@fixback/expo 0.2.0 → 0.3.0

package/dist/http.d.ts

@@ -1,31 +1,16 @@
 /**
- * Minimal structural types for the HTTP surface the SDK touches.
+ * The **`FormData` slice** the multipart submission uses — the one HTTP shape that
+ * is genuinely React Native's own.
  *
- * The package typechecks without the DOM lib (React Native is not a browser), so
- * rather than depending on ambient `fetch`/`FormData` declarations, the exact
- * slices the transport uses are described here and the globals are read off
- * `globalThis` defensively. React Native provides both at runtime; tests inject
- * fakes through the same seams.
+ * The `fetch` surface (`FetchLike`, `FetchRequestInit`, `FetchResponseLike`,
+ * `resolveFetch`) is shared with the browser and Node SDKs and lives in
+ * `@fixback/sdk-core` (ADR-0028). What stays here is the part that differs:
+ * React Native's `FormData` accepts `{ uri, name, type }` objects as file parts —
+ * that is how the screenshot travels, since there is no `Blob` screenshot on
+ * mobile. The package typechecks without the DOM lib (React Native is not a
+ * browser), so the constructor is read off `globalThis` defensively; tests inject
+ * fakes through the same seam.
  */
-/** The response slice `boot`/`submit` read: status, ok, headers, JSON body. */
-export interface FetchResponseLike {
-    readonly ok: boolean;
-    readonly status: number;
-    readonly headers?: {
-        get(name: string): string | null;
-    } | null;
-    json(): Promise<unknown>;
-}
-/** The request init the SDK sends — method, plain headers, and a body. */
-export interface FetchRequestInit {
-    readonly method: string;
-    readonly headers?: Record<string, string>;
-    readonly body?: unknown;
-}
-/** A `fetch`-shaped function, injectable for tests. */
-export type FetchLike = (url: string, init: FetchRequestInit) => Promise<FetchResponseLike>;
-/** React Native's global `fetch`, when present. Bound so `this` never matters. */
-export declare function globalFetch(): FetchLike | undefined;
 /**
  * The `FormData` slice the submission uses. React Native's implementation
  * accepts `{ uri, name, type }` objects as file parts — that is how the

package/dist/http.js

@@ -1,20 +1,23 @@
+"use strict";
 /**
- * Minimal structural types for the HTTP surface the SDK touches.
+ * The **`FormData` slice** the multipart submission uses — the one HTTP shape that
+ * is genuinely React Native's own.
  *
- * The package typechecks without the DOM lib (React Native is not a browser), so
- * rather than depending on ambient `fetch`/`FormData` declarations, the exact
- * slices the transport uses are described here and the globals are read off
- * `globalThis` defensively. React Native provides both at runtime; tests inject
- * fakes through the same seams.
+ * The `fetch` surface (`FetchLike`, `FetchRequestInit`, `FetchResponseLike`,
+ * `resolveFetch`) is shared with the browser and Node SDKs and lives in
+ * `@fixback/sdk-core` (ADR-0028). What stays here is the part that differs:
+ * React Native's `FormData` accepts `{ uri, name, type }` objects as file parts —
+ * that is how the screenshot travels, since there is no `Blob` screenshot on
+ * mobile. The package typechecks without the DOM lib (React Native is not a
+ * browser), so the constructor is read off `globalThis` defensively; tests inject
+ * fakes through the same seam.
  */
-/** React Native's global `fetch`, when present. Bound so `this` never matters. */
-export function globalFetch() {
-    const g = globalThis;
-    return typeof g.fetch === "function" ? g.fetch.bind(globalThis) : undefined;
-}
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.globalFormData = globalFormData;
 /** React Native's global `FormData` constructor, when present. */
-export function globalFormData() {
+function globalFormData() {
     const g = globalThis;
     const ctor = g.FormData;
     return typeof ctor === "function" ? () => new ctor() : undefined;
 }
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AAeH,wCAIC;AALD,kEAAkE;AAClE,SAAgB,cAAc;IAC5B,MAAM,CAAC,GAAG,UAAmD,CAAC;IAC9D,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;IACxB,OAAO,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC"}

package/dist/identity.d.ts

@@ -1,22 +1,22 @@
 /**
- * The Public Reporter's stable, first-party anonymous id — the mobile
- * counterpart of `packages/sdk/src/identity.ts`.
+ * The Public Reporter's anonymous id on React Native — the **storage binding**
+ * only.
  *
- * When the host app does not supply its own identity, the SDK establishes a
- * per-device id and persists it (AsyncStorage on React Native), so repeated
- * boots from the same device are one Reporter. Persistence is best-effort: if
- * storage is unavailable or failing, we fall back to an ephemeral id rather
- * than throw — the SDK must never disturb the host app. The storage key is the
- * web SDK's, so the shape stays recognisable across clients.
+ * The key and the id generator are shared with every other SDK
+ * (`@fixback/sdk-core`, ADR-0028), so a Fixback anonymous id looks the same across
+ * clients. What differs, and so lives here, is persistence: React Native's
+ * AsyncStorage is asynchronous, where a browser's `localStorage` is not.
+ *
+ * Persistence is best-effort: if storage is unavailable or failing, we fall back to
+ * an ephemeral id rather than throw — the SDK must never disturb the host app.
  */
+import { ANONYMOUS_ID_STORAGE_KEY, generateAnonymousId } from "@fixback/sdk-core";
+export { ANONYMOUS_ID_STORAGE_KEY, generateAnonymousId };
 /** The async storage slice the SDK uses — AsyncStorage-shaped, injectable. */
 export interface StorageLike {
     getItem(key: string): Promise<string | null>;
     setItem(key: string, value: string): Promise<void>;
 }
-export declare const ANONYMOUS_ID_STORAGE_KEY = "fixback.anonymousId";
-/** A random id: a UUID where the platform offers one, else a compact fallback. */
-export declare function generateAnonymousId(): string;
 /**
  * Return this device's anonymous id, creating and persisting one on first use.
  * Any storage failure — absent module, quota, corrupted value — yields an

package/dist/identity.js

@@ -1,46 +1,41 @@
+"use strict";
 /**
- * The Public Reporter's stable, first-party anonymous id — the mobile
- * counterpart of `packages/sdk/src/identity.ts`.
+ * The Public Reporter's anonymous id on React Native — the **storage binding**
+ * only.
  *
- * When the host app does not supply its own identity, the SDK establishes a
- * per-device id and persists it (AsyncStorage on React Native), so repeated
- * boots from the same device are one Reporter. Persistence is best-effort: if
- * storage is unavailable or failing, we fall back to an ephemeral id rather
- * than throw — the SDK must never disturb the host app. The storage key is the
- * web SDK's, so the shape stays recognisable across clients.
+ * The key and the id generator are shared with every other SDK
+ * (`@fixback/sdk-core`, ADR-0028), so a Fixback anonymous id looks the same across
+ * clients. What differs, and so lives here, is persistence: React Native's
+ * AsyncStorage is asynchronous, where a browser's `localStorage` is not.
+ *
+ * Persistence is best-effort: if storage is unavailable or failing, we fall back to
+ * an ephemeral id rather than throw — the SDK must never disturb the host app.
  */
-export const ANONYMOUS_ID_STORAGE_KEY = "fixback.anonymousId";
-/** A random id: a UUID where the platform offers one, else a compact fallback. */
-export function generateAnonymousId() {
-    const c = globalThis.crypto;
-    if (c && typeof c.randomUUID === "function") {
-        try {
-            return c.randomUUID();
-        }
-        catch {
-            // Fall through to the compact fallback.
-        }
-    }
-    return `fb-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
-}
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateAnonymousId = exports.ANONYMOUS_ID_STORAGE_KEY = void 0;
+exports.ensureAnonymousId = ensureAnonymousId;
+const sdk_core_1 = require("@fixback/sdk-core");
+Object.defineProperty(exports, "ANONYMOUS_ID_STORAGE_KEY", { enumerable: true, get: function () { return sdk_core_1.ANONYMOUS_ID_STORAGE_KEY; } });
+Object.defineProperty(exports, "generateAnonymousId", { enumerable: true, get: function () { return sdk_core_1.generateAnonymousId; } });
 /**
  * Return this device's anonymous id, creating and persisting one on first use.
  * Any storage failure — absent module, quota, corrupted value — yields an
  * ephemeral id for this session instead of an error.
  */
-export async function ensureAnonymousId(storage) {
+async function ensureAnonymousId(storage) {
     if (!storage)
-        return generateAnonymousId();
+        return (0, sdk_core_1.generateAnonymousId)();
     try {
-        const existing = await storage.getItem(ANONYMOUS_ID_STORAGE_KEY);
+        const existing = await storage.getItem(sdk_core_1.ANONYMOUS_ID_STORAGE_KEY);
         if (typeof existing === "string" && existing.length > 0)
             return existing;
-        const id = generateAnonymousId();
-        await storage.setItem(ANONYMOUS_ID_STORAGE_KEY, id);
+        const id = (0, sdk_core_1.generateAnonymousId)();
+        await storage.setItem(sdk_core_1.ANONYMOUS_ID_STORAGE_KEY, id);
         return id;
     }
     catch {
         // Storage blocked or absent — an ephemeral id keeps this boot working.
-        return generateAnonymousId();
+        return (0, sdk_core_1.generateAnonymousId)();
     }
 }
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAkBH,8CAcC;AA9BD,gDAAkF;AAGzE,yGAHA,mCAAwB,OAGA;AAAE,oGAHA,8BAAmB,OAGA;AAQtD;;;;GAIG;AACI,KAAK,UAAU,iBAAiB,CACrC,OAAuC;IAEvC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAA,8BAAmB,GAAE,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,mCAAwB,CAAC,CAAC;QACjE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC;QACzE,MAAM,EAAE,GAAG,IAAA,8BAAmB,GAAE,CAAC;QACjC,MAAM,OAAO,CAAC,OAAO,CAAC,mCAAwB,EAAE,EAAE,CAAC,CAAC;QACpD,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,OAAO,IAAA,8BAAmB,GAAE,CAAC;IAC/B,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -2,14 +2,15 @@
  * @fixback/expo — the Fixback capture SDK for Expo / React Native apps.
  *
  * Shake the device to report feedback with trace Evidence; uncaught errors
- * report themselves. Spec 0004; decision record ADR-0021.
+ * report themselves. Spec 0004; decision record ADR-0021. The runtime-agnostic
+ * half (trace buffer, crumb builders, scrubbing, fingerprinting, boot contract)
+ * is `@fixback/sdk-core` (ADR-0028) and re-exported here, so a host app imports
+ * everything from one package.
  */
 export { Fixback, FixbackProvider, useFixback, type FixbackHandle, type FixbackProviderProps, } from "./FixbackProvider";
-export { canonicalizeOrigin, createFixbackClient, DEFAULT_API_URL, DEFAULT_SHAKE_SAMPLE_INTERVAL_MS, type ComposerContext, type ComposerDraft, type FixbackAdapters, type FixbackClient, type FixbackOptions, type FixbackStatus, type ShakeOptions, } from "./client";
-export type { BootAnswer, CaptureConfig, IdentityInputs, ProjectGate, ReporterTier, } from "./boot";
+export { canonicalizeOrigin, createFixbackClient, DEFAULT_API_URL, DEFAULT_SHAKE_SAMPLE_INTERVAL_MS, type ComposerContext, type ComposerDraft, type FixbackAdapters, type FixbackClient, type FixbackOptions, type FixbackStatus, type ResolvedShakeConfig, type ShakeOptions, } from "./client";
+export type { BeforeBreadcrumb, BeforeSend, BootAnswer, Breadcrumb, BreadcrumbCategory, BreadcrumbLevel, CaptureConfig, CaptureToggles, CommonInitOptions, IdentityInputs, ProjectGate, ReporterIdentity, ReporterTier, } from "@fixback/sdk-core";
 export type { CaptureEnvironment, FeedbackSource, ReportContent, } from "./report";
-export type { Breadcrumb, BreadcrumbCategory, BreadcrumbLevel, BeforeBreadcrumb, } from "./breadcrumbs";
-export type { BeforeSend } from "./scrub";
 export { createShakeDetector, DEFAULT_SHAKE_TUNING, type ShakeDetector, type ShakeSample, type ShakeTuning, } from "./shake";
 export type { RecordedFeedback, ScreenshotFile, SubmitResult, } from "./submit";
 export { EXPO_SDK_VERSION } from "./version";

package/dist/index.js

@@ -1,10 +1,27 @@
+"use strict";
 /**
  * @fixback/expo — the Fixback capture SDK for Expo / React Native apps.
  *
  * Shake the device to report feedback with trace Evidence; uncaught errors
- * report themselves. Spec 0004; decision record ADR-0021.
+ * report themselves. Spec 0004; decision record ADR-0021. The runtime-agnostic
+ * half (trace buffer, crumb builders, scrubbing, fingerprinting, boot contract)
+ * is `@fixback/sdk-core` (ADR-0028) and re-exported here, so a host app imports
+ * everything from one package.
  */
-export { Fixback, FixbackProvider, useFixback, } from "./FixbackProvider";
-export { canonicalizeOrigin, createFixbackClient, DEFAULT_API_URL, DEFAULT_SHAKE_SAMPLE_INTERVAL_MS, } from "./client";
-export { createShakeDetector, DEFAULT_SHAKE_TUNING, } from "./shake";
-export { EXPO_SDK_VERSION } from "./version";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EXPO_SDK_VERSION = exports.DEFAULT_SHAKE_TUNING = exports.createShakeDetector = exports.DEFAULT_SHAKE_SAMPLE_INTERVAL_MS = exports.DEFAULT_API_URL = exports.createFixbackClient = exports.canonicalizeOrigin = exports.useFixback = exports.FixbackProvider = exports.Fixback = void 0;
+var FixbackProvider_1 = require("./FixbackProvider");
+Object.defineProperty(exports, "Fixback", { enumerable: true, get: function () { return FixbackProvider_1.Fixback; } });
+Object.defineProperty(exports, "FixbackProvider", { enumerable: true, get: function () { return FixbackProvider_1.FixbackProvider; } });
+Object.defineProperty(exports, "useFixback", { enumerable: true, get: function () { return FixbackProvider_1.useFixback; } });
+var client_1 = require("./client");
+Object.defineProperty(exports, "canonicalizeOrigin", { enumerable: true, get: function () { return client_1.canonicalizeOrigin; } });
+Object.defineProperty(exports, "createFixbackClient", { enumerable: true, get: function () { return client_1.createFixbackClient; } });
+Object.defineProperty(exports, "DEFAULT_API_URL", { enumerable: true, get: function () { return client_1.DEFAULT_API_URL; } });
+Object.defineProperty(exports, "DEFAULT_SHAKE_SAMPLE_INTERVAL_MS", { enumerable: true, get: function () { return client_1.DEFAULT_SHAKE_SAMPLE_INTERVAL_MS; } });
+var shake_1 = require("./shake");
+Object.defineProperty(exports, "createShakeDetector", { enumerable: true, get: function () { return shake_1.createShakeDetector; } });
+Object.defineProperty(exports, "DEFAULT_SHAKE_TUNING", { enumerable: true, get: function () { return shake_1.DEFAULT_SHAKE_TUNING; } });
+var version_1 = require("./version");
+Object.defineProperty(exports, "EXPO_SDK_VERSION", { enumerable: true, get: function () { return version_1.EXPO_SDK_VERSION; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAEH,qDAM2B;AALzB,0GAAA,OAAO,OAAA;AACP,kHAAA,eAAe,OAAA;AACf,6GAAA,UAAU,OAAA;AAKZ,mCAakB;AAZhB,4GAAA,kBAAkB,OAAA;AAClB,6GAAA,mBAAmB,OAAA;AACnB,yGAAA,eAAe,OAAA;AACf,0HAAA,gCAAgC,OAAA;AAkClC,iCAMiB;AALf,4GAAA,mBAAmB,OAAA;AACnB,6GAAA,oBAAoB,OAAA;AAYtB,qCAA6C;AAApC,2GAAA,gBAAgB,OAAA"}

package/dist/origin.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Canonicalizing the configured **origin** (spec 0004 §A).
+ *
+ * On the web the browser serializes the `Origin` header; here the SDK is the
+ * serializer, so it must produce exactly what the server stored. This is pure and
+ * self-contained precisely so it can be unit-tested directly, without booting a
+ * client.
+ */
+/**
+ * Canonicalize the configured origin exactly as the server's `normalizeOrigin`
+ * does when an allowlist entry is stored (`apps/api/src/projects/origin.ts`):
+ * lowercase the scheme and host, elide default ports, and drop any userinfo,
+ * path, query, or fragment. The server compares the `Origin` header by exact
+ * string equality against those canonical rows — so without this a pasted
+ * `https://com.acme.MyApp` (bundle ids legally carry uppercase) would silently
+ * never match its own allowlist entry. Implemented without `URL` (React Native's
+ * polyfill is partial); a value that doesn't parse as an http(s) origin is kept
+ * trimmed — boot will simply refuse it. IDN hosts are not punycoded (the one
+ * divergence from the server; use the encoded form).
+ */
+export declare function canonicalizeOrigin(value: string): string;

package/dist/origin.js

@@ -0,0 +1,45 @@
+"use strict";
+/**
+ * Canonicalizing the configured **origin** (spec 0004 §A).
+ *
+ * On the web the browser serializes the `Origin` header; here the SDK is the
+ * serializer, so it must produce exactly what the server stored. This is pure and
+ * self-contained precisely so it can be unit-tested directly, without booting a
+ * client.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalizeOrigin = canonicalizeOrigin;
+/**
+ * Canonicalize the configured origin exactly as the server's `normalizeOrigin`
+ * does when an allowlist entry is stored (`apps/api/src/projects/origin.ts`):
+ * lowercase the scheme and host, elide default ports, and drop any userinfo,
+ * path, query, or fragment. The server compares the `Origin` header by exact
+ * string equality against those canonical rows — so without this a pasted
+ * `https://com.acme.MyApp` (bundle ids legally carry uppercase) would silently
+ * never match its own allowlist entry. Implemented without `URL` (React Native's
+ * polyfill is partial); a value that doesn't parse as an http(s) origin is kept
+ * trimmed — boot will simply refuse it. IDN hosts are not punycoded (the one
+ * divergence from the server; use the encoded form).
+ */
+function canonicalizeOrigin(value) {
+    const trimmed = value.trim();
+    const match = trimmed.match(/^(https?):\/\/([^/?#]+)(?:[/?#].*)?$/i);
+    if (!match)
+        return trimmed.replace(/\/+$/, "");
+    const scheme = match[1].toLowerCase();
+    let authority = match[2];
+    const at = authority.lastIndexOf("@");
+    if (at >= 0)
+        authority = authority.slice(at + 1);
+    let host = authority;
+    let port;
+    const portMatch = authority.match(/^(.+):(\d+)$/);
+    if (portMatch) {
+        host = portMatch[1];
+        port = portMatch[2];
+    }
+    host = host.toLowerCase();
+    const isDefaultPort = !port || (scheme === "https" && port === "443") || (scheme === "http" && port === "80");
+    return isDefaultPort ? `${scheme}://${host}` : `${scheme}://${host}:${port}`;
+}
+//# sourceMappingURL=origin.js.map

package/dist/origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.js","sourceRoot":"","sources":["../src/origin.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AAcH,gDAmBC;AA/BD;;;;;;;;;;;GAWG;AACH,SAAgB,kBAAkB,CAAC,KAAa;IAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACrE,IAAI,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,SAAS,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IAC1B,MAAM,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,EAAE,IAAI,CAAC;QAAE,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACjD,IAAI,IAAI,GAAG,SAAS,CAAC;IACrB,IAAI,IAAwB,CAAC;IAC7B,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAClD,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC;IACvB,CAAC;IACD,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC1B,MAAM,aAAa,GACjB,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC;IAC1F,OAAO,aAAa,CAAC,CAAC,CAAC,GAAG,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;AAC/E,CAAC"}

package/dist/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/dist/report.d.ts

@@ -1,63 +1,33 @@
 /**
- * The ingest **feedback** content wire-contract, vendored, plus the helpers
- * that assemble it from what a Reporter composed — kept file-parallel with
- * `packages/sdk/src/report.ts` (ADR-0021). The mobile slice carries no
- * `annotation` (element picking and drawing are web-only today, spec 0004 §G);
- * every content field is optional on the server, so the payload simply omits it.
+ * Assembling the ingest **feedback** content from what a Reporter composed in the
+ * mobile composer, plus the device-side environment capture.
+ *
+ * The wire shapes themselves — `ReportContent`, `CaptureEnvironment`,
+ * `FeedbackSource` — live in `@fixback/sdk-core` (ADR-0028), so the mobile SDK
+ * speaks the *same* contract as the browser and backend rather than a vendored
+ * subset of it. This module re-exports them for the SDK's public surface and holds
+ * only the mobile-specific assembly: reading the environment off the device, and
+ * clamping the free-form reporter display fields.
+ *
+ * The mobile slice carries no `annotation` (element picking and drawing are web-only
+ * today, spec 0004 §G); every content field is optional on the server, so the
+ * payload simply omits it.
  */
-import type { Breadcrumb } from "./breadcrumbs";
-/**
- * Where a Feedback came from — a human in the composer (`reporter`, the
- * default) or the SDK's automatic error capture (`error`). Mirrors the server's
- * `FEEDBACK_SOURCES`; the server derives trust independently.
- */
-export type FeedbackSource = "reporter" | "error";
-/** The capture environment recorded alongside a report. */
-export interface CaptureEnvironment {
-    readonly viewportWidth?: number;
-    readonly viewportHeight?: number;
-    readonly browser?: string;
-    readonly sdkVersion?: string;
-}
-/**
- * The JSON content of a feedback submission — the object serialised into the
- * multipart `payload` part next to the `key` and identity evidence. Every
- * field is optional: none of it feeds the server's trust decision. The
- * screenshot is a separate binary part, never part of this JSON.
- */
-export interface ReportContent {
-    readonly comment?: string;
-    /**
-     * The Reporter's self-provided display **name / email** — display only,
-     * never a trust signal; the server derives the tier from identity evidence
-     * alone and ignores these.
-     */
-    readonly reporterName?: string;
-    readonly reporterEmail?: string;
-    /** On mobile: `<origin>/<screen>` when a screen was tracked, else the origin. */
-    readonly url?: string;
-    readonly environment?: CaptureEnvironment;
-    /** The masked breadcrumb trace buffer that rode on this report. */
-    readonly trace?: readonly Breadcrumb[];
-    /**
-     * Provenance. Omitted for a manual report — the transport stamps the
-     * `reporter` default on the wire; set to `error` by the SDK's error capture.
-     */
-    readonly source?: FeedbackSource;
-    /** For `source: error` only — the SDK's per-session error fingerprint. */
-    readonly errorSignature?: string;
-    /** For `source: error` only — the running occurrence count within the session. */
-    readonly occurrences?: number;
-}
+import type { Breadcrumb, CaptureEnvironment, FeedbackSource, ReportContent } from "@fixback/sdk-core";
+export type { CaptureEnvironment, FeedbackSource, ReportContent };
 /** What the composer hands to {@link assembleContent} when the Reporter sends. */
 export interface ReportDraft {
     readonly comment?: string;
     readonly url?: string;
     readonly environment?: CaptureEnvironment;
     readonly trace?: readonly Breadcrumb[];
-    /** The Reporter's self-provided display name / email, if the SDK holds them. */
-    readonly reporterName?: string;
-    readonly reporterEmail?: string;
+    /**
+     * The deploy **Environment** the SDK was configured with (ADR-0025) —
+     * `production` / `staging` / … — distinct from the build `release` in
+     * {@link CaptureEnvironment}. Named apart from `environment` (the capture bag)
+     * to avoid the collision, exactly as the wire does.
+     */
+    readonly deployEnvironment?: string;
 }
 /** What the platform adapter reads off the device for the environment. */
 export interface EnvironmentInputs {
@@ -72,18 +42,13 @@ export interface EnvironmentInputs {
  * dimension is recorded only when it is a positive number (the server rejects
  * `0` via `int().positive()`); the `browser` field — the server's free-form
  * client string — carries a `react-native <os>` description.
+ *
+ * The **Release** (#117, ADR-0024) is stamped here too, already validated by the
+ * client (`normaliseRelease`). Without it a mobile build's captured frames cannot
+ * be matched against the sourcemaps `fixback sourcemaps upload` shipped for that
+ * build, so symbolication would silently do nothing.
  */
-export declare function collectEnvironment(inputs: EnvironmentInputs, sdkVersion: string): CaptureEnvironment;
-/**
- * The server's hard bounds on the display-only reporter fields
- * (`feedbackContentBody` in `apps/api/src/ingest/ingest.controller.ts`). An
- * over-long value fails the whole submission with a 400 there, and unlike the
- * web SDK — whose onboarding input is the source — these arrive as free-form
- * init options, so the client clamps rather than lets one oversized display
- * string swallow every report.
- */
-export declare const MAX_REPORTER_NAME_LENGTH = 200;
-export declare const MAX_REPORTER_EMAIL_LENGTH = 320;
+export declare function collectEnvironment(inputs: EnvironmentInputs, sdkVersion: string, release?: string): CaptureEnvironment;
 /**
  * Assemble the ingest content from what the Reporter composed. Empty pieces
  * are dropped rather than sent as blanks: a whitespace-only comment or an

package/dist/report.js

@@ -1,17 +1,34 @@
+"use strict";
 /**
- * The ingest **feedback** content wire-contract, vendored, plus the helpers
- * that assemble it from what a Reporter composed — kept file-parallel with
- * `packages/sdk/src/report.ts` (ADR-0021). The mobile slice carries no
- * `annotation` (element picking and drawing are web-only today, spec 0004 §G);
- * every content field is optional on the server, so the payload simply omits it.
+ * Assembling the ingest **feedback** content from what a Reporter composed in the
+ * mobile composer, plus the device-side environment capture.
+ *
+ * The wire shapes themselves — `ReportContent`, `CaptureEnvironment`,
+ * `FeedbackSource` — live in `@fixback/sdk-core` (ADR-0028), so the mobile SDK
+ * speaks the *same* contract as the browser and backend rather than a vendored
+ * subset of it. This module re-exports them for the SDK's public surface and holds
+ * only the mobile-specific assembly: reading the environment off the device, and
+ * clamping the free-form reporter display fields.
+ *
+ * The mobile slice carries no `annotation` (element picking and drawing are web-only
+ * today, spec 0004 §G); every content field is optional on the server, so the
+ * payload simply omits it.
  */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectEnvironment = collectEnvironment;
+exports.assembleContent = assembleContent;
 /**
  * Build the capture environment from what the adapter read off the device. A
  * dimension is recorded only when it is a positive number (the server rejects
  * `0` via `int().positive()`); the `browser` field — the server's free-form
  * client string — carries a `react-native <os>` description.
+ *
+ * The **Release** (#117, ADR-0024) is stamped here too, already validated by the
+ * client (`normaliseRelease`). Without it a mobile build's captured frames cannot
+ * be matched against the sourcemaps `fixback sourcemaps upload` shipped for that
+ * build, so symbolication would silently do nothing.
  */
-export function collectEnvironment(inputs, sdkVersion) {
+function collectEnvironment(inputs, sdkVersion, release) {
     const env = {};
     const width = inputs.windowWidth;
     if (typeof width === "number" && width > 0)
@@ -24,44 +41,35 @@ export function collectEnvironment(inputs, sdkVersion) {
     env.browser = os ? `react-native ${os}` : "react-native";
     if (sdkVersion.length > 0)
         env.sdkVersion = sdkVersion;
+    if (release && release.length > 0)
+        env.release = release;
     return env;
 }
-/**
- * The server's hard bounds on the display-only reporter fields
- * (`feedbackContentBody` in `apps/api/src/ingest/ingest.controller.ts`). An
- * over-long value fails the whole submission with a 400 there, and unlike the
- * web SDK — whose onboarding input is the source — these arrive as free-form
- * init options, so the client clamps rather than lets one oversized display
- * string swallow every report.
- */
-export const MAX_REPORTER_NAME_LENGTH = 200;
-export const MAX_REPORTER_EMAIL_LENGTH = 320;
+// The self-provided reporter display name / email are gone (ADR-0032): a Reporter is an
+// Account, so a name and email come from the signed-in `user`. The Expo Connect flow
+// that supplies the Account lands in ticket #251.
 /**
  * Assemble the ingest content from what the Reporter composed. Empty pieces
  * are dropped rather than sent as blanks: a whitespace-only comment or an
  * empty environment is simply omitted, so the payload carries only what was
  * actually provided (mirroring the server's all-optional content).
  */
-export function assembleContent(draft) {
+function assembleContent(draft) {
     const content = {};
     const comment = draft.comment?.trim();
     if (comment)
         content.comment = comment;
-    const reporterName = draft.reporterName?.trim();
-    if (reporterName) {
-        content.reporterName = reporterName.slice(0, MAX_REPORTER_NAME_LENGTH);
-    }
-    const reporterEmail = draft.reporterEmail?.trim();
-    if (reporterEmail) {
-        content.reporterEmail = reporterEmail.slice(0, MAX_REPORTER_EMAIL_LENGTH);
-    }
     if (draft.url)
         content.url = draft.url;
     if (draft.environment && Object.keys(draft.environment).length > 0) {
         content.environment = draft.environment;
     }
+    const deployEnvironment = draft.deployEnvironment?.trim();
+    if (deployEnvironment)
+        content.deployEnvironment = deployEnvironment;
     // Only a non-empty trace rides along — an empty buffer is simply omitted.
     if (draft.trace && draft.trace.length > 0)
         content.trace = draft.trace;
     return content;
 }
+//# sourceMappingURL=report.js.map

package/dist/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AAgDH,gDA4BC;AAWD,0CAyBC;AA3ED;;;;;;;;;;GAUG;AACH,SAAgB,kBAAkB,CAChC,MAAyB,EACzB,UAAkB,EAClB,OAAgB;IAEhB,MAAM,GAAG,GAML,EAAE,CAAC;IAEP,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,GAAG,CAAC;QAAE,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC;IACnC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,EAAE,GAAG,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IAEzD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC;IAEvD,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;IAEzD,OAAO,GAAG,CAAC;AACb,CAAC;AACD,wFAAwF;AACxF,qFAAqF;AACrF,kDAAkD;AAElD;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,KAAkB;IAChD,MAAM,OAAO,GAMT,EAAE,CAAC;IAEP,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,OAAO;QAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;IAEvC,IAAI,KAAK,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IAEvC,IAAI,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnE,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IAC1C,CAAC;IAED,MAAM,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,iBAAiB;QAAE,OAAO,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAErE,0EAA0E;IAC1E,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAEvE,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/reporter-session-store.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The Expo **Reporter session** store (ADR-0032) — the storage binding only.
+ *
+ * After a Connect the SDK holds a compact signed token per origin and forwards it on
+ * every boot; the boot answer hands back a refreshed one (30-day sliding). On React
+ * Native the token is a real credential, so it lives in **Expo SecureStore**
+ * (Keychain / Keystore), not AsyncStorage — under a key **scoped by publishable key**
+ * (so two Projects in one app keep separate sessions), the key format shared with every
+ * SDK (`@fixback/sdk-core`). Persistence is best-effort: an unavailable or failing
+ * secure store simply means no stored session — the SDK falls back to anonymous rather
+ * than throwing, so it never disturbs the host app.
+ */
+/**
+ * The SecureStore slice the SDK uses — `expo-secure-store`-shaped, injectable so the
+ * client is unit-tested without the native module. Absent ⇒ no persisted session.
+ */
+export interface SecureStorageLike {
+    getItemAsync(key: string): Promise<string | null>;
+    setItemAsync(key: string, value: string): Promise<void>;
+    deleteItemAsync(key: string): Promise<void>;
+}
+/** Read the stored Reporter session token for this Project, or `null`. Best-effort. */
+export declare function readReporterSession(store: SecureStorageLike | null | undefined, publishableKey: string): Promise<string | null>;
+/** Persist a Reporter session token for this Project. Best-effort. */
+export declare function writeReporterSession(store: SecureStorageLike | null | undefined, publishableKey: string, token: string): Promise<void>;
+/** Clear the stored Reporter session token for this Project (sign out). Best-effort. */
+export declare function clearReporterSession(store: SecureStorageLike | null | undefined, publishableKey: string): Promise<void>;