@capxul/observability 4.1.4 → 4.2.0-rc.10

package/dist/index.mjs

@@ -1,3 +1,4 @@
+import { i as redactUrlSecrets, n as isCredentialField, r as redactSecrets, t as CAPXUL_ERROR_CODES } from "./src-CWfRYsBI.mjs";
 import { Effect, Schema, SchemaGetter } from "effect";
 //#region ../errors/src/chain-cause.ts
 /**
@@ -35,39 +36,6 @@ const CHAIN_UPSTREAMS = [
 	"gateway"
 ];
 //#endregion
-//#region ../errors/src/errors.ts
-const CAPXUL_ERROR_CODES = [
-	"NOT_AUTHENTICATED",
-	"EMAIL_DELIVERY_FAILED",
-	"PROFILE_NOT_FOUND",
-	"SMART_ACCOUNT_MISSING",
-	"PLAYER_NOT_FOUND",
-	"ACCOUNT_NOT_FOUND",
-	"ACCOUNT_CLAIMED_BY_OTHER_SIGNER",
-	"PROVIDER_ERROR",
-	"CAPABILITY_UNAVAILABLE",
-	"INVALID_INPUT",
-	"ENV_MISSING",
-	"NOT_IMPLEMENTED",
-	"VERIFICATION_REQUIRED",
-	"INSUFFICIENT_BALANCE",
-	"INVALID_RECIPIENT",
-	"ROLE_PERMISSION_DENIED",
-	"TRANSACTION_FAILED",
-	"RATE_LIMITED",
-	"NETWORK_ERROR",
-	"UNKNOWN",
-	"OTP_EXPIRED",
-	"SIGNER_REJECTED",
-	"CANCELLED",
-	"WRONG_STATE",
-	"STALE_EPOCH",
-	"SUPERSEDED",
-	"WORK_DIED",
-	"ACTOR_STOPPED"
-];
-new Set(CAPXUL_ERROR_CODES);
-//#endregion
 //#region ../types/src/index.ts
 const EVM_ADDRESS_RE = /^0x[0-9a-f]{40}$/i;
 const BYTES32_RE = /^0x[0-9a-f]{64}$/i;
@@ -146,6 +114,8 @@ const CAPXUL_OPERATIONS = {
 		emitAnnotationSaved: "activity.emitAnnotationSaved",
 		get: "activity.get",
 		list: "activity.list",
+		/** The SDK's live Activity read over the indexer's SSE stream. */
+		subscribe: "activity.subscribe",
 		summary: "activity.summary"
 	},
 	addressBook: {
@@ -505,6 +475,7 @@ const TELEMETRY_EVENT_NAMES = [
 	"auth_otp_expired",
 	"auth_verified",
 	"auth_failed",
+	"identity_refused",
 	"auth_signed_out",
 	"onboarding_intent_selected",
 	"onboarding_profile_submitted",
@@ -553,7 +524,18 @@ const TELEMETRY_EVENT_NAMES = [
 	"activity_annotation_saved",
 	"ui_activity_action_completed",
 	"contact_relationship_changed",
-	"ui_contact_action_completed"
+	"ui_contact_action_completed",
+	"access_recovery_completed",
+	"ui_access_step_completed",
+	"org_invite_progressed",
+	"invoice_issued",
+	"invoice_request_transitioned",
+	"ui_invoice_step_completed",
+	"ui_treasury_step_completed",
+	"ui_receive_step_completed",
+	"payroll_group_changed",
+	"payroll_run_transitioned",
+	"ui_payroll_action_completed"
 ];
 const TELEMETRY_JOURNEYS = {
 	returning_user_login: {
@@ -901,6 +883,17 @@ const AuthFailedProps = Schema.Struct({
 	auth_type: OptionalString,
 	reason: OptionalString
 });
+const IdentityRefusedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	/** The refused identity event tag, for example CreateOrganization. */
+	event: OptionalString,
+	/** The machine's refusal code: WRONG_STATE, SUPERSEDED or STALE_EPOCH. */
+	refusal_code: OptionalString,
+	/** The machine slot the request targeted, for example identity:org. */
+	slot: OptionalString,
+	/** The machine state at refusal, for example authenticated:claiming. */
+	state: OptionalString
+});
 const AuthSignedOutProps = Schema.Struct(TelemetryEnvelopeProps);
 const ProvisioningSafeCreatedProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
@@ -1288,10 +1281,24 @@ const DepositSettledProps = Schema.Struct({
 });
 const PermissionMirrorVerificationProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
+	/** The RECEIPT verification outcome. What the mirror then did is separate. */
 	outcome: Schema.String,
 	reason: Schema.String,
 	chain_id: Schema.Number,
-	retry_count: Schema.Number
+	retry_count: Schema.Number,
+	/**
+	* #1960 R02, consumed by R03. A verified receipt is not an applied Permission:
+	* these two optional fields let the producer say what the applying mutation
+	* actually returned, and which command it was, without either fact rewriting
+	* the receipt outcome above. Absent when application has not happened yet.
+	*/
+	application_result: Schema.optional(Schema.Literals([
+		"applied",
+		"replayed",
+		"conflicting_replay",
+		"revision_mismatch"
+	])),
+	command_id: OptionalString
 });
 const MovementScanWindowProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
@@ -1337,6 +1344,10 @@ const AuthFailedTelemetryEventSchema = Schema.Struct({
 	name: Schema.Literal("auth_failed"),
 	props: AuthFailedProps
 });
+const IdentityRefusedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("identity_refused"),
+	props: IdentityRefusedProps
+});
 const AuthSignedOutTelemetryEventSchema = Schema.Struct({
 	name: Schema.Literal("auth_signed_out"),
 	props: AuthSignedOutProps
@@ -1517,6 +1528,10 @@ const MovementScanIncidentTelemetryEventSchema = Schema.Struct({
 	name: Schema.Literal("movement_scan_incident"),
 	props: MovementScanIncidentProps
 });
+/** The one spelling of "whose scope did this happen in" across every surface. */
+const ScopeKindSchema = Schema.Literals(["account", "organization"]);
+const AccountKindSchema = Schema.Literals(["personalSafe", "orgTreasury"]);
+const OptionalReasonCode = Schema.optional(Schema.Literals(CAPXUL_ERROR_CODES));
 const ActivityReferenceProps = {
 	reference_kind: Schema.Literals(["payment", "movement"]),
 	reference_id: Schema.String
@@ -1547,8 +1562,8 @@ const ActivityFilterProps = {
 };
 const ActivityActionProps = {
 	...TelemetryEnvelopeProps,
-	scope_kind: Schema.Literals(["account", "organization"]),
-	reason_code: Schema.optional(Schema.Literals(CAPXUL_ERROR_CODES))
+	scope_kind: ScopeKindSchema,
+	reason_code: OptionalReasonCode
 };
 const ContactRelationshipChangedTelemetryEventSchema = Schema.Struct({
 	name: Schema.Literal("contact_relationship_changed"),
@@ -1560,7 +1575,7 @@ const ContactRelationshipChangedTelemetryEventSchema = Schema.Struct({
 			"hidden",
 			"restored"
 		]),
-		scope_kind: Schema.Literals(["account", "organization"]),
+		scope_kind: ScopeKindSchema,
 		scope_id: Schema.String,
 		owner_party_id: Schema.String,
 		party_id: Schema.String,
@@ -1576,9 +1591,9 @@ const ContactRelationshipChangedTelemetryEventSchema = Schema.Struct({
 });
 const ContactActionProps = {
 	...TelemetryEnvelopeProps,
-	scope_kind: Schema.Literals(["account", "organization"]),
+	scope_kind: ScopeKindSchema,
 	party_id: OptionalString,
-	reason_code: Schema.optional(Schema.Literals(CAPXUL_ERROR_CODES))
+	reason_code: OptionalReasonCode
 };
 const UiContactActionCompletedTelemetryEventSchema = Schema.Struct({
 	name: Schema.Literal("ui_contact_action_completed"),
@@ -1605,7 +1620,7 @@ const ActivityAnnotationSavedTelemetryEventSchema = Schema.Struct({
 	props: Schema.Struct({
 		...TelemetryEnvelopeProps,
 		...ActivityReferenceProps,
-		scope_kind: Schema.Literals(["account", "organization"]),
+		scope_kind: ScopeKindSchema,
 		scope_id: Schema.String,
 		occurred_at: Schema.Number
 	})
@@ -1660,8 +1675,206 @@ const UiActivityActionCompletedTelemetryEventSchema = Schema.Struct({
 		})
 	])
 });
+/**
+* Reliability closeout (#1960 R02) — the shape every explicit UI observation
+* below shares. `scope_kind` says whose surface the person was looking at,
+* `organization_id` is the verified Organization the producer resolved (absent
+* on a personal action), and `reason_code` is a catalog error code, never copy.
+*/
+const UiStepProps = {
+	...TelemetryEnvelopeProps,
+	scope_kind: ScopeKindSchema,
+	organization_id: OptionalOrgId,
+	reason_code: OptionalReasonCode
+};
+const AccessRecoveryCompletedProps = Schema.Union([Schema.Struct({
+	...TelemetryEnvelopeProps,
+	recovery: Schema.Literal("session_restoration"),
+	outcome: Schema.Literals([
+		"restored",
+		"absent",
+		"failed"
+	]),
+	reason_code: OptionalReasonCode,
+	organization_id: OptionalOrgId
+}), Schema.Struct({
+	...TelemetryEnvelopeProps,
+	recovery: Schema.Literal("signer_readiness"),
+	outcome: Schema.Literals(["ready", "unavailable"]),
+	reason_code: OptionalReasonCode,
+	organization_id: OptionalOrgId
+})]);
+const AccessRecoveryCompletedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("access_recovery_completed"),
+	props: AccessRecoveryCompletedProps
+});
+const UiAccessStepCompletedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("ui_access_step_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		step: Schema.Literals([
+			"dashboard_granted",
+			"redirect_completed",
+			"gate_error_displayed",
+			"retry_selected",
+			"capability_refusal_displayed",
+			"signer_refusal_displayed"
+		]),
+		capability: Schema.optional(Schema.Literals(["spend", "managePeople"])),
+		probe: Schema.optional(Schema.Literals([
+			"session",
+			"membership",
+			"lifecycle"
+		])),
+		reason: Schema.optional(Schema.Literals([
+			"loading",
+			"no-permission",
+			"org-unavailable"
+		]))
+	})
+});
+const OrgInviteProgressedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("org_invite_progressed"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		organization_id: OrgIdTelemetrySchema,
+		progress: Schema.Literals([
+			"account_ready",
+			"permission_applied",
+			"membership_activated",
+			"revoked"
+		]),
+		/** The invited Party. The initiating actor stays on the envelope's identity. */
+		member_party_id: Schema.String,
+		occurred_at: Schema.Number
+	})
+});
+const InvoiceIssuedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("invoice_issued"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		request_id: Schema.String,
+		issuer_scope_kind: ScopeKindSchema,
+		issuer_scope_id: Schema.String,
+		payer_party_id: OptionalString,
+		occurred_at: Schema.Number
+	})
+});
+const InvoiceRequestTransitionedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("invoice_request_transitioned"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		request_id: Schema.String,
+		transition: Schema.Literals([
+			"approval_prepared",
+			"declined",
+			"cancelled"
+		]),
+		actor_scope_kind: ScopeKindSchema,
+		actor_scope_id: Schema.String,
+		occurred_at: Schema.Number
+	})
+});
+const UiInvoiceStepCompletedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("ui_invoice_step_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		step: Schema.Literals([
+			"opened",
+			"previewed",
+			"dismissed",
+			"submitted",
+			"result_displayed",
+			"refusal_displayed",
+			"retry_selected"
+		]),
+		request_id: OptionalString
+	})
+});
+const UiTreasuryStepCompletedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("ui_treasury_step_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		step: Schema.Literals([
+			"balance_displayed",
+			"read_refusal_displayed",
+			"retry_selected",
+			"recovery_completed"
+		]),
+		account_kind: Schema.optional(AccountKindSchema)
+	})
+});
+const UiReceiveStepCompletedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("ui_receive_step_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		step: Schema.Literals([
+			"instructions_displayed",
+			"address_copied",
+			"copy_failed",
+			"refusal_displayed",
+			"retry_selected"
+		]),
+		account_kind: Schema.optional(AccountKindSchema)
+	})
+});
+const PayrollGroupChangedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("payroll_group_changed"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		organization_id: OrgIdTelemetrySchema,
+		change: Schema.Literals([
+			"created",
+			"updated",
+			"deleted"
+		]),
+		group_id: Schema.String,
+		member_count: Schema.Number,
+		occurred_at: Schema.Number
+	})
+});
+const PayrollRunTransitionedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("payroll_run_transitioned"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		organization_id: OrgIdTelemetrySchema,
+		transition: Schema.Literals([
+			"prepared",
+			"authorized",
+			"settled"
+		]),
+		run_id: Schema.String,
+		payment_count: Schema.optional(Schema.Number),
+		occurred_at: Schema.Number
+	})
+});
+const UiPayrollActionCompletedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("ui_payroll_action_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		action: Schema.Literals([
+			"opened",
+			"refusal_displayed",
+			"recovery_completed",
+			"cancelled",
+			"submitted_displayed"
+		]),
+		run_id: OptionalString
+	})
+});
 const TELEMETRY_EVENT_SCHEMAS = {
 	contact_relationship_changed: ContactRelationshipChangedTelemetryEventSchema,
+	access_recovery_completed: AccessRecoveryCompletedTelemetryEventSchema,
+	ui_access_step_completed: UiAccessStepCompletedTelemetryEventSchema,
+	org_invite_progressed: OrgInviteProgressedTelemetryEventSchema,
+	invoice_issued: InvoiceIssuedTelemetryEventSchema,
+	invoice_request_transitioned: InvoiceRequestTransitionedTelemetryEventSchema,
+	ui_invoice_step_completed: UiInvoiceStepCompletedTelemetryEventSchema,
+	ui_treasury_step_completed: UiTreasuryStepCompletedTelemetryEventSchema,
+	ui_receive_step_completed: UiReceiveStepCompletedTelemetryEventSchema,
+	payroll_group_changed: PayrollGroupChangedTelemetryEventSchema,
+	payroll_run_transitioned: PayrollRunTransitionedTelemetryEventSchema,
+	ui_payroll_action_completed: UiPayrollActionCompletedTelemetryEventSchema,
 	ui_contact_action_completed: UiContactActionCompletedTelemetryEventSchema,
 	activity_annotation_saved: ActivityAnnotationSavedTelemetryEventSchema,
 	ui_activity_action_completed: UiActivityActionCompletedTelemetryEventSchema,
@@ -1670,6 +1883,7 @@ const TELEMETRY_EVENT_SCHEMAS = {
 	auth_otp_expired: AuthOtpExpiredTelemetryEventSchema,
 	auth_verified: AuthVerifiedTelemetryEventSchema,
 	auth_failed: AuthFailedTelemetryEventSchema,
+	identity_refused: IdentityRefusedTelemetryEventSchema,
 	auth_signed_out: AuthSignedOutTelemetryEventSchema,
 	onboarding_intent_selected: OnboardingIntentSelectedTelemetryEventSchema,
 	onboarding_profile_submitted: OnboardingProfileSubmittedTelemetryEventSchema,
@@ -1723,7 +1937,14 @@ const FINANCIAL_OPS_TARGET_TELEMETRY_PRODUCERS = [];
 * A domain node removes its entry when it adds the producer. The telemetry
 * gate rejects an entry that has a producer.
 */
-const CONTRACT_FIRST_TELEMETRY_EVENTS = [];
+const CONTRACT_FIRST_TELEMETRY_EVENTS = [
+	"access_recovery_completed",
+	"org_invite_progressed",
+	"invoice_issued",
+	"invoice_request_transitioned",
+	"payroll_group_changed",
+	"payroll_run_transitioned"
+];
 /**
 * Catalog events whose product mapper remains gated on the #1150 frontend
 * adoption. L1 S1 removes their retired SDK-flow producers without inventing
@@ -1739,7 +1960,12 @@ const BROWSER_GATED_TELEMETRY_EVENTS = [
 	"onboarding_organization_submitted",
 	"onboarding_dashboard_reached",
 	"ui_activity_action_completed",
-	"ui_contact_action_completed"
+	"ui_contact_action_completed",
+	"ui_access_step_completed",
+	"ui_invoice_step_completed",
+	"ui_treasury_step_completed",
+	"ui_receive_step_completed",
+	"ui_payroll_action_completed"
 ];
 let trackHandler = () => {};
 function setTrackHandler(handler) {
@@ -1775,22 +2001,24 @@ function redactTelemetryProps(name, props, options = {}) {
 * The callback mutates and returns the supplied event, matching PostHog's
 * `before_send` contract while preserving the event's full structural type.
 */
-function sanitizePostHogBrowserEvent(event) {
+function sanitizePostHogBrowserEvent(event, urlPolicy = "path-only") {
 	if (event === null) return event;
+	const transportToken = event.properties.token;
 	const seen = /* @__PURE__ */ new WeakSet();
-	sanitizePostHogBrowserValue(event.properties, seen);
-	if (event.$set !== void 0) sanitizePostHogBrowserValue(event.$set, seen);
-	if (event.$set_once !== void 0) sanitizePostHogBrowserValue(event.$set_once, seen);
+	sanitizePostHogBrowserValue(event.properties, seen, urlPolicy);
+	if (transportToken !== void 0) event.properties.token = transportToken;
+	if (event.$set !== void 0) sanitizePostHogBrowserValue(event.$set, seen, urlPolicy);
+	if (event.$set_once !== void 0) sanitizePostHogBrowserValue(event.$set_once, seen, urlPolicy);
 	return event;
 }
 /**
 * Drop local events before transport. Sanitize and stamp every other browser
 * event with `capxul_env` and `producer: "browser"`.
 */
-function createCapxulBeforeSend(capxulEnv) {
+function createCapxulBeforeSend(capxulEnv, urlPolicy = "path-only") {
 	return (event) => {
 		if (capxulEnv === "local") return null;
-		const sanitized = sanitizePostHogBrowserEvent(event);
+		const sanitized = sanitizePostHogBrowserEvent(event, urlPolicy);
 		if (sanitized === null) return sanitized;
 		sanitized.properties.capxul_env = capxulEnv;
 		sanitized.properties.producer ??= "browser";
@@ -1821,67 +2049,64 @@ function utilityAppAnalytics(input) {
 		before_send: createCapxulBeforeSend(input.capxulEnv)
 	};
 }
-const CREDENTIAL_HEADERS = /* @__PURE__ */ new Set([
-	"authorization",
-	"proxy-authorization",
-	"proxy-authenticate",
-	"www-authenticate",
-	"cookie",
-	"set-cookie",
-	"x-api-key",
-	"x-auth-token"
-]);
-/** Any JSON field whose name says "credential", however it is spelled. */
-const CREDENTIAL_FIELD_NAME = /(?:otp|code|pass(?:word|wd|phrase)?|token|secret|credential|api[_-]?key|private[_-]?key|authorization|cookie|session)/iu;
-/** Secret material in captured text: bearer tokens, JWTs, keys, and credential fields. */
-const NETWORK_TEXT_MASKS = [
-	[/\bBearer\s+[^\s,;"]+/giu, "Bearer [REDACTED]"],
-	[/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[REDACTED]"],
-	[/\b0x[a-fA-F0-9]{40,}\b/gu, "[REDACTED]"],
-	[/\b([A-Za-z_][A-Za-z0-9_.-]*=)[^&\s"]+/gu, "$1[REDACTED]"]
-];
-/** `"name": "value"` JSON pairs; the name decides whether the value is masked. */
-const JSON_STRING_FIELD = /("([^"\\]*)"\s*:\s*")((?:[^"\\]|\\.)*)(")/gu;
-const QUERY_PAIR = /\b([A-Za-z_][A-Za-z0-9_.-]*=)[^&\s"]+/gu;
-function maskNetworkText(text) {
-	return NETWORK_TEXT_MASKS.slice(0, 3).reduce((current, [pattern, replacement]) => current.replace(pattern, replacement), text).replace(JSON_STRING_FIELD, (whole, open, name, _value, close) => CREDENTIAL_FIELD_NAME.test(name) ? `${open}[REDACTED]${close}` : whole).replace(QUERY_PAIR, (whole, name) => CREDENTIAL_FIELD_NAME.test(name) ? `${name}[REDACTED]` : whole);
+/** In unstructured bodies, preserve text around explicitly named credentials. */
+const NETWORK_FIELD = /((?:"?)([A-Za-z_][A-Za-z0-9_.-]*)(?:"?)\s*[:=]\s*)("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|[^\s,;&}]+)/gu;
+function maskNetworkText(text, context) {
+	return redactSecrets(text).replace(NETWORK_FIELD, (whole, prefix, name, value) => {
+		if (!isCredentialField(name, context)) return whole;
+		const quote = value.startsWith("\"") ? "\"" : value.startsWith("'") ? "'" : "";
+		return `${prefix}${quote}[REDACTED]${quote}`;
+	});
 }
 function maskNetworkHeaders(headers) {
 	if (headers === void 0) return void 0;
 	const masked = {};
-	for (const [name, value] of Object.entries(headers)) masked[name] = CREDENTIAL_HEADERS.has(name.toLowerCase()) ? "[REDACTED]" : maskNetworkText(value);
+	for (const [name, value] of Object.entries(headers)) masked[name] = isCredentialField(name, "header") ? "[REDACTED]" : /^(?:location|content-location|referer)$/iu.test(name) ? redactUrlSecrets(value) : maskNetworkText(value);
 	return masked;
 }
-/** Mask by KEY at every depth: a credential-named field loses its whole value. */
-function maskJsonValue(value, depth = 0) {
-	if (typeof value === "string") return maskNetworkText(value);
+function maskJsonValue(value, depth = 0, context) {
+	if (typeof value === "function" || typeof value === "symbol") return "[UNREADABLE]";
+	if (typeof value === "string") return maskNetworkText(value, context);
 	if (typeof value !== "object" || value === null) return value;
 	if (depth >= 16) return "[REDACTED]";
-	if (Array.isArray(value)) return value.map((item) => maskJsonValue(item, depth + 1));
-	const masked = {};
-	for (const [key, nested] of Object.entries(value)) masked[key] = CREDENTIAL_FIELD_NAME.test(key) ? "[REDACTED]" : maskJsonValue(nested, depth + 1);
+	if (Array.isArray(value)) return value.map((item) => maskJsonValue(item, depth + 1, context));
+	const masked = Object.create(null);
+	for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(value))) {
+		if (!descriptor.enumerable) continue;
+		masked[key] = isCredentialField(key, context) ? "[REDACTED]" : !("value" in descriptor) ? "[UNREADABLE]" : typeof descriptor.value === "string" && isPostHogUrlProperty(key) ? redactUrlSecrets(descriptor.value) : maskJsonValue(descriptor.value, depth + 1, context);
+	}
 	return masked;
 }
-function maskNetworkBody(body) {
-	if (typeof body !== "string") return body;
+function maskNetworkBody(body, context) {
 	try {
-		const parsed = JSON.parse(body);
-		if (typeof parsed === "object" && parsed !== null) return JSON.stringify(maskJsonValue(parsed));
-	} catch {}
-	return maskNetworkText(body);
+		if (typeof body !== "string") return maskJsonValue(body, 0, context);
+		let parsed;
+		try {
+			parsed = JSON.parse(body);
+		} catch {
+			if (/^[^=&\s]+=[\s\S]*$/u.test(body)) return new URLSearchParams(Array.from(new URLSearchParams(body), ([name, value]) => [name, isCredentialField(name, context) ? "[REDACTED]" : maskNetworkText(value)])).toString();
+			return maskNetworkText(body, context);
+		}
+		return JSON.stringify(maskJsonValue(parsed, 0, context));
+	} catch {
+		return "[UNREADABLE]";
+	}
 }
-/**
-* Replay keeps the request line, status, timing, headers, and bodies, so a
-* failed call carries its evidence. Credential headers and secret material
-* never leave the browser: bearer tokens, cookies, API keys, and the OTP a
-* user just typed are masked before the recording is sent.
-*/
+/** Keep request evidence while masking credential values at the browser boundary. */
 function maskCapturedNetworkRequest(request) {
+	const requestUrl = request.name ?? request.url ?? "";
+	let context;
+	try {
+		const path = new URL(requestUrl, "https://capxul.invalid").pathname;
+		if (/\/(?:auth|oauth|sign-in|signin|login|verify-otp|verify-email)(?:\/|$)/iu.test(path)) context = "authentication";
+	} catch {}
 	return {
 		...request,
+		...request.name === void 0 ? {} : { name: redactUrlSecrets(request.name) },
+		...request.url === void 0 ? {} : { url: redactUrlSecrets(request.url) },
 		requestHeaders: maskNetworkHeaders(request.requestHeaders),
 		responseHeaders: maskNetworkHeaders(request.responseHeaders),
-		requestBody: maskNetworkBody(request.requestBody),
+		requestBody: maskNetworkBody(request.requestBody, context),
 		responseBody: maskNetworkBody(request.responseBody)
 	};
 }
@@ -1911,13 +2136,20 @@ function productAppAnalytics(input) {
 		save_referrer: false,
 		session_recording: {
 			maskAllInputs: true,
-			maskInputFn: (text, element) => element?.getAttribute("autocomplete")?.toLowerCase().split(/\s+/u).includes("one-time-code") ? "*".repeat(text.length) : text,
+			maskInputFn: (text, element) => {
+				const autocomplete = element?.getAttribute("autocomplete")?.toLowerCase().split(/\s+/u) ?? [];
+				return element?.getAttribute("type")?.toLowerCase() === "password" || autocomplete.some((value) => [
+					"one-time-code",
+					"current-password",
+					"new-password"
+				].includes(value)) || isCredentialField(element?.getAttribute("name") ?? "") || isCredentialField(element?.getAttribute("id") ?? "") ? "*".repeat(text.length) : maskNetworkText(text);
+			},
 			captureCanvas: { recordCanvas: false },
 			recordHeaders: true,
 			recordBody: true,
 			maskCapturedNetworkRequestFn: maskCapturedNetworkRequest
 		},
-		before_send: createCapxulBeforeSend(input.capxulEnv)
+		before_send: createCapxulBeforeSend(input.capxulEnv, "diagnostic")
 	};
 }
 /**
@@ -1974,11 +2206,15 @@ function createPostHogBrowserPageviewTracker(client) {
 		} catch {}
 	};
 }
-function sanitizePostHogBrowserValue(value, seen) {
+function sanitizePostHogBrowserValue(value, seen, urlPolicy) {
 	if (typeof value !== "object" || value === null || seen.has(value)) return;
 	seen.add(value);
 	if (Array.isArray(value)) {
-		for (const item of value) sanitizePostHogBrowserValue(item, seen);
+		for (let index = 0; index < value.length; index++) {
+			const item = value[index];
+			if (typeof item === "string") value[index] = maskNetworkText(item);
+			else sanitizePostHogBrowserValue(item, seen, urlPolicy);
+		}
 		return;
 	}
 	const properties = value;
@@ -1987,11 +2223,15 @@ function sanitizePostHogBrowserValue(value, seen) {
 			delete properties[key];
 			continue;
 		}
-		if (typeof nestedValue === "string" && isPostHogUrlProperty(key)) {
-			properties[key] = stripUrlQueryAndFragment(nestedValue);
+		if (isCredentialField(key)) {
+			properties[key] = "[REDACTED]";
+			continue;
+		}
+		if (typeof nestedValue === "string") {
+			properties[key] = isPostHogUrlProperty(key) ? urlPolicy === "path-only" ? stripUrlQueryAndFragment(nestedValue) : redactUrlSecrets(nestedValue) : maskNetworkText(nestedValue);
 			continue;
 		}
-		sanitizePostHogBrowserValue(nestedValue, seen);
+		sanitizePostHogBrowserValue(nestedValue, seen, urlPolicy);
 	}
 }
 const POSTHOG_QUERY_DERIVED_PROPERTY_NAMES = [
@@ -2307,4 +2547,4 @@ function rotr(value, bits) {
 	return value >>> bits | value << 32 - bits;
 }
 //#endregion
-export { AccountBalanceFailedTelemetryEventSchema, AccountBalanceReadTelemetryEventSchema, ActivityAnnotationSavedTelemetryEventSchema, AuthFailedTelemetryEventSchema, AuthOtpDeliveredTelemetryEventSchema, AuthOtpExpiredTelemetryEventSchema, AuthOtpRequestedTelemetryEventSchema, AuthSignedOutTelemetryEventSchema, AuthVerifiedTelemetryEventSchema, BROWSER_GATED_TELEMETRY_EVENTS, BootstrapFailedTelemetryEventSchema, BootstrapResolvedTelemetryEventSchema, BundlerErrorTelemetryEventSchema, CAPXUL_ENVS, CAPXUL_OPERATIONS, CONTRACT_FIRST_TELEMETRY_EVENTS, ChainAttemptSchema, ChainUpstreamFallbackTelemetryEventSchema, ChainUpstreamSchema, ContactRelationshipChangedTelemetryEventSchema, DepositInitiatedTelemetryEventSchema, DepositSettledTelemetryEventSchema, FINANCIAL_OPS_TARGET_TELEMETRY_PRODUCERS, FailureModeSchema, FaucetConfirmedTelemetryEventSchema, FaucetFailedTelemetryEventSchema, FaucetRequestedTelemetryEventSchema, InMemoryTelemetryBusAdapter, MemberActivationFailedTelemetryEventSchema, MemberActivationReadyTelemetryEventSchema, MemberActivationStartedTelemetryEventSchema, MovementScanCheckpointTelemetryEventSchema, MovementScanIncidentTelemetryEventSchema, MovementScanWindowTelemetryEventSchema, OnboardingDashboardReachedTelemetryEventSchema, OnboardingIntentSelectedTelemetryEventSchema, OnboardingOrganizationSubmittedTelemetryEventSchema, OnboardingProfileSubmittedTelemetryEventSchema, OperationRetriedTelemetryEventSchema, OrgCreateFailedTelemetryEventSchema, OrgCreateStartedTelemetryEventSchema, OrgCreatedTelemetryEventSchema, OrgInviteAcceptedTelemetryEventSchema, OrgInviteExpiredTelemetryEventSchema, OrgInviteSentTelemetryEventSchema, OrgRolesSeededTelemetryEventSchema, OrgSafeConfirmedTelemetryEventSchema, OrgSafeCreatedTelemetryEventSchema, OrganizationCreationFailedTelemetryEventSchema, OrganizationCreationReadyTelemetryEventSchema, OrganizationCreationStartedTelemetryEventSchema, PII, PRODUCT_MAPPER_GATED_TELEMETRY_EVENTS, PaymentFailedTelemetryEventSchema, PaymentInitiatedTelemetryEventSchema, PaymentLifecycleTransitionTelemetryEventSchema, PaymentSettledTelemetryEventSchema, PaymentVerificationRetryTelemetryEventSchema, PermissionMirrorVerificationTelemetryEventSchema, PostHogTelemetryAdapter, ProvisioningSafeConfirmedTelemetryEventSchema, ProvisioningSafeCreatedTelemetryEventSchema, QuickPayExternalAddressAcknowledgedTelemetryEventSchema, ReceiptPendingTelemetryEventSchema, RecordingTelemetryAdapter, ResponseHeadersSchema, SYNCABLE_CAPXUL_ENVS, TELEMETRY_EVENT_NAMES, TELEMETRY_EVENT_SCHEMAS, TELEMETRY_JOURNEYS, TELEMETRY_PRODUCERS, UiActivityActionCompletedTelemetryEventSchema, UiContactActionCompletedTelemetryEventSchema, createCapxulBeforeSend, createPostHogBrowserPageviewTracker, getTrackHandler, initializeCapxulBrowserAnalytics, initializePostHogBrowserAnalytics, isCapxulOperation, maskCapturedNetworkRequest, normalizeCapxulOperation, productAppAnalytics, redactTelemetryEvent, redactTelemetryProps, sanitizePostHogBrowserEvent, setTrackHandler, stampTelemetryEnvelope, track, utilityAppAnalytics };
+export { AccessRecoveryCompletedTelemetryEventSchema, AccountBalanceFailedTelemetryEventSchema, AccountBalanceReadTelemetryEventSchema, ActivityAnnotationSavedTelemetryEventSchema, AuthFailedTelemetryEventSchema, AuthOtpDeliveredTelemetryEventSchema, AuthOtpExpiredTelemetryEventSchema, AuthOtpRequestedTelemetryEventSchema, AuthSignedOutTelemetryEventSchema, AuthVerifiedTelemetryEventSchema, BROWSER_GATED_TELEMETRY_EVENTS, BootstrapFailedTelemetryEventSchema, BootstrapResolvedTelemetryEventSchema, BundlerErrorTelemetryEventSchema, CAPXUL_ENVS, CAPXUL_OPERATIONS, CONTRACT_FIRST_TELEMETRY_EVENTS, ChainAttemptSchema, ChainUpstreamFallbackTelemetryEventSchema, ChainUpstreamSchema, ContactRelationshipChangedTelemetryEventSchema, DepositInitiatedTelemetryEventSchema, DepositSettledTelemetryEventSchema, FINANCIAL_OPS_TARGET_TELEMETRY_PRODUCERS, FailureModeSchema, FaucetConfirmedTelemetryEventSchema, FaucetFailedTelemetryEventSchema, FaucetRequestedTelemetryEventSchema, IdentityRefusedTelemetryEventSchema, InMemoryTelemetryBusAdapter, InvoiceIssuedTelemetryEventSchema, InvoiceRequestTransitionedTelemetryEventSchema, MemberActivationFailedTelemetryEventSchema, MemberActivationReadyTelemetryEventSchema, MemberActivationStartedTelemetryEventSchema, MovementScanCheckpointTelemetryEventSchema, MovementScanIncidentTelemetryEventSchema, MovementScanWindowTelemetryEventSchema, OnboardingDashboardReachedTelemetryEventSchema, OnboardingIntentSelectedTelemetryEventSchema, OnboardingOrganizationSubmittedTelemetryEventSchema, OnboardingProfileSubmittedTelemetryEventSchema, OperationRetriedTelemetryEventSchema, OrgCreateFailedTelemetryEventSchema, OrgCreateStartedTelemetryEventSchema, OrgCreatedTelemetryEventSchema, OrgInviteAcceptedTelemetryEventSchema, OrgInviteExpiredTelemetryEventSchema, OrgInviteProgressedTelemetryEventSchema, OrgInviteSentTelemetryEventSchema, OrgRolesSeededTelemetryEventSchema, OrgSafeConfirmedTelemetryEventSchema, OrgSafeCreatedTelemetryEventSchema, OrganizationCreationFailedTelemetryEventSchema, OrganizationCreationReadyTelemetryEventSchema, OrganizationCreationStartedTelemetryEventSchema, PII, PRODUCT_MAPPER_GATED_TELEMETRY_EVENTS, PaymentFailedTelemetryEventSchema, PaymentInitiatedTelemetryEventSchema, PaymentLifecycleTransitionTelemetryEventSchema, PaymentSettledTelemetryEventSchema, PaymentVerificationRetryTelemetryEventSchema, PayrollGroupChangedTelemetryEventSchema, PayrollRunTransitionedTelemetryEventSchema, PermissionMirrorVerificationTelemetryEventSchema, PostHogTelemetryAdapter, ProvisioningSafeConfirmedTelemetryEventSchema, ProvisioningSafeCreatedTelemetryEventSchema, QuickPayExternalAddressAcknowledgedTelemetryEventSchema, ReceiptPendingTelemetryEventSchema, RecordingTelemetryAdapter, ResponseHeadersSchema, SYNCABLE_CAPXUL_ENVS, TELEMETRY_EVENT_NAMES, TELEMETRY_EVENT_SCHEMAS, TELEMETRY_JOURNEYS, TELEMETRY_PRODUCERS, UiAccessStepCompletedTelemetryEventSchema, UiActivityActionCompletedTelemetryEventSchema, UiContactActionCompletedTelemetryEventSchema, UiInvoiceStepCompletedTelemetryEventSchema, UiPayrollActionCompletedTelemetryEventSchema, UiReceiveStepCompletedTelemetryEventSchema, UiTreasuryStepCompletedTelemetryEventSchema, createCapxulBeforeSend, createPostHogBrowserPageviewTracker, getTrackHandler, initializeCapxulBrowserAnalytics, initializePostHogBrowserAnalytics, isCapxulOperation, maskCapturedNetworkRequest, normalizeCapxulOperation, productAppAnalytics, redactTelemetryEvent, redactTelemetryProps, sanitizePostHogBrowserEvent, setTrackHandler, stampTelemetryEnvelope, track, utilityAppAnalytics };