@reticlehq/browser 2.11.0 → 2.13.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reticlehq/browser",
-  "version": "2.11.0",
+  "version": "2.13.0",
   "description": "Reticle browser SDK — installs observers, builds semantic snapshots, executes actions, talks to the bridge.",
   "type": "module",
   "main": "./dist/index.js",
@@ -13,22 +13,19 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@testing-library/dom": "^10.4.1",
-    "@reticlehq/core": "2.11.0"
+    "@reticlehq/core": "2.13.0"
   },
   "devDependencies": {
     "@iconify-json/heroicons-outline": "^1.2.1",
     "@iconify-json/heroicons-solid": "^1.2.1",
     "@tanstack/query-core": "^5.101.4",
-    "@types/jsdom": "^30.0.0",
     "jotai": "^2.20.2",
     "jsdom": "^30.0.1",
-    "mobx": "^7.0.0",
+    "mobx": "^7.0.3",
     "pinia": "^4.0.3",
     "react": "^19.2.8",
     "recoil": "^0.7.7",
-    "sharp": "^0.35.3",
-    "svelte": "^5.56.8",
+    "svelte": "^5.56.10",
     "valtio": "^2.3.2",
     "vue": "^3.5.41",
     "xstate": "^5.32.5"

package/dist/dom/blind-spots.d.ts

@@ -1,13 +0,0 @@
-/**
- * Blind-spot detection, the detectable half). Cross-origin iframes are a real observation gap — the
- * SDK cannot see inside them (same-origin policy). We COUNT them so a result can say "coverage: partial —
- * 2 cross-origin frames unobserved" instead of implying it saw the whole page. Closed shadow roots are a
- * blind spot too, but undetectable by design (element.shadowRoot === null), so they are not counted here.
- */
-/** Pure: how many frames are cross-origin, given each frame's same-origin flag + whether it has a src. */
-export declare function classifyCrossOriginFrames(frames: ReadonlyArray<{
-    sameOrigin: boolean;
-    hasSrc: boolean;
-}>): number;
-/** Probe the live document: count iframes whose document is unreachable (cross-origin). */
-export declare function countCrossOriginFrames(): number;

package/dist/dom/blind-spots.js

@@ -1,29 +0,0 @@
-/**
- * Blind-spot detection, the detectable half). Cross-origin iframes are a real observation gap — the
- * SDK cannot see inside them (same-origin policy). We COUNT them so a result can say "coverage: partial —
- * 2 cross-origin frames unobserved" instead of implying it saw the whole page. Closed shadow roots are a
- * blind spot too, but undetectable by design (element.shadowRoot === null), so they are not counted here.
- */
-/** Pure: how many frames are cross-origin, given each frame's same-origin flag + whether it has a src. */
-export function classifyCrossOriginFrames(frames) {
-    return frames.filter((f) => f.hasSrc && !f.sameOrigin).length;
-}
-/** Probe the live document: count iframes whose document is unreachable (cross-origin). */
-export function countCrossOriginFrames() {
-    if ('undefined' === typeof document)
-        return 0;
-    const frames = [];
-    for (const frame of document.querySelectorAll('iframe')) {
-        const hasSrc = frame.getAttribute('src') !== null && frame.getAttribute('src') !== '';
-        let sameOrigin;
-        try {
-            // Reaching contentDocument throws (or yields null) for a cross-origin frame.
-            sameOrigin = frame.contentDocument !== null;
-        }
-        catch {
-            sameOrigin = false;
-        }
-        frames.push({ sameOrigin, hasSrc });
-    }
-    return classifyCrossOriginFrames(frames);
-}

package/dist/observers/subresources.d.ts

@@ -1,10 +0,0 @@
-export interface SubresourceObservation {
-    url: string;
-    method: string;
-    status?: number;
-    ok?: boolean;
-    durationMs: number;
-    transferSize?: number;
-    initiatorType: string;
-}
-export declare function collectSubresources(seenUrls: ReadonlySet<string>, nowMs: number, sinceMs: number): SubresourceObservation[];

package/dist/observers/subresources.js

@@ -1,63 +0,0 @@
-import { redactUrl } from './network-redact.js';
-/**
- * Document-initiated subresource observation.
- *
- * fetch/XHR patches never see requests the DOCUMENT makes on its own: `<link rel=icon>`,
- * `<link rel=manifest>`, stylesheets, `<img src>`, `<script src>`. Those are exactly the loads a
- * branding change touches, so a `{net}` predicate over them used to return `assertion_failed`
- * ("your change is broken") when the truthful answer was "not observable" — and an agent trusting
- * that verdict goes and "fixes" working code.
- *
- * `performance.getEntriesByType('resource')` reports these with no CDP and no patching: URL (name),
- * initiator type (`link`, `css`, `img`, `script`, …), duration, transfer size. The known limitation
- * is the status code — resource timing does not expose one directly (`responseStatus` exists only
- * in newer Chromium). Entries carry `status` ONLY when it could be read; predicates asserting a
- * status over unreadable data are handled at the evaluation seam, which downgrades rather than
- * guesses.
- *
- * Deduplication matters: a fetch/XHR-initiated request ALSO lands in resource timing. Every entry
- * is checked against the URLs the patched transports already reported this page, and only genuinely
- * document-initiated loads survive.
- */
-/** Resource-timing initiator types that mean "the document itself asked", not a patched transport. */
-const DOCUMENT_INITIATORS = new Set(['link', 'css', 'img', 'script', 'manifest', 'other']);
-/** Cap per call — a pathological page must not blow the event budget. */
-const MAX_SUBRESOURCE_EVENTS = 200;
-export function collectSubresources(seenUrls, nowMs, sinceMs) {
-    const out = [];
-    try {
-        const entries = performance.getEntriesByType('resource');
-        for (const entry of entries) {
-            const initiatorType = entry.initiatorType || 'other';
-            // fetch/XHR already have richer records from their own patches.
-            if (!DOCUMENT_INITIATORS.has(initiatorType))
-                continue;
-            const raw = entry.name;
-            if (seenUrls.has(raw))
-                continue;
-            const startMs = nowMs - entry.duration;
-            if (startMs < sinceMs)
-                continue;
-            const obs = {
-                url: redactUrl(raw),
-                method: 'GET',
-                durationMs: Math.round(entry.duration),
-                initiatorType,
-                ...(entry.transferSize > 0 ? { transferSize: entry.transferSize } : {}),
-            };
-            // responseStatus is Chromium-only and may be 0 when unreadable. Present ONLY when it says
-            // something real, so the wire never carries a guessed status.
-            const rs = entry.responseStatus;
-            if ('number' === typeof rs && rs > 0) {
-                obs.status = rs;
-                obs.ok = rs >= 200 && rs < 400;
-            }
-            out.push(obs);
-        }
-    }
-    catch {
-        // No resource-timing support / security error: report nothing, honestly.
-        return [];
-    }
-    return out.slice(0, MAX_SUBRESOURCE_EVENTS);
-}