,GAAG,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;AAEvE;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,kCAAkC,CAAC;AAC3E,eAAO,MAAM,yBAAyB,gCAAgC,CAAC;AAIvE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,cAAM,eAAe;IACnB,OAAO,CAAC,SAAS,CAAiC;IAClD,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,cAAc,CAAQ;IAG9B,OAAO,CAAC,WAAW,CASjB;IAGF,OAAO,CAAC,aAAa,CAAe;IACpC,OAAO,CAAC,eAAe,CAAuC;IAC9D,OAAO,CAAC,eAAe,CAAuC;IAC9D,OAAO,CAAC,2BAA2B,CAAmD;IAEtF;;;;;OAKG;IACH,OAAO,CAAC,YAAY,CAA6B;IACjD,OAAO,CAAC,cAAc,CAAqD;IAC3E,OAAO,CAAC,cAAc,CAAqD;IAC3E,OAAO,CAAC,0BAA0B,CAElB;IAEhB;;;;;OAKG;IACH,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,aAAa,CAAK;;IAW1B;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe;IAKvB,OAAO,CAAC,IAAI;IAUZ;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ;IA0BhB;;;;;OAKG;YACW,mBAAmB;IA2DjC;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAQnB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IA8NzB,yEAAyE;IACzE,OAAO,CAAC,uBAAuB;IAQ/B,0EAA0E;IAC1E,OAAO,CAAC,qBAAqB;IAQ7B;;;;OAIG;IACH,kBAAkB,IAAI,OAAO;IAI7B;;;;;;;;;;;;;;;;OAgBG;IACH,cAAc;IAoBd,4EAA4E;IAC5E,OAAO,CAAC,uBAAuB;IA+N/B,6EAA6E;IAC7E,OAAO,CAAC,qBAAqB;IA2O7B;;;;;OAKG;IACH,aAAa;IA+Cb;;;;;OAKG;IACH,WAAW,CAAC,QAAQ,EAAE,uBAAuB;IAa7C,kBAAkB;IAKlB,IAAI,QAAQ,YAEX;IAGD,IAAI,aAAa,WAEhB;CACF;AAsBD;;;;GAIG;AACH,eAAO,MAAM,eAAe,uBAAqB,CAAC;AAElD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,YAA8C,CAAC;AAEhF;;GAEG;AACH,eAAO,MAAM,mBAAmB,YAA6C,CAAC;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,kBAAkB,GAAI,UAAU,uBAAuB,eACxB,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,yBAAyB,YACK,CAAC;AAE5C;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,eAAsC,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,cAA2C,CAAC;AAEhF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,eACK,CAAC"}
+{"version":3,"file":"networkListener.d.ts","sourceRoot":"","sources":["../../../../src/network/utils/networkListener.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAS/C,OAAO,EAAkB,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AA+B9E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,SAAS,GAAG,UAAU,GAAG,OAAO,CAAC;IACvC,SAAS,EAAE,IAAI,CAAC;IAChB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,OAAO,EAAE;QACP,EAAE,EAAE,MAAM,CAAC;QACX,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,KAAK,GAAG,SAAS,GAAG,UAAU,CAAC;KAC7D,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,KAAK,CAAC,EAAE;QACN,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC;AAED,MAAM,MAAM,uBAAuB,GAAG,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;AAEvE;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,kCAAkC,CAAC;AAC3E,eAAO,MAAM,yBAAyB,gCAAgC,CAAC;AA4EvE,cAAM,eAAe;IACnB,OAAO,CAAC,SAAS,CAAiC;IAClD,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,cAAc,CAAQ;IAG9B,OAAO,CAAC,WAAW,CASjB;IAGF,OAAO,CAAC,aAAa,CAAe;IACpC,OAAO,CAAC,eAAe,CAAuC;IAC9D,OAAO,CAAC,eAAe,CAAuC;IAC9D,OAAO,CAAC,2BAA2B,CAAmD;IAEtF;;;;;OAKG;IACH,OAAO,CAAC,YAAY,CAA6B;IACjD,OAAO,CAAC,cAAc,CAAqD;IAC3E,OAAO,CAAC,cAAc,CAAqD;IAC3E,OAAO,CAAC,0BAA0B,CAElB;IAEhB;;;;;OAKG;IACH,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,aAAa,CAAK;;IAW1B;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe;IAMvB,OAAO,CAAC,IAAI;IAUZ;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ;IA0BhB;;;;;OAKG;IACH;;;;;;;;;OASG;YACW,gBAAgB;YA+ChB,mBAAmB;IA2DjC;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAQnB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IA8NzB,yEAAyE;IACzE,OAAO,CAAC,uBAAuB;IAQ/B,0EAA0E;IAC1E,OAAO,CAAC,qBAAqB;IAQ7B;;;;OAIG;IACH,kBAAkB,IAAI,OAAO;IAI7B;;;;;;;;;;;;;;;;OAgBG;IACH,cAAc;IAoBd,4EAA4E;IAC5E,OAAO,CAAC,uBAAuB;IAkR/B,6EAA6E;IAC7E,OAAO,CAAC,qBAAqB;IA2O7B;;;;;OAKG;IACH,aAAa;IA+Cb;;;;;OAKG;IACH,WAAW,CAAC,QAAQ,EAAE,uBAAuB;IAa7C,kBAAkB;IAKlB,IAAI,QAAQ,YAEX;IAGD,IAAI,aAAa,WAEhB;CACF;AAsBD;;;;GAIG;AACH,eAAO,MAAM,eAAe,uBAAqB,CAAC;AAElD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,YAA8C,CAAC;AAEhF;;GAEG;AACH,eAAO,MAAM,mBAAmB,YAA6C,CAAC;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,kBAAkB,GAAI,UAAU,uBAAuB,eACxB,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,yBAAyB,YACK,CAAC;AAE5C;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,eAAsC,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,cAA2C,CAAC;AAEhF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,eACK,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@buoy-gg/network",
-  "version": "7.0.35",
+  "version": "7.0.36",
   "description": "In-app network inspector for React Native — requests, responses, timing & errors live, with GraphQL operation parsing. Part of Buoy devtools.",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",
@@ -26,7 +26,7 @@
   ],
   "sideEffects": false,
   "dependencies": {
-    "@buoy-gg/shared-ui": "^7.0.35"
+    "@buoy-gg/shared-ui": "^7.0.36"
   },
   "peerDependencies": {
     "react": "*",