@fixback/sdk-core 0.2.0 → 0.3.0

package/dist/connect.js

@@ -0,0 +1,147 @@
+"use strict";
+/**
+ * The **Connect** wire contract (ADR-0032, CONTEXT.md "Connect") — the one copy every
+ * capture SDK speaks, kept in the shared core beside the boot contract for the same
+ * reason (`@fixback/shared` is server-shaped and private, ticket #47).
+ *
+ * Connect is the round trip that binds an Account to a site: the SDK opens the
+ * platform's connect page ({@link BootAnswer.connectUrl}), the person signs in, the
+ * page hands back a **one-time code**, and the SDK exchanges it here for a **Reporter
+ * session** — a compact token it stores per origin and forwards on every boot. Keep
+ * this in lock-step with the server: `POST /api/connect/exchange` and
+ * `POST /api/connect/signout` (`apps/api/src/connect/*`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONNECT_RETURN_PARAM = exports.CONNECT_MESSAGE_SOURCE = void 0;
+exports.connectExchangeEndpoint = connectExchangeEndpoint;
+exports.connectSignOutEndpoint = connectSignOutEndpoint;
+exports.buildConnectUrl = buildConnectUrl;
+exports.reporterSessionStorageKey = reporterSessionStorageKey;
+exports.parseConnectMessage = parseConnectMessage;
+exports.isConnectExchangeResponse = isConnectExchangeResponse;
+exports.exchangeConnectCode = exchangeConnectCode;
+exports.revokeReporterSession = revokeReporterSession;
+const http_1 = require("./http");
+/**
+ * The `postMessage` a connect page in a popup sends back to the opener. `source`
+ * pins it to Fixback so an unrelated message on the window is ignored; `code` is the
+ * one-time Connect code to exchange. Read with {@link parseConnectMessage}.
+ */
+exports.CONNECT_MESSAGE_SOURCE = "fixback-connect";
+/**
+ * The query parameter a Fixback link — and the connect page's **redirect fallback** —
+ * carries the one-time code back on, when a popup could not be used (ADR-0032,
+ * "arriving with the `fixback` query parameter"). The SDK detects it on boot, exchanges
+ * it, and strips it from the URL.
+ */
+exports.CONNECT_RETURN_PARAM = "fixback";
+/** Join an API base URL with the Connect exchange path, tolerating a trailing slash. */
+function connectExchangeEndpoint(apiUrl) {
+    return `${apiUrl.replace(/\/+$/, "")}/api/connect/exchange`;
+}
+/** Join an API base URL with the Connect sign-out path, tolerating a trailing slash. */
+function connectSignOutEndpoint(apiUrl) {
+    return `${apiUrl.replace(/\/+$/, "")}/api/connect/signout`;
+}
+/**
+ * Build the connect-page URL the SDK opens (popup or redirect). `connectUrl` is the
+ * base the boot answer carried; `key` identifies the Project and `returnUrl` is where
+ * the person is sent back — validated server-side against the Project's allowed
+ * origins, so a hostile page cannot redirect the code anywhere else.
+ */
+function buildConnectUrl(connectUrl, params) {
+    // Built with `encodeURIComponent` rather than `URLSearchParams`/`URL` so the
+    // runtime-agnostic core needs no DOM lib (it runs on web, Expo, and Node alike).
+    const base = connectUrl.split("#")[0] ?? connectUrl;
+    const sep = base.includes("?") ? "&" : "?";
+    const query = `key=${encodeURIComponent(params.key)}` +
+        `&return=${encodeURIComponent(params.returnUrl)}`;
+    return `${base}${sep}${query}`;
+}
+/**
+ * The `localStorage` key a browser SDK stores its Reporter session token under,
+ * **scoped by publishable key** so two Fixback Projects on one origin keep separate
+ * sessions (ADR-0032). The storage binding is per-runtime; the key format is shared.
+ */
+function reporterSessionStorageKey(publishableKey) {
+    return `fixback.reporterSession.${publishableKey}`;
+}
+/**
+ * Narrow an unknown `message.data` to the Connect code it carries, or `null`. Guards
+ * `source` so an unrelated `postMessage` — the web is noisy — is ignored.
+ */
+function parseConnectMessage(data) {
+    if (typeof data !== "object" || data === null)
+        return null;
+    const v = data;
+    if (v.source !== exports.CONNECT_MESSAGE_SOURCE)
+        return null;
+    return typeof v.code === "string" && v.code.length > 0 ? v.code : null;
+}
+/** Narrow an unknown JSON body to a {@link ConnectExchangeResponse}. */
+function isConnectExchangeResponse(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const v = value;
+    if (typeof v.reporterSession !== "string" || v.reporterSession.length === 0) {
+        return false;
+    }
+    const account = v.account;
+    return (typeof account === "object" &&
+        account !== null &&
+        typeof account.name === "string" &&
+        typeof account.email === "string");
+}
+/**
+ * Exchange a one-time code for a Reporter session. Resolves to the response, or `null`
+ * when Fixback was unreachable, the code was refused, or the body was not a valid
+ * response — the caller stays anonymous rather than surfacing an error into the host
+ * page (ticket #47: "fails quietly").
+ */
+async function exchangeConnectCode(apiUrl, request, deps = {}) {
+    const doFetch = deps.fetch ?? (0, http_1.resolveFetch)();
+    if (!doFetch)
+        return null;
+    let response;
+    try {
+        response = await doFetch(connectExchangeEndpoint(apiUrl), {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify(request),
+        });
+    }
+    catch {
+        return null;
+    }
+    if (!response.ok)
+        return null;
+    let body;
+    try {
+        body = await response.json?.();
+    }
+    catch {
+        return null;
+    }
+    return isConnectExchangeResponse(body) ? body : null;
+}
+/**
+ * Revoke a Reporter session server-side ("sign out"). Best-effort: a network failure
+ * still lets the SDK clear its stored token locally, and a revoked-anyway token is
+ * refused at the next boot regardless.
+ */
+async function revokeReporterSession(apiUrl, token, deps = {}) {
+    const doFetch = deps.fetch ?? (0, http_1.resolveFetch)();
+    if (!doFetch)
+        return;
+    try {
+        await doFetch(connectSignOutEndpoint(apiUrl), {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ reporterSession: token }),
+        });
+    }
+    catch {
+        // Best-effort: the local token is cleared by the caller regardless.
+    }
+}
+//# sourceMappingURL=connect.js.map

package/dist/connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.js","sourceRoot":"","sources":["../src/connect.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAgEH,0DAEC;AAGD,wDAEC;AAQD,0CAYC;AAOD,8DAEC;AAMD,kDAKC;AAGD,8DAeC;AAaD,kDA2BC;AAOD,sDAgBC;AA7LD,iCAA8E;AAE9E;;;;GAIG;AACU,QAAA,sBAAsB,GAAG,iBAAiB,CAAC;AAExD;;;;;GAKG;AACU,QAAA,oBAAoB,GAAG,SAAS,CAAC;AA6C9C,wFAAwF;AACxF,SAAgB,uBAAuB,CAAC,MAAc;IACpD,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC;AAC9D,CAAC;AAED,wFAAwF;AACxF,SAAgB,sBAAsB,CAAC,MAAc;IACnD,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,sBAAsB,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,SAAgB,eAAe,CAC7B,UAAkB,EAClB,MAA4D;IAE5D,6EAA6E;IAC7E,iFAAiF;IACjF,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3C,MAAM,KAAK,GACT,OAAO,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;QACvC,WAAW,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;IACpD,OAAO,GAAG,IAAI,GAAG,GAAG,GAAG,KAAK,EAAE,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,SAAgB,yBAAyB,CAAC,cAAsB;IAC9D,OAAO,2BAA2B,cAAc,EAAE,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,IAAa;IAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,CAAC,CAAC,MAAM,KAAK,8BAAsB;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC;AAED,wEAAwE;AACxE,SAAgB,yBAAyB,CACvC,KAAc;IAEd,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,OAA8C,CAAC;IACjE,OAAO,CACL,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QAChC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAClC,CAAC;AACJ,CAAC;AAOD;;;;;GAKG;AACI,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,OAA+B,EAC/B,OAAoB,EAAE;IAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,IAAA,mBAAY,GAAE,CAAC;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,QAA2B,CAAC;IAChC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,uBAAuB,CAAC,MAAM,CAAC,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAE9B,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,KAAa,EACb,OAAoB,EAAE;IAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,IAAA,mBAAY,GAAE,CAAC;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE;YAC5C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;SACjD,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;AACH,CAAC"}

package/dist/env.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The **runtime probes** every capture SDK shares (ADR-0028): a high-res clock and
+ * the three byte-measuring helpers, written against `globalThis` alone so one
+ * implementation serves the browser, React Native, and Node.
+ *
+ * Each probe reads its global defensively — `performance`, `TextEncoder`, `Blob`
+ * and `ArrayBuffer` are all optional here — and falls back rather than throwing, so
+ * a runtime missing one of them degrades to a coarser measurement instead of
+ * breaking capture. Nothing in this module reads a body's *content*: a size is
+ * taken only when it is trivially known (spec #122 §D).
+ */
+/**
+ * A high-res monotonic timestamp: `performance.now()` where the runtime offers it
+ * (browsers and React Native both do), else `Date.now()`. Used to order trace
+ * entries across streams and to measure request durations as a delta.
+ */
+export declare function nowMono(): number;
+/**
+ * A string's UTF-8 byte length, measured with `TextEncoder` when available and
+ * falling back to the UTF-16 code-unit count otherwise. Never throws — the
+ * fallback is an approximation, not an error.
+ */
+export declare function utf8ByteLength(value: string): number;
+/**
+ * The serialized UTF-8 byte length of a value; `Infinity` when it cannot be
+ * serialized at all. The cap helpers use it to bound what a single entry may
+ * carry, so an unserializable value is treated as over budget rather than shipped.
+ */
+export declare function serializedBytes(value: unknown): number;
+/**
+ * The trivially-known byte size of a request body (spec #122 §D) — a string's
+ * UTF-8 length, a `Blob`'s `.size`, or an `ArrayBuffer`/typed-array `.byteLength`.
+ * Anything that would require **reading** the body (a `ReadableStream`, `FormData`,
+ * a `Request` with a stream body) returns `undefined` — the "never read the body"
+ * line holds.
+ */
+export declare function trivialBodySize(body: unknown): number | undefined;

package/dist/env.js

@@ -0,0 +1,83 @@
+"use strict";
+/**
+ * The **runtime probes** every capture SDK shares (ADR-0028): a high-res clock and
+ * the three byte-measuring helpers, written against `globalThis` alone so one
+ * implementation serves the browser, React Native, and Node.
+ *
+ * Each probe reads its global defensively — `performance`, `TextEncoder`, `Blob`
+ * and `ArrayBuffer` are all optional here — and falls back rather than throwing, so
+ * a runtime missing one of them degrades to a coarser measurement instead of
+ * breaking capture. Nothing in this module reads a body's *content*: a size is
+ * taken only when it is trivially known (spec #122 §D).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nowMono = nowMono;
+exports.utf8ByteLength = utf8ByteLength;
+exports.serializedBytes = serializedBytes;
+exports.trivialBodySize = trivialBodySize;
+/**
+ * A high-res monotonic timestamp: `performance.now()` where the runtime offers it
+ * (browsers and React Native both do), else `Date.now()`. Used to order trace
+ * entries across streams and to measure request durations as a delta.
+ */
+function nowMono() {
+    const perf = globalThis.performance;
+    return perf && typeof perf.now === "function" ? perf.now() : Date.now();
+}
+/** The `TextEncoder` constructor, when the runtime provides one. */
+function textEncoder() {
+    return globalThis.TextEncoder;
+}
+/**
+ * A string's UTF-8 byte length, measured with `TextEncoder` when available and
+ * falling back to the UTF-16 code-unit count otherwise. Never throws — the
+ * fallback is an approximation, not an error.
+ */
+function utf8ByteLength(value) {
+    try {
+        const Encoder = textEncoder();
+        return Encoder ? new Encoder().encode(value).length : value.length;
+    }
+    catch {
+        return value.length;
+    }
+}
+/**
+ * The serialized UTF-8 byte length of a value; `Infinity` when it cannot be
+ * serialized at all. The cap helpers use it to bound what a single entry may
+ * carry, so an unserializable value is treated as over budget rather than shipped.
+ */
+function serializedBytes(value) {
+    try {
+        const json = JSON.stringify(value) ?? "";
+        return utf8ByteLength(json);
+    }
+    catch {
+        return Number.POSITIVE_INFINITY;
+    }
+}
+/**
+ * The trivially-known byte size of a request body (spec #122 §D) — a string's
+ * UTF-8 length, a `Blob`'s `.size`, or an `ArrayBuffer`/typed-array `.byteLength`.
+ * Anything that would require **reading** the body (a `ReadableStream`, `FormData`,
+ * a `Request` with a stream body) returns `undefined` — the "never read the body"
+ * line holds.
+ */
+function trivialBodySize(body) {
+    if (typeof body === "string")
+        return utf8ByteLength(body);
+    // `Blob` is optional here (the core compiles without the DOM lib) and its real
+    // constructor takes arguments, so the probe is read through `unknown` and only
+    // ever used as an `instanceof` right-hand side.
+    const BlobCtor = globalThis.Blob;
+    if (BlobCtor && body instanceof BlobCtor)
+        return body.size;
+    if (typeof ArrayBuffer !== "undefined") {
+        if (body instanceof ArrayBuffer)
+            return body.byteLength;
+        if (ArrayBuffer.isView(body))
+            return body.byteLength;
+    }
+    return undefined;
+}
+//# sourceMappingURL=env.js.map

package/dist/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AAOH,0BAGC;AAkBD,wCAOC;AAOD,0CAOC;AASD,0CAgBC;AAxED;;;;GAIG;AACH,SAAgB,OAAO;IACrB,MAAM,IAAI,GAAI,UAAuD,CAAC,WAAW,CAAC;IAClF,OAAO,IAAI,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;AAC1E,CAAC;AAED,oEAAoE;AACpE,SAAS,WAAW;IAGlB,OACE,UAGD,CAAC,WAAW,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,KAAa;IAC1C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,KAAc;IAC5C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACzC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,iBAAiB,CAAC;IAClC,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,eAAe,CAAC,IAAa;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IAC1D,+EAA+E;IAC/E,+EAA+E;IAC/E,gDAAgD;IAChD,MAAM,QAAQ,GACZ,UAGD,CAAC,IAAI,CAAC;IACP,IAAI,QAAQ,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IAC3D,IAAI,OAAO,WAAW,KAAK,WAAW,EAAE,CAAC;QACvC,IAAI,IAAI,YAAY,WAAW;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QACxD,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAQ,IAAwB,CAAC,UAAU,CAAC;IAC5E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/fingerprint.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The cross-surface error **fingerprint** (research `sentry-error-capture-findings.md`
+ * §7.2; ADR-0027/0028) — the pure, runtime-agnostic key by which the same logical
+ * error groups together, computed the **same way** on every SDK.
+ *
+ * `computeFingerprint(type, value, stack)` hashes the error type, a normalised
+ * message, and a compact top-frames signature. It only has to be stable and
+ * well-distributed (the client key is a flood guard; the server does canonical
+ * cross-session clustering), so a dependency-free FNV-1a hash is right. The
+ * `normalize` shape and the frame limit are **starting points** from research
+ * (ticket #92), tunable — never a frozen magic set.
+ */
+/**
+ * Collapse the volatile parts of an error message so a changing string doesn't
+ * split one bug: UUIDs, URLs, `0x…` and long hex runs, and long digit runs are
+ * replaced with stable placeholders. Short numbers and stable text are kept so
+ * genuinely distinct bugs stay distinct. A small, dependency-free regex set —
+ * tunable per ticket #92, never a frozen magic set.
+ */
+export declare function normalize(value: string): string;
+/**
+ * A dependency-free FNV-1a hash rendered in base-36. It only has to be stable and
+ * well-distributed within one session (the client key is a flood guard; the server
+ * does canonical cross-session clustering), so a non-cryptographic hash is right.
+ */
+export declare function hashString(input: string): string;
+/**
+ * Extract a compact, stable signature of the top in-app frames of a stack: up to
+ * {@link FINGERPRINT_FRAME_LIMIT} frames as `function@basename:line:col`, origin
+ * and cache-busting query stripped so a per-deploy asset hash doesn't matter within
+ * a session. Returns `""` when there is no usable stack (message-only fallback).
+ */
+export declare function extractTopFrames(stack: string | undefined, limit?: number): string;
+/**
+ * The per-session fingerprint (research §7.2):
+ * `hash(errorType + "|" + normalize(value) + "|" + topFrames)`. Stack frames
+ * dominate when present; otherwise it falls back to type + normalized value.
+ */
+export declare function computeFingerprint(type: string, value: string, stack?: string): string;

package/dist/fingerprint.js

@@ -16,6 +16,7 @@ exports.normalize = normalize;
 exports.hashString = hashString;
 exports.extractTopFrames = extractTopFrames;
 exports.computeFingerprint = computeFingerprint;
+const stack_1 = require("./stack");
 const UUID_RE = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi;
 const URL_RE = /\bhttps?:\/\/[^\s"')]+/gi;
 const HEX_0X_RE = /\b0x[0-9a-f]+\b/gi;
@@ -60,22 +61,16 @@ function compactLocation(location) {
     const lastSlash = noQuery.lastIndexOf("/");
     return lastSlash >= 0 ? noQuery.slice(lastSlash + 1) : noQuery;
 }
-/** Parse one stack line into a compact `function@basename:line:col` frame id. */
+/**
+ * Reduce one stack line to a compact `function@basename:line:col` frame id, using
+ * the core's single frame tokenizer (`stack.ts`) so the fingerprint sees exactly
+ * the frames every other stack reader does.
+ */
 function parseFrame(line) {
-    // V8: "at fn (loc)"  |  "at loc"
-    const v8Named = line.match(/^at\s+(.+?)\s+\((.+)\)$/);
-    if (v8Named)
-        return `${v8Named[1] ?? ""}@${compactLocation(v8Named[2] ?? "")}`;
-    const v8Bare = line.match(/^at\s+(.+)$/);
-    if (v8Bare)
-        return `@${compactLocation(v8Bare[1] ?? "")}`;
-    // Firefox / Safari: "fn@loc"  |  "@loc"
-    const at = line.indexOf("@");
-    if (at >= 0) {
-        const fn = line.slice(0, at);
-        return `${fn}@${compactLocation(line.slice(at + 1))}`;
-    }
-    return null;
+    const tokens = (0, stack_1.parseStackLine)(line);
+    if (!tokens)
+        return null;
+    return `${tokens.fn ?? ""}@${compactLocation(tokens.location)}`;
 }
 /**
  * Extract a compact, stable signature of the top in-app frames of a stack: up to

package/dist/fingerprint.js.map

@@ -1 +1 @@
-{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAmBH,8BASC;AAOD,gCAOC;AA+BD,4CAcC;AAOD,gDAMC;AAlGD,MAAM,OAAO,GACX,gEAAgE,CAAC;AACnE,MAAM,MAAM,GAAG,0BAA0B,CAAC;AAC1C,MAAM,SAAS,GAAG,mBAAmB,CAAC;AACtC,MAAM,UAAU,GAAG,oBAAoB,CAAC;AACxC,MAAM,YAAY,GAAG,SAAS,CAAC;AAE/B,sEAAsE;AACtE,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAElC;;;;;;GAMG;AACH,SAAgB,SAAS,CAAC,KAAa;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/D,OAAO,KAAK;SACT,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC;SAC1B,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC;SAC5B,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC;SAC5B,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,SAAgB,UAAU,CAAC,KAAa;IACtC,IAAI,CAAC,GAAG,UAAU,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,iFAAiF;AACjF,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACjE,CAAC;AAED,iFAAiF;AACjF,SAAS,UAAU,CAAC,IAAY;IAC9B,iCAAiC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACtD,IAAI,OAAO;QAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;IAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACzC,IAAI,MAAM;QAAE,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;IAC1D,wCAAwC;IACxC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACZ,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAgB,gBAAgB,CAC9B,KAAyB,EACzB,KAAK,GAAG,uBAAuB;IAE/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACrC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,IAAI,MAAM,CAAC,MAAM,IAAI,KAAK;gBAAE,MAAM;QACpC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB,CAChC,IAAY,EACZ,KAAa,EACb,KAAc;IAEd,OAAO,UAAU,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAqBH,8BASC;AAOD,gCAOC;AA0BD,4CAcC;AAOD,gDAMC;AA/FD,mCAAyC;AAEzC,MAAM,OAAO,GACX,gEAAgE,CAAC;AACnE,MAAM,MAAM,GAAG,0BAA0B,CAAC;AAC1C,MAAM,SAAS,GAAG,mBAAmB,CAAC;AACtC,MAAM,UAAU,GAAG,oBAAoB,CAAC;AACxC,MAAM,YAAY,GAAG,SAAS,CAAC;AAE/B,sEAAsE;AACtE,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAElC;;;;;;GAMG;AACH,SAAgB,SAAS,CAAC,KAAa;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/D,OAAO,KAAK;SACT,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC;SAC1B,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC;SAC5B,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC;SAC5B,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,SAAgB,UAAU,CAAC,KAAa;IACtC,IAAI,CAAC,GAAG,UAAU,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,iFAAiF;AACjF,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,MAAM,GAAG,IAAA,sBAAc,EAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,gBAAgB,CAC9B,KAAyB,EACzB,KAAK,GAAG,uBAAuB;IAE/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACrC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,IAAI,MAAM,CAAC,MAAM,IAAI,KAAK;gBAAE,MAAM;QACpC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB,CAChC,IAAY,EACZ,KAAa,EACb,KAAc;IAEd,OAAO,UAAU,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC9E,CAAC"}

package/dist/http.d.ts

@@ -0,0 +1,51 @@
+/**
+ * The **structural HTTP surface** every Fixback SDK talks to ingest through
+ * (ADR-0028) — one description of the `fetch` slice the transports use, shared by
+ * the browser, Expo, and Node SDKs.
+ *
+ * Described structurally rather than against the DOM lib: the core typechecks with
+ * `types: []` and no `lib.dom`, React Native is not a browser, and Node's `fetch`
+ * is a global with its own types. Every runtime satisfies these shapes at runtime,
+ * and tests inject plain fakes through the same seams. Only what the SDKs actually
+ * read is described — status, `ok`, one header at a time, and an optional JSON body.
+ */
+/**
+ * The response slice the transports read: the outcome, the status, the header bag
+ * (for `Retry-After` / `content-length`), and — for the endpoints that answer with
+ * JSON — the parsed body. `json()` is **optional**: the batched Node transport
+ * never reads a body, so a fake need not provide one.
+ */
+export interface FetchResponseLike {
+    readonly ok: boolean;
+    readonly status: number;
+    readonly headers?: {
+        get(name: string): string | null;
+    } | null;
+    json?(): Promise<unknown>;
+}
+/** The request init the SDKs send — a method, plain headers, and a body. */
+export interface FetchRequestInit {
+    readonly method: string;
+    readonly headers?: Record<string, string>;
+    /**
+     * The request body: a JSON string, or a runtime-specific multipart form (a
+     * browser `FormData`, React Native's `FormData`). Deliberately `unknown` — the
+     * core never inspects it, it only hands it to the runtime's `fetch`.
+     */
+    readonly body?: unknown;
+}
+/** A `fetch`-shaped function, injectable for tests. */
+export type FetchLike = (url: string, init: FetchRequestInit) => Promise<FetchResponseLike>;
+/**
+ * The runtime's global `fetch` adapted to {@link FetchLike}, or `undefined` when
+ * the runtime has none. Bound to `globalThis` so a `this`-less call never throws
+ * an "illegal invocation", and adapted through one cast here so no call site has
+ * to reconcile the runtime's own `fetch` types with the structural slice.
+ */
+export declare function resolveFetch(): FetchLike | undefined;
+/**
+ * Read one response header defensively — `null` when the response carries no
+ * header bag, the header is absent, or the getter throws (an opaque cross-origin
+ * response). A transport must never fail because a header could not be read.
+ */
+export declare function safeHeader(response: FetchResponseLike, name: string): string | null;

package/dist/http.js

@@ -0,0 +1,42 @@
+"use strict";
+/**
+ * The **structural HTTP surface** every Fixback SDK talks to ingest through
+ * (ADR-0028) — one description of the `fetch` slice the transports use, shared by
+ * the browser, Expo, and Node SDKs.
+ *
+ * Described structurally rather than against the DOM lib: the core typechecks with
+ * `types: []` and no `lib.dom`, React Native is not a browser, and Node's `fetch`
+ * is a global with its own types. Every runtime satisfies these shapes at runtime,
+ * and tests inject plain fakes through the same seams. Only what the SDKs actually
+ * read is described — status, `ok`, one header at a time, and an optional JSON body.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveFetch = resolveFetch;
+exports.safeHeader = safeHeader;
+/**
+ * The runtime's global `fetch` adapted to {@link FetchLike}, or `undefined` when
+ * the runtime has none. Bound to `globalThis` so a `this`-less call never throws
+ * an "illegal invocation", and adapted through one cast here so no call site has
+ * to reconcile the runtime's own `fetch` types with the structural slice.
+ */
+function resolveFetch() {
+    const g = globalThis;
+    if (typeof g.fetch !== "function")
+        return undefined;
+    const bound = g.fetch.bind(globalThis);
+    return (url, init) => bound(url, init);
+}
+/**
+ * Read one response header defensively — `null` when the response carries no
+ * header bag, the header is absent, or the getter throws (an opaque cross-origin
+ * response). A transport must never fail because a header could not be read.
+ */
+function safeHeader(response, name) {
+    try {
+        return response.headers?.get?.(name) ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AAuCH,oCAOC;AAOD,gCAMC;AA1BD;;;;;GAKG;AACH,SAAgB,YAAY;IAC1B,MAAM,CAAC,GAAG,UAET,CAAC;IACF,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAA+B,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,SAAgB,UAAU,CAAC,QAA2B,EAAE,IAAY;IAClE,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,28 @@
+/**
+ * `@fixback/sdk-core` — the runtime-agnostic core shared by the Fixback capture
+ * SDKs (ADR-0028). Fingerprinting, stack parsing, scrubbing, backoff, the trace
+ * buffer and its crumb builders, the automatic-capture state machine, the ingest
+ * boot contract, and the shared wire shapes — with no DOM, no Node built-ins, and
+ * no rrweb. Every runtime touchpoint is either injected or probed off `globalThis`.
+ */
+export { SDK_CORE_VERSION } from "./version";
+export { computeFingerprint, extractTopFrames, hashString, normalize } from "./fingerprint";
+export { extractStructuredFrames, parseFrameLocation, parseStackLine, type StackFrameTokens, } from "./stack";
+export { applyDefaultScrub, type BeforeSend, type BeforeSendOptions, redactPii, runBeforeSend, scrubUrl, } from "./scrub";
+export { AutoReportBackoff, type Clock, DEFAULT_RETRY_AFTER_SECONDS, parseRetryAfter, } from "./backoff";
+export { nowMono, serializedBytes, trivialBodySize, utf8ByteLength } from "./env";
+export { type FetchLike, type FetchRequestInit, type FetchResponseLike, resolveFetch, safeHeader, } from "./http";
+export { type BootAnswer, type BootDeps, bootEndpoint, type BootRequest, type CaptureConfig, compactIdentity, type ConnectedAccount, feedbackEndpoint, type IdentityInputs, isBootAnswer, isFixbackApiRequest, type ProjectGate, type ReporterTier, requestBoot, } from "./boot";
+export { buildConnectUrl, CONNECT_MESSAGE_SOURCE, CONNECT_RETURN_PARAM, type ConnectDeps, type ConnectExchangeRequest, type ConnectExchangeResponse, type ConnectMessage, connectExchangeEndpoint, connectSignOutEndpoint, exchangeConnectCode, isConnectExchangeResponse, parseConnectMessage, type ReporterIdentity, reporterSessionStorageKey, revokeReporterSession, } from "./connect";
+export { ANONYMOUS_ID_STORAGE_KEY, generateAnonymousId } from "./anonymous-id";
+export { normaliseRelease, RELEASE_MAX_LENGTH } from "./release";
+export { type CaptureToggles, type CommonCaptureInitOptions, type CommonInitOptions, DEFAULT_API_URL, } from "./options";
+export { type AutoCaptureCore, type AutoCaptureCoreConfig, type AutoReport, asString, CAUSED_BY_LIMIT, createAutoCapture, DEFAULT_BURST_CAPACITY, DEFAULT_BURST_REFILL_MS, DEFAULT_MAX_DISTINCT_AUTO, type ExtractedError, precedingIds, TokenBucket, type TokenBucketOptions, } from "./auto-capture";
+export { type BeforeBreadcrumb, type BreadcrumbBuffer, type BreadcrumbBufferConfig, capturesSource, createBreadcrumbBuffer, createIdFactory, DEFAULT_CONSOLE_LEVELS, DEFAULT_MAX_AGE_MS, DEFAULT_STREAM_BUDGETS, isPinnedConsoleLevel, normalizeBudget, PINNED_CONSOLE_LEVELS, SOURCE_CAPTURE_LEVELS, streamOf, type TraceStream, trimConsoleStream, } from "./trace/buffer";
+export { capConsoleArgs, capLength, describeErrorValue, joinArgs, MAX_ARG_DEPTH, MAX_ARG_ITEMS, MAX_ARG_STRING_LENGTH, MAX_CONSOLE_ARGS_BYTES, MAX_MESSAGE_LENGTH, safeCloneValue, stringifyArg, toConsoleArg, } from "./trace/console-args";
+export { consoleCrumb, contentTypeOf, describeError, errorCrumb, fetchCrumb, MAX_URL_LENGTH, navigationCrumb, type NetworkCrumbInput, networkCrumb, outcomeFromStatus, parseContentLength, xhrCrumb, } from "./trace/crumbs";
+export { CONSOLE_SOURCE_SKIP_FRAMES, parseStackFrame, sourceFromStack, } from "./trace/source";
+export { type ConsoleLike, instrumentConsole, type Teardown } from "./trace/console";
+export type { CaptureEnvironment, CapturedFrame, FeedbackSource, Platform, ReportContent, } from "./wire";
+export type { Annotation, ArrowMark, BoxMark, DrawTool, ElementRect, Mark, PenMark, Point, Rect, SelectedElement, TextMark, } from "./annotation";
+export type { Breadcrumb, BreadcrumbCategory, BreadcrumbData, BreadcrumbLevel, ConsoleArg, ConsoleArgType, NetworkApi, NetworkOutcome, SourceLocation, } from "./breadcrumb";