@lightworkai.official/debug-capture 0.6.0

package/README.md

@@ -0,0 +1,241 @@
+# @lightworkai.official/debug-capture
+
+A "report a problem" widget: rolling capture of network, console and user
+actions, plus a screenshot the user can draw on, filed as a ticket on a
+Lightwork Support host.
+
+Framework-agnostic core with React, Vue and Angular wrappers.
+
+```ts
+// once, at app start
+import { configureDebugCapture } from "@lightworkai.official/debug-capture";
+
+configureDebugCapture({
+  host: "https://support.example.com",
+  realmKey: "pk_live_…",              // public by design
+  app: { version: "1.4.2", environment: "production" },
+  user: () => ({ id, email, fullName, unit, roles }),
+});
+```
+
+```tsx
+<DebugCaptureInit />      {/* arms the buffers; renders nothing */}
+<ReportProblemButton />   {/* opens the reporter */}
+```
+
+## What it captures
+
+| | |
+| --- | --- |
+| Network | method, URL, status, duration for everything; bodies only for allowed origins |
+| Console | log/info/warn/error/debug, plus uncaught errors and rejections |
+| Actions | clicks, inputs, navigations, and overlays that appeared — with the control's own HTML before and after |
+| Context | route, module, user, viewport, memory, timing |
+| Cause | the failed requests and errors most likely to be the reason |
+| Screenshot | `getDisplayMedia` (captures cross-origin iframes), annotated by the user |
+
+## Configuration
+
+Everything app-specific is a callback, called at capture time. The package
+contains no hostnames, no keys and no organisation's vocabulary.
+
+See `DebugCaptureConfig` in [`src/config.ts`](src/config.ts). The parts worth
+knowing before you ship:
+
+- **`capture.bodyOrigins`** — response bodies are stored for same-origin only
+  unless you name more. Bodies from a third party your app merely talks to are
+  not yours to collect.
+- **`redact`** — extends the built-in header/query/body masking. Every app has a
+  secret the defaults do not know about.
+- **`module(pathname)`** — becomes the ticket's category. Defaults to the first
+  path segment.
+
+## The other half: letting people track what they reported
+
+Filing a report is one side. `<lw-my-tickets>` is the other — the list of what
+this person has reported and where each one stands, with the conversation, the
+team's answer, and a "still a problem" button — the reporter-facing
+counterpart to the agent's ticket list, as a component you drop on a route of
+your own.
+
+```tsx
+import { MyTicketsPanel } from "@lightworkai.official/debug-capture-react";
+
+export default function SupportPage() {
+  return <MyTicketsPanel />;   // or openMyTickets() for a modal
+}
+```
+
+### It needs to know who is asking
+
+This is the one part that is not plug-and-play, and it cannot be.
+
+`realmKey` is public by design — it ships in your client source, and that is
+fine for filing, because the worst a stolen key buys is noise the rate limits
+already absorb. **Reading is different.** "List the tickets for this email"
+behind a public key is an endpoint that reads *everyone's* reports.
+
+So your server vouches for your user. Ask the support team for the realm's reporter
+secret (an admin sets `authConfig.reporterSecret` on the realm), keep it on your
+**server**, and mint a short-lived token:
+
+```ts
+// your backend — e.g. app/api/support-token/route.ts
+import jwt from "jsonwebtoken";
+
+export async function GET() {
+  const user = await currentUser();                       // your session, your rules
+  const token = jwt.sign(
+    { sub: user.id, email: user.email, name: user.fullName },
+    process.env.SUPPORT_REPORTER_SECRET!,                 // never reaches the browser
+    { algorithm: "HS256", expiresIn: "1h" },
+  );
+  return Response.json({ token });
+}
+```
+
+```ts
+// your config — the callback just fetches that
+configureDebugCapture({
+  host, realmKey, app: { name: "ERP" },
+  identity: () => fetch("/api/support-token").then((r) => r.json()).then((d) => d.token),
+});
+```
+
+That is the whole contract. Tokens must carry `exp`, live at most 12 hours, and
+be signed HS256; anything else is refused. The callback runs per request, so
+cache the token on your side until it is close to expiring.
+
+`identity` is optional. Without it, filing still works exactly as before — the
+report is simply anonymous, and the panel says "sign in to see your reports"
+rather than showing an empty list. With it, submissions are linked to the person
+too, and the identity in the token wins over any `requesterEmail` in the body.
+
+### What the panel shows
+
+The realm's own status vocabulary, read from `/ingest/config` — so a lane an
+admin adds appears with its label and colour, and an **internal** lane is never
+named: the server resolves it to its public stand-in before it leaves. Internal
+notes are not in the payload either. Beyond that:
+
+- search over number, title, module and status; a status filter; sortable
+  columns; ten rows a page
+- **รอคุณตอบกลับ** in amber when the team is waiting on this person
+- **คำตอบจากทีม** — มีวิธีแก้ไข > ตอบกลับแล้ว > ยังไม่มีการตอบกลับ
+- a status hero, a progress timeline including reopens, the conversation, and
+  **ยังมีปัญหา** when the realm enables `selfServiceReopen`
+
+The reply box is TipTap, with the original's own toolbar — bold, italic,
+underline, bullets, numbers, link, image. TipTap is a PEER dependency, so an app
+that already has it pays nothing for it. Images upload first and are referenced
+by the token the server mints; pasting a screenshot straight in works, which is
+how one usually arrives.
+
+### Where the code lives
+
+This package is the **core**: the capture buffers, the bundle, the ingest client,
+the sanitiser, the status maps, the comparators, the dates, the strings — and one
+stylesheet. It renders no panel UI.
+
+The panel is real components in the framework packages:
+`@lightworkai.official/debug-capture-vue` ships `.vue` single-file components,
+`@lightworkai.official/debug-capture-react` ships `.tsx`, and
+`@lightworkai.official/debug-capture-angular` ships standalone components. Each is markup
+over the shared functions — the filtering, sorting and formatting exist once,
+here.
+
+Import the stylesheet once, from anywhere:
+
+```ts
+import "@lightworkai.official/debug-capture/style.css";
+```
+
+Every colour in it is a custom property, so a host restyles by setting variables
+rather than by fighting specificity:
+
+```css
+.my-app { --lw-primary: #7c3aed; --lw-accent: #6d28d9; }
+```
+
+There is no attachments list. The original's reporter view has none either, and
+what a widget report actually carries makes the reason plain: `debug-bundle.json`
+is the capture payload the *team* reads, and offering it as a download put the
+one artefact the reporter has no use for on their page. The screenshot they drew
+on is theirs, and it is shown as a picture.
+
+Message bodies are HTML written by other people and rendered inside *your* page,
+so they go through an allowlist sanitiser: a small tag set, no event handlers,
+links forced to `rel="noopener noreferrer nofollow"`, and images restricted to
+the host's own inline URLs — a remote `<img>` would make every ticket a tracking
+pixel aimed at whoever opens it.
+
+Both outcomes dispatch a cancelable event (`lw-ticket-replied`,
+`lw-ticket-reopened`, and their `-failed` pairs) before the built-in toast, so an
+app with its own notification system calls `preventDefault()` and shows its own.
+
+## Installing
+
+```bash
+bun add @lightworkai.official/debug-capture @lightworkai.official/debug-capture-react
+# or: npm i @lightworkai.official/debug-capture @lightworkai.official/debug-capture-vue
+```
+
+Install **both**: the framework package peer-depends on the core rather than
+carrying it as a transitive dependency. That is deliberate. The core keeps the
+capture buffers and the config as module-level singletons, so two copies in one
+app means the `fetch` you patched is not the `fetch` the reporter reads back —
+a failure that looks like "capture is empty" and nothing like a duplicate
+install. A peer dependency is how you say *there must be exactly one of these*.
+
+One stylesheet, imported once, from the core:
+
+```ts
+import "@lightworkai.official/debug-capture/style.css";
+```
+
+The wrappers deliberately do **not** re-export it. One file in one place is what
+keeps a consumer who installs two wrappers from shipping two copies of it.
+
+### Peers you may already have
+
+The wrappers compile the reply editor against TipTap and declare it as a peer
+instead of bundling it: an app that already uses TipTap must end up on a single
+copy, and the panel's editor should follow the app's version, not fight it.
+
+| package | peers, besides the core |
+| --- | --- |
+| `-react` | `react` · `@tiptap/react` + `starter-kit`, `extension-image`, `extension-placeholder` |
+| `-vue` | `vue` · `@tiptap/vue-3` + the same three |
+| `-angular` | `@angular/{core,common,forms,platform-browser}` · `@tiptap/core` + the same three |
+
+`html-to-image` is an *optional* peer of the core — see the maintainer notes.
+
+## Releasing
+
+```bash
+bun run release:packages 0.4.1   # bump all four, keep peer ranges, rebuild
+bun run check:packages           # typecheck, test, and verify dist is not stale
+```
+
+`dist` is **committed** as well as published. That makes it possible to change
+source and leave the built output behind — shipping the previous release's code
+under a new version number, with nothing downstream able to tell. `check:dist`
+rebuilds and fails if git sees a difference, which is the only thing standing
+between that mistake and a published tarball.
+
+## Notes for maintainers
+
+**This package has side effects and must never be marked `sideEffects: false`.**
+It patches `window.fetch` and `XMLHttpRequest` and defines a custom element. The
+claim was there once, and because `index.ts` is only re-exports, bundlers
+tree-shook the entire implementation away and emitted an entry that exported
+names bound to nothing — a build that succeeds and ships nothing.
+
+**`html-to-image` is an optional peer.** It is only the fallback for browsers
+without the Screen Capture API, and it is loaded by a runtime `import()` so an
+app that never installs it still builds.
+
+**The reporter UI is one custom element in a shadow root.** Not three framework
+components: the annotator alone would be three ports of the same canvas code.
+The shadow root also means the host's CSS cannot reach in, which is what makes
+this safe to drop into an app we do not control.

package/dist/budget.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Keeping a bundle inside what the server will accept.
+ *
+ * The capture buffers hold full response bodies, which is the point — a 500's
+ * body is usually the answer. But a long session can hold megabytes of them, and
+ * the ingest endpoint caps an attachment at 5 MB and the request at 10 MB total.
+ * Arriving over the limit means the report is refused at the very moment
+ * somebody finally bothered to file one.
+ *
+ * So trim, in the order that loses the least: response bodies are the biggest
+ * and least often needed, oldest first, because the failure that prompted the
+ * report is at the END of the buffer. Only if that is not enough do whole
+ * entries go, and the trail of actions is never touched — it is small, and it is
+ * the part a human actually reads.
+ */
+import type { DebugBundle } from "./types";
+/**
+ * Well under the 5 MB attachment cap. The gap is deliberate: base64 adds a
+ * third, and the screenshot is in the same request.
+ */
+export declare const BUNDLE_BUDGET_BYTES = 2000000;
+export declare function trimToBudget(bundle: DebugBundle, budget?: number): DebugBundle;

package/dist/bundle.d.ts

@@ -0,0 +1,20 @@
+import type { CapturedRequest, DebugBundle, DebugReason, ErroredQuery, ScreenshotMethod } from './types';
+export interface BuildBundleInput {
+    note: string;
+    reason: DebugReason;
+    screenshotDataUrl: string | null;
+    screenshotMethod: ScreenshotMethod;
+    erroredQueries: ErroredQuery[];
+}
+/** Snapshot the live buffers + context into an immutable bundle. */
+export declare function buildBundle(input: BuildBundleInput): DebugBundle;
+export declare function toCurl(req: CapturedRequest): string;
+/** Ticket-friendly Markdown report (excludes the screenshot binary). */
+export declare function bundleToMarkdown(bundle: DebugBundle): string;
+export declare function bundleFileName(bundle: DebugBundle, ext: string): string;
+export declare function hasCause(bundle: DebugBundle): boolean;
+export declare function downloadBlob(blob: Blob, filename: string): void;
+/** Copy a PNG data URL to the clipboard as an actual image (pasteable into
+ *  chat apps), not as base64 text. */
+export declare function copyImageToClipboard(dataUrl: string): Promise<boolean>;
+export declare function copyTextToClipboard(text: string): Promise<boolean>;

package/dist/capture/actionTrail.d.ts

@@ -0,0 +1,7 @@
+import type { ActionTrailEntry } from '../types';
+/** Display suffix for a collapsed repeated action, e.g. " (×4)". Empty for a
+ *  single occurrence — shared by the report text + the in-dialog preview. */
+export declare function actionCountSuffix(count?: number): string;
+export declare function installActionTrail(): void;
+export declare function getActionTrail(): ActionTrailEntry[];
+export declare function clearActionTrail(): void;

package/dist/capture/cause.d.ts

@@ -0,0 +1,3 @@
+import type { CapturedConsoleEntry, CapturedRequest, CauseSummary, ErroredQuery } from '../types';
+export declare function computeCause(network: CapturedRequest[], consoleLog: CapturedConsoleEntry[], erroredQueries: ErroredQuery[]): CauseSummary;
+export declare function causeCount(cause: CauseSummary): number;

package/dist/capture/consoleBuffer.d.ts

@@ -0,0 +1,4 @@
+import type { CapturedConsoleEntry } from '../types';
+export declare function installConsoleCapture(): void;
+export declare function getConsoleLog(): CapturedConsoleEntry[];
+export declare function clearConsoleLog(): void;

package/dist/capture/crashWatcher.d.ts

@@ -0,0 +1 @@
+export declare function installCrashWatcher(): void;

package/dist/capture/networkBuffer.d.ts

@@ -0,0 +1,4 @@
+import type { CapturedRequest } from '../types';
+export declare function installNetworkCapture(): void;
+export declare function getNetworkLog(): CapturedRequest[];
+export declare function clearNetworkLog(): void;

package/dist/capture/redact.d.ts

@@ -0,0 +1,9 @@
+export declare const REDACTED = "\u2039redacted\u203A";
+/** Strip likely PII (emails, phone/ID number runs) from a captured UI label.
+ *  Labels come from visible text, so they rarely hold secrets — but a container's
+ *  text can carry a reporter's name/number, and tickets are shown to admins. */
+export declare function redactLabel(text: string): string;
+export declare function redactHeaders(headers: Record<string, string>): Record<string, string>;
+export declare function redactUrl(rawUrl: string): string;
+/** Redact + truncate a request/response body string. */
+export declare function redactBody(body: string | null, maxLen: number): string | null;

package/dist/capture/stepCorrelation.d.ts

@@ -0,0 +1,41 @@
+import type { ActionTrailEntry, CapturedConsoleEntry, CapturedRequest } from '../types';
+export interface StepActivity {
+    /** ms since the previous step. Null on the first — nothing to measure from. */
+    elapsedMs: number | null;
+    /** Requests that STARTED while this step was the most recent one. */
+    requests: CapturedRequest[];
+    /** Subset that errored or came back >= 400 — usually the answer. */
+    failedRequests: CapturedRequest[];
+    /** error / exception / unhandledrejection logged in the same window. */
+    consoleErrors: CapturedConsoleEntry[];
+    /** Longest request in the window — surfaces the click that appeared to hang. */
+    slowestMs: number | null;
+}
+/** A request counts as failed if it rejected outright or returned >= 400. */
+export declare function isFailedRequest(req: CapturedRequest): boolean;
+/** Path (no origin, no query) for compact display — the origin is identical on
+ *  every row and the query is often a long redacted filter string.
+ *
+ *  Decoded before display: `URL` percent-encodes non-ASCII, and these paths
+ *  routinely carry Thai, so the raw `pathname` would render as a wall of
+ *  `%E0%B9%84…` exactly where a human is trying to read which endpoint failed. */
+export declare function requestPath(url: string): string;
+/**
+ * Attribute network + console activity to the step that was current at the time.
+ *
+ * Step `i` owns `[at(i), at(i+1))`; the last step owns everything after it.
+ * Returns one entry per trail row, in the same order, so callers can index by
+ * position without a lookup.
+ *
+ * Activity BEFORE the first recorded step belongs to no step and is omitted:
+ * the trail is a bounded ring buffer, so the earliest rows are frequently
+ * mid-session and anything before them was caused by actions already evicted —
+ * attributing it to step 1 would invent a link that isn't there. The Network and
+ * Console sections still list every row.
+ */
+export declare function correlateActionTrail(trail: readonly ActionTrailEntry[], network: readonly CapturedRequest[], consoleEntries: readonly CapturedConsoleEntry[]): StepActivity[];
+/** True when a step produced nothing worth showing — lets the UI skip the row
+ *  rather than print a line of zeroes under every step. */
+export declare function isQuietStep(activity: StepActivity, gapThresholdMs: number): boolean;
+/** Compact Thai duration: "1.4 วิ" / "12 วิ" / "2 นาที 5 วิ". */
+export declare function formatDuration(ms: number): string;

package/dist/config.d.ts

@@ -0,0 +1,217 @@
+/**
+ * Everything this library refuses to guess.
+ *
+ * The original read the app's env module, its user store and its API-header
+ * helper directly — three imports that made it un-shippable. They are callbacks
+ * now, and the rule they follow is: if a fact belongs to ONE app, the app
+ * supplies it.
+ *
+ * That includes the module vocabulary. The original hard-coded a map of Thai
+ * department names; a package that ships another organisation's org chart is
+ * not a package.
+ *
+ * Nothing here is secret. `realmKey` is public by design — the support ingest
+ * endpoint authenticates the widget with it and rate-limits per IP *and* per
+ * realm precisely because it travels in client code. Do not put a bearer token
+ * in `headers()`; it is captured into every bundle (redacted, but still).
+ */
+import type { DebugUser } from "./types";
+/** The shape of html-to-image's `toPng`, without depending on it. */
+export type ToPng = (node: HTMLElement, options?: Record<string, unknown>) => Promise<string>;
+export interface DebugCaptureConfig {
+    /** Support host origin, e.g. https://support.example.com */
+    host: string;
+    /** The realm's public embed key. */
+    realmKey: string;
+    app: {
+        /**
+         * What this app is called, in the words a support agent would use.
+         *
+         * It becomes the ticket's category, so a desk taking reports from several
+         * apps can filter by the one that broke. The module was doing that job,
+         * derived from the first path segment — which produced badges like "admin"
+         * and told a reader nothing about WHICH admin, of which app. A name the app
+         * states about itself cannot be wrong; one inferred from a URL usually is.
+         */
+        name: string;
+        /** Defaults to "0.0.0". Worth setting: it ties a report to a build. */
+        version?: string;
+        /**
+         * "production" | "uat" | "development" — free text; it is only reported.
+         *
+         * Inferred from the hostname when omitted, which gets localhost right and
+         * everything else wrong-but-harmless. A staging environment is worth naming
+         * yourself; nothing can guess the difference between uat and production
+         * from a URL.
+         */
+        environment?: string;
+    };
+    /** Who is using the app. Called at capture time, not at config time. */
+    user?: () => DebugUser;
+    /**
+     * Proof of who that is, minted by the HOST'S SERVER. Required only by the
+     * "my tickets" surface.
+     *
+     * `user()` above is a claim; this is evidence. Filing a report needs no
+     * evidence — the worst a false name buys is a mislabelled ticket — but reading
+     * reports back does, because `realmKey` is public and "show me the tickets for
+     * this email" behind a public key is an endpoint that reads everyone's.
+     *
+     * Your server signs a short-lived HS256 JWT with the realm's reporter secret:
+     *
+     *   jwt.sign({ sub: user.id, email: user.email, name: user.fullName },
+     *            process.env.SUPPORT_REPORTER_SECRET,
+     *            { algorithm: 'HS256', expiresIn: '1h' })
+     *
+     * The SECRET NEVER REACHES THE BROWSER. This callback fetches the finished
+     * token from your own backend; it is called per request, so cache it on your
+     * side until it is close to expiring.
+     *
+     * Returning null means "nobody is signed in" — the panel says so rather than
+     * failing.
+     */
+    identity?: () => string | null | Promise<string | null>;
+    /**
+     * Extra request headers the app sends, for the record — acting-as ids and
+     * the like. Redacted before it reaches a bundle.
+     */
+    headers?: () => Record<string, string>;
+    /**
+     * Which part of the app the user was in — สารบรรณ, ครุภัณฑ์, งบประมาณ.
+     *
+     * This becomes the ticket's category, because on a desk that supports web
+     * applications "which module broke" is the question worth filtering by. It
+     * falls back to `app.name`, so a single-module app still lands somewhere
+     * sensible without configuring anything.
+     *
+     * A DECLARED module is worth having; a guessed one is not. This used to
+     * default to the first path segment, which produced categories like "admin"
+     * — true of the URL and meaningless to whoever picks the report up. If the app
+     * cannot say, it should not guess, so the fallback is the app's own name.
+     *
+     * Return null for a path you have no name for. Most hosts declare a map of
+     * the screens they care about, and the rule this callback exists to enforce
+     * applies to THEM too: without a way to say "not one of mine", the only ways
+     * out are inventing a label or throwing, and a host that throws here looks
+     * like a host with no modules at all.
+     */
+    module?: (pathname: string) => {
+        key: string;
+        label: string;
+    } | null;
+    /** Anything else worth recording — feature flags, build id, tenant. */
+    extra?: () => Record<string, unknown>;
+    capture?: CaptureOptions;
+    redact?: RedactOptions;
+    /**
+     * A DOM-rendering screenshot fallback, for browsers without the Screen
+     * Capture API. Supplied by the host so this package never names a dependency
+     * it does not have — a bare `import('html-to-image')` here survives our build
+     * and then fails the CONSUMER's, because a minifier folds any runtime
+     * specifier back into a literal Rollup tries to resolve.
+     *
+     *   screenshotFallback: () => import('html-to-image').then((m) => m.toPng)
+     */
+    screenshotFallback?: () => Promise<ToPng | null>;
+    /** UI language. Only affects the built-in reporter's own strings. */
+    locale?: "th" | "en";
+}
+export interface CaptureOptions {
+    /** Rolling buffer sizes. */
+    maxRequests?: number;
+    maxConsoleEntries?: number;
+    maxActions?: number;
+    /** Per-response body cap, in characters. */
+    maxBodyChars?: number;
+    /**
+     * Origins whose RESPONSE BODIES may be captured. Same-origin is always
+     * included; anything else records method/status/duration only.
+     */
+    bodyOrigins?: string[];
+    /**
+     * CSS selectors for overlays worth recording when they appear — dialogs,
+     * menus, toasts. Defaults cover ARIA roles, which is most component libraries.
+     */
+    overlaySelectors?: string[];
+}
+export interface RedactOptions {
+    /** Extra header names to mask. Matched case-insensitively, as whole names. */
+    headers?: string[];
+    /** Extra query-string keys to mask. */
+    queryKeys?: string[];
+    /** Extra body keys to mask. Matched as a substring, like the built-ins. */
+    bodyKeys?: string[];
+}
+declare const DEFAULTS: {
+    maxRequests: number;
+    maxConsoleEntries: number;
+    maxActions: number;
+    maxBodyChars: number;
+};
+export declare function configureDebugCapture(config: DebugCaptureConfig): void;
+/**
+ * Throws rather than returning a default. A bundle assembled against a
+ * half-configured library would be submitted to nowhere and look like it
+ * worked — and that failure surfaces as a missing ticket, days later.
+ */
+export declare function getConfig(): DebugCaptureConfig;
+export declare function isConfigured(): boolean;
+/**
+ * The app's identity, with the parts it did not bother to state filled in.
+ *
+ * Everything optional in this library is optional because a sensible default
+ * exists — the config a host writes should be the things only that host knows.
+ */
+export declare function appInfo(): {
+    name: string;
+    version: string;
+    environment: string;
+};
+export declare function captureOption(key: keyof typeof DEFAULTS): number;
+/**
+ * The host's module for this path, or nothing.
+ *
+ * Nothing, deliberately: an undeclared module is not the first path segment. See
+ * the note on `module` above.
+ */
+export declare function resolveModule(pathname: string): {
+    key: string;
+    label: string;
+} | null;
+/** Redaction extras, always a usable shape even before configure() runs. */
+export declare function getRedactOptions(): Required<RedactOptions>;
+export declare function overlaySelectors(): string[];
+/**
+ * Whether a response body from this URL may be stored.
+ *
+ * Same-origin always: the app's own API is the whole reason anyone opens a
+ * report. Anything else only if the host named it in `bodyOrigins` — a body
+ * from a third party the host merely calls is not ours to collect.
+ *
+ * The one exclusion is the WIDGET'S OWN traffic: `/ingest/*` on the support
+ * host. Those calls are this library talking to itself, and a report that
+ * contains the request which fetched the report's own config tells a reader
+ * nothing.
+ *
+ * It used to exclude the support host's WHOLE origin, as a guard against a
+ * report filed from a ticket screen storing ticket bodies that themselves carry
+ * earlier reports' captured data. That was too blunt by half: when the app IS
+ * the support product filing its own bugs, the support host is its
+ * own origin, so the guard dropped every body it had and reports arrived with
+ * nothing but URLs and timings.
+ *
+ * The compounding it worried about is already bounded, and was before: every
+ * body is truncated at `maxBodyChars` (20k), a response over 1 MB is never read
+ * at all, and `trimToBudget` caps the finished bundle at 2 MB. A second, much
+ * coarser cap on top of those cost far more than it saved.
+ */
+export declare function mayCaptureBody(url: string): boolean;
+/**
+ * This library talking to the support host — `/ingest/config`, `/ingest/me/…`.
+ *
+ * Matched by PATH as well as origin, deliberately. Matching the origin alone is
+ * what made a self-hosted support app unable to capture anything: its own API
+ * lives on that origin too.
+ */
+export declare function isWidgetTraffic(target: URL): boolean;
+export {};

package/dist/context.d.ts

@@ -0,0 +1,2 @@
+import type { DebugContext } from "./types";
+export declare function collectContext(): DebugContext;