@sightspool/sdk 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Sightspool
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+

package/NOTICE

@@ -0,0 +1,5 @@
+Sightspool SDK
+Copyright 2026 Sightspool
+
+This product includes software developed by Sightspool.
+Licensed under the Apache License, Version 2.0 (see LICENSE).

package/README.md

@@ -0,0 +1,192 @@
+# @sightspool/sdk
+
+In-product capture for [Sightspool](https://github.com/sightspool). Drop it into your web app and
+it captures, **at the moment of friction**, what a user was trying to do (*intent*),
+how hard it was (*effort*), and the account behind it — emitting one linked **Signal**
+into your Sightspool workspace.
+
+It's the one source of data that exists nowhere else: the *silent failures* (the user
+who calmly couldn't do the thing, hit no error, filed no ticket, and left) and the
+*unmet demand* (goals your product has no path for, so no funnel or error ever records
+them).
+
+> **Status:** v0.1, collect-side. The SDK *senses* — it captures and analyses. It does
+> **not** act on your surface (surveys/nudges/experiments are Wave 0005, and every one
+> is human-gated). Trigger sensitivity and intent inference calibrate with live traffic.
+
+---
+
+## Install — two lines
+
+### npm / bundler
+
+```bash
+npm install @sightspool/sdk
+```
+
+```js
+import Sightspool from '@sightspool/sdk'
+
+Sightspool.init({ key: 'pk_live_…' })
+
+// once you know who the user is:
+Sightspool.identify(currentUser.id, { account: 'Vertex Logistics', plan: 'growth' })
+```
+
+`init` boots passive capture immediately. `identify` attaches the user to an **account**
+and **plan** — the only required wiring, and it's what lets Sightspool rank by customer
+(and, with a connected billing source, by MRR). Most apps already make an equivalent
+call for their analytics/support tools.
+
+### Script tag (no build step)
+
+```html
+<script
+  async
+  src="https://app.sightspool.com/sdk.global.js"
+  data-sightspool-key="pk_live_…"
+></script>
+```
+
+The tag auto-`init`s from its `data-sightspool-key`. Call `identify` once the user is
+known:
+
+```html
+<script>
+  window.Sightspool && window.Sightspool.identify(userId, { account, plan })
+</script>
+```
+
+(Loading the script before `Sightspool` is defined? Calls are safe to make against
+`window.Sightspool` once the script has loaded; until then, guard with `&&` as above.)
+
+The script tag also reads these optional attributes (the no-build equivalent of the
+`init` options — comma-separate selector lists):
+
+```html
+<script
+  async
+  src="https://app.sightspool.com/sdk.global.js"
+  data-sightspool-key="pk_live_…"
+  data-sightspool-block=".billing-panel, [data-private]"
+  data-sightspool-redact=".customer-name"
+  data-sightspool-debug
+  data-sightspool-capture-localhost
+></script>
+```
+
+---
+
+## Configuration
+
+`init(config)` — all optional except `key`:
+
+| option | type | default | purpose |
+|---|---|---|---|
+| `key` | `string` | — | **required.** Your publishable key (`pk_live_…`), from the Connections → In-product SDK card. Publishable — safe to ship in client JS. |
+| `endpoint` | `string` | the bundle's origin (script tag) / `https://app.sightspool.com` (npm) | Ingest base URL. The `<script>` install auto-resolves it to wherever `sdk.global.js` was served from (your app), so the key alone is enough; override for a CDN-hosted bundle or dev. |
+| `boundaryAsk` | `boolean` | `true` | Show the one-tap "did you do what you came to do?" ask at session boundaries. |
+| `consent` | `boolean` | `true` | Start capturing immediately. Set `false` to stay paused until you call `Sightspool.consent(true)` (or `start()`) after obtaining consent. |
+| `redact` | `string[]` | `[]` | CSS selectors whose captured text is **masked** (replaced with `‹redacted›`) before anything leaves the page. The event is still recorded — only its label is masked. |
+| `block` | `string[]` | `[]` | CSS selectors whose events are **dropped entirely** (the hard opt-out). Equivalent to putting `data-sightspool-ignore` on the element. |
+| `captureOnLocalhost` | `boolean` | `false` | By default the SDK **no-ops on localhost** (`localhost`, `127.0.0.1`, `*.local`, `*.localhost`) so your `npm run dev` traffic never pollutes analytics. Set `true` to capture locally (e.g. to test the install). |
+| `debug` | `boolean` | `false` | Log every capture decision to the console (`[sightspool] …`) so you can watch it work. |
+
+Server-side config (allowed CORS origins, additional redaction rules) lives on the
+Connections card and is enforced at ingest — the key alone can't post from an
+un-allowlisted origin.
+
+### Privacy controls at a glance
+
+| You want to… | Use |
+|---|---|
+| Never capture a subtree (e.g. a billing panel) | `data-sightspool-ignore` on the element, or a `block` selector |
+| Mask a field's text but still log the interaction | a `redact` selector (text → `‹redacted›`) |
+| Wait for cookie-banner consent | init `{ consent: false }` then `Sightspool.consent(true)` |
+| Keep dev traffic out of analytics | nothing — localhost is suppressed by default |
+
+---
+
+## What it captures
+
+- **Passively, no wiring** — route/screen sequence, clicks, **dead-clicks** and
+  **rage-clicks**, client-side errors and failed requests, and a rolling trail of the
+  last meaningful events.
+- **Stated intent** — typed queries in search / filter / command-palette / empty-state
+  inputs, especially **zero-result** searches (the highest-signal intent, no question).
+- **The one-tap ask** (at a session boundary or after detected friction, rate-limited
+  and fatigue-aware): *"Were you able to do what you came here to do today?"* → on "Not
+  really," a short shortlist of likely goals + an always-present "Something else."
+
+Each capture emits one **Signal** (`intent + path + account + effort`). Intent and
+effort are *constructed* server-side with calibrated confidence — the SDK ships the
+raw trace and the answer; it never guesses.
+
+---
+
+## Safety & privacy
+
+Privacy-conscious **by default** — these are on without any config:
+
+- **PII is masked before it leaves the page.** Emails and long digit runs (card /
+  account-number-ish) in any captured label are replaced with `‹email›` / `‹num›`.
+  Password, email, `tel`, and credit-card inputs are dropped entirely — their values
+  are **never** captured.
+- **No cookies, no `localStorage`, no raw keystrokes.** The SDK reads none of them. It
+  captures *debounced* search-input values (stated intent) and interaction events — not
+  a keylog.
+- **You control the rest.** Drop any subtree with `data-sightspool-ignore` or a `block`
+  selector; mask a field's text with a `redact` selector; gate everything behind
+  `Sightspool.consent(false)` until your cookie banner says otherwise.
+- **Suppressed on localhost** so dev traffic never pollutes analytics (opt back in with
+  `captureOnLocalhost`).
+
+And the engineering guarantees:
+
+- **Never throws into your app.** Every path is wrapped; capture degrades silently
+  (no Signal is worth a broken host UI).
+- **Tiny + non-blocking.** The prompt UI lazy-loads into a shadow root, so it can't be
+  styled-broken by your CSS and adds ~nothing to your bundle until it's needed.
+- **Processor posture.** Sightspool processes on your behalf; the prompt discloses that
+  diagnostic context is attached.
+
+---
+
+## API
+
+```ts
+Sightspool.init(config: SightspoolConfig): void
+Sightspool.identify(userId: string, traits?: { account?: string; plan?: string }): void
+Sightspool.consent(granted: boolean): void  // runtime consent toggle (wire to your cookie banner)
+Sightspool.start(): void   // begin capture if init'd with { consent: false } (alias of consent(true))
+Sightspool.stop(): void    // pause capture and flush (alias of consent(false))
+```
+
+---
+
+## Roadmap (not yet built)
+
+Deliberately deferred from the v1 collect side. Most are **data-gated** — they need real
+traffic to calibrate, so they wait for the first production installs.
+
+- **Server-LLM State-B candidates** (`/api/sdk/candidates`). Today the prompt's candidate goals
+  are derived **locally** (recent search query + page label) — instant and free, but shallow. A
+  server endpoint would generate sharper candidates in the app's own feature vocabulary, at the
+  cost of a per-prompt round-trip; it must fall back to the local/generic ask within a tight
+  latency budget.
+- **Adaptive micro-interview** on high-value / high-MRR friction — a short, session-grounded,
+  agent-authored follow-up beyond the one-tap default, under the same fatigue caps.
+- **Reliable zero-result detection.** v1 harvests the typed query; flagging it as *zero-result*
+  (the highest-signal intent) is best-effort and needs per-app empty-state hints.
+- **Server-to-server signed (HMAC) ingest** — for non-browser / backend Signal sources (the
+  publishable-key + origin-allowlist posture is browser-only).
+- **Mobile / native SDK** — web-first for now.
+
+## Develop
+
+```bash
+pnpm install
+pnpm build        # tsup → dist/ (ESM + CJS + types + dist/sdk.global.js)
+pnpm type-check
+pnpm test         # node --test over the pure cores
+```

package/dist/chunk-4PADVIIO.js

@@ -0,0 +1,41 @@
+// src/privacy.ts
+var EMAIL_RE = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
+var LONG_DIGITS_RE = /\d{6,}/g;
+var MAX_LABEL_LEN = 280;
+function redactText(input) {
+  if (!input) return "";
+  try {
+    return String(input).replace(EMAIL_RE, "\u2039email\u203A").replace(LONG_DIGITS_RE, "\u2039num\u203A").replace(/\s+/g, " ").trim().slice(0, MAX_LABEL_LEN);
+  } catch (e) {
+    return "";
+  }
+}
+var ATTACH_DISCLOSURE = "Session and account attached automatically.";
+var REDACTED = "\u2039redacted\u203A";
+var IGNORE_ATTR = "data-sightspool-ignore";
+function safeClosest(el, selector) {
+  try {
+    return typeof el.closest === "function" && el.closest(selector) != null;
+  } catch (e) {
+    return false;
+  }
+}
+function isIgnoredElement(el, blockSelectors = []) {
+  if (!el || typeof el.closest !== "function") return false;
+  if (safeClosest(el, `[${IGNORE_ATTR}]`)) return true;
+  for (const sel of blockSelectors) {
+    if (sel && safeClosest(el, sel)) return true;
+  }
+  return false;
+}
+function matchesRedactSelector(el, redactSelectors = []) {
+  if (!el || typeof el.closest !== "function") return false;
+  for (const sel of redactSelectors) {
+    if (sel && safeClosest(el, sel)) return true;
+  }
+  return false;
+}
+
+export { ATTACH_DISCLOSURE, REDACTED, isIgnoredElement, matchesRedactSelector, redactText };
+//# sourceMappingURL=chunk-4PADVIIO.js.map
+//# sourceMappingURL=chunk-4PADVIIO.js.map

package/dist/chunk-4PADVIIO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/privacy.ts"],"names":[],"mappings":";AAIA,IAAM,QAAA,GAAW,iDAAA;AACjB,IAAM,cAAA,GAAiB,SAAA;AAEhB,IAAM,aAAA,GAAgB,GAAA;AAMtB,SAAS,WAAW,KAAA,EAA0C;AACnE,EAAA,IAAI,CAAC,OAAO,OAAO,EAAA;AACnB,EAAA,IAAI;AACF,IAAA,OAAO,OAAO,KAAK,CAAA,CAChB,QAAQ,QAAA,EAAU,mBAAS,EAC3B,OAAA,CAAQ,cAAA,EAAgB,iBAAO,CAAA,CAC/B,OAAA,CAAQ,QAAQ,GAAG,CAAA,CACnB,MAAK,CACL,KAAA,CAAM,GAAG,aAAa,CAAA;AAAA,EAC3B,CAAA,CAAA,OAAQ,CAAA,EAAA;AACN,IAAA,OAAO,EAAA;AAAA,EACT;AACF;AAQO,IAAM,iBAAA,GAAoB;AAG1B,IAAM,QAAA,GAAW;AAGjB,IAAM,WAAA,GAAc,wBAAA;AAK3B,SAAS,WAAA,CAAY,IAAe,QAAA,EAA2B;AAC7D,EAAA,IAAI;AACF,IAAA,OAAO,OAAO,EAAA,CAAG,OAAA,KAAY,cAAc,EAAA,CAAG,OAAA,CAAQ,QAAQ,CAAA,IAAK,IAAA;AAAA,EACrE,CAAA,CAAA,OAAQ,CAAA,EAAA;AAIN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAOO,SAAS,gBAAA,CACd,EAAA,EACA,cAAA,GAAoC,EAAC,EAC5B;AACT,EAAA,IAAI,CAAC,EAAA,IAAM,OAAO,EAAA,CAAG,OAAA,KAAY,YAAY,OAAO,KAAA;AACpD,EAAA,IAAI,YAAY,EAAA,EAAI,CAAA,CAAA,EAAI,WAAW,CAAA,CAAA,CAAG,GAAG,OAAO,IAAA;AAChD,EAAA,KAAA,MAAW,OAAO,cAAA,EAAgB;AAChC,IAAA,IAAI,GAAA,IAAO,WAAA,CAAY,EAAA,EAAI,GAAG,GAAG,OAAO,IAAA;AAAA,EAC1C;AACA,EAAA,OAAO,KAAA;AACT;AAOO,SAAS,qBAAA,CACd,EAAA,EACA,eAAA,GAAqC,EAAC,EAC7B;AACT,EAAA,IAAI,CAAC,EAAA,IAAM,OAAO,EAAA,CAAG,OAAA,KAAY,YAAY,OAAO,KAAA;AACpD,EAAA,KAAA,MAAW,OAAO,eAAA,EAAiB;AACjC,IAAA,IAAI,GAAA,IAAO,WAAA,CAAY,EAAA,EAAI,GAAG,GAAG,OAAO,IAAA;AAAA,EAC1C;AACA,EAAA,OAAO,KAAA;AACT","file":"chunk-4PADVIIO.js","sourcesContent":["// Redaction — mask sensitive text before it ever leaves the page (GOV-3). The\n// pure string helpers are unit-tested; the DOM-querying part (selector masking)\n// lives in capture.ts and calls in here.\n\nconst EMAIL_RE = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}/g;\nconst LONG_DIGITS_RE = /\\d{6,}/g; // card / account-number-ish runs\n\nexport const MAX_LABEL_LEN = 280;\n\n/**\n * Mask PII-ish substrings in a captured label/verbatim and clamp length.\n * Conservative: emails and long digit runs become placeholders. Never throws.\n */\nexport function redactText(input: string | null | undefined): string {\n  if (!input) return \"\";\n  try {\n    return String(input)\n      .replace(EMAIL_RE, \"‹email›\")\n      .replace(LONG_DIGITS_RE, \"‹num›\")\n      .replace(/\\s+/g, \" \")\n      .trim()\n      .slice(0, MAX_LABEL_LEN);\n  } catch {\n    return \"\";\n  }\n}\n\n/** Should a captured element's value be dropped entirely (not just masked)? */\nexport function isSensitiveInput(type: string | null | undefined): boolean {\n  const t = (type ?? \"\").toLowerCase();\n  return t === \"password\" || t === \"email\" || t === \"tel\" || t === \"creditcard\";\n}\n\nexport const ATTACH_DISCLOSURE = \"Session and account attached automatically.\";\n\n/** Placeholder substituted for the text of a `redact`-matched element (GOV-3). */\nexport const REDACTED = \"‹redacted›\";\n\n/** The per-element opt-out attribute: a click/input inside `[data-sightspool-ignore]` is dropped entirely. */\nexport const IGNORE_ATTR = \"data-sightspool-ignore\";\n\n/** Anything with a `.closest(selector)` — the bit of Element we depend on (kept DOM-free for unit tests). */\ntype Closeable = { closest?: (selectors: string) => unknown };\n\nfunction safeClosest(el: Closeable, selector: string): boolean {\n  try {\n    return typeof el.closest === \"function\" && el.closest(selector) != null;\n  } catch {\n    // An invalid selector (host misconfig) must never throw into capture — and must\n    // never *accidentally capture* what was meant to be excluded: treat as no-match\n    // for that one selector and let the others decide.\n    return false;\n  }\n}\n\n/**\n * Should this element's events be dropped entirely (not just masked)? True when the\n * element — or any ancestor — carries `data-sightspool-ignore` or matches one of the\n * configured `block` selectors. The host's hard privacy opt-out (GOV-3).\n */\nexport function isIgnoredElement(\n  el: Closeable | null | undefined,\n  blockSelectors: readonly string[] = [],\n): boolean {\n  if (!el || typeof el.closest !== \"function\") return false;\n  if (safeClosest(el, `[${IGNORE_ATTR}]`)) return true;\n  for (const sel of blockSelectors) {\n    if (sel && safeClosest(el, sel)) return true;\n  }\n  return false;\n}\n\n/**\n * Should this element's captured text be masked wholesale? True when the element —\n * or any ancestor — matches one of the configured `redact` selectors. (The event is\n * still recorded; only its label becomes {@link REDACTED}.)\n */\nexport function matchesRedactSelector(\n  el: Closeable | null | undefined,\n  redactSelectors: readonly string[] = [],\n): boolean {\n  if (!el || typeof el.closest !== \"function\") return false;\n  for (const sel of redactSelectors) {\n    if (sel && safeClosest(el, sel)) return true;\n  }\n  return false;\n}\n"]}