@corbado/autocapture 1.0.1 → 1.2.0

package/dist/types-lamU1Fd3.d.mts

@@ -0,0 +1,317 @@
+import { WebAuthnIdentifierProjectors } from '@corbado/observe';
+
+/** Receives optional diagnostics. Capture functions remain silent when no logger is provided. */
+type Logger = {
+    /** Records a non-fatal diagnostic message. */
+    log: (...args: unknown[]) => void;
+};
+/** Controls a capture session. */
+type CaptureHandle = {
+    /**
+     * Result of starting the capture.
+     *
+     * - `"standard"`: capture started normally.
+     * - `"unavailable"`: capture could not be started and will not emit events.
+     */
+    readonly mode: "standard" | "unavailable";
+    /** Stops future event delivery. Safe to call more than once. */
+    disconnect(): void;
+};
+/** Normalized Credential Management mediation. Missing mediation defaults to `optional`. */
+type CredentialMediation = "silent" | "optional" | "conditional" | "required" | "unknown";
+/** Normalized Credential Management mediation of a WebAuthn ceremony. */
+type WebAuthnMediation = CredentialMediation;
+/** Normalized Credential Management UI mode for authentication ceremonies. */
+type WebAuthnUiMode = "default" | "immediate" | "unknown";
+/** Browser-native facts that remain stable for one ceremony. */
+type WebAuthnCeremonyContext = {
+    kind: "authentication";
+    mediation: WebAuthnMediation;
+    uiMode: WebAuthnUiMode;
+    /** Whether the RP supplied a non-empty allow list or requested discoverable credentials. */
+    credentialSet: "allowlisted" | "discoverable";
+} | {
+    kind: "registration";
+    mediation: WebAuthnMediation;
+};
+type WebAuthnCeremonyBase = WebAuthnCeremonyContext & {
+    /** Identifier shared by all events belonging to the same ceremony. */
+    ceremonyId: string;
+};
+type WebAuthnCeremonyStartedEvent = WebAuthnCeremonyBase & {
+    phase: "started";
+    /** Whether transient user activation was active when the ceremony started, when exposed by the browser. */
+    userActivation?: boolean;
+    /**
+     * JSON-encoded authentication publicKey options. All fields are retained.
+     * Binary values are base64url-encoded. Treat this value as sensitive telemetry.
+     */
+    requestOptionsJson?: string;
+    /** Creation publicKey options with user.name and user.displayName removed. */
+    creationOptionsJson?: string;
+};
+type WebAuthnCeremonyCompletedEvent = WebAuthnCeremonyBase & {
+    phase: "completed";
+    /** JSON-encoded credential after the centralized blacklist; present only when applicable and serializable. Treat this value as sensitive telemetry. */
+    credentialJson?: string;
+    /** A credential manager may complete even after the ceremony signal was aborted. */
+    aborted?: true;
+};
+type WebAuthnCeremonyFailedEvent = WebAuthnCeremonyBase & {
+    phase: "failed";
+    /** Rejection value from the failed ceremony. This may contain application-specific data. */
+    error: unknown;
+    /** DOM exception name, or `UnknownError` when no name is available. */
+    errorName: string;
+    /** Present when the request signal was aborted before settlement. */
+    aborted?: true;
+};
+/** A protocol-native lifecycle event for WebAuthn authentication or registration. */
+type WebAuthnCeremonyEvent = WebAuthnCeremonyStartedEvent | WebAuthnCeremonyCompletedEvent | WebAuthnCeremonyFailedEvent;
+/**
+ * Surface WebAuthn capture may attach to.
+ *
+ * - `"methods"`: `credentials.get` / `credentials.create` only.
+ * - `"container"`: additionally the `navigator.credentials` container, used when the methods are
+ *   held by another integration in a form that cannot be shared.
+ */
+type WebAuthnAttachSurface = "methods" | "container";
+/** Options for {@link captureWebAuthn}. */
+type WebAuthnCaptureOptions = {
+    /** Receives WebAuthn lifecycle events. Return values are not awaited. */
+    onEvent: (event: WebAuthnCeremonyEvent) => void;
+    /** Optional diagnostic logger. */
+    logger?: Logger;
+    /**
+     * Synchronous SDK user identifier projection for creation user.id and response userHandle.
+     * Missing callbacks preserve user IDs; callback errors omit them. Credential IDs stay unchanged.
+     * Use the same projector in network fallback serializers.
+     * Projection affects telemetry only; authentication arguments, results and errors stay unchanged.
+     */
+    identifierProjectors?: WebAuthnIdentifierProjectors;
+    /**
+     * Highest surface capture may attach to. Defaults to `"methods"`.
+     *
+     * With `"container"`, a capture that cannot patch the methods attaches to the
+     * `navigator.credentials` container instead: reads of `get`/`create` are observed while the
+     * integration holding them keeps handling the ceremony. The methods surface is always tried
+     * first, so this changes nothing when it is available.
+     */
+    attach?: WebAuthnAttachSurface;
+};
+/**
+ * Handle returned by {@link captureWebAuthn}.
+ *
+ * `surface` reports where the capture actually attached, which is not implied by `mode`: an
+ * `attach: "container"` capture reports `mode: "standard"` from either surface.
+ */
+type WebAuthnCaptureHandle = CaptureHandle & {
+    /** Surface this capture attached to; `"none"` when `mode` is `"unavailable"`. */
+    readonly surface: WebAuthnAttachSurface | "none";
+};
+/** FedCM request context. Missing context defaults to `signin`. */
+type FederatedIdentityContext = "signin" | "signup" | "use" | "continue" | "unknown";
+/** FedCM UI mode: `passive` is a prompt the browser shows by itself, `active` follows a user gesture. Missing mode defaults to `passive`. */
+type FederatedIdentityMode = "passive" | "active" | "unknown";
+/** An identity provider named in a FedCM request. Nonce and parameters are never read. */
+type FederatedIdentityProvider = {
+    /** The provider's FedCM config file URL; it names the provider. */
+    configURL: string;
+    /** The relying party's public client ID at the provider. */
+    clientId?: string;
+};
+type FederatedIdentityBase = {
+    /** Identifier shared by all events belonging to the same request. */
+    requestId: string;
+};
+type FederatedIdentityStartedEvent = FederatedIdentityBase & {
+    phase: "started";
+    /** Providers with a string `configURL`, in request order. */
+    providers: FederatedIdentityProvider[];
+    context: FederatedIdentityContext;
+    mode: FederatedIdentityMode;
+    mediation: CredentialMediation;
+    /** Whether transient user activation was active when the request started, when exposed by the browser. */
+    userActivation?: boolean;
+};
+type FederatedIdentityCompletedEvent = FederatedIdentityBase & {
+    phase: "completed";
+    /** Config file URL of the provider whose account was chosen, when the browser exposes it. */
+    configURL?: string;
+    /** Whether the browser chose the account without user interaction, when exposed. */
+    isAutoSelected?: boolean;
+};
+type FederatedIdentityFailedEvent = FederatedIdentityBase & {
+    phase: "failed";
+    /**
+     * DOM exception name, or `UnknownError`. Typical values: `NotAllowedError` (declined or blocked),
+     * `NetworkError` (no account, provider unavailable or cooldown), `AbortError`,
+     * `IdentityCredentialError` (the provider refused after an account was chosen). `NoCredential`
+     * when the request resolved without a credential.
+     */
+    errorName: string;
+    /** Error code of an `IdentityCredentialError`, when non-empty. */
+    code?: string;
+    /** Present when the request signal was aborted before settlement. */
+    aborted?: true;
+};
+/**
+ * Lifecycle event of a FedCM request (`navigator.credentials.get({ identity })`). Tokens, nonces,
+ * parameters and login hints never appear in events.
+ */
+type FederatedIdentityEvent = FederatedIdentityStartedEvent | FederatedIdentityCompletedEvent | FederatedIdentityFailedEvent;
+/** Options for {@link captureFederatedIdentity}. */
+type FederatedIdentityCaptureOptions = {
+    /** Receives FedCM lifecycle events. Return values are not awaited. */
+    onEvent: (event: FederatedIdentityEvent) => void;
+    /** Optional diagnostic logger. */
+    logger?: Logger;
+    /**
+     * Highest surface capture may attach to when no other capture is attached yet; see
+     * {@link WebAuthnCaptureOptions.attach}. Defaults to `"methods"`.
+     */
+    attach?: WebAuthnAttachSurface;
+};
+/** Handle returned by {@link captureFederatedIdentity}. */
+type FederatedIdentityCaptureHandle = CaptureHandle & {
+    /** Surface the shared attachment uses; `"none"` when `mode` is `"unavailable"`. */
+    readonly surface: WebAuthnAttachSurface | "none";
+};
+/** Network API used for an observed exchange. */
+type NetworkTransport = "xhr" | "fetch";
+/** Direction of a projected body within an observed network exchange. */
+type NetworkBodyDirection = "request" | "response";
+/** A matched network request immediately after the platform accepted it. */
+type HttpRequestStarted<RequestBody = unknown> = {
+    /** Identifier shared with the eventual {@link HttpExchange}. */
+    requestId: string;
+    /** Network API used for the request. */
+    transport: NetworkTransport;
+    /** Uppercase HTTP method. */
+    method: string;
+    /** Resolved absolute request input URL. */
+    url: string;
+    /** Pathname component of the request URL. */
+    path: string;
+    /** Timestamp captured at the request boundary. */
+    startedAt: number;
+    /** Request-body value returned by the configured projector, when synchronously available. */
+    requestBody?: RequestBody;
+};
+/** An observed network request and its outcome. */
+type HttpExchange<RequestBody = unknown, ResponseBody = unknown> = {
+    /** Identifier shared with the corresponding {@link HttpRequestStarted}. */
+    requestId: string;
+    /** Network API used for the request. */
+    transport: NetworkTransport;
+    /** Uppercase HTTP method. */
+    method: string;
+    /**
+     * Resolved absolute request input URL, including its query string and
+     * fragment. Redact it before forwarding if either component may be sensitive.
+     */
+    url: string;
+    /** Pathname component of the request URL. */
+    path: string;
+    /** HTTP status code, or `0` when a status is unavailable. */
+    status: number;
+    /** Whether the status code represents a successful response. */
+    ok: boolean;
+    /**
+     * How the request completed. `load` includes successful and non-successful
+     * HTTP responses; inspect `ok` or `status` for HTTP success.
+     */
+    outcome: "load" | "abort" | "timeout" | "error";
+    /** Elapsed request time in milliseconds, when available. */
+    durationMs?: number;
+    /**
+     * Final absolute response URL, when available. This may differ from `url`
+     * after redirects and may contain sensitive query or fragment values.
+     */
+    responseUrl?: string;
+    /** Request-body value returned by the configured projector, when available. */
+    requestBody?: RequestBody;
+    /** Response-body value returned by the configured projector, when available. */
+    responseBody?: ResponseBody;
+};
+/** Metadata supplied to a body projector for one matched exchange. */
+type NetworkBodyProjectionContext<Direction extends NetworkBodyDirection = NetworkBodyDirection> = {
+    /** Whether the observed body belongs to the request or response. */
+    direction: Direction;
+    /** Network API used by the application. */
+    transport: NetworkTransport;
+    /** Uppercase HTTP method. */
+    method: string;
+    /** Resolved absolute request URL. */
+    url: string;
+    /** Pathname component of the request URL. */
+    path: string;
+};
+/**
+ * Synchronously selects the only body data that may leave network capture.
+ * Textual bodies are supplied as strings; an XHR with `responseType="json"`
+ * supplies the browser-parsed value. Returning `undefined`, throwing, or
+ * returning a Promise omits the body without affecting the application.
+ * `ProjectedBody` describes the exact value delivered to callbacks.
+ */
+type NetworkBodyProjector<ProjectedBody = unknown, Direction extends NetworkBodyDirection = NetworkBodyDirection> = (body: unknown, context: NetworkBodyProjectionContext<Direction>) => ProjectedBody | undefined;
+/**
+ * Options for {@link captureNetwork}. Request and response body types are
+ * inferred from their projectors and propagated to the corresponding callbacks.
+ */
+type NetworkCaptureOptions<RequestBody = unknown, ResponseBody = unknown> = {
+    /**
+     * Selects requests to observe. The URL is resolved against the document base
+     * URL and the method is uppercase. Return `true` to observe the request.
+     * This callback must return synchronously; Promise results are not matched.
+     */
+    match: (url: URL, method: string) => boolean;
+    /** Receives completed network exchanges. Return values are not awaited. */
+    onExchange: (exchange: HttpExchange<NoInfer<RequestBody>, NoInfer<ResponseBody>>) => void;
+    /**
+     * Receives matched requests after the platform call succeeds. The request ID
+     * matches the eventual exchange. Return values are not awaited.
+     */
+    onRequest?: (request: HttpRequestStarted<NoInfer<RequestBody>>) => void;
+    /**
+     * Network APIs to observe. Defaults to both `xhr` and `fetch`. Unavailable
+     * transports are skipped if at least one requested transport can be observed.
+     */
+    transports?: readonly NetworkTransport[];
+    /**
+     * Best-effort body observation, enabled independently per direction by a
+     * mandatory projector. Without a projector, that direction is never read.
+     * Autocapture performs no generic parsing or redaction: the projector owns
+     * data minimization and its return value is the only body data reported.
+     */
+    bodyCapture?: {
+        /** Projects a request body. */
+        request?: NetworkBodyProjector<RequestBody, "request">;
+        /** Projects a response body. */
+        response?: NetworkBodyProjector<ResponseBody, "response">;
+    };
+    /** Optional diagnostic logger. */
+    logger?: Logger;
+};
+/** Mechanism that produced a navigation event. */
+type NavigationSource = "push" | "replace" | "pop" | "hash";
+/** A same-document navigation. */
+type NavigationEvent = {
+    /** Current URL pathname. */
+    path: string;
+    /** Current URL query string, including the leading `?` when present. May contain sensitive data. */
+    search: string;
+    /** Current URL fragment, including the leading `#` when present. May contain sensitive data. */
+    hash: string;
+    /** Mechanism that produced the event. */
+    source: NavigationSource;
+};
+/** Options for {@link captureNavigation}. */
+type NavigationCaptureOptions = {
+    /** Receives same-document navigation events. Return values are not awaited. */
+    onNavigate: (event: NavigationEvent) => void;
+    /** Optional diagnostic logger. */
+    logger?: Logger;
+};
+
+export type { CaptureHandle as C, FederatedIdentityCaptureOptions as F, HttpExchange as H, Logger as L, NetworkCaptureOptions as N, WebAuthnCaptureOptions as W, WebAuthnCaptureHandle as a, FederatedIdentityCaptureHandle as b, NavigationCaptureOptions as c, CredentialMediation as d, FederatedIdentityCompletedEvent as e, FederatedIdentityContext as f, FederatedIdentityEvent as g, FederatedIdentityFailedEvent as h, FederatedIdentityMode as i, FederatedIdentityProvider as j, FederatedIdentityStartedEvent as k, HttpRequestStarted as l, NavigationEvent as m, NavigationSource as n, NetworkBodyDirection as o, NetworkBodyProjectionContext as p, NetworkBodyProjector as q, NetworkTransport as r, WebAuthnAttachSurface as s, WebAuthnCeremonyCompletedEvent as t, WebAuthnCeremonyContext as u, WebAuthnCeremonyEvent as v, WebAuthnCeremonyFailedEvent as w, WebAuthnCeremonyStartedEvent as x, WebAuthnMediation as y, WebAuthnUiMode as z };

package/dist/types-lamU1Fd3.d.ts

@@ -0,0 +1,317 @@
+import { WebAuthnIdentifierProjectors } from '@corbado/observe';
+
+/** Receives optional diagnostics. Capture functions remain silent when no logger is provided. */
+type Logger = {
+    /** Records a non-fatal diagnostic message. */
+    log: (...args: unknown[]) => void;
+};
+/** Controls a capture session. */
+type CaptureHandle = {
+    /**
+     * Result of starting the capture.
+     *
+     * - `"standard"`: capture started normally.
+     * - `"unavailable"`: capture could not be started and will not emit events.
+     */
+    readonly mode: "standard" | "unavailable";
+    /** Stops future event delivery. Safe to call more than once. */
+    disconnect(): void;
+};
+/** Normalized Credential Management mediation. Missing mediation defaults to `optional`. */
+type CredentialMediation = "silent" | "optional" | "conditional" | "required" | "unknown";
+/** Normalized Credential Management mediation of a WebAuthn ceremony. */
+type WebAuthnMediation = CredentialMediation;
+/** Normalized Credential Management UI mode for authentication ceremonies. */
+type WebAuthnUiMode = "default" | "immediate" | "unknown";
+/** Browser-native facts that remain stable for one ceremony. */
+type WebAuthnCeremonyContext = {
+    kind: "authentication";
+    mediation: WebAuthnMediation;
+    uiMode: WebAuthnUiMode;
+    /** Whether the RP supplied a non-empty allow list or requested discoverable credentials. */
+    credentialSet: "allowlisted" | "discoverable";
+} | {
+    kind: "registration";
+    mediation: WebAuthnMediation;
+};
+type WebAuthnCeremonyBase = WebAuthnCeremonyContext & {
+    /** Identifier shared by all events belonging to the same ceremony. */
+    ceremonyId: string;
+};
+type WebAuthnCeremonyStartedEvent = WebAuthnCeremonyBase & {
+    phase: "started";
+    /** Whether transient user activation was active when the ceremony started, when exposed by the browser. */
+    userActivation?: boolean;
+    /**
+     * JSON-encoded authentication publicKey options. All fields are retained.
+     * Binary values are base64url-encoded. Treat this value as sensitive telemetry.
+     */
+    requestOptionsJson?: string;
+    /** Creation publicKey options with user.name and user.displayName removed. */
+    creationOptionsJson?: string;
+};
+type WebAuthnCeremonyCompletedEvent = WebAuthnCeremonyBase & {
+    phase: "completed";
+    /** JSON-encoded credential after the centralized blacklist; present only when applicable and serializable. Treat this value as sensitive telemetry. */
+    credentialJson?: string;
+    /** A credential manager may complete even after the ceremony signal was aborted. */
+    aborted?: true;
+};
+type WebAuthnCeremonyFailedEvent = WebAuthnCeremonyBase & {
+    phase: "failed";
+    /** Rejection value from the failed ceremony. This may contain application-specific data. */
+    error: unknown;
+    /** DOM exception name, or `UnknownError` when no name is available. */
+    errorName: string;
+    /** Present when the request signal was aborted before settlement. */
+    aborted?: true;
+};
+/** A protocol-native lifecycle event for WebAuthn authentication or registration. */
+type WebAuthnCeremonyEvent = WebAuthnCeremonyStartedEvent | WebAuthnCeremonyCompletedEvent | WebAuthnCeremonyFailedEvent;
+/**
+ * Surface WebAuthn capture may attach to.
+ *
+ * - `"methods"`: `credentials.get` / `credentials.create` only.
+ * - `"container"`: additionally the `navigator.credentials` container, used when the methods are
+ *   held by another integration in a form that cannot be shared.
+ */
+type WebAuthnAttachSurface = "methods" | "container";
+/** Options for {@link captureWebAuthn}. */
+type WebAuthnCaptureOptions = {
+    /** Receives WebAuthn lifecycle events. Return values are not awaited. */
+    onEvent: (event: WebAuthnCeremonyEvent) => void;
+    /** Optional diagnostic logger. */
+    logger?: Logger;
+    /**
+     * Synchronous SDK user identifier projection for creation user.id and response userHandle.
+     * Missing callbacks preserve user IDs; callback errors omit them. Credential IDs stay unchanged.
+     * Use the same projector in network fallback serializers.
+     * Projection affects telemetry only; authentication arguments, results and errors stay unchanged.
+     */
+    identifierProjectors?: WebAuthnIdentifierProjectors;
+    /**
+     * Highest surface capture may attach to. Defaults to `"methods"`.
+     *
+     * With `"container"`, a capture that cannot patch the methods attaches to the
+     * `navigator.credentials` container instead: reads of `get`/`create` are observed while the
+     * integration holding them keeps handling the ceremony. The methods surface is always tried
+     * first, so this changes nothing when it is available.
+     */
+    attach?: WebAuthnAttachSurface;
+};
+/**
+ * Handle returned by {@link captureWebAuthn}.
+ *
+ * `surface` reports where the capture actually attached, which is not implied by `mode`: an
+ * `attach: "container"` capture reports `mode: "standard"` from either surface.
+ */
+type WebAuthnCaptureHandle = CaptureHandle & {
+    /** Surface this capture attached to; `"none"` when `mode` is `"unavailable"`. */
+    readonly surface: WebAuthnAttachSurface | "none";
+};
+/** FedCM request context. Missing context defaults to `signin`. */
+type FederatedIdentityContext = "signin" | "signup" | "use" | "continue" | "unknown";
+/** FedCM UI mode: `passive` is a prompt the browser shows by itself, `active` follows a user gesture. Missing mode defaults to `passive`. */
+type FederatedIdentityMode = "passive" | "active" | "unknown";
+/** An identity provider named in a FedCM request. Nonce and parameters are never read. */
+type FederatedIdentityProvider = {
+    /** The provider's FedCM config file URL; it names the provider. */
+    configURL: string;
+    /** The relying party's public client ID at the provider. */
+    clientId?: string;
+};
+type FederatedIdentityBase = {
+    /** Identifier shared by all events belonging to the same request. */
+    requestId: string;
+};
+type FederatedIdentityStartedEvent = FederatedIdentityBase & {
+    phase: "started";
+    /** Providers with a string `configURL`, in request order. */
+    providers: FederatedIdentityProvider[];
+    context: FederatedIdentityContext;
+    mode: FederatedIdentityMode;
+    mediation: CredentialMediation;
+    /** Whether transient user activation was active when the request started, when exposed by the browser. */
+    userActivation?: boolean;
+};
+type FederatedIdentityCompletedEvent = FederatedIdentityBase & {
+    phase: "completed";
+    /** Config file URL of the provider whose account was chosen, when the browser exposes it. */
+    configURL?: string;
+    /** Whether the browser chose the account without user interaction, when exposed. */
+    isAutoSelected?: boolean;
+};
+type FederatedIdentityFailedEvent = FederatedIdentityBase & {
+    phase: "failed";
+    /**
+     * DOM exception name, or `UnknownError`. Typical values: `NotAllowedError` (declined or blocked),
+     * `NetworkError` (no account, provider unavailable or cooldown), `AbortError`,
+     * `IdentityCredentialError` (the provider refused after an account was chosen). `NoCredential`
+     * when the request resolved without a credential.
+     */
+    errorName: string;
+    /** Error code of an `IdentityCredentialError`, when non-empty. */
+    code?: string;
+    /** Present when the request signal was aborted before settlement. */
+    aborted?: true;
+};
+/**
+ * Lifecycle event of a FedCM request (`navigator.credentials.get({ identity })`). Tokens, nonces,
+ * parameters and login hints never appear in events.
+ */
+type FederatedIdentityEvent = FederatedIdentityStartedEvent | FederatedIdentityCompletedEvent | FederatedIdentityFailedEvent;
+/** Options for {@link captureFederatedIdentity}. */
+type FederatedIdentityCaptureOptions = {
+    /** Receives FedCM lifecycle events. Return values are not awaited. */
+    onEvent: (event: FederatedIdentityEvent) => void;
+    /** Optional diagnostic logger. */
+    logger?: Logger;
+    /**
+     * Highest surface capture may attach to when no other capture is attached yet; see
+     * {@link WebAuthnCaptureOptions.attach}. Defaults to `"methods"`.
+     */
+    attach?: WebAuthnAttachSurface;
+};
+/** Handle returned by {@link captureFederatedIdentity}. */
+type FederatedIdentityCaptureHandle = CaptureHandle & {
+    /** Surface the shared attachment uses; `"none"` when `mode` is `"unavailable"`. */
+    readonly surface: WebAuthnAttachSurface | "none";
+};
+/** Network API used for an observed exchange. */
+type NetworkTransport = "xhr" | "fetch";
+/** Direction of a projected body within an observed network exchange. */
+type NetworkBodyDirection = "request" | "response";
+/** A matched network request immediately after the platform accepted it. */
+type HttpRequestStarted<RequestBody = unknown> = {
+    /** Identifier shared with the eventual {@link HttpExchange}. */
+    requestId: string;
+    /** Network API used for the request. */
+    transport: NetworkTransport;
+    /** Uppercase HTTP method. */
+    method: string;
+    /** Resolved absolute request input URL. */
+    url: string;
+    /** Pathname component of the request URL. */
+    path: string;
+    /** Timestamp captured at the request boundary. */
+    startedAt: number;
+    /** Request-body value returned by the configured projector, when synchronously available. */
+    requestBody?: RequestBody;
+};
+/** An observed network request and its outcome. */
+type HttpExchange<RequestBody = unknown, ResponseBody = unknown> = {
+    /** Identifier shared with the corresponding {@link HttpRequestStarted}. */
+    requestId: string;
+    /** Network API used for the request. */
+    transport: NetworkTransport;
+    /** Uppercase HTTP method. */
+    method: string;
+    /**
+     * Resolved absolute request input URL, including its query string and
+     * fragment. Redact it before forwarding if either component may be sensitive.
+     */
+    url: string;
+    /** Pathname component of the request URL. */
+    path: string;
+    /** HTTP status code, or `0` when a status is unavailable. */
+    status: number;
+    /** Whether the status code represents a successful response. */
+    ok: boolean;
+    /**
+     * How the request completed. `load` includes successful and non-successful
+     * HTTP responses; inspect `ok` or `status` for HTTP success.
+     */
+    outcome: "load" | "abort" | "timeout" | "error";
+    /** Elapsed request time in milliseconds, when available. */
+    durationMs?: number;
+    /**
+     * Final absolute response URL, when available. This may differ from `url`
+     * after redirects and may contain sensitive query or fragment values.
+     */
+    responseUrl?: string;
+    /** Request-body value returned by the configured projector, when available. */
+    requestBody?: RequestBody;
+    /** Response-body value returned by the configured projector, when available. */
+    responseBody?: ResponseBody;
+};
+/** Metadata supplied to a body projector for one matched exchange. */
+type NetworkBodyProjectionContext<Direction extends NetworkBodyDirection = NetworkBodyDirection> = {
+    /** Whether the observed body belongs to the request or response. */
+    direction: Direction;
+    /** Network API used by the application. */
+    transport: NetworkTransport;
+    /** Uppercase HTTP method. */
+    method: string;
+    /** Resolved absolute request URL. */
+    url: string;
+    /** Pathname component of the request URL. */
+    path: string;
+};
+/**
+ * Synchronously selects the only body data that may leave network capture.
+ * Textual bodies are supplied as strings; an XHR with `responseType="json"`
+ * supplies the browser-parsed value. Returning `undefined`, throwing, or
+ * returning a Promise omits the body without affecting the application.
+ * `ProjectedBody` describes the exact value delivered to callbacks.
+ */
+type NetworkBodyProjector<ProjectedBody = unknown, Direction extends NetworkBodyDirection = NetworkBodyDirection> = (body: unknown, context: NetworkBodyProjectionContext<Direction>) => ProjectedBody | undefined;
+/**
+ * Options for {@link captureNetwork}. Request and response body types are
+ * inferred from their projectors and propagated to the corresponding callbacks.
+ */
+type NetworkCaptureOptions<RequestBody = unknown, ResponseBody = unknown> = {
+    /**
+     * Selects requests to observe. The URL is resolved against the document base
+     * URL and the method is uppercase. Return `true` to observe the request.
+     * This callback must return synchronously; Promise results are not matched.
+     */
+    match: (url: URL, method: string) => boolean;
+    /** Receives completed network exchanges. Return values are not awaited. */
+    onExchange: (exchange: HttpExchange<NoInfer<RequestBody>, NoInfer<ResponseBody>>) => void;
+    /**
+     * Receives matched requests after the platform call succeeds. The request ID
+     * matches the eventual exchange. Return values are not awaited.
+     */
+    onRequest?: (request: HttpRequestStarted<NoInfer<RequestBody>>) => void;
+    /**
+     * Network APIs to observe. Defaults to both `xhr` and `fetch`. Unavailable
+     * transports are skipped if at least one requested transport can be observed.
+     */
+    transports?: readonly NetworkTransport[];
+    /**
+     * Best-effort body observation, enabled independently per direction by a
+     * mandatory projector. Without a projector, that direction is never read.
+     * Autocapture performs no generic parsing or redaction: the projector owns
+     * data minimization and its return value is the only body data reported.
+     */
+    bodyCapture?: {
+        /** Projects a request body. */
+        request?: NetworkBodyProjector<RequestBody, "request">;
+        /** Projects a response body. */
+        response?: NetworkBodyProjector<ResponseBody, "response">;
+    };
+    /** Optional diagnostic logger. */
+    logger?: Logger;
+};
+/** Mechanism that produced a navigation event. */
+type NavigationSource = "push" | "replace" | "pop" | "hash";
+/** A same-document navigation. */
+type NavigationEvent = {
+    /** Current URL pathname. */
+    path: string;
+    /** Current URL query string, including the leading `?` when present. May contain sensitive data. */
+    search: string;
+    /** Current URL fragment, including the leading `#` when present. May contain sensitive data. */
+    hash: string;
+    /** Mechanism that produced the event. */
+    source: NavigationSource;
+};
+/** Options for {@link captureNavigation}. */
+type NavigationCaptureOptions = {
+    /** Receives same-document navigation events. Return values are not awaited. */
+    onNavigate: (event: NavigationEvent) => void;
+    /** Optional diagnostic logger. */
+    logger?: Logger;
+};
+
+export type { CaptureHandle as C, FederatedIdentityCaptureOptions as F, HttpExchange as H, Logger as L, NetworkCaptureOptions as N, WebAuthnCaptureOptions as W, WebAuthnCaptureHandle as a, FederatedIdentityCaptureHandle as b, NavigationCaptureOptions as c, CredentialMediation as d, FederatedIdentityCompletedEvent as e, FederatedIdentityContext as f, FederatedIdentityEvent as g, FederatedIdentityFailedEvent as h, FederatedIdentityMode as i, FederatedIdentityProvider as j, FederatedIdentityStartedEvent as k, HttpRequestStarted as l, NavigationEvent as m, NavigationSource as n, NetworkBodyDirection as o, NetworkBodyProjectionContext as p, NetworkBodyProjector as q, NetworkTransport as r, WebAuthnAttachSurface as s, WebAuthnCeremonyCompletedEvent as t, WebAuthnCeremonyContext as u, WebAuthnCeremonyEvent as v, WebAuthnCeremonyFailedEvent as w, WebAuthnCeremonyStartedEvent as x, WebAuthnMediation as y, WebAuthnUiMode as z };