Load and index a Shadow Monitor diagnostic bundle from a local file path. Handles plain JSON, gzip (.json.gz), and per-bundle encrypted exports (supply passphrase for the latter). Returns a bundleId used by the other tools, plus a quick summary. Loading the same path twice reuses the existing handle unless reload is true.

High-level aggregates for a loaded bundle: page, capture window, event counts, network status/method breakdown, slowest and largest requests, error totals, console levels, user-action kinds, and the navigation timeline. Prefers the bundle's pre-computed semantics when present (schema 2/3); falls back to scanning events for schema 1. Use this first to orient before drilling in.

Lightweight metadata for a loaded bundle without any event data: schema version, generation time, page, capture window, counts, capture-start context (URL, title, user agent), userDescription (QA bug note), page.navigation / color scheme, journey session list, and load info.

Return network and console errors in time order. Network errors are failed/aborted requests, blocked (status 0), and 4xx/5xx responses (phase:"start" begin-markers are excluded). Console errors are level matching /error/i or uncaught===true (and level=warn when includeWarnings is true). Each row carries the event id (string like "e_3069") for get_network_request / get_console_event. Network rows include responseBodyPreview so API error messages are visible without a detail call.

Filter the captured network requests and return compact rows (id, time, method, status, url, duration, type, size). Combine any filters: urlContains, method, exact status or statusMin/statusMax, failed, resourceType, mimeType, bodyContains (searches request + response bodies), minDurationMs. Filters match the raw captured values; displayed urls are field-hygiened. Paginate with limit/offset. Fetch full detail with get_network_request using a row's id (string like "e_3069").

Return the full detail of one captured network request by its event id (pass the string id from find_errors/search_network, e.g. "e_3069"; bare numbers like 3069 are also accepted). Includes headers and request/response bodies. Very large bodies are truncated with the original length noted. Signed-URL params and sensitive headers are redacted by default; pass redact=false to see raw values.

Return the full detail of one captured console event by its event id (string like "e_3068", or bare number). Includes level, message/args, stack trace, and originating URL.

Return the full time-ordered user-action timeline (never just the last action — that lives on stateAtCapture.lastUserAction / bundle_overview). DEFAULT types are the story timeline: click, submit, navigate, toggle, select (plus dblclick/contextmenu/page_load) — NOT raw text inputs. Pass types:["input"] explicitly to see keystroke commits. source "auto" (default) uses semantics.userActions only when that list is genuinely populated (≥3 story actions, or the bundle has type:"action" events); otherwise reconstructs from rrweb so today's thin-semantics bundles still get the full ~20-row story. Explicit source "semantics" / "rrweb" force one path. Response includes actionsSource: "semantics" | "rrweb". Each action includes an rrweb window { fromTs, toTs, anchorId } for get_action_replay. Default limit 50.

Return the raw rrweb events for one user-action step, with the FullSnapshot anchor prepended so a viewer can render just that step. Pass actionId (from get_user_actions) or explicit fromTs/toTs. This can be large — optional maxEvents caps the returned list. Does not change get_user_actions (which only returns the lightweight rrweb window pointer).

Return the bundle's pre-computed semantics block when present (schema 2/3): stateAtCapture (last click target, last error, window), errorSummary (curated console/network failures), userActions (with text/selector/label), networkSummary, and pageNavigations. Prefer this for UAT triage orientation; use find_errors / get_* for per-event drill-down.