@scalebun/web 1.0.0

package/dist/features/network/NetworkFeature.d.ts

@@ -0,0 +1,56 @@
+/**
+ * F-NET — captures fetch + XHR (+ WebSocket/SSE/beacon) requests and emits contract `network` items
+ * onto the unified pipeline. Metadata by default (method/url/status/duration/sizes + N0 failure
+ * taxonomy/slow/route); bodies/headers are off by default (privacy) and an opt-in (N4). Self-excludes
+ * the SDK's own ingestion traffic. Thin shell: interceptors + normalize + stats.
+ */
+import type { IFeature, FeatureContext } from '@scalebun/sdk-contracts';
+import type { NetProtocol, NetFailure } from './types';
+/** Self-observability snapshot (N5) — the SDK's own network-capture health. */
+export interface NetworkStats {
+    /** emitted to the pipeline */
+    captured: number;
+    /** count per protocol */
+    byProtocol: Record<NetProtocol, number>;
+    /** count per failure class (successful requests aren't counted here) */
+    byFailure: Record<NetFailure, number>;
+    /** dropped by denyUrls / sampling / beforeSend(null) */
+    dropped: number;
+    /** kept by the success-sampler (failed/slow are always kept, counted in `captured`) */
+    sampledIn: number;
+    /** how many emitted items carried captured bodies */
+    bodiesCaptured: number;
+}
+export declare class NetworkFeature implements IFeature {
+    readonly name = "network";
+    private active;
+    private uninstalls;
+    private slowMs;
+    private sampleRate;
+    private dedupMs;
+    private deduper?;
+    private denyUrls;
+    private beforeSend?;
+    private readonly timingIndex;
+    private timingOn;
+    /** N4 — resolved body-capture options when `captureBodies` is on; undefined ⇒ bodies off. */
+    private bodyOpts?;
+    private readonly counters;
+    /** Self-observability — the SDK's own network-capture health. */
+    stats(): NetworkStats;
+    get isActive(): boolean;
+    setup(ctx: FeatureContext): void;
+    /** Normalize → denyUrls gate → beforeSend → emit, accumulating stats. The single emit point. */
+    private handle;
+    private finalize;
+    /** Tiny core-side gate: only the cheapest signals, so the GraphQL chunk loads on demand. */
+    private maybeGraphql;
+    private emit;
+    /** Final emit. With dedup on (opt-in), a burst of identical requests collapses into one trailing
+     *  `repeat` item (see {@link Deduper}); the first of the burst still emits immediately. */
+    private emitItem;
+    /** Update self-observability counters from an item about to be emitted. */
+    private record;
+    teardown(): void;
+}
+//# sourceMappingURL=NetworkFeature.d.ts.map

package/dist/features/network/NetworkFeature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NetworkFeature.d.ts","sourceRoot":"","sources":["../../../src/features/network/NetworkFeature.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAUxE,OAAO,KAAK,EAAc,WAAW,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEnE,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,yBAAyB;IACzB,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACxC,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACtC,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,cAAc,EAAE,MAAM,CAAC;CACxB;AAMD,qBAAa,cAAe,YAAW,QAAQ;IAC7C,QAAQ,CAAC,IAAI,aAAa;IAC1B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,UAAU,CAAyB;IAC3C,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,OAAO,CAAK;IACpB,OAAO,CAAC,OAAO,CAAC,CAAU;IAC1B,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,UAAU,CAAC,CAA4C;IAC/D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,OAAO,CAAC,QAAQ,CAAS;IACzB,6FAA6F;IAC7F,OAAO,CAAC,QAAQ,CAAC,CAA2D;IAC5E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAOvB;IAEF,iEAAiE;IACjE,KAAK,IAAI,YAAY;IAWrB,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED,KAAK,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI;IAoFhC,gGAAgG;IAChG,OAAO,CAAC,MAAM;IAqBd,OAAO,CAAC,QAAQ;IAmBhB,4FAA4F;IAC5F,OAAO,CAAC,YAAY;IAKpB,OAAO,CAAC,IAAI;IAiCZ;+FAC2F;IAC3F,OAAO,CAAC,QAAQ;IAShB,2EAA2E;IAC3E,OAAO,CAAC,MAAM;IASd,QAAQ,IAAI,IAAI;CASjB"}

package/dist/features/network/NetworkFeature.js

@@ -0,0 +1,235 @@
+/**
+ * F-NET — captures fetch + XHR (+ WebSocket/SSE/beacon) requests and emits contract `network` items
+ * onto the unified pipeline. Metadata by default (method/url/status/duration/sizes + N0 failure
+ * taxonomy/slow/route); bodies/headers are off by default (privacy) and an opt-in (N4). Self-excludes
+ * the SDK's own ingestion traffic. Thin shell: interceptors + normalize + stats.
+ */
+import { installFetch } from './fetchInterceptor';
+import { installXhr } from './xhrInterceptor';
+import { toNetworkItem } from './normalize';
+import { makeTraceInjector } from './tracing';
+import { DEFAULT_SLOW_MS } from './classify';
+import { ResourceTimingIndex } from './timing';
+import { shouldKeep } from './sampler';
+import { Deduper } from './dedup';
+function matchUrl(pat, url) {
+    return typeof pat === 'string' ? url.includes(pat) : pat.test(url);
+}
+export class NetworkFeature {
+    constructor() {
+        this.name = 'network';
+        this.active = false;
+        this.uninstalls = [];
+        this.slowMs = DEFAULT_SLOW_MS;
+        this.sampleRate = 1;
+        this.dedupMs = 0; // opt-in (network.dedupWindowMs); 0 = off
+        this.denyUrls = [];
+        this.timingIndex = new ResourceTimingIndex();
+        this.timingOn = false;
+        this.counters = {
+            captured: 0,
+            byProtocol: { http: 0, ws: 0, sse: 0, beacon: 0 },
+            byFailure: { http_4xx: 0, http_5xx: 0, network_error: 0, timeout: 0, cors: 0, abort: 0 },
+            dropped: 0,
+            sampledIn: 0,
+            bodiesCaptured: 0,
+        };
+    }
+    /** Self-observability — the SDK's own network-capture health. */
+    stats() {
+        return {
+            captured: this.counters.captured,
+            byProtocol: { ...this.counters.byProtocol },
+            byFailure: { ...this.counters.byFailure },
+            dropped: this.counters.dropped,
+            sampledIn: this.counters.sampledIn,
+            bodiesCaptured: this.counters.bodiesCaptured,
+        };
+    }
+    get isActive() {
+        return this.active;
+    }
+    setup(ctx) {
+        if (typeof window === 'undefined')
+            return;
+        const opts = ctx.networkOptions ?? {};
+        this.slowMs = opts.slowRequestMs ?? DEFAULT_SLOW_MS;
+        this.sampleRate = typeof opts.sampleRate === 'number' ? opts.sampleRate : 1;
+        // dedup is opt-in; read defensively so it works before the contract type formally lists it.
+        const dw = opts.dedupWindowMs;
+        this.dedupMs = typeof dw === 'number' && dw > 0 ? dw : 0;
+        if (this.dedupMs > 0) {
+            this.deduper = new Deduper(this.dedupMs, (item) => {
+                this.record(item);
+                ctx.emit(item);
+            }, () => {
+                this.counters.dropped++;
+            });
+        }
+        this.denyUrls = opts.denyUrls ?? [];
+        this.beforeSend = opts.beforeSend;
+        // N4 — body capture is opt-in (privacy). Resolve the cap/allowlist once; the heavy redaction +
+        // read logic lives in the lazy chunk. Cap is ceiling-enforced there too.
+        if (opts.captureBodies) {
+            this.bodyOpts = {
+                bodyMaxBytes: Math.min(Math.max(0, opts.bodyMaxBytes ?? 8192), 64 * 1024),
+                contentTypeAllowlist: opts.contentTypeAllowlist && opts.contentTypeAllowlist.length
+                    ? opts.contentTypeAllowlist
+                    : ['application/json', 'text/plain'],
+            };
+        }
+        // N1 — buffered ResourceTiming observer (DNS/TCP/TLS/TTFB/transferSize). Graceful no-op where
+        // the API is missing. The entry lands AFTER the response settles, so the merge is deferred.
+        this.timingOn = this.timingIndex.install();
+        const base = ctx.apiBaseUrl;
+        const isOwnUrl = (url) => !!base && url.startsWith(base);
+        const onRecord = (c) => this.handle(ctx, c);
+        // P4.3 — W3C traceparent injection for the allowlisted origins (FE→BE correlation handoff).
+        // ctx.traceOrigins is the resolved allowlist (same-origin by default; empty = tracing off).
+        //
+        // N5 cross-vertical seam (trace handoff): today Network MINTS a fresh trace per request (the
+        // makeTrace() inside makeTraceInjector). The end state is that when a Perf/RUM transaction is
+        // OPEN, the request joins THAT transaction's trace (one traceId across FE txn ↔ FE request ↔ BE
+        // span) and falls back to a per-request mint when none is open. The accessor shape the Perf
+        // engineer should expose (read-only, no Network→Perf import):
+        //
+        //   FeatureContext.getActiveTrace?: () => { traceId: string; parentSpanId: string } | null
+        //
+        // When present and non-null, makeTraceInjector should build the traceparent from it
+        // (`00-${traceId}-${childSpanId}-01`, a fresh child spanId) instead of minting a new traceId.
+        // Until that accessor lands, we KEEP the per-request mint (no behavior change).
+        // TODO(perf-seam): consume ctx.getActiveTrace() here once Perf provides it.
+        const injectTrace = makeTraceInjector(ctx.traceOrigins ?? []) ?? undefined;
+        this.uninstalls.push(installFetch(window, onRecord, isOwnUrl, injectTrace));
+        this.uninstalls.push(installXhr(window, onRecord, isOwnUrl, injectTrace));
+        // N3/N6 — WebSocket + SSE lifecycle + sendBeacon, all in ONE LAZY chunk (feature-detection +
+        // wiring live there, so core stays light). Default on; patched as soon as the chunk resolves.
+        const flags = {
+            ws: opts.trackWebSocket !== false,
+            sse: opts.trackSse !== false,
+            beacon: true,
+        };
+        const nav = typeof navigator !== 'undefined' ? navigator : undefined;
+        void import('./intercept/streams')
+            .then((m) => {
+            if (this.active)
+                this.uninstalls.push(...m.installStreams(window, nav, onRecord, isOwnUrl, flags));
+        })
+            .catch(() => {
+            /* chunk failed to load — WS/SSE/beacon simply not tracked */
+        });
+        this.active = true;
+    }
+    /** Normalize → denyUrls gate → beforeSend → emit, accumulating stats. The single emit point. */
+    handle(ctx, c) {
+        if (this.denyUrls.some((p) => matchUrl(p, c.url))) {
+            this.counters.dropped++;
+            return;
+        }
+        // N1 — ResourceTiming lands just after settle. For http captures, defer one macrotask so the
+        // entry is available, then merge DNS/TCP/TLS/TTFB/transferSize. WS/SSE/beacon have no entry.
+        const proto = c.protocol ?? 'http';
+        if (this.timingOn && proto === 'http' && c.timing === undefined) {
+            setTimeout(() => {
+                if (!this.active)
+                    return;
+                const merged = this.timingIndex.match(c.url, c.startedAt);
+                if (merged.timing)
+                    c.timing = merged.timing;
+                if (merged.transferSize !== undefined && c.transferSize === undefined)
+                    c.transferSize = merged.transferSize;
+                this.finalize(ctx, c);
+            }, 0);
+            return;
+        }
+        this.finalize(ctx, c);
+    }
+    finalize(ctx, c) {
+        // N2/N4 — http captures may need GraphQL op-awareness and/or body capture, both in the LAZY
+        // chunk (a single pass reads the one-shot response clone once). Cheap inline gates the import so
+        // ordinary REST traffic with bodies off never loads it.
+        const proto = c.protocol ?? 'http';
+        const wantGraphql = proto === 'http' && c.graphql === undefined && this.maybeGraphql(c);
+        const wantBody = !!this.bodyOpts && proto === 'http';
+        if (wantGraphql || wantBody) {
+            import('./lazy')
+                .then((m) => m.enrichHttpCapture(c, { graphql: wantGraphql, body: wantBody ? this.bodyOpts : undefined }))
+                .catch(() => { })
+                .finally(() => {
+                if (this.active)
+                    this.emit(ctx, c);
+            });
+            return;
+        }
+        this.emit(ctx, c);
+    }
+    /** Tiny core-side gate: only the cheapest signals, so the GraphQL chunk loads on demand. */
+    maybeGraphql(c) {
+        if (c.method !== 'POST')
+            return false;
+        return /graphql/i.test(c.url) || (!!c.reqBody && c.reqBody.includes('query'));
+    }
+    emit(ctx, c) {
+        let item = toNetworkItem(c, { slowMs: this.slowMs });
+        // N5 — adaptive sampling: always keep failed/slow, deterministically thin successful requests to
+        // the base rate. Sampled-out items are dropped (counted), never emitted.
+        if (this.sampleRate < 1) {
+            const kept = shouldKeep({ failed: !!item.failure, slow: !!item.slow, key: `${c.url}|${c.startedAt}` }, this.sampleRate);
+            if (!kept) {
+                this.counters.dropped++;
+                return;
+            }
+            this.counters.sampledIn++;
+        }
+        if (this.beforeSend) {
+            try {
+                const out = this.beforeSend(item);
+                if (out == null) {
+                    this.counters.dropped++;
+                    return;
+                }
+                item = out;
+            }
+            catch {
+                /* a throwing host hook keeps the original item — never lose the capture */
+            }
+        }
+        // E1 (engage) — nudge the capture-signal bus on a genuine request failure (not a user-abort) so a
+        // `network_error`-triggered campaign can fire. Fire-and-forget; the signaller isolates listener throws.
+        if (item.failure && item.failure !== 'abort')
+            ctx.signal('network_error');
+        this.emitItem(ctx, item);
+    }
+    /** Final emit. With dedup on (opt-in), a burst of identical requests collapses into one trailing
+     *  `repeat` item (see {@link Deduper}); the first of the burst still emits immediately. */
+    emitItem(ctx, item) {
+        if (this.deduper) {
+            this.deduper.push(item); // record + ctx.emit happen via the Deduper's emit callback
+            return;
+        }
+        this.record(item);
+        ctx.emit(item);
+    }
+    /** Update self-observability counters from an item about to be emitted. */
+    record(item) {
+        this.counters.captured++;
+        const proto = item.protocol ?? 'http';
+        this.counters.byProtocol[proto]++;
+        const failure = item.failure;
+        if (failure)
+            this.counters.byFailure[failure]++;
+        if (item.request || item.response)
+            this.counters.bodiesCaptured++;
+    }
+    teardown() {
+        for (const u of this.uninstalls)
+            u();
+        this.uninstalls = [];
+        this.deduper?.dispose();
+        this.deduper = undefined;
+        this.timingIndex.teardown();
+        this.timingOn = false;
+        this.active = false;
+    }
+}
+//# sourceMappingURL=NetworkFeature.js.map

package/dist/features/network/NetworkFeature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NetworkFeature.js","sourceRoot":"","sources":["../../../src/features/network/NetworkFeature.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAmBlC,SAAS,QAAQ,CAAC,GAAoB,EAAE,GAAW;IACjD,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,OAAO,cAAc;IAA3B;QACW,SAAI,GAAG,SAAS,CAAC;QAClB,WAAM,GAAG,KAAK,CAAC;QACf,eAAU,GAAsB,EAAE,CAAC;QACnC,WAAM,GAAG,eAAe,CAAC;QACzB,eAAU,GAAG,CAAC,CAAC;QACf,YAAO,GAAG,CAAC,CAAC,CAAC,0CAA0C;QAEvD,aAAQ,GAAmC,EAAE,CAAC;QAErC,gBAAW,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACjD,aAAQ,GAAG,KAAK,CAAC;QAGR,aAAQ,GAAG;YAC1B,QAAQ,EAAE,CAAC;YACX,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAiC;YAChF,SAAS,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAgC;YACtH,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,CAAC;YACZ,cAAc,EAAE,CAAC;SAClB,CAAC;IAoNJ,CAAC;IAlNC,iEAAiE;IACjE,KAAK;QACH,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;YAChC,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE;YAC3C,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE;YACzC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO;YAC9B,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;YAClC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc;SAC7C,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,GAAmB;QACvB,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,OAAO;QAE1C,MAAM,IAAI,GAAG,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,eAAe,CAAC;QACpD,IAAI,CAAC,UAAU,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,4FAA4F;QAC5F,MAAM,EAAE,GAAI,IAAmC,CAAC,aAAa,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CACxB,IAAI,CAAC,OAAO,EACZ,CAAC,IAAI,EAAE,EAAE;gBACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAClB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC,EACD,GAAG,EAAE;gBACH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC1B,CAAC,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,+FAA+F;QAC/F,yEAAyE;QACzE,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,IAAI,CAAC,QAAQ,GAAG;gBACd,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC;gBACzE,oBAAoB,EAClB,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC,oBAAoB,CAAC,MAAM;oBAC3D,CAAC,CAAC,IAAI,CAAC,oBAAoB;oBAC3B,CAAC,CAAC,CAAC,kBAAkB,EAAE,YAAY,CAAC;aACzC,CAAC;QACJ,CAAC;QAED,8FAA8F;QAC9F,4FAA4F;QAC5F,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QAE3C,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC;QAC5B,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAExD,4FAA4F;QAC5F,4FAA4F;QAC5F,EAAE;QACF,6FAA6F;QAC7F,8FAA8F;QAC9F,gGAAgG;QAChG,4FAA4F;QAC5F,8DAA8D;QAC9D,EAAE;QACF,2FAA2F;QAC3F,EAAE;QACF,oFAAoF;QACpF,8FAA8F;QAC9F,gFAAgF;QAChF,4EAA4E;QAC5E,MAAM,WAAW,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,IAAI,SAAS,CAAC;QAE3E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,MAA4C,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;QAClH,IAAI,CAAC,UAAU,CAAC,IAAI,CAClB,UAAU,CAAC,MAA8D,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAC5G,CAAC;QAEF,6FAA6F;QAC7F,8FAA8F;QAC9F,MAAM,KAAK,GAAG;YACZ,EAAE,EAAE,IAAI,CAAC,cAAc,KAAK,KAAK;YACjC,GAAG,EAAE,IAAI,CAAC,QAAQ,KAAK,KAAK;YAC5B,MAAM,EAAE,IAAI;SACb,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,KAAK,MAAM,CAAC,qBAAqB,CAAC;aAC/B,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACV,IAAI,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,MAAe,EAAE,GAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QACvH,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACV,6DAA6D;QAC/D,CAAC,CAAC,CAAC;QAEL,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,gGAAgG;IACxF,MAAM,CAAC,GAAmB,EAAE,CAAa;QAC/C,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,6FAA6F;QAC7F,6FAA6F;QAC7F,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC;QACnC,IAAI,IAAI,CAAC,QAAQ,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChE,UAAU,CAAC,GAAG,EAAE;gBACd,IAAI,CAAC,IAAI,CAAC,MAAM;oBAAE,OAAO;gBACzB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC1D,IAAI,MAAM,CAAC,MAAM;oBAAE,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC5C,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS;oBAAE,CAAC,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;gBAC5G,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACxB,CAAC,EAAE,CAAC,CAAC,CAAC;YACN,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACxB,CAAC;IAEO,QAAQ,CAAC,GAAmB,EAAE,CAAa;QACjD,4FAA4F;QAC5F,iGAAiG;QACjG,wDAAwD;QACxD,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC;QACnC,MAAM,WAAW,GAAG,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACxF,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,KAAK,KAAK,MAAM,CAAC;QACrD,IAAI,WAAW,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,CAAC,QAAQ,CAAC;iBACb,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;iBACzG,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;iBACf,OAAO,CAAC,GAAG,EAAE;gBACZ,IAAI,IAAI,CAAC,MAAM;oBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACrC,CAAC,CAAC,CAAC;YACL,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,4FAA4F;IACpF,YAAY,CAAC,CAAa;QAChC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QACtC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,CAAC;IAEO,IAAI,CAAC,GAAmB,EAAE,CAAa;QAC7C,IAAI,IAAI,GAAG,aAAa,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACrD,iGAAiG;QACjG,yEAAyE;QACzE,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,UAAU,CACrB,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,EAC7E,IAAI,CAAC,UAAU,CAChB,CAAC;YACF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;oBAChB,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACxB,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,GAAG,CAAC;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,2EAA2E;YAC7E,CAAC;QACH,CAAC;QACD,kGAAkG;QAClG,wGAAwG;QACxG,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO;YAAE,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC1E,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED;+FAC2F;IACnF,QAAQ,CAAC,GAAmB,EAAE,IAAiB;QACrD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,2DAA2D;YACpF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IAED,2EAA2E;IACnE,MAAM,CAAC,IAAiB;QAC9B,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,KAAK,GAAI,IAAI,CAAC,QAAoC,IAAI,MAAM,CAAC;QACnE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAiC,CAAC;QACvD,IAAI,OAAO;YAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;IACpE,CAAC;IAED,QAAQ;QACN,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU;YAAE,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;CACF"}

package/dist/features/network/capture/body.d.ts

@@ -0,0 +1,31 @@
+/**
+ * N4 — hardened request/response body capture (LAZY chunk, opt-in via `network.captureBodies`).
+ * Off by default for privacy. When on, this is the ONLY place a body/header is read into an item, and
+ * it is defended:
+ *   - content-type allowlist (default json + text) — binary / unknown types are skipped.
+ *   - hard byte cap (default 8 KB, ceiling-enforced) — oversized bodies are truncated with a marker.
+ *   - PII redaction (`scrubText`) over the captured text + a header denylist (auth/cookies/tokens).
+ * Stream-safety is guaranteed by the interceptor (it clones the response before the host reads it);
+ * here we only consume the already-cloned text. Never throws — capture is best-effort.
+ */
+import type { NetCapture } from '../types';
+export interface BodyCaptureOptions {
+    bodyMaxBytes: number;
+    contentTypeAllowlist: string[];
+}
+export declare const DEFAULT_BODY_MAX_BYTES = 8192;
+export declare const BODY_MAX_CEILING: number;
+export declare const DEFAULT_CONTENT_TYPES: string[];
+export declare function resolveBodyOptions(o?: Partial<BodyCaptureOptions>): BodyCaptureOptions;
+/** True when a content-type is eligible for capture (prefix match, e.g. 'application/json; charset…'). */
+export declare function isAllowedContentType(ct: string | undefined, allowlist: string[]): boolean;
+/** Cap + redact a body string. Returns the (possibly truncated, scrubbed) text. */
+export declare function sanitizeBody(text: string, maxBytes: number): string;
+/** Build a redacted header map, dropping denylisted keys. */
+export declare function sanitizeHeaders(headers: Record<string, string> | undefined): Record<string, string> | undefined;
+/**
+ * Enrich a settled capture with request/response bodies in place, honoring the allowlist + cap +
+ * redaction. Mutates `c.request` / `c.response`. Best-effort; never throws.
+ */
+export declare function captureBodies(c: NetCapture, opts: BodyCaptureOptions): Promise<void>;
+//# sourceMappingURL=body.d.ts.map

package/dist/features/network/capture/body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.d.ts","sourceRoot":"","sources":["../../../../src/features/network/capture/body.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAW,UAAU,EAAE,MAAM,UAAU,CAAC;AAEpD,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,MAAM,EAAE,CAAC;CAChC;AAED,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAC3C,eAAO,MAAM,gBAAgB,QAAY,CAAC;AAC1C,eAAO,MAAM,qBAAqB,UAAqC,CAAC;AAYxE,wBAAgB,kBAAkB,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAItF;AAED,0GAA0G;AAC1G,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAIzF;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAInE;AAED,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAS/G;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB1F"}

package/dist/features/network/capture/body.js

@@ -0,0 +1,81 @@
+/**
+ * N4 — hardened request/response body capture (LAZY chunk, opt-in via `network.captureBodies`).
+ * Off by default for privacy. When on, this is the ONLY place a body/header is read into an item, and
+ * it is defended:
+ *   - content-type allowlist (default json + text) — binary / unknown types are skipped.
+ *   - hard byte cap (default 8 KB, ceiling-enforced) — oversized bodies are truncated with a marker.
+ *   - PII redaction (`scrubText`) over the captured text + a header denylist (auth/cookies/tokens).
+ * Stream-safety is guaranteed by the interceptor (it clones the response before the host reads it);
+ * here we only consume the already-cloned text. Never throws — capture is best-effort.
+ */
+import { scrubText } from '../../../core';
+export const DEFAULT_BODY_MAX_BYTES = 8192;
+export const BODY_MAX_CEILING = 64 * 1024; // hard ceiling regardless of config (caps egress)
+export const DEFAULT_CONTENT_TYPES = ['application/json', 'text/plain'];
+/** Header names never captured (case-insensitive) — auth material + cookies must never leave. */
+const HEADER_DENYLIST = new Set([
+    'authorization',
+    'cookie',
+    'set-cookie',
+    'x-api-key',
+    'x-auth-token',
+    'proxy-authorization',
+]);
+export function resolveBodyOptions(o) {
+    const max = Math.min(Math.max(0, o?.bodyMaxBytes ?? DEFAULT_BODY_MAX_BYTES), BODY_MAX_CEILING);
+    const types = o?.contentTypeAllowlist && o.contentTypeAllowlist.length ? o.contentTypeAllowlist : DEFAULT_CONTENT_TYPES;
+    return { bodyMaxBytes: max, contentTypeAllowlist: types };
+}
+/** True when a content-type is eligible for capture (prefix match, e.g. 'application/json; charset…'). */
+export function isAllowedContentType(ct, allowlist) {
+    if (!ct)
+        return false;
+    const lc = ct.toLowerCase();
+    return allowlist.some((a) => lc.startsWith(a.toLowerCase()));
+}
+/** Cap + redact a body string. Returns the (possibly truncated, scrubbed) text. */
+export function sanitizeBody(text, maxBytes) {
+    let out = text;
+    if (out.length > maxBytes)
+        out = out.slice(0, maxBytes) + '…[truncated]';
+    return scrubText(out);
+}
+/** Build a redacted header map, dropping denylisted keys. */
+export function sanitizeHeaders(headers) {
+    if (!headers)
+        return undefined;
+    const out = {};
+    for (const k in headers) {
+        if (HEADER_DENYLIST.has(k.toLowerCase()))
+            continue;
+        const v = headers[k];
+        if (typeof v === 'string')
+            out[k] = scrubText(v);
+    }
+    return Object.keys(out).length ? out : undefined;
+}
+/**
+ * Enrich a settled capture with request/response bodies in place, honoring the allowlist + cap +
+ * redaction. Mutates `c.request` / `c.response`. Best-effort; never throws.
+ */
+export async function captureBodies(c, opts) {
+    try {
+        // Request body — already a string when the interceptor could read it (string / URLSearchParams).
+        if (c.reqBody && isAllowedContentType(c.reqContentType, opts.contentTypeAllowlist)) {
+            const req = { body: sanitizeBody(c.reqBody, opts.bodyMaxBytes) };
+            c.request = c.request ? { ...c.request, ...req } : req;
+        }
+        // Response body — read the stream-safe clone, gated by content-type.
+        if (c.readResponseText && isAllowedContentType(c.resContentType, opts.contentTypeAllowlist)) {
+            const text = await c.readResponseText();
+            if (text != null) {
+                const res = { body: sanitizeBody(text, opts.bodyMaxBytes) };
+                c.response = c.response ? { ...c.response, ...res } : res;
+            }
+        }
+    }
+    catch {
+        /* capture is best-effort — never lose the item over a body read */
+    }
+}
+//# sourceMappingURL=body.js.map

package/dist/features/network/capture/body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.js","sourceRoot":"","sources":["../../../../src/features/network/capture/body.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAQ1C,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAC3C,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,kDAAkD;AAC7F,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;AAExE,iGAAiG;AACjG,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,eAAe;IACf,QAAQ;IACR,YAAY;IACZ,WAAW;IACX,cAAc;IACd,qBAAqB;CACtB,CAAC,CAAC;AAEH,MAAM,UAAU,kBAAkB,CAAC,CAA+B;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,IAAI,sBAAsB,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,CAAC,EAAE,oBAAoB,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,qBAAqB,CAAC;IACxH,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;AAC5D,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,oBAAoB,CAAC,EAAsB,EAAE,SAAmB;IAC9E,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,QAAgB;IACzD,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,IAAI,GAAG,CAAC,MAAM,GAAG,QAAQ;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,cAAc,CAAC;IACzE,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,eAAe,CAAC,OAA2C;IACzE,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAAE,SAAS;QACnD,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,CAAa,EAAE,IAAwB;IACzE,IAAI,CAAC;QACH,iGAAiG;QACjG,IAAI,CAAC,CAAC,OAAO,IAAI,oBAAoB,CAAC,CAAC,CAAC,cAAc,EAAE,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACnF,MAAM,GAAG,GAAY,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1E,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QACzD,CAAC;QACD,qEAAqE;QACrE,IAAI,CAAC,CAAC,gBAAgB,IAAI,oBAAoB,CAAC,CAAC,CAAC,cAAc,EAAE,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,gBAAgB,EAAE,CAAC;YACxC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;gBACjB,MAAM,GAAG,GAAY,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBACrE,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;AACH,CAAC"}

package/dist/features/network/classify.d.ts

@@ -0,0 +1,21 @@
+/**
+ * N0 — failure taxonomy + slow flag. Turns the interceptor's raw outcome (status / thrown error /
+ * abort) into a stable `failure` enum the dashboard can triage by, plus a `slow` flag. Pure +
+ * zero-dep. The taxonomy mirrors the wire enum on `NetworkItemSchema.failure`.
+ *
+ * A CORS-blocked fetch and a genuine network drop both surface to JS as a thrown TypeError with
+ * status 0 — we disambiguate by the error message shape (browsers say "Failed to fetch" / mention
+ * CORS) but stay conservative: ambiguous → `network_error`.
+ */
+import type { NetFailure } from './types';
+export declare const DEFAULT_SLOW_MS = 2000;
+/** Map a settled HTTP request to a failure class, or undefined when it succeeded. */
+export declare function classifyHttp(input: {
+    status?: number;
+    error?: string;
+    aborted?: boolean;
+    timedOut?: boolean;
+}): NetFailure | undefined;
+/** Whether a request crossed the slow threshold (failures are kept regardless; slow is orthogonal). */
+export declare function isSlow(duration: number, slowMs?: number): boolean;
+//# sourceMappingURL=classify.d.ts.map

package/dist/features/network/classify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../../../src/features/network/classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,GAAG,UAAU,GAAG,SAAS,CAkBzB;AAED,uGAAuG;AACvG,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAkB,GAAG,OAAO,CAE1E"}

package/dist/features/network/classify.js

@@ -0,0 +1,50 @@
+/**
+ * N0 — failure taxonomy + slow flag. Turns the interceptor's raw outcome (status / thrown error /
+ * abort) into a stable `failure` enum the dashboard can triage by, plus a `slow` flag. Pure +
+ * zero-dep. The taxonomy mirrors the wire enum on `NetworkItemSchema.failure`.
+ *
+ * A CORS-blocked fetch and a genuine network drop both surface to JS as a thrown TypeError with
+ * status 0 — we disambiguate by the error message shape (browsers say "Failed to fetch" / mention
+ * CORS) but stay conservative: ambiguous → `network_error`.
+ */
+export const DEFAULT_SLOW_MS = 2000;
+/** Map a settled HTTP request to a failure class, or undefined when it succeeded. */
+export function classifyHttp(input) {
+    const { status, error, aborted, timedOut } = input;
+    if (aborted)
+        return 'abort';
+    if (timedOut)
+        return 'timeout';
+    // status 0 with a thrown error ⇒ transport-level failure (CORS / network drop).
+    if ((status === 0 || status === undefined) && error) {
+        if (isAbortMessage(error))
+            return 'abort';
+        if (isTimeoutMessage(error))
+            return 'timeout';
+        if (isCorsMessage(error))
+            return 'cors';
+        return 'network_error';
+    }
+    if (typeof status === 'number') {
+        if (status >= 500)
+            return 'http_5xx';
+        if (status >= 400)
+            return 'http_4xx';
+    }
+    return undefined;
+}
+/** Whether a request crossed the slow threshold (failures are kept regardless; slow is orthogonal). */
+export function isSlow(duration, slowMs = DEFAULT_SLOW_MS) {
+    return typeof duration === 'number' && duration >= slowMs;
+}
+function isAbortMessage(msg) {
+    return /\babort(ed)?\b/i.test(msg);
+}
+function isTimeoutMessage(msg) {
+    return /\btimed?\s*out\b|\btimeout\b/i.test(msg);
+}
+/** Heuristic CORS detection from a thrown-error message (best-effort; browsers vary). */
+function isCorsMessage(msg) {
+    return /\bcors\b|cross-origin|access-control|opaque/i.test(msg);
+}
+//# sourceMappingURL=classify.js.map

package/dist/features/network/classify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.js","sourceRoot":"","sources":["../../../src/features/network/classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,KAK5B;IACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACnD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,IAAI,QAAQ;QAAE,OAAO,SAAS,CAAC;IAE/B,gFAAgF;IAChF,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,SAAS,CAAC,IAAI,KAAK,EAAE,CAAC;QACpD,IAAI,cAAc,CAAC,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;QAC1C,IAAI,gBAAgB,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9C,IAAI,aAAa,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QACxC,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,MAAM,IAAI,GAAG;YAAE,OAAO,UAAU,CAAC;QACrC,IAAI,MAAM,IAAI,GAAG;YAAE,OAAO,UAAU,CAAC;IACvC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,MAAM,CAAC,QAAgB,EAAE,MAAM,GAAG,eAAe;IAC/D,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,IAAI,MAAM,CAAC;AAC5D,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,OAAO,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnD,CAAC;AAED,yFAAyF;AACzF,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,8CAA8C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClE,CAAC"}

package/dist/features/network/dedup.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Network request dedup (opt-in via `network.dedupWindowMs`). Collapses a burst of identical requests
+ * — keyed by `method|route|status` — within a time window into ONE trailing item carrying `repeat: N`.
+ *
+ * Design:
+ *  - The FIRST request of a burst emits IMMEDIATELY (zero added latency); subsequent identical ones
+ *    within the window are suppressed + counted, and one collapsed item is emitted once the burst goes
+ *    quiet (window of silence). A lone request emits once with no trailing item.
+ *  - BOUNDED: at most MAX_KEYS active windows; when full, the oldest is evicted (its pending repeat
+ *    flushed first) so high-cardinality traffic can never grow the map unbounded.
+ *  - `dispose()` clears all pending timers WITHOUT emitting (the pipeline is shutting down).
+ */
+import type { NetworkItem } from '@scalebun/protocol';
+type EmitFn = (item: NetworkItem) => void;
+/** Cap on concurrently-tracked dedup windows (memory guard). */
+export declare const MAX_KEYS = 500;
+export declare class Deduper {
+    private readonly windowMs;
+    private readonly emit;
+    /** Stats hook fired once per suppressed (collapsed) request. */
+    private readonly onSuppress?;
+    private readonly map;
+    constructor(windowMs: number, emit: EmitFn, 
+    /** Stats hook fired once per suppressed (collapsed) request. */
+    onSuppress?: (() => void) | undefined);
+    /** Returns true if the item was emitted now, false if suppressed into a pending window. */
+    push(item: NetworkItem): boolean;
+    private flush;
+    private evictOldest;
+    /** Pending-window count (diagnostics/tests). */
+    get pending(): number;
+    /** Teardown: clear all timers without emitting. */
+    dispose(): void;
+}
+export {};
+//# sourceMappingURL=dedup.d.ts.map

package/dist/features/network/dedup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dedup.d.ts","sourceRoot":"","sources":["../../../src/features/network/dedup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,KAAK,MAAM,GAAG,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC;AAO1C,gEAAgE;AAChE,eAAO,MAAM,QAAQ,MAAM,CAAC;AAE5B,qBAAa,OAAO;IAIhB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,gEAAgE;IAChE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAN9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA4B;gBAG7B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM;IAC7B,gEAAgE;IAC/C,UAAU,CAAC,GAAE,MAAM,IAAI,aAAA;IAG1C,2FAA2F;IAC3F,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO;IAiBhC,OAAO,CAAC,KAAK;IAMb,OAAO,CAAC,WAAW;IASnB,gDAAgD;IAChD,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,mDAAmD;IACnD,OAAO,IAAI,IAAI;CAIhB"}

package/dist/features/network/dedup.js

@@ -0,0 +1,68 @@
+/**
+ * Network request dedup (opt-in via `network.dedupWindowMs`). Collapses a burst of identical requests
+ * — keyed by `method|route|status` — within a time window into ONE trailing item carrying `repeat: N`.
+ *
+ * Design:
+ *  - The FIRST request of a burst emits IMMEDIATELY (zero added latency); subsequent identical ones
+ *    within the window are suppressed + counted, and one collapsed item is emitted once the burst goes
+ *    quiet (window of silence). A lone request emits once with no trailing item.
+ *  - BOUNDED: at most MAX_KEYS active windows; when full, the oldest is evicted (its pending repeat
+ *    flushed first) so high-cardinality traffic can never grow the map unbounded.
+ *  - `dispose()` clears all pending timers WITHOUT emitting (the pipeline is shutting down).
+ */
+/** Cap on concurrently-tracked dedup windows (memory guard). */
+export const MAX_KEYS = 500;
+export class Deduper {
+    constructor(windowMs, emit, 
+    /** Stats hook fired once per suppressed (collapsed) request. */
+    onSuppress) {
+        this.windowMs = windowMs;
+        this.emit = emit;
+        this.onSuppress = onSuppress;
+        this.map = new Map();
+    }
+    /** Returns true if the item was emitted now, false if suppressed into a pending window. */
+    push(item) {
+        const key = `${item.method}|${item.route ?? item.url}|${item.status ?? item.error ?? ''}`;
+        const e = this.map.get(key);
+        if (e) {
+            e.count++;
+            e.item = item; // keep the latest representative
+            clearTimeout(e.timer);
+            e.timer = setTimeout(() => this.flush(key), this.windowMs);
+            this.onSuppress?.();
+            return false;
+        }
+        if (this.map.size >= MAX_KEYS)
+            this.evictOldest();
+        this.map.set(key, { count: 0, item, timer: setTimeout(() => this.flush(key), this.windowMs) });
+        this.emit(item);
+        return true;
+    }
+    flush(key) {
+        const e = this.map.get(key);
+        this.map.delete(key);
+        if (e && e.count > 0)
+            this.emit({ ...e.item, repeat: e.count });
+    }
+    evictOldest() {
+        const oldest = this.map.keys().next().value; // Map preserves insertion order
+        if (oldest !== undefined) {
+            const e = this.map.get(oldest);
+            if (e)
+                clearTimeout(e.timer);
+            this.flush(oldest); // emit its pending repeat (if any) before dropping it
+        }
+    }
+    /** Pending-window count (diagnostics/tests). */
+    get pending() {
+        return this.map.size;
+    }
+    /** Teardown: clear all timers without emitting. */
+    dispose() {
+        for (const e of this.map.values())
+            clearTimeout(e.timer);
+        this.map.clear();
+    }
+}
+//# sourceMappingURL=dedup.js.map

package/dist/features/network/dedup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dedup.js","sourceRoot":"","sources":["../../../src/features/network/dedup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAWH,gEAAgE;AAChE,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAC;AAE5B,MAAM,OAAO,OAAO;IAGlB,YACmB,QAAgB,EAChB,IAAY;IAC7B,gEAAgE;IAC/C,UAAuB;QAHvB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,SAAI,GAAJ,IAAI,CAAQ;QAEZ,eAAU,GAAV,UAAU,CAAa;QANzB,QAAG,GAAG,IAAI,GAAG,EAAiB,CAAC;IAO7C,CAAC;IAEJ,2FAA2F;IAC3F,IAAI,CAAC,IAAiB;QACpB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,IAAK,IAA2B,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QAClH,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,EAAE,CAAC;YACN,CAAC,CAAC,KAAK,EAAE,CAAC;YACV,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,iCAAiC;YAChD,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3D,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,QAAQ;YAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/F,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,GAAW;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAiB,CAAC,CAAC;IACjF,CAAC;IAEO,WAAW;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,gCAAgC;QAC7E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,CAAC;gBAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,sDAAsD;QAC5E,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,mDAAmD;IACnD,OAAO;QACL,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE;YAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;CACF"}