@corbado/observe 1.14.0 → 1.14.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @corbado/observe
 
+## 1.14.1
+
+### Patch Changes
+
+- 77ac0d7: Paste observation no longer copies or compares input values: it keeps only the fields' lengths and whether the browser applied the paste. The unused inserted count and the undeclared "Length of the pasted text" reader field are removed. A host-handled paste that replaces text with text of the same length, without an input event, is no longer detected.
+
 ## 1.14.0
 
 ### Minor Changes

package/dist/analysis/low-events/grouped-input-tracker.mjs

@@ -18,7 +18,7 @@ var LowEventGroupedInputTracker = class {
       {
         key: "dom:input.paste",
         title: "Paste into tracked input fields",
-        accessNote: "paste events on the input elements the integration passes to Observe; pasted values never leave the reader",
+        accessNote: "paste events on the input elements the integration passes to Observe; only the fields' lengths are compared, values are never copied or compared",
         group: "Input interaction",
         origin: "observe-external",
         fields: [
@@ -28,19 +28,12 @@ var LowEventGroupedInputTracker = class {
             category: "behavior",
             exposure: "presence",
             transform: { note: "trusted paste events only" }
-          },
-          {
-            path: "value",
-            label: "Length of the pasted text",
-            category: "behavior",
-            exposure: "size",
-            transform: { note: "inserted length only; values are compared in memory and discarded" }
           }
         ]
       },
       this.inputs,
       logger,
-      (ts, _inserted, captureSeq) => {
+      (ts, captureSeq) => {
         this.cancelChange();
         this.changes.flush();
         this.changes.markInputObserved();

package/dist/analysis/low-events/input-tracker.mjs

@@ -40,7 +40,7 @@ var LowEventInputTracker = class {
       {
         key: "dom:input.paste",
         title: "Paste into tracked input fields",
-        accessNote: "paste events on the input elements the integration passes to Observe; pasted values never leave the reader",
+        accessNote: "paste events on the input elements the integration passes to Observe; only the fields' lengths are compared, values are never copied or compared",
         group: "Input interaction",
         origin: "observe-external",
         fields: [
@@ -50,19 +50,12 @@ var LowEventInputTracker = class {
             category: "behavior",
             exposure: "presence",
             transform: { note: "trusted paste events only" }
-          },
-          {
-            path: "value",
-            label: "Length of the pasted text",
-            category: "behavior",
-            exposure: "size",
-            transform: { note: "inserted length only; values are compared in memory and discarded" }
           }
         ]
       },
       [inputField],
       logger,
-      (ts, _inserted, captureSeq) => {
+      (ts, captureSeq) => {
         this.changes.flush();
         this.changes.markInputObserved();
         const oldLength = this.changes.previousLength;

package/dist/analysis/readers/input-paste.mjs

@@ -10,7 +10,9 @@ var InputPasteObserver = class {
       input.addEventListener("beforeinput", this.onBeforeInput, true);
     }
   }
-  before = null;
+  lengthsBefore = null;
+  /** An input event of this paste arrived (the browser applied it). */
+  applied = false;
   timestamp = 0;
   captureSeq;
   pasteEvent;
@@ -22,21 +24,23 @@ var InputPasteObserver = class {
   };
   /** An unrelated input event invalidates pending paste provenance before recording its change. */
   handlesInput(event) {
-    if (!this.before) return false;
+    if (!this.lengthsBefore) return false;
     const inPasteDispatch = this.pasteEvent?.type === "paste" && (this.pasteEvent.eventPhase ?? 0) > 0;
     if (event.inputType === "insertFromPaste" || inPasteDispatch) {
+      this.applied = true;
       return true;
     }
     this.clear();
     return false;
   }
   get pending() {
-    return this.before !== null;
+    return this.lengthsBefore !== null;
   }
   begin(event) {
-    if (!event.isTrusted || this.before) return;
+    if (!event.isTrusted || this.lengthsBefore) return;
     try {
-      this.before = this.inputs.map((input) => input.value);
+      this.lengthsBefore = this.inputs.map((input) => input.value.length);
+      this.applied = false;
       this.pasteEvent = event;
       this.timestamp = Date.now();
       this.captureSeq = this.reserveCaptureSeq?.();
@@ -47,27 +51,15 @@ var InputPasteObserver = class {
     }
   }
   flush() {
-    const before = this.before;
-    if (!before) return;
+    const lengthsBefore = this.lengthsBefore;
+    if (!lengthsBefore) return;
     const timestamp = this.timestamp;
     const captureSeq = this.captureSeq;
+    const applied = this.applied;
     this.clear();
     try {
-      let inserted = 0;
-      let changed = false;
-      this.inputs.forEach((input, index) => {
-        const old = before[index];
-        const value = input.value;
-        if (old === value) return;
-        changed = true;
-        let start = 0;
-        while (start < old.length && start < value.length && old[start] === value[start]) start++;
-        let end = 0;
-        while (end < old.length - start && end < value.length - start && old[old.length - end - 1] === value[value.length - end - 1])
-          end++;
-        inserted += value.length - start - end;
-      });
-      if (changed) this.changed(timestamp, inserted, captureSeq);
+      const changed = applied || this.inputs.some((input, index) => input.value.length !== lengthsBefore[index]);
+      if (changed) this.changed(timestamp, captureSeq);
     } catch (error) {
       this.logger.error("Failed to finish paste observation", error);
     }
@@ -75,7 +67,8 @@ var InputPasteObserver = class {
   clear() {
     if (this.timer !== null) clearTimeout(this.timer);
     this.timer = null;
-    this.before = null;
+    this.lengthsBefore = null;
+    this.applied = false;
     this.pasteEvent = void 0;
   }
   destroy() {

package/dist/analysis/version.mjs

@@ -1,6 +1,6 @@
 // src/version.ts
 var SDK_NAME = "@corbado/observe";
-var SDK_VERSION = true ? "1.14.0" : "0.0.0-dev";
+var SDK_VERSION = true ? "1.14.1" : "0.0.0-dev";
 export {
   SDK_NAME,
   SDK_VERSION