@fixback/sdk-core 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Fixback
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,19 @@
+# @fixback/sdk-core
+
+The small, runtime-agnostic core shared by the Fixback capture SDKs
+(`@fixback/sdk` today; `@fixback/node` next). It holds the **pure** capture logic
+so every surface computes it the same way (ADR-0028):
+
+- **Fingerprinting** — `computeFingerprint` and its `normalize` / `extractTopFrames`
+  helpers, so the same logical error groups identically across surfaces
+  (ADR-0027).
+- **Scrubbing** — `scrubUrl`, `redactPii`, and the `runBeforeSend` choke point.
+- **Backoff** — `AutoReportBackoff` + `parseRetryAfter`, honouring ingest's
+  `429` / `Retry-After` backpressure.
+- **Wire shapes** — `ReportContent`, `CapturedFrame`, the `Annotation` /
+  `Breadcrumb` value types, and the provenance vocabulary (`FeedbackSource`,
+  `Platform`).
+
+It is deliberately **runtime-agnostic**: no DOM, no Node built-ins, no rrweb —
+those live in the consuming SDKs. This is an internal implementation package for
+the Fixback SDK family, not a public API.

package/dist/annotation.js

@@ -0,0 +1,18 @@
+"use strict";
+/**
+ * The Annotation & vector-marks **wire types** (spec 0003 §B/§D) — the shared,
+ * runtime-agnostic shapes that ride on a report's content (ADR-0028).
+ *
+ * An Annotation is everything a Reporter marked on the page, as three
+ * **composable, optional** layers over one full masked screenshot: the picked
+ * `element` (from the element-picker), a drag-captured `region`, and vector
+ * `marks` — arrow / box / pen / text. Marks live in the **screenshot's coordinate
+ * space**, never baked into the PNG: the dashboard composites them at view time.
+ *
+ * This module carries only the pure value types; the SDK's geometry and assembly
+ * helpers (`normalizeRect`, `arrowHeadPoints`, `assembleAnnotation`) live in the
+ * consuming SDK. Keep these in lock-step with the server's ingest contract
+ * (spec §D/§H).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=annotation.js.map

package/dist/annotation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"annotation.js","sourceRoot":"","sources":["../src/annotation.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG"}

package/dist/backoff.js

@@ -0,0 +1,79 @@
+"use strict";
+/**
+ * Client-side backpressure for **automatic** error reports (spec 0003 §E/§H,
+ * ticket #89) — the pure, runtime-agnostic backoff every SDK shares (ADR-0028).
+ * When ingest sheds `source: error` load it answers `429` with a `Retry-After`;
+ * the SDK honours it by holding a pause window during which further automatic
+ * reports are dropped without touching the network. **Manual** reports — a human
+ * clicking Send — never consult this gate.
+ *
+ * This is the transport's counterpart to the server's per-Project token bucket
+ * (`apps/api/src/ingest/auto-report-rate-limiter.ts`): one shared window per page,
+ * so a 429 from one auto-report shed applies to the auto-reports that follow it.
+ * The clock is injectable so the window is unit-tested deterministically, never on
+ * wall time — mirroring the server limiter's `Clock`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AutoReportBackoff = exports.DEFAULT_RETRY_AFTER_SECONDS = void 0;
+exports.parseRetryAfter = parseRetryAfter;
+/** The hold window applied when a `429` carries no usable `Retry-After` (spec §E). */
+exports.DEFAULT_RETRY_AFTER_SECONDS = 60;
+/**
+ * Parse a `Retry-After` header into whole seconds to hold for. Handles both HTTP
+ * forms — a delta-seconds integer and an HTTP-date (measured from `now`, rounded up
+ * and clamped at zero) — and falls back to {@link DEFAULT_RETRY_AFTER_SECONDS} when
+ * the header is absent, blank, or unparseable. Ingest sends the delta-seconds form;
+ * the date form is handled for spec-completeness.
+ */
+function parseRetryAfter(header, now) {
+    if (header == null)
+        return exports.DEFAULT_RETRY_AFTER_SECONDS;
+    const value = header.trim();
+    if (value === "")
+        return exports.DEFAULT_RETRY_AFTER_SECONDS;
+    if (/^\d+$/.test(value)) {
+        return Number(value);
+    }
+    const when = Date.parse(value);
+    if (!Number.isNaN(when)) {
+        return Math.max(0, Math.ceil((when - now) / 1000));
+    }
+    return exports.DEFAULT_RETRY_AFTER_SECONDS;
+}
+/**
+ * A single pause window for automatic (`source: error`) reports. `hold` opens (or
+ * extends) it from a `429`'s `Retry-After`; `isPaused` reports whether it is still
+ * open. The default instance in the SDK's transport is shared across a page's
+ * reports so the hold persists across successive automatic submissions.
+ */
+class AutoReportBackoff {
+    now;
+    /** Epoch ms until which automatic reports are held; `0` when clear. */
+    pausedUntil = 0;
+    constructor(now = Date.now) {
+        this.now = now;
+    }
+    /** Is the automatic-report pause window currently open? */
+    isPaused() {
+        return this.now() < this.pausedUntil;
+    }
+    /** Whole seconds remaining in the pause window (`0` when clear). */
+    retryAfterSeconds() {
+        return Math.max(0, Math.ceil((this.pausedUntil - this.now()) / 1000));
+    }
+    /**
+     * Open (or extend) the window from a `429`'s `Retry-After` value, returning the
+     * seconds it will hold for. The window only ever grows — a shorter later hold
+     * never clips a longer one already in effect.
+     */
+    hold(retryAfterHeader) {
+        const now = this.now();
+        const seconds = parseRetryAfter(retryAfterHeader, now);
+        const until = now + seconds * 1000;
+        if (until > this.pausedUntil)
+            this.pausedUntil = until;
+        return seconds;
+    }
+}
+exports.AutoReportBackoff = AutoReportBackoff;
+//# sourceMappingURL=backoff.js.map

package/dist/backoff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backoff.js","sourceRoot":"","sources":["../src/backoff.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;AAeH,0CAkBC;AA5BD,sFAAsF;AACzE,QAAA,2BAA2B,GAAG,EAAE,CAAC;AAE9C;;;;;;GAMG;AACH,SAAgB,eAAe,CAC7B,MAAiC,EACjC,GAAW;IAEX,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,mCAA2B,CAAC;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,mCAA2B,CAAC;IAErD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,mCAA2B,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAa,iBAAiB;IAIC;IAH7B,uEAAuE;IAC/D,WAAW,GAAG,CAAC,CAAC;IAExB,YAA6B,MAAa,IAAI,CAAC,GAAG;QAArB,QAAG,GAAH,GAAG,CAAkB;IAAG,CAAC;IAEtD,2DAA2D;IAC3D,QAAQ;QACN,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC;IACvC,CAAC;IAED,oEAAoE;IACpE,iBAAiB;QACf,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACxE,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,gBAA2C;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,eAAe,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,GAAG,GAAG,OAAO,GAAG,IAAI,CAAC;QACnC,IAAI,KAAK,GAAG,IAAI,CAAC,WAAW;YAAE,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACvD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AA5BD,8CA4BC"}

package/dist/breadcrumb.js

@@ -0,0 +1,15 @@
+"use strict";
+/**
+ * The trace **breadcrumb wire types** (spec 0003 §C, spec #122) — the shared,
+ * runtime-agnostic shapes for one entry of a captured trace stream (ADR-0028).
+ *
+ * A breadcrumb records recent activity — console, navigation, network metadata,
+ * masked user actions, and the failing error — that rides on a report as
+ * Evidence. This module carries only the value types; the SDK's ring buffer and
+ * DOM/Node instrumentation that produce them live in the consuming SDK.
+ * Everything private is kept out **at the source** by that instrumentation:
+ * `ui.input` records that an input changed, never its value; network crumbs carry
+ * method + URL + status only, never bodies.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=breadcrumb.js.map

package/dist/breadcrumb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"breadcrumb.js","sourceRoot":"","sources":["../src/breadcrumb.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG"}

package/dist/fingerprint.js

@@ -0,0 +1,108 @@
+"use strict";
+/**
+ * The cross-surface error **fingerprint** (research `sentry-error-capture-findings.md`
+ * §7.2; ADR-0027/0028) — the pure, runtime-agnostic key by which the same logical
+ * error groups together, computed the **same way** on every SDK.
+ *
+ * `computeFingerprint(type, value, stack)` hashes the error type, a normalised
+ * message, and a compact top-frames signature. It only has to be stable and
+ * well-distributed (the client key is a flood guard; the server does canonical
+ * cross-session clustering), so a dependency-free FNV-1a hash is right. The
+ * `normalize` shape and the frame limit are **starting points** from research
+ * (ticket #92), tunable — never a frozen magic set.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalize = normalize;
+exports.hashString = hashString;
+exports.extractTopFrames = extractTopFrames;
+exports.computeFingerprint = computeFingerprint;
+const UUID_RE = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi;
+const URL_RE = /\bhttps?:\/\/[^\s"')]+/gi;
+const HEX_0X_RE = /\b0x[0-9a-f]+\b/gi;
+const HEX_RUN_RE = /\b[0-9a-f]{8,}\b/gi;
+const DIGIT_RUN_RE = /\d{4,}/g;
+/** How many top stack frames feed the fingerprint (research §7.2). */
+const FINGERPRINT_FRAME_LIMIT = 5;
+/**
+ * Collapse the volatile parts of an error message so a changing string doesn't
+ * split one bug: UUIDs, URLs, `0x…` and long hex runs, and long digit runs are
+ * replaced with stable placeholders. Short numbers and stable text are kept so
+ * genuinely distinct bugs stay distinct. A small, dependency-free regex set —
+ * tunable per ticket #92, never a frozen magic set.
+ */
+function normalize(value) {
+    if (typeof value !== "string" || value.length === 0)
+        return "";
+    return value
+        .replace(UUID_RE, "<uuid>")
+        .replace(URL_RE, "<url>")
+        .replace(HEX_0X_RE, "<hex>")
+        .replace(HEX_RUN_RE, "<hex>")
+        .replace(DIGIT_RUN_RE, "<n>")
+        .trim();
+}
+/**
+ * A dependency-free FNV-1a hash rendered in base-36. It only has to be stable and
+ * well-distributed within one session (the client key is a flood guard; the server
+ * does canonical cross-session clustering), so a non-cryptographic hash is right.
+ */
+function hashString(input) {
+    let h = 0x811c9dc5;
+    for (let i = 0; i < input.length; i++) {
+        h ^= input.charCodeAt(i);
+        h = Math.imul(h, 0x01000193);
+    }
+    return (h >>> 0).toString(36);
+}
+/** Reduce a frame location to `basename:line:col`, dropping origin and query. */
+function compactLocation(location) {
+    const noQuery = location.replace(/\?[^:]*/, "");
+    const lastSlash = noQuery.lastIndexOf("/");
+    return lastSlash >= 0 ? noQuery.slice(lastSlash + 1) : noQuery;
+}
+/** Parse one stack line into a compact `function@basename:line:col` frame id. */
+function parseFrame(line) {
+    // V8: "at fn (loc)"  |  "at loc"
+    const v8Named = line.match(/^at\s+(.+?)\s+\((.+)\)$/);
+    if (v8Named)
+        return `${v8Named[1] ?? ""}@${compactLocation(v8Named[2] ?? "")}`;
+    const v8Bare = line.match(/^at\s+(.+)$/);
+    if (v8Bare)
+        return `@${compactLocation(v8Bare[1] ?? "")}`;
+    // Firefox / Safari: "fn@loc"  |  "@loc"
+    const at = line.indexOf("@");
+    if (at >= 0) {
+        const fn = line.slice(0, at);
+        return `${fn}@${compactLocation(line.slice(at + 1))}`;
+    }
+    return null;
+}
+/**
+ * Extract a compact, stable signature of the top in-app frames of a stack: up to
+ * {@link FINGERPRINT_FRAME_LIMIT} frames as `function@basename:line:col`, origin
+ * and cache-busting query stripped so a per-deploy asset hash doesn't matter within
+ * a session. Returns `""` when there is no usable stack (message-only fallback).
+ */
+function extractTopFrames(stack, limit = FINGERPRINT_FRAME_LIMIT) {
+    if (typeof stack !== "string" || stack.length === 0)
+        return "";
+    const frames = [];
+    for (const raw of stack.split("\n")) {
+        const frame = parseFrame(raw.trim());
+        if (frame) {
+            frames.push(frame);
+            if (frames.length >= limit)
+                break;
+        }
+    }
+    return frames.join(" < ");
+}
+/**
+ * The per-session fingerprint (research §7.2):
+ * `hash(errorType + "|" + normalize(value) + "|" + topFrames)`. Stack frames
+ * dominate when present; otherwise it falls back to type + normalized value.
+ */
+function computeFingerprint(type, value, stack) {
+    return hashString(`${type}|${normalize(value)}|${extractTopFrames(stack)}`);
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAmBH,8BASC;AAOD,gCAOC;AA+BD,4CAcC;AAOD,gDAMC;AAlGD,MAAM,OAAO,GACX,gEAAgE,CAAC;AACnE,MAAM,MAAM,GAAG,0BAA0B,CAAC;AAC1C,MAAM,SAAS,GAAG,mBAAmB,CAAC;AACtC,MAAM,UAAU,GAAG,oBAAoB,CAAC;AACxC,MAAM,YAAY,GAAG,SAAS,CAAC;AAE/B,sEAAsE;AACtE,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAElC;;;;;;GAMG;AACH,SAAgB,SAAS,CAAC,KAAa;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/D,OAAO,KAAK;SACT,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC;SAC1B,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC;SAC5B,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC;SAC5B,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,SAAgB,UAAU,CAAC,KAAa;IACtC,IAAI,CAAC,GAAG,UAAU,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,iFAAiF;AACjF,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACjE,CAAC;AAED,iFAAiF;AACjF,SAAS,UAAU,CAAC,IAAY;IAC9B,iCAAiC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACtD,IAAI,OAAO;QAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;IAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACzC,IAAI,MAAM;QAAE,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;IAC1D,wCAAwC;IACxC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACZ,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAgB,gBAAgB,CAC9B,KAAyB,EACzB,KAAK,GAAG,uBAAuB;IAE/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACrC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,IAAI,MAAM,CAAC,MAAM,IAAI,KAAK;gBAAE,MAAM;QACpC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB,CAChC,IAAY,EACZ,KAAa,EACb,KAAc;IAEd,OAAO,UAAU,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC9E,CAAC"}

package/dist/index.js

@@ -0,0 +1,26 @@
+"use strict";
+/**
+ * `@fixback/sdk-core` — the runtime-agnostic core shared by the Fixback capture
+ * SDKs (ADR-0028). Pure fingerprinting, scrubbing, and backoff logic plus the
+ * shared ingest wire shapes — no DOM, no Node built-ins, no rrweb.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseRetryAfter = exports.DEFAULT_RETRY_AFTER_SECONDS = exports.AutoReportBackoff = exports.scrubUrl = exports.runBeforeSend = exports.redactPii = exports.applyDefaultScrub = exports.normalize = exports.hashString = exports.extractTopFrames = exports.computeFingerprint = void 0;
+// Fingerprint (ADR-0027) — the cross-surface grouping key.
+var fingerprint_1 = require("./fingerprint");
+Object.defineProperty(exports, "computeFingerprint", { enumerable: true, get: function () { return fingerprint_1.computeFingerprint; } });
+Object.defineProperty(exports, "extractTopFrames", { enumerable: true, get: function () { return fingerprint_1.extractTopFrames; } });
+Object.defineProperty(exports, "hashString", { enumerable: true, get: function () { return fingerprint_1.hashString; } });
+Object.defineProperty(exports, "normalize", { enumerable: true, get: function () { return fingerprint_1.normalize; } });
+// Scrub choke point (spec 0003 §C).
+var scrub_1 = require("./scrub");
+Object.defineProperty(exports, "applyDefaultScrub", { enumerable: true, get: function () { return scrub_1.applyDefaultScrub; } });
+Object.defineProperty(exports, "redactPii", { enumerable: true, get: function () { return scrub_1.redactPii; } });
+Object.defineProperty(exports, "runBeforeSend", { enumerable: true, get: function () { return scrub_1.runBeforeSend; } });
+Object.defineProperty(exports, "scrubUrl", { enumerable: true, get: function () { return scrub_1.scrubUrl; } });
+// Backoff (spec 0003 §E/§H) — honouring ingest's 429 / Retry-After.
+var backoff_1 = require("./backoff");
+Object.defineProperty(exports, "AutoReportBackoff", { enumerable: true, get: function () { return backoff_1.AutoReportBackoff; } });
+Object.defineProperty(exports, "DEFAULT_RETRY_AFTER_SECONDS", { enumerable: true, get: function () { return backoff_1.DEFAULT_RETRY_AFTER_SECONDS; } });
+Object.defineProperty(exports, "parseRetryAfter", { enumerable: true, get: function () { return backoff_1.parseRetryAfter; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,2DAA2D;AAC3D,6CAA4F;AAAnF,iHAAA,kBAAkB,OAAA;AAAE,+GAAA,gBAAgB,OAAA;AAAE,yGAAA,UAAU,OAAA;AAAE,wGAAA,SAAS,OAAA;AAEpE,oCAAoC;AACpC,iCAOiB;AANf,0GAAA,iBAAiB,OAAA;AAGjB,kGAAA,SAAS,OAAA;AACT,sGAAA,aAAa,OAAA;AACb,iGAAA,QAAQ,OAAA;AAGV,oEAAoE;AACpE,qCAKmB;AAJjB,4GAAA,iBAAiB,OAAA;AAEjB,sHAAA,2BAA2B,OAAA;AAC3B,0GAAA,eAAe,OAAA"}

package/dist/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/dist/scrub.js

@@ -0,0 +1,216 @@
+"use strict";
+/**
+ * The single client-side **scrub choke point** every report passes through
+ * before transport (spec 0003 §C; research `sentry-error-capture-findings.md`
+ * §7.4) — the SDK's `beforeSend` equivalent, shared runtime-agnostically across
+ * surfaces (ADR-0028).
+ *
+ * Masking is the SDK's job, done before anything leaves the process. The
+ * screenshot is masked at capture, and breadcrumbs never record a value or a
+ * body at the source; `runBeforeSend` is the **last** gate over the assembled
+ * report. Its default scrubbers are **on**: they strip credentials, query
+ * strings, and bearer tokens from URLs, and redact obvious PII (emails, long
+ * digit runs, bearer tokens) from crumb and error text. The result is then handed
+ * to an optional per-project hook that can mutate it further or drop the whole
+ * report by returning `null`.
+ *
+ * The hook is **synchronous and network-free** by contract, and both manual
+ * (overlay) and automatic (error-capture) reports run through the very same
+ * choke point. A project relaxes the defaults with `scrub: false`, or reshapes
+ * the draft in its own hook — never a silent raw send.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactPii = redactPii;
+exports.scrubUrl = scrubUrl;
+exports.applyDefaultScrub = applyDefaultScrub;
+exports.runBeforeSend = runBeforeSend;
+/** A digit run at least this long is treated as sensitive (phone, card, id). */
+const MIN_DIGIT_RUN = 7;
+const EMAIL_RE = /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/gi;
+const DIGIT_RUN_RE = new RegExp(`\\d{${MIN_DIGIT_RUN},}`, "g");
+const BEARER_RE = /\b(bearer|token)\s+[\w.\-~+/]+=*/gi;
+/** An http(s) URL embedded in free text (e.g. a console log line). */
+const URL_IN_TEXT_RE = /\bhttps?:\/\/[^\s"'<>]+/gi;
+/**
+ * Redact obvious PII from free text: email addresses, `Bearer <token>` /
+ * `token <value>` pairs, and long digit runs. Conservative by design — it keeps
+ * the shape of the message readable while removing the sensitive spans.
+ */
+function redactPii(text) {
+    if (typeof text !== "string" || text.length === 0)
+        return text;
+    return text
+        .replace(EMAIL_RE, "[redacted-email]")
+        .replace(BEARER_RE, (_match, keyword) => `${keyword} [redacted]`)
+        .replace(DIGIT_RUN_RE, "[redacted-number]");
+}
+/**
+ * Redact PII from the **path** portion of a URL (spec #122 §E, ticket #139):
+ * emails and long digit runs in path (or fragment-route) segments — a network
+ * list shows URLs prominently, so an identifier baked into a path
+ * (`/users/jane@acme.app`, `/card/4111111111111111`) must not leak. Deliberately
+ * narrower than {@link redactPii}: no bearer/token rule (URL credentials are
+ * already stripped by {@link scrubUrl}) and it is only ever applied to the
+ * post-authority remainder, so a host or port with digits is never touched.
+ */
+function redactPathPii(pathAndBeyond) {
+    return pathAndBeyond
+        .replace(EMAIL_RE, "[redacted-email]")
+        .replace(DIGIT_RUN_RE, "[redacted-number]");
+}
+/**
+ * Strip the sensitive parts of a URL: userinfo credentials
+ * (`scheme://user:pass@host`), the entire query string, a token-bearing
+ * fragment (one that carries `key=value`), and PII (emails, long digit runs) in
+ * the **path segments** (#139). Plain hash routes (`#/checkout`) are kept. Works
+ * on absolute and relative URLs alike, with no dependency and no throw. The host
+ * (authority) is never redacted — only the path and any surviving fragment route.
+ */
+function scrubUrl(url) {
+    if (typeof url !== "string" || url.length === 0)
+        return url;
+    let out = url;
+    // Drop userinfo credentials: scheme://user:pass@host → scheme://host
+    out = out.replace(/(^[a-z][a-z0-9+.-]*:\/\/)[^/@?#]*@/i, "$1");
+    // Drop the query string entirely (everything from '?' up to a '#').
+    out = out.replace(/\?[^#]*/, "");
+    // Drop a token-bearing fragment (it carries '='); keep plain hash routes.
+    out = out.replace(/#.*$/, (fragment) => fragment.includes("=") ? "" : fragment);
+    // Redact PII in the path (and any kept fragment route), never in the authority.
+    // Split off `scheme://authority` (or a protocol-relative `//authority`) so a
+    // host/port that contains digits is preserved; the remainder is the path onward.
+    const absolute = out.match(/^([a-z][a-z0-9+.-]*:\/\/[^/?#]*)([\s\S]*)$/i);
+    if (absolute)
+        return absolute[1] + redactPathPii(absolute[2] ?? "");
+    const protocolRelative = out.match(/^(\/\/[^/?#]*)([\s\S]*)$/);
+    if (protocolRelative) {
+        return protocolRelative[1] + redactPathPii(protocolRelative[2] ?? "");
+    }
+    // A relative URL is all path — redact the whole thing.
+    return redactPathPii(out);
+}
+function scrubCrumbData(data) {
+    const next = { ...data };
+    if (typeof next.url === "string")
+        next.url = scrubUrl(next.url);
+    if (typeof next.from === "string")
+        next.from = scrubUrl(next.from);
+    if (typeof next.to === "string")
+        next.to = scrubUrl(next.to);
+    return next;
+}
+/** Scrub a crumb's free-text message: strip URL query strings, then redact PII. */
+function scrubMessage(message) {
+    return redactPii(message.replace(URL_IN_TEXT_RE, (url) => scrubUrl(url)));
+}
+/**
+ * Scrub the string leaves of a structured console-arg value (spec #122 §C/§E) — the
+ * value a `json` arg carries. Walks arrays and plain objects, applying the same
+ * URL-strip + PII redaction as a crumb message to every nested string, so a value
+ * logged through `console.*` is swept just like the flattened preview.
+ */
+function scrubArgValue(value) {
+    if (typeof value === "string")
+        return scrubMessage(value);
+    if (Array.isArray(value))
+        return value.map(scrubArgValue);
+    if (value && typeof value === "object") {
+        const out = {};
+        for (const [key, v] of Object.entries(value)) {
+            out[key] = scrubArgValue(v);
+        }
+        return out;
+    }
+    return value;
+}
+/**
+ * Scrub one structured console argument (spec #122 §C): redact PII / strip URL query
+ * strings from a `string` value, from every string leaf of a `json` value, and from an
+ * `error` value's `message` and `stack`. Other tags (`number`/`bool`/`null`) carry no
+ * free text and pass through unchanged.
+ */
+function scrubConsoleArg(arg) {
+    switch (arg.t) {
+        case "string":
+            return typeof arg.v === "string" ? { t: "string", v: scrubMessage(arg.v) } : arg;
+        case "json":
+            return { t: "json", v: scrubArgValue(arg.v) };
+        case "error": {
+            if (!arg.v || typeof arg.v !== "object")
+                return arg;
+            const v = arg.v;
+            const next = { ...v };
+            if (typeof next.message === "string")
+                next.message = scrubMessage(next.message);
+            if (typeof next.stack === "string")
+                next.stack = scrubMessage(next.stack);
+            return { t: "error", v: next };
+        }
+        default:
+            return arg;
+    }
+}
+function scrubCrumb(crumb) {
+    const next = { ...crumb };
+    if (typeof next.message === "string")
+        next.message = scrubMessage(next.message);
+    if (next.data)
+        next.data = scrubCrumbData(next.data);
+    // A rich network crumb (#139) carries its scrubbed URL at the top level — sweep it
+    // again here (idempotent) so the choke point holds whether the URL rode in `data`
+    // (a legacy thin crumb) or top-level, and path-PII redaction is never skipped.
+    if (typeof next.url === "string")
+        next.url = scrubUrl(next.url);
+    // A console crumb's structured args carry the same free text as its preview — sweep
+    // them too, so PII redaction holds whether a value is read from `message` or `args`.
+    if (Array.isArray(next.args))
+        next.args = next.args.map(scrubConsoleArg);
+    return next;
+}
+/**
+ * Apply the built-in default scrubbers to a report draft: strip the page URL,
+ * and scrub every crumb's URLs and redact PII from its text. The Reporter's own
+ * `comment` is intentionally left untouched — it is authored on purpose, not
+ * scraped. The screenshot and input values are masked elsewhere (at capture and
+ * at crumb creation); this is the final URL/PII sweep.
+ */
+function applyDefaultScrub(draft) {
+    const next = { ...draft };
+    if (typeof next.url === "string")
+        next.url = scrubUrl(next.url);
+    if (next.trace && next.trace.length > 0) {
+        next.trace = next.trace.map(scrubCrumb);
+    }
+    // The structured stack frames (#117) carry script URLs — sweep them again here
+    // (idempotent, like the crumb URLs) so the choke point holds regardless of
+    // where the frames were parsed.
+    if (next.errorFrames && next.errorFrames.length > 0) {
+        next.errorFrames = next.errorFrames.map((frame) => ({
+            ...frame,
+            file: scrubUrl(frame.file),
+        }));
+    }
+    return next;
+}
+/**
+ * Run the report draft through the client scrub choke point: the default
+ * scrubbers first (unless `scrub` is `false`), then the optional per-project
+ * hook. Returns the scrubbed (and possibly hook-mutated) draft, or `null` when
+ * the hook drops the report. A hook that throws is treated as a no-op — the
+ * already-scrubbed draft is kept, so a buggy hook never breaks the report path
+ * nor leaks unscrubbed data.
+ */
+function runBeforeSend(draft, options = {}) {
+    const current = options.scrub === false ? draft : applyDefaultScrub(draft);
+    const hook = options.hook;
+    if (!hook)
+        return current;
+    try {
+        const result = hook(current);
+        return result ?? null;
+    }
+    catch {
+        return current;
+    }
+}
+//# sourceMappingURL=scrub.js.map

package/dist/scrub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrub.js","sourceRoot":"","sources":["../src/scrub.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;AA6BH,8BAMC;AAyBD,4BAsBC;AAoFD,8CAgBC;AAUD,sCAcC;AA9LD,gFAAgF;AAChF,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,MAAM,QAAQ,GAAG,yCAAyC,CAAC;AAC3D,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,OAAO,aAAa,IAAI,EAAE,GAAG,CAAC,CAAC;AAC/D,MAAM,SAAS,GAAG,oCAAoC,CAAC;AACvD,sEAAsE;AACtE,MAAM,cAAc,GAAG,2BAA2B,CAAC;AAEnD;;;;GAIG;AACH,SAAgB,SAAS,CAAC,IAAY;IACpC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,OAAO,IAAI;SACR,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CAAC;SACrC,OAAO,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,OAAe,EAAE,EAAE,CAAC,GAAG,OAAO,aAAa,CAAC;SACxE,OAAO,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,aAAqB;IAC1C,OAAO,aAAa;SACjB,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CAAC;SACrC,OAAO,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,QAAQ,CAAC,GAAW;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAC5D,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,qEAAqE;IACrE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,qCAAqC,EAAE,IAAI,CAAC,CAAC;IAC/D,oEAAoE;IACpE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACjC,0EAA0E;IAC1E,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CACvC,CAAC;IACF,gFAAgF;IAChF,6EAA6E;IAC7E,iFAAiF;IACjF,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC1E,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC/D,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,gBAAgB,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,uDAAuD;IACvD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAMD,SAAS,cAAc,CAAC,IAAoB;IAC1C,MAAM,IAAI,GAA0B,EAAE,GAAG,IAAI,EAAE,CAAC;IAChD,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;QAAE,IAAI,CAAC,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ;QAAE,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mFAAmF;AACnF,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC1D,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,GAAe;IACtC,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QACnF,KAAK,MAAM;YACT,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;gBAAE,OAAO,GAAG,CAAC;YACpD,MAAM,CAAC,GAAG,GAAG,CAAC,CAA2C,CAAC;YAC1D,MAAM,IAAI,GAA4B,EAAE,GAAG,CAAC,EAAE,CAAC;YAC/C,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;gBAAE,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChF,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAAE,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1E,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;QACjC,CAAC;QACD;YACE,OAAO,GAAG,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,MAAM,IAAI,GAAsB,EAAE,GAAG,KAAK,EAAE,CAAC;IAC7C,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAAE,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChF,IAAI,IAAI,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,mFAAmF;IACnF,kFAAkF;IAClF,+EAA+E;IAC/E,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;QAAE,IAAI,CAAC,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChE,oFAAoF;IACpF,qFAAqF;IACrF,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,iBAAiB,CAAC,KAAoB;IACpD,MAAM,IAAI,GAAmB,EAAE,GAAG,KAAK,EAAE,CAAC;IAC1C,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;QAAE,IAAI,CAAC,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IACD,+EAA+E;IAC/E,2EAA2E;IAC3E,gCAAgC;IAChC,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAClD,GAAG,KAAK;YACR,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC,CAAC;IACN,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,aAAa,CAC3B,KAAoB,EACpB,UAA6B,EAAE;IAE/B,MAAM,OAAO,GACX,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/wire.js

@@ -0,0 +1,16 @@
+"use strict";
+/**
+ * The shared **ingest wire shapes** (ADR-0028) — the value contract a captured
+ * report carries to `POST /api/ingest/feedback`, shared by every Fixback capture
+ * SDK so they all speak the same shape.
+ *
+ * Like the rest of the core these are runtime-agnostic value types: the browser
+ * and (future) backend SDKs both assemble a {@link ReportContent} from what they
+ * captured. Keep them in lock-step with the server: the JSON `payload` part the
+ * ingest controller parses (`apps/api/src/ingest/ingest.controller.ts`) and the
+ * `SubmissionContent` it maps to (`apps/api/src/ingest/reporter-identity.ts`).
+ * Each SDK keeps vendoring its own transport envelope (ticket #47) — the core
+ * carries the pure content shape, not the multipart envelope.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=wire.js.map

package/dist/wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.js","sourceRoot":"","sources":["../src/wire.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG"}

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@fixback/sdk-core",
+  "version": "0.2.0",
+  "description": "Runtime-agnostic core shared by the Fixback capture SDKs — fingerprinting, scrubbing, backoff, and the shared wire shapes.",
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "types": "./src/index.ts",
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "import": "./src/index.ts",
+      "require": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "fixback",
+    "feedback",
+    "sdk",
+    "fingerprint"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/wemuda/fixback.git",
+    "directory": "packages/sdk-core"
+  },
+  "homepage": "https://github.com/wemuda/fixback/tree/master/packages/sdk-core#readme",
+  "bugs": "https://github.com/wemuda/fixback/issues",
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "typescript": "5.9.3",
+    "vitest": "^4.1.10"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && node scripts/finalize-cjs.mjs",
+    "lint": "eslint .",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  }
+}