@corbado/observe 1.7.2 → 1.9.0

package/dist/analysis/utils/serialize-raw-error.mjs

@@ -0,0 +1,205 @@
+// src/utils/serialize-raw-error.ts
+var RAW_ERROR_BOUNDS = {
+  maxStackFrames: { min: 1, max: 100, default: 50 },
+  depth: { min: 0, max: 10, default: 3 },
+  maxBreadth: { min: 1, max: 1e3, default: 30 },
+  maxValueLength: { min: 1, max: 1e4, default: 1024 },
+  maxCauseDepth: { min: 0, max: 10, default: 3 },
+  maxBytes: { min: 0, max: 65536, default: 32768 }
+};
+var MAX_NODES = 1024;
+var RawErrorBudgetExceeded = class extends Error {
+};
+var ERROR_FIELDS = ["name", "message", "code", "errors", "stack"];
+var HAS_MULTI_BYTE_CHARACTERS = /[^\x20-\x7E]/;
+var tag = (value) => Object.prototype.toString.call(value).slice(8, -1);
+var typeOf = (value) => value === null ? "null" : typeof value === "object" ? tag(value) : typeof value;
+var isErrorLike = (value) => value instanceof Error || tag(value) === "Error" || tag(value) === "DOMException";
+function byteLength(json) {
+  return HAS_MULTI_BYTE_CHARACTERS.test(json) ? new TextEncoder().encode(json).byteLength : json.length;
+}
+function clamp(name, value) {
+  const bounds = RAW_ERROR_BOUNDS[name];
+  if (typeof value !== "number" || !Number.isFinite(value)) return bounds.default;
+  return Math.min(bounds.max, Math.max(bounds.min, Math.floor(value)));
+}
+function resolveRawErrorLimits(options = {}) {
+  return {
+    stack: options.stack === true,
+    maxStackFrames: clamp("maxStackFrames", options.maxStackFrames),
+    depth: clamp("depth", options.depth),
+    maxBreadth: clamp("maxBreadth", options.maxBreadth),
+    maxValueLength: clamp("maxValueLength", options.maxValueLength),
+    maxCauseDepth: clamp("maxCauseDepth", options.maxCauseDepth),
+    maxBytes: clamp("maxBytes", options.maxBytes)
+  };
+}
+function serializeRawError(value, options = {}) {
+  if (value === void 0) return void 0;
+  let limits = resolveRawErrorLimits();
+  const fits = (out) => {
+    const json = JSON.stringify(out);
+    return json === void 0 || byteLength(json) <= limits.maxBytes;
+  };
+  try {
+    limits = resolveRawErrorLimits(options);
+    if (limits.maxBytes === 0) return void 0;
+    const type = truncate(typeOf(value), 1024);
+    for (let depth = limits.depth; depth >= 0; depth--) {
+      const ctx = { limits, causeBudget: limits.maxCauseDepth, seen: /* @__PURE__ */ new Set(), nodes: 0, textBytes: 0 };
+      try {
+        const out = { type, value: walk(value, depth, ctx) };
+        if (fits(out)) return out;
+      } catch (error) {
+        if (!(error instanceof RawErrorBudgetExceeded)) throw error;
+      }
+    }
+    const fallback = { type, truncated: true };
+    return fits(fallback) ? fallback : void 0;
+  } catch {
+    const fallback = { type: "unserializable" };
+    return fits(fallback) ? fallback : void 0;
+  }
+}
+function accountText(text, ctx) {
+  if (text.length > ctx.limits.maxBytes) throw new RawErrorBudgetExceeded();
+  ctx.textBytes += byteLength(JSON.stringify(text));
+  if (ctx.textBytes > ctx.limits.maxBytes) throw new RawErrorBudgetExceeded();
+  return text;
+}
+function walk(value, depth, ctx) {
+  if (++ctx.nodes > MAX_NODES) throw new RawErrorBudgetExceeded();
+  const out = walkValue(value, depth, ctx);
+  return typeof out === "string" ? accountText(out, ctx) : out;
+}
+function walkValue(value, depth, ctx) {
+  switch (typeof value) {
+    case "string":
+      return truncate(value, ctx.limits.maxValueLength);
+    case "number":
+      return Number.isFinite(value) ? value : String(value);
+    case "boolean":
+    case "undefined":
+      return value;
+    case "bigint":
+    case "symbol":
+      return truncate(String(value), ctx.limits.maxValueLength);
+    case "function":
+      return `[Function: ${value.name || "anonymous"}]`;
+  }
+  if (value === null) return null;
+  const obj = value;
+  if (ctx.seen.has(obj)) return "[Circular]";
+  if (depth < 0) return `[${tag(obj)}]`;
+  ctx.seen.add(obj);
+  try {
+    return walkObject(obj, depth, ctx);
+  } finally {
+    ctx.seen.delete(obj);
+  }
+}
+function truncate(value, max) {
+  return value.length > max ? value.slice(0, max) + "\u2026" : value;
+}
+function truncateStack(stack, maxFrames, maxValueLength) {
+  const textTruncated = stack.length > maxValueLength;
+  stack = truncate(stack, maxValueLength);
+  const lines = stack.split("\n");
+  if (lines.length <= maxFrames + 1) return truncate(stack, maxValueLength);
+  const kept = lines.slice(0, maxFrames + 1).join("\n");
+  const marker = textTruncated ? "[truncated]" : `[+${lines.length - maxFrames - 1} frames]`;
+  return truncate(`${kept}
+${marker}`, maxValueLength);
+}
+function walkObject(obj, depth, ctx) {
+  const { limits } = ctx;
+  const kind = tag(obj);
+  const next = (v) => walk(v, depth - 1, ctx);
+  if (kind === "Date") return Number.isNaN(obj.getTime()) ? "[Invalid Date]" : obj.toISOString();
+  if (kind === "RegExp") return truncate(String(obj), limits.maxValueLength);
+  if (kind === "ArrayBuffer") return `[ArrayBuffer(${obj.byteLength})]`;
+  if (ArrayBuffer.isView(obj)) return `[${kind}(${obj.byteLength})]`;
+  if (kind === "Map" || kind === "Set") {
+    const collection = obj;
+    const items = [];
+    for (const value of collection) {
+      if (items.length === limits.maxBreadth) break;
+      items.push(next(value));
+    }
+    if (collection.size > items.length) items.push(`[+${collection.size - items.length} more]`);
+    return items;
+  }
+  if (kind === "Promise" || kind === "WeakMap" || kind === "WeakSet" || kind === "Window") return `[${kind}]`;
+  if (typeof Node !== "undefined" && obj instanceof Node) return `[${kind}]`;
+  if (Array.isArray(obj)) {
+    const items = obj.slice(0, limits.maxBreadth).map(next);
+    if (obj.length > limits.maxBreadth) items.push(`[+${obj.length - limits.maxBreadth} more]`);
+    return items;
+  }
+  if (typeof Response !== "undefined" && obj instanceof Response) {
+    return {
+      status: next(obj.status),
+      statusText: next(obj.statusText),
+      url: next(obj.url),
+      redirected: next(obj.redirected)
+    };
+  }
+  if (typeof Event !== "undefined" && obj instanceof Event) {
+    const ev = obj;
+    const out2 = { type: next(ev.type) };
+    for (const key of ["message", "filename", "lineno", "colno"]) {
+      if (key in ev) out2[key] = next(ev[key]);
+    }
+    if ("error" in ev && ev.error != null) out2.error = next(ev.error);
+    return out2;
+  }
+  const out = /* @__PURE__ */ Object.create(null);
+  const record = obj;
+  const errorLike = isErrorLike(obj);
+  if (errorLike) {
+    for (const field of ERROR_FIELDS) {
+      if (field === "stack" && !limits.stack) continue;
+      const v = record[field];
+      if (v === void 0 || v === null || typeof v === "function") continue;
+      if (field === "stack") {
+        if (limits.stack && typeof v === "string")
+          out.stack = accountText(truncateStack(v, limits.maxStackFrames, limits.maxValueLength), ctx);
+        continue;
+      }
+      out[field] = next(v);
+    }
+    const cause = record.cause;
+    if (cause !== void 0 && cause !== null && typeof cause !== "function") {
+      out.cause = walkCause(cause, depth - 1, ctx);
+    }
+  }
+  let keys = 0;
+  const ownKeys = Object.keys(record);
+  for (const key of ownKeys) {
+    if (key in out || key === "stack" && !limits.stack || errorLike && key === "cause") continue;
+    if (++keys > limits.maxBreadth) {
+      out["\u2026"] = `[+${ownKeys.length - limits.maxBreadth} keys]`;
+      break;
+    }
+    const v = record[key];
+    if (typeof v === "function") continue;
+    out[accountText(key, ctx)] = key === "stack" && typeof v === "string" ? accountText(truncateStack(v, limits.maxStackFrames, limits.maxValueLength), ctx) : next(v);
+  }
+  if (!errorLike && kind !== "Object" && keys === 0) return `[${kind}]`;
+  return out;
+}
+function walkCause(cause, depth, ctx) {
+  if (typeof cause !== "object" || cause === null) return walk(cause, depth, ctx);
+  if (ctx.causeBudget <= 0) return accountText(`[${tag(cause)}]`, ctx);
+  ctx.causeBudget--;
+  try {
+    return walk(cause, depth, ctx);
+  } finally {
+    ctx.causeBudget++;
+  }
+}
+export {
+  RAW_ERROR_BOUNDS,
+  resolveRawErrorLimits,
+  serializeRawError
+};

package/dist/analysis/utils/sms-otp-operation-full.mjs

@@ -0,0 +1,38 @@
+// src/utils/sms-otp-operation-full.ts
+import { OTPInputBinding } from "../low-events/otp-input-binding.mjs";
+import { OperationFull } from "./operation-full.mjs";
+var SmsOtpOperationFull = class extends OperationFull {
+  lowEventTracker;
+  send;
+  postResponse;
+  resend;
+  constructor(tracker, config = {}) {
+    super(tracker, "sms-otp");
+    this.send = this.defineStep("send");
+    this.postResponse = this.defineStep("post-response");
+    this.resend = this.defineStep("resend");
+    void this.subflowStart({ explicitSpecType: config.explicitSpecType });
+    this.lowEventTracker = this.createLowCollector(
+      () => new OTPInputBinding(
+        tracker.getLogger(),
+        this.lowEventSink("input", "otp"),
+        this.lowEventSink("input-group", "otp")
+      )
+    );
+    if (config.inputHtmlFields?.length) {
+      this.setInputFields(config.inputHtmlFields);
+    } else if (config.inputHtmlField) {
+      this.lowEventTracker?.setFields([config.inputHtmlField], false);
+    }
+    this.registerLowFlusher(() => this.lowEventTracker?.flushPending());
+  }
+  setInputFields(fields) {
+    this.lowEventTracker?.setFields(fields);
+  }
+  destroy() {
+    this.lowEventTracker?.destroy();
+  }
+};
+export {
+  SmsOtpOperationFull
+};

package/dist/analysis/utils/social-operation-login.mjs

@@ -0,0 +1,17 @@
+// src/utils/social-operation-login.ts
+import { OperationFull } from "./operation-full.mjs";
+var SocialLoginOperationFull = class extends OperationFull {
+  getRedirectUrl;
+  exchangeCode;
+  constructor(tracker, config = {}) {
+    super(tracker, "social-login");
+    this.getRedirectUrl = this.defineStep(
+      "get-redirect-url"
+    );
+    this.exchangeCode = this.defineStep("exchange-code");
+    void this.subflowStart({ explicitSpecType: config.explicitSpecType, entry: config.entry });
+  }
+};
+export {
+  SocialLoginOperationFull
+};

package/dist/analysis/utils/source-path.mjs

@@ -0,0 +1,39 @@
+// src/utils/source-path.ts
+var MASKED_QUERY_VALUE = "*";
+function decodeKey(raw) {
+  try {
+    return decodeURIComponent(raw.replace(/\+/g, " "));
+  } catch {
+    return raw;
+  }
+}
+function isAllowed(key, allow) {
+  const lower = key.toLowerCase();
+  return allow.some((pattern) => {
+    const entry = pattern.toLowerCase();
+    return entry.endsWith("*") ? lower.startsWith(entry.slice(0, -1)) : lower === entry;
+  });
+}
+function applySourcePathQuery(search, mode, allow) {
+  if (mode !== "allowlist" || search === "" || search === "?") {
+    return search;
+  }
+  const query = search.startsWith("?") ? search.slice(1) : search;
+  const masked = query.split("&").map((pair) => {
+    const separator = pair.indexOf("=");
+    if (separator === -1) {
+      return pair;
+    }
+    const key = pair.slice(0, separator);
+    const value = pair.slice(separator + 1);
+    if (value === "" || isAllowed(decodeKey(key), allow)) {
+      return pair;
+    }
+    return `${key}=${MASKED_QUERY_VALUE}`;
+  });
+  return `?${masked.join("&")}`;
+}
+export {
+  MASKED_QUERY_VALUE,
+  applySourcePathQuery
+};

package/dist/analysis/utils/sso-operation-login.mjs

@@ -0,0 +1,37 @@
+// src/utils/sso-operation-login.ts
+import { OperationFull } from "./operation-full.mjs";
+var SsoLoginOperationFull = class extends OperationFull {
+  getRedirectUrl;
+  exchangeCode;
+  constructor(tracker, config = {}) {
+    super(tracker, "sso-login");
+    this.getRedirectUrl = this.defineStep(
+      "get-redirect-url"
+    );
+    this.exchangeCode = this.defineStep("exchange-code");
+    const { explicitSpecType, organizationDomain, actor } = validateConfig(config ?? {}, tracker);
+    void this.subflowStart({ explicitSpecType, organizationDomain, actor });
+  }
+};
+function validateConfig(config, tracker) {
+  const result = { ...config };
+  const warn = (field) => {
+    try {
+      tracker.getLogger().warn(`SSO login: unsupported ${field}; omitted from telemetry`);
+    } catch {
+    }
+  };
+  const domain = result.organizationDomain;
+  if (domain !== void 0 && (typeof domain !== "string" || domain.includes("@") || domain.length > 253)) {
+    delete result.organizationDomain;
+    warn("organizationDomain");
+  }
+  if (result.actor !== void 0 && result.actor !== "user" && result.actor !== "system") {
+    delete result.actor;
+    warn("actor");
+  }
+  return result;
+}
+export {
+  SsoLoginOperationFull
+};

package/dist/analysis/utils/totp-operation-full.mjs

@@ -0,0 +1,34 @@
+// src/utils/totp-operation-full.ts
+import { OTPInputBinding } from "../low-events/otp-input-binding.mjs";
+import { OperationFull } from "./operation-full.mjs";
+var TotpOperationFull = class extends OperationFull {
+  lowEventTracker;
+  postResponse;
+  constructor(tracker, config = {}) {
+    super(tracker, "totp");
+    this.postResponse = this.defineStep("post-response");
+    void this.subflowStart({ explicitSpecType: config.explicitSpecType });
+    this.lowEventTracker = this.createLowCollector(
+      () => new OTPInputBinding(
+        tracker.getLogger(),
+        this.lowEventSink("input", "otp"),
+        this.lowEventSink("input-group", "otp")
+      )
+    );
+    if (config.inputHtmlFields?.length) {
+      this.setInputFields(config.inputHtmlFields);
+    } else if (config.inputHtmlField) {
+      this.lowEventTracker?.setFields([config.inputHtmlField], false);
+    }
+    this.registerLowFlusher(() => this.lowEventTracker?.flushPending());
+  }
+  setInputFields(fields) {
+    this.lowEventTracker?.setFields(fields);
+  }
+  destroy() {
+    this.lowEventTracker?.destroy();
+  }
+};
+export {
+  TotpOperationFull
+};

package/dist/analysis/utils/trusted-device-operation-full.mjs

@@ -0,0 +1,100 @@
+// src/utils/trusted-device-operation-full.ts
+import { normalizeError } from "./normalize-error.mjs";
+import { OperationFull } from "./operation-full.mjs";
+function stampIdentity(data, identity, tracker) {
+  if (data === null || typeof data !== "object") return data;
+  try {
+    const out = { ...data };
+    if (out.purpose === void 0 && identity.purpose !== void 0) out.purpose = identity.purpose;
+    if (out.storage === void 0 && identity.storage !== void 0) out.storage = identity.storage;
+    if (out.trustName === void 0 && identity.trustName !== void 0) out.trustName = identity.trustName;
+    for (const [field, limit] of [
+      ["bindingReference", 255],
+      ["trustName", 128]
+    ]) {
+      if (typeof out[field] === "string" && [...out[field]].length > limit) {
+        delete out[field];
+        try {
+          tracker.getLogger().debug(`Trusted device: omitted ${field} exceeding ${limit} characters`);
+        } catch {
+        }
+      }
+    }
+    return out;
+  } catch {
+    return data;
+  }
+}
+function withIdentity(step, identity, tracker) {
+  return {
+    ...step,
+    start: (data, options) => step.start(stampIdentity(data, identity, tracker), options),
+    finished: (data, options) => step.finished(stampIdentity(data, identity, tracker), options)
+  };
+}
+var TrustedDeviceCheckOperationFull = class extends OperationFull {
+  getOptions;
+  ceremony;
+  postResponse;
+  constructor(tracker, config) {
+    super(tracker, "trusted-device-check");
+    config = validateConfig(config, tracker);
+    const identity = { purpose: config.purpose, storage: config.storage, trustName: config.trustName };
+    this.getOptions = this.checkStep("get-options", identity, tracker);
+    this.ceremony = this.checkStep("ceremony", identity, tracker);
+    this.postResponse = this.checkStep("post-response", identity, tracker);
+    this.subflowStart({ explicitSpecType: config.explicitSpecType, actor: "system", ignoreAsInteraction: true });
+  }
+  checkStep(name, identity, tracker) {
+    const step = this.defineStep(name, true);
+    return {
+      ...withIdentity(step, identity, tracker),
+      errorTyped: (data, options) => {
+        step.errorTyped(
+          stampIdentity({ code: data?.code, error: normalizeError(data?.error) }, identity, tracker),
+          options
+        );
+      }
+    };
+  }
+};
+var TrustedDeviceEnrollmentOperationFull = class extends OperationFull {
+  getOptions;
+  ceremony;
+  postResponse;
+  constructor(tracker, config) {
+    super(tracker, "trusted-device-enrollment");
+    config = validateConfig(config, tracker);
+    const identity = { purpose: config.purpose, storage: config.storage, trustName: config.trustName };
+    this.getOptions = withIdentity(this.defineStep("get-options"), identity, tracker);
+    this.ceremony = withIdentity(this.defineStep("ceremony"), identity, tracker);
+    this.postResponse = withIdentity(
+      this.defineStep("post-response"),
+      identity,
+      tracker
+    );
+    this.subflowStart({ explicitSpecType: config.explicitSpecType });
+  }
+};
+function validateConfig(config, tracker) {
+  const result = { ...config };
+  const warn = (field) => {
+    try {
+      tracker.getLogger().warn(`Trusted device: missing or unsupported ${field}; omitted from telemetry`);
+    } catch {
+    }
+  };
+  if (result.purpose !== "additional-verification" && result.purpose !== "mfa-exemption") {
+    delete result.purpose;
+    warn("purpose");
+  }
+  if (!["cookie", "indexeddb", "localstore", "sessionstore"].includes(result.storage)) {
+    delete result.storage;
+    warn("storage");
+  }
+  return result;
+}
+export {
+  TrustedDeviceCheckOperationFull,
+  TrustedDeviceEnrollmentOperationFull
+};

package/dist/analysis/utils/webauthn-payloads.mjs

@@ -0,0 +1,101 @@
+// src/utils/webauthn-payloads.ts
+var BLACKLIST = {
+  creationOptions: ["/user/name", "/user/displayName"],
+  creationResponse: ["/clientExtensionResults/prf/results"],
+  requestOptions: [],
+  assertionResponse: ["/response/signature", "/clientExtensionResults/prf/results"]
+};
+function sanitizeCreationOptions(value, projectors) {
+  return sanitize(value, "creationOptions", projectors);
+}
+function sanitizeCreationResponse(value, projectors) {
+  return sanitize(value, "creationResponse", projectors);
+}
+function sanitizeRequestOptions(value) {
+  return sanitize(value, "requestOptions");
+}
+function sanitizeAssertionResponse(value, projectors) {
+  return sanitize(value, "assertionResponse", projectors);
+}
+function sanitize(input, kind, projectors = {}) {
+  try {
+    const value = typeof input === "string" ? JSON.parse(input) : input;
+    if (!isRecord(value)) return void 0;
+    const blocked = new Set(BLACKLIST[kind]);
+    const ancestors = /* @__PURE__ */ new Set();
+    const clone = (item, path, depth = 0) => {
+      if (blocked.has(path)) return void 0;
+      if (kind === "creationOptions" && path === "/user/id" || (kind === "creationResponse" || kind === "assertionResponse") && path === "/response/userHandle") {
+        if (item === null) return null;
+        if (!projectors.userId) return void 0;
+        const identifier = typeof item === "string" ? item : item instanceof ArrayBuffer || ArrayBuffer.isView(item) ? base64url(item) : void 0;
+        if (identifier === void 0) return void 0;
+        try {
+          const output = projectors.userId(identifier);
+          return typeof output === "string" || output === null ? output : void 0;
+        } catch {
+          return void 0;
+        }
+      }
+      if (item === null || typeof item === "string" || typeof item === "boolean") return item;
+      if (typeof item === "number") return Number.isFinite(item) ? item : null;
+      if (typeof item !== "object") return void 0;
+      if (item instanceof ArrayBuffer || ArrayBuffer.isView(item)) return base64url(item);
+      if (depth > 64 || ancestors.has(item)) throw new TypeError("Invalid telemetry payload");
+      ancestors.add(item);
+      try {
+        if (Array.isArray(item)) {
+          return item.map((entry, i) => clone(entry, `${path}/${i}`, depth + 1));
+        }
+        const result = /* @__PURE__ */ Object.create(null);
+        for (const key in item) {
+          const childPath = `${path}/${key.replace(/~/g, "~0").replace(/\//g, "~1")}`;
+          if (blocked.has(childPath) || key === "toJSON") continue;
+          const child = clone(item[key], childPath, depth + 1);
+          if (child !== void 0) result[key] = child;
+        }
+        const source = item;
+        const readMethod = (method, field) => {
+          if (result[field] !== void 0 || typeof source[method] !== "function") return;
+          const childPath = `${path}/${field}`;
+          const child = clone(
+            Reflect.apply(source[method], item, []),
+            childPath,
+            depth + 1
+          );
+          if (child !== void 0) result[field] = child;
+        };
+        if (path === "" && (kind === "creationResponse" || kind === "assertionResponse")) {
+          readMethod("getClientExtensionResults", "clientExtensionResults");
+        }
+        if (path === "/response" && kind === "creationResponse") {
+          readMethod("getTransports", "transports");
+          readMethod("getAuthenticatorData", "authenticatorData");
+          readMethod("getPublicKey", "publicKey");
+          readMethod("getPublicKeyAlgorithm", "publicKeyAlgorithm");
+        }
+        return result;
+      } finally {
+        ancestors.delete(item);
+      }
+    };
+    return JSON.stringify(clone(value, ""));
+  } catch {
+    return void 0;
+  }
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) && !(value instanceof ArrayBuffer) && !ArrayBuffer.isView(value);
+}
+function base64url(value) {
+  const bytes = value instanceof ArrayBuffer ? new Uint8Array(value) : new Uint8Array(value.buffer, value.byteOffset, value.byteLength);
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+export {
+  sanitizeAssertionResponse,
+  sanitizeCreationOptions,
+  sanitizeCreationResponse,
+  sanitizeRequestOptions
+};

package/dist/analysis/version.mjs

@@ -0,0 +1,7 @@
+// src/version.ts
+var SDK_NAME = "@corbado/observe";
+var SDK_VERSION = true ? "1.9.0" : "0.0.0-dev";
+export {
+  SDK_NAME,
+  SDK_VERSION
+};