wield-mcp 0.0.0-stage → 0.1.2

package/dist/extension/record.js

@@ -0,0 +1,1806 @@
+"use strict";
+(() => {
+  // packages/builder/src/classify.ts
+  var JWT = /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/;
+  var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  var EMAIL = /[^\s@<>"']+@[^\s@<>"']+\.[a-z]{2,}/i;
+  var PHONE = /^(?:\+|00|0|\()[0-9 ()/.-]{6,}[0-9]$/;
+  var IBAN = /^[A-Z]{2}[0-9]{2}[A-Z0-9 ]{11,30}$/;
+  var CARD = /^(?:[0-9][ -]?){13,19}$/;
+  var ISO_DATE = /^\d{4}-\d{2}-\d{2}$/;
+  var ISO_DATETIME = /^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:?\d{2})?$/;
+  var DE_DATE = /^\d{1,2}\.\d{1,2}\.(\d{2}|\d{4})$/;
+  var TIME = /^\d{1,2}:\d{2}(:\d{2})?$/;
+  var PRICE = /^(?:[€$£¥]|US\$|EUR|USD|GBP|CHF)?\s*-?\d{1,3}(?:[.,\s  ]\d{3})*(?:[.,]\d{1,2})?\s*(?:[€$£¥]|EUR|USD|GBP|CHF|€\*|€¹)?$/;
+  var HAS_CURRENCY = /[€$£¥]|\b(?:EUR|USD|GBP|CHF)\b/;
+  var URL_RE = /^https?:\/\/\S+$/;
+  var PATH_RE = /^\/[^\s]*$/;
+  var ENUMISH = /^[A-Za-z_][A-Za-z0-9_.:-]{0,39}$/;
+  var HEX64 = /^[0-9a-f]{64}$/i;
+  var URN = /^(?:[a-z][a-z0-9-]{1,15}:(?:[a-z][a-z0-9_-]{0,30})?:+|gid:\/\/[a-z]+\/[A-Za-z]+\/)(?=\S)/;
+  var SECRET_KEY = /(^|[_-])(token|csrf|xsrf|auth|authorization|session|sess|sid|ssid|esid|secret|password|passwd|pwd|otp|nonce|signature|sig|apikey|api_key|access_key|private|cookie|bearer|jwt|hash_?key|device_?id|fingerprint|captcha|recaptcha|cf_clearance)([_-]|$)|token|csrf|xsrf|secret|password|session|signature|apikey|captcha/i;
+  var PERSONAL_KEY = /(e-?mail|phone|telefon|tel$|mobile|handy|(contact|customer|recipient|sender|patient|owner|buyer|seller|account|member|guest|passenger|travell?er|person|full|display|real|nick)_?name|first_?name|last_?name|full_?name|vorname|nachname|surname|given_?name|family_?name|^name$|username|user_?name|login|birth|geburt|dob|address|adresse|street|strasse|straße|house_?number|hausnummer|zip|plz|postal|postcode|iban|bic|card|cvc|cvv|ssn|tax_?id|steuer|insurance_?number|versicherten|passport|message|nachricht|comment|kommentar|note|notiz|text$|body$|subject|betreff)/i;
+  var STRUCTURAL_KEY = /^(operationName|operation_name|query|sha256Hash|version|persistedQuery|extensions|__typename|typename|type|kind|format|locale|lang|language|currency|sort|sort_?by|order|order_?by|direction|dir|page|page_?size|per_?page|limit|offset|size|count|view|mode|category|categories|filter|filters|vertical|channel|platform|client|source|context|scope|fields|include|expand|tab|section|layout|variant|country|market|region|tld|site|domain|brand|vc|sb|od)$/i;
+  function looksLikeToken(v) {
+    if (typeof v !== "string") return false;
+    const s = v.trim();
+    if (s.length < 16) return false;
+    if (JWT.test(s)) return true;
+    if (UUID.test(s)) return true;
+    if (/\s/.test(s)) return false;
+    if (/^[0-9]+$/.test(s)) return false;
+    if (ISO_DATETIME.test(s) || ISO_DATE.test(s) || DE_DATE.test(s) || TIME.test(s)) return false;
+    if (/^https?:\/\//.test(s)) return false;
+    if (/^[\w.+-]+\/[\w.+*-]+(\s*;.*)?$/.test(s)) return false;
+    if (/^[a-z]+(?:[-_][a-z]+){1,}$/i.test(s)) return false;
+    if (/[,;|]/.test(s) && s.split(/\s*[,;|]\s*/).every((p) => /^[A-Za-z][A-Za-z0-9_.-]{0,40}$/.test(p) && !/\d{4,}/.test(p))) return false;
+    if (URN.test(s)) return false;
+    if (/^[a-z]+(?:[A-Z][a-z]*)+\d{0,2}$|^(?:[A-Z][a-z]+){2,}[A-Z]?\d{0,2}$/.test(s)) return false;
+    const parts = s.split(/[-_]+/).filter(Boolean);
+    if (parts.length >= 3 && parts.every((p) => /^[a-z0-9]+$/.test(p)) && parts.filter((p) => /^[a-z]{2,}$/.test(p)).length >= parts.length / 2) return false;
+    if (/^\/?[A-Za-z_$][\w$-]*(?:[./:][A-Za-z_$][\w$-]*)+\/?$/.test(s)) return false;
+    if (s.includes("/") && s.split("/").every((seg) => seg === "" || seg.length < 16 || /^[A-Za-z][a-z]+(?:[A-Z][a-z]+)*$/.test(seg))) return false;
+    const classes = [/[a-z]/, /[A-Z]/, /[0-9]/, /[^A-Za-z0-9]/].filter((r) => r.test(s)).length;
+    return s.length >= 24 || classes >= 3;
+  }
+  function looksPersonal(v) {
+    if (typeof v !== "string") return false;
+    const s = v.trim();
+    return EMAIL.test(s) || isPhone(s) || IBAN.test(s.replace(/\s/g, "")) || CARD.test(s) && luhn(s.replace(/\D/g, ""));
+  }
+  function isPhone(s) {
+    if (!PHONE.test(s) || ISO_DATE.test(s) || DE_DATE.test(s)) return false;
+    const digits = s.replace(/\D/g, "").length;
+    return digits >= 7 && digits <= 15;
+  }
+  function luhn(d) {
+    if (d.length < 13) return false;
+    let sum = 0;
+    for (let i = 0; i < d.length; i++) {
+      let x = Number(d[d.length - 1 - i]);
+      if (i % 2 === 1) {
+        x *= 2;
+        if (x > 9) x -= 9;
+      }
+      sum += x;
+    }
+    return sum % 10 === 0;
+  }
+  function stringClass(s) {
+    const t = s.trim();
+    if (t === "") return "\xABempty\xBB";
+    if (JWT.test(t)) return `\xABsecret:jwt\xBB`;
+    if (EMAIL.test(t)) return "\xABemail\xBB";
+    if (/^\d+$/.test(t)) return t.length > 9 ? "\xABid:num\xBB" : "\xABint-string\xBB";
+    if (isPhone(t)) return "\xABphone\xBB";
+    if (UUID.test(t)) return "\xABuuid\xBB";
+    if (ISO_DATETIME.test(t)) return "\xABdatetime\xBB";
+    if (ISO_DATE.test(t)) return "\xABdate\xBB";
+    if (DE_DATE.test(t)) return "\xABdate:dmy\xBB";
+    if (TIME.test(t)) return "\xABtime\xBB";
+    if (PRICE.test(t) && HAS_CURRENCY.test(t)) return "\xABprice\xBB";
+    if (/^-?\d+$/.test(t)) return t.length > 9 ? "\xABid:num\xBB" : "\xABint-string\xBB";
+    if (/^-?\d+[.,]\d+$/.test(t)) return "\xABdecimal-string\xBB";
+    if (URL_RE.test(t)) return "\xABurl\xBB";
+    if (PATH_RE.test(t) && t.length > 1) return "\xABpath\xBB";
+    if (HEX64.test(t)) return "\xABhash\xBB";
+    {
+      const u = URN.exec(t);
+      if (u && !/\s/.test(t)) return `\xABurn:${u[0]}\xBB`;
+    }
+    if (looksLikeToken(t)) return `\xABsecret:${t.length}\xBB`;
+    if (/^[A-Za-z0-9_-]{6,24}$/.test(t) && /\d/.test(t) && /[A-Za-z]/.test(t)) return "\xABid\xBB";
+    const words = t.split(/\s+/).length;
+    return words > 1 ? `\xABtext:${t.length}\xBB` : `\xABword:${t.length}\xBB`;
+  }
+  function numberClass(n) {
+    if (!Number.isFinite(n)) return "\xABnumber\xBB";
+    if (Number.isInteger(n)) {
+      if (n > 1e12 && n < 4e12) return "\xABtimestamp-ms\xBB";
+      if (n > 1e9 && n < 4e9) return "\xABtimestamp\xBB";
+      return "\xABint\xBB";
+    }
+    return "\xABfloat\xBB";
+  }
+  function slugify(s) {
+    return s.toLowerCase().normalize("NFKD").replace(/[̀-ͯ]/g, "").replace(/ß/g, "ss").replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+  }
+  function variants(value) {
+    const v = value.trim();
+    if (v.length < 2) return [];
+    const out = /* @__PURE__ */ new Set([v, v.toLowerCase(), encodeURIComponent(v), encodeURIComponent(v).replace(/%20/g, "+"), encodeURIComponent(v.toLowerCase())]);
+    const slug = slugify(v);
+    if (slug.length >= 2) out.add(slug);
+    return [...out].filter((x) => x.length >= 2).sort((a, b) => b.length - a.length);
+  }
+  var InputMatcher = class {
+    table;
+    /** Every spelling of every input, longest first: when one typed value extends another ("piz",
+     *  "pizza"), the longer one claims the text, whatever order the recorder listed them in. */
+    spellings;
+    constructor(inputs) {
+      this.table = inputs.filter((i) => typeof i.value === "string" && i.value.trim().length >= 2).map((i) => ({ id: i.id, forms: variants(i.value) }));
+      this.spellings = this.table.flatMap((r) => r.forms.map((f) => ({ id: r.id, f }))).sort((a, b) => b.f.length - a.f.length);
+    }
+    get size() {
+      return this.table.length;
+    }
+    /** The input whose value equals s (any spelling), if any. */
+    exact(s) {
+      const t = s.trim();
+      const lower = t.toLowerCase();
+      for (const row of this.table) for (const f of row.forms) if (f === t || f.toLowerCase() === lower) return row.id;
+      return null;
+    }
+    /** Replace every input spelling inside s by {{inN}}. Returns null when nothing matched. */
+    replaceIn(s) {
+      let text = s;
+      const ids = [];
+      for (const { id, f } of this.spellings) {
+        if ((f.length < 3 || /^[\d.,:+-]+$/.test(f)) && text.trim() !== f) continue;
+        const re = new RegExp(escapeRe(f), "gi");
+        if (re.test(text)) {
+          text = text.replace(re, `{{${id}}}`);
+          if (!ids.includes(id)) ids.push(id);
+        }
+      }
+      return ids.length ? { text, ids } : null;
+    }
+    /** Every raw spelling (for the final scrub). */
+    allForms() {
+      return this.table.flatMap((r) => r.forms);
+    }
+  };
+  function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  }
+  function sanitizeRequestLeaf(v, c) {
+    if (v === null || typeof v === "boolean") return v;
+    if (typeof v === "number") {
+      if (!c.loggedIn && Number.isInteger(v) && Math.abs(v) < 1e6) return v;
+      if (Number.isInteger(v) && v >= 0 && v <= 9 && !PERSONAL_KEY.test(c.key) && !SECRET_KEY.test(c.key)) return v;
+      if (STRUCTURAL_KEY.test(c.key) && Math.abs(v) < 1e5) return v;
+      return numberClass(v);
+    }
+    if (typeof v !== "string") return "\xABvalue\xBB";
+    const s = v;
+    const inputId = c.inputs.exact(s);
+    if (inputId) return `{{${inputId}}}`;
+    if (SECRET_KEY.test(c.key) || looksLikeToken(s)) {
+      if (/^sha256Hash$/i.test(c.key) && HEX64.test(s)) return s;
+      if (s.length >= 4) c.secrets.add(s);
+      return `\xABsecret:${s.length}\xBB`;
+    }
+    if (/^(operationName|operation_name|sha256Hash|__typename)$/.test(c.key) && s.length <= 120 && !looksPersonal(s)) return s;
+    if (URL_RE.test(s) && !PERSONAL_KEY.test(c.key)) return urlLeaf(s, c);
+    if (PERSONAL_KEY.test(c.key) || looksPersonal(s)) {
+      if (s.length >= 3) c.secrets.add(s);
+      const replaced = c.inputs.replaceIn(s);
+      if (replaced) return `\xABpersonal with ${replaced.ids.map((i) => `{{${i}}}`).join(", ")}\xBB`;
+      const cls = stringClass(s);
+      return /^«(word|text):/.test(cls) ? `\xABpersonal:${s.length}\xBB` : cls;
+    }
+    if (/^(query)$/i.test(c.key) && /^\s*(query|mutation|subscription|fragment|\{)/.test(s)) {
+      return c.inputs.replaceIn(s)?.text ?? s;
+    }
+    const partial = c.inputs.replaceIn(s);
+    if (partial) {
+      const rest = partial.text.replace(/\{\{in\d+\}\}/g, "").replace(/[^A-Za-z0-9]/g, "");
+      if (c.loggedIn && rest.length > 3) {
+        if (s.length >= 4) c.secrets.add(s);
+        return `${stringClass(s).replace(/»$/, "")} with ${partial.ids.map((i) => `{{${i}}}`).join(", ")}\xBB`;
+      }
+      return partial.text;
+    }
+    if (STRUCTURAL_KEY.test(c.key) && s.length <= 64 && !looksPersonal(s)) return s;
+    if (BOOL_WORD.test(s)) return s;
+    if (s.length <= 40 && REQUEST_CONSTANT.test(s)) return s;
+    if (!c.loggedIn) {
+      if (ENUMISH.test(s) || /^[\w ,.:;/+-]{1,40}$/.test(s)) return s;
+      if (/^-?\d+([.,]\d+)?$/.test(s) && s.length <= 9) return s;
+    }
+    if (s.length >= 4) c.secrets.add(s);
+    return stringClass(s);
+  }
+  function urlLeaf(s, c) {
+    collectUrlSecrets(s, c);
+    const partial = c.inputs.replaceIn(s);
+    if (partial) return c.loggedIn ? `\xABurl with ${partial.ids.map((i) => `{{${i}}}`).join(", ")}\xBB` : partial.text;
+    if (!c.loggedIn && /^[\w ,.:;/+-]{1,40}$/.test(s)) return s;
+    return "\xABurl\xBB";
+  }
+  function collectUrlSecrets(s, c) {
+    let u;
+    try {
+      u = new URL(s);
+    } catch {
+      if (s.length >= 4) c.secrets.add(s);
+      return;
+    }
+    for (const part of [u.username, u.password]) if (part.length >= 4) c.secrets.add(part);
+    for (const seg of u.pathname.split("/")) {
+      if (!seg) continue;
+      let dec = seg;
+      try {
+        dec = decodeURIComponent(seg);
+      } catch {
+      }
+      if (looksLikeToken(dec) || looksPersonal(dec)) {
+        c.secrets.add(seg);
+        c.secrets.add(dec);
+      }
+    }
+    const leaf = (k, v) => {
+      sanitizeRequestLeaf(v, { ...c, key: k });
+      const enc2 = encodeURIComponent(v);
+      if (c.secrets.has(v) && enc2 !== v) c.secrets.add(enc2);
+    };
+    for (const [k, v] of u.searchParams) leaf(k, v);
+    const frag = u.hash.slice(1);
+    if (frag.includes("=")) for (const [k, v] of new URLSearchParams(frag)) leaf(k, v);
+    else if (frag.length >= 4) {
+      let dec = frag;
+      try {
+        dec = decodeURIComponent(frag);
+      } catch {
+      }
+      if (looksLikeToken(dec) || looksPersonal(dec)) {
+        c.secrets.add(frag);
+        c.secrets.add(dec);
+      }
+    }
+  }
+  var SCREAMING = /^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)*$|^[A-Z][A-Za-z0-9]*_[A-Za-z0-9_]+$/;
+  var REQUEST_CONSTANT = /^[A-Z]{2,}(?:_(?:[A-Z]{2,}|[0-9]{1,2}))*$/;
+  var BOOL_WORD = /^(?:true|false|on|off|yes|no|ja|nein)$/i;
+  var IDENT = /^[a-z][a-z0-9]*(?:[_-][a-z0-9]+)+$/;
+  var PASCAL = /^[A-Z][a-z0-9]+(?:[A-Z][a-z0-9]+)+$/;
+  var TYPE_KEY = /^(__typename|typename|type|kind|_type|@type|component|template|variant|layout|status|state|category|vertical|name)$/i;
+  function sanitizeResponseLeaf(v, inputs, seen, opts = {}) {
+    if (v === null || typeof v === "boolean") return v;
+    if (typeof v === "number") return Number.isInteger(v) && v >= 0 && v <= 9 ? v : opts.keepText && Math.abs(v) < 1e7 && !(v > 1e9) ? v : numberClass(v);
+    if (typeof v !== "string") return "\xABvalue\xBB";
+    if (opts.key && SECRET_KEY.test(opts.key) && v.length >= 6) return `\xABsecret:${v.length}\xBB`;
+    if (v.length >= 2 && v.length <= 40 && !inputs.exact(v)) {
+      if (SCREAMING.test(v) || IDENT.test(v) && !looksLikeToken(v)) return v;
+      if (PASCAL.test(v) && opts.key && TYPE_KEY.test(opts.key)) return v;
+    }
+    if (opts.keepText && v.length <= 40 && !looksPersonal(v) && !looksLikeToken(v) && !inputs.exact(v) && !inputs.replaceIn(v)) {
+      const cls = stringClass(v);
+      if (!cls.startsWith("\xABsecret") && cls !== "\xABemail\xBB" && cls !== "\xABphone\xBB") return v;
+    }
+    const exact = inputs.exact(v);
+    if (exact) {
+      seen.add(exact);
+      return `{{${exact}}}`;
+    }
+    const part = inputs.replaceIn(v);
+    if (part) {
+      for (const id of part.ids) seen.add(id);
+      return `${stringClass(v).replace(/»$/, "")} with ${part.ids.map((i) => `{{${i}}}`).join(", ")}\xBB`;
+    }
+    return stringClass(v);
+  }
+
+  // packages/builder/src/valuefree.ts
+  var MORE_KEYS = "\xAB\u2026\xBB";
+  function shapeSig(v, depth = 0) {
+    if (depth > 2) return "\u2026";
+    if (v === null) return "n";
+    if (Array.isArray(v)) return `[${v.length ? shapeSig(v[0], depth + 1) : ""}]`;
+    if (typeof v === "object") {
+      const o = v;
+      const tn = typeof o.__typename === "string" ? `:${o.__typename}` : typeof o.type === "string" && o.type.length < 40 ? `:${o.type}` : "";
+      return `{${Object.keys(o).sort().slice(0, 30).join(",")}${tn}}`;
+    }
+    return typeof v;
+  }
+  var DISC_KEYS = ["name", "key", "code", "type", "kind", "attribute", "field", "id", "label", "__typename"];
+  var CONST = /^(?:[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)*|[a-z][a-z0-9]*(?:[_.-][a-z0-9]+)+|[a-z][a-z0-9]{1,23}|[a-z]+(?:[A-Z][a-z0-9]+)+|[A-Z][a-z0-9]+(?:[A-Z][a-z0-9]+)+|[A-Z][A-Za-z0-9]*_[A-Za-z0-9_]+)$/;
+  function discriminator(arr) {
+    if (arr.length < 2 || !arr.every((x) => x && typeof x === "object" && !Array.isArray(x))) return null;
+    const first = arr[0];
+    const candidates = [...DISC_KEYS, ...Object.keys(first).filter((k) => !DISC_KEYS.includes(k) && /(name|type|key|code|kind|id)$/i.test(k))];
+    for (const k of candidates) {
+      const vals = arr.map((x) => x[k]);
+      const good = vals.filter((x) => typeof x === "string" && x.length <= 48 && CONST.test(x));
+      if (good.length < vals.length * 0.8) continue;
+      const distinct = new Set(good);
+      if (distinct.size >= 2 && distinct.size >= Math.min(arr.length, 4) / 2) return k;
+    }
+    return null;
+  }
+  function isDataKey(k) {
+    return /^-?\d+$/.test(k) || looksLikeToken(k) || looksPersonal(k) || /^\d{4}-\d{2}-\d{2}/.test(k) || /^[0-9a-f]{8}-/i.test(k);
+  }
+  function onFocus(path, focus) {
+    if (!focus) return true;
+    return focus.some((fp) => {
+      const n = Math.min(fp.length, path.length);
+      for (let i = 0; i < n; i++) if (fp[i] !== path[i]) return false;
+      return true;
+    });
+  }
+  function summary(v, o, depth, path) {
+    if (JSON.stringify(v).length <= 1500) return valueFree(v, { ...o, focus: void 0 }, depth, "", path);
+    if (Array.isArray(v)) {
+      const first = v[0];
+      if (v.length && JSON.stringify(first ?? null).length <= 600) return [valueFree(first, { ...o, focus: void 0, maxItems: 1 }, depth + 1, "", [...path, "*"]), `\xAB\u2026${v.length} items total\xBB`];
+      return [`\xAB\u2026${v.length} items total\xBB`];
+    }
+    const obj = v;
+    const out = {};
+    let nested = 0;
+    for (const [k, x] of Object.entries(obj)) {
+      if (x === null || typeof x !== "object") {
+        if (Object.keys(out).length < 25) out[isDataKey(k) ? keyMarker(k) : k] = sanitizeResponseLeaf(x, o.inputs, o.seen, { keepText: o.keepText, key: k });
+      } else if (depth < (o.offFocusDepth ?? 2) + 4 && !Array.isArray(x)) {
+        out[isDataKey(k) ? keyMarker(k) : k] = summary(x, o, depth + 1, [...path, k]);
+      } else nested++;
+    }
+    if (nested) out[MORE_KEYS] = `\xAB${nested} nested values not shown\xBB`;
+    return out;
+  }
+  function keyMarker(k) {
+    return `\xABkey:${stringClass(k).replace(/^«|»$/g, "").split(":")[0]}\xBB`;
+  }
+  function pickKeys(obj, keys, max) {
+    if (keys.length <= max) return keys;
+    const size = (x) => x === null || typeof x !== "object" ? 0 : JSON.stringify(x).length;
+    const keep = new Set([...keys].sort((a, b) => size(obj[a]) - size(obj[b])).slice(0, max));
+    return keys.filter((k) => keep.has(k));
+  }
+  function valueFree(v, o, depth = 0, key = "", path = []) {
+    const maxDepth = o.maxDepth ?? 18;
+    const maxKeys = o.maxKeys ?? 60;
+    const maxItems = o.maxItems ?? 3;
+    if (depth > maxDepth) return "\xAB\u2026deeper\xBB";
+    if (v === null || typeof v !== "object") return sanitizeResponseLeaf(v, o.inputs, o.seen, { keepText: o.keepText, key });
+    if (o.focus && depth > (o.offFocusDepth ?? 2) && !onFocus(path, o.focus)) return summary(v, o, depth, path);
+    if (Array.isArray(v)) {
+      if (v.length === 0) return [];
+      const itemPath = [...path, "*"];
+      const disc = discriminator(v);
+      if (disc) {
+        const byName = /* @__PURE__ */ new Map();
+        let bytes = 0;
+        const cap = maxItems >= 3 ? 12e3 : maxItems === 2 ? 6e3 : 3e3;
+        for (const item of v) {
+          const name = item[disc];
+          if (typeof name !== "string" || byName.has(name) || byName.size >= 40) continue;
+          const size = JSON.stringify(item).length;
+          if (byName.size >= 2 && bytes + size > cap) break;
+          byName.set(name, item);
+          bytes += size;
+        }
+        const out3 = [...byName.values()].map((x) => valueFree(x, o, depth + 1, key, itemPath));
+        if (v.length > out3.length) out3.push(`\xAB\u2026${v.length} items total\xBB`);
+        return out3;
+      }
+      const picked = [];
+      const sigs = /* @__PURE__ */ new Set();
+      for (const item of v) {
+        if (picked.length >= maxItems) break;
+        const sig = shapeSig(item);
+        if (picked.length > 0 && sigs.has(sig) && v.length > maxItems) continue;
+        sigs.add(sig);
+        picked.push(item);
+      }
+      if (!picked.length) picked.push(v[0]);
+      const head = picked[0];
+      const kindOf = (o2) => ["__typename", "component", "type", "kind", "@type"].map((k) => typeof o2[k] === "string" ? `${k}=${o2[k]}` : "").join("|");
+      const overlap = (o2) => {
+        const a = Object.keys(head);
+        const b = Object.keys(o2);
+        return a.filter((k) => b.includes(k)).length / Math.max(1, Math.min(a.length, b.length));
+      };
+      const objs = v.slice(0, 20).filter((x) => x && typeof x === "object" && !Array.isArray(x)).filter((o2) => head && typeof head === "object" && !Array.isArray(head) && kindOf(o2) === kindOf(head) && overlap(o2) >= 0.5);
+      if (objs.length > 1) {
+        const union = { ...head };
+        for (const ob of objs) for (const [k, x] of Object.entries(ob)) if (union[k] === void 0 || union[k] === null && x !== null) union[k] = x;
+        picked[0] = union;
+      }
+      const out2 = picked.map((x) => valueFree(x, o, depth + 1, key, itemPath));
+      if (v.length > out2.length) out2.push(`\xAB\u2026${v.length} items total\xBB`);
+      return out2;
+    }
+    const obj = v;
+    const keys = Object.keys(obj);
+    const dataKeys = keys.filter(isDataKey);
+    const out = {};
+    if (dataKeys.length >= 3 && dataKeys.length >= keys.length / 2) {
+      out[keyMarker(dataKeys[0])] = valueFree(obj[dataKeys[0]], o, depth + 1, "", [...path, "*"]);
+      for (const k of keys.filter((k2) => !isDataKey(k2)).slice(0, maxKeys)) out[k] = valueFree(obj[k], o, depth + 1, k, [...path, k]);
+      out[MORE_KEYS] = `\xABmap with ${dataKeys.length} keys\xBB`;
+      return out;
+    }
+    const full = new Set(pickKeys(obj, keys, maxKeys));
+    for (const k of keys.slice(0, 400)) {
+      const name = isDataKey(k) ? keyMarker(k) : k;
+      const p2 = [...path, isDataKey(k) ? "*" : k];
+      out[name] = full.has(k) ? valueFree(obj[k], o, depth + 1, k, p2) : obj[k] !== null && typeof obj[k] === "object" ? summary(obj[k], { ...o, offFocusDepth: depth }, depth + 1, p2) : valueFree(obj[k], o, depth + 1, k, p2);
+    }
+    if (keys.length > 400) out[MORE_KEYS] = `\xAB${keys.length - 400} more keys\xBB`;
+    return out;
+  }
+  function largestArrays(v, limit = 3) {
+    const sizes = /* @__PURE__ */ new Map();
+    let visited = 0;
+    const walk2 = (x, path, depth) => {
+      if (depth > 24 || x === null || typeof x !== "object" || ++visited > 2e5) return;
+      if (Array.isArray(x)) {
+        if (x.length >= 3 && x.filter((e) => e && typeof e === "object").length >= 3) {
+          const k = path.join("/");
+          const size = JSON.stringify(x).length;
+          const prev = sizes.get(k);
+          if (!prev || prev.size < size) sizes.set(k, { path, size });
+        }
+        x.slice(0, 3).forEach((e) => walk2(e, [...path, "*"], depth + 1));
+        return;
+      }
+      const keys = Object.keys(x);
+      const mapLike = keys.filter(isDataKey).length >= 3;
+      for (const k of keys) walk2(x[k], [...path, mapLike && isDataKey(k) ? "*" : k], depth + 1);
+    };
+    walk2(v, [], 0);
+    const RESULTY = /^(results?|items?|listings?|products?|adverts?|advertSummary|hits|offers?|ads|docs|records|entries|stays|homes|trips|cars|vehicles|journeys|connections|restaurants|doctors|practitioners|events|recipes|edges|nodes|searchResults|listResults|data)$/i;
+    const CONFIGY = /^(filters?|facets?|navigator\w*|aggregations?|rollouts|featureFlags|experiments?|config\w*|i18n|translations?|messages|categories|menu\w*|navigation|breadcrumbs|sortOrders?|footer|header|seo\w*|tracking\w*|analytics|initialOptimizelyDatafile|audiences|attributes|events)$/i;
+    const weight = (p) => {
+      const last = [...p].reverse().find((x) => x !== "*") ?? "";
+      let w = 1;
+      if (RESULTY.test(last)) w *= 3;
+      if (p.some((x) => CONFIGY.test(x))) w *= 0.05;
+      return w;
+    };
+    const sorted = [...sizes.values()].sort((a, b) => b.size * weight(b.path) - a.size * weight(a.path));
+    const out = [];
+    for (const c of sorted) {
+      if (out.length >= limit) break;
+      if (out.some((p) => p.length <= c.path.length && p.every((seg, i) => seg === c.path[i]))) continue;
+      out.push(c.path);
+    }
+    return out;
+  }
+  function valueFreeBudget(v, inputs, seen, maxBytes = 24e3, keepText = false) {
+    const top3 = largestArrays(v, 3);
+    const top1 = top3.slice(0, 1);
+    const steps = [
+      {},
+      { maxItems: 2 },
+      { maxItems: 2, focus: top3, offFocusDepth: 2 },
+      { maxItems: 1, focus: top3, offFocusDepth: 1 },
+      { maxItems: 1, focus: top3.slice(0, 2), offFocusDepth: 1, maxKeys: 40 },
+      { maxItems: 1, focus: top1, offFocusDepth: 1, maxKeys: 40 },
+      { maxItems: 1, focus: top1, offFocusDepth: 0, maxKeys: 30, maxDepth: 14 },
+      { maxItems: 1, focus: top1, offFocusDepth: 0, maxKeys: 15, maxDepth: 10 }
+    ];
+    let last = null;
+    for (const st of steps) {
+      if (st.focus && !st.focus.length) continue;
+      const localSeen = /* @__PURE__ */ new Set();
+      last = valueFree(v, { inputs, seen: localSeen, keepText, ...st });
+      if (JSON.stringify(last).length <= maxBytes) {
+        for (const id of localSeen) seen.add(id);
+        return { value: last, trimmed: st !== steps[0] };
+      }
+    }
+    return { value: last, trimmed: true };
+  }
+
+  // packages/builder/src/skeleton.ts
+  var DROP = /* @__PURE__ */ new Set(["style", "noscript", "template", "link", "base", "path", "g", "defs", "use", "symbol", "source", "track", "head"]);
+  var VOID_SHORT = /* @__PURE__ */ new Set(["svg", "iframe", "canvas", "video", "audio", "picture", "img", "input", "br", "hr", "wbr", "button", "meta"]);
+  var KEEP_ATTR = /* @__PURE__ */ new Set(["id", "class", "role", "name", "type", "itemprop", "itemtype", "itemscope", "for", "rel", "method", "action", "datetime", "lang", "colspan", "rowspan"]);
+  var TEXT_ATTR = /* @__PURE__ */ new Set(["aria-label", "title", "alt", "placeholder", "content", "value", "label"]);
+  var TESTID = /^data-(testid|test-id|test|qa|cy|e2e|automation|component|type|role|track|tracking|name|id|ad|sponsored|position|index|variant|item-type|listing-type)$/;
+  var NOISY_CLASS = /^(css|sc|jsx|emotion|styled|tw|chakra|mui|Mui|_)[-_][A-Za-z0-9_-]+$|^[a-zA-Z]{1,3}[0-9a-zA-Z]{5,}$|^[A-Za-z0-9_-]{30,}$/;
+  var LAYOUT_TAGS = /* @__PURE__ */ new Set(["header", "footer", "nav", "aside"]);
+  function attrs(el2) {
+    const a = el2.attributes;
+    if (!a) return [];
+    const out = [];
+    for (let i = 0; i < a.length; i++) out.push({ name: a[i].name.toLowerCase(), value: a[i].value ?? "" });
+    return out;
+  }
+  function getAttr(el2, name) {
+    const x = attrs(el2).find((a) => a.name === name);
+    return x ? x.value : null;
+  }
+  function esc(s) {
+    return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+  }
+  function hrefPattern(href, o) {
+    let u;
+    try {
+      u = new URL(href, "https://x.invalid");
+    } catch {
+      return "\xABhref\xBB";
+    }
+    if (!/^https?:$/.test(u.protocol)) return `${u.protocol}\u2026`;
+    const hash = u.hash && u.hash.length <= 40 && !looksLikeToken(u.hash.slice(1)) ? u.hash : u.hash ? "#\u2026" : "";
+    const query = u.search ? "?" + [...new Set(u.searchParams.keys())].map((k) => `${k}=\u2026`).join("&") : "";
+    const path = u.pathname.split("/").map((seg) => {
+      if (!seg) return seg;
+      const inp = o.inputs.replaceIn(seg);
+      if (inp) {
+        for (const id of inp.ids) o.seen.add(id);
+        return inp.text;
+      }
+      if (/^\d{3,}$/.test(seg)) return "\xABn\xBB";
+      if (/\d{4,}/.test(seg) && seg.length > 12) return seg.replace(/\d{4,}/g, "\xABn\xBB");
+      const c = stringClass(seg);
+      if (c.startsWith("\xABsecret") || c === "\xABuuid\xBB" || c === "\xABemail\xBB") return c;
+      return seg.length > 60 ? `\xABslug:${seg.length}\xBB` : seg;
+    }).join("/");
+    return (u.host === "x.invalid" ? "" : `${u.protocol}//${u.host}`) + path + query + hash;
+  }
+  function textMarker(raw2, o) {
+    const t = raw2.replace(/\s+/g, " ").trim();
+    if (!t) return "";
+    const exact = o.inputs.exact(t);
+    if (exact) {
+      o.seen.add(exact);
+      return `{{${exact}}}`;
+    }
+    const part = o.inputs.replaceIn(t);
+    if (part) {
+      for (const id of part.ids) o.seen.add(id);
+      if (!o.loggedIn && t.length <= 60) return esc(part.text);
+      return `${stringClass(t).replace(/»$/, "")} with ${part.ids.map((i) => `{{${i}}}`).join(", ")}\xBB`;
+    }
+    const cls = stringClass(t);
+    if (o.loggedIn) return cls;
+    if (cls.startsWith("\xABsecret") || cls === "\xABemail\xBB" || cls === "\xABphone\xBB") return cls;
+    if (t.length <= 160) return esc(t);
+    return `\xABtext:${t.length}\xBB ${esc(t.slice(0, 80))}\u2026`;
+  }
+  function shallowSig(el2) {
+    const tag = el2.nodeName.toLowerCase();
+    const cls = (getAttr(el2, "class") ?? "").split(/\s+/).filter((c) => c && !NOISY_CLASS.test(c)).sort().join(".");
+    const tid = attrs(el2).filter((a) => TESTID.test(a.name)).map((a) => `${a.name}=${/\d/.test(a.value) ? a.value.replace(/\d+/g, "N") : a.value}`).join(",");
+    return `${tag}.${cls}[${tid}]`;
+  }
+  function signature(el2, depth = 0) {
+    const own = shallowSig(el2);
+    if (depth >= 3) return own;
+    const kids = [];
+    const cn = el2.childNodes;
+    for (let i = 0; i < cn.length && kids.length < 8; i++) {
+      const k = cn[i];
+      if (k.nodeType !== 1) continue;
+      const sig = signature(k, depth + 1);
+      if (!kids.includes(sig)) kids.push(sig);
+    }
+    return kids.length ? `${own}(${kids.sort().join("|")})` : own;
+  }
+  function visibleTextLength(el2, cap = 4e3) {
+    let n = 0;
+    const walk2 = (x) => {
+      if (n >= cap) return;
+      const kids = x.childNodes;
+      for (let i = 0; i < kids.length && n < cap; i++) {
+        const k = kids[i];
+        if (k.nodeType === 3) n += (k.textContent ?? "").replace(/\s+/g, " ").trim().length;
+        else if (k.nodeType === 1 && !/^(style|script|noscript|template|svg)$/i.test(k.nodeName)) walk2(k);
+      }
+    };
+    walk2(el2);
+    return Math.min(n, cap);
+  }
+  function findMainList(body, k = 2) {
+    const found = [];
+    const visit = (el2, chain, depth) => {
+      if (depth > 40) return;
+      const counts = /* @__PURE__ */ new Map();
+      const textBySig = /* @__PURE__ */ new Map();
+      const kids = el2.childNodes;
+      for (let i = 0; i < kids.length; i++) {
+        const kid = kids[i];
+        if (kid.nodeType !== 1) continue;
+        const tag = kid.nodeName.toLowerCase();
+        if (tag === "script" || DROP.has(tag)) continue;
+        const sig = shallowSig(kid);
+        counts.set(sig, (counts.get(sig) ?? 0) + 1);
+        textBySig.set(sig, (textBySig.get(sig) ?? 0) + visibleTextLength(kid));
+      }
+      let weight = 0;
+      for (const [sig, n] of counts) {
+        if (n < 3) continue;
+        const avg = (textBySig.get(sig) ?? 0) / n;
+        const w = Math.min(n, 100) * Math.min(20, avg / 40);
+        if (w > weight) weight = w;
+      }
+      if (weight > 0) found.push({ el: el2, n: weight, chain: [...chain, el2] });
+      for (let i = 0; i < kids.length; i++) {
+        const kid = kids[i];
+        if (kid.nodeType === 1) visit(kid, [...chain, el2], depth + 1);
+      }
+    };
+    visit(body, [], 0);
+    if (!found.length) return null;
+    found.sort((a, b) => b.n - a.n);
+    const best = found[0];
+    const picks = found.filter((f, i) => i === 0 || i < k && f.n >= best.n * 0.25 && !f.chain.includes(best.el) && !best.chain.includes(f.el));
+    return { lists: new Set(picks.map((p) => p.el)), path: new Set(picks.flatMap((p) => p.chain)) };
+  }
+  function renderAttrs(el2, c) {
+    const parts = [];
+    for (const { name, value } of attrs(el2)) {
+      if (name === "class") {
+        const cls = value.split(/\s+/).filter(Boolean);
+        const kept = cls.filter((x) => x.length <= 40).slice(0, 8);
+        if (kept.length) parts.push(`class="${esc(kept.join(" "))}"`);
+      } else if (KEEP_ATTR.has(name)) {
+        if (name === "id" && /\d{5,}/.test(value)) parts.push(`id="${esc(value.replace(/\d{5,}/g, "\xABn\xBB"))}"`);
+        else if (name === "action") parts.push(`action="${esc(hrefPattern(value, c.o))}"`);
+        else if (name === "datetime") parts.push(`datetime="\xABdatetime\xBB"`);
+        else parts.push(value === "" ? name : `${name}="${esc(value.length > 80 ? value.slice(0, 80) + "\u2026" : value)}"`);
+      } else if (TESTID.test(name) || name.startsWith("data-") && value.length <= 60 && !/\s/.test(value)) {
+        const g = value.replace(/\d{4,}/g, "\xABn\xBB");
+        const v = /^\d{1,3}$/.test(value) ? value : g !== value ? g : stringClass(value).startsWith("\xABsecret") ? "\xABsecret\xBB" : value;
+        parts.push(`${name}="${esc(v)}"`);
+      } else if (name.startsWith("data-")) {
+        parts.push(`${name}="\xAB${value.length}\xBB"`);
+      } else if (name === "href") {
+        parts.push(`href="${esc(hrefPattern(value, c.o))}"`);
+      } else if (name === "src" || name === "srcset") {
+        parts.push(`${name}="\xABurl\xBB"`);
+      } else if (TEXT_ATTR.has(name)) {
+        parts.push(`${name}="${textMarker(value, c.o).replace(/"/g, "&quot;")}"`);
+      } else if (name.startsWith("aria-") || name === "disabled" || name === "checked" || name === "selected") {
+        parts.push(value === "" ? name : `${name}="${esc(value.slice(0, 30))}"`);
+      }
+    }
+    return parts.length ? " " + parts.join(" ") : "";
+  }
+  function scriptSelector(el2, c) {
+    const id = getAttr(el2, "id");
+    if (id && !/\d{6,}/.test(id)) return `script#${cssIdent(id)}`;
+    const type = getAttr(el2, "type");
+    const base = type ? `script[type="${type}"]` : "script:not([src])";
+    const n = (c.scriptIndex.get(base) ?? 0) + 1;
+    c.scriptIndex.set(base, n);
+    return n === 1 ? base : `${base} (#${n} on the page)`;
+  }
+  function cssIdent(s) {
+    return /^[A-Za-z_][\w-]*$/.test(s) ? s : s.replace(/([^\w-])/g, "\\$1");
+  }
+  function firstBalancedJson(text, from = 0) {
+    for (let i = from; i < text.length; i++) {
+      const ch = text[i];
+      if (ch !== "{" && ch !== "[") continue;
+      let depth = 0;
+      let quote = null;
+      for (let j = i; j < text.length; j++) {
+        const c = text[j];
+        if (quote) {
+          if (c === "\\") j++;
+          else if (c === quote) quote = null;
+          continue;
+        }
+        if (c === '"' || c === "'" || c === "`") quote = c;
+        else if (c === "{" || c === "[") depth++;
+        else if (c === "}" || c === "]") {
+          if (--depth === 0) {
+            try {
+              return { json: JSON.parse(text.slice(i, j + 1)), start: i, end: j + 1 };
+            } catch {
+              break;
+            }
+          }
+        }
+      }
+    }
+    return null;
+  }
+  function handleScript(el2, c) {
+    if (getAttr(el2, "src")) return;
+    const type = (getAttr(el2, "type") ?? "").toLowerCase();
+    const text = el2.textContent ?? "";
+    if (!text.trim()) return;
+    const budget = c.o.maxEmbeddedBytes ?? 24e3;
+    if (type.includes("json")) {
+      try {
+        const parsed = JSON.parse(text);
+        const sel = scriptSelector(el2, c);
+        const vf = valueFreeBudget(parsed, c.o.inputs, c.o.seen, budget, !c.o.loggedIn);
+        c.embedded.push({ selector: sel, how: "json", json: vf.value, trimmed: vf.trimmed || void 0 });
+      } catch {
+        c.hints.add(`${scriptSelector(el2, c)}: not valid JSON`);
+      }
+      return;
+    }
+    const assigns = [...text.matchAll(/(?:window|self|globalThis)((?:\.[A-Za-z_$][\w$]*|\[\s*["'][^"'\]]{1,80}["']\s*\])+)\s*=\s*(?=[{[])/g)];
+    const firstObj = firstBalancedJson(text);
+    for (const m of assigns.slice(0, 6)) {
+      const found = firstBalancedJson(text, m.index + m[0].length);
+      if (!found) continue;
+      const target = `window${m[1]}`;
+      const vf = valueFreeBudget(found.json, c.o.inputs, c.o.seen, Math.min(budget, 12e3), !c.o.loggedIn);
+      c.embedded.push({ selector: `script:not([src]) containing "${target} ="`, how: "strip_js", json: vf.value, trimmed: vf.trimmed || void 0 });
+      if (firstObj && firstObj.start !== found.start) c.hints.add(`in the script that assigns ${target}, strip_js would return an earlier object (${JSON.stringify(firstObj.json).slice(0, 20)}), not ${target}: read this data another way`);
+    }
+    if (/self\.__next_f\.push/.test(text)) c.hints.add("Next.js app router flight data in self.__next_f (data is usually in the server-rendered HTML instead)");
+    if (/__APOLLO_STATE__|__RELAY_STORE__|__INITIAL_STATE__|__PRELOADED_STATE__|__NUXT__/.test(text)) {
+      const name = /(__APOLLO_STATE__|__RELAY_STORE__|__INITIAL_STATE__|__PRELOADED_STATE__|__NUXT__)/.exec(text)[1];
+      c.hints.add(`inline state ${name}`);
+    }
+  }
+  function walk(el2, c, depth, out) {
+    const tag = el2.nodeName.toLowerCase();
+    if (tag === "script") {
+      handleScript(el2, c);
+      return;
+    }
+    if (tag === "style") {
+      if (depth < 3) return;
+      out.push("<style>\xABcss\xBB</style>");
+      c.hints.add("inline <style> elements sit inside the content (CSS-in-JS): an element's text includes that CSS, so extract from the innermost elements that hold only text, never from a card or wrapper");
+      return;
+    }
+    if (DROP.has(tag) || tag.startsWith("#")) return;
+    if (depth > 45) {
+      out.push("<!-- \u2026deeper -->");
+      return;
+    }
+    if (tag === "astro-island") {
+      const props = getAttr(el2, "props");
+      if (props) {
+        try {
+          const vf = valueFreeBudget(JSON.parse(props), c.o.inputs, c.o.seen, c.o.maxEmbeddedBytes ?? 24e3, !c.o.loggedIn);
+          const comp = getAttr(el2, "component-url") ?? "";
+          const name = /\/([A-Za-z0-9_-]+)\.[A-Za-z0-9_-]+\.js$/.exec(comp)?.[1];
+          c.embedded.push({ selector: name ? `astro-island[component-url*="${name}"]` : "astro-island", how: "astro_props", attr: "props", json: vf.value, trimmed: vf.trimmed || void 0 });
+        } catch {
+        }
+      }
+    }
+    if (tag === "meta" && !getAttr(el2, "itemprop")) return;
+    const open = `<${tag}${renderAttrs(el2, c)}>`;
+    if (VOID_SHORT.has(tag)) {
+      out.push(tag === "button" ? `${open}${textMarker(el2.textContent ?? "", c.o)}</${tag}>` : open.replace(/>$/, " />"));
+      return;
+    }
+    out.push(open);
+    if (c.compact && !c.compact.onPath.has(el2) && !c.compact.inside) {
+      if (c.compact.depthLeft <= 0) {
+        out.push("\u2026");
+        out.push(`</${tag}>`);
+        return;
+      }
+      const saved = c.compact.depthLeft;
+      c.compact.depthLeft--;
+      renderChildren(el2, c, depth, out);
+      c.compact.depthLeft = saved;
+    } else if (c.compact && !c.compact.inside && c.compact.lists.has(el2)) {
+      c.compact.inside = el2;
+      renderChildren(el2, c, depth, out);
+      c.compact.inside = null;
+    } else {
+      renderChildren(el2, c, depth, out);
+    }
+    out.push(`</${tag}>`);
+  }
+  function renderChildren(el2, c, depth, out) {
+    const kids = el2.childNodes;
+    const counts = /* @__PURE__ */ new Map();
+    const extra = /* @__PURE__ */ new Map();
+    const lastKept = /* @__PURE__ */ new Map();
+    let styled = false;
+    for (let i = 0; i < kids.length; i++) {
+      const k = kids[i];
+      if (k.nodeType === 3) {
+        const t = textMarker(k.textContent ?? "", c.o);
+        if (t) out.push(t);
+        continue;
+      }
+      if (k.nodeType !== 1) continue;
+      if (k.nodeName.toLowerCase() === "script") {
+        handleScript(k, c);
+        continue;
+      }
+      if (k.nodeName.toLowerCase() === "style") {
+        if (!styled) walk(k, c, depth + 1, out);
+        styled = true;
+        continue;
+      }
+      const sig = c.compact?.inside === el2 ? shallowSig(k) : signature(k);
+      const n = (counts.get(sig) ?? 0) + 1;
+      counts.set(sig, n);
+      if (n > c.keepRun) {
+        extra.set(sig, (extra.get(sig) ?? 0) + 1);
+        continue;
+      }
+      walk(k, c, depth + 1, out);
+      lastKept.set(sig, out.length);
+    }
+    if (extra.size) {
+      const notes = [...extra].map(([sig, n]) => ({ at: lastKept.get(sig) ?? out.length, text: `<!-- \xD7${n} more like the previous <${sig.split(/[.([]/)[0]}> -->` }));
+      notes.sort((a, b) => b.at - a.at);
+      for (const nt of notes) out.splice(nt.at, 0, nt.text);
+    }
+  }
+  function htmlSkeleton(root, o) {
+    const max = o.maxBytes ?? 4e4;
+    let result = null;
+    for (const keepRun of [2, 1]) {
+      const c = { o, keepRun, embedded: [], hints: /* @__PURE__ */ new Set(), scriptIndex: /* @__PURE__ */ new Map() };
+      const out = [];
+      visitScripts(root, c);
+      const body2 = findBody(root);
+      const bodyCtx = { ...c, embedded: [], hints: /* @__PURE__ */ new Set(), scriptIndex: c.scriptIndex };
+      if (body2) walk(body2, bodyCtx, 0, out);
+      const html2 = out.join("");
+      const embedded = dedupeEmbedded([...c.embedded, ...bodyCtx.embedded]);
+      result = { html: html2, embedded, hints: [.../* @__PURE__ */ new Set([...c.hints, ...bodyCtx.hints])], trimmed: keepRun === 1 };
+      if (html2.length <= max) return result;
+    }
+    const body = findBody(root);
+    const main2 = body ? findMainList(body) : null;
+    if (body && main2) {
+      for (const [keepRun, depthLeft] of [[3, 3], [2, 3], [2, 2], [2, 1], [1, 1]]) {
+        const c = { o, keepRun, embedded: [], hints: /* @__PURE__ */ new Set(), scriptIndex: /* @__PURE__ */ new Map(), compact: { onPath: main2.path, lists: main2.lists, inside: null, depthLeft } };
+        const out = [];
+        visitScripts(root, c);
+        walk(body, c, 0, out);
+        const html2 = out.join("").replace(/<(header|footer|nav|aside)\b[^>]*>[\s\S]*?<\/\1>/g, (m, t) => LAYOUT_TAGS.has(t) ? `<${t}>\u2026</${t}>` : m);
+        result = { html: html2, embedded: dedupeEmbedded(c.embedded), hints: [...c.hints, "compacted: the page's main list is complete, other parts are cut a few levels deep (\u2026)"], trimmed: true };
+        if (html2.length <= max) return result;
+      }
+    }
+    const r = result;
+    let html = r.html.replace(/<(header|footer|nav|aside)\b[^>]*>[\s\S]*?<\/\1>/g, (m, t) => LAYOUT_TAGS.has(t) ? `<${t}>\u2026</${t}>` : m);
+    if (html.length > max) html = html.slice(0, max) + "<!-- \u2026cut: skeleton budget reached -->";
+    return { ...r, html, trimmed: true };
+  }
+  function findBody(root) {
+    if (root.nodeName.toLowerCase() === "body") return root;
+    const kids = root.childNodes;
+    for (let i = 0; i < kids.length; i++) {
+      const k = kids[i];
+      if (k.nodeType !== 1 && k.nodeType !== 9) continue;
+      const f = findBody(k);
+      if (f) return f;
+    }
+    return null;
+  }
+  function visitScripts(root, c) {
+    const head = findHead(root);
+    if (!head) return;
+    const kids = head.childNodes;
+    for (let i = 0; i < kids.length; i++) {
+      const k = kids[i];
+      if (k.nodeType === 1 && k.nodeName.toLowerCase() === "script") handleScript(k, c);
+      if (k.nodeType === 1 && k.nodeName.toLowerCase() === "title") c.hints.add(`title: ${textMarker(k.textContent ?? "", c.o)}`);
+    }
+  }
+  function findHead(root) {
+    if (root.nodeName.toLowerCase() === "head") return root;
+    const kids = root.childNodes;
+    for (let i = 0; i < kids.length; i++) {
+      const k = kids[i];
+      if (k.nodeType !== 1 && k.nodeType !== 9) continue;
+      if (k.nodeName.toLowerCase() === "body") continue;
+      const f = findHead(k);
+      if (f) return f;
+    }
+    return null;
+  }
+  function dedupeEmbedded(list) {
+    const seen = /* @__PURE__ */ new Set();
+    return list.filter((e) => {
+      const key = `${e.selector}|${JSON.stringify(e.json).slice(0, 200)}`;
+      if (seen.has(key)) return false;
+      seen.add(key);
+      return true;
+    });
+  }
+
+  // packages/recipe/src/html.ts
+  var MAX_JSON_VALUE = 256 * 1024;
+
+  // packages/recipe/src/decoders.ts
+  function decodeTurboStream(text) {
+    const firstLine = text.split("\n", 1)[0] ?? "";
+    const values = JSON.parse(firstLine);
+    if (!Array.isArray(values)) throw new Error("turbo-stream: root is not an array");
+    const done2 = /* @__PURE__ */ new Map();
+    const hydrate = (index) => {
+      switch (index) {
+        case -1:
+        case -7:
+          return null;
+        // hole / undefined
+        case -2:
+          return null;
+        // NaN is not JSON
+        case -3:
+          return null;
+        // -Infinity
+        case -4:
+          return 0;
+        // -0
+        case -5:
+          return null;
+        case -6:
+          return null;
+      }
+      if (typeof index !== "number" || index < 0 || index >= values.length) return null;
+      if (done2.has(index)) return done2.get(index);
+      const v = values[index];
+      if (v === null || typeof v !== "object") {
+        done2.set(index, v);
+        return v;
+      }
+      if (Array.isArray(v)) {
+        if (v.length && typeof v[0] === "string") return tagged(index, v);
+        const out2 = [];
+        done2.set(index, out2);
+        for (const i of v) out2.push(hydrate(i));
+        return out2;
+      }
+      const out = {};
+      done2.set(index, out);
+      for (const [k, vi] of Object.entries(v)) {
+        const key = /^_\d+$/.test(k) ? String(values[Number(k.slice(1))]) : k;
+        out[key] = hydrate(vi);
+      }
+      return out;
+    };
+    const tagged = (index, v) => {
+      const tag = v[0];
+      let out;
+      switch (tag) {
+        case "D": {
+          const d = new Date(v[1]);
+          out = Number.isNaN(d.getTime()) ? null : d.toISOString();
+          break;
+        }
+        case "B":
+        // BigInt
+        case "U":
+        // URL
+        case "R":
+        // RegExp
+        case "Y":
+          out = String(v[1]);
+          break;
+        case "S": {
+          const arr = [];
+          done2.set(index, arr);
+          for (let i = 1; i < v.length; i++) arr.push(hydrate(v[i]));
+          return arr;
+        }
+        case "M": {
+          const obj = {};
+          done2.set(index, obj);
+          for (let i = 1; i + 1 < v.length; i += 2) obj[String(hydrate(v[i]))] = hydrate(v[i + 1]);
+          return obj;
+        }
+        case "N": {
+          const obj = {};
+          done2.set(index, obj);
+          for (let i = 1; i + 1 < v.length; i += 2) obj[String(values[v[i]])] = hydrate(v[i + 1]);
+          return obj;
+        }
+        case "E":
+          out = { error: String(v[1] ?? "") };
+          break;
+        case "P":
+        // unresolved promise (deferred data)
+        default:
+          out = null;
+      }
+      done2.set(index, out);
+      return out;
+    };
+    return hydrate(0);
+  }
+
+  // packages/recipe/src/interpreter.ts
+  var LIMITS = {
+    steps: 12,
+    foreach: 20,
+    requests: 40,
+    responseBytes: 5 * 1024 * 1024,
+    runMs: 6e4,
+    redirects: 3,
+    confirmMs: 13e4
+  };
+
+  // packages/recipe/src/lint.ts
+  var OPERAND = String.raw`(?<![\w$.@])(§S|params\s*\.\s*[A-Za-z_]\w*|\$[A-Za-z_]\w*)`;
+  var COMPARISON = new RegExp(String.raw`${OPERAND}\s*(<=|>=|<|>)|(<=|>=|<|>)\s*${OPERAND}`, "g");
+
+  // packages/recipe/src/signature.ts
+  var enc = new TextEncoder();
+
+  // packages/builder/src/trace.ts
+  var TRACE_FORMAT = "wield-trace/1";
+  var MULTI_PART_TLDS = /* @__PURE__ */ new Set([
+    "co.uk",
+    "org.uk",
+    "ac.uk",
+    "gov.uk",
+    "com.au",
+    "net.au",
+    "org.au",
+    "co.nz",
+    "co.jp",
+    "ne.jp",
+    "or.jp",
+    "com.br",
+    "com.mx",
+    "com.ar",
+    "com.tr",
+    "co.za",
+    "com.sg",
+    "com.hk",
+    "com.tw",
+    "co.kr",
+    "co.in",
+    "co.il",
+    "com.cn",
+    "com.pl",
+    "co.at",
+    "or.at",
+    "gv.at",
+    "com.ua",
+    "com.es",
+    "com.pt",
+    "com.ph",
+    "com.my",
+    "co.id",
+    "co.th",
+    "com.vn",
+    "com.sa",
+    "com.eg",
+    "com.co",
+    "com.pe",
+    "com.cl"
+  ]);
+  function registrableDomain(host) {
+    const h = host.toLowerCase().replace(/\.$/, "");
+    if (/^\d+\.\d+\.\d+\.\d+$/.test(h) || !h.includes(".")) return h;
+    const parts = h.split(".");
+    const last2 = parts.slice(-2).join(".");
+    if (parts.length >= 3 && MULTI_PART_TLDS.has(last2)) return parts.slice(-3).join(".");
+    return last2;
+  }
+  var TRACKER_HOSTS = /(^|\.)(google-analytics\.com|googletagmanager\.com|googlesyndication\.com|googleadservices\.com|doubleclick\.net|g\.doubleclick\.net|facebook\.(com|net)|fbcdn\.net|hotjar\.(com|io)|segment\.(com|io)|sentry\.io|sentry-cdn\.com|datadoghq\.(com|eu)|browser-intake[\w.-]*|nr-data\.net|newrelic\.com|optimizely\.com|criteo\.(com|net)|amazon-adsystem\.com|adnxs\.com|bing\.com|clarity\.ms|tiktok\.com|tiktokcdn\.com|linkedin\.com|licdn\.com|pinterest\.com|twitter\.com|t\.co|snapchat\.com|taboola\.com|outbrain\.com|usercentrics\.eu|onetrust\.com|cookielaw\.org|cookiebot\.com|didomi\.io|trustarc\.com|consensu\.org|go-mpulse\.net|akstat\.io|cloudflareinsights\.com|recaptcha\.net|hcaptcha\.com|gstatic\.com|fonts\.googleapis\.com|cdn\.jsdelivr\.net|cdnjs\.cloudflare\.com|braze\.(com|eu)|appsflyer\.com|adjust\.com|mixpanel\.com|amplitude\.com|heap(analytics)?\.(com|io)|fullstory\.com|mouseflow\.com|quantummetric\.com|contentsquare\.net|trustpilot\.com|zendesk\.com|intercom\.io|launchdarkly\.com|split\.io|statsig\.com|yandex\.(ru|com)|adform\.net|rubiconproject\.com|pubmatic\.com|casalemedia\.com|openx\.net|smartadserver\.com|teads\.tv|ioam\.de|xiti\.com|chartbeat\.(com|net)|kameleoon\.(com|eu)|dynatrace\.com|demdex\.net|omtrdc\.net|adobedtm\.com|everesttech\.net|perimeterx\.net|px-cloud\.net|datadome\.co|captcha-delivery\.com)$/i;
+  var NOISE_PATH = /\/(collect|beacon|beacons|log|logs|logging|metrics|telemetry|track|tracking|tracker|analytics|rum|events?|pixel|impression|impressions|ping|heartbeat|consent|cmp|gdpr|privacy-?manager|sw\.js|service-worker|manifest\.json|favicon|ads?|adserver|prebid|_vercel\/insights|cdn-cgi\/(rum|challenge-platform|bm)|akam|_sec\/|\.well-known)(\/|$|\?|\.)/i;
+  var STATIC_MIME = /^(image|font|audio|video)\/|^text\/css|javascript|ecmascript|wasm|^application\/(octet-stream|x-protobuf|manifest\+json)/i;
+  var DROP_HEADERS = /* @__PURE__ */ new Set([
+    "cookie",
+    "cookie2",
+    "set-cookie",
+    "set-cookie2",
+    "authorization",
+    "proxy-authorization",
+    "host",
+    "content-length",
+    "connection",
+    "accept-encoding",
+    "user-agent",
+    "sec-ch-ua",
+    "sec-ch-ua-mobile",
+    "sec-ch-ua-platform",
+    "sec-ch-ua-full-version-list",
+    "sec-ch-ua-arch",
+    "sec-ch-ua-bitness",
+    "sec-ch-ua-model",
+    "sec-ch-ua-platform-version",
+    "sec-ch-ua-wow64",
+    "sec-ch-prefers-color-scheme",
+    "sec-ch-viewport-width",
+    "sec-ch-dpr",
+    "viewport-width",
+    "dpr",
+    "device-memory",
+    "rtt",
+    "downlink",
+    "ect",
+    "sec-fetch-dest",
+    "sec-fetch-mode",
+    "sec-fetch-site",
+    "sec-fetch-user",
+    "sec-fetch-storage-access",
+    "priority",
+    "upgrade-insecure-requests",
+    "referer",
+    "origin",
+    "pragma",
+    "cache-control",
+    "dnt",
+    "te",
+    "if-none-match",
+    "if-modified-since",
+    "purpose",
+    "sec-purpose"
+  ]);
+  var PLAIN_HEADERS = /* @__PURE__ */ new Set(["content-type", "accept", "accept-language", "x-requested-with"]);
+  var SECRET_HEADER = /(token|csrf|xsrf|auth|session|secret|api[-_]?key|signature|bearer|jwt|cookie|password|otp|nonce|device[-_]?id|visitor[-_]?id|client[-_]?id|tracer|correlation|request[-_]?id|traceparent|tracestate|b3|sentry|x-amz|x-datadome|x-px|x-kpsdk|akamai|x-acf|x-dtc)/i;
+  function headerPairs(h) {
+    if (Array.isArray(h)) return h.map(([k, v]) => [String(k), String(v ?? "")]);
+    return Object.entries(h ?? {}).map(([k, v]) => [k, String(v ?? "")]);
+  }
+  function header(h, name) {
+    return headerPairs(h).find(([k]) => k.toLowerCase() === name)?.[1];
+  }
+  function mimeOf(c) {
+    return (c.mime || header(c.response_headers, "content-type") || "").split(";")[0].trim().toLowerCase();
+  }
+  function normType(t) {
+    const x = (t || "").toLowerCase();
+    if (x === "document" || x === "xhr" || x === "fetch") return x;
+    return "other";
+  }
+  function findOrigin(value, prior) {
+    if (!value || value.length < 8) return null;
+    for (const p of prior) {
+      for (const c of p.setCookies) if (c.value && c.value.length >= 8 && (c.value === value || value.includes(c.value))) return `#${p.n} Set-Cookie ${c.name}`;
+      const t = p.text;
+      if (!t) continue;
+      const i = t.indexOf(value);
+      if (i < 0) continue;
+      const before = t.slice(Math.max(0, i - 200), i);
+      const meta = /<meta[^>]*\b(?:name|property|itemprop)=["']([^"']+)["'][^>]*content=["']$/i.exec(before);
+      if (meta) return `#${p.n} html meta[name="${meta[1]}"]`;
+      const input = /<input[^>]*\bname=["']([^"']+)["'][^>]*value=["']$/i.exec(before);
+      if (input) return `#${p.n} html input[name="${input[1]}"]`;
+      const key = /["']?([A-Za-z0-9_$.-]+)["']?\s*[:=]\s*\\?["']$/.exec(before);
+      if (key) return `#${p.n} ${p.isJson ? "json key" : "inline script/attribute"} "${key[1]}"`;
+      return `#${p.n} ${p.mime || "response"} body`;
+    }
+    return null;
+  }
+  var ID_KEY = /(?:^|[_-])(?:id|sku)$|[a-z0-9](?:Id|ID|Sku)$|^(?:ID|SKU)$/;
+  var SHORT_ID = "\0id:";
+  function jsonIndex(v) {
+    const idx = /* @__PURE__ */ new Map();
+    let count = 0;
+    const walk2 = (x, path, depth, key) => {
+      if (depth > 25 || ++count > 2e5) return;
+      if (typeof x === "string" || typeof x === "number") {
+        const k = String(x);
+        const long = typeof x === "string" ? k.length >= 4 && k.length <= 300 : k.replace(/\D/g, "").length >= 4;
+        if (long) {
+          if (!idx.has(k)) idx.set(k, path);
+        } else if (k.length >= 2 && ID_KEY.test(key) && !idx.has(SHORT_ID + k)) idx.set(SHORT_ID + k, path);
+      } else if (Array.isArray(x)) x.slice(0, 50).forEach((e, i) => walk2(e, `${path}[${i}]`, depth + 1, key));
+      else if (x && typeof x === "object") for (const [k, e] of Object.entries(x)) walk2(e, /^[A-Za-z_$][\w$]*$/.test(k) ? `${path}.${k}` : `${path}[${JSON.stringify(k)}]`, depth + 1, k);
+    };
+    walk2(v, "$", 0, "");
+    return idx;
+  }
+  function leafKey(where) {
+    const m = /([A-Za-z_$][\w$-]*)(?:\[\d+\])*$/.exec(where.replace(/^(query|form|header|body)\s+/, ""));
+    return m?.[1] ?? "";
+  }
+  function valueSource(value, prior, shortId = false) {
+    for (let i = prior.length - 1; i >= 0; i--) {
+      const p = prior[i];
+      if (p.isJson && p.text) {
+        if (p.index === void 0) {
+          try {
+            p.index = jsonIndex(JSON.parse(p.text));
+          } catch {
+            p.index = null;
+          }
+        }
+        const hit = p.index?.get(shortId ? SHORT_ID + value : value);
+        if (hit) return `#${p.n} json ${hit}`;
+        continue;
+      }
+      if (shortId) continue;
+      const loc = findOrigin(value, [p]);
+      if (loc && (!loc.endsWith(" body") || idLike(value))) return loc;
+    }
+    return null;
+  }
+  function idLike(v) {
+    if (/[\s<>"']/.test(v)) return false;
+    if (looksLikeToken(v)) return true;
+    return /\d/.test(v) && !/^«(date|datetime|time|price|decimal-string)/.test(stringClass(v));
+  }
+  function isDomSnapshot(c) {
+    if (c.dom_snapshot !== void 0) return c.dom_snapshot;
+    return normType(c.type) === "document" && headerPairs(c.response_headers).length === 0;
+  }
+  var DOM_SNAPSHOT_HINT = "DOM snapshot: the recorder saw this page's DOM after its scripts ran, not the server's HTML. Elements rendered by JavaScript may be missing when the recipe fetches the page: prefer embedded JSON islands and server-rendered markup, and trust the live test over this skeleton";
+  function tryJson(t) {
+    if (!t) return void 0;
+    const s = t.trim();
+    if (!(s.startsWith("{") || s.startsWith("["))) return void 0;
+    try {
+      return JSON.parse(s);
+    } catch {
+      return void 0;
+    }
+  }
+  function sanitizeUrl(raw2, s) {
+    const u = new URL(raw2);
+    const path = u.pathname.split("/").map((seg) => {
+      if (!seg) return seg;
+      let dec = seg;
+      try {
+        dec = decodeURIComponent(seg);
+      } catch {
+      }
+      const exact = s.inputs.exact(dec) ?? s.inputs.exact(seg);
+      if (exact) return `{{${exact}}}`;
+      const part = s.inputs.replaceIn(seg);
+      if (part) return part.text;
+      if (looksLikeToken(dec)) {
+        s.secrets.add(seg);
+        s.secrets.add(dec);
+        const from = findOrigin(dec, s.prior);
+        return `\xABsecret:${dec.length}${from ? ` from ${from}` : ""}\xBB`;
+      }
+      if (looksPersonal(dec)) {
+        s.secrets.add(seg);
+        s.secrets.add(dec);
+        return stringClass(dec);
+      }
+      return seg;
+    }).join("/");
+    const query = [];
+    for (const [k, v] of u.searchParams) {
+      let val = sanitizeRequestLeaf(v, { key: k, loggedIn: s.loggedIn, inputs: s.inputs, secrets: s.secrets });
+      if (typeof val === "string" && val.startsWith("\xABsecret")) {
+        const from = findOrigin(v, s.prior);
+        if (from) val = val.replace(/»$/, ` from ${from}\xBB`);
+      }
+      query.push([k, val]);
+    }
+    return { url: `${u.origin}${path}`, query };
+  }
+  function sanitizeJsonBody(v, s, key = "", depth = 0) {
+    if (depth > 30) return "\xAB\u2026deeper\xBB";
+    if (Array.isArray(v)) return v.slice(0, 20).map((x) => sanitizeJsonBody(x, s, key, depth + 1));
+    if (v && typeof v === "object") {
+      const out = {};
+      for (const [k, val] of Object.entries(v)) {
+        const safeKey = looksPersonal(k) || looksLikeToken(k) ? "\xABkey\xBB" : k;
+        out[safeKey] = sanitizeJsonBody(val, s, k, depth + 1);
+      }
+      return out;
+    }
+    const r = sanitizeRequestLeaf(v, { key, loggedIn: s.loggedIn, inputs: s.inputs, secrets: s.secrets });
+    if (typeof r === "string" && r.startsWith("\xABsecret") && typeof v === "string") {
+      const from = findOrigin(v, s.prior);
+      if (from) return r.replace(/»$/, ` from ${from}\xBB`);
+    }
+    return r;
+  }
+  function sanitizeBody(c, s) {
+    const text = c.request_body;
+    if (text === void 0 || text === null || text === "") return void 0;
+    const ct = (header(c.request_headers, "content-type") || "").split(";")[0].trim().toLowerCase();
+    const j = tryJson(text);
+    if (j !== void 0) return { type: "json", value: sanitizeJsonBody(j, s) };
+    if (ct.includes("x-www-form-urlencoded") || /^[^=&\s]+=[^&]*(&[^=&\s]+=[^&]*)*$/.test(text)) {
+      const fields = [];
+      for (const [k, v] of new URLSearchParams(text)) fields.push([k, sanitizeRequestLeaf(v, { key: k, loggedIn: s.loggedIn, inputs: s.inputs, secrets: s.secrets })]);
+      return { type: "form", fields };
+    }
+    if (/^https?:\/\/\S+$/.test(text.trim())) collectUrlSecrets(text.trim(), { key: "", loggedIn: s.loggedIn, inputs: s.inputs, secrets: s.secrets });
+    else if (text.length >= 4) s.secrets.add(text);
+    const part = s.inputs.replaceIn(text);
+    return { type: ct.startsWith("text/") ? "text" : "other", mime: ct || "?", length: text.length, inputs: part?.ids };
+  }
+  function sanitizeHeaders(c, s) {
+    const out = [];
+    let sendsCookies = false;
+    for (const [rawName, value] of headerPairs(c.request_headers)) {
+      const name = rawName.toLowerCase();
+      if (name.startsWith(":")) continue;
+      if (name === "cookie" || name === "cookie2") {
+        sendsCookies = true;
+        for (const part of value.split(";")) {
+          const v = part.split("=").slice(1).join("=").trim();
+          if (v.length >= 6) s.secrets.add(v);
+        }
+        continue;
+      }
+      if (name === "authorization" || name === "proxy-authorization") {
+        const v = value.replace(/^(Bearer|Basic|Token)\s+/i, "");
+        if (v) s.secrets.add(v);
+        const scheme = /^(Bearer|Basic|Token)\s/i.exec(value)?.[1];
+        const from = findOrigin(v, s.prior);
+        out.push([rawName, `${scheme ? scheme + " " : ""}\xABsecret:${v.length}${from ? ` from ${from}` : ""}\xBB`]);
+        continue;
+      }
+      if (DROP_HEADERS.has(name)) continue;
+      if (PLAIN_HEADERS.has(name)) {
+        out.push([rawName, value]);
+        continue;
+      }
+      if (SECRET_HEADER.test(name) || looksLikeToken(value)) {
+        const v = value.replace(/^Bearer\s+/i, "");
+        if (v.length >= 4) s.secrets.add(v);
+        const from = findOrigin(v, s.prior);
+        out.push([rawName, `\xABsecret:${v.length}${from ? ` from ${from}` : ""}\xBB`]);
+        continue;
+      }
+      if (looksPersonal(value)) {
+        s.secrets.add(value);
+        out.push([rawName, "\xABpersonal\xBB"]);
+        continue;
+      }
+      const inp = s.inputs.replaceIn(value);
+      out.push([rawName, inp ? inp.text : value.length > 120 ? `\xAB${value.length} chars\xBB` : value]);
+    }
+    return { headers: out, sendsCookies };
+  }
+  function setCookiesOf(c) {
+    return headerPairs(c.response_headers).filter(([k]) => k.toLowerCase() === "set-cookie").flatMap(([, v]) => v.split(/\n/)).map((line) => {
+      const m = /^([^=]+)=([^;]*)/.exec(line || "");
+      return m ? { name: m[1].trim(), value: m[2] } : { name: "?", value: "" };
+    });
+  }
+  function dropReason(c, siteDomain, keepThirdParty) {
+    let u;
+    try {
+      u = new URL(c.url);
+    } catch {
+      return "bad-url";
+    }
+    if (u.protocol !== "https:" && u.protocol !== "http:") return "scheme";
+    if (TRACKER_HOSTS.test(u.hostname)) return "tracker";
+    const type = (c.type || "").toLowerCase();
+    const mime = mimeOf(c);
+    if (type !== "document" && STATIC_MIME.test(mime)) return "static";
+    if (["script", "stylesheet", "image", "font", "media", "manifest", "texttrack", "ping", "cspviolationreport", "websocket", "eventsource", "preflight", "signedexchange", "prefetch"].includes(type)) return "static";
+    if (c.method === "OPTIONS") return "preflight";
+    if (NOISE_PATH.test(u.pathname)) return "noise";
+    const sameSite = registrableDomain(u.hostname) === siteDomain;
+    if (!sameSite) {
+      if (!keepThirdParty) return "third-party";
+      if (type === "document") return "third-party";
+      const looksApi = /json|graphql/.test(mime) || /\/(api|graphql|v\d+|search|suche)(\/|$)/i.test(u.pathname);
+      if (!looksApi) return "third-party";
+    }
+    if (c.status === 0) return "failed";
+    if (c.status === 204 && type !== "document") return "empty";
+    return null;
+  }
+  function requestLeaves(c) {
+    const out = [];
+    let u;
+    try {
+      u = new URL(c.url);
+    } catch {
+      return out;
+    }
+    u.pathname.split("/").forEach((seg, i) => {
+      if (!seg) return;
+      let d = seg;
+      try {
+        d = decodeURIComponent(seg);
+      } catch {
+      }
+      out.push([`path[${i}]`, d]);
+    });
+    for (const [k, v] of u.searchParams) out.push([`query ${k}`, v]);
+    for (const [k, v] of headerPairs(c.request_headers)) {
+      const name = k.toLowerCase();
+      if (DROP_HEADERS.has(name) || PLAIN_HEADERS.has(name) || name.startsWith(":")) continue;
+      out.push([`header ${k}`, v.replace(/^Bearer\s+/i, "")]);
+    }
+    const body = c.request_body;
+    if (body) {
+      const j = tryJson(body);
+      if (j !== void 0) {
+        const walk2 = (x, path, depth) => {
+          if (depth > 20 || out.length > 300) return;
+          if (typeof x === "string" || typeof x === "number") out.push([`body ${path}`, String(x)]);
+          else if (Array.isArray(x)) x.slice(0, 20).forEach((e, i) => walk2(e, `${path}[${i}]`, depth + 1));
+          else if (x && typeof x === "object") for (const [k, e] of Object.entries(x)) walk2(e, `${path}.${k}`, depth + 1);
+        };
+        walk2(j, "$", 0);
+      } else if (/^[^=&\s]+=[^&]*(&[^=&\s]+=[^&]*)*$/.test(body)) {
+        for (const [k, v] of new URLSearchParams(body)) out.push([`form ${k}`, v]);
+      }
+    }
+    return out;
+  }
+  function buildTrace(raw2, opts = {}) {
+    const origin = new URL(raw2.origin).origin;
+    const siteDomain = registrableDomain(new URL(origin).hostname);
+    const inputs = raw2.inputs.map((x, i) => ({ id: x.id ?? `in${i + 1}`, value: String(x.value ?? "") }));
+    const s = { inputs: new InputMatcher(inputs), secrets: /* @__PURE__ */ new Set(), loggedIn: !!raw2.logged_in, prior: [] };
+    const calls = [];
+    const reasons = {};
+    let dropped = 0;
+    const keepThirdParty = opts.keepThirdParty ?? true;
+    const links = [];
+    raw2.calls.forEach((c, idx) => {
+      const n = idx + 1;
+      const text = c.response_body ?? "";
+      const mime = mimeOf(c);
+      const setCookies = setCookiesOf(c);
+      for (const ck of setCookies) if (ck.value.length >= 6) s.secrets.add(ck.value);
+      const why = dropReason(c, siteDomain, keepThirdParty);
+      if (why) {
+        dropped++;
+        reasons[why] = (reasons[why] ?? 0) + 1;
+        sanitizeHeaders(c, s);
+        s.prior.push({ n, text, mime, isJson: mime.includes("json"), setCookies });
+        return;
+      }
+      const { headers, sendsCookies } = sanitizeHeaders(c, s);
+      const { url, query } = sanitizeUrl(c.url, s);
+      const body = sanitizeBody(c, s);
+      const location2 = header(c.response_headers, "location");
+      const call = {
+        n,
+        t_ms: Math.max(0, Math.round(c.t_ms)),
+        type: normType(c.type),
+        method: c.method.toUpperCase(),
+        url,
+        query,
+        headers,
+        sends_cookies: sendsCookies,
+        status: c.status,
+        mime,
+        size: c.size ?? text.length
+      };
+      if (body) call.body = body;
+      if (location2) {
+        try {
+          const r = sanitizeUrl(new URL(location2, c.url).toString(), s);
+          call.redirect = r.url + (r.query.length ? "?" + r.query.map(([k, v]) => `${k}=${String(v)}`).join("&") : "");
+        } catch {
+          call.redirect = "\xABredirect\xBB";
+        }
+      }
+      if (setCookies.length) call.sets_cookies = [...new Set(setCookies.map((x) => x.name))];
+      for (const [where, value] of requestLeaves(c)) {
+        if (links.length >= 60 || s.inputs.exact(value)) continue;
+        const shortId = value.length < 4;
+        if (shortId && (value.length < 2 || !ID_KEY.test(leafKey(where)))) continue;
+        const from = valueSource(value, s.prior, shortId);
+        if (from && !from.startsWith(`#${n} `)) links.push({ to: `#${n} ${where}`, from });
+      }
+      if (registrableDomain(new URL(c.url).hostname) !== siteDomain) call.third_party = true;
+      call.response = sanitizeResponse(text, mime, s, opts);
+      if (call.response?.html !== void 0 && isDomSnapshot(c)) call.response.hints = [DOM_SNAPSHOT_HINT, ...call.response.hints ?? []];
+      calls.push(call);
+      s.prior.push({ n, text, mime, isJson: mime.includes("json"), setCookies });
+    });
+    const trace2 = {
+      format: TRACE_FORMAT,
+      recorded_at: raw2.recorded_at ?? (/* @__PURE__ */ new Date()).toISOString(),
+      recorder: raw2.recorder,
+      site: { origin, ...raw2.page_path ? { page_path: sanitizeUrl(origin + raw2.page_path, s).url.slice(origin.length) } : {} },
+      task: raw2.task,
+      logged_in: !!raw2.logged_in,
+      inputs: raw2.inputs.map((x, i) => ({
+        id: x.id ?? `in${i + 1}`,
+        label: x.label.slice(0, 80),
+        kind: x.kind ?? "text",
+        ...raw2.share_examples && !looksPersonal(x.value) ? { example: String(x.value) } : {}
+      })),
+      calls,
+      dropped: { calls: dropped, reasons },
+      ...links.length ? { links } : {}
+    };
+    const forbidden = new Set(s.secrets);
+    if (!raw2.share_examples) for (const f of s.inputs.allForms()) forbidden.add(f);
+    return scrubTrace(trace2, forbidden);
+  }
+  function sanitizeResponse(text, mime, s, opts) {
+    if (!text) return void 0;
+    const seen = /* @__PURE__ */ new Set();
+    const out = {};
+    const asJson = mime.includes("json") || mime === "" ? tryJson(text) : void 0;
+    let turbo;
+    if (asJson === void 0 && /^\[\{"_\d+"/.test(text.trimStart())) {
+      try {
+        turbo = decodeTurboStream(text);
+      } catch {
+        turbo = void 0;
+      }
+    }
+    if (turbo !== void 0) {
+      const vf = valueFreeBudget(turbo, s.inputs, seen, 24e3, !s.loggedIn);
+      out.json = vf.value;
+      out.decoded_from = "turbo_stream";
+      out.hints = ['React Router turbo-stream (single fetch), shown decoded: use parse "turbo_stream"'];
+      if (vf.trimmed) out.trimmed = true;
+    } else if (asJson !== void 0) {
+      const vf = valueFreeBudget(asJson, s.inputs, seen, 24e3, !s.loggedIn);
+      out.json = vf.value;
+      if (vf.trimmed) out.trimmed = true;
+    } else if (mime.includes("html")) {
+      if (opts.parseHtml) {
+        const parsed = opts.parseHtml(text);
+        const root = parsed.documentElement ?? parsed;
+        const sk = htmlSkeleton(root, { inputs: s.inputs, seen, loggedIn: s.loggedIn });
+        out.html = sk.html;
+        if (sk.embedded.length) out.embedded = sk.embedded;
+        if (sk.hints.length) out.hints = sk.hints;
+        if (sk.trimmed) out.trimmed = true;
+      } else {
+        out.hints = ["html (no parser available in the recorder)"];
+      }
+      const metas = [...text.matchAll(/<meta[^>]*\bname=["']([^"']*(?:csrf|token|xsrf|key)[^"']*)["']/gi)].map((m) => m[1]);
+      if (metas.length) out.hints = [...out.hints ?? [], `token meta tags: ${[...new Set(metas)].join(", ")}`];
+    } else if (mime.includes("json")) {
+      out.hints = [`json body that does not parse (${text.length} chars; truncated by the recorder?)`];
+    } else if (mime.startsWith("text/") || mime.includes("xml") || mime.includes("x-component") || mime.includes("turbo")) {
+      out.hints = [`${mime || "text"} body, ${text.length} chars${/^\[\[|^\[\{"_\d/.test(text.trim()) ? " (looks like a React Router turbo-stream)" : ""}`];
+      for (const id of s.inputs.replaceIn(text)?.ids ?? []) seen.add(id);
+    } else {
+      return void 0;
+    }
+    if (seen.size) out.inputs_seen = [...seen].sort();
+    return out;
+  }
+  function scrubTrace(trace2, forbidden) {
+    const list = [...forbidden].filter((x) => typeof x === "string" && x.length >= 4 && !/^\{\{in\d+\}\}$/.test(x)).sort((a, b) => b.length - a.length);
+    if (!list.length) return trace2;
+    const long = list.filter((x) => x.length >= 6);
+    const short = list.filter((x) => x.length < 6).map((x) => new RegExp(`(?<![\\w-])${x.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![\\w-])`, "g"));
+    const fix = (str) => {
+      let t = str;
+      for (const f of long) if (t.includes(f)) t = t.split(f).join("\xABredacted\xBB");
+      for (const re of short) t = t.replace(re, "\xABredacted\xBB");
+      return t;
+    };
+    const walk2 = (v) => {
+      if (typeof v === "string") return fix(v);
+      if (Array.isArray(v)) return v.map(walk2);
+      if (v && typeof v === "object") {
+        const out = {};
+        for (const [k, val] of Object.entries(v)) out[fix(k)] = walk2(val);
+        return out;
+      }
+      return v;
+    };
+    return walk2(trace2);
+  }
+  function validateTrace(t) {
+    const p = [];
+    const err = (path, message) => p.push({ path, message });
+    if (!t || typeof t !== "object") return [{ path: "/", message: "trace must be an object" }];
+    const x = t;
+    if (x.format !== TRACE_FORMAT) err("/format", `must be "${TRACE_FORMAT}"`);
+    if (typeof x.task !== "string" || !x.task.trim() || x.task.length > 300) err("/task", "a task of 1\u2013300 characters is required");
+    try {
+      if (!x.site || new URL(x.site.origin).origin !== x.site.origin || !x.site.origin.startsWith("https://")) err("/site/origin", "must be an https origin");
+    } catch {
+      err("/site/origin", "must be an https origin");
+    }
+    if (!Array.isArray(x.inputs)) err("/inputs", "must be an array");
+    if (!Array.isArray(x.calls) || x.calls.length === 0) err("/calls", "at least one call is required");
+    else if (x.calls.length > 200) err("/calls", "at most 200 calls");
+    const size = JSON.stringify(t).length;
+    if (size > 15e5) err("/", `trace is ${Math.round(size / 1024)} KB; the limit is 1.5 MB`);
+    const walk2 = (v, path, key) => {
+      if (p.length > 20) return;
+      if (typeof v === "string") {
+        if (v.startsWith("\xAB") || /\{\{in\d+\}\}/.test(v)) return;
+        if (/^(Bearer|Basic)\s+[A-Za-z0-9._~+/-]{12,}/.test(v)) err(path, "an Authorization value was not redacted");
+        else if (key !== "html" && /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\./.test(v)) err(path, "a JWT was not redacted");
+        else if (SECRET_KEY.test(key) && looksLikeToken(v) && !/^sha256Hash$/i.test(key)) err(path, `value under "${key}" looks like an unredacted secret`);
+        return;
+      }
+      if (Array.isArray(v)) {
+        if (v.length === 2 && typeof v[0] === "string" && typeof v[1] === "string" && /^(cookie|cookie2|authorization|proxy-authorization)$/i.test(v[0]) && !/«secret[^»]*»/.test(v[1])) err(path, `${v[0]} header value must be redacted`);
+        v.forEach((e, i) => walk2(e, `${path}/${i}`, Array.isArray(e) ? key : typeof v[0] === "string" && i === 1 ? String(v[0]) : key));
+        return;
+      }
+      if (v && typeof v === "object") for (const [k, val] of Object.entries(v)) walk2(val, `${path}/${k}`, k);
+    };
+    walk2(t, "", "");
+    return p;
+  }
+
+  // apps/extension/src/shared/capture.ts
+  var KIND = {
+    text: "text",
+    search: "text",
+    email: "text",
+    tel: "text",
+    url: "text",
+    textarea: "text",
+    number: "number",
+    range: "number",
+    date: "date",
+    month: "date",
+    week: "date",
+    time: "time",
+    "datetime-local": "datetime",
+    "select-one": "select",
+    "select-multiple": "select",
+    select: "select",
+    checkbox: "checkbox",
+    radio: "checkbox"
+  };
+  function toBuilderCapture(raw2, opts) {
+    const firstDoc = raw2.entries.find((e) => e.resource_type === "Document" && safeOrigin(e.url) === raw2.origin);
+    return {
+      origin: raw2.origin,
+      ...firstDoc ? { page_path: new URL(firstDoc.url).pathname } : {},
+      task: (raw2.task.trim() || `A task on ${new URL(raw2.origin).host}`).slice(0, 300),
+      logged_in: opts.loggedIn,
+      inputs: raw2.typed.filter((t) => t.value.trim() !== "").map((t) => ({ label: t.label || t.name || t.input_type, kind: KIND[t.input_type] ?? "other", value: t.value })),
+      calls: raw2.entries.map((e) => ({
+        method: e.method,
+        url: e.url,
+        type: e.resource_type.toLowerCase(),
+        t_ms: e.t_ms,
+        request_headers: e.request_headers ?? {},
+        request_body: e.post_data ?? null,
+        status: e.failed ? 0 : e.status ?? 0,
+        response_headers: e.response_headers ?? {},
+        ...e.mime ? { mime: e.mime } : {},
+        response_body: e.body ?? null,
+        ...e.body_bytes !== void 0 ? { size: e.body_bytes } : {}
+      })),
+      recorder: { name: "wield-extension", version: raw2.extension_version },
+      recorded_at: raw2.started_at,
+      share_examples: false
+    };
+  }
+  function safeOrigin(u) {
+    try {
+      return new URL(u).origin;
+    } catch {
+      return null;
+    }
+  }
+  function makeTrace(raw2, parseHtml, opts) {
+    const trace2 = buildTrace(toBuilderCapture(raw2, opts), { parseHtml: (h) => parseHtml(h) });
+    const problems = [...validateTrace(trace2).map((p) => `${p.message} (at ${p.path || "/"})`), ...leaks(trace2, raw2)];
+    return { trace: trace2, problems: [...new Set(problems)] };
+  }
+  var AUTH_HEADERS = /* @__PURE__ */ new Set(["authorization", "proxy-authorization", "cookie", "x-csrf-token", "x-xsrf-token", "x-auth-token", "x-api-key", "x-access-token"]);
+  function leaks(trace2, raw2) {
+    const out = JSON.stringify(trace2).toLowerCase();
+    const has = (v) => {
+      const s = v.trim().toLowerCase();
+      return s.length >= 3 && (out.includes(s) || out.includes(encodeURIComponent(s).toLowerCase()));
+    };
+    const found = [];
+    for (const t of raw2.typed) if (has(t.value)) found.push(`what you typed in \u201C${t.label || t.name || "a field"}\u201D`);
+    for (const e of raw2.entries) {
+      for (const [k, v] of Object.entries(e.request_headers ?? {})) {
+        const key = k.toLowerCase();
+        if (key === "cookie") {
+          for (const part of v.split(";")) {
+            const val = part.split("=").slice(1).join("=").trim();
+            if (val.length >= 8 && has(val)) found.push("a cookie value");
+          }
+        } else if (AUTH_HEADERS.has(key)) {
+          const val = v.replace(/^(bearer|basic|token)\s+/i, "");
+          if (val.length >= 8 && has(val.slice(0, 40))) found.push(`the ${k} header`);
+        }
+      }
+      for (const [k, v] of Object.entries(e.response_headers ?? {})) {
+        if (k.toLowerCase() !== "set-cookie") continue;
+        for (const line of v.split("\n")) {
+          const val = line.split(";")[0].split("=").slice(1).join("=").trim();
+          if (val.length >= 8 && has(val)) found.push("a Set-Cookie value");
+        }
+      }
+    }
+    return [...new Set(found)];
+  }
+
+  // apps/extension/src/ui/record.ts
+  var $ = (id) => document.getElementById(id);
+  var rec_id = location.hash.slice(1);
+  var trace = null;
+  var raw = null;
+  function el(tag, cls, text) {
+    const e = document.createElement(tag);
+    if (cls) e.className = cls;
+    if (text !== void 0) e.textContent = text;
+    return e;
+  }
+  function setButtons(on) {
+    for (const id of ["send", "discard", "download"]) $(id).disabled = !on;
+  }
+  function done(msg, state) {
+    setButtons(false);
+    $("public").disabled = true;
+    $("state").textContent = state;
+    $("note").textContent = msg;
+  }
+  var plural = (k, one, many) => `${k} ${k === 1 ? one : many}`;
+  var LOGIN_HEADERS = /^(authorization|proxy-authorization|x-csrf-token|x-xsrf-token|x-auth-token|x-api-key|x-access-token)$/i;
+  function render(r, loggedIn) {
+    const built = makeTrace(r, (html) => new DOMParser().parseFromString(html, "text/html"), { loggedIn });
+    trace = built.trace;
+    const t = built.trace;
+    const host = new URL(r.origin).host;
+    $("title").textContent = t.task;
+    $("sub").textContent = `${host} \xB7 ${Math.round(r.duration_ms / 1e3)} s \xB7 ${plural(t.calls.length, "request", "requests")} kept of ${r.entries.length} captured`;
+    const json = JSON.stringify(t);
+    const markers = (json.match(/«secret[^»]*»|«redacted»/g) ?? []).length;
+    const withCookies = r.entries.filter((e) => Object.keys(e.request_headers ?? {}).some((k) => k.toLowerCase() === "cookie")).length;
+    const loginHeaders = r.entries.reduce((n, e) => n + Object.keys(e.request_headers ?? {}).filter((k) => LOGIN_HEADERS.test(k)).length, 0);
+    const reasons = Object.entries(t.dropped.reasons).sort((a, b) => b[1] - a[1]).slice(0, 3).map(([k, v]) => `${v} ${k}`).join(", ");
+    const hosts = [...new Set(t.calls.map((c) => {
+      try {
+        return new URL(c.url).host;
+      } catch {
+        return host;
+      }
+    }))];
+    const facts = [
+      ["kept", `${plural(t.calls.length, "request", "requests")} to ${hosts.join(", ") || host}`],
+      ["param", t.inputs.length ? `${plural(t.inputs.length, "value", "values")} you typed became ${t.inputs.length === 1 ? "a placeholder" : "placeholders"}: ${t.inputs.map((i) => `{{${i.id}}} \u201C${i.label}\u201D`).join(", ")}` : "No typed values detected"],
+      ["removed", `Removed: the cookies of ${plural(withCookies, "request", "requests")}, ${plural(loginHeaders, "login header", "login headers")}, ${plural(t.dropped.calls, "unrelated request", "unrelated requests")}${reasons ? ` (${reasons})` : ""}`],
+      ["linked", `${plural(markers, "token or secret", "tokens or secrets")} replaced by markers; response values replaced by their kind (\xABprice\xBB, \xABdate\xBB, \xABtext:24\xBB)${t.links?.length ? `; ${plural(t.links.length, "value", "values")} that a response passed to a later request, by location only` : ""}`]
+    ];
+    $("facts").replaceChildren(...facts.map(([k, text]) => el("li", `rec-fact rec-fact-${k}`, text)));
+    $("requests").replaceChildren(
+      ...t.calls.map((c) => {
+        const li = el("li", "rec-request");
+        const line = el("div", "rec-line");
+        let where = c.url;
+        try {
+          const u = new URL(c.url);
+          where = `${u.host}${decodeURI(u.pathname)}`;
+        } catch {
+        }
+        line.append(el("span", "rec-method", c.method), el("span", "rec-path", where), el("span", "rec-status", String(c.status)));
+        li.append(line);
+        const bits = [];
+        if (c.query.length) bits.push(`query: ${c.query.map(([k]) => k).join(", ")}`);
+        if (c.body?.type === "json") bits.push("JSON body (shape and placeholders)");
+        if (c.body?.type === "form") bits.push(`form: ${c.body.fields.map(([k]) => k).join(", ")}`);
+        if (c.response?.json !== void 0) bits.push(`response: value-free JSON${c.mime ? ` (${c.mime})` : ""}`);
+        else if (c.response?.html) bits.push(`response: HTML skeleton${c.response.embedded?.length ? ` + ${plural(c.response.embedded.length, "data island", "data islands")}` : ""}`);
+        if (c.sends_cookies) bits.push("sent with your cookies (not included)");
+        if (bits.length) li.append(el("p", "rec-detail", bits.join(" \xB7 ")));
+        return li;
+      })
+    );
+    $("json").textContent = JSON.stringify(t, null, 2);
+    const err = $("error");
+    if (built.problems.length) {
+      err.hidden = false;
+      err.textContent = `Not sendable: ${built.problems.slice(0, 3).join("; ")}. This is a bug in Wield; please discard and report it.`;
+      setButtons(false);
+      $("discard").disabled = false;
+      return;
+    }
+    err.hidden = true;
+    setButtons(true);
+  }
+  async function main() {
+    const key = `rec:${rec_id}`;
+    raw = (await chrome.storage.session.get(key))[key] ?? null;
+    if (!raw) return done("This recording is gone (sent, discarded or expired). Nothing was sent from this page.", "Gone");
+    render(raw, true);
+    const pub = $("public");
+    pub.disabled = false;
+    pub.addEventListener("change", () => raw && render(raw, !pub.checked));
+    if (!$("send").disabled) $("send").focus();
+  }
+  $("send").addEventListener("click", async () => {
+    if (!trace) return;
+    setButtons(false);
+    const r = await chrome.runtime.sendMessage({ type: "record_send", rec_id, trace });
+    done(r.message, r.delivered === "agent" ? "Sent" : r.delivered === "refused" ? "Not sent" : "Saved");
+    $("download").disabled = false;
+  });
+  $("discard").addEventListener("click", async () => {
+    await chrome.runtime.sendMessage({ type: "record_discard", rec_id });
+    done("Discarded. Nothing was sent.", "Discarded");
+  });
+  $("download").addEventListener("click", () => {
+    if (!trace) return;
+    const a = el("a");
+    a.href = URL.createObjectURL(new Blob([JSON.stringify(trace, null, 2)], { type: "application/json" }));
+    a.download = `wield-trace-${new URL(trace.site.origin).host}-${rec_id}.json`;
+    a.click();
+    setTimeout(() => URL.revokeObjectURL(a.href), 5e3);
+  });
+  void main();
+})();