@corbado/autocapture 0.5.0 → 0.6.0

package/README.md

@@ -148,11 +148,37 @@ Navigation events likewise contain the raw `search` and `hash`. OAuth responses,
 links, and application routes can put secrets or PII there; no navigation redaction policy is
 currently applied.
 
-WebAuthn responses use an explicit serializer rather than `credential.toJSON()`. The allowlist keeps
-the assertion and attestation fields the Observe backend parses for credential, authenticator,
-backup-state, AAGUID, transport, and discoverability insight. Client-extension output is limited to
-`credProps.rk`; PRF and unrelated extension results are omitted. The payload therefore still contains
-credential IDs, user handles, challenges, signatures, authenticator data, and attestation material.
+WebAuthn interception and network fallbacks share four exported helpers:
+`sanitizeCreationOptions`, `sanitizeCreationResponse`, `sanitizeRequestOptions`, and
+`sanitizeAssertionResponse`. Each accepts the relevant native browser object, a JSON object, or a
+JSON string, and returns JSON text or `undefined` on malformed/unserializable input. Pass the
+`publicKey` options or credential itself, not an application-specific request envelope.
+
+The blacklist lives only in `src/webauthn-payloads.ts`:
+
+| Payload | Removed paths |
+| --- | --- |
+| Creation options | `user.name`, `user.displayName` |
+| Creation response | `clientExtensionResults.prf.results` |
+| Request options | None |
+| Assertion response | `response.signature`, `clientExtensionResults.prf.results` |
+
+All other JSON fields are retained, including new/unknown fields and extensions. Binary values are
+base64url-encoded. Native WebIDL attributes and response methods are normalized without calling
+`credential.toJSON()`. Inputs are never mutated; blacklisted property getters are not read. Failures
+omit the payload without logging raw input or exception messages. This is a path blacklist, not a
+content scanner: IDs, user handles, challenges, complete attestation material and non-blacklisted
+extension data remain. Encoded attestation/client-data blobs are not decoded or redacted.
+
+`started` registration events carry `creationOptionsJson`; authentication events carry
+`requestOptionsJson`. `completed` events carry `credentialJson`. All are processed by the helpers
+before callbacks run. For a network fallback, extract the credential/options from the endpoint
+body and call the corresponding helper in `bodyCapture` before returning the projected body.
+Adapters own endpoint mapping and source deduplication, never copies of the blacklist.
+
+This changes the telemetry contract: assertion signatures are removed, and fields formerly excluded
+by the old allowlist are retained unless blacklisted. Existing consumers should validate their
+parsers when upgrading. An adapter pinned to an older release is unaffected until upgraded.
 
 The tested 1Password browser extension exposes locked `get` and `create` accessors. By default
 WebAuthn capture therefore reports `mode: "unavailable"`; passkey operations continue through

package/dist/index.d.mts

@@ -39,15 +39,16 @@ type WebAuthnCeremonyStartedEvent = WebAuthnCeremonyBase & {
     /** Whether transient user activation was active when the ceremony started, when exposed by the browser. */
     userActivation?: boolean;
     /**
-     * JSON-encoded request metadata for authentication: `rpId`, `timeout`,
-     * `userVerification`, `hints`, `challenge`, and `allowCredentials`.
+     * JSON-encoded authentication publicKey options. All fields are retained.
      * Binary values are base64url-encoded. Treat this value as sensitive telemetry.
      */
     requestOptionsJson?: string;
+    /** Creation publicKey options with user.name and user.displayName removed. */
+    creationOptionsJson?: string;
 };
 type WebAuthnCeremonyCompletedEvent = WebAuthnCeremonyBase & {
     phase: "completed";
-    /** JSON-encoded allowlisted credential; present only when applicable and serializable. Treat this value as sensitive telemetry. */
+    /** JSON-encoded credential after the centralized blacklist; present only when applicable and serializable. Treat this value as sensitive telemetry. */
     credentialJson?: string;
     /** A credential manager may complete even after the ceremony signal was aborted. */
     aborted?: true;
@@ -312,4 +313,13 @@ declare function composedPath(event: Event): readonly EventTarget[];
 /** Version identifier embedded in the current build. */
 declare const VERSION: string;
 
-export { type CaptureHandle, type HttpExchange, type HttpRequestStarted, type Logger, type NavigationCaptureOptions, type NavigationEvent, type NavigationSource, type NetworkBodyDirection, type NetworkBodyProjectionContext, type NetworkBodyProjector, type NetworkCaptureOptions, type NetworkTransport, VERSION, type WebAuthnAttachSurface, type WebAuthnCaptureHandle, type WebAuthnCaptureOptions, type WebAuthnCeremonyCompletedEvent, type WebAuthnCeremonyContext, type WebAuthnCeremonyEvent, type WebAuthnCeremonyFailedEvent, type WebAuthnCeremonyStartedEvent, type WebAuthnMediation, type WebAuthnUiMode, captureNavigation, captureNetwork, captureWebAuthn, composedPath };
+/** Sanitizes publicKey creation options (native values, JSON object, or JSON string). */
+declare function sanitizeCreationOptions(value: unknown): string | undefined;
+/** Sanitizes a registration credential; keeps attestation material but removes PRF results. */
+declare function sanitizeCreationResponse(value: unknown): string | undefined;
+/** Serializes publicKey authentication options. No fields are currently blacklisted. */
+declare function sanitizeRequestOptions(value: unknown): string | undefined;
+/** Sanitizes an authentication credential; removes its login signature and PRF results. */
+declare function sanitizeAssertionResponse(value: unknown): string | undefined;
+
+export { type CaptureHandle, type HttpExchange, type HttpRequestStarted, type Logger, type NavigationCaptureOptions, type NavigationEvent, type NavigationSource, type NetworkBodyDirection, type NetworkBodyProjectionContext, type NetworkBodyProjector, type NetworkCaptureOptions, type NetworkTransport, VERSION, type WebAuthnAttachSurface, type WebAuthnCaptureHandle, type WebAuthnCaptureOptions, type WebAuthnCeremonyCompletedEvent, type WebAuthnCeremonyContext, type WebAuthnCeremonyEvent, type WebAuthnCeremonyFailedEvent, type WebAuthnCeremonyStartedEvent, type WebAuthnMediation, type WebAuthnUiMode, captureNavigation, captureNetwork, captureWebAuthn, composedPath, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions };

package/dist/index.d.ts

@@ -39,15 +39,16 @@ type WebAuthnCeremonyStartedEvent = WebAuthnCeremonyBase & {
     /** Whether transient user activation was active when the ceremony started, when exposed by the browser. */
     userActivation?: boolean;
     /**
-     * JSON-encoded request metadata for authentication: `rpId`, `timeout`,
-     * `userVerification`, `hints`, `challenge`, and `allowCredentials`.
+     * JSON-encoded authentication publicKey options. All fields are retained.
      * Binary values are base64url-encoded. Treat this value as sensitive telemetry.
      */
     requestOptionsJson?: string;
+    /** Creation publicKey options with user.name and user.displayName removed. */
+    creationOptionsJson?: string;
 };
 type WebAuthnCeremonyCompletedEvent = WebAuthnCeremonyBase & {
     phase: "completed";
-    /** JSON-encoded allowlisted credential; present only when applicable and serializable. Treat this value as sensitive telemetry. */
+    /** JSON-encoded credential after the centralized blacklist; present only when applicable and serializable. Treat this value as sensitive telemetry. */
     credentialJson?: string;
     /** A credential manager may complete even after the ceremony signal was aborted. */
     aborted?: true;
@@ -312,4 +313,13 @@ declare function composedPath(event: Event): readonly EventTarget[];
 /** Version identifier embedded in the current build. */
 declare const VERSION: string;
 
-export { type CaptureHandle, type HttpExchange, type HttpRequestStarted, type Logger, type NavigationCaptureOptions, type NavigationEvent, type NavigationSource, type NetworkBodyDirection, type NetworkBodyProjectionContext, type NetworkBodyProjector, type NetworkCaptureOptions, type NetworkTransport, VERSION, type WebAuthnAttachSurface, type WebAuthnCaptureHandle, type WebAuthnCaptureOptions, type WebAuthnCeremonyCompletedEvent, type WebAuthnCeremonyContext, type WebAuthnCeremonyEvent, type WebAuthnCeremonyFailedEvent, type WebAuthnCeremonyStartedEvent, type WebAuthnMediation, type WebAuthnUiMode, captureNavigation, captureNetwork, captureWebAuthn, composedPath };
+/** Sanitizes publicKey creation options (native values, JSON object, or JSON string). */
+declare function sanitizeCreationOptions(value: unknown): string | undefined;
+/** Sanitizes a registration credential; keeps attestation material but removes PRF results. */
+declare function sanitizeCreationResponse(value: unknown): string | undefined;
+/** Serializes publicKey authentication options. No fields are currently blacklisted. */
+declare function sanitizeRequestOptions(value: unknown): string | undefined;
+/** Sanitizes an authentication credential; removes its login signature and PRF results. */
+declare function sanitizeAssertionResponse(value: unknown): string | undefined;
+
+export { type CaptureHandle, type HttpExchange, type HttpRequestStarted, type Logger, type NavigationCaptureOptions, type NavigationEvent, type NavigationSource, type NetworkBodyDirection, type NetworkBodyProjectionContext, type NetworkBodyProjector, type NetworkCaptureOptions, type NetworkTransport, VERSION, type WebAuthnAttachSurface, type WebAuthnCaptureHandle, type WebAuthnCaptureOptions, type WebAuthnCeremonyCompletedEvent, type WebAuthnCeremonyContext, type WebAuthnCeremonyEvent, type WebAuthnCeremonyFailedEvent, type WebAuthnCeremonyStartedEvent, type WebAuthnMediation, type WebAuthnUiMode, captureNavigation, captureNetwork, captureWebAuthn, composedPath, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions };

package/dist/index.js

@@ -1 +1 @@
-"use strict";var re=Object.defineProperty;var Ae=Object.getOwnPropertyDescriptor;var ke=Object.getOwnPropertyNames;var qe=Object.prototype.hasOwnProperty;var Oe=(e,n)=>{for(var t in n)re(e,t,{get:n[t],enumerable:!0})},Pe=(e,n,t,o)=>{if(n&&typeof n=="object"||typeof n=="function")for(let r of ke(n))!qe.call(e,r)&&r!==t&&re(e,r,{get:()=>n[r],enumerable:!(o=Ae(n,r))||o.enumerable});return e};var xe=e=>Pe(re({},"__esModule",{value:!0}),e);var _e={};Oe(_e,{VERSION:()=>Re,captureNavigation:()=>ve,captureNetwork:()=>ge,captureWebAuthn:()=>de,composedPath:()=>we});module.exports=xe(_e);var Ee={log:()=>{}};function K(e){return e?{log:(...n)=>{try{let t=e.log(...n);if(t&&(typeof t=="object"||typeof t=="function"))try{Promise.resolve(t).catch(()=>{})}catch{}}catch{}}}:Ee}var ue=Symbol.for("corbado.autocapture.installed");function M(e){try{return typeof e=="function"&&Object.prototype.hasOwnProperty.call(e,ue)}catch{return!1}}function F(e,n){var o,r;let t=n;try{Object.defineProperty(e,ue,{value:n,configurable:!0})}catch{}try{Object.defineProperty(e,"name",{value:(o=t.name)!=null?o:"",configurable:!0})}catch{}try{Object.defineProperty(e,"length",{value:(r=t.length)!=null?r:0,configurable:!0})}catch{}return e}function B(){return{mode:"unavailable",disconnect:()=>{}}}function oe(e,n){return!!e&&"value"in e&&"value"in n&&e.value===n.value&&e.writable===n.writable&&e.enumerable===n.enumerable&&e.configurable===n.configurable}function z(e,n,t,o,r,a=String(n)){try{let p=Object.getOwnPropertyDescriptor(e,n);oe(p,{...o,value:t})&&Object.defineProperty(e,n,o)}catch(p){r.log(`${a} restoration skipped`,p)}}function J(e,n,t){let o=K(e);return r=>{try{let a=t(r);if(a&&(typeof a=="object"||typeof a=="function"))try{Promise.resolve(a).catch(p=>o.log(`${n} listener failed`,p))}catch(p){o.log(`${n} listener failed`,p)}}catch(a){o.log(`${n} listener failed`,a)}}}var ce=e=>({get:e("get"),create:e("create")});function de(e){let n=e.onEvent;if(typeof n!="function")throw new TypeError("captureWebAuthn requires an onEvent callback");let t=K(e.logger),o=c=>(t.log(`webauthn capture unavailable: ${c}`),{...B(),surface:"none"}),r=typeof navigator=="undefined"?void 0:navigator,a=r==null?void 0:r.credentials;if(!r||!a)return o("navigator.credentials missing");let p=a,w=ce(c=>p[c]);if(typeof w.get!="function"||typeof w.create!="function")return o("credentials methods missing");if(M(w.get)||M(w.create))return o("an equivalent capture is already active");let R=!1,I=0,q=J(t,"webauthn",n),N=(c,y,g)=>{let W={invoke(...u){let d=u[0];if(!R||g!=null&&g()||!Z(d)||!Z(d.publicKey))return y(this,u);let h=d.publicKey,s=`wa-${++I}`,v=y(this,u),C=Z(d.signal)?d.signal:void 0,f=Se(c,d,h),A=O=>{R&&q({...f,ceremonyId:s,...O()})},x=()=>(C==null?void 0:C.aborted)===!0?{aborted:!0}:{};return A(()=>({phase:"started",userActivation:De(r),...f.kind==="authentication"?{requestOptionsJson:Te(h,t)}:{}})),Promise.resolve(v).then(O=>(A(()=>({phase:"completed",credentialJson:Le(O,c,t),...x()})),O),O=>{throw A(()=>({phase:"failed",error:O,errorName:Me(O),...x()})),O})}}.invoke;return F(W,{name:c,length:0})},U=c=>{var W;let y=N(c,(u,d)=>Reflect.apply(w[c],u,d)),g=Object.getOwnPropertyDescriptor(a,c);if(g&&(!("value"in g)||g.writable!==!0))return null;try{p[c]=y}catch{return null}if(((W=Object.getOwnPropertyDescriptor(a,c))==null?void 0:W.value)!==y){try{p[c]=w[c]}catch{}return null}return()=>{p[c]===y&&(g?p[c]=g.value:delete p[c])}},D=()=>{let c=ce(()=>new WeakMap),y=(h,s)=>{let v=c[h].get(s);if(v)return v;let C=N(h,(f,A)=>Reflect.apply(s,a,A),()=>{try{let f=p[h];return f!==s&&f!==C}catch(f){return t.log("suppress check failed; ceremony unreported",f),!0}});return c[h].set(s,C),C},g=h=>{let s=Object.getOwnPropertyDescriptor(a,h);return s?s.configurable===!0||!("value"in s)||s.writable===!0:!0},W=new WeakMap,u=new Proxy(a,{get(h,s){let v=Reflect.get(a,s,a);if((s==="get"||s==="create")&&g(s))return typeof v!="function"||M(v)?v:y(s,v);if(typeof v!="function"||!g(s)||s==="constructor")return v;let C=W.get(v);if(C)return C;let f=v.bind(a);return W.set(v,f),f},set(h,s,v){return Reflect.set(a,s,v,a)}}),d=Object.getOwnPropertyDescriptor(r,"credentials");if(d&&d.configurable!==!0)return null;try{Object.defineProperty(r,"credentials",{value:u,writable:!0,enumerable:!0,configurable:!0})}catch{return null}return r.credentials!==u?null:()=>{r.credentials===u&&(d?Object.defineProperty(r,"credentials",d):delete r.credentials)}},L=(c,y)=>(R=!0,{mode:"standard",surface:c,disconnect:()=>{R=!1,y()}}),E=U("get"),$=E?U("create"):null;if(E&&$)return L("methods",()=>{E(),$()});if(E==null||E(),e.attach==="container"){let c=D();if(c)return t.log("webauthn capture attached at the credentials container"),L("container",c)}return o("credentials methods cannot be patched safely")}function Se(e,n,t){let o=Ne(n.mediation);if(e==="create")return{kind:"registration",mediation:o};let r=t;return{kind:"authentication",mediation:o,uiMode:Be(n.uiMode),credentialSet:Array.isArray(r.allowCredentials)&&r.allowCredentials.length>0?"allowlisted":"discoverable"}}function Ne(e){return e===void 0?"optional":e==="silent"||e==="optional"||e==="conditional"||e==="required"?e:"unknown"}function Be(e){return e===void 0?"default":e==="immediate"?"immediate":"unknown"}function De(e){let n=e.userActivation;return typeof(n==null?void 0:n.isActive)=="boolean"?n.isActive:void 0}function Le(e,n,t){var o;if(e)try{let r=e,a=r.response,p={id:G(r.id),rawId:X(r.rawId),type:G(r.type),authenticatorAttachment:G(r.authenticatorAttachment),response:n==="create"?{clientDataJSON:X(a==null?void 0:a.clientDataJSON),attestationObject:X(a==null?void 0:a.attestationObject),transports:ae((o=a==null?void 0:a.getTransports)==null?void 0:o.call(a))}:{clientDataJSON:X(a==null?void 0:a.clientDataJSON),authenticatorData:X(a==null?void 0:a.authenticatorData),signature:X(a==null?void 0:a.signature),userHandle:X(a==null?void 0:a.userHandle)},...n==="create"?He(r):{}};return JSON.stringify(p)}catch(r){t.log("credential serialization failed",r);return}}function Te(e,n){try{let t={},o=G(e.rpId),r=G(e.userVerification),a=ae(e.hints);return o!==void 0&&(t.rpId=o),typeof e.timeout=="number"&&Number.isFinite(e.timeout)&&(t.timeout=e.timeout),r!==void 0&&(t.userVerification=r),a!==void 0&&(t.hints=a),t.challenge=X(e.challenge),Array.isArray(e.allowCredentials)&&(t.allowCredentials=je(e.allowCredentials)),JSON.stringify(t)}catch(t){n.log("request options serialization failed",t);return}}function je(e){let n=[];for(let t of e){if(!Z(t))continue;let o=t;n.push({type:G(o.type),id:X(o.id),transports:ae(o.transports)})}return n}function ae(e){if(Array.isArray(e))return e.filter(n=>typeof n=="string")}function G(e){return typeof e=="string"?e:void 0}function He(e){var o;let n=(o=e.getClientExtensionResults)==null?void 0:o.call(e);if(!Z(n))return{};let t=n.credProps;return!t||typeof t.rk!="boolean"?{}:{clientExtensionResults:{credProps:{rk:t.rk}}}}function X(e){let n;if(e instanceof ArrayBuffer)n=new Uint8Array(e);else if(ArrayBuffer.isView(e))n=new Uint8Array(e.buffer,e.byteOffset,e.byteLength);else return;let t="";for(let o of n)t+=String.fromCharCode(o);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}function Z(e){return e!==null&&(typeof e=="object"||typeof e=="function")}function Me(e){return e instanceof DOMException?e.name:"UnknownError"}var le=0;function pe(){return le+=1,`network-${le}`}function Ie(e,n){let t=e.responseType;if(t===""||t==="text")return n(e.responseText);if(t==="json"){let o=e.response;return o==null?void 0:n(o)}}var We=500,fe=Symbol("body-read-timeout");function he(e){return/event-stream|octet-stream/i.test(e)?!1:/json|text|urlencoded/i.test(e)}async function ye(e,n){let t=e.body;if(!t)return;let o=t.getReader(),r;try{let a=new Promise(R=>{r=setTimeout(()=>R(fe),We)}),p=new TextDecoder,w=[];for(;;){let R=await Promise.race([o.read(),a]);if(R===fe){n.log("body omitted: read timed out"),o.cancel().catch(()=>{});return}if(R.done)break;w.push(p.decode(R.value,{stream:!0}))}return w.push(p.decode()),w.join("")}catch{o.cancel().catch(()=>{});return}finally{r!==void 0&&clearTimeout(r)}}function ie(e){var n;(n=e==null?void 0:e.body)==null||n.cancel().catch(()=>{})}function ge(e){var y,g,W;let{onExchange:n,onRequest:t,match:o}=e;if(typeof n!="function"||typeof o!="function")throw new TypeError("captureNetwork requires onExchange and match callbacks");let r=K(e.logger),a=(y=e.transports)!=null?y:["xhr","fetch"],p=(g=e.bodyCapture)==null?void 0:g.request,w=(W=e.bodyCapture)==null?void 0:W.response,R=typeof p=="function",I=typeof w=="function",q=!1,N=J(r,"network",u=>{if(q)return n(u)}),U=J(r,"network request",u=>{if(q)return t==null?void 0:t(u)}),D=(u,d,h)=>{if(typeof h=="function")try{return h(u,d)}catch(s){r.log("body projection failed",s);return}},L=(u,d)=>{try{let h=typeof document!="undefined"?document.baseURI:void 0,s=new URL(String(u),h);return o(s,d)===!0?{url:s.href,path:s.pathname}:void 0}catch{return}},E=()=>{if(typeof XMLHttpRequest=="undefined")return r.log("xhr capture unavailable: XMLHttpRequest missing"),null;let u=XMLHttpRequest.prototype,d=Object.getOwnPropertyDescriptor(u,"open"),h=Object.getOwnPropertyDescriptor(u,"send");if(!d||!("value"in d)||typeof d.value!="function"||!h||!("value"in h)||typeof h.value!="function")return r.log("xhr capture unavailable: XMLHttpRequest methods missing"),null;let s=d.value,v=h.value;if(M(s)||M(v))return r.log("xhr capture unavailable: an equivalent capture is already active"),null;let C=new WeakMap,f=new Set,A=!1,x={open(...k){var b;let i=Reflect.apply(s,this,k);if(!q||!A)return i;try{let S=C.get(this);S&&(S.reported=!0,(b=S.cleanupListeners)==null||b.call(S));let T=String(k[0]).toUpperCase(),P=L(k[1],T);P?C.set(this,{method:T,url:P.url,path:P.path,reported:!1}):C.delete(this)}catch(S){r.log("xhr open observation failed",S)}return i}}.open,O={send(...k){let i=q&&A?C.get(this):void 0;if(!i||i.reported||i.cleanupListeners)return Reflect.apply(v,this,k);let b=()=>{},S=!1;try{i.requestId=pe();let P={direction:"request",transport:"xhr",method:i.method,url:i.url,path:i.path};i.requestBody=R&&typeof k[0]=="string"?D(k[0],P,p):void 0;let Y=()=>{i.outcome===void 0&&(i.outcome="abort")},Q=()=>{i.outcome===void 0&&(i.outcome="timeout")},l=()=>{i.outcome===void 0&&(i.outcome="error")},m=()=>{var V;b();try{if(!q||!A||i.reported||!i.requestId)return;i.reported=!0;let H={direction:"response",transport:"xhr",method:i.method,url:i.url,path:i.path},ne=this.status,se={requestId:i.requestId,transport:"xhr",method:i.method,url:i.url,path:i.path,status:ne,ok:ne>=200&&ne<300,outcome:(V=i.outcome)!=null?V:"load",durationMs:i.startedAt!==void 0?Date.now()-i.startedAt:void 0,responseUrl:this.responseURL||void 0,requestBody:i.requestBody,responseBody:I?Ie(this,Ce=>D(Ce,H,w)):void 0};i.requestEmitted?N(se):i.pendingExchange=se}catch(H){r.log("xhr exchange observation failed",H)}finally{C.get(this)===i&&C.delete(this)}},j=()=>{try{this.readyState===XMLHttpRequest.DONE&&this.status!==0&&m()}catch(V){r.log("xhr ready-state observation failed",V)}},_=()=>m();b=()=>{for(let[V,H]of[["readystatechange",j],["abort",Y],["timeout",Q],["error",l],["loadend",_]])this.removeEventListener(V,H);i.cleanupListeners===b&&(i.cleanupListeners=void 0),f.delete(b)},this.addEventListener("readystatechange",j),this.addEventListener("abort",Y),this.addEventListener("timeout",Q),this.addEventListener("error",l),this.addEventListener("loadend",_),i.cleanupListeners=b,f.add(b),i.startedAt=Date.now(),S=!0}catch(P){r.log("xhr send observation failed",P),b()}let T;try{T=Reflect.apply(v,this,k)}catch(P){throw b(),P}if(S&&i.requestId!==void 0&&i.startedAt!==void 0){i.requestEmitted=!0,U({requestId:i.requestId,transport:"xhr",method:i.method,url:i.url,path:i.path,startedAt:i.startedAt,requestBody:i.requestBody});let P=i.pendingExchange;i.pendingExchange=void 0,P&&N(P)}return T}}.send;return F(x,s),F(O,v),d.writable!==!0||h.writable!==!0?(r.log("xhr capture unavailable: XMLHttpRequest methods are not writable"),null):(Object.defineProperty(u,"open",{...d,value:x}),Object.defineProperty(u,"send",{...h,value:O}),A=!0,()=>{A=!1;for(let k of[...f])k();z(u,"open",x,d,r),z(u,"send",O,h,r)})},$=()=>{let u=globalThis,d=Object.getOwnPropertyDescriptor(u,"fetch");if(!d||!("value"in d))return r.log("fetch capture unavailable: fetch is not an own data property"),null;let h=d.value;if(typeof h!="function")return r.log("fetch capture unavailable: fetch missing"),null;if(M(h))return r.log("fetch capture unavailable: an equivalent capture is already active"),null;let s=!1,v=async(f,A,x,O)=>{try{if(!q||!s){ie(x);return}let[k,i]=await Promise.all([O!=null?O:Promise.resolve(void 0),x?ye(x,r):Promise.resolve(void 0)]);if(!q||!s)return;let b={direction:"request",transport:"fetch",method:f.method,url:f.url,path:f.path},S={...b,direction:"response"},T=f.requestBody;T===void 0&&k!==void 0&&(T=D(k,b,p));let P=i!==void 0?D(i,S,w):void 0;N({requestId:f.requestId,transport:"fetch",method:f.method,url:f.url,path:f.path,status:A.status,ok:A.ok,outcome:"load",durationMs:Date.now()-f.startedAt,responseUrl:A.url||void 0,requestBody:T,responseBody:P})}catch(k){r.log("fetch exchange observation failed",k)}},C={fetch(...f){var T,P,Y,Q;let A;try{let l=f[0],m=f[1];if(q&&s&&R&&typeof Request!="undefined"&&l instanceof Request&&(m==null?void 0:m.body)===void 0&&l.body){let j=String((T=m==null?void 0:m.method)!=null?T:l.method).toUpperCase(),_=(P=l.headers.get("content-type"))!=null?P:"";L(l.url,j)&&he(_)&&(A=l.clone())}}catch(l){r.log("fetch observation failed",l)}let x,O=Date.now();try{x=Reflect.apply(h,this,f)}catch(l){throw ie(A),l}let k,i;try{if(q&&s){let l=f[0],m=f[1],j=typeof Request!="undefined"&&l instanceof Request,_=String((Y=m==null?void 0:m.method)!=null?Y:j?l.method:"GET").toUpperCase(),V=j?l.url:l,H=L(V,_);H&&(k={requestId:pe(),method:_,url:H.url,path:H.path,startedAt:O},i=(Q=m==null?void 0:m.signal)!=null?Q:j?l.signal:void 0,R&&typeof(m==null?void 0:m.body)=="string"&&(k.requestBody=D(m.body,{direction:"request",transport:"fetch",method:_,url:H.url,path:H.path},p)))}}catch(l){r.log("fetch observation failed",l)}if(!k)return ie(A),x;let b=k;U({requestId:b.requestId,transport:"fetch",method:b.method,url:b.url,path:b.path,startedAt:b.startedAt,requestBody:b.requestBody});let S=A?ye(A,r):void 0;return x.then(l=>{var j;let m;try{if(q&&s&&I){let _=(j=l.headers.get("content-type"))!=null?j:"";he(_)&&l.body&&(m=l.clone())}}catch{}v(b,l,m,S)},l=>{try{if(!q||!s)return;let m=(i==null?void 0:i.aborted)===!0||(l==null?void 0:l.name)==="AbortError"||typeof DOMException!="undefined"&&l instanceof DOMException&&l.code===DOMException.ABORT_ERR;N({requestId:b.requestId,transport:"fetch",method:b.method,url:b.url,path:b.path,status:0,ok:!1,outcome:m?"abort":"error",durationMs:Date.now()-b.startedAt})}catch(m){r.log("fetch failure observation failed",m)}}),x}}.fetch;return F(C,h),d.writable!==!0?(r.log("fetch capture unavailable: fetch is not writable"),null):(Object.defineProperty(u,"fetch",{...d,value:C}),s=!0,()=>{s=!1,z(u,"fetch",C,d,r)})},c=[];if(a.includes("xhr")){let u=E();u&&c.push(u)}if(a.includes("fetch")){let u=$();u&&c.push(u)}return c.length===0?B():(q=!0,{mode:"standard",disconnect:()=>{q=!1;for(let u of c.splice(0))u()}})}function ve(e){let n=e.onNavigate;if(typeof n!="function")throw new TypeError("captureNavigation requires an onNavigate callback");let t=K(e.logger),o,r,a,p,w,R;try{if(o=window,r=o==null?void 0:o.history,!o||!r)return t.log("navigation capture unavailable: window/history missing"),B();if(w=be(r,"pushState"),R=be(r,"replaceState"),!w||!R)return t.log("navigation capture unavailable: history method descriptors missing"),B();if(a=w.descriptor.value,p=R.descriptor.value,typeof a!="function"||typeof p!="function")return t.log("navigation capture unavailable: history methods missing"),B();if(typeof o.addEventListener!="function"||typeof o.removeEventListener!="function")return t.log("navigation capture unavailable: window event methods missing"),B()}catch(y){return t.log("navigation capture unavailable: history inspection failed",y),B()}if(M(a)||M(p))return t.log("navigation capture unavailable: an equivalent capture is already active"),B();let I=!1,q=()=>({path:o.location.pathname,search:o.location.search,hash:o.location.hash}),N;try{N=q()}catch(y){return t.log("navigation capture unavailable: location inspection failed",y),B()}let U=J(t,"navigation",y=>{if(I)return n(y)}),D=y=>{if(I)try{let g=q();if(g.path===N.path&&g.search===N.search&&g.hash===N.hash)return;N=g,U({...g,source:y})}catch(g){t.log("navigation observation failed",g)}},L={pushState(...y){let g=Reflect.apply(a,this,y);return D("push"),g}}.pushState,E={replaceState(...y){let g=Reflect.apply(p,this,y);return D("replace"),g}}.replaceState;F(L,a),F(E,p);let $=()=>D("pop"),c=()=>D("hash");try{if(me(w,L),me(R,E),r.pushState!==L||r.replaceState!==E)throw new Error("history method replacement did not take effect");o.addEventListener("popstate",$),o.addEventListener("hashchange",c),I=!0}catch(y){return I=!1,te(o,"popstate",$,t),te(o,"hashchange",c,t),ee(R,E,t),ee(w,L,t),t.log("navigation capture unavailable: history methods are not writable",y),n=()=>{},U=()=>{},t=K(),B()}return{mode:"standard",disconnect:()=>{I=!1,n=()=>{},te(o,"popstate",$,t),te(o,"hashchange",c,t),ee(w,L,t),ee(R,E,t),U=()=>{},t=K()}}}function be(e,n){let t=e;for(;t;){let o=Object.getOwnPropertyDescriptor(t,n);if(o)return!("value"in o)||typeof o.value!="function"?null:{owner:t,key:n,descriptor:o};t=Object.getPrototypeOf(t)}return null}function me(e,n){if(e.descriptor.writable!==!0)throw new TypeError(`${e.key} is not writable`);let t=Object.getOwnPropertyDescriptor(e.owner,e.key);if(!oe(t,e.descriptor))throw new Error(`${e.key} changed during installation`);Object.defineProperty(e.owner,e.key,{...e.descriptor,value:n})}function ee(e,n,t){z(e.owner,e.key,n,e.descriptor,t,`navigation ${e.key}`)}function te(e,n,t,o){try{e.removeEventListener(n,t)}catch(r){o.log(`navigation ${n} listener removal skipped`,r)}}function we(e){let n=e.composedPath();return n.length>0?n:e.target?[e.target]:[]}var Re="0.5.0";0&&(module.exports={VERSION,captureNavigation,captureNetwork,captureWebAuthn,composedPath});
+"use strict";var ae=Object.defineProperty;var Ae=Object.getOwnPropertyDescriptor;var ke=Object.getOwnPropertyNames;var xe=Object.prototype.hasOwnProperty;var Pe=(e,t)=>{for(var n in t)ae(e,n,{get:t[n],enumerable:!0})},Ee=(e,t,n,o)=>{if(t&&typeof t=="object"||typeof t=="function")for(let r of ke(t))!xe.call(e,r)&&r!==n&&ae(e,r,{get:()=>t[r],enumerable:!(o=Ae(t,r))||o.enumerable});return e};var Se=e=>Ee(ae({},"__esModule",{value:!0}),e);var Ue={};Pe(Ue,{VERSION:()=>Ce,captureNavigation:()=>Re,captureNetwork:()=>ve,captureWebAuthn:()=>pe,composedPath:()=>Oe,sanitizeAssertionResponse:()=>ee,sanitizeCreationOptions:()=>Y,sanitizeCreationResponse:()=>Q,sanitizeRequestOptions:()=>Z});module.exports=Se(Ue);var Be={creationOptions:["/user/name","/user/displayName"],creationResponse:["/clientExtensionResults/prf/results"],requestOptions:[],assertionResponse:["/response/signature","/clientExtensionResults/prf/results"]};function Y(e){return te(e,"creationOptions")}function Q(e){return te(e,"creationResponse")}function Z(e){return te(e,"requestOptions")}function ee(e){return te(e,"assertionResponse")}function te(e,t){try{let n=typeof e=="string"?JSON.parse(e):e;if(!Ne(n))return;let o=new Set(Be[t]),r=new Set,u=(i,y,m=0)=>{if(!o.has(y)){if(i===null||typeof i=="string"||typeof i=="boolean")return i;if(typeof i=="number")return Number.isFinite(i)?i:null;if(typeof i=="object"){if(i instanceof ArrayBuffer||ArrayBuffer.isView(i))return je(i);if(m>64||r.has(i))throw new TypeError("Invalid telemetry payload");r.add(i);try{if(Array.isArray(i))return i.map((P,C)=>u(P,`${y}/${C}`,m+1));let j=Object.create(null);for(let P in i){let C=`${y}/${P.replace(/~/g,"~0").replace(/\//g,"~1")}`;if(o.has(C)||P==="toJSON")continue;let S=u(i[P],C,m+1);S!==void 0&&(j[P]=S)}let O=i,x=(P,C)=>{if(j[C]!==void 0||typeof O[P]!="function")return;let S=`${y}/${C}`,B=u(Reflect.apply(O[P],i,[]),S,m+1);B!==void 0&&(j[C]=B)};return y===""&&(t==="creationResponse"||t==="assertionResponse")&&x("getClientExtensionResults","clientExtensionResults"),y==="/response"&&t==="creationResponse"&&(x("getTransports","transports"),x("getAuthenticatorData","authenticatorData"),x("getPublicKey","publicKey"),x("getPublicKeyAlgorithm","publicKeyAlgorithm")),j}finally{r.delete(i)}}}};return JSON.stringify(u(n,""))}catch{return}}function Ne(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)&&!(e instanceof ArrayBuffer)&&!ArrayBuffer.isView(e)}function je(e){let t=e instanceof ArrayBuffer?new Uint8Array(e):new Uint8Array(e.buffer,e.byteOffset,e.byteLength),n="";for(let o of t)n+=String.fromCharCode(o);return btoa(n).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}var De={log:()=>{}};function K(e){return e?{log:(...t)=>{try{let n=e.log(...t);if(n&&(typeof n=="object"||typeof n=="function"))try{Promise.resolve(n).catch(()=>{})}catch{}}catch{}}}:De}var de=Symbol.for("corbado.autocapture.installed");function W(e){try{return typeof e=="function"&&Object.prototype.hasOwnProperty.call(e,de)}catch{return!1}}function F(e,t){var o,r;let n=t;try{Object.defineProperty(e,de,{value:t,configurable:!0})}catch{}try{Object.defineProperty(e,"name",{value:(o=n.name)!=null?o:"",configurable:!0})}catch{}try{Object.defineProperty(e,"length",{value:(r=n.length)!=null?r:0,configurable:!0})}catch{}return e}function T(){return{mode:"unavailable",disconnect:()=>{}}}function ie(e,t){return!!e&&"value"in e&&"value"in t&&e.value===t.value&&e.writable===t.writable&&e.enumerable===t.enumerable&&e.configurable===t.configurable}function J(e,t,n,o,r,u=String(t)){try{let i=Object.getOwnPropertyDescriptor(e,t);ie(i,{...o,value:n})&&Object.defineProperty(e,t,o)}catch(i){r.log(`${u} restoration skipped`,i)}}function X(e,t,n){let o=K(e);return r=>{try{let u=n(r);if(u&&(typeof u=="object"||typeof u=="function"))try{Promise.resolve(u).catch(i=>o.log(`${t} listener failed`,i))}catch(i){o.log(`${t} listener failed`,i)}}catch(u){o.log(`${t} listener failed`,u)}}}var le=e=>({get:e("get"),create:e("create")});function pe(e){let t=e.onEvent;if(typeof t!="function")throw new TypeError("captureWebAuthn requires an onEvent callback");let n=K(e.logger),o=d=>(n.log(`webauthn capture unavailable: ${d}`),{...T(),surface:"none"}),r=typeof navigator=="undefined"?void 0:navigator,u=r==null?void 0:r.credentials;if(!r||!u)return o("navigator.credentials missing");let i=u,y=le(d=>i[d]);if(typeof y.get!="function"||typeof y.create!="function")return o("credentials methods missing");if(W(y.get)||W(y.create))return o("an equivalent capture is already active");let m=!1,j=0,O=X(n,"webauthn",t),x=(d,g,b)=>{let _={invoke(...c){let l=c[0];if(!m||b!=null&&b()||!se(l)||!se(l.publicKey))return g(this,c);let h=l.publicKey,s=`wa-${++j}`,R=g(this,c),q=se(l.signal)?l.signal:void 0,f=Le(d,l,h),A=E=>{m&&O({...f,ceremonyId:s,...E()})},D=()=>(q==null?void 0:q.aborted)===!0?{aborted:!0}:{};return A(()=>({phase:"started",userActivation:Me(r),...f.kind==="authentication"?{requestOptionsJson:Z(h)}:{creationOptionsJson:Y(h)}})),Promise.resolve(R).then(E=>(A(()=>({phase:"completed",credentialJson:d==="create"?Q(E):ee(E),...D()})),E),E=>{throw A(()=>({phase:"failed",error:E,errorName:Ie(E),...D()})),E})}}.invoke;return F(_,{name:d,length:0})},P=d=>{var _;let g=x(d,(c,l)=>Reflect.apply(y[d],c,l)),b=Object.getOwnPropertyDescriptor(u,d);if(b&&(!("value"in b)||b.writable!==!0))return null;try{i[d]=g}catch{return null}if(((_=Object.getOwnPropertyDescriptor(u,d))==null?void 0:_.value)!==g){try{i[d]=y[d]}catch{}return null}return()=>{i[d]===g&&(b?i[d]=b.value:delete i[d])}},C=()=>{let d=le(()=>new WeakMap),g=(h,s)=>{let R=d[h].get(s);if(R)return R;let q=x(h,(f,A)=>Reflect.apply(s,u,A),()=>{try{let f=i[h];return f!==s&&f!==q}catch(f){return n.log("suppress check failed; ceremony unreported",f),!0}});return d[h].set(s,q),q},b=h=>{let s=Object.getOwnPropertyDescriptor(u,h);return s?s.configurable===!0||!("value"in s)||s.writable===!0:!0},_=new WeakMap,c=new Proxy(u,{get(h,s){let R=Reflect.get(u,s,u);if((s==="get"||s==="create")&&b(s))return typeof R!="function"||W(R)?R:g(s,R);if(typeof R!="function"||!b(s)||s==="constructor")return R;let q=_.get(R);if(q)return q;let f=R.bind(u);return _.set(R,f),f},set(h,s,R){return Reflect.set(u,s,R,u)}}),l=Object.getOwnPropertyDescriptor(r,"credentials");if(l&&l.configurable!==!0)return null;try{Object.defineProperty(r,"credentials",{value:c,writable:!0,enumerable:!0,configurable:!0})}catch{return null}return r.credentials!==c?null:()=>{r.credentials===c&&(l?Object.defineProperty(r,"credentials",l):delete r.credentials)}},S=(d,g)=>(m=!0,{mode:"standard",surface:d,disconnect:()=>{m=!1,g()}}),B=P("get"),$=B?P("create"):null;if(B&&$)return S("methods",()=>{B(),$()});if(B==null||B(),e.attach==="container"){let d=C();if(d)return n.log("webauthn capture attached at the credentials container"),S("container",d)}return o("credentials methods cannot be patched safely")}function Le(e,t,n){let o=Te(t.mediation);if(e==="create")return{kind:"registration",mediation:o};let r=n;return{kind:"authentication",mediation:o,uiMode:He(t.uiMode),credentialSet:Array.isArray(r.allowCredentials)&&r.allowCredentials.length>0?"allowlisted":"discoverable"}}function Te(e){return e===void 0?"optional":e==="silent"||e==="optional"||e==="conditional"||e==="required"?e:"unknown"}function He(e){return e===void 0?"default":e==="immediate"?"immediate":"unknown"}function Me(e){let t=e.userActivation;return typeof(t==null?void 0:t.isActive)=="boolean"?t.isActive:void 0}function se(e){return e!==null&&(typeof e=="object"||typeof e=="function")}function Ie(e){return e instanceof DOMException?e.name:"UnknownError"}var fe=0;function he(){return fe+=1,`network-${fe}`}function We(e,t){let n=e.responseType;if(n===""||n==="text")return t(e.responseText);if(n==="json"){let o=e.response;return o==null?void 0:t(o)}}var _e=500,ye=Symbol("body-read-timeout");function ge(e){return/event-stream|octet-stream/i.test(e)?!1:/json|text|urlencoded/i.test(e)}async function be(e,t){let n=e.body;if(!n)return;let o=n.getReader(),r;try{let u=new Promise(m=>{r=setTimeout(()=>m(ye),_e)}),i=new TextDecoder,y=[];for(;;){let m=await Promise.race([o.read(),u]);if(m===ye){t.log("body omitted: read timed out"),o.cancel().catch(()=>{});return}if(m.done)break;y.push(i.decode(m.value,{stream:!0}))}return y.push(i.decode()),y.join("")}catch{o.cancel().catch(()=>{});return}finally{r!==void 0&&clearTimeout(r)}}function ue(e){var t;(t=e==null?void 0:e.body)==null||t.cancel().catch(()=>{})}function ve(e){var g,b,_;let{onExchange:t,onRequest:n,match:o}=e;if(typeof t!="function"||typeof o!="function")throw new TypeError("captureNetwork requires onExchange and match callbacks");let r=K(e.logger),u=(g=e.transports)!=null?g:["xhr","fetch"],i=(b=e.bodyCapture)==null?void 0:b.request,y=(_=e.bodyCapture)==null?void 0:_.response,m=typeof i=="function",j=typeof y=="function",O=!1,x=X(r,"network",c=>{if(O)return t(c)}),P=X(r,"network request",c=>{if(O)return n==null?void 0:n(c)}),C=(c,l,h)=>{if(typeof h=="function")try{return h(c,l)}catch(s){r.log("body projection failed",s);return}},S=(c,l)=>{try{let h=typeof document!="undefined"?document.baseURI:void 0,s=new URL(String(c),h);return o(s,l)===!0?{url:s.href,path:s.pathname}:void 0}catch{return}},B=()=>{if(typeof XMLHttpRequest=="undefined")return r.log("xhr capture unavailable: XMLHttpRequest missing"),null;let c=XMLHttpRequest.prototype,l=Object.getOwnPropertyDescriptor(c,"open"),h=Object.getOwnPropertyDescriptor(c,"send");if(!l||!("value"in l)||typeof l.value!="function"||!h||!("value"in h)||typeof h.value!="function")return r.log("xhr capture unavailable: XMLHttpRequest methods missing"),null;let s=l.value,R=h.value;if(W(s)||W(R))return r.log("xhr capture unavailable: an equivalent capture is already active"),null;let q=new WeakMap,f=new Set,A=!1,D={open(...k){var v;let a=Reflect.apply(s,this,k);if(!O||!A)return a;try{let L=q.get(this);L&&(L.reported=!0,(v=L.cleanupListeners)==null||v.call(L));let H=String(k[0]).toUpperCase(),N=S(k[1],H);N?q.set(this,{method:H,url:N.url,path:N.path,reported:!1}):q.delete(this)}catch(L){r.log("xhr open observation failed",L)}return a}}.open,E={send(...k){let a=O&&A?q.get(this):void 0;if(!a||a.reported||a.cleanupListeners)return Reflect.apply(R,this,k);let v=()=>{},L=!1;try{a.requestId=he();let N={direction:"request",transport:"xhr",method:a.method,url:a.url,path:a.path};a.requestBody=m&&typeof k[0]=="string"?C(k[0],N,i):void 0;let V=()=>{a.outcome===void 0&&(a.outcome="abort")},G=()=>{a.outcome===void 0&&(a.outcome="timeout")},p=()=>{a.outcome===void 0&&(a.outcome="error")},w=()=>{var z;v();try{if(!O||!A||a.reported||!a.requestId)return;a.reported=!0;let I={direction:"response",transport:"xhr",method:a.method,url:a.url,path:a.path},oe=this.status,ce={requestId:a.requestId,transport:"xhr",method:a.method,url:a.url,path:a.path,status:oe,ok:oe>=200&&oe<300,outcome:(z=a.outcome)!=null?z:"load",durationMs:a.startedAt!==void 0?Date.now()-a.startedAt:void 0,responseUrl:this.responseURL||void 0,requestBody:a.requestBody,responseBody:j?We(this,qe=>C(qe,I,y)):void 0};a.requestEmitted?x(ce):a.pendingExchange=ce}catch(I){r.log("xhr exchange observation failed",I)}finally{q.get(this)===a&&q.delete(this)}},M=()=>{try{this.readyState===XMLHttpRequest.DONE&&this.status!==0&&w()}catch(z){r.log("xhr ready-state observation failed",z)}},U=()=>w();v=()=>{for(let[z,I]of[["readystatechange",M],["abort",V],["timeout",G],["error",p],["loadend",U]])this.removeEventListener(z,I);a.cleanupListeners===v&&(a.cleanupListeners=void 0),f.delete(v)},this.addEventListener("readystatechange",M),this.addEventListener("abort",V),this.addEventListener("timeout",G),this.addEventListener("error",p),this.addEventListener("loadend",U),a.cleanupListeners=v,f.add(v),a.startedAt=Date.now(),L=!0}catch(N){r.log("xhr send observation failed",N),v()}let H;try{H=Reflect.apply(R,this,k)}catch(N){throw v(),N}if(L&&a.requestId!==void 0&&a.startedAt!==void 0){a.requestEmitted=!0,P({requestId:a.requestId,transport:"xhr",method:a.method,url:a.url,path:a.path,startedAt:a.startedAt,requestBody:a.requestBody});let N=a.pendingExchange;a.pendingExchange=void 0,N&&x(N)}return H}}.send;return F(D,s),F(E,R),l.writable!==!0||h.writable!==!0?(r.log("xhr capture unavailable: XMLHttpRequest methods are not writable"),null):(Object.defineProperty(c,"open",{...l,value:D}),Object.defineProperty(c,"send",{...h,value:E}),A=!0,()=>{A=!1;for(let k of[...f])k();J(c,"open",D,l,r),J(c,"send",E,h,r)})},$=()=>{let c=globalThis,l=Object.getOwnPropertyDescriptor(c,"fetch");if(!l||!("value"in l))return r.log("fetch capture unavailable: fetch is not an own data property"),null;let h=l.value;if(typeof h!="function")return r.log("fetch capture unavailable: fetch missing"),null;if(W(h))return r.log("fetch capture unavailable: an equivalent capture is already active"),null;let s=!1,R=async(f,A,D,E)=>{try{if(!O||!s){ue(D);return}let[k,a]=await Promise.all([E!=null?E:Promise.resolve(void 0),D?be(D,r):Promise.resolve(void 0)]);if(!O||!s)return;let v={direction:"request",transport:"fetch",method:f.method,url:f.url,path:f.path},L={...v,direction:"response"},H=f.requestBody;H===void 0&&k!==void 0&&(H=C(k,v,i));let N=a!==void 0?C(a,L,y):void 0;x({requestId:f.requestId,transport:"fetch",method:f.method,url:f.url,path:f.path,status:A.status,ok:A.ok,outcome:"load",durationMs:Date.now()-f.startedAt,responseUrl:A.url||void 0,requestBody:H,responseBody:N})}catch(k){r.log("fetch exchange observation failed",k)}},q={fetch(...f){var H,N,V,G;let A;try{let p=f[0],w=f[1];if(O&&s&&m&&typeof Request!="undefined"&&p instanceof Request&&(w==null?void 0:w.body)===void 0&&p.body){let M=String((H=w==null?void 0:w.method)!=null?H:p.method).toUpperCase(),U=(N=p.headers.get("content-type"))!=null?N:"";S(p.url,M)&&ge(U)&&(A=p.clone())}}catch(p){r.log("fetch observation failed",p)}let D,E=Date.now();try{D=Reflect.apply(h,this,f)}catch(p){throw ue(A),p}let k,a;try{if(O&&s){let p=f[0],w=f[1],M=typeof Request!="undefined"&&p instanceof Request,U=String((V=w==null?void 0:w.method)!=null?V:M?p.method:"GET").toUpperCase(),z=M?p.url:p,I=S(z,U);I&&(k={requestId:he(),method:U,url:I.url,path:I.path,startedAt:E},a=(G=w==null?void 0:w.signal)!=null?G:M?p.signal:void 0,m&&typeof(w==null?void 0:w.body)=="string"&&(k.requestBody=C(w.body,{direction:"request",transport:"fetch",method:U,url:I.url,path:I.path},i)))}}catch(p){r.log("fetch observation failed",p)}if(!k)return ue(A),D;let v=k;P({requestId:v.requestId,transport:"fetch",method:v.method,url:v.url,path:v.path,startedAt:v.startedAt,requestBody:v.requestBody});let L=A?be(A,r):void 0;return D.then(p=>{var M;let w;try{if(O&&s&&j){let U=(M=p.headers.get("content-type"))!=null?M:"";ge(U)&&p.body&&(w=p.clone())}}catch{}R(v,p,w,L)},p=>{try{if(!O||!s)return;let w=(a==null?void 0:a.aborted)===!0||(p==null?void 0:p.name)==="AbortError"||typeof DOMException!="undefined"&&p instanceof DOMException&&p.code===DOMException.ABORT_ERR;x({requestId:v.requestId,transport:"fetch",method:v.method,url:v.url,path:v.path,status:0,ok:!1,outcome:w?"abort":"error",durationMs:Date.now()-v.startedAt})}catch(w){r.log("fetch failure observation failed",w)}}),D}}.fetch;return F(q,h),l.writable!==!0?(r.log("fetch capture unavailable: fetch is not writable"),null):(Object.defineProperty(c,"fetch",{...l,value:q}),s=!0,()=>{s=!1,J(c,"fetch",q,l,r)})},d=[];if(u.includes("xhr")){let c=B();c&&d.push(c)}if(u.includes("fetch")){let c=$();c&&d.push(c)}return d.length===0?T():(O=!0,{mode:"standard",disconnect:()=>{O=!1;for(let c of d.splice(0))c()}})}function Re(e){let t=e.onNavigate;if(typeof t!="function")throw new TypeError("captureNavigation requires an onNavigate callback");let n=K(e.logger),o,r,u,i,y,m;try{if(o=window,r=o==null?void 0:o.history,!o||!r)return n.log("navigation capture unavailable: window/history missing"),T();if(y=we(r,"pushState"),m=we(r,"replaceState"),!y||!m)return n.log("navigation capture unavailable: history method descriptors missing"),T();if(u=y.descriptor.value,i=m.descriptor.value,typeof u!="function"||typeof i!="function")return n.log("navigation capture unavailable: history methods missing"),T();if(typeof o.addEventListener!="function"||typeof o.removeEventListener!="function")return n.log("navigation capture unavailable: window event methods missing"),T()}catch(g){return n.log("navigation capture unavailable: history inspection failed",g),T()}if(W(u)||W(i))return n.log("navigation capture unavailable: an equivalent capture is already active"),T();let j=!1,O=()=>({path:o.location.pathname,search:o.location.search,hash:o.location.hash}),x;try{x=O()}catch(g){return n.log("navigation capture unavailable: location inspection failed",g),T()}let P=X(n,"navigation",g=>{if(j)return t(g)}),C=g=>{if(j)try{let b=O();if(b.path===x.path&&b.search===x.search&&b.hash===x.hash)return;x=b,P({...b,source:g})}catch(b){n.log("navigation observation failed",b)}},S={pushState(...g){let b=Reflect.apply(u,this,g);return C("push"),b}}.pushState,B={replaceState(...g){let b=Reflect.apply(i,this,g);return C("replace"),b}}.replaceState;F(S,u),F(B,i);let $=()=>C("pop"),d=()=>C("hash");try{if(me(y,S),me(m,B),r.pushState!==S||r.replaceState!==B)throw new Error("history method replacement did not take effect");o.addEventListener("popstate",$),o.addEventListener("hashchange",d),j=!0}catch(g){return j=!1,re(o,"popstate",$,n),re(o,"hashchange",d,n),ne(m,B,n),ne(y,S,n),n.log("navigation capture unavailable: history methods are not writable",g),t=()=>{},P=()=>{},n=K(),T()}return{mode:"standard",disconnect:()=>{j=!1,t=()=>{},re(o,"popstate",$,n),re(o,"hashchange",d,n),ne(y,S,n),ne(m,B,n),P=()=>{},n=K()}}}function we(e,t){let n=e;for(;n;){let o=Object.getOwnPropertyDescriptor(n,t);if(o)return!("value"in o)||typeof o.value!="function"?null:{owner:n,key:t,descriptor:o};n=Object.getPrototypeOf(n)}return null}function me(e,t){if(e.descriptor.writable!==!0)throw new TypeError(`${e.key} is not writable`);let n=Object.getOwnPropertyDescriptor(e.owner,e.key);if(!ie(n,e.descriptor))throw new Error(`${e.key} changed during installation`);Object.defineProperty(e.owner,e.key,{...e.descriptor,value:t})}function ne(e,t,n){J(e.owner,e.key,t,e.descriptor,n,`navigation ${e.key}`)}function re(e,t,n,o){try{e.removeEventListener(t,n)}catch(r){o.log(`navigation ${t} listener removal skipped`,r)}}function Oe(e){let t=e.composedPath();return t.length>0?t:e.target?[e.target]:[]}var Ce="0.6.0";0&&(module.exports={VERSION,captureNavigation,captureNetwork,captureWebAuthn,composedPath,sanitizeAssertionResponse,sanitizeCreationOptions,sanitizeCreationResponse,sanitizeRequestOptions});

package/dist/index.mjs

@@ -1 +1 @@
-var be={log:()=>{}};function K(e){return e?{log:(...n)=>{try{let t=e.log(...n);if(t&&(typeof t=="object"||typeof t=="function"))try{Promise.resolve(t).catch(()=>{})}catch{}}catch{}}}:be}var se=Symbol.for("corbado.autocapture.installed");function M(e){try{return typeof e=="function"&&Object.prototype.hasOwnProperty.call(e,se)}catch{return!1}}function F(e,n){var o,r;let t=n;try{Object.defineProperty(e,se,{value:n,configurable:!0})}catch{}try{Object.defineProperty(e,"name",{value:(o=t.name)!=null?o:"",configurable:!0})}catch{}try{Object.defineProperty(e,"length",{value:(r=t.length)!=null?r:0,configurable:!0})}catch{}return e}function B(){return{mode:"unavailable",disconnect:()=>{}}}function re(e,n){return!!e&&"value"in e&&"value"in n&&e.value===n.value&&e.writable===n.writable&&e.enumerable===n.enumerable&&e.configurable===n.configurable}function z(e,n,t,o,r,a=String(n)){try{let p=Object.getOwnPropertyDescriptor(e,n);re(p,{...o,value:t})&&Object.defineProperty(e,n,o)}catch(p){r.log(`${a} restoration skipped`,p)}}function J(e,n,t){let o=K(e);return r=>{try{let a=t(r);if(a&&(typeof a=="object"||typeof a=="function"))try{Promise.resolve(a).catch(p=>o.log(`${n} listener failed`,p))}catch(p){o.log(`${n} listener failed`,p)}}catch(a){o.log(`${n} listener failed`,a)}}}var ue=e=>({get:e("get"),create:e("create")});function me(e){let n=e.onEvent;if(typeof n!="function")throw new TypeError("captureWebAuthn requires an onEvent callback");let t=K(e.logger),o=c=>(t.log(`webauthn capture unavailable: ${c}`),{...B(),surface:"none"}),r=typeof navigator=="undefined"?void 0:navigator,a=r==null?void 0:r.credentials;if(!r||!a)return o("navigator.credentials missing");let p=a,w=ue(c=>p[c]);if(typeof w.get!="function"||typeof w.create!="function")return o("credentials methods missing");if(M(w.get)||M(w.create))return o("an equivalent capture is already active");let R=!1,I=0,q=J(t,"webauthn",n),N=(c,y,g)=>{let W={invoke(...u){let d=u[0];if(!R||g!=null&&g()||!Z(d)||!Z(d.publicKey))return y(this,u);let h=d.publicKey,s=`wa-${++I}`,v=y(this,u),C=Z(d.signal)?d.signal:void 0,f=ve(c,d,h),A=O=>{R&&q({...f,ceremonyId:s,...O()})},x=()=>(C==null?void 0:C.aborted)===!0?{aborted:!0}:{};return A(()=>({phase:"started",userActivation:Ce(r),...f.kind==="authentication"?{requestOptionsJson:ke(h,t)}:{}})),Promise.resolve(v).then(O=>(A(()=>({phase:"completed",credentialJson:Ae(O,c,t),...x()})),O),O=>{throw A(()=>({phase:"failed",error:O,errorName:Pe(O),...x()})),O})}}.invoke;return F(W,{name:c,length:0})},U=c=>{var W;let y=N(c,(u,d)=>Reflect.apply(w[c],u,d)),g=Object.getOwnPropertyDescriptor(a,c);if(g&&(!("value"in g)||g.writable!==!0))return null;try{p[c]=y}catch{return null}if(((W=Object.getOwnPropertyDescriptor(a,c))==null?void 0:W.value)!==y){try{p[c]=w[c]}catch{}return null}return()=>{p[c]===y&&(g?p[c]=g.value:delete p[c])}},D=()=>{let c=ue(()=>new WeakMap),y=(h,s)=>{let v=c[h].get(s);if(v)return v;let C=N(h,(f,A)=>Reflect.apply(s,a,A),()=>{try{let f=p[h];return f!==s&&f!==C}catch(f){return t.log("suppress check failed; ceremony unreported",f),!0}});return c[h].set(s,C),C},g=h=>{let s=Object.getOwnPropertyDescriptor(a,h);return s?s.configurable===!0||!("value"in s)||s.writable===!0:!0},W=new WeakMap,u=new Proxy(a,{get(h,s){let v=Reflect.get(a,s,a);if((s==="get"||s==="create")&&g(s))return typeof v!="function"||M(v)?v:y(s,v);if(typeof v!="function"||!g(s)||s==="constructor")return v;let C=W.get(v);if(C)return C;let f=v.bind(a);return W.set(v,f),f},set(h,s,v){return Reflect.set(a,s,v,a)}}),d=Object.getOwnPropertyDescriptor(r,"credentials");if(d&&d.configurable!==!0)return null;try{Object.defineProperty(r,"credentials",{value:u,writable:!0,enumerable:!0,configurable:!0})}catch{return null}return r.credentials!==u?null:()=>{r.credentials===u&&(d?Object.defineProperty(r,"credentials",d):delete r.credentials)}},L=(c,y)=>(R=!0,{mode:"standard",surface:c,disconnect:()=>{R=!1,y()}}),E=U("get"),$=E?U("create"):null;if(E&&$)return L("methods",()=>{E(),$()});if(E==null||E(),e.attach==="container"){let c=D();if(c)return t.log("webauthn capture attached at the credentials container"),L("container",c)}return o("credentials methods cannot be patched safely")}function ve(e,n,t){let o=we(n.mediation);if(e==="create")return{kind:"registration",mediation:o};let r=t;return{kind:"authentication",mediation:o,uiMode:Re(n.uiMode),credentialSet:Array.isArray(r.allowCredentials)&&r.allowCredentials.length>0?"allowlisted":"discoverable"}}function we(e){return e===void 0?"optional":e==="silent"||e==="optional"||e==="conditional"||e==="required"?e:"unknown"}function Re(e){return e===void 0?"default":e==="immediate"?"immediate":"unknown"}function Ce(e){let n=e.userActivation;return typeof(n==null?void 0:n.isActive)=="boolean"?n.isActive:void 0}function Ae(e,n,t){var o;if(e)try{let r=e,a=r.response,p={id:G(r.id),rawId:X(r.rawId),type:G(r.type),authenticatorAttachment:G(r.authenticatorAttachment),response:n==="create"?{clientDataJSON:X(a==null?void 0:a.clientDataJSON),attestationObject:X(a==null?void 0:a.attestationObject),transports:oe((o=a==null?void 0:a.getTransports)==null?void 0:o.call(a))}:{clientDataJSON:X(a==null?void 0:a.clientDataJSON),authenticatorData:X(a==null?void 0:a.authenticatorData),signature:X(a==null?void 0:a.signature),userHandle:X(a==null?void 0:a.userHandle)},...n==="create"?Oe(r):{}};return JSON.stringify(p)}catch(r){t.log("credential serialization failed",r);return}}function ke(e,n){try{let t={},o=G(e.rpId),r=G(e.userVerification),a=oe(e.hints);return o!==void 0&&(t.rpId=o),typeof e.timeout=="number"&&Number.isFinite(e.timeout)&&(t.timeout=e.timeout),r!==void 0&&(t.userVerification=r),a!==void 0&&(t.hints=a),t.challenge=X(e.challenge),Array.isArray(e.allowCredentials)&&(t.allowCredentials=qe(e.allowCredentials)),JSON.stringify(t)}catch(t){n.log("request options serialization failed",t);return}}function qe(e){let n=[];for(let t of e){if(!Z(t))continue;let o=t;n.push({type:G(o.type),id:X(o.id),transports:oe(o.transports)})}return n}function oe(e){if(Array.isArray(e))return e.filter(n=>typeof n=="string")}function G(e){return typeof e=="string"?e:void 0}function Oe(e){var o;let n=(o=e.getClientExtensionResults)==null?void 0:o.call(e);if(!Z(n))return{};let t=n.credProps;return!t||typeof t.rk!="boolean"?{}:{clientExtensionResults:{credProps:{rk:t.rk}}}}function X(e){let n;if(e instanceof ArrayBuffer)n=new Uint8Array(e);else if(ArrayBuffer.isView(e))n=new Uint8Array(e.buffer,e.byteOffset,e.byteLength);else return;let t="";for(let o of n)t+=String.fromCharCode(o);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}function Z(e){return e!==null&&(typeof e=="object"||typeof e=="function")}function Pe(e){return e instanceof DOMException?e.name:"UnknownError"}var ce=0;function de(){return ce+=1,`network-${ce}`}function xe(e,n){let t=e.responseType;if(t===""||t==="text")return n(e.responseText);if(t==="json"){let o=e.response;return o==null?void 0:n(o)}}var Ee=500,le=Symbol("body-read-timeout");function pe(e){return/event-stream|octet-stream/i.test(e)?!1:/json|text|urlencoded/i.test(e)}async function fe(e,n){let t=e.body;if(!t)return;let o=t.getReader(),r;try{let a=new Promise(R=>{r=setTimeout(()=>R(le),Ee)}),p=new TextDecoder,w=[];for(;;){let R=await Promise.race([o.read(),a]);if(R===le){n.log("body omitted: read timed out"),o.cancel().catch(()=>{});return}if(R.done)break;w.push(p.decode(R.value,{stream:!0}))}return w.push(p.decode()),w.join("")}catch{o.cancel().catch(()=>{});return}finally{r!==void 0&&clearTimeout(r)}}function ae(e){var n;(n=e==null?void 0:e.body)==null||n.cancel().catch(()=>{})}function Se(e){var y,g,W;let{onExchange:n,onRequest:t,match:o}=e;if(typeof n!="function"||typeof o!="function")throw new TypeError("captureNetwork requires onExchange and match callbacks");let r=K(e.logger),a=(y=e.transports)!=null?y:["xhr","fetch"],p=(g=e.bodyCapture)==null?void 0:g.request,w=(W=e.bodyCapture)==null?void 0:W.response,R=typeof p=="function",I=typeof w=="function",q=!1,N=J(r,"network",u=>{if(q)return n(u)}),U=J(r,"network request",u=>{if(q)return t==null?void 0:t(u)}),D=(u,d,h)=>{if(typeof h=="function")try{return h(u,d)}catch(s){r.log("body projection failed",s);return}},L=(u,d)=>{try{let h=typeof document!="undefined"?document.baseURI:void 0,s=new URL(String(u),h);return o(s,d)===!0?{url:s.href,path:s.pathname}:void 0}catch{return}},E=()=>{if(typeof XMLHttpRequest=="undefined")return r.log("xhr capture unavailable: XMLHttpRequest missing"),null;let u=XMLHttpRequest.prototype,d=Object.getOwnPropertyDescriptor(u,"open"),h=Object.getOwnPropertyDescriptor(u,"send");if(!d||!("value"in d)||typeof d.value!="function"||!h||!("value"in h)||typeof h.value!="function")return r.log("xhr capture unavailable: XMLHttpRequest methods missing"),null;let s=d.value,v=h.value;if(M(s)||M(v))return r.log("xhr capture unavailable: an equivalent capture is already active"),null;let C=new WeakMap,f=new Set,A=!1,x={open(...k){var b;let i=Reflect.apply(s,this,k);if(!q||!A)return i;try{let S=C.get(this);S&&(S.reported=!0,(b=S.cleanupListeners)==null||b.call(S));let T=String(k[0]).toUpperCase(),P=L(k[1],T);P?C.set(this,{method:T,url:P.url,path:P.path,reported:!1}):C.delete(this)}catch(S){r.log("xhr open observation failed",S)}return i}}.open,O={send(...k){let i=q&&A?C.get(this):void 0;if(!i||i.reported||i.cleanupListeners)return Reflect.apply(v,this,k);let b=()=>{},S=!1;try{i.requestId=de();let P={direction:"request",transport:"xhr",method:i.method,url:i.url,path:i.path};i.requestBody=R&&typeof k[0]=="string"?D(k[0],P,p):void 0;let Y=()=>{i.outcome===void 0&&(i.outcome="abort")},Q=()=>{i.outcome===void 0&&(i.outcome="timeout")},l=()=>{i.outcome===void 0&&(i.outcome="error")},m=()=>{var V;b();try{if(!q||!A||i.reported||!i.requestId)return;i.reported=!0;let H={direction:"response",transport:"xhr",method:i.method,url:i.url,path:i.path},ne=this.status,ie={requestId:i.requestId,transport:"xhr",method:i.method,url:i.url,path:i.path,status:ne,ok:ne>=200&&ne<300,outcome:(V=i.outcome)!=null?V:"load",durationMs:i.startedAt!==void 0?Date.now()-i.startedAt:void 0,responseUrl:this.responseURL||void 0,requestBody:i.requestBody,responseBody:I?xe(this,ge=>D(ge,H,w)):void 0};i.requestEmitted?N(ie):i.pendingExchange=ie}catch(H){r.log("xhr exchange observation failed",H)}finally{C.get(this)===i&&C.delete(this)}},j=()=>{try{this.readyState===XMLHttpRequest.DONE&&this.status!==0&&m()}catch(V){r.log("xhr ready-state observation failed",V)}},_=()=>m();b=()=>{for(let[V,H]of[["readystatechange",j],["abort",Y],["timeout",Q],["error",l],["loadend",_]])this.removeEventListener(V,H);i.cleanupListeners===b&&(i.cleanupListeners=void 0),f.delete(b)},this.addEventListener("readystatechange",j),this.addEventListener("abort",Y),this.addEventListener("timeout",Q),this.addEventListener("error",l),this.addEventListener("loadend",_),i.cleanupListeners=b,f.add(b),i.startedAt=Date.now(),S=!0}catch(P){r.log("xhr send observation failed",P),b()}let T;try{T=Reflect.apply(v,this,k)}catch(P){throw b(),P}if(S&&i.requestId!==void 0&&i.startedAt!==void 0){i.requestEmitted=!0,U({requestId:i.requestId,transport:"xhr",method:i.method,url:i.url,path:i.path,startedAt:i.startedAt,requestBody:i.requestBody});let P=i.pendingExchange;i.pendingExchange=void 0,P&&N(P)}return T}}.send;return F(x,s),F(O,v),d.writable!==!0||h.writable!==!0?(r.log("xhr capture unavailable: XMLHttpRequest methods are not writable"),null):(Object.defineProperty(u,"open",{...d,value:x}),Object.defineProperty(u,"send",{...h,value:O}),A=!0,()=>{A=!1;for(let k of[...f])k();z(u,"open",x,d,r),z(u,"send",O,h,r)})},$=()=>{let u=globalThis,d=Object.getOwnPropertyDescriptor(u,"fetch");if(!d||!("value"in d))return r.log("fetch capture unavailable: fetch is not an own data property"),null;let h=d.value;if(typeof h!="function")return r.log("fetch capture unavailable: fetch missing"),null;if(M(h))return r.log("fetch capture unavailable: an equivalent capture is already active"),null;let s=!1,v=async(f,A,x,O)=>{try{if(!q||!s){ae(x);return}let[k,i]=await Promise.all([O!=null?O:Promise.resolve(void 0),x?fe(x,r):Promise.resolve(void 0)]);if(!q||!s)return;let b={direction:"request",transport:"fetch",method:f.method,url:f.url,path:f.path},S={...b,direction:"response"},T=f.requestBody;T===void 0&&k!==void 0&&(T=D(k,b,p));let P=i!==void 0?D(i,S,w):void 0;N({requestId:f.requestId,transport:"fetch",method:f.method,url:f.url,path:f.path,status:A.status,ok:A.ok,outcome:"load",durationMs:Date.now()-f.startedAt,responseUrl:A.url||void 0,requestBody:T,responseBody:P})}catch(k){r.log("fetch exchange observation failed",k)}},C={fetch(...f){var T,P,Y,Q;let A;try{let l=f[0],m=f[1];if(q&&s&&R&&typeof Request!="undefined"&&l instanceof Request&&(m==null?void 0:m.body)===void 0&&l.body){let j=String((T=m==null?void 0:m.method)!=null?T:l.method).toUpperCase(),_=(P=l.headers.get("content-type"))!=null?P:"";L(l.url,j)&&pe(_)&&(A=l.clone())}}catch(l){r.log("fetch observation failed",l)}let x,O=Date.now();try{x=Reflect.apply(h,this,f)}catch(l){throw ae(A),l}let k,i;try{if(q&&s){let l=f[0],m=f[1],j=typeof Request!="undefined"&&l instanceof Request,_=String((Y=m==null?void 0:m.method)!=null?Y:j?l.method:"GET").toUpperCase(),V=j?l.url:l,H=L(V,_);H&&(k={requestId:de(),method:_,url:H.url,path:H.path,startedAt:O},i=(Q=m==null?void 0:m.signal)!=null?Q:j?l.signal:void 0,R&&typeof(m==null?void 0:m.body)=="string"&&(k.requestBody=D(m.body,{direction:"request",transport:"fetch",method:_,url:H.url,path:H.path},p)))}}catch(l){r.log("fetch observation failed",l)}if(!k)return ae(A),x;let b=k;U({requestId:b.requestId,transport:"fetch",method:b.method,url:b.url,path:b.path,startedAt:b.startedAt,requestBody:b.requestBody});let S=A?fe(A,r):void 0;return x.then(l=>{var j;let m;try{if(q&&s&&I){let _=(j=l.headers.get("content-type"))!=null?j:"";pe(_)&&l.body&&(m=l.clone())}}catch{}v(b,l,m,S)},l=>{try{if(!q||!s)return;let m=(i==null?void 0:i.aborted)===!0||(l==null?void 0:l.name)==="AbortError"||typeof DOMException!="undefined"&&l instanceof DOMException&&l.code===DOMException.ABORT_ERR;N({requestId:b.requestId,transport:"fetch",method:b.method,url:b.url,path:b.path,status:0,ok:!1,outcome:m?"abort":"error",durationMs:Date.now()-b.startedAt})}catch(m){r.log("fetch failure observation failed",m)}}),x}}.fetch;return F(C,h),d.writable!==!0?(r.log("fetch capture unavailable: fetch is not writable"),null):(Object.defineProperty(u,"fetch",{...d,value:C}),s=!0,()=>{s=!1,z(u,"fetch",C,d,r)})},c=[];if(a.includes("xhr")){let u=E();u&&c.push(u)}if(a.includes("fetch")){let u=$();u&&c.push(u)}return c.length===0?B():(q=!0,{mode:"standard",disconnect:()=>{q=!1;for(let u of c.splice(0))u()}})}function Ne(e){let n=e.onNavigate;if(typeof n!="function")throw new TypeError("captureNavigation requires an onNavigate callback");let t=K(e.logger),o,r,a,p,w,R;try{if(o=window,r=o==null?void 0:o.history,!o||!r)return t.log("navigation capture unavailable: window/history missing"),B();if(w=he(r,"pushState"),R=he(r,"replaceState"),!w||!R)return t.log("navigation capture unavailable: history method descriptors missing"),B();if(a=w.descriptor.value,p=R.descriptor.value,typeof a!="function"||typeof p!="function")return t.log("navigation capture unavailable: history methods missing"),B();if(typeof o.addEventListener!="function"||typeof o.removeEventListener!="function")return t.log("navigation capture unavailable: window event methods missing"),B()}catch(y){return t.log("navigation capture unavailable: history inspection failed",y),B()}if(M(a)||M(p))return t.log("navigation capture unavailable: an equivalent capture is already active"),B();let I=!1,q=()=>({path:o.location.pathname,search:o.location.search,hash:o.location.hash}),N;try{N=q()}catch(y){return t.log("navigation capture unavailable: location inspection failed",y),B()}let U=J(t,"navigation",y=>{if(I)return n(y)}),D=y=>{if(I)try{let g=q();if(g.path===N.path&&g.search===N.search&&g.hash===N.hash)return;N=g,U({...g,source:y})}catch(g){t.log("navigation observation failed",g)}},L={pushState(...y){let g=Reflect.apply(a,this,y);return D("push"),g}}.pushState,E={replaceState(...y){let g=Reflect.apply(p,this,y);return D("replace"),g}}.replaceState;F(L,a),F(E,p);let $=()=>D("pop"),c=()=>D("hash");try{if(ye(w,L),ye(R,E),r.pushState!==L||r.replaceState!==E)throw new Error("history method replacement did not take effect");o.addEventListener("popstate",$),o.addEventListener("hashchange",c),I=!0}catch(y){return I=!1,te(o,"popstate",$,t),te(o,"hashchange",c,t),ee(R,E,t),ee(w,L,t),t.log("navigation capture unavailable: history methods are not writable",y),n=()=>{},U=()=>{},t=K(),B()}return{mode:"standard",disconnect:()=>{I=!1,n=()=>{},te(o,"popstate",$,t),te(o,"hashchange",c,t),ee(w,L,t),ee(R,E,t),U=()=>{},t=K()}}}function he(e,n){let t=e;for(;t;){let o=Object.getOwnPropertyDescriptor(t,n);if(o)return!("value"in o)||typeof o.value!="function"?null:{owner:t,key:n,descriptor:o};t=Object.getPrototypeOf(t)}return null}function ye(e,n){if(e.descriptor.writable!==!0)throw new TypeError(`${e.key} is not writable`);let t=Object.getOwnPropertyDescriptor(e.owner,e.key);if(!re(t,e.descriptor))throw new Error(`${e.key} changed during installation`);Object.defineProperty(e.owner,e.key,{...e.descriptor,value:n})}function ee(e,n,t){z(e.owner,e.key,n,e.descriptor,t,`navigation ${e.key}`)}function te(e,n,t,o){try{e.removeEventListener(n,t)}catch(r){o.log(`navigation ${n} listener removal skipped`,r)}}function Be(e){let n=e.composedPath();return n.length>0?n:e.target?[e.target]:[]}var De="0.5.0";export{De as VERSION,Ne as captureNavigation,Se as captureNetwork,me as captureWebAuthn,Be as composedPath};
+var we={creationOptions:["/user/name","/user/displayName"],creationResponse:["/clientExtensionResults/prf/results"],requestOptions:[],assertionResponse:["/response/signature","/clientExtensionResults/prf/results"]};function te(e){return Y(e,"creationOptions")}function ne(e){return Y(e,"creationResponse")}function re(e){return Y(e,"requestOptions")}function oe(e){return Y(e,"assertionResponse")}function Y(e,n){try{let t=typeof e=="string"?JSON.parse(e):e;if(!me(t))return;let o=new Set(we[n]),r=new Set,u=(i,y,m=0)=>{if(!o.has(y)){if(i===null||typeof i=="string"||typeof i=="boolean")return i;if(typeof i=="number")return Number.isFinite(i)?i:null;if(typeof i=="object"){if(i instanceof ArrayBuffer||ArrayBuffer.isView(i))return Re(i);if(m>64||r.has(i))throw new TypeError("Invalid telemetry payload");r.add(i);try{if(Array.isArray(i))return i.map((P,C)=>u(P,`${y}/${C}`,m+1));let j=Object.create(null);for(let P in i){let C=`${y}/${P.replace(/~/g,"~0").replace(/\//g,"~1")}`;if(o.has(C)||P==="toJSON")continue;let S=u(i[P],C,m+1);S!==void 0&&(j[P]=S)}let O=i,x=(P,C)=>{if(j[C]!==void 0||typeof O[P]!="function")return;let S=`${y}/${C}`,B=u(Reflect.apply(O[P],i,[]),S,m+1);B!==void 0&&(j[C]=B)};return y===""&&(n==="creationResponse"||n==="assertionResponse")&&x("getClientExtensionResults","clientExtensionResults"),y==="/response"&&n==="creationResponse"&&(x("getTransports","transports"),x("getAuthenticatorData","authenticatorData"),x("getPublicKey","publicKey"),x("getPublicKeyAlgorithm","publicKeyAlgorithm")),j}finally{r.delete(i)}}}};return JSON.stringify(u(t,""))}catch{return}}function me(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)&&!(e instanceof ArrayBuffer)&&!ArrayBuffer.isView(e)}function Re(e){let n=e instanceof ArrayBuffer?new Uint8Array(e):new Uint8Array(e.buffer,e.byteOffset,e.byteLength),t="";for(let o of n)t+=String.fromCharCode(o);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}var Oe={log:()=>{}};function K(e){return e?{log:(...n)=>{try{let t=e.log(...n);if(t&&(typeof t=="object"||typeof t=="function"))try{Promise.resolve(t).catch(()=>{})}catch{}}catch{}}}:Oe}var ce=Symbol.for("corbado.autocapture.installed");function W(e){try{return typeof e=="function"&&Object.prototype.hasOwnProperty.call(e,ce)}catch{return!1}}function F(e,n){var o,r;let t=n;try{Object.defineProperty(e,ce,{value:n,configurable:!0})}catch{}try{Object.defineProperty(e,"name",{value:(o=t.name)!=null?o:"",configurable:!0})}catch{}try{Object.defineProperty(e,"length",{value:(r=t.length)!=null?r:0,configurable:!0})}catch{}return e}function T(){return{mode:"unavailable",disconnect:()=>{}}}function ae(e,n){return!!e&&"value"in e&&"value"in n&&e.value===n.value&&e.writable===n.writable&&e.enumerable===n.enumerable&&e.configurable===n.configurable}function J(e,n,t,o,r,u=String(n)){try{let i=Object.getOwnPropertyDescriptor(e,n);ae(i,{...o,value:t})&&Object.defineProperty(e,n,o)}catch(i){r.log(`${u} restoration skipped`,i)}}function X(e,n,t){let o=K(e);return r=>{try{let u=t(r);if(u&&(typeof u=="object"||typeof u=="function"))try{Promise.resolve(u).catch(i=>o.log(`${n} listener failed`,i))}catch(i){o.log(`${n} listener failed`,i)}}catch(u){o.log(`${n} listener failed`,u)}}}var de=e=>({get:e("get"),create:e("create")});function Ce(e){let n=e.onEvent;if(typeof n!="function")throw new TypeError("captureWebAuthn requires an onEvent callback");let t=K(e.logger),o=d=>(t.log(`webauthn capture unavailable: ${d}`),{...T(),surface:"none"}),r=typeof navigator=="undefined"?void 0:navigator,u=r==null?void 0:r.credentials;if(!r||!u)return o("navigator.credentials missing");let i=u,y=de(d=>i[d]);if(typeof y.get!="function"||typeof y.create!="function")return o("credentials methods missing");if(W(y.get)||W(y.create))return o("an equivalent capture is already active");let m=!1,j=0,O=X(t,"webauthn",n),x=(d,g,b)=>{let _={invoke(...c){let l=c[0];if(!m||b!=null&&b()||!ie(l)||!ie(l.publicKey))return g(this,c);let h=l.publicKey,s=`wa-${++j}`,R=g(this,c),q=ie(l.signal)?l.signal:void 0,f=qe(d,l,h),A=E=>{m&&O({...f,ceremonyId:s,...E()})},D=()=>(q==null?void 0:q.aborted)===!0?{aborted:!0}:{};return A(()=>({phase:"started",userActivation:xe(r),...f.kind==="authentication"?{requestOptionsJson:re(h)}:{creationOptionsJson:te(h)}})),Promise.resolve(R).then(E=>(A(()=>({phase:"completed",credentialJson:d==="create"?ne(E):oe(E),...D()})),E),E=>{throw A(()=>({phase:"failed",error:E,errorName:Pe(E),...D()})),E})}}.invoke;return F(_,{name:d,length:0})},P=d=>{var _;let g=x(d,(c,l)=>Reflect.apply(y[d],c,l)),b=Object.getOwnPropertyDescriptor(u,d);if(b&&(!("value"in b)||b.writable!==!0))return null;try{i[d]=g}catch{return null}if(((_=Object.getOwnPropertyDescriptor(u,d))==null?void 0:_.value)!==g){try{i[d]=y[d]}catch{}return null}return()=>{i[d]===g&&(b?i[d]=b.value:delete i[d])}},C=()=>{let d=de(()=>new WeakMap),g=(h,s)=>{let R=d[h].get(s);if(R)return R;let q=x(h,(f,A)=>Reflect.apply(s,u,A),()=>{try{let f=i[h];return f!==s&&f!==q}catch(f){return t.log("suppress check failed; ceremony unreported",f),!0}});return d[h].set(s,q),q},b=h=>{let s=Object.getOwnPropertyDescriptor(u,h);return s?s.configurable===!0||!("value"in s)||s.writable===!0:!0},_=new WeakMap,c=new Proxy(u,{get(h,s){let R=Reflect.get(u,s,u);if((s==="get"||s==="create")&&b(s))return typeof R!="function"||W(R)?R:g(s,R);if(typeof R!="function"||!b(s)||s==="constructor")return R;let q=_.get(R);if(q)return q;let f=R.bind(u);return _.set(R,f),f},set(h,s,R){return Reflect.set(u,s,R,u)}}),l=Object.getOwnPropertyDescriptor(r,"credentials");if(l&&l.configurable!==!0)return null;try{Object.defineProperty(r,"credentials",{value:c,writable:!0,enumerable:!0,configurable:!0})}catch{return null}return r.credentials!==c?null:()=>{r.credentials===c&&(l?Object.defineProperty(r,"credentials",l):delete r.credentials)}},S=(d,g)=>(m=!0,{mode:"standard",surface:d,disconnect:()=>{m=!1,g()}}),B=P("get"),$=B?P("create"):null;if(B&&$)return S("methods",()=>{B(),$()});if(B==null||B(),e.attach==="container"){let d=C();if(d)return t.log("webauthn capture attached at the credentials container"),S("container",d)}return o("credentials methods cannot be patched safely")}function qe(e,n,t){let o=Ae(n.mediation);if(e==="create")return{kind:"registration",mediation:o};let r=t;return{kind:"authentication",mediation:o,uiMode:ke(n.uiMode),credentialSet:Array.isArray(r.allowCredentials)&&r.allowCredentials.length>0?"allowlisted":"discoverable"}}function Ae(e){return e===void 0?"optional":e==="silent"||e==="optional"||e==="conditional"||e==="required"?e:"unknown"}function ke(e){return e===void 0?"default":e==="immediate"?"immediate":"unknown"}function xe(e){let n=e.userActivation;return typeof(n==null?void 0:n.isActive)=="boolean"?n.isActive:void 0}function ie(e){return e!==null&&(typeof e=="object"||typeof e=="function")}function Pe(e){return e instanceof DOMException?e.name:"UnknownError"}var le=0;function pe(){return le+=1,`network-${le}`}function Ee(e,n){let t=e.responseType;if(t===""||t==="text")return n(e.responseText);if(t==="json"){let o=e.response;return o==null?void 0:n(o)}}var Se=500,fe=Symbol("body-read-timeout");function he(e){return/event-stream|octet-stream/i.test(e)?!1:/json|text|urlencoded/i.test(e)}async function ye(e,n){let t=e.body;if(!t)return;let o=t.getReader(),r;try{let u=new Promise(m=>{r=setTimeout(()=>m(fe),Se)}),i=new TextDecoder,y=[];for(;;){let m=await Promise.race([o.read(),u]);if(m===fe){n.log("body omitted: read timed out"),o.cancel().catch(()=>{});return}if(m.done)break;y.push(i.decode(m.value,{stream:!0}))}return y.push(i.decode()),y.join("")}catch{o.cancel().catch(()=>{});return}finally{r!==void 0&&clearTimeout(r)}}function se(e){var n;(n=e==null?void 0:e.body)==null||n.cancel().catch(()=>{})}function Be(e){var g,b,_;let{onExchange:n,onRequest:t,match:o}=e;if(typeof n!="function"||typeof o!="function")throw new TypeError("captureNetwork requires onExchange and match callbacks");let r=K(e.logger),u=(g=e.transports)!=null?g:["xhr","fetch"],i=(b=e.bodyCapture)==null?void 0:b.request,y=(_=e.bodyCapture)==null?void 0:_.response,m=typeof i=="function",j=typeof y=="function",O=!1,x=X(r,"network",c=>{if(O)return n(c)}),P=X(r,"network request",c=>{if(O)return t==null?void 0:t(c)}),C=(c,l,h)=>{if(typeof h=="function")try{return h(c,l)}catch(s){r.log("body projection failed",s);return}},S=(c,l)=>{try{let h=typeof document!="undefined"?document.baseURI:void 0,s=new URL(String(c),h);return o(s,l)===!0?{url:s.href,path:s.pathname}:void 0}catch{return}},B=()=>{if(typeof XMLHttpRequest=="undefined")return r.log("xhr capture unavailable: XMLHttpRequest missing"),null;let c=XMLHttpRequest.prototype,l=Object.getOwnPropertyDescriptor(c,"open"),h=Object.getOwnPropertyDescriptor(c,"send");if(!l||!("value"in l)||typeof l.value!="function"||!h||!("value"in h)||typeof h.value!="function")return r.log("xhr capture unavailable: XMLHttpRequest methods missing"),null;let s=l.value,R=h.value;if(W(s)||W(R))return r.log("xhr capture unavailable: an equivalent capture is already active"),null;let q=new WeakMap,f=new Set,A=!1,D={open(...k){var v;let a=Reflect.apply(s,this,k);if(!O||!A)return a;try{let L=q.get(this);L&&(L.reported=!0,(v=L.cleanupListeners)==null||v.call(L));let H=String(k[0]).toUpperCase(),N=S(k[1],H);N?q.set(this,{method:H,url:N.url,path:N.path,reported:!1}):q.delete(this)}catch(L){r.log("xhr open observation failed",L)}return a}}.open,E={send(...k){let a=O&&A?q.get(this):void 0;if(!a||a.reported||a.cleanupListeners)return Reflect.apply(R,this,k);let v=()=>{},L=!1;try{a.requestId=pe();let N={direction:"request",transport:"xhr",method:a.method,url:a.url,path:a.path};a.requestBody=m&&typeof k[0]=="string"?C(k[0],N,i):void 0;let V=()=>{a.outcome===void 0&&(a.outcome="abort")},G=()=>{a.outcome===void 0&&(a.outcome="timeout")},p=()=>{a.outcome===void 0&&(a.outcome="error")},w=()=>{var z;v();try{if(!O||!A||a.reported||!a.requestId)return;a.reported=!0;let I={direction:"response",transport:"xhr",method:a.method,url:a.url,path:a.path},ee=this.status,ue={requestId:a.requestId,transport:"xhr",method:a.method,url:a.url,path:a.path,status:ee,ok:ee>=200&&ee<300,outcome:(z=a.outcome)!=null?z:"load",durationMs:a.startedAt!==void 0?Date.now()-a.startedAt:void 0,responseUrl:this.responseURL||void 0,requestBody:a.requestBody,responseBody:j?Ee(this,ve=>C(ve,I,y)):void 0};a.requestEmitted?x(ue):a.pendingExchange=ue}catch(I){r.log("xhr exchange observation failed",I)}finally{q.get(this)===a&&q.delete(this)}},M=()=>{try{this.readyState===XMLHttpRequest.DONE&&this.status!==0&&w()}catch(z){r.log("xhr ready-state observation failed",z)}},U=()=>w();v=()=>{for(let[z,I]of[["readystatechange",M],["abort",V],["timeout",G],["error",p],["loadend",U]])this.removeEventListener(z,I);a.cleanupListeners===v&&(a.cleanupListeners=void 0),f.delete(v)},this.addEventListener("readystatechange",M),this.addEventListener("abort",V),this.addEventListener("timeout",G),this.addEventListener("error",p),this.addEventListener("loadend",U),a.cleanupListeners=v,f.add(v),a.startedAt=Date.now(),L=!0}catch(N){r.log("xhr send observation failed",N),v()}let H;try{H=Reflect.apply(R,this,k)}catch(N){throw v(),N}if(L&&a.requestId!==void 0&&a.startedAt!==void 0){a.requestEmitted=!0,P({requestId:a.requestId,transport:"xhr",method:a.method,url:a.url,path:a.path,startedAt:a.startedAt,requestBody:a.requestBody});let N=a.pendingExchange;a.pendingExchange=void 0,N&&x(N)}return H}}.send;return F(D,s),F(E,R),l.writable!==!0||h.writable!==!0?(r.log("xhr capture unavailable: XMLHttpRequest methods are not writable"),null):(Object.defineProperty(c,"open",{...l,value:D}),Object.defineProperty(c,"send",{...h,value:E}),A=!0,()=>{A=!1;for(let k of[...f])k();J(c,"open",D,l,r),J(c,"send",E,h,r)})},$=()=>{let c=globalThis,l=Object.getOwnPropertyDescriptor(c,"fetch");if(!l||!("value"in l))return r.log("fetch capture unavailable: fetch is not an own data property"),null;let h=l.value;if(typeof h!="function")return r.log("fetch capture unavailable: fetch missing"),null;if(W(h))return r.log("fetch capture unavailable: an equivalent capture is already active"),null;let s=!1,R=async(f,A,D,E)=>{try{if(!O||!s){se(D);return}let[k,a]=await Promise.all([E!=null?E:Promise.resolve(void 0),D?ye(D,r):Promise.resolve(void 0)]);if(!O||!s)return;let v={direction:"request",transport:"fetch",method:f.method,url:f.url,path:f.path},L={...v,direction:"response"},H=f.requestBody;H===void 0&&k!==void 0&&(H=C(k,v,i));let N=a!==void 0?C(a,L,y):void 0;x({requestId:f.requestId,transport:"fetch",method:f.method,url:f.url,path:f.path,status:A.status,ok:A.ok,outcome:"load",durationMs:Date.now()-f.startedAt,responseUrl:A.url||void 0,requestBody:H,responseBody:N})}catch(k){r.log("fetch exchange observation failed",k)}},q={fetch(...f){var H,N,V,G;let A;try{let p=f[0],w=f[1];if(O&&s&&m&&typeof Request!="undefined"&&p instanceof Request&&(w==null?void 0:w.body)===void 0&&p.body){let M=String((H=w==null?void 0:w.method)!=null?H:p.method).toUpperCase(),U=(N=p.headers.get("content-type"))!=null?N:"";S(p.url,M)&&he(U)&&(A=p.clone())}}catch(p){r.log("fetch observation failed",p)}let D,E=Date.now();try{D=Reflect.apply(h,this,f)}catch(p){throw se(A),p}let k,a;try{if(O&&s){let p=f[0],w=f[1],M=typeof Request!="undefined"&&p instanceof Request,U=String((V=w==null?void 0:w.method)!=null?V:M?p.method:"GET").toUpperCase(),z=M?p.url:p,I=S(z,U);I&&(k={requestId:pe(),method:U,url:I.url,path:I.path,startedAt:E},a=(G=w==null?void 0:w.signal)!=null?G:M?p.signal:void 0,m&&typeof(w==null?void 0:w.body)=="string"&&(k.requestBody=C(w.body,{direction:"request",transport:"fetch",method:U,url:I.url,path:I.path},i)))}}catch(p){r.log("fetch observation failed",p)}if(!k)return se(A),D;let v=k;P({requestId:v.requestId,transport:"fetch",method:v.method,url:v.url,path:v.path,startedAt:v.startedAt,requestBody:v.requestBody});let L=A?ye(A,r):void 0;return D.then(p=>{var M;let w;try{if(O&&s&&j){let U=(M=p.headers.get("content-type"))!=null?M:"";he(U)&&p.body&&(w=p.clone())}}catch{}R(v,p,w,L)},p=>{try{if(!O||!s)return;let w=(a==null?void 0:a.aborted)===!0||(p==null?void 0:p.name)==="AbortError"||typeof DOMException!="undefined"&&p instanceof DOMException&&p.code===DOMException.ABORT_ERR;x({requestId:v.requestId,transport:"fetch",method:v.method,url:v.url,path:v.path,status:0,ok:!1,outcome:w?"abort":"error",durationMs:Date.now()-v.startedAt})}catch(w){r.log("fetch failure observation failed",w)}}),D}}.fetch;return F(q,h),l.writable!==!0?(r.log("fetch capture unavailable: fetch is not writable"),null):(Object.defineProperty(c,"fetch",{...l,value:q}),s=!0,()=>{s=!1,J(c,"fetch",q,l,r)})},d=[];if(u.includes("xhr")){let c=B();c&&d.push(c)}if(u.includes("fetch")){let c=$();c&&d.push(c)}return d.length===0?T():(O=!0,{mode:"standard",disconnect:()=>{O=!1;for(let c of d.splice(0))c()}})}function Ne(e){let n=e.onNavigate;if(typeof n!="function")throw new TypeError("captureNavigation requires an onNavigate callback");let t=K(e.logger),o,r,u,i,y,m;try{if(o=window,r=o==null?void 0:o.history,!o||!r)return t.log("navigation capture unavailable: window/history missing"),T();if(y=ge(r,"pushState"),m=ge(r,"replaceState"),!y||!m)return t.log("navigation capture unavailable: history method descriptors missing"),T();if(u=y.descriptor.value,i=m.descriptor.value,typeof u!="function"||typeof i!="function")return t.log("navigation capture unavailable: history methods missing"),T();if(typeof o.addEventListener!="function"||typeof o.removeEventListener!="function")return t.log("navigation capture unavailable: window event methods missing"),T()}catch(g){return t.log("navigation capture unavailable: history inspection failed",g),T()}if(W(u)||W(i))return t.log("navigation capture unavailable: an equivalent capture is already active"),T();let j=!1,O=()=>({path:o.location.pathname,search:o.location.search,hash:o.location.hash}),x;try{x=O()}catch(g){return t.log("navigation capture unavailable: location inspection failed",g),T()}let P=X(t,"navigation",g=>{if(j)return n(g)}),C=g=>{if(j)try{let b=O();if(b.path===x.path&&b.search===x.search&&b.hash===x.hash)return;x=b,P({...b,source:g})}catch(b){t.log("navigation observation failed",b)}},S={pushState(...g){let b=Reflect.apply(u,this,g);return C("push"),b}}.pushState,B={replaceState(...g){let b=Reflect.apply(i,this,g);return C("replace"),b}}.replaceState;F(S,u),F(B,i);let $=()=>C("pop"),d=()=>C("hash");try{if(be(y,S),be(m,B),r.pushState!==S||r.replaceState!==B)throw new Error("history method replacement did not take effect");o.addEventListener("popstate",$),o.addEventListener("hashchange",d),j=!0}catch(g){return j=!1,Z(o,"popstate",$,t),Z(o,"hashchange",d,t),Q(m,B,t),Q(y,S,t),t.log("navigation capture unavailable: history methods are not writable",g),n=()=>{},P=()=>{},t=K(),T()}return{mode:"standard",disconnect:()=>{j=!1,n=()=>{},Z(o,"popstate",$,t),Z(o,"hashchange",d,t),Q(y,S,t),Q(m,B,t),P=()=>{},t=K()}}}function ge(e,n){let t=e;for(;t;){let o=Object.getOwnPropertyDescriptor(t,n);if(o)return!("value"in o)||typeof o.value!="function"?null:{owner:t,key:n,descriptor:o};t=Object.getPrototypeOf(t)}return null}function be(e,n){if(e.descriptor.writable!==!0)throw new TypeError(`${e.key} is not writable`);let t=Object.getOwnPropertyDescriptor(e.owner,e.key);if(!ae(t,e.descriptor))throw new Error(`${e.key} changed during installation`);Object.defineProperty(e.owner,e.key,{...e.descriptor,value:n})}function Q(e,n,t){J(e.owner,e.key,n,e.descriptor,t,`navigation ${e.key}`)}function Z(e,n,t,o){try{e.removeEventListener(n,t)}catch(r){o.log(`navigation ${n} listener removal skipped`,r)}}function je(e){let n=e.composedPath();return n.length>0?n:e.target?[e.target]:[]}var De="0.6.0";export{De as VERSION,Ne as captureNavigation,Be as captureNetwork,Ce as captureWebAuthn,je as composedPath,oe as sanitizeAssertionResponse,te as sanitizeCreationOptions,ne as sanitizeCreationResponse,re as sanitizeRequestOptions};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corbado/autocapture",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Observer-style capture helpers for WebAuthn ceremonies, selected network exchanges, in-app navigation, and composed event paths.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",