cyborg-hunter 0.9.2 → 0.10.0

package/src/oneliner/boot.js

@@ -0,0 +1,270 @@
+// src/oneliner/boot.js
+// Everything dist/ch.js does at load, in order:
+//   0. window.jsPsychCyborgHunter = OneLinerExtension unless a class is
+//      already there, before anything that can stop or fail: the documented
+//      per-trial { type: jsPsychCyborgHunter, params } entry then works with
+//      ch.js alone, and never becomes a ReferenceError in the researcher's
+//      code (extension-cyborg-hunter.js loaded first keeps its own class, and
+//      loaded later replaces this one: manual mode either way when initJsPsych
+//      lists it). With no context wired the class is inert;
+//   1. double-load sentinel: if cyborg-hunter.min.js (or another ch.js)
+//      already ran, say so and stop: no monitor, window.CyborgHunter untouched.
+//      After min.js, initJsPsych gets the inert wrapper (below); after another
+//      ch.js it is left to that one;
+//   2. config (tag data-* attributes over window.CyborgHunterConfig);
+//   3. participant id (warns when it has to fall back to a random id). The
+//      id is kept for the tab in sessionStorage, so a later page without an
+//      id of its own reuses the first page's random id (source 'session')
+//      and continues its session; a URL, attribute or config id still wins;
+//   4. a monitor (its session starts at step 6);
+//   5. host: 'jspsych' when initJsPsych is already defined, else 'vanilla'
+//      (the host adapters install their hooks into ctx.handlers). The vanilla
+//      adapter (adapters/vanilla.js) is installed before the first span
+//      opens: it restores a previous page's segment index, so the boot span
+//      is named after the continued index;
+//   6. the monitor's session starts and the segmenter keeps it inside a
+//      trial from this moment on ('span-<index>'), so a paste before the
+//      first host trial or mark is still recorded. The session start needs
+//      document.body (core signals/browser.js observes it), so with ch.js in
+//      <head> this step alone waits for DOMContentLoaded (a paste before
+//      then is not recorded); a failure then is logged as bootFailed;
+//   7. guards, vanilla host only (honeypot on by default, friction
+//      observe-only when enabled). On the jsPsych host the injected guard
+//      extensions own them: their initialize() runs GuardHoneypot.init and
+//      friction's setJsPsych / injectRefusalNotices, and the entry trial
+//      starts enforcement. Starting them here too would init the honeypot
+//      twice (the second init resets its violation log). On the jsPsych host
+//      initJsPsych is wrapped (adapters/jspsych.js); on both, a placement
+//      check reports a ch.js tag above jspsych.js or below the experiment
+//      code, and a jsPsych page that turns out not hookable falls back to the
+//      vanilla host (its guards and adapter start then);
+//   8. replay, only with data-replay (replay-loader.js): on the jsPsych
+//      host a proxy extension the initJsPsych wrap lists, which loads
+//      cyborg-hunter-replay.js in jsPsych's run(); on the vanilla host (and
+//      on the not-hookable fallback) the standalone recorder, started after
+//      DOMContentLoaded. CyborgHunter.replay() is wired either way;
+//   9. window.CyborgHunter = the one-liner namespace; then the sentinel;
+//  10. data-debug only (debug.js): the badge and the console summary, shown
+//      once now and again when the jsPsych timeline is walked.
+//
+// boot({ script, win, monitorFactory?, participantParams? }) → ctx | null
+//   script:            the ch.js <script> element (document.currentScript), or null
+//   win:               the window (the core monitor itself uses the globals)
+//   monitorFactory:    core init(); injectable for tests
+//   participantParams: URL parameter names for the participant id, in order
+// ctx = { config, participantId, participantIdSource, monitor, differ,
+//         segmenter, host, scriptSrc, handlers, win, api, vanilla?,
+//         replaySrc?, replayProxy? (jsPsych), replay? (vanilla handle),
+//         debug? (data-debug) }
+//
+// boot never throws into the page: any failure is logged as bootFailed, a
+// monitor created before the failure is destroyed, and boot returns null.
+// The sentinel is set only after a successful boot, so a later
+// cyborg-hunter.min.js still works if ch.js failed. The exception is a
+// failure at the deferred session start (step 6, ch.js in <head>): boot has
+// returned by then, so the namespace and the sentinel stay, and what can
+// still be saved is marked (failDeferred below).
+//
+// Whenever ch.js does not monitor (a failure, either kind, or the stand-down
+// after min.js) the host page must still run as it would without ch.js:
+// initJsPsych is left with only the inert wrapper (adapters/jspsych.js
+// installInertWrapper), which lists OneLinerExtension when nothing named
+// 'cyborg-hunter' is listed, so the researcher's jsPsychCyborgHunter trials
+// find a registered instance; and a boot failure with no window.CyborgHunter
+// yet leaves the inert namespace (api.js buildInertApi), so documented calls
+// do not throw.
+
+import { init } from '../core/monitor.js';
+import { createSegmentDiffer } from './segment-diff.js';
+import { createSegmenter } from './segmenter.js';
+import { readConfig } from './config.js';
+import { resolveParticipantId, randomParticipantId, DEFAULT_PARAMS } from './participant-id.js';
+import { startGuards } from './guards.js';
+import { buildPublicApi, buildInertApi } from './api.js';
+import { MESSAGES } from './errors.js';
+import { installJsPsychAdapter, installInertWrapper, watchHostPlacement } from './adapters/jspsych.js';
+import { OneLinerExtension } from './adapters/jspsych-extension.js';
+import { installVanillaAdapter } from './adapters/vanilla.js';
+import { installReplay } from './replay-loader.js';
+import { createDebug } from './debug.js';
+
+// Not under the session prefix (adapters/vanilla.js, cyborg-hunter:oneliner:
+// session:<id>), so no participant id can collide with it.
+var PID_KEY = 'cyborg-hunter:oneliner:pid';
+
+function sessionGet(win, key) {
+  try { return win.sessionStorage.getItem(key); } catch (_) { return null; }
+}
+function sessionSet(win, key, value) {
+  try { win.sessionStorage.setItem(key, value); } catch (_) { /* blocked: the id is per page then */ }
+}
+
+export function boot(opts) {
+  var win = opts.win;
+  var monitorFactory = opts.monitorFactory || init;
+  var monitor = null;
+  var ctx = null;
+  var adapter = null;   // the jsPsych adapter, once installed (step 7)
+  try {
+    // detectManualMode (adapters/jspsych.js) treats this class as the one-liner.
+    if (win.jsPsychCyborgHunter === undefined) win.jsPsychCyborgHunter = OneLinerExtension;
+  } catch (_) { /* a locked global: the researcher's own script tag still works */ }
+  try {
+    if (win.__cyborgHunterLoaded) {
+      console.error(MESSAGES.doubleLoad(win.__cyborgHunterLoaded, 'ch.js'));
+      // Another ch.js already wraps initJsPsych; a second wrapper would list
+      // this bundle's own class, which that ch.js takes for a manual-mode
+      // extension (detectManualMode compares classes).
+      if (win.__cyborgHunterLoaded !== 'ch.js') installInertWrapper(win);
+      return null;
+    }
+
+    var script = opts.script || null;
+    var config = readConfig({ dataset: (script && script.dataset) || {}, globalConfig: win.CyborgHunterConfig });
+
+    var pid = resolveParticipantId({
+      search: (win.location && win.location.search) || '',
+      attr: config.participantIdAttr,
+      configId: config.monitor.participantId,
+      params: opts.participantParams || DEFAULT_PARAMS,
+      random: function () { return randomParticipantId(win.crypto || globalThis.crypto); }
+    });
+    if (pid.source === 'random') {
+      var kept = sessionGet(win, PID_KEY);
+      if (kept) pid = { id: kept, source: 'session' };
+      else console.warn(MESSAGES.randomId(pid.id));
+    }
+    sessionSet(win, PID_KEY, pid.id);
+
+    monitor = monitorFactory(Object.assign({}, config.monitor, { participantId: pid.id, preset: config.preset }));
+    var differ = createSegmentDiffer(monitor);
+    var segmenter = createSegmenter({ monitor: monitor, differ: differ });
+    var host = typeof win.initJsPsych === 'function' ? 'jspsych' : 'vanilla';
+
+    ctx = {
+      config: config,
+      participantId: pid.id,
+      participantIdSource: pid.source,
+      monitor: monitor,
+      differ: differ,
+      segmenter: segmenter,
+      host: host,
+      scriptSrc: (script && script.src) || null,
+      scriptNonce: (script && script.nonce) || null,   // copied onto the lazily loaded replay <script>
+      handlers: {},
+      win: win,
+      api: null
+    };
+    ctx.api = buildPublicApi(ctx);
+    // data-debug only: the badge, the console summary and the perf counters.
+    if (config.debug) {
+      ctx.debug = createDebug({ doc: win.document, ctx: ctx });
+      win.__cyborgHunterDebug = { stats: ctx.debug.stats };
+    }
+    var replay = installReplay({ win: win, ctx: ctx });
+    if (host === 'vanilla') ctx.vanilla = installVanillaAdapter({ win: win, ctx: ctx });
+
+    // The session start observes document.body (core signals/browser.js), so
+    // with ch.js in <head> it waits for DOMContentLoaded; everything else,
+    // including the initJsPsych wrap the experiment code may call before
+    // DOMContentLoaded, is in place at once.
+    if (win.document.body) startMonitoring(ctx);
+    else {
+      win.document.addEventListener('DOMContentLoaded', function () {
+        try { startMonitoring(ctx); } catch (e) { failDeferred(ctx, adapter, e); }
+      }, { once: true });
+    }
+
+    if (host === 'vanilla') {
+      startGuards({ win: win, doc: win.document, guards: config.guards, debug: config.debug });
+      replay.startVanilla();
+    } else adapter = installJsPsychAdapter({ win: win, ctx: ctx });
+    watchHostPlacement({
+      win: win, doc: win.document, ctx: ctx, adapter: adapter,
+      onVanilla: function () {
+        try {
+          startGuards({ win: win, doc: win.document, guards: config.guards, debug: config.debug });
+          if (!ctx.vanilla) ctx.vanilla = installVanillaAdapter({ win: win, ctx: ctx });
+          replay.startVanilla();
+          if (ctx.debug) ctx.debug.logWhenParsed();
+        } catch (e) {
+          console.error(MESSAGES.bootFailed(String((e && e.message) || e)));
+        }
+      }
+    });
+    win.CyborgHunter = ctx.api;
+    win.__cyborgHunterLoaded = 'ch.js';
+    // One console summary per page: vanilla logs once the DOM is parsed;
+    // jsPsych logs from the wrapped run() (after the walk), so here it only
+    // shows the badge.
+    if (ctx.debug) {
+      if (host === 'jspsych') ctx.debug.refresh(); else ctx.debug.logWhenParsed();
+    }
+    return ctx;
+  } catch (e) {
+    fail(win, ctx || { monitor: monitor }, adapter, e);
+    return null;
+  }
+}
+
+// The monitor's session and the first span ('span-<index>'). Skipped after a
+// manual-mode hand-over, which destroyed the monitor already.
+function startMonitoring(ctx) {
+  if (ctx.host === 'manual') return;
+  ctx.monitor.startSession();
+  var started = ctx.segmenter.start();
+  if (started && started.error) throw new Error('could not open the first trial: ' + started.error);
+}
+
+// The deferred session start failed. The segmenter is abandoned first (it
+// closes a span the failure left open while the monitor is still alive, and
+// latches, so a later cut() or finish() neither touches the destroyed
+// monitor nor replaces the marker below). The monitor is destroyed and the
+// failure logged once; ctx.bootError keeps the placement check from taking
+// the page for one ch.js could not hook. Then:
+//   vanilla  the adapter stays (cut() does nothing without an open span), so
+//            data(), the form's hidden input and the next page still carry
+//            the earlier pages, with a cyborgHunterError note;
+//   jsPsych  the initJsPsych wrap is removed, so a later initJsPsych() runs
+//            jsPsych as if ch.js were absent. An instance created before
+//            DOMContentLoaded keeps the extensions already injected (they
+//            stand down on ctx.bootError) and gets cyborgHunterError on every
+//            row.
+function failDeferred(ctx, adapter, e) {
+  var msg = String((e && e.message) || e);
+  ctx.bootError = msg;
+  try { ctx.segmenter.abandon(); } catch (_) { /* already failing */ }
+  try { ctx.monitor.destroy(); } catch (_) { /* already failing */ }
+  console.error(MESSAGES.bootFailed(msg));
+  try {
+    if (ctx.vanilla) {
+      var page = ctx.vanilla.blob().cyborgHunterOneLiner.pageCount;
+      ctx.vanilla.noteError('Cyborg Hunter did not start on page ' + page + ': ' + msg);
+    }
+    if (adapter) {
+      adapter.restore();
+      installInertWrapper(ctx.win);
+      if (ctx.jsPsych) ctx.jsPsych.data.addProperties({ cyborgHunterError: 'Cyborg Hunter did not start: ' + msg });
+    }
+  } catch (_) { /* the failure is logged above */ }
+}
+
+// A failure inside boot(). ctx.bootError keeps the placement check
+// (watchHostPlacement, registered before some steps that can fail) from
+// taking the page for one ch.js could not hook and starting the vanilla
+// path. A jsPsych wrap already installed is removed (it would drive the
+// destroyed monitor) and the inert wrapper takes its place.
+function fail(win, ctx, adapter, e) {
+  var msg = String((e && e.message) || e);
+  ctx.bootError = msg;
+  if (ctx.vanilla) { try { ctx.vanilla.teardown(); } catch (_) { /* already failing */ } }
+  if (ctx.monitor) { try { ctx.monitor.destroy(); } catch (_) { /* already failing; the boot error is the one to show */ } }
+  console.error(MESSAGES.bootFailed(msg));
+  try {
+    if (adapter) adapter.restore();
+    installInertWrapper(win);
+  } catch (_) { /* the failure is logged above */ }
+  try {
+    if (win.CyborgHunter === undefined) win.CyborgHunter = buildInertApi();
+  } catch (_) { /* a locked global */ }
+}

package/src/oneliner/config.js

@@ -0,0 +1,122 @@
+// src/oneliner/config.js
+// The one-liner's configuration, from two places: the ch.js tag's data-*
+// attributes (`dataset`) and window.CyborgHunterConfig (`globalConfig`).
+// A tag attribute wins over the same key in CyborgHunterConfig.
+//
+// readConfig({ dataset, globalConfig }) → {
+//   preset,                                  permissive | standard | strict,
+//                                            case-insensitive; 'standard' when
+//                                            unset; an unknown value warns
+//                                            (unknownPreset) and is 'standard'
+//   participantIdAttr,                       data-participant-id, or null
+//   guards: { honeypot, friction },          data-guards: comma list of
+//                                            honeypot | friction | none;
+//                                            default honeypot on, friction off
+//   replay: null | { tier: 'trace'|'dom',    data-replay: "" | trace → trace, dom → dom;
+//                    autoSave? },            CyborgHunterConfig.replay may be
+//                                            { tier, autoSave } (autoSave kept
+//                                            even when data-replay sets the tier)
+//   replaySrc,                               data-replay-src, or null
+//   debug,                                   data-debug present (and not "false")
+//   monitor                                  every other CyborgHunterConfig key,
+//                                            passed to init() as is (init's own
+//                                            validateConfig warns on typos);
+//                                            CyborgHunterConfig.participantId
+//                                            rides here for the id resolver
+// }
+// autoMonitor and excludeTrialTypes are dropped with a warning: the one-liner
+// monitors every trial.
+
+import { MESSAGES } from './errors.js';
+
+export const DATA_KEYS = ['preset', 'participantId', 'guards', 'replay', 'replaySrc', 'debug'];
+
+var ONE_LINER_KEYS = ['preset', 'guards', 'replay', 'replaySrc', 'debug'];
+var REMOVED_KEYS = ['autoMonitor', 'excludeTrialTypes'];
+var GUARD_NAMES = ['honeypot', 'friction'];
+var PRESETS = ['permissive', 'standard', 'strict'];
+
+function has(obj, key) {
+  return !!obj && obj[key] !== undefined && obj[key] !== null;
+}
+
+// A bare attribute (data-debug) is the empty string, which is "on".
+function flag(v) {
+  if (typeof v === 'string') return v.trim().toLowerCase() !== 'false';
+  return !!v;
+}
+
+function parseGuards(v) {
+  var out = { honeypot: false, friction: false };
+  var names = Array.isArray(v) ? v : String(v).split(',');
+  names.forEach(function (raw) {
+    var name = String(raw).trim().toLowerCase();
+    if (name === '' || name === 'none') return;
+    if (GUARD_NAMES.indexOf(name) === -1) {
+      console.warn('[cyborg-hunter] data-guards: unknown guard "' + name + '" ignored (use honeypot, friction or none)');
+      return;
+    }
+    out[name] = true;
+  });
+  return out;
+}
+
+// init() would reject an unknown preset outright (and boot would fail), so a
+// typo like "stric" or "Strict" must not reach it.
+function parsePreset(v) {
+  if (v === undefined || v === '') return 'standard';
+  var name = String(v).trim().toLowerCase();
+  if (PRESETS.indexOf(name) !== -1) return name;
+  console.warn(MESSAGES.unknownPreset(v));
+  return 'standard';
+}
+
+function parseReplay(v) {
+  if (v === false) return null;
+  if (v === true) return { tier: 'trace' };
+  if (typeof v === 'object') return parseReplay(v.tier === undefined || v.tier === null ? '' : v.tier);
+  var tier = String(v).trim().toLowerCase();
+  if (tier === '' || tier === 'trace') return { tier: 'trace' };
+  if (tier === 'dom') return { tier: 'dom' };
+  console.warn('[cyborg-hunter] data-replay: unknown tier "' + v + '"; recording the trace tier (use trace or dom)');
+  return { tier: 'trace' };
+}
+
+export function readConfig(opts) {
+  var dataset = (opts && opts.dataset) || {};
+  var globalConfig = (opts && opts.globalConfig) || {};
+
+  // The tag attribute when present, else the CyborgHunterConfig value.
+  function pick(key) {
+    if (has(dataset, key)) return dataset[key];
+    if (has(globalConfig, key)) return globalConfig[key];
+    return undefined;
+  }
+
+  var monitor = {};
+  Object.keys(globalConfig).forEach(function (key) {
+    if (ONE_LINER_KEYS.indexOf(key) !== -1) return;
+    if (REMOVED_KEYS.indexOf(key) !== -1) {
+      console.warn('[cyborg-hunter] CyborgHunterConfig.' + key + ' is ignored: the one-line setup monitors every trial');
+      return;
+    }
+    monitor[key] = globalConfig[key];
+  });
+
+  var guards = pick('guards');
+  var replay = pick('replay');
+  replay = replay === undefined ? null : parseReplay(replay);
+  // The replay recorder's autoSave (DataPipe) only comes from the object form.
+  var g = globalConfig.replay;
+  if (replay && g && typeof g === 'object' && g.autoSave) replay.autoSave = g.autoSave;
+  var debug = pick('debug');
+  return {
+    preset: parsePreset(pick('preset')),
+    participantIdAttr: has(dataset, 'participantId') ? dataset.participantId : null,
+    guards: guards === undefined ? { honeypot: true, friction: false } : parseGuards(guards),
+    replay: replay,
+    replaySrc: pick('replaySrc') || null,
+    debug: debug === undefined ? false : flag(debug),
+    monitor: monitor
+  };
+}

package/src/oneliner/debug.js

@@ -0,0 +1,137 @@
+// src/oneliner/debug.js
+// data-debug: a small fixed badge on the page, one console line per update,
+// and the segment-write timings a later perf budget reads. Off by default;
+// the docs say to remove it before launch, because participants can see it.
+// boot only creates this when config.debug is on, so a page without
+// data-debug pays nothing (no badge, no counters, no timing calls).
+//
+// createDebug({ doc, ctx, log = console.info })
+//   → { update(), refresh(), logWhenParsed(), summary() → string, badgeText() → string,
+//        stats() → { segmentWriteMs }, remove() }
+//
+// summary():
+//   Cyborg Hunter active · <jsPsych detected | vanilla mode> ·
+//   <N trials instrumented | N mark elements> · ID from <source> ·
+//   honeypot <on|off> · friction <off|observe|enforce>
+//   N on jsPsych is the PLANNED count: unique trial objects the timeline walk
+//   instrumented (ctx.jspsych.instrumented). On vanilla it is the number of
+//   [data-ch-trial] elements in the DOM.
+//   One summary is logged per page: update() logs, refresh() never does. The
+//   badge on jsPsych shows live progress, "written/planned trials"
+//   (ctx.jspsych.segmentsWritten / instrumented), or "N trials (M planned)"
+//   once loops / timeline_variables write more rows than planned (so never
+//   "5/3"); refresh() updates it.
+//   <source> is the URL parameter name that resolved, data-participant-id,
+//   CyborgHunterConfig, or "random id (not linkable)".
+//   With data-replay (and no recorder autoSave) the summary, not the badge,
+//   ends with " · data-replay is on: save CyborgHunter.replay() in your save
+//   code", in place of boot's console.info reminder (replay-loader.js).
+//
+// The badge never takes focus or clicks (pointer-events: none) and nothing
+// here throws into the host page. update() and refresh() re-attach it when
+// the host has wiped it from the document (jsPsych's run() resets <body>).
+
+import { REPLAY_SAVE_REMINDER } from './errors.js';
+import { replaySaveReminderApplies } from './replay-loader.js';
+
+var BADGE_ID = 'ch-debug-badge';
+var BADGE_STYLE = 'position:fixed;left:8px;bottom:8px;z-index:2147483646;font:12px/1.4 system-ui;' +
+  'background:#111;color:#fff;padding:6px 8px;border-radius:4px;opacity:.9;pointer-events:none';
+
+function idSource(source) {
+  if (typeof source === 'string' && source.indexOf('url:') === 0) return source.slice(4);
+  if (source === 'attribute') return 'data-participant-id';
+  if (source === 'config') return 'CyborgHunterConfig';
+  return 'random id (not linkable)';   // 'random', or 'session' (a random id kept from an earlier page)
+}
+
+function frictionMode(ctx) {
+  if (!ctx.config.guards.friction) return 'off';
+  // On jsPsych the entry trial turns enforcement on; otherwise observe-only.
+  return ctx.host === 'jspsych' && ctx.jspsych && ctx.jspsych.entryTrialFound ? 'enforce' : 'observe';
+}
+
+export function createDebug(opts) {
+  var doc = opts.doc, ctx = opts.ctx;
+  var log = opts.log || function (m) { console.info(m); };
+  var stats = { segmentWriteMs: [] };
+  var badge = null;
+  var waiting = false;
+
+  function parts(live) {
+    var hostPart, countPart;
+    if (ctx.host === 'vanilla') {
+      var marks = doc.querySelectorAll ? doc.querySelectorAll('[data-ch-trial]').length : 0;
+      hostPart = 'vanilla mode';
+      countPart = marks + ' mark elements';
+    } else {
+      hostPart = 'jsPsych detected';
+      var js = ctx.jspsych || {};
+      var written = js.segmentsWritten || 0, planned = js.instrumented || 0;
+      if (!live) countPart = planned + ' trials instrumented';
+      else if (written > planned) countPart = written + ' trials (' + planned + ' planned)';   // loops repeat one trial object
+      else countPart = written + '/' + planned + ' trials';
+    }
+    var out = ['Cyborg Hunter active', hostPart, countPart,
+      'ID from ' + idSource(ctx.participantIdSource),
+      'honeypot ' + (ctx.config.guards.honeypot ? 'on' : 'off'),
+      'friction ' + frictionMode(ctx)];
+    if (!live && replaySaveReminderApplies(ctx)) out.push(REPLAY_SAVE_REMINDER);
+    return out.join(' · ');
+  }
+  function summary() { return parts(false); }
+  function badgeText() { return parts(true); }
+
+  function render(text) {
+    if (!badge) {
+      if (!doc.body) {
+        if (!waiting) {
+          waiting = true;
+          doc.addEventListener('DOMContentLoaded', function () {
+            waiting = false;
+            try { render(badgeText()); } catch (_) { /* the badge is optional */ }
+          }, { once: true });
+        }
+        return;
+      }
+      badge = doc.getElementById(BADGE_ID) || doc.createElement('div');
+      badge.id = BADGE_ID;
+      badge.setAttribute('style', BADGE_STYLE);
+    }
+    // jsPsych 7 sets display_element.innerHTML in run(), and display_element
+    // defaults to <body>, so the badge appended at boot is gone by the first
+    // trial. The same node goes back (getElementById no longer finds it, so a
+    // lookup would make a second one); under <html> if a page has no <body>.
+    if (!badge.isConnected) (doc.body || doc.documentElement).appendChild(badge);
+    badge.textContent = text;
+  }
+
+  return {
+    summary: summary,
+    badgeText: badgeText,
+    stats: function () { return stats; },
+    update: function () {
+      try {
+        render(badgeText());
+        log(summary());
+      } catch (_) { /* a debug aid never breaks the page */ }
+    },
+    // Badge only, no console line (a row was written).
+    refresh: function () {
+      try { render(badgeText()); } catch (_) { /* a debug aid never breaks the page */ }
+    },
+    // update() once the DOM is parsed, so vanilla mark elements are all there.
+    logWhenParsed: function () {
+      try {
+        var self = this;
+        if (doc.readyState === 'loading' && doc.addEventListener) {
+          doc.addEventListener('DOMContentLoaded', function () { self.update(); }, { once: true });
+        } else this.update();
+      } catch (_) { /* a debug aid never breaks the page */ }
+    },
+    remove: function () {
+      try { if (badge && badge.parentNode) badge.parentNode.removeChild(badge); } catch (_) { /* ignore */ }
+      badge = null;
+    }
+  };
+}

package/src/oneliner/entry.js

@@ -0,0 +1,8 @@
+// src/oneliner/entry.js — dist/ch.js entry. Keep this file tiny: everything
+// testable lives in boot.js. document.currentScript is only meaningful while
+// this script runs, so it is captured here, synchronously, before anything else.
+import '../jspsych/extension-guard-friction.js';   // side effect: window.GuardFriction + window.jsPsychGuardFriction
+import '../jspsych/extension-guard-honeypot.js';   // side effect: window.GuardHoneypot + window.jsPsychGuardHoneypot
+import { boot } from './boot.js';
+var script = typeof document !== 'undefined' ? document.currentScript : null;
+boot({ script: script, win: window });