@tracelane/wdio 0.1.0-alpha.2 → 0.1.0-alpha.21

package/README.md

@@ -1,6 +1,53 @@
+<img src="https://raw.githubusercontent.com/Cubenest/rrweb-stack/main/assets/brand/sub-tracelane.svg" height="40" alt="tracelane">
+
 # @tracelane/wdio
 
-A [WebdriverIO](https://webdriver.io) **Service** that records an [rrweb](https://www.rrweb.io)-grade session of your test run and, on a failed test, writes a **single self-contained `.html` report** to `./tracelane-reports/` — replay, console panel, and failed-network panel, all offline in one file.
+> The reporter for your WebdriverIO tests — Playwright and Cypress on the roadmap. Self-contained HTML for every run — replay failures, audit successes, attach to any bug tracker. No SaaS, no dashboard, no signup.
+
+[![npm](https://img.shields.io/npm/v/@tracelane/wdio.svg)](https://www.npmjs.com/package/@tracelane/wdio)
+[![downloads](https://img.shields.io/npm/dw/@tracelane/wdio.svg)](https://www.npmjs.com/package/@tracelane/wdio)
+[![license](https://img.shields.io/npm/l/@tracelane/wdio.svg)](https://github.com/Cubenest/rrweb-stack/blob/main/LICENSE)
+[![CI](https://github.com/Cubenest/rrweb-stack/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/Cubenest/rrweb-stack/actions/workflows/ci.yml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Cubenest/rrweb-stack/badge)](https://scorecard.dev/viewer/?uri=github.com/Cubenest/rrweb-stack)
+
+![tracelane install — one command](https://raw.githubusercontent.com/Cubenest/rrweb-stack/main/assets/tracelane-hero.gif)
+
+Docs: <https://tracelane.cubenest.in>
+
+```sh
+cd your-wdio-project
+npx @tracelane/cli init
+```
+
+That's it. [`npx @tracelane/cli init`](https://www.npmjs.com/package/@tracelane/cli) detects your runner, installs `@tracelane/wdio`, edits `wdio.conf.ts` in place, and gitignores the reports directory. Idempotent (re-run is a no-op) and dry-runnable (`--dry-run`).
+
+Run your suite. On a failing test you get a single `.html` file at `./tracelane-reports/<spec>--<title>--<cid>-<ts>.html` — open it in any browser, fully offline. Replay the run with [rrweb-player](https://www.rrweb.io), inspect the console + failed-network panels, attach to your bug tracker, archive it forever. No upload, no signup, no cloud.
+
+### Or wire it manually
+
+```sh
+npm install --save-dev @tracelane/wdio
+```
+
+```ts
+// wdio.conf.ts
+import TraceLaneService from '@tracelane/wdio';
+
+export const config = {
+  // ...your existing config
+  services: [[TraceLaneService, { mode: 'failed' }]],
+};
+```
+
+Same result — `npx @tracelane/cli init` is just the orchestration that does the lines above for you.
+
+## What this is NOT
+
+- Not Cypress Cloud, Replay.io, or Sentry Session Replay. There is no SaaS to host. There is no signup. There is no dashboard. There is no telemetry. The artifact is a single HTML file on your filesystem.
+- Not a reporter (in the `@wdio/reporter` sense). `tracelane` is a WDIO **Service** because only a Service can attach to the live browser, inject the rrweb recorder + in-page network plugin, drain the in-page buffer, and (where available) use CDP to enrich network capture. A paired Allure **Reporter** shim is planned for v1.1.
+- Not just for failures. `mode: 'all'` writes a report for every test — useful as a CI artifact, evidence in a PR, or a "what changed between green and red" diff.
+
+## Full example
 
 ```ts
 // wdio.conf.ts
@@ -18,7 +65,10 @@ export const config: Options.Testrunner = {
     },
   ],
   services: [
-    ['devtools', {}], // enables browser.cdp(...) for network capture — see "Network capture" below
+    // Optional: network is captured in-page by default (all browsers, no CDP).
+    // Add devtools only to enrich it with authoritative status + no-response
+    // failures on Chromium — see "Network capture" below.
+    ['devtools', {}],
     [
       TraceLaneService,
       {
@@ -32,21 +82,13 @@ export const config: Options.Testrunner = {
 };
 ```
 
-Run your suite. On a failing Chrome+Mocha test you get `./tracelane-reports/<spec>--<title>--<cid>-<ts>.html` — open it in any browser, fully offline.
-
-## Install
-
-```sh
-pnpm add -D @tracelane/wdio webdriverio @wdio/cli @wdio/local-runner @wdio/mocha-framework
-```
-
 `webdriverio` and `@wdio/types` are **peer dependencies** (`^9.0.0`); you already have them in a WDIO project.
 
 ## How it works
 
 - On the first test, the Service injects an rrweb recorder bundle into the page and installs an in-page event buffer (`window.__tracelane__events`).
-- The Node side drains that buffer on a poll (default every 5 s) and on every `afterTest`, re-injecting on navigation ([ADR-0006](https://github.com/Cubenest/rrweb-stack/blob/main/prds/adrs/0006-p1-in-page-buffer-node-polled.md)).
-- In `failed` mode (default) a passing test discards its buffer; a failing test's buffer is handed to [`@tracelane/report`](https://github.com/Cubenest/rrweb-stack/tree/main/packages/tracelane-report), which builds the single offline HTML (≤ 25 MB, [ADR-0005](https://github.com/Cubenest/rrweb-stack/blob/main/prds/adrs/0005-p1-failed-only-self-contained-html.md)).
+- The Node side drains that buffer on a poll (default every 500 ms) and on every `afterTest`, re-injecting after each navigation.
+- In `failed` mode (default) a passing test discards its buffer; a failing test's buffer is handed to [`@tracelane/report`](https://github.com/Cubenest/rrweb-stack/tree/main/packages/tracelane-report), which builds the single offline HTML (≤ 25 MB).
 
 ## Options
 
@@ -55,9 +97,10 @@ pnpm add -D @tracelane/wdio webdriverio @wdio/cli @wdio/local-runner @wdio/mocha
 | `mode` | `'failed' \| 'all'` | `'failed'` | `failed` writes a report only on failure; `all` on every test. `TRACELANE_MODE` env var overrides this. |
 | `outDir` | `string` | `'./tracelane-reports'` | Report output directory (created if missing). |
 | `capture.rrweb` | `boolean` | `true` | Record the rrweb session. |
-| `capture.network` | `boolean` | `true` | Route failed responses (`status >= 400`) into the console timeline via CDP. |
-| `capture.console` | `boolean` | `true` | Capture `console.*` via the rrweb console plugin. Setting this `false` also drops the `[tracelane.net]` network-error lines, since `capture.network` surfaces them through `console.error`. |
-| `drainIntervalMs` | `number` | `5000` | Node-side drain poll interval. |
+| `capture.network` | `boolean` | `true` | Capture network requests via the in-page `rrweb/network@1` plugin — all browsers, no CDP. Privacy-first: only URL/method/status/timing by default (headers + bodies off; opt in via `capture.networkOptions`). CDP is an optional fallback that adds authoritative status + true no-response failures where it's available. |
+| `capture.networkOptions` | `NetworkRecordOptions` | plugin defaults | Forwarded to the in-page network plugin (`recordHeaders`, `recordBody`, `maskRequestFn`, `payloadHostDenyList`, …). Defaults are privacy-first (headers + bodies off). Ignored when `capture.network` is `false`. |
+| `capture.console` | `boolean` | `true` | Capture `console.*` via the rrweb console plugin. Setting this `false` also drops any `[tracelane.net]` network-error lines from the CDP fallback path, since those surface through `console.error`. |
+| `drainIntervalMs` | `number` | `500` | Node-side drain poll interval. |
 | `cooldownMs` | `number` | `250` | Re-injection cooldown guard (suppresses double-init on hash/HMR navigation). |
 | `allure` | `boolean` | `false` | Reserved for the v1.1 Allure shim. No-op in v1. |
 | `visualDiff` | `boolean` | `false` | Reserved for the post-MVP visual-diff add-on. No-op in v1. |
@@ -66,7 +109,7 @@ The options type is published — `import type { TraceLaneOptions } from '@trace
 
 ## Hook-factory alternative (no Service)
 
-For setups that can't register a Service, the **same logic** is available as plain `wdio.conf.ts` hook functions ([ADR-0004](https://github.com/Cubenest/rrweb-stack/blob/main/prds/adrs/0004-p1-wdio-service-not-reporter.md)):
+For setups that can't register a Service, the **same logic** is available as plain `wdio.conf.ts` hook functions:
 
 ```ts
 import { traceLaneHooks } from '@tracelane/wdio/hooks';
@@ -79,7 +122,7 @@ export const config: Options.Testrunner = {
   before: tracelane.before,
   beforeSuite: tracelane.beforeSuite,
   beforeTest: tracelane.beforeTest,
-  beforeCommand: tracelane.beforeCommand, // re-injection on navigation
+  afterCommand: tracelane.afterCommand, // re-injection after navigation
   afterTest: tracelane.afterTest,
   afterSuite: tracelane.afterSuite,
   after: tracelane.after,
@@ -87,26 +130,23 @@ export const config: Options.Testrunner = {
 };
 ```
 
-## FAQ — Why is this a Service and not a Reporter?
+## Network capture
 
-Because only a **Service** can do what `tracelane` needs ([ADR-0004](https://github.com/Cubenest/rrweb-stack/blob/main/prds/adrs/0004-p1-wdio-service-not-reporter.md)):
+By default network is captured **in-page** by the framework-agnostic `rrweb/network@1` plugin (shipped in `@cubenest/rrweb-core`). It works on **every browser** — Chrome, Edge, Firefox, Safari, and cloud Selenium — with **no CDP and no extra service**, because the plugin wraps `fetch`/`XHR` and reads `PerformanceObserver` entries from inside the page.
 
-| | Service (`Services.ServiceInstance`) | Reporter (`@wdio/reporter`) |
-|---|---|---|
-| Access to live `browser` in worker hooks | **Yes** | No — reporters run in the launcher process |
-| `browser.execute(...)` to inject rrweb / drain the buffer | **Yes** | No |
-| `browser.cdp(...)` for network capture | **Yes** | No |
+Privacy-first by default: only **URL, method, status, and timing** are captured. Request/response **headers and bodies are OFF** unless you opt in via `capture.networkOptions` (`recordHeaders` / `recordBody`, plus masking hooks like `maskRequestFn` and `payloadHostDenyList`). A couple of accuracy caveats of the default timing surface:
 
-A Reporter receives only serialized lifecycle events (`testFail`, `testEnd`, …) in the launcher process — it has no page handle, so it can't inject rrweb, drain the in-page buffer, or attach CDP. (`wdio-allure-reporter` hit exactly this wall and had to add a runtime-side `addAttachment` helper to bridge browser access.) A paired Allure **Reporter** shim is planned for v1.1 to push `tracelane` artifacts into Allure's `addAttachment` API — that's a Reporter-shaped problem; capture is not.
+- For cross-origin **sub-resources** (images, scripts, fonts loaded from another origin), the Resource Timing spec reports `status: 0` and no method — these are not surfaced as failures.
+- Accurate per-request **status** for `fetch`/`XHR` requires those wrappers, which are part of the default capture; the plugin only omits header/body payloads unless opted in.
 
-## Network capture
+### CDP fallback (optional enhancement)
 
-Failed responses (`status >= 400`) are routed into the report's console timeline (prefixed `[tracelane.net]`, [P1 PRD §E.2](https://github.com/Cubenest/rrweb-stack/blob/main/prds/compass_artifact_wf-d53d32da-17e9-41b5-bb70-21dd1bf648c6_text_markdown.md)). This needs `browser.cdp(...)`, which a separate WDIO service provides:
+When a CDP-capable session is present, `tracelane` *additionally* uses `browser.cdp(...)` to capture **authoritative HTTP status** for failed responses (`status >= 400`) and **true no-response failures** (CORS/DNS/offline/abort) that the page wrappers can't always see. These are routed into the report's console timeline (prefixed `[tracelane.net]`) and the report merges them over the in-page rows for the same request (real status wins). To enable it:
 
 - **WDIO 8:** add `['devtools', {}]` via `@wdio/devtools-service@8`.
-- **WDIO 9:** `@wdio/devtools-service` has no stable v9 line (it stabilized at v10); use the v10 service or a CDP-capable session. **If `browser.cdp` is unavailable, `tracelane` degrades gracefully to rrweb + console capture** — the report is still produced, just without the network panel.
+- **WDIO 9:** `@wdio/devtools-service` has no stable v9 line (it stabilized at v10); use the v10 service or a CDP-capable session.
 
-Cloud Selenium vendors typically don't expose CDP; rrweb + console capture still work there.
+If CDP is unavailable (cloud Selenium, Firefox, Safari), nothing is lost beyond the CDP-only authoritative-status enhancement — the in-page plugin still populates the network panel and the report is still produced.
 
 ## Supported runners / browsers
 
@@ -116,23 +156,30 @@ Cloud Selenium vendors typically don't expose CDP; rrweb + console capture still
 | Jasmine | Supported (same `afterTest` result shape) |
 | Cucumber | Supported via `beforeScenario`/`afterScenario` |
 
-| Browser | rrweb + console | Network (CDP) |
-|---|---|---|
-| Chrome / Chromium ≥ 116 | **Yes** | Yes (with a CDP-capable session) |
-| Edge (Chromium) | Yes | Yes |
-| Firefox | Yes | No (CDP is Chromium-only) |
-| Safari | Yes | No |
+| Browser | rrweb + console | Network (in-page plugin) | Authoritative status / no-response failures (CDP) |
+|---|---|---|---|
+| Chrome / Chromium ≥ 116 | **Yes** | Yes | Yes (with a CDP-capable session) |
+| Edge (Chromium) | Yes | Yes | Yes |
+| Firefox | Yes | Yes (in-page plugin) | No (CDP is Chromium-only) |
+| Safari | Yes | Yes (in-page plugin) | No |
+
+## Playwright + Cypress
+
+The tagline says Playwright and Cypress because the design is portable across runners — same `@tracelane/core` engine, different glue. Tracking issues:
+
+- **`@tracelane/playwright`** — Playwright Reporter implementing `onTestEnd` + `onAttachment` for shareable HTML. Targeted for week 2-3 of the public launch.
+- **`@tracelane/cypress`** — JSON-output adapter only (no Cypress Test Replay overlap). Targeted for week 11.
 
-## Versioning
+Watch the [release notes](https://github.com/Cubenest/rrweb-stack/releases) on `Cubenest/rrweb-stack` or follow `@cubenest_in` on X (when announced).
 
-Semantic Versioning. Currently `0.1.0-alpha.0` (pre-release; the API may shift before `1.0.0`).
+## Versioning & telemetry
 
-## Telemetry
+Semantic Versioning. Currently `0.1.0-alpha.x` (pre-release; the API may shift before `1.0.0`). See [SUPPORTED.md](https://github.com/Cubenest/rrweb-stack/blob/main/SUPPORTED.md) for the compatibility matrix.
 
-None. `tracelane` collects and sends nothing; reports are written to your local `outDir` only.
+**No telemetry.** `tracelane` collects and sends nothing; reports are written to your local `outDir` only. The generated HTML report includes a footer crediting the tool; you can suppress it with `report: { footer: false }`.
 
 ## License
 
 Apache 2.0. The bundled rrweb engine + console plugin remain MIT-licensed; see `NOTICE`.
 
-Contributions are accepted under the [Developer Certificate of Origin (DCO)](https://developercertificate.org/) — sign your commits with `git commit -s`.
+Contributions are accepted under the [Developer Certificate of Origin (DCO)](https://developercertificate.org/) — sign your commits with `git commit -s`. See [CONTRIBUTING.md](https://github.com/Cubenest/rrweb-stack/blob/main/CONTRIBUTING.md) + [SECURITY.md](https://github.com/Cubenest/rrweb-stack/blob/main/SECURITY.md).

package/dist/hooks.d.ts

@@ -15,7 +15,14 @@ export interface TraceLaneHooks {
     before(capabilities: unknown, specs: string[], browser: WebdriverIO.Browser): Promise<void>;
     beforeSuite(suite: Frameworks.Suite): void;
     beforeTest(test: Frameworks.Test, context?: unknown): Promise<void>;
-    beforeCommand(commandName: string, args: unknown[]): Promise<void>;
+    /**
+     * Post-command hook. Re-injects the recorder AFTER a `url(...)` returns
+     * (T-9 fix, 2026-05-28 QA walk) — re-injecting before the navigation lands
+     * on a doomed page that's about to be torn down, leaving no recorder on
+     * the new page. The full Service / hooks pair was previously wired to
+     * `beforeCommand`; that was the bug.
+     */
+    afterCommand(commandName: string, args: unknown[], result: unknown, error?: Error): Promise<void>;
     afterTest(test: Frameworks.Test, context: unknown, result: Frameworks.TestResult): Promise<void>;
     afterSuite(suite: Frameworks.Suite): void;
     after(result: number, capabilities: unknown, specs: string[]): Promise<void>;

package/dist/hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKrD,6EAA6E;AAC7E,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;IAC5D;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mEAAmE;AACnE,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3F,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC;IAC3C,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjG,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC;IAC1C,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7F,yDAAyD;IACzD,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,uDAAuD;IACvD,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,GAAE,oBAAyB,GAAG,cAAc,CAoCjF"}
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKrD,6EAA6E;AAC7E,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;IAC5D;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mEAAmE;AACnE,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3F,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC;IAC3C,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;;;;OAMG;IACH,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClG,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjG,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC;IAC1C,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7F,yDAAyD;IACzD,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,uDAAuD;IACvD,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,GAAE,oBAAyB,GAAG,cAAc,CAuCjF"}

package/dist/hooks.js

@@ -31,10 +31,15 @@ export function traceLaneHooks(options = {}) {
             const { title, spec } = testIdentity(test);
             await session.onBeforeTest(title, spec);
         },
-        async beforeCommand(commandName, args) {
-            if (commandName === 'url' && typeof args[0] === 'string') {
-                await session.onUrl(args[0]);
-            }
+        async afterCommand(commandName, args, _result, error) {
+            // T-9 fix (2026-05-28): re-inject only after a successful url() returns.
+            // `beforeCommand` fires before the navigation, so injecting there
+            // lands rrweb on a page that's about to be torn down.
+            if (commandName !== 'url' || typeof args[0] !== 'string')
+                return;
+            if (error !== undefined)
+                return;
+            await session.onUrl(args[0]);
         },
         async afterTest(_test, _context, result) {
             await session.onAfterTest(result);

package/dist/hooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,2BAA2B;AAC3B,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,oBAAoB;AACpB,EAAE;AACF,wFAAwF;AACxF,4FAA4F;AAC5F,EAAE;AACF,kFAAkF;AAClF,iCAAiC;AAIjC,OAAO,EAAiB,gBAAgB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AA8B1D;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,UAAgC,EAAE;IAC/D,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC;IAE5E,OAAO;QACL,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG;YAC/C,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO;YACzC,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAiC,CAAC,CAAC;QAC5D,CAAC;QACD,WAAW,CAAC,MAAM,IAAG,CAAC;QACtB,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ;YAC7B,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,IAAgB,CAAC,CAAC;YACvD,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI;YACnC,IAAI,WAAW,KAAK,KAAK,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACzD,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM;YACrC,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,UAAU,CAAC,MAAM,IAAG,CAAC;QACrB,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM;YACxC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC;QACD,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,IAAG,CAAC;QAC1D,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ;YAClC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAChD,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM;YAC/B,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,2BAA2B;AAC3B,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,oBAAoB;AACpB,EAAE;AACF,wFAAwF;AACxF,4FAA4F;AAC5F,EAAE;AACF,kFAAkF;AAClF,iCAAiC;AAIjC,OAAO,EAAiB,gBAAgB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAqC1D;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,UAAgC,EAAE;IAC/D,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC;IAE5E,OAAO;QACL,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG;YAC/C,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO;YACzC,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAiC,CAAC,CAAC;QAC5D,CAAC;QACD,WAAW,CAAC,MAAM,IAAG,CAAC;QACtB,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ;YAC7B,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,IAAgB,CAAC,CAAC;YACvD,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK;YAClD,yEAAyE;YACzE,kEAAkE;YAClE,sDAAsD;YACtD,IAAI,WAAW,KAAK,KAAK,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;gBAAE,OAAO;YACjE,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO;YAChC,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM;YACrC,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,UAAU,CAAC,MAAM,IAAG,CAAC;QACrB,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM;YACxC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC;QACD,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,IAAG,CAAC;QAC1D,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ;YAClC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAChD,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM;YAC/B,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/options.d.ts

@@ -1,12 +1,49 @@
+import type { NetworkRecordOptions } from '@cubenest/rrweb-core';
 import type { ConsolePluginOptions, Mode } from '@tracelane/core';
 /** Which capture channels are enabled (P1 PRD §M.1). */
 export interface CaptureOptions {
     /** Record the rrweb session. Default true. */
     rrweb?: boolean;
-    /** Attach CDP and route failed responses into the console timeline. Default true. */
+    /**
+     * Capture network requests. Default `true`.
+     *
+     * When enabled (default), the in-page rrweb network plugin
+     * (`rrweb/network@1`) is registered alongside the recorder —
+     * framework-agnostic, no CDP required, works on all browsers. The
+     * legacy CDP-based path is preserved as a fallback but no longer the
+     * primary capture mechanism.
+     *
+     * Privacy defaults (inherited from `@cubenest/rrweb-core`): headers and
+     * bodies are NOT captured unless opted in via {@link networkOptions}.
+     * Because the fetch/XHR wrappers are gated behind `recordHeaders` /
+     * `recordBody` (both off by default), the DEFAULT capture surface is
+     * PerformanceObserver timing only. That has two consequences worth
+     * knowing:
+     *   - method and an accurate per-request status may be unavailable
+     *     (PerformanceObserver entries don't carry the request method, and
+     *     report `status` only on same-origin / Timing-Allow-Origin
+     *     responses);
+     *   - cross-origin sub-resources report `status: 0` per the Resource
+     *     Timing spec even though they loaded fine — these are NOT treated
+     *     as failures by the report.
+     * Enable the wrappers (and thus accurate per-request method + status,
+     * plus optional headers/bodies) via {@link networkOptions}. The CDP
+     * fallback, when present, separately supplies authoritative status and
+     * true no-response failures.
+     */
     network?: boolean;
     /** Capture `console.*` via the rrweb console plugin. Default true. */
     console?: boolean;
+    /**
+     * Options forwarded to the in-page rrweb network plugin
+     * (`getRecordNetworkPlugin`). The full surface from
+     * `@cubenest/rrweb-core` is exposed: `recordHeaders`, `recordBody`,
+     * `maskRequestFn`, `payloadHostDenyList`, etc. Defaults are the
+     * plugin's defaults (privacy-first — headers + bodies off).
+     *
+     * Ignored when {@link network} is `false`.
+     */
+    networkOptions?: NetworkRecordOptions;
 }
 /** Options for {@link TraceLaneService} and {@link traceLaneHooks} (P1 PRD §M.1). */
 export interface TraceLaneOptions {
@@ -24,12 +61,25 @@ export interface TraceLaneOptions {
     capture?: CaptureOptions;
     /** Reserved for the post-MVP visual-diff add-on (P1 PRD §H). No-op in v1. */
     visualDiff?: boolean;
-    /** Node-side drain poll interval in ms (ADR-0006). Default 5000. */
+    /** Node-side drain poll interval in ms (ADR-0006). Default 500 (from @tracelane/core when unset). */
     drainIntervalMs?: number;
     /** Re-injection cooldown guard in ms (ADR-0006). Default 250. */
     cooldownMs?: number;
     /** Options forwarded to the in-page rrweb console plugin. */
     consolePluginOptions?: ConsolePluginOptions;
+    /** Advisory security-hygiene signals in the report (default true). Set false to disable capture + analysis. */
+    security?: boolean;
+    /**
+     * Report-output tweaks.
+     *
+     * - `footer` — render the self-contained report's "Generated by tracelane"
+     *   footer. Default `true`. Set `false` to suppress it (e.g. when embedding
+     *   reports in an internal tool where the attribution isn't wanted).
+     */
+    report?: {
+        /** Render the report footer. Default `true`. */
+        footer?: boolean;
+    };
 }
 /** The default output directory for reports. */
 export declare const DEFAULT_OUT_DIR = "./tracelane-reports";

package/dist/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAElE,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC7B,8CAA8C;IAC9C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,qFAAqF;IACrF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,qFAAqF;AACrF,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mCAAmC;IACnC,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oEAAoE;IACpE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;CAC7C;AAED,gDAAgD;AAChD,eAAO,MAAM,eAAe,wBAAwB,CAAC"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAElE,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC7B,8CAA8C;IAC9C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC;AAED,qFAAqF;AACrF,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mCAAmC;IACnC,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qGAAqG;IACrG,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,+GAA+G;IAC/G,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE;QACP,gDAAgD;QAChD,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;CACH;AAED,gDAAgD;AAChD,eAAO,MAAM,eAAe,wBAAwB,CAAC"}

package/dist/options.js.map

@@ -1 +1 @@
-{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAsCzE,gDAAgD;AAChD,MAAM,CAAC,MAAM,eAAe,GAAG,qBAAqB,CAAC"}
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAwFzE,gDAAgD;AAChD,MAAM,CAAC,MAAM,eAAe,GAAG,qBAAqB,CAAC"}