@insitue/sdk 0.1.9 → 0.1.11

package/dist/capture-only.js

@@ -1,7 +1,7 @@
 import {
   mountCaptureOnly
-} from "./chunk-BNREKX5C.js";
-import "./chunk-CPPXBTE5.js";
+} from "./chunk-PAKDACTF.js";
+import "./chunk-SMR4AYKA.js";
 export {
   mountCaptureOnly
 };

package/dist/{chunk-DSHJX2LF.js → chunk-DJN4LPOV.js}

@@ -15,7 +15,7 @@ import {
   setCaptureSettings,
   stopDisplayMedia,
   y
-} from "./chunk-CPPXBTE5.js";
+} from "./chunk-SMR4AYKA.js";
 
 // src/client.ts
 var CompanionClient = class {

package/dist/{chunk-BNREKX5C.js → chunk-PAKDACTF.js}

@@ -11,7 +11,7 @@ import {
   setCaptureSettings,
   stopDisplayMedia,
   y
-} from "./chunk-CPPXBTE5.js";
+} from "./chunk-SMR4AYKA.js";
 
 // src/capture-only.ts
 var DEFAULT_INGEST = "https://www.insitue.com/api/v1/capture";
@@ -351,11 +351,19 @@ function CaptureOnlyApp(props) {
         style: `display:flex;justify-content:space-between;padding:9px 16px;border-top:1px solid ${C.line};color:${C.faint};font-size:11px`
       },
       [
-        k("span", {}, "\u{1F512} Secrets scrubbed automatically"),
+        // No "Secrets scrubbed" badge — the redaction is narrow
+        // (regex on attr-names + console.log args; see
+        // packages/sdk/src/runtime.ts safeArg, capture-core/dom.ts
+        // serializeNode). Visible password VALUES, URL query
+        // params, and any text rendered in the screenshot pixels
+        // are NOT scrubbed — claiming otherwise misleads reporters
+        // about what's safe to capture. If we ever build real
+        // form-value redaction the badge can come back.
+        k("span", {}, ""),
         k(
           "span",
-          { title: `@insitue/sdk@${"0.1.9"}` },
-          `InSitue \xB7 v${"0.1.9"}`
+          { title: `@insitue/sdk@${"0.1.11"}` },
+          `InSitue \xB7 v${"0.1.11"}`
         )
       ]
     )

package/dist/{chunk-CPPXBTE5.js → chunk-SMR4AYKA.js}

@@ -1641,16 +1641,6 @@ async function toCanvas(node, options = {}) {
 }
 
 // src/capture.ts
-function crossOrigin(url) {
-  if (!url || url.startsWith("data:") || url.startsWith("blob:")) {
-    return false;
-  }
-  try {
-    return new URL(url, location.href).origin !== location.origin;
-  } catch {
-    return false;
-  }
-}
 var IMAGE_PLACEHOLDER = "data:image/svg+xml;base64," + (typeof btoa !== "undefined" ? btoa(
   '<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32"><rect width="32" height="32" fill="#e8e8e8"/><path d="M0 0 L32 32 M32 0 L0 32" stroke="#b0b0b0" stroke-width="1.5"/></svg>'
 ) : "");
@@ -1681,7 +1671,7 @@ async function renderViewportCrop(cropRect, pixelRatio) {
   out.height = Math.max(1, Math.round(cropRect.height * pixelRatio));
   const ctx = out.getContext("2d");
   if (!ctx) return { dataUrl: null, failedImages };
-  const drawnImgs = drawAbsoluteImagesOnto(
+  const drawnImgs = await drawAbsoluteImagesOnto(
     ctx,
     cropRect,
     pixelRatio,
@@ -1721,67 +1711,102 @@ async function renderViewportCrop(cropRect, pixelRatio) {
   detectUnrenderedImages(ctx, cropRect, out, pixelRatio, failedImages);
   return { dataUrl: out.toDataURL("image/png"), failedImages };
 }
-function drawAbsoluteImagesOnto(ctx, cropRect, pixelRatio, failedImages) {
+async function drawAbsoluteImagesOnto(ctx, cropRect, pixelRatio, failedImages) {
   const drawn = /* @__PURE__ */ new Set();
   const imgs = Array.from(
     document.querySelectorAll("img")
   ).filter(
     (img) => !img.closest?.("#insitu-root, [data-insitu-layer]")
   );
-  for (const img of imgs) {
-    const r3 = img.getBoundingClientRect();
-    if (r3.width <= 0 || r3.height <= 0) continue;
-    const cs = getComputedStyle(img);
-    if (cs.position !== "absolute" && cs.position !== "fixed") continue;
-    if (r3.right < cropRect.x || r3.left > cropRect.x + cropRect.width || r3.bottom < cropRect.y || r3.top > cropRect.y + cropRect.height) {
-      continue;
-    }
-    const src = img.currentSrc || img.src;
-    if (!src) continue;
-    if (crossOrigin(src) && img.crossOrigin !== "anonymous" && img.crossOrigin !== "use-credentials") {
-      failedImages.add(img);
-      continue;
-    }
-    if (!img.complete || img.naturalWidth === 0 || img.naturalHeight === 0) {
-      failedImages.add(img);
-      continue;
-    }
-    const dest = {
-      x: (r3.left - cropRect.x) * pixelRatio,
-      y: (r3.top - cropRect.y) * pixelRatio,
-      w: r3.width * pixelRatio,
-      h: r3.height * pixelRatio
-    };
-    const source = computeObjectFitSource(img, cs);
-    try {
-      ctx.drawImage(
-        img,
-        source.sx,
-        source.sy,
-        source.sw,
-        source.sh,
-        dest.x,
-        dest.y,
-        dest.w,
-        dest.h
+  const PER_IMAGE_TIMEOUT_MS = 3e3;
+  await Promise.allSettled(
+    imgs.map(async (img) => {
+      const r3 = img.getBoundingClientRect();
+      if (r3.width <= 0 || r3.height <= 0) return;
+      const cs = getComputedStyle(img);
+      if (cs.position !== "absolute" && cs.position !== "fixed") return;
+      if (r3.right < cropRect.x || r3.left > cropRect.x + cropRect.width || r3.bottom < cropRect.y || r3.top > cropRect.y + cropRect.height) {
+        return;
+      }
+      const src = img.currentSrc || img.src;
+      if (!src) return;
+      const usesFreshLoad = !src.startsWith("data:") && !src.startsWith("blob:");
+      let source;
+      if (usesFreshLoad) {
+        try {
+          source = await loadFresh(src, PER_IMAGE_TIMEOUT_MS);
+        } catch {
+          failedImages.add(img);
+          return;
+        }
+      } else {
+        if (!img.complete || img.naturalWidth === 0) {
+          failedImages.add(img);
+          return;
+        }
+        source = img;
+      }
+      const objFit = computeObjectFitSource(
+        { naturalWidth: source.naturalWidth, naturalHeight: source.naturalHeight },
+        r3.width,
+        r3.height,
+        cs.objectFit || "fill"
       );
-      drawn.add(img);
-    } catch {
-      failedImages.add(img);
-    }
-  }
+      const dest = {
+        x: (r3.left - cropRect.x) * pixelRatio,
+        y: (r3.top - cropRect.y) * pixelRatio,
+        w: r3.width * pixelRatio,
+        h: r3.height * pixelRatio
+      };
+      try {
+        ctx.drawImage(
+          source,
+          objFit.sx,
+          objFit.sy,
+          objFit.sw,
+          objFit.sh,
+          dest.x,
+          dest.y,
+          dest.w,
+          dest.h
+        );
+        drawn.add(img);
+      } catch {
+        failedImages.add(img);
+      }
+    })
+  );
   return drawn;
 }
-function computeObjectFitSource(img, cs) {
-  const nw = img.naturalWidth;
-  const nh = img.naturalHeight;
-  const r3 = img.getBoundingClientRect();
-  const dw = r3.width;
-  const dh = r3.height;
+function loadFresh(url, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const img = new Image();
+    img.crossOrigin = "anonymous";
+    const timer = setTimeout(() => {
+      img.src = "";
+      reject(new Error("timeout"));
+    }, timeoutMs);
+    img.onload = async () => {
+      clearTimeout(timer);
+      try {
+        await img.decode();
+      } catch {
+      }
+      resolve(img);
+    };
+    img.onerror = () => {
+      clearTimeout(timer);
+      reject(new Error("load failed"));
+    };
+    img.src = url;
+  });
+}
+function computeObjectFitSource(natural, dw, dh, fit) {
+  const nw = natural.naturalWidth;
+  const nh = natural.naturalHeight;
   if (!nw || !nh || !dw || !dh) {
     return { sx: 0, sy: 0, sw: nw || 1, sh: nh || 1 };
   }
-  const fit = cs.objectFit || "fill";
   if (fit === "fill") {
     return { sx: 0, sy: 0, sw: nw, sh: nh };
   }

package/dist/index.js

@@ -1,10 +1,10 @@
 import {
   mountCaptureOnly
-} from "./chunk-BNREKX5C.js";
+} from "./chunk-PAKDACTF.js";
 import {
   mountInSitue
-} from "./chunk-DSHJX2LF.js";
-import "./chunk-CPPXBTE5.js";
+} from "./chunk-DJN4LPOV.js";
+import "./chunk-SMR4AYKA.js";
 
 // src/InSitue.tsx
 import { useEffect } from "react";
@@ -52,7 +52,7 @@ function InSitueCapture({
 }
 
 // src/index.ts
-var SDK_VERSION = "0.1.9";
+var SDK_VERSION = "0.1.11";
 export {
   InSitue,
   InSitueCapture,

package/dist/overlay.js

@@ -1,7 +1,7 @@
 import {
   mountInSitue
-} from "./chunk-DSHJX2LF.js";
-import "./chunk-CPPXBTE5.js";
+} from "./chunk-DJN4LPOV.js";
+import "./chunk-SMR4AYKA.js";
 export {
   mountInSitue
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@insitue/sdk",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "description": "InSitue capture SDK — drop one snippet into your deployed app; your users point at a bug, InSitue opens a verified pull request.",
   "license": "MIT",
   "type": "module",