@fixback/expo 0.1.0 → 0.3.0

package/dist/boot.d.ts

@@ -1,65 +0,0 @@
-/**
- * The ingest **boot** wire-contract, vendored — kept file-parallel with
- * `packages/sdk/src/boot.ts` (ADR-0021: a server contract change must be
- * mirrored in both clients).
- *
- * The one mobile difference: a native HTTP stack attaches no `Origin` header,
- * so the SDK sends the configured `origin` explicitly — the server reads it to
- * decide `originAllowed` exactly as it does for a browser request (spec 0004 §A).
- */
-import { type FetchLike } from "./http";
-/** A Project's Gate — who may submit. Mirrors the server's `ProjectGate`. */
-export type ProjectGate = "open" | "invited" | "internal";
-/** The trust tier a Reporter holds. Mirrors the server's `ReporterTier`. */
-export type ReporterTier = "public" | "invited" | "internal";
-/**
- * Optional identity evidence the SDK forwards to boot. None of it is a tier: the
- * server re-derives trust from this evidence and never honours a self-declared
- * tier, so the SDK does not send one.
- */
-export interface IdentityInputs {
-    readonly signedIdentity?: string;
-    readonly reporterId?: string;
-    readonly anonymousId?: string;
-}
-/** The JSON body `POST /api/ingest/boot` accepts. */
-export interface BootRequest extends IdentityInputs {
-    readonly key: string;
-}
-/**
- * The Project's effective console/network capture config, served on the boot
- * answer. Optional on the wire: an older server that does not send it (or a
- * malformed value) is treated as **capture on**, and init options override
- * whatever is served.
- */
-export interface CaptureConfig {
-    readonly console: boolean;
-    readonly network: boolean;
-}
-/**
- * The boot answer: whether this origin is allowlisted, the Project's Gate, the
- * caller's derived tier (`null` when a presented identity was refused), whether
- * a submission would be accepted right now, and the Project's capture config.
- * The shake gesture arms only when `canSubmit` is true.
- */
-export interface BootAnswer {
-    readonly originAllowed: boolean;
-    readonly gate: ProjectGate;
-    readonly tier: ReporterTier | null;
-    readonly canSubmit: boolean;
-    /** The Project's console/network capture config; absent ⇒ default-on. */
-    readonly capture?: CaptureConfig;
-}
-/** Join an API base URL with the boot path, tolerating a trailing slash. */
-export declare function bootEndpoint(apiUrl: string): string;
-/**
- * Ask ingest whether a submission would be accepted for this key / origin /
- * Gate. Resolves to the boot answer, or `null` when Fixback could not be
- * reached, the key was refused, or the response was not a boot answer. It never
- * throws: any non-answer is treated by the caller as "stay dormant", so a
- * Fixback outage stays invisible to the host app.
- *
- * Unlike a browser, React Native attaches no `Origin` header of its own — the
- * configured origin is sent explicitly so the server's allowlist check works.
- */
-export declare function requestBoot(apiUrl: string, request: BootRequest, origin: string, fetchImpl?: FetchLike): Promise<BootAnswer | null>;

package/dist/boot.js

@@ -1,60 +0,0 @@
-/**
- * The ingest **boot** wire-contract, vendored — kept file-parallel with
- * `packages/sdk/src/boot.ts` (ADR-0021: a server contract change must be
- * mirrored in both clients).
- *
- * The one mobile difference: a native HTTP stack attaches no `Origin` header,
- * so the SDK sends the configured `origin` explicitly — the server reads it to
- * decide `originAllowed` exactly as it does for a browser request (spec 0004 §A).
- */
-import { globalFetch } from "./http";
-/** Join an API base URL with the boot path, tolerating a trailing slash. */
-export function bootEndpoint(apiUrl) {
-    return `${apiUrl.replace(/\/+$/, "")}/api/ingest/boot`;
-}
-/** Narrow an unknown JSON body to a `BootAnswer` before the SDK trusts it. */
-function isBootAnswer(value) {
-    if (typeof value !== "object" || value === null)
-        return false;
-    const v = value;
-    return (typeof v.originAllowed === "boolean" &&
-        typeof v.canSubmit === "boolean" &&
-        typeof v.gate === "string" &&
-        (v.tier === null || typeof v.tier === "string"));
-}
-/**
- * Ask ingest whether a submission would be accepted for this key / origin /
- * Gate. Resolves to the boot answer, or `null` when Fixback could not be
- * reached, the key was refused, or the response was not a boot answer. It never
- * throws: any non-answer is treated by the caller as "stay dormant", so a
- * Fixback outage stays invisible to the host app.
- *
- * Unlike a browser, React Native attaches no `Origin` header of its own — the
- * configured origin is sent explicitly so the server's allowlist check works.
- */
-export async function requestBoot(apiUrl, request, origin, fetchImpl) {
-    const doFetch = fetchImpl ?? globalFetch();
-    if (!doFetch)
-        return null;
-    let response;
-    try {
-        response = await doFetch(bootEndpoint(apiUrl), {
-            method: "POST",
-            headers: { "content-type": "application/json", origin },
-            body: JSON.stringify(request),
-        });
-    }
-    catch {
-        return null; // network error / Fixback unreachable
-    }
-    if (!response.ok)
-        return null; // 401 unknown key, or any other refusal
-    let body;
-    try {
-        body = await response.json();
-    }
-    catch {
-        return null;
-    }
-    return isBootAnswer(body) ? body : null;
-}

package/dist/scrub.d.ts

@@ -1,55 +0,0 @@
-/**
- * The single client-side **scrub choke point** every report passes through
- * before transport — a verbatim port of `packages/sdk/src/scrub.ts` (spec 0003
- * §C; ADR-0021 keeps the two clients file-parallel).
- *
- * Masking is the SDK's job, done on the device before anything leaves it. The
- * default scrubbers are **on**: they strip credentials, query strings, and
- * bearer tokens from URLs, and redact obvious PII (emails, long digit runs,
- * bearer tokens) from crumb and error text. The result is then handed to an
- * optional per-project hook that can mutate it further or drop the whole report
- * by returning `null`. The hook is **synchronous and network-free** by
- * contract, and both manual (composer) and automatic (error-capture) reports
- * run through the very same choke point.
- */
-import type { ReportContent } from "./report";
-/** The per-project client scrub hook. Return `null` to drop the whole report. */
-export type BeforeSend = (draft: ReportContent) => ReportContent | null;
-/** Options for {@link runBeforeSend}. */
-export interface BeforeSendOptions {
-    /** The per-project hook, run **after** the default scrubbers. */
-    readonly hook?: BeforeSend | null;
-    /** Run the built-in default scrubbers first. Defaults to `true`. */
-    readonly scrub?: boolean;
-}
-/**
- * Redact obvious PII from free text: email addresses, `Bearer <token>` /
- * `token <value>` pairs, and long digit runs. Conservative by design — it keeps
- * the shape of the message readable while removing the sensitive spans.
- */
-export declare function redactPii(text: string): string;
-/**
- * Strip the sensitive parts of a URL: userinfo credentials, the entire query
- * string, a token-bearing fragment (one that carries `key=value`), and PII in
- * the **path segments**. Plain hash routes (`#/checkout`) are kept. Works on
- * absolute and relative URLs alike, with no dependency and no throw. The host
- * (authority) is never redacted.
- */
-export declare function scrubUrl(url: string): string;
-/**
- * Apply the built-in default scrubbers to a report draft: strip the report URL,
- * and scrub every crumb's URLs and redact PII from its text. The Reporter's own
- * `comment` is intentionally left untouched — it is authored on purpose, not
- * scraped. The screenshot is handled elsewhere (composer preview + removal,
- * spec 0004 §C); this is the final URL/PII sweep.
- */
-export declare function applyDefaultScrub(draft: ReportContent): ReportContent;
-/**
- * Run the report draft through the client scrub choke point: the default
- * scrubbers first (unless `scrub` is `false`), then the optional per-project
- * hook. Returns the scrubbed (and possibly hook-mutated) draft, or `null` when
- * the hook drops the report. A hook that throws is treated as a no-op — the
- * already-scrubbed draft is kept, so a buggy hook never breaks the report path
- * nor leaks unscrubbed data.
- */
-export declare function runBeforeSend(draft: ReportContent, options?: BeforeSendOptions): ReportContent | null;

package/dist/scrub.js

@@ -1,184 +0,0 @@
-/**
- * The single client-side **scrub choke point** every report passes through
- * before transport — a verbatim port of `packages/sdk/src/scrub.ts` (spec 0003
- * §C; ADR-0021 keeps the two clients file-parallel).
- *
- * Masking is the SDK's job, done on the device before anything leaves it. The
- * default scrubbers are **on**: they strip credentials, query strings, and
- * bearer tokens from URLs, and redact obvious PII (emails, long digit runs,
- * bearer tokens) from crumb and error text. The result is then handed to an
- * optional per-project hook that can mutate it further or drop the whole report
- * by returning `null`. The hook is **synchronous and network-free** by
- * contract, and both manual (composer) and automatic (error-capture) reports
- * run through the very same choke point.
- */
-/** A digit run at least this long is treated as sensitive (phone, card, id). */
-const MIN_DIGIT_RUN = 7;
-const EMAIL_RE = /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/gi;
-const DIGIT_RUN_RE = new RegExp(`\\d{${MIN_DIGIT_RUN},}`, "g");
-const BEARER_RE = /\b(bearer|token)\s+[\w.\-~+/]+=*/gi;
-/** An http(s) URL embedded in free text (e.g. a console log line). */
-const URL_IN_TEXT_RE = /\bhttps?:\/\/[^\s"'<>]+/gi;
-/**
- * Redact obvious PII from free text: email addresses, `Bearer <token>` /
- * `token <value>` pairs, and long digit runs. Conservative by design — it keeps
- * the shape of the message readable while removing the sensitive spans.
- */
-export function redactPii(text) {
-    if (typeof text !== "string" || text.length === 0)
-        return text;
-    return text
-        .replace(EMAIL_RE, "[redacted-email]")
-        .replace(BEARER_RE, (_match, keyword) => `${keyword} [redacted]`)
-        .replace(DIGIT_RUN_RE, "[redacted-number]");
-}
-/**
- * Redact PII from the **path** portion of a URL: emails and long digit runs in
- * path (or fragment-route) segments. Deliberately narrower than
- * {@link redactPii}: no bearer/token rule and only ever applied to the
- * post-authority remainder, so a host or port with digits is never touched.
- */
-function redactPathPii(pathAndBeyond) {
-    return pathAndBeyond
-        .replace(EMAIL_RE, "[redacted-email]")
-        .replace(DIGIT_RUN_RE, "[redacted-number]");
-}
-/**
- * Strip the sensitive parts of a URL: userinfo credentials, the entire query
- * string, a token-bearing fragment (one that carries `key=value`), and PII in
- * the **path segments**. Plain hash routes (`#/checkout`) are kept. Works on
- * absolute and relative URLs alike, with no dependency and no throw. The host
- * (authority) is never redacted.
- */
-export function scrubUrl(url) {
-    if (typeof url !== "string" || url.length === 0)
-        return url;
-    let out = url;
-    // Drop userinfo credentials: scheme://user:pass@host → scheme://host
-    out = out.replace(/(^[a-z][a-z0-9+.-]*:\/\/)[^/@?#]*@/i, "$1");
-    // Drop the query string entirely (everything from '?' up to a '#').
-    out = out.replace(/\?[^#]*/, "");
-    // Drop a token-bearing fragment (it carries '='); keep plain hash routes.
-    out = out.replace(/#.*$/, (fragment) => fragment.includes("=") ? "" : fragment);
-    // Redact PII in the path (and any kept fragment route), never in the authority.
-    const absolute = out.match(/^([a-z][a-z0-9+.-]*:\/\/[^/?#]*)([\s\S]*)$/i);
-    if (absolute)
-        return absolute[1] + redactPathPii(absolute[2] ?? "");
-    const protocolRelative = out.match(/^(\/\/[^/?#]*)([\s\S]*)$/);
-    if (protocolRelative) {
-        return protocolRelative[1] + redactPathPii(protocolRelative[2] ?? "");
-    }
-    // A relative URL is all path — redact the whole thing.
-    return redactPathPii(out);
-}
-function scrubCrumbData(data) {
-    const next = { ...data };
-    if (typeof next.url === "string")
-        next.url = scrubUrl(next.url);
-    if (typeof next.from === "string")
-        next.from = scrubUrl(next.from);
-    if (typeof next.to === "string")
-        next.to = scrubUrl(next.to);
-    return next;
-}
-/** Scrub a crumb's free-text message: strip URL query strings, then redact PII. */
-function scrubMessage(message) {
-    return redactPii(message.replace(URL_IN_TEXT_RE, (url) => scrubUrl(url)));
-}
-/**
- * Scrub the string leaves of a structured console-arg value — the value a
- * `json` arg carries. Walks arrays and plain objects, applying the same
- * URL-strip + PII redaction as a crumb message to every nested string.
- */
-function scrubArgValue(value) {
-    if (typeof value === "string")
-        return scrubMessage(value);
-    if (Array.isArray(value))
-        return value.map(scrubArgValue);
-    if (value && typeof value === "object") {
-        const out = {};
-        for (const [key, v] of Object.entries(value)) {
-            out[key] = scrubArgValue(v);
-        }
-        return out;
-    }
-    return value;
-}
-/**
- * Scrub one structured console argument: redact PII / strip URL query strings
- * from a `string` value, from every string leaf of a `json` value, and from an
- * `error` value's `message` and `stack`. Other tags carry no free text.
- */
-function scrubConsoleArg(arg) {
-    switch (arg.t) {
-        case "string":
-            return typeof arg.v === "string" ? { t: "string", v: scrubMessage(arg.v) } : arg;
-        case "json":
-            return { t: "json", v: scrubArgValue(arg.v) };
-        case "error": {
-            if (!arg.v || typeof arg.v !== "object")
-                return arg;
-            const v = arg.v;
-            const next = { ...v };
-            if (typeof next.message === "string")
-                next.message = scrubMessage(next.message);
-            if (typeof next.stack === "string")
-                next.stack = scrubMessage(next.stack);
-            return { t: "error", v: next };
-        }
-        default:
-            return arg;
-    }
-}
-function scrubCrumb(crumb) {
-    const next = { ...crumb };
-    if (typeof next.message === "string")
-        next.message = scrubMessage(next.message);
-    if (next.data)
-        next.data = scrubCrumbData(next.data);
-    // A rich network crumb carries its scrubbed URL at the top level — sweep it
-    // again here (idempotent) so the choke point holds wherever the URL rode.
-    if (typeof next.url === "string")
-        next.url = scrubUrl(next.url);
-    // A console crumb's structured args carry the same free text as its preview.
-    if (Array.isArray(next.args))
-        next.args = next.args.map(scrubConsoleArg);
-    return next;
-}
-/**
- * Apply the built-in default scrubbers to a report draft: strip the report URL,
- * and scrub every crumb's URLs and redact PII from its text. The Reporter's own
- * `comment` is intentionally left untouched — it is authored on purpose, not
- * scraped. The screenshot is handled elsewhere (composer preview + removal,
- * spec 0004 §C); this is the final URL/PII sweep.
- */
-export function applyDefaultScrub(draft) {
-    const next = { ...draft };
-    if (typeof next.url === "string")
-        next.url = scrubUrl(next.url);
-    if (next.trace && next.trace.length > 0) {
-        next.trace = next.trace.map(scrubCrumb);
-    }
-    return next;
-}
-/**
- * Run the report draft through the client scrub choke point: the default
- * scrubbers first (unless `scrub` is `false`), then the optional per-project
- * hook. Returns the scrubbed (and possibly hook-mutated) draft, or `null` when
- * the hook drops the report. A hook that throws is treated as a no-op — the
- * already-scrubbed draft is kept, so a buggy hook never breaks the report path
- * nor leaks unscrubbed data.
- */
-export function runBeforeSend(draft, options = {}) {
-    const current = options.scrub === false ? draft : applyDefaultScrub(draft);
-    const hook = options.hook;
-    if (!hook)
-        return current;
-    try {
-        const result = hook(current);
-        return result ?? null;
-    }
-    catch {
-        return current;
-    }
-}