drengr-js 0.1.0

package/dist/cjs/sink.js

@@ -0,0 +1,276 @@
+"use strict";
+/**
+ * Batches captured signals and ships them to the Drengr ingest endpoint,
+ * authenticated by a publishable key. Port of the proven Dart IngestSink,
+ * carrying both device-run lessons from birth:
+ *  - delivery uses the PRE-PATCH fetch (structurally invisible to capture —
+ *    the self-capture loop cannot exist);
+ *  - the persistence scheduler uses the writer-loops-until-clean pattern
+ *    (an overlap marks dirty and returns; never reschedules a microtask,
+ *    which starved the event loop and froze the Flutter demo).
+ *
+ * Best-effort and non-blocking: never throws into the app, drops oldest on
+ * overflow, retries with exponential backoff + full jitter, persists the
+ * queue through a pluggable storage adapter (localStorage on web,
+ * AsyncStorage-compatible on React Native, in-memory fallback anywhere).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IngestSink = void 0;
+exports.defaultStorage = defaultStorage;
+const capture_js_1 = require("./capture.js");
+const redact_js_1 = require("./redact.js");
+const QUEUE_KEY = 'drengr_queue_v1';
+const BASE_BACKOFF_MS = 2000;
+const MAX_BACKOFF_MS = 5 * 60000;
+function defaultStorage() {
+    try {
+        const ls = globalThis.localStorage;
+        if (ls) {
+            const probe = '__drengr_probe__';
+            ls.setItem(probe, '1');
+            ls.removeItem(probe);
+            return ls;
+        }
+    }
+    catch { /* private mode / RN / node — fall through */ }
+    const mem = new Map();
+    return {
+        getItem: (k) => mem.get(k) ?? null,
+        setItem: (k, v) => void mem.set(k, v),
+        removeItem: (k) => void mem.delete(k),
+    };
+}
+class IngestSink {
+    constructor(opts) {
+        this.queue = [];
+        this.timer = null;
+        this.sending = false;
+        this.retries = 0;
+        this.persistScheduled = false;
+        this.persisting = false;
+        this.persistDirty = false;
+        this.experiments = {};
+        /** Map a captured exchange to an ingest event and enqueue it. */
+        this.addNetwork = (e) => {
+            try {
+                this.enqueue(this.toNet(e));
+            }
+            catch { /* never throw into the app */ }
+        };
+        /** Sets the session's external_id (attached to every event hereafter) and emits
+         *  one identify event. traits go through the same redact+project pipeline as
+         *  bodies. Fail-open: invalid externalId is a no-op. */
+        this.identify = (externalId, traits) => {
+            if (typeof externalId !== 'string' || externalId.length === 0)
+                return;
+            let redactedTraits = null;
+            try {
+                if (traits)
+                    redactedTraits = (0, capture_js_1.projectBody)((0, redact_js_1.redactBody)(JSON.stringify(traits)));
+            }
+            catch { /* bad traits: ship identify without them */ }
+            try {
+                this.externalId = externalId;
+                this.enqueue({
+                    kind: 'identify',
+                    event_id: randomId(),
+                    ts_ms: Date.now(),
+                    external_id: externalId,
+                    ...(redactedTraits != null ? { traits: redactedTraits } : {}),
+                });
+            }
+            catch { /* never throw into the app */ }
+        };
+        /** Sets/clears a session-scoped experiment variant (attached to every event
+         *  hereafter as `experiments`). variant null/empty clears the key. Fail-open. */
+        this.setExperiment = (key, variant) => {
+            try {
+                if (typeof key !== 'string' || key.length === 0)
+                    return;
+                if (!variant)
+                    delete this.experiments[key];
+                else
+                    this.experiments[key] = variant;
+            }
+            catch { /* never throw into the app */ }
+        };
+        this.url = opts.url;
+        this.key = opts.publishableKey;
+        this.context = opts.context;
+        this.storage = opts.storage ?? defaultStorage();
+        this.maxBatch = opts.maxBatch ?? 50;
+        this.maxQueue = opts.maxQueue ?? 500;
+        this.flushIntervalMs = opts.flushIntervalMs ?? 10000;
+        void this.restore();
+    }
+    toNet(e) {
+        const status = e.statusCode ?? 0;
+        const failed = e.errorText != null || status >= 400;
+        const reqBody = (0, capture_js_1.projectBody)(e.requestBody);
+        const respBody = (0, capture_js_1.projectBody)(e.responseBody);
+        return {
+            kind: failed ? 'net_fail' : 'net',
+            event_id: randomId(),
+            ts_ms: e.timestampMs,
+            method: e.method,
+            url: e.url, // already redacted by the capture layer
+            status,
+            error_kind: failed
+                ? e.errorText != null
+                    ? 'transport'
+                    : status >= 500
+                        ? 'server'
+                        : 'client'
+                : '',
+            duration_ms: e.durationMs,
+            req_bytes: e.requestBodyBytes,
+            resp_bytes: e.responseBodyBytes,
+            ...(reqBody != null ? { req_body: reqBody } : {}),
+            ...(respBody != null ? { body: respBody } : {}),
+        };
+    }
+    enqueue(ev) {
+        this.queue.push(ev);
+        while (this.queue.length > this.maxQueue) {
+            this.queue.shift(); // drop oldest on overflow — never block
+        }
+        this.schedulePersist();
+        if (this.retries > 0)
+            return; // backoff timer drives the flush
+        if (this.queue.length >= this.maxBatch) {
+            void this.flush();
+        }
+        else if (this.timer == null) {
+            this.timer = setTimeout(() => void this.flush(), this.flushIntervalMs);
+        }
+    }
+    async flush() {
+        if (this.timer != null) {
+            clearTimeout(this.timer);
+            this.timer = null;
+        }
+        if (this.sending || this.queue.length === 0)
+            return;
+        this.sending = true;
+        const batch = this.queue.splice(0, 1000);
+        // sent_at_ms = device clock AT SEND: the server derives clock error from it
+        // and corrects timeline placement exactly. Set per attempt.
+        const envelope = { ...this.context, sent_at_ms: Date.now(), events: batch };
+        if (this.externalId)
+            envelope.external_id = this.externalId;
+        if (Object.keys(this.experiments).length > 0)
+            envelope.experiments = { ...this.experiments };
+        let acked = false;
+        let permanent = false;
+        try {
+            // nativeFetch: the pre-patch fetch — delivery is invisible to capture.
+            const resp = await (0, capture_js_1.nativeFetch)()(this.url, {
+                method: 'POST',
+                headers: {
+                    authorization: `Bearer ${this.key}`,
+                    'content-type': 'application/json',
+                },
+                body: JSON.stringify(envelope),
+                keepalive: batch.length < 30, // survive page unload for small batches
+            });
+            acked = resp.status >= 200 && resp.status < 300;
+            // A non-retriable 4xx (revoked key 401, bad batch 400/413) will never
+            // succeed — retrying it forever head-of-line-blocks the queue and drops all
+            // newer events. Drop it. 429/408 are transient and still retry.
+            permanent = resp.status >= 400 && resp.status < 500 && resp.status !== 429 && resp.status !== 408;
+        }
+        catch {
+            acked = false; // best-effort: never throw into the app
+        }
+        finally {
+            this.sending = false;
+            if (acked || permanent) {
+                this.retries = 0; // batch consumed (delivered or dropped as permanent)
+                this.schedulePersist();
+                if (this.queue.length > 0 && this.timer == null) {
+                    this.timer = setTimeout(() => void this.flush(), this.flushIntervalMs);
+                }
+            }
+            else {
+                // Keep the batch: requeue at the front, shed newest on overflow.
+                this.queue.unshift(...batch);
+                while (this.queue.length > this.maxQueue)
+                    this.queue.pop();
+                this.schedulePersist();
+                this.armBackoff();
+            }
+        }
+    }
+    armBackoff() {
+        if (this.timer != null)
+            clearTimeout(this.timer);
+        const exp = BASE_BACKOFF_MS * 2 ** Math.min(this.retries, 20);
+        const capped = Math.min(exp, MAX_BACKOFF_MS);
+        const delay = BASE_BACKOFF_MS + Math.floor(Math.random() * capped);
+        this.retries++;
+        this.timer = setTimeout(() => void this.flush(), delay);
+    }
+    // --- persistence (writer-loops-until-clean; overlap marks dirty) ---
+    schedulePersist() {
+        if (this.persistScheduled)
+            return;
+        this.persistScheduled = true;
+        queueMicrotask(() => void this.persist());
+    }
+    async persist() {
+        this.persistScheduled = false;
+        if (this.persisting) {
+            this.persistDirty = true; // the in-flight writer re-snapshots
+            return;
+        }
+        this.persisting = true;
+        try {
+            do {
+                this.persistDirty = false;
+                if (this.queue.length === 0) {
+                    await this.storage.removeItem(QUEUE_KEY);
+                }
+                else {
+                    await this.storage.setItem(QUEUE_KEY, JSON.stringify(this.queue));
+                }
+            } while (this.persistDirty);
+        }
+        catch { /* best-effort */ }
+        finally {
+            this.persisting = false;
+        }
+    }
+    async restore() {
+        try {
+            const raw = await this.storage.getItem(QUEUE_KEY);
+            if (!raw)
+                return;
+            const parsed = JSON.parse(raw);
+            if (Array.isArray(parsed)) {
+                for (const ev of parsed) {
+                    if (ev && typeof ev === 'object')
+                        this.queue.push(ev);
+                }
+                while (this.queue.length > this.maxQueue)
+                    this.queue.shift();
+                if (this.queue.length > 0 && this.timer == null) {
+                    this.timer = setTimeout(() => void this.flush(), this.flushIntervalMs);
+                }
+            }
+        }
+        catch { /* corrupt/missing store: start empty */ }
+    }
+}
+exports.IngestSink = IngestSink;
+function randomId() {
+    try {
+        const c = globalThis.crypto;
+        if (c?.randomUUID)
+            return c.randomUUID().replace(/-/g, '');
+    }
+    catch { /* fall through */ }
+    let out = '';
+    for (let i = 0; i < 32; i++)
+        out += Math.floor(Math.random() * 16).toString(16);
+    return out;
+}

package/dist/esm/capture.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Zero-code network capture for JS runtimes (Web, React Native, Electron
+ * renderer/main): patches `fetch` and `XMLHttpRequest`, emits one redacted
+ * NetworkEvent per completed exchange. Fail-open by design — capture errors
+ * never propagate into the app, and the app's response objects are never
+ * consumed (fetch bodies are read from a clone; XHR is observed post-loadend).
+ *
+ * The pre-patch `fetch` is preserved and exported for the sink, so delivery
+ * traffic is STRUCTURALLY invisible to capture (lesson from the Flutter SDK's
+ * self-capture loop — no ignoreHosts wiring, no recursion possible).
+ */
+import { projectBody } from './redact.js';
+export interface NetworkEvent {
+    method: string;
+    /** Already redacted. */
+    url: string;
+    statusCode: number | null;
+    durationMs: number;
+    requestBodyBytes: number;
+    responseBodyBytes: number;
+    requestHeaders: Record<string, string>;
+    responseHeaders: Record<string, string>;
+    /** Redacted request body text (textual bodies only, capped). */
+    requestBody: string | null;
+    /** Redacted response body text (textual bodies only, capped). */
+    responseBody: string | null;
+    errorText: string | null;
+    timestampMs: number;
+}
+export interface CaptureOptions {
+    maxBodyBytes?: number;
+    /** Return false to skip a request entirely (sampling / allow-listing). */
+    captureWhen?: (url: string) => boolean;
+    /** Hosts to skip (exact or subdomain match). */
+    ignoreHosts?: Set<string>;
+    /** Extra header names (lowercase) to mask on top of the built-in set. */
+    redactHeaderNames?: Set<string>;
+    onEvent: (e: NetworkEvent) => void;
+}
+type FetchFn = typeof globalThis.fetch;
+/** The runtime's fetch as it was BEFORE capture installed. Sink delivery uses
+ *  this so its own requests can never be captured. */
+export declare function nativeFetch(): FetchFn;
+export declare function setEnabled(v: boolean): void;
+export declare function isInstalled(): boolean;
+export declare function install(options: CaptureOptions): void;
+export declare function uninstall(): void;
+/** Exported for the projection step in the sink. */
+export { projectBody };

package/dist/esm/capture.js

@@ -0,0 +1,371 @@
+/**
+ * Zero-code network capture for JS runtimes (Web, React Native, Electron
+ * renderer/main): patches `fetch` and `XMLHttpRequest`, emits one redacted
+ * NetworkEvent per completed exchange. Fail-open by design — capture errors
+ * never propagate into the app, and the app's response objects are never
+ * consumed (fetch bodies are read from a clone; XHR is observed post-loadend).
+ *
+ * The pre-patch `fetch` is preserved and exported for the sink, so delivery
+ * traffic is STRUCTURALLY invisible to capture (lesson from the Flutter SDK's
+ * self-capture loop — no ignoreHosts wiring, no recursion possible).
+ */
+import { projectBody, redactBody, redactHeaders, redactUrl } from './redact.js';
+const g = globalThis;
+let installed = false;
+let enabled = true;
+let opts = {
+    maxBodyBytes: 64 * 1024,
+    onEvent: () => { },
+};
+let originalFetch = null;
+let originalXhrOpen = null;
+let originalXhrSend = null;
+/** The runtime's fetch as it was BEFORE capture installed. Sink delivery uses
+ *  this so its own requests can never be captured. */
+export function nativeFetch() {
+    return originalFetch ?? g.fetch;
+}
+export function setEnabled(v) {
+    enabled = v;
+}
+export function isInstalled() {
+    return installed;
+}
+// React Native implements fetch ON TOP of XMLHttpRequest. Detecting it lets us
+// avoid patching both layers (which would double-capture every fetch and let the
+// sink's own XHR-backed deliveries recurse).
+function isReactNative() {
+    try {
+        const nav = g.navigator;
+        return nav?.product === 'ReactNative';
+    }
+    catch {
+        return false;
+    }
+}
+function ignored(url) {
+    try {
+        if (!enabled)
+            return true;
+        if (opts.captureWhen && !opts.captureWhen(url))
+            return true;
+        if (opts.ignoreHosts && opts.ignoreHosts.size > 0) {
+            const host = new URL(url, 'http://localhost').host;
+            for (const h of opts.ignoreHosts) {
+                if (host === h || host.endsWith(`.${h}`))
+                    return true;
+            }
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+function isTextual(contentType) {
+    if (!contentType)
+        return false;
+    const ct = contentType.toLowerCase();
+    return (ct.startsWith('text/') ||
+        ct.includes('json') ||
+        ct.includes('xml') ||
+        ct.includes('x-www-form-urlencoded') ||
+        ct.includes('graphql'));
+}
+function headerObj(h) {
+    const out = {};
+    try {
+        h?.forEach((v, k) => {
+            out[k] = v;
+        });
+    }
+    catch { /* fail-open */ }
+    return out;
+}
+function cap(s, max) {
+    return s.length > max ? s.slice(0, max) : s;
+}
+// Read a response body with a HARD byte cap: pull chunks until `max` is exceeded,
+// then cancel — so an infinite SSE/streaming or multi-MB body never buffers
+// unbounded. Over the cap → { text: null } (size-only). Never throws.
+async function readCapped(resp, max) {
+    const body = resp.body;
+    if (!body) {
+        try {
+            const t = await resp.text();
+            return { text: t.length <= max ? t : null, bytes: t.length };
+        }
+        catch {
+            return { text: null, bytes: 0 };
+        }
+    }
+    const reader = body.getReader();
+    const chunks = [];
+    let total = 0;
+    let over = false;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            total += value.byteLength;
+            if (total > max) {
+                over = true;
+                break;
+            }
+            chunks.push(value);
+        }
+    }
+    catch {
+        return { text: null, bytes: total };
+    }
+    finally {
+        // Fire-and-forget cancel: it aborts the underlying network read (so an
+        // infinite SSE stops), but AWAITING it can hang forever (observed in
+        // undici on a cloned body) — which would swallow the event entirely.
+        try {
+            void reader.cancel();
+        }
+        catch { /* ignore */ }
+    }
+    if (over)
+        return { text: null, bytes: total }; // over cap → size-only
+    const buf = new Uint8Array(total);
+    let off = 0;
+    for (const c of chunks) {
+        buf.set(c, off);
+        off += c.byteLength;
+    }
+    try {
+        return { text: new TextDecoder().decode(buf), bytes: total };
+    }
+    catch {
+        return { text: null, bytes: total };
+    }
+}
+function emit(e) {
+    try {
+        opts.onEvent(e);
+    }
+    catch { /* the app must never see capture errors */ }
+}
+// ---------------------------------------------------------------- fetch ----
+function patchFetch() {
+    const orig = g.fetch;
+    if (typeof orig !== 'function')
+        return;
+    originalFetch = orig.bind(globalThis);
+    const wrapped = async (input, init) => {
+        const start = Date.now();
+        let url = '';
+        let method = 'GET';
+        let reqBodyText = null;
+        let reqHeaders = {};
+        try {
+            if (typeof input === 'string')
+                url = input;
+            else if (input instanceof URL)
+                url = input.toString();
+            else {
+                url = input.url;
+                method = input.method || 'GET';
+                reqHeaders = headerObj(input.headers);
+            }
+            if (init?.method)
+                method = init.method;
+            if (init?.headers) {
+                reqHeaders = { ...reqHeaders, ...headerObj(new Headers(init.headers)) };
+            }
+            const b = init?.body;
+            if (typeof b === 'string')
+                reqBodyText = b;
+            else if (b instanceof URLSearchParams)
+                reqBodyText = b.toString();
+            // Streams / FormData / binary: recorded by absence (size unknown), never read.
+        }
+        catch { /* fail-open */ }
+        const skip = ignored(url);
+        try {
+            const resp = await originalFetch(input, init);
+            if (!skip) {
+                void captureFetchResponse(resp, url, method.toUpperCase(), reqHeaders, reqBodyText, start);
+            }
+            return resp;
+        }
+        catch (err) {
+            if (!skip) {
+                emit({
+                    method: method.toUpperCase(),
+                    url: redactUrl(url),
+                    statusCode: null,
+                    durationMs: Date.now() - start,
+                    requestBodyBytes: reqBodyText?.length ?? 0,
+                    responseBodyBytes: 0,
+                    requestHeaders: redactHeaders(reqHeaders, opts.redactHeaderNames),
+                    responseHeaders: {},
+                    requestBody: reqBodyText ? redactBody(cap(reqBodyText, opts.maxBodyBytes)) : null,
+                    responseBody: null,
+                    errorText: String(err),
+                    timestampMs: start,
+                });
+            }
+            throw err; // the app sees exactly what it would have seen
+        }
+    };
+    try {
+        g.fetch = wrapped;
+    }
+    catch { /* frozen global: capture unavailable, app unharmed */ }
+}
+async function captureFetchResponse(resp, url, method, reqHeaders, reqBodyText, start) {
+    try {
+        const respHeaders = headerObj(resp.headers);
+        const ct = resp.headers.get('content-type');
+        let respBody = null;
+        let respBytes = 0;
+        const lenHeader = Number(resp.headers.get('content-length'));
+        if (Number.isFinite(lenHeader) && lenHeader > 0)
+            respBytes = lenHeader;
+        if (isTextual(ct)) {
+            // Read a CLONE with a hard cap so an SSE / streaming / huge textual body
+            // can never buffer unbounded (was `resp.clone().text()` → OOM on an
+            // infinite stream). Over the cap → size-only. The app's own stream is
+            // untouched (we read the clone) and we cancel the clone's reader.
+            const capped = await readCapped(resp.clone(), opts.maxBodyBytes);
+            if (capped.bytes > 0)
+                respBytes = capped.bytes;
+            respBody = capped.text; // null when over cap or unreadable
+        }
+        emit({
+            method,
+            url: redactUrl(url),
+            statusCode: resp.status,
+            durationMs: Date.now() - start,
+            requestBodyBytes: reqBodyText?.length ?? 0,
+            responseBodyBytes: respBytes,
+            requestHeaders: redactHeaders(reqHeaders, opts.redactHeaderNames),
+            responseHeaders: redactHeaders(respHeaders, opts.redactHeaderNames),
+            requestBody: reqBodyText ? redactBody(cap(reqBodyText, opts.maxBodyBytes)) : null,
+            responseBody: respBody ? redactBody(respBody) : null,
+            errorText: null,
+            timestampMs: start,
+        });
+    }
+    catch { /* fail-open */ }
+}
+const xhrMeta = new WeakMap();
+function patchXhr() {
+    const X = g.XMLHttpRequest;
+    if (typeof X !== 'function')
+        return;
+    originalXhrOpen = X.prototype.open;
+    originalXhrSend = X.prototype.send;
+    const origSetHeader = X.prototype.setRequestHeader;
+    X.prototype.open = function (method, url, ...rest) {
+        try {
+            xhrMeta.set(this, {
+                method: String(method).toUpperCase(),
+                url: String(url),
+                start: 0,
+                reqBody: null,
+                reqHeaders: {},
+            });
+        }
+        catch { /* fail-open */ }
+        // @ts-expect-error — pass through the runtime's own signature verbatim
+        return originalXhrOpen.call(this, method, url, ...rest);
+    };
+    X.prototype.setRequestHeader = function (name, value) {
+        try {
+            const m = xhrMeta.get(this);
+            if (m)
+                m.reqHeaders[name] = value;
+        }
+        catch { /* fail-open */ }
+        return origSetHeader.call(this, name, value);
+    };
+    X.prototype.send = function (body) {
+        const m = xhrMeta.get(this);
+        if (m && !ignored(m.url)) {
+            m.start = Date.now();
+            if (typeof body === 'string')
+                m.reqBody = body;
+            else if (body instanceof URLSearchParams)
+                m.reqBody = body.toString();
+            this.addEventListener('loadend', () => {
+                try {
+                    const status = this.status;
+                    let respBody = null;
+                    let respBytes = 0;
+                    if (this.responseType === '' || this.responseType === 'text') {
+                        const text = this.responseText ?? '';
+                        respBytes = text.length;
+                        if (text.length > 0 &&
+                            text.length <= opts.maxBodyBytes &&
+                            isTextual(this.getResponseHeader('content-type'))) {
+                            respBody = text;
+                        }
+                    }
+                    const respHeaders = {};
+                    for (const line of (this.getAllResponseHeaders() || '').split('\r\n')) {
+                        const i = line.indexOf(': ');
+                        if (i > 0)
+                            respHeaders[line.slice(0, i)] = line.slice(i + 2);
+                    }
+                    emit({
+                        method: m.method,
+                        url: redactUrl(m.url),
+                        statusCode: status === 0 ? null : status,
+                        durationMs: Date.now() - m.start,
+                        requestBodyBytes: m.reqBody?.length ?? 0,
+                        responseBodyBytes: respBytes,
+                        requestHeaders: redactHeaders(m.reqHeaders, opts.redactHeaderNames),
+                        responseHeaders: redactHeaders(respHeaders, opts.redactHeaderNames),
+                        requestBody: m.reqBody ? redactBody(cap(m.reqBody, opts.maxBodyBytes)) : null,
+                        responseBody: respBody ? redactBody(respBody) : null,
+                        errorText: status === 0 ? 'network_error' : null,
+                        timestampMs: m.start,
+                    });
+                }
+                catch { /* fail-open */ }
+            });
+        }
+        return originalXhrSend.call(this, body);
+    };
+}
+// -------------------------------------------------------------- install ----
+export function install(options) {
+    if (installed)
+        return;
+    // maxBodyBytes AFTER the spread with a nullish default: the documented minimal
+    // call passes `maxBodyBytes: undefined`, and a spread of an explicit-undefined
+    // key would clobber the default — silently dropping every response body and
+    // uncapping request bodies. Coerce so undefined can never win.
+    opts = { ...options, maxBodyBytes: options.maxBodyBytes ?? 64 * 1024 };
+    // On React Native, fetch is XHR-backed: patching both layers would capture every
+    // fetch() TWICE and let the sink's own deliveries recurse. Patch ONLY XHR there —
+    // the single substrate every request funnels through. Native fetch elsewhere is
+    // independent, so patch both. (Self-capture is also blocked by ignoring the
+    // ingest host — see index.ts — which is what makes the RN sink path safe.)
+    if (!isReactNative())
+        patchFetch();
+    patchXhr();
+    installed = true;
+}
+export function uninstall() {
+    if (!installed)
+        return;
+    try {
+        if (originalFetch)
+            g.fetch = originalFetch;
+        const X = g.XMLHttpRequest;
+        if (X && originalXhrOpen)
+            X.prototype.open = originalXhrOpen;
+        if (X && originalXhrSend)
+            X.prototype.send = originalXhrSend;
+    }
+    catch { /* best-effort */ }
+    installed = false;
+}
+/** Exported for the projection step in the sink. */
+export { projectBody };