@fixback/expo 0.1.0 → 0.3.0

package/dist/reporter-session-store.js

@@ -0,0 +1,53 @@
+"use strict";
+/**
+ * The Expo **Reporter session** store (ADR-0032) — the storage binding only.
+ *
+ * After a Connect the SDK holds a compact signed token per origin and forwards it on
+ * every boot; the boot answer hands back a refreshed one (30-day sliding). On React
+ * Native the token is a real credential, so it lives in **Expo SecureStore**
+ * (Keychain / Keystore), not AsyncStorage — under a key **scoped by publishable key**
+ * (so two Projects in one app keep separate sessions), the key format shared with every
+ * SDK (`@fixback/sdk-core`). Persistence is best-effort: an unavailable or failing
+ * secure store simply means no stored session — the SDK falls back to anonymous rather
+ * than throwing, so it never disturbs the host app.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readReporterSession = readReporterSession;
+exports.writeReporterSession = writeReporterSession;
+exports.clearReporterSession = clearReporterSession;
+const sdk_core_1 = require("@fixback/sdk-core");
+/** Read the stored Reporter session token for this Project, or `null`. Best-effort. */
+async function readReporterSession(store, publishableKey) {
+    if (!store)
+        return null;
+    try {
+        const value = await store.getItemAsync((0, sdk_core_1.reporterSessionStorageKey)(publishableKey));
+        return typeof value === "string" && value.length > 0 ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Persist a Reporter session token for this Project. Best-effort. */
+async function writeReporterSession(store, publishableKey, token) {
+    if (!store)
+        return;
+    try {
+        await store.setItemAsync((0, sdk_core_1.reporterSessionStorageKey)(publishableKey), token);
+    }
+    catch {
+        // Secure store blocked — the session lives only for this launch, which still works.
+    }
+}
+/** Clear the stored Reporter session token for this Project (sign out). Best-effort. */
+async function clearReporterSession(store, publishableKey) {
+    if (!store)
+        return;
+    try {
+        await store.deleteItemAsync((0, sdk_core_1.reporterSessionStorageKey)(publishableKey));
+    }
+    catch {
+        // Nothing to do — an unreadable store holds nothing to clear.
+    }
+}
+//# sourceMappingURL=reporter-session-store.js.map

package/dist/reporter-session-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reporter-session-store.js","sourceRoot":"","sources":["../src/reporter-session-store.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAeH,kDAWC;AAGD,oDAWC;AAGD,oDAUC;AAnDD,gDAA8D;AAY9D,uFAAuF;AAChF,KAAK,UAAU,mBAAmB,CACvC,KAA2C,EAC3C,cAAsB;IAEtB,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,IAAA,oCAAyB,EAAC,cAAc,CAAC,CAAC,CAAC;QAClF,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,sEAAsE;AAC/D,KAAK,UAAU,oBAAoB,CACxC,KAA2C,EAC3C,cAAsB,EACtB,KAAa;IAEb,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,YAAY,CAAC,IAAA,oCAAyB,EAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,oFAAoF;IACtF,CAAC;AACH,CAAC;AAED,wFAAwF;AACjF,KAAK,UAAU,oBAAoB,CACxC,KAA2C,EAC3C,cAAsB;IAEtB,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,eAAe,CAAC,IAAA,oCAAyB,EAAC,cAAc,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC"}

package/dist/shake.d.ts

@@ -49,3 +49,29 @@ export interface ShakeDetector {
  * every sample, so memory stays bounded however long the app runs.
  */
 export declare function createShakeDetector(options: ShakeDetectorOptions): ShakeDetector;
+/** How often the accelerometer reports while the gesture is armed. */
+export declare const DEFAULT_SHAKE_SAMPLE_INTERVAL_MS = 80;
+/** The shake gesture's init options: the tuning plus an off switch. */
+export interface ShakeOptions extends Partial<ShakeTuning> {
+    /** Arm the shake gesture. Defaults to `true`. */
+    readonly enabled?: boolean;
+    /**
+     * The accelerometer update interval to request, in ms. Defaults to
+     * {@link DEFAULT_SHAKE_SAMPLE_INTERVAL_MS}. The interval is global to the
+     * sensor in `expo-sensors` — the SDK only sets it when no other listener is
+     * registered, and apps that drive the accelerometer themselves should align
+     * this with their own setting.
+     */
+    readonly sampleIntervalMs?: number;
+}
+/** The resolved shake configuration the provider arms the gesture with. */
+export interface ResolvedShakeConfig extends ShakeTuning {
+    readonly enabled: boolean;
+    readonly sampleIntervalMs: number;
+}
+/**
+ * Fill every shake knob from the init options, defaulting each independently —
+ * so `shake: { thresholdG: 3 }` retunes only the threshold and keeps the rest of
+ * spec 0004 §B's numbers.
+ */
+export declare function resolveShakeConfig(shake?: ShakeOptions): ResolvedShakeConfig;

package/dist/shake.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * The pure **shake detector** — the mobile launcher's brain (spec 0004 §B,
  * ADR-0021). It consumes raw accelerometer samples (in g, gravity included, as
@@ -9,8 +10,12 @@
  * Kept free of any React Native import so the recogniser is unit-tested
  * deterministically; the sensor wiring lives in `adapters.ts`.
  */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_SHAKE_SAMPLE_INTERVAL_MS = exports.DEFAULT_SHAKE_TUNING = void 0;
+exports.createShakeDetector = createShakeDetector;
+exports.resolveShakeConfig = resolveShakeConfig;
 /** The default tuning: a deliberate shake, not a bump or a phone put down hard. */
-export const DEFAULT_SHAKE_TUNING = {
+exports.DEFAULT_SHAKE_TUNING = {
     thresholdG: 2.0,
     minPeaks: 3,
     windowMs: 900,
@@ -26,12 +31,12 @@ function tuned(value, fallback) {
  * Create a shake recogniser. The peak list is pruned to the sliding window on
  * every sample, so memory stays bounded however long the app runs.
  */
-export function createShakeDetector(options) {
-    const thresholdG = tuned(options.thresholdG, DEFAULT_SHAKE_TUNING.thresholdG);
-    const minPeaks = Math.max(1, Math.floor(tuned(options.minPeaks, DEFAULT_SHAKE_TUNING.minPeaks)));
-    const windowMs = tuned(options.windowMs, DEFAULT_SHAKE_TUNING.windowMs);
-    const minGapMs = tuned(options.minGapMs, DEFAULT_SHAKE_TUNING.minGapMs);
-    const cooldownMs = tuned(options.cooldownMs, DEFAULT_SHAKE_TUNING.cooldownMs);
+function createShakeDetector(options) {
+    const thresholdG = tuned(options.thresholdG, exports.DEFAULT_SHAKE_TUNING.thresholdG);
+    const minPeaks = Math.max(1, Math.floor(tuned(options.minPeaks, exports.DEFAULT_SHAKE_TUNING.minPeaks)));
+    const windowMs = tuned(options.windowMs, exports.DEFAULT_SHAKE_TUNING.windowMs);
+    const minGapMs = tuned(options.minGapMs, exports.DEFAULT_SHAKE_TUNING.minGapMs);
+    const cooldownMs = tuned(options.cooldownMs, exports.DEFAULT_SHAKE_TUNING.cooldownMs);
     /** Epoch-ms times of the peaks inside the current window. */
     let peaks = [];
     let lastPeakAt = Number.NEGATIVE_INFINITY;
@@ -77,3 +82,23 @@ export function createShakeDetector(options) {
         },
     };
 }
+// --- The gesture's init options ------------------------------------------------
+/** How often the accelerometer reports while the gesture is armed. */
+exports.DEFAULT_SHAKE_SAMPLE_INTERVAL_MS = 80;
+/**
+ * Fill every shake knob from the init options, defaulting each independently —
+ * so `shake: { thresholdG: 3 }` retunes only the threshold and keeps the rest of
+ * spec 0004 §B's numbers.
+ */
+function resolveShakeConfig(shake = {}) {
+    return {
+        enabled: shake.enabled !== false,
+        sampleIntervalMs: shake.sampleIntervalMs ?? exports.DEFAULT_SHAKE_SAMPLE_INTERVAL_MS,
+        thresholdG: shake.thresholdG ?? exports.DEFAULT_SHAKE_TUNING.thresholdG,
+        minPeaks: shake.minPeaks ?? exports.DEFAULT_SHAKE_TUNING.minPeaks,
+        windowMs: shake.windowMs ?? exports.DEFAULT_SHAKE_TUNING.windowMs,
+        minGapMs: shake.minGapMs ?? exports.DEFAULT_SHAKE_TUNING.minGapMs,
+        cooldownMs: shake.cooldownMs ?? exports.DEFAULT_SHAKE_TUNING.cooldownMs,
+    };
+}
+//# sourceMappingURL=shake.js.map

package/dist/shake.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shake.js","sourceRoot":"","sources":["../src/shake.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AA0DH,kDAwDC;AAgCD,gDAUC;AAnID,mFAAmF;AACtE,QAAA,oBAAoB,GAAgB;IAC/C,UAAU,EAAE,GAAG;IACf,QAAQ,EAAE,CAAC;IACX,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,EAAE;IACZ,UAAU,EAAE,IAAI;CACjB,CAAC;AAgBF,SAAS,KAAK,CAAC,KAAyB,EAAE,QAAgB;IACxD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QACrE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,OAA6B;IAC/D,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,4BAAoB,CAAC,UAAU,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CACvB,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,4BAAoB,CAAC,QAAQ,CAAC,CAAC,CACnE,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,4BAAoB,CAAC,QAAQ,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,4BAAoB,CAAC,QAAQ,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,4BAAoB,CAAC,UAAU,CAAC,CAAC;IAE9E,6DAA6D;IAC7D,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IAAI,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC1C,IAAI,WAAW,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAE3C,OAAO;QACL,MAAM,CAAC,MAAmB;YACxB,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC;YAC/B,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACnB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACnB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACnB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EACpB,CAAC;gBACD,OAAO;YACT,CAAC;YACD,0EAA0E;YAC1E,kEAAkE;YAClE,IAAI,EAAE,GAAG,WAAW,GAAG,UAAU;gBAAE,OAAO;YAE1C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YACnD,IAAI,SAAS,GAAG,UAAU;gBAAE,OAAO;YACnC,yEAAyE;YACzE,IAAI,EAAE,GAAG,UAAU,GAAG,QAAQ;gBAAE,OAAO;YAEvC,UAAU,GAAG,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,CAAC;YAC7B,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC;YAEzC,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;gBAC7B,KAAK,GAAG,EAAE,CAAC;gBACX,WAAW,GAAG,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,CAAC;gBAAC,MAAM,CAAC;oBACP,kDAAkD;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK;YACH,KAAK,GAAG,EAAE,CAAC;YACX,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC;YACtC,WAAW,GAAG,MAAM,CAAC,iBAAiB,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,kFAAkF;AAElF,sEAAsE;AACzD,QAAA,gCAAgC,GAAG,EAAE,CAAC;AAsBnD;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,QAAsB,EAAE;IACzD,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO,KAAK,KAAK;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,wCAAgC;QAC5E,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,4BAAoB,CAAC,UAAU;QAC/D,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,4BAAoB,CAAC,QAAQ;QACzD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,4BAAoB,CAAC,QAAQ;QACzD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,4BAAoB,CAAC,QAAQ;QACzD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,4BAAoB,CAAC,UAAU;KAChE,CAAC;AACJ,CAAC"}

package/dist/submit.d.ts

@@ -1,6 +1,9 @@
 /**
- * The multipart feedback submission — the transport half of the capture loop,
- * kept file-parallel with `packages/sdk/src/submit.ts` (ADR-0021).
+ * The multipart feedback submission — the transport half of the capture loop.
+ *
+ * The endpoint, the identity compaction, the backpressure window, and the `fetch`
+ * surface are all shared with the browser SDK through `@fixback/sdk-core`
+ * (ADR-0028); what stays here is the mobile envelope.
  *
  * `POST /api/ingest/feedback` is a multipart request: a single text part
  * `payload` carrying the JSON (publishable key + identity evidence + content)
@@ -14,13 +17,12 @@
  * The content-type header is deliberately not set, so the runtime writes the
  * `multipart/form-data` boundary itself. Like `requestBoot`, this never throws:
  * an unreachable Fixback or a refusal is a quiet result, so a Fixback problem
- * never breaks the host app. Automatic reports (`source: auto`) honour ingest's
+ * never breaks the host app. Automatic reports (`source: error`) honour ingest's
  * `429` + `Retry-After` backpressure; manual reports are never gated.
  */
-import { AutoReportBackoff } from "./auto-report-backoff";
-import type { IdentityInputs, ReporterTier } from "./boot";
-import { type FetchLike, type FormDataFactory } from "./http";
-import type { ReportContent } from "./report";
+import { AutoReportBackoff, feedbackEndpoint, type FetchLike, type IdentityInputs, type ReportContent, type ReporterTier } from "@fixback/sdk-core";
+import { type FormDataFactory } from "./http";
+export { feedbackEndpoint };
 /** What ingest returns for an accepted submission (vendored server shape). */
 export interface RecordedFeedback {
     readonly feedbackId: string;
@@ -41,8 +43,6 @@ export interface ScreenshotFile {
 /** Everything a single feedback submission carries. */
 export interface SubmitInput {
     readonly key: string;
-    /** The configured origin, sent as the `Origin` header (spec 0004 §A). */
-    readonly origin: string;
     readonly identity?: IdentityInputs;
     readonly content: ReportContent;
     readonly screenshot?: ScreenshotFile | null;
@@ -57,7 +57,7 @@ export type SubmitResult = {
     readonly status?: number;
 } | {
     /**
-     * A `source: auto` report shed under ingest backpressure — either held
+     * A `source: error` report shed under ingest backpressure — either held
      * locally because the window is still open, or answered `429` by ingest,
      * which opened/extended the window. Manual reports never produce this.
      */
@@ -72,16 +72,25 @@ export type SubmitResult = {
  * The abandoned request keeps running in the background harmlessly.
  */
 export declare const DEFAULT_SUBMIT_TIMEOUT_MS = 30000;
-/** Injectable transport collaborators, defaulted to the real implementations. */
+/**
+ * Injectable transport collaborators, defaulted to the real implementations —
+ * the same deps-object shape `requestBoot` takes, `origin` included.
+ */
 export interface SubmitDeps {
-    readonly fetchImpl?: FetchLike;
+    /** The `fetch` to call. Defaults to the runtime's global. */
+    readonly fetch?: FetchLike;
+    /** Creates the multipart form. Defaults to React Native's `FormData`. */
     readonly formData?: FormDataFactory;
+    /**
+     * The origin to declare explicitly (spec 0004 §A): React Native attaches no
+     * `Origin` header of its own, so the SDK sends the configured one and the server
+     * matches it against the Project's allowlist.
+     */
+    readonly origin?: string;
     readonly backoff?: AutoReportBackoff;
     /** Overall request timeout in ms; `0` disables. Defaults to {@link DEFAULT_SUBMIT_TIMEOUT_MS}. */
     readonly timeoutMs?: number;
 }
-/** Join an API base URL with the feedback path, tolerating a trailing slash. */
-export declare function feedbackEndpoint(apiUrl: string): string;
 /**
  * Submit a report to ingest. Assembles the `payload` JSON (key + identity +
  * content, with an explicit `source` stamped) and the optional screenshot file
@@ -89,7 +98,7 @@ export declare function feedbackEndpoint(apiUrl: string): string;
  * and resolves to the recorded Feedback on success or a named failure
  * otherwise.
  *
- * A `source: auto` report first consults the shared backpressure window: while
+ * A `source: error` report first consults the shared backpressure window: while
  * it is open the report is dropped without a request. Ingest's `429` +
  * `Retry-After` opens/extends that window. Manual reports (`source: reporter`,
  * the default) never consult the window and a non-2xx for them stays a plain

package/dist/submit.js

@@ -1,6 +1,10 @@
+"use strict";
 /**
- * The multipart feedback submission — the transport half of the capture loop,
- * kept file-parallel with `packages/sdk/src/submit.ts` (ADR-0021).
+ * The multipart feedback submission — the transport half of the capture loop.
+ *
+ * The endpoint, the identity compaction, the backpressure window, and the `fetch`
+ * surface are all shared with the browser SDK through `@fixback/sdk-core`
+ * (ADR-0028); what stays here is the mobile envelope.
  *
  * `POST /api/ingest/feedback` is a multipart request: a single text part
  * `payload` carrying the JSON (publishable key + identity evidence + content)
@@ -14,11 +18,15 @@
  * The content-type header is deliberately not set, so the runtime writes the
  * `multipart/form-data` boundary itself. Like `requestBoot`, this never throws:
  * an unreachable Fixback or a refusal is a quiet result, so a Fixback problem
- * never breaks the host app. Automatic reports (`source: auto`) honour ingest's
+ * never breaks the host app. Automatic reports (`source: error`) honour ingest's
  * `429` + `Retry-After` backpressure; manual reports are never gated.
  */
-import { AutoReportBackoff } from "./auto-report-backoff";
-import { globalFetch, globalFormData, } from "./http";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_SUBMIT_TIMEOUT_MS = exports.feedbackEndpoint = void 0;
+exports.submitReport = submitReport;
+const sdk_core_1 = require("@fixback/sdk-core");
+Object.defineProperty(exports, "feedbackEndpoint", { enumerable: true, get: function () { return sdk_core_1.feedbackEndpoint; } });
+const http_1 = require("./http");
 /** The multipart field the screenshot binary is sent under (mirrors the server). */
 const SCREENSHOT_FIELD = "screenshot";
 /**
@@ -27,38 +35,12 @@ const SCREENSHOT_FIELD = "screenshot";
  * timeout, so without this a stalled connection would hang a report forever.
  * The abandoned request keeps running in the background harmlessly.
  */
-export const DEFAULT_SUBMIT_TIMEOUT_MS = 30_000;
+exports.DEFAULT_SUBMIT_TIMEOUT_MS = 30_000;
 /**
- * The shared `source: auto` backpressure window for the app. One instance so a
+ * The shared `source: error` backpressure window for the app. One instance so a
  * `429` from an auto-report holds the auto-reports that follow it.
  */
-const defaultBackoff = new AutoReportBackoff();
-/** Join an API base URL with the feedback path, tolerating a trailing slash. */
-export function feedbackEndpoint(apiUrl) {
-    return `${apiUrl.replace(/\/+$/, "")}/api/ingest/feedback`;
-}
-/** Drop `undefined` identity fields so the payload carries only what was given. */
-function compactIdentity(identity) {
-    if (!identity)
-        return {};
-    const out = {};
-    if (identity.signedIdentity)
-        out.signedIdentity = identity.signedIdentity;
-    if (identity.reporterId)
-        out.reporterId = identity.reporterId;
-    if (identity.anonymousId)
-        out.anonymousId = identity.anonymousId;
-    return out;
-}
-/** Read one response header defensively — `null` when unavailable or on any throw. */
-function safeHeader(response, name) {
-    try {
-        return response.headers?.get?.(name) ?? null;
-    }
-    catch {
-        return null;
-    }
-}
+const defaultBackoff = new sdk_core_1.AutoReportBackoff();
 /**
  * Submit a report to ingest. Assembles the `payload` JSON (key + identity +
  * content, with an explicit `source` stamped) and the optional screenshot file
@@ -66,32 +48,32 @@ function safeHeader(response, name) {
  * and resolves to the recorded Feedback on success or a named failure
  * otherwise.
  *
- * A `source: auto` report first consults the shared backpressure window: while
+ * A `source: error` report first consults the shared backpressure window: while
  * it is open the report is dropped without a request. Ingest's `429` +
  * `Retry-After` opens/extends that window. Manual reports (`source: reporter`,
  * the default) never consult the window and a non-2xx for them stays a plain
  * refusal. The `deps` seams exist purely so the call is testable.
  */
-export async function submitReport(apiUrl, input, deps = {}) {
+async function submitReport(apiUrl, input, deps = {}) {
     const source = input.content.source ?? "reporter";
-    const isAuto = source === "auto";
+    const isError = source === "error";
     const backoff = deps.backoff ?? defaultBackoff;
     // Client-side backpressure: shed auto-reports while the hold window is open,
     // without touching the network. Manual reports are never gated.
-    if (isAuto && backoff.isPaused()) {
+    if (isError && backoff.isPaused()) {
         return {
             ok: false,
             reason: "backpressure",
             retryAfterSeconds: backoff.retryAfterSeconds(),
         };
     }
-    const doFetch = deps.fetchImpl ?? globalFetch();
-    const makeForm = deps.formData ?? globalFormData();
+    const doFetch = deps.fetch ?? (0, sdk_core_1.resolveFetch)();
+    const makeForm = deps.formData ?? (0, http_1.globalFormData)();
     if (!doFetch || !makeForm)
         return { ok: false, reason: "unreachable" };
     const payload = {
         key: input.key,
-        ...compactIdentity(input.identity),
+        ...(0, sdk_core_1.compactIdentity)(input.identity),
         ...input.content,
         source,
     };
@@ -107,13 +89,13 @@ export async function submitReport(apiUrl, input, deps = {}) {
             type: input.screenshot.type ?? "image/png",
         });
     }
-    const timeoutMs = deps.timeoutMs ?? DEFAULT_SUBMIT_TIMEOUT_MS;
+    const timeoutMs = deps.timeoutMs ?? exports.DEFAULT_SUBMIT_TIMEOUT_MS;
     let timer;
     let response;
     try {
-        const request = doFetch(feedbackEndpoint(apiUrl), {
+        const request = doFetch((0, sdk_core_1.feedbackEndpoint)(apiUrl), {
             method: "POST",
-            headers: { origin: input.origin },
+            headers: deps.origin ? { origin: deps.origin } : {},
             body: form,
         });
         response =
@@ -137,14 +119,14 @@ export async function submitReport(apiUrl, input, deps = {}) {
         // A `429` for an auto-report is backpressure, not a refusal: open/extend
         // the hold window from `Retry-After` and report the wait. Manual reports
         // never 429 here, so any non-2xx for them stays a plain refusal.
-        if (isAuto && response.status === 429) {
-            const retryAfterSeconds = backoff.hold(safeHeader(response, "Retry-After"));
+        if (isError && response.status === 429) {
+            const retryAfterSeconds = backoff.hold((0, sdk_core_1.safeHeader)(response, "Retry-After"));
             return { ok: false, reason: "backpressure", retryAfterSeconds };
         }
         return { ok: false, reason: "refused", status: response.status };
     }
     try {
-        const feedback = (await response.json());
+        const feedback = (await response.json?.());
         return { ok: true, feedback };
     }
     catch {
@@ -152,3 +134,4 @@ export async function submitReport(apiUrl, input, deps = {}) {
         return { ok: true, feedback: null };
     }
 }
+//# sourceMappingURL=submit.js.map

package/dist/submit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"submit.js","sourceRoot":"","sources":["../src/submit.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;AAqHH,oCAwFC;AA3MD,gDAY2B;AAKlB,iGAdP,2BAAgB,OAcO;AAHzB,iCAA8D;AAK9D,oFAAoF;AACpF,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAgDtC;;;;;GAKG;AACU,QAAA,yBAAyB,GAAG,MAAM,CAAC;AAsBhD;;;GAGG;AACH,MAAM,cAAc,GAAG,IAAI,4BAAiB,EAAE,CAAC;AAE/C;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,KAAkB,EAClB,OAAmB,EAAE;IAErB,MAAM,MAAM,GAAmB,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;IAClE,MAAM,OAAO,GAAG,MAAM,KAAK,OAAO,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAE/C,6EAA6E;IAC7E,gEAAgE;IAChE,IAAI,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;QAClC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,cAAc;YACtB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE;SAC/C,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,IAAA,uBAAY,GAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAA,qBAAc,GAAE,CAAC;IACnD,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAEvE,MAAM,OAAO,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,IAAA,0BAAe,EAAC,KAAK,CAAC,QAAQ,CAAC;QAClC,GAAG,KAAK,CAAC,OAAO;QAChB,MAAM;KACP,CAAC;IAEF,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC;QAC1B,yEAAyE;QACzE,qEAAqE;QACrE,iCAAiC;QACjC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE;YAC5B,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG;YACzB,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,IAAI,gBAAgB;YAC/C,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,IAAI,WAAW;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,iCAAyB,CAAC;IAC9D,IAAI,KAAgD,CAAC;IACrD,IAAI,QAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,IAAA,2BAAgB,EAAC,MAAM,CAAC,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;YACnD,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,QAAQ;YACN,SAAS,GAAG,CAAC;gBACX,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC;oBACjB,OAAO;oBACP,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;wBAC/B,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,EACxD,SAAS,CACV,CAAC;oBACJ,CAAC,CAAC;iBACH,CAAC;gBACJ,CAAC,CAAC,MAAM,OAAO,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,yEAAyE;QACzE,yEAAyE;QACzE,iEAAiE;QACjE,IAAI,OAAO,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvC,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,IAAA,qBAAU,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;YAC5E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC;QAClE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAqB,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;AACH,CAAC"}

package/dist/tokens.js

@@ -1,3 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signal = void 0;
 /**
  * A vendored slice of the **Signal** design tokens for the mobile composer.
  *
@@ -11,7 +14,7 @@
  * (the composer passes `Platform.select` for that — this module stays free of
  * React Native imports so pure code can use it too).
  */
-export const signal = {
+exports.signal = {
     /* --fb-color-accent / tints */
     accent: "#2f6fed",
     accentTint: "#eaf1fe",
@@ -44,3 +47,4 @@ export const signal = {
     onEmphasis: "#ffffff",
     scrim: "rgba(15, 23, 32, 0.42)",
 };
+//# sourceMappingURL=tokens.js.map

package/dist/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;GAYG;AACU,QAAA,MAAM,GAAG;IACpB,+BAA+B;IAC/B,MAAM,EAAE,SAAS;IACjB,UAAU,EAAE,SAAS;IACrB,YAAY,EAAE,SAAS;IAEvB,2BAA2B;IAC3B,IAAI,EAAE,SAAS;IACf,SAAS,EAAE,SAAS;IACpB,SAAS,EAAE,SAAS;IACpB,SAAS,EAAE,SAAS;IACpB,UAAU,EAAE,SAAS;IACrB,SAAS,EAAE,SAAS;IAEpB,wBAAwB;IACxB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,SAAS;IACjB,MAAM,EAAE,SAAS;IACjB,MAAM,EAAE,SAAS;IACjB,aAAa,EAAE,SAAS;IACxB,YAAY,EAAE,SAAS;IAEvB,yFAAyF;IACzF,MAAM,EAAE,SAAS;IACjB,aAAa,EAAE,SAAS;IACxB,YAAY,EAAE,SAAS;IACvB,OAAO,EAAE,SAAS;IAClB,cAAc,EAAE,SAAS;IACzB,aAAa,EAAE,SAAS;IACxB,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,SAAS;IACtB,UAAU,EAAE,SAAS;IAErB,cAAc;IACd,UAAU,EAAE,SAAS;IACrB,KAAK,EAAE,wBAAwB;CACvB,CAAC"}

package/dist/version.d.ts

@@ -10,4 +10,4 @@
  * ever drift. Do not hand-edit this line to a value other than `package.json`'s
  * version.
  */
-export declare const EXPO_SDK_VERSION = "0.1.0";
+export declare const EXPO_SDK_VERSION = "0.3.0";

package/dist/version.js

@@ -1,3 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EXPO_SDK_VERSION = void 0;
 /**
  * The Expo SDK's own version string, reported to ingest as
  * `environment.sdkVersion`. Kept as an inlined constant rather than a runtime
@@ -10,4 +13,5 @@
  * ever drift. Do not hand-edit this line to a value other than `package.json`'s
  * version.
  */
-export const EXPO_SDK_VERSION = "0.1.0";
+exports.EXPO_SDK_VERSION = "0.3.0";
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;GAWG;AACU,QAAA,gBAAgB,GAAG,OAAO,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fixback/expo",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "The Fixback capture SDK for Expo / React Native apps — shake the device to report feedback with trace Evidence.",
   "license": "MIT",
   "type": "module",
@@ -11,13 +11,12 @@
     "LICENSE"
   ],
   "main": "./dist/index.js",
-  "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
-      "default": "./dist/index.js"
+      "require": "./dist/index.js"
     },
     "./package.json": "./package.json"
   },
@@ -35,27 +34,35 @@
     "url": "git+https://github.com/wemuda/fixback.git",
     "directory": "packages/expo"
   },
-  "homepage": "https://github.com/wemuda/fixback/tree/master/packages/expo#readme",
-  "bugs": "https://github.com/wemuda/fixback/issues",
+  "homepage": "https://docs.fixback.dev/sdk/expo",
+  "bugs": "https://docs.fixback.dev",
   "publishConfig": {
     "access": "public"
   },
   "peerDependencies": {
     "@react-native-async-storage/async-storage": ">=1.23.0",
+    "expo-secure-store": ">=13.0.0",
     "expo-sensors": ">=13.0.0",
+    "expo-web-browser": ">=13.0.0",
     "react": ">=18.0.0",
     "react-native": ">=0.74.0",
     "react-native-view-shot": ">=3.8.0"
   },
   "devDependencies": {
-    "@types/react": "^19.0.0",
+    "@types/react": "^19.2.18",
     "react": "19.2.8",
     "react-native": "^0.81.0",
     "typescript": "5.9.3",
     "vitest": "^4.1.10"
   },
+  "dependencies": {
+    "@fixback/sdk-core": "0.3.0"
+  },
+  "engines": {
+    "node": ">=20.12"
+  },
   "scripts": {
-    "build": "tsc -p tsconfig.build.json",
+    "build": "tsc -p tsconfig.build.json && node ../../scripts/finalize-cjs.mjs dist",
     "lint": "eslint .",
     "typecheck": "tsc --noEmit",
     "test": "vitest run"

package/dist/auto-report-backoff.d.ts

@@ -1,42 +0,0 @@
-/**
- * Client-side backpressure for **automatic** error reports — a verbatim port of
- * `packages/sdk/src/auto-report-backoff.ts` (spec 0003 §E/§H). When ingest
- * sheds `source: auto` load it answers `429` with a `Retry-After`; the SDK
- * honours it by holding a pause window during which further `source: auto`
- * reports are dropped without touching the network. **Manual** reports — a
- * human tapping Send — never consult this gate.
- */
-/** A source of the current time in epoch milliseconds — injectable for tests. */
-export type Clock = () => number;
-/** The hold window applied when a `429` carries no usable `Retry-After`. */
-export declare const DEFAULT_RETRY_AFTER_SECONDS = 60;
-/**
- * Parse a `Retry-After` header into whole seconds to hold for. Handles both
- * HTTP forms — a delta-seconds integer and an HTTP-date (measured from `now`,
- * rounded up and clamped at zero) — and falls back to
- * {@link DEFAULT_RETRY_AFTER_SECONDS} when the header is absent, blank, or
- * unparseable.
- */
-export declare function parseRetryAfter(header: string | null | undefined, now: number): number;
-/**
- * A single pause window for `source: auto` reports. `hold` opens (or extends)
- * it from a `429`'s `Retry-After`; `isPaused` reports whether it is still open.
- * The default instance in `submit.ts` is shared across the app's reports so the
- * hold persists across successive auto submissions.
- */
-export declare class AutoReportBackoff {
-    private readonly now;
-    /** Epoch ms until which `source: auto` reports are held; `0` when clear. */
-    private pausedUntil;
-    constructor(now?: Clock);
-    /** Is the `source: auto` pause window currently open? */
-    isPaused(): boolean;
-    /** Whole seconds remaining in the pause window (`0` when clear). */
-    retryAfterSeconds(): number;
-    /**
-     * Open (or extend) the window from a `429`'s `Retry-After` value, returning
-     * the seconds it will hold for. The window only ever grows — a shorter later
-     * hold never clips a longer one already in effect.
-     */
-    hold(retryAfterHeader: string | null | undefined): number;
-}

package/dist/auto-report-backoff.js

@@ -1,67 +0,0 @@
-/**
- * Client-side backpressure for **automatic** error reports — a verbatim port of
- * `packages/sdk/src/auto-report-backoff.ts` (spec 0003 §E/§H). When ingest
- * sheds `source: auto` load it answers `429` with a `Retry-After`; the SDK
- * honours it by holding a pause window during which further `source: auto`
- * reports are dropped without touching the network. **Manual** reports — a
- * human tapping Send — never consult this gate.
- */
-/** The hold window applied when a `429` carries no usable `Retry-After`. */
-export const DEFAULT_RETRY_AFTER_SECONDS = 60;
-/**
- * Parse a `Retry-After` header into whole seconds to hold for. Handles both
- * HTTP forms — a delta-seconds integer and an HTTP-date (measured from `now`,
- * rounded up and clamped at zero) — and falls back to
- * {@link DEFAULT_RETRY_AFTER_SECONDS} when the header is absent, blank, or
- * unparseable.
- */
-export function parseRetryAfter(header, now) {
-    if (header == null)
-        return DEFAULT_RETRY_AFTER_SECONDS;
-    const value = header.trim();
-    if (value === "")
-        return DEFAULT_RETRY_AFTER_SECONDS;
-    if (/^\d+$/.test(value)) {
-        return Number(value);
-    }
-    const when = Date.parse(value);
-    if (!Number.isNaN(when)) {
-        return Math.max(0, Math.ceil((when - now) / 1000));
-    }
-    return DEFAULT_RETRY_AFTER_SECONDS;
-}
-/**
- * A single pause window for `source: auto` reports. `hold` opens (or extends)
- * it from a `429`'s `Retry-After`; `isPaused` reports whether it is still open.
- * The default instance in `submit.ts` is shared across the app's reports so the
- * hold persists across successive auto submissions.
- */
-export class AutoReportBackoff {
-    now;
-    /** Epoch ms until which `source: auto` reports are held; `0` when clear. */
-    pausedUntil = 0;
-    constructor(now = Date.now) {
-        this.now = now;
-    }
-    /** Is the `source: auto` pause window currently open? */
-    isPaused() {
-        return this.now() < this.pausedUntil;
-    }
-    /** Whole seconds remaining in the pause window (`0` when clear). */
-    retryAfterSeconds() {
-        return Math.max(0, Math.ceil((this.pausedUntil - this.now()) / 1000));
-    }
-    /**
-     * Open (or extend) the window from a `429`'s `Retry-After` value, returning
-     * the seconds it will hold for. The window only ever grows — a shorter later
-     * hold never clips a longer one already in effect.
-     */
-    hold(retryAfterHeader) {
-        const now = this.now();
-        const seconds = parseRetryAfter(retryAfterHeader, now);
-        const until = now + seconds * 1000;
-        if (until > this.pausedUntil)
-            this.pausedUntil = until;
-        return seconds;
-    }
-}