@corbado/autocapture 0.2.0 → 0.3.0-next.14-2a142aa

package/README.md

@@ -76,9 +76,9 @@ navigation.disconnect();
 
 Each capture call returns a `CaptureHandle` with a mode (`"standard"` or `"unavailable"`) and a
 `disconnect()` method. Environments that cannot be instrumented report `"unavailable"` rather than
-throwing; a misconfigured `captureNetwork` call (missing `match` or `onExchange`) throws a
-`TypeError` instead, since that is a programming error, not a degraded environment. Full event and
-option types ship with the package.
+throwing; a misconfigured call (a missing `onEvent`, `onNavigate`, `match`, or `onExchange`
+callback) throws a `TypeError` instead, since that is a programming error, not a degraded
+environment. Full event and option types ship with the package.
 
 WebAuthn events use a protocol-native discriminated union. Authentication phases carry normalized
 `mediation`, `uiMode`, and `credentialSet` (`"allowlisted"` or `"discoverable"`); registration
@@ -123,7 +123,8 @@ timing, memory, privacy, or Promise-semantics impact.
 Network observation is designed for minimal data exposure:
 
 - Only URLs a caller's `match` predicate explicitly selects are observed; all other traffic is
-  ignored. The Corbado `/observe/events/{projectID}` sink is always excluded to prevent recursion.
+  ignored. Keep the predicate from matching the endpoint the consumer reports events to, or the
+  reporting traffic itself becomes observed traffic.
 - Requests and exchanges carry **metadata only** by default. `onRequest` runs after the platform
   accepts the call; `onExchange` reports its eventual outcome, and their `requestId` values match. A
   request or response body is read only when the caller configures a projector for that direction.

package/dist/index.d.mts

@@ -33,15 +33,6 @@ type WebAuthnCeremonyContext = {
 type WebAuthnCeremonyBase = WebAuthnCeremonyContext & {
     /** Identifier shared by all events belonging to the same ceremony. */
     ceremonyId: string;
-    /** Authentication request metadata; present only when applicable and serializable. */
-    requestOptionsJson?: string;
-    /** Completed credential metadata; present only when applicable and serializable. */
-    credentialJson?: string;
-    /** Failure details; present only for failed ceremonies. */
-    error?: unknown;
-    errorName?: string;
-    /** Present when the request signal was aborted before settlement. */
-    aborted?: true;
 };
 type WebAuthnCeremonyStartedEvent = WebAuthnCeremonyBase & {
     phase: "started";
@@ -56,7 +47,7 @@ type WebAuthnCeremonyStartedEvent = WebAuthnCeremonyBase & {
 };
 type WebAuthnCeremonyCompletedEvent = WebAuthnCeremonyBase & {
     phase: "completed";
-    /** JSON-encoded allowlisted credential. Treat this value as sensitive telemetry. */
+    /** JSON-encoded allowlisted credential; present only when applicable and serializable. Treat this value as sensitive telemetry. */
     credentialJson?: string;
     /** A credential manager may complete even after the ceremony signal was aborted. */
     aborted?: true;
@@ -67,6 +58,7 @@ type WebAuthnCeremonyFailedEvent = WebAuthnCeremonyBase & {
     error: unknown;
     /** DOM exception name, or `UnknownError` when no name is available. */
     errorName: string;
+    /** Present when the request signal was aborted before settlement. */
     aborted?: true;
 };
 /** A protocol-native lifecycle event for WebAuthn authentication or registration. */
@@ -163,8 +155,7 @@ type NetworkBodyProjector<ProjectedBody = unknown, Direction extends NetworkBody
 type NetworkCaptureOptions<RequestBody = unknown, ResponseBody = unknown> = {
     /**
      * Selects requests to observe. The URL is resolved against the document base
-     * URL and the method is uppercase. Return `true` to observe the request. The
-     * Corbado Observe event endpoint is always excluded to prevent recursion.
+     * URL and the method is uppercase. Return `true` to observe the request.
      * This callback must return synchronously; Promise results are not matched.
      */
     match: (url: URL, method: string) => boolean;
@@ -247,6 +238,8 @@ type NavigationCaptureOptions = {
  *
  * @param options Event callback and optional diagnostic logger.
  * @returns A handle used to inspect the capture mode or stop event delivery.
+ * @throws TypeError when `onEvent` is not a function — a misconfigured
+ * integration is a programming error, not a degraded mode.
  */
 declare function captureWebAuthn(options: WebAuthnCaptureOptions): CaptureHandle;
 
@@ -255,10 +248,9 @@ declare function captureWebAuthn(options: WebAuthnCaptureOptions): CaptureHandle
  *
  * While capture remains active, selected requests on available transports can
  * produce one {@link HttpRequestStarted} after the platform accepts the call,
- * followed by one correlated {@link HttpExchange} after completion. The
- * Corbado Observe event endpoint is always excluded. If only some requested
- * transports are available, capture continues on those transports and reports
- * the others to the optional logger.
+ * followed by one correlated {@link HttpExchange} after completion. If only
+ * some requested transports are available, capture continues on those
+ * transports and reports the others to the optional logger.
  *
  * Exchanges contain metadata by default; body capture must be enabled
  * explicitly.
@@ -279,6 +271,8 @@ declare function captureNetwork<RequestBody = unknown, ResponseBody = unknown>(o
  *
  * @param options Navigation callback and optional diagnostic logger.
  * @returns A handle used to inspect the capture mode or stop event delivery.
+ * @throws TypeError when `onNavigate` is not a function — a misconfigured
+ * integration is a programming error, not a degraded mode.
  */
 declare function captureNavigation(options: NavigationCaptureOptions): CaptureHandle;
 

package/dist/index.d.ts

@@ -33,15 +33,6 @@ type WebAuthnCeremonyContext = {
 type WebAuthnCeremonyBase = WebAuthnCeremonyContext & {
     /** Identifier shared by all events belonging to the same ceremony. */
     ceremonyId: string;
-    /** Authentication request metadata; present only when applicable and serializable. */
-    requestOptionsJson?: string;
-    /** Completed credential metadata; present only when applicable and serializable. */
-    credentialJson?: string;
-    /** Failure details; present only for failed ceremonies. */
-    error?: unknown;
-    errorName?: string;
-    /** Present when the request signal was aborted before settlement. */
-    aborted?: true;
 };
 type WebAuthnCeremonyStartedEvent = WebAuthnCeremonyBase & {
     phase: "started";
@@ -56,7 +47,7 @@ type WebAuthnCeremonyStartedEvent = WebAuthnCeremonyBase & {
 };
 type WebAuthnCeremonyCompletedEvent = WebAuthnCeremonyBase & {
     phase: "completed";
-    /** JSON-encoded allowlisted credential. Treat this value as sensitive telemetry. */
+    /** JSON-encoded allowlisted credential; present only when applicable and serializable. Treat this value as sensitive telemetry. */
     credentialJson?: string;
     /** A credential manager may complete even after the ceremony signal was aborted. */
     aborted?: true;
@@ -67,6 +58,7 @@ type WebAuthnCeremonyFailedEvent = WebAuthnCeremonyBase & {
     error: unknown;
     /** DOM exception name, or `UnknownError` when no name is available. */
     errorName: string;
+    /** Present when the request signal was aborted before settlement. */
     aborted?: true;
 };
 /** A protocol-native lifecycle event for WebAuthn authentication or registration. */
@@ -163,8 +155,7 @@ type NetworkBodyProjector<ProjectedBody = unknown, Direction extends NetworkBody
 type NetworkCaptureOptions<RequestBody = unknown, ResponseBody = unknown> = {
     /**
      * Selects requests to observe. The URL is resolved against the document base
-     * URL and the method is uppercase. Return `true` to observe the request. The
-     * Corbado Observe event endpoint is always excluded to prevent recursion.
+     * URL and the method is uppercase. Return `true` to observe the request.
      * This callback must return synchronously; Promise results are not matched.
      */
     match: (url: URL, method: string) => boolean;
@@ -247,6 +238,8 @@ type NavigationCaptureOptions = {
  *
  * @param options Event callback and optional diagnostic logger.
  * @returns A handle used to inspect the capture mode or stop event delivery.
+ * @throws TypeError when `onEvent` is not a function — a misconfigured
+ * integration is a programming error, not a degraded mode.
  */
 declare function captureWebAuthn(options: WebAuthnCaptureOptions): CaptureHandle;
 
@@ -255,10 +248,9 @@ declare function captureWebAuthn(options: WebAuthnCaptureOptions): CaptureHandle
  *
  * While capture remains active, selected requests on available transports can
  * produce one {@link HttpRequestStarted} after the platform accepts the call,
- * followed by one correlated {@link HttpExchange} after completion. The
- * Corbado Observe event endpoint is always excluded. If only some requested
- * transports are available, capture continues on those transports and reports
- * the others to the optional logger.
+ * followed by one correlated {@link HttpExchange} after completion. If only
+ * some requested transports are available, capture continues on those
+ * transports and reports the others to the optional logger.
  *
  * Exchanges contain metadata by default; body capture must be enabled
  * explicitly.
@@ -279,6 +271,8 @@ declare function captureNetwork<RequestBody = unknown, ResponseBody = unknown>(o
  *
  * @param options Navigation callback and optional diagnostic logger.
  * @returns A handle used to inspect the capture mode or stop event delivery.
+ * @throws TypeError when `onNavigate` is not a function — a misconfigured
+ * integration is a programming error, not a degraded mode.
  */
 declare function captureNavigation(options: NavigationCaptureOptions): CaptureHandle;
 

package/dist/index.js

@@ -1 +1 @@
-"use strict";var ne=Object.defineProperty;var Ce=Object.getOwnPropertyDescriptor;var ke=Object.getOwnPropertyNames;var qe=Object.prototype.hasOwnProperty;var Oe=(e,t)=>{for(var o in t)ne(e,o,{get:t[o],enumerable:!0})},Ae=(e,t,o,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let r of ke(t))!qe.call(e,r)&&r!==o&&ne(e,r,{get:()=>t[r],enumerable:!(n=Ce(t,r))||n.enumerable});return e};var Pe=e=>Ae(ne({},"__esModule",{value:!0}),e);var _e={};Oe(_e,{VERSION:()=>we,captureNavigation:()=>me,captureNetwork:()=>he,captureWebAuthn:()=>ue,composedPath:()=>ve});module.exports=Pe(_e);var Ee={log:()=>{}};function U(e){return e?{log:(...t)=>{try{let o=e.log(...t);if(o&&(typeof o=="object"||typeof o=="function"))try{Promise.resolve(o).catch(()=>{})}catch{}}catch{}}}:Ee}var se=Symbol.for("corbado.autocapture.installed");function _(e){try{return typeof e=="function"&&Object.prototype.hasOwnProperty.call(e,se)}catch{return!1}}function X(e,t){var n,r;let o=t;try{Object.defineProperty(e,se,{value:t,configurable:!0})}catch{}try{Object.defineProperty(e,"name",{value:(n=o.name)!=null?n:"",configurable:!0})}catch{}try{Object.defineProperty(e,"length",{value:(r=o.length)!=null?r:0,configurable:!0})}catch{}return e}function C(){return{mode:"unavailable",disconnect:()=>{}}}function $(e,t,o){let n=U(e);return r=>{try{let a=o(r);if(a&&(typeof a=="object"||typeof a=="function"))try{Promise.resolve(a).catch(p=>n.log(`${t} listener failed`,p))}catch(p){n.log(`${t} listener failed`,p)}}catch(a){n.log(`${t} listener failed`,a)}}}function ue(e){let t=U(e.logger),o=e.onEvent;if(typeof o!="function")return C();let n=typeof navigator=="undefined"?void 0:navigator,r=n==null?void 0:n.credentials;if(!n||!r)return t.log("webauthn capture unavailable: navigator.credentials missing"),C();let a=r.get,p=r.create;if(typeof a!="function"||typeof p!="function")return t.log("webauthn capture unavailable: credentials methods missing"),C();if(_(a)||_(p))return t.log("webauthn capture unavailable: an equivalent capture is already active"),C();let y=!1,k=0,B=$(t,"webauthn",h=>{if(y)return o(h)}),q=(h,D)=>{let I={invoke(...O){let v=this,g=O[0];if(!y||!Q(g)||!Q(g.publicKey))return Reflect.apply(D,v,O);let z=g.publicKey,u=`wa-${++k}`,m=Reflect.apply(D,v,O),l=Q(g.signal)?g.signal:void 0,f=xe(h,g,z),W={...f,ceremonyId:u,phase:"started",userActivation:Be(n)};if(f.kind==="authentication"){let w=z;W.requestOptionsJson=Le(w,t)}return B(W),Promise.resolve(m).then(w=>(y&&B({...f,ceremonyId:u,phase:"completed",credentialJson:De(w,h,t),...(l==null?void 0:l.aborted)===!0?{aborted:!0}:{}}),w),w=>{throw y&&B({...f,ceremonyId:u,phase:"failed",error:w,errorName:Te(w),...(l==null?void 0:l.aborted)===!0?{aborted:!0}:{}}),w})}}.invoke;return X(I,{name:h,length:0})},x=(h,D)=>{let I=q(h,D),O=Object.getOwnPropertyDescriptor(r,h);if(O&&(!("value"in O)||O.writable!==!0))return null;try{r[h]=I}catch{return null}return()=>{r[h]===I&&(O?r[h]=O.value:delete r[h])}},S=x("get",a),N=S?x("create",p):null;return!S||!N?(S==null||S(),t.log("webauthn capture unavailable: credentials methods cannot be patched safely"),C()):(y=!0,{mode:"standard",disconnect:()=>{y=!1,S(),N()}})}function xe(e,t,o){let n=Se(t.mediation);if(e==="create")return{kind:"registration",mediation:n};let r=o;return{kind:"authentication",mediation:n,uiMode:Ne(t.uiMode),credentialSet:Array.isArray(r.allowCredentials)&&r.allowCredentials.length>0?"allowlisted":"discoverable"}}function Se(e){return e===void 0?"optional":e==="silent"||e==="optional"||e==="conditional"||e==="required"?e:"unknown"}function Ne(e){return e===void 0?"default":e==="immediate"?"immediate":"unknown"}function Be(e){let t=e.userActivation;return typeof(t==null?void 0:t.isActive)=="boolean"?t.isActive:void 0}function De(e,t,o){var n;if(e)try{let r=e,a=r.response,p={id:J(r.id),rawId:K(r.rawId),type:J(r.type),authenticatorAttachment:J(r.authenticatorAttachment),response:t==="create"?{clientDataJSON:K(a==null?void 0:a.clientDataJSON),attestationObject:K(a==null?void 0:a.attestationObject),transports:re((n=a==null?void 0:a.getTransports)==null?void 0:n.call(a))}:{clientDataJSON:K(a==null?void 0:a.clientDataJSON),authenticatorData:K(a==null?void 0:a.authenticatorData),signature:K(a==null?void 0:a.signature),userHandle:K(a==null?void 0:a.userHandle)},...t==="create"?He(r):{}};return JSON.stringify(p)}catch(r){o.log("credential serialization failed",r);return}}function Le(e,t){try{let o={},n=J(e.rpId),r=J(e.userVerification),a=re(e.hints);return n!==void 0&&(o.rpId=n),typeof e.timeout=="number"&&Number.isFinite(e.timeout)&&(o.timeout=e.timeout),r!==void 0&&(o.userVerification=r),a!==void 0&&(o.hints=a),o.challenge=K(e.challenge),Array.isArray(e.allowCredentials)&&(o.allowCredentials=je(e.allowCredentials)),JSON.stringify(o)}catch(o){t.log("request options serialization failed",o);return}}function je(e){let t=[];for(let o of e){if(!Q(o))continue;let n=o;t.push({type:J(n.type),id:K(n.id),transports:re(n.transports)})}return t}function re(e){if(Array.isArray(e))return e.filter(t=>typeof t=="string")}function J(e){return typeof e=="string"?e:void 0}function He(e){var n;let t=(n=e.getClientExtensionResults)==null?void 0:n.call(e);if(!Q(t))return{};let o=t.credProps;return!o||typeof o.rk!="boolean"?{}:{clientExtensionResults:{credProps:{rk:o.rk}}}}function K(e){let t;if(e instanceof ArrayBuffer)t=new Uint8Array(e);else if(ArrayBuffer.isView(e))t=new Uint8Array(e.buffer,e.byteOffset,e.byteLength);else return;let o="";for(let n of t)o+=String.fromCharCode(n);return btoa(o).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}function Q(e){return e!==null&&(typeof e=="object"||typeof e=="function")}function Te(e){return e instanceof DOMException?e.name:"UnknownError"}var ce=0;function de(){return ce+=1,`network-${ce}`}function Ie(e,t){let o=e.responseType;if(o===""||o==="text")return t(e.responseText);if(o==="json"){let n=e.response;return n==null?void 0:t(n)}}var Me=500,le=Symbol("body-read-timeout");function pe(e){return/event-stream|octet-stream/i.test(e)?!1:/json|text|urlencoded/i.test(e)}async function fe(e,t){let o=e.body;if(!o)return;let n=o.getReader(),r;try{let a=new Promise(k=>{r=setTimeout(()=>k(le),Me)}),p=new TextDecoder,y=[];for(;;){let k=await Promise.race([n.read(),a]);if(k===le){t.log("body omitted: read timed out"),n.cancel().catch(()=>{});return}if(k.done)break;y.push(p.decode(k.value,{stream:!0}))}return y.push(p.decode()),y.join("")}catch{n.cancel().catch(()=>{});return}finally{r!==void 0&&clearTimeout(r)}}function oe(e){var t;(t=e==null?void 0:e.body)==null||t.cancel().catch(()=>{})}function ie(e,t,o,n,r){try{let a=Object.getOwnPropertyDescriptor(e,t);Ue(a,{...n,value:o})&&Object.defineProperty(e,t,n)}catch(a){r.log(`${String(t)} restoration skipped`,a)}}function Ue(e,t){return!!e&&"value"in e&&"value"in t&&e.value===t.value&&e.writable===t.writable&&e.enumerable===t.enumerable&&e.configurable===t.configurable}function he(e){var v,g,z;let{onExchange:t,onRequest:o,match:n}=e;if(typeof t!="function"||typeof n!="function")throw new TypeError("captureNetwork requires onExchange and match callbacks");let r=U(e.logger),a=(v=e.transports)!=null?v:["xhr","fetch"],p=(g=e.bodyCapture)==null?void 0:g.request,y=(z=e.bodyCapture)==null?void 0:z.response,k=typeof p=="function",B=typeof y=="function",q=!1,x=$(r,"network",u=>{if(q)return t(u)}),S=$(r,"network request",u=>{if(q)return o==null?void 0:o(u)}),N=(u,m,l)=>{if(typeof l=="function")try{return l(u,m)}catch(f){r.log("body projection failed",f);return}},h=(u,m)=>{try{let l=typeof document!="undefined"?document.baseURI:void 0,f=new URL(String(u),l);return n(f,m)===!0?{url:f.href,path:f.pathname}:void 0}catch{return}},D=()=>{if(typeof XMLHttpRequest=="undefined")return r.log("xhr capture unavailable: XMLHttpRequest missing"),null;let u=XMLHttpRequest.prototype,m=Object.getOwnPropertyDescriptor(u,"open"),l=Object.getOwnPropertyDescriptor(u,"send");if(!m||!("value"in m)||typeof m.value!="function"||!l||!("value"in l)||typeof l.value!="function")return r.log("xhr capture unavailable: XMLHttpRequest methods missing"),null;let f=m.value,W=l.value;if(_(f)||_(W))return r.log("xhr capture unavailable: an equivalent capture is already active"),null;let w=new WeakMap,R=new Set,P=!1,L={open(...b){var c;let i=Reflect.apply(f,this,b);if(!q||!P)return i;try{let E=w.get(this);E&&(E.reported=!0,(c=E.cleanupListeners)==null||c.call(E));let j=String(b[0]).toUpperCase(),A=h(b[1],j);A?w.set(this,{method:j,url:A.url,path:A.path,reported:!1}):w.delete(this)}catch(E){r.log("xhr open observation failed",E)}return i}}.open,F={send(...b){let i=q&&P?w.get(this):void 0;if(!i||i.reported||i.cleanupListeners)return Reflect.apply(W,this,b);let c=()=>{},E=!1;try{i.requestId=de();let A={direction:"request",transport:"xhr",method:i.method,url:i.url,path:i.path};i.requestBody=k&&typeof b[0]=="string"?N(b[0],A,p):void 0;let G=()=>{i.outcome===void 0&&(i.outcome="abort")},Y=()=>{i.outcome===void 0&&(i.outcome="timeout")},s=()=>{i.outcome===void 0&&(i.outcome="error")},d=()=>{var V;c();try{if(!q||!P||i.reported||!i.requestId)return;i.reported=!0;let T={direction:"response",transport:"xhr",method:i.method,url:i.url,path:i.path},te=this.status,ae={requestId:i.requestId,transport:"xhr",method:i.method,url:i.url,path:i.path,status:te,ok:te>=200&&te<300,outcome:(V=i.outcome)!=null?V:"load",durationMs:i.startedAt!==void 0?Date.now()-i.startedAt:void 0,responseUrl:this.responseURL||void 0,requestBody:i.requestBody,responseBody:B?Ie(this,Re=>N(Re,T,y)):void 0};i.requestEmitted?x(ae):i.pendingExchange=ae}catch(T){r.log("xhr exchange observation failed",T)}finally{w.get(this)===i&&w.delete(this)}},H=()=>{try{this.readyState===XMLHttpRequest.DONE&&this.status!==0&&d()}catch(V){r.log("xhr ready-state observation failed",V)}},M=()=>d();c=()=>{for(let[V,T]of[["readystatechange",H],["abort",G],["timeout",Y],["error",s],["loadend",M]])this.removeEventListener(V,T);i.cleanupListeners===c&&(i.cleanupListeners=void 0),R.delete(c)},this.addEventListener("readystatechange",H),this.addEventListener("abort",G),this.addEventListener("timeout",Y),this.addEventListener("error",s),this.addEventListener("loadend",M),i.cleanupListeners=c,R.add(c),i.startedAt=Date.now(),E=!0}catch(A){r.log("xhr send observation failed",A),c()}let j;try{j=Reflect.apply(W,this,b)}catch(A){throw c(),A}if(E&&i.requestId!==void 0&&i.startedAt!==void 0){i.requestEmitted=!0,S({requestId:i.requestId,transport:"xhr",method:i.method,url:i.url,path:i.path,startedAt:i.startedAt,requestBody:i.requestBody});let A=i.pendingExchange;i.pendingExchange=void 0,A&&x(A)}return j}}.send;return X(L,f),X(F,W),m.writable!==!0||l.writable!==!0?(r.log("xhr capture unavailable: XMLHttpRequest methods are not writable"),null):(Object.defineProperty(u,"open",{...m,value:L}),Object.defineProperty(u,"send",{...l,value:F}),P=!0,()=>{P=!1;for(let b of[...R])b();ie(u,"open",L,m,r),ie(u,"send",F,l,r)})},I=()=>{let u=globalThis,m=Object.getOwnPropertyDescriptor(u,"fetch");if(!m||!("value"in m))return r.log("fetch capture unavailable: fetch is not an own data property"),null;let l=m.value;if(typeof l!="function")return r.log("fetch capture unavailable: fetch missing"),null;if(_(l))return r.log("fetch capture unavailable: an equivalent capture is already active"),null;let f=!1,W=async(R,P,L,F)=>{try{if(!q||!f){oe(L);return}let[b,i]=await Promise.all([F!=null?F:Promise.resolve(void 0),L?fe(L,r):Promise.resolve(void 0)]);if(!q||!f)return;let c={direction:"request",transport:"fetch",method:R.method,url:R.url,path:R.path},E={...c,direction:"response"},j=R.requestBody;j===void 0&&b!==void 0&&(j=N(b,c,p));let A=i!==void 0?N(i,E,y):void 0;x({requestId:R.requestId,transport:"fetch",method:R.method,url:R.url,path:R.path,status:P.status,ok:P.ok,outcome:"load",durationMs:Date.now()-R.startedAt,responseUrl:P.url||void 0,requestBody:j,responseBody:A})}catch(b){r.log("fetch exchange observation failed",b)}},w={fetch(...R){var j,A,G,Y;let P;try{let s=R[0],d=R[1];if(q&&f&&k&&typeof Request!="undefined"&&s instanceof Request&&(d==null?void 0:d.body)===void 0&&s.body){let H=String((j=d==null?void 0:d.method)!=null?j:s.method).toUpperCase(),M=(A=s.headers.get("content-type"))!=null?A:"";h(s.url,H)&&pe(M)&&(P=s.clone())}}catch(s){r.log("fetch observation failed",s)}let L,F=Date.now();try{L=Reflect.apply(l,this,R)}catch(s){throw oe(P),s}let b,i;try{if(q&&f){let s=R[0],d=R[1],H=typeof Request!="undefined"&&s instanceof Request,M=String((G=d==null?void 0:d.method)!=null?G:H?s.method:"GET").toUpperCase(),V=H?s.url:s,T=h(V,M);T&&(b={requestId:de(),method:M,url:T.url,path:T.path,startedAt:F},i=(Y=d==null?void 0:d.signal)!=null?Y:H?s.signal:void 0,k&&typeof(d==null?void 0:d.body)=="string"&&(b.requestBody=N(d.body,{direction:"request",transport:"fetch",method:M,url:T.url,path:T.path},p)))}}catch(s){r.log("fetch observation failed",s)}if(!b)return oe(P),L;let c=b;S({requestId:c.requestId,transport:"fetch",method:c.method,url:c.url,path:c.path,startedAt:c.startedAt,requestBody:c.requestBody});let E=P?fe(P,r):void 0;return L.then(s=>{var H;let d;try{if(q&&f&&B){let M=(H=s.headers.get("content-type"))!=null?H:"";pe(M)&&s.body&&(d=s.clone())}}catch{}W(c,s,d,E)},s=>{try{if(!q||!f)return;let d=(i==null?void 0:i.aborted)===!0||(s==null?void 0:s.name)==="AbortError"||typeof DOMException!="undefined"&&s instanceof DOMException&&s.code===DOMException.ABORT_ERR;x({requestId:c.requestId,transport:"fetch",method:c.method,url:c.url,path:c.path,status:0,ok:!1,outcome:d?"abort":"error",durationMs:Date.now()-c.startedAt})}catch(d){r.log("fetch failure observation failed",d)}}),L}}.fetch;return X(w,l),m.writable!==!0?(r.log("fetch capture unavailable: fetch is not writable"),null):(Object.defineProperty(u,"fetch",{...m,value:w}),f=!0,()=>{f=!1,ie(u,"fetch",w,m,r)})},O=[];if(a.includes("xhr")){let u=D();u&&O.push(u)}if(a.includes("fetch")){let u=I();u&&O.push(u)}return O.length===0?C():(q=!0,{mode:"standard",disconnect:()=>{q=!1;for(let u of O.splice(0))u()}})}function me(e){let t=U(),o;try{if(t=U(e.logger),o=e.onNavigate,typeof o!="function")return C()}catch{return C()}let n,r,a,p,y,k;try{if(n=window,r=n==null?void 0:n.history,!n||!r)return t.log("navigation capture unavailable: window/history missing"),C();if(y=ye(r,"pushState"),k=ye(r,"replaceState"),!y||!k)return t.log("navigation capture unavailable: history method descriptors missing"),C();if(a=y.descriptor.value,p=k.descriptor.value,typeof a!="function"||typeof p!="function")return t.log("navigation capture unavailable: history methods missing"),C();if(typeof n.addEventListener!="function"||typeof n.removeEventListener!="function")return t.log("navigation capture unavailable: window event methods missing"),C()}catch(v){return t.log("navigation capture unavailable: history inspection failed",v),C()}if(_(a)||_(p))return t.log("navigation capture unavailable: an equivalent capture is already active"),C();let B=!1,q=()=>({path:n.location.pathname,search:n.location.search,hash:n.location.hash}),x;try{x=q()}catch(v){return t.log("navigation capture unavailable: location inspection failed",v),C()}let S=$(t,"navigation",v=>{if(B)return o(v)}),N=v=>{if(B)try{let g=q();if(g.path===x.path&&g.search===x.search&&g.hash===x.hash)return;x=g,S({...g,source:v})}catch(g){t.log("navigation observation failed",g)}},h={pushState(...v){let g=Reflect.apply(a,this,v);return N("push"),g}}.pushState,D={replaceState(...v){let g=Reflect.apply(p,this,v);return N("replace"),g}}.replaceState;X(h,a),X(D,p);let I=()=>N("pop"),O=()=>N("hash");try{if(ge(y,h),ge(k,D),r.pushState!==h||r.replaceState!==D)throw new Error("history method replacement did not take effect");n.addEventListener("popstate",I),n.addEventListener("hashchange",O),B=!0}catch(v){return B=!1,ee(n,"popstate",I,t),ee(n,"hashchange",O,t),Z(k,D,t),Z(y,h,t),t.log("navigation capture unavailable: history methods are not writable",v),o=()=>{},S=()=>{},t=U(),C()}return{mode:"standard",disconnect:()=>{B=!1,o=()=>{},ee(n,"popstate",I,t),ee(n,"hashchange",O,t),Z(y,h,t),Z(k,D,t),S=()=>{},t=U()}}}function ye(e,t){let o=e;for(;o;){let n=Object.getOwnPropertyDescriptor(o,t);if(n)return!("value"in n)||typeof n.value!="function"?null:{owner:o,key:t,descriptor:n};o=Object.getPrototypeOf(o)}return null}function ge(e,t){if(e.descriptor.writable!==!0)throw new TypeError(`${e.key} is not writable`);let o=Object.getOwnPropertyDescriptor(e.owner,e.key);if(!be(o,e.descriptor))throw new Error(`${e.key} changed during installation`);Object.defineProperty(e.owner,e.key,{...e.descriptor,value:t})}function be(e,t){return!!e&&"value"in e&&"value"in t&&e.value===t.value&&e.writable===t.writable&&e.enumerable===t.enumerable&&e.configurable===t.configurable}function Z(e,t,o){try{let n=Object.getOwnPropertyDescriptor(e.owner,e.key);be(n,{...e.descriptor,value:t})&&Object.defineProperty(e.owner,e.key,e.descriptor)}catch(n){o.log(`navigation ${e.key} restoration skipped`,n)}}function ee(e,t,o,n){try{e.removeEventListener(t,o)}catch(r){n.log(`navigation ${t} listener removal skipped`,r)}}function ve(e){let t=e.composedPath();return t.length>0?t:e.target?[e.target]:[]}var we="0.2.0";0&&(module.exports={VERSION,captureNavigation,captureNetwork,captureWebAuthn,composedPath});
+"use strict";var re=Object.defineProperty;var Ce=Object.getOwnPropertyDescriptor;var ke=Object.getOwnPropertyNames;var qe=Object.prototype.hasOwnProperty;var Ae=(e,n)=>{for(var t in n)re(e,t,{get:n[t],enumerable:!0})},Oe=(e,n,t,o)=>{if(n&&typeof n=="object"||typeof n=="function")for(let r of ke(n))!qe.call(e,r)&&r!==t&&re(e,r,{get:()=>n[r],enumerable:!(o=Ce(n,r))||o.enumerable});return e};var Ee=e=>Oe(re({},"__esModule",{value:!0}),e);var Ue={};Ae(Ue,{VERSION:()=>we,captureNavigation:()=>be,captureNetwork:()=>ye,captureWebAuthn:()=>ce,composedPath:()=>ve});module.exports=Ee(Ue);var Pe={log:()=>{}};function F(e){return e?{log:(...n)=>{try{let t=e.log(...n);if(t&&(typeof t=="object"||typeof t=="function"))try{Promise.resolve(t).catch(()=>{})}catch{}}catch{}}}:Pe}var ue=Symbol.for("corbado.autocapture.installed");function U(e){try{return typeof e=="function"&&Object.prototype.hasOwnProperty.call(e,ue)}catch{return!1}}function X(e,n){var o,r;let t=n;try{Object.defineProperty(e,ue,{value:n,configurable:!0})}catch{}try{Object.defineProperty(e,"name",{value:(o=t.name)!=null?o:"",configurable:!0})}catch{}try{Object.defineProperty(e,"length",{value:(r=t.length)!=null?r:0,configurable:!0})}catch{}return e}function O(){return{mode:"unavailable",disconnect:()=>{}}}function oe(e,n){return!!e&&"value"in e&&"value"in n&&e.value===n.value&&e.writable===n.writable&&e.enumerable===n.enumerable&&e.configurable===n.configurable}function J(e,n,t,o,r,i=String(n)){try{let c=Object.getOwnPropertyDescriptor(e,n);oe(c,{...o,value:t})&&Object.defineProperty(e,n,o)}catch(c){r.log(`${i} restoration skipped`,c)}}function $(e,n,t){let o=F(e);return r=>{try{let i=t(r);if(i&&(typeof i=="object"||typeof i=="function"))try{Promise.resolve(i).catch(c=>o.log(`${n} listener failed`,c))}catch(c){o.log(`${n} listener failed`,c)}}catch(i){o.log(`${n} listener failed`,i)}}}function ce(e){let n=e.onEvent;if(typeof n!="function")throw new TypeError("captureWebAuthn requires an onEvent callback");let t=F(e.logger),o=typeof navigator=="undefined"?void 0:navigator,r=o==null?void 0:o.credentials;if(!o||!r)return t.log("webauthn capture unavailable: navigator.credentials missing"),O();let i=r.get,c=r.create;if(typeof i!="function"||typeof c!="function")return t.log("webauthn capture unavailable: credentials methods missing"),O();if(U(i)||U(c))return t.log("webauthn capture unavailable: an equivalent capture is already active"),O();let y=!1,C=0,B=$(t,"webauthn",h=>{if(y)return n(h)}),k=(h,D)=>{let I={invoke(...q){let v=this,g=q[0];if(!y||!Z(g)||!Z(g.publicKey))return Reflect.apply(D,v,q);let G=g.publicKey,u=`wa-${++C}`,m=Reflect.apply(D,v,q),p=Z(g.signal)?g.signal:void 0,f=xe(h,g,G),_={...f,ceremonyId:u,phase:"started",userActivation:Be(o)};if(f.kind==="authentication"){let w=G;_.requestOptionsJson=Le(w,t)}return B(_),Promise.resolve(m).then(w=>(y&&B({...f,ceremonyId:u,phase:"completed",credentialJson:De(w,h,t),...(p==null?void 0:p.aborted)===!0?{aborted:!0}:{}}),w),w=>{throw y&&B({...f,ceremonyId:u,phase:"failed",error:w,errorName:He(w),...(p==null?void 0:p.aborted)===!0?{aborted:!0}:{}}),w})}}.invoke;return X(I,{name:h,length:0})},x=(h,D)=>{let I=k(h,D),q=Object.getOwnPropertyDescriptor(r,h);if(q&&(!("value"in q)||q.writable!==!0))return null;try{r[h]=I}catch{return null}return()=>{r[h]===I&&(q?r[h]=q.value:delete r[h])}},S=x("get",i),N=S?x("create",c):null;return!S||!N?(S==null||S(),t.log("webauthn capture unavailable: credentials methods cannot be patched safely"),O()):(y=!0,{mode:"standard",disconnect:()=>{y=!1,S(),N()}})}function xe(e,n,t){let o=Se(n.mediation);if(e==="create")return{kind:"registration",mediation:o};let r=t;return{kind:"authentication",mediation:o,uiMode:Ne(n.uiMode),credentialSet:Array.isArray(r.allowCredentials)&&r.allowCredentials.length>0?"allowlisted":"discoverable"}}function Se(e){return e===void 0?"optional":e==="silent"||e==="optional"||e==="conditional"||e==="required"?e:"unknown"}function Ne(e){return e===void 0?"default":e==="immediate"?"immediate":"unknown"}function Be(e){let n=e.userActivation;return typeof(n==null?void 0:n.isActive)=="boolean"?n.isActive:void 0}function De(e,n,t){var o;if(e)try{let r=e,i=r.response,c={id:z(r.id),rawId:K(r.rawId),type:z(r.type),authenticatorAttachment:z(r.authenticatorAttachment),response:n==="create"?{clientDataJSON:K(i==null?void 0:i.clientDataJSON),attestationObject:K(i==null?void 0:i.attestationObject),transports:ae((o=i==null?void 0:i.getTransports)==null?void 0:o.call(i))}:{clientDataJSON:K(i==null?void 0:i.clientDataJSON),authenticatorData:K(i==null?void 0:i.authenticatorData),signature:K(i==null?void 0:i.signature),userHandle:K(i==null?void 0:i.userHandle)},...n==="create"?je(r):{}};return JSON.stringify(c)}catch(r){t.log("credential serialization failed",r);return}}function Le(e,n){try{let t={},o=z(e.rpId),r=z(e.userVerification),i=ae(e.hints);return o!==void 0&&(t.rpId=o),typeof e.timeout=="number"&&Number.isFinite(e.timeout)&&(t.timeout=e.timeout),r!==void 0&&(t.userVerification=r),i!==void 0&&(t.hints=i),t.challenge=K(e.challenge),Array.isArray(e.allowCredentials)&&(t.allowCredentials=Te(e.allowCredentials)),JSON.stringify(t)}catch(t){n.log("request options serialization failed",t);return}}function Te(e){let n=[];for(let t of e){if(!Z(t))continue;let o=t;n.push({type:z(o.type),id:K(o.id),transports:ae(o.transports)})}return n}function ae(e){if(Array.isArray(e))return e.filter(n=>typeof n=="string")}function z(e){return typeof e=="string"?e:void 0}function je(e){var o;let n=(o=e.getClientExtensionResults)==null?void 0:o.call(e);if(!Z(n))return{};let t=n.credProps;return!t||typeof t.rk!="boolean"?{}:{clientExtensionResults:{credProps:{rk:t.rk}}}}function K(e){let n;if(e instanceof ArrayBuffer)n=new Uint8Array(e);else if(ArrayBuffer.isView(e))n=new Uint8Array(e.buffer,e.byteOffset,e.byteLength);else return;let t="";for(let o of n)t+=String.fromCharCode(o);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}function Z(e){return e!==null&&(typeof e=="object"||typeof e=="function")}function He(e){return e instanceof DOMException?e.name:"UnknownError"}var de=0;function le(){return de+=1,`network-${de}`}function Ie(e,n){let t=e.responseType;if(t===""||t==="text")return n(e.responseText);if(t==="json"){let o=e.response;return o==null?void 0:n(o)}}var Me=500,pe=Symbol("body-read-timeout");function fe(e){return/event-stream|octet-stream/i.test(e)?!1:/json|text|urlencoded/i.test(e)}async function he(e,n){let t=e.body;if(!t)return;let o=t.getReader(),r;try{let i=new Promise(C=>{r=setTimeout(()=>C(pe),Me)}),c=new TextDecoder,y=[];for(;;){let C=await Promise.race([o.read(),i]);if(C===pe){n.log("body omitted: read timed out"),o.cancel().catch(()=>{});return}if(C.done)break;y.push(c.decode(C.value,{stream:!0}))}return y.push(c.decode()),y.join("")}catch{o.cancel().catch(()=>{});return}finally{r!==void 0&&clearTimeout(r)}}function ie(e){var n;(n=e==null?void 0:e.body)==null||n.cancel().catch(()=>{})}function ye(e){var v,g,G;let{onExchange:n,onRequest:t,match:o}=e;if(typeof n!="function"||typeof o!="function")throw new TypeError("captureNetwork requires onExchange and match callbacks");let r=F(e.logger),i=(v=e.transports)!=null?v:["xhr","fetch"],c=(g=e.bodyCapture)==null?void 0:g.request,y=(G=e.bodyCapture)==null?void 0:G.response,C=typeof c=="function",B=typeof y=="function",k=!1,x=$(r,"network",u=>{if(k)return n(u)}),S=$(r,"network request",u=>{if(k)return t==null?void 0:t(u)}),N=(u,m,p)=>{if(typeof p=="function")try{return p(u,m)}catch(f){r.log("body projection failed",f);return}},h=(u,m)=>{try{let p=typeof document!="undefined"?document.baseURI:void 0,f=new URL(String(u),p);return o(f,m)===!0?{url:f.href,path:f.pathname}:void 0}catch{return}},D=()=>{if(typeof XMLHttpRequest=="undefined")return r.log("xhr capture unavailable: XMLHttpRequest missing"),null;let u=XMLHttpRequest.prototype,m=Object.getOwnPropertyDescriptor(u,"open"),p=Object.getOwnPropertyDescriptor(u,"send");if(!m||!("value"in m)||typeof m.value!="function"||!p||!("value"in p)||typeof p.value!="function")return r.log("xhr capture unavailable: XMLHttpRequest methods missing"),null;let f=m.value,_=p.value;if(U(f)||U(_))return r.log("xhr capture unavailable: an equivalent capture is already active"),null;let w=new WeakMap,R=new Set,E=!1,L={open(...b){var d;let a=Reflect.apply(f,this,b);if(!k||!E)return a;try{let P=w.get(this);P&&(P.reported=!0,(d=P.cleanupListeners)==null||d.call(P));let T=String(b[0]).toUpperCase(),A=h(b[1],T);A?w.set(this,{method:T,url:A.url,path:A.path,reported:!1}):w.delete(this)}catch(P){r.log("xhr open observation failed",P)}return a}}.open,W={send(...b){let a=k&&E?w.get(this):void 0;if(!a||a.reported||a.cleanupListeners)return Reflect.apply(_,this,b);let d=()=>{},P=!1;try{a.requestId=le();let A={direction:"request",transport:"xhr",method:a.method,url:a.url,path:a.path};a.requestBody=C&&typeof b[0]=="string"?N(b[0],A,c):void 0;let Y=()=>{a.outcome===void 0&&(a.outcome="abort")},Q=()=>{a.outcome===void 0&&(a.outcome="timeout")},s=()=>{a.outcome===void 0&&(a.outcome="error")},l=()=>{var V;d();try{if(!k||!E||a.reported||!a.requestId)return;a.reported=!0;let H={direction:"response",transport:"xhr",method:a.method,url:a.url,path:a.path},ne=this.status,se={requestId:a.requestId,transport:"xhr",method:a.method,url:a.url,path:a.path,status:ne,ok:ne>=200&&ne<300,outcome:(V=a.outcome)!=null?V:"load",durationMs:a.startedAt!==void 0?Date.now()-a.startedAt:void 0,responseUrl:this.responseURL||void 0,requestBody:a.requestBody,responseBody:B?Ie(this,Re=>N(Re,H,y)):void 0};a.requestEmitted?x(se):a.pendingExchange=se}catch(H){r.log("xhr exchange observation failed",H)}finally{w.get(this)===a&&w.delete(this)}},j=()=>{try{this.readyState===XMLHttpRequest.DONE&&this.status!==0&&l()}catch(V){r.log("xhr ready-state observation failed",V)}},M=()=>l();d=()=>{for(let[V,H]of[["readystatechange",j],["abort",Y],["timeout",Q],["error",s],["loadend",M]])this.removeEventListener(V,H);a.cleanupListeners===d&&(a.cleanupListeners=void 0),R.delete(d)},this.addEventListener("readystatechange",j),this.addEventListener("abort",Y),this.addEventListener("timeout",Q),this.addEventListener("error",s),this.addEventListener("loadend",M),a.cleanupListeners=d,R.add(d),a.startedAt=Date.now(),P=!0}catch(A){r.log("xhr send observation failed",A),d()}let T;try{T=Reflect.apply(_,this,b)}catch(A){throw d(),A}if(P&&a.requestId!==void 0&&a.startedAt!==void 0){a.requestEmitted=!0,S({requestId:a.requestId,transport:"xhr",method:a.method,url:a.url,path:a.path,startedAt:a.startedAt,requestBody:a.requestBody});let A=a.pendingExchange;a.pendingExchange=void 0,A&&x(A)}return T}}.send;return X(L,f),X(W,_),m.writable!==!0||p.writable!==!0?(r.log("xhr capture unavailable: XMLHttpRequest methods are not writable"),null):(Object.defineProperty(u,"open",{...m,value:L}),Object.defineProperty(u,"send",{...p,value:W}),E=!0,()=>{E=!1;for(let b of[...R])b();J(u,"open",L,m,r),J(u,"send",W,p,r)})},I=()=>{let u=globalThis,m=Object.getOwnPropertyDescriptor(u,"fetch");if(!m||!("value"in m))return r.log("fetch capture unavailable: fetch is not an own data property"),null;let p=m.value;if(typeof p!="function")return r.log("fetch capture unavailable: fetch missing"),null;if(U(p))return r.log("fetch capture unavailable: an equivalent capture is already active"),null;let f=!1,_=async(R,E,L,W)=>{try{if(!k||!f){ie(L);return}let[b,a]=await Promise.all([W!=null?W:Promise.resolve(void 0),L?he(L,r):Promise.resolve(void 0)]);if(!k||!f)return;let d={direction:"request",transport:"fetch",method:R.method,url:R.url,path:R.path},P={...d,direction:"response"},T=R.requestBody;T===void 0&&b!==void 0&&(T=N(b,d,c));let A=a!==void 0?N(a,P,y):void 0;x({requestId:R.requestId,transport:"fetch",method:R.method,url:R.url,path:R.path,status:E.status,ok:E.ok,outcome:"load",durationMs:Date.now()-R.startedAt,responseUrl:E.url||void 0,requestBody:T,responseBody:A})}catch(b){r.log("fetch exchange observation failed",b)}},w={fetch(...R){var T,A,Y,Q;let E;try{let s=R[0],l=R[1];if(k&&f&&C&&typeof Request!="undefined"&&s instanceof Request&&(l==null?void 0:l.body)===void 0&&s.body){let j=String((T=l==null?void 0:l.method)!=null?T:s.method).toUpperCase(),M=(A=s.headers.get("content-type"))!=null?A:"";h(s.url,j)&&fe(M)&&(E=s.clone())}}catch(s){r.log("fetch observation failed",s)}let L,W=Date.now();try{L=Reflect.apply(p,this,R)}catch(s){throw ie(E),s}let b,a;try{if(k&&f){let s=R[0],l=R[1],j=typeof Request!="undefined"&&s instanceof Request,M=String((Y=l==null?void 0:l.method)!=null?Y:j?s.method:"GET").toUpperCase(),V=j?s.url:s,H=h(V,M);H&&(b={requestId:le(),method:M,url:H.url,path:H.path,startedAt:W},a=(Q=l==null?void 0:l.signal)!=null?Q:j?s.signal:void 0,C&&typeof(l==null?void 0:l.body)=="string"&&(b.requestBody=N(l.body,{direction:"request",transport:"fetch",method:M,url:H.url,path:H.path},c)))}}catch(s){r.log("fetch observation failed",s)}if(!b)return ie(E),L;let d=b;S({requestId:d.requestId,transport:"fetch",method:d.method,url:d.url,path:d.path,startedAt:d.startedAt,requestBody:d.requestBody});let P=E?he(E,r):void 0;return L.then(s=>{var j;let l;try{if(k&&f&&B){let M=(j=s.headers.get("content-type"))!=null?j:"";fe(M)&&s.body&&(l=s.clone())}}catch{}_(d,s,l,P)},s=>{try{if(!k||!f)return;let l=(a==null?void 0:a.aborted)===!0||(s==null?void 0:s.name)==="AbortError"||typeof DOMException!="undefined"&&s instanceof DOMException&&s.code===DOMException.ABORT_ERR;x({requestId:d.requestId,transport:"fetch",method:d.method,url:d.url,path:d.path,status:0,ok:!1,outcome:l?"abort":"error",durationMs:Date.now()-d.startedAt})}catch(l){r.log("fetch failure observation failed",l)}}),L}}.fetch;return X(w,p),m.writable!==!0?(r.log("fetch capture unavailable: fetch is not writable"),null):(Object.defineProperty(u,"fetch",{...m,value:w}),f=!0,()=>{f=!1,J(u,"fetch",w,m,r)})},q=[];if(i.includes("xhr")){let u=D();u&&q.push(u)}if(i.includes("fetch")){let u=I();u&&q.push(u)}return q.length===0?O():(k=!0,{mode:"standard",disconnect:()=>{k=!1;for(let u of q.splice(0))u()}})}function be(e){let n=e.onNavigate;if(typeof n!="function")throw new TypeError("captureNavigation requires an onNavigate callback");let t=F(e.logger),o,r,i,c,y,C;try{if(o=window,r=o==null?void 0:o.history,!o||!r)return t.log("navigation capture unavailable: window/history missing"),O();if(y=ge(r,"pushState"),C=ge(r,"replaceState"),!y||!C)return t.log("navigation capture unavailable: history method descriptors missing"),O();if(i=y.descriptor.value,c=C.descriptor.value,typeof i!="function"||typeof c!="function")return t.log("navigation capture unavailable: history methods missing"),O();if(typeof o.addEventListener!="function"||typeof o.removeEventListener!="function")return t.log("navigation capture unavailable: window event methods missing"),O()}catch(v){return t.log("navigation capture unavailable: history inspection failed",v),O()}if(U(i)||U(c))return t.log("navigation capture unavailable: an equivalent capture is already active"),O();let B=!1,k=()=>({path:o.location.pathname,search:o.location.search,hash:o.location.hash}),x;try{x=k()}catch(v){return t.log("navigation capture unavailable: location inspection failed",v),O()}let S=$(t,"navigation",v=>{if(B)return n(v)}),N=v=>{if(B)try{let g=k();if(g.path===x.path&&g.search===x.search&&g.hash===x.hash)return;x=g,S({...g,source:v})}catch(g){t.log("navigation observation failed",g)}},h={pushState(...v){let g=Reflect.apply(i,this,v);return N("push"),g}}.pushState,D={replaceState(...v){let g=Reflect.apply(c,this,v);return N("replace"),g}}.replaceState;X(h,i),X(D,c);let I=()=>N("pop"),q=()=>N("hash");try{if(me(y,h),me(C,D),r.pushState!==h||r.replaceState!==D)throw new Error("history method replacement did not take effect");o.addEventListener("popstate",I),o.addEventListener("hashchange",q),B=!0}catch(v){return B=!1,te(o,"popstate",I,t),te(o,"hashchange",q,t),ee(C,D,t),ee(y,h,t),t.log("navigation capture unavailable: history methods are not writable",v),n=()=>{},S=()=>{},t=F(),O()}return{mode:"standard",disconnect:()=>{B=!1,n=()=>{},te(o,"popstate",I,t),te(o,"hashchange",q,t),ee(y,h,t),ee(C,D,t),S=()=>{},t=F()}}}function ge(e,n){let t=e;for(;t;){let o=Object.getOwnPropertyDescriptor(t,n);if(o)return!("value"in o)||typeof o.value!="function"?null:{owner:t,key:n,descriptor:o};t=Object.getPrototypeOf(t)}return null}function me(e,n){if(e.descriptor.writable!==!0)throw new TypeError(`${e.key} is not writable`);let t=Object.getOwnPropertyDescriptor(e.owner,e.key);if(!oe(t,e.descriptor))throw new Error(`${e.key} changed during installation`);Object.defineProperty(e.owner,e.key,{...e.descriptor,value:n})}function ee(e,n,t){J(e.owner,e.key,n,e.descriptor,t,`navigation ${e.key}`)}function te(e,n,t,o){try{e.removeEventListener(n,t)}catch(r){o.log(`navigation ${n} listener removal skipped`,r)}}function ve(e){let n=e.composedPath();return n.length>0?n:e.target?[e.target]:[]}var we="0.3.0-next.14-2a142aa";0&&(module.exports={VERSION,captureNavigation,captureNetwork,captureWebAuthn,composedPath});

package/dist/index.mjs

@@ -1 +1 @@
-var ge={log:()=>{}};function U(e){return e?{log:(...t)=>{try{let o=e.log(...t);if(o&&(typeof o=="object"||typeof o=="function"))try{Promise.resolve(o).catch(()=>{})}catch{}}catch{}}}:ge}var ae=Symbol.for("corbado.autocapture.installed");function _(e){try{return typeof e=="function"&&Object.prototype.hasOwnProperty.call(e,ae)}catch{return!1}}function X(e,t){var n,r;let o=t;try{Object.defineProperty(e,ae,{value:t,configurable:!0})}catch{}try{Object.defineProperty(e,"name",{value:(n=o.name)!=null?n:"",configurable:!0})}catch{}try{Object.defineProperty(e,"length",{value:(r=o.length)!=null?r:0,configurable:!0})}catch{}return e}function C(){return{mode:"unavailable",disconnect:()=>{}}}function $(e,t,o){let n=U(e);return r=>{try{let a=o(r);if(a&&(typeof a=="object"||typeof a=="function"))try{Promise.resolve(a).catch(p=>n.log(`${t} listener failed`,p))}catch(p){n.log(`${t} listener failed`,p)}}catch(a){n.log(`${t} listener failed`,a)}}}function me(e){let t=U(e.logger),o=e.onEvent;if(typeof o!="function")return C();let n=typeof navigator=="undefined"?void 0:navigator,r=n==null?void 0:n.credentials;if(!n||!r)return t.log("webauthn capture unavailable: navigator.credentials missing"),C();let a=r.get,p=r.create;if(typeof a!="function"||typeof p!="function")return t.log("webauthn capture unavailable: credentials methods missing"),C();if(_(a)||_(p))return t.log("webauthn capture unavailable: an equivalent capture is already active"),C();let y=!1,k=0,B=$(t,"webauthn",h=>{if(y)return o(h)}),q=(h,D)=>{let I={invoke(...O){let v=this,g=O[0];if(!y||!Q(g)||!Q(g.publicKey))return Reflect.apply(D,v,O);let z=g.publicKey,u=`wa-${++k}`,m=Reflect.apply(D,v,O),l=Q(g.signal)?g.signal:void 0,f=be(h,g,z),W={...f,ceremonyId:u,phase:"started",userActivation:Re(n)};if(f.kind==="authentication"){let w=z;W.requestOptionsJson=ke(w,t)}return B(W),Promise.resolve(m).then(w=>(y&&B({...f,ceremonyId:u,phase:"completed",credentialJson:Ce(w,h,t),...(l==null?void 0:l.aborted)===!0?{aborted:!0}:{}}),w),w=>{throw y&&B({...f,ceremonyId:u,phase:"failed",error:w,errorName:Ae(w),...(l==null?void 0:l.aborted)===!0?{aborted:!0}:{}}),w})}}.invoke;return X(I,{name:h,length:0})},x=(h,D)=>{let I=q(h,D),O=Object.getOwnPropertyDescriptor(r,h);if(O&&(!("value"in O)||O.writable!==!0))return null;try{r[h]=I}catch{return null}return()=>{r[h]===I&&(O?r[h]=O.value:delete r[h])}},S=x("get",a),N=S?x("create",p):null;return!S||!N?(S==null||S(),t.log("webauthn capture unavailable: credentials methods cannot be patched safely"),C()):(y=!0,{mode:"standard",disconnect:()=>{y=!1,S(),N()}})}function be(e,t,o){let n=ve(t.mediation);if(e==="create")return{kind:"registration",mediation:n};let r=o;return{kind:"authentication",mediation:n,uiMode:we(t.uiMode),credentialSet:Array.isArray(r.allowCredentials)&&r.allowCredentials.length>0?"allowlisted":"discoverable"}}function ve(e){return e===void 0?"optional":e==="silent"||e==="optional"||e==="conditional"||e==="required"?e:"unknown"}function we(e){return e===void 0?"default":e==="immediate"?"immediate":"unknown"}function Re(e){let t=e.userActivation;return typeof(t==null?void 0:t.isActive)=="boolean"?t.isActive:void 0}function Ce(e,t,o){var n;if(e)try{let r=e,a=r.response,p={id:J(r.id),rawId:K(r.rawId),type:J(r.type),authenticatorAttachment:J(r.authenticatorAttachment),response:t==="create"?{clientDataJSON:K(a==null?void 0:a.clientDataJSON),attestationObject:K(a==null?void 0:a.attestationObject),transports:ne((n=a==null?void 0:a.getTransports)==null?void 0:n.call(a))}:{clientDataJSON:K(a==null?void 0:a.clientDataJSON),authenticatorData:K(a==null?void 0:a.authenticatorData),signature:K(a==null?void 0:a.signature),userHandle:K(a==null?void 0:a.userHandle)},...t==="create"?Oe(r):{}};return JSON.stringify(p)}catch(r){o.log("credential serialization failed",r);return}}function ke(e,t){try{let o={},n=J(e.rpId),r=J(e.userVerification),a=ne(e.hints);return n!==void 0&&(o.rpId=n),typeof e.timeout=="number"&&Number.isFinite(e.timeout)&&(o.timeout=e.timeout),r!==void 0&&(o.userVerification=r),a!==void 0&&(o.hints=a),o.challenge=K(e.challenge),Array.isArray(e.allowCredentials)&&(o.allowCredentials=qe(e.allowCredentials)),JSON.stringify(o)}catch(o){t.log("request options serialization failed",o);return}}function qe(e){let t=[];for(let o of e){if(!Q(o))continue;let n=o;t.push({type:J(n.type),id:K(n.id),transports:ne(n.transports)})}return t}function ne(e){if(Array.isArray(e))return e.filter(t=>typeof t=="string")}function J(e){return typeof e=="string"?e:void 0}function Oe(e){var n;let t=(n=e.getClientExtensionResults)==null?void 0:n.call(e);if(!Q(t))return{};let o=t.credProps;return!o||typeof o.rk!="boolean"?{}:{clientExtensionResults:{credProps:{rk:o.rk}}}}function K(e){let t;if(e instanceof ArrayBuffer)t=new Uint8Array(e);else if(ArrayBuffer.isView(e))t=new Uint8Array(e.buffer,e.byteOffset,e.byteLength);else return;let o="";for(let n of t)o+=String.fromCharCode(n);return btoa(o).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}function Q(e){return e!==null&&(typeof e=="object"||typeof e=="function")}function Ae(e){return e instanceof DOMException?e.name:"UnknownError"}var se=0;function ue(){return se+=1,`network-${se}`}function Pe(e,t){let o=e.responseType;if(o===""||o==="text")return t(e.responseText);if(o==="json"){let n=e.response;return n==null?void 0:t(n)}}var Ee=500,ce=Symbol("body-read-timeout");function de(e){return/event-stream|octet-stream/i.test(e)?!1:/json|text|urlencoded/i.test(e)}async function le(e,t){let o=e.body;if(!o)return;let n=o.getReader(),r;try{let a=new Promise(k=>{r=setTimeout(()=>k(ce),Ee)}),p=new TextDecoder,y=[];for(;;){let k=await Promise.race([n.read(),a]);if(k===ce){t.log("body omitted: read timed out"),n.cancel().catch(()=>{});return}if(k.done)break;y.push(p.decode(k.value,{stream:!0}))}return y.push(p.decode()),y.join("")}catch{n.cancel().catch(()=>{});return}finally{r!==void 0&&clearTimeout(r)}}function re(e){var t;(t=e==null?void 0:e.body)==null||t.cancel().catch(()=>{})}function oe(e,t,o,n,r){try{let a=Object.getOwnPropertyDescriptor(e,t);xe(a,{...n,value:o})&&Object.defineProperty(e,t,n)}catch(a){r.log(`${String(t)} restoration skipped`,a)}}function xe(e,t){return!!e&&"value"in e&&"value"in t&&e.value===t.value&&e.writable===t.writable&&e.enumerable===t.enumerable&&e.configurable===t.configurable}function Se(e){var v,g,z;let{onExchange:t,onRequest:o,match:n}=e;if(typeof t!="function"||typeof n!="function")throw new TypeError("captureNetwork requires onExchange and match callbacks");let r=U(e.logger),a=(v=e.transports)!=null?v:["xhr","fetch"],p=(g=e.bodyCapture)==null?void 0:g.request,y=(z=e.bodyCapture)==null?void 0:z.response,k=typeof p=="function",B=typeof y=="function",q=!1,x=$(r,"network",u=>{if(q)return t(u)}),S=$(r,"network request",u=>{if(q)return o==null?void 0:o(u)}),N=(u,m,l)=>{if(typeof l=="function")try{return l(u,m)}catch(f){r.log("body projection failed",f);return}},h=(u,m)=>{try{let l=typeof document!="undefined"?document.baseURI:void 0,f=new URL(String(u),l);return n(f,m)===!0?{url:f.href,path:f.pathname}:void 0}catch{return}},D=()=>{if(typeof XMLHttpRequest=="undefined")return r.log("xhr capture unavailable: XMLHttpRequest missing"),null;let u=XMLHttpRequest.prototype,m=Object.getOwnPropertyDescriptor(u,"open"),l=Object.getOwnPropertyDescriptor(u,"send");if(!m||!("value"in m)||typeof m.value!="function"||!l||!("value"in l)||typeof l.value!="function")return r.log("xhr capture unavailable: XMLHttpRequest methods missing"),null;let f=m.value,W=l.value;if(_(f)||_(W))return r.log("xhr capture unavailable: an equivalent capture is already active"),null;let w=new WeakMap,R=new Set,P=!1,L={open(...b){var c;let i=Reflect.apply(f,this,b);if(!q||!P)return i;try{let E=w.get(this);E&&(E.reported=!0,(c=E.cleanupListeners)==null||c.call(E));let j=String(b[0]).toUpperCase(),A=h(b[1],j);A?w.set(this,{method:j,url:A.url,path:A.path,reported:!1}):w.delete(this)}catch(E){r.log("xhr open observation failed",E)}return i}}.open,F={send(...b){let i=q&&P?w.get(this):void 0;if(!i||i.reported||i.cleanupListeners)return Reflect.apply(W,this,b);let c=()=>{},E=!1;try{i.requestId=ue();let A={direction:"request",transport:"xhr",method:i.method,url:i.url,path:i.path};i.requestBody=k&&typeof b[0]=="string"?N(b[0],A,p):void 0;let G=()=>{i.outcome===void 0&&(i.outcome="abort")},Y=()=>{i.outcome===void 0&&(i.outcome="timeout")},s=()=>{i.outcome===void 0&&(i.outcome="error")},d=()=>{var V;c();try{if(!q||!P||i.reported||!i.requestId)return;i.reported=!0;let T={direction:"response",transport:"xhr",method:i.method,url:i.url,path:i.path},te=this.status,ie={requestId:i.requestId,transport:"xhr",method:i.method,url:i.url,path:i.path,status:te,ok:te>=200&&te<300,outcome:(V=i.outcome)!=null?V:"load",durationMs:i.startedAt!==void 0?Date.now()-i.startedAt:void 0,responseUrl:this.responseURL||void 0,requestBody:i.requestBody,responseBody:B?Pe(this,ye=>N(ye,T,y)):void 0};i.requestEmitted?x(ie):i.pendingExchange=ie}catch(T){r.log("xhr exchange observation failed",T)}finally{w.get(this)===i&&w.delete(this)}},H=()=>{try{this.readyState===XMLHttpRequest.DONE&&this.status!==0&&d()}catch(V){r.log("xhr ready-state observation failed",V)}},M=()=>d();c=()=>{for(let[V,T]of[["readystatechange",H],["abort",G],["timeout",Y],["error",s],["loadend",M]])this.removeEventListener(V,T);i.cleanupListeners===c&&(i.cleanupListeners=void 0),R.delete(c)},this.addEventListener("readystatechange",H),this.addEventListener("abort",G),this.addEventListener("timeout",Y),this.addEventListener("error",s),this.addEventListener("loadend",M),i.cleanupListeners=c,R.add(c),i.startedAt=Date.now(),E=!0}catch(A){r.log("xhr send observation failed",A),c()}let j;try{j=Reflect.apply(W,this,b)}catch(A){throw c(),A}if(E&&i.requestId!==void 0&&i.startedAt!==void 0){i.requestEmitted=!0,S({requestId:i.requestId,transport:"xhr",method:i.method,url:i.url,path:i.path,startedAt:i.startedAt,requestBody:i.requestBody});let A=i.pendingExchange;i.pendingExchange=void 0,A&&x(A)}return j}}.send;return X(L,f),X(F,W),m.writable!==!0||l.writable!==!0?(r.log("xhr capture unavailable: XMLHttpRequest methods are not writable"),null):(Object.defineProperty(u,"open",{...m,value:L}),Object.defineProperty(u,"send",{...l,value:F}),P=!0,()=>{P=!1;for(let b of[...R])b();oe(u,"open",L,m,r),oe(u,"send",F,l,r)})},I=()=>{let u=globalThis,m=Object.getOwnPropertyDescriptor(u,"fetch");if(!m||!("value"in m))return r.log("fetch capture unavailable: fetch is not an own data property"),null;let l=m.value;if(typeof l!="function")return r.log("fetch capture unavailable: fetch missing"),null;if(_(l))return r.log("fetch capture unavailable: an equivalent capture is already active"),null;let f=!1,W=async(R,P,L,F)=>{try{if(!q||!f){re(L);return}let[b,i]=await Promise.all([F!=null?F:Promise.resolve(void 0),L?le(L,r):Promise.resolve(void 0)]);if(!q||!f)return;let c={direction:"request",transport:"fetch",method:R.method,url:R.url,path:R.path},E={...c,direction:"response"},j=R.requestBody;j===void 0&&b!==void 0&&(j=N(b,c,p));let A=i!==void 0?N(i,E,y):void 0;x({requestId:R.requestId,transport:"fetch",method:R.method,url:R.url,path:R.path,status:P.status,ok:P.ok,outcome:"load",durationMs:Date.now()-R.startedAt,responseUrl:P.url||void 0,requestBody:j,responseBody:A})}catch(b){r.log("fetch exchange observation failed",b)}},w={fetch(...R){var j,A,G,Y;let P;try{let s=R[0],d=R[1];if(q&&f&&k&&typeof Request!="undefined"&&s instanceof Request&&(d==null?void 0:d.body)===void 0&&s.body){let H=String((j=d==null?void 0:d.method)!=null?j:s.method).toUpperCase(),M=(A=s.headers.get("content-type"))!=null?A:"";h(s.url,H)&&de(M)&&(P=s.clone())}}catch(s){r.log("fetch observation failed",s)}let L,F=Date.now();try{L=Reflect.apply(l,this,R)}catch(s){throw re(P),s}let b,i;try{if(q&&f){let s=R[0],d=R[1],H=typeof Request!="undefined"&&s instanceof Request,M=String((G=d==null?void 0:d.method)!=null?G:H?s.method:"GET").toUpperCase(),V=H?s.url:s,T=h(V,M);T&&(b={requestId:ue(),method:M,url:T.url,path:T.path,startedAt:F},i=(Y=d==null?void 0:d.signal)!=null?Y:H?s.signal:void 0,k&&typeof(d==null?void 0:d.body)=="string"&&(b.requestBody=N(d.body,{direction:"request",transport:"fetch",method:M,url:T.url,path:T.path},p)))}}catch(s){r.log("fetch observation failed",s)}if(!b)return re(P),L;let c=b;S({requestId:c.requestId,transport:"fetch",method:c.method,url:c.url,path:c.path,startedAt:c.startedAt,requestBody:c.requestBody});let E=P?le(P,r):void 0;return L.then(s=>{var H;let d;try{if(q&&f&&B){let M=(H=s.headers.get("content-type"))!=null?H:"";de(M)&&s.body&&(d=s.clone())}}catch{}W(c,s,d,E)},s=>{try{if(!q||!f)return;let d=(i==null?void 0:i.aborted)===!0||(s==null?void 0:s.name)==="AbortError"||typeof DOMException!="undefined"&&s instanceof DOMException&&s.code===DOMException.ABORT_ERR;x({requestId:c.requestId,transport:"fetch",method:c.method,url:c.url,path:c.path,status:0,ok:!1,outcome:d?"abort":"error",durationMs:Date.now()-c.startedAt})}catch(d){r.log("fetch failure observation failed",d)}}),L}}.fetch;return X(w,l),m.writable!==!0?(r.log("fetch capture unavailable: fetch is not writable"),null):(Object.defineProperty(u,"fetch",{...m,value:w}),f=!0,()=>{f=!1,oe(u,"fetch",w,m,r)})},O=[];if(a.includes("xhr")){let u=D();u&&O.push(u)}if(a.includes("fetch")){let u=I();u&&O.push(u)}return O.length===0?C():(q=!0,{mode:"standard",disconnect:()=>{q=!1;for(let u of O.splice(0))u()}})}function Ne(e){let t=U(),o;try{if(t=U(e.logger),o=e.onNavigate,typeof o!="function")return C()}catch{return C()}let n,r,a,p,y,k;try{if(n=window,r=n==null?void 0:n.history,!n||!r)return t.log("navigation capture unavailable: window/history missing"),C();if(y=pe(r,"pushState"),k=pe(r,"replaceState"),!y||!k)return t.log("navigation capture unavailable: history method descriptors missing"),C();if(a=y.descriptor.value,p=k.descriptor.value,typeof a!="function"||typeof p!="function")return t.log("navigation capture unavailable: history methods missing"),C();if(typeof n.addEventListener!="function"||typeof n.removeEventListener!="function")return t.log("navigation capture unavailable: window event methods missing"),C()}catch(v){return t.log("navigation capture unavailable: history inspection failed",v),C()}if(_(a)||_(p))return t.log("navigation capture unavailable: an equivalent capture is already active"),C();let B=!1,q=()=>({path:n.location.pathname,search:n.location.search,hash:n.location.hash}),x;try{x=q()}catch(v){return t.log("navigation capture unavailable: location inspection failed",v),C()}let S=$(t,"navigation",v=>{if(B)return o(v)}),N=v=>{if(B)try{let g=q();if(g.path===x.path&&g.search===x.search&&g.hash===x.hash)return;x=g,S({...g,source:v})}catch(g){t.log("navigation observation failed",g)}},h={pushState(...v){let g=Reflect.apply(a,this,v);return N("push"),g}}.pushState,D={replaceState(...v){let g=Reflect.apply(p,this,v);return N("replace"),g}}.replaceState;X(h,a),X(D,p);let I=()=>N("pop"),O=()=>N("hash");try{if(fe(y,h),fe(k,D),r.pushState!==h||r.replaceState!==D)throw new Error("history method replacement did not take effect");n.addEventListener("popstate",I),n.addEventListener("hashchange",O),B=!0}catch(v){return B=!1,ee(n,"popstate",I,t),ee(n,"hashchange",O,t),Z(k,D,t),Z(y,h,t),t.log("navigation capture unavailable: history methods are not writable",v),o=()=>{},S=()=>{},t=U(),C()}return{mode:"standard",disconnect:()=>{B=!1,o=()=>{},ee(n,"popstate",I,t),ee(n,"hashchange",O,t),Z(y,h,t),Z(k,D,t),S=()=>{},t=U()}}}function pe(e,t){let o=e;for(;o;){let n=Object.getOwnPropertyDescriptor(o,t);if(n)return!("value"in n)||typeof n.value!="function"?null:{owner:o,key:t,descriptor:n};o=Object.getPrototypeOf(o)}return null}function fe(e,t){if(e.descriptor.writable!==!0)throw new TypeError(`${e.key} is not writable`);let o=Object.getOwnPropertyDescriptor(e.owner,e.key);if(!he(o,e.descriptor))throw new Error(`${e.key} changed during installation`);Object.defineProperty(e.owner,e.key,{...e.descriptor,value:t})}function he(e,t){return!!e&&"value"in e&&"value"in t&&e.value===t.value&&e.writable===t.writable&&e.enumerable===t.enumerable&&e.configurable===t.configurable}function Z(e,t,o){try{let n=Object.getOwnPropertyDescriptor(e.owner,e.key);he(n,{...e.descriptor,value:t})&&Object.defineProperty(e.owner,e.key,e.descriptor)}catch(n){o.log(`navigation ${e.key} restoration skipped`,n)}}function ee(e,t,o,n){try{e.removeEventListener(t,o)}catch(r){n.log(`navigation ${t} listener removal skipped`,r)}}function Be(e){let t=e.composedPath();return t.length>0?t:e.target?[e.target]:[]}var De="0.2.0";export{De as VERSION,Ne as captureNavigation,Se as captureNetwork,me as captureWebAuthn,Be as composedPath};
+var ge={log:()=>{}};function F(e){return e?{log:(...n)=>{try{let t=e.log(...n);if(t&&(typeof t=="object"||typeof t=="function"))try{Promise.resolve(t).catch(()=>{})}catch{}}catch{}}}:ge}var se=Symbol.for("corbado.autocapture.installed");function U(e){try{return typeof e=="function"&&Object.prototype.hasOwnProperty.call(e,se)}catch{return!1}}function X(e,n){var r,o;let t=n;try{Object.defineProperty(e,se,{value:n,configurable:!0})}catch{}try{Object.defineProperty(e,"name",{value:(r=t.name)!=null?r:"",configurable:!0})}catch{}try{Object.defineProperty(e,"length",{value:(o=t.length)!=null?o:0,configurable:!0})}catch{}return e}function O(){return{mode:"unavailable",disconnect:()=>{}}}function re(e,n){return!!e&&"value"in e&&"value"in n&&e.value===n.value&&e.writable===n.writable&&e.enumerable===n.enumerable&&e.configurable===n.configurable}function J(e,n,t,r,o,i=String(n)){try{let c=Object.getOwnPropertyDescriptor(e,n);re(c,{...r,value:t})&&Object.defineProperty(e,n,r)}catch(c){o.log(`${i} restoration skipped`,c)}}function $(e,n,t){let r=F(e);return o=>{try{let i=t(o);if(i&&(typeof i=="object"||typeof i=="function"))try{Promise.resolve(i).catch(c=>r.log(`${n} listener failed`,c))}catch(c){r.log(`${n} listener failed`,c)}}catch(i){r.log(`${n} listener failed`,i)}}}function me(e){let n=e.onEvent;if(typeof n!="function")throw new TypeError("captureWebAuthn requires an onEvent callback");let t=F(e.logger),r=typeof navigator=="undefined"?void 0:navigator,o=r==null?void 0:r.credentials;if(!r||!o)return t.log("webauthn capture unavailable: navigator.credentials missing"),O();let i=o.get,c=o.create;if(typeof i!="function"||typeof c!="function")return t.log("webauthn capture unavailable: credentials methods missing"),O();if(U(i)||U(c))return t.log("webauthn capture unavailable: an equivalent capture is already active"),O();let y=!1,C=0,B=$(t,"webauthn",h=>{if(y)return n(h)}),k=(h,D)=>{let I={invoke(...q){let v=this,g=q[0];if(!y||!Z(g)||!Z(g.publicKey))return Reflect.apply(D,v,q);let G=g.publicKey,u=`wa-${++C}`,m=Reflect.apply(D,v,q),p=Z(g.signal)?g.signal:void 0,f=be(h,g,G),_={...f,ceremonyId:u,phase:"started",userActivation:Re(r)};if(f.kind==="authentication"){let w=G;_.requestOptionsJson=ke(w,t)}return B(_),Promise.resolve(m).then(w=>(y&&B({...f,ceremonyId:u,phase:"completed",credentialJson:Ce(w,h,t),...(p==null?void 0:p.aborted)===!0?{aborted:!0}:{}}),w),w=>{throw y&&B({...f,ceremonyId:u,phase:"failed",error:w,errorName:Oe(w),...(p==null?void 0:p.aborted)===!0?{aborted:!0}:{}}),w})}}.invoke;return X(I,{name:h,length:0})},x=(h,D)=>{let I=k(h,D),q=Object.getOwnPropertyDescriptor(o,h);if(q&&(!("value"in q)||q.writable!==!0))return null;try{o[h]=I}catch{return null}return()=>{o[h]===I&&(q?o[h]=q.value:delete o[h])}},S=x("get",i),N=S?x("create",c):null;return!S||!N?(S==null||S(),t.log("webauthn capture unavailable: credentials methods cannot be patched safely"),O()):(y=!0,{mode:"standard",disconnect:()=>{y=!1,S(),N()}})}function be(e,n,t){let r=ve(n.mediation);if(e==="create")return{kind:"registration",mediation:r};let o=t;return{kind:"authentication",mediation:r,uiMode:we(n.uiMode),credentialSet:Array.isArray(o.allowCredentials)&&o.allowCredentials.length>0?"allowlisted":"discoverable"}}function ve(e){return e===void 0?"optional":e==="silent"||e==="optional"||e==="conditional"||e==="required"?e:"unknown"}function we(e){return e===void 0?"default":e==="immediate"?"immediate":"unknown"}function Re(e){let n=e.userActivation;return typeof(n==null?void 0:n.isActive)=="boolean"?n.isActive:void 0}function Ce(e,n,t){var r;if(e)try{let o=e,i=o.response,c={id:z(o.id),rawId:K(o.rawId),type:z(o.type),authenticatorAttachment:z(o.authenticatorAttachment),response:n==="create"?{clientDataJSON:K(i==null?void 0:i.clientDataJSON),attestationObject:K(i==null?void 0:i.attestationObject),transports:oe((r=i==null?void 0:i.getTransports)==null?void 0:r.call(i))}:{clientDataJSON:K(i==null?void 0:i.clientDataJSON),authenticatorData:K(i==null?void 0:i.authenticatorData),signature:K(i==null?void 0:i.signature),userHandle:K(i==null?void 0:i.userHandle)},...n==="create"?Ae(o):{}};return JSON.stringify(c)}catch(o){t.log("credential serialization failed",o);return}}function ke(e,n){try{let t={},r=z(e.rpId),o=z(e.userVerification),i=oe(e.hints);return r!==void 0&&(t.rpId=r),typeof e.timeout=="number"&&Number.isFinite(e.timeout)&&(t.timeout=e.timeout),o!==void 0&&(t.userVerification=o),i!==void 0&&(t.hints=i),t.challenge=K(e.challenge),Array.isArray(e.allowCredentials)&&(t.allowCredentials=qe(e.allowCredentials)),JSON.stringify(t)}catch(t){n.log("request options serialization failed",t);return}}function qe(e){let n=[];for(let t of e){if(!Z(t))continue;let r=t;n.push({type:z(r.type),id:K(r.id),transports:oe(r.transports)})}return n}function oe(e){if(Array.isArray(e))return e.filter(n=>typeof n=="string")}function z(e){return typeof e=="string"?e:void 0}function Ae(e){var r;let n=(r=e.getClientExtensionResults)==null?void 0:r.call(e);if(!Z(n))return{};let t=n.credProps;return!t||typeof t.rk!="boolean"?{}:{clientExtensionResults:{credProps:{rk:t.rk}}}}function K(e){let n;if(e instanceof ArrayBuffer)n=new Uint8Array(e);else if(ArrayBuffer.isView(e))n=new Uint8Array(e.buffer,e.byteOffset,e.byteLength);else return;let t="";for(let r of n)t+=String.fromCharCode(r);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}function Z(e){return e!==null&&(typeof e=="object"||typeof e=="function")}function Oe(e){return e instanceof DOMException?e.name:"UnknownError"}var ue=0;function ce(){return ue+=1,`network-${ue}`}function Ee(e,n){let t=e.responseType;if(t===""||t==="text")return n(e.responseText);if(t==="json"){let r=e.response;return r==null?void 0:n(r)}}var Pe=500,de=Symbol("body-read-timeout");function le(e){return/event-stream|octet-stream/i.test(e)?!1:/json|text|urlencoded/i.test(e)}async function pe(e,n){let t=e.body;if(!t)return;let r=t.getReader(),o;try{let i=new Promise(C=>{o=setTimeout(()=>C(de),Pe)}),c=new TextDecoder,y=[];for(;;){let C=await Promise.race([r.read(),i]);if(C===de){n.log("body omitted: read timed out"),r.cancel().catch(()=>{});return}if(C.done)break;y.push(c.decode(C.value,{stream:!0}))}return y.push(c.decode()),y.join("")}catch{r.cancel().catch(()=>{});return}finally{o!==void 0&&clearTimeout(o)}}function ae(e){var n;(n=e==null?void 0:e.body)==null||n.cancel().catch(()=>{})}function xe(e){var v,g,G;let{onExchange:n,onRequest:t,match:r}=e;if(typeof n!="function"||typeof r!="function")throw new TypeError("captureNetwork requires onExchange and match callbacks");let o=F(e.logger),i=(v=e.transports)!=null?v:["xhr","fetch"],c=(g=e.bodyCapture)==null?void 0:g.request,y=(G=e.bodyCapture)==null?void 0:G.response,C=typeof c=="function",B=typeof y=="function",k=!1,x=$(o,"network",u=>{if(k)return n(u)}),S=$(o,"network request",u=>{if(k)return t==null?void 0:t(u)}),N=(u,m,p)=>{if(typeof p=="function")try{return p(u,m)}catch(f){o.log("body projection failed",f);return}},h=(u,m)=>{try{let p=typeof document!="undefined"?document.baseURI:void 0,f=new URL(String(u),p);return r(f,m)===!0?{url:f.href,path:f.pathname}:void 0}catch{return}},D=()=>{if(typeof XMLHttpRequest=="undefined")return o.log("xhr capture unavailable: XMLHttpRequest missing"),null;let u=XMLHttpRequest.prototype,m=Object.getOwnPropertyDescriptor(u,"open"),p=Object.getOwnPropertyDescriptor(u,"send");if(!m||!("value"in m)||typeof m.value!="function"||!p||!("value"in p)||typeof p.value!="function")return o.log("xhr capture unavailable: XMLHttpRequest methods missing"),null;let f=m.value,_=p.value;if(U(f)||U(_))return o.log("xhr capture unavailable: an equivalent capture is already active"),null;let w=new WeakMap,R=new Set,E=!1,L={open(...b){var d;let a=Reflect.apply(f,this,b);if(!k||!E)return a;try{let P=w.get(this);P&&(P.reported=!0,(d=P.cleanupListeners)==null||d.call(P));let T=String(b[0]).toUpperCase(),A=h(b[1],T);A?w.set(this,{method:T,url:A.url,path:A.path,reported:!1}):w.delete(this)}catch(P){o.log("xhr open observation failed",P)}return a}}.open,W={send(...b){let a=k&&E?w.get(this):void 0;if(!a||a.reported||a.cleanupListeners)return Reflect.apply(_,this,b);let d=()=>{},P=!1;try{a.requestId=ce();let A={direction:"request",transport:"xhr",method:a.method,url:a.url,path:a.path};a.requestBody=C&&typeof b[0]=="string"?N(b[0],A,c):void 0;let Y=()=>{a.outcome===void 0&&(a.outcome="abort")},Q=()=>{a.outcome===void 0&&(a.outcome="timeout")},s=()=>{a.outcome===void 0&&(a.outcome="error")},l=()=>{var V;d();try{if(!k||!E||a.reported||!a.requestId)return;a.reported=!0;let H={direction:"response",transport:"xhr",method:a.method,url:a.url,path:a.path},ne=this.status,ie={requestId:a.requestId,transport:"xhr",method:a.method,url:a.url,path:a.path,status:ne,ok:ne>=200&&ne<300,outcome:(V=a.outcome)!=null?V:"load",durationMs:a.startedAt!==void 0?Date.now()-a.startedAt:void 0,responseUrl:this.responseURL||void 0,requestBody:a.requestBody,responseBody:B?Ee(this,ye=>N(ye,H,y)):void 0};a.requestEmitted?x(ie):a.pendingExchange=ie}catch(H){o.log("xhr exchange observation failed",H)}finally{w.get(this)===a&&w.delete(this)}},j=()=>{try{this.readyState===XMLHttpRequest.DONE&&this.status!==0&&l()}catch(V){o.log("xhr ready-state observation failed",V)}},M=()=>l();d=()=>{for(let[V,H]of[["readystatechange",j],["abort",Y],["timeout",Q],["error",s],["loadend",M]])this.removeEventListener(V,H);a.cleanupListeners===d&&(a.cleanupListeners=void 0),R.delete(d)},this.addEventListener("readystatechange",j),this.addEventListener("abort",Y),this.addEventListener("timeout",Q),this.addEventListener("error",s),this.addEventListener("loadend",M),a.cleanupListeners=d,R.add(d),a.startedAt=Date.now(),P=!0}catch(A){o.log("xhr send observation failed",A),d()}let T;try{T=Reflect.apply(_,this,b)}catch(A){throw d(),A}if(P&&a.requestId!==void 0&&a.startedAt!==void 0){a.requestEmitted=!0,S({requestId:a.requestId,transport:"xhr",method:a.method,url:a.url,path:a.path,startedAt:a.startedAt,requestBody:a.requestBody});let A=a.pendingExchange;a.pendingExchange=void 0,A&&x(A)}return T}}.send;return X(L,f),X(W,_),m.writable!==!0||p.writable!==!0?(o.log("xhr capture unavailable: XMLHttpRequest methods are not writable"),null):(Object.defineProperty(u,"open",{...m,value:L}),Object.defineProperty(u,"send",{...p,value:W}),E=!0,()=>{E=!1;for(let b of[...R])b();J(u,"open",L,m,o),J(u,"send",W,p,o)})},I=()=>{let u=globalThis,m=Object.getOwnPropertyDescriptor(u,"fetch");if(!m||!("value"in m))return o.log("fetch capture unavailable: fetch is not an own data property"),null;let p=m.value;if(typeof p!="function")return o.log("fetch capture unavailable: fetch missing"),null;if(U(p))return o.log("fetch capture unavailable: an equivalent capture is already active"),null;let f=!1,_=async(R,E,L,W)=>{try{if(!k||!f){ae(L);return}let[b,a]=await Promise.all([W!=null?W:Promise.resolve(void 0),L?pe(L,o):Promise.resolve(void 0)]);if(!k||!f)return;let d={direction:"request",transport:"fetch",method:R.method,url:R.url,path:R.path},P={...d,direction:"response"},T=R.requestBody;T===void 0&&b!==void 0&&(T=N(b,d,c));let A=a!==void 0?N(a,P,y):void 0;x({requestId:R.requestId,transport:"fetch",method:R.method,url:R.url,path:R.path,status:E.status,ok:E.ok,outcome:"load",durationMs:Date.now()-R.startedAt,responseUrl:E.url||void 0,requestBody:T,responseBody:A})}catch(b){o.log("fetch exchange observation failed",b)}},w={fetch(...R){var T,A,Y,Q;let E;try{let s=R[0],l=R[1];if(k&&f&&C&&typeof Request!="undefined"&&s instanceof Request&&(l==null?void 0:l.body)===void 0&&s.body){let j=String((T=l==null?void 0:l.method)!=null?T:s.method).toUpperCase(),M=(A=s.headers.get("content-type"))!=null?A:"";h(s.url,j)&&le(M)&&(E=s.clone())}}catch(s){o.log("fetch observation failed",s)}let L,W=Date.now();try{L=Reflect.apply(p,this,R)}catch(s){throw ae(E),s}let b,a;try{if(k&&f){let s=R[0],l=R[1],j=typeof Request!="undefined"&&s instanceof Request,M=String((Y=l==null?void 0:l.method)!=null?Y:j?s.method:"GET").toUpperCase(),V=j?s.url:s,H=h(V,M);H&&(b={requestId:ce(),method:M,url:H.url,path:H.path,startedAt:W},a=(Q=l==null?void 0:l.signal)!=null?Q:j?s.signal:void 0,C&&typeof(l==null?void 0:l.body)=="string"&&(b.requestBody=N(l.body,{direction:"request",transport:"fetch",method:M,url:H.url,path:H.path},c)))}}catch(s){o.log("fetch observation failed",s)}if(!b)return ae(E),L;let d=b;S({requestId:d.requestId,transport:"fetch",method:d.method,url:d.url,path:d.path,startedAt:d.startedAt,requestBody:d.requestBody});let P=E?pe(E,o):void 0;return L.then(s=>{var j;let l;try{if(k&&f&&B){let M=(j=s.headers.get("content-type"))!=null?j:"";le(M)&&s.body&&(l=s.clone())}}catch{}_(d,s,l,P)},s=>{try{if(!k||!f)return;let l=(a==null?void 0:a.aborted)===!0||(s==null?void 0:s.name)==="AbortError"||typeof DOMException!="undefined"&&s instanceof DOMException&&s.code===DOMException.ABORT_ERR;x({requestId:d.requestId,transport:"fetch",method:d.method,url:d.url,path:d.path,status:0,ok:!1,outcome:l?"abort":"error",durationMs:Date.now()-d.startedAt})}catch(l){o.log("fetch failure observation failed",l)}}),L}}.fetch;return X(w,p),m.writable!==!0?(o.log("fetch capture unavailable: fetch is not writable"),null):(Object.defineProperty(u,"fetch",{...m,value:w}),f=!0,()=>{f=!1,J(u,"fetch",w,m,o)})},q=[];if(i.includes("xhr")){let u=D();u&&q.push(u)}if(i.includes("fetch")){let u=I();u&&q.push(u)}return q.length===0?O():(k=!0,{mode:"standard",disconnect:()=>{k=!1;for(let u of q.splice(0))u()}})}function Se(e){let n=e.onNavigate;if(typeof n!="function")throw new TypeError("captureNavigation requires an onNavigate callback");let t=F(e.logger),r,o,i,c,y,C;try{if(r=window,o=r==null?void 0:r.history,!r||!o)return t.log("navigation capture unavailable: window/history missing"),O();if(y=fe(o,"pushState"),C=fe(o,"replaceState"),!y||!C)return t.log("navigation capture unavailable: history method descriptors missing"),O();if(i=y.descriptor.value,c=C.descriptor.value,typeof i!="function"||typeof c!="function")return t.log("navigation capture unavailable: history methods missing"),O();if(typeof r.addEventListener!="function"||typeof r.removeEventListener!="function")return t.log("navigation capture unavailable: window event methods missing"),O()}catch(v){return t.log("navigation capture unavailable: history inspection failed",v),O()}if(U(i)||U(c))return t.log("navigation capture unavailable: an equivalent capture is already active"),O();let B=!1,k=()=>({path:r.location.pathname,search:r.location.search,hash:r.location.hash}),x;try{x=k()}catch(v){return t.log("navigation capture unavailable: location inspection failed",v),O()}let S=$(t,"navigation",v=>{if(B)return n(v)}),N=v=>{if(B)try{let g=k();if(g.path===x.path&&g.search===x.search&&g.hash===x.hash)return;x=g,S({...g,source:v})}catch(g){t.log("navigation observation failed",g)}},h={pushState(...v){let g=Reflect.apply(i,this,v);return N("push"),g}}.pushState,D={replaceState(...v){let g=Reflect.apply(c,this,v);return N("replace"),g}}.replaceState;X(h,i),X(D,c);let I=()=>N("pop"),q=()=>N("hash");try{if(he(y,h),he(C,D),o.pushState!==h||o.replaceState!==D)throw new Error("history method replacement did not take effect");r.addEventListener("popstate",I),r.addEventListener("hashchange",q),B=!0}catch(v){return B=!1,te(r,"popstate",I,t),te(r,"hashchange",q,t),ee(C,D,t),ee(y,h,t),t.log("navigation capture unavailable: history methods are not writable",v),n=()=>{},S=()=>{},t=F(),O()}return{mode:"standard",disconnect:()=>{B=!1,n=()=>{},te(r,"popstate",I,t),te(r,"hashchange",q,t),ee(y,h,t),ee(C,D,t),S=()=>{},t=F()}}}function fe(e,n){let t=e;for(;t;){let r=Object.getOwnPropertyDescriptor(t,n);if(r)return!("value"in r)||typeof r.value!="function"?null:{owner:t,key:n,descriptor:r};t=Object.getPrototypeOf(t)}return null}function he(e,n){if(e.descriptor.writable!==!0)throw new TypeError(`${e.key} is not writable`);let t=Object.getOwnPropertyDescriptor(e.owner,e.key);if(!re(t,e.descriptor))throw new Error(`${e.key} changed during installation`);Object.defineProperty(e.owner,e.key,{...e.descriptor,value:n})}function ee(e,n,t){J(e.owner,e.key,n,e.descriptor,t,`navigation ${e.key}`)}function te(e,n,t,r){try{e.removeEventListener(n,t)}catch(o){r.log(`navigation ${n} listener removal skipped`,o)}}function Ne(e){let n=e.composedPath();return n.length>0?n:e.target?[e.target]:[]}var Be="0.3.0-next.14-2a142aa";export{Be as VERSION,Se as captureNavigation,xe as captureNetwork,me as captureWebAuthn,Ne as composedPath};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corbado/autocapture",
-  "version": "0.2.0",
+  "version": "0.3.0-next.14-2a142aa",
   "description": "Observer-style capture helpers for WebAuthn ceremonies, selected network exchanges, in-app navigation, and composed event paths.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -22,13 +22,11 @@
   "devDependencies": {
     "@playwright/test": "^1.57.0",
     "@types/node": "^20",
-    "es-check": "latest",
-    "eslint-config-prettier": "^10.1.8",
-    "jsdom": "latest",
+    "es-check": "9.6.4",
+    "jsdom": "29.1.1",
     "prettier": "^3.7.4",
-    "tsup": "latest",
-    "typescript": "latest",
-    "typescript-eslint": "^8.55.0",
+    "tsup": "8.5.1",
+    "typescript": "6.0.3",
     "vitest": "^4.1.0"
   }
 }