feat(core): add capture config to decide what gets recorded

[vklimontovich]

A single, dev-friendly knob for what becomes an event — replacing isApiPath +
excludeApiCalls + excludePaths (now deprecated, still working).

capture?: (req: { path; method; fromBrowser; userAgent? }) => boolean | string
//  false    → don't record
//  true     → record as the default type ("pageView")
//  "<type>" → record with this string as event.type ("apiCall", …)
// default when omitted: ({ fromBrowser }) => fromBrowser

capture only sees the requests that could be events — real browser
navigations and direct (non-browser) GETs. RSC/XHR sub-requests, prefetches,
static assets, and non-GET writes are filtered before it, so consumers never
deal with the RSC-duplicate / method nuances. fromBrowser distinguishes real
users from agents/crawlers/curl (no Sec-Fetch-*).

Example

capture: ({ path, fromBrowser }) => {
  if (path.startsWith("/api/")) return false;               // skip API (or return "apiCall")
  if (fromBrowser) return true;                             // real users → every page
  return path.endsWith(".md") || path.startsWith("/llms");  // agents → docs + llms only
}

This also fixes the scanner-404 noise: an unknown path simply isn't allowlisted, so the library never needs to know whether a route exists.

Backward compatibility

isApiPath / excludeApiCalls / excludePaths are marked @deprecated but
fully functional — when capture is absent the old code path runs unchanged. A
warning is logged if they're combined with capture (capture wins). The demo
site is migrated to capture.

Tests

• New capture.test.ts (5 unit tests) for resolveCaptureType.
• Full e2e matrix green (44/44) on the unchanged deprecated path — proves backward compat.

🤖 Generated with Claude Code