@cross-deck/web 1.5.1 → 1.5.3

package/dist/index 2.cjs

@@ -1,4778 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/index.ts
-var index_exports = {};
-__export(index_exports, {
-  CROSSDECK_ERROR_CODES: () => CROSSDECK_ERROR_CODES,
-  Crossdeck: () => Crossdeck,
-  CrossdeckClient: () => CrossdeckClient,
-  CrossdeckContracts: () => CrossdeckContracts,
-  CrossdeckError: () => CrossdeckError,
-  DEFAULT_BASE_URL: () => DEFAULT_BASE_URL,
-  MemoryStorage: () => MemoryStorage,
-  SDK_NAME: () => SDK_NAME,
-  SDK_VERSION: () => SDK_VERSION,
-  getErrorCode: () => getErrorCode
-});
-module.exports = __toCommonJS(index_exports);
-
-// src/errors.ts
-var CrossdeckError = class _CrossdeckError extends Error {
-  constructor(payload) {
-    super(payload.message);
-    this.name = "CrossdeckError";
-    this.type = payload.type;
-    this.code = payload.code;
-    this.requestId = payload.requestId;
-    this.status = payload.status;
-    this.retryAfterMs = payload.retryAfterMs;
-    Object.setPrototypeOf(this, _CrossdeckError.prototype);
-  }
-};
-async function crossdeckErrorFromResponse(res) {
-  const requestId = res.headers.get("x-request-id") ?? void 0;
-  const retryAfterMs = parseRetryAfterHeader(res.headers.get("retry-after"));
-  let body;
-  try {
-    body = await res.json();
-  } catch {
-    body = null;
-  }
-  const envelope = body?.error;
-  if (envelope && typeof envelope.type === "string" && typeof envelope.code === "string") {
-    return new CrossdeckError({
-      type: envelope.type,
-      code: envelope.code,
-      message: envelope.message ?? `HTTP ${res.status}`,
-      requestId: envelope.request_id ?? requestId,
-      status: res.status,
-      retryAfterMs
-    });
-  }
-  return new CrossdeckError({
-    type: typeMapForStatus(res.status),
-    code: `http_${res.status}`,
-    message: `HTTP ${res.status} ${res.statusText || ""}`.trim(),
-    requestId,
-    status: res.status,
-    retryAfterMs
-  });
-}
-function parseRetryAfterHeader(value) {
-  if (!value) return void 0;
-  const trimmed = value.trim();
-  if (!trimmed) return void 0;
-  if (/^\d+(\.\d+)?$/.test(trimmed)) {
-    const secs = Number(trimmed);
-    if (!Number.isFinite(secs) || secs < 0) return void 0;
-    return Math.round(secs * 1e3);
-  }
-  if (!/[a-zA-Z,/:]/.test(trimmed)) return void 0;
-  const target = Date.parse(trimmed);
-  if (!Number.isFinite(target)) return void 0;
-  const delta = target - Date.now();
-  return delta > 0 ? delta : 0;
-}
-function typeMapForStatus(status) {
-  if (status === 401) return "authentication_error";
-  if (status === 403) return "permission_error";
-  if (status === 429) return "rate_limit_error";
-  if (status >= 400 && status < 500) return "invalid_request_error";
-  return "internal_error";
-}
-
-// src/_version.ts
-var SDK_VERSION = "1.4.2";
-var SDK_NAME = "@cross-deck/web";
-
-// src/http.ts
-var DEFAULT_BASE_URL = "https://api.cross-deck.com/v1";
-var DEFAULT_TIMEOUT_MS = 15e3;
-var HttpClient = class {
-  constructor(config) {
-    this.config = config;
-  }
-  /**
-   * Issue a request. `path` is relative to the configured baseUrl
-   * ("/entitlements", "/identity/alias", etc.).
-   *
-   * Throws CrossdeckError on:
-   *   - Network failure (`type: "network_error"`)
-   *   - Non-2xx response (typed from the body envelope)
-   *   - JSON parse failure on a 2xx (treated as `internal_error`)
-   */
-  async request(method, path, options = {}) {
-    if (this.config.localDevMode) {
-      return synthesizeLocalDevResponse(path);
-    }
-    const url = this.buildUrl(path, options.query);
-    const headers = {
-      Authorization: `Bearer ${this.config.publicKey}`,
-      "Crossdeck-Sdk-Version": `${SDK_NAME}@${this.config.sdkVersion}`,
-      Accept: "application/json"
-    };
-    if (options.idempotencyKey) {
-      headers["Idempotency-Key"] = options.idempotencyKey;
-    }
-    let bodyInit;
-    if (options.body !== void 0) {
-      headers["Content-Type"] = "application/json";
-      bodyInit = JSON.stringify(options.body);
-    }
-    const effectiveTimeout = options.timeoutMs ?? this.config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-    const controller = typeof AbortController !== "undefined" && effectiveTimeout > 0 ? new AbortController() : null;
-    let timeoutHandle = null;
-    if (controller && effectiveTimeout > 0) {
-      timeoutHandle = setTimeout(() => controller.abort(), effectiveTimeout);
-    }
-    let response;
-    try {
-      response = await fetch(url, {
-        method,
-        headers,
-        body: bodyInit,
-        keepalive: options.keepalive === true,
-        signal: controller?.signal
-      });
-    } catch (err) {
-      const aborted = controller?.signal?.aborted === true;
-      throw new CrossdeckError({
-        type: "network_error",
-        code: aborted ? "request_timeout" : "fetch_failed",
-        message: aborted ? `Request to ${path} aborted after ${effectiveTimeout}ms` : err instanceof Error ? err.message : "fetch failed"
-      });
-    } finally {
-      if (timeoutHandle !== null) clearTimeout(timeoutHandle);
-    }
-    if (!response.ok) {
-      throw await crossdeckErrorFromResponse(response);
-    }
-    if (response.status === 204) return void 0;
-    try {
-      return await response.json();
-    } catch (err) {
-      throw new CrossdeckError({
-        type: "internal_error",
-        code: "invalid_json_response",
-        message: "Server returned a 2xx with an unparseable body.",
-        requestId: response.headers.get("x-request-id") ?? void 0,
-        status: response.status
-      });
-    }
-  }
-  /**
-   * Whether this client is in localhost dev-mode short-circuit. Used
-   * by other SDK pieces (event-queue) to skip network-bound work
-   * entirely rather than going through synthesizeLocalDevResponse.
-   */
-  get isLocalDevMode() {
-    return this.config.localDevMode === true;
-  }
-  buildUrl(path, query) {
-    const base = this.config.baseUrl.replace(/\/+$/, "");
-    const cleanPath = path.startsWith("/") ? path : `/${path}`;
-    let url = base + cleanPath;
-    if (query) {
-      const params = new URLSearchParams();
-      for (const [k, v] of Object.entries(query)) {
-        if (typeof v === "string" && v.length > 0) params.append(k, v);
-      }
-      const qs = params.toString();
-      if (qs) url += (url.includes("?") ? "&" : "?") + qs;
-    }
-    return url;
-  }
-};
-var cachedLocalCdcust = null;
-function synthesizeLocalDevResponse(path) {
-  if (path.startsWith("/sdk/heartbeat")) {
-    return {
-      object: "heartbeat",
-      ok: true,
-      projectId: "proj_local_dev",
-      appId: "app_local_dev",
-      platform: "web",
-      env: "sandbox",
-      serverTime: Date.now()
-    };
-  }
-  if (path.startsWith("/identity/alias")) {
-    if (!cachedLocalCdcust) {
-      const tail = typeof crypto !== "undefined" && "randomUUID" in crypto ? crypto.randomUUID().replace(/-/g, "").slice(0, 16) : Math.random().toString(36).slice(2, 18);
-      cachedLocalCdcust = `cdcust_local_${tail}`;
-    }
-    return {
-      object: "alias_result",
-      crossdeckCustomerId: cachedLocalCdcust,
-      linked: [],
-      mergePending: false,
-      env: "sandbox"
-    };
-  }
-  if (path.startsWith("/entitlements")) {
-    return {
-      object: "list",
-      data: [],
-      crossdeckCustomerId: cachedLocalCdcust ?? "",
-      env: "sandbox"
-    };
-  }
-  if (path.startsWith("/events")) {
-    return {
-      object: "list",
-      received: 0,
-      env: "sandbox"
-    };
-  }
-  return {};
-}
-
-// src/identity.ts
-var KEY_ANON = "anon_id";
-var KEY_CDCUST = "cdcust_id";
-var IdentityStore = class {
-  constructor(primary, prefix, secondary) {
-    this.primary = primary;
-    this.prefix = prefix;
-    this.secondary = secondary ?? null;
-    const anonFromPrimary = primary.getItem(prefix + KEY_ANON);
-    const cdcustFromPrimary = primary.getItem(prefix + KEY_CDCUST);
-    const anonFromSecondary = this.secondary?.getItem(prefix + KEY_ANON) ?? null;
-    const cdcustFromSecondary = this.secondary?.getItem(prefix + KEY_CDCUST) ?? null;
-    const anon = anonFromPrimary ?? anonFromSecondary;
-    const cdcust = cdcustFromPrimary ?? cdcustFromSecondary;
-    this.state = {
-      anonymousId: anon ?? this.mintAnonymousId(),
-      crossdeckCustomerId: cdcust
-    };
-    if (!anonFromPrimary || !anonFromSecondary) {
-      this.writeBoth(prefix + KEY_ANON, this.state.anonymousId);
-    }
-    if (cdcust && (!cdcustFromPrimary || !cdcustFromSecondary)) {
-      this.writeBoth(prefix + KEY_CDCUST, cdcust);
-    }
-  }
-  /** Return the persisted anonymous device ID (always set). */
-  get anonymousId() {
-    return this.state.anonymousId;
-  }
-  /** Return the resolved cross­deckCustomerId once we have one, else null. */
-  get crossdeckCustomerId() {
-    return this.state.crossdeckCustomerId;
-  }
-  /** Persist a newly-resolved Crossdeck customer ID. */
-  setCrossdeckCustomerId(value) {
-    this.state.crossdeckCustomerId = value;
-    this.writeBoth(this.prefix + KEY_CDCUST, value);
-  }
-  /**
-   * Wipe persisted identity. Called by reset() — used when an end-user
-   * logs out. After reset the SDK mints a new anonymousId so the next
-   * pre-login session is a fresh customer in the identity graph.
-   */
-  reset() {
-    this.deleteBoth(this.prefix + KEY_ANON);
-    this.deleteBoth(this.prefix + KEY_CDCUST);
-    this.state = {
-      anonymousId: this.mintAnonymousId(),
-      crossdeckCustomerId: null
-    };
-    this.writeBoth(this.prefix + KEY_ANON, this.state.anonymousId);
-  }
-  /**
-   * Generate an anonymousId. Crockford-ish base32 timestamp + random
-   * suffix. Same shape Stripe / Segment / others use — sortable, log-
-   * friendly, no PII.
-   */
-  mintAnonymousId() {
-    const ts = Date.now().toString(36);
-    const rand = randomChars(10);
-    return `anon_${ts}${rand}`;
-  }
-  writeBoth(key, value) {
-    try {
-      this.primary.setItem(key, value);
-    } catch {
-    }
-    if (this.secondary) {
-      try {
-        this.secondary.setItem(key, value);
-      } catch {
-      }
-    }
-  }
-  deleteBoth(key) {
-    try {
-      this.primary.removeItem(key);
-    } catch {
-    }
-    if (this.secondary) {
-      try {
-        this.secondary.removeItem(key);
-      } catch {
-      }
-    }
-  }
-};
-function randomChars(count) {
-  const alphabet = "0123456789abcdefghijklmnopqrstuvwxyz";
-  const out = [];
-  const cryptoApi = globalThis.crypto;
-  if (cryptoApi?.getRandomValues) {
-    const buf = new Uint8Array(count);
-    cryptoApi.getRandomValues(buf);
-    for (let i = 0; i < count; i++) {
-      out.push(alphabet[buf[i] % alphabet.length] ?? "0");
-    }
-  } else {
-    for (let i = 0; i < count; i++) {
-      out.push(alphabet[Math.floor(Math.random() * alphabet.length)] ?? "0");
-    }
-  }
-  return out.join("");
-}
-
-// src/hash.ts
-var K = new Uint32Array([
-  1116352408,
-  1899447441,
-  3049323471,
-  3921009573,
-  961987163,
-  1508970993,
-  2453635748,
-  2870763221,
-  3624381080,
-  310598401,
-  607225278,
-  1426881987,
-  1925078388,
-  2162078206,
-  2614888103,
-  3248222580,
-  3835390401,
-  4022224774,
-  264347078,
-  604807628,
-  770255983,
-  1249150122,
-  1555081692,
-  1996064986,
-  2554220882,
-  2821834349,
-  2952996808,
-  3210313671,
-  3336571891,
-  3584528711,
-  113926993,
-  338241895,
-  666307205,
-  773529912,
-  1294757372,
-  1396182291,
-  1695183700,
-  1986661051,
-  2177026350,
-  2456956037,
-  2730485921,
-  2820302411,
-  3259730800,
-  3345764771,
-  3516065817,
-  3600352804,
-  4094571909,
-  275423344,
-  430227734,
-  506948616,
-  659060556,
-  883997877,
-  958139571,
-  1322822218,
-  1537002063,
-  1747873779,
-  1955562222,
-  2024104815,
-  2227730452,
-  2361852424,
-  2428436474,
-  2756734187,
-  3204031479,
-  3329325298
-]);
-function utf8Bytes(input) {
-  if (typeof TextEncoder !== "undefined") {
-    return new TextEncoder().encode(input);
-  }
-  const out = [];
-  for (let i = 0; i < input.length; i++) {
-    let codePoint = input.charCodeAt(i);
-    if (codePoint >= 55296 && codePoint <= 56319 && i + 1 < input.length) {
-      const next = input.charCodeAt(i + 1);
-      if (next >= 56320 && next <= 57343) {
-        codePoint = 65536 + (codePoint - 55296 << 10) + (next - 56320);
-        i++;
-      }
-    }
-    if (codePoint < 128) {
-      out.push(codePoint);
-    } else if (codePoint < 2048) {
-      out.push(192 | codePoint >> 6);
-      out.push(128 | codePoint & 63);
-    } else if (codePoint < 65536) {
-      out.push(224 | codePoint >> 12);
-      out.push(128 | codePoint >> 6 & 63);
-      out.push(128 | codePoint & 63);
-    } else {
-      out.push(240 | codePoint >> 18);
-      out.push(128 | codePoint >> 12 & 63);
-      out.push(128 | codePoint >> 6 & 63);
-      out.push(128 | codePoint & 63);
-    }
-  }
-  return new Uint8Array(out);
-}
-function sha256Hex(input) {
-  const bytes = utf8Bytes(input);
-  const bitLength = bytes.length * 8;
-  const blockCount = Math.floor((bytes.length + 9 + 63) / 64);
-  const padded = new Uint8Array(blockCount * 64);
-  padded.set(bytes);
-  padded[bytes.length] = 128;
-  const high = Math.floor(bitLength / 4294967296);
-  const low = bitLength >>> 0;
-  const lenOffset = padded.length - 8;
-  padded[lenOffset + 0] = high >>> 24 & 255;
-  padded[lenOffset + 1] = high >>> 16 & 255;
-  padded[lenOffset + 2] = high >>> 8 & 255;
-  padded[lenOffset + 3] = high & 255;
-  padded[lenOffset + 4] = low >>> 24 & 255;
-  padded[lenOffset + 5] = low >>> 16 & 255;
-  padded[lenOffset + 6] = low >>> 8 & 255;
-  padded[lenOffset + 7] = low & 255;
-  const H = new Uint32Array([
-    1779033703,
-    3144134277,
-    1013904242,
-    2773480762,
-    1359893119,
-    2600822924,
-    528734635,
-    1541459225
-  ]);
-  const W = new Uint32Array(64);
-  for (let block = 0; block < blockCount; block++) {
-    const offset = block * 64;
-    for (let t = 0; t < 16; t++) {
-      W[t] = (padded[offset + t * 4] << 24 | padded[offset + t * 4 + 1] << 16 | padded[offset + t * 4 + 2] << 8 | padded[offset + t * 4 + 3]) >>> 0;
-    }
-    for (let t = 16; t < 64; t++) {
-      const w15 = W[t - 15];
-      const w2 = W[t - 2];
-      const s0 = (w15 >>> 7 | w15 << 25) ^ (w15 >>> 18 | w15 << 14) ^ w15 >>> 3;
-      const s1 = (w2 >>> 17 | w2 << 15) ^ (w2 >>> 19 | w2 << 13) ^ w2 >>> 10;
-      W[t] = W[t - 16] + s0 + W[t - 7] + s1 >>> 0;
-    }
-    let a = H[0], b = H[1], c = H[2], d = H[3];
-    let e = H[4], f = H[5], g = H[6], h = H[7];
-    for (let t = 0; t < 64; t++) {
-      const S1 = (e >>> 6 | e << 26) ^ (e >>> 11 | e << 21) ^ (e >>> 25 | e << 7);
-      const ch = e & f ^ ~e & g;
-      const temp1 = h + S1 + ch + K[t] + W[t] >>> 0;
-      const S0 = (a >>> 2 | a << 30) ^ (a >>> 13 | a << 19) ^ (a >>> 22 | a << 10);
-      const maj = a & b ^ a & c ^ b & c;
-      const temp2 = S0 + maj >>> 0;
-      h = g;
-      g = f;
-      f = e;
-      e = d + temp1 >>> 0;
-      d = c;
-      c = b;
-      b = a;
-      a = temp1 + temp2 >>> 0;
-    }
-    H[0] = H[0] + a >>> 0;
-    H[1] = H[1] + b >>> 0;
-    H[2] = H[2] + c >>> 0;
-    H[3] = H[3] + d >>> 0;
-    H[4] = H[4] + e >>> 0;
-    H[5] = H[5] + f >>> 0;
-    H[6] = H[6] + g >>> 0;
-    H[7] = H[7] + h >>> 0;
-  }
-  let hex = "";
-  for (let i = 0; i < 8; i++) {
-    hex += H[i].toString(16).padStart(8, "0");
-  }
-  return hex;
-}
-
-// src/entitlement-cache.ts
-var DEFAULT_STALE_AFTER_MS = 24 * 60 * 60 * 1e3;
-var ANON_SUFFIX = "_anon";
-var INDEX_SUFFIX = "_index";
-var EntitlementCache = class _EntitlementCache {
-  /**
-   * @param storage          Device storage adapter. When omitted (tests) or
-   *                         a MemoryStorage (strict-consent / no-persistence
-   *                         mode) the cache is session-only — durability is
-   *                         simply absent, never wrong.
-   * @param storageKeyPrefix Prefix used to derive per-user storage keys
-   *                         (`<prefix>:<sha256(userId)>`). Default
-   *                         `crossdeck:entitlements`. The trailing user
-   *                         suffix is filled at identify() / reset()
-   *                         time — see [[setUserKey]].
-   * @param staleAfterMs     Age past which last-known-good is flagged stale
-   *                         even without a failed refresh. Default 24h.
-   */
-  constructor(storage, storageKeyPrefix = "crossdeck:entitlements", staleAfterMs = DEFAULT_STALE_AFTER_MS) {
-    this.all = [];
-    this.lastUpdated = 0;
-    this.lastRefreshFailedAt = 0;
-    this.listeners = /* @__PURE__ */ new Set();
-    this.listenerErrorCount = 0;
-    this.currentSuffix = ANON_SUFFIX;
-    this.storage = storage;
-    this.storageKeyPrefix = storageKeyPrefix;
-    this.staleAfterMs = staleAfterMs;
-    this.hydrate();
-  }
-  /** The full storage key the current-user blob is persisted under. */
-  get storageKey() {
-    return `${this.storageKeyPrefix}:${this.currentSuffix}`;
-  }
-  /** Key of the index blob — a JSON array of every suffix we've
-   * written. Used by clearAll() to scope a logout-wipe. */
-  get indexKey() {
-    return `${this.storageKeyPrefix}:${INDEX_SUFFIX}`;
-  }
-  /** Derive a stable suffix for a developerUserId via SHA-256. The
-   * raw userId never lands in the storage key — protects against
-   * accidentally leaking email-style identifiers through DevTools
-   * inspection. Pass `null` to switch back to the anonymous slot. */
-  static suffixForUserId(userId) {
-    if (userId == null || userId === "") return ANON_SUFFIX;
-    return sha256Hex(userId);
-  }
-  /**
-   * Switch the cache to a different user's storage slot. Bank-grade
-   * three-layer isolation:
-   *   (a) Physical key separation — `<prefix>:<sha256(userId)>` so
-   *       a user-switch can't physically read prior user's data
-   *       even if the in-memory clear was skipped.
-   *   (b) Unconditional in-memory clear — invoked whenever the
-   *       active suffix changes, even on same-id re-identify.
-   *   (c) Re-hydrate from the new slot — a returning user observes
-   *       their last-known-good cache from storage immediately.
-   *
-   * Caller (identify() / reset()) MUST invoke this BEFORE the next
-   * setFromList() so the write lands under the right key.
-   */
-  setUserKey(userId) {
-    const nextSuffix = _EntitlementCache.suffixForUserId(userId);
-    if (nextSuffix === this.currentSuffix) {
-      this.all = [];
-      this.lastUpdated = 0;
-      this.lastRefreshFailedAt = 0;
-      this.notify();
-      this.hydrate();
-      return;
-    }
-    this.currentSuffix = nextSuffix;
-    this.all = [];
-    this.lastUpdated = 0;
-    this.lastRefreshFailedAt = 0;
-    this.hydrate();
-    this.notify();
-  }
-  /**
-   * Sync read — true iff the entitlement is currently granting access.
-   *
-   * Served from last-known-good: a stale cache (server unreachable since
-   * the last successful fetch) still answers true for a still-valid
-   * entitlement. The ONLY thing that turns it false is the entitlement's
-   * own expiry (validUntil) — never overall cache staleness.
-   */
-  isEntitled(key) {
-    const nowSec = Date.now() / 1e3;
-    return this.all.some(
-      (e) => e.key === key && e.isActive && (e.validUntil == null || e.validUntil > nowSec)
-    );
-  }
-  /** Full snapshot for callers that need source / validUntil details. */
-  list() {
-    return this.all.slice();
-  }
-  /** When the cache was last refreshed from the server. 0 means "never". */
-  get freshness() {
-    return this.lastUpdated;
-  }
-  /**
-   * Whether the cache is knowingly serving older-than-trustworthy data.
-   *
-   * True when the most recent refresh ATTEMPT failed (Crossdeck
-   * unreachable since the last success — the outage case, distinct from
-   * a benign idle tab that simply hasn't re-fetched), OR when
-   * last-known-good has aged past staleAfterMs.
-   *
-   * isStale never changes what isEntitled() returns — the cache still
-   * serves last-known-good. It exists so the staleness is observable
-   * (diagnostics()) instead of an unbounded silent window where a
-   * revoked customer holds access with nobody able to see it.
-   */
-  get isStale() {
-    if (this.lastRefreshFailedAt > this.lastUpdated) return true;
-    return this.lastUpdated > 0 && Date.now() - this.lastUpdated > this.staleAfterMs;
-  }
-  /** Epoch ms of the last failed refresh attempt. 0 if none since the last success. */
-  get refreshFailedAt() {
-    return this.lastRefreshFailedAt;
-  }
-  get listenerErrors() {
-    return this.listenerErrorCount;
-  }
-  /**
-   * Record that a refresh attempt failed (Crossdeck unreachable / a
-   * transient error). The SDK's getEntitlements() calls this in its
-   * catch path. It does NOT touch the cached entitlements — last-known-
-   * good keeps serving — it only flips isStale so the staleness shows
-   * up in diagnostics() rather than being silent.
-   */
-  markRefreshFailed() {
-    this.lastRefreshFailedAt = Date.now();
-  }
-  /**
-   * Replace the cache with a fresh server response and persist it to
-   * device storage so it survives a reload / app restart.
-   *
-   * Called ONLY after a successful server read — a failed fetch throws
-   * before it reaches here, so last-known-good is preserved through an
-   * outage. A success also clears the stale flag.
-   */
-  setFromList(entitlements) {
-    this.all = entitlements.slice();
-    this.lastUpdated = Date.now();
-    this.lastRefreshFailedAt = 0;
-    this.persist();
-    this.recordSuffixInIndex(this.currentSuffix);
-    this.notify();
-  }
-  /**
-   * Wipe the CURRENT user's slot. Used internally when a single
-   * user's cache needs to be invalidated without affecting other
-   * persisted slots. The full-logout path is [[clearAll]].
-   */
-  clear() {
-    this.all = [];
-    this.lastUpdated = 0;
-    this.lastRefreshFailedAt = 0;
-    if (this.storage) {
-      try {
-        this.storage.removeItem(this.storageKey);
-      } catch {
-      }
-    }
-    this.removeSuffixFromIndex(this.currentSuffix);
-    this.notify();
-  }
-  /**
-   * Logout-grade wipe — bank-grade contract: removes EVERY per-user
-   * entitlement slot the SDK has ever written on this device, then
-   * clears the index. Used by `Crossdeck.reset()` so a logout on a
-   * shared device can never leave another user's entitlements
-   * readable (layer (c) of the v1.4.0 isolation fix).
-   *
-   * After clearAll(), the cache is back to anonymous + empty.
-   */
-  clearAll() {
-    this.all = [];
-    this.lastUpdated = 0;
-    this.lastRefreshFailedAt = 0;
-    this.currentSuffix = ANON_SUFFIX;
-    if (this.storage) {
-      const suffixes = this.readIndex();
-      for (const suffix of suffixes) {
-        try {
-          this.storage.removeItem(`${this.storageKeyPrefix}:${suffix}`);
-        } catch {
-        }
-      }
-      try {
-        this.storage.removeItem(`${this.storageKeyPrefix}:${ANON_SUFFIX}`);
-      } catch {
-      }
-      try {
-        this.storage.removeItem(this.indexKey);
-      } catch {
-      }
-    }
-    this.notify();
-  }
-  /**
-   * Subscribe to cache mutations. Returns an idempotent unsubscribe fn.
-   * The listener fires AFTER setFromList() or clear() with the current
-   * snapshot. Used by `@cross-deck/web/react`'s `useEntitlement` hook.
-   */
-  subscribe(listener) {
-    this.listeners.add(listener);
-    let unsubscribed = false;
-    return () => {
-      if (unsubscribed) return;
-      unsubscribed = true;
-      this.listeners.delete(listener);
-    };
-  }
-  // ----- Durable persistence -----
-  /**
-   * Load last-known-good from device storage. Runs once in the
-   * constructor, synchronously, so isEntitled() is correct from boot.
-   * Any corrupt / unparseable blob degrades silently to an empty cache —
-   * boot must never throw.
-   */
-  hydrate() {
-    if (!this.storage) return;
-    try {
-      const raw = this.storage.getItem(this.storageKey);
-      if (!raw) return;
-      const parsed = JSON.parse(raw);
-      if (parsed && parsed.v === 1 && Array.isArray(parsed.entitlements)) {
-        this.all = parsed.entitlements;
-        this.lastUpdated = typeof parsed.lastUpdated === "number" ? parsed.lastUpdated : 0;
-      }
-    } catch {
-    }
-  }
-  /** Write last-known-good to device storage. Best-effort. */
-  persist() {
-    if (!this.storage) return;
-    try {
-      const blob = {
-        v: 1,
-        entitlements: this.all,
-        lastUpdated: this.lastUpdated
-      };
-      this.storage.setItem(this.storageKey, JSON.stringify(blob));
-    } catch {
-    }
-  }
-  /** Read the index of all per-user suffixes the SDK has written. */
-  readIndex() {
-    if (!this.storage) return [];
-    try {
-      const raw = this.storage.getItem(this.indexKey);
-      if (!raw) return [];
-      const parsed = JSON.parse(raw);
-      if (Array.isArray(parsed)) {
-        return parsed.filter((x) => typeof x === "string");
-      }
-      return [];
-    } catch {
-      return [];
-    }
-  }
-  /** Add a suffix to the persisted index. Idempotent. */
-  recordSuffixInIndex(suffix) {
-    if (!this.storage) return;
-    const existing = this.readIndex();
-    if (existing.includes(suffix)) return;
-    existing.push(suffix);
-    try {
-      this.storage.setItem(this.indexKey, JSON.stringify(existing));
-    } catch {
-    }
-  }
-  /** Remove a suffix from the persisted index. No-op if absent. */
-  removeSuffixFromIndex(suffix) {
-    if (!this.storage) return;
-    const existing = this.readIndex();
-    const next = existing.filter((s) => s !== suffix);
-    if (next.length === existing.length) return;
-    try {
-      if (next.length === 0) {
-        this.storage.removeItem(this.indexKey);
-      } else {
-        this.storage.setItem(this.indexKey, JSON.stringify(next));
-      }
-    } catch {
-    }
-  }
-  notify() {
-    if (this.listeners.size === 0) return;
-    const snapshot = this.all.slice();
-    const listenersSnapshot = [...this.listeners];
-    for (const listener of listenersSnapshot) {
-      try {
-        listener(snapshot);
-      } catch {
-        this.listenerErrorCount += 1;
-      }
-    }
-  }
-};
-
-// src/idempotency-key.ts
-function formatAsUuid(hex) {
-  return [
-    hex.slice(0, 8),
-    hex.slice(8, 12),
-    hex.slice(12, 16),
-    hex.slice(16, 20),
-    hex.slice(20, 32)
-  ].join("-");
-}
-function deriveIdempotencyKeyForPurchase(body) {
-  let identifier;
-  if (body.rail === "apple") {
-    identifier = body.signedTransactionInfo ?? "";
-  } else if (body.rail === "google") {
-    identifier = body.purchaseToken ?? "";
-  } else {
-    identifier = "";
-  }
-  if (!identifier) {
-    throw new Error(
-      `deriveIdempotencyKeyForPurchase: no stable identifier in body (rail=${body.rail}). Apple needs signedTransactionInfo; Google needs purchaseToken.`
-    );
-  }
-  const namespaced = `crossdeck:purchases/sync:${body.rail}:${identifier}`;
-  return formatAsUuid(sha256Hex(namespaced));
-}
-
-// src/retry-policy.ts
-var DEFAULT_BASE = 1e3;
-var DEFAULT_MAX = 6e4;
-var DEFAULT_FACTOR = 2;
-var DEFAULT_WARN = 8;
-function computeNextDelay(attempts, retryAfterMs, options = {}, random = Math.random) {
-  const base = options.baseMs ?? DEFAULT_BASE;
-  const max = options.maxMs ?? DEFAULT_MAX;
-  const factor = options.factor ?? DEFAULT_FACTOR;
-  const safeAttempts = Math.min(attempts, 30);
-  const ceiling = Math.min(max, base * Math.pow(factor, safeAttempts));
-  const jittered = ceiling * random();
-  if (retryAfterMs !== void 0) {
-    const ABSOLUTE_MAX_MS = 24 * 60 * 60 * 1e3;
-    const honoured = Math.min(ABSOLUTE_MAX_MS, retryAfterMs);
-    if (honoured > jittered) return honoured;
-  }
-  return Math.max(0, Math.round(jittered));
-}
-var RetryPolicy = class {
-  constructor(options = {}) {
-    this.options = options;
-    this.attempts = 0;
-  }
-  /** How many consecutive failures since the last success. */
-  get consecutiveFailures() {
-    return this.attempts;
-  }
-  /** Whether we've crossed the failuresBeforeWarn threshold. */
-  get isWarning() {
-    return this.attempts >= (this.options.failuresBeforeWarn ?? DEFAULT_WARN);
-  }
-  /** Schedule-time delay for the NEXT retry. Increments the counter. */
-  nextDelay(retryAfterMs, random = Math.random) {
-    const delay = computeNextDelay(this.attempts, retryAfterMs, this.options, random);
-    this.attempts += 1;
-    return delay;
-  }
-  /** Mark a successful flush — reset the counter. */
-  recordSuccess() {
-    this.attempts = 0;
-  }
-};
-
-// src/event-queue.ts
-var HARD_BUFFER_CAP = 1e3;
-var EventQueue = class {
-  constructor(cfg) {
-    this.cfg = cfg;
-    this.buffer = [];
-    /**
-     * In-flight events that have been spliced from `buffer` for the
-     * current batch but haven't yet been confirmed (success or permanent
-     * failure). On a retry-driven re-flush we re-use this slot alongside
-     * `pendingBatchId` so the Stripe-style Idempotency-Key is preserved
-     * across retries of the SAME logical batch.
-     *
-     * Pre-fix the splice cleared the buffer AND we immediately
-     * `persistent.save(empty)` BEFORE awaiting the network call — a
-     * crash mid-flight wiped the persisted blob and the batch was lost
-     * with no replay on next boot. Now the persisted blob always carries
-     * `[...pendingBatch, ...buffer]` so the in-flight events survive
-     * until the server confirms them.
-     *
-     * Pre-fix every retry attempt also minted a NEW batchId via
-     * `splice + mintBatchId`, defeating the backend's
-     * `Idempotency-Key` dedup. Reuse via this slot brings web in
-     * lockstep with node (which already had the field).
-     */
-    this.pendingBatch = null;
-    this.pendingBatchId = null;
-    this.dropped = 0;
-    this.inFlight = 0;
-    this.lastFlushAt = 0;
-    this.lastError = null;
-    this.cancelTimer = null;
-    this.firstFlushFired = false;
-    this.nextRetryAt = null;
-    this.retry = new RetryPolicy(cfg.retry ?? {});
-    this.persistent = cfg.persistentStore ?? null;
-    if (this.persistent) {
-      const restored = this.persistent.load();
-      if (restored.length > 0) {
-        if (restored.length > HARD_BUFFER_CAP) {
-          this.dropped += restored.length - HARD_BUFFER_CAP;
-          this.buffer = restored.slice(restored.length - HARD_BUFFER_CAP);
-        } else {
-          this.buffer = restored;
-        }
-        this.cfg.onBufferChange?.(this.buffer.length);
-        this.scheduleIdleFlush();
-      }
-    }
-  }
-  enqueue(event) {
-    this.buffer.push(event);
-    if (this.buffer.length > HARD_BUFFER_CAP) {
-      const overflow = this.buffer.length - HARD_BUFFER_CAP;
-      this.buffer.splice(0, overflow);
-      this.dropped += overflow;
-      this.cfg.onDrop?.(overflow);
-    }
-    this.cfg.onBufferChange?.(this.buffer.length);
-    this.persistAll();
-    if (this.buffer.length >= this.cfg.batchSize) {
-      void this.flush();
-    } else {
-      this.scheduleIdleFlush();
-    }
-  }
-  /**
-   * Flush the buffer to /v1/events. Resolves when the network call
-   * completes (success or failure). On a retryable failure the batch
-   * stays in `pendingBatch` for the next scheduled retry — the SAME
-   * batch with the SAME `Idempotency-Key` is re-sent (Stripe pattern).
-   *
-   * Three terminal states from one call:
-   *   - 2xx success: pendingBatch cleared, persisted state collapses to
-   *     just `buffer` (any new events that arrived during in-flight).
-   *   - 4xx permanent (except 408/429): pendingBatch DROPPED, `dropped`
-   *     counter increments, a `permanent_failure` signal fires. The
-   *     server is telling us our request is malformed / our key is
-   *     revoked / we lack permission — retrying with the same key
-   *     forever just grows the queue while the customer thinks events
-   *     are landing.
-   *   - 5xx / network / 408 / 429: pendingBatch + batchId stay; backoff
-   *     schedules a retry; the next `flush()` re-uses both.
-   *
-   * `options.keepalive` marks the underlying fetch as keepalive so the
-   * browser keeps the request alive past page unload. Use for terminal
-   * flushes (pagehide / visibilitychange→hidden / beforeunload).
-   */
-  async flush(options = {}) {
-    let batch;
-    let batchId;
-    if (this.pendingBatch !== null && this.pendingBatchId !== null) {
-      batch = this.pendingBatch;
-      batchId = this.pendingBatchId;
-    } else {
-      if (this.buffer.length === 0) return null;
-      batch = this.buffer.splice(0);
-      batchId = this.mintBatchId();
-      this.pendingBatch = batch;
-      this.pendingBatchId = batchId;
-      this.inFlight += batch.length;
-      this.cfg.onBufferChange?.(this.buffer.length);
-      this.persistAll();
-    }
-    this.cancelTimerIfSet();
-    this.nextRetryAt = null;
-    try {
-      const env = this.cfg.envelope();
-      const result = await this.cfg.http.request("POST", "/events", {
-        body: {
-          // NorthStar §13.1 batch envelope. The backend validates these
-          // against the API-key-resolved app and rejects mismatches
-          // loudly (env_mismatch).
-          appId: env.appId,
-          environment: env.environment,
-          sdk: env.sdk,
-          events: batch
-        },
-        keepalive: options.keepalive === true,
-        idempotencyKey: batchId
-      });
-      this.lastFlushAt = Date.now();
-      this.lastError = null;
-      this.inFlight -= batch.length;
-      this.pendingBatch = null;
-      this.pendingBatchId = null;
-      this.retry.recordSuccess();
-      this.persistAll();
-      if (!this.firstFlushFired) {
-        this.firstFlushFired = true;
-        this.cfg.onFirstFlushSuccess?.();
-      }
-      return result;
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      this.lastError = message;
-      if (isPermanent4xx(err)) {
-        const droppedCount = batch.length;
-        this.pendingBatch = null;
-        this.pendingBatchId = null;
-        this.inFlight -= droppedCount;
-        this.dropped += droppedCount;
-        this.persistAll();
-        this.cfg.onDrop?.(droppedCount);
-        this.cfg.onPermanentFailure?.({
-          status: err.status ?? 0,
-          droppedCount,
-          lastError: message
-        });
-        return null;
-      }
-      const retryAfterMs = extractRetryAfterMs(err);
-      const delay = this.retry.nextDelay(retryAfterMs);
-      this.scheduleRetry(delay);
-      this.cfg.onRetryScheduled?.({
-        delayMs: delay,
-        consecutiveFailures: this.retry.consecutiveFailures,
-        retryAfterMs,
-        lastError: message
-      });
-      return null;
-    }
-  }
-  /** Cancel any pending timer and clear in-memory state. Wipes durable store too. */
-  reset() {
-    this.cancelTimerIfSet();
-    this.nextRetryAt = null;
-    this.buffer = [];
-    this.pendingBatch = null;
-    this.pendingBatchId = null;
-    this.dropped = 0;
-    this.inFlight = 0;
-    this.lastError = null;
-    this.retry.recordSuccess();
-    this.persistent?.clear();
-    this.cfg.onBufferChange?.(0);
-  }
-  getStats() {
-    return {
-      // `buffered` counts events waiting for their FIRST flush. The
-      // in-flight pendingBatch (retrying) is tracked separately via
-      // `inFlight` — surfacing both lets diagnostics show "we have
-      // events stuck retrying" distinct from "new events arriving".
-      buffered: this.buffer.length,
-      dropped: this.dropped,
-      inFlight: this.inFlight,
-      lastFlushAt: this.lastFlushAt,
-      lastError: this.lastError,
-      consecutiveFailures: this.retry.consecutiveFailures,
-      nextRetryAt: this.nextRetryAt
-    };
-  }
-  /**
-   * The Idempotency-Key of the in-flight pending batch (if any).
-   * Exposed for testing the Stripe-style retry-reuse contract.
-   * Production callers don't need this.
-   */
-  get pendingIdempotencyKey() {
-    return this.pendingBatchId;
-  }
-  /**
-   * Persist `[...pendingBatch, ...buffer]` — the full set of
-   * not-yet-confirmed events. The next boot rehydrates this exact set
-   * into `buffer` and replays. The server dedups via eventId
-   * (ReplacingMergeTree on the warehouse side), so re-sending an event
-   * that may have already landed is safe.
-   */
-  persistAll() {
-    if (!this.persistent) return;
-    if (this.pendingBatch === null) {
-      this.persistent.save(this.buffer);
-      return;
-    }
-    this.persistent.save([...this.pendingBatch, ...this.buffer]);
-  }
-  // ---------- internal scheduling ----------
-  scheduleIdleFlush() {
-    this.cancelTimerIfSet();
-    const sched = this.cfg.scheduler ?? defaultScheduler;
-    this.cancelTimer = sched(() => {
-      void this.flush();
-    }, this.cfg.intervalMs);
-  }
-  scheduleRetry(delayMs) {
-    this.cancelTimerIfSet();
-    this.nextRetryAt = Date.now() + delayMs;
-    const sched = this.cfg.scheduler ?? defaultScheduler;
-    this.cancelTimer = sched(() => {
-      void this.flush();
-    }, delayMs);
-  }
-  cancelTimerIfSet() {
-    if (this.cancelTimer) {
-      this.cancelTimer();
-      this.cancelTimer = null;
-    }
-  }
-  mintBatchId() {
-    return `batch_${Date.now().toString(36)}${randomChars(10)}`;
-  }
-};
-function extractRetryAfterMs(err) {
-  if (err && typeof err === "object" && "retryAfterMs" in err) {
-    const v = err.retryAfterMs;
-    return typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : void 0;
-  }
-  return void 0;
-}
-function isPermanent4xx(err) {
-  if (!err || typeof err !== "object") return false;
-  const status = err.status;
-  if (typeof status !== "number" || !Number.isFinite(status)) return false;
-  if (status < 400 || status >= 500) return false;
-  if (status === 408 || status === 429) return false;
-  return true;
-}
-function defaultScheduler(fn, ms) {
-  const id = setTimeout(fn, ms);
-  if (typeof id.unref === "function") {
-    try {
-      id.unref();
-    } catch {
-    }
-  }
-  return () => clearTimeout(id);
-}
-
-// src/event-storage.ts
-var PersistentEventStore = class {
-  constructor(options) {
-    this.options = options;
-    this.writeScheduled = false;
-    // Pending events captured on the most recent write request. We keep
-    // the latest snapshot ref so a debounced write always picks up the
-    // freshest buffer state.
-    this.pendingSnapshot = null;
-    this.key = `${options.prefix}queue.v1`;
-  }
-  /**
-   * Read the persisted queue on boot. Returns an empty array (with no
-   * warning) when nothing is stored, the blob is malformed, or storage
-   * is unavailable. Caller is responsible for treating duplicates from
-   * the persisted queue as the SAME events (eventId-based dedup).
-   */
-  load() {
-    let raw;
-    try {
-      raw = this.options.storage.getItem(this.key);
-    } catch {
-      return [];
-    }
-    if (!raw) return [];
-    try {
-      const parsed = JSON.parse(raw);
-      if (!parsed || parsed.version !== 1 || !Array.isArray(parsed.events)) {
-        return [];
-      }
-      return parsed.events;
-    } catch {
-      return [];
-    }
-  }
-  /**
-   * Schedule a write of the current buffer. Debounced via microtask so
-   * a burst of enqueue() calls coalesces into one persistence write.
-   * Writes are best-effort: if storage throws (quota, private mode),
-   * we swallow and rely on the in-memory buffer.
-   */
-  save(snapshot) {
-    this.pendingSnapshot = snapshot.slice();
-    if (this.writeScheduled) return;
-    this.writeScheduled = true;
-    queueMicrotask(() => this.flushWrite());
-  }
-  /** Synchronous variant for terminal flushes (pagehide / beforeunload). */
-  saveSync(snapshot) {
-    this.pendingSnapshot = snapshot.slice();
-    this.flushWrite();
-  }
-  /** Wipe the persisted blob. Used by reset() (logout). */
-  clear() {
-    this.pendingSnapshot = null;
-    this.writeScheduled = false;
-    try {
-      this.options.storage.removeItem(this.key);
-    } catch {
-    }
-  }
-  flushWrite() {
-    this.writeScheduled = false;
-    const snapshot = this.pendingSnapshot;
-    this.pendingSnapshot = null;
-    if (snapshot === null) return;
-    if (snapshot.length === 0) {
-      try {
-        this.options.storage.removeItem(this.key);
-      } catch {
-      }
-      return;
-    }
-    const blob = { version: 1, events: snapshot };
-    try {
-      this.options.storage.setItem(this.key, JSON.stringify(blob));
-    } catch {
-    }
-  }
-};
-
-// src/storage.ts
-var MemoryStorage = class {
-  constructor() {
-    this.store = /* @__PURE__ */ new Map();
-  }
-  getItem(key) {
-    return this.store.get(key) ?? null;
-  }
-  setItem(key, value) {
-    this.store.set(key, value);
-  }
-  removeItem(key) {
-    this.store.delete(key);
-  }
-};
-var CookieStorage = class {
-  constructor(options) {
-    this.maxAgeSec = options?.maxAgeSec ?? 63072e3;
-    this.secure = options?.secure ?? defaultSecure();
-    this.sameSite = options?.sameSite ?? "Lax";
-  }
-  getItem(key) {
-    if (!hasDocument()) return null;
-    const doc = globalThis.document;
-    const cookies = doc.cookie ? doc.cookie.split(/;\s*/) : [];
-    const prefix = encodeURIComponent(key) + "=";
-    for (const c of cookies) {
-      if (c.startsWith(prefix)) {
-        try {
-          return decodeURIComponent(c.slice(prefix.length));
-        } catch {
-          return null;
-        }
-      }
-    }
-    return null;
-  }
-  setItem(key, value) {
-    if (!hasDocument()) return;
-    const doc = globalThis.document;
-    const parts = [
-      `${encodeURIComponent(key)}=${encodeURIComponent(value)}`,
-      "Path=/",
-      `Max-Age=${this.maxAgeSec}`,
-      `SameSite=${this.sameSite}`
-    ];
-    if (this.secure) parts.push("Secure");
-    try {
-      doc.cookie = parts.join("; ");
-    } catch {
-    }
-  }
-  removeItem(key) {
-    if (!hasDocument()) return;
-    const doc = globalThis.document;
-    const parts = [
-      `${encodeURIComponent(key)}=`,
-      "Path=/",
-      "Max-Age=0",
-      `SameSite=${this.sameSite}`
-    ];
-    if (this.secure) parts.push("Secure");
-    try {
-      doc.cookie = parts.join("; ");
-    } catch {
-    }
-  }
-};
-function detectDefaultStorage() {
-  try {
-    const ls = globalThis.localStorage;
-    if (ls) {
-      const probe = "__crossdeck_probe__";
-      ls.setItem(probe, "1");
-      ls.removeItem(probe);
-      return ls;
-    }
-  } catch {
-  }
-  return new MemoryStorage();
-}
-function defaultSecure() {
-  try {
-    const loc = globalThis.location;
-    return loc?.protocol === "https:";
-  } catch {
-    return false;
-  }
-}
-function hasDocument() {
-  return typeof globalThis.document !== "undefined";
-}
-
-// src/device-info.ts
-function isBrowser() {
-  return typeof globalThis.window !== "undefined" && typeof globalThis.document !== "undefined" && typeof globalThis.navigator !== "undefined";
-}
-function collectDeviceInfo(extra) {
-  const info = {};
-  if (extra?.appVersion) info.appVersion = extra.appVersion;
-  if (!isBrowser()) return info;
-  const w = globalThis.window;
-  const nav = globalThis.navigator;
-  const doc = globalThis.document;
-  try {
-    if (typeof nav.language === "string") info.locale = nav.language;
-  } catch {
-  }
-  try {
-    info.timezone = Intl.DateTimeFormat().resolvedOptions().timeZone;
-  } catch {
-  }
-  try {
-    if (w.screen) {
-      info.screenWidth = w.screen.width;
-      info.screenHeight = w.screen.height;
-    }
-    info.viewportWidth = w.innerWidth;
-    info.viewportHeight = w.innerHeight;
-    info.devicePixelRatio = w.devicePixelRatio;
-  } catch {
-  }
-  try {
-    const ua = nav.userAgent ?? "";
-    const parsed = parseUserAgent(ua);
-    Object.assign(info, parsed);
-  } catch {
-  }
-  try {
-    const uaData = nav.userAgentData;
-    if (uaData?.platform && !info.os) info.os = uaData.platform;
-    if (uaData?.brands && !info.browser) {
-      const real = uaData.brands.find(
-        (b) => !/Not[ .;A]*Brand/i.test(b.brand) && !/Chromium/i.test(b.brand)
-      );
-      if (real) {
-        info.browser = real.brand;
-        info.browserVersion = real.version;
-      }
-    }
-  } catch {
-  }
-  void doc;
-  return info;
-}
-function parseUserAgent(ua) {
-  const out = {};
-  if (/iPad|iPhone|iPod/.test(ua)) {
-    out.os = "iOS";
-    const m = ua.match(/OS (\d+[._]\d+(?:[._]\d+)?)/);
-    if (m?.[1]) out.osVersion = m[1].replace(/_/g, ".");
-  } else if (/Android/.test(ua)) {
-    out.os = "Android";
-    const m = ua.match(/Android (\d+(?:\.\d+)*)/);
-    if (m?.[1]) out.osVersion = m[1];
-  } else if (/Windows/.test(ua)) {
-    out.os = "Windows";
-    const m = ua.match(/Windows NT (\d+\.\d+)/);
-    if (m?.[1]) out.osVersion = m[1];
-  } else if (/Mac OS X|Macintosh/.test(ua)) {
-    out.os = "macOS";
-    const m = ua.match(/Mac OS X (\d+[._]\d+(?:[._]\d+)?)/);
-    if (m?.[1]) out.osVersion = m[1].replace(/_/g, ".");
-  } else if (/Linux/.test(ua)) {
-    out.os = "Linux";
-  }
-  if (/Edg\/(\d+(?:\.\d+)*)/.test(ua)) {
-    out.browser = "Edge";
-    out.browserVersion = ua.match(/Edg\/(\d+(?:\.\d+)*)/)?.[1];
-  } else if (/Firefox\/(\d+(?:\.\d+)*)/.test(ua)) {
-    out.browser = "Firefox";
-    out.browserVersion = ua.match(/Firefox\/(\d+(?:\.\d+)*)/)?.[1];
-  } else if (/OPR\/(\d+(?:\.\d+)*)/.test(ua)) {
-    out.browser = "Opera";
-    out.browserVersion = ua.match(/OPR\/(\d+(?:\.\d+)*)/)?.[1];
-  } else if (/Chrome\/(\d+(?:\.\d+)*)/.test(ua)) {
-    out.browser = "Chrome";
-    out.browserVersion = ua.match(/Chrome\/(\d+(?:\.\d+)*)/)?.[1];
-  } else if (/Version\/(\d+(?:\.\d+)*).*Safari/.test(ua)) {
-    out.browser = "Safari";
-    out.browserVersion = ua.match(/Version\/(\d+(?:\.\d+)*)/)?.[1];
-  }
-  return out;
-}
-
-// src/auto-track.ts
-var DEFAULT_AUTO_TRACK = {
-  sessions: true,
-  pageViews: true,
-  deviceInfo: true,
-  clicks: true,
-  webVitals: true,
-  errors: true
-};
-var SESSION_RESUME_THRESHOLD_MS = 30 * 60 * 1e3;
-var EMPTY_ACQUISITION = {
-  utm_source: "",
-  utm_medium: "",
-  utm_campaign: "",
-  utm_content: "",
-  utm_term: "",
-  referrer: "",
-  gclid: "",
-  fbclid: "",
-  msclkid: "",
-  ttclid: "",
-  li_fat_id: "",
-  twclid: ""
-};
-var AutoTracker = class {
-  constructor(cfg, track) {
-    this.cfg = cfg;
-    this.track = track;
-    this.session = null;
-    this.cleanups = [];
-    /**
-     * Stable per-page-view identifier. Minted at every `page.viewed`
-     * emission and attached to every subsequent event until the next
-     * `page.viewed`. Lets dashboards correlate "user clicked X" to
-     * "user viewed page Y" without timestamp arithmetic — the canonical
-     * Mixpanel `$current_url` / Segment `pageId` pattern.
-     *
-     * Null until the first `page.viewed` fires (which happens at SDK
-     * install if `autoTrack.pageViews !== false`).
-     */
-    this.pageviewId = null;
-  }
-  install() {
-    if (!isBrowserSafe()) return;
-    if (this.cfg.sessions) this.installSessionTracking();
-    if (this.cfg.pageViews) this.installPageViewTracking();
-    if (this.cfg.clicks) this.installClickTracking();
-  }
-  uninstall() {
-    while (this.cleanups.length) {
-      const fn = this.cleanups.pop();
-      try {
-        fn?.();
-      } catch {
-      }
-    }
-    if (this.session && !this.session.endedSent) {
-      this.emitSessionEnd();
-    }
-    this.session = null;
-  }
-  /** Exposed for tests + consumers that want to reset the session manually. */
-  resetSession() {
-    if (this.session && !this.session.endedSent) this.emitSessionEnd();
-    this.pageviewId = null;
-    this.session = this.startNewSession();
-    this.emitSessionStart();
-  }
-  /** Exposed for inspection/tests — returns the current sessionId (or null if not in a session). */
-  get currentSessionId() {
-    return this.session?.sessionId ?? null;
-  }
-  /** Stable per-page-view ID. Null before the first page.viewed has fired. */
-  get currentPageviewId() {
-    return this.pageviewId;
-  }
-  /**
-   * Per-session acquisition context — utm_* + referrer, captured once
-   * at session start. Returns empty strings when there's no session
-   * (Node, before init, after uninstall) so callers can spread without
-   * conditional logic. Bank-grade rule: capture once, attach to every
-   * event of the session, don't re-read on every track() (the URL
-   * changes via SPA pushState; the source-of-record is the URL we
-   * landed on).
-   */
-  get currentAcquisition() {
-    return this.session?.acquisition ?? EMPTY_ACQUISITION;
-  }
-  // ---------- sessions ----------
-  installSessionTracking() {
-    this.session = this.startNewSession();
-    this.emitSessionStart();
-    const onVisChange = () => {
-      if (!this.session) return;
-      const doc2 = globalThis.document;
-      if (doc2.visibilityState === "hidden") {
-        this.session.hiddenAt = Date.now();
-      } else if (doc2.visibilityState === "visible") {
-        const hiddenFor = this.session.hiddenAt ? Date.now() - this.session.hiddenAt : 0;
-        if (hiddenFor >= SESSION_RESUME_THRESHOLD_MS) {
-          this.emitSessionEnd();
-          this.pageviewId = null;
-          this.session = this.startNewSession();
-          this.emitSessionStart();
-        } else {
-          this.session.hiddenAt = null;
-        }
-      }
-    };
-    const onPageHide = () => this.emitSessionEnd();
-    const w = globalThis.window;
-    const doc = globalThis.document;
-    doc.addEventListener("visibilitychange", onVisChange);
-    w.addEventListener("pagehide", onPageHide);
-    w.addEventListener("beforeunload", onPageHide);
-    this.cleanups.push(() => {
-      doc.removeEventListener("visibilitychange", onVisChange);
-      w.removeEventListener("pagehide", onPageHide);
-      w.removeEventListener("beforeunload", onPageHide);
-    });
-  }
-  startNewSession() {
-    return {
-      sessionId: mintSessionId(),
-      startedAt: Date.now(),
-      hiddenAt: null,
-      endedSent: false,
-      acquisition: captureAcquisition()
-    };
-  }
-  emitSessionStart() {
-    if (!this.session) return;
-    this.track("session.started", { sessionId: this.session.sessionId });
-  }
-  emitSessionEnd() {
-    if (!this.session || this.session.endedSent) return;
-    const duration = Date.now() - this.session.startedAt;
-    this.track("session.ended", {
-      sessionId: this.session.sessionId,
-      durationMs: duration
-    });
-    this.session.endedSent = true;
-  }
-  // ---------- page views ----------
-  installPageViewTracking() {
-    const w = globalThis.window;
-    const doc = globalThis.document;
-    let lastFiredAt = 0;
-    let lastFiredUrl = "";
-    const DEDUP_WINDOW_MS = 250;
-    const fire = (force = false) => {
-      const loc = w.location;
-      const url = loc.href;
-      const now = Date.now();
-      if (!force && url === lastFiredUrl && now - lastFiredAt < DEDUP_WINDOW_MS) return;
-      lastFiredAt = now;
-      lastFiredUrl = url;
-      this.pageviewId = `pv_${Date.now().toString(36)}${randomChars(10)}`;
-      this.track("page.viewed", {
-        pageviewId: this.pageviewId,
-        path: loc.pathname,
-        url,
-        search: loc.search || void 0,
-        hash: loc.hash || void 0,
-        title: doc.title,
-        // referrer only on the first hit of the session — afterward it's
-        // always our previous URL, which isn't useful.
-        referrer: doc.referrer || void 0
-      });
-    };
-    fire();
-    const origPush = w.history.pushState;
-    const origReplace = w.history.replaceState;
-    function patchedPush(data, unused, url) {
-      origPush.apply(this, [data, unused, url]);
-      queueMicrotask(fire);
-    }
-    function patchedReplace(data, unused, url) {
-      origReplace.apply(this, [data, unused, url]);
-      queueMicrotask(fire);
-    }
-    w.history.pushState = patchedPush;
-    w.history.replaceState = patchedReplace;
-    const onPopState = () => fire(true);
-    w.addEventListener("popstate", onPopState);
-    this.cleanups.push(() => {
-      if (w.history.pushState === patchedPush) {
-        w.history.pushState = origPush;
-      }
-      if (w.history.replaceState === patchedReplace) {
-        w.history.replaceState = origReplace;
-      }
-      w.removeEventListener("popstate", onPopState);
-    });
-  }
-  // ---------- click autocapture ----------
-  /**
-   * Global click tracking — Mixpanel / Amplitude style autocapture.
-   * Fires `element.clicked` for every interactive click with the
-   * target element's selector path, text content, tag, href, data-*
-   * attributes, and viewport coordinates. Powers the funnel /
-   * attribution USP: "users who clicked X then converted within
-   * 7 days." Default ON because behavioural attribution is the
-   * core product promise.
-   *
-   * Privacy guardrails:
-   *   - Skip clicks ON inputs / textareas / selects (form interaction
-   *     isn't button telemetry; the dev should track form submits
-   *     deliberately via track('form_submitted'))
-   *   - Skip clicks INSIDE [type="password"] and password-class
-   *     elements
-   *   - Skip clicks inside elements opted out via class="cd-noTrack"
-   *     or data-cd-noTrack attribute (Mixpanel's exact opt-out
-   *     idiom — most devs already know it)
-   *   - Capture text content but cap at 64 chars and trim — never
-   *     more than what you'd see on a button label
-   *
-   * Volume guardrails:
-   *   - Coalesce double-clicks within 100ms (React's synthetic click
-   *     pattern + browser's native dblclick can fire twice)
-   *   - Listen on document at capture phase so we see the click
-   *     before any framework's own handlers stop propagation
-   */
-  installClickTracking() {
-    const w = globalThis.window;
-    const doc = globalThis.document;
-    let lastFiredAt = 0;
-    let lastFiredTarget = null;
-    const COALESCE_MS = 100;
-    const TEXT_CAP = 64;
-    const onClick = (ev) => {
-      const target = ev.target;
-      if (!target || !(target instanceof Element)) return;
-      const now = Date.now();
-      if (target === lastFiredTarget && now - lastFiredAt < COALESCE_MS) return;
-      lastFiredAt = now;
-      lastFiredTarget = target;
-      const actionable = closestActionable(target);
-      const clicked = actionable || target;
-      if (isFormInput(clicked)) return;
-      if (isInOptedOut(clicked)) return;
-      if (isInsidePasswordField(clicked)) return;
-      const tag = clicked.tagName.toLowerCase();
-      const text = trimText(extractText(clicked), TEXT_CAP);
-      const href = clicked.href || void 0;
-      const linkTarget = clicked.target || void 0;
-      const elementId = clicked.id || void 0;
-      const role = clicked.getAttribute("role") || void 0;
-      const ariaLabel = clicked.getAttribute("aria-label") || void 0;
-      const selector = buildSelector(clicked);
-      const dataAttrs = collectDataAttrs(clicked);
-      const isLink = tag === "a" && !!href;
-      const explicitName = clicked.getAttribute("data-cd-event");
-      const props = {
-        selector,
-        tag,
-        text,
-        elementId,
-        role,
-        ariaLabel,
-        href,
-        isLink,
-        linkTarget,
-        viewportX: ev.clientX,
-        viewportY: ev.clientY,
-        pageX: ev.pageX,
-        pageY: ev.pageY,
-        ...dataAttrs
-      };
-      for (const k of Object.keys(props)) {
-        if (props[k] === void 0 || props[k] === null || props[k] === "") delete props[k];
-      }
-      this.track(explicitName || "element.clicked", props);
-    };
-    doc.addEventListener("click", onClick, { capture: true, passive: true });
-    this.cleanups.push(() => {
-      doc.removeEventListener("click", onClick, { capture: true });
-    });
-  }
-};
-function closestActionable(el) {
-  return el.closest("[data-cd-event]") || el.closest("[data-cd-noTrack]") || el.closest("button, a, [role='button'], [role='link'], input[type='button'], input[type='submit']") || null;
-}
-function isFormInput(el) {
-  if (!(el instanceof HTMLElement)) return false;
-  const tag = el.tagName.toLowerCase();
-  if (tag === "textarea" || tag === "select") return true;
-  if (tag === "input") {
-    const type = (el.type || "").toLowerCase();
-    return type !== "button" && type !== "submit" && type !== "image" && type !== "reset";
-  }
-  return false;
-}
-function isInOptedOut(el) {
-  if (el.closest("[data-cd-noTrack], [data-cd-no-track], .cd-noTrack, .cd-no-track")) return true;
-  return false;
-}
-function isInsidePasswordField(el) {
-  if (el.closest('input[type="password"]')) return true;
-  return false;
-}
-function extractText(el) {
-  const clean = (s) => s.replace(/\s+/g, " ").trim();
-  const explicit = el.getAttribute("data-cd-track") || el.getAttribute("data-track") || el.getAttribute("data-testid");
-  if (explicit) {
-    const t = clean(explicit);
-    if (t) return t;
-  }
-  const aria = el.getAttribute("aria-label");
-  if (aria) {
-    const t = clean(aria);
-    if (t) return t;
-  }
-  const labelledBy = el.getAttribute("aria-labelledby");
-  if (labelledBy && typeof el.ownerDocument?.getElementById === "function") {
-    const parts = [];
-    for (const id of labelledBy.split(/\s+/)) {
-      const ref = el.ownerDocument.getElementById(id);
-      const t = ref?.textContent ? clean(ref.textContent) : "";
-      if (t) parts.push(t);
-    }
-    if (parts.length > 0) return parts.join(" ");
-  }
-  if (el instanceof HTMLInputElement && el.value) {
-    const t = clean(el.value);
-    if (t) return t;
-  }
-  const text = clean(el.textContent || "");
-  if (text) return text;
-  const title = el.getAttribute("title");
-  if (title) {
-    const t = clean(title);
-    if (t) return t;
-  }
-  const img = el.querySelector("img[alt]");
-  if (img) {
-    const alt = img.getAttribute("alt") ?? "";
-    const t = clean(alt);
-    if (t) return t;
-  }
-  const svgTitle = el.querySelector("svg title");
-  if (svgTitle?.textContent) {
-    const t = clean(svgTitle.textContent);
-    if (t) return t;
-  }
-  return "";
-}
-function trimText(s, cap) {
-  if (s.length <= cap) return s;
-  return s.slice(0, cap - 1) + "\u2026";
-}
-function buildSelector(el) {
-  const parts = [];
-  let cur = el;
-  let depth = 0;
-  while (cur && cur.nodeName.toLowerCase() !== "body" && depth < 5) {
-    let part = cur.nodeName.toLowerCase();
-    if (cur.id) {
-      parts.unshift(`${part}#${cur.id}`);
-      break;
-    }
-    if (cur.classList.length > 0) {
-      const cls = Array.from(cur.classList).filter((c) => !c.startsWith("cd-")).slice(0, 2).join(".");
-      if (cls) part += `.${cls}`;
-    }
-    parts.unshift(part);
-    cur = cur.parentElement;
-    depth++;
-  }
-  return parts.join(" > ");
-}
-function collectDataAttrs(el) {
-  const out = {};
-  if (!(el instanceof HTMLElement)) return out;
-  for (const name of el.getAttributeNames()) {
-    if (!name.startsWith("data-")) continue;
-    if (name === "data-cd-noTrack" || name === "data-cd-no-track") continue;
-    if (name === "data-cd-event") continue;
-    const value = el.getAttribute(name) || "";
-    const key = name.replace(/^data-cd-prop-/, "").replace(/^data-/, "");
-    out[key] = value;
-  }
-  return out;
-}
-function isBrowserSafe() {
-  return typeof globalThis.window !== "undefined" && typeof globalThis.document !== "undefined";
-}
-function mintSessionId() {
-  const ts = Date.now().toString(36);
-  return `sess_${ts}${randomChars(10)}`;
-}
-function captureAcquisition() {
-  if (!isBrowserSafe()) return { ...EMPTY_ACQUISITION };
-  const result = { ...EMPTY_ACQUISITION };
-  try {
-    const w = globalThis.window;
-    const params = new URLSearchParams(w.location.search ?? "");
-    result.utm_source = params.get("utm_source") ?? "";
-    result.utm_medium = params.get("utm_medium") ?? "";
-    result.utm_campaign = params.get("utm_campaign") ?? "";
-    result.utm_content = params.get("utm_content") ?? "";
-    result.utm_term = params.get("utm_term") ?? "";
-    result.gclid = params.get("gclid") ?? "";
-    result.fbclid = params.get("fbclid") ?? "";
-    result.msclkid = params.get("msclkid") ?? "";
-    result.ttclid = params.get("ttclid") ?? "";
-    result.li_fat_id = params.get("li_fat_id") ?? "";
-    result.twclid = params.get("twclid") ?? "";
-  } catch {
-  }
-  try {
-    const doc = globalThis.document;
-    if (typeof doc.referrer === "string") result.referrer = doc.referrer;
-  } catch {
-  }
-  return result;
-}
-
-// src/debug.ts
-var SENSITIVE_KEY_PATTERNS = [
-  /^email$/i,
-  /^password$/i,
-  /^token$/i,
-  /^secret$/i,
-  /^card$/i,
-  /^phone$/i,
-  /password/i,
-  /credit_?card/i
-];
-function findSensitivePropertyKeys(properties) {
-  if (!properties) return [];
-  const hits = [];
-  for (const k of Object.keys(properties)) {
-    if (SENSITIVE_KEY_PATTERNS.some((re) => re.test(k))) hits.push(k);
-  }
-  return hits;
-}
-var ConsoleDebugLogger = class {
-  constructor() {
-    this.enabled = false;
-    this.seen = /* @__PURE__ */ new Set();
-  }
-  emit(signal, message, context) {
-    if (!this.enabled) return;
-    if (ONCE_SIGNALS.has(signal)) {
-      if (this.seen.has(signal)) return;
-      this.seen.add(signal);
-    }
-    const ctx = context ? ` ${safeJson(context)}` : "";
-    console.info(`[crossdeck:${signal}] ${message}${ctx}`);
-  }
-};
-var ONCE_SIGNALS = /* @__PURE__ */ new Set([
-  "sdk.configured",
-  "sdk.first_event_sent",
-  "sdk.environment_mismatch"
-]);
-function safeJson(obj) {
-  try {
-    return JSON.stringify(obj);
-  } catch {
-    return "[unserialisable context]";
-  }
-}
-
-// src/event-validation.ts
-var DEFAULT_MAX_STRING = 1024;
-var DEFAULT_MAX_BYTES = 8 * 1024;
-var DEFAULT_MAX_DEPTH = 5;
-function validateEventProperties(input, options = {}) {
-  const warnings = [];
-  if (!input) return { properties: {}, warnings };
-  const maxStringLength = options.maxStringLength ?? DEFAULT_MAX_STRING;
-  const maxBatchPropertyBytes = options.maxBatchPropertyBytes ?? DEFAULT_MAX_BYTES;
-  const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;
-  const seen = /* @__PURE__ */ new Set();
-  const visit = (value, key, depth) => {
-    if (depth > maxDepth) {
-      warnings.push({ kind: "depth_exceeded", key });
-      return { keep: true, value: "[depth-exceeded]" };
-    }
-    if (value === null) return { keep: true, value: null };
-    const t = typeof value;
-    if (t === "string") {
-      const s = value;
-      if (s.length > maxStringLength) {
-        warnings.push({ kind: "truncated_string", key });
-        return { keep: true, value: s.slice(0, maxStringLength - 1) + "\u2026" };
-      }
-      return { keep: true, value: s };
-    }
-    if (t === "number") {
-      if (!Number.isFinite(value)) {
-        warnings.push({ kind: "non_serialisable", key });
-        return { keep: true, value: null };
-      }
-      return { keep: true, value };
-    }
-    if (t === "boolean") return { keep: true, value };
-    if (t === "bigint") {
-      warnings.push({ kind: "coerced_bigint", key });
-      return { keep: true, value: value.toString() };
-    }
-    if (t === "function") {
-      warnings.push({ kind: "dropped_function", key });
-      return { keep: false, value: void 0 };
-    }
-    if (t === "symbol") {
-      warnings.push({ kind: "dropped_symbol", key });
-      return { keep: false, value: void 0 };
-    }
-    if (t === "undefined") {
-      warnings.push({ kind: "dropped_undefined", key });
-      return { keep: false, value: void 0 };
-    }
-    if (value instanceof Date) {
-      warnings.push({ kind: "coerced_date", key });
-      const iso = Number.isFinite(value.getTime()) ? value.toISOString() : null;
-      return { keep: true, value: iso };
-    }
-    if (value instanceof Error) {
-      warnings.push({ kind: "coerced_error", key });
-      return {
-        keep: true,
-        value: {
-          name: value.name,
-          message: value.message,
-          stack: typeof value.stack === "string" ? value.stack.slice(0, maxStringLength) : void 0
-        }
-      };
-    }
-    if (value instanceof Map) {
-      warnings.push({ kind: "coerced_map", key });
-      const obj = {};
-      for (const [k, v] of value.entries()) {
-        const subKey = typeof k === "string" ? k : String(k);
-        const result = visit(v, `${key}.${subKey}`, depth + 1);
-        if (result.keep) obj[subKey] = result.value;
-      }
-      return { keep: true, value: obj };
-    }
-    if (value instanceof Set) {
-      warnings.push({ kind: "coerced_set", key });
-      const arr = [];
-      let i = 0;
-      for (const v of value.values()) {
-        const result = visit(v, `${key}[${i}]`, depth + 1);
-        if (result.keep) arr.push(result.value);
-        i++;
-      }
-      return { keep: true, value: arr };
-    }
-    if (Array.isArray(value)) {
-      if (seen.has(value)) {
-        warnings.push({ kind: "circular_reference", key });
-        return { keep: true, value: "[circular]" };
-      }
-      seen.add(value);
-      const out = [];
-      for (let i = 0; i < value.length; i++) {
-        const result = visit(value[i], `${key}[${i}]`, depth + 1);
-        if (result.keep) out.push(result.value);
-      }
-      seen.delete(value);
-      return { keep: true, value: out };
-    }
-    if (t === "object") {
-      const obj = value;
-      if (seen.has(obj)) {
-        warnings.push({ kind: "circular_reference", key });
-        return { keep: true, value: "[circular]" };
-      }
-      seen.add(obj);
-      const out = {};
-      for (const k of Object.keys(obj)) {
-        const result = visit(obj[k], `${key}.${k}`, depth + 1);
-        if (result.keep) out[k] = result.value;
-      }
-      seen.delete(obj);
-      return { keep: true, value: out };
-    }
-    warnings.push({ kind: "non_serialisable", key });
-    try {
-      return { keep: true, value: String(value) };
-    } catch {
-      return { keep: false, value: void 0 };
-    }
-  };
-  const cleaned = {};
-  for (const k of Object.keys(input)) {
-    const result = visit(input[k], k, 0);
-    if (result.keep) cleaned[k] = result.value;
-  }
-  const serialised = safeStringify(cleaned);
-  if (serialised && byteLength(serialised) > maxBatchPropertyBytes) {
-    warnings.push({ kind: "size_cap_exceeded", key: "*" });
-    const sizes = Object.keys(cleaned).map((k) => ({ k, size: byteLength(safeStringify(cleaned[k]) ?? "") })).sort((a, b) => b.size - a.size);
-    let currentSize = byteLength(serialised);
-    for (const { k } of sizes) {
-      if (currentSize <= maxBatchPropertyBytes) break;
-      currentSize -= sizes.find((s) => s.k === k).size;
-      delete cleaned[k];
-    }
-    cleaned.__truncated = true;
-  }
-  return { properties: cleaned, warnings };
-}
-function safeStringify(v) {
-  try {
-    return JSON.stringify(v) ?? null;
-  } catch {
-    return null;
-  }
-}
-function byteLength(s) {
-  if (typeof TextEncoder !== "undefined") {
-    return new TextEncoder().encode(s).length;
-  }
-  return s.length * 4;
-}
-
-// src/super-properties.ts
-var KEY_SUPER = "super_props";
-var KEY_GROUPS = "groups";
-var SuperPropertyStore = class {
-  constructor(storage, prefix) {
-    this.storage = storage;
-    this.prefix = prefix;
-    this.superProps = {};
-    this.groups = {};
-    this.superProps = readJson(storage, prefix + KEY_SUPER) ?? {};
-    this.groups = readJson(storage, prefix + KEY_GROUPS) ?? {};
-  }
-  // ---------- super properties ----------
-  /**
-   * Merge new keys into the super-property bag. Returns a snapshot of
-   * the resulting bag. Values that are `null` are deleted (Mixpanel
-   * semantics — explicit null = "stop tracking this key").
-   */
-  register(props) {
-    for (const [k, v] of Object.entries(props)) {
-      if (v === null) {
-        delete this.superProps[k];
-      } else if (v !== void 0) {
-        this.superProps[k] = v;
-      }
-    }
-    writeJson(this.storage, this.prefix + KEY_SUPER, this.superProps);
-    return { ...this.superProps };
-  }
-  /** Remove a single super-property key. Idempotent. */
-  unregister(key) {
-    if (key in this.superProps) {
-      delete this.superProps[key];
-      writeJson(this.storage, this.prefix + KEY_SUPER, this.superProps);
-    }
-  }
-  /** Snapshot of the current super-property bag. */
-  getSuperProperties() {
-    return { ...this.superProps };
-  }
-  // ---------- groups ----------
-  /**
-   * Set a group membership. Passing `id: null` clears the membership
-   * for that group type — the SDK stops attaching it to events.
-   */
-  setGroup(type, id, traits) {
-    if (id === null) {
-      delete this.groups[type];
-    } else {
-      this.groups[type] = traits !== void 0 ? { id, traits } : { id };
-    }
-    writeJson(this.storage, this.prefix + KEY_GROUPS, this.groups);
-  }
-  /**
-   * Snapshot of the current groups map, keyed by group type. Returned
-   * shape mirrors what the SDK attaches to every event as
-   * `$groups.{type}`. The `traits` sub-object is the most-recent
-   * traits payload passed to `setGroup` for that type; null when none.
-   */
-  getGroups() {
-    return JSON.parse(JSON.stringify(this.groups));
-  }
-  /**
-   * The flat `{ type: id }` projection used for event-attachment. Stable
-   * for fast every-event merge — we don't want to JSON-clone on each
-   * track() call.
-   */
-  getGroupIds() {
-    const out = {};
-    for (const [type, info] of Object.entries(this.groups)) {
-      out[type] = info.id;
-    }
-    return out;
-  }
-  /** Wipe both bags. Called by Crossdeck.reset() (logout). */
-  clear() {
-    this.superProps = {};
-    this.groups = {};
-    try {
-      this.storage.removeItem(this.prefix + KEY_SUPER);
-    } catch {
-    }
-    try {
-      this.storage.removeItem(this.prefix + KEY_GROUPS);
-    } catch {
-    }
-  }
-};
-function readJson(storage, key) {
-  let raw;
-  try {
-    raw = storage.getItem(key);
-  } catch {
-    return null;
-  }
-  if (!raw) return null;
-  try {
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-function writeJson(storage, key, value) {
-  try {
-    storage.setItem(key, JSON.stringify(value));
-  } catch {
-  }
-}
-
-// src/web-vitals.ts
-var WebVitalsTracker = class {
-  constructor(cfg, report) {
-    this.cfg = cfg;
-    this.report = report;
-    this.observers = [];
-    this.flushed = /* @__PURE__ */ new Set();
-    this.cls = 0;
-    this.clsEntries = [];
-    this.inp = 0;
-    this.cleanups = [];
-  }
-  install() {
-    if (!this.cfg.enabled) return;
-    if (typeof PerformanceObserver === "undefined") return;
-    if (typeof globalThis === "undefined" || !("document" in globalThis)) return;
-    const doc = globalThis.document;
-    try {
-      const navObserver = new PerformanceObserver((list) => {
-        for (const entry of list.getEntries()) {
-          const e = entry;
-          if (e.responseStart > 0 && !this.flushed.has("ttfb")) {
-            this.flushed.add("ttfb");
-            this.report("webvitals.ttfb", { valueMs: Math.round(e.responseStart - e.startTime) });
-          }
-        }
-      });
-      navObserver.observe({ type: "navigation", buffered: true });
-      this.observers.push(navObserver);
-    } catch {
-    }
-    try {
-      const paintObserver = new PerformanceObserver((list) => {
-        for (const entry of list.getEntries()) {
-          if (entry.name === "first-contentful-paint" && !this.flushed.has("fcp")) {
-            this.flushed.add("fcp");
-            this.report("webvitals.fcp", { valueMs: Math.round(entry.startTime) });
-          }
-        }
-      });
-      paintObserver.observe({ type: "paint", buffered: true });
-      this.observers.push(paintObserver);
-    } catch {
-    }
-    let lcpValue = 0;
-    try {
-      const lcpObserver = new PerformanceObserver((list) => {
-        const entries = list.getEntries();
-        const last = entries[entries.length - 1];
-        if (last) lcpValue = last.startTime;
-      });
-      lcpObserver.observe({ type: "largest-contentful-paint", buffered: true });
-      this.observers.push(lcpObserver);
-    } catch {
-    }
-    try {
-      const clsObserver = new PerformanceObserver((list) => {
-        for (const entry of list.getEntries()) {
-          const e = entry;
-          if (typeof e.value === "number" && !e.hadRecentInput) {
-            this.cls += e.value;
-            this.clsEntries.push(entry);
-          }
-        }
-      });
-      clsObserver.observe({ type: "layout-shift", buffered: true });
-      this.observers.push(clsObserver);
-    } catch {
-    }
-    try {
-      const eventObserver = new PerformanceObserver((list) => {
-        for (const entry of list.getEntries()) {
-          const e = entry;
-          if (e.interactionId && e.duration > this.inp) {
-            this.inp = e.duration;
-          }
-        }
-      });
-      try {
-        eventObserver.observe({ type: "event", buffered: true, durationThreshold: 16 });
-      } catch {
-        eventObserver.observe({ type: "first-input", buffered: true });
-      }
-      this.observers.push(eventObserver);
-    } catch {
-    }
-    const flush = () => {
-      if (lcpValue > 0 && !this.flushed.has("lcp")) {
-        this.flushed.add("lcp");
-        this.report("webvitals.lcp", { valueMs: Math.round(lcpValue) });
-      }
-      if (this.cls > 0 && !this.flushed.has("cls")) {
-        this.flushed.add("cls");
-        this.report("webvitals.cls", { value: Math.round(this.cls * 1e3) / 1e3 });
-      }
-      if (this.inp > 0 && !this.flushed.has("inp")) {
-        this.flushed.add("inp");
-        this.report("webvitals.inp", { valueMs: Math.round(this.inp) });
-      }
-    };
-    const onHidden = () => {
-      if (doc.visibilityState === "hidden") flush();
-    };
-    doc.addEventListener("visibilitychange", onHidden);
-    globalThis.window.addEventListener("pagehide", flush);
-    this.cleanups.push(() => {
-      doc.removeEventListener("visibilitychange", onHidden);
-      globalThis.window.removeEventListener("pagehide", flush);
-    });
-  }
-  uninstall() {
-    for (const o of this.observers) {
-      try {
-        o.disconnect();
-      } catch {
-      }
-    }
-    this.observers = [];
-    for (const fn of this.cleanups.splice(0)) {
-      try {
-        fn();
-      } catch {
-      }
-    }
-  }
-};
-
-// src/consent.ts
-var ALL_GRANTED = {
-  analytics: true,
-  marketing: true,
-  errors: true
-};
-var ConsentManager = class {
-  constructor(options) {
-    this.state = { ...ALL_GRANTED };
-    this.dntDenied = false;
-    if (options?.respectDnt && this.detectDnt()) {
-      this.dntDenied = true;
-      this.state = { analytics: false, marketing: false, errors: false };
-    }
-  }
-  /**
-   * Merge new dimensions onto the current state. Returns the resulting
-   * snapshot. DNT-derived denies cannot be flipped back on by a `set`
-   * call — once the browser says "don't track", we don't track even if
-   * the developer code disagrees. That's the contract.
-   */
-  set(partial) {
-    if (this.dntDenied) return { ...this.state };
-    for (const k of Object.keys(partial)) {
-      const v = partial[k];
-      if (typeof v === "boolean") this.state[k] = v;
-    }
-    return { ...this.state };
-  }
-  /** Snapshot of the current state. */
-  get() {
-    return { ...this.state };
-  }
-  /** Convenience getters for hot paths. */
-  get analytics() {
-    return this.state.analytics;
-  }
-  get marketing() {
-    return this.state.marketing;
-  }
-  get errors() {
-    return this.state.errors;
-  }
-  /** True iff the constructor detected and applied DNT. */
-  get isDntDenied() {
-    return this.dntDenied;
-  }
-  detectDnt() {
-    try {
-      const nav = globalThis.navigator;
-      if (!nav) return false;
-      const sources = [
-        nav.doNotTrack,
-        nav.msDoNotTrack,
-        globalThis.doNotTrack
-      ];
-      return sources.some((v) => v === "1" || v === "yes");
-    } catch {
-      return false;
-    }
-  }
-};
-var EMAIL_PATTERN = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
-var CARD_PATTERN = /\b\d(?:[ -]?\d){12,18}\b/g;
-var REPLACEMENT_EMAIL = "<email>";
-var REPLACEMENT_CARD = "<card>";
-function scrubPii(value) {
-  if (!value) return value;
-  return value.replace(EMAIL_PATTERN, REPLACEMENT_EMAIL).replace(CARD_PATTERN, REPLACEMENT_CARD);
-}
-function scrubPiiFromProperties(properties) {
-  const out = {};
-  for (const k of Object.keys(properties)) {
-    out[k] = scrubValue(properties[k]);
-  }
-  return out;
-}
-function scrubValue(v) {
-  if (typeof v === "string") return scrubPii(v);
-  if (Array.isArray(v)) return v.map(scrubValue);
-  if (v && typeof v === "object" && v.constructor === Object) {
-    return scrubPiiFromProperties(v);
-  }
-  return v;
-}
-
-// src/breadcrumbs.ts
-var BreadcrumbBuffer = class {
-  constructor(maxSize = 50) {
-    this.maxSize = maxSize;
-    this.items = [];
-  }
-  add(crumb) {
-    this.items.push(crumb);
-    if (this.items.length > this.maxSize) {
-      this.items.shift();
-    }
-  }
-  /** Defensive copy — caller can read freely without mutating buffer state. */
-  snapshot() {
-    return this.items.slice();
-  }
-  clear() {
-    this.items = [];
-  }
-  get size() {
-    return this.items.length;
-  }
-};
-
-// src/stack-parser.ts
-function parseStack(stack) {
-  if (!stack || typeof stack !== "string") return [];
-  const lines = stack.split("\n");
-  const frames = [];
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (!trimmed) continue;
-    const frame = parseLine(trimmed);
-    if (frame) frames.push(frame);
-  }
-  return frames;
-}
-function parseLine(line) {
-  let m = /^at\s+(.+?)\s+\((.+?):(\d+):(\d+)\)$/.exec(line);
-  if (m) {
-    return buildFrame({
-      function: m[1],
-      filename: m[2],
-      lineno: parseInt(m[3], 10),
-      colno: parseInt(m[4], 10),
-      raw: line
-    });
-  }
-  m = /^at\s+(.+?):(\d+):(\d+)$/.exec(line);
-  if (m) {
-    return buildFrame({
-      function: "?",
-      filename: m[1],
-      lineno: parseInt(m[2], 10),
-      colno: parseInt(m[3], 10),
-      raw: line
-    });
-  }
-  m = /^(.*?)@(.+?):(\d+):(\d+)$/.exec(line);
-  if (m) {
-    return buildFrame({
-      function: m[1] || "?",
-      filename: m[2],
-      lineno: parseInt(m[3], 10),
-      colno: parseInt(m[4], 10),
-      raw: line
-    });
-  }
-  if (/^\w*Error/.test(line) || !line.includes(":")) {
-    return null;
-  }
-  return {
-    function: "?",
-    filename: "",
-    lineno: 0,
-    colno: 0,
-    in_app: true,
-    raw: line
-  };
-}
-function buildFrame(input) {
-  return {
-    function: input.function || "?",
-    filename: input.filename,
-    lineno: Number.isFinite(input.lineno) ? input.lineno : 0,
-    colno: Number.isFinite(input.colno) ? input.colno : 0,
-    in_app: isInAppFrame(input.filename),
-    raw: input.raw
-  };
-}
-function isInAppFrame(filename) {
-  if (!filename) return true;
-  if (/^(?:chrome|moz|safari|webkit)-extension:\/\//.test(filename)) return false;
-  if (/\bcdn\.jsdelivr\.net\b/.test(filename)) return false;
-  if (/\bunpkg\.com\b/.test(filename)) return false;
-  if (/\bgoogletagmanager\.com\b/.test(filename)) return false;
-  if (/\bgoogle-analytics\.com\b/.test(filename)) return false;
-  if (/\b@cross-deck\/web\b/.test(filename)) return false;
-  if (/\/crossdeck\.umd\.min\.js$/.test(filename)) return false;
-  return true;
-}
-function fingerprintError(message, frames, location) {
-  const inAppFrames = frames.filter((f) => f.in_app).slice(0, 3);
-  const parts = [
-    (message || "").slice(0, 200),
-    ...inAppFrames.map((f) => `${f.function}@${f.filename}:${f.lineno}`)
-  ];
-  if (inAppFrames.length === 0 && location) {
-    const loc = [
-      location.errorType ?? "",
-      location.filename ?? "",
-      location.lineno ?? "",
-      location.colno ?? ""
-    ].join(":");
-    if (loc !== ":::") parts.push(loc);
-  }
-  return djb2Hex(parts.join("|"));
-}
-function djb2Hex(input) {
-  let h = 5381;
-  for (let i = 0; i < input.length; i++) {
-    h = (h << 5) + h + input.charCodeAt(i) | 0;
-  }
-  return (h >>> 0).toString(16).padStart(8, "0");
-}
-
-// src/error-capture.ts
-var DEFAULT_ERROR_CAPTURE = {
-  enabled: true,
-  onError: true,
-  onUnhandledRejection: true,
-  wrapFetch: true,
-  wrapXhr: true,
-  captureConsole: false,
-  ignoreErrors: [
-    // Classic browser noise. These aren't application bugs.
-    "ResizeObserver loop limit exceeded",
-    "ResizeObserver loop completed with undelivered notifications",
-    "Non-Error promise rejection captured"
-    // NOTE: We deliberately do NOT drop cross-origin "Script error."
-    // events here. They used to be silently filtered as noise, but
-    // silent drops are the opposite of "developer sleeps well at
-    // night". We now capture them with a clear label and the
-    // `cross_origin` tag so the dashboard surfaces them as a
-    // distinct, actionable category (the fix is always the same —
-    // add `crossorigin="anonymous"` to the script tag + CORS
-    // headers on the script's origin). Apps that genuinely want
-    // them muted can re-add "Script error" to ignoreErrors via
-    // init config.
-  ],
-  allowUrls: [],
-  denyUrls: [
-    // Common third-party extensions that pollute error streams.
-    /^chrome-extension:\/\//,
-    /^moz-extension:\/\//,
-    /^safari-extension:\/\//,
-    /^webkit-extension:\/\//,
-    /^safari-web-extension:\/\//
-  ],
-  sampleRate: 1,
-  maxPerFingerprintPerMinute: 5,
-  maxPerSession: 100
-};
-var ErrorTracker = class {
-  constructor(opts) {
-    this.opts = opts;
-    this.installed = false;
-    this.cleanups = [];
-    this._reporting = false;
-    this.sessionCount = 0;
-    this.fingerprintWindow = /* @__PURE__ */ new Map();
-  }
-  install() {
-    if (this.installed) return;
-    if (!this.opts.config.enabled) return;
-    if (typeof globalThis === "undefined" || !("window" in globalThis)) return;
-    const w = globalThis.window;
-    if (this.opts.config.onError) this.installOnErrorListener(w);
-    if (this.opts.config.onUnhandledRejection) this.installRejectionListener(w);
-    if (this.opts.config.wrapFetch) this.installFetchWrap(w);
-    if (this.opts.config.wrapXhr) this.installXhrWrap(w);
-    if (this.opts.config.captureConsole) this.installConsoleWrap();
-    this.installed = true;
-  }
-  uninstall() {
-    for (const fn of this.cleanups.splice(0)) {
-      try {
-        fn();
-      } catch {
-      }
-    }
-    this.installed = false;
-  }
-  /**
-   * Manual API. Either an Error instance or any unknown value (we
-   * coerce). Returns silently — never throws.
-   */
-  captureError(error, options) {
-    if (!this.opts.isConsented()) return;
-    try {
-      const captured = this.buildFromUnknown(error, "error.handled", options?.level ?? "error");
-      if (options?.context) captured.context = { ...captured.context, ...options.context };
-      if (options?.tags) captured.tags = { ...captured.tags, ...options.tags };
-      this.maybeReport(captured);
-    } catch {
-    }
-  }
-  /**
-   * Capture a non-error event as an issue. For "we hit a soft-warning
-   * code path" / "deprecated API used" kinds of signals. Pairs with
-   * Sentry's captureMessage().
-   */
-  captureMessage(message, level = "info") {
-    if (!this.opts.isConsented()) return;
-    try {
-      const captured = {
-        timestamp: Date.now(),
-        kind: "error.message",
-        level,
-        message,
-        errorType: null,
-        frames: [],
-        rawStack: null,
-        filename: null,
-        lineno: null,
-        colno: null,
-        fingerprint: fingerprintError(message, []),
-        breadcrumbs: this.opts.breadcrumbs.snapshot(),
-        context: this.opts.getContext(),
-        tags: this.opts.getTags()
-      };
-      this.maybeReport(captured);
-    } catch {
-    }
-  }
-  // ============================================================
-  // Listener installation
-  // ============================================================
-  installOnErrorListener(w) {
-    const handler = (event) => {
-      if (this._reporting) return;
-      if (!this.opts.isConsented()) return;
-      try {
-        this._reporting = true;
-        const captured = this.buildFromErrorEvent(event);
-        this.maybeReport(captured);
-      } catch {
-      } finally {
-        this._reporting = false;
-      }
-    };
-    w.addEventListener("error", handler, true);
-    this.cleanups.push(() => w.removeEventListener("error", handler, true));
-  }
-  installRejectionListener(w) {
-    const handler = (event) => {
-      if (this._reporting) return;
-      if (!this.opts.isConsented()) return;
-      try {
-        this._reporting = true;
-        const captured = this.buildFromUnknown(
-          event.reason,
-          "error.unhandledrejection",
-          "error"
-        );
-        this.maybeReport(captured);
-      } catch {
-      } finally {
-        this._reporting = false;
-      }
-    };
-    w.addEventListener("unhandledrejection", handler);
-    this.cleanups.push(() => w.removeEventListener("unhandledrejection", handler));
-  }
-  /**
-   * Wrap fetch() so failed HTTP requests get auto-captured. We do NOT
-   * call this an "error" for 4xx (those are often expected — auth
-   * required, validation failed). Only 5xx + network failures fire.
-   */
-  installFetchWrap(w) {
-    const origFetch = w.fetch?.bind(w);
-    if (!origFetch) return;
-    const wrapped = async (...args) => {
-      const input = args[0];
-      const init = args[1] ?? {};
-      const url = typeof input === "string" ? input : input?.url ?? "";
-      const method = (init.method || "GET").toUpperCase();
-      const start = Date.now();
-      if (!isSelfRequest(url, this.opts.selfHostname)) {
-        this.opts.breadcrumbs.add({
-          timestamp: start,
-          category: "http",
-          message: `${method} ${url}`,
-          data: { url, method }
-        });
-      }
-      try {
-        const response = await origFetch(...args);
-        if (response.status >= 500 && this.opts.isConsented()) {
-          if (!isSelfRequest(url, this.opts.selfHostname)) {
-            this.captureHttp({
-              url,
-              method,
-              status: response.status,
-              statusText: response.statusText
-            });
-          }
-        }
-        return response;
-      } catch (err) {
-        if (this.opts.isConsented() && !url.includes("api.cross-deck.com")) {
-          this.captureHttp({
-            url,
-            method,
-            status: 0,
-            statusText: err instanceof Error ? err.message : "network error"
-          });
-        }
-        throw err;
-      }
-    };
-    w.fetch = wrapped;
-    this.cleanups.push(() => {
-      if (w.fetch === wrapped) w.fetch = origFetch;
-    });
-  }
-  /**
-   * Wrap XMLHttpRequest for legacy consumers (jQuery $.ajax under the
-   * hood, older bundlers). Same capture semantics as fetch.
-   */
-  installXhrWrap(w) {
-    const xhrCtor = w.XMLHttpRequest;
-    const proto = xhrCtor?.prototype;
-    if (!proto) return;
-    const origOpen = proto.open;
-    const origSend = proto.send;
-    const tracker = this;
-    proto.open = function(method, url, ...rest) {
-      this._cdMethod = method;
-      this._cdUrl = url;
-      return origOpen.apply(this, [method, url, ...rest]);
-    };
-    proto.send = function(body) {
-      const xhr = this;
-      const onLoad = () => {
-        try {
-          if (xhr.status >= 500 && tracker.opts.isConsented()) {
-            const url = xhr._cdUrl ?? "";
-            if (!isSelfRequest(url, tracker.opts.selfHostname)) {
-              tracker.captureHttp({
-                url,
-                method: (xhr._cdMethod ?? "GET").toUpperCase(),
-                status: xhr.status,
-                statusText: xhr.statusText
-              });
-            }
-          }
-        } catch {
-        }
-      };
-      xhr.addEventListener("loadend", onLoad);
-      return origSend.apply(this, [body ?? null]);
-    };
-    this.cleanups.push(() => {
-      proto.open = origOpen;
-      proto.send = origSend;
-    });
-  }
-  installConsoleWrap() {
-    const console2 = globalThis.console;
-    if (!console2) return;
-    const orig = console2.error.bind(console2);
-    console2.error = (...args) => {
-      try {
-        if (this.opts.isConsented()) {
-          this.captureMessage(args.map((a) => safeStringify2(a)).join(" "), "error");
-        }
-      } catch {
-      }
-      return orig(...args);
-    };
-    this.cleanups.push(() => {
-      console2.error = orig;
-    });
-  }
-  // ============================================================
-  // Builders
-  // ============================================================
-  buildFromErrorEvent(event) {
-    const err = event.error;
-    const filename = event.filename || null;
-    const lineno = typeof event.lineno === "number" && event.lineno > 0 ? event.lineno : null;
-    const colno = typeof event.colno === "number" && event.colno > 0 ? event.colno : null;
-    const isCrossOriginStripped = err == null && !filename && lineno == null && (event.message === "Script error." || event.message === "Script error" || !event.message);
-    if (isCrossOriginStripped) {
-      const message2 = "Cross-origin script error (browser hid details \u2014 script needs crossorigin attribute + CORS headers)";
-      return {
-        timestamp: Date.now(),
-        kind: "error.unhandled",
-        level: "error",
-        message: message2,
-        errorType: "ScriptError",
-        frames: [],
-        rawStack: null,
-        filename: null,
-        lineno: null,
-        colno: null,
-        // No location to fingerprint by — all of these will share one
-        // group, which is correct: developer fixes them all with the
-        // same CORS change.
-        fingerprint: fingerprintError(message2, []),
-        breadcrumbs: this.opts.breadcrumbs.snapshot(),
-        context: this.opts.getContext(),
-        tags: { ...this.opts.getTags(), cross_origin: "true" }
-      };
-    }
-    const payload = coerceErrorPayload(err);
-    const message = (payload.message || event.message || "Unknown error").slice(0, 1024);
-    const stack = err instanceof Error ? err.stack ?? null : null;
-    const frames = parseStack(stack);
-    const errorType = payload.errorType ?? null;
-    const context = payload.extras ? { ...this.opts.getContext(), __error_extras: payload.extras } : this.opts.getContext();
-    return {
-      timestamp: Date.now(),
-      kind: "error.unhandled",
-      level: "error",
-      message,
-      errorType,
-      frames,
-      rawStack: stack,
-      filename,
-      lineno,
-      colno,
-      // Location fallback ensures distinct call sites stay separate
-      // even when the message is generic ("Unknown error",
-      // "[object Object]") and there are no parseable frames.
-      fingerprint: fingerprintError(message, frames, {
-        filename,
-        lineno,
-        colno,
-        errorType
-      }),
-      breadcrumbs: this.opts.breadcrumbs.snapshot(),
-      context,
-      tags: this.opts.getTags()
-    };
-  }
-  buildFromUnknown(err, kind, level) {
-    const payload = coerceErrorPayload(err);
-    const message = (payload.message || "Unknown error").slice(0, 1024);
-    const stack = err instanceof Error ? err.stack ?? null : null;
-    const frames = parseStack(stack);
-    const errorType = payload.errorType ?? null;
-    const context = payload.extras ? { ...this.opts.getContext(), __error_extras: payload.extras } : this.opts.getContext();
-    return {
-      timestamp: Date.now(),
-      kind,
-      level,
-      message,
-      errorType,
-      frames,
-      rawStack: stack,
-      filename: null,
-      lineno: null,
-      colno: null,
-      fingerprint: fingerprintError(message, frames, { errorType }),
-      breadcrumbs: this.opts.breadcrumbs.snapshot(),
-      context,
-      tags: this.opts.getTags()
-    };
-  }
-  captureHttp(info) {
-    try {
-      const message = `HTTP ${info.status} ${info.method} ${info.url}`;
-      const captured = {
-        timestamp: Date.now(),
-        kind: "error.http",
-        level: "error",
-        message,
-        errorType: `HTTPError`,
-        frames: [],
-        rawStack: null,
-        filename: info.url,
-        lineno: null,
-        colno: null,
-        fingerprint: fingerprintError(`HTTP ${info.status} ${info.method}`, [], {
-          filename: info.url,
-          errorType: "HTTPError"
-        }),
-        breadcrumbs: this.opts.breadcrumbs.snapshot(),
-        context: this.opts.getContext(),
-        tags: this.opts.getTags(),
-        http: info
-      };
-      this.maybeReport(captured);
-    } catch {
-    }
-  }
-  // ============================================================
-  // Reporting pipeline — filter / sample / rate-limit / send
-  // ============================================================
-  maybeReport(err) {
-    if (this.sessionCount >= this.opts.config.maxPerSession) return;
-    if (this.shouldIgnore(err)) return;
-    if (!this.passesUrlGate(err)) return;
-    if (!this.passesSample(err)) return;
-    if (!this.passesRateLimit(err)) return;
-    let finalErr = err;
-    const hook = this.opts.beforeSend?.();
-    if (hook) {
-      try {
-        finalErr = hook(err);
-      } catch {
-        finalErr = err;
-      }
-      if (!finalErr) return;
-    }
-    this.sessionCount += 1;
-    try {
-      this.opts.report(finalErr);
-    } catch {
-    }
-  }
-  shouldIgnore(err) {
-    for (const pat of this.opts.config.ignoreErrors) {
-      if (typeof pat === "string" && err.message.includes(pat)) return true;
-      if (pat instanceof RegExp && pat.test(err.message)) return true;
-    }
-    return false;
-  }
-  passesUrlGate(err) {
-    const topFrame = err.frames.find((f) => f.filename) ?? null;
-    const url = topFrame?.filename ?? err.filename ?? "";
-    if (!url) return true;
-    for (const pat of this.opts.config.denyUrls) {
-      if (typeof pat === "string" && url.includes(pat)) return false;
-      if (pat instanceof RegExp && pat.test(url)) return false;
-    }
-    if (this.opts.config.allowUrls.length > 0) {
-      for (const pat of this.opts.config.allowUrls) {
-        if (typeof pat === "string" && url.includes(pat)) return true;
-        if (pat instanceof RegExp && pat.test(url)) return true;
-      }
-      return false;
-    }
-    return true;
-  }
-  passesSample(err) {
-    if (this.opts.config.sampleRate >= 1) return true;
-    if (this.opts.config.sampleRate <= 0) return false;
-    const hashByte = parseInt(err.fingerprint.slice(0, 2), 16);
-    return hashByte / 255 < this.opts.config.sampleRate;
-  }
-  passesRateLimit(err) {
-    const windowMs = 6e4;
-    const now = Date.now();
-    const max = this.opts.config.maxPerFingerprintPerMinute;
-    const arr = this.fingerprintWindow.get(err.fingerprint) ?? [];
-    const fresh = arr.filter((t) => now - t < windowMs);
-    if (fresh.length >= max) {
-      this.fingerprintWindow.set(err.fingerprint, fresh);
-      return false;
-    }
-    fresh.push(now);
-    this.fingerprintWindow.set(err.fingerprint, fresh);
-    return true;
-  }
-};
-function coerceErrorPayload(v) {
-  if (v === null) return { message: "(thrown: null)", errorType: null, extras: null };
-  if (v === void 0) return { message: "(thrown: undefined)", errorType: null, extras: null };
-  if (typeof v === "string") {
-    return { message: v, errorType: null, extras: null };
-  }
-  if (typeof v === "number" || typeof v === "boolean" || typeof v === "bigint") {
-    return { message: String(v), errorType: typeof v, extras: null };
-  }
-  if (typeof v === "symbol") {
-    return { message: v.toString(), errorType: "symbol", extras: null };
-  }
-  if (typeof v === "function") {
-    return { message: `(thrown function: ${v.name || "anonymous"})`, errorType: "function", extras: null };
-  }
-  if (v instanceof Error) {
-    const errorType = v.name || v.constructor?.name || "Error";
-    const message = typeof v.message === "string" && v.message.length > 0 ? v.message : safeToString(v) || errorType;
-    const extras = {};
-    const causeChain = collectCauseChain(v);
-    if (causeChain.length > 0) extras.cause = causeChain;
-    for (const key of ["code", "status", "statusCode", "errno", "response", "data", "detail", "details"]) {
-      const val = v[key];
-      if (val !== void 0 && typeof val !== "function") {
-        extras[key] = safeClone(val);
-      }
-    }
-    for (const key of Object.keys(v)) {
-      if (key === "message" || key === "stack" || key === "name" || key === "cause") continue;
-      if (key in extras) continue;
-      const val = v[key];
-      if (typeof val === "function") continue;
-      extras[key] = safeClone(val);
-    }
-    return {
-      message,
-      errorType,
-      extras: Object.keys(extras).length > 0 ? extras : null
-    };
-  }
-  if (typeof Response !== "undefined" && v instanceof Response) {
-    return {
-      message: `HTTP ${v.status} ${v.statusText || ""}${v.url ? ` ${v.url}` : ""}`.trim(),
-      errorType: "Response",
-      extras: { status: v.status, statusText: v.statusText, url: v.url, type: v.type }
-    };
-  }
-  if (typeof v === "object") {
-    const obj = v;
-    const ctorName = obj.constructor && typeof obj.constructor === "function" && obj.constructor.name || null;
-    const ownMessage = typeof obj.message === "string" && obj.message ? obj.message : null;
-    const ownName = typeof obj.name === "string" && obj.name ? obj.name : null;
-    let jsonForm = null;
-    try {
-      const serialised = JSON.stringify(obj);
-      jsonForm = serialised === "{}" ? null : serialised;
-    } catch {
-      jsonForm = null;
-    }
-    const fallbackString = safeToString(obj);
-    const message = ownMessage ?? jsonForm ?? (fallbackString && fallbackString !== "[object Object]" ? fallbackString : null) ?? (ctorName ? `(thrown ${ctorName} with no message)` : "(thrown object with no message)");
-    const errorType = ownName ?? ctorName ?? null;
-    const extras = {};
-    let count = 0;
-    for (const key of Object.keys(obj)) {
-      if (count >= 20) break;
-      if (key === "message" || key === "name") continue;
-      const val = obj[key];
-      if (typeof val === "function") continue;
-      extras[key] = safeClone(val);
-      count++;
-    }
-    return {
-      message,
-      errorType,
-      extras: Object.keys(extras).length > 0 ? extras : null
-    };
-  }
-  return { message: safeToString(v) || "(unstringifiable thrown value)", errorType: null, extras: null };
-}
-function collectCauseChain(err) {
-  const out = [];
-  let cur = err.cause;
-  let depth = 0;
-  while (cur != null && depth < 5) {
-    if (cur instanceof Error) {
-      out.push({ name: cur.name || "Error", message: cur.message || "" });
-      cur = cur.cause;
-    } else {
-      out.push({ name: "non-Error", message: safeToString(cur) });
-      cur = null;
-    }
-    depth++;
-  }
-  return out;
-}
-function safeToString(v) {
-  try {
-    const s = Object.prototype.toString.call(v);
-    if (s !== "[object Object]") return s;
-    const own = v?.toString;
-    if (typeof own === "function" && own !== Object.prototype.toString) {
-      const r = own.call(v);
-      if (typeof r === "string") return r;
-    }
-    return s;
-  } catch {
-    return "(throwing toString)";
-  }
-}
-function safeClone(v) {
-  if (v == null) return v;
-  const t = typeof v;
-  if (t === "string" || t === "number" || t === "boolean") return v;
-  if (t === "bigint") return String(v);
-  try {
-    const s = JSON.stringify(v);
-    return s === void 0 ? safeToString(v) : JSON.parse(s);
-  } catch {
-    return safeToString(v);
-  }
-}
-function safeStringify2(v) {
-  return coerceErrorPayload(v).message;
-}
-function extractSelfHostname(baseUrl) {
-  if (!baseUrl || typeof baseUrl !== "string") return null;
-  try {
-    return new URL(baseUrl).hostname.toLowerCase();
-  } catch {
-    return null;
-  }
-}
-function isSelfRequest(requestUrl, selfHostname) {
-  if (!selfHostname || !requestUrl) return false;
-  try {
-    return new URL(requestUrl).hostname.toLowerCase() === selfHostname;
-  } catch {
-    return false;
-  }
-}
-
-// src/crossdeck.ts
-var CrossdeckClient = class {
-  constructor() {
-    this.state = null;
-  }
-  /**
-   * Boot the SDK. Idempotent — calling init twice with the same options
-   * is a no-op; calling with different options replaces the previous
-   * configuration.
-   *
-   * NorthStar §11.1: signature is `Crossdeck.init({ appId, publicKey,
-   * environment })`. The trio is validated up-front so a typo'd key or a
-   * mismatched env fails fast at boot rather than at first event-flush.
-   */
-  init(options) {
-    if (this.state) {
-      try {
-        this.state.uninstallUnloadFlush?.();
-      } catch {
-      }
-      try {
-        this.state.autoTracker?.uninstall();
-      } catch {
-      }
-      try {
-        this.state.webVitals?.uninstall();
-      } catch {
-      }
-      try {
-        this.state.errors?.uninstall();
-      } catch {
-      }
-      try {
-        void this.state.events.flush({ keepalive: true });
-      } catch {
-      }
-    }
-    if (!options.publicKey || !options.publicKey.startsWith("cd_pub_")) {
-      throw new CrossdeckError({
-        type: "configuration_error",
-        code: "invalid_public_key",
-        message: "Crossdeck.init requires a publishable key starting with cd_pub_."
-      });
-    }
-    if (!options.appId) {
-      throw new CrossdeckError({
-        type: "configuration_error",
-        code: "missing_app_id",
-        message: "Crossdeck.init requires an appId. Find yours in the Crossdeck dashboard."
-      });
-    }
-    if (options.environment !== "production" && options.environment !== "sandbox") {
-      throw new CrossdeckError({
-        type: "configuration_error",
-        code: "invalid_environment",
-        message: 'Crossdeck.init requires environment: "production" | "sandbox".'
-      });
-    }
-    const keyEnv = inferEnvFromKey(options.publicKey);
-    if (keyEnv && keyEnv !== options.environment) {
-      throw new CrossdeckError({
-        type: "configuration_error",
-        code: "environment_mismatch",
-        message: `Crossdeck.init: environment "${options.environment}" disagrees with key prefix (${keyEnv}). Reconcile the publishable key with the environment declaration.`
-      });
-    }
-    const localDevMode = isLocalHostname();
-    const storage = options.storage ?? detectDefaultStorage();
-    const persistIdentity = options.persistIdentity ?? true;
-    const autoTrack = resolveAutoTrack(options.autoTrack);
-    const opts = {
-      appId: options.appId,
-      publicKey: options.publicKey,
-      environment: options.environment,
-      baseUrl: options.baseUrl ?? DEFAULT_BASE_URL,
-      persistIdentity,
-      storagePrefix: options.storagePrefix ?? "crossdeck:",
-      autoHeartbeat: options.autoHeartbeat ?? true,
-      eventFlushBatchSize: options.eventFlushBatchSize ?? 20,
-      // 1500ms idle window. Short enough that an event queued on page
-      // load still flushes if the user leaves quickly (the keepalive
-      // pagehide handler picks up anything that doesn't); long enough
-      // that bursts of clicks coalesce into one network round-trip.
-      // v1.4.0 Phase 3.3 — flush interval default parity. Pre-
-      // v1.4.0: Web/Node 1500ms, RN/Swift/Android 5000ms. All
-      // converged on 2000ms (the Stripe-adjacent industry norm)
-      // so cross-platform funnels show events landing at the
-      // same cadence on every SDK. Per-instance override stays.
-      eventFlushIntervalMs: options.eventFlushIntervalMs ?? 2e3,
-      sdkVersion: options.sdkVersion ?? SDK_VERSION,
-      autoTrack,
-      appVersion: options.appVersion ?? null
-    };
-    const debug = new ConsoleDebugLogger();
-    debug.enabled = options.debug === true;
-    const http = new HttpClient({
-      publicKey: opts.publicKey,
-      baseUrl: opts.baseUrl,
-      sdkVersion: opts.sdkVersion,
-      // Localhost auto-route: HttpClient short-circuits every request
-      // to a successful no-op response when localDevMode is set.
-      // SDK methods continue to work locally; nothing reaches the
-      // server.
-      localDevMode
-    });
-    if (localDevMode) {
-      console.log(
-        "[crossdeck] Localhost detected \u2014 running in dev mode (no network calls). Set publicKey: 'cd_pub_test_\u2026' and deploy to a real domain to test against the Crossdeck Sandbox."
-      );
-    }
-    const effectiveStorage = persistIdentity ? storage : new MemoryStorage();
-    const useCookieRedundancy = persistIdentity && !options.storage && // honour caller's adapter choice
-    typeof globalThis.document !== "undefined";
-    const cookieStore = useCookieRedundancy ? new CookieStorage() : void 0;
-    const identity = new IdentityStore(effectiveStorage, opts.storagePrefix, cookieStore);
-    const entitlements = new EntitlementCache(
-      effectiveStorage,
-      opts.storagePrefix + "entitlements"
-    );
-    const persistentEvents = persistIdentity ? new PersistentEventStore({ storage: effectiveStorage, prefix: opts.storagePrefix }) : null;
-    if (persistentEvents) {
-      debug.emit(
-        "sdk.queue_restored",
-        "Restored persisted event queue from a prior session."
-      );
-    }
-    const events = new EventQueue({
-      http,
-      batchSize: opts.eventFlushBatchSize,
-      intervalMs: opts.eventFlushIntervalMs,
-      envelope: () => ({
-        appId: opts.appId,
-        environment: opts.environment,
-        sdk: { name: SDK_NAME, version: opts.sdkVersion }
-      }),
-      persistentStore: persistentEvents ?? void 0,
-      onFirstFlushSuccess: () => {
-        debug.emit(
-          "sdk.first_event_sent",
-          "First telemetry event received. View it in Live Events.",
-          { appId: opts.appId, environment: opts.environment }
-        );
-      },
-      onRetryScheduled: (info) => {
-        debug.emit(
-          "sdk.flush_retry_scheduled",
-          `Event flush failed (${info.lastError}). Retrying in ${info.delayMs}ms (attempt ${info.consecutiveFailures}).`,
-          { ...info }
-        );
-      },
-      onPermanentFailure: (info) => {
-        const headline = `[crossdeck] Event batch DROPPED (status ${info.status}): ${info.lastError}. ${info.droppedCount} event(s) lost \u2014 check your publishable key + app config.`;
-        console.error(headline);
-        debug.emit(
-          "sdk.flush_permanent_failure",
-          headline,
-          { ...info }
-        );
-      }
-    });
-    const deviceInfo = autoTrack.deviceInfo ? collectDeviceInfo({ appVersion: opts.appVersion ?? void 0 }) : opts.appVersion ? { appVersion: opts.appVersion } : {};
-    const superProps = new SuperPropertyStore(
-      persistIdentity ? effectiveStorage : new MemoryStorage(),
-      opts.storagePrefix
-    );
-    const consent = new ConsentManager({ respectDnt: options.respectDnt === true });
-    if (consent.isDntDenied) {
-      debug.emit(
-        "sdk.consent_dnt_applied",
-        "Do Not Track detected \u2014 all tracking dimensions denied at init."
-      );
-    }
-    const breadcrumbs = new BreadcrumbBuffer(50);
-    this.state = {
-      http,
-      identity,
-      entitlements,
-      events,
-      autoTracker: null,
-      webVitals: null,
-      errors: null,
-      breadcrumbs,
-      errorContext: {},
-      errorTags: {},
-      errorBeforeSend: null,
-      superProps,
-      consent,
-      scrubPii: options.scrubPii !== false,
-      deviceInfo,
-      options: opts,
-      debug,
-      developerUserId: null,
-      uninstallUnloadFlush: null,
-      lastServerTime: null,
-      lastClientTime: null
-    };
-    debug.emit("sdk.configured", `Crossdeck connected to ${opts.appId} in ${opts.environment} mode.`, {
-      appId: opts.appId,
-      environment: opts.environment,
-      sdkVersion: opts.sdkVersion
-    });
-    if (autoTrack.sessions || autoTrack.pageViews) {
-      const tracker = new AutoTracker(
-        autoTrack,
-        (name, properties) => this.track(name, properties)
-      );
-      this.state.autoTracker = tracker;
-      tracker.install();
-    }
-    if (autoTrack.webVitals) {
-      const vitals = new WebVitalsTracker(
-        { enabled: true },
-        (name, properties) => this.track(name, properties)
-      );
-      this.state.webVitals = vitals;
-      vitals.install();
-    }
-    if (autoTrack.errors) {
-      const tracker = new ErrorTracker({
-        config: { ...DEFAULT_ERROR_CAPTURE, enabled: true },
-        breadcrumbs,
-        report: (err) => this.reportError(err),
-        getContext: () => ({ ...this.state.errorContext }),
-        getTags: () => ({ ...this.state.errorTags }),
-        // GETTER, not a captured value — `setErrorBeforeSend()` mutates
-        // `state.errorBeforeSend` after init() and the tracker MUST
-        // pick up the new hook on the next error. The pre-fix shape
-        // (`beforeSend: this.state!.errorBeforeSend`) snapshotted
-        // `null` at construction and made the customer's PII scrubber
-        // silently inert. See error-capture.ts:ErrorTrackerOptions.beforeSend.
-        beforeSend: () => this.state.errorBeforeSend,
-        isConsented: () => this.state.consent.errors,
-        // Derived from the configured baseUrl at init() time. Used by
-        // the fetch / XHR wrappers to skip captureHttp on Crossdeck's
-        // own requests — pre-fix the skip was hardcoded to
-        // `api.cross-deck.com` and broke for customers on staging /
-        // regional / self-hosted base URLs (recursive capture loop).
-        selfHostname: extractSelfHostname(opts.baseUrl)
-      });
-      this.state.errors = tracker;
-      tracker.install();
-    }
-    this.state.uninstallUnloadFlush = installUnloadFlush(() => {
-      void this.flush({ keepalive: true }).catch(() => void 0);
-    });
-    if (opts.autoHeartbeat && !localDevMode) {
-      void this.heartbeat().catch(() => void 0);
-    }
-  }
-  /**
-   * @deprecated Use `init()` instead. NorthStar §4 standardised the
-   * lifecycle method name across SDKs as `init` (formerly `start` /
-   * `configure`). `start` will be removed in a future major version.
-   */
-  start(options) {
-    if (typeof console !== "undefined") {
-      console.warn(
-        "[crossdeck] Crossdeck.start() is deprecated \u2014 use Crossdeck.init() instead. The signature is the same."
-      );
-    }
-    this.init(options);
-  }
-  /**
-   * Link the anonymous device to a developer-supplied user ID. Cache
-   * the resolved Crossdeck customer for follow-up calls.
-   *
-   * v0.9.0+ accepts an optional `traits` bag — profile data (name,
-   * plan, signupDate, role) persisted on the Crossdeck customer record
-   * and queryable from dashboards. Traits are sanitised through the
-   * same validator that gates `track()` properties, so a `{ avatar:
-   * <File>, onSave: () => {} }` payload can't corrupt the alias call.
-   *
-   *   Crossdeck.identify("user_847", {
-   *     email: "wes@pinet.co.za",
-   *     traits: { name: "Wes", plan: "pro", signedUpAt: "2026-05-11" },
-   *   });
-   */
-  async identify(userId, options) {
-    const s = this.requireStarted();
-    if (!userId) {
-      throw new CrossdeckError({
-        type: "invalid_request_error",
-        code: "missing_user_id",
-        message: "identify(userId) requires a non-empty userId."
-      });
-    }
-    if (!s.consent.analytics) {
-      s.debug.emit(
-        "sdk.consent_denied",
-        `identify() skipped \u2014 consent denied for analytics.`
-      );
-      return {
-        object: "alias_result",
-        crossdeckCustomerId: s.identity.crossdeckCustomerId ?? "",
-        linked: [],
-        mergePending: false,
-        env: s.options.environment
-      };
-    }
-    const traitsValidation = options?.traits !== void 0 ? validateEventProperties(options.traits) : null;
-    const traits = traitsValidation && Object.keys(traitsValidation.properties).length > 0 ? traitsValidation.properties : void 0;
-    if (s.debug.enabled && traitsValidation && traitsValidation.warnings.length > 0) {
-      for (const w of traitsValidation.warnings) {
-        s.debug.emit(
-          "sdk.property_coerced",
-          `identify() traits key ${JSON.stringify(w.key)} was ${w.kind.replace(/_/g, " ")} during validation.`,
-          { key: w.key, kind: w.kind }
-        );
-      }
-    }
-    const body = {
-      userId,
-      anonymousId: s.identity.anonymousId
-    };
-    if (options?.email) body.email = options.email;
-    if (traits) body.traits = traits;
-    s.entitlements.setUserKey(userId);
-    const result = await s.http.request("POST", "/identity/alias", {
-      body
-    });
-    s.identity.setCrossdeckCustomerId(result.crossdeckCustomerId);
-    s.developerUserId = userId;
-    return result;
-  }
-  /**
-   * Register super-properties — Mixpanel pattern. Once set, every
-   * subsequent event of THIS SDK instance carries these keys on its
-   * properties bag automatically.
-   *
-   *   Crossdeck.register({ plan: "pro", releaseChannel: "beta" });
-   *   Crossdeck.track("paywall_shown");  // includes plan + releaseChannel
-   *
-   * Values that are `null` are deleted (the explicit "stop tracking
-   * this key" idiom). Returns the resulting bag.
-   *
-   * Sanitised through `validateEventProperties` so a `{ avatar: File }`
-   * payload can't poison the queue at flush time.
-   */
-  register(properties) {
-    const s = this.requireStarted();
-    const validation = validateEventProperties(properties);
-    return s.superProps.register(validation.properties);
-  }
-  /** Remove a single super-property key. Idempotent. */
-  unregister(key) {
-    const s = this.requireStarted();
-    s.superProps.unregister(key);
-  }
-  /** Snapshot of the current super-property bag. */
-  getSuperProperties() {
-    if (!this.state) return {};
-    return this.state.superProps.getSuperProperties();
-  }
-  /**
-   * Associate the current user with a group (org, team, account, etc.).
-   * Mixpanel / Segment "Group Analytics" pattern.
-   *
-   *   Crossdeck.group("org", "acme_inc");
-   *   Crossdeck.group("team", "design", { headcount: 12 });
-   *
-   * Once set, every subsequent event carries `$groups.<type>: id` on
-   * its properties bag, enabling B2B dashboards ("how is Acme using
-   * the product"). Pass `id: null` to clear a group membership.
-   */
-  group(type, id, traits) {
-    const s = this.requireStarted();
-    if (!type) {
-      throw new CrossdeckError({
-        type: "invalid_request_error",
-        code: "missing_group_type",
-        message: "group(type, id) requires a non-empty type."
-      });
-    }
-    const sanitisedTraits = traits ? validateEventProperties(traits).properties : void 0;
-    s.superProps.setGroup(type, id, sanitisedTraits);
-  }
-  /** Snapshot of the current groups map keyed by type. */
-  getGroups() {
-    if (!this.state) return {};
-    return this.state.superProps.getGroups();
-  }
-  /**
-   * Update consent state. Three independent dimensions:
-   *
-   *   analytics  — track() + identify() + auto-emissions
-   *   marketing  — paid-traffic click IDs + referrer URL on events
-   *   errors     — Web Vitals + (future) error reporting
-   *
-   * Each defaults to `true` (granted). Pass partial state — only the
-   * keys you provide are changed.
-   *
-   *   Crossdeck.consent({ analytics: false });
-   *   Crossdeck.consent({ marketing: true, errors: true });
-   *
-   * DNT-derived denies cannot be flipped back on; if the browser said
-   * "don't track" we don't track even if the developer code disagrees.
-   */
-  consent(state) {
-    const s = this.requireStarted();
-    const next = s.consent.set(state);
-    s.debug.emit("sdk.consent_changed", "Consent state updated.", { ...next });
-    return next;
-  }
-  /** Snapshot of the current consent state. */
-  consentStatus() {
-    if (!this.state) {
-      return { analytics: true, marketing: true, errors: true };
-    }
-    return this.state.consent.get();
-  }
-  // ============================================================
-  // Error capture surface (v1.0.0+)
-  // ============================================================
-  /**
-   * Manually capture an error from a try/catch block.
-   *
-   *   try { …risky… } catch (err) {
-   *     Crossdeck.captureError(err, { context: { plan: "pro" } });
-   *   }
-   *
-   * The error is shipped through the same event queue as analytics
-   * (durable, retried, rate-limited per fingerprint). Sends are gated
-   * by `consent.errors`. Returns silently — never throws, even if the
-   * SDK isn't initialised yet.
-   */
-  captureError(error, options) {
-    if (!this.state?.errors) return;
-    this.state.errors.captureError(error, options);
-  }
-  /**
-   * Capture a non-error event you want to surface as an issue
-   * ("deprecated path hit", "we entered the slow code path"). Sentry
-   * captureMessage pattern. Returns silently if not initialised.
-   */
-  captureMessage(message, level = "info") {
-    if (!this.state?.errors) return;
-    this.state.errors.captureMessage(message, level);
-  }
-  /**
-   * Attach a tag to every subsequent error report. Tags are key/value
-   * strings (Sentry pattern): `setTag("flow", "checkout")` → every
-   * error from this point on carries `tags.flow === "checkout"`.
-   */
-  setTag(key, value) {
-    if (!this.state) return;
-    this.state.errorTags[key] = value;
-  }
-  /** Bulk-set tags. Merges with existing tags. */
-  setTags(tags) {
-    if (!this.state) return;
-    Object.assign(this.state.errorTags, tags);
-  }
-  /**
-   * Attach a structured context blob to every subsequent error report.
-   * Unlike tags (flat key/value), context is a named bag of arbitrary
-   * data: `setContext("cart", { items: 3, total: 42.99 })`.
-   */
-  setContext(name, data) {
-    if (!this.state) return;
-    this.state.errorContext[name] = data;
-  }
-  /**
-   * Add a custom breadcrumb to the rolling buffer. Useful for marking
-   * domain-meaningful moments ("user opened paywall") that aren't
-   * already auto-captured. The buffer caps at 50 entries; old ones
-   * evict.
-   */
-  addBreadcrumb(crumb) {
-    if (!this.state) return;
-    this.state.breadcrumbs.add(crumb);
-  }
-  /**
-   * Install a pre-send hook for errors. Return null to drop, or a
-   * modified CapturedError to scrub / rewrite. Sentry's beforeSend
-   * pattern — the only way to redact app-specific PII (auth tokens
-   * in URLs, etc.) before the report leaves the browser.
-   */
-  setErrorBeforeSend(hook) {
-    if (!this.state) return;
-    this.state.errorBeforeSend = hook;
-  }
-  /**
-   * Internal: turn a CapturedError into a Crossdeck event and enqueue
-   * it. Goes through the same queue / persistence / consent / scrub
-   * pipeline as analytics events.
-   */
-  reportError(err) {
-    const properties = {
-      // Identifiers
-      fingerprint: err.fingerprint,
-      level: err.level,
-      // Error shape
-      errorType: err.errorType,
-      message: err.message,
-      // Stack
-      stack: err.rawStack ?? void 0,
-      frames: err.frames,
-      filename: err.filename ?? void 0,
-      lineno: err.lineno ?? void 0,
-      colno: err.colno ?? void 0,
-      // Context
-      tags: err.tags,
-      context: err.context,
-      breadcrumbs: err.breadcrumbs,
-      // HTTP (only when applicable)
-      http: err.http
-    };
-    for (const k of Object.keys(properties)) {
-      if (properties[k] === void 0) delete properties[k];
-    }
-    this.track(err.kind, properties);
-  }
-  /**
-   * GDPR/CCPA "right to be forgotten" — calls the backend's
-   * /v1/identity/forget endpoint to schedule a server-side deletion of
-   * the customer's events and profile, then wipes all local state
-   * (identity, entitlements, queue, super-props, persistent stores).
-   *
-   * Idempotent. Safe to call when no identity has been established
-   * (it just wipes the empty local state).
-   *
-   * After forget() resolves, the SDK is in the same shape as if the
-   * developer had called `Crossdeck.reset()` — a fresh anonymousId is
-   * minted and the next session is a brand new identity-graph entry.
-   */
-  async forget() {
-    const s = this.requireStarted();
-    const identityQuery = this.identityQueryParams();
-    try {
-      await s.http.request("POST", "/identity/forget", {
-        body: {
-          // Send every identity hint we hold; the server resolves the
-          // canonical customer record and queues deletion. Missing
-          // endpoint (older backend) gracefully degrades — local state
-          // still wipes via the reset() call below.
-          ...identityQuery
-        }
-      });
-    } catch (err) {
-      s.debug.emit(
-        "sdk.consent_denied",
-        `forget() server call failed (${err instanceof Error ? err.message : String(err)}). Local state wiped anyway.`
-      );
-    }
-    this.reset();
-  }
-  /**
-   * Read the current customer's active entitlements from the server.
-   * Updates the local cache so subsequent isEntitled() calls answer
-   * synchronously.
-   */
-  async getEntitlements() {
-    const s = this.requireStarted();
-    const query = this.identityQueryParams();
-    let result;
-    try {
-      result = await s.http.request(
-        "GET",
-        "/entitlements",
-        { query }
-      );
-    } catch (err) {
-      s.entitlements.markRefreshFailed();
-      throw err;
-    }
-    if (result.crossdeckCustomerId) {
-      s.identity.setCrossdeckCustomerId(result.crossdeckCustomerId);
-    }
-    s.entitlements.setFromList(result.data);
-    return result.data;
-  }
-  /**
-   * Synchronous read from the durable local cache — answers from
-   * last-known-good. The cache hydrates from device storage on boot and
-   * survives a Crossdeck outage, so a returning paying customer reads
-   * true even before the session's first network round-trip. Returns
-   * false only for a genuinely new install that has never completed a
-   * getEntitlements(), or for an entitlement past its own validUntil.
-   */
-  isEntitled(key) {
-    const s = this.requireStarted();
-    return s.entitlements.isEntitled(key);
-  }
-  /** Snapshot of the local entitlement cache. */
-  listEntitlements() {
-    const s = this.requireStarted();
-    return s.entitlements.list();
-  }
-  /**
-   * Subscribe to entitlement-cache changes. Returns an unsubscribe fn.
-   *
-   * The listener is invoked AFTER the cache mutates — once after a
-   * successful `getEntitlements()` warms it, again after `syncPurchases()`
-   * delivers fresh entitlements, and once on `reset()` to fire the
-   * empty-cache state for logout flows.
-   *
-   * It is NOT invoked synchronously on subscribe. Callers that need
-   * the current state should read it via `isEntitled()` / `listEntitlements()`
-   * inline; the listener fires only on FUTURE changes.
-   *
-   * This is the foundation of the `useEntitlement` React hook in
-   * `@cross-deck/web/react` — without it, React (or SwiftUI / Compose
-   * / Vue) would have no way to re-render when entitlements arrive
-   * asynchronously after init. The naive pattern of calling
-   * `Crossdeck.isEntitled("pro")` directly inside a render path
-   * shows the empty-cache result forever; binding the result to
-   * component state via `onEntitlementsChange` is the correct
-   * pattern.
-   *
-   * Idempotent unsubscribe — calling the returned function multiple
-   * times is safe.
-   *
-   * Listener errors are swallowed (a buggy listener can't crash the
-   * SDK or other listeners).
-   */
-  onEntitlementsChange(listener) {
-    const s = this.requireStarted();
-    return s.entitlements.subscribe(listener);
-  }
-  /**
-   * Queue a telemetry event. Returns immediately — the network round-
-   * trip happens in the background. To flush before the page unloads,
-   * call flush().
-   */
-  /**
-   * Emit `crossdeck.contract_failed` with the canonical property
-   * shape (`contract_id`, `sdk_version`, `sdk_platform`,
-   * `failure_reason`, `run_context`, `run_id`). Goes through the
-   * standard track() pipeline — same consent gate, same queue,
-   * same ingest, no new endpoint.
-   *
-   * Wire the call from a test hook, dogfood failure path, or
-   * customer contract-verification harness; see
-   * `contracts/README.md` for the per-test-framework hook recipes.
-   */
-  reportContractFailure(input) {
-    const props = {
-      contract_id: input.contractId,
-      sdk_version: SDK_VERSION,
-      sdk_platform: "web",
-      failure_reason: input.failureReason,
-      run_context: input.runContext,
-      run_id: input.runId
-    };
-    if (input.testRef) {
-      props.test_file = input.testRef.file;
-      props.test_name = input.testRef.name;
-    }
-    if (input.extra) {
-      for (const [k, v] of Object.entries(input.extra)) {
-        if (props[k] === void 0) props[k] = v;
-      }
-    }
-    this.track("crossdeck.contract_failed", props);
-  }
-  track(name, properties) {
-    const s = this.requireStarted();
-    if (!name) {
-      throw new CrossdeckError({
-        type: "invalid_request_error",
-        code: "missing_event_name",
-        message: "track(name) requires a non-empty name."
-      });
-    }
-    const isError = name.startsWith("error.");
-    const isWebVital = name.startsWith("webvitals.");
-    const consentGateOk = isError || isWebVital ? s.consent.errors : s.consent.analytics;
-    if (!consentGateOk) {
-      if (s.debug.enabled) {
-        s.debug.emit(
-          "sdk.consent_denied",
-          `Dropped event "${name}" \u2014 consent denied for ${isWebVital ? "errors" : "analytics"}.`
-        );
-      }
-      return;
-    }
-    if (s.debug.enabled && properties) {
-      const flagged = findSensitivePropertyKeys(properties);
-      if (flagged.length > 0) {
-        s.debug.emit(
-          "sdk.sensitive_property_warning",
-          `Event "${name}" has potentially sensitive property names: ${flagged.join(", ")}. Crossdeck is privacy-first \u2014 avoid sending PII unless intentional.`,
-          { eventName: name, flagged }
-        );
-      }
-    }
-    if (s.debug.enabled && !s.developerUserId && !s.identity.crossdeckCustomerId) {
-      s.debug.emit(
-        "sdk.no_identity",
-        "Using anonymous user until identify(userId) is called."
-      );
-    }
-    const validation = validateEventProperties(properties);
-    if (s.debug.enabled && validation.warnings.length > 0) {
-      for (const w of validation.warnings) {
-        s.debug.emit(
-          "sdk.property_coerced",
-          `Event "${name}" property ${JSON.stringify(w.key)} was ${w.kind.replace(/_/g, " ")} during validation.`,
-          { eventName: name, key: w.key, kind: w.kind }
-        );
-      }
-    }
-    const enriched = { ...s.deviceInfo };
-    const sessionId = s.autoTracker?.currentSessionId;
-    if (sessionId) enriched.sessionId = sessionId;
-    const pageviewId = s.autoTracker?.currentPageviewId;
-    if (pageviewId) enriched.pageviewId = pageviewId;
-    const acquisition = s.autoTracker?.currentAcquisition;
-    if (acquisition) {
-      if (acquisition.utm_source) enriched.utm_source = acquisition.utm_source;
-      if (acquisition.utm_medium) enriched.utm_medium = acquisition.utm_medium;
-      if (acquisition.utm_campaign) enriched.utm_campaign = acquisition.utm_campaign;
-      if (acquisition.utm_content) enriched.utm_content = acquisition.utm_content;
-      if (acquisition.utm_term) enriched.utm_term = acquisition.utm_term;
-      if (acquisition.referrer && s.consent.marketing) enriched.referrer = acquisition.referrer;
-      if (s.consent.marketing) {
-        if (acquisition.gclid) enriched.gclid = acquisition.gclid;
-        if (acquisition.fbclid) enriched.fbclid = acquisition.fbclid;
-        if (acquisition.msclkid) enriched.msclkid = acquisition.msclkid;
-        if (acquisition.ttclid) enriched.ttclid = acquisition.ttclid;
-        if (acquisition.li_fat_id) enriched.li_fat_id = acquisition.li_fat_id;
-        if (acquisition.twclid) enriched.twclid = acquisition.twclid;
-      }
-    }
-    const supers = s.superProps.getSuperProperties();
-    for (const k of Object.keys(supers)) {
-      if (!(k in enriched)) enriched[k] = supers[k];
-    }
-    const groupIds = s.superProps.getGroupIds();
-    if (Object.keys(groupIds).length > 0) {
-      enriched.$groups = groupIds;
-    }
-    Object.assign(enriched, validation.properties);
-    const finalProperties = s.scrubPii ? scrubPiiFromProperties(enriched) : enriched;
-    const event = {
-      eventId: this.mintEventId(),
-      name,
-      timestamp: Date.now(),
-      properties: finalProperties
-    };
-    Object.assign(event, this.identityHintForEvent());
-    s.events.enqueue(event);
-    if (!isError && !isWebVital) {
-      const category = name.startsWith("page.") ? "navigation" : name.startsWith("element.") || name === "session.started" ? "ui.click" : "custom";
-      s.breadcrumbs.add({
-        timestamp: event.timestamp,
-        category,
-        message: name,
-        // Strip the device-info / session bloat from the breadcrumb
-        // payload — only the caller-supplied properties belong in
-        // the user-readable trail.
-        data: properties ? { ...properties } : void 0
-      });
-    }
-  }
-  /**
-   * Force-flush queued events. Useful to call from page-unload handlers.
-   *
-   * Pass `{ keepalive: true }` from terminal handlers (pagehide /
-   * visibilitychange→hidden / beforeunload). The browser keeps the
-   * request alive after the page tears down, so the final batch
-   * actually lands instead of being cancelled with the unload.
-   *
-   * NorthStar §4: standard method name across all Crossdeck SDKs.
-   */
-  async flush(options = {}) {
-    const s = this.requireStarted();
-    await s.events.flush(options);
-  }
-  /** @deprecated Use `flush()` instead. NorthStar §4 standardised the name. */
-  async flushEvents() {
-    return this.flush();
-  }
-  /**
-   * Forward purchase evidence to the backend for verification + entitlement
-   * projection. NorthStar §4 + §13 canonical name.
-   *
-   * Today the web SDK only supports Apple StoreKit 2 forwarding (web apps
-   * that sit alongside an iOS app). Stripe doesn't need this method —
-   * Stripe webhooks deliver evidence server-side without a client round-trip.
-   */
-  async syncPurchases(input) {
-    const s = this.requireStarted();
-    if (!input.signedTransactionInfo) {
-      throw new CrossdeckError({
-        type: "invalid_request_error",
-        code: "missing_signed_transaction_info",
-        message: "syncPurchases requires a signedTransactionInfo string from StoreKit 2."
-      });
-    }
-    const rail = input.rail ?? "apple";
-    const body = { ...input, rail };
-    const idempotencyKey = deriveIdempotencyKeyForPurchase(body);
-    const result = await s.http.request("POST", "/purchases/sync", {
-      body,
-      idempotencyKey
-    });
-    s.identity.setCrossdeckCustomerId(result.crossdeckCustomerId);
-    s.entitlements.setFromList(result.entitlements);
-    try {
-      const sourceProductId = result.entitlements[0]?.source.productId;
-      const sourceSubscriptionId = result.entitlements[0]?.source.subscriptionId;
-      const props = { rail };
-      if (sourceProductId) props.productId = sourceProductId;
-      if (sourceSubscriptionId) props.subscriptionId = sourceSubscriptionId;
-      if (result.idempotent_replay) props.idempotent_replay = true;
-      this.track("purchase.completed", props);
-    } catch {
-    }
-    s.debug.emit(
-      "sdk.purchase_evidence_sent",
-      "StoreKit transaction forwarded. Waiting for backend verification.",
-      { rail: input.rail ?? "apple" }
-    );
-    return result;
-  }
-  /** @deprecated Use `syncPurchases()` instead. NorthStar §4 standardised the name. */
-  async purchaseApple(input) {
-    return this.syncPurchases({ rail: "apple", ...input });
-  }
-  /**
-   * Toggle verbose diagnostic logging — NorthStar §16. When enabled, the
-   * SDK emits a fixed vocabulary of debug signals to console.info that the
-   * dashboard's onboarding checklist can also surface as live events.
-   */
-  setDebugMode(enabled) {
-    const s = this.requireStarted();
-    s.debug.enabled = enabled;
-    if (enabled) {
-      s.debug.emit(
-        "sdk.configured",
-        `Debug mode enabled for ${s.options.appId} in ${s.options.environment} mode.`,
-        { appId: s.options.appId, environment: s.options.environment }
-      );
-    }
-  }
-  /**
-   * Send the boot heartbeat. Called automatically by start() unless
-   * autoHeartbeat:false. Safe to call manually as a "we're still here" ping.
-   */
-  async heartbeat() {
-    const s = this.requireStarted();
-    const result = await s.http.request("GET", "/sdk/heartbeat");
-    if (typeof result?.serverTime === "number" && Number.isFinite(result.serverTime)) {
-      s.lastServerTime = result.serverTime;
-      s.lastClientTime = Date.now();
-    }
-    return result;
-  }
-  /**
-   * Wipe persisted identity + entitlement cache. Use on logout. The
-   * next pre-login session generates a fresh anonymousId and starts a
-   * new identity-graph entry.
-   */
-  reset() {
-    if (!this.state) return;
-    if (this.state.developerUserId) {
-      try {
-        this.track("user.signed_out", { auto: true });
-      } catch {
-      }
-    }
-    this.state.autoTracker?.uninstall();
-    this.state.identity.reset();
-    this.state.entitlements.clearAll();
-    this.state.events.reset();
-    this.state.superProps.clear();
-    this.state.breadcrumbs.clear();
-    this.state.errorContext = {};
-    this.state.errorTags = {};
-    this.state.developerUserId = null;
-    this.state.lastServerTime = null;
-    this.state.lastClientTime = null;
-    if (this.state.autoTracker) {
-      const tracker = new AutoTracker(
-        this.state.options.autoTrack,
-        (name, props) => this.track(name, props)
-      );
-      this.state.autoTracker = tracker;
-      tracker.install();
-    }
-  }
-  /**
-   * Diagnostic: current state + queue stats. Useful for the dashboard's
-   * heartbeat row and debugging in dev.
-   *
-   * Returns a stable shape regardless of whether start() has been called —
-   * callers don't need to narrow on `started` to access `events` or
-   * `entitlements`. Pre-start values are sensible empties.
-   */
-  diagnostics() {
-    if (!this.state) {
-      return {
-        started: false,
-        anonymousId: null,
-        crossdeckCustomerId: null,
-        developerUserId: null,
-        sdkVersion: null,
-        baseUrl: null,
-        clock: { lastServerTime: null, lastClientTime: null, skewMs: null },
-        entitlements: { count: 0, lastUpdated: 0, stale: false, listenerErrors: 0 },
-        events: {
-          buffered: 0,
-          dropped: 0,
-          inFlight: 0,
-          lastFlushAt: 0,
-          lastError: null,
-          consecutiveFailures: 0,
-          nextRetryAt: null
-        }
-      };
-    }
-    const s = this.state;
-    const skewMs = s.lastServerTime !== null && s.lastClientTime !== null ? s.lastClientTime - s.lastServerTime : null;
-    return {
-      started: true,
-      anonymousId: s.identity.anonymousId,
-      crossdeckCustomerId: s.identity.crossdeckCustomerId,
-      developerUserId: s.developerUserId,
-      sdkVersion: s.options.sdkVersion,
-      baseUrl: s.options.baseUrl,
-      clock: {
-        lastServerTime: s.lastServerTime,
-        lastClientTime: s.lastClientTime,
-        skewMs
-      },
-      entitlements: {
-        count: s.entitlements.list().length,
-        lastUpdated: s.entitlements.freshness,
-        stale: s.entitlements.isStale,
-        listenerErrors: s.entitlements.listenerErrors
-      },
-      events: s.events.getStats()
-    };
-  }
-  // ---------- private helpers ----------
-  requireStarted() {
-    if (!this.state) {
-      throw new CrossdeckError({
-        type: "configuration_error",
-        code: "not_initialized",
-        message: "Call Crossdeck.init({ appId, publicKey, environment }) before any other method."
-      });
-    }
-    return this.state;
-  }
-  /**
-   * Build the identity query for /v1/entitlements. Priority:
-   *   crossdeckCustomerId > developerUserId > anonymousId
-   * — matches the resolveCrossdeckCustomerId precedence on the server.
-   */
-  identityQueryParams() {
-    const s = this.requireStarted();
-    if (s.identity.crossdeckCustomerId) {
-      return { customerId: s.identity.crossdeckCustomerId };
-    }
-    if (s.developerUserId) return { userId: s.developerUserId };
-    return { anonymousId: s.identity.anonymousId };
-  }
-  /**
-   * Embed every known identity axis on the event. Earlier this returned
-   * just the highest-priority hint (cdcust → developerUserId → anonymousId)
-   * to keep payloads small, but that leaked into analytics: once a user
-   * was logged in, every subsequent page.viewed shipped without
-   * anonymousId, and `uniqExact(anonymous_id)` on the warehouse side
-   * counted 0 visitors for the entire authenticated app.
-   *
-   * Bank-grade rule: the server is the single source of truth on
-   * dedup. Send everything we know; let CH count by whichever axis
-   * matches the question. Each field is at most 32 bytes — sending
-   * three on every event costs ~80 bytes per request, which is
-   * trivial compared to the analytics correctness it buys.
-   */
-  identityHintForEvent() {
-    const s = this.requireStarted();
-    const hint = {
-      anonymousId: s.identity.anonymousId
-    };
-    if (s.developerUserId) hint.developerUserId = s.developerUserId;
-    if (s.identity.crossdeckCustomerId) {
-      hint.crossdeckCustomerId = s.identity.crossdeckCustomerId;
-    }
-    return hint;
-  }
-  mintEventId() {
-    const ts = Date.now().toString(36);
-    return `evt_${ts}${randomChars(8)}`;
-  }
-};
-var Crossdeck = new CrossdeckClient();
-function inferEnvFromKey(publicKey) {
-  if (publicKey.startsWith("cd_pub_test_")) return "sandbox";
-  if (publicKey.startsWith("cd_pub_live_")) return "production";
-  return null;
-}
-function isLocalHostname() {
-  const w = globalThis.window;
-  if (w?.__CROSSDECK_FORCE_LIVE__ === true) return false;
-  const hostname = w?.location?.hostname;
-  if (!hostname) return false;
-  if (hostname === "localhost" || hostname === "127.0.0.1") return true;
-  if (hostname === "0.0.0.0") return true;
-  if (hostname === "::1" || hostname === "[::1]") return true;
-  if (/^\[?fe80::/i.test(hostname)) return true;
-  if (hostname.endsWith(".local")) return true;
-  if (/^10\./.test(hostname)) return true;
-  if (/^192\.168\./.test(hostname)) return true;
-  if (/^172\.(1[6-9]|2\d|3[0-1])\./.test(hostname)) return true;
-  return false;
-}
-function resolveAutoTrack(input) {
-  if (input === false) {
-    return {
-      sessions: false,
-      pageViews: false,
-      deviceInfo: false,
-      clicks: false,
-      webVitals: false,
-      errors: false
-    };
-  }
-  if (input === void 0 || input === true) {
-    return { ...DEFAULT_AUTO_TRACK };
-  }
-  return {
-    sessions: input.sessions ?? DEFAULT_AUTO_TRACK.sessions,
-    pageViews: input.pageViews ?? DEFAULT_AUTO_TRACK.pageViews,
-    deviceInfo: input.deviceInfo ?? DEFAULT_AUTO_TRACK.deviceInfo,
-    clicks: input.clicks ?? DEFAULT_AUTO_TRACK.clicks,
-    webVitals: input.webVitals ?? DEFAULT_AUTO_TRACK.webVitals,
-    errors: input.errors ?? DEFAULT_AUTO_TRACK.errors
-  };
-}
-function installUnloadFlush(onUnload) {
-  const w = globalThis.window;
-  const doc = globalThis.document;
-  if (!w || !doc) return () => void 0;
-  const onVisChange = () => {
-    if (doc.visibilityState === "hidden") onUnload();
-  };
-  const onTerminal = () => onUnload();
-  doc.addEventListener("visibilitychange", onVisChange);
-  w.addEventListener("pagehide", onTerminal);
-  w.addEventListener("beforeunload", onTerminal);
-  return () => {
-    doc.removeEventListener("visibilitychange", onVisChange);
-    w.removeEventListener("pagehide", onTerminal);
-    w.removeEventListener("beforeunload", onTerminal);
-  };
-}
-
-// src/error-codes.ts
-var CROSSDECK_ERROR_CODES = Object.freeze([
-  // ----- Configuration -----
-  {
-    code: "invalid_public_key",
-    type: "configuration_error",
-    description: "The publishable key passed to Crossdeck.init() doesn't start with cd_pub_.",
-    resolution: "Copy the key from your Crossdeck dashboard \u2192 API keys page.",
-    retryable: false
-  },
-  {
-    code: "missing_app_id",
-    type: "configuration_error",
-    description: "Crossdeck.init() was called without an appId.",
-    resolution: "Add appId to your init options \u2014 find it in the dashboard's Apps page.",
-    retryable: false
-  },
-  {
-    code: "invalid_environment",
-    type: "configuration_error",
-    description: "Crossdeck.init() requires environment: 'production' | 'sandbox'.",
-    resolution: 'Pass the literal string "production" or "sandbox" \u2014 no other values are accepted.',
-    retryable: false
-  },
-  {
-    code: "environment_mismatch",
-    type: "configuration_error",
-    description: "The publishable key's env prefix doesn't match the declared environment option.",
-    resolution: "Either change `environment` to match the key prefix (cd_pub_test_ \u2194 sandbox, cd_pub_live_ \u2194 production), or swap the key for one minted in the right env.",
-    retryable: false
-  },
-  {
-    code: "not_initialized",
-    type: "configuration_error",
-    description: "An SDK method was called before Crossdeck.init().",
-    resolution: "Call Crossdeck.init({ appId, publicKey, environment }) once at app startup before any other method.",
-    retryable: false
-  },
-  // ----- Identify / track / purchase argument validation -----
-  {
-    code: "missing_user_id",
-    type: "invalid_request_error",
-    description: "identify() was called with an empty userId.",
-    resolution: "Pass a stable, non-empty user identifier from your auth layer \u2014 never a hardcoded placeholder.",
-    retryable: false
-  },
-  {
-    code: "missing_event_name",
-    type: "invalid_request_error",
-    description: "track() was called without an event name.",
-    resolution: "Pass a non-empty string as the first argument.",
-    retryable: false
-  },
-  {
-    code: "missing_group_type",
-    type: "invalid_request_error",
-    description: "group() was called without a group type.",
-    resolution: 'Pass a non-empty type (e.g. "org", "team") as the first argument.',
-    retryable: false
-  },
-  {
-    code: "missing_signed_transaction_info",
-    type: "invalid_request_error",
-    description: "syncPurchases() was called without StoreKit 2 signed transaction info.",
-    resolution: "Pass the JWS string from Transaction.currentEntitlements / Transaction.updates.",
-    retryable: false
-  },
-  // ----- Network / transport -----
-  {
-    code: "fetch_failed",
-    type: "network_error",
-    description: "The underlying fetch() call failed (typically a network outage or DNS issue).",
-    resolution: "Check the user's network. The SDK will retry automatically with exponential backoff.",
-    retryable: true
-  },
-  {
-    code: "request_timeout",
-    type: "network_error",
-    description: "A request was aborted after the configured timeoutMs (default 15s).",
-    resolution: "Check the user's connection. Increase timeoutMs in init options if the user is on a known-slow network.",
-    retryable: true
-  },
-  {
-    code: "invalid_json_response",
-    type: "internal_error",
-    description: "The server returned a 2xx with an unparseable body.",
-    resolution: "Likely a transient backend bug. Retry; if it persists, contact support with the requestId.",
-    retryable: true
-  },
-  // ----- Backend-emitted codes (v1.4.0 Phase 6.2 backfill) -----
-  // Mirror of backend/src/api/v1-errors.ts ApiErrorCode. A developer
-  // hitting any of these on the wire can look them up via
-  // getErrorCode(code) for a canonical remediation step instead of
-  // hunting through Slack history.
-  {
-    code: "missing_api_key",
-    type: "authentication_error",
-    description: "No Authorization header (or Crossdeck-Api-Key header) on the request.",
-    resolution: "Make sure Crossdeck.init({ publicKey }) was called with a cd_pub_\u2026 key before the request fired. Re-check your env-vars in CI / Docker if the key is empty at runtime.",
-    retryable: false
-  },
-  {
-    code: "invalid_api_key",
-    type: "authentication_error",
-    description: "The API key is malformed, unknown, or doesn't resolve to a project.",
-    resolution: "Copy the key from your Crossdeck dashboard \u2192 API keys. Confirm prefix is cd_pub_test_ / cd_pub_live_ for client SDKs and cd_sk_test_ / cd_sk_live_ for the Node server SDK.",
-    retryable: false
-  },
-  {
-    code: "key_revoked",
-    type: "authentication_error",
-    description: "The API key was revoked in the Crossdeck dashboard.",
-    resolution: "Mint a fresh key in the dashboard \u2192 API keys \u2192 Create new, swap it in, and redeploy. The revoked key cannot be reactivated.",
-    retryable: false
-  },
-  {
-    code: "identity_token_invalid",
-    type: "authentication_error",
-    description: "The Firebase / Apple / Google ID token supplied with the request didn't verify against the dashboard's configured signers.",
-    resolution: "Refresh the token client-side (Firebase auth.currentUser.getIdToken(true)) and retry. If the failure persists, confirm the signer is registered under dashboard \u2192 Authentication \u2192 Identity sources.",
-    retryable: true
-  },
-  {
-    code: "origin_not_allowed",
-    type: "permission_error",
-    description: "The Origin header isn't in the project's Allowed origins list.",
-    resolution: "Add the origin (e.g. https://app.example.com) under dashboard \u2192 Settings \u2192 Allowed origins. Wildcards like https://*.example.com are supported.",
-    retryable: false
-  },
-  {
-    code: "bundle_id_not_allowed",
-    type: "permission_error",
-    description: "The iOS bundle ID sent via X-Crossdeck-Bundle-Id isn't registered under this app's Apple identity lock.",
-    resolution: "Add the bundle ID under dashboard \u2192 Apps \u2192 <your app> \u2192 iOS bundle IDs.",
-    retryable: false
-  },
-  {
-    code: "package_name_not_allowed",
-    type: "permission_error",
-    description: "The Android package name sent via X-Crossdeck-Package-Name isn't registered under this app's Android identity lock.",
-    resolution: "Add the package name under dashboard \u2192 Apps \u2192 <your app> \u2192 Android package names.",
-    retryable: false
-  },
-  {
-    code: "env_mismatch",
-    type: "permission_error",
-    description: "The request env (inferred from key prefix) doesn't match the resolved app's configured env.",
-    resolution: "Use a cd_pub_live_ / cd_sk_live_ key with a production app, cd_pub_test_ / cd_sk_test_ with a sandbox app. The two cannot cross.",
-    retryable: false
-  },
-  {
-    code: "idempotency_key_in_use",
-    type: "invalid_request_error",
-    description: "An Idempotency-Key was reused for a request with a different body (Stripe-grade contract).",
-    resolution: "Generate a fresh key for a different transaction, or reuse the key only with the EXACT same body. The v1.4.0 SDKs derive keys deterministically from the body so this should never fire on SDK-managed calls.",
-    retryable: false
-  },
-  {
-    code: "rate_limited",
-    type: "rate_limit_error",
-    description: "Request rate exceeded the project's per-second cap.",
-    resolution: "Honour the Retry-After header \u2014 the SDK does this automatically on managed retries. If you're hitting it from a custom code path, throttle to <100 req/s/key.",
-    retryable: true
-  },
-  {
-    code: "internal_error",
-    type: "internal_error",
-    description: "Server-side issue. Safe to retry with backoff.",
-    resolution: "The SDK retries automatically. If your code paths through to this error, contact support with the requestId from the response envelope.",
-    retryable: true
-  },
-  {
-    code: "google_not_supported",
-    type: "invalid_request_error",
-    description: "POST /purchases/sync with rail=google is gated until the Play Developer API reconciliation worker ships.",
-    resolution: "Until v1.5+, Google Play purchases verify via Real-time Developer Notifications. The SDK auto-track path handles this transparently for Android consumers.",
-    retryable: false
-  },
-  {
-    code: "stripe_not_supported",
-    type: "invalid_request_error",
-    description: "POST /purchases/sync with rail=stripe is unsupported \u2014 Stripe Checkout's redirect flow uses platform webhooks instead.",
-    resolution: "Wire Stripe via the standard Checkout / Customer Portal flow; Crossdeck reconciles via the platform webhook automatically. No SDK call needed.",
-    retryable: false
-  },
-  {
-    code: "missing_required_param",
-    type: "invalid_request_error",
-    description: "A required field is absent from the request body.",
-    resolution: "Inspect the error.message \u2014 the missing field name is included verbatim. Refer to the SDK's TypeScript types for the canonical request shape.",
-    retryable: false
-  },
-  {
-    code: "invalid_param_value",
-    type: "invalid_request_error",
-    description: "A field is present but the value failed validation (wrong shape, wrong length, wrong enum value).",
-    resolution: "Read error.message for the specific field + reason. SDK-managed call sites should never emit this \u2014 file a bug if you do.",
-    retryable: false
-  }
-]);
-function getErrorCode(code) {
-  return CROSSDECK_ERROR_CODES.find((e) => e.code === code);
-}
-
-// src/_contracts-bundled.ts
-var BUNDLED_IN = "@cross-deck/web@1.5.0";
-var SDK_VERSION2 = "1.5.0";
-var BUNDLED_CONTRACTS = Object.freeze([
-  {
-    "id": "error-envelope-shape",
-    "pillar": "errors",
-    "status": "enforced",
-    "claim": "Every v1 REST endpoint returns errors in a Stripe-shape envelope: `{ error: { type, code, message, request_id } }` where `type` is one of authentication_error / permission_error / invalid_request_error / rate_limit_error / internal_error (the wire vocabulary in backend/src/api/v1-errors.ts ApiErrorType). HTTP status parity: invalid_request_error \u2192 400, authentication_error \u2192 401, permission_error \u2192 403, rate_limit_error \u2192 429, internal_error \u2192 500. SDK-side clients parse this shape via `crossdeckErrorFromResponse` (Web/Node/RN) / `crossdeckErrorFrom(response:)` (Swift) / `crossdeckErrorFromResponse` (Android) and surface the request_id verbatim so support traces are end-to-end joinable. Firebase callable endpoints (managed-keys / dashboard auth) use the Firebase HttpsError envelope instead \u2014 this contract applies to REST /v1/* only.",
-    "appliesTo": [
-      "web",
-      "node",
-      "react-native",
-      "swift",
-      "android",
-      "backend"
-    ],
-    "codeRef": [
-      "backend/src/api/v1-errors.ts",
-      "sdks/web/src/errors.ts",
-      "sdks/node/src/errors.ts",
-      "sdks/react-native/src/errors.ts",
-      "sdks/swift/Sources/Crossdeck/Errors.swift",
-      "sdks/android/crossdeck/src/main/kotlin/com/crossdeck/Errors.kt"
-    ],
-    "testRef": [
-      {
-        "file": "sdks/swift/Tests/CrossdeckTests/ErrorsTests.swift",
-        "name": "test_errorEnvelope_fallsBackOnGarbageBody"
-      },
-      {
-        "file": "sdks/swift/Tests/CrossdeckTests/ErrorsTests.swift",
-        "name": "test_errorEnvelope_reads_XRequestId_fallback"
-      },
-      {
-        "file": "sdks/android/crossdeck/src/test/kotlin/com/crossdeck/ErrorTypeWireVocabTest.kt",
-        "name": "backend 500 response parses to INTERNAL_ERROR"
-      }
-    ],
-    "registeredAt": "2026-05-26",
-    "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 8 (codifies existing contract)",
-    "bundledIn": "@cross-deck/web@1.5.0"
-  },
-  {
-    "id": "flush-interval-parity",
-    "pillar": "analytics",
-    "status": "enforced",
-    "claim": "Every Crossdeck SDK defaults its event-queue flush interval to 2000ms \u2014 the Stripe-adjacent industry norm. Pre-v1.4.0 the defaults disagreed (Web/Node 1500ms; RN/Swift/Android 5000ms), so cross-platform funnels saw events landing at different cadences. Per-instance override stays \u2014 call sites can still tune it freely.",
-    "appliesTo": [
-      "web",
-      "node",
-      "react-native",
-      "swift",
-      "android"
-    ],
-    "codeRef": [
-      "sdks/web/src/crossdeck.ts",
-      "sdks/node/src/crossdeck-server.ts",
-      "sdks/react-native/src/crossdeck.ts",
-      "sdks/swift/Sources/Crossdeck/EventQueue.swift",
-      "sdks/android/crossdeck/src/main/kotlin/com/crossdeck/EventQueue.kt"
-    ],
-    "testRef": [
-      {
-        "file": "sdks/swift/Sources/Crossdeck/EventQueue.swift",
-        "name": "flushIntervalMs: Int = 2_000"
-      },
-      {
-        "file": "sdks/android/crossdeck/src/main/kotlin/com/crossdeck/EventQueue.kt",
-        "name": "flushIntervalMs: Long = 2_000L"
-      },
-      {
-        "file": "sdks/web/src/crossdeck.ts",
-        "name": "options.eventFlushIntervalMs ?? 2000"
-      },
-      {
-        "file": "sdks/node/src/crossdeck-server.ts",
-        "name": "options.eventFlushIntervalMs ?? 2000"
-      },
-      {
-        "file": "sdks/react-native/src/crossdeck.ts",
-        "name": "options.eventFlushIntervalMs ?? 2000"
-      }
-    ],
-    "registeredAt": "2026-05-26",
-    "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 3.3",
-    "bundledIn": "@cross-deck/web@1.5.0"
-  },
-  {
-    "id": "idempotency-key-deterministic",
-    "pillar": "revenue",
-    "status": "enforced",
-    "claim": "syncPurchases() on every SDK derives a deterministic Idempotency-Key from the request body (UUID-shaped SHA-256 of `crossdeck:purchases/sync:<rail>:<jws|token>`). Same input -> same key. Backend short-circuits same-key-same-body retries by returning the cached response (status + body) with `idempotent_replay: true` flag in the body AND `Idempotent-Replayed: true` response header. Same-key-different-body returns 400 `idempotency_key_in_use`. 24-hour TTL matches Stripe. Cache only stores 2xx responses \u2014 4xx/5xx pass through so callers can fix bugs and retry. Helper returns nil/throws on missing identifier (no silent random fallback). Cross-SDK parity is CI-pinned: deriveForPurchase('apple', 'eyJ.jws.sig') MUST equal 'a66b1640-efaf-bb4d-1261-6650033bf111' on every SDK.",
-    "appliesTo": [
-      "web",
-      "node",
-      "react-native",
-      "swift",
-      "android",
-      "backend"
-    ],
-    "codeRef": [
-      "sdks/web/src/idempotency-key.ts",
-      "sdks/web/src/crossdeck.ts",
-      "sdks/react-native/src/idempotency-key.ts",
-      "sdks/react-native/src/crossdeck.ts",
-      "sdks/node/src/idempotency-key.ts",
-      "sdks/node/src/crossdeck-server.ts",
-      "sdks/swift/Sources/Crossdeck/IdempotencyKey.swift",
-      "sdks/swift/Sources/Crossdeck/Crossdeck.swift",
-      "sdks/android/crossdeck/src/main/kotlin/com/crossdeck/IdempotencyKey.kt",
-      "sdks/android/crossdeck/src/main/kotlin/com/crossdeck/Crossdeck.kt",
-      "backend/src/lib/idempotency-response-cache.ts",
-      "backend/src/api/v1-purchases.ts"
-    ],
-    "testRef": [
-      {
-        "file": "sdks/web/tests/idempotency-key.test.ts",
-        "name": "cross-SDK oracle \u2014 apple JWS pins canonical vector"
-      },
-      {
-        "file": "sdks/web/tests/idempotency-key.test.ts",
-        "name": "is deterministic: same body twice -> identical key"
-      },
-      {
-        "file": "sdks/web/tests/idempotency-key.test.ts",
-        "name": "same identifier under different rails -> different keys"
-      },
-      {
-        "file": "sdks/web/tests/idempotency-key.test.ts",
-        "name": "never silently falls back to a random key on missing identifier"
-      },
-      {
-        "file": "sdks/react-native/tests/idempotency-key.test.ts",
-        "name": "is deterministic"
-      },
-      {
-        "file": "sdks/react-native/tests/idempotency-key.test.ts",
-        "name": "cross-SDK oracle \u2014 apple JWS pins canonical vector"
-      },
-      {
-        "file": "sdks/node/tests/idempotency-key.test.ts",
-        "name": "is deterministic"
-      },
-      {
-        "file": "sdks/node/tests/idempotency-key.test.ts",
-        "name": "rail namespacing prevents cross-rail collisions"
-      },
-      {
-        "file": "sdks/node/tests/idempotency-key.test.ts",
-        "name": "apple JWS produces the canonical pinned UUID across all 5 SDKs"
-      },
-      {
-        "file": "backend/tests/unit/idempotency-response-cache.test.ts",
-        "name": "is deterministic for the same input"
-      },
-      {
-        "file": "backend/tests/unit/idempotency-response-cache.test.ts",
-        "name": "injects idempotent_replay: true into a JSON object body"
-      },
-      {
-        "file": "backend/tests/unit/idempotency-response-cache.test.ts",
-        "name": "matches Stripe's 24-hour idempotency window"
-      },
-      {
-        "file": "sdks/swift/Tests/CrossdeckTests/IdempotencyKeyTests.swift",
-        "name": "test_crossSdkOracle_appleJWS"
-      },
-      {
-        "file": "sdks/swift/Tests/CrossdeckTests/IdempotencyKeyTests.swift",
-        "name": "test_railNamespacing_preventsCrossRailCollisions"
-      },
-      {
-        "file": "sdks/swift/Tests/CrossdeckTests/IdempotencyKeyTests.swift",
-        "name": "test_missingIdentifier_returnsNil"
-      },
-      {
-        "file": "sdks/android/crossdeck/src/test/kotlin/com/crossdeck/IdempotencyKeyTest.kt",
-        "name": "cross-SDK oracle for apple JWS"
-      },
-      {
-        "file": "sdks/android/crossdeck/src/test/kotlin/com/crossdeck/IdempotencyKeyTest.kt",
-        "name": "rail namespacing prevents cross-rail collisions"
-      },
-      {
-        "file": "sdks/android/crossdeck/src/test/kotlin/com/crossdeck/IdempotencyKeyTest.kt",
-        "name": "missing identifier returns null - never silent random fallback"
-      }
-    ],
-    "registeredAt": "2026-05-26",
-    "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 2.2.a + 2.2.b + 2.2.c",
-    "bundledIn": "@cross-deck/web@1.5.0"
-  },
-  {
-    "id": "init-reentry-drains-prior-queue",
-    "pillar": "lifecycle",
-    "status": "enforced",
-    "claim": "Web + RN init() re-entry drains the prior EventQueue's pending setTimeout BEFORE replacing this.state. Pre-v1.4.0 the teardown handled autoTracker/webVitals/errors/unloadFlush but NOT events, so the prior queue's timer would fire AFTER the state swap \u2014 sending old-init events against new-init http + identity references (cross-identity leak during HMR / config swap / multi-tenant SDK shells). The teardown CANNOT call persistent.clear() \u2014 the durable queue belongs to the SDK lifetime, not the init() lifetime, and a survived crash mid-flush re-hydrates on the next init.",
-    "appliesTo": [
-      "web",
-      "react-native"
-    ],
-    "codeRef": [
-      "sdks/web/src/crossdeck.ts",
-      "sdks/react-native/src/crossdeck.ts"
-    ],
-    "testRef": [
-      {
-        "file": "sdks/web/tests/init-reentry.test.ts",
-        "name": "re-init drains the prior queue's pending timer before swapping state"
-      },
-      {
-        "file": "sdks/web/tests/init-reentry.test.ts",
-        "name": "re-init does NOT wipe the durable event store"
-      }
-    ],
-    "registeredAt": "2026-05-26",
-    "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 5.5",
-    "bundledIn": "@cross-deck/web@1.5.0"
-  },
-  {
-    "id": "per-user-cache-isolation",
-    "pillar": "entitlements",
-    "status": "enforced",
-    "claim": "Every identify(userId) switches the entitlement cache to a physically separate per-user storage slot \u2014 `crossdeck:entitlements:<sha256(userId)>` \u2014 and unconditionally wipes the in-memory snapshot. A user-switch on a shared device CANNOT cross-read a prior user's cached entitlements, even if the in-memory clear is somehow skipped, because the storage keys are physically separate. reset() wipes every per-user slot via the persisted index.",
-    "appliesTo": [
-      "web",
-      "react-native",
-      "swift",
-      "android"
-    ],
-    "codeRef": [
-      "sdks/web/src/entitlement-cache.ts",
-      "sdks/web/src/hash.ts",
-      "sdks/web/src/crossdeck.ts",
-      "sdks/react-native/src/entitlement-cache.ts",
-      "sdks/react-native/src/hash.ts",
-      "sdks/react-native/src/crossdeck.ts",
-      "sdks/swift/Sources/Crossdeck/EntitlementCache.swift",
-      "sdks/swift/Sources/Crossdeck/IdempotencyKey.swift",
-      "sdks/swift/Sources/Crossdeck/Crossdeck.swift",
-      "sdks/android/crossdeck/src/main/kotlin/com/crossdeck/EntitlementCache.kt",
-      "sdks/android/crossdeck/src/main/kotlin/com/crossdeck/IdempotencyKey.kt",
-      "sdks/android/crossdeck/src/main/kotlin/com/crossdeck/Crossdeck.kt"
-    ],
-    "testRef": [
-      {
-        "file": "sdks/web/tests/entitlement-cache-isolation.test.ts",
-        "name": "identify(B) makes A's entitlements unreachable from in-memory"
-      },
-      {
-        "file": "sdks/web/tests/entitlement-cache-isolation.test.ts",
-        "name": "clearAll() removes every per-user storage key plus the index"
-      },
-      {
-        "file": "sdks/web/tests/entitlement-cache-isolation.test.ts",
-        "name": "a second cache instance reading A's storage suffix CANNOT see B's data"
-      },
-      {
-        "file": "sdks/react-native/tests/entitlement-cache-isolation.test.ts",
-        "name": "identify(B) makes A's entitlements unreachable from in-memory"
-      },
-      {
-        "file": "sdks/react-native/tests/entitlement-cache-isolation.test.ts",
-        "name": "removes every per-user storage key plus the index"
-      },
-      {
-        "file": "sdks/swift/Tests/CrossdeckTests/EntitlementCacheIsolationTests.swift",
-        "name": "test_identifyB_makesAEntitlementsUnreachable"
-      },
-      {
-        "file": "sdks/swift/Tests/CrossdeckTests/EntitlementCacheIsolationTests.swift",
-        "name": "test_identifiedWritesLandUnderPerUserSha256Key"
-      },
-      {
-        "file": "sdks/swift/Tests/CrossdeckTests/EntitlementCacheIsolationTests.swift",
-        "name": "test_clearAll_removesEveryPerUserStorageKeyPlusIndex"
-      },
-      {
-        "file": "sdks/android/crossdeck/src/test/kotlin/com/crossdeck/EntitlementCacheIsolationTest.kt",
-        "name": "identified writes land under per-user sha256 key"
-      },
-      {
-        "file": "sdks/android/crossdeck/src/test/kotlin/com/crossdeck/EntitlementCacheIsolationTest.kt",
-        "name": "identify B makes A entitlements unreachable from in-memory"
-      },
-      {
-        "file": "sdks/android/crossdeck/src/test/kotlin/com/crossdeck/EntitlementCacheIsolationTest.kt",
-        "name": "clearAll removes every per-user storage key plus the index"
-      },
-      {
-        "file": "sdks/android/crossdeck/src/test/kotlin/com/crossdeck/EntitlementCacheIsolationTest.kt",
-        "name": "a fresh cache bound to A's key CANNOT read B's blob"
-      }
-    ],
-    "registeredAt": "2026-05-26",
-    "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 1.3 (web/RN) + dogfood-gap fix (swift + android)",
-    "bundledIn": "@cross-deck/web@1.5.0"
-  },
-  {
-    "id": "sdk-error-codes-catalogue",
-    "pillar": "errors",
-    "status": "enforced",
-    "claim": "Web + Node SDK error-codes catalogues include EVERY backend-emitted ApiErrorCode with a description + resolution. Pre-v1.4.0 the catalogues documented codes the SDK threw ITSELF but ZERO backend codes \u2014 a developer hitting `invalid_api_key` / `origin_not_allowed` / `bundle_id_not_allowed` / `env_mismatch` / `idempotency_key_in_use` etc. got `undefined` from getErrorCode() and had to hunt for guidance. v1.4.0 backfills the catalogue from backend/src/api/v1-errors.ts so every wire code has a canonical 'what does this mean / what should I do' answer Stripe-style.",
-    "appliesTo": [
-      "web",
-      "node"
-    ],
-    "codeRef": [
-      "sdks/web/src/error-codes.ts",
-      "sdks/node/src/error-codes.ts",
-      "backend/src/api/v1-errors.ts"
-    ],
-    "testRef": [
-      {
-        "file": "sdks/web/tests/error-codes-backfill.test.ts",
-        "name": "includes backend code"
-      },
-      {
-        "file": "sdks/web/tests/error-codes-backfill.test.ts",
-        "name": "invalid_api_key resolution points at the dashboard"
-      },
-      {
-        "file": "sdks/web/tests/error-codes-backfill.test.ts",
-        "name": "idempotency_key_in_use resolution mentions Stripe-grade contract"
-      },
-      {
-        "file": "sdks/web/tests/error-codes-backfill.test.ts",
-        "name": "identity-lock codes carry permission_error type"
-      },
-      {
-        "file": "sdks/web/tests/error-codes-backfill.test.ts",
-        "name": "no entry has an empty description or resolution"
-      }
-    ],
-    "registeredAt": "2026-05-26",
-    "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 6.2",
-    "bundledIn": "@cross-deck/web@1.5.0"
-  },
-  {
-    "id": "sync-purchases-funnel-parity",
-    "pillar": "analytics",
-    "status": "enforced",
-    "claim": "Manual syncPurchases() emits a `purchase.completed` analytics event on success across ALL SDKs (Web / Node / RN / Swift / Android). Pre-v1.4.0 only Swift/Android auto-track emitted it \u2014 Web/Node/RN manual calls + Swift/Android manual calls fired ZERO analytics. Schema mirrors the auto-track event name + rail/productId/subscriptionId so cross-platform funnels reconcile on every payment path. When the backend short-circuits via the v1.4.0 idempotency cache, the event also carries `idempotent_replay: true`.",
-    "appliesTo": [
-      "web",
-      "node",
-      "react-native",
-      "swift",
-      "android"
-    ],
-    "codeRef": [
-      "sdks/web/src/crossdeck.ts",
-      "sdks/node/src/crossdeck-server.ts",
-      "sdks/react-native/src/crossdeck.ts",
-      "sdks/swift/Sources/Crossdeck/Crossdeck.swift",
-      "sdks/android/crossdeck/src/main/kotlin/com/crossdeck/Crossdeck.kt"
-    ],
-    "testRef": [
-      {
-        "file": "sdks/web/tests/sync-purchases-funnel.test.ts",
-        "name": "emits purchase.completed after a successful sync"
-      },
-      {
-        "file": "sdks/web/tests/sync-purchases-funnel.test.ts",
-        "name": "carries idempotent_replay=true when backend replied from cache"
-      }
-    ],
-    "registeredAt": "2026-05-26",
-    "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 3.5",
-    "bundledIn": "@cross-deck/web@1.5.0"
-  }
-]);
-
-// src/contracts.ts
-var CrossdeckContracts = {
-  /** Every contract that applies to this SDK and is currently enforced. */
-  all() {
-    return BUNDLED_CONTRACTS.filter((c) => c.status === "enforced");
-  },
-  /**
-   * Every contract bundled with this SDK release, including
-   * `proposed` and `retired` entries. Use `all()` for the
-   * enforced-only view.
-   */
-  allIncludingHistorical() {
-    return BUNDLED_CONTRACTS;
-  },
-  /** Look up a contract by its stable `id`. */
-  byId(id) {
-    return BUNDLED_CONTRACTS.find((c) => c.id === id);
-  },
-  /** Every enforced contract within a pillar. */
-  byPillar(pillar) {
-    return BUNDLED_CONTRACTS.filter(
-      (c) => c.pillar === pillar && c.status === "enforced"
-    );
-  },
-  /** Filter by lifecycle status. */
-  withStatus(status) {
-    return BUNDLED_CONTRACTS.filter((c) => c.status === status);
-  },
-  /** Semver of the SDK release these contracts were bundled with. */
-  sdkVersion: SDK_VERSION2,
-  /** Fully-qualified bundle identifier — e.g. `@cross-deck/web@1.4.2`. */
-  bundledIn: BUNDLED_IN,
-  /**
-   * Resolve a failing test back to the contract it exercises.
-   * Used by test-framework hooks (Vitest `afterEach`, XCTest
-   * observation, JUnit `TestWatcher`) to find the contract id of
-   * a failed contract test so `reportContractFailure(...)` can
-   * stamp the right `contract_id` on the emitted event.
-   *
-   * Match is on `testRef.name` (case-sensitive, exact). Returns
-   * the first contract whose `testRef` list contains a matching
-   * entry, regardless of pillar or status.
-   */
-  findByTestName(name) {
-    return BUNDLED_CONTRACTS.find(
-      (c) => c.testRef.some((ref) => ref.name === name)
-    );
-  }
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  CROSSDECK_ERROR_CODES,
-  Crossdeck,
-  CrossdeckClient,
-  CrossdeckContracts,
-  CrossdeckError,
-  DEFAULT_BASE_URL,
-  MemoryStorage,
-  SDK_NAME,
-  SDK_VERSION,
-  getErrorCode
-});
-//# sourceMappingURL=index.cjs.map