@reticlehq/browser 2.0.1 → 2.2.0

package/dist/observers/console.js.map

@@ -1 +1 @@
-{"version":3,"file":"console.js","sourceRoot":"","sources":["../../src/observers/console.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAI7D,MAAM,YAAY,GAAqC;IACrD,GAAG,EAAE,SAAS,CAAC,WAAW;IAC1B,IAAI,EAAE,SAAS,CAAC,YAAY;IAC5B,KAAK,EAAE,SAAS,CAAC,aAAa;CAC/B,CAAC;AAEF,SAAS,aAAa,CAAC,IAAe;IACpC,OAAO,IAAI;SACR,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,YAAY,KAAK;YAAE,OAAO,CAAC,CAAC,OAAO,CAAC;QACzC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,cAAc,CAAC,IAAU;IACvC,MAAM,OAAO,GAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,IAAI,GAAG,EAA+C,CAAC;IAEzE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAiC,CAAC;QACjE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAChC,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAe,EAAQ,EAAE;YAC7C,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7D,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC;QACxB,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,KAAiB,EAAQ,EAAE;QAC1C,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE;YAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,QAAQ;YACtB,IAAI,EAAE,KAAK,CAAC,MAAM;SACnB,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,KAA4B,EAAQ,EAAE;QACzD,MAAM,MAAM,GAAY,KAAK,CAAC,MAAM,CAAC;QACrC,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE;YAC7B,OAAO,EAAE,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;YAClE,IAAI,EAAE,oBAAoB;SAC3B,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;IAE3D,OAAO,GAAG,EAAE;QACV,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC;YAC3C,OAAO,CAAC,MAAM,CAAC,GAAG,QAA8B,CAAC;QACnD,CAAC;QACD,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,CAAC,mBAAmB,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;IAChE,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"console.js","sourceRoot":"","sources":["../../src/observers/console.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAE9D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAI7D,MAAM,YAAY,GAAqC;IACrD,GAAG,EAAE,SAAS,CAAC,WAAW;IAC1B,IAAI,EAAE,SAAS,CAAC,YAAY;IAC5B,KAAK,EAAE,SAAS,CAAC,aAAa;IAC9B,oGAAoG;IACpG,wEAAwE;IACxE,IAAI,EAAE,SAAS,CAAC,YAAY;IAC5B,KAAK,EAAE,SAAS,CAAC,aAAa;CAC/B,CAAC;AAEF,SAAS,aAAa,CAAC,IAAe;IACpC,OAAO,IAAI;SACR,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,YAAY,KAAK;YAAE,OAAO,CAAC,CAAC,OAAO,CAAC;QACzC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,kFAAkF;AAClF,MAAM,aAAa,GAAG,gBAAgB,CAAC,gBAAgB,CAAC;AAExD,SAAS,QAAQ,CAAC,KAAyB;IACzC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChE,OAAO,KAAK,CAAC,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9E,CAAC;AAED,4GAA4G;AAC5G,SAAS,eAAe,CAAC,IAAe;IACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,YAAY,KAAK;YAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,cAAc,CAAC,IAAU;IACvC,MAAM,OAAO,GAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,IAAI,GAAG,EAA+C,CAAC;IACzE,MAAM,OAAO,GAAG,IAAI,GAAG,EAA+C,CAAC;IAEvE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAiC,CAAC;QACjE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAChC,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,CAAC,GAAG,IAAe,EAAQ,EAAE;YAC3C,+EAA+E;YAC/E,MAAM,KAAK,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACrE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE;gBACzB,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC;gBAC5B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;aAC1C,CAAC,CAAC;YACH,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC;QACxB,CAAC,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC;IAC5B,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,KAAiB,EAAQ,EAAE;QAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrF,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE;YAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,QAAQ;YACtB,IAAI,EAAE,KAAK,CAAC,MAAM;YAClB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,KAA4B,EAAQ,EAAE;QACzD,MAAM,MAAM,GAAY,KAAK,CAAC,MAAM,CAAC;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3E,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE;YAC7B,OAAO,EAAE,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;YAClE,IAAI,EAAE,oBAAoB;YAC1B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;IAE3D,OAAO,GAAG,EAAE;QACV,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC;YAC3C,8FAA8F;YAC9F,kFAAkF;YAClF,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,QAA8B,CAAC;QAChG,CAAC;QACD,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,CAAC,mBAAmB,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;IAChE,CAAC,CAAC;AACJ,CAAC"}

package/dist/observers/dom.d.ts

@@ -1,4 +1,4 @@
 import type { Emit, Teardown } from './types.js';
-/** Observe DOM mutations and emit semantic (not raw) events. See plan/03 §1. */
+/** Observe DOM mutations and emit semantic (not raw) events. */
 export declare function installDom(emit: Emit): Teardown;
 //# sourceMappingURL=dom.d.ts.map

package/dist/observers/dom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dom.d.ts","sourceRoot":"","sources":["../../src/observers/dom.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAwBjD,gFAAgF;AAChF,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,QAAQ,CA0E/C"}
+{"version":3,"file":"dom.d.ts","sourceRoot":"","sources":["../../src/observers/dom.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAqCjD,gEAAgE;AAChE,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,QAAQ,CA+G/C"}

package/dist/observers/dom.js

@@ -1,6 +1,19 @@
-import { EventType } from '@reticlehq/core';
+import { EventType, TruncationChannel } from '@reticlehq/core';
 import { getAccessibleName, getRole, isVisible } from '../dom/a11y.js';
 import { refs } from '../dom/refs.js';
+/**
+ * A STABLE identity for the region a mutation happened in. Ambient learning cannot key on the element
+ * ref for a churning list: every appended row is a NEW element (fresh ref) and a removed one has no ref
+ * at all, so per-ref counts never accumulate and the region is never recognized as ambient. The
+ * container persists across ticks, so its testid (or ref) is the identity that does accumulate.
+ */
+function regionKeyOf(target) {
+    const el = target instanceof Element ? target : null;
+    if (el === null)
+        return undefined;
+    const labelled = el.closest('[data-testid]');
+    return labelled?.getAttribute('data-testid') ?? refs.refFor(el);
+}
 import { isReticleOverlay } from '../dom/dom-ignore.js';
 const WATCHED_ATTRS = [
     'class',
@@ -12,7 +25,19 @@ const WATCHED_ATTRS = [
     'aria-selected',
     'aria-checked',
     'data-state',
+    // Widened: visual + resource + form-value attributes. Values are capped (they can be long).
+    'style',
+    'src',
+    'href',
+    'value',
 ];
+/** Attribute/text values are capped per event — style/src can be huge and would bloat the ledger. */
+const MAX_ATTR_VALUE_LEN = 120;
+function capValue(value) {
+    if (value === null)
+        return undefined;
+    return value.length > MAX_ATTR_VALUE_LEN ? `${value.slice(0, MAX_ATTR_VALUE_LEN)}…` : value;
+}
 const DIALOG_ROLES = new Set(['dialog', 'alertdialog']);
 const LIVE_ROLES = new Set(['alert', 'status']);
 /** Max meaningful added/removed nodes reported per mutation batch (backpressure). */
@@ -20,21 +45,35 @@ const MAX_PER_BATCH = 40;
 function isMeaningful(role, name) {
     return role !== 'generic' || name.length > 0;
 }
-/** Observe DOM mutations and emit semantic (not raw) events. See plan/03 §1. */
+/** Observe DOM mutations and emit semantic (not raw) events. */
 export function installDom(emit) {
     const observer = new MutationObserver((records) => {
         let added = 0;
         let removed = 0;
         let changed = 0;
+        // Count element nodes dropped purely because a per-batch cap was already reached. The cap is on
+        // MEANINGFUL events, so it is only hit after a real flood — the count is a raw over-estimate
+        // (it can include not-yet-inspected noise) but `dropped > 0` honestly means "this batch was capped".
+        let dropped = 0;
         for (const record of records) {
             if (record.type === 'attributes') {
                 const target = record.target;
                 if (target instanceof Element &&
                     record.attributeName !== null &&
-                    changed < MAX_PER_BATCH &&
                     !isReticleOverlay(target)) {
+                    if (changed >= MAX_PER_BATCH) {
+                        dropped += 1;
+                        continue;
+                    }
                     changed += 1;
-                    emit(EventType.DOM_ATTR, { attr: record.attributeName, value: target.getAttribute(record.attributeName) }, refs.refFor(target));
+                    // Old value (attributeOldValue) + capped new value — a diff, not just a reading.
+                    const value = capValue(target.getAttribute(record.attributeName));
+                    const old = capValue(record.oldValue);
+                    emit(EventType.DOM_ATTR, {
+                        attr: record.attributeName,
+                        ...(value === undefined ? {} : { value }),
+                        ...(old === undefined ? {} : { old }),
+                    }, refs.refFor(target));
                 }
                 continue;
             }
@@ -42,16 +81,25 @@ export function installDom(emit) {
                 // In-place text change inside an existing subtree (wizard steps, inline edits) —
                 // childList-only would miss this.
                 const parent = record.target.parentElement;
-                if (parent !== null && changed < MAX_PER_BATCH && !isReticleOverlay(parent)) {
+                if (parent !== null && !isReticleOverlay(parent)) {
+                    if (changed >= MAX_PER_BATCH) {
+                        dropped += 1;
+                        continue;
+                    }
                     changed += 1;
                     const text = (record.target.textContent ?? '').trim().slice(0, 80);
-                    emit(EventType.DOM_TEXT, { text }, refs.refFor(parent));
+                    const old = capValue(record.oldValue?.trim() ?? null);
+                    emit(EventType.DOM_TEXT, { text, ...(old === undefined ? {} : { old }) }, refs.refFor(parent));
                 }
                 continue;
             }
             for (const node of record.addedNodes) {
-                if (!(node instanceof Element) || added >= MAX_PER_BATCH)
+                if (!(node instanceof Element))
+                    continue;
+                if (added >= MAX_PER_BATCH) {
+                    dropped += 1;
                     continue;
+                }
                 if (isReticleOverlay(node))
                     continue;
                 const role = getRole(node);
@@ -60,7 +108,7 @@ export function installDom(emit) {
                     continue;
                 added += 1;
                 const ref = refs.refFor(node);
-                emit(EventType.DOM_ADDED, { role, name }, ref);
+                emit(EventType.DOM_ADDED, { role, name, region: regionKeyOf(record.target) }, ref);
                 if (DIALOG_ROLES.has(role) ||
                     LIVE_ROLES.has(role) ||
                     node.getAttribute('aria-modal') === 'true') {
@@ -69,8 +117,12 @@ export function installDom(emit) {
                 }
             }
             for (const node of record.removedNodes) {
-                if (!(node instanceof Element) || removed >= MAX_PER_BATCH)
+                if (!(node instanceof Element))
+                    continue;
+                if (removed >= MAX_PER_BATCH) {
+                    dropped += 1;
                     continue;
+                }
                 if (isReticleOverlay(node))
                     continue;
                 const role = getRole(node);
@@ -78,16 +130,23 @@ export function installDom(emit) {
                 if (!isMeaningful(role, name))
                     continue;
                 removed += 1;
-                emit(EventType.DOM_REMOVED, { role, name });
+                // A removed node has no ref (it is gone), so the CONTAINER is the only stable identity — and it
+                // is what ambient learning needs to recognize a churning region.
+                emit(EventType.DOM_REMOVED, { role, name, region: regionKeyOf(record.target) });
             }
         }
+        // Never silent: a capped batch tells the ledger its DOM counts understate reality.
+        if (dropped > 0)
+            emit(EventType.TRUNCATED, { channel: TruncationChannel.DOM, dropped });
     });
     observer.observe(document.documentElement, {
         subtree: true,
         childList: true,
         attributes: true,
         attributeFilter: WATCHED_ATTRS,
+        attributeOldValue: true,
         characterData: true,
+        characterDataOldValue: true,
     });
     return () => {
         observer.disconnect();

package/dist/observers/dom.js.map

@@ -1 +1 @@
-{"version":3,"file":"dom.js","sourceRoot":"","sources":["../../src/observers/dom.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGxD,MAAM,aAAa,GAAG;IACpB,OAAO;IACP,QAAQ;IACR,UAAU;IACV,MAAM;IACN,aAAa;IACb,eAAe;IACf,eAAe;IACf,cAAc;IACd,YAAY;CACb,CAAC;AAEF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AACxD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEhD,qFAAqF;AACrF,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC9C,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,IAAU;IACnC,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,CAAC,OAAO,EAAE,EAAE;QAChD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC7B,IACE,MAAM,YAAY,OAAO;oBACzB,MAAM,CAAC,aAAa,KAAK,IAAI;oBAC7B,OAAO,GAAG,aAAa;oBACvB,CAAC,gBAAgB,CAAC,MAAM,CAAC,EACzB,CAAC;oBACD,OAAO,IAAI,CAAC,CAAC;oBACb,IAAI,CACF,SAAS,CAAC,QAAQ,EAClB,EAAE,IAAI,EAAE,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAChF,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CACpB,CAAC;gBACJ,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBACpC,iFAAiF;gBACjF,kCAAkC;gBAClC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;gBAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,GAAG,aAAa,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC5E,OAAO,IAAI,CAAC,CAAC;oBACb,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACnE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC1D,CAAC;gBACD,SAAS;YACX,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACrC,IAAI,CAAC,CAAC,IAAI,YAAY,OAAO,CAAC,IAAI,KAAK,IAAI,aAAa;oBAAE,SAAS;gBACnE,IAAI,gBAAgB,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACrC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC3B,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC;oBAAE,SAAS;gBACxC,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC9B,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC/C,IACE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;oBACtB,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;oBACpB,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,MAAM,EAC1C,CAAC;oBACD,IAAI,SAAS,CAAC,IAAI,CAAC;wBAAE,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACvC,IAAI,CAAC,CAAC,IAAI,YAAY,OAAO,CAAC,IAAI,OAAO,IAAI,aAAa;oBAAE,SAAS;gBACrE,IAAI,gBAAgB,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACrC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC3B,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC;oBAAE,SAAS;gBACxC,OAAO,IAAI,CAAC,CAAC;gBACb,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,EAAE;QACzC,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,IAAI;QAChB,eAAe,EAAE,aAAa;QAC9B,aAAa,EAAE,IAAI;KACpB,CAAC,CAAC;IAEH,OAAO,GAAG,EAAE;QACV,QAAQ,CAAC,UAAU,EAAE,CAAC;IACxB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"dom.js","sourceRoot":"","sources":["../../src/observers/dom.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAEtC;;;;;GAKG;AACH,SAAS,WAAW,CAAC,MAAY;IAC/B,MAAM,EAAE,GAAG,MAAM,YAAY,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7C,OAAO,QAAQ,EAAE,YAAY,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAClE,CAAC;AACD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGxD,MAAM,aAAa,GAAG;IACpB,OAAO;IACP,QAAQ;IACR,UAAU;IACV,MAAM;IACN,aAAa;IACb,eAAe;IACf,eAAe;IACf,cAAc;IACd,YAAY;IACZ,4FAA4F;IAC5F,OAAO;IACP,KAAK;IACL,MAAM;IACN,OAAO;CACR,CAAC;AAEF,qGAAqG;AACrG,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B,SAAS,QAAQ,CAAC,KAAoB;IACpC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9F,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AACxD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEhD,qFAAqF;AACrF,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC9C,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,UAAU,CAAC,IAAU;IACnC,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,CAAC,OAAO,EAAE,EAAE;QAChD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,gGAAgG;QAChG,6FAA6F;QAC7F,qGAAqG;QACrG,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC7B,IACE,MAAM,YAAY,OAAO;oBACzB,MAAM,CAAC,aAAa,KAAK,IAAI;oBAC7B,CAAC,gBAAgB,CAAC,MAAM,CAAC,EACzB,CAAC;oBACD,IAAI,OAAO,IAAI,aAAa,EAAE,CAAC;wBAC7B,OAAO,IAAI,CAAC,CAAC;wBACb,SAAS;oBACX,CAAC;oBACD,OAAO,IAAI,CAAC,CAAC;oBACb,iFAAiF;oBACjF,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;oBAClE,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;oBACtC,IAAI,CACF,SAAS,CAAC,QAAQ,EAClB;wBACE,IAAI,EAAE,MAAM,CAAC,aAAa;wBAC1B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;wBACzC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;qBACtC,EACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CACpB,CAAC;gBACJ,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBACpC,iFAAiF;gBACjF,kCAAkC;gBAClC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;gBAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;oBACjD,IAAI,OAAO,IAAI,aAAa,EAAE,CAAC;wBAC7B,OAAO,IAAI,CAAC,CAAC;wBACb,SAAS;oBACX,CAAC;oBACD,OAAO,IAAI,CAAC,CAAC;oBACb,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACnE,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC;oBACtD,IAAI,CACF,SAAS,CAAC,QAAQ,EAClB,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAC/C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CACpB,CAAC;gBACJ,CAAC;gBACD,SAAS;YACX,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACrC,IAAI,CAAC,CAAC,IAAI,YAAY,OAAO,CAAC;oBAAE,SAAS;gBACzC,IAAI,KAAK,IAAI,aAAa,EAAE,CAAC;oBAC3B,OAAO,IAAI,CAAC,CAAC;oBACb,SAAS;gBACX,CAAC;gBACD,IAAI,gBAAgB,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACrC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC3B,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC;oBAAE,SAAS;gBACxC,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC9B,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;gBACnF,IACE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;oBACtB,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;oBACpB,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,MAAM,EAC1C,CAAC;oBACD,IAAI,SAAS,CAAC,IAAI,CAAC;wBAAE,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACvC,IAAI,CAAC,CAAC,IAAI,YAAY,OAAO,CAAC;oBAAE,SAAS;gBACzC,IAAI,OAAO,IAAI,aAAa,EAAE,CAAC;oBAC7B,OAAO,IAAI,CAAC,CAAC;oBACb,SAAS;gBACX,CAAC;gBACD,IAAI,gBAAgB,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACrC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC3B,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC;oBAAE,SAAS;gBACxC,OAAO,IAAI,CAAC,CAAC;gBACb,gGAAgG;gBAChG,iEAAiE;gBACjE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QACD,mFAAmF;QACnF,IAAI,OAAO,GAAG,CAAC;YAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,EAAE;QACzC,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,IAAI;QAChB,eAAe,EAAE,aAAa;QAC9B,iBAAiB,EAAE,IAAI;QACvB,aAAa,EAAE,IAAI;QACnB,qBAAqB,EAAE,IAAI;KAC5B,CAAC,CAAC;IAEH,OAAO,GAAG,EAAE;QACV,QAAQ,CAAC,UAAU,EAAE,CAAC;IACxB,CAAC,CAAC;AACJ,CAAC"}

package/dist/observers/focus.d.ts

@@ -0,0 +1,10 @@
+import type { Emit, Teardown } from './types.js';
+/** A human-legible label for a focused element, or undefined for body/none. Pure; exported for testing. */
+export declare function focusLabel(el: EventTarget | null): string | undefined;
+/**
+ * Track element focus movement. Focus dropping to <body> after an act — a modal that closed and stranded
+ * focus, a button that vanished — is a real accessibility/UX regression no screenshot names. Emits
+ * FOCUS_CHANGE {to, from, toBody}. Reversible.
+ */
+export declare function installFocus(emit: Emit): Teardown;
+//# sourceMappingURL=focus.d.ts.map

package/dist/observers/focus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"focus.d.ts","sourceRoot":"","sources":["../../src/observers/focus.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEjD,2GAA2G;AAC3G,wBAAgB,UAAU,CAAC,EAAE,EAAE,WAAW,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAKrE;AAMD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,QAAQ,CA+BjD"}

package/dist/observers/focus.js

@@ -0,0 +1,49 @@
+import { EventType } from '@reticlehq/core';
+import { getAccessibleName, getRole } from '../dom/a11y.js';
+/** A human-legible label for a focused element, or undefined for body/none. Pure; exported for testing. */
+export function focusLabel(el) {
+    if (!(el instanceof Element) || el === document.body)
+        return undefined;
+    const role = getRole(el);
+    const name = getAccessibleName(el);
+    return name.length > 0 ? `${role} "${name}"` : role;
+}
+function toBody(el) {
+    return el === null || el === document.body;
+}
+/**
+ * Track element focus movement. Focus dropping to <body> after an act — a modal that closed and stranded
+ * focus, a button that vanished — is a real accessibility/UX regression no screenshot names. Emits
+ * FOCUS_CHANGE {to, from, toBody}. Reversible.
+ */
+export function installFocus(emit) {
+    let last = null;
+    const onFocusIn = (event) => {
+        const to = event.target;
+        const from = last;
+        last = to;
+        emit(EventType.FOCUS_CHANGE, {
+            ...(focusLabel(to) === undefined ? {} : { to: focusLabel(to) }),
+            ...(focusLabel(from) === undefined ? {} : { from: focusLabel(from) }),
+            toBody: toBody(to),
+        });
+    };
+    const onFocusOut = (event) => {
+        // Focus left with nothing gaining it → it dropped to the body (the regression case).
+        if (event.relatedTarget !== null)
+            return;
+        const from = last;
+        last = null;
+        emit(EventType.FOCUS_CHANGE, {
+            ...(focusLabel(from) === undefined ? {} : { from: focusLabel(from) }),
+            toBody: true,
+        });
+    };
+    document.addEventListener('focusin', onFocusIn);
+    document.addEventListener('focusout', onFocusOut);
+    return () => {
+        document.removeEventListener('focusin', onFocusIn);
+        document.removeEventListener('focusout', onFocusOut);
+    };
+}
+//# sourceMappingURL=focus.js.map

package/dist/observers/focus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"focus.js","sourceRoot":"","sources":["../../src/observers/focus.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAG5D,2GAA2G;AAC3G,MAAM,UAAU,UAAU,CAAC,EAAsB;IAC/C,IAAI,CAAC,CAAC,EAAE,YAAY,OAAO,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IACvE,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED,SAAS,MAAM,CAAC,EAAsB;IACpC,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAU;IACrC,IAAI,IAAI,GAAuB,IAAI,CAAC;IAEpC,MAAM,SAAS,GAAG,CAAC,KAAiB,EAAQ,EAAE;QAC5C,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC;QAClB,IAAI,GAAG,EAAE,CAAC;QACV,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE;YAC3B,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;SACnB,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,KAAiB,EAAQ,EAAE;QAC7C,qFAAqF;QACrF,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI;YAAE,OAAO;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC;QAClB,IAAI,GAAG,IAAI,CAAC;QACZ,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE;YAC3B,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,QAAQ,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAChD,QAAQ,CAAC,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAClD,OAAO,GAAG,EAAE;QACV,QAAQ,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACnD,QAAQ,CAAC,mBAAmB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACvD,CAAC,CAAC;AACJ,CAAC"}

package/dist/observers/network-body.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Resolve with the body text, or `undefined` if it takes too long.
+ *
+ * The app is already awaiting our patched fetch, so any unbounded read here is a hang in the host app.
+ * Losing an observation is always preferable to freezing the page being observed.
+ */
+export declare function withBodyDeadline(read: Promise<string>): Promise<string | undefined>;
+export declare function isCapturableType(contentType: string | null): boolean;
+/**
+ * Redact + cap a body for the agent transcript. JSON is parsed and run through the same
+ * sanitizeForTransport redaction used for state (sensitive keys -> [REDACTED]); every other text body
+ * (and JSON that didn't parse) goes through redactText so form/plain-text credentials can't leak.
+ * Returns the (possibly truncated) body plus whether it was cut.
+ */
+export declare function projectBody(rawText: string, contentType: string | null): {
+    body: string;
+    truncated: boolean;
+};
+//# sourceMappingURL=network-body.d.ts.map

package/dist/observers/network-body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-body.d.ts","sourceRoot":"","sources":["../../src/observers/network-body.ts"],"names":[],"mappings":"AAuCA;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAgBzF;AAED,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAIpE;AAkDD;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAAG,IAAI,GACzB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CA8BtC"}

package/dist/observers/network-body.js

@@ -0,0 +1,143 @@
+/**
+ * Response/request BODY projection for the network observer.
+ *
+ * Split out of network.ts, which had grown to hold URL redaction, body projection, fetch, XHR, SSE,
+ * WebSocket and sendBeacon at once. This module owns exactly one question: given a body, what is safe
+ * and affordable to report?
+ */
+import { REDACTED_VALUE } from '@reticlehq/core';
+import { isSensitiveKey, safeStringify, scrubKnownSecrets } from '../security/serialization.js';
+import { nativeClearTimeout, nativeSetTimeout } from '../timers/native-timers.js';
+/** Only text-like bodies are worth capturing; binary (images/fonts/octet-stream) is skipped. */
+const CAPTURABLE_CONTENT = /application\/json|text\/|application\/xml|x-www-form-urlencoded|graphql/i;
+/**
+ * Content types that are STREAMS, never complete bodies.
+ *
+ * `text/event-stream` matches `text/` in CAPTURABLE_CONTENT, and body capture awaited
+ * `res.clone.text` BEFORE returning the response to the app. A clone of a stream only settles when
+ * the stream ends — and an SSE stream does not end — so the app's `await fetch...)` never resolved.
+ * Enabling body capture silently hung every streaming endpoint (SSE, and the chunked `application/json`
+ * every token-streaming model API uses), leaving a permanently loading UI with no reason to suspect the
+ * observability SDK. Never read these; the frame observer covers SSE properly.
+ */
+const STREAMING_CONTENT = /event-stream|x-ndjson|application\/stream/i;
+/**
+ * Longest the SDK will wait on a response-body clone before emitting without it.
+ *
+ * Two layers protect the app. `text/event-stream` and friends are skipped outright, which covers the
+ * common streaming case at zero cost. This deadline is the backstop for a body that streams WITHOUT
+ * announcing it in its content type — chunked `application/json` from a token-streaming API. Gating on
+ * `content-length` instead was tried and rejected: plenty of complete responses omit it (gzip, HTTP/2),
+ * so that would silently stop capturing bodies for ordinary apps. A bounded half-second on a rare path
+ * beats an unbounded hang, and beats losing capture everywhere.
+ */
+const BODY_READ_TIMEOUT_MS = 500;
+/**
+ * Resolve with the body text, or `undefined` if it takes too long.
+ *
+ * The app is already awaiting our patched fetch, so any unbounded read here is a hang in the host app.
+ * Losing an observation is always preferable to freezing the page being observed.
+ */
+export async function withBodyDeadline(read) {
+    // The timer is CLEARED on the winning path. Left uncleared, every captured body leaves a live timer
+    // and a retained closure behind — harmless individually, but `boundedFrame` in this same package
+    // already races-with-cleanup correctly, so not reusing that shape was an oversight rather than a
+    // choice. It also keeps test workers from being held open by pending handles.
+    let timer;
+    try {
+        return await Promise.race([
+            read,
+            new Promise((resolve) => {
+                timer = nativeSetTimeout(() => resolve(undefined), BODY_READ_TIMEOUT_MS);
+            }),
+        ]);
+    }
+    finally {
+        if (timer !== undefined)
+            nativeClearTimeout(timer);
+    }
+}
+export function isCapturableType(contentType) {
+    if (contentType === null)
+        return false;
+    if (STREAMING_CONTENT.test(contentType))
+        return false;
+    return CAPTURABLE_CONTENT.test(contentType);
+}
+/**
+ * Per-body character cap. Bodies ride the same ring buffer as the DOM/route/console timeline, so an
+ * uncapped body could evict the whole behavioral history; the small cap keeps a few large responses
+ * from starving the timeline (the separate-budget concern in the scalability audit).
+ */
+const MAX_BODY_CHARS = 8192;
+/**
+ * Hard bound on how much of a body is ever PARSED or SCANNED, independent of how much is reported.
+ *
+ * Only twice the output cap, and that ceiling is measured rather than guessed. The redaction pass uses
+ * `[A-Za-z0-9_.-]+` followed by a delimiter, which backtracks quadratically on a long run without one.
+ * Timed on this machine: 8 KB → 36 ms, 16 KB → 136 ms, 64 KB → 2067 ms. A first attempt at 8× the
+ * output cap therefore still froze the main thread for seconds, so the bound is set where the cost
+ * stays bounded AND redaction keeps enough context to catch a secret straddling the reported edge.
+ * Scanning far past the output cap is wasted work in any case — only 8 KB is ever reported.
+ */
+const MAX_BODY_SCAN_CHARS = MAX_BODY_CHARS * 2;
+/**
+ * An `Authorization: Bearer …` / `Basic …` credential. The token side requires credential shape — 16+
+ * chars AND at least one digit or symbol — so ordinary prose ("Basic subscription includes…", "Bearer
+ * capacity exceeded") is NOT mangled, only actual opaque tokens are.
+ */
+const AUTH_SCHEME_TOKEN = /\b(Bearer|Basic)\s+(?=[A-Za-z0-9._~+/=-]{16,})(?=[A-Za-z0-9._~+/=-]*[\d._~+/=-])[A-Za-z0-9._~+/=-]+/gi;
+/**
+ * Redact credentials in ANY text body (form-urlencoded, text/plain, xml, or JSON that failed to parse).
+ * sanitizeForTransport only redacts KEYS inside a parsed object, so a `password=secret` form post or a
+ * `Bearer <token>` string would otherwise ship verbatim. Redacts the value of any `key=value` / `key: value`
+ * pair whose key is sensitive, plus credential-shaped auth-scheme tokens.
+ */
+function redactText(text) {
+    return (text
+        // Auth-scheme tokens FIRST: `Authorization: Bearer <token>` — the key/value rule below would
+        // otherwise consume just "Bearer" as Authorization's value (it stops at whitespace) and leave the
+        // token behind, so the scheme rule must run before it.
+        .replace(AUTH_SCHEME_TOKEN, (_m, scheme) => `${scheme} ${REDACTED_VALUE}`)
+        .replace(/([A-Za-z0-9_.-]+)(\s*[=:]\s*"?)([^&\s,;"}]+)/g, (match, key, sep) => isSensitiveKey(key) ? `${key}${sep}${REDACTED_VALUE}` : match));
+}
+/**
+ * Redact + cap a body for the agent transcript. JSON is parsed and run through the same
+ * sanitizeForTransport redaction used for state (sensitive keys -> [REDACTED]); every other text body
+ * (and JSON that didn't parse) goes through redactText so form/plain-text credentials can't leak.
+ * Returns the (possibly truncated) body plus whether it was cut.
+ */
+export function projectBody(rawText, contentType) {
+    // Bound the INPUT before any parsing or scanning. The cap used to be applied only at the end, so a
+    // large body was JSON.parsed in full, deep-walked, re-stringified, and swept by two global regexes
+    // before all but 8 KB of the result was thrown away — seconds of synchronous main-thread work for a
+    // fixed-size output. A 30 MB CSV export or a big HTML error page froze the app, which is the same
+    // class of host-app damage as the streaming hang, with the SDK still the cause.
+    //
+    // The slice is generous (a multiple of the output cap) so redaction still sees enough context to
+    // recognise a secret that straddles the boundary, while the work stays bounded regardless of body size.
+    const oversized = rawText.length > MAX_BODY_SCAN_CHARS;
+    const text = oversized ? rawText.slice(0, MAX_BODY_SCAN_CHARS) : rawText;
+    let out;
+    if (contentType !== null && /json|graphql/i.test(contentType)) {
+        try {
+            // safeStringify already sanitizes internally — the extra sanitizeForTransport here re-walked
+            // every captured JSON body a second time (~21% of the per-response cost) for an identical result.
+            out = safeStringify(JSON.parse(text));
+        }
+        catch {
+            out = redactText(text); // looked like JSON but wasn't — still redact key/value + auth tokens
+        }
+    }
+    else {
+        out = redactText(text);
+    }
+    // Key-based redaction can't see a secret sitting in a VALUE under a benign key — scan the projected
+    // text for high-confidence secret shapes (JWTs, provider keys) as a backstop, JSON or not.
+    out = scrubKnownSecrets(out);
+    // Truncated if the projection overflows the cap OR the input itself was clipped above — a body the
+    // SDK never fully read must not be reported as complete.
+    const truncated = oversized || out.length > MAX_BODY_CHARS;
+    return { body: out.length > MAX_BODY_CHARS ? out.slice(0, MAX_BODY_CHARS) : out, truncated };
+}
+//# sourceMappingURL=network-body.js.map

package/dist/observers/network-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-body.js","sourceRoot":"","sources":["../../src/observers/network-body.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAElF,gGAAgG;AAChG,MAAM,kBAAkB,GACtB,0EAA0E,CAAC;AAE7E;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAG,4CAA4C,CAAC;AAEvE;;;;;;;;;GASG;AACH,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAqB;IAC1D,oGAAoG;IACpG,iGAAiG;IACjG,iGAAiG;IACjG,8EAA8E;IAC9E,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,IAAI;YACJ,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,EAAE;gBACjC,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC,CAAC;YAC3E,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS;YAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,WAA0B;IACzD,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B;;;;;;;;;GASG;AACH,MAAM,mBAAmB,GAAG,cAAc,GAAG,CAAC,CAAC;AAE/C;;;;GAIG;AACH,MAAM,iBAAiB,GACrB,uGAAuG,CAAC;AAE1G;;;;;GAKG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,CACL,IAAI;QACF,6FAA6F;QAC7F,kGAAkG;QAClG,uDAAuD;SACtD,OAAO,CAAC,iBAAiB,EAAE,CAAC,EAAU,EAAE,MAAc,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,cAAc,EAAE,CAAC;SACzF,OAAO,CACN,+CAA+C,EAC/C,CAAC,KAAa,EAAE,GAAW,EAAE,GAAW,EAAE,EAAE,CAC1C,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,GAAG,GAAG,cAAc,EAAE,CAAC,CAAC,CAAC,KAAK,CAChE,CACJ,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,WAA0B;IAE1B,mGAAmG;IACnG,mGAAmG;IACnG,oGAAoG;IACpG,kGAAkG;IAClG,gFAAgF;IAChF,EAAE;IACF,iGAAiG;IACjG,wGAAwG;IACxG,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,mBAAmB,CAAC;IACvD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACzE,IAAI,GAAW,CAAC;IAChB,IAAI,WAAW,KAAK,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC;YACH,6FAA6F;YAC7F,kGAAkG;YAClG,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,qEAAqE;QAC/F,CAAC;IACH,CAAC;SAAM,CAAC;QACN,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,oGAAoG;IACpG,2FAA2F;IAC3F,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC7B,mGAAmG;IACnG,yDAAyD;IACzD,MAAM,SAAS,GAAG,SAAS,IAAI,GAAG,CAAC,MAAM,GAAG,cAAc,CAAC;IAC3D,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC;AAC/F,CAAC"}

package/dist/observers/network-redact.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Redact credential-bearing values so they don't leak into the agent transcript / flow / run
+ * artifacts: query params (`?access_token=…`, signed-URL keys) via the shared `isSensitiveKey` regex,
+ * AND path-embedded tokens (`/reset/<token>`, `/invite/<token>`) that live in the path, not the query.
+ * The hash is preserved and the URL is returned byte-for-byte when nothing matched.
+ */
+export declare function redactUrl(raw: string): string;
+//# sourceMappingURL=network-redact.d.ts.map

package/dist/observers/network-redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-redact.d.ts","sourceRoot":"","sources":["../../src/observers/network-redact.ts"],"names":[],"mappings":"AASA;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CA4D7C"}

package/dist/observers/network-redact.js

@@ -0,0 +1,66 @@
+import { REDACTED_VALUE } from '@reticlehq/core';
+import { isSensitiveKey } from '../security/serialization.js';
+/** A path segment name that is typically followed by a single-use secret token in the NEXT segment. */
+const SENSITIVE_PATH_SEGMENT = /^(reset|verify|verification|confirm|activate|invite|magic|magiclink|token|key|oauth|unsubscribe|password)$/i;
+/** Only mask a following segment that looks token-like — short ids/words (`reset/form`) are left alone. */
+const PATH_TOKEN_MIN_LENGTH = 12;
+/**
+ * Redact credential-bearing values so they don't leak into the agent transcript / flow / run
+ * artifacts: query params (`?access_token=…`, signed-URL keys) via the shared `isSensitiveKey` regex,
+ * AND path-embedded tokens (`/reset/<token>`, `/invite/<token>`) that live in the path, not the query.
+ * The hash is preserved and the URL is returned byte-for-byte when nothing matched.
+ */
+export function redactUrl(raw) {
+    const hashStart = raw.indexOf('#');
+    const hash = hashStart === -1 ? '' : raw.slice(hashStart);
+    const beforeHash = hashStart === -1 ? raw : raw.slice(0, hashStart);
+    const queryStart = beforeHash.indexOf('?');
+    const pathPart = queryStart === -1 ? beforeHash : beforeHash.slice(0, queryStart);
+    const query = queryStart === -1 ? '' : beforeHash.slice(queryStart + 1);
+    let changed = false;
+    // Credentials in the authority (`scheme://user:pass@host`) never belong in a transcript.
+    // Match to the LAST `@` before the path (`[^/]*@`, greedy), not the first — a password containing
+    // `@` (`user:p@ss@host`) otherwise left its tail (`ss@host`) in the clear.
+    let authority = pathPart;
+    const userinfo = /^([a-z][a-z0-9+.-]*:\/\/)[^/]*@/i.exec(pathPart);
+    if (userinfo !== null) {
+        authority = `${userinfo[1] ?? ''}${REDACTED_VALUE}@${pathPart.slice(userinfo[0].length)}`;
+        changed = true;
+    }
+    let newQuery = query;
+    if (query !== '') {
+        const params = new URLSearchParams(query);
+        for (const key of [...params.keys()]) {
+            if (isSensitiveKey(key)) {
+                params.set(key, REDACTED_VALUE);
+                changed = true;
+            }
+        }
+        newQuery = params.toString();
+    }
+    const segments = authority.split('/');
+    for (let i = 0; i + 1 < segments.length; i++) {
+        const name = segments[i];
+        const next = segments[i + 1];
+        if (name !== undefined &&
+            next !== undefined &&
+            next.length >= PATH_TOKEN_MIN_LENGTH &&
+            SENSITIVE_PATH_SEGMENT.test(name)) {
+            segments[i + 1] = REDACTED_VALUE;
+            changed = true;
+        }
+    }
+    // OAuth implicit flow puts the access_token in the FRAGMENT (`#access_token=…`), and hash-routers carry
+    // `?token=…` in the hash — redact sensitive params there too, leaving plain anchors (`#section`) alone.
+    let newHash = hash;
+    if (hash.length > 1) {
+        newHash = hash.replace(/([A-Za-z0-9_.-]+)=([^&\s]+)/g, (m, key) => isSensitiveKey(key) ? `${key}=${REDACTED_VALUE}` : m);
+        if (newHash !== hash)
+            changed = true;
+    }
+    if (!changed)
+        return raw;
+    const queryOut = queryStart === -1 ? '' : `?${newQuery}`;
+    return `${segments.join('/')}${queryOut}${newHash}`;
+}
+//# sourceMappingURL=network-redact.js.map

package/dist/observers/network-redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-redact.js","sourceRoot":"","sources":["../../src/observers/network-redact.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,uGAAuG;AACvG,MAAM,sBAAsB,GAC1B,6GAA6G,CAAC;AAChH,2GAA2G;AAC3G,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAExE,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,yFAAyF;IACzF,kGAAkG;IAClG,2EAA2E;IAC3E,IAAI,SAAS,GAAG,QAAQ,CAAC;IACzB,MAAM,QAAQ,GAAG,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,SAAS,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,cAAc,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1F,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACrC,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;gBAChC,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QACD,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,IACE,IAAI,KAAK,SAAS;YAClB,IAAI,KAAK,SAAS;YAClB,IAAI,CAAC,MAAM,IAAI,qBAAqB;YACpC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EACjC,CAAC;YACD,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,cAAc,CAAC;YACjC,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IAED,wGAAwG;IACxG,wGAAwG;IACxG,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,8BAA8B,EAAE,CAAC,CAAS,EAAE,GAAW,EAAE,EAAE,CAChF,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,CACrD,CAAC;QACF,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,GAAG,IAAI,CAAC;IACvC,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC;IACzB,MAAM,QAAQ,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;IACzD,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,GAAG,OAAO,EAAE,CAAC;AACtD,CAAC"}

package/dist/observers/network.d.ts

@@ -1,11 +1,23 @@
 import type { Emit, Teardown } from './types.js';
+import { redactUrl } from './network-redact.js';
+export { redactUrl };
+/** Config for the network observer. Body capture is OFF by default and dev-only opt-in. */
+export interface NetworkOptions {
+    /** Capture request/response bodies (text-like content only, redacted, per-body capped). */
+    captureBodies?: boolean;
+}
+/** Pure: the first real app-code frame in a stack string, capped. Exported for unit testing. */
+export declare function firstAppFrame(stack: string | undefined): string | undefined;
+/** The timing fields we lift from a resource entry — TTFB is the perf signal a duration alone hides. */
+export interface NetTiming {
+    ttfbMs?: number;
+    transferSize?: number;
+}
 /**
- * Redact credential-bearing query params (`?access_token=…`, signed-URL keys, magic-link tokens) so
- * they don't leak into the agent transcript / flow / run artifacts. Only the query string is rewritten
- * — the path (relative or absolute) and any hash are preserved — and only when something actually
- * matched, so non-sensitive URLs pass through byte-for-byte. Uses the shared `isSensitiveKey` regex.
+ * Pure: derive TTFB + transfer size from a PerformanceResourceTiming entry. TTFB = responseStart -
+ * requestStart; cross-origin responses zero those (Timing-Allow-Origin), so we omit rather than report a
+ * bogus 0. Exported for unit testing (jsdom doesn't post real resource entries).
  */
-export declare function redactUrl(raw: string): string;
-/** Patch fetch + XMLHttpRequest to emit net.request events. Fully reversible. */
-export declare function installNetwork(emit: Emit): Teardown;
+export declare function extractTiming(entry: PerformanceResourceTiming | undefined): NetTiming;
+export declare function installNetwork(emit: Emit, opts?: NetworkOptions): Teardown;
 //# sourceMappingURL=network.d.ts.map

package/dist/observers/network.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../src/observers/network.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAiB7C;AAqBD,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,GAAG,QAAQ,CAiGnD"}
+{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../src/observers/network.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEjD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAIhD,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB,2FAA2F;AAC3F,MAAM,WAAW,cAAc;IAC7B,2FAA2F;IAC3F,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AA2GD,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAS3E;AAMD,wGAAwG;AACxG,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,yBAAyB,GAAG,SAAS,GAAG,SAAS,CAQrF;AAwDD,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,GAAE,cAAmB,GAAG,QAAQ,CAgV9E"}