wield-mcp 0.0.0-stage → 0.1.2

package/dist/extension/managed_schema.json

@@ -0,0 +1,41 @@
+{
+  "type": "object",
+  "properties": {
+    "org_name": {
+      "title": "Organization name",
+      "description": "Shown in Wield's popup and errors.",
+      "type": "string"
+    },
+    "allowed_sites": {
+      "title": "Allowed sites",
+      "description": "Only these sites may be used (e.g. bahn.de or *.doctolib.de). Empty: no restriction.",
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "writes": {
+      "title": "Actions that change something",
+      "description": "deny: refuse every recipe with write steps. allow: ask for Allow each time (always).",
+      "type": "string",
+      "enum": [
+        "allow",
+        "deny"
+      ]
+    },
+    "telemetry": {
+      "title": "Outcome counts",
+      "description": "off: wield-mcp must not send outcome counts.",
+      "type": "string",
+      "enum": [
+        "off",
+        "allowed"
+      ]
+    },
+    "require_signed": {
+      "title": "Require signed recipes",
+      "description": "Refuse recipes without a valid wield.run or org signature.",
+      "type": "boolean"
+    }
+  }
+}

package/dist/extension/manifest.json

@@ -0,0 +1,150 @@
+{
+  "manifest_version": 3,
+  "name": "Wield",
+  "short_name": "Wield",
+  "description": "Lets your AI agent use websites through your own browser and logins. Your passwords never leave your device.",
+  "version": "0.1.15",
+  "minimum_chrome_version": "137",
+  "permissions": [
+    "nativeMessaging",
+    "scripting",
+    "activeTab",
+    "storage"
+  ],
+  "host_permissions": [
+    "https://en.zalando.de/*",
+    "https://energie.check24.de/*",
+    "https://fahrplan.oebb.at/*",
+    "https://regiojet.cz/*",
+    "https://shop.flixbus.de/*",
+    "https://suchen.mobile.de/*",
+    "https://www.11880.com/*",
+    "https://www.2dehands.be/*",
+    "https://www.airbnb.com/*",
+    "https://www.allrecipes.com/*",
+    "https://www.alternate.de/*",
+    "https://www.amazon.ca/*",
+    "https://www.amazon.co.uk/*",
+    "https://www.amazon.com/*",
+    "https://www.amazon.de/*",
+    "https://www.amazon.es/*",
+    "https://www.amazon.fr/*",
+    "https://www.amazon.it/*",
+    "https://www.amazon.nl/*",
+    "https://www.arbeitsagentur.de/*",
+    "https://www.autoscout24.at/*",
+    "https://www.autoscout24.de/*",
+    "https://www.autoscout24.es/*",
+    "https://www.autoscout24.fr/*",
+    "https://www.autoscout24.it/*",
+    "https://www.autoscout24.nl/*",
+    "https://www.autotrader.co.uk/*",
+    "https://www.bahn.de/*",
+    "https://www.bbcgoodfood.com/*",
+    "https://www.blocket.se/*",
+    "https://www.booking.com/*",
+    "https://www.chefkoch.de/*",
+    "https://www.dasoertliche.de/*",
+    "https://www.dba.dk/*",
+    "https://www.doctolib.de/*",
+    "https://www.ebay.co.uk/*",
+    "https://www.ebay.com/*",
+    "https://www.ebay.de/*",
+    "https://www.ebay.es/*",
+    "https://www.ebay.fr/*",
+    "https://www.ebay.it/*",
+    "https://www.eventbrite.co.uk/*",
+    "https://www.eventbrite.com/*",
+    "https://www.eventbrite.de/*",
+    "https://www.eventim.de/*",
+    "https://www.finn.no/*",
+    "https://www.gelbeseiten.de/*",
+    "https://www.giallozafferano.it/*",
+    "https://www.gumtree.com/*",
+    "https://www.hugendubel.de/*",
+    "https://www.idealo.de/*",
+    "https://www.ikea.com/*",
+    "https://www.imdb.com/*",
+    "https://www.immobilienscout24.de/*",
+    "https://www.immoweb.be/*",
+    "https://www.jameda.de/*",
+    "https://www.jobs.ch/*",
+    "https://www.just-eat.co.uk/*",
+    "https://www.karriere.at/*",
+    "https://www.kijiji.ca/*",
+    "https://www.kleinanzeigen.de/*",
+    "https://www.lefrecce.it/*",
+    "https://www.lidl.de/*",
+    "https://www.lieferando.de/*",
+    "https://www.local.ch/*",
+    "https://www.marktplaats.nl/*",
+    "https://www.marmiton.org/*",
+    "https://www.mvg.de/*",
+    "https://www.mydealz.de/*",
+    "https://www.ns.nl/*",
+    "https://www.olx.pl/*",
+    "https://www.onthemarket.com/*",
+    "https://www.opentable.com/*",
+    "https://www.otodom.pl/*",
+    "https://www.otto.de/*",
+    "https://www.pyszne.pl/*",
+    "https://www.reed.co.uk/*",
+    "https://www.rightmove.co.uk/*",
+    "https://www.ryanair.com/*",
+    "https://www.spareroom.co.uk/*",
+    "https://www.stepstone.de/*",
+    "https://www.thomann.de/*",
+    "https://www.thuisbezorgd.nl/*",
+    "https://www.ticketmaster.co.uk/*",
+    "https://www.ticketmaster.com/*",
+    "https://www.ticketmaster.de/*",
+    "https://www.ticketmaster.nl/*",
+    "https://www.tori.fi/*",
+    "https://www.vinted.co.uk/*",
+    "https://www.vinted.de/*",
+    "https://www.vinted.es/*",
+    "https://www.vinted.fr/*",
+    "https://www.vinted.it/*",
+    "https://www.vinted.nl/*",
+    "https://www.vinted.pl/*",
+    "https://www.walmart.com/*",
+    "https://www.wg-gesucht.de/*",
+    "https://www.willhaben.at/*",
+    "https://www.youtube.com/*",
+    "https://www.zalando.de/*",
+    "https://www.zillow.com/*"
+  ],
+  "optional_host_permissions": [
+    "https://*/*"
+  ],
+  "background": {
+    "service_worker": "sw.js",
+    "type": "module"
+  },
+  "action": {
+    "default_title": "Wield",
+    "default_popup": "popup.html",
+    "default_icon": {
+      "16": "icons/16.png",
+      "32": "icons/32.png"
+    }
+  },
+  "icons": {
+    "16": "icons/16.png",
+    "32": "icons/32.png",
+    "48": "icons/48.png",
+    "128": "icons/128.png"
+  },
+  "externally_connectable": {
+    "matches": [
+      "https://wield.run/*"
+    ]
+  },
+  "content_security_policy": {
+    "extension_pages": "script-src 'self'; object-src 'self'; connect-src 'self'; img-src 'self' data:; font-src 'self'"
+  },
+  "storage": {
+    "managed_schema": "managed_schema.json"
+  },
+  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsho7lWZClmnKKB3lw7dV1NbUJKal1ki8eDz0DmNdxaIa/ejaSAi3S+eQ9jsk2vERxt0DwoCGwH4iGrV6DfdhNIm2t7/iGiwfBh5DbzYnA4clv3BkOrPb9No3t5QdAgptW8zYLse/UR89GMrVOUaAob1Jn0uEbQtR2uY1WOb/58fhoDx26qOJSxsFX3G6LgwOUdWZZOSndedrGOR2XMzVomSI9zd3+0ANTupYX7ouwgYEYJ1+ICyBe4bHfmWOreRhennx+X594qxlAOaRqjetcScrD5/npmsLuEwH+2RrlKyEKT0tal8AOQKGLqzRKhGDU1sWKYXSgztY65/Djq0dbwIDAQAB"
+}

package/dist/extension/popup.html

@@ -0,0 +1,77 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <title>Wield</title>
+  <link rel="stylesheet" href="tokens.css">
+  <link rel="stylesheet" href="ui.css">
+  <style>
+    body { width: 380px; max-height: 590px; overflow-y: auto; }
+  </style>
+</head>
+<body>
+  <header class="top">
+    <span class="brand" aria-label="Wield">
+      <svg viewBox="0 0 24 24" aria-hidden="true"><defs><linearGradient id="wm-hd" x1="0" y1="0" x2="0" y2="1"><stop offset="0" stop-color="#ffd85a"/><stop offset=".5" stop-color="#ff9a24"/><stop offset="1" stop-color="#ff5200"/></linearGradient><linearGradient id="wm-ht" x1="0" y1="0" x2="0" y2="1"><stop offset="0" stop-color="#ff6a0a"/><stop offset="1" stop-color="currentColor"/></linearGradient></defs><g transform="translate(0 -2.45)"><path d="M7.0 11.6 2.4 16.6 7.0 21.6M17.0 11.6 21.6 16.6 17.0 21.6" fill="none" stroke="currentColor" stroke-width="2.7" stroke-linecap="round" stroke-linejoin="round"/><path d="M11.0 21.6 12.6 10.28" stroke="currentColor" stroke-width="2.3" stroke-linecap="round"/><g transform="translate(12.6 10.28) rotate(8.045051779050041)"><rect x="-1.15" y="-.2" width="2.3" height="2.4" fill="url(#wm-ht)"/></g><g transform="translate(12.908 8.102) rotate(8.05) scale(0.84)"><path d="M-4.6 -1.9 -2.9 -1.9 -2.4 -1.5 1.3 -1.5 4.4 -0.55 4.6 -0.2 4.6 0.2 4.4 0.55 1.3 1.5 -2.4 1.5 -2.9 1.9 -4.6 1.9Z" fill="url(#wm-hd)" stroke="url(#wm-hd)" stroke-width=".35" stroke-linejoin="round"/><path d="M-4.2 -1.25H-2.9M-1.9 -.95H1.0" stroke="#fff1b8" stroke-width=".55" stroke-linecap="round" opacity=".85"/><rect x="-1.4" y="1.35" width="2.8" height=".8" rx=".3" fill="currentColor"/></g><rect x="7.01" y="5.50" width="1.3" height="1.3" fill="#ffc23d"/><rect x="5.41" y="7.20" width=".9" height=".9" fill="#ff8a1f"/></g></svg>
+      <b>wield</b>
+    </span>
+    <span id="bridge" class="badge" role="status">Checking</span>
+  </header>
+
+  <section aria-labelledby="h-exec">
+    <h2 class="label" id="h-exec">Executor</h2>
+    <p id="exec" class="mono muted" style="margin:0"></p>
+    <p id="pace" class="hint num" style="margin:4px 0 0"></p>
+    <div id="rebuilt" hidden>
+      <p class="hint">Wield was rebuilt on disk. Runs stop until it reloads.</p>
+      <button class="btn btn-primary btn-sm" id="reload" type="button" style="margin-top:8px">Reload Wield</button>
+    </div>
+    <div id="offline" hidden>
+      <p class="hint">The bridge is not running. Run <code>npx -y wield-mcp init</code> once, then reconnect. Chrome starts the bridge itself.</p>
+      <p class="hint mono" id="bridge-error"></p>
+      <button class="btn btn-secondary btn-sm" id="reconnect" type="button" style="margin-top:8px">Reconnect</button>
+    </div>
+  </section>
+
+  <section aria-labelledby="h-rec" id="rec-section">
+    <h2 class="label" id="h-rec">Teach a site</h2>
+    <div id="rec-idle">
+      <p class="hint" style="margin:0 0 8px">Do a task once in this tab; Wield turns it into a recipe for your agent. You review everything before it is sent.</p>
+      <div class="rec-start">
+        <input id="rec-task" class="input" type="text" placeholder="What will you do? e.g. search trains" maxlength="200" aria-label="What will you do?">
+        <button class="btn btn-secondary btn-sm" id="rec-go" type="button">Record</button>
+      </div>
+      <p class="hint" id="rec-msg" role="status"></p>
+    </div>
+    <div id="rec-active" hidden>
+      <p class="mono" style="margin:0 0 8px" id="rec-what"></p>
+      <button class="btn btn-secondary btn-sm" id="rec-cancel" type="button">Cancel</button>
+      <button class="btn btn-primary btn-sm" id="rec-done" type="button">Done</button>
+    </div>
+  </section>
+
+  <!-- The run log first: it is the proof of what left the browser. -->
+  <section aria-labelledby="h-runs">
+    <h2 class="label" id="h-runs">Recent runs</h2>
+    <ul class="rows" id="runs"></ul>
+  </section>
+
+  <section aria-labelledby="h-sites">
+    <h2 class="label" id="h-sites">Sites</h2>
+    <ul class="rows" id="sites"></ul>
+    <details class="sites-all" id="sites-all-wrap">
+      <summary>All built-in sites (<span id="sites-all-count">0</span>)</summary>
+      <ul class="rows" id="sites-all"></ul>
+    </details>
+  </section>
+
+  <section aria-labelledby="h-dev">
+    <h2 class="label" id="h-dev">Developer</h2>
+    <label class="dev-toggle"><input type="checkbox" id="dev-mode"> Run local recipes</label>
+    <p class="hint" style="margin:4px 0 0">Lets programs on this computer run recipes that the registry hasn't signed, such as ones you are writing. Leave it off otherwise. Changes on a site still ask you first.</p>
+  </section>
+
+  <p class="proof">Wield sent nothing but the requests listed here, each from this browser to the site itself. Your passwords and cookies went nowhere else.</p>
+  <script src="popup.js"></script>
+</body>
+</html>

package/dist/extension/popup.js

@@ -0,0 +1,182 @@
+"use strict";
+(() => {
+  // apps/extension/src/ui/popup.ts
+  var $ = (id) => document.getElementById(id);
+  function el(tag, cls, text) {
+    const e = document.createElement(tag);
+    if (cls) e.className = cls;
+    if (text !== void 0) e.textContent = text;
+    return e;
+  }
+  function clock(iso) {
+    if (!iso) return "";
+    return new Date(iso).toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" });
+  }
+  function secs(ms) {
+    return ms < 1e3 ? `${ms} ms` : `${(ms / 1e3).toFixed(1)} s`;
+  }
+  function renderBridge(s) {
+    const badge = $("bridge");
+    const b = s.bridge.state;
+    badge.className = `badge ${b === "connected" ? "ok" : b === "connecting" ? "" : "fail"}`;
+    badge.textContent = b === "connected" ? "Bridge connected" : b === "connecting" ? "Connecting" : "Bridge offline";
+    const since = s.bridge.since ? ` since ${clock(s.bridge.since)}` : "";
+    $("exec").title = `build ${s.build}`;
+    $("rebuilt").hidden = !s.pending_build;
+    $("exec").textContent = `${s.browser} \xB7 extension ${s.version}${b === "connected" ? ` \xB7 connected${since}` : ""}${s.active_runs ? ` \xB7 ${s.active_runs} running` : ""}`;
+    $("offline").hidden = b === "connected";
+    const pace = Object.entries(s.pace ?? {}).filter(([, v]) => v.last_hour > 0).sort((x, y) => y[1].last_hour - x[1].last_hour);
+    $("pace").textContent = pace.length ? `This hour: ${pace.map(([k, v]) => `${k} ${v.last_hour}/${v.per_hour}`).join(" \xB7 ")}` : "";
+    $("bridge-error").textContent = s.bridge.last_error ?? "";
+  }
+  function siteBadge(r) {
+    if (r.policy_blocked_by) return ["fail", `Blocked by ${r.policy_blocked_by}`, `Your organization's policy doesn't allow this site.`];
+    if (r.paused) return ["warn", "Paused", "Your agent can\u2019t use this site until you resume it."];
+    if (r.last_run && !r.last_run.ok && r.last_run.error_code === "site_challenge") return ["warn", "Needs a quick check", `The site asked for a bot check. Open ${r.host} and click once on the page.`];
+    if (r.last_run && !r.last_run.ok && r.last_run.error_code === "login_required") return ["warn", "Log in needed", `Log in to ${r.host} in this browser, then try again.`];
+    if (r.logged_in === true) return ["ok", "Logged in", null];
+    if (r.logged_in === false) return ["warn", "Logged out", null];
+    if (r.last_run) return [r.last_run.ok ? "ok" : "fail", r.last_run.ok ? "Working" : r.last_run.error_code?.replace(/_/g, " ") ?? "Failed", null];
+    return ["", r.access === "granted" ? "Allowed" : "Ready", null];
+  }
+  function siteRow(r, compact) {
+    const li = el("li", "site");
+    li.append(el("span", "name", r.host.replace(/^www\./, "")));
+    const [cls, text, hint] = siteBadge(r);
+    li.append(el("span", `badge ${cls}`, text));
+    if (!compact) {
+      const bits = [r.access === "built-in" ? "built in" : r.access === "granted" ? "you allowed it" : "no access", r.tab_open ? "tab open" : null, r.pace?.last_hour ? `${r.pace.last_hour}/${r.pace.per_hour} this hour` : null];
+      li.append(el("span", "sub", bits.filter(Boolean).join(" \xB7 ")));
+      if (hint) li.append(el("span", "sub site-hint", hint));
+    }
+    const actions = el("span", "site-actions");
+    if (!r.policy_blocked_by) {
+      const pause = el("button", "btn btn-ghost btn-xs", r.paused ? "Resume" : "Pause");
+      pause.type = "button";
+      pause.setAttribute("aria-label", `${r.paused ? "Resume" : "Pause"} ${r.host}`);
+      pause.addEventListener("click", async () => {
+        await chrome.runtime.sendMessage({ type: "site_pause", host: r.host, paused: !r.paused });
+        void refresh();
+      });
+      actions.append(pause);
+    }
+    if (r.access === "granted") {
+      const revoke = el("button", "btn btn-ghost btn-xs", "Remove access");
+      revoke.type = "button";
+      revoke.setAttribute("aria-label", `Remove Wield's access to ${r.host}`);
+      revoke.addEventListener("click", async () => {
+        await chrome.runtime.sendMessage({ type: "site_revoke", origin: r.origin });
+        void refresh();
+      });
+      actions.append(revoke);
+    }
+    li.append(actions);
+    return li;
+  }
+  function renderSites(rows, policy) {
+    const ul = $("sites");
+    ul.replaceChildren();
+    const active = rows.filter((r) => r.active);
+    const rest = rows.filter((r) => !r.active);
+    if (policy) {
+      const org = policy.orgs.map((o) => `${o.name}${o.expired ? " (expired, still applied)" : ""}`).join(", ");
+      const li = el("li", "site site-policy");
+      li.append(el("span", "name", `Managed by ${org}`));
+      li.append(el("span", "sub", [policy.allowed_sites ? `only ${policy.allowed_sites.flat().join(", ")}` : "all sites", policy.writes === "deny" ? "no actions that change something" : "actions need your Allow"].join(" \xB7 ")));
+      ul.append(li);
+    }
+    if (!active.length) ul.append(el("li", "empty", "No site used yet. Your agent\u2019s runs show up here."));
+    for (const r of active) ul.append(siteRow(r, false));
+    $("sites-all-count").textContent = String(rest.length);
+    const all = $("sites-all");
+    all.replaceChildren(...rest.map((r) => siteRow(r, true)));
+    $("sites-all-wrap").hidden = rest.length === 0;
+  }
+  function renderRuns(runs) {
+    const ul = $("runs");
+    ul.replaceChildren();
+    if (!runs.length) {
+      ul.append(el("li", "empty", "No runs yet."));
+      return;
+    }
+    for (const r of runs.slice(0, 12)) {
+      const li = el("li");
+      const head = el("div", "run-head");
+      head.append(el("span", "id", r.kind === "status" ? `${r.site_id} \xB7 login check` : `${r.recipe_id} v${r.version}`));
+      head.append(el("span", `badge ${r.ok ? "ok" : "fail"}`, r.ok ? "ok" : (r.error_code ?? "failed").replace(/_/g, " ")));
+      li.append(head);
+      li.append(el("span", "run-meta num", `${secs(r.duration_ms)} \xB7 ${clock(r.started_at)} \xB7 ${r.requests.length} ${r.requests.length === 1 ? "request" : "requests"}`));
+      if (r.requests.length) {
+        const hosts = [...new Set(r.requests.map((q) => new URL(q.origin).host))];
+        const reqs = el("ul", "reqs");
+        reqs.setAttribute("aria-label", `Requests sent to ${hosts.join(", ")}`);
+        if (hosts.length === 1) reqs.append(el("li", "dest", `to ${hosts[0]}`));
+        for (const q of r.requests) {
+          const row = el("li");
+          row.append(el("span", "", q.method));
+          const p = el("span", "path");
+          if (hosts.length > 1) p.append(el("span", "host", new URL(q.origin).host));
+          q.path.split("/").forEach((seg, i) => {
+            if (i > 0) p.append("/", document.createElement("wbr"));
+            p.append(seg);
+          });
+          p.title = `${q.origin}${q.path}`;
+          row.append(p);
+          row.append(el("span", `st num${q.status >= 400 || q.status === 0 ? " bad" : ""}`, String(q.status || "err")));
+          row.append(el("span", "ms num", `${q.ms} ms`));
+          reqs.append(row);
+        }
+        li.append(reqs);
+      } else {
+        li.append(el("span", "muted", "No requests sent."));
+      }
+      ul.append(li);
+    }
+  }
+  function renderRecording(s) {
+    const r = s.recording;
+    $("rec-idle").hidden = !!r;
+    $("rec-active").hidden = !r;
+    if (r) $("rec-what").textContent = `${r.state === "review" ? "Reviewing" : "Recording"} on ${new URL(r.origin).host} \xB7 ${r.requests} requests`;
+  }
+  async function refresh() {
+    const s = await chrome.runtime.sendMessage({ type: "popup_state" });
+    renderRecording(s);
+    renderBridge(s);
+    renderSites(s.sites_overview ?? [], s.policy ?? null);
+    renderRuns(s.runs);
+  }
+  $("rec-go").addEventListener("click", async () => {
+    const msg = $("rec-msg");
+    const [tab] = await chrome.tabs.query({ active: true, currentWindow: true });
+    if (!tab?.id || !tab.url || !/^https:\/\//.test(tab.url)) {
+      msg.textContent = "Open the site you want to teach in this tab first (https only).";
+      return;
+    }
+    msg.textContent = "Starting\u2026";
+    const r = await chrome.runtime.sendMessage({ type: "record_begin", tabId: tab.id, task: $("rec-task").value });
+    if (!r.ok) msg.textContent = r.error ?? "Could not start recording.";
+    else window.close();
+  });
+  $("rec-done").addEventListener("click", async () => {
+    await chrome.runtime.sendMessage({ type: "record_stop", how: "done" });
+    window.close();
+  });
+  $("rec-cancel").addEventListener("click", async () => {
+    await chrome.runtime.sendMessage({ type: "record_stop", how: "cancel" });
+    void refresh();
+  });
+  $("reload").addEventListener("click", () => {
+    void chrome.runtime.sendMessage({ type: "reload_extension" });
+    window.close();
+  });
+  $("reconnect").addEventListener("click", async () => {
+    await chrome.runtime.sendMessage({ type: "reconnect" });
+    setTimeout(refresh, 1200);
+  });
+  var devBox = $("dev-mode");
+  void chrome.storage.local.get("dev_mode").then((v) => devBox.checked = v.dev_mode === true);
+  devBox.addEventListener("change", () => void chrome.storage.local.set({ dev_mode: devBox.checked }));
+  chrome.storage.onChanged.addListener(() => void refresh());
+  void refresh();
+})();

package/dist/extension/recmain.js

@@ -0,0 +1,206 @@
+"use strict";
+(() => {
+  // apps/extension/src/content/recmain.ts
+  (() => {
+    const KEY = "__wield_rec__";
+    const NAV_KEY = "__wield_rec_nav__";
+    const MAX_BODY = 1e6;
+    const TEXT = /(json|html|xml|text\/|javascript|x-www-form-urlencoded|graphql|turbo-stream)/i;
+    const w = window;
+    let nonce = null;
+    try {
+      nonce = sessionStorage.getItem(KEY);
+    } catch {
+      return;
+    }
+    if (!nonce || w.__wieldRecNonce === nonce) return;
+    w.__wieldRecNonce = nonce;
+    const myNonce = nonce;
+    const active = () => {
+      try {
+        return sessionStorage.getItem(KEY) === myNonce;
+      } catch {
+        return false;
+      }
+    };
+    let ready = false;
+    const queue = [];
+    const flush = () => {
+      if (!ready) return;
+      while (queue.length) window.postMessage({ source: "wield-rec", nonce: myNonce, entry: queue.shift() }, location.origin);
+    };
+    const post = (entry) => {
+      if (!active() || queue.length > 400) return;
+      queue.push(entry);
+      flush();
+    };
+    window.addEventListener("message", (e) => {
+      const d = e.data;
+      if (e.source !== window || !d || d.source !== "wield-rec-ctl" || d.nonce !== myNonce) return;
+      if (d.cmd === "ready") {
+        ready = true;
+        flush();
+      }
+    });
+    window.postMessage({ source: "wield-rec-hello", nonce: myNonce }, location.origin);
+    const cap = (s) => typeof s === "string" ? s.length > MAX_BODY ? { body: s.slice(0, MAX_BODY), body_truncated: true } : { body: s } : {};
+    const headersOf = (h) => {
+      const o = {};
+      h.forEach((v, k) => o[k] = v);
+      return o;
+    };
+    const formText = (fd) => {
+      const p = new URLSearchParams();
+      fd.forEach((v, k) => typeof v === "string" && p.append(k, v));
+      return p.toString();
+    };
+    const bodyText = (b) => {
+      if (b == null) return void 0;
+      if (typeof b === "string") return b.slice(0, 65536);
+      if (b instanceof URLSearchParams) return b.toString().slice(0, 65536);
+      if (b instanceof FormData) return formText(b).slice(0, 65536);
+      return "[binary body]";
+    };
+    const sendsCookies = (url, credentials) => {
+      try {
+        const sameOrigin = new URL(url).origin === location.origin;
+        return credentials === "include" || sameOrigin && credentials !== "omit";
+      } catch {
+        return false;
+      }
+    };
+    const ofetch = window.fetch;
+    window.fetch = function(input, init) {
+      let method = "GET";
+      let url = "";
+      let credentials;
+      const request_headers = {};
+      let post_data;
+      let reqBody;
+      const started = Date.now();
+      try {
+        if (input instanceof Request) {
+          method = input.method;
+          url = input.url;
+          credentials = input.credentials;
+          input.headers.forEach((v, k) => request_headers[k] = v);
+          if (!init?.body && method !== "GET" && method !== "HEAD") reqBody = input.clone().text().catch(() => "");
+        } else url = input instanceof URL ? input.href : String(input);
+        if (init?.method) method = String(init.method).toUpperCase();
+        if (init?.credentials) credentials = init.credentials;
+        if (init?.headers) new Headers(init.headers).forEach((v, k) => request_headers[k] = v);
+        post_data = bodyText(init?.body);
+        url = new URL(url, location.href).href;
+      } catch {
+      }
+      const p = ofetch.apply(this, arguments);
+      if (!/^https?:/.test(url) || !active()) return p;
+      p.then(
+        async (res) => {
+          const mime = res.headers.get("content-type") ?? "";
+          const len = Number(res.headers.get("content-length") ?? 0);
+          let text;
+          if (TEXT.test(mime) && !/event-stream/i.test(mime) && len <= 4 * MAX_BODY) text = await res.clone().text().catch(() => void 0);
+          if (reqBody) post_data = (await reqBody).slice(0, 65536);
+          post({ kind: "fetch", method, url, ...res.url && res.url !== url ? { final_url: res.url } : {}, started, status: res.status, mime, request_headers, ...post_data !== void 0 ? { post_data } : {}, response_headers: headersOf(res.headers), ...cap(text), sends_cookies: sendsCookies(url, credentials) });
+        },
+        (err) => post({ kind: "fetch", method, url, started, request_headers, failed: String(err?.message ?? err).slice(0, 200) })
+      );
+      return p;
+    };
+    const META = /* @__PURE__ */ new WeakMap();
+    const XP = XMLHttpRequest.prototype;
+    const oOpen = XP.open;
+    const oSend = XP.send;
+    const oSet = XP.setRequestHeader;
+    XP.open = function(method, url) {
+      try {
+        META.set(this, { method: String(method).toUpperCase(), url: new URL(String(url), location.href).href, headers: {} });
+      } catch {
+      }
+      return oOpen.apply(this, arguments);
+    };
+    XP.setRequestHeader = function(k, v) {
+      const m = META.get(this);
+      if (m) m.headers[String(k).toLowerCase()] = String(v);
+      return oSet.call(this, k, v);
+    };
+    XP.send = function(body) {
+      const m = META.get(this);
+      if (m && /^https?:/.test(m.url) && active()) {
+        m.started = Date.now();
+        m.post_data = bodyText(body);
+        this.addEventListener("loadend", () => {
+          let text;
+          try {
+            if (this.responseType === "" || this.responseType === "text") text = this.responseText;
+            else if (this.responseType === "json") text = JSON.stringify(this.response);
+          } catch {
+          }
+          const mime = this.getResponseHeader("content-type") ?? "";
+          const response_headers = {};
+          for (const line of this.getAllResponseHeaders().trim().split(/[\r\n]+/)) {
+            const i = line.indexOf(":");
+            if (i > 0) response_headers[line.slice(0, i).trim().toLowerCase()] = line.slice(i + 1).trim();
+          }
+          post({
+            kind: "xhr",
+            method: m.method,
+            url: m.url,
+            started: m.started,
+            status: this.status,
+            mime,
+            request_headers: m.headers,
+            ...m.post_data !== void 0 ? { post_data: m.post_data } : {},
+            response_headers,
+            ...TEXT.test(mime) ? cap(text) : {},
+            ...this.status === 0 ? { failed: "network error or aborted" } : {},
+            sends_cookies: sendsCookies(m.url, this.withCredentials ? "include" : "same-origin")
+          });
+        });
+      }
+      return oSend.call(this, body);
+    };
+    window.addEventListener("submit", (e) => {
+      const form = e.target;
+      if (!form || e.defaultPrevented || !active()) return;
+      const method = (form.method || "get").toUpperCase();
+      if (method !== "POST") return;
+      try {
+        const fd = new FormData(form, e.submitter ?? void 0);
+        for (const el of Array.from(form.elements)) {
+          if (el.name && (el.type === "password" || el.getAttribute?.("autocomplete")?.includes("password"))) fd.delete(el.name);
+        }
+        sessionStorage.setItem(NAV_KEY, JSON.stringify({ method, url: new URL(form.action || location.href, location.href).href, post_data: formText(fd).slice(0, 65536), started: Date.now() }));
+      } catch {
+      }
+    });
+    const snapshotDocument = (fromRecordingStart) => {
+      const nav = performance.getEntriesByType("navigation")[0];
+      let pending = null;
+      try {
+        pending = JSON.parse(sessionStorage.getItem(NAV_KEY) ?? "null");
+        sessionStorage.removeItem(NAV_KEY);
+      } catch {
+        pending = null;
+      }
+      const viaForm = pending && Date.now() - pending.started < 6e4 ? pending : null;
+      post({
+        kind: "document",
+        method: viaForm ? viaForm.method : "GET",
+        url: location.href,
+        started: fromRecordingStart ? Date.now() : Math.round(performance.timeOrigin),
+        status: nav?.responseStatus || 200,
+        mime: document.contentType || "text/html",
+        request_headers: {},
+        ...viaForm ? { post_data: viaForm.post_data } : {},
+        response_headers: {},
+        ...cap(document.documentElement?.outerHTML),
+        sends_cookies: true,
+        start_page: fromRecordingStart
+      });
+    };
+    if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", () => snapshotDocument(false), { once: true });
+    else snapshotDocument(true);
+  })();
+})();