@corbado/autocapture 0.1.0-next.2-dd9eb36

package/README.md

@@ -0,0 +1,174 @@
+# @corbado/autocapture
+
+Observe browser authentication signals without changing application code.
+
+`@corbado/autocapture` provides small, focused observers for the browser APIs that authentication
+flows run through. Each observer reports a well-defined stream of events while leaving the
+application — and other code sharing the same APIs — as safely as browser monkey-patching permits.
+It is designed to be dropped into a page it does not own and fail closed when a surface cannot be
+instrumented safely. The remaining cases where observation cannot be perfectly transparent are
+called out in the safety invariants and data handling sections below.
+
+The package observes five kinds of signal:
+
+- **WebAuthn ceremonies** — the lifecycle of `navigator.credentials.get`/`create` passkey
+  ceremonies, from invocation to settlement, including silent cancellations.
+- **Network requests and exchanges** — request starts and their eventual outcomes over
+  `XMLHttpRequest` and `fetch`, limited to URLs a caller-provided predicate selects. A page-local
+  request ID correlates both callbacks.
+- **In-app navigation** — same-document (SPA) route changes.
+- **Shadow roots** — open or closed roots attached after capture starts, plus discoverable existing
+  open roots when explicitly requested.
+- **Rendered UI state** — caller-owned semantic snapshots read after selected UI events or
+  imperative triggers settle.
+
+It has no runtime dependencies, ships TypeScript type definitions, and targets ES2019 so it parses
+on older engines.
+
+## Installation
+
+```sh
+npm install @corbado/autocapture
+```
+
+## Usage
+
+Every observer follows the platform observer pattern (`MutationObserver`, `ResizeObserver`): create
+it with a callback, receive events, and call `disconnect()` when finished.
+
+```ts
+import {
+  captureWebAuthn,
+  captureNetwork,
+  captureNavigation,
+  captureShadowRoots,
+} from "@corbado/autocapture";
+
+const webauthn = captureWebAuthn({
+  onEvent: (event) => console.log(event.kind, event.phase, event.ceremonyId),
+});
+
+const network = captureNetwork({
+  match: (url) => url.origin === location.origin && url.pathname.startsWith("/auth-api/"),
+  bodyCapture: {
+    request: (body) => {
+      const value = typeof body === "string" ? JSON.parse(body) : body;
+      return value && typeof value === "object" ? { type: "type" in value ? value.type : undefined } : undefined;
+    },
+    response: (body) => {
+      const value = typeof body === "string" ? JSON.parse(body) : body;
+      return value && typeof value === "object" ? { status: "status" in value ? value.status : undefined } : undefined;
+    },
+  },
+  onRequest: (request) => console.log(request.requestId, request.method, request.path),
+  onExchange: (exchange) => console.log(exchange.method, exchange.path, exchange.status, exchange.outcome),
+});
+
+const navigation = captureNavigation({
+  onNavigate: (event) => console.log(event.source, event.path),
+});
+
+const shadowRoots = captureShadowRoots({
+  onAttached: ({ host, shadowRoot, mode }) => console.log(host, shadowRoot, mode),
+});
+
+// when finished
+webauthn.disconnect();
+network.disconnect();
+navigation.disconnect();
+shadowRoots.disconnect();
+```
+
+Each call returns a `CaptureHandle` with a mode (`"standard"` or `"unavailable"`) and a
+`disconnect()` method. Environments that cannot be instrumented report `"unavailable"` rather than
+throwing; a misconfigured `captureNetwork` call (missing `match` or `onExchange`) throws a
+`TypeError` instead, since that is a programming error, not a degraded environment. Full event and
+option types ship with the package.
+
+## Safety invariants
+
+The observers run inside application call paths, so their behaviour is defined by what they promise
+never to disturb:
+
+- **Exact host delegation.** Patched methods call the delegate once with the original receiver and
+  argument vector, and preserve its return value and synchronous exception. Non-WebAuthn Credential
+  Management calls are literal pass-throughs. Two Promise-observation choices are unavoidable:
+  public-key ceremonies return a derived Promise (identity and microtask timing change), and fetch
+  settlement is observed on the platform Promise itself, so an ignored failed fetch no longer
+  surfaces as an `unhandledrejection`.
+- **Observation is firewalled.** Synchronous callback, projector, serializer, and logger faults
+  are contained; rejected asynchronous event callbacks are consumed and logged. The firewall covers
+  first-party faults on a real browser engine — hostile polyfills and patched built-ins are outside
+  the threat model.
+- **Coexistence over ownership.** Existing delegates are preserved, slots are restored only while
+  still owned by the capture, and later wrappers are never overwritten. A buried wrapper becomes an
+  inert pass-through after disconnect. Locked WebAuthn methods are never bypassed through a container
+  proxy; the entire WebAuthn attachment is rolled back and reported as unavailable.
+- **Exactly-once reporting.** Each patched surface holds a single capture wrapper, so one
+  application action passes through observation once. A later integration that overwrites a wrapped
+  method without forwarding through it displaces capture for that surface: the application call
+  still succeeds, telemetry is lost. A package wrapper hidden below an unknown third-party wrapper
+  cannot currently be detected by another copy.
+- **Conditional removal.** `disconnect()` stops delivery immediately, releases active listeners, and
+  restores only slots still owned by the capture. If another integration sits above it, the inert
+  pass-through is deliberately left in that chain.
+
+These are implementation invariants, not a claim that monkey-patching is undetectable or has zero
+timing, memory, privacy, or Promise-semantics impact.
+
+## Data handling
+
+Network observation is designed for minimal data exposure:
+
+- Only URLs a caller's `match` predicate explicitly selects are observed; all other traffic is
+  ignored. The Corbado `/observe/events/{projectID}` sink is always excluded to prevent recursion.
+- Requests and exchanges carry **metadata only** by default. `onRequest` runs after the platform
+  accepts the call; `onExchange` reports its eventual outcome, and their `requestId` values match. A
+  request or response body is read only when the caller configures a projector for that direction.
+- Projected XHR request bodies are available at request time. For `fetch(new Request(...))`, reading
+  the request clone is asynchronous, so the request body may be absent from `onRequest` and present
+  only on `onExchange`; string bodies passed through `RequestInit` are available synchronously.
+- Autocapture performs no generic body parsing or redaction. The endpoint-specific projector is the
+  privacy boundary: it receives the matched raw body and must return only the fields the consumer is
+  allowed to observe. Only that projected value is attached to the exchange. Projector failures,
+  promises, `undefined`, oversized output, and non-JSON output fail closed by omitting the body.
+- Projected outputs are size-bounded (`maxBodyChars`, on the JSON-serialized projection); raw bodies
+  are not size-checked, since matched traffic is first-party. Readable bodies come from isolated
+  clones read within a 500 ms window; the source body is never directly consumed, and streaming and
+  binary payloads are never read. Body cloning still has inherent stream tee/backpressure costs, so
+  enabling it is a security and performance decision.
+
+Network metadata currently includes the resolved full URL and final response URL. Query strings can
+contain secrets or PII; callers should restrict `match` accordingly until a URL-redaction policy is
+chosen.
+
+Navigation events likewise contain the raw `search` and `hash`. OAuth responses, password-reset
+links, and application routes can put secrets or PII there; no navigation redaction policy is
+currently applied.
+
+WebAuthn responses use an explicit serializer rather than `credential.toJSON()`. The allowlist keeps
+the assertion and attestation fields the Observe backend parses for credential, authenticator,
+backup-state, AAGUID, transport, and discoverability insight. Client-extension output is limited to
+`credProps.rk`; PRF and unrelated extension results are omitted. The payload therefore still contains
+credential IDs, user handles, challenges, signatures, authenticator data, and attestation material.
+
+The tested 1Password browser extension exposes locked `get` and `create` accessors. WebAuthn capture
+therefore reports `mode: "unavailable"`; passkey operations continue through 1Password unchanged but
+produce no autocaptured WebAuthn events. Password managers that wrap the writable methods before
+autocapture are delegated to; one that assigns its wrapper afterwards keeps working, and its
+ceremonies stay observed when the wrapper forwards through the method it replaced (the surveyed
+managers do). A later assignment that does not forward displaces WebAuthn telemetry.
+
+Shadow capture can retain access to closed roots that the page normally cannot rediscover. Treat the
+callback as a privileged capability and do not enable `includeExisting` without accepting a
+synchronous full-DOM walk.
+
+## Runtime support
+
+The published bundle targets ES2019 and assumes ES2019-era runtime primitives such as `Promise`,
+`WeakMap`, `WeakSet`, `Symbol`, `Reflect`, and `URL`. Body capture additionally relies on the
+Streams API and `TextDecoder`; these are part of the assumed baseline, not feature-detected at
+runtime. The current real-browser suite covers current
+Chromium, Firefox, and WebKit, with password-manager simulation and virtual WebAuthn in Chromium.
+That is not yet evidence for old iOS, Android WebView, legacy Edge, or arbitrary polyfills; expanding
+the declared browser floor and test matrix is an open release decision.

package/dist/index.d.mts

@@ -0,0 +1,378 @@
+/** Receives optional diagnostics. Capture functions remain silent when no logger is provided. */
+type Logger = {
+    /** Records a non-fatal diagnostic message. */
+    log: (...args: unknown[]) => void;
+};
+/** Controls a capture session. */
+type CaptureHandle = {
+    /**
+     * Result of starting the capture.
+     *
+     * - `"standard"`: capture started normally.
+     * - `"unavailable"`: capture could not be started and will not emit events.
+     */
+    readonly mode: "standard" | "unavailable";
+    /** Stops future event delivery. Safe to call more than once. */
+    disconnect(): void;
+};
+/** WebAuthn operation that initiated a ceremony. */
+type WebAuthnCeremonyKind = "get" | "create";
+/**
+ * A lifecycle event for a WebAuthn ceremony initiated through
+ * `navigator.credentials.get()` or `navigator.credentials.create()`.
+ */
+type WebAuthnCeremonyEvent = {
+    /** WebAuthn operation that initiated the ceremony. */
+    kind: WebAuthnCeremonyKind;
+    /** Identifier shared by all events belonging to the same ceremony. */
+    ceremonyId: string;
+    /** Current ceremony lifecycle phase. */
+    phase: "started" | "completed" | "failed";
+    /** Requested mediation mode, when available. */
+    mediation?: string;
+    /** Whether transient user activation was active when the ceremony started. Present on `started` events when exposed by the browser. */
+    userActivation?: boolean;
+    /**
+     * JSON-encoded request metadata for a `get` ceremony: `rpId`, `timeout`,
+     * `userVerification`, `hints`, `challenge`, and `allowCredentials`
+     * (`type`, `id`, and `transports`). Binary values are base64url-encoded.
+     * Unavailable fields are omitted. Present on `started` events when
+     * serialization succeeds. Treat this value as sensitive telemetry.
+     */
+    requestOptionsJson?: string;
+    /** Whether a `get` request included at least one allowed credential. Present on `started` events. */
+    hasAllowCredentials?: boolean;
+    /**
+     * JSON-encoded, allowlisted credential returned by a completed ceremony.
+     * Common fields are `id`, `rawId`, `type`, and `authenticatorAttachment`.
+     * Assertion responses include `clientDataJSON`, `authenticatorData`,
+     * `signature`, and `userHandle`; attestation responses include
+     * `clientDataJSON`, `attestationObject`, and `transports`. Binary values are
+     * base64url-encoded. Of the client-extension results, only `credProps.rk` may
+     * be included. Present when serialization succeeds. Treat this value as
+     * sensitive telemetry.
+     */
+    credentialJson?: string;
+    /** Rejection value from a failed ceremony. This may contain application-specific data. */
+    error?: unknown;
+    /** Error name for a failed ceremony, or `UnknownError` when no DOM exception name is available. */
+    errorName?: string;
+    /**
+     * `true` when the request signal was observed as aborted before settlement.
+     * A credential manager may still complete such a ceremony, so this can be
+     * present on either a `completed` or `failed` event.
+     */
+    aborted?: boolean;
+};
+/** Options for {@link captureWebAuthn}. */
+type WebAuthnCaptureOptions = {
+    /** Receives WebAuthn lifecycle events. Return values are not awaited. */
+    onEvent: (event: WebAuthnCeremonyEvent) => void;
+    /** Optional diagnostic logger. */
+    logger?: Logger;
+};
+/** Network API used for an observed exchange. */
+type NetworkTransport = "xhr" | "fetch";
+/** A matched network request immediately after the platform accepted it. */
+type HttpRequestStarted = {
+    /** Identifier shared with the eventual {@link HttpExchange}. */
+    requestId: string;
+    /** Network API used for the request. */
+    transport: NetworkTransport;
+    /** Uppercase HTTP method. */
+    method: string;
+    /** Resolved absolute request input URL. */
+    url: string;
+    /** Pathname component of the request URL. */
+    path: string;
+    /** Timestamp captured at the request boundary. */
+    startedAt: number;
+    /** Request-body value returned by the configured projector, when synchronously available. */
+    requestBody?: unknown;
+};
+/** An observed network request and its outcome. */
+type HttpExchange = {
+    /** Identifier shared with the corresponding {@link HttpRequestStarted}. */
+    requestId: string;
+    /** Network API used for the request. */
+    transport: NetworkTransport;
+    /** Uppercase HTTP method. */
+    method: string;
+    /**
+     * Resolved absolute request input URL, including its query string and
+     * fragment. Redact it before forwarding if either component may be sensitive.
+     */
+    url: string;
+    /** Pathname component of the request URL. */
+    path: string;
+    /** HTTP status code, or `0` when a status is unavailable. */
+    status: number;
+    /** Whether the status code represents a successful response. */
+    ok: boolean;
+    /**
+     * How the request completed. `load` includes successful and non-successful
+     * HTTP responses; inspect `ok` or `status` for HTTP success.
+     */
+    outcome: "load" | "abort" | "timeout" | "error";
+    /** Elapsed request time in milliseconds, when available. */
+    durationMs?: number;
+    /**
+     * Final absolute response URL, when available. This may differ from `url`
+     * after redirects and may contain sensitive query or fragment values.
+     */
+    responseUrl?: string;
+    /** Request-body value returned by the configured projector, when available. */
+    requestBody?: unknown;
+    /** Response-body value returned by the configured projector, when available. */
+    responseBody?: unknown;
+};
+/** Metadata supplied to a body projector for one matched exchange. */
+type NetworkBodyProjectionContext = {
+    /** Whether the observed body belongs to the request or response. */
+    direction: "request" | "response";
+    /** Network API used by the application. */
+    transport: NetworkTransport;
+    /** Uppercase HTTP method. */
+    method: string;
+    /** Resolved absolute request URL. */
+    url: string;
+    /** Pathname component of the request URL. */
+    path: string;
+};
+/**
+ * Synchronously selects the only body data that may leave network capture.
+ * Textual bodies are supplied as strings; an XHR with `responseType="json"`
+ * supplies the browser-parsed value. Returning `undefined`, throwing, or
+ * returning a Promise omits the body without affecting the application.
+ */
+type NetworkBodyProjector = (body: unknown, context: NetworkBodyProjectionContext) => unknown;
+/** Options for {@link captureNetwork}. */
+type NetworkCaptureOptions = {
+    /**
+     * Selects requests to observe. The URL is resolved against the document base
+     * URL and the method is uppercase. Return `true` to observe the request. The
+     * Corbado Observe event endpoint is always excluded to prevent recursion.
+     * This callback must return synchronously; Promise results are not matched.
+     */
+    match: (url: URL, method: string) => boolean;
+    /** Receives completed network exchanges. Return values are not awaited. */
+    onExchange: (exchange: HttpExchange) => void;
+    /**
+     * Receives matched requests after the platform call succeeds. The request ID
+     * matches the eventual exchange. Return values are not awaited.
+     */
+    onRequest?: (request: HttpRequestStarted) => void;
+    /**
+     * Network APIs to observe. Defaults to both `xhr` and `fetch`. Unavailable
+     * transports are skipped if at least one requested transport can be observed.
+     */
+    transports?: readonly NetworkTransport[];
+    /**
+     * Best-effort body observation, enabled independently per direction by a
+     * mandatory projector. Without a projector, that direction is never read.
+     * Autocapture performs no generic parsing or redaction: the projector owns
+     * data minimization and its return value is the only body data reported.
+     */
+    bodyCapture?: {
+        /** Projects a bounded request body. */
+        request?: NetworkBodyProjector;
+        /** Projects a bounded response body. */
+        response?: NetworkBodyProjector;
+    };
+    /**
+     * Maximum size of a projected body attached to a request or exchange,
+     * measured on its JSON-serialized form; larger projections are omitted.
+     * Raw bodies are not size-checked before projection — matched traffic is
+     * first-party and assumed well-behaved. Must be a finite, non-negative
+     * number when provided. Defaults to 65,536.
+     */
+    maxBodyChars?: number;
+    /** Optional diagnostic logger. */
+    logger?: Logger;
+};
+/** Mechanism that produced a navigation event. */
+type NavigationSource = "push" | "replace" | "pop" | "hash";
+/** A same-document navigation. */
+type NavigationEvent = {
+    /** Current URL pathname. */
+    path: string;
+    /** Current URL query string, including the leading `?` when present. May contain sensitive data. */
+    search: string;
+    /** Current URL fragment, including the leading `#` when present. May contain sensitive data. */
+    hash: string;
+    /** Mechanism that produced the event. */
+    source: NavigationSource;
+};
+/** Options for {@link captureNavigation}. */
+type NavigationCaptureOptions = {
+    /** Receives same-document navigation events. Return values are not awaited. */
+    onNavigate: (event: NavigationEvent) => void;
+    /** Optional diagnostic logger. */
+    logger?: Logger;
+};
+/** A shadow root reported by {@link captureShadowRoots}. */
+type ShadowRootAttachedEvent = {
+    /** Element that owns the shadow root. */
+    host: Element;
+    /**
+     * Attached shadow root. For a closed root, `host.shadowRoot` remains `null`;
+     * retain this reference if later access is required.
+     */
+    shadowRoot: ShadowRoot;
+    /** Shadow root mode. */
+    mode: "open" | "closed";
+};
+/** Options for {@link captureShadowRoots}. */
+type ShadowRootCaptureOptions = {
+    /** Receives shadow roots synchronously. Return values are not awaited. */
+    onAttached: (event: ShadowRootAttachedEvent) => void;
+    /**
+     * Also reports open shadow roots that already exist when capture starts.
+     * These callbacks may run before `captureShadowRoots()` returns. Existing
+     * closed roots cannot be discovered. Defaults to `false`.
+     */
+    includeExisting?: boolean;
+    /** Optional diagnostic logger. */
+    logger?: Logger;
+};
+/** Event that should schedule a rendered UI-state read. */
+type UiStateTrigger = {
+    target: EventTarget;
+    type: string;
+    capture?: boolean;
+};
+/** A capture handle that also accepts imperative triggers such as completed network exchanges. */
+type UiStateCaptureHandle = CaptureHandle & {
+    /** Coalesces a state read onto the next task, after the application's synchronous layout work. */
+    schedule(): void;
+};
+/** Options for {@link captureUiState}. State interpretation remains application-owned. */
+type UiStateCaptureOptions<T> = {
+    /** Reads one allowlisted semantic snapshot. Return undefined to emit nothing. */
+    read: () => T | undefined;
+    /** Receives the snapshot after the deferred read. Return values are not awaited. */
+    onState: (state: T) => void;
+    /** DOM/custom events that should schedule a read. */
+    triggers?: readonly UiStateTrigger[];
+    /** Task delay in milliseconds. Defaults to 0. */
+    delayMs?: number;
+    /** Optional diagnostic logger. */
+    logger?: Logger;
+};
+
+/**
+ * Observes WebAuthn ceremonies initiated through
+ * `navigator.credentials.get()` and `navigator.credentials.create()`.
+ *
+ * While capture is active, each ceremony emits a `started` event followed by a
+ * correlated `completed` or `failed` event. Credential Management calls
+ * without `publicKey` options are not reported. Observation never changes a
+ * ceremony's arguments, result, or error; a fault in event delivery is
+ * contained, and the ceremony proceeds as if unobserved.
+ *
+ * Attachment is all-or-nothing. When WebAuthn cannot be observed in the
+ * current environment — the API is missing, a capture is already active, or
+ * another integration holds the credential methods in a form that cannot be
+ * shared — nothing is modified and the returned handle reports
+ * `mode: "unavailable"`.
+ *
+ * Assumptions and limitations:
+ *
+ * - Options are expected to be plain dictionaries as defined by the Credential
+ *   Management and WebAuthn specifications. Exotic option objects, such as
+ *   proxies or dictionaries with accessor members, are not supported.
+ * - Some password-manager extensions expose the credential methods in a form
+ *   that cannot be observed. Capture then reports `mode: "unavailable"`;
+ *   authentication continues but produces no events.
+ * - A script that replaces the credential methods or the whole
+ *   `navigator.credentials` object after capture starts is left untouched.
+ *   Authentication continues, but ceremonies are no longer reported unless the
+ *   replacement delegates to the methods it replaced.
+ *
+ * @param options Event callback and optional diagnostic logger.
+ * @returns A handle used to inspect the capture mode or stop event delivery.
+ */
+declare function captureWebAuthn(options: WebAuthnCaptureOptions): CaptureHandle;
+
+/**
+ * Observes selected requests made through `XMLHttpRequest` and `fetch`.
+ *
+ * While capture remains active, selected requests on available transports can
+ * produce one {@link HttpRequestStarted} after the platform accepts the call,
+ * followed by one correlated {@link HttpExchange} after completion. The
+ * Corbado Observe event endpoint is always excluded. If only some requested
+ * transports are available, capture continues on those transports and reports
+ * the others to the optional logger.
+ *
+ * Exchanges contain metadata by default; body capture must be enabled
+ * explicitly.
+ *
+ * @param options Request selection, event callback, and optional body controls.
+ * @returns A handle used to inspect the capture mode or stop event delivery.
+ * @throws TypeError when `onExchange` or `match` is not a function — a
+ * misconfigured integration is a programming error, not a degraded mode.
+ */
+declare function captureNetwork(options: NetworkCaptureOptions): CaptureHandle;
+
+/**
+ * Observes same-document navigations produced by `history.pushState()`,
+ * `history.replaceState()`, browser history traversal, and fragment changes.
+ *
+ * No event is emitted when the pathname, query string, and fragment are all
+ * unchanged. Callbacks run synchronously with the observed navigation.
+ *
+ * @param options Navigation callback and optional diagnostic logger.
+ * @returns A handle used to inspect the capture mode or stop event delivery.
+ */
+declare function captureNavigation(options: NavigationCaptureOptions): CaptureHandle;
+
+/**
+ * Observes shadow roots attached after capture starts. Both open and closed
+ * roots are reported with their host and mode.
+ *
+ * Set `includeExisting` to also report discoverable open roots that already
+ * exist. Closed roots created before capture starts cannot be discovered.
+ * Callbacks run synchronously; existing roots may be reported before this
+ * function returns.
+ *
+ * Assumes a browser environment whose DOM and shadow DOM primitives behave
+ * as specified, and a `logger` that never throws. Behavior in environments
+ * that violate these assumptions is undefined.
+ *
+ * @param options Shadow-root callback and discovery options.
+ * @returns A handle used to inspect the capture mode or stop event delivery.
+ */
+declare function captureShadowRoots(options: ShadowRootCaptureOptions): CaptureHandle;
+/**
+ * Returns the first entry in `event.composedPath()` when available, otherwise
+ * returns `event.target`. Closed shadow boundaries remain subject to browser
+ * retargeting.
+ *
+ * @param event Event whose target should be resolved.
+ * @returns The deepest visible target, or `null` when the event has no target.
+ */
+declare function composedTarget(event: Event): EventTarget | null;
+/** Returns the visible composed event path; outside dispatch the path is empty and the retargeted target stands in. */
+declare function composedPath(event: Event): readonly EventTarget[];
+
+/**
+ * Defers allowlisted UI-state reads until the application has handled the
+ * triggering event. This is useful when a component announces a transition
+ * before synchronously updating its DOM, and for state changes that are only
+ * observable after a network callback or mutation.
+ */
+declare function captureUiState<T>(options: UiStateCaptureOptions<T>): UiStateCaptureHandle;
+
+/**
+ * Creates a diagnostic logger that writes to `console.log` with an optional
+ * prefix. Logging failures are ignored.
+ *
+ * @param prefix Prefix added to each message. Defaults to `[autocapture]`.
+ * @returns A logger suitable for the capture option objects.
+ */
+declare function createConsoleLogger(prefix?: string): Logger;
+
+/** Version identifier embedded in the current build. */
+declare const VERSION: string;
+
+export { type CaptureHandle, type HttpExchange, type HttpRequestStarted, type Logger, type NavigationCaptureOptions, type NavigationEvent, type NavigationSource, type NetworkBodyProjectionContext, type NetworkBodyProjector, type NetworkCaptureOptions, type NetworkTransport, type ShadowRootAttachedEvent, type ShadowRootCaptureOptions, type UiStateCaptureHandle, type UiStateCaptureOptions, type UiStateTrigger, VERSION, type WebAuthnCaptureOptions, type WebAuthnCeremonyEvent, type WebAuthnCeremonyKind, captureNavigation, captureNetwork, captureShadowRoots, captureUiState, captureWebAuthn, composedPath, composedTarget, createConsoleLogger };

package/dist/index.d.ts

@@ -0,0 +1,378 @@
+/** Receives optional diagnostics. Capture functions remain silent when no logger is provided. */
+type Logger = {
+    /** Records a non-fatal diagnostic message. */
+    log: (...args: unknown[]) => void;
+};
+/** Controls a capture session. */
+type CaptureHandle = {
+    /**
+     * Result of starting the capture.
+     *
+     * - `"standard"`: capture started normally.
+     * - `"unavailable"`: capture could not be started and will not emit events.
+     */
+    readonly mode: "standard" | "unavailable";
+    /** Stops future event delivery. Safe to call more than once. */
+    disconnect(): void;
+};
+/** WebAuthn operation that initiated a ceremony. */
+type WebAuthnCeremonyKind = "get" | "create";
+/**
+ * A lifecycle event for a WebAuthn ceremony initiated through
+ * `navigator.credentials.get()` or `navigator.credentials.create()`.
+ */
+type WebAuthnCeremonyEvent = {
+    /** WebAuthn operation that initiated the ceremony. */
+    kind: WebAuthnCeremonyKind;
+    /** Identifier shared by all events belonging to the same ceremony. */
+    ceremonyId: string;
+    /** Current ceremony lifecycle phase. */
+    phase: "started" | "completed" | "failed";
+    /** Requested mediation mode, when available. */
+    mediation?: string;
+    /** Whether transient user activation was active when the ceremony started. Present on `started` events when exposed by the browser. */
+    userActivation?: boolean;
+    /**
+     * JSON-encoded request metadata for a `get` ceremony: `rpId`, `timeout`,
+     * `userVerification`, `hints`, `challenge`, and `allowCredentials`
+     * (`type`, `id`, and `transports`). Binary values are base64url-encoded.
+     * Unavailable fields are omitted. Present on `started` events when
+     * serialization succeeds. Treat this value as sensitive telemetry.
+     */
+    requestOptionsJson?: string;
+    /** Whether a `get` request included at least one allowed credential. Present on `started` events. */
+    hasAllowCredentials?: boolean;
+    /**
+     * JSON-encoded, allowlisted credential returned by a completed ceremony.
+     * Common fields are `id`, `rawId`, `type`, and `authenticatorAttachment`.
+     * Assertion responses include `clientDataJSON`, `authenticatorData`,
+     * `signature`, and `userHandle`; attestation responses include
+     * `clientDataJSON`, `attestationObject`, and `transports`. Binary values are
+     * base64url-encoded. Of the client-extension results, only `credProps.rk` may
+     * be included. Present when serialization succeeds. Treat this value as
+     * sensitive telemetry.
+     */
+    credentialJson?: string;
+    /** Rejection value from a failed ceremony. This may contain application-specific data. */
+    error?: unknown;
+    /** Error name for a failed ceremony, or `UnknownError` when no DOM exception name is available. */
+    errorName?: string;
+    /**
+     * `true` when the request signal was observed as aborted before settlement.
+     * A credential manager may still complete such a ceremony, so this can be
+     * present on either a `completed` or `failed` event.
+     */
+    aborted?: boolean;
+};
+/** Options for {@link captureWebAuthn}. */
+type WebAuthnCaptureOptions = {
+    /** Receives WebAuthn lifecycle events. Return values are not awaited. */
+    onEvent: (event: WebAuthnCeremonyEvent) => void;
+    /** Optional diagnostic logger. */
+    logger?: Logger;
+};
+/** Network API used for an observed exchange. */
+type NetworkTransport = "xhr" | "fetch";
+/** A matched network request immediately after the platform accepted it. */
+type HttpRequestStarted = {
+    /** Identifier shared with the eventual {@link HttpExchange}. */
+    requestId: string;
+    /** Network API used for the request. */
+    transport: NetworkTransport;
+    /** Uppercase HTTP method. */
+    method: string;
+    /** Resolved absolute request input URL. */
+    url: string;
+    /** Pathname component of the request URL. */
+    path: string;
+    /** Timestamp captured at the request boundary. */
+    startedAt: number;
+    /** Request-body value returned by the configured projector, when synchronously available. */
+    requestBody?: unknown;
+};
+/** An observed network request and its outcome. */
+type HttpExchange = {
+    /** Identifier shared with the corresponding {@link HttpRequestStarted}. */
+    requestId: string;
+    /** Network API used for the request. */
+    transport: NetworkTransport;
+    /** Uppercase HTTP method. */
+    method: string;
+    /**
+     * Resolved absolute request input URL, including its query string and
+     * fragment. Redact it before forwarding if either component may be sensitive.
+     */
+    url: string;
+    /** Pathname component of the request URL. */
+    path: string;
+    /** HTTP status code, or `0` when a status is unavailable. */
+    status: number;
+    /** Whether the status code represents a successful response. */
+    ok: boolean;
+    /**
+     * How the request completed. `load` includes successful and non-successful
+     * HTTP responses; inspect `ok` or `status` for HTTP success.
+     */
+    outcome: "load" | "abort" | "timeout" | "error";
+    /** Elapsed request time in milliseconds, when available. */
+    durationMs?: number;
+    /**
+     * Final absolute response URL, when available. This may differ from `url`
+     * after redirects and may contain sensitive query or fragment values.
+     */
+    responseUrl?: string;
+    /** Request-body value returned by the configured projector, when available. */
+    requestBody?: unknown;
+    /** Response-body value returned by the configured projector, when available. */
+    responseBody?: unknown;
+};
+/** Metadata supplied to a body projector for one matched exchange. */
+type NetworkBodyProjectionContext = {
+    /** Whether the observed body belongs to the request or response. */
+    direction: "request" | "response";
+    /** Network API used by the application. */
+    transport: NetworkTransport;
+    /** Uppercase HTTP method. */
+    method: string;
+    /** Resolved absolute request URL. */
+    url: string;
+    /** Pathname component of the request URL. */
+    path: string;
+};
+/**
+ * Synchronously selects the only body data that may leave network capture.
+ * Textual bodies are supplied as strings; an XHR with `responseType="json"`
+ * supplies the browser-parsed value. Returning `undefined`, throwing, or
+ * returning a Promise omits the body without affecting the application.
+ */
+type NetworkBodyProjector = (body: unknown, context: NetworkBodyProjectionContext) => unknown;
+/** Options for {@link captureNetwork}. */
+type NetworkCaptureOptions = {
+    /**
+     * Selects requests to observe. The URL is resolved against the document base
+     * URL and the method is uppercase. Return `true` to observe the request. The
+     * Corbado Observe event endpoint is always excluded to prevent recursion.
+     * This callback must return synchronously; Promise results are not matched.
+     */
+    match: (url: URL, method: string) => boolean;
+    /** Receives completed network exchanges. Return values are not awaited. */
+    onExchange: (exchange: HttpExchange) => void;
+    /**
+     * Receives matched requests after the platform call succeeds. The request ID
+     * matches the eventual exchange. Return values are not awaited.
+     */
+    onRequest?: (request: HttpRequestStarted) => void;
+    /**
+     * Network APIs to observe. Defaults to both `xhr` and `fetch`. Unavailable
+     * transports are skipped if at least one requested transport can be observed.
+     */
+    transports?: readonly NetworkTransport[];
+    /**
+     * Best-effort body observation, enabled independently per direction by a
+     * mandatory projector. Without a projector, that direction is never read.
+     * Autocapture performs no generic parsing or redaction: the projector owns
+     * data minimization and its return value is the only body data reported.
+     */
+    bodyCapture?: {
+        /** Projects a bounded request body. */
+        request?: NetworkBodyProjector;
+        /** Projects a bounded response body. */
+        response?: NetworkBodyProjector;
+    };
+    /**
+     * Maximum size of a projected body attached to a request or exchange,
+     * measured on its JSON-serialized form; larger projections are omitted.
+     * Raw bodies are not size-checked before projection — matched traffic is
+     * first-party and assumed well-behaved. Must be a finite, non-negative
+     * number when provided. Defaults to 65,536.
+     */
+    maxBodyChars?: number;
+    /** Optional diagnostic logger. */
+    logger?: Logger;
+};
+/** Mechanism that produced a navigation event. */
+type NavigationSource = "push" | "replace" | "pop" | "hash";
+/** A same-document navigation. */
+type NavigationEvent = {
+    /** Current URL pathname. */
+    path: string;
+    /** Current URL query string, including the leading `?` when present. May contain sensitive data. */
+    search: string;
+    /** Current URL fragment, including the leading `#` when present. May contain sensitive data. */
+    hash: string;
+    /** Mechanism that produced the event. */
+    source: NavigationSource;
+};
+/** Options for {@link captureNavigation}. */
+type NavigationCaptureOptions = {
+    /** Receives same-document navigation events. Return values are not awaited. */
+    onNavigate: (event: NavigationEvent) => void;
+    /** Optional diagnostic logger. */
+    logger?: Logger;
+};
+/** A shadow root reported by {@link captureShadowRoots}. */
+type ShadowRootAttachedEvent = {
+    /** Element that owns the shadow root. */
+    host: Element;
+    /**
+     * Attached shadow root. For a closed root, `host.shadowRoot` remains `null`;
+     * retain this reference if later access is required.
+     */
+    shadowRoot: ShadowRoot;
+    /** Shadow root mode. */
+    mode: "open" | "closed";
+};
+/** Options for {@link captureShadowRoots}. */
+type ShadowRootCaptureOptions = {
+    /** Receives shadow roots synchronously. Return values are not awaited. */
+    onAttached: (event: ShadowRootAttachedEvent) => void;
+    /**
+     * Also reports open shadow roots that already exist when capture starts.
+     * These callbacks may run before `captureShadowRoots()` returns. Existing
+     * closed roots cannot be discovered. Defaults to `false`.
+     */
+    includeExisting?: boolean;
+    /** Optional diagnostic logger. */
+    logger?: Logger;
+};
+/** Event that should schedule a rendered UI-state read. */
+type UiStateTrigger = {
+    target: EventTarget;
+    type: string;
+    capture?: boolean;
+};
+/** A capture handle that also accepts imperative triggers such as completed network exchanges. */
+type UiStateCaptureHandle = CaptureHandle & {
+    /** Coalesces a state read onto the next task, after the application's synchronous layout work. */
+    schedule(): void;
+};
+/** Options for {@link captureUiState}. State interpretation remains application-owned. */
+type UiStateCaptureOptions<T> = {
+    /** Reads one allowlisted semantic snapshot. Return undefined to emit nothing. */
+    read: () => T | undefined;
+    /** Receives the snapshot after the deferred read. Return values are not awaited. */
+    onState: (state: T) => void;
+    /** DOM/custom events that should schedule a read. */
+    triggers?: readonly UiStateTrigger[];
+    /** Task delay in milliseconds. Defaults to 0. */
+    delayMs?: number;
+    /** Optional diagnostic logger. */
+    logger?: Logger;
+};
+
+/**
+ * Observes WebAuthn ceremonies initiated through
+ * `navigator.credentials.get()` and `navigator.credentials.create()`.
+ *
+ * While capture is active, each ceremony emits a `started` event followed by a
+ * correlated `completed` or `failed` event. Credential Management calls
+ * without `publicKey` options are not reported. Observation never changes a
+ * ceremony's arguments, result, or error; a fault in event delivery is
+ * contained, and the ceremony proceeds as if unobserved.
+ *
+ * Attachment is all-or-nothing. When WebAuthn cannot be observed in the
+ * current environment — the API is missing, a capture is already active, or
+ * another integration holds the credential methods in a form that cannot be
+ * shared — nothing is modified and the returned handle reports
+ * `mode: "unavailable"`.
+ *
+ * Assumptions and limitations:
+ *
+ * - Options are expected to be plain dictionaries as defined by the Credential
+ *   Management and WebAuthn specifications. Exotic option objects, such as
+ *   proxies or dictionaries with accessor members, are not supported.
+ * - Some password-manager extensions expose the credential methods in a form
+ *   that cannot be observed. Capture then reports `mode: "unavailable"`;
+ *   authentication continues but produces no events.
+ * - A script that replaces the credential methods or the whole
+ *   `navigator.credentials` object after capture starts is left untouched.
+ *   Authentication continues, but ceremonies are no longer reported unless the
+ *   replacement delegates to the methods it replaced.
+ *
+ * @param options Event callback and optional diagnostic logger.
+ * @returns A handle used to inspect the capture mode or stop event delivery.
+ */
+declare function captureWebAuthn(options: WebAuthnCaptureOptions): CaptureHandle;
+
+/**
+ * Observes selected requests made through `XMLHttpRequest` and `fetch`.
+ *
+ * While capture remains active, selected requests on available transports can
+ * produce one {@link HttpRequestStarted} after the platform accepts the call,
+ * followed by one correlated {@link HttpExchange} after completion. The
+ * Corbado Observe event endpoint is always excluded. If only some requested
+ * transports are available, capture continues on those transports and reports
+ * the others to the optional logger.
+ *
+ * Exchanges contain metadata by default; body capture must be enabled
+ * explicitly.
+ *
+ * @param options Request selection, event callback, and optional body controls.
+ * @returns A handle used to inspect the capture mode or stop event delivery.
+ * @throws TypeError when `onExchange` or `match` is not a function — a
+ * misconfigured integration is a programming error, not a degraded mode.
+ */
+declare function captureNetwork(options: NetworkCaptureOptions): CaptureHandle;
+
+/**
+ * Observes same-document navigations produced by `history.pushState()`,
+ * `history.replaceState()`, browser history traversal, and fragment changes.
+ *
+ * No event is emitted when the pathname, query string, and fragment are all
+ * unchanged. Callbacks run synchronously with the observed navigation.
+ *
+ * @param options Navigation callback and optional diagnostic logger.
+ * @returns A handle used to inspect the capture mode or stop event delivery.
+ */
+declare function captureNavigation(options: NavigationCaptureOptions): CaptureHandle;
+
+/**
+ * Observes shadow roots attached after capture starts. Both open and closed
+ * roots are reported with their host and mode.
+ *
+ * Set `includeExisting` to also report discoverable open roots that already
+ * exist. Closed roots created before capture starts cannot be discovered.
+ * Callbacks run synchronously; existing roots may be reported before this
+ * function returns.
+ *
+ * Assumes a browser environment whose DOM and shadow DOM primitives behave
+ * as specified, and a `logger` that never throws. Behavior in environments
+ * that violate these assumptions is undefined.
+ *
+ * @param options Shadow-root callback and discovery options.
+ * @returns A handle used to inspect the capture mode or stop event delivery.
+ */
+declare function captureShadowRoots(options: ShadowRootCaptureOptions): CaptureHandle;
+/**
+ * Returns the first entry in `event.composedPath()` when available, otherwise
+ * returns `event.target`. Closed shadow boundaries remain subject to browser
+ * retargeting.
+ *
+ * @param event Event whose target should be resolved.
+ * @returns The deepest visible target, or `null` when the event has no target.
+ */
+declare function composedTarget(event: Event): EventTarget | null;
+/** Returns the visible composed event path; outside dispatch the path is empty and the retargeted target stands in. */
+declare function composedPath(event: Event): readonly EventTarget[];
+
+/**
+ * Defers allowlisted UI-state reads until the application has handled the
+ * triggering event. This is useful when a component announces a transition
+ * before synchronously updating its DOM, and for state changes that are only
+ * observable after a network callback or mutation.
+ */
+declare function captureUiState<T>(options: UiStateCaptureOptions<T>): UiStateCaptureHandle;
+
+/**
+ * Creates a diagnostic logger that writes to `console.log` with an optional
+ * prefix. Logging failures are ignored.
+ *
+ * @param prefix Prefix added to each message. Defaults to `[autocapture]`.
+ * @returns A logger suitable for the capture option objects.
+ */
+declare function createConsoleLogger(prefix?: string): Logger;
+
+/** Version identifier embedded in the current build. */
+declare const VERSION: string;
+
+export { type CaptureHandle, type HttpExchange, type HttpRequestStarted, type Logger, type NavigationCaptureOptions, type NavigationEvent, type NavigationSource, type NetworkBodyProjectionContext, type NetworkBodyProjector, type NetworkCaptureOptions, type NetworkTransport, type ShadowRootAttachedEvent, type ShadowRootCaptureOptions, type UiStateCaptureHandle, type UiStateCaptureOptions, type UiStateTrigger, VERSION, type WebAuthnCaptureOptions, type WebAuthnCeremonyEvent, type WebAuthnCeremonyKind, captureNavigation, captureNetwork, captureShadowRoots, captureUiState, captureWebAuthn, composedPath, composedTarget, createConsoleLogger };

package/dist/index.js

@@ -0,0 +1 @@
+"use strict";var oe=Object.defineProperty;var xe=Object.getOwnPropertyDescriptor;var Le=Object.getOwnPropertyNames;var Ne=Object.prototype.hasOwnProperty;var De=(e,t)=>{for(var n in t)oe(e,n,{get:t[n],enumerable:!0})},Te=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Le(t))!Ne.call(e,o)&&o!==n&&oe(e,o,{get:()=>t[o],enumerable:!(r=xe(t,o))||r.enumerable});return e};var He=e=>Te(oe({},"__esModule",{value:!0}),e);var Ke={};De(Ke,{VERSION:()=>Pe,captureNavigation:()=>Re,captureNetwork:()=>ve,captureShadowRoots:()=>Oe,captureUiState:()=>Ae,captureWebAuthn:()=>pe,composedPath:()=>ce,composedTarget:()=>Ce,createConsoleLogger:()=>ke});module.exports=He(Ke);var ae={log:()=>{}};function j(e){return e?{log:(...t)=>{try{let n=e.log(...t);if(n&&(typeof n=="object"||typeof n=="function"))try{Promise.resolve(n).catch(()=>{})}catch{}}catch{}}}:ae}var le=Symbol.for("corbado.autocapture.installed");function B(e){try{return typeof e=="function"&&Object.prototype.hasOwnProperty.call(e,le)}catch{return!1}}function M(e,t){var r,o;let n=t;try{Object.defineProperty(e,le,{value:t,configurable:!0})}catch{}try{Object.defineProperty(e,"name",{value:(r=n.name)!=null?r:"",configurable:!0})}catch{}try{Object.defineProperty(e,"length",{value:(o=n.length)!=null?o:0,configurable:!0})}catch{}return e}function w(){return{mode:"unavailable",disconnect:()=>{}}}function _(e,t,n){let r=j(e);return o=>{try{let a=n(o);if(a&&(typeof a=="object"||typeof a=="function"))try{Promise.resolve(a).catch(d=>r.log(`${t} listener failed`,d))}catch(d){r.log(`${t} listener failed`,d)}}catch(a){r.log(`${t} listener failed`,a)}}}function pe(e){let t=j(e.logger),n=e.onEvent;if(typeof n!="function")return w();let r=typeof navigator=="undefined"?void 0:navigator,o=r==null?void 0:r.credentials;if(!r||!o)return t.log("webauthn capture unavailable: navigator.credentials missing"),w();let a=o.get,d=o.create;if(typeof a!="function"||typeof d!="function")return t.log("webauthn capture unavailable: credentials methods missing"),w();if(B(a)||B(d))return t.log("webauthn capture unavailable: an equivalent capture is already active"),w();let p=!1,v=0,k=_(t,"webauthn",s=>{if(p)return n(s)}),D=(s,b)=>{let L={invoke(...q){let O=this,R=q[0];if(!p||!Q(R)||!Q(R.publicKey))return Reflect.apply(b,O,q);let Z=R.publicKey,V=`wa-${++v}`,ee=Reflect.apply(b,O,q),f=typeof R.mediation=="string"?R.mediation:void 0,m=Q(R.signal)?R.signal:void 0,C={kind:s,ceremonyId:V,phase:"started",mediation:f,userActivation:je(r)};if(s==="get"){let c=Z;C.requestOptionsJson=Ie(c,t),C.hasAllowCredentials=Array.isArray(c.allowCredentials)&&c.allowCredentials.length>0}return k(C),Promise.resolve(ee).then(c=>(p&&k({kind:s,ceremonyId:V,phase:"completed",mediation:f,credentialJson:Be(c,s,t),...(m==null?void 0:m.aborted)===!0?{aborted:!0}:{}}),c),c=>{throw p&&k({kind:s,ceremonyId:V,phase:"failed",mediation:f,error:c,errorName:_e(c),...(m==null?void 0:m.aborted)===!0?{aborted:!0}:{}}),c})}}.invoke;return M(L,{name:s,length:0})},h=(s,b)=>{let L=D(s,b),q=Object.getOwnPropertyDescriptor(o,s);if(q&&(!("value"in q)||q.writable!==!0))return null;try{o[s]=L}catch{return null}return()=>{o[s]===L&&(q?o[s]=q.value:delete o[s])}},S=h("get",a),u=S?h("create",d):null;return!S||!u?(S==null||S(),t.log("webauthn capture unavailable: credentials methods cannot be patched safely"),w()):(p=!0,{mode:"standard",disconnect:()=>{p=!1,S(),u()}})}function je(e){let t=e.userActivation;return typeof(t==null?void 0:t.isActive)=="boolean"?t.isActive:void 0}function Be(e,t,n){var r;if(e)try{let o=e,a=o.response,d={id:z(o.id),rawId:$(o.rawId),type:z(o.type),authenticatorAttachment:z(o.authenticatorAttachment),response:t==="create"?{clientDataJSON:$(a==null?void 0:a.clientDataJSON),attestationObject:$(a==null?void 0:a.attestationObject),transports:ie((r=a==null?void 0:a.getTransports)==null?void 0:r.call(a))}:{clientDataJSON:$(a==null?void 0:a.clientDataJSON),authenticatorData:$(a==null?void 0:a.authenticatorData),signature:$(a==null?void 0:a.signature),userHandle:$(a==null?void 0:a.userHandle)},...t==="create"?Me(o):{}};return JSON.stringify(d)}catch(o){n.log("credential serialization failed",o);return}}function Ie(e,t){try{let n={},r=z(e.rpId),o=z(e.userVerification),a=ie(e.hints);return r!==void 0&&(n.rpId=r),typeof e.timeout=="number"&&Number.isFinite(e.timeout)&&(n.timeout=e.timeout),o!==void 0&&(n.userVerification=o),a!==void 0&&(n.hints=a),n.challenge=$(e.challenge),Array.isArray(e.allowCredentials)&&(n.allowCredentials=Ue(e.allowCredentials)),JSON.stringify(n)}catch(n){t.log("request options serialization failed",n);return}}function Ue(e){let t=[];for(let n of e){if(!Q(n))continue;let r=n;t.push({type:z(r.type),id:$(r.id),transports:ie(r.transports)})}return t}function ie(e){if(Array.isArray(e))return e.filter(t=>typeof t=="string")}function z(e){return typeof e=="string"?e:void 0}function Me(e){var r;let t=(r=e.getClientExtensionResults)==null?void 0:r.call(e);if(!Q(t))return{};let n=t.credProps;return!n||typeof n.rk!="boolean"?{}:{clientExtensionResults:{credProps:{rk:n.rk}}}}function $(e){let t;if(e instanceof ArrayBuffer)t=new Uint8Array(e);else if(ArrayBuffer.isView(e))t=new Uint8Array(e.buffer,e.byteOffset,e.byteLength);else return;let n="";for(let r of t)n+=String.fromCharCode(r);return btoa(n).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}function Q(e){return e!==null&&(typeof e=="object"||typeof e=="function")}function _e(e){return e instanceof DOMException?e.name:"UnknownError"}var fe=0;function he(){return fe+=1,`network-${fe}`}function Fe(e,t){let n=e.responseType;if(n===""||n==="text")return t(e.responseText);if(n==="json"){let r=e.response;return r==null?void 0:t(r)}}var Xe=500,We=65536,ge=Symbol("body-read-timeout");function ye(e){return/event-stream|octet-stream/i.test(e)?!1:/json|text|urlencoded/i.test(e)}async function me(e,t){let n=e.body;if(!n)return;let r=n.getReader(),o;try{let a=new Promise(v=>{o=setTimeout(()=>v(ge),Xe)}),d=new TextDecoder,p=[];for(;;){let v=await Promise.race([r.read(),a]);if(v===ge){t.log("body omitted: read timed out"),r.cancel().catch(()=>{});return}if(v.done)break;p.push(d.decode(v.value,{stream:!0}))}return p.push(d.decode()),p.join("")}catch{r.cancel().catch(()=>{});return}finally{o!==void 0&&clearTimeout(o)}}function se(e){var t;(t=e==null?void 0:e.body)==null||t.cancel().catch(()=>{})}function ue(e,t,n,r,o){try{let a=Object.getOwnPropertyDescriptor(e,t);Je(a,{...r,value:n})&&Object.defineProperty(e,t,r)}catch(a){o.log(`${String(t)} restoration skipped`,a)}}function Je(e,t){return!!e&&"value"in e&&"value"in t&&e.value===t.value&&e.writable===t.writable&&e.enumerable===t.enumerable&&e.configurable===t.configurable}function ve(e){var R,Z,V,ee;let{onExchange:t,onRequest:n,match:r}=e;if(typeof t!="function"||typeof r!="function")throw new TypeError("captureNetwork requires onExchange and match callbacks");let o=j(e.logger),a=(R=e.transports)!=null?R:["xhr","fetch"],d=(Z=e.bodyCapture)==null?void 0:Z.request,p=(V=e.bodyCapture)==null?void 0:V.response,v=typeof d=="function",k=typeof p=="function",D=(ee=e.maxBodyChars)!=null?ee:We,h=!1,S=_(o,"network",f=>{if(h)return t(f)}),u=_(o,"network request",f=>{if(h)return n==null?void 0:n(f)}),s=(f,m)=>{let C=m.direction==="request"?d:p;if(typeof C=="function")try{let c=C(f,m);if(c===void 0||typeof(c==null?void 0:c.then)=="function")return;let F=JSON.stringify(c);return F===void 0||F.length>D?void 0:JSON.parse(F)}catch(c){o.log("body projection failed",c);return}},b=(f,m)=>{try{let C=typeof document!="undefined"?document.baseURI:void 0,c=new URL(String(f),C);return/\/observe\/events\/[^/]+\/?$/.test(c.pathname)?void 0:r(c,m)===!0?{url:c.href,path:c.pathname}:void 0}catch{return}},L=()=>{if(typeof XMLHttpRequest=="undefined")return o.log("xhr capture unavailable: XMLHttpRequest missing"),null;let f=XMLHttpRequest.prototype,m=Object.getOwnPropertyDescriptor(f,"open"),C=Object.getOwnPropertyDescriptor(f,"send");if(!m||!("value"in m)||typeof m.value!="function"||!C||!("value"in C)||typeof C.value!="function")return o.log("xhr capture unavailable: XMLHttpRequest methods missing"),null;let c=m.value,F=C.value;if(B(c)||B(F))return o.log("xhr capture unavailable: an equivalent capture is already active"),null;let X=new WeakMap,A=new Set,x=!1,T={open(...E){var g;let i=Reflect.apply(c,this,E);if(!h||!x)return i;try{let N=X.get(this);N&&(N.reported=!0,(g=N.cleanupListeners)==null||g.call(N));let H=String(E[0]).toUpperCase(),P=b(E[1],H);P?X.set(this,{method:H,url:P.url,path:P.path,reported:!1}):X.delete(this)}catch(N){o.log("xhr open observation failed",N)}return i}}.open,J={send(...E){let i=h&&x?X.get(this):void 0;if(!i||i.reported||i.cleanupListeners)return Reflect.apply(F,this,E);let g=()=>{},N=!1;try{i.requestId=he();let P={direction:"request",transport:"xhr",method:i.method,url:i.url,path:i.path};i.requestBody=v&&typeof E[0]=="string"?s(E[0],P):void 0;let G=()=>{i.outcome===void 0&&(i.outcome="abort")},Y=()=>{i.outcome===void 0&&(i.outcome="timeout")},l=()=>{i.outcome===void 0&&(i.outcome="error")},y=()=>{var K;g();try{if(!h||!x||i.reported||!i.requestId)return;i.reported=!0;let U={direction:"response",transport:"xhr",method:i.method,url:i.url,path:i.path},re=this.status,de={requestId:i.requestId,transport:"xhr",method:i.method,url:i.url,path:i.path,status:re,ok:re>=200&&re<300,outcome:(K=i.outcome)!=null?K:"load",durationMs:i.startedAt!==void 0?Date.now()-i.startedAt:void 0,responseUrl:this.responseURL||void 0,requestBody:i.requestBody,responseBody:k?Fe(this,qe=>s(qe,U)):void 0};i.requestEmitted?S(de):i.pendingExchange=de}catch(U){o.log("xhr exchange observation failed",U)}finally{X.get(this)===i&&X.delete(this)}},I=()=>{try{this.readyState===XMLHttpRequest.DONE&&this.status!==0&&y()}catch(K){o.log("xhr ready-state observation failed",K)}},W=()=>y();g=()=>{for(let[K,U]of[["readystatechange",I],["abort",G],["timeout",Y],["error",l],["loadend",W]])this.removeEventListener(K,U);i.cleanupListeners===g&&(i.cleanupListeners=void 0),A.delete(g)},this.addEventListener("readystatechange",I),this.addEventListener("abort",G),this.addEventListener("timeout",Y),this.addEventListener("error",l),this.addEventListener("loadend",W),i.cleanupListeners=g,A.add(g),i.startedAt=Date.now(),N=!0}catch(P){o.log("xhr send observation failed",P),g()}let H;try{H=Reflect.apply(F,this,E)}catch(P){throw g(),P}if(N&&i.requestId!==void 0&&i.startedAt!==void 0){i.requestEmitted=!0,u({requestId:i.requestId,transport:"xhr",method:i.method,url:i.url,path:i.path,startedAt:i.startedAt,requestBody:i.requestBody});let P=i.pendingExchange;i.pendingExchange=void 0,P&&S(P)}return H}}.send;return M(T,c),M(J,F),m.writable!==!0||C.writable!==!0?(o.log("xhr capture unavailable: XMLHttpRequest methods are not writable"),null):(Object.defineProperty(f,"open",{...m,value:T}),Object.defineProperty(f,"send",{...C,value:J}),x=!0,()=>{x=!1;for(let E of[...A])E();ue(f,"open",T,m,o),ue(f,"send",J,C,o)})},q=()=>{let f=globalThis,m=Object.getOwnPropertyDescriptor(f,"fetch");if(!m||!("value"in m))return o.log("fetch capture unavailable: fetch is not an own data property"),null;let C=m.value;if(typeof C!="function")return o.log("fetch capture unavailable: fetch missing"),null;if(B(C))return o.log("fetch capture unavailable: an equivalent capture is already active"),null;let c=!1,F=async(A,x,T,J)=>{try{if(!h||!c){se(T);return}let[E,i]=await Promise.all([J!=null?J:Promise.resolve(void 0),T?me(T,o):Promise.resolve(void 0)]);if(!h||!c)return;let g={direction:"request",transport:"fetch",method:A.method,url:A.url,path:A.path},N={...g,direction:"response"},H=A.requestBody;H===void 0&&E!==void 0&&(H=s(E,g));let P=i!==void 0?s(i,N):void 0;S({requestId:A.requestId,transport:"fetch",method:A.method,url:A.url,path:A.path,status:x.status,ok:x.ok,outcome:"load",durationMs:Date.now()-A.startedAt,responseUrl:x.url||void 0,requestBody:H,responseBody:P})}catch(E){o.log("fetch exchange observation failed",E)}},X={fetch(...A){var H,P,G,Y;let x;try{let l=A[0],y=A[1];if(h&&c&&v&&typeof Request!="undefined"&&l instanceof Request&&(y==null?void 0:y.body)===void 0&&l.body){let I=String((H=y==null?void 0:y.method)!=null?H:l.method).toUpperCase(),W=(P=l.headers.get("content-type"))!=null?P:"";b(l.url,I)&&ye(W)&&(x=l.clone())}}catch(l){o.log("fetch observation failed",l)}let T,J=Date.now();try{T=Reflect.apply(C,this,A)}catch(l){throw se(x),l}let E,i;try{if(h&&c){let l=A[0],y=A[1],I=typeof Request!="undefined"&&l instanceof Request,W=String((G=y==null?void 0:y.method)!=null?G:I?l.method:"GET").toUpperCase(),K=I?l.url:l,U=b(K,W);U&&(E={requestId:he(),method:W,url:U.url,path:U.path,startedAt:J},i=(Y=y==null?void 0:y.signal)!=null?Y:I?l.signal:void 0,v&&typeof(y==null?void 0:y.body)=="string"&&(E.requestBody=s(y.body,{direction:"request",transport:"fetch",method:W,url:U.url,path:U.path})))}}catch(l){o.log("fetch observation failed",l)}if(!E)return se(x),T;let g=E;u({requestId:g.requestId,transport:"fetch",method:g.method,url:g.url,path:g.path,startedAt:g.startedAt,requestBody:g.requestBody});let N=x?me(x,o):void 0;return T.then(l=>{var I;let y;try{if(h&&c&&k){let W=(I=l.headers.get("content-type"))!=null?I:"";ye(W)&&l.body&&(y=l.clone())}}catch{}F(g,l,y,N)},l=>{try{if(!h||!c)return;let y=(i==null?void 0:i.aborted)===!0||(l==null?void 0:l.name)==="AbortError"||typeof DOMException!="undefined"&&l instanceof DOMException&&l.code===DOMException.ABORT_ERR;S({requestId:g.requestId,transport:"fetch",method:g.method,url:g.url,path:g.path,status:0,ok:!1,outcome:y?"abort":"error",durationMs:Date.now()-g.startedAt})}catch(y){o.log("fetch failure observation failed",y)}}),T}}.fetch;return M(X,C),m.writable!==!0?(o.log("fetch capture unavailable: fetch is not writable"),null):(Object.defineProperty(f,"fetch",{...m,value:X}),c=!0,()=>{c=!1,ue(f,"fetch",X,m,o)})},O=[];if(a.includes("xhr")){let f=L();f&&O.push(f)}if(a.includes("fetch")){let f=q();f&&O.push(f)}return O.length===0?w():(h=!0,{mode:"standard",disconnect:()=>{h=!1;for(let f of O.splice(0))f()}})}function Re(e){let t=j(),n;try{if(t=j(e.logger),n=e.onNavigate,typeof n!="function")return w()}catch{return w()}let r,o,a,d,p,v;try{if(r=window,o=r==null?void 0:r.history,!r||!o)return t.log("navigation capture unavailable: window/history missing"),w();if(p=we(o,"pushState"),v=we(o,"replaceState"),!p||!v)return t.log("navigation capture unavailable: history method descriptors missing"),w();if(a=p.descriptor.value,d=v.descriptor.value,typeof a!="function"||typeof d!="function")return t.log("navigation capture unavailable: history methods missing"),w();if(typeof r.addEventListener!="function"||typeof r.removeEventListener!="function")return t.log("navigation capture unavailable: window event methods missing"),w()}catch(O){return t.log("navigation capture unavailable: history inspection failed",O),w()}if(B(a)||B(d))return t.log("navigation capture unavailable: an equivalent capture is already active"),w();let k=!1,D=()=>({path:r.location.pathname,search:r.location.search,hash:r.location.hash}),h;try{h=D()}catch(O){return t.log("navigation capture unavailable: location inspection failed",O),w()}let S=_(t,"navigation",O=>{if(k)return n(O)}),u=O=>{if(k)try{let R=D();if(R.path===h.path&&R.search===h.search&&R.hash===h.hash)return;h=R,S({...R,source:O})}catch(R){t.log("navigation observation failed",R)}},s={pushState(...O){let R=Reflect.apply(a,this,O);return u("push"),R}}.pushState,b={replaceState(...O){let R=Reflect.apply(d,this,O);return u("replace"),R}}.replaceState;M(s,a),M(b,d);let L=()=>u("pop"),q=()=>u("hash");try{if(be(p,s),be(v,b),o.pushState!==s||o.replaceState!==b)throw new Error("history method replacement did not take effect");r.addEventListener("popstate",L),r.addEventListener("hashchange",q),k=!0}catch(O){return k=!1,ne(r,"popstate",L,t),ne(r,"hashchange",q,t),te(v,b,t),te(p,s,t),t.log("navigation capture unavailable: history methods are not writable",O),n=()=>{},S=()=>{},t=j(),w()}return{mode:"standard",disconnect:()=>{k=!1,n=()=>{},ne(r,"popstate",L,t),ne(r,"hashchange",q,t),te(p,s,t),te(v,b,t),S=()=>{},t=j()}}}function we(e,t){let n=e;for(;n;){let r=Object.getOwnPropertyDescriptor(n,t);if(r)return!("value"in r)||typeof r.value!="function"?null:{owner:n,key:t,descriptor:r};n=Object.getPrototypeOf(n)}return null}function be(e,t){if(e.descriptor.writable!==!0)throw new TypeError(`${e.key} is not writable`);let n=Object.getOwnPropertyDescriptor(e.owner,e.key);if(!Se(n,e.descriptor))throw new Error(`${e.key} changed during installation`);Object.defineProperty(e.owner,e.key,{...e.descriptor,value:t})}function Se(e,t){return!!e&&"value"in e&&"value"in t&&e.value===t.value&&e.writable===t.writable&&e.enumerable===t.enumerable&&e.configurable===t.configurable}function te(e,t,n){try{let r=Object.getOwnPropertyDescriptor(e.owner,e.key);Se(r,{...e.descriptor,value:t})&&Object.defineProperty(e.owner,e.key,e.descriptor)}catch(r){n.log(`navigation ${e.key} restoration skipped`,r)}}function ne(e,t,n,r){try{e.removeEventListener(t,n)}catch(o){r.log(`navigation ${t} listener removal skipped`,o)}}function Oe(e){var S;let t=(S=e.logger)!=null?S:ae,n=e.onAttached;if(typeof n!="function")return w();let r=Element.prototype,o=Object.getOwnPropertyDescriptor(r,"attachShadow");if(!o||typeof o.value!="function")return t.log("shadow-root capture unavailable: attachShadow not supported"),w();let a=o.value;if(B(a))return t.log("shadow-root capture unavailable: an equivalent capture is already active"),w();let d=!1,p=new WeakSet,v=_(t,"shadow-root",n),k=(u,s)=>{!d||p.has(s)||(p.add(s),v({host:u,shadowRoot:s,mode:s.mode==="closed"?"closed":"open"}))},D={attachShadow(...u){let s=Reflect.apply(a,this,u);return k(this,s),s}}.attachShadow;M(D,a);try{Object.defineProperty(r,"attachShadow",{...o,value:D})}catch(u){return t.log("shadow-root capture unavailable: attachShadow is locked",u),w()}d=!0;let h=u=>{let s=u.querySelectorAll("*");for(let b=0;b<s.length&&d;b++){let L=s[b].shadowRoot;L&&(k(s[b],L),h(L))}};return e.includeExisting&&h(document),{mode:"standard",disconnect:()=>{d=!1;let u=Object.getOwnPropertyDescriptor(r,"attachShadow");$e(u,{...o,value:D})&&Object.defineProperty(r,"attachShadow",o)}}}function Ce(e){var t;return(t=ce(e)[0])!=null?t:null}function ce(e){let t=e.composedPath();return t.length>0?t:e.target?[e.target]:[]}function $e(e,t){return!!e&&"value"in e&&"value"in t&&e.value===t.value&&e.writable===t.writable&&e.enumerable===t.enumerable&&e.configurable===t.configurable}function Ae(e){var D,h,S;let t=j(e==null?void 0:e.logger),n=e==null?void 0:e.read,r=e==null?void 0:e.onState;if(typeof n!="function"||typeof r!="function")return Ee();let o=Number.isFinite(e.delayMs)&&((D=e.delayMs)!=null?D:0)>=0&&(h=e.delayMs)!=null?h:0,a=_(t,"ui-state",r),d=!0,p,v=[],k=()=>{d&&(p!==void 0&&clearTimeout(p),p=setTimeout(()=>{if(p=void 0,!!d)try{let u=n();u!==void 0&&a(u)}catch(u){t.log("ui-state read failed",u)}},o))};try{for(let u of(S=e.triggers)!=null?S:[]){if(!(u!=null&&u.target)||typeof u.target.addEventListener!="function")continue;let s=k;u.target.addEventListener(u.type,s,u.capture===!0),v.push({trigger:u,listener:s})}}catch(u){t.log("ui-state trigger installation failed",u);for(let{trigger:s,listener:b}of v)try{s.target.removeEventListener(s.type,b,s.capture===!0)}catch{}return d=!1,Ee()}return{mode:"standard",schedule:k,disconnect:()=>{if(d){d=!1,p!==void 0&&clearTimeout(p),p=void 0;for(let{trigger:u,listener:s}of v)try{u.target.removeEventListener(u.type,s,u.capture===!0)}catch(b){t.log("ui-state trigger removal failed",b)}v.length=0}}}}function Ee(){return{mode:"unavailable",schedule:()=>{},disconnect:()=>{}}}function ke(e="[autocapture]"){return{log:(...t)=>{try{let n=console.log(e,...t);if(n&&(typeof n=="object"||typeof n=="function"))try{Promise.resolve(n).catch(()=>{})}catch{}}catch{}}}}var Pe="0.1.0-next.2-dd9eb36";0&&(module.exports={VERSION,captureNavigation,captureNetwork,captureShadowRoots,captureUiState,captureWebAuthn,composedPath,composedTarget,createConsoleLogger});

package/dist/index.mjs

@@ -0,0 +1 @@
+var oe={log:()=>{}};function j(e){return e?{log:(...t)=>{try{let r=e.log(...t);if(r&&(typeof r=="object"||typeof r=="function"))try{Promise.resolve(r).catch(()=>{})}catch{}}catch{}}}:oe}var ce=Symbol.for("corbado.autocapture.installed");function B(e){try{return typeof e=="function"&&Object.prototype.hasOwnProperty.call(e,ce)}catch{return!1}}function M(e,t){var n,o;let r=t;try{Object.defineProperty(e,ce,{value:t,configurable:!0})}catch{}try{Object.defineProperty(e,"name",{value:(n=r.name)!=null?n:"",configurable:!0})}catch{}try{Object.defineProperty(e,"length",{value:(o=r.length)!=null?o:0,configurable:!0})}catch{}return e}function w(){return{mode:"unavailable",disconnect:()=>{}}}function _(e,t,r){let n=j(e);return o=>{try{let a=r(o);if(a&&(typeof a=="object"||typeof a=="function"))try{Promise.resolve(a).catch(d=>n.log(`${t} listener failed`,d))}catch(d){n.log(`${t} listener failed`,d)}}catch(a){n.log(`${t} listener failed`,a)}}}function Re(e){let t=j(e.logger),r=e.onEvent;if(typeof r!="function")return w();let n=typeof navigator=="undefined"?void 0:navigator,o=n==null?void 0:n.credentials;if(!n||!o)return t.log("webauthn capture unavailable: navigator.credentials missing"),w();let a=o.get,d=o.create;if(typeof a!="function"||typeof d!="function")return t.log("webauthn capture unavailable: credentials methods missing"),w();if(B(a)||B(d))return t.log("webauthn capture unavailable: an equivalent capture is already active"),w();let p=!1,v=0,k=_(t,"webauthn",s=>{if(p)return r(s)}),D=(s,b)=>{let L={invoke(...q){let O=this,R=q[0];if(!p||!Q(R)||!Q(R.publicKey))return Reflect.apply(b,O,q);let Z=R.publicKey,V=`wa-${++v}`,ee=Reflect.apply(b,O,q),f=typeof R.mediation=="string"?R.mediation:void 0,m=Q(R.signal)?R.signal:void 0,C={kind:s,ceremonyId:V,phase:"started",mediation:f,userActivation:Se(n)};if(s==="get"){let c=Z;C.requestOptionsJson=Ce(c,t),C.hasAllowCredentials=Array.isArray(c.allowCredentials)&&c.allowCredentials.length>0}return k(C),Promise.resolve(ee).then(c=>(p&&k({kind:s,ceremonyId:V,phase:"completed",mediation:f,credentialJson:Oe(c,s,t),...(m==null?void 0:m.aborted)===!0?{aborted:!0}:{}}),c),c=>{throw p&&k({kind:s,ceremonyId:V,phase:"failed",mediation:f,error:c,errorName:ke(c),...(m==null?void 0:m.aborted)===!0?{aborted:!0}:{}}),c})}}.invoke;return M(L,{name:s,length:0})},h=(s,b)=>{let L=D(s,b),q=Object.getOwnPropertyDescriptor(o,s);if(q&&(!("value"in q)||q.writable!==!0))return null;try{o[s]=L}catch{return null}return()=>{o[s]===L&&(q?o[s]=q.value:delete o[s])}},S=h("get",a),u=S?h("create",d):null;return!S||!u?(S==null||S(),t.log("webauthn capture unavailable: credentials methods cannot be patched safely"),w()):(p=!0,{mode:"standard",disconnect:()=>{p=!1,S(),u()}})}function Se(e){let t=e.userActivation;return typeof(t==null?void 0:t.isActive)=="boolean"?t.isActive:void 0}function Oe(e,t,r){var n;if(e)try{let o=e,a=o.response,d={id:z(o.id),rawId:$(o.rawId),type:z(o.type),authenticatorAttachment:z(o.authenticatorAttachment),response:t==="create"?{clientDataJSON:$(a==null?void 0:a.clientDataJSON),attestationObject:$(a==null?void 0:a.attestationObject),transports:ae((n=a==null?void 0:a.getTransports)==null?void 0:n.call(a))}:{clientDataJSON:$(a==null?void 0:a.clientDataJSON),authenticatorData:$(a==null?void 0:a.authenticatorData),signature:$(a==null?void 0:a.signature),userHandle:$(a==null?void 0:a.userHandle)},...t==="create"?Ae(o):{}};return JSON.stringify(d)}catch(o){r.log("credential serialization failed",o);return}}function Ce(e,t){try{let r={},n=z(e.rpId),o=z(e.userVerification),a=ae(e.hints);return n!==void 0&&(r.rpId=n),typeof e.timeout=="number"&&Number.isFinite(e.timeout)&&(r.timeout=e.timeout),o!==void 0&&(r.userVerification=o),a!==void 0&&(r.hints=a),r.challenge=$(e.challenge),Array.isArray(e.allowCredentials)&&(r.allowCredentials=Ee(e.allowCredentials)),JSON.stringify(r)}catch(r){t.log("request options serialization failed",r);return}}function Ee(e){let t=[];for(let r of e){if(!Q(r))continue;let n=r;t.push({type:z(n.type),id:$(n.id),transports:ae(n.transports)})}return t}function ae(e){if(Array.isArray(e))return e.filter(t=>typeof t=="string")}function z(e){return typeof e=="string"?e:void 0}function Ae(e){var n;let t=(n=e.getClientExtensionResults)==null?void 0:n.call(e);if(!Q(t))return{};let r=t.credProps;return!r||typeof r.rk!="boolean"?{}:{clientExtensionResults:{credProps:{rk:r.rk}}}}function $(e){let t;if(e instanceof ArrayBuffer)t=new Uint8Array(e);else if(ArrayBuffer.isView(e))t=new Uint8Array(e.buffer,e.byteOffset,e.byteLength);else return;let r="";for(let n of t)r+=String.fromCharCode(n);return btoa(r).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}function Q(e){return e!==null&&(typeof e=="object"||typeof e=="function")}function ke(e){return e instanceof DOMException?e.name:"UnknownError"}var de=0;function le(){return de+=1,`network-${de}`}function Pe(e,t){let r=e.responseType;if(r===""||r==="text")return t(e.responseText);if(r==="json"){let n=e.response;return n==null?void 0:t(n)}}var qe=500,xe=65536,pe=Symbol("body-read-timeout");function fe(e){return/event-stream|octet-stream/i.test(e)?!1:/json|text|urlencoded/i.test(e)}async function he(e,t){let r=e.body;if(!r)return;let n=r.getReader(),o;try{let a=new Promise(v=>{o=setTimeout(()=>v(pe),qe)}),d=new TextDecoder,p=[];for(;;){let v=await Promise.race([n.read(),a]);if(v===pe){t.log("body omitted: read timed out"),n.cancel().catch(()=>{});return}if(v.done)break;p.push(d.decode(v.value,{stream:!0}))}return p.push(d.decode()),p.join("")}catch{n.cancel().catch(()=>{});return}finally{o!==void 0&&clearTimeout(o)}}function ie(e){var t;(t=e==null?void 0:e.body)==null||t.cancel().catch(()=>{})}function se(e,t,r,n,o){try{let a=Object.getOwnPropertyDescriptor(e,t);Le(a,{...n,value:r})&&Object.defineProperty(e,t,n)}catch(a){o.log(`${String(t)} restoration skipped`,a)}}function Le(e,t){return!!e&&"value"in e&&"value"in t&&e.value===t.value&&e.writable===t.writable&&e.enumerable===t.enumerable&&e.configurable===t.configurable}function Ne(e){var R,Z,V,ee;let{onExchange:t,onRequest:r,match:n}=e;if(typeof t!="function"||typeof n!="function")throw new TypeError("captureNetwork requires onExchange and match callbacks");let o=j(e.logger),a=(R=e.transports)!=null?R:["xhr","fetch"],d=(Z=e.bodyCapture)==null?void 0:Z.request,p=(V=e.bodyCapture)==null?void 0:V.response,v=typeof d=="function",k=typeof p=="function",D=(ee=e.maxBodyChars)!=null?ee:xe,h=!1,S=_(o,"network",f=>{if(h)return t(f)}),u=_(o,"network request",f=>{if(h)return r==null?void 0:r(f)}),s=(f,m)=>{let C=m.direction==="request"?d:p;if(typeof C=="function")try{let c=C(f,m);if(c===void 0||typeof(c==null?void 0:c.then)=="function")return;let F=JSON.stringify(c);return F===void 0||F.length>D?void 0:JSON.parse(F)}catch(c){o.log("body projection failed",c);return}},b=(f,m)=>{try{let C=typeof document!="undefined"?document.baseURI:void 0,c=new URL(String(f),C);return/\/observe\/events\/[^/]+\/?$/.test(c.pathname)?void 0:n(c,m)===!0?{url:c.href,path:c.pathname}:void 0}catch{return}},L=()=>{if(typeof XMLHttpRequest=="undefined")return o.log("xhr capture unavailable: XMLHttpRequest missing"),null;let f=XMLHttpRequest.prototype,m=Object.getOwnPropertyDescriptor(f,"open"),C=Object.getOwnPropertyDescriptor(f,"send");if(!m||!("value"in m)||typeof m.value!="function"||!C||!("value"in C)||typeof C.value!="function")return o.log("xhr capture unavailable: XMLHttpRequest methods missing"),null;let c=m.value,F=C.value;if(B(c)||B(F))return o.log("xhr capture unavailable: an equivalent capture is already active"),null;let X=new WeakMap,A=new Set,x=!1,T={open(...E){var g;let i=Reflect.apply(c,this,E);if(!h||!x)return i;try{let N=X.get(this);N&&(N.reported=!0,(g=N.cleanupListeners)==null||g.call(N));let H=String(E[0]).toUpperCase(),P=b(E[1],H);P?X.set(this,{method:H,url:P.url,path:P.path,reported:!1}):X.delete(this)}catch(N){o.log("xhr open observation failed",N)}return i}}.open,J={send(...E){let i=h&&x?X.get(this):void 0;if(!i||i.reported||i.cleanupListeners)return Reflect.apply(F,this,E);let g=()=>{},N=!1;try{i.requestId=le();let P={direction:"request",transport:"xhr",method:i.method,url:i.url,path:i.path};i.requestBody=v&&typeof E[0]=="string"?s(E[0],P):void 0;let G=()=>{i.outcome===void 0&&(i.outcome="abort")},Y=()=>{i.outcome===void 0&&(i.outcome="timeout")},l=()=>{i.outcome===void 0&&(i.outcome="error")},y=()=>{var K;g();try{if(!h||!x||i.reported||!i.requestId)return;i.reported=!0;let U={direction:"response",transport:"xhr",method:i.method,url:i.url,path:i.path},re=this.status,ue={requestId:i.requestId,transport:"xhr",method:i.method,url:i.url,path:i.path,status:re,ok:re>=200&&re<300,outcome:(K=i.outcome)!=null?K:"load",durationMs:i.startedAt!==void 0?Date.now()-i.startedAt:void 0,responseUrl:this.responseURL||void 0,requestBody:i.requestBody,responseBody:k?Pe(this,be=>s(be,U)):void 0};i.requestEmitted?S(ue):i.pendingExchange=ue}catch(U){o.log("xhr exchange observation failed",U)}finally{X.get(this)===i&&X.delete(this)}},I=()=>{try{this.readyState===XMLHttpRequest.DONE&&this.status!==0&&y()}catch(K){o.log("xhr ready-state observation failed",K)}},W=()=>y();g=()=>{for(let[K,U]of[["readystatechange",I],["abort",G],["timeout",Y],["error",l],["loadend",W]])this.removeEventListener(K,U);i.cleanupListeners===g&&(i.cleanupListeners=void 0),A.delete(g)},this.addEventListener("readystatechange",I),this.addEventListener("abort",G),this.addEventListener("timeout",Y),this.addEventListener("error",l),this.addEventListener("loadend",W),i.cleanupListeners=g,A.add(g),i.startedAt=Date.now(),N=!0}catch(P){o.log("xhr send observation failed",P),g()}let H;try{H=Reflect.apply(F,this,E)}catch(P){throw g(),P}if(N&&i.requestId!==void 0&&i.startedAt!==void 0){i.requestEmitted=!0,u({requestId:i.requestId,transport:"xhr",method:i.method,url:i.url,path:i.path,startedAt:i.startedAt,requestBody:i.requestBody});let P=i.pendingExchange;i.pendingExchange=void 0,P&&S(P)}return H}}.send;return M(T,c),M(J,F),m.writable!==!0||C.writable!==!0?(o.log("xhr capture unavailable: XMLHttpRequest methods are not writable"),null):(Object.defineProperty(f,"open",{...m,value:T}),Object.defineProperty(f,"send",{...C,value:J}),x=!0,()=>{x=!1;for(let E of[...A])E();se(f,"open",T,m,o),se(f,"send",J,C,o)})},q=()=>{let f=globalThis,m=Object.getOwnPropertyDescriptor(f,"fetch");if(!m||!("value"in m))return o.log("fetch capture unavailable: fetch is not an own data property"),null;let C=m.value;if(typeof C!="function")return o.log("fetch capture unavailable: fetch missing"),null;if(B(C))return o.log("fetch capture unavailable: an equivalent capture is already active"),null;let c=!1,F=async(A,x,T,J)=>{try{if(!h||!c){ie(T);return}let[E,i]=await Promise.all([J!=null?J:Promise.resolve(void 0),T?he(T,o):Promise.resolve(void 0)]);if(!h||!c)return;let g={direction:"request",transport:"fetch",method:A.method,url:A.url,path:A.path},N={...g,direction:"response"},H=A.requestBody;H===void 0&&E!==void 0&&(H=s(E,g));let P=i!==void 0?s(i,N):void 0;S({requestId:A.requestId,transport:"fetch",method:A.method,url:A.url,path:A.path,status:x.status,ok:x.ok,outcome:"load",durationMs:Date.now()-A.startedAt,responseUrl:x.url||void 0,requestBody:H,responseBody:P})}catch(E){o.log("fetch exchange observation failed",E)}},X={fetch(...A){var H,P,G,Y;let x;try{let l=A[0],y=A[1];if(h&&c&&v&&typeof Request!="undefined"&&l instanceof Request&&(y==null?void 0:y.body)===void 0&&l.body){let I=String((H=y==null?void 0:y.method)!=null?H:l.method).toUpperCase(),W=(P=l.headers.get("content-type"))!=null?P:"";b(l.url,I)&&fe(W)&&(x=l.clone())}}catch(l){o.log("fetch observation failed",l)}let T,J=Date.now();try{T=Reflect.apply(C,this,A)}catch(l){throw ie(x),l}let E,i;try{if(h&&c){let l=A[0],y=A[1],I=typeof Request!="undefined"&&l instanceof Request,W=String((G=y==null?void 0:y.method)!=null?G:I?l.method:"GET").toUpperCase(),K=I?l.url:l,U=b(K,W);U&&(E={requestId:le(),method:W,url:U.url,path:U.path,startedAt:J},i=(Y=y==null?void 0:y.signal)!=null?Y:I?l.signal:void 0,v&&typeof(y==null?void 0:y.body)=="string"&&(E.requestBody=s(y.body,{direction:"request",transport:"fetch",method:W,url:U.url,path:U.path})))}}catch(l){o.log("fetch observation failed",l)}if(!E)return ie(x),T;let g=E;u({requestId:g.requestId,transport:"fetch",method:g.method,url:g.url,path:g.path,startedAt:g.startedAt,requestBody:g.requestBody});let N=x?he(x,o):void 0;return T.then(l=>{var I;let y;try{if(h&&c&&k){let W=(I=l.headers.get("content-type"))!=null?I:"";fe(W)&&l.body&&(y=l.clone())}}catch{}F(g,l,y,N)},l=>{try{if(!h||!c)return;let y=(i==null?void 0:i.aborted)===!0||(l==null?void 0:l.name)==="AbortError"||typeof DOMException!="undefined"&&l instanceof DOMException&&l.code===DOMException.ABORT_ERR;S({requestId:g.requestId,transport:"fetch",method:g.method,url:g.url,path:g.path,status:0,ok:!1,outcome:y?"abort":"error",durationMs:Date.now()-g.startedAt})}catch(y){o.log("fetch failure observation failed",y)}}),T}}.fetch;return M(X,C),m.writable!==!0?(o.log("fetch capture unavailable: fetch is not writable"),null):(Object.defineProperty(f,"fetch",{...m,value:X}),c=!0,()=>{c=!1,se(f,"fetch",X,m,o)})},O=[];if(a.includes("xhr")){let f=L();f&&O.push(f)}if(a.includes("fetch")){let f=q();f&&O.push(f)}return O.length===0?w():(h=!0,{mode:"standard",disconnect:()=>{h=!1;for(let f of O.splice(0))f()}})}function De(e){let t=j(),r;try{if(t=j(e.logger),r=e.onNavigate,typeof r!="function")return w()}catch{return w()}let n,o,a,d,p,v;try{if(n=window,o=n==null?void 0:n.history,!n||!o)return t.log("navigation capture unavailable: window/history missing"),w();if(p=ge(o,"pushState"),v=ge(o,"replaceState"),!p||!v)return t.log("navigation capture unavailable: history method descriptors missing"),w();if(a=p.descriptor.value,d=v.descriptor.value,typeof a!="function"||typeof d!="function")return t.log("navigation capture unavailable: history methods missing"),w();if(typeof n.addEventListener!="function"||typeof n.removeEventListener!="function")return t.log("navigation capture unavailable: window event methods missing"),w()}catch(O){return t.log("navigation capture unavailable: history inspection failed",O),w()}if(B(a)||B(d))return t.log("navigation capture unavailable: an equivalent capture is already active"),w();let k=!1,D=()=>({path:n.location.pathname,search:n.location.search,hash:n.location.hash}),h;try{h=D()}catch(O){return t.log("navigation capture unavailable: location inspection failed",O),w()}let S=_(t,"navigation",O=>{if(k)return r(O)}),u=O=>{if(k)try{let R=D();if(R.path===h.path&&R.search===h.search&&R.hash===h.hash)return;h=R,S({...R,source:O})}catch(R){t.log("navigation observation failed",R)}},s={pushState(...O){let R=Reflect.apply(a,this,O);return u("push"),R}}.pushState,b={replaceState(...O){let R=Reflect.apply(d,this,O);return u("replace"),R}}.replaceState;M(s,a),M(b,d);let L=()=>u("pop"),q=()=>u("hash");try{if(ye(p,s),ye(v,b),o.pushState!==s||o.replaceState!==b)throw new Error("history method replacement did not take effect");n.addEventListener("popstate",L),n.addEventListener("hashchange",q),k=!0}catch(O){return k=!1,ne(n,"popstate",L,t),ne(n,"hashchange",q,t),te(v,b,t),te(p,s,t),t.log("navigation capture unavailable: history methods are not writable",O),r=()=>{},S=()=>{},t=j(),w()}return{mode:"standard",disconnect:()=>{k=!1,r=()=>{},ne(n,"popstate",L,t),ne(n,"hashchange",q,t),te(p,s,t),te(v,b,t),S=()=>{},t=j()}}}function ge(e,t){let r=e;for(;r;){let n=Object.getOwnPropertyDescriptor(r,t);if(n)return!("value"in n)||typeof n.value!="function"?null:{owner:r,key:t,descriptor:n};r=Object.getPrototypeOf(r)}return null}function ye(e,t){if(e.descriptor.writable!==!0)throw new TypeError(`${e.key} is not writable`);let r=Object.getOwnPropertyDescriptor(e.owner,e.key);if(!me(r,e.descriptor))throw new Error(`${e.key} changed during installation`);Object.defineProperty(e.owner,e.key,{...e.descriptor,value:t})}function me(e,t){return!!e&&"value"in e&&"value"in t&&e.value===t.value&&e.writable===t.writable&&e.enumerable===t.enumerable&&e.configurable===t.configurable}function te(e,t,r){try{let n=Object.getOwnPropertyDescriptor(e.owner,e.key);me(n,{...e.descriptor,value:t})&&Object.defineProperty(e.owner,e.key,e.descriptor)}catch(n){r.log(`navigation ${e.key} restoration skipped`,n)}}function ne(e,t,r,n){try{e.removeEventListener(t,r)}catch(o){n.log(`navigation ${t} listener removal skipped`,o)}}function Te(e){var S;let t=(S=e.logger)!=null?S:oe,r=e.onAttached;if(typeof r!="function")return w();let n=Element.prototype,o=Object.getOwnPropertyDescriptor(n,"attachShadow");if(!o||typeof o.value!="function")return t.log("shadow-root capture unavailable: attachShadow not supported"),w();let a=o.value;if(B(a))return t.log("shadow-root capture unavailable: an equivalent capture is already active"),w();let d=!1,p=new WeakSet,v=_(t,"shadow-root",r),k=(u,s)=>{!d||p.has(s)||(p.add(s),v({host:u,shadowRoot:s,mode:s.mode==="closed"?"closed":"open"}))},D={attachShadow(...u){let s=Reflect.apply(a,this,u);return k(this,s),s}}.attachShadow;M(D,a);try{Object.defineProperty(n,"attachShadow",{...o,value:D})}catch(u){return t.log("shadow-root capture unavailable: attachShadow is locked",u),w()}d=!0;let h=u=>{let s=u.querySelectorAll("*");for(let b=0;b<s.length&&d;b++){let L=s[b].shadowRoot;L&&(k(s[b],L),h(L))}};return e.includeExisting&&h(document),{mode:"standard",disconnect:()=>{d=!1;let u=Object.getOwnPropertyDescriptor(n,"attachShadow");je(u,{...o,value:D})&&Object.defineProperty(n,"attachShadow",o)}}}function He(e){var t;return(t=ve(e)[0])!=null?t:null}function ve(e){let t=e.composedPath();return t.length>0?t:e.target?[e.target]:[]}function je(e,t){return!!e&&"value"in e&&"value"in t&&e.value===t.value&&e.writable===t.writable&&e.enumerable===t.enumerable&&e.configurable===t.configurable}function Be(e){var D,h,S;let t=j(e==null?void 0:e.logger),r=e==null?void 0:e.read,n=e==null?void 0:e.onState;if(typeof r!="function"||typeof n!="function")return we();let o=Number.isFinite(e.delayMs)&&((D=e.delayMs)!=null?D:0)>=0&&(h=e.delayMs)!=null?h:0,a=_(t,"ui-state",n),d=!0,p,v=[],k=()=>{d&&(p!==void 0&&clearTimeout(p),p=setTimeout(()=>{if(p=void 0,!!d)try{let u=r();u!==void 0&&a(u)}catch(u){t.log("ui-state read failed",u)}},o))};try{for(let u of(S=e.triggers)!=null?S:[]){if(!(u!=null&&u.target)||typeof u.target.addEventListener!="function")continue;let s=k;u.target.addEventListener(u.type,s,u.capture===!0),v.push({trigger:u,listener:s})}}catch(u){t.log("ui-state trigger installation failed",u);for(let{trigger:s,listener:b}of v)try{s.target.removeEventListener(s.type,b,s.capture===!0)}catch{}return d=!1,we()}return{mode:"standard",schedule:k,disconnect:()=>{if(d){d=!1,p!==void 0&&clearTimeout(p),p=void 0;for(let{trigger:u,listener:s}of v)try{u.target.removeEventListener(u.type,s,u.capture===!0)}catch(b){t.log("ui-state trigger removal failed",b)}v.length=0}}}}function we(){return{mode:"unavailable",schedule:()=>{},disconnect:()=>{}}}function Ie(e="[autocapture]"){return{log:(...t)=>{try{let r=console.log(e,...t);if(r&&(typeof r=="object"||typeof r=="function"))try{Promise.resolve(r).catch(()=>{})}catch{}}catch{}}}}var Ue="0.1.0-next.2-dd9eb36";export{Ue as VERSION,De as captureNavigation,Ne as captureNetwork,Te as captureShadowRoots,Be as captureUiState,Re as captureWebAuthn,ve as composedPath,He as composedTarget,Ie as createConsoleLogger};

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@corbado/autocapture",
+  "version": "0.1.0-next.2-dd9eb36",
+  "description": "Observer-style capture helpers for WebAuthn ceremonies, selected network exchanges, in-app navigation, shadow roots, and rendered UI state.",
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsup src/index.ts --format cjs,esm --target es2019 --dts --minify --define.__CORBADO_AUTOCAPTURE_VERSION__='\"'${CORBADO_AUTOCAPTURE_VERSION:-0.0.0-dev}'\"'",
+    "dev": "tsup src/index.ts --format cjs,esm --target es2019 --watch --dts",
+    "lint": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:e2e": "pnpm build && playwright test --config e2e/playwright.config.ts",
+    "check:dist": "es-check es2019 './dist/index.js' && es-check es2019 './dist/index.mjs' --module",
+    "format": "prettier --write 'src/**/*.ts' 'e2e/**/*.ts'",
+    "format:check": "prettier --check 'src/**/*.ts' 'e2e/**/*.ts'"
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.57.0",
+    "@types/node": "^20",
+    "es-check": "latest",
+    "eslint-config-prettier": "^10.1.8",
+    "jsdom": "latest",
+    "prettier": "^3.7.4",
+    "tsup": "latest",
+    "typescript": "latest",
+    "typescript-eslint": "^8.55.0",
+    "vitest": "^4.1.0"
+  }
+}