@scalebun-release/web 2.2.2

package/dist/features/network/parse/url.js

@@ -0,0 +1,52 @@
+/**
+ * N0 — URL → templated `route` grouping key. Strips volatile path segments (numeric ids, UUIDs,
+ * hashes, ULIDs) down to `:id` so `/users/42` and `/users/99` group as `/users/:id`, and drops the
+ * query string + hash. Pure, allocation-light, zero-dep. Used as the stable grouping key for the
+ * dashboard's "by endpoint" rollups and (later) the failure-rate / anomaly detector.
+ */
+// One alternation covers: pure numeric id · UUID · Mongo ObjectId / long hex (≥16) · ULID (Crockford).
+const ID_SEG = /^(?:\d+|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|[0-9a-f]{16,}|[0-9A-HJKMNP-TV-Z]{26})$/i;
+/** True if a path segment looks like a volatile identifier we should template out. */
+function isIdSegment(seg) {
+    if (!seg)
+        return false;
+    if (ID_SEG.test(seg))
+        return true;
+    // mixed alnum tokens that contain a digit and are long-ish (e.g. "a1b2c3d4e5") — likely an id
+    if (seg.length >= 12 && /\d/.test(seg) && /^[A-Za-z0-9_-]+$/.test(seg))
+        return true;
+    return false;
+}
+/**
+ * Templated grouping route from a (possibly relative) URL. Returns `METHODless` path with ids → `:id`.
+ * Falls back to the raw pathname (or the input) when the URL can't be parsed. Never throws.
+ */
+export function templateRoute(url) {
+    let pathname = url;
+    try {
+        const base = typeof location !== 'undefined' ? location.href : 'http://x';
+        pathname = new URL(url, base).pathname;
+    }
+    catch {
+        // strip query/hash manually from a non-parseable input
+        const q = pathname.indexOf('?');
+        if (q >= 0)
+            pathname = pathname.slice(0, q);
+        const h = pathname.indexOf('#');
+        if (h >= 0)
+            pathname = pathname.slice(0, h);
+    }
+    if (pathname === '/' || pathname === '')
+        return pathname || '/';
+    const parts = pathname.split('/');
+    let changed = false;
+    for (let i = 0; i < parts.length; i++) {
+        const seg = parts[i];
+        if (seg !== undefined && isIdSegment(seg)) {
+            parts[i] = ':id';
+            changed = true;
+        }
+    }
+    return changed ? parts.join('/') : pathname;
+}
+//# sourceMappingURL=url.js.map

package/dist/features/network/parse/url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../../../../src/features/network/parse/url.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,uGAAuG;AACvG,MAAM,MAAM,GACV,8GAA8G,CAAC;AAEjH,sFAAsF;AACtF,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,8FAA8F;IAC9F,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,QAAQ,GAAG,GAAG,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;QAC1E,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;QACvD,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC;YAAE,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC;YAAE,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,QAAQ,IAAI,GAAG,CAAC;IAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,GAAG,KAAK,SAAS,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;YACjB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9C,CAAC"}

package/dist/features/network/sampler.d.ts

@@ -0,0 +1,21 @@
+/**
+ * N5 — adaptive network sampling. The rule that makes high-RPS apps affordable WITHOUT losing the
+ * signal that matters: ALWAYS keep failed + slow requests; thin only the SUCCESSFUL ones to the base
+ * `sampleRate`. The thin is deterministic per-request (fnv1a32 over a stable per-request key) so it's
+ * spread evenly and the backend could re-derive it — no client trust, the same hash family as
+ * flags/experiments/error-grouping. Zero-dep.
+ */
+export interface SampleInput {
+    /** A classified failure ⇒ always kept. */
+    failed: boolean;
+    /** Over the slow threshold ⇒ always kept. */
+    slow: boolean;
+    /** Stable per-request key for the deterministic bucket (e.g. url + startedAt). */
+    key: string;
+}
+/**
+ * Decide whether to keep a request. `sampleRate` ∈ [0,1] is the base for SUCCESSFUL requests; 1 keeps
+ * everything (today's behavior), 0 keeps only failed/slow. Out-of-range rates clamp.
+ */
+export declare function shouldKeep(input: SampleInput, sampleRate: number): boolean;
+//# sourceMappingURL=sampler.d.ts.map

package/dist/features/network/sampler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sampler.d.ts","sourceRoot":"","sources":["../../../src/features/network/sampler.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,WAAW,WAAW;IAC1B,0CAA0C;IAC1C,MAAM,EAAE,OAAO,CAAC;IAChB,6CAA6C;IAC7C,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAQ1E"}

package/dist/features/network/sampler.js

@@ -0,0 +1,25 @@
+/**
+ * N5 — adaptive network sampling. The rule that makes high-RPS apps affordable WITHOUT losing the
+ * signal that matters: ALWAYS keep failed + slow requests; thin only the SUCCESSFUL ones to the base
+ * `sampleRate`. The thin is deterministic per-request (fnv1a32 over a stable per-request key) so it's
+ * spread evenly and the backend could re-derive it — no client trust, the same hash family as
+ * flags/experiments/error-grouping. Zero-dep.
+ */
+import { fnv1a32 } from '../config/bucketing.js';
+/**
+ * Decide whether to keep a request. `sampleRate` ∈ [0,1] is the base for SUCCESSFUL requests; 1 keeps
+ * everything (today's behavior), 0 keeps only failed/slow. Out-of-range rates clamp.
+ */
+export function shouldKeep(input, sampleRate) {
+    if (input.failed || input.slow)
+        return true; // never thin the actionable ones
+    const rate = sampleRate >= 1 ? 1 : sampleRate <= 0 ? 0 : sampleRate;
+    if (rate >= 1)
+        return true;
+    if (rate <= 0)
+        return false;
+    // bucket 0..9999 → fractional decision with 1/10000 resolution
+    const bucket = fnv1a32(input.key) % 10000;
+    return bucket < Math.round(rate * 10000);
+}
+//# sourceMappingURL=sampler.js.map

package/dist/features/network/sampler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sampler.js","sourceRoot":"","sources":["../../../src/features/network/sampler.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAW9C;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAkB,EAAE,UAAkB;IAC/D,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,iCAAiC;IAC9E,MAAM,IAAI,GAAG,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACpE,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5B,+DAA+D;IAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAM,CAAC;IAC3C,OAAO,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAM,CAAC,CAAC;AAC5C,CAAC"}

package/dist/features/network/size.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Byte-accurate request/response sizes (N0). Byte *counts* carry no payload content, so they're safe
+ * to compute unconditionally — independent of body capture (which is opt-in). Mirrors the mobile SDK's
+ * `bodyCapture` size helpers for cross-platform parity. Never throws.
+ */
+/** UTF-8 byte length of a string (not the char/code-unit count). Never throws. */
+export declare function utf8ByteLength(s: string): number;
+/**
+ * Best-effort byte size of an outgoing request body, computed synchronously without consuming streams.
+ * Returns undefined when the size can't be known cheaply (FormData / ReadableStream / unknown). Never throws.
+ */
+export declare function requestBodyBytes(body: unknown): number | undefined;
+/** Parse a `content-length` header value to a byte count. undefined when absent/invalid. */
+export declare function contentLengthBytes(value: string | null | undefined): number | undefined;
+/**
+ * Monotonic high-resolution clock for measuring request DURATIONS — immune to wall-clock jumps
+ * (NTP corrections, sleep/wake) that can make `Date.now()` deltas wrong or negative. Falls back to
+ * `Date.now()` where `performance.now` is unavailable. (Wire timestamps still use epoch `Date.now()`.)
+ */
+export declare function perfNow(): number;
+//# sourceMappingURL=size.d.ts.map

package/dist/features/network/size.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"size.d.ts","sourceRoot":"","sources":["../../../src/features/network/size.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAQhD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAYlE;AAED,4FAA4F;AAC5F,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIvF;AAED;;;;GAIG;AACH,wBAAgB,OAAO,IAAI,MAAM,CAEhC"}

package/dist/features/network/size.js

@@ -0,0 +1,63 @@
+/**
+ * Byte-accurate request/response sizes (N0). Byte *counts* carry no payload content, so they're safe
+ * to compute unconditionally — independent of body capture (which is opt-in). Mirrors the mobile SDK's
+ * `bodyCapture` size helpers for cross-platform parity. Never throws.
+ */
+let _enc;
+function encoder() {
+    if (_enc)
+        return _enc;
+    return (_enc = typeof TextEncoder !== 'undefined' ? new TextEncoder() : undefined);
+}
+/** UTF-8 byte length of a string (not the char/code-unit count). Never throws. */
+export function utf8ByteLength(s) {
+    try {
+        const e = encoder();
+        if (e)
+            return e.encode(s).length;
+        return unescape(encodeURIComponent(s)).length; // fallback when TextEncoder is absent
+    }
+    catch {
+        return s.length;
+    }
+}
+/**
+ * Best-effort byte size of an outgoing request body, computed synchronously without consuming streams.
+ * Returns undefined when the size can't be known cheaply (FormData / ReadableStream / unknown). Never throws.
+ */
+export function requestBodyBytes(body) {
+    try {
+        if (body == null)
+            return undefined;
+        if (typeof body === 'string')
+            return utf8ByteLength(body);
+        if (typeof URLSearchParams !== 'undefined' && body instanceof URLSearchParams)
+            return utf8ByteLength(body.toString());
+        if (typeof Blob !== 'undefined' && body instanceof Blob)
+            return body.size;
+        if (body instanceof ArrayBuffer)
+            return body.byteLength;
+        if (ArrayBuffer.isView(body))
+            return body.byteLength;
+        return undefined; // FormData / ReadableStream / Document — not cheaply measurable without consuming
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Parse a `content-length` header value to a byte count. undefined when absent/invalid. */
+export function contentLengthBytes(value) {
+    if (!value)
+        return undefined;
+    const n = parseInt(value, 10);
+    return Number.isFinite(n) && n >= 0 ? n : undefined;
+}
+/**
+ * Monotonic high-resolution clock for measuring request DURATIONS — immune to wall-clock jumps
+ * (NTP corrections, sleep/wake) that can make `Date.now()` deltas wrong or negative. Falls back to
+ * `Date.now()` where `performance.now` is unavailable. (Wire timestamps still use epoch `Date.now()`.)
+ */
+export function perfNow() {
+    return typeof performance !== 'undefined' && typeof performance.now === 'function' ? performance.now() : Date.now();
+}
+//# sourceMappingURL=size.js.map

package/dist/features/network/size.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"size.js","sourceRoot":"","sources":["../../../src/features/network/size.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,IAAI,IAA6B,CAAC;AAClC,SAAS,OAAO;IACd,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,CAAC,IAAI,GAAG,OAAO,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACrF,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACjC,OAAO,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,sCAAsC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAa;IAC5C,IAAI,CAAC;QACH,IAAI,IAAI,IAAI,IAAI;YAAE,OAAO,SAAS,CAAC;QACnC,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,OAAO,eAAe,KAAK,WAAW,IAAI,IAAI,YAAY,eAAe;YAAE,OAAO,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtH,IAAI,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,YAAY,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;QAC1E,IAAI,IAAI,YAAY,WAAW;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QACxD,IAAI,WAAW,CAAC,MAAM,CAAC,IAAuB,CAAC;YAAE,OAAQ,IAAwB,CAAC,UAAU,CAAC;QAC7F,OAAO,SAAS,CAAC,CAAC,kFAAkF;IACtG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,kBAAkB,CAAC,KAAgC;IACjE,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO;IACrB,OAAO,OAAO,WAAW,KAAK,WAAW,IAAI,OAAO,WAAW,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;AACtH,CAAC"}

package/dist/features/network/thirdParty.d.ts

@@ -0,0 +1,95 @@
+/**
+ * THIRD-PARTY BEACON HOSTS — the one list, and the one matcher, for every layer that drops them.
+ *
+ * WHAT THIS IS FOR
+ * A session on an instrumented site spends most of its network tab on traffic the app did not
+ * meaningfully make: analytics collectors, ad pixels, IP-enrichment calls, tag managers. It is
+ * captured, uploaded, stored and rendered, and none of it answers a question anyone asks a session
+ * replay. One real sign-in screen was 27 requests, most of them beacons.
+ *
+ * It is not only clutter. Session health scores `failedRequests` and `slowRequests`, so a tracker
+ * killed by an ad blocker (a transport error) or one that is simply slow moves a number that is
+ * supposed to describe the APP. That is the part that makes this a correctness fix rather than a
+ * tidy-up.
+ *
+ * WHY HOSTS ONLY, NEVER PATHS
+ * The obvious rules from looking at a network tab are `/collect`, `/p`, `/api/v2/pixel`. Every one
+ * of them is a path that a customer's own API is allowed to have, and dropping a real API call is
+ * far worse than keeping a beacon: the noise is visible and annoying, the missing request is
+ * invisible and misleading. So matching is on the HOSTNAME, with a dot boundary, and a request to
+ * `/collect` on the app's own origin is kept — correctly.
+ *
+ * WHY IT IS A SUFFIX LIST AND NOT A REGEX
+ * Two reasons, both practical. It is applied inside an SDK whose eager bundle is measured in bytes,
+ * and a comma-joined string of suffixes compresses to almost nothing next to an equivalent pattern
+ * source. And it has to be COPIED, byte for byte, into the React Native SDK and into the backend's
+ * ingest path — a list with no syntax is a list that cannot drift in meaning between three
+ * languages' worth of tooling. `third-party:parity` hashes all three copies.
+ *
+ * ZERO IMPORTS, DELIBERATELY. That is what makes the byte-identical copy possible. If an edit here
+ * ever needs an import, the parity gate is the thing that will say so — keep the module pure rather
+ * than weakening the gate.
+ *
+ * WHAT IS DELIBERATELY NOT ON THE LIST
+ * The rule is: a host whose ONLY purpose is to receive telemetry. Everything else stays, because a
+ * dropped request is invisible and a kept one is merely noisy.
+ *
+ *   - Feature-flag and experiment services (LaunchDarkly, Optimizely, Split). Their RESPONSES
+ *     change what the app does, so a failed flag fetch is an application incident and the single
+ *     most useful request in the session.
+ *   - Chat and support widgets (Intercom, Zendesk, Drift). A broken widget is a broken feature the
+ *     user can see.
+ *   - `facebook.com` as a whole. `graph.facebook.com` is an API real apps call; only the pixel
+ *     delivery hosts are listed.
+ *   - CDNs of any kind, even ones that mostly serve tags: they also serve application assets, and
+ *     dropping them would hide a real asset failure.
+ *
+ * When in doubt, leave it out. `denyUrls` stays the per-app escape hatch in both SDKs, and it can
+ * do what this list will not.
+ */
+/**
+ * Known telemetry, advertising and enrichment endpoints, as hostname suffixes.
+ *
+ * One comma-joined string rather than an array: identical meaning, materially smaller once gzipped,
+ * and it keeps the copy in three repos a single line to compare by eye.
+ */
+export declare const THIRD_PARTY_BEACON_HOSTS: string;
+/**
+ * True when `url` is addressed to a known beacon host.
+ *
+ * Deliberately total: an unparseable or relative URL is NOT third party. A relative URL is
+ * same-origin by definition — the app's own call — and guessing on garbage input would drop real
+ * requests for no benefit.
+ */
+export declare function isThirdPartyBeacon(url: string, hosts?: string): boolean;
+/**
+ * WHAT A CAPTURED REQUEST IS — the general rule, so a new client's traffic needs no new list entry.
+ *
+ * The host list above only knows the trackers someone has already seen. On production the network
+ * table was ~92% requests that were not the app's own API calls (2026-09-22: 1.13M tracker beacons,
+ * 1.10M Next.js page payloads, 136k CDN analytics beacons, 31k browser-internal URLs, of 2.6M rows),
+ * and every one of them also moved session health as a failed or slow request. So a request is
+ * classified by what ANY client's traffic carries, and only `api` is kept:
+ *
+ *   other      not http(s)/ws(s): `properties://`, `chrome-extension://`, `blob:`, `data:` —
+ *              browser and extension internals, never the app's backend.
+ *   telemetry  sent with `navigator.sendBeacon` (protocol 'beacon'): fire-and-forget, no response,
+ *              so it has no status or latency worth scoring — it is how analytics and pixels send.
+ *              Plus Cloudflare's `/cdn-cgi/rum` (a path Cloudflare reserves on every zone it
+ *              proxies), the `/generate_204` connectivity probe, and the known hosts above.
+ *   page       framework page-data payloads, fetched on navigation and on link PREFETCH:
+ *              Next.js `?_rsc=` and `/_next/data/…json`, Remix `?_data=routes…|root`, SvelteKit
+ *              `/__data.json`, Nuxt `/_payload.json`, Gatsby `/page-data/…json`.
+ *   asset      image, font, stylesheet, script and media files by extension. `.json`, `.pdf`,
+ *              `.csv` are NOT assets — those are what an API returns.
+ *   api        everything else — including anything unparseable, per the rule above: a dropped
+ *              API call is invisible data loss, a kept beacon is only noise.
+ *
+ * Deliberately NOT a signal: `fetch(…, {keepalive: true})`. Apps use it for their own save-on-leave
+ * calls, and those are exactly the requests whose failure matters.
+ */
+export type RequestKind = 'api' | 'telemetry' | 'page' | 'asset' | 'other';
+export declare function requestKind(url: string, protocol?: string, hosts?: string): RequestKind;
+/** True when the request is one of the app's own API calls — the only kind the network lane keeps. */
+export declare function isAppRequest(url: string, protocol?: string, hosts?: string): boolean;
+//# sourceMappingURL=thirdParty.d.ts.map

package/dist/features/network/thirdParty.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"thirdParty.d.ts","sourceRoot":"","sources":["../../../src/features/network/thirdParty.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,QAcyC,CAAC;AAE/E;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAUvE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,WAAW,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAE3E,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,WAAW,CAqBvF;AAgBD,sGAAsG;AACtG,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAEpF"}

package/dist/features/network/thirdParty.js

@@ -0,0 +1,126 @@
+/**
+ * THIRD-PARTY BEACON HOSTS — the one list, and the one matcher, for every layer that drops them.
+ *
+ * WHAT THIS IS FOR
+ * A session on an instrumented site spends most of its network tab on traffic the app did not
+ * meaningfully make: analytics collectors, ad pixels, IP-enrichment calls, tag managers. It is
+ * captured, uploaded, stored and rendered, and none of it answers a question anyone asks a session
+ * replay. One real sign-in screen was 27 requests, most of them beacons.
+ *
+ * It is not only clutter. Session health scores `failedRequests` and `slowRequests`, so a tracker
+ * killed by an ad blocker (a transport error) or one that is simply slow moves a number that is
+ * supposed to describe the APP. That is the part that makes this a correctness fix rather than a
+ * tidy-up.
+ *
+ * WHY HOSTS ONLY, NEVER PATHS
+ * The obvious rules from looking at a network tab are `/collect`, `/p`, `/api/v2/pixel`. Every one
+ * of them is a path that a customer's own API is allowed to have, and dropping a real API call is
+ * far worse than keeping a beacon: the noise is visible and annoying, the missing request is
+ * invisible and misleading. So matching is on the HOSTNAME, with a dot boundary, and a request to
+ * `/collect` on the app's own origin is kept — correctly.
+ *
+ * WHY IT IS A SUFFIX LIST AND NOT A REGEX
+ * Two reasons, both practical. It is applied inside an SDK whose eager bundle is measured in bytes,
+ * and a comma-joined string of suffixes compresses to almost nothing next to an equivalent pattern
+ * source. And it has to be COPIED, byte for byte, into the React Native SDK and into the backend's
+ * ingest path — a list with no syntax is a list that cannot drift in meaning between three
+ * languages' worth of tooling. `third-party:parity` hashes all three copies.
+ *
+ * ZERO IMPORTS, DELIBERATELY. That is what makes the byte-identical copy possible. If an edit here
+ * ever needs an import, the parity gate is the thing that will say so — keep the module pure rather
+ * than weakening the gate.
+ *
+ * WHAT IS DELIBERATELY NOT ON THE LIST
+ * The rule is: a host whose ONLY purpose is to receive telemetry. Everything else stays, because a
+ * dropped request is invisible and a kept one is merely noisy.
+ *
+ *   - Feature-flag and experiment services (LaunchDarkly, Optimizely, Split). Their RESPONSES
+ *     change what the app does, so a failed flag fetch is an application incident and the single
+ *     most useful request in the session.
+ *   - Chat and support widgets (Intercom, Zendesk, Drift). A broken widget is a broken feature the
+ *     user can see.
+ *   - `facebook.com` as a whole. `graph.facebook.com` is an API real apps call; only the pixel
+ *     delivery hosts are listed.
+ *   - CDNs of any kind, even ones that mostly serve tags: they also serve application assets, and
+ *     dropping them would hide a real asset failure.
+ *
+ * When in doubt, leave it out. `denyUrls` stays the per-app escape hatch in both SDKs, and it can
+ * do what this list will not.
+ */
+/**
+ * Known telemetry, advertising and enrichment endpoints, as hostname suffixes.
+ *
+ * One comma-joined string rather than an array: identical meaning, materially smaller once gzipped,
+ * and it keeps the copy in three repos a single line to compare by eye.
+ */
+export const THIRD_PARTY_BEACON_HOSTS = 'google-analytics.com,googletagmanager.com,analytics.google.com,doubleclick.net,googlesyndication.com,' +
+    'googleadservices.com,app-measurement.com,facebook.net,analytics.tiktok.com,' +
+    'ads-twitter.com,analytics.twitter.com,ct.pinterest.com,bat.bing.com,px.ads.linkedin.com,tr.snapchat.com,' +
+    // Pixel delivery hosts seen leaking past the list on production (2026-09-22): Snapchat's pixel also
+    // posts to tr6 / tr-shadow, TikTok's to its US analytics hosts. Exact hosts, not the parent domains —
+    // snapchat.com and tiktokw.us also serve things an app may legitimately call.
+    'tr6.snapchat.com,tr-shadow.snapchat.com,analytics.tiktokw.us,analytics-ipv6.tiktokw.us,' +
+    'criteo.com,criteo.net,taboola.com,outbrain.com,adroll.com,adsrvr.org,quantserve.com,scorecardresearch.com,' +
+    'hotjar.com,hotjar.io,clarity.ms,fullstory.com,mouseflow.com,crazyegg.com,luckyorange.com,inspectlet.com,' +
+    'segment.io,mixpanel.com,amplitude.com,heap.io,heapanalytics.com,rudderstack.com,posthog.com,' +
+    'matomo.cloud,plausible.io,simpleanalytics.com,statcounter.com,' +
+    'appsflyer.com,adjust.com,branch.io,' +
+    'ipify.org,ipinfo.io,ipapi.co,ip-api.com,geolocation-db.com,cloudflareinsights.com,' +
+    'nr-data.net,browser-intake-datadoghq.com,sentry.io,bugsnag.com,rollbar.com';
+/**
+ * True when `url` is addressed to a known beacon host.
+ *
+ * Deliberately total: an unparseable or relative URL is NOT third party. A relative URL is
+ * same-origin by definition — the app's own call — and guessing on garbage input would drop real
+ * requests for no benefit.
+ */
+export function isThirdPartyBeacon(url, hosts) {
+    // A relative URL has no host, which is the answer we want: it is first-party.
+    const host = parts(url)[1];
+    if (!host)
+        return false;
+    for (const suffix of (hosts ?? THIRD_PARTY_BEACON_HOSTS).split(',')) {
+        // Dot boundary, so `notevil-facebook.com` does not match `facebook.com` while
+        // `connect.facebook.com` does. The bare-equality arm covers the apex domain itself.
+        if (host === suffix || host.endsWith('.' + suffix))
+            return true;
+    }
+    return false;
+}
+export function requestKind(url, protocol, hosts) {
+    const [scheme, , p, q] = parts(url);
+    if (scheme && !/^(https?|wss?)$/.test(scheme))
+        return 'other';
+    if (protocol === 'beacon' ||
+        p === '/cdn-cgi/rum' ||
+        p.endsWith('/generate_204') ||
+        isThirdPartyBeacon(url, hosts)) {
+        return 'telemetry';
+    }
+    if (/[?&](_rsc(=|&|$)|_data=(routes|root))/.test(q) ||
+        /\/(_next\/data\/.+|__data|_payload|page-data\/.+)\.json$/.test(p)) {
+        return 'page';
+    }
+    if (/\.(png|jpe?g|gif|svg|webp|avif|ico|bmp|woff2?|ttf|otf|eot|css|m?js|map|mp4|webm|mov|m3u8|mp3|m4a|wav|ogg)$/i.test(p)) {
+        return 'asset';
+    }
+    return 'api';
+}
+/**
+ * [scheme, host, path, query] of a URL, lower-cased where case is not significant.
+ *
+ * A regex, NOT `new URL`: React Native's built-in URL throws "not implemented" for hostname,
+ * pathname and searchParams, so the `new URL(url).hostname` this module used to call was caught
+ * and answered "first-party" for EVERY request on mobile — the host list silently never matched
+ * there. The same string parsing now runs identically in the browser, in React Native and in Node.
+ * Never throws; a string it cannot read yields empty parts, which classify as the app's own call.
+ */
+function parts(url) {
+    const m = /^(?:([a-z][\w+.-]*):)?(?:\/\/(?:[^@/?#]*@)?([^:/?#]*)[^/?#]*)?([^?#]*)(\?[^#]*)?/i.exec(url || '') || [];
+    return [(m[1] || '').toLowerCase(), (m[2] || '').toLowerCase(), m[3] || '', m[4] || ''];
+}
+/** True when the request is one of the app's own API calls — the only kind the network lane keeps. */
+export function isAppRequest(url, protocol, hosts) {
+    return requestKind(url, protocol, hosts) === 'api';
+}
+//# sourceMappingURL=thirdParty.js.map

package/dist/features/network/thirdParty.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"thirdParty.js","sourceRoot":"","sources":["../../../src/features/network/thirdParty.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,uGAAuG;IACvG,6EAA6E;IAC7E,0GAA0G;IAC1G,oGAAoG;IACpG,sGAAsG;IACtG,8EAA8E;IAC9E,yFAAyF;IACzF,4GAA4G;IAC5G,0GAA0G;IAC1G,8FAA8F;IAC9F,gEAAgE;IAChE,qCAAqC;IACrC,oFAAoF;IACpF,4EAA4E,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,KAAc;IAC5D,8EAA8E;IAC9E,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,KAAK,MAAM,MAAM,IAAI,CAAC,KAAK,IAAI,wBAAwB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpE,8EAA8E;QAC9E,oFAAoF;QACpF,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AA8BD,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,QAAiB,EAAE,KAAc;IACxE,MAAM,CAAC,MAAM,EAAE,AAAD,EAAG,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC;IAC9D,IACE,QAAQ,KAAK,QAAQ;QACrB,CAAC,KAAK,cAAc;QACpB,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC3B,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,EAC9B,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IACE,uCAAuC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,0DAA0D,CAAC,IAAI,CAAC,CAAC,CAAC,EAClE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,6GAA6G,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1H,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,KAAK,CAAC,GAAW;IACxB,MAAM,CAAC,GAAG,mFAAmF,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;IACpH,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,QAAiB,EAAE,KAAc;IACzE,OAAO,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,KAAK,CAAC;AACrD,CAAC"}

package/dist/features/network/timing.d.ts

@@ -0,0 +1,41 @@
+/**
+ * N1 — `PerformanceResourceTiming` correlation. The interceptor sees status/duration/body but NOT
+ * the network-stack phases (DNS/TCP/TLS/TTFB) or the actual transferred bytes (chunked/compressed).
+ * The browser records those in a `PerformanceResourceTiming` entry that lands *after* the response
+ * settles. We buffer recent entries via a `PerformanceObserver` (no polling) and match a settled
+ * capture to its entry by URL + a start-time window.
+ *
+ * Cross-vertical seam: Perf owns navigation + STATIC-resource timing + spans; Network owns request
+ * capture and merges timing onto fetch/XHR (`initiatorType` 'fetch'|'xmlhttprequest'). We only read
+ * those initiator types so a resource isn't double-counted by both verticals.
+ */
+import type { NetTiming } from './types.js';
+export interface MergedTiming {
+    timing?: NetTiming;
+    transferSize?: number;
+}
+/** Extract the phase breakdown (ms, clamped ≥0) + transferSize from a ResourceTiming entry. */
+export declare function timingFromEntry(e: PerformanceResourceTiming): MergedTiming;
+/**
+ * A bounded, time-windowed index of recent ResourceTiming entries for our initiator types, fed by a
+ * buffered `PerformanceObserver`. `match(url, startedAt)` pops the closest entry (one-shot so two
+ * requests to the same URL each get their own). Graceful no-op where the API is unavailable.
+ */
+export declare class ResourceTimingIndex {
+    private readonly byUrl;
+    private observer?;
+    private timeOriginMs;
+    /** Entries older than this (ms, relative to performance.now()) are pruned to bound memory. */
+    private static readonly TTL_MS;
+    private static readonly MAX_PER_URL;
+    install(): boolean;
+    private add;
+    /**
+     * Pop the ResourceTiming entry that best matches this settled capture. `startedAt` is an epoch ms
+     * (Date.now()); we convert it to the performance timeline to pick the closest entry. One-shot.
+     */
+    match(url: string, startedAt: number): MergedTiming;
+    private prune;
+    teardown(): void;
+}
+//# sourceMappingURL=timing.d.ts.map

package/dist/features/network/timing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timing.d.ts","sourceRoot":"","sources":["../../../src/features/network/timing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAIzC,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,+FAA+F;AAC/F,wBAAgB,eAAe,CAAC,CAAC,EAAE,yBAAyB,GAAG,YAAY,CAmB1E;AAMD;;;;GAIG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkD;IACxE,OAAO,CAAC,QAAQ,CAAC,CAAsB;IACvC,OAAO,CAAC,YAAY,CAAK;IACzB,8FAA8F;IAC9F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAU;IACxC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAK;IAExC,OAAO,IAAI,OAAO;IAmBlB,OAAO,CAAC,GAAG;IAYX;;;OAGG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY;IAqBnD,OAAO,CAAC,KAAK;IAUb,QAAQ,IAAI,IAAI;CAKjB"}

package/dist/features/network/timing.js

@@ -0,0 +1,134 @@
+/**
+ * N1 — `PerformanceResourceTiming` correlation. The interceptor sees status/duration/body but NOT
+ * the network-stack phases (DNS/TCP/TLS/TTFB) or the actual transferred bytes (chunked/compressed).
+ * The browser records those in a `PerformanceResourceTiming` entry that lands *after* the response
+ * settles. We buffer recent entries via a `PerformanceObserver` (no polling) and match a settled
+ * capture to its entry by URL + a start-time window.
+ *
+ * Cross-vertical seam: Perf owns navigation + STATIC-resource timing + spans; Network owns request
+ * capture and merges timing onto fetch/XHR (`initiatorType` 'fetch'|'xmlhttprequest'). We only read
+ * those initiator types so a resource isn't double-counted by both verticals.
+ */
+const NET_INITIATORS = new Set(['fetch', 'xmlhttprequest']);
+/** Extract the phase breakdown (ms, clamped ≥0) + transferSize from a ResourceTiming entry. */
+export function timingFromEntry(e) {
+    const t = {};
+    const dns = e.domainLookupEnd - e.domainLookupStart;
+    const tcp = e.connectEnd - e.connectStart;
+    // secureConnectionStart is 0 when the connection wasn't TLS or timing is opaque.
+    const tls = e.secureConnectionStart > 0 ? e.connectEnd - e.secureConnectionStart : 0;
+    const ttfb = e.responseStart - e.requestStart;
+    const download = e.responseEnd - e.responseStart;
+    if (dns > 0)
+        t.dns = round(dns);
+    if (tcp > 0)
+        t.tcp = round(tcp);
+    if (tls > 0)
+        t.tls = round(tls);
+    if (ttfb > 0)
+        t.ttfb = round(ttfb);
+    if (download > 0)
+        t.download = round(download);
+    const out = {};
+    if (Object.keys(t).length)
+        out.timing = t;
+    // transferSize === 0 means a cache hit or a cross-origin opaque entry — only report a positive count.
+    if (typeof e.transferSize === 'number' && e.transferSize > 0)
+        out.transferSize = e.transferSize;
+    return out;
+}
+function round(n) {
+    return Math.round(n * 100) / 100;
+}
+/**
+ * A bounded, time-windowed index of recent ResourceTiming entries for our initiator types, fed by a
+ * buffered `PerformanceObserver`. `match(url, startedAt)` pops the closest entry (one-shot so two
+ * requests to the same URL each get their own). Graceful no-op where the API is unavailable.
+ */
+export class ResourceTimingIndex {
+    constructor() {
+        this.byUrl = new Map();
+        this.timeOriginMs = 0;
+    }
+    install() {
+        if (typeof PerformanceObserver === 'undefined' || typeof performance === 'undefined')
+            return false;
+        this.timeOriginMs = performance.timeOrigin ?? 0;
+        try {
+            this.observer = new PerformanceObserver((list) => {
+                for (const e of list.getEntries()) {
+                    const r = e;
+                    if (!NET_INITIATORS.has(r.initiatorType))
+                        continue;
+                    this.add(r);
+                }
+            });
+            // buffered:true replays entries recorded before we subscribed — no polling, no missed early reqs.
+            this.observer.observe({ type: 'resource', buffered: true });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    add(r) {
+        const key = r.name;
+        let arr = this.byUrl.get(key);
+        if (!arr) {
+            arr = [];
+            this.byUrl.set(key, arr);
+        }
+        arr.push(r);
+        if (arr.length > ResourceTimingIndex.MAX_PER_URL)
+            arr.shift();
+        this.prune();
+    }
+    /**
+     * Pop the ResourceTiming entry that best matches this settled capture. `startedAt` is an epoch ms
+     * (Date.now()); we convert it to the performance timeline to pick the closest entry. One-shot.
+     */
+    match(url, startedAt) {
+        const arr = this.byUrl.get(url);
+        if (!arr || !arr.length)
+            return {};
+        // epoch → performance-relative ms (entry.startTime is relative to timeOrigin).
+        const startRel = startedAt - this.timeOriginMs;
+        let bestIdx = 0;
+        let bestDelta = Infinity;
+        for (let i = 0; i < arr.length; i++) {
+            const e = arr[i];
+            if (!e)
+                continue;
+            const d = Math.abs(e.startTime - startRel);
+            if (d < bestDelta) {
+                bestDelta = d;
+                bestIdx = i;
+            }
+        }
+        const [entry] = arr.splice(bestIdx, 1);
+        if (!arr.length)
+            this.byUrl.delete(url);
+        return entry ? timingFromEntry(entry) : {};
+    }
+    prune() {
+        if (typeof performance === 'undefined')
+            return;
+        const cutoff = performance.now() - ResourceTimingIndex.TTL_MS;
+        for (const [url, arr] of this.byUrl) {
+            const kept = arr.filter((e) => e.startTime >= cutoff);
+            if (kept.length)
+                this.byUrl.set(url, kept);
+            else
+                this.byUrl.delete(url);
+        }
+    }
+    teardown() {
+        this.observer?.disconnect();
+        this.observer = undefined;
+        this.byUrl.clear();
+    }
+}
+/** Entries older than this (ms, relative to performance.now()) are pruned to bound memory. */
+ResourceTimingIndex.TTL_MS = 60000;
+ResourceTimingIndex.MAX_PER_URL = 8;
+//# sourceMappingURL=timing.js.map

package/dist/features/network/timing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timing.js","sourceRoot":"","sources":["../../../src/features/network/timing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAO5D,+FAA+F;AAC/F,MAAM,UAAU,eAAe,CAAC,CAA4B;IAC1D,MAAM,CAAC,GAAc,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,CAAC,CAAC,eAAe,GAAG,CAAC,CAAC,iBAAiB,CAAC;IACpD,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1C,iFAAiF;IACjF,MAAM,GAAG,GAAG,CAAC,CAAC,qBAAqB,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9C,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,aAAa,CAAC;IACjD,IAAI,GAAG,GAAG,CAAC;QAAE,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,GAAG,GAAG,CAAC;QAAE,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,GAAG,GAAG,CAAC;QAAE,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC;QAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,QAAQ,GAAG,CAAC;QAAE,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IAE/C,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM;QAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1C,sGAAsG;IACtG,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,CAAC,YAAY,GAAG,CAAC;QAAE,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IAChG,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,KAAK,CAAC,CAAS;IACtB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,mBAAmB;IAAhC;QACmB,UAAK,GAAG,IAAI,GAAG,EAAuC,CAAC;QAEhE,iBAAY,GAAG,CAAC,CAAC;IA4E3B,CAAC;IAvEC,OAAO;QACL,IAAI,OAAO,mBAAmB,KAAK,WAAW,IAAI,OAAO,WAAW,KAAK,WAAW;YAAE,OAAO,KAAK,CAAC;QACnG,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,GAAG,IAAI,mBAAmB,CAAC,CAAC,IAAI,EAAE,EAAE;gBAC/C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;oBAClC,MAAM,CAAC,GAAG,CAA8B,CAAC;oBACzC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC;wBAAE,SAAS;oBACnD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;YACH,kGAAkG;YAClG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAA6B,CAAC,CAAC;YACvF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,GAAG,CAAC,CAA4B;QACtC,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,GAAG,CAAC,MAAM,GAAG,mBAAmB,CAAC,WAAW;YAAE,GAAG,CAAC,KAAK,EAAE,CAAC;QAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAW,EAAE,SAAiB;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QACnC,+EAA+E;QAC/E,MAAM,QAAQ,GAAG,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC;QAC/C,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,SAAS,GAAG,QAAQ,CAAC;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,QAAQ,CAAC,CAAC;YAC3C,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC;gBAClB,SAAS,GAAG,CAAC,CAAC;gBACd,OAAO,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,CAAC;IAEO,KAAK;QACX,IAAI,OAAO,WAAW,KAAK,WAAW;YAAE,OAAO;QAC/C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC,MAAM,CAAC;QAC9D,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;YACtD,IAAI,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;;gBACtC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,QAAQ;QACN,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;;AA1ED,8FAA8F;AACtE,0BAAM,GAAG,KAAM,AAAT,CAAU;AAChB,+BAAW,GAAG,CAAC,AAAJ,CAAK"}