@corbado/autocapture 0.7.0 → 0.8.1

package/README.md

@@ -20,13 +20,13 @@ The package observes three kinds of signal:
 
 It also exposes `composedPath()` for selector matching across visible shadow-DOM boundaries.
 
-It has no runtime dependencies, ships TypeScript type definitions, and targets ES2019 so it parses
-on older engines.
+It uses `@corbado/observe` as a required runtime peer, ships TypeScript type definitions, and targets
+ES2019 for its own bundle. The host application must also support the Observe SDK.
 
 ## Installation
 
 ```sh
-npm install @corbado/autocapture
+npm install @corbado/autocapture @corbado/observe@^0.16.1
 ```
 
 ## Usage
@@ -148,13 +148,15 @@ Navigation events likewise contain the raw `search` and `hash`. OAuth responses,
 links, and application routes can put secrets or PII there; no navigation redaction policy is
 currently applied.
 
-WebAuthn interception and network fallbacks share four exported helpers:
+WebAuthn interception and network fallbacks share four helpers exported by `@corbado/observe`
+(and re-exported here for compatibility):
 `sanitizeCreationOptions`, `sanitizeCreationResponse`, `sanitizeRequestOptions`, and
 `sanitizeAssertionResponse`. Each accepts the relevant native browser object, a JSON object, or a
 JSON string, and returns JSON text or `undefined` on malformed/unserializable input. Pass the
 `publicKey` options or credential itself, not an application-specific request envelope.
 
-The blacklist lives only in `src/webauthn-payloads.ts`:
+Import these helpers directly from `@corbado/observe` for new integrations. The blacklist lives
+only in Observe’s `src/utils/webauthn-payloads.ts`:
 
 | Payload | Removed paths |
 | --- | --- |
@@ -213,3 +215,11 @@ It does not activate automatically or collect field values/message text.
 
 See [the API and evidence contract](src/input-validation.contract.md), including the limits of
 asynchronous DOM inference and the `beginAttempt()`, `requestStarted()`, and `refresh()` methods.
+
+## Local development
+
+Run `pnpm --filter @corbado/autocapture... build` from the workspace root before linting or
+running unit tests. The workspace development dependency supplies the required Observe peer;
+Observe stays external in the published bundles. `pnpm test:e2e` builds both packages.
+
+When increasing the minimum Observe peer version, publish Observe before autocapture.

package/dist/index.d.mts

@@ -1,3 +1,5 @@
+export { sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions } from '@corbado/observe';
+
 /** Receives optional diagnostics. Capture functions remain silent when no logger is provided. */
 type Logger = {
     /** Records a non-fatal diagnostic message. */
@@ -367,13 +369,4 @@ declare function isValidationMessageVisible(element: Element | null): boolean;
  */
 declare function captureInputValidation(options: InputValidationCaptureOptions): InputValidationCaptureHandle;
 
-/** Sanitizes publicKey creation options (native values, JSON object, or JSON string). */
-declare function sanitizeCreationOptions(value: unknown): string | undefined;
-/** Sanitizes a registration credential; keeps attestation material but removes PRF results. */
-declare function sanitizeCreationResponse(value: unknown): string | undefined;
-/** Serializes publicKey authentication options. No fields are currently blacklisted. */
-declare function sanitizeRequestOptions(value: unknown): string | undefined;
-/** Sanitizes an authentication credential; removes its login signature and PRF results. */
-declare function sanitizeAssertionResponse(value: unknown): string | undefined;
-
-export { type CaptureHandle, type HttpExchange, type HttpRequestStarted, type InputValidationCaptureHandle, type InputValidationCaptureOptions, type InputValidationError, type InputValidationState, type Logger, type NavigationCaptureOptions, type NavigationEvent, type NavigationSource, type NetworkBodyDirection, type NetworkBodyProjectionContext, type NetworkBodyProjector, type NetworkCaptureOptions, type NetworkTransport, VERSION, type WebAuthnAttachSurface, type WebAuthnCaptureHandle, type WebAuthnCaptureOptions, type WebAuthnCeremonyCompletedEvent, type WebAuthnCeremonyContext, type WebAuthnCeremonyEvent, type WebAuthnCeremonyFailedEvent, type WebAuthnCeremonyStartedEvent, type WebAuthnMediation, type WebAuthnUiMode, captureInputValidation, captureNavigation, captureNetwork, captureWebAuthn, composedPath, inputValidationCode, isValidationMessageVisible, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions };
+export { type CaptureHandle, type HttpExchange, type HttpRequestStarted, type InputValidationCaptureHandle, type InputValidationCaptureOptions, type InputValidationError, type InputValidationState, type Logger, type NavigationCaptureOptions, type NavigationEvent, type NavigationSource, type NetworkBodyDirection, type NetworkBodyProjectionContext, type NetworkBodyProjector, type NetworkCaptureOptions, type NetworkTransport, VERSION, type WebAuthnAttachSurface, type WebAuthnCaptureHandle, type WebAuthnCaptureOptions, type WebAuthnCeremonyCompletedEvent, type WebAuthnCeremonyContext, type WebAuthnCeremonyEvent, type WebAuthnCeremonyFailedEvent, type WebAuthnCeremonyStartedEvent, type WebAuthnMediation, type WebAuthnUiMode, captureInputValidation, captureNavigation, captureNetwork, captureWebAuthn, composedPath, inputValidationCode, isValidationMessageVisible };

package/dist/index.d.ts

@@ -1,3 +1,5 @@
+export { sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions } from '@corbado/observe';
+
 /** Receives optional diagnostics. Capture functions remain silent when no logger is provided. */
 type Logger = {
     /** Records a non-fatal diagnostic message. */
@@ -367,13 +369,4 @@ declare function isValidationMessageVisible(element: Element | null): boolean;
  */
 declare function captureInputValidation(options: InputValidationCaptureOptions): InputValidationCaptureHandle;
 
-/** Sanitizes publicKey creation options (native values, JSON object, or JSON string). */
-declare function sanitizeCreationOptions(value: unknown): string | undefined;
-/** Sanitizes a registration credential; keeps attestation material but removes PRF results. */
-declare function sanitizeCreationResponse(value: unknown): string | undefined;
-/** Serializes publicKey authentication options. No fields are currently blacklisted. */
-declare function sanitizeRequestOptions(value: unknown): string | undefined;
-/** Sanitizes an authentication credential; removes its login signature and PRF results. */
-declare function sanitizeAssertionResponse(value: unknown): string | undefined;
-
-export { type CaptureHandle, type HttpExchange, type HttpRequestStarted, type InputValidationCaptureHandle, type InputValidationCaptureOptions, type InputValidationError, type InputValidationState, type Logger, type NavigationCaptureOptions, type NavigationEvent, type NavigationSource, type NetworkBodyDirection, type NetworkBodyProjectionContext, type NetworkBodyProjector, type NetworkCaptureOptions, type NetworkTransport, VERSION, type WebAuthnAttachSurface, type WebAuthnCaptureHandle, type WebAuthnCaptureOptions, type WebAuthnCeremonyCompletedEvent, type WebAuthnCeremonyContext, type WebAuthnCeremonyEvent, type WebAuthnCeremonyFailedEvent, type WebAuthnCeremonyStartedEvent, type WebAuthnMediation, type WebAuthnUiMode, captureInputValidation, captureNavigation, captureNetwork, captureWebAuthn, composedPath, inputValidationCode, isValidationMessageVisible, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions };
+export { type CaptureHandle, type HttpExchange, type HttpRequestStarted, type InputValidationCaptureHandle, type InputValidationCaptureOptions, type InputValidationError, type InputValidationState, type Logger, type NavigationCaptureOptions, type NavigationEvent, type NavigationSource, type NetworkBodyDirection, type NetworkBodyProjectionContext, type NetworkBodyProjector, type NetworkCaptureOptions, type NetworkTransport, VERSION, type WebAuthnAttachSurface, type WebAuthnCaptureHandle, type WebAuthnCaptureOptions, type WebAuthnCeremonyCompletedEvent, type WebAuthnCeremonyContext, type WebAuthnCeremonyEvent, type WebAuthnCeremonyFailedEvent, type WebAuthnCeremonyStartedEvent, type WebAuthnMediation, type WebAuthnUiMode, captureInputValidation, captureNavigation, captureNetwork, captureWebAuthn, composedPath, inputValidationCode, isValidationMessageVisible };

package/dist/index.js

@@ -1 +1 @@
-"use strict";var ie=Object.defineProperty;var ke=Object.getOwnPropertyDescriptor;var Se=Object.getOwnPropertyNames;var Pe=Object.prototype.hasOwnProperty;var Ie=(e,t)=>{for(var n in t)ie(e,n,{get:t[n],enumerable:!0})},Te=(e,t,n,i)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Se(t))!Pe.call(e,o)&&o!==n&&ie(e,o,{get:()=>t[o],enumerable:!(i=ke(t,o))||i.enumerable});return e};var Be=e=>Te(ie({},"__esModule",{value:!0}),e);var $e={};Ie($e,{VERSION:()=>Ae,captureInputValidation:()=>xe,captureNavigation:()=>Ce,captureNetwork:()=>ve,captureWebAuthn:()=>fe,composedPath:()=>Oe,inputValidationCode:()=>ce,isValidationMessageVisible:()=>Ee,sanitizeAssertionResponse:()=>ee,sanitizeCreationOptions:()=>Y,sanitizeCreationResponse:()=>Q,sanitizeRequestOptions:()=>Z});module.exports=Be($e);var Le={creationOptions:["/user/name","/user/displayName"],creationResponse:["/clientExtensionResults/prf/results"],requestOptions:[],assertionResponse:["/response/signature","/clientExtensionResults/prf/results"]};function Y(e){return te(e,"creationOptions")}function Q(e){return te(e,"creationResponse")}function Z(e){return te(e,"requestOptions")}function ee(e){return te(e,"assertionResponse")}function te(e,t){try{let n=typeof e=="string"?JSON.parse(e):e;if(!Ne(n))return;let i=new Set(Le[t]),o=new Set,d=(s,v,u=0)=>{if(!i.has(v)){if(s===null||typeof s=="string"||typeof s=="boolean")return s;if(typeof s=="number")return Number.isFinite(s)?s:null;if(typeof s=="object"){if(s instanceof ArrayBuffer||ArrayBuffer.isView(s))return De(s);if(u>64||o.has(s))throw new TypeError("Invalid telemetry payload");o.add(s);try{if(Array.isArray(s))return s.map((P,k)=>d(P,`${v}/${k}`,u+1));let B=Object.create(null);for(let P in s){let k=`${v}/${P.replace(/~/g,"~0").replace(/\//g,"~1")}`;if(i.has(k)||P==="toJSON")continue;let I=d(s[P],k,u+1);I!==void 0&&(B[P]=I)}let R=s,q=(P,k)=>{if(B[k]!==void 0||typeof R[P]!="function")return;let I=`${v}/${k}`,T=d(Reflect.apply(R[P],s,[]),I,u+1);T!==void 0&&(B[k]=T)};return v===""&&(t==="creationResponse"||t==="assertionResponse")&&q("getClientExtensionResults","clientExtensionResults"),v==="/response"&&t==="creationResponse"&&(q("getTransports","transports"),q("getAuthenticatorData","authenticatorData"),q("getPublicKey","publicKey"),q("getPublicKeyAlgorithm","publicKeyAlgorithm")),B}finally{o.delete(s)}}}};return JSON.stringify(d(n,""))}catch{return}}function Ne(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)&&!(e instanceof ArrayBuffer)&&!ArrayBuffer.isView(e)}function De(e){let t=e instanceof ArrayBuffer?new Uint8Array(e):new Uint8Array(e.buffer,e.byteOffset,e.byteLength),n="";for(let i of t)n+=String.fromCharCode(i);return btoa(n).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}var Me={log:()=>{}};function K(e){return e?{log:(...t)=>{try{let n=e.log(...t);if(n&&(typeof n=="object"||typeof n=="function"))try{Promise.resolve(n).catch(()=>{})}catch{}}catch{}}}:Me}var le=Symbol.for("corbado.autocapture.installed");function _(e){try{return typeof e=="function"&&Object.prototype.hasOwnProperty.call(e,le)}catch{return!1}}function F(e,t){var i,o;let n=t;try{Object.defineProperty(e,le,{value:t,configurable:!0})}catch{}try{Object.defineProperty(e,"name",{value:(i=n.name)!=null?i:"",configurable:!0})}catch{}try{Object.defineProperty(e,"length",{value:(o=n.length)!=null?o:0,configurable:!0})}catch{}return e}function M(){return{mode:"unavailable",disconnect:()=>{}}}function ae(e,t){return!!e&&"value"in e&&"value"in t&&e.value===t.value&&e.writable===t.writable&&e.enumerable===t.enumerable&&e.configurable===t.configurable}function X(e,t,n,i,o,d=String(t)){try{let s=Object.getOwnPropertyDescriptor(e,t);ae(s,{...i,value:n})&&Object.defineProperty(e,t,i)}catch(s){o.log(`${d} restoration skipped`,s)}}function z(e,t,n){let i=K(e);return o=>{try{let d=n(o);if(d&&(typeof d=="object"||typeof d=="function"))try{Promise.resolve(d).catch(s=>i.log(`${t} listener failed`,s))}catch(s){i.log(`${t} listener failed`,s)}}catch(d){i.log(`${t} listener failed`,d)}}}var pe=e=>({get:e("get"),create:e("create")});function fe(e){let t=e.onEvent;if(typeof t!="function")throw new TypeError("captureWebAuthn requires an onEvent callback");let n=K(e.logger),i=p=>(n.log(`webauthn capture unavailable: ${p}`),{...M(),surface:"none"}),o=typeof navigator=="undefined"?void 0:navigator,d=o==null?void 0:o.credentials;if(!o||!d)return i("navigator.credentials missing");let s=d,v=pe(p=>s[p]);if(typeof v.get!="function"||typeof v.create!="function")return i("credentials methods missing");if(_(v.get)||_(v.create))return i("an equivalent capture is already active");let u=!1,B=0,R=z(n,"webauthn",t),q=(p,y,w)=>{let N={invoke(...l){let g=l[0];if(!u||w!=null&&w()||!se(g)||!se(g.publicKey))return y(this,l);let f=g.publicKey,c=`wa-${++B}`,x=y(this,l),S=se(g.signal)?g.signal:void 0,r=He(p,g,f),h=b=>{u&&R({...r,ceremonyId:c,...b()})},C=()=>(S==null?void 0:S.aborted)===!0?{aborted:!0}:{};return h(()=>({phase:"started",userActivation:We(o),...r.kind==="authentication"?{requestOptionsJson:Z(f)}:{creationOptionsJson:Y(f)}})),Promise.resolve(x).then(b=>(h(()=>({phase:"completed",credentialJson:p==="create"?Q(b):ee(b),...C()})),b),b=>{throw h(()=>({phase:"failed",error:b,errorName:_e(b),...C()})),b})}}.invoke;return F(N,{name:p,length:0})},P=p=>{var N;let y=q(p,(l,g)=>Reflect.apply(v[p],l,g)),w=Object.getOwnPropertyDescriptor(d,p);if(w&&(!("value"in w)||w.writable!==!0))return null;try{s[p]=y}catch{return null}if(((N=Object.getOwnPropertyDescriptor(d,p))==null?void 0:N.value)!==y){try{s[p]=v[p]}catch{}return null}return()=>{s[p]===y&&(w?s[p]=w.value:delete s[p])}},k=()=>{let p=pe(()=>new WeakMap),y=(f,c)=>{let x=p[f].get(c);if(x)return x;let S=q(f,(r,h)=>Reflect.apply(c,d,h),()=>{try{let r=s[f];return r!==c&&r!==S}catch(r){return n.log("suppress check failed; ceremony unreported",r),!0}});return p[f].set(c,S),S},w=f=>{let c=Object.getOwnPropertyDescriptor(d,f);return c?c.configurable===!0||!("value"in c)||c.writable===!0:!0},N=new WeakMap,l=new Proxy(d,{get(f,c){let x=Reflect.get(d,c,d);if((c==="get"||c==="create")&&w(c))return typeof x!="function"||_(x)?x:y(c,x);if(typeof x!="function"||!w(c)||c==="constructor")return x;let S=N.get(x);if(S)return S;let r=x.bind(d);return N.set(x,r),r},set(f,c,x){return Reflect.set(d,c,x,d)}}),g=Object.getOwnPropertyDescriptor(o,"credentials");if(g&&g.configurable!==!0)return null;try{Object.defineProperty(o,"credentials",{value:l,writable:!0,enumerable:!0,configurable:!0})}catch{return null}return o.credentials!==l?null:()=>{o.credentials===l&&(g?Object.defineProperty(o,"credentials",g):delete o.credentials)}},I=(p,y)=>(u=!0,{mode:"standard",surface:p,disconnect:()=>{u=!1,y()}}),T=P("get"),j=T?P("create"):null;if(T&&j)return I("methods",()=>{T(),j()});if(T==null||T(),e.attach==="container"){let p=k();if(p)return n.log("webauthn capture attached at the credentials container"),I("container",p)}return i("credentials methods cannot be patched safely")}function He(e,t,n){let i=je(t.mediation);if(e==="create")return{kind:"registration",mediation:i};let o=n;return{kind:"authentication",mediation:i,uiMode:Ve(t.uiMode),credentialSet:Array.isArray(o.allowCredentials)&&o.allowCredentials.length>0?"allowlisted":"discoverable"}}function je(e){return e===void 0?"optional":e==="silent"||e==="optional"||e==="conditional"||e==="required"?e:"unknown"}function Ve(e){return e===void 0?"default":e==="immediate"?"immediate":"unknown"}function We(e){let t=e.userActivation;return typeof(t==null?void 0:t.isActive)=="boolean"?t.isActive:void 0}function se(e){return e!==null&&(typeof e=="object"||typeof e=="function")}function _e(e){return e instanceof DOMException?e.name:"UnknownError"}var he=0;function ye(){return he+=1,`network-${he}`}function Ue(e,t){let n=e.responseType;if(n===""||n==="text")return t(e.responseText);if(n==="json"){let i=e.response;return i==null?void 0:t(i)}}var Ke=500,ge=Symbol("body-read-timeout");function be(e){return/event-stream|octet-stream/i.test(e)?!1:/json|text|urlencoded/i.test(e)}async function me(e,t){let n=e.body;if(!n)return;let i=n.getReader(),o;try{let d=new Promise(u=>{o=setTimeout(()=>u(ge),Ke)}),s=new TextDecoder,v=[];for(;;){let u=await Promise.race([i.read(),d]);if(u===ge){t.log("body omitted: read timed out"),i.cancel().catch(()=>{});return}if(u.done)break;v.push(s.decode(u.value,{stream:!0}))}return v.push(s.decode()),v.join("")}catch{i.cancel().catch(()=>{});return}finally{o!==void 0&&clearTimeout(o)}}function ue(e){var t;(t=e==null?void 0:e.body)==null||t.cancel().catch(()=>{})}function ve(e){var y,w,N;let{onExchange:t,onRequest:n,match:i}=e;if(typeof t!="function"||typeof i!="function")throw new TypeError("captureNetwork requires onExchange and match callbacks");let o=K(e.logger),d=(y=e.transports)!=null?y:["xhr","fetch"],s=(w=e.bodyCapture)==null?void 0:w.request,v=(N=e.bodyCapture)==null?void 0:N.response,u=typeof s=="function",B=typeof v=="function",R=!1,q=z(o,"network",l=>{if(R)return t(l)}),P=z(o,"network request",l=>{if(R)return n==null?void 0:n(l)}),k=(l,g,f)=>{if(typeof f=="function")try{return f(l,g)}catch(c){o.log("body projection failed",c);return}},I=(l,g)=>{try{let f=typeof document!="undefined"?document.baseURI:void 0,c=new URL(String(l),f);return i(c,g)===!0?{url:c.href,path:c.pathname}:void 0}catch{return}},T=()=>{if(typeof XMLHttpRequest=="undefined")return o.log("xhr capture unavailable: XMLHttpRequest missing"),null;let l=XMLHttpRequest.prototype,g=Object.getOwnPropertyDescriptor(l,"open"),f=Object.getOwnPropertyDescriptor(l,"send");if(!g||!("value"in g)||typeof g.value!="function"||!f||!("value"in f)||typeof f.value!="function")return o.log("xhr capture unavailable: XMLHttpRequest methods missing"),null;let c=g.value,x=f.value;if(_(c)||_(x))return o.log("xhr capture unavailable: an equivalent capture is already active"),null;let S=new WeakMap,r=new Set,h=!1,C={open(...O){var A;let a=Reflect.apply(c,this,O);if(!R||!h)return a;try{let D=S.get(this);D&&(D.reported=!0,(A=D.cleanupListeners)==null||A.call(D));let H=String(O[0]).toUpperCase(),L=I(O[1],H);L?S.set(this,{method:H,url:L.url,path:L.path,reported:!1}):S.delete(this)}catch(D){o.log("xhr open observation failed",D)}return a}}.open,b={send(...O){let a=R&&h?S.get(this):void 0;if(!a||a.reported||a.cleanupListeners)return Reflect.apply(x,this,O);let A=()=>{},D=!1;try{a.requestId=ye();let L={direction:"request",transport:"xhr",method:a.method,url:a.url,path:a.path};a.requestBody=u&&typeof O[0]=="string"?k(O[0],L,s):void 0;let J=()=>{a.outcome===void 0&&(a.outcome="abort")},G=()=>{a.outcome===void 0&&(a.outcome="timeout")},m=()=>{a.outcome===void 0&&(a.outcome="error")},E=()=>{var $;A();try{if(!R||!h||a.reported||!a.requestId)return;a.reported=!0;let W={direction:"response",transport:"xhr",method:a.method,url:a.url,path:a.path},oe=this.status,de={requestId:a.requestId,transport:"xhr",method:a.method,url:a.url,path:a.path,status:oe,ok:oe>=200&&oe<300,outcome:($=a.outcome)!=null?$:"load",durationMs:a.startedAt!==void 0?Date.now()-a.startedAt:void 0,responseUrl:this.responseURL||void 0,requestBody:a.requestBody,responseBody:B?Ue(this,qe=>k(qe,W,v)):void 0};a.requestEmitted?q(de):a.pendingExchange=de}catch(W){o.log("xhr exchange observation failed",W)}finally{S.get(this)===a&&S.delete(this)}},V=()=>{try{this.readyState===XMLHttpRequest.DONE&&this.status!==0&&E()}catch($){o.log("xhr ready-state observation failed",$)}},U=()=>E();A=()=>{for(let[$,W]of[["readystatechange",V],["abort",J],["timeout",G],["error",m],["loadend",U]])this.removeEventListener($,W);a.cleanupListeners===A&&(a.cleanupListeners=void 0),r.delete(A)},this.addEventListener("readystatechange",V),this.addEventListener("abort",J),this.addEventListener("timeout",G),this.addEventListener("error",m),this.addEventListener("loadend",U),a.cleanupListeners=A,r.add(A),a.startedAt=Date.now(),D=!0}catch(L){o.log("xhr send observation failed",L),A()}let H;try{H=Reflect.apply(x,this,O)}catch(L){throw A(),L}if(D&&a.requestId!==void 0&&a.startedAt!==void 0){a.requestEmitted=!0,P({requestId:a.requestId,transport:"xhr",method:a.method,url:a.url,path:a.path,startedAt:a.startedAt,requestBody:a.requestBody});let L=a.pendingExchange;a.pendingExchange=void 0,L&&q(L)}return H}}.send;return F(C,c),F(b,x),g.writable!==!0||f.writable!==!0?(o.log("xhr capture unavailable: XMLHttpRequest methods are not writable"),null):(Object.defineProperty(l,"open",{...g,value:C}),Object.defineProperty(l,"send",{...f,value:b}),h=!0,()=>{h=!1;for(let O of[...r])O();X(l,"open",C,g,o),X(l,"send",b,f,o)})},j=()=>{let l=globalThis,g=Object.getOwnPropertyDescriptor(l,"fetch");if(!g||!("value"in g))return o.log("fetch capture unavailable: fetch is not an own data property"),null;let f=g.value;if(typeof f!="function")return o.log("fetch capture unavailable: fetch missing"),null;if(_(f))return o.log("fetch capture unavailable: an equivalent capture is already active"),null;let c=!1,x=async(r,h,C,b)=>{try{if(!R||!c){ue(C);return}let[O,a]=await Promise.all([b!=null?b:Promise.resolve(void 0),C?me(C,o):Promise.resolve(void 0)]);if(!R||!c)return;let A={direction:"request",transport:"fetch",method:r.method,url:r.url,path:r.path},D={...A,direction:"response"},H=r.requestBody;H===void 0&&O!==void 0&&(H=k(O,A,s));let L=a!==void 0?k(a,D,v):void 0;q({requestId:r.requestId,transport:"fetch",method:r.method,url:r.url,path:r.path,status:h.status,ok:h.ok,outcome:"load",durationMs:Date.now()-r.startedAt,responseUrl:h.url||void 0,requestBody:H,responseBody:L})}catch(O){o.log("fetch exchange observation failed",O)}},S={fetch(...r){var H,L,J,G;let h;try{let m=r[0],E=r[1];if(R&&c&&u&&typeof Request!="undefined"&&m instanceof Request&&(E==null?void 0:E.body)===void 0&&m.body){let V=String((H=E==null?void 0:E.method)!=null?H:m.method).toUpperCase(),U=(L=m.headers.get("content-type"))!=null?L:"";I(m.url,V)&&be(U)&&(h=m.clone())}}catch(m){o.log("fetch observation failed",m)}let C,b=Date.now();try{C=Reflect.apply(f,this,r)}catch(m){throw ue(h),m}let O,a;try{if(R&&c){let m=r[0],E=r[1],V=typeof Request!="undefined"&&m instanceof Request,U=String((J=E==null?void 0:E.method)!=null?J:V?m.method:"GET").toUpperCase(),$=V?m.url:m,W=I($,U);W&&(O={requestId:ye(),method:U,url:W.url,path:W.path,startedAt:b},a=(G=E==null?void 0:E.signal)!=null?G:V?m.signal:void 0,u&&typeof(E==null?void 0:E.body)=="string"&&(O.requestBody=k(E.body,{direction:"request",transport:"fetch",method:U,url:W.url,path:W.path},s)))}}catch(m){o.log("fetch observation failed",m)}if(!O)return ue(h),C;let A=O;P({requestId:A.requestId,transport:"fetch",method:A.method,url:A.url,path:A.path,startedAt:A.startedAt,requestBody:A.requestBody});let D=h?me(h,o):void 0;return C.then(m=>{var V;let E;try{if(R&&c&&B){let U=(V=m.headers.get("content-type"))!=null?V:"";be(U)&&m.body&&(E=m.clone())}}catch{}x(A,m,E,D)},m=>{try{if(!R||!c)return;let E=(a==null?void 0:a.aborted)===!0||(m==null?void 0:m.name)==="AbortError"||typeof DOMException!="undefined"&&m instanceof DOMException&&m.code===DOMException.ABORT_ERR;q({requestId:A.requestId,transport:"fetch",method:A.method,url:A.url,path:A.path,status:0,ok:!1,outcome:E?"abort":"error",durationMs:Date.now()-A.startedAt})}catch(E){o.log("fetch failure observation failed",E)}}),C}}.fetch;return F(S,f),g.writable!==!0?(o.log("fetch capture unavailable: fetch is not writable"),null):(Object.defineProperty(l,"fetch",{...g,value:S}),c=!0,()=>{c=!1,X(l,"fetch",S,g,o)})},p=[];if(d.includes("xhr")){let l=T();l&&p.push(l)}if(d.includes("fetch")){let l=j();l&&p.push(l)}return p.length===0?M():(R=!0,{mode:"standard",disconnect:()=>{R=!1;for(let l of p.splice(0))l()}})}function Ce(e){let t=e.onNavigate;if(typeof t!="function")throw new TypeError("captureNavigation requires an onNavigate callback");let n=K(e.logger),i,o,d,s,v,u;try{if(i=window,o=i==null?void 0:i.history,!i||!o)return n.log("navigation capture unavailable: window/history missing"),M();if(v=we(o,"pushState"),u=we(o,"replaceState"),!v||!u)return n.log("navigation capture unavailable: history method descriptors missing"),M();if(d=v.descriptor.value,s=u.descriptor.value,typeof d!="function"||typeof s!="function")return n.log("navigation capture unavailable: history methods missing"),M();if(typeof i.addEventListener!="function"||typeof i.removeEventListener!="function")return n.log("navigation capture unavailable: window event methods missing"),M()}catch(y){return n.log("navigation capture unavailable: history inspection failed",y),M()}if(_(d)||_(s))return n.log("navigation capture unavailable: an equivalent capture is already active"),M();let B=!1,R=()=>({path:i.location.pathname,search:i.location.search,hash:i.location.hash}),q;try{q=R()}catch(y){return n.log("navigation capture unavailable: location inspection failed",y),M()}let P=z(n,"navigation",y=>{if(B)return t(y)}),k=y=>{if(B)try{let w=R();if(w.path===q.path&&w.search===q.search&&w.hash===q.hash)return;q=w,P({...w,source:y})}catch(w){n.log("navigation observation failed",w)}},I={pushState(...y){let w=Reflect.apply(d,this,y);return k("push"),w}}.pushState,T={replaceState(...y){let w=Reflect.apply(s,this,y);return k("replace"),w}}.replaceState;F(I,d),F(T,s);let j=()=>k("pop"),p=()=>k("hash");try{if(Re(v,I),Re(u,T),o.pushState!==I||o.replaceState!==T)throw new Error("history method replacement did not take effect");i.addEventListener("popstate",j),i.addEventListener("hashchange",p),B=!0}catch(y){return B=!1,re(i,"popstate",j,n),re(i,"hashchange",p,n),ne(u,T,n),ne(v,I,n),n.log("navigation capture unavailable: history methods are not writable",y),t=()=>{},P=()=>{},n=K(),M()}return{mode:"standard",disconnect:()=>{B=!1,t=()=>{},re(i,"popstate",j,n),re(i,"hashchange",p,n),ne(v,I,n),ne(u,T,n),P=()=>{},n=K()}}}function we(e,t){let n=e;for(;n;){let i=Object.getOwnPropertyDescriptor(n,t);if(i)return!("value"in i)||typeof i.value!="function"?null:{owner:n,key:t,descriptor:i};n=Object.getPrototypeOf(n)}return null}function Re(e,t){if(e.descriptor.writable!==!0)throw new TypeError(`${e.key} is not writable`);let n=Object.getOwnPropertyDescriptor(e.owner,e.key);if(!ae(n,e.descriptor))throw new Error(`${e.key} changed during installation`);Object.defineProperty(e.owner,e.key,{...e.descriptor,value:t})}function ne(e,t,n){X(e.owner,e.key,t,e.descriptor,n,`navigation ${e.key}`)}function re(e,t,n,i){try{e.removeEventListener(t,n)}catch(o){i.log(`navigation ${t} listener removal skipped`,o)}}function Oe(e){let t=e.composedPath();return t.length>0?t:e.target?[e.target]:[]}var Ae="0.7.0";var Fe=["valueMissing","typeMismatch","patternMismatch","tooShort","tooLong","rangeUnderflow","rangeOverflow","stepMismatch","badInput","customError"];function ce(e){return Fe.find(t=>e.validity[t])}function Ee(e){if(!(e!=null&&e.isConnected)||!e.getClientRects().length)return!1;let t=e.ownerDocument.defaultView;if(!t)return!1;for(let n=e;n;n=n.parentElement){let i=t.getComputedStyle(n);if(n.hasAttribute("hidden")||i.display==="none"||i.visibility==="hidden"||i.visibility==="collapse"||i.opacity==="0")return!1}return!0}function xe(e){var x,S;if(typeof e.readValidation!="function"||typeof e.onError!="function")throw new TypeError("captureInputValidation requires readValidation and onError callbacks");let{form:t}=e,n=[...e.fields],i=(x=e.maxObservationMs)!=null?x:1e4;if(!n.length||!Number.isFinite(i)||i<=0)throw new TypeError("captureInputValidation requires fields and a positive maxObservationMs");let o={mode:"unavailable",disconnect(){},beginAttempt:()=>{},requestStarted(){},refresh(){}},d=(S=t==null?void 0:t.ownerDocument)==null?void 0:S.defaultView;if(!d||!n.every(r=>r.form===t))return o;let s=!0,v=0,u,B=!1,R,q,P,k,I=[],T=()=>t.isConnected&&n.every(r=>r.isConnected&&r.form===t),j=()=>{try{let r=e.readValidation();if(r&&["clear","pending","unknown"].includes(r.status)||(r==null?void 0:r.status)==="invalid"&&typeof r.code=="string"&&["constraint","application"].includes(r.source))return r}catch{}return{status:"unknown"}},p=r=>r.status==="invalid"?JSON.stringify([r.code,r.fieldIndex]):void 0,y=()=>{u=void 0,clearTimeout(q),clearTimeout(P),q=P=void 0},w=()=>{q=void 0;let r=u;if(!s||!(r!=null&&r.confirmed))return;if(!T()){y();return}let h=r.nativeInvalid?(()=>{for(let[b,O]of n.entries()){let a=ce(O);if(a)return{status:"invalid",source:"constraint",code:a,fieldIndex:b}}return{status:"clear"}})():j();if(h.status==="clear"){r.serverBaseline=void 0;return}if(h.status!=="invalid"||h.source==="application"&&r.serverBaseline===p(h))return;let C={attemptId:r.id,startedAt:r.startedAt,timestamp:Date.now(),code:h.code,...h.fieldIndex===void 0?{}:{fieldIndex:h.fieldIndex}};y(),B=!1;try{Promise.resolve(e.onError(C)).catch(()=>{})}catch{}},N=()=>{!s||!u||q!==void 0||(q=setTimeout(w,0))},l=r=>{if(!s||!T())return;y();let h=B?p(j()):void 0;return u={id:++v,startedAt:Date.now(),confirmed:r,nativeInvalid:!1,serverBaseline:h},P=setTimeout(y,i),N(),u.id},g=()=>{R===void 0&&(R=l(!1),k=setTimeout(()=>{u&&u.id===R&&!u.confirmed&&y(),R=void 0},0))},f=(r,h,C)=>{r.addEventListener(h,C,!0),I.push(()=>r.removeEventListener(h,C,!0))},c={mode:"standard",beginAttempt:()=>l(!0),refresh:N,requestStarted(r={}){s&&(r.attemptId!==void 0&&r.attemptId!==(u==null?void 0:u.id)||u&&r.timestamp!==void 0&&r.timestamp<u.startedAt||(y(),B=!0))},disconnect(){if(s){s=!1,y(),clearTimeout(k);for(let r of I.splice(0))r()}}};try{let r=C=>{var a;let b=C.target,O=(a=b==null?void 0:b.closest)==null?void 0:a.call(b,"button,input");(O==null?void 0:O.form)===t&&!O.disabled&&["submit","image"].includes(O.type)&&g()};f(t.ownerDocument,"click",r),f(t,"click",r),f(t,"keydown",C=>{let b=C;b.key==="Enter"&&!b.isComposing&&!b.defaultPrevented&&n.includes(b.target)&&g()}),f(t,"submit",()=>{(u==null?void 0:u.id)===R&&u?(u.confirmed=!0,N()):l(!0),R=void 0}),f(t,"invalid",C=>{!u||!n.includes(C.target)||(u.confirmed=!0,u.nativeInvalid=!0,N())}),f(t,"input",C=>{n.includes(C.target)&&y()});let h=new d.MutationObserver(N);h.observe(t,{subtree:!0,childList:!0,attributes:!0,characterData:!0}),I.push(()=>h.disconnect())}catch{return c.disconnect(),o}return c}0&&(module.exports={VERSION,captureInputValidation,captureNavigation,captureNetwork,captureWebAuthn,composedPath,inputValidationCode,isValidationMessageVisible,sanitizeAssertionResponse,sanitizeCreationOptions,sanitizeCreationResponse,sanitizeRequestOptions});
+"use strict";var ne=Object.defineProperty;var Oe=Object.getOwnPropertyDescriptor;var xe=Object.getOwnPropertyNames;var Ae=Object.prototype.hasOwnProperty;var ke=(e,t)=>{for(var n in t)ne(e,n,{get:t[n],enumerable:!0})},Ie=(e,t,n,i)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of xe(t))!Ae.call(e,o)&&o!==n&&ne(e,o,{get:()=>t[o],enumerable:!(i=Oe(t,o))||i.enumerable});return e};var Pe=e=>Ie(ne({},"__esModule",{value:!0}),e);var Ve={};ke(Ve,{VERSION:()=>Re,captureInputValidation:()=>Ee,captureNavigation:()=>be,captureNetwork:()=>ge,captureWebAuthn:()=>ce,composedPath:()=>we,inputValidationCode:()=>ae,isValidationMessageVisible:()=>Ce,sanitizeAssertionResponse:()=>$.sanitizeAssertionResponse,sanitizeCreationOptions:()=>$.sanitizeCreationOptions,sanitizeCreationResponse:()=>$.sanitizeCreationResponse,sanitizeRequestOptions:()=>$.sanitizeRequestOptions});module.exports=Pe(Ve);var z=require("@corbado/observe");var Se={log:()=>{}};function F(e){return e?{log:(...t)=>{try{let n=e.log(...t);if(n&&(typeof n=="object"||typeof n=="function"))try{Promise.resolve(n).catch(()=>{})}catch{}}catch{}}}:Se}var ue=Symbol.for("corbado.autocapture.installed");function _(e){try{return typeof e=="function"&&Object.prototype.hasOwnProperty.call(e,ue)}catch{return!1}}function K(e,t){var i,o;let n=t;try{Object.defineProperty(e,ue,{value:t,configurable:!0})}catch{}try{Object.defineProperty(e,"name",{value:(i=n.name)!=null?i:"",configurable:!0})}catch{}try{Object.defineProperty(e,"length",{value:(o=n.length)!=null?o:0,configurable:!0})}catch{}return e}function N(){return{mode:"unavailable",disconnect:()=>{}}}function re(e,t){return!!e&&"value"in e&&"value"in t&&e.value===t.value&&e.writable===t.writable&&e.enumerable===t.enumerable&&e.configurable===t.configurable}function G(e,t,n,i,o,y=String(t)){try{let f=Object.getOwnPropertyDescriptor(e,t);re(f,{...i,value:n})&&Object.defineProperty(e,t,i)}catch(f){o.log(`${y} restoration skipped`,f)}}function J(e,t,n){let i=F(e);return o=>{try{let y=n(o);if(y&&(typeof y=="object"||typeof y=="function"))try{Promise.resolve(y).catch(f=>i.log(`${t} listener failed`,f))}catch(f){i.log(`${t} listener failed`,f)}}catch(y){i.log(`${t} listener failed`,y)}}}var de=e=>({get:e("get"),create:e("create")});function ce(e){let t=e.onEvent;if(typeof t!="function")throw new TypeError("captureWebAuthn requires an onEvent callback");let n=F(e.logger),i=c=>(n.log(`webauthn capture unavailable: ${c}`),{...N(),surface:"none"}),o=typeof navigator=="undefined"?void 0:navigator,y=o==null?void 0:o.credentials;if(!o||!y)return i("navigator.credentials missing");let f=y,A=de(c=>f[c]);if(typeof A.get!="function"||typeof A.create!="function")return i("credentials methods missing");if(_(A.get)||_(A.create))return i("an equivalent capture is already active");let s=!1,B=0,O=J(n,"webauthn",t),k=(c,h,b)=>{let T={invoke(...d){let g=d[0];if(!s||b!=null&&b()||!oe(g)||!oe(g.publicKey))return h(this,d);let l=g.publicKey,u=`wa-${++B}`,q=h(this,d),x=oe(g.signal)?g.signal:void 0,r=Te(c,g,l),p=m=>{s&&O({...r,ceremonyId:u,...m()})},w=()=>(x==null?void 0:x.aborted)===!0?{aborted:!0}:{};return p(()=>({phase:"started",userActivation:Me(o),...r.kind==="authentication"?{requestOptionsJson:(0,z.sanitizeRequestOptions)(l)}:{creationOptionsJson:(0,z.sanitizeCreationOptions)(l)}})),Promise.resolve(q).then(m=>(p(()=>({phase:"completed",credentialJson:c==="create"?(0,z.sanitizeCreationResponse)(m):(0,z.sanitizeAssertionResponse)(m),...w()})),m),m=>{throw p(()=>({phase:"failed",error:m,errorName:De(m),...w()})),m})}}.invoke;return K(T,{name:c,length:0})},D=c=>{var T;let h=k(c,(d,g)=>Reflect.apply(A[c],d,g)),b=Object.getOwnPropertyDescriptor(y,c);if(b&&(!("value"in b)||b.writable!==!0))return null;try{f[c]=h}catch{return null}if(((T=Object.getOwnPropertyDescriptor(y,c))==null?void 0:T.value)!==h){try{f[c]=A[c]}catch{}return null}return()=>{f[c]===h&&(b?f[c]=b.value:delete f[c])}},L=()=>{let c=de(()=>new WeakMap),h=(l,u)=>{let q=c[l].get(u);if(q)return q;let x=k(l,(r,p)=>Reflect.apply(u,y,p),()=>{try{let r=f[l];return r!==u&&r!==x}catch(r){return n.log("suppress check failed; ceremony unreported",r),!0}});return c[l].set(u,x),x},b=l=>{let u=Object.getOwnPropertyDescriptor(y,l);return u?u.configurable===!0||!("value"in u)||u.writable===!0:!0},T=new WeakMap,d=new Proxy(y,{get(l,u){let q=Reflect.get(y,u,y);if((u==="get"||u==="create")&&b(u))return typeof q!="function"||_(q)?q:h(u,q);if(typeof q!="function"||!b(u)||u==="constructor")return q;let x=T.get(q);if(x)return x;let r=q.bind(y);return T.set(q,r),r},set(l,u,q){return Reflect.set(y,u,q,y)}}),g=Object.getOwnPropertyDescriptor(o,"credentials");if(g&&g.configurable!==!0)return null;try{Object.defineProperty(o,"credentials",{value:d,writable:!0,enumerable:!0,configurable:!0})}catch{return null}return o.credentials!==d?null:()=>{o.credentials===d&&(g?Object.defineProperty(o,"credentials",g):delete o.credentials)}},S=(c,h)=>(s=!0,{mode:"standard",surface:c,disconnect:()=>{s=!1,h()}}),I=D("get"),j=I?D("create"):null;if(I&&j)return S("methods",()=>{I(),j()});if(I==null||I(),e.attach==="container"){let c=L();if(c)return n.log("webauthn capture attached at the credentials container"),S("container",c)}return i("credentials methods cannot be patched safely")}function Te(e,t,n){let i=Le(t.mediation);if(e==="create")return{kind:"registration",mediation:i};let o=n;return{kind:"authentication",mediation:i,uiMode:Be(t.uiMode),credentialSet:Array.isArray(o.allowCredentials)&&o.allowCredentials.length>0?"allowlisted":"discoverable"}}function Le(e){return e===void 0?"optional":e==="silent"||e==="optional"||e==="conditional"||e==="required"?e:"unknown"}function Be(e){return e===void 0?"default":e==="immediate"?"immediate":"unknown"}function Me(e){let t=e.userActivation;return typeof(t==null?void 0:t.isActive)=="boolean"?t.isActive:void 0}function oe(e){return e!==null&&(typeof e=="object"||typeof e=="function")}function De(e){return e instanceof DOMException?e.name:"UnknownError"}var le=0;function pe(){return le+=1,`network-${le}`}function Ne(e,t){let n=e.responseType;if(n===""||n==="text")return t(e.responseText);if(n==="json"){let i=e.response;return i==null?void 0:t(i)}}var He=500,fe=Symbol("body-read-timeout");function he(e){return/event-stream|octet-stream/i.test(e)?!1:/json|text|urlencoded/i.test(e)}async function ye(e,t){let n=e.body;if(!n)return;let i=n.getReader(),o;try{let y=new Promise(s=>{o=setTimeout(()=>s(fe),He)}),f=new TextDecoder,A=[];for(;;){let s=await Promise.race([i.read(),y]);if(s===fe){t.log("body omitted: read timed out"),i.cancel().catch(()=>{});return}if(s.done)break;A.push(f.decode(s.value,{stream:!0}))}return A.push(f.decode()),A.join("")}catch{i.cancel().catch(()=>{});return}finally{o!==void 0&&clearTimeout(o)}}function ie(e){var t;(t=e==null?void 0:e.body)==null||t.cancel().catch(()=>{})}function ge(e){var h,b,T;let{onExchange:t,onRequest:n,match:i}=e;if(typeof t!="function"||typeof i!="function")throw new TypeError("captureNetwork requires onExchange and match callbacks");let o=F(e.logger),y=(h=e.transports)!=null?h:["xhr","fetch"],f=(b=e.bodyCapture)==null?void 0:b.request,A=(T=e.bodyCapture)==null?void 0:T.response,s=typeof f=="function",B=typeof A=="function",O=!1,k=J(o,"network",d=>{if(O)return t(d)}),D=J(o,"network request",d=>{if(O)return n==null?void 0:n(d)}),L=(d,g,l)=>{if(typeof l=="function")try{return l(d,g)}catch(u){o.log("body projection failed",u);return}},S=(d,g)=>{try{let l=typeof document!="undefined"?document.baseURI:void 0,u=new URL(String(d),l);return i(u,g)===!0?{url:u.href,path:u.pathname}:void 0}catch{return}},I=()=>{if(typeof XMLHttpRequest=="undefined")return o.log("xhr capture unavailable: XMLHttpRequest missing"),null;let d=XMLHttpRequest.prototype,g=Object.getOwnPropertyDescriptor(d,"open"),l=Object.getOwnPropertyDescriptor(d,"send");if(!g||!("value"in g)||typeof g.value!="function"||!l||!("value"in l)||typeof l.value!="function")return o.log("xhr capture unavailable: XMLHttpRequest methods missing"),null;let u=g.value,q=l.value;if(_(u)||_(q))return o.log("xhr capture unavailable: an equivalent capture is already active"),null;let x=new WeakMap,r=new Set,p=!1,w={open(...R){var C;let a=Reflect.apply(u,this,R);if(!O||!p)return a;try{let M=x.get(this);M&&(M.reported=!0,(C=M.cleanupListeners)==null||C.call(M));let H=String(R[0]).toUpperCase(),P=S(R[1],H);P?x.set(this,{method:H,url:P.url,path:P.path,reported:!1}):x.delete(this)}catch(M){o.log("xhr open observation failed",M)}return a}}.open,m={send(...R){let a=O&&p?x.get(this):void 0;if(!a||a.reported||a.cleanupListeners)return Reflect.apply(q,this,R);let C=()=>{},M=!1;try{a.requestId=pe();let P={direction:"request",transport:"xhr",method:a.method,url:a.url,path:a.path};a.requestBody=s&&typeof R[0]=="string"?L(R[0],P,f):void 0;let Y=()=>{a.outcome===void 0&&(a.outcome="abort")},Q=()=>{a.outcome===void 0&&(a.outcome="timeout")},v=()=>{a.outcome===void 0&&(a.outcome="error")},E=()=>{var X;C();try{if(!O||!p||a.reported||!a.requestId)return;a.reported=!0;let W={direction:"response",transport:"xhr",method:a.method,url:a.url,path:a.path},te=this.status,se={requestId:a.requestId,transport:"xhr",method:a.method,url:a.url,path:a.path,status:te,ok:te>=200&&te<300,outcome:(X=a.outcome)!=null?X:"load",durationMs:a.startedAt!==void 0?Date.now()-a.startedAt:void 0,responseUrl:this.responseURL||void 0,requestBody:a.requestBody,responseBody:B?Ne(this,qe=>L(qe,W,A)):void 0};a.requestEmitted?k(se):a.pendingExchange=se}catch(W){o.log("xhr exchange observation failed",W)}finally{x.get(this)===a&&x.delete(this)}},V=()=>{try{this.readyState===XMLHttpRequest.DONE&&this.status!==0&&E()}catch(X){o.log("xhr ready-state observation failed",X)}},U=()=>E();C=()=>{for(let[X,W]of[["readystatechange",V],["abort",Y],["timeout",Q],["error",v],["loadend",U]])this.removeEventListener(X,W);a.cleanupListeners===C&&(a.cleanupListeners=void 0),r.delete(C)},this.addEventListener("readystatechange",V),this.addEventListener("abort",Y),this.addEventListener("timeout",Q),this.addEventListener("error",v),this.addEventListener("loadend",U),a.cleanupListeners=C,r.add(C),a.startedAt=Date.now(),M=!0}catch(P){o.log("xhr send observation failed",P),C()}let H;try{H=Reflect.apply(q,this,R)}catch(P){throw C(),P}if(M&&a.requestId!==void 0&&a.startedAt!==void 0){a.requestEmitted=!0,D({requestId:a.requestId,transport:"xhr",method:a.method,url:a.url,path:a.path,startedAt:a.startedAt,requestBody:a.requestBody});let P=a.pendingExchange;a.pendingExchange=void 0,P&&k(P)}return H}}.send;return K(w,u),K(m,q),g.writable!==!0||l.writable!==!0?(o.log("xhr capture unavailable: XMLHttpRequest methods are not writable"),null):(Object.defineProperty(d,"open",{...g,value:w}),Object.defineProperty(d,"send",{...l,value:m}),p=!0,()=>{p=!1;for(let R of[...r])R();G(d,"open",w,g,o),G(d,"send",m,l,o)})},j=()=>{let d=globalThis,g=Object.getOwnPropertyDescriptor(d,"fetch");if(!g||!("value"in g))return o.log("fetch capture unavailable: fetch is not an own data property"),null;let l=g.value;if(typeof l!="function")return o.log("fetch capture unavailable: fetch missing"),null;if(_(l))return o.log("fetch capture unavailable: an equivalent capture is already active"),null;let u=!1,q=async(r,p,w,m)=>{try{if(!O||!u){ie(w);return}let[R,a]=await Promise.all([m!=null?m:Promise.resolve(void 0),w?ye(w,o):Promise.resolve(void 0)]);if(!O||!u)return;let C={direction:"request",transport:"fetch",method:r.method,url:r.url,path:r.path},M={...C,direction:"response"},H=r.requestBody;H===void 0&&R!==void 0&&(H=L(R,C,f));let P=a!==void 0?L(a,M,A):void 0;k({requestId:r.requestId,transport:"fetch",method:r.method,url:r.url,path:r.path,status:p.status,ok:p.ok,outcome:"load",durationMs:Date.now()-r.startedAt,responseUrl:p.url||void 0,requestBody:H,responseBody:P})}catch(R){o.log("fetch exchange observation failed",R)}},x={fetch(...r){var H,P,Y,Q;let p;try{let v=r[0],E=r[1];if(O&&u&&s&&typeof Request!="undefined"&&v instanceof Request&&(E==null?void 0:E.body)===void 0&&v.body){let V=String((H=E==null?void 0:E.method)!=null?H:v.method).toUpperCase(),U=(P=v.headers.get("content-type"))!=null?P:"";S(v.url,V)&&he(U)&&(p=v.clone())}}catch(v){o.log("fetch observation failed",v)}let w,m=Date.now();try{w=Reflect.apply(l,this,r)}catch(v){throw ie(p),v}let R,a;try{if(O&&u){let v=r[0],E=r[1],V=typeof Request!="undefined"&&v instanceof Request,U=String((Y=E==null?void 0:E.method)!=null?Y:V?v.method:"GET").toUpperCase(),X=V?v.url:v,W=S(X,U);W&&(R={requestId:pe(),method:U,url:W.url,path:W.path,startedAt:m},a=(Q=E==null?void 0:E.signal)!=null?Q:V?v.signal:void 0,s&&typeof(E==null?void 0:E.body)=="string"&&(R.requestBody=L(E.body,{direction:"request",transport:"fetch",method:U,url:W.url,path:W.path},f)))}}catch(v){o.log("fetch observation failed",v)}if(!R)return ie(p),w;let C=R;D({requestId:C.requestId,transport:"fetch",method:C.method,url:C.url,path:C.path,startedAt:C.startedAt,requestBody:C.requestBody});let M=p?ye(p,o):void 0;return w.then(v=>{var V;let E;try{if(O&&u&&B){let U=(V=v.headers.get("content-type"))!=null?V:"";he(U)&&v.body&&(E=v.clone())}}catch{}q(C,v,E,M)},v=>{try{if(!O||!u)return;let E=(a==null?void 0:a.aborted)===!0||(v==null?void 0:v.name)==="AbortError"||typeof DOMException!="undefined"&&v instanceof DOMException&&v.code===DOMException.ABORT_ERR;k({requestId:C.requestId,transport:"fetch",method:C.method,url:C.url,path:C.path,status:0,ok:!1,outcome:E?"abort":"error",durationMs:Date.now()-C.startedAt})}catch(E){o.log("fetch failure observation failed",E)}}),w}}.fetch;return K(x,l),g.writable!==!0?(o.log("fetch capture unavailable: fetch is not writable"),null):(Object.defineProperty(d,"fetch",{...g,value:x}),u=!0,()=>{u=!1,G(d,"fetch",x,g,o)})},c=[];if(y.includes("xhr")){let d=I();d&&c.push(d)}if(y.includes("fetch")){let d=j();d&&c.push(d)}return c.length===0?N():(O=!0,{mode:"standard",disconnect:()=>{O=!1;for(let d of c.splice(0))d()}})}function be(e){let t=e.onNavigate;if(typeof t!="function")throw new TypeError("captureNavigation requires an onNavigate callback");let n=F(e.logger),i,o,y,f,A,s;try{if(i=window,o=i==null?void 0:i.history,!i||!o)return n.log("navigation capture unavailable: window/history missing"),N();if(A=me(o,"pushState"),s=me(o,"replaceState"),!A||!s)return n.log("navigation capture unavailable: history method descriptors missing"),N();if(y=A.descriptor.value,f=s.descriptor.value,typeof y!="function"||typeof f!="function")return n.log("navigation capture unavailable: history methods missing"),N();if(typeof i.addEventListener!="function"||typeof i.removeEventListener!="function")return n.log("navigation capture unavailable: window event methods missing"),N()}catch(h){return n.log("navigation capture unavailable: history inspection failed",h),N()}if(_(y)||_(f))return n.log("navigation capture unavailable: an equivalent capture is already active"),N();let B=!1,O=()=>({path:i.location.pathname,search:i.location.search,hash:i.location.hash}),k;try{k=O()}catch(h){return n.log("navigation capture unavailable: location inspection failed",h),N()}let D=J(n,"navigation",h=>{if(B)return t(h)}),L=h=>{if(B)try{let b=O();if(b.path===k.path&&b.search===k.search&&b.hash===k.hash)return;k=b,D({...b,source:h})}catch(b){n.log("navigation observation failed",b)}},S={pushState(...h){let b=Reflect.apply(y,this,h);return L("push"),b}}.pushState,I={replaceState(...h){let b=Reflect.apply(f,this,h);return L("replace"),b}}.replaceState;K(S,y),K(I,f);let j=()=>L("pop"),c=()=>L("hash");try{if(ve(A,S),ve(s,I),o.pushState!==S||o.replaceState!==I)throw new Error("history method replacement did not take effect");i.addEventListener("popstate",j),i.addEventListener("hashchange",c),B=!0}catch(h){return B=!1,ee(i,"popstate",j,n),ee(i,"hashchange",c,n),Z(s,I,n),Z(A,S,n),n.log("navigation capture unavailable: history methods are not writable",h),t=()=>{},D=()=>{},n=F(),N()}return{mode:"standard",disconnect:()=>{B=!1,t=()=>{},ee(i,"popstate",j,n),ee(i,"hashchange",c,n),Z(A,S,n),Z(s,I,n),D=()=>{},n=F()}}}function me(e,t){let n=e;for(;n;){let i=Object.getOwnPropertyDescriptor(n,t);if(i)return!("value"in i)||typeof i.value!="function"?null:{owner:n,key:t,descriptor:i};n=Object.getPrototypeOf(n)}return null}function ve(e,t){if(e.descriptor.writable!==!0)throw new TypeError(`${e.key} is not writable`);let n=Object.getOwnPropertyDescriptor(e.owner,e.key);if(!re(n,e.descriptor))throw new Error(`${e.key} changed during installation`);Object.defineProperty(e.owner,e.key,{...e.descriptor,value:t})}function Z(e,t,n){G(e.owner,e.key,t,e.descriptor,n,`navigation ${e.key}`)}function ee(e,t,n,i){try{e.removeEventListener(t,n)}catch(o){i.log(`navigation ${t} listener removal skipped`,o)}}function we(e){let t=e.composedPath();return t.length>0?t:e.target?[e.target]:[]}var Re="0.8.1";var je=["valueMissing","typeMismatch","patternMismatch","tooShort","tooLong","rangeUnderflow","rangeOverflow","stepMismatch","badInput","customError"];function ae(e){return je.find(t=>e.validity[t])}function Ce(e){if(!(e!=null&&e.isConnected)||!e.getClientRects().length)return!1;let t=e.ownerDocument.defaultView;if(!t)return!1;for(let n=e;n;n=n.parentElement){let i=t.getComputedStyle(n);if(n.hasAttribute("hidden")||i.display==="none"||i.visibility==="hidden"||i.visibility==="collapse"||i.opacity==="0")return!1}return!0}function Ee(e){var q,x;if(typeof e.readValidation!="function"||typeof e.onError!="function")throw new TypeError("captureInputValidation requires readValidation and onError callbacks");let{form:t}=e,n=[...e.fields],i=(q=e.maxObservationMs)!=null?q:1e4;if(!n.length||!Number.isFinite(i)||i<=0)throw new TypeError("captureInputValidation requires fields and a positive maxObservationMs");let o={mode:"unavailable",disconnect(){},beginAttempt:()=>{},requestStarted(){},refresh(){}},y=(x=t==null?void 0:t.ownerDocument)==null?void 0:x.defaultView;if(!y||!n.every(r=>r.form===t))return o;let f=!0,A=0,s,B=!1,O,k,D,L,S=[],I=()=>t.isConnected&&n.every(r=>r.isConnected&&r.form===t),j=()=>{try{let r=e.readValidation();if(r&&["clear","pending","unknown"].includes(r.status)||(r==null?void 0:r.status)==="invalid"&&typeof r.code=="string"&&["constraint","application"].includes(r.source))return r}catch{}return{status:"unknown"}},c=r=>r.status==="invalid"?JSON.stringify([r.code,r.fieldIndex]):void 0,h=()=>{s=void 0,clearTimeout(k),clearTimeout(D),k=D=void 0},b=()=>{k=void 0;let r=s;if(!f||!(r!=null&&r.confirmed))return;if(!I()){h();return}let p=r.nativeInvalid?(()=>{for(let[m,R]of n.entries()){let a=ae(R);if(a)return{status:"invalid",source:"constraint",code:a,fieldIndex:m}}return{status:"clear"}})():j();if(p.status==="clear"){r.serverBaseline=void 0;return}if(p.status!=="invalid"||p.source==="application"&&r.serverBaseline===c(p))return;let w={attemptId:r.id,startedAt:r.startedAt,timestamp:Date.now(),code:p.code,...p.fieldIndex===void 0?{}:{fieldIndex:p.fieldIndex}};h(),B=!1;try{Promise.resolve(e.onError(w)).catch(()=>{})}catch{}},T=()=>{!f||!s||k!==void 0||(k=setTimeout(b,0))},d=r=>{if(!f||!I())return;h();let p=B?c(j()):void 0;return s={id:++A,startedAt:Date.now(),confirmed:r,nativeInvalid:!1,serverBaseline:p},D=setTimeout(h,i),T(),s.id},g=()=>{O===void 0&&(O=d(!1),L=setTimeout(()=>{s&&s.id===O&&!s.confirmed&&h(),O=void 0},0))},l=(r,p,w)=>{r.addEventListener(p,w,!0),S.push(()=>r.removeEventListener(p,w,!0))},u={mode:"standard",beginAttempt:()=>d(!0),refresh:T,requestStarted(r={}){f&&(r.attemptId!==void 0&&r.attemptId!==(s==null?void 0:s.id)||s&&r.timestamp!==void 0&&r.timestamp<s.startedAt||(h(),B=!0))},disconnect(){if(f){f=!1,h(),clearTimeout(L);for(let r of S.splice(0))r()}}};try{let r=w=>{var a;let m=w.target,R=(a=m==null?void 0:m.closest)==null?void 0:a.call(m,"button,input");(R==null?void 0:R.form)===t&&!R.disabled&&["submit","image"].includes(R.type)&&g()};l(t.ownerDocument,"click",r),l(t,"click",r),l(t,"keydown",w=>{let m=w;m.key==="Enter"&&!m.isComposing&&!m.defaultPrevented&&n.includes(m.target)&&g()}),l(t,"submit",()=>{(s==null?void 0:s.id)===O&&s?(s.confirmed=!0,T()):d(!0),O=void 0}),l(t,"invalid",w=>{!s||!n.includes(w.target)||(s.confirmed=!0,s.nativeInvalid=!0,T())}),l(t,"input",w=>{n.includes(w.target)&&h()});let p=new y.MutationObserver(T);p.observe(t,{subtree:!0,childList:!0,attributes:!0,characterData:!0}),S.push(()=>p.disconnect())}catch{return u.disconnect(),o}return u}var $=require("@corbado/observe");0&&(module.exports={VERSION,captureInputValidation,captureNavigation,captureNetwork,captureWebAuthn,composedPath,inputValidationCode,isValidationMessageVisible,sanitizeAssertionResponse,sanitizeCreationOptions,sanitizeCreationResponse,sanitizeRequestOptions});

package/dist/index.mjs

@@ -1 +1 @@
-var we={creationOptions:["/user/name","/user/displayName"],creationResponse:["/clientExtensionResults/prf/results"],requestOptions:[],assertionResponse:["/response/signature","/clientExtensionResults/prf/results"]};function te(e){return Y(e,"creationOptions")}function ne(e){return Y(e,"creationResponse")}function re(e){return Y(e,"requestOptions")}function oe(e){return Y(e,"assertionResponse")}function Y(e,t){try{let n=typeof e=="string"?JSON.parse(e):e;if(!Re(n))return;let o=new Set(we[t]),i=new Set,d=(s,v,u=0)=>{if(!o.has(v)){if(s===null||typeof s=="string"||typeof s=="boolean")return s;if(typeof s=="number")return Number.isFinite(s)?s:null;if(typeof s=="object"){if(s instanceof ArrayBuffer||ArrayBuffer.isView(s))return Ce(s);if(u>64||i.has(s))throw new TypeError("Invalid telemetry payload");i.add(s);try{if(Array.isArray(s))return s.map((P,k)=>d(P,`${v}/${k}`,u+1));let B=Object.create(null);for(let P in s){let k=`${v}/${P.replace(/~/g,"~0").replace(/\//g,"~1")}`;if(o.has(k)||P==="toJSON")continue;let I=d(s[P],k,u+1);I!==void 0&&(B[P]=I)}let R=s,q=(P,k)=>{if(B[k]!==void 0||typeof R[P]!="function")return;let I=`${v}/${k}`,T=d(Reflect.apply(R[P],s,[]),I,u+1);T!==void 0&&(B[k]=T)};return v===""&&(t==="creationResponse"||t==="assertionResponse")&&q("getClientExtensionResults","clientExtensionResults"),v==="/response"&&t==="creationResponse"&&(q("getTransports","transports"),q("getAuthenticatorData","authenticatorData"),q("getPublicKey","publicKey"),q("getPublicKeyAlgorithm","publicKeyAlgorithm")),B}finally{i.delete(s)}}}};return JSON.stringify(d(n,""))}catch{return}}function Re(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)&&!(e instanceof ArrayBuffer)&&!ArrayBuffer.isView(e)}function Ce(e){let t=e instanceof ArrayBuffer?new Uint8Array(e):new Uint8Array(e.buffer,e.byteOffset,e.byteLength),n="";for(let o of t)n+=String.fromCharCode(o);return btoa(n).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}var Oe={log:()=>{}};function K(e){return e?{log:(...t)=>{try{let n=e.log(...t);if(n&&(typeof n=="object"||typeof n=="function"))try{Promise.resolve(n).catch(()=>{})}catch{}}catch{}}}:Oe}var ce=Symbol.for("corbado.autocapture.installed");function _(e){try{return typeof e=="function"&&Object.prototype.hasOwnProperty.call(e,ce)}catch{return!1}}function F(e,t){var o,i;let n=t;try{Object.defineProperty(e,ce,{value:t,configurable:!0})}catch{}try{Object.defineProperty(e,"name",{value:(o=n.name)!=null?o:"",configurable:!0})}catch{}try{Object.defineProperty(e,"length",{value:(i=n.length)!=null?i:0,configurable:!0})}catch{}return e}function M(){return{mode:"unavailable",disconnect:()=>{}}}function ie(e,t){return!!e&&"value"in e&&"value"in t&&e.value===t.value&&e.writable===t.writable&&e.enumerable===t.enumerable&&e.configurable===t.configurable}function X(e,t,n,o,i,d=String(t)){try{let s=Object.getOwnPropertyDescriptor(e,t);ie(s,{...o,value:n})&&Object.defineProperty(e,t,o)}catch(s){i.log(`${d} restoration skipped`,s)}}function z(e,t,n){let o=K(e);return i=>{try{let d=n(i);if(d&&(typeof d=="object"||typeof d=="function"))try{Promise.resolve(d).catch(s=>o.log(`${t} listener failed`,s))}catch(s){o.log(`${t} listener failed`,s)}}catch(d){o.log(`${t} listener failed`,d)}}}var de=e=>({get:e("get"),create:e("create")});function Ae(e){let t=e.onEvent;if(typeof t!="function")throw new TypeError("captureWebAuthn requires an onEvent callback");let n=K(e.logger),o=p=>(n.log(`webauthn capture unavailable: ${p}`),{...M(),surface:"none"}),i=typeof navigator=="undefined"?void 0:navigator,d=i==null?void 0:i.credentials;if(!i||!d)return o("navigator.credentials missing");let s=d,v=de(p=>s[p]);if(typeof v.get!="function"||typeof v.create!="function")return o("credentials methods missing");if(_(v.get)||_(v.create))return o("an equivalent capture is already active");let u=!1,B=0,R=z(n,"webauthn",t),q=(p,y,w)=>{let N={invoke(...l){let g=l[0];if(!u||w!=null&&w()||!ae(g)||!ae(g.publicKey))return y(this,l);let f=g.publicKey,c=`wa-${++B}`,x=y(this,l),S=ae(g.signal)?g.signal:void 0,r=Ee(p,g,f),h=b=>{u&&R({...r,ceremonyId:c,...b()})},C=()=>(S==null?void 0:S.aborted)===!0?{aborted:!0}:{};return h(()=>({phase:"started",userActivation:ke(i),...r.kind==="authentication"?{requestOptionsJson:re(f)}:{creationOptionsJson:te(f)}})),Promise.resolve(x).then(b=>(h(()=>({phase:"completed",credentialJson:p==="create"?ne(b):oe(b),...C()})),b),b=>{throw h(()=>({phase:"failed",error:b,errorName:Se(b),...C()})),b})}}.invoke;return F(N,{name:p,length:0})},P=p=>{var N;let y=q(p,(l,g)=>Reflect.apply(v[p],l,g)),w=Object.getOwnPropertyDescriptor(d,p);if(w&&(!("value"in w)||w.writable!==!0))return null;try{s[p]=y}catch{return null}if(((N=Object.getOwnPropertyDescriptor(d,p))==null?void 0:N.value)!==y){try{s[p]=v[p]}catch{}return null}return()=>{s[p]===y&&(w?s[p]=w.value:delete s[p])}},k=()=>{let p=de(()=>new WeakMap),y=(f,c)=>{let x=p[f].get(c);if(x)return x;let S=q(f,(r,h)=>Reflect.apply(c,d,h),()=>{try{let r=s[f];return r!==c&&r!==S}catch(r){return n.log("suppress check failed; ceremony unreported",r),!0}});return p[f].set(c,S),S},w=f=>{let c=Object.getOwnPropertyDescriptor(d,f);return c?c.configurable===!0||!("value"in c)||c.writable===!0:!0},N=new WeakMap,l=new Proxy(d,{get(f,c){let x=Reflect.get(d,c,d);if((c==="get"||c==="create")&&w(c))return typeof x!="function"||_(x)?x:y(c,x);if(typeof x!="function"||!w(c)||c==="constructor")return x;let S=N.get(x);if(S)return S;let r=x.bind(d);return N.set(x,r),r},set(f,c,x){return Reflect.set(d,c,x,d)}}),g=Object.getOwnPropertyDescriptor(i,"credentials");if(g&&g.configurable!==!0)return null;try{Object.defineProperty(i,"credentials",{value:l,writable:!0,enumerable:!0,configurable:!0})}catch{return null}return i.credentials!==l?null:()=>{i.credentials===l&&(g?Object.defineProperty(i,"credentials",g):delete i.credentials)}},I=(p,y)=>(u=!0,{mode:"standard",surface:p,disconnect:()=>{u=!1,y()}}),T=P("get"),j=T?P("create"):null;if(T&&j)return I("methods",()=>{T(),j()});if(T==null||T(),e.attach==="container"){let p=k();if(p)return n.log("webauthn capture attached at the credentials container"),I("container",p)}return o("credentials methods cannot be patched safely")}function Ee(e,t,n){let o=xe(t.mediation);if(e==="create")return{kind:"registration",mediation:o};let i=n;return{kind:"authentication",mediation:o,uiMode:qe(t.uiMode),credentialSet:Array.isArray(i.allowCredentials)&&i.allowCredentials.length>0?"allowlisted":"discoverable"}}function xe(e){return e===void 0?"optional":e==="silent"||e==="optional"||e==="conditional"||e==="required"?e:"unknown"}function qe(e){return e===void 0?"default":e==="immediate"?"immediate":"unknown"}function ke(e){let t=e.userActivation;return typeof(t==null?void 0:t.isActive)=="boolean"?t.isActive:void 0}function ae(e){return e!==null&&(typeof e=="object"||typeof e=="function")}function Se(e){return e instanceof DOMException?e.name:"UnknownError"}var le=0;function pe(){return le+=1,`network-${le}`}function Pe(e,t){let n=e.responseType;if(n===""||n==="text")return t(e.responseText);if(n==="json"){let o=e.response;return o==null?void 0:t(o)}}var Ie=500,fe=Symbol("body-read-timeout");function he(e){return/event-stream|octet-stream/i.test(e)?!1:/json|text|urlencoded/i.test(e)}async function ye(e,t){let n=e.body;if(!n)return;let o=n.getReader(),i;try{let d=new Promise(u=>{i=setTimeout(()=>u(fe),Ie)}),s=new TextDecoder,v=[];for(;;){let u=await Promise.race([o.read(),d]);if(u===fe){t.log("body omitted: read timed out"),o.cancel().catch(()=>{});return}if(u.done)break;v.push(s.decode(u.value,{stream:!0}))}return v.push(s.decode()),v.join("")}catch{o.cancel().catch(()=>{});return}finally{i!==void 0&&clearTimeout(i)}}function se(e){var t;(t=e==null?void 0:e.body)==null||t.cancel().catch(()=>{})}function Te(e){var y,w,N;let{onExchange:t,onRequest:n,match:o}=e;if(typeof t!="function"||typeof o!="function")throw new TypeError("captureNetwork requires onExchange and match callbacks");let i=K(e.logger),d=(y=e.transports)!=null?y:["xhr","fetch"],s=(w=e.bodyCapture)==null?void 0:w.request,v=(N=e.bodyCapture)==null?void 0:N.response,u=typeof s=="function",B=typeof v=="function",R=!1,q=z(i,"network",l=>{if(R)return t(l)}),P=z(i,"network request",l=>{if(R)return n==null?void 0:n(l)}),k=(l,g,f)=>{if(typeof f=="function")try{return f(l,g)}catch(c){i.log("body projection failed",c);return}},I=(l,g)=>{try{let f=typeof document!="undefined"?document.baseURI:void 0,c=new URL(String(l),f);return o(c,g)===!0?{url:c.href,path:c.pathname}:void 0}catch{return}},T=()=>{if(typeof XMLHttpRequest=="undefined")return i.log("xhr capture unavailable: XMLHttpRequest missing"),null;let l=XMLHttpRequest.prototype,g=Object.getOwnPropertyDescriptor(l,"open"),f=Object.getOwnPropertyDescriptor(l,"send");if(!g||!("value"in g)||typeof g.value!="function"||!f||!("value"in f)||typeof f.value!="function")return i.log("xhr capture unavailable: XMLHttpRequest methods missing"),null;let c=g.value,x=f.value;if(_(c)||_(x))return i.log("xhr capture unavailable: an equivalent capture is already active"),null;let S=new WeakMap,r=new Set,h=!1,C={open(...O){var A;let a=Reflect.apply(c,this,O);if(!R||!h)return a;try{let D=S.get(this);D&&(D.reported=!0,(A=D.cleanupListeners)==null||A.call(D));let H=String(O[0]).toUpperCase(),L=I(O[1],H);L?S.set(this,{method:H,url:L.url,path:L.path,reported:!1}):S.delete(this)}catch(D){i.log("xhr open observation failed",D)}return a}}.open,b={send(...O){let a=R&&h?S.get(this):void 0;if(!a||a.reported||a.cleanupListeners)return Reflect.apply(x,this,O);let A=()=>{},D=!1;try{a.requestId=pe();let L={direction:"request",transport:"xhr",method:a.method,url:a.url,path:a.path};a.requestBody=u&&typeof O[0]=="string"?k(O[0],L,s):void 0;let J=()=>{a.outcome===void 0&&(a.outcome="abort")},G=()=>{a.outcome===void 0&&(a.outcome="timeout")},m=()=>{a.outcome===void 0&&(a.outcome="error")},E=()=>{var $;A();try{if(!R||!h||a.reported||!a.requestId)return;a.reported=!0;let W={direction:"response",transport:"xhr",method:a.method,url:a.url,path:a.path},ee=this.status,ue={requestId:a.requestId,transport:"xhr",method:a.method,url:a.url,path:a.path,status:ee,ok:ee>=200&&ee<300,outcome:($=a.outcome)!=null?$:"load",durationMs:a.startedAt!==void 0?Date.now()-a.startedAt:void 0,responseUrl:this.responseURL||void 0,requestBody:a.requestBody,responseBody:B?Pe(this,ve=>k(ve,W,v)):void 0};a.requestEmitted?q(ue):a.pendingExchange=ue}catch(W){i.log("xhr exchange observation failed",W)}finally{S.get(this)===a&&S.delete(this)}},V=()=>{try{this.readyState===XMLHttpRequest.DONE&&this.status!==0&&E()}catch($){i.log("xhr ready-state observation failed",$)}},U=()=>E();A=()=>{for(let[$,W]of[["readystatechange",V],["abort",J],["timeout",G],["error",m],["loadend",U]])this.removeEventListener($,W);a.cleanupListeners===A&&(a.cleanupListeners=void 0),r.delete(A)},this.addEventListener("readystatechange",V),this.addEventListener("abort",J),this.addEventListener("timeout",G),this.addEventListener("error",m),this.addEventListener("loadend",U),a.cleanupListeners=A,r.add(A),a.startedAt=Date.now(),D=!0}catch(L){i.log("xhr send observation failed",L),A()}let H;try{H=Reflect.apply(x,this,O)}catch(L){throw A(),L}if(D&&a.requestId!==void 0&&a.startedAt!==void 0){a.requestEmitted=!0,P({requestId:a.requestId,transport:"xhr",method:a.method,url:a.url,path:a.path,startedAt:a.startedAt,requestBody:a.requestBody});let L=a.pendingExchange;a.pendingExchange=void 0,L&&q(L)}return H}}.send;return F(C,c),F(b,x),g.writable!==!0||f.writable!==!0?(i.log("xhr capture unavailable: XMLHttpRequest methods are not writable"),null):(Object.defineProperty(l,"open",{...g,value:C}),Object.defineProperty(l,"send",{...f,value:b}),h=!0,()=>{h=!1;for(let O of[...r])O();X(l,"open",C,g,i),X(l,"send",b,f,i)})},j=()=>{let l=globalThis,g=Object.getOwnPropertyDescriptor(l,"fetch");if(!g||!("value"in g))return i.log("fetch capture unavailable: fetch is not an own data property"),null;let f=g.value;if(typeof f!="function")return i.log("fetch capture unavailable: fetch missing"),null;if(_(f))return i.log("fetch capture unavailable: an equivalent capture is already active"),null;let c=!1,x=async(r,h,C,b)=>{try{if(!R||!c){se(C);return}let[O,a]=await Promise.all([b!=null?b:Promise.resolve(void 0),C?ye(C,i):Promise.resolve(void 0)]);if(!R||!c)return;let A={direction:"request",transport:"fetch",method:r.method,url:r.url,path:r.path},D={...A,direction:"response"},H=r.requestBody;H===void 0&&O!==void 0&&(H=k(O,A,s));let L=a!==void 0?k(a,D,v):void 0;q({requestId:r.requestId,transport:"fetch",method:r.method,url:r.url,path:r.path,status:h.status,ok:h.ok,outcome:"load",durationMs:Date.now()-r.startedAt,responseUrl:h.url||void 0,requestBody:H,responseBody:L})}catch(O){i.log("fetch exchange observation failed",O)}},S={fetch(...r){var H,L,J,G;let h;try{let m=r[0],E=r[1];if(R&&c&&u&&typeof Request!="undefined"&&m instanceof Request&&(E==null?void 0:E.body)===void 0&&m.body){let V=String((H=E==null?void 0:E.method)!=null?H:m.method).toUpperCase(),U=(L=m.headers.get("content-type"))!=null?L:"";I(m.url,V)&&he(U)&&(h=m.clone())}}catch(m){i.log("fetch observation failed",m)}let C,b=Date.now();try{C=Reflect.apply(f,this,r)}catch(m){throw se(h),m}let O,a;try{if(R&&c){let m=r[0],E=r[1],V=typeof Request!="undefined"&&m instanceof Request,U=String((J=E==null?void 0:E.method)!=null?J:V?m.method:"GET").toUpperCase(),$=V?m.url:m,W=I($,U);W&&(O={requestId:pe(),method:U,url:W.url,path:W.path,startedAt:b},a=(G=E==null?void 0:E.signal)!=null?G:V?m.signal:void 0,u&&typeof(E==null?void 0:E.body)=="string"&&(O.requestBody=k(E.body,{direction:"request",transport:"fetch",method:U,url:W.url,path:W.path},s)))}}catch(m){i.log("fetch observation failed",m)}if(!O)return se(h),C;let A=O;P({requestId:A.requestId,transport:"fetch",method:A.method,url:A.url,path:A.path,startedAt:A.startedAt,requestBody:A.requestBody});let D=h?ye(h,i):void 0;return C.then(m=>{var V;let E;try{if(R&&c&&B){let U=(V=m.headers.get("content-type"))!=null?V:"";he(U)&&m.body&&(E=m.clone())}}catch{}x(A,m,E,D)},m=>{try{if(!R||!c)return;let E=(a==null?void 0:a.aborted)===!0||(m==null?void 0:m.name)==="AbortError"||typeof DOMException!="undefined"&&m instanceof DOMException&&m.code===DOMException.ABORT_ERR;q({requestId:A.requestId,transport:"fetch",method:A.method,url:A.url,path:A.path,status:0,ok:!1,outcome:E?"abort":"error",durationMs:Date.now()-A.startedAt})}catch(E){i.log("fetch failure observation failed",E)}}),C}}.fetch;return F(S,f),g.writable!==!0?(i.log("fetch capture unavailable: fetch is not writable"),null):(Object.defineProperty(l,"fetch",{...g,value:S}),c=!0,()=>{c=!1,X(l,"fetch",S,g,i)})},p=[];if(d.includes("xhr")){let l=T();l&&p.push(l)}if(d.includes("fetch")){let l=j();l&&p.push(l)}return p.length===0?M():(R=!0,{mode:"standard",disconnect:()=>{R=!1;for(let l of p.splice(0))l()}})}function Be(e){let t=e.onNavigate;if(typeof t!="function")throw new TypeError("captureNavigation requires an onNavigate callback");let n=K(e.logger),o,i,d,s,v,u;try{if(o=window,i=o==null?void 0:o.history,!o||!i)return n.log("navigation capture unavailable: window/history missing"),M();if(v=ge(i,"pushState"),u=ge(i,"replaceState"),!v||!u)return n.log("navigation capture unavailable: history method descriptors missing"),M();if(d=v.descriptor.value,s=u.descriptor.value,typeof d!="function"||typeof s!="function")return n.log("navigation capture unavailable: history methods missing"),M();if(typeof o.addEventListener!="function"||typeof o.removeEventListener!="function")return n.log("navigation capture unavailable: window event methods missing"),M()}catch(y){return n.log("navigation capture unavailable: history inspection failed",y),M()}if(_(d)||_(s))return n.log("navigation capture unavailable: an equivalent capture is already active"),M();let B=!1,R=()=>({path:o.location.pathname,search:o.location.search,hash:o.location.hash}),q;try{q=R()}catch(y){return n.log("navigation capture unavailable: location inspection failed",y),M()}let P=z(n,"navigation",y=>{if(B)return t(y)}),k=y=>{if(B)try{let w=R();if(w.path===q.path&&w.search===q.search&&w.hash===q.hash)return;q=w,P({...w,source:y})}catch(w){n.log("navigation observation failed",w)}},I={pushState(...y){let w=Reflect.apply(d,this,y);return k("push"),w}}.pushState,T={replaceState(...y){let w=Reflect.apply(s,this,y);return k("replace"),w}}.replaceState;F(I,d),F(T,s);let j=()=>k("pop"),p=()=>k("hash");try{if(be(v,I),be(u,T),i.pushState!==I||i.replaceState!==T)throw new Error("history method replacement did not take effect");o.addEventListener("popstate",j),o.addEventListener("hashchange",p),B=!0}catch(y){return B=!1,Z(o,"popstate",j,n),Z(o,"hashchange",p,n),Q(u,T,n),Q(v,I,n),n.log("navigation capture unavailable: history methods are not writable",y),t=()=>{},P=()=>{},n=K(),M()}return{mode:"standard",disconnect:()=>{B=!1,t=()=>{},Z(o,"popstate",j,n),Z(o,"hashchange",p,n),Q(v,I,n),Q(u,T,n),P=()=>{},n=K()}}}function ge(e,t){let n=e;for(;n;){let o=Object.getOwnPropertyDescriptor(n,t);if(o)return!("value"in o)||typeof o.value!="function"?null:{owner:n,key:t,descriptor:o};n=Object.getPrototypeOf(n)}return null}function be(e,t){if(e.descriptor.writable!==!0)throw new TypeError(`${e.key} is not writable`);let n=Object.getOwnPropertyDescriptor(e.owner,e.key);if(!ie(n,e.descriptor))throw new Error(`${e.key} changed during installation`);Object.defineProperty(e.owner,e.key,{...e.descriptor,value:t})}function Q(e,t,n){X(e.owner,e.key,t,e.descriptor,n,`navigation ${e.key}`)}function Z(e,t,n,o){try{e.removeEventListener(t,n)}catch(i){o.log(`navigation ${t} listener removal skipped`,i)}}function Le(e){let t=e.composedPath();return t.length>0?t:e.target?[e.target]:[]}var Ne="0.7.0";var De=["valueMissing","typeMismatch","patternMismatch","tooShort","tooLong","rangeUnderflow","rangeOverflow","stepMismatch","badInput","customError"];function me(e){return De.find(t=>e.validity[t])}function Me(e){if(!(e!=null&&e.isConnected)||!e.getClientRects().length)return!1;let t=e.ownerDocument.defaultView;if(!t)return!1;for(let n=e;n;n=n.parentElement){let o=t.getComputedStyle(n);if(n.hasAttribute("hidden")||o.display==="none"||o.visibility==="hidden"||o.visibility==="collapse"||o.opacity==="0")return!1}return!0}function He(e){var x,S;if(typeof e.readValidation!="function"||typeof e.onError!="function")throw new TypeError("captureInputValidation requires readValidation and onError callbacks");let{form:t}=e,n=[...e.fields],o=(x=e.maxObservationMs)!=null?x:1e4;if(!n.length||!Number.isFinite(o)||o<=0)throw new TypeError("captureInputValidation requires fields and a positive maxObservationMs");let i={mode:"unavailable",disconnect(){},beginAttempt:()=>{},requestStarted(){},refresh(){}},d=(S=t==null?void 0:t.ownerDocument)==null?void 0:S.defaultView;if(!d||!n.every(r=>r.form===t))return i;let s=!0,v=0,u,B=!1,R,q,P,k,I=[],T=()=>t.isConnected&&n.every(r=>r.isConnected&&r.form===t),j=()=>{try{let r=e.readValidation();if(r&&["clear","pending","unknown"].includes(r.status)||(r==null?void 0:r.status)==="invalid"&&typeof r.code=="string"&&["constraint","application"].includes(r.source))return r}catch{}return{status:"unknown"}},p=r=>r.status==="invalid"?JSON.stringify([r.code,r.fieldIndex]):void 0,y=()=>{u=void 0,clearTimeout(q),clearTimeout(P),q=P=void 0},w=()=>{q=void 0;let r=u;if(!s||!(r!=null&&r.confirmed))return;if(!T()){y();return}let h=r.nativeInvalid?(()=>{for(let[b,O]of n.entries()){let a=me(O);if(a)return{status:"invalid",source:"constraint",code:a,fieldIndex:b}}return{status:"clear"}})():j();if(h.status==="clear"){r.serverBaseline=void 0;return}if(h.status!=="invalid"||h.source==="application"&&r.serverBaseline===p(h))return;let C={attemptId:r.id,startedAt:r.startedAt,timestamp:Date.now(),code:h.code,...h.fieldIndex===void 0?{}:{fieldIndex:h.fieldIndex}};y(),B=!1;try{Promise.resolve(e.onError(C)).catch(()=>{})}catch{}},N=()=>{!s||!u||q!==void 0||(q=setTimeout(w,0))},l=r=>{if(!s||!T())return;y();let h=B?p(j()):void 0;return u={id:++v,startedAt:Date.now(),confirmed:r,nativeInvalid:!1,serverBaseline:h},P=setTimeout(y,o),N(),u.id},g=()=>{R===void 0&&(R=l(!1),k=setTimeout(()=>{u&&u.id===R&&!u.confirmed&&y(),R=void 0},0))},f=(r,h,C)=>{r.addEventListener(h,C,!0),I.push(()=>r.removeEventListener(h,C,!0))},c={mode:"standard",beginAttempt:()=>l(!0),refresh:N,requestStarted(r={}){s&&(r.attemptId!==void 0&&r.attemptId!==(u==null?void 0:u.id)||u&&r.timestamp!==void 0&&r.timestamp<u.startedAt||(y(),B=!0))},disconnect(){if(s){s=!1,y(),clearTimeout(k);for(let r of I.splice(0))r()}}};try{let r=C=>{var a;let b=C.target,O=(a=b==null?void 0:b.closest)==null?void 0:a.call(b,"button,input");(O==null?void 0:O.form)===t&&!O.disabled&&["submit","image"].includes(O.type)&&g()};f(t.ownerDocument,"click",r),f(t,"click",r),f(t,"keydown",C=>{let b=C;b.key==="Enter"&&!b.isComposing&&!b.defaultPrevented&&n.includes(b.target)&&g()}),f(t,"submit",()=>{(u==null?void 0:u.id)===R&&u?(u.confirmed=!0,N()):l(!0),R=void 0}),f(t,"invalid",C=>{!u||!n.includes(C.target)||(u.confirmed=!0,u.nativeInvalid=!0,N())}),f(t,"input",C=>{n.includes(C.target)&&y()});let h=new d.MutationObserver(N);h.observe(t,{subtree:!0,childList:!0,attributes:!0,characterData:!0}),I.push(()=>h.disconnect())}catch{return c.disconnect(),i}return c}export{Ne as VERSION,He as captureInputValidation,Be as captureNavigation,Te as captureNetwork,Ae as captureWebAuthn,Le as composedPath,me as inputValidationCode,Me as isValidationMessageVisible,oe as sanitizeAssertionResponse,te as sanitizeCreationOptions,ne as sanitizeCreationResponse,re as sanitizeRequestOptions};
+import{sanitizeCreationOptions as ge,sanitizeCreationResponse as me,sanitizeRequestOptions as ve,sanitizeAssertionResponse as be}from"@corbado/observe";var ye={log:()=>{}};function F(e){return e?{log:(...t)=>{try{let n=e.log(...t);if(n&&(typeof n=="object"||typeof n=="function"))try{Promise.resolve(n).catch(()=>{})}catch{}}catch{}}}:ye}var oe=Symbol.for("corbado.autocapture.installed");function _(e){try{return typeof e=="function"&&Object.prototype.hasOwnProperty.call(e,oe)}catch{return!1}}function K(e,t){var a,i;let n=t;try{Object.defineProperty(e,oe,{value:t,configurable:!0})}catch{}try{Object.defineProperty(e,"name",{value:(a=n.name)!=null?a:"",configurable:!0})}catch{}try{Object.defineProperty(e,"length",{value:(i=n.length)!=null?i:0,configurable:!0})}catch{}return e}function N(){return{mode:"unavailable",disconnect:()=>{}}}function ee(e,t){return!!e&&"value"in e&&"value"in t&&e.value===t.value&&e.writable===t.writable&&e.enumerable===t.enumerable&&e.configurable===t.configurable}function $(e,t,n,a,i,y=String(t)){try{let f=Object.getOwnPropertyDescriptor(e,t);ee(f,{...a,value:n})&&Object.defineProperty(e,t,a)}catch(f){i.log(`${y} restoration skipped`,f)}}function z(e,t,n){let a=F(e);return i=>{try{let y=n(i);if(y&&(typeof y=="object"||typeof y=="function"))try{Promise.resolve(y).catch(f=>a.log(`${t} listener failed`,f))}catch(f){a.log(`${t} listener failed`,f)}}catch(y){a.log(`${t} listener failed`,y)}}}var ie=e=>({get:e("get"),create:e("create")});function we(e){let t=e.onEvent;if(typeof t!="function")throw new TypeError("captureWebAuthn requires an onEvent callback");let n=F(e.logger),a=c=>(n.log(`webauthn capture unavailable: ${c}`),{...N(),surface:"none"}),i=typeof navigator=="undefined"?void 0:navigator,y=i==null?void 0:i.credentials;if(!i||!y)return a("navigator.credentials missing");let f=y,A=ie(c=>f[c]);if(typeof A.get!="function"||typeof A.create!="function")return a("credentials methods missing");if(_(A.get)||_(A.create))return a("an equivalent capture is already active");let s=!1,B=0,O=z(n,"webauthn",t),k=(c,h,b)=>{let T={invoke(...d){let g=d[0];if(!s||b!=null&&b()||!te(g)||!te(g.publicKey))return h(this,d);let l=g.publicKey,u=`wa-${++B}`,q=h(this,d),x=te(g.signal)?g.signal:void 0,r=Re(c,g,l),p=m=>{s&&O({...r,ceremonyId:u,...m()})},w=()=>(x==null?void 0:x.aborted)===!0?{aborted:!0}:{};return p(()=>({phase:"started",userActivation:qe(i),...r.kind==="authentication"?{requestOptionsJson:ve(l)}:{creationOptionsJson:ge(l)}})),Promise.resolve(q).then(m=>(p(()=>({phase:"completed",credentialJson:c==="create"?me(m):be(m),...w()})),m),m=>{throw p(()=>({phase:"failed",error:m,errorName:Oe(m),...w()})),m})}}.invoke;return K(T,{name:c,length:0})},D=c=>{var T;let h=k(c,(d,g)=>Reflect.apply(A[c],d,g)),b=Object.getOwnPropertyDescriptor(y,c);if(b&&(!("value"in b)||b.writable!==!0))return null;try{f[c]=h}catch{return null}if(((T=Object.getOwnPropertyDescriptor(y,c))==null?void 0:T.value)!==h){try{f[c]=A[c]}catch{}return null}return()=>{f[c]===h&&(b?f[c]=b.value:delete f[c])}},L=()=>{let c=ie(()=>new WeakMap),h=(l,u)=>{let q=c[l].get(u);if(q)return q;let x=k(l,(r,p)=>Reflect.apply(u,y,p),()=>{try{let r=f[l];return r!==u&&r!==x}catch(r){return n.log("suppress check failed; ceremony unreported",r),!0}});return c[l].set(u,x),x},b=l=>{let u=Object.getOwnPropertyDescriptor(y,l);return u?u.configurable===!0||!("value"in u)||u.writable===!0:!0},T=new WeakMap,d=new Proxy(y,{get(l,u){let q=Reflect.get(y,u,y);if((u==="get"||u==="create")&&b(u))return typeof q!="function"||_(q)?q:h(u,q);if(typeof q!="function"||!b(u)||u==="constructor")return q;let x=T.get(q);if(x)return x;let r=q.bind(y);return T.set(q,r),r},set(l,u,q){return Reflect.set(y,u,q,y)}}),g=Object.getOwnPropertyDescriptor(i,"credentials");if(g&&g.configurable!==!0)return null;try{Object.defineProperty(i,"credentials",{value:d,writable:!0,enumerable:!0,configurable:!0})}catch{return null}return i.credentials!==d?null:()=>{i.credentials===d&&(g?Object.defineProperty(i,"credentials",g):delete i.credentials)}},S=(c,h)=>(s=!0,{mode:"standard",surface:c,disconnect:()=>{s=!1,h()}}),I=D("get"),j=I?D("create"):null;if(I&&j)return S("methods",()=>{I(),j()});if(I==null||I(),e.attach==="container"){let c=L();if(c)return n.log("webauthn capture attached at the credentials container"),S("container",c)}return a("credentials methods cannot be patched safely")}function Re(e,t,n){let a=Ce(t.mediation);if(e==="create")return{kind:"registration",mediation:a};let i=n;return{kind:"authentication",mediation:a,uiMode:Ee(t.uiMode),credentialSet:Array.isArray(i.allowCredentials)&&i.allowCredentials.length>0?"allowlisted":"discoverable"}}function Ce(e){return e===void 0?"optional":e==="silent"||e==="optional"||e==="conditional"||e==="required"?e:"unknown"}function Ee(e){return e===void 0?"default":e==="immediate"?"immediate":"unknown"}function qe(e){let t=e.userActivation;return typeof(t==null?void 0:t.isActive)=="boolean"?t.isActive:void 0}function te(e){return e!==null&&(typeof e=="object"||typeof e=="function")}function Oe(e){return e instanceof DOMException?e.name:"UnknownError"}var ae=0;function se(){return ae+=1,`network-${ae}`}function xe(e,t){let n=e.responseType;if(n===""||n==="text")return t(e.responseText);if(n==="json"){let a=e.response;return a==null?void 0:t(a)}}var Ae=500,ue=Symbol("body-read-timeout");function de(e){return/event-stream|octet-stream/i.test(e)?!1:/json|text|urlencoded/i.test(e)}async function ce(e,t){let n=e.body;if(!n)return;let a=n.getReader(),i;try{let y=new Promise(s=>{i=setTimeout(()=>s(ue),Ae)}),f=new TextDecoder,A=[];for(;;){let s=await Promise.race([a.read(),y]);if(s===ue){t.log("body omitted: read timed out"),a.cancel().catch(()=>{});return}if(s.done)break;A.push(f.decode(s.value,{stream:!0}))}return A.push(f.decode()),A.join("")}catch{a.cancel().catch(()=>{});return}finally{i!==void 0&&clearTimeout(i)}}function ne(e){var t;(t=e==null?void 0:e.body)==null||t.cancel().catch(()=>{})}function ke(e){var h,b,T;let{onExchange:t,onRequest:n,match:a}=e;if(typeof t!="function"||typeof a!="function")throw new TypeError("captureNetwork requires onExchange and match callbacks");let i=F(e.logger),y=(h=e.transports)!=null?h:["xhr","fetch"],f=(b=e.bodyCapture)==null?void 0:b.request,A=(T=e.bodyCapture)==null?void 0:T.response,s=typeof f=="function",B=typeof A=="function",O=!1,k=z(i,"network",d=>{if(O)return t(d)}),D=z(i,"network request",d=>{if(O)return n==null?void 0:n(d)}),L=(d,g,l)=>{if(typeof l=="function")try{return l(d,g)}catch(u){i.log("body projection failed",u);return}},S=(d,g)=>{try{let l=typeof document!="undefined"?document.baseURI:void 0,u=new URL(String(d),l);return a(u,g)===!0?{url:u.href,path:u.pathname}:void 0}catch{return}},I=()=>{if(typeof XMLHttpRequest=="undefined")return i.log("xhr capture unavailable: XMLHttpRequest missing"),null;let d=XMLHttpRequest.prototype,g=Object.getOwnPropertyDescriptor(d,"open"),l=Object.getOwnPropertyDescriptor(d,"send");if(!g||!("value"in g)||typeof g.value!="function"||!l||!("value"in l)||typeof l.value!="function")return i.log("xhr capture unavailable: XMLHttpRequest methods missing"),null;let u=g.value,q=l.value;if(_(u)||_(q))return i.log("xhr capture unavailable: an equivalent capture is already active"),null;let x=new WeakMap,r=new Set,p=!1,w={open(...R){var C;let o=Reflect.apply(u,this,R);if(!O||!p)return o;try{let M=x.get(this);M&&(M.reported=!0,(C=M.cleanupListeners)==null||C.call(M));let H=String(R[0]).toUpperCase(),P=S(R[1],H);P?x.set(this,{method:H,url:P.url,path:P.path,reported:!1}):x.delete(this)}catch(M){i.log("xhr open observation failed",M)}return o}}.open,m={send(...R){let o=O&&p?x.get(this):void 0;if(!o||o.reported||o.cleanupListeners)return Reflect.apply(q,this,R);let C=()=>{},M=!1;try{o.requestId=se();let P={direction:"request",transport:"xhr",method:o.method,url:o.url,path:o.path};o.requestBody=s&&typeof R[0]=="string"?L(R[0],P,f):void 0;let J=()=>{o.outcome===void 0&&(o.outcome="abort")},G=()=>{o.outcome===void 0&&(o.outcome="timeout")},v=()=>{o.outcome===void 0&&(o.outcome="error")},E=()=>{var X;C();try{if(!O||!p||o.reported||!o.requestId)return;o.reported=!0;let W={direction:"response",transport:"xhr",method:o.method,url:o.url,path:o.path},Z=this.status,re={requestId:o.requestId,transport:"xhr",method:o.method,url:o.url,path:o.path,status:Z,ok:Z>=200&&Z<300,outcome:(X=o.outcome)!=null?X:"load",durationMs:o.startedAt!==void 0?Date.now()-o.startedAt:void 0,responseUrl:this.responseURL||void 0,requestBody:o.requestBody,responseBody:B?xe(this,he=>L(he,W,A)):void 0};o.requestEmitted?k(re):o.pendingExchange=re}catch(W){i.log("xhr exchange observation failed",W)}finally{x.get(this)===o&&x.delete(this)}},V=()=>{try{this.readyState===XMLHttpRequest.DONE&&this.status!==0&&E()}catch(X){i.log("xhr ready-state observation failed",X)}},U=()=>E();C=()=>{for(let[X,W]of[["readystatechange",V],["abort",J],["timeout",G],["error",v],["loadend",U]])this.removeEventListener(X,W);o.cleanupListeners===C&&(o.cleanupListeners=void 0),r.delete(C)},this.addEventListener("readystatechange",V),this.addEventListener("abort",J),this.addEventListener("timeout",G),this.addEventListener("error",v),this.addEventListener("loadend",U),o.cleanupListeners=C,r.add(C),o.startedAt=Date.now(),M=!0}catch(P){i.log("xhr send observation failed",P),C()}let H;try{H=Reflect.apply(q,this,R)}catch(P){throw C(),P}if(M&&o.requestId!==void 0&&o.startedAt!==void 0){o.requestEmitted=!0,D({requestId:o.requestId,transport:"xhr",method:o.method,url:o.url,path:o.path,startedAt:o.startedAt,requestBody:o.requestBody});let P=o.pendingExchange;o.pendingExchange=void 0,P&&k(P)}return H}}.send;return K(w,u),K(m,q),g.writable!==!0||l.writable!==!0?(i.log("xhr capture unavailable: XMLHttpRequest methods are not writable"),null):(Object.defineProperty(d,"open",{...g,value:w}),Object.defineProperty(d,"send",{...l,value:m}),p=!0,()=>{p=!1;for(let R of[...r])R();$(d,"open",w,g,i),$(d,"send",m,l,i)})},j=()=>{let d=globalThis,g=Object.getOwnPropertyDescriptor(d,"fetch");if(!g||!("value"in g))return i.log("fetch capture unavailable: fetch is not an own data property"),null;let l=g.value;if(typeof l!="function")return i.log("fetch capture unavailable: fetch missing"),null;if(_(l))return i.log("fetch capture unavailable: an equivalent capture is already active"),null;let u=!1,q=async(r,p,w,m)=>{try{if(!O||!u){ne(w);return}let[R,o]=await Promise.all([m!=null?m:Promise.resolve(void 0),w?ce(w,i):Promise.resolve(void 0)]);if(!O||!u)return;let C={direction:"request",transport:"fetch",method:r.method,url:r.url,path:r.path},M={...C,direction:"response"},H=r.requestBody;H===void 0&&R!==void 0&&(H=L(R,C,f));let P=o!==void 0?L(o,M,A):void 0;k({requestId:r.requestId,transport:"fetch",method:r.method,url:r.url,path:r.path,status:p.status,ok:p.ok,outcome:"load",durationMs:Date.now()-r.startedAt,responseUrl:p.url||void 0,requestBody:H,responseBody:P})}catch(R){i.log("fetch exchange observation failed",R)}},x={fetch(...r){var H,P,J,G;let p;try{let v=r[0],E=r[1];if(O&&u&&s&&typeof Request!="undefined"&&v instanceof Request&&(E==null?void 0:E.body)===void 0&&v.body){let V=String((H=E==null?void 0:E.method)!=null?H:v.method).toUpperCase(),U=(P=v.headers.get("content-type"))!=null?P:"";S(v.url,V)&&de(U)&&(p=v.clone())}}catch(v){i.log("fetch observation failed",v)}let w,m=Date.now();try{w=Reflect.apply(l,this,r)}catch(v){throw ne(p),v}let R,o;try{if(O&&u){let v=r[0],E=r[1],V=typeof Request!="undefined"&&v instanceof Request,U=String((J=E==null?void 0:E.method)!=null?J:V?v.method:"GET").toUpperCase(),X=V?v.url:v,W=S(X,U);W&&(R={requestId:se(),method:U,url:W.url,path:W.path,startedAt:m},o=(G=E==null?void 0:E.signal)!=null?G:V?v.signal:void 0,s&&typeof(E==null?void 0:E.body)=="string"&&(R.requestBody=L(E.body,{direction:"request",transport:"fetch",method:U,url:W.url,path:W.path},f)))}}catch(v){i.log("fetch observation failed",v)}if(!R)return ne(p),w;let C=R;D({requestId:C.requestId,transport:"fetch",method:C.method,url:C.url,path:C.path,startedAt:C.startedAt,requestBody:C.requestBody});let M=p?ce(p,i):void 0;return w.then(v=>{var V;let E;try{if(O&&u&&B){let U=(V=v.headers.get("content-type"))!=null?V:"";de(U)&&v.body&&(E=v.clone())}}catch{}q(C,v,E,M)},v=>{try{if(!O||!u)return;let E=(o==null?void 0:o.aborted)===!0||(v==null?void 0:v.name)==="AbortError"||typeof DOMException!="undefined"&&v instanceof DOMException&&v.code===DOMException.ABORT_ERR;k({requestId:C.requestId,transport:"fetch",method:C.method,url:C.url,path:C.path,status:0,ok:!1,outcome:E?"abort":"error",durationMs:Date.now()-C.startedAt})}catch(E){i.log("fetch failure observation failed",E)}}),w}}.fetch;return K(x,l),g.writable!==!0?(i.log("fetch capture unavailable: fetch is not writable"),null):(Object.defineProperty(d,"fetch",{...g,value:x}),u=!0,()=>{u=!1,$(d,"fetch",x,g,i)})},c=[];if(y.includes("xhr")){let d=I();d&&c.push(d)}if(y.includes("fetch")){let d=j();d&&c.push(d)}return c.length===0?N():(O=!0,{mode:"standard",disconnect:()=>{O=!1;for(let d of c.splice(0))d()}})}function Ie(e){let t=e.onNavigate;if(typeof t!="function")throw new TypeError("captureNavigation requires an onNavigate callback");let n=F(e.logger),a,i,y,f,A,s;try{if(a=window,i=a==null?void 0:a.history,!a||!i)return n.log("navigation capture unavailable: window/history missing"),N();if(A=le(i,"pushState"),s=le(i,"replaceState"),!A||!s)return n.log("navigation capture unavailable: history method descriptors missing"),N();if(y=A.descriptor.value,f=s.descriptor.value,typeof y!="function"||typeof f!="function")return n.log("navigation capture unavailable: history methods missing"),N();if(typeof a.addEventListener!="function"||typeof a.removeEventListener!="function")return n.log("navigation capture unavailable: window event methods missing"),N()}catch(h){return n.log("navigation capture unavailable: history inspection failed",h),N()}if(_(y)||_(f))return n.log("navigation capture unavailable: an equivalent capture is already active"),N();let B=!1,O=()=>({path:a.location.pathname,search:a.location.search,hash:a.location.hash}),k;try{k=O()}catch(h){return n.log("navigation capture unavailable: location inspection failed",h),N()}let D=z(n,"navigation",h=>{if(B)return t(h)}),L=h=>{if(B)try{let b=O();if(b.path===k.path&&b.search===k.search&&b.hash===k.hash)return;k=b,D({...b,source:h})}catch(b){n.log("navigation observation failed",b)}},S={pushState(...h){let b=Reflect.apply(y,this,h);return L("push"),b}}.pushState,I={replaceState(...h){let b=Reflect.apply(f,this,h);return L("replace"),b}}.replaceState;K(S,y),K(I,f);let j=()=>L("pop"),c=()=>L("hash");try{if(pe(A,S),pe(s,I),i.pushState!==S||i.replaceState!==I)throw new Error("history method replacement did not take effect");a.addEventListener("popstate",j),a.addEventListener("hashchange",c),B=!0}catch(h){return B=!1,Q(a,"popstate",j,n),Q(a,"hashchange",c,n),Y(s,I,n),Y(A,S,n),n.log("navigation capture unavailable: history methods are not writable",h),t=()=>{},D=()=>{},n=F(),N()}return{mode:"standard",disconnect:()=>{B=!1,t=()=>{},Q(a,"popstate",j,n),Q(a,"hashchange",c,n),Y(A,S,n),Y(s,I,n),D=()=>{},n=F()}}}function le(e,t){let n=e;for(;n;){let a=Object.getOwnPropertyDescriptor(n,t);if(a)return!("value"in a)||typeof a.value!="function"?null:{owner:n,key:t,descriptor:a};n=Object.getPrototypeOf(n)}return null}function pe(e,t){if(e.descriptor.writable!==!0)throw new TypeError(`${e.key} is not writable`);let n=Object.getOwnPropertyDescriptor(e.owner,e.key);if(!ee(n,e.descriptor))throw new Error(`${e.key} changed during installation`);Object.defineProperty(e.owner,e.key,{...e.descriptor,value:t})}function Y(e,t,n){$(e.owner,e.key,t,e.descriptor,n,`navigation ${e.key}`)}function Q(e,t,n,a){try{e.removeEventListener(t,n)}catch(i){a.log(`navigation ${t} listener removal skipped`,i)}}function Pe(e){let t=e.composedPath();return t.length>0?t:e.target?[e.target]:[]}var Se="0.8.1";var Te=["valueMissing","typeMismatch","patternMismatch","tooShort","tooLong","rangeUnderflow","rangeOverflow","stepMismatch","badInput","customError"];function fe(e){return Te.find(t=>e.validity[t])}function Le(e){if(!(e!=null&&e.isConnected)||!e.getClientRects().length)return!1;let t=e.ownerDocument.defaultView;if(!t)return!1;for(let n=e;n;n=n.parentElement){let a=t.getComputedStyle(n);if(n.hasAttribute("hidden")||a.display==="none"||a.visibility==="hidden"||a.visibility==="collapse"||a.opacity==="0")return!1}return!0}function Be(e){var q,x;if(typeof e.readValidation!="function"||typeof e.onError!="function")throw new TypeError("captureInputValidation requires readValidation and onError callbacks");let{form:t}=e,n=[...e.fields],a=(q=e.maxObservationMs)!=null?q:1e4;if(!n.length||!Number.isFinite(a)||a<=0)throw new TypeError("captureInputValidation requires fields and a positive maxObservationMs");let i={mode:"unavailable",disconnect(){},beginAttempt:()=>{},requestStarted(){},refresh(){}},y=(x=t==null?void 0:t.ownerDocument)==null?void 0:x.defaultView;if(!y||!n.every(r=>r.form===t))return i;let f=!0,A=0,s,B=!1,O,k,D,L,S=[],I=()=>t.isConnected&&n.every(r=>r.isConnected&&r.form===t),j=()=>{try{let r=e.readValidation();if(r&&["clear","pending","unknown"].includes(r.status)||(r==null?void 0:r.status)==="invalid"&&typeof r.code=="string"&&["constraint","application"].includes(r.source))return r}catch{}return{status:"unknown"}},c=r=>r.status==="invalid"?JSON.stringify([r.code,r.fieldIndex]):void 0,h=()=>{s=void 0,clearTimeout(k),clearTimeout(D),k=D=void 0},b=()=>{k=void 0;let r=s;if(!f||!(r!=null&&r.confirmed))return;if(!I()){h();return}let p=r.nativeInvalid?(()=>{for(let[m,R]of n.entries()){let o=fe(R);if(o)return{status:"invalid",source:"constraint",code:o,fieldIndex:m}}return{status:"clear"}})():j();if(p.status==="clear"){r.serverBaseline=void 0;return}if(p.status!=="invalid"||p.source==="application"&&r.serverBaseline===c(p))return;let w={attemptId:r.id,startedAt:r.startedAt,timestamp:Date.now(),code:p.code,...p.fieldIndex===void 0?{}:{fieldIndex:p.fieldIndex}};h(),B=!1;try{Promise.resolve(e.onError(w)).catch(()=>{})}catch{}},T=()=>{!f||!s||k!==void 0||(k=setTimeout(b,0))},d=r=>{if(!f||!I())return;h();let p=B?c(j()):void 0;return s={id:++A,startedAt:Date.now(),confirmed:r,nativeInvalid:!1,serverBaseline:p},D=setTimeout(h,a),T(),s.id},g=()=>{O===void 0&&(O=d(!1),L=setTimeout(()=>{s&&s.id===O&&!s.confirmed&&h(),O=void 0},0))},l=(r,p,w)=>{r.addEventListener(p,w,!0),S.push(()=>r.removeEventListener(p,w,!0))},u={mode:"standard",beginAttempt:()=>d(!0),refresh:T,requestStarted(r={}){f&&(r.attemptId!==void 0&&r.attemptId!==(s==null?void 0:s.id)||s&&r.timestamp!==void 0&&r.timestamp<s.startedAt||(h(),B=!0))},disconnect(){if(f){f=!1,h(),clearTimeout(L);for(let r of S.splice(0))r()}}};try{let r=w=>{var o;let m=w.target,R=(o=m==null?void 0:m.closest)==null?void 0:o.call(m,"button,input");(R==null?void 0:R.form)===t&&!R.disabled&&["submit","image"].includes(R.type)&&g()};l(t.ownerDocument,"click",r),l(t,"click",r),l(t,"keydown",w=>{let m=w;m.key==="Enter"&&!m.isComposing&&!m.defaultPrevented&&n.includes(m.target)&&g()}),l(t,"submit",()=>{(s==null?void 0:s.id)===O&&s?(s.confirmed=!0,T()):d(!0),O=void 0}),l(t,"invalid",w=>{!s||!n.includes(w.target)||(s.confirmed=!0,s.nativeInvalid=!0,T())}),l(t,"input",w=>{n.includes(w.target)&&h()});let p=new y.MutationObserver(T);p.observe(t,{subtree:!0,childList:!0,attributes:!0,characterData:!0}),S.push(()=>p.disconnect())}catch{return u.disconnect(),i}return u}import{sanitizeCreationOptions as et,sanitizeCreationResponse as tt,sanitizeRequestOptions as nt,sanitizeAssertionResponse as rt}from"@corbado/observe";export{Se as VERSION,Be as captureInputValidation,Ie as captureNavigation,ke as captureNetwork,we as captureWebAuthn,Pe as composedPath,fe as inputValidationCode,Le as isValidationMessageVisible,rt as sanitizeAssertionResponse,et as sanitizeCreationOptions,tt as sanitizeCreationResponse,nt as sanitizeRequestOptions};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corbado/autocapture",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "description": "Observer-style capture helpers for WebAuthn ceremonies, selected network exchanges, in-app navigation, and composed event paths.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -14,19 +14,24 @@
     "lint": "tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
-    "test:e2e": "pnpm build && playwright test --config e2e/playwright.config.ts",
+    "test:e2e": "pnpm --filter @corbado/autocapture... build && playwright test --config e2e/playwright.config.ts",
     "check:dist": "es-check es2019 './dist/index.js' && es-check es2019 './dist/index.mjs' --module",
     "format": "prettier --write 'src/**/*.ts' 'e2e/**/*.ts'",
     "format:check": "prettier --check 'src/**/*.ts' 'e2e/**/*.ts'"
   },
   "devDependencies": {
+    "@corbado/observe": "workspace:*",
     "@playwright/test": "^1.57.0",
     "@types/node": "^20",
     "es-check": "9.6.4",
+    "esbuild": "^0.27.0",
     "jsdom": "29.1.1",
     "prettier": "^3.7.4",
     "tsup": "8.5.1",
     "typescript": "6.0.3",
     "vitest": "^4.1.0"
+  },
+  "peerDependencies": {
+    "@corbado/observe": "^0.16.1"
   }
 }