@kanca-app/ikas 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kanca
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,173 @@
+# @kanca-app/ikas
+
+Observability for [ikas](https://ikas.com) apps: webhook deliveries, Admin API
+calls, installs/uninstalls and admin UI web vitals — shown in the
+[Kanca](https://kanca.onurhan.dev) dashboard.
+
+- **Metadata only.** Never payloads, variables, responses, headers or tokens.
+- **Never breaks your app.** No throws, no added latency, responses untouched.
+- Node 18+, Next.js App Router, any runtime with `fetch`/`Request`. No runtime
+  dependencies on the server (`web-vitals` is used by the browser entry only).
+
+```sh
+pnpm add @kanca-app/ikas
+```
+
+## Environment
+
+| Variable                       | Where         | Value                                |
+| ------------------------------ | ------------- | ------------------------------------ |
+| `KANCA_KEY`                    | backend only  | server key `kk_...`                  |
+| `NEXT_PUBLIC_KANCA_PUBLIC_KEY` | browser       | public key `kp_...` (vitals only)    |
+
+Without `KANCA_KEY` the SDK is a silent no-op, so local dev and CI need no setup.
+
+## Integrate the ikas starter app (3 steps)
+
+Create the client once — `src/lib/kanca.ts`:
+
+```ts
+import { createKanca } from '@kanca-app/ikas';
+export const kanca = createKanca({ key: process.env.KANCA_KEY });
+```
+
+### 1. Webhooks — `src/app/api/webhooks/ikas/route.ts`
+
+Wrap your route handler. Each delivery records scope, delivery id, merchant id,
+your response status and duration. Subscribe to `store/app/deleted` to get
+uninstalls for free.
+
+```ts
+import { kanca } from '@/lib/kanca';
+import { validateIkasWebhookSignature, type IkasWebhook } from '@ikas/admin-api-client';
+import { NextRequest, NextResponse } from 'next/server';
+
+export const POST = kanca.webhook(async (request: NextRequest) => {
+  const webhook = (await request.json()) as IkasWebhook; // body is still yours to read
+  if (!validateIkasWebhookSignature(webhook, process.env.CLIENT_SECRET!)) {
+    return NextResponse.json({ error: 'invalid signature' }, { status: 401 });
+  }
+  // ... handle webhook.scope
+  return NextResponse.json({ ok: true }); // must be 200 — ikas retries anything else, even 201/204
+});
+```
+
+### 2. Installs — `src/app/api/oauth/callback/ikas/route.ts`
+
+After `await AuthTokenManager.put(token);`:
+
+```ts
+kanca.track('install', { merchantId, storeName: merchantResponse.data.getMerchant.storeName });
+await kanca.flush();
+```
+
+### 3. Admin API calls — `src/helpers/api-helpers.ts`
+
+Wrap the client in `getIkas()`:
+
+```ts
+export function getIkas(token: AuthToken) {
+  return kanca.instrument(
+    new ikasAdminGraphQLAPIClient<AuthToken>({
+      graphApiUrl: config.graphApiUrl!,
+      accessToken: token.accessToken,
+      tokenData: token, // token.merchantId is attached to each call
+      onCheckToken: () => onCheckToken(token),
+    }),
+  );
+}
+```
+
+Every `ikas.queries.*` / `query()` / `mutate()` call becomes a `graphql` event
+named after the operation (`getMerchant`, `listOrder`, …). A `200` response with
+an `errors` array counts as a failure, with `errors[0].extensions.code` as the
+error code.
+
+`instrument()` works with `@ikas/admin-api-client` 2.x (any
+`BaseGraphQLAPIClient` subclass) and survives token refreshes. For anything else
+— your own GraphQL client, `graphql-request`, REST calls — use the drop-in
+`kanca.fetch`:
+
+```ts
+const res = await kanca.fetch('https://api.myikas.com/api/v1/admin/graphql', { method: 'POST', headers, body });
+```
+
+ikas GraphQL URLs (`*.myikas.com/…graphql`) become `graphql` events; any other URL
+becomes a `rest` event named `"POST api.example.com/v1/items"` (no query string).
+
+Full example files: [`examples/starter-app`](./examples/starter-app).
+
+## Admin UI web vitals
+
+```tsx
+// src/app/layout.tsx
+import { KancaVitals } from '@kanca-app/ikas/react';
+
+<body>
+  <KancaVitals publicKey={process.env.NEXT_PUBLIC_KANCA_PUBLIC_KEY} />
+  {children}
+</body>;
+```
+
+Records LCP, INP, CLS, FCP and TTFB (final values, once per page load) with the
+pathname and rating, sent with `fetch` + `keepalive` when the page is hidden
+(`sendBeacon` only as a fallback — content blockers drop beacons silently).
+Without React: `import { reportVitals } from '@kanca-app/ikas/browser'`.
+
+## Serverless
+
+Events are batched in memory and sent every 2 s (or at 100 events), and on
+process exit. After each recorded event the SDK schedules a send without awaiting it.
+On platforms that freeze the function after the response (Vercel, Lambda),
+pass `waitUntil` so webhook, Admin API and install events all survive the freeze:
+
+```ts
+import { waitUntil } from '@vercel/functions';
+export const kanca = createKanca({ key: process.env.KANCA_KEY, waitUntil });
+```
+
+or `await kanca.flush()` before returning (it never throws).
+
+## Options
+
+```ts
+createKanca({
+  key,                    // kk_...
+  endpoint,               // default https://kanca.onurhan.dev
+  debug,                  // log activity to the console
+  disabled,               // force no-op
+  flushIntervalMs,        // default 2000
+  maxBatchSize,           // default 100, max 500
+  maxQueueSize,           // default 5000; oldest events dropped beyond this
+  waitUntil,              // (promise) => void
+});
+```
+
+Failed sends are retried on 429/5xx/network errors (exponential backoff, 3
+attempts). Every event has a UUID, so retries never double count.
+
+## Privacy
+
+What is sent: event type, name (webhook scope / GraphQL operation name /
+`METHOD host/path`), HTTP status, ok, duration, error code, error message
+(≤ 500 chars), merchant id, webhook delivery id, and for installs the store
+name. Vitals send metric name, value, rating and pathname.
+
+What is never sent: webhook bodies, the webhook signature, GraphQL queries,
+variables or responses, request/response headers, access tokens, query strings,
+customer or order data. Kanca never asks for your ikas client secret.
+
+## Honest limits
+
+- The SDK sees what reaches your app. Deliveries that never arrive (app down,
+  DNS, TLS, timeouts before your handler runs) are invisible — the dashboard
+  shows failures *seen by your app*.
+- For `instrument()`, `@ikas/admin-api-client` does not expose the HTTP status
+  of successful calls, so those events carry `ok: true` without a status. Use
+  `kanca.fetch` if you need exact statuses.
+- Events buffered in memory are lost if the process is killed hard (SIGKILL,
+  OOM) before the next send.
+
+## License
+
+MIT

package/dist/browser.cjs

@@ -0,0 +1,172 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/browser.ts
+var browser_exports = {};
+__export(browser_exports, {
+  __resetVitalsForTests: () => __resetVitalsForTests,
+  reportVitals: () => reportVitals
+});
+module.exports = __toCommonJS(browser_exports);
+var import_web_vitals = require("web-vitals");
+
+// src/shared.ts
+var SDK_NAME = "@kanca-app/ikas";
+var SDK_VERSION = "0.1.1";
+var DEFAULT_ENDPOINT = "https://kanca.onurhan.dev";
+var MAX_NAME = 200;
+var MAX_ERROR_MESSAGE = 500;
+var MAX_ERROR_CODE = 100;
+var MAX_ATTR_KEYS = 20;
+var MAX_ATTR_STRING = 500;
+var MAX_ATTR_KEY = 64;
+var MAX_BATCH_BYTES = 480 * 1024;
+function truncate(s, max) {
+  return s.length > max ? s.slice(0, max) : s;
+}
+function hex(bytes) {
+  let out = "";
+  for (const b of bytes) out += b.toString(16).padStart(2, "0");
+  return out;
+}
+function uuid() {
+  const c = globalThis.crypto;
+  if (c && typeof c.randomUUID === "function") return c.randomUUID();
+  const b = new Uint8Array(16);
+  if (c && typeof c.getRandomValues === "function") c.getRandomValues(b);
+  else for (let i = 0; i < 16; i++) b[i] = Math.floor(Math.random() * 256);
+  b[6] = b[6] & 15 | 64;
+  b[8] = b[8] & 63 | 128;
+  const h = hex(b);
+  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;
+}
+function isFiniteNumber(v) {
+  return typeof v === "number" && Number.isFinite(v);
+}
+function cleanAttrs(attrs) {
+  if (!attrs || typeof attrs !== "object") return void 0;
+  const out = {};
+  let n = 0;
+  for (const [k, v] of Object.entries(attrs)) {
+    if (n >= MAX_ATTR_KEYS) break;
+    if (v === void 0 || v === null || !k) continue;
+    let val;
+    if (typeof v === "boolean") val = v;
+    else if (typeof v === "number") {
+      if (!Number.isFinite(v)) continue;
+      val = v;
+    } else if (typeof v === "string") val = truncate(v, MAX_ATTR_STRING);
+    else continue;
+    out[truncate(k, MAX_ATTR_KEY)] = val;
+    n++;
+  }
+  return n > 0 ? out : void 0;
+}
+function sanitizeEvent(e) {
+  const out = {
+    id: typeof e.id === "string" && e.id ? e.id : uuid(),
+    type: e.type,
+    ts: isFiniteNumber(e.ts) ? Math.round(e.ts) : Date.now(),
+    name: truncate(typeof e.name === "string" && e.name ? e.name : "unknown", MAX_NAME)
+  };
+  if (isFiniteNumber(e.status) && e.status >= 100 && e.status <= 599) out.status = Math.trunc(e.status);
+  if (typeof e.ok === "boolean") out.ok = e.ok;
+  if (isFiniteNumber(e.durationMs)) out.durationMs = Math.min(864e5, Math.max(0, Math.round(e.durationMs * 10) / 10));
+  if (isFiniteNumber(e.value)) out.value = e.value;
+  if (e.error && typeof e.error.code === "string") {
+    out.error = { code: truncate(e.error.code, MAX_ERROR_CODE) };
+    if (typeof e.error.message === "string" && e.error.message) {
+      out.error.message = truncate(e.error.message, MAX_ERROR_MESSAGE);
+    }
+  }
+  if (typeof e.merchantId === "string" && e.merchantId) out.merchantId = truncate(e.merchantId, 200);
+  if (typeof e.deliveryId === "string" && e.deliveryId) out.deliveryId = truncate(e.deliveryId, 200);
+  const attrs = cleanAttrs(e.attrs);
+  if (attrs) out.attrs = attrs;
+  return out;
+}
+function joinUrl(endpoint, path) {
+  return endpoint.replace(/\/+$/, "") + path;
+}
+var encoder = typeof TextEncoder !== "undefined" ? new TextEncoder() : void 0;
+
+// src/browser.ts
+var VITALS = ["LCP", "INP", "CLS", "FCP", "TTFB"];
+var FLAG = "__kancaVitalsStarted";
+var g = globalThis;
+function reportVitals(options) {
+  try {
+    if (g[FLAG] || typeof window === "undefined" || typeof document === "undefined") return;
+    const key = typeof options?.publicKey === "string" ? options.publicKey.trim() : "";
+    const debug = !!options?.debug;
+    if (!key.startsWith("kp_")) {
+      if (debug || key) console.warn("[kanca] reportVitals(): a public key (kp_...) is required; vitals disabled.");
+      return;
+    }
+    g[FLAG] = true;
+    const url = `${joinUrl(options.endpoint || DEFAULT_ENDPOINT, "/api/ingest/browser")}?key=${encodeURIComponent(key)}`;
+    const path = location.pathname;
+    const ts = typeof performance !== "undefined" && typeof performance.timeOrigin === "number" && performance.timeOrigin > 0 ? Math.round(performance.timeOrigin) : Date.now();
+    const queue = [];
+    const seen = /* @__PURE__ */ new Set();
+    const send = () => {
+      if (!queue.length) return;
+      const events = queue.splice(0, queue.length);
+      const body = JSON.stringify({ sdk: { name: SDK_NAME, version: SDK_VERSION }, events });
+      if (debug) console.debug("[kanca] vitals", events);
+      try {
+        if (typeof fetch === "function") {
+          void fetch(url, { method: "POST", body, keepalive: true, mode: "cors", credentials: "omit", headers: { "content-type": "text/plain" } }).catch(() => void 0);
+          return;
+        }
+      } catch {
+      }
+      try {
+        if (typeof navigator !== "undefined" && typeof navigator.sendBeacon === "function") navigator.sendBeacon(url, body);
+      } catch {
+      }
+    };
+    const onMetric = (m) => {
+      try {
+        if (!VITALS.includes(m.name) || seen.has(m.name)) return;
+        seen.add(m.name);
+        queue.push(sanitizeEvent({ id: uuid(), type: "vital", ts, name: m.name, value: m.value, attrs: { path, rating: m.rating } }));
+      } catch {
+      }
+    };
+    (0, import_web_vitals.onLCP)(onMetric);
+    (0, import_web_vitals.onINP)(onMetric);
+    (0, import_web_vitals.onCLS)(onMetric);
+    (0, import_web_vitals.onFCP)(onMetric);
+    (0, import_web_vitals.onTTFB)(onMetric);
+    addEventListener(
+      "visibilitychange",
+      () => {
+        if (document.visibilityState === "hidden") queueMicrotask(send);
+      },
+      true
+    );
+    addEventListener("pagehide", send, true);
+  } catch {
+  }
+}
+function __resetVitalsForTests() {
+  g[FLAG] = false;
+}
+//# sourceMappingURL=browser.cjs.map

package/dist/browser.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/browser.ts","../src/shared.ts"],"sourcesContent":["// @kanca-app/ikas/browser — Core Web Vitals for the ikas admin iframe.\n// Sends only { name, value, rating, pathname } per metric. Uses a public key (kp_...).\n\nimport { onCLS, onFCP, onINP, onLCP, onTTFB, type Metric } from \"web-vitals\";\nimport { DEFAULT_ENDPOINT, SDK_NAME, SDK_VERSION, joinUrl, sanitizeEvent, uuid, type KancaEvent } from \"./shared\";\n\nexport interface ReportVitalsOptions {\n  /** Public key (`kp_...`). Safe to expose in the browser; only accepts `vital` events. */\n  publicKey: string | undefined;\n  /** Kanca base URL. Default `https://kanca.onurhan.dev`. */\n  endpoint?: string;\n  debug?: boolean;\n}\n\nconst VITALS = [\"LCP\", \"INP\", \"CLS\", \"FCP\", \"TTFB\"] as const;\n\n// Global (not module) flag so duplicate copies (ESM + CJS, browser + react bundles) still start once.\nconst FLAG = \"__kancaVitalsStarted\";\nconst g = globalThis as { [FLAG]?: boolean };\n\n/**\n * Starts collecting LCP, INP, CLS, FCP and TTFB (final values, once per page\n * load per metric) and sends them when the page is hidden or unloaded.\n * Safe to call more than once — only the first call has an effect.\n */\nexport function reportVitals(options: ReportVitalsOptions): void {\n  try {\n    if (g[FLAG] || typeof window === \"undefined\" || typeof document === \"undefined\") return;\n    const key = typeof options?.publicKey === \"string\" ? options.publicKey.trim() : \"\";\n    const debug = !!options?.debug;\n    if (!key.startsWith(\"kp_\")) {\n      if (debug || key) console.warn(\"[kanca] reportVitals(): a public key (kp_...) is required; vitals disabled.\");\n      return;\n    }\n    g[FLAG] = true;\n\n    const url = `${joinUrl(options.endpoint || DEFAULT_ENDPOINT, \"/api/ingest/browser\")}?key=${encodeURIComponent(key)}`;\n    const path = location.pathname;\n    const ts =\n      typeof performance !== \"undefined\" && typeof performance.timeOrigin === \"number\" && performance.timeOrigin > 0\n        ? Math.round(performance.timeOrigin)\n        : Date.now();\n    const queue: KancaEvent[] = [];\n    const seen = new Set<string>();\n\n    const send = () => {\n      if (!queue.length) return;\n      const events = queue.splice(0, queue.length);\n      const body = JSON.stringify({ sdk: { name: SDK_NAME, version: SDK_VERSION }, events });\n      if (debug) console.debug(\"[kanca] vitals\", events);\n      // fetch+keepalive first: content blockers drop sendBeacon (\"ping\") requests\n      // while sendBeacon still returns true, so vitals would vanish silently.\n      // A text/plain body keeps it a simple request (no CORS preflight).\n      try {\n        if (typeof fetch === \"function\") {\n          void fetch(url, { method: \"POST\", body, keepalive: true, mode: \"cors\", credentials: \"omit\", headers: { \"content-type\": \"text/plain\" } }).catch(() => undefined);\n          return;\n        }\n      } catch {\n        /* fall through */\n      }\n      try {\n        if (typeof navigator !== \"undefined\" && typeof navigator.sendBeacon === \"function\") navigator.sendBeacon(url, body);\n      } catch {\n        /* never throw */\n      }\n    };\n\n    const onMetric = (m: Metric) => {\n      try {\n        if (!(VITALS as readonly string[]).includes(m.name) || seen.has(m.name)) return;\n        seen.add(m.name);\n        queue.push(sanitizeEvent({ id: uuid(), type: \"vital\", ts, name: m.name, value: m.value, attrs: { path, rating: m.rating } }));\n      } catch {\n        /* ignore */\n      }\n    };\n\n    // Without reportAllChanges, web-vitals reports each metric's final value.\n    onLCP(onMetric);\n    onINP(onMetric);\n    onCLS(onMetric);\n    onFCP(onMetric);\n    onTTFB(onMetric);\n\n    // Registered after web-vitals' own listeners, so final values are queued before we send.\n    addEventListener(\n      \"visibilitychange\",\n      () => {\n        // Microtask: lets any report web-vitals triggers on this same event land first.\n        if (document.visibilityState === \"hidden\") queueMicrotask(send);\n      },\n      true,\n    );\n    addEventListener(\"pagehide\", send, true);\n  } catch {\n    /* never break the host page */\n  }\n}\n\n/** @internal for tests */\nexport function __resetVitalsForTests(): void {\n  g[FLAG] = false;\n}\n","// Shared, runtime-agnostic helpers (used by both the Node and browser entries).\n// Wire format: see docs/PROTOCOL.md (v1).\n\nexport const SDK_NAME = \"@kanca-app/ikas\";\nexport const SDK_VERSION = \"0.1.1\";\nexport const DEFAULT_ENDPOINT = \"https://kanca.onurhan.dev\";\n\nexport const MAX_NAME = 200;\nexport const MAX_ERROR_MESSAGE = 500;\nexport const MAX_ERROR_CODE = 100;\nexport const MAX_ATTR_KEYS = 20;\nexport const MAX_ATTR_STRING = 500;\nexport const MAX_ATTR_KEY = 64;\nexport const MAX_EVENTS_PER_BATCH = 500;\n/** Protocol limit is 512 KB; keep headroom for the envelope. */\nexport const MAX_BATCH_BYTES = 480 * 1024;\n\nexport type EventType = \"webhook\" | \"graphql\" | \"rest\" | \"install\" | \"uninstall\" | \"vital\";\n\nexport type AttrValue = string | number | boolean;\n\nexport interface KancaError {\n  code: string;\n  message?: string;\n}\n\n/** A single wire event (PROTOCOL.md → Event). */\nexport interface KancaEvent {\n  id: string;\n  type: EventType;\n  ts: number;\n  name: string;\n  status?: number;\n  ok?: boolean;\n  durationMs?: number;\n  value?: number;\n  error?: KancaError;\n  merchantId?: string;\n  deliveryId?: string;\n  attrs?: Record<string, AttrValue>;\n}\n\nexport interface Batch {\n  sdk: { name: string; version: string };\n  events: KancaEvent[];\n}\n\nexport function truncate(s: string, max: number): string {\n  return s.length > max ? s.slice(0, max) : s;\n}\n\nfunction hex(bytes: Uint8Array): string {\n  let out = \"\";\n  for (const b of bytes) out += b.toString(16).padStart(2, \"0\");\n  return out;\n}\n\n/** UUID v4 via crypto.randomUUID, with a getRandomValues fallback (non-secure browser contexts). */\nexport function uuid(): string {\n  const c = (globalThis as { crypto?: Crypto }).crypto;\n  if (c && typeof c.randomUUID === \"function\") return c.randomUUID();\n  const b = new Uint8Array(16);\n  if (c && typeof c.getRandomValues === \"function\") c.getRandomValues(b);\n  else for (let i = 0; i < 16; i++) b[i] = Math.floor(Math.random() * 256);\n  b[6] = (b[6]! & 0x0f) | 0x40;\n  b[8] = (b[8]! & 0x3f) | 0x80;\n  const h = hex(b);\n  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;\n}\n\nfunction isFiniteNumber(v: unknown): v is number {\n  return typeof v === \"number\" && Number.isFinite(v);\n}\n\nfunction cleanAttrs(attrs: unknown): Record<string, AttrValue> | undefined {\n  if (!attrs || typeof attrs !== \"object\") return undefined;\n  const out: Record<string, AttrValue> = {};\n  let n = 0;\n  for (const [k, v] of Object.entries(attrs as Record<string, unknown>)) {\n    if (n >= MAX_ATTR_KEYS) break;\n    if (v === undefined || v === null || !k) continue;\n    let val: AttrValue;\n    if (typeof v === \"boolean\") val = v;\n    else if (typeof v === \"number\") {\n      if (!Number.isFinite(v)) continue;\n      val = v;\n    } else if (typeof v === \"string\") val = truncate(v, MAX_ATTR_STRING);\n    else continue; // attrs are flat: nested values are dropped, never stringified\n    out[truncate(k, MAX_ATTR_KEY)] = val;\n    n++;\n  }\n  return n > 0 ? out : undefined;\n}\n\n/**\n * Normalises an event so it always satisfies the protocol limits. Unknown\n * fields are dropped — only the whitelisted metadata below ever leaves the process.\n */\nexport function sanitizeEvent(e: KancaEvent): KancaEvent {\n  const out: KancaEvent = {\n    id: typeof e.id === \"string\" && e.id ? e.id : uuid(),\n    type: e.type,\n    ts: isFiniteNumber(e.ts) ? Math.round(e.ts) : Date.now(),\n    name: truncate(typeof e.name === \"string\" && e.name ? e.name : \"unknown\", MAX_NAME),\n  };\n  if (isFiniteNumber(e.status) && e.status >= 100 && e.status <= 599) out.status = Math.trunc(e.status);\n  if (typeof e.ok === \"boolean\") out.ok = e.ok;\n  if (isFiniteNumber(e.durationMs)) out.durationMs = Math.min(86_400_000, Math.max(0, Math.round(e.durationMs * 10) / 10));\n  if (isFiniteNumber(e.value)) out.value = e.value;\n  if (e.error && typeof e.error.code === \"string\") {\n    out.error = { code: truncate(e.error.code, MAX_ERROR_CODE) };\n    if (typeof e.error.message === \"string\" && e.error.message) {\n      out.error.message = truncate(e.error.message, MAX_ERROR_MESSAGE);\n    }\n  }\n  if (typeof e.merchantId === \"string\" && e.merchantId) out.merchantId = truncate(e.merchantId, 200);\n  if (typeof e.deliveryId === \"string\" && e.deliveryId) out.deliveryId = truncate(e.deliveryId, 200);\n  const attrs = cleanAttrs(e.attrs);\n  if (attrs) out.attrs = attrs;\n  return out;\n}\n\nexport function errorMessage(err: unknown): string | undefined {\n  try {\n    if (err instanceof Error) return truncate(err.message || err.name, MAX_ERROR_MESSAGE);\n    if (typeof err === \"string\") return truncate(err, MAX_ERROR_MESSAGE);\n  } catch {\n    /* ignore */\n  }\n  return undefined;\n}\n\nexport function joinUrl(endpoint: string, path: string): string {\n  return endpoint.replace(/\\/+$/, \"\") + path;\n}\n\nconst encoder = typeof TextEncoder !== \"undefined\" ? new TextEncoder() : undefined;\nexport function byteLength(s: string): number {\n  return encoder ? encoder.encode(s).length : s.length * 3;\n}\n\n/**\n * Splits events into protocol-sized batches (<= maxEvents events and\n * <= MAX_BATCH_BYTES serialized). Returns serialized bodies.\n */\nexport function buildBodies(events: KancaEvent[], maxEvents: number): { body: string; events: KancaEvent[] }[] {\n  const sdk = { name: SDK_NAME, version: SDK_VERSION };\n  const envelope = byteLength(JSON.stringify({ sdk, events: [] }));\n  const out: { body: string; events: KancaEvent[] }[] = [];\n  let cur: KancaEvent[] = [];\n  let size = envelope;\n  const push = () => {\n    if (cur.length) out.push({ body: JSON.stringify({ sdk, events: cur } satisfies Batch), events: cur });\n    cur = [];\n    size = envelope;\n  };\n  for (const ev of events) {\n    const len = byteLength(JSON.stringify(ev)) + 1;\n    if (cur.length && (cur.length >= maxEvents || size + len > MAX_BATCH_BYTES)) push();\n    cur.push(ev);\n    size += len;\n  }\n  push();\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAGA,wBAAgE;;;ACAzD,IAAM,WAAW;AACjB,IAAM,cAAc;AACpB,IAAM,mBAAmB;AAEzB,IAAM,WAAW;AACjB,IAAM,oBAAoB;AAC1B,IAAM,iBAAiB;AACvB,IAAM,gBAAgB;AACtB,IAAM,kBAAkB;AACxB,IAAM,eAAe;AAGrB,IAAM,kBAAkB,MAAM;AAgC9B,SAAS,SAAS,GAAW,KAAqB;AACvD,SAAO,EAAE,SAAS,MAAM,EAAE,MAAM,GAAG,GAAG,IAAI;AAC5C;AAEA,SAAS,IAAI,OAA2B;AACtC,MAAI,MAAM;AACV,aAAW,KAAK,MAAO,QAAO,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAC5D,SAAO;AACT;AAGO,SAAS,OAAe;AAC7B,QAAM,IAAK,WAAmC;AAC9C,MAAI,KAAK,OAAO,EAAE,eAAe,WAAY,QAAO,EAAE,WAAW;AACjE,QAAM,IAAI,IAAI,WAAW,EAAE;AAC3B,MAAI,KAAK,OAAO,EAAE,oBAAoB,WAAY,GAAE,gBAAgB,CAAC;AAAA,MAChE,UAAS,IAAI,GAAG,IAAI,IAAI,IAAK,GAAE,CAAC,IAAI,KAAK,MAAM,KAAK,OAAO,IAAI,GAAG;AACvE,IAAE,CAAC,IAAK,EAAE,CAAC,IAAK,KAAQ;AACxB,IAAE,CAAC,IAAK,EAAE,CAAC,IAAK,KAAQ;AACxB,QAAM,IAAI,IAAI,CAAC;AACf,SAAO,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;AAChG;AAEA,SAAS,eAAe,GAAyB;AAC/C,SAAO,OAAO,MAAM,YAAY,OAAO,SAAS,CAAC;AACnD;AAEA,SAAS,WAAW,OAAuD;AACzE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,MAAiC,CAAC;AACxC,MAAI,IAAI;AACR,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAgC,GAAG;AACrE,QAAI,KAAK,cAAe;AACxB,QAAI,MAAM,UAAa,MAAM,QAAQ,CAAC,EAAG;AACzC,QAAI;AACJ,QAAI,OAAO,MAAM,UAAW,OAAM;AAAA,aACzB,OAAO,MAAM,UAAU;AAC9B,UAAI,CAAC,OAAO,SAAS,CAAC,EAAG;AACzB,YAAM;AAAA,IACR,WAAW,OAAO,MAAM,SAAU,OAAM,SAAS,GAAG,eAAe;AAAA,QAC9D;AACL,QAAI,SAAS,GAAG,YAAY,CAAC,IAAI;AACjC;AAAA,EACF;AACA,SAAO,IAAI,IAAI,MAAM;AACvB;AAMO,SAAS,cAAc,GAA2B;AACvD,QAAM,MAAkB;AAAA,IACtB,IAAI,OAAO,EAAE,OAAO,YAAY,EAAE,KAAK,EAAE,KAAK,KAAK;AAAA,IACnD,MAAM,EAAE;AAAA,IACR,IAAI,eAAe,EAAE,EAAE,IAAI,KAAK,MAAM,EAAE,EAAE,IAAI,KAAK,IAAI;AAAA,IACvD,MAAM,SAAS,OAAO,EAAE,SAAS,YAAY,EAAE,OAAO,EAAE,OAAO,WAAW,QAAQ;AAAA,EACpF;AACA,MAAI,eAAe,EAAE,MAAM,KAAK,EAAE,UAAU,OAAO,EAAE,UAAU,IAAK,KAAI,SAAS,KAAK,MAAM,EAAE,MAAM;AACpG,MAAI,OAAO,EAAE,OAAO,UAAW,KAAI,KAAK,EAAE;AAC1C,MAAI,eAAe,EAAE,UAAU,EAAG,KAAI,aAAa,KAAK,IAAI,OAAY,KAAK,IAAI,GAAG,KAAK,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AACvH,MAAI,eAAe,EAAE,KAAK,EAAG,KAAI,QAAQ,EAAE;AAC3C,MAAI,EAAE,SAAS,OAAO,EAAE,MAAM,SAAS,UAAU;AAC/C,QAAI,QAAQ,EAAE,MAAM,SAAS,EAAE,MAAM,MAAM,cAAc,EAAE;AAC3D,QAAI,OAAO,EAAE,MAAM,YAAY,YAAY,EAAE,MAAM,SAAS;AAC1D,UAAI,MAAM,UAAU,SAAS,EAAE,MAAM,SAAS,iBAAiB;AAAA,IACjE;AAAA,EACF;AACA,MAAI,OAAO,EAAE,eAAe,YAAY,EAAE,WAAY,KAAI,aAAa,SAAS,EAAE,YAAY,GAAG;AACjG,MAAI,OAAO,EAAE,eAAe,YAAY,EAAE,WAAY,KAAI,aAAa,SAAS,EAAE,YAAY,GAAG;AACjG,QAAM,QAAQ,WAAW,EAAE,KAAK;AAChC,MAAI,MAAO,KAAI,QAAQ;AACvB,SAAO;AACT;AAYO,SAAS,QAAQ,UAAkB,MAAsB;AAC9D,SAAO,SAAS,QAAQ,QAAQ,EAAE,IAAI;AACxC;AAEA,IAAM,UAAU,OAAO,gBAAgB,cAAc,IAAI,YAAY,IAAI;;;AD1HzE,IAAM,SAAS,CAAC,OAAO,OAAO,OAAO,OAAO,MAAM;AAGlD,IAAM,OAAO;AACb,IAAM,IAAI;AAOH,SAAS,aAAa,SAAoC;AAC/D,MAAI;AACF,QAAI,EAAE,IAAI,KAAK,OAAO,WAAW,eAAe,OAAO,aAAa,YAAa;AACjF,UAAM,MAAM,OAAO,SAAS,cAAc,WAAW,QAAQ,UAAU,KAAK,IAAI;AAChF,UAAM,QAAQ,CAAC,CAAC,SAAS;AACzB,QAAI,CAAC,IAAI,WAAW,KAAK,GAAG;AAC1B,UAAI,SAAS,IAAK,SAAQ,KAAK,6EAA6E;AAC5G;AAAA,IACF;AACA,MAAE,IAAI,IAAI;AAEV,UAAM,MAAM,GAAG,QAAQ,QAAQ,YAAY,kBAAkB,qBAAqB,CAAC,QAAQ,mBAAmB,GAAG,CAAC;AAClH,UAAM,OAAO,SAAS;AACtB,UAAM,KACJ,OAAO,gBAAgB,eAAe,OAAO,YAAY,eAAe,YAAY,YAAY,aAAa,IACzG,KAAK,MAAM,YAAY,UAAU,IACjC,KAAK,IAAI;AACf,UAAM,QAAsB,CAAC;AAC7B,UAAM,OAAO,oBAAI,IAAY;AAE7B,UAAM,OAAO,MAAM;AACjB,UAAI,CAAC,MAAM,OAAQ;AACnB,YAAM,SAAS,MAAM,OAAO,GAAG,MAAM,MAAM;AAC3C,YAAM,OAAO,KAAK,UAAU,EAAE,KAAK,EAAE,MAAM,UAAU,SAAS,YAAY,GAAG,OAAO,CAAC;AACrF,UAAI,MAAO,SAAQ,MAAM,kBAAkB,MAAM;AAIjD,UAAI;AACF,YAAI,OAAO,UAAU,YAAY;AAC/B,eAAK,MAAM,KAAK,EAAE,QAAQ,QAAQ,MAAM,WAAW,MAAM,MAAM,QAAQ,aAAa,QAAQ,SAAS,EAAE,gBAAgB,aAAa,EAAE,CAAC,EAAE,MAAM,MAAM,MAAS;AAC9J;AAAA,QACF;AAAA,MACF,QAAQ;AAAA,MAER;AACA,UAAI;AACF,YAAI,OAAO,cAAc,eAAe,OAAO,UAAU,eAAe,WAAY,WAAU,WAAW,KAAK,IAAI;AAAA,MACpH,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,UAAM,WAAW,CAAC,MAAc;AAC9B,UAAI;AACF,YAAI,CAAE,OAA6B,SAAS,EAAE,IAAI,KAAK,KAAK,IAAI,EAAE,IAAI,EAAG;AACzE,aAAK,IAAI,EAAE,IAAI;AACf,cAAM,KAAK,cAAc,EAAE,IAAI,KAAK,GAAG,MAAM,SAAS,IAAI,MAAM,EAAE,MAAM,OAAO,EAAE,OAAO,OAAO,EAAE,MAAM,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;AAAA,MAC9H,QAAQ;AAAA,MAER;AAAA,IACF;AAGA,iCAAM,QAAQ;AACd,iCAAM,QAAQ;AACd,iCAAM,QAAQ;AACd,iCAAM,QAAQ;AACd,kCAAO,QAAQ;AAGf;AAAA,MACE;AAAA,MACA,MAAM;AAEJ,YAAI,SAAS,oBAAoB,SAAU,gBAAe,IAAI;AAAA,MAChE;AAAA,MACA;AAAA,IACF;AACA,qBAAiB,YAAY,MAAM,IAAI;AAAA,EACzC,QAAQ;AAAA,EAER;AACF;AAGO,SAAS,wBAA8B;AAC5C,IAAE,IAAI,IAAI;AACZ;","names":[]}

package/dist/browser.d.cts

@@ -0,0 +1,17 @@
+interface ReportVitalsOptions {
+    /** Public key (`kp_...`). Safe to expose in the browser; only accepts `vital` events. */
+    publicKey: string | undefined;
+    /** Kanca base URL. Default `https://kanca.onurhan.dev`. */
+    endpoint?: string;
+    debug?: boolean;
+}
+/**
+ * Starts collecting LCP, INP, CLS, FCP and TTFB (final values, once per page
+ * load per metric) and sends them when the page is hidden or unloaded.
+ * Safe to call more than once — only the first call has an effect.
+ */
+declare function reportVitals(options: ReportVitalsOptions): void;
+/** @internal for tests */
+declare function __resetVitalsForTests(): void;
+
+export { type ReportVitalsOptions, __resetVitalsForTests, reportVitals };

package/dist/browser.d.ts

@@ -0,0 +1,17 @@
+interface ReportVitalsOptions {
+    /** Public key (`kp_...`). Safe to expose in the browser; only accepts `vital` events. */
+    publicKey: string | undefined;
+    /** Kanca base URL. Default `https://kanca.onurhan.dev`. */
+    endpoint?: string;
+    debug?: boolean;
+}
+/**
+ * Starts collecting LCP, INP, CLS, FCP and TTFB (final values, once per page
+ * load per metric) and sends them when the page is hidden or unloaded.
+ * Safe to call more than once — only the first call has an effect.
+ */
+declare function reportVitals(options: ReportVitalsOptions): void;
+/** @internal for tests */
+declare function __resetVitalsForTests(): void;
+
+export { type ReportVitalsOptions, __resetVitalsForTests, reportVitals };

package/dist/browser.js

@@ -0,0 +1,151 @@
+// src/browser.ts
+import { onCLS, onFCP, onINP, onLCP, onTTFB } from "web-vitals";
+
+// src/shared.ts
+var SDK_NAME = "@kanca-app/ikas";
+var SDK_VERSION = "0.1.1";
+var DEFAULT_ENDPOINT = "https://kanca.onurhan.dev";
+var MAX_NAME = 200;
+var MAX_ERROR_MESSAGE = 500;
+var MAX_ERROR_CODE = 100;
+var MAX_ATTR_KEYS = 20;
+var MAX_ATTR_STRING = 500;
+var MAX_ATTR_KEY = 64;
+var MAX_BATCH_BYTES = 480 * 1024;
+function truncate(s, max) {
+  return s.length > max ? s.slice(0, max) : s;
+}
+function hex(bytes) {
+  let out = "";
+  for (const b of bytes) out += b.toString(16).padStart(2, "0");
+  return out;
+}
+function uuid() {
+  const c = globalThis.crypto;
+  if (c && typeof c.randomUUID === "function") return c.randomUUID();
+  const b = new Uint8Array(16);
+  if (c && typeof c.getRandomValues === "function") c.getRandomValues(b);
+  else for (let i = 0; i < 16; i++) b[i] = Math.floor(Math.random() * 256);
+  b[6] = b[6] & 15 | 64;
+  b[8] = b[8] & 63 | 128;
+  const h = hex(b);
+  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;
+}
+function isFiniteNumber(v) {
+  return typeof v === "number" && Number.isFinite(v);
+}
+function cleanAttrs(attrs) {
+  if (!attrs || typeof attrs !== "object") return void 0;
+  const out = {};
+  let n = 0;
+  for (const [k, v] of Object.entries(attrs)) {
+    if (n >= MAX_ATTR_KEYS) break;
+    if (v === void 0 || v === null || !k) continue;
+    let val;
+    if (typeof v === "boolean") val = v;
+    else if (typeof v === "number") {
+      if (!Number.isFinite(v)) continue;
+      val = v;
+    } else if (typeof v === "string") val = truncate(v, MAX_ATTR_STRING);
+    else continue;
+    out[truncate(k, MAX_ATTR_KEY)] = val;
+    n++;
+  }
+  return n > 0 ? out : void 0;
+}
+function sanitizeEvent(e) {
+  const out = {
+    id: typeof e.id === "string" && e.id ? e.id : uuid(),
+    type: e.type,
+    ts: isFiniteNumber(e.ts) ? Math.round(e.ts) : Date.now(),
+    name: truncate(typeof e.name === "string" && e.name ? e.name : "unknown", MAX_NAME)
+  };
+  if (isFiniteNumber(e.status) && e.status >= 100 && e.status <= 599) out.status = Math.trunc(e.status);
+  if (typeof e.ok === "boolean") out.ok = e.ok;
+  if (isFiniteNumber(e.durationMs)) out.durationMs = Math.min(864e5, Math.max(0, Math.round(e.durationMs * 10) / 10));
+  if (isFiniteNumber(e.value)) out.value = e.value;
+  if (e.error && typeof e.error.code === "string") {
+    out.error = { code: truncate(e.error.code, MAX_ERROR_CODE) };
+    if (typeof e.error.message === "string" && e.error.message) {
+      out.error.message = truncate(e.error.message, MAX_ERROR_MESSAGE);
+    }
+  }
+  if (typeof e.merchantId === "string" && e.merchantId) out.merchantId = truncate(e.merchantId, 200);
+  if (typeof e.deliveryId === "string" && e.deliveryId) out.deliveryId = truncate(e.deliveryId, 200);
+  const attrs = cleanAttrs(e.attrs);
+  if (attrs) out.attrs = attrs;
+  return out;
+}
+function joinUrl(endpoint, path) {
+  return endpoint.replace(/\/+$/, "") + path;
+}
+var encoder = typeof TextEncoder !== "undefined" ? new TextEncoder() : void 0;
+
+// src/browser.ts
+var VITALS = ["LCP", "INP", "CLS", "FCP", "TTFB"];
+var FLAG = "__kancaVitalsStarted";
+var g = globalThis;
+function reportVitals(options) {
+  try {
+    if (g[FLAG] || typeof window === "undefined" || typeof document === "undefined") return;
+    const key = typeof options?.publicKey === "string" ? options.publicKey.trim() : "";
+    const debug = !!options?.debug;
+    if (!key.startsWith("kp_")) {
+      if (debug || key) console.warn("[kanca] reportVitals(): a public key (kp_...) is required; vitals disabled.");
+      return;
+    }
+    g[FLAG] = true;
+    const url = `${joinUrl(options.endpoint || DEFAULT_ENDPOINT, "/api/ingest/browser")}?key=${encodeURIComponent(key)}`;
+    const path = location.pathname;
+    const ts = typeof performance !== "undefined" && typeof performance.timeOrigin === "number" && performance.timeOrigin > 0 ? Math.round(performance.timeOrigin) : Date.now();
+    const queue = [];
+    const seen = /* @__PURE__ */ new Set();
+    const send = () => {
+      if (!queue.length) return;
+      const events = queue.splice(0, queue.length);
+      const body = JSON.stringify({ sdk: { name: SDK_NAME, version: SDK_VERSION }, events });
+      if (debug) console.debug("[kanca] vitals", events);
+      try {
+        if (typeof fetch === "function") {
+          void fetch(url, { method: "POST", body, keepalive: true, mode: "cors", credentials: "omit", headers: { "content-type": "text/plain" } }).catch(() => void 0);
+          return;
+        }
+      } catch {
+      }
+      try {
+        if (typeof navigator !== "undefined" && typeof navigator.sendBeacon === "function") navigator.sendBeacon(url, body);
+      } catch {
+      }
+    };
+    const onMetric = (m) => {
+      try {
+        if (!VITALS.includes(m.name) || seen.has(m.name)) return;
+        seen.add(m.name);
+        queue.push(sanitizeEvent({ id: uuid(), type: "vital", ts, name: m.name, value: m.value, attrs: { path, rating: m.rating } }));
+      } catch {
+      }
+    };
+    onLCP(onMetric);
+    onINP(onMetric);
+    onCLS(onMetric);
+    onFCP(onMetric);
+    onTTFB(onMetric);
+    addEventListener(
+      "visibilitychange",
+      () => {
+        if (document.visibilityState === "hidden") queueMicrotask(send);
+      },
+      true
+    );
+    addEventListener("pagehide", send, true);
+  } catch {
+  }
+}
+function __resetVitalsForTests() {
+  g[FLAG] = false;
+}
+export {
+  __resetVitalsForTests,
+  reportVitals
+};
+//# sourceMappingURL=browser.js.map

package/dist/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/browser.ts","../src/shared.ts"],"sourcesContent":["// @kanca-app/ikas/browser — Core Web Vitals for the ikas admin iframe.\n// Sends only { name, value, rating, pathname } per metric. Uses a public key (kp_...).\n\nimport { onCLS, onFCP, onINP, onLCP, onTTFB, type Metric } from \"web-vitals\";\nimport { DEFAULT_ENDPOINT, SDK_NAME, SDK_VERSION, joinUrl, sanitizeEvent, uuid, type KancaEvent } from \"./shared\";\n\nexport interface ReportVitalsOptions {\n  /** Public key (`kp_...`). Safe to expose in the browser; only accepts `vital` events. */\n  publicKey: string | undefined;\n  /** Kanca base URL. Default `https://kanca.onurhan.dev`. */\n  endpoint?: string;\n  debug?: boolean;\n}\n\nconst VITALS = [\"LCP\", \"INP\", \"CLS\", \"FCP\", \"TTFB\"] as const;\n\n// Global (not module) flag so duplicate copies (ESM + CJS, browser + react bundles) still start once.\nconst FLAG = \"__kancaVitalsStarted\";\nconst g = globalThis as { [FLAG]?: boolean };\n\n/**\n * Starts collecting LCP, INP, CLS, FCP and TTFB (final values, once per page\n * load per metric) and sends them when the page is hidden or unloaded.\n * Safe to call more than once — only the first call has an effect.\n */\nexport function reportVitals(options: ReportVitalsOptions): void {\n  try {\n    if (g[FLAG] || typeof window === \"undefined\" || typeof document === \"undefined\") return;\n    const key = typeof options?.publicKey === \"string\" ? options.publicKey.trim() : \"\";\n    const debug = !!options?.debug;\n    if (!key.startsWith(\"kp_\")) {\n      if (debug || key) console.warn(\"[kanca] reportVitals(): a public key (kp_...) is required; vitals disabled.\");\n      return;\n    }\n    g[FLAG] = true;\n\n    const url = `${joinUrl(options.endpoint || DEFAULT_ENDPOINT, \"/api/ingest/browser\")}?key=${encodeURIComponent(key)}`;\n    const path = location.pathname;\n    const ts =\n      typeof performance !== \"undefined\" && typeof performance.timeOrigin === \"number\" && performance.timeOrigin > 0\n        ? Math.round(performance.timeOrigin)\n        : Date.now();\n    const queue: KancaEvent[] = [];\n    const seen = new Set<string>();\n\n    const send = () => {\n      if (!queue.length) return;\n      const events = queue.splice(0, queue.length);\n      const body = JSON.stringify({ sdk: { name: SDK_NAME, version: SDK_VERSION }, events });\n      if (debug) console.debug(\"[kanca] vitals\", events);\n      // fetch+keepalive first: content blockers drop sendBeacon (\"ping\") requests\n      // while sendBeacon still returns true, so vitals would vanish silently.\n      // A text/plain body keeps it a simple request (no CORS preflight).\n      try {\n        if (typeof fetch === \"function\") {\n          void fetch(url, { method: \"POST\", body, keepalive: true, mode: \"cors\", credentials: \"omit\", headers: { \"content-type\": \"text/plain\" } }).catch(() => undefined);\n          return;\n        }\n      } catch {\n        /* fall through */\n      }\n      try {\n        if (typeof navigator !== \"undefined\" && typeof navigator.sendBeacon === \"function\") navigator.sendBeacon(url, body);\n      } catch {\n        /* never throw */\n      }\n    };\n\n    const onMetric = (m: Metric) => {\n      try {\n        if (!(VITALS as readonly string[]).includes(m.name) || seen.has(m.name)) return;\n        seen.add(m.name);\n        queue.push(sanitizeEvent({ id: uuid(), type: \"vital\", ts, name: m.name, value: m.value, attrs: { path, rating: m.rating } }));\n      } catch {\n        /* ignore */\n      }\n    };\n\n    // Without reportAllChanges, web-vitals reports each metric's final value.\n    onLCP(onMetric);\n    onINP(onMetric);\n    onCLS(onMetric);\n    onFCP(onMetric);\n    onTTFB(onMetric);\n\n    // Registered after web-vitals' own listeners, so final values are queued before we send.\n    addEventListener(\n      \"visibilitychange\",\n      () => {\n        // Microtask: lets any report web-vitals triggers on this same event land first.\n        if (document.visibilityState === \"hidden\") queueMicrotask(send);\n      },\n      true,\n    );\n    addEventListener(\"pagehide\", send, true);\n  } catch {\n    /* never break the host page */\n  }\n}\n\n/** @internal for tests */\nexport function __resetVitalsForTests(): void {\n  g[FLAG] = false;\n}\n","// Shared, runtime-agnostic helpers (used by both the Node and browser entries).\n// Wire format: see docs/PROTOCOL.md (v1).\n\nexport const SDK_NAME = \"@kanca-app/ikas\";\nexport const SDK_VERSION = \"0.1.1\";\nexport const DEFAULT_ENDPOINT = \"https://kanca.onurhan.dev\";\n\nexport const MAX_NAME = 200;\nexport const MAX_ERROR_MESSAGE = 500;\nexport const MAX_ERROR_CODE = 100;\nexport const MAX_ATTR_KEYS = 20;\nexport const MAX_ATTR_STRING = 500;\nexport const MAX_ATTR_KEY = 64;\nexport const MAX_EVENTS_PER_BATCH = 500;\n/** Protocol limit is 512 KB; keep headroom for the envelope. */\nexport const MAX_BATCH_BYTES = 480 * 1024;\n\nexport type EventType = \"webhook\" | \"graphql\" | \"rest\" | \"install\" | \"uninstall\" | \"vital\";\n\nexport type AttrValue = string | number | boolean;\n\nexport interface KancaError {\n  code: string;\n  message?: string;\n}\n\n/** A single wire event (PROTOCOL.md → Event). */\nexport interface KancaEvent {\n  id: string;\n  type: EventType;\n  ts: number;\n  name: string;\n  status?: number;\n  ok?: boolean;\n  durationMs?: number;\n  value?: number;\n  error?: KancaError;\n  merchantId?: string;\n  deliveryId?: string;\n  attrs?: Record<string, AttrValue>;\n}\n\nexport interface Batch {\n  sdk: { name: string; version: string };\n  events: KancaEvent[];\n}\n\nexport function truncate(s: string, max: number): string {\n  return s.length > max ? s.slice(0, max) : s;\n}\n\nfunction hex(bytes: Uint8Array): string {\n  let out = \"\";\n  for (const b of bytes) out += b.toString(16).padStart(2, \"0\");\n  return out;\n}\n\n/** UUID v4 via crypto.randomUUID, with a getRandomValues fallback (non-secure browser contexts). */\nexport function uuid(): string {\n  const c = (globalThis as { crypto?: Crypto }).crypto;\n  if (c && typeof c.randomUUID === \"function\") return c.randomUUID();\n  const b = new Uint8Array(16);\n  if (c && typeof c.getRandomValues === \"function\") c.getRandomValues(b);\n  else for (let i = 0; i < 16; i++) b[i] = Math.floor(Math.random() * 256);\n  b[6] = (b[6]! & 0x0f) | 0x40;\n  b[8] = (b[8]! & 0x3f) | 0x80;\n  const h = hex(b);\n  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;\n}\n\nfunction isFiniteNumber(v: unknown): v is number {\n  return typeof v === \"number\" && Number.isFinite(v);\n}\n\nfunction cleanAttrs(attrs: unknown): Record<string, AttrValue> | undefined {\n  if (!attrs || typeof attrs !== \"object\") return undefined;\n  const out: Record<string, AttrValue> = {};\n  let n = 0;\n  for (const [k, v] of Object.entries(attrs as Record<string, unknown>)) {\n    if (n >= MAX_ATTR_KEYS) break;\n    if (v === undefined || v === null || !k) continue;\n    let val: AttrValue;\n    if (typeof v === \"boolean\") val = v;\n    else if (typeof v === \"number\") {\n      if (!Number.isFinite(v)) continue;\n      val = v;\n    } else if (typeof v === \"string\") val = truncate(v, MAX_ATTR_STRING);\n    else continue; // attrs are flat: nested values are dropped, never stringified\n    out[truncate(k, MAX_ATTR_KEY)] = val;\n    n++;\n  }\n  return n > 0 ? out : undefined;\n}\n\n/**\n * Normalises an event so it always satisfies the protocol limits. Unknown\n * fields are dropped — only the whitelisted metadata below ever leaves the process.\n */\nexport function sanitizeEvent(e: KancaEvent): KancaEvent {\n  const out: KancaEvent = {\n    id: typeof e.id === \"string\" && e.id ? e.id : uuid(),\n    type: e.type,\n    ts: isFiniteNumber(e.ts) ? Math.round(e.ts) : Date.now(),\n    name: truncate(typeof e.name === \"string\" && e.name ? e.name : \"unknown\", MAX_NAME),\n  };\n  if (isFiniteNumber(e.status) && e.status >= 100 && e.status <= 599) out.status = Math.trunc(e.status);\n  if (typeof e.ok === \"boolean\") out.ok = e.ok;\n  if (isFiniteNumber(e.durationMs)) out.durationMs = Math.min(86_400_000, Math.max(0, Math.round(e.durationMs * 10) / 10));\n  if (isFiniteNumber(e.value)) out.value = e.value;\n  if (e.error && typeof e.error.code === \"string\") {\n    out.error = { code: truncate(e.error.code, MAX_ERROR_CODE) };\n    if (typeof e.error.message === \"string\" && e.error.message) {\n      out.error.message = truncate(e.error.message, MAX_ERROR_MESSAGE);\n    }\n  }\n  if (typeof e.merchantId === \"string\" && e.merchantId) out.merchantId = truncate(e.merchantId, 200);\n  if (typeof e.deliveryId === \"string\" && e.deliveryId) out.deliveryId = truncate(e.deliveryId, 200);\n  const attrs = cleanAttrs(e.attrs);\n  if (attrs) out.attrs = attrs;\n  return out;\n}\n\nexport function errorMessage(err: unknown): string | undefined {\n  try {\n    if (err instanceof Error) return truncate(err.message || err.name, MAX_ERROR_MESSAGE);\n    if (typeof err === \"string\") return truncate(err, MAX_ERROR_MESSAGE);\n  } catch {\n    /* ignore */\n  }\n  return undefined;\n}\n\nexport function joinUrl(endpoint: string, path: string): string {\n  return endpoint.replace(/\\/+$/, \"\") + path;\n}\n\nconst encoder = typeof TextEncoder !== \"undefined\" ? new TextEncoder() : undefined;\nexport function byteLength(s: string): number {\n  return encoder ? encoder.encode(s).length : s.length * 3;\n}\n\n/**\n * Splits events into protocol-sized batches (<= maxEvents events and\n * <= MAX_BATCH_BYTES serialized). Returns serialized bodies.\n */\nexport function buildBodies(events: KancaEvent[], maxEvents: number): { body: string; events: KancaEvent[] }[] {\n  const sdk = { name: SDK_NAME, version: SDK_VERSION };\n  const envelope = byteLength(JSON.stringify({ sdk, events: [] }));\n  const out: { body: string; events: KancaEvent[] }[] = [];\n  let cur: KancaEvent[] = [];\n  let size = envelope;\n  const push = () => {\n    if (cur.length) out.push({ body: JSON.stringify({ sdk, events: cur } satisfies Batch), events: cur });\n    cur = [];\n    size = envelope;\n  };\n  for (const ev of events) {\n    const len = byteLength(JSON.stringify(ev)) + 1;\n    if (cur.length && (cur.length >= maxEvents || size + len > MAX_BATCH_BYTES)) push();\n    cur.push(ev);\n    size += len;\n  }\n  push();\n  return out;\n}\n"],"mappings":";AAGA,SAAS,OAAO,OAAO,OAAO,OAAO,cAA2B;;;ACAzD,IAAM,WAAW;AACjB,IAAM,cAAc;AACpB,IAAM,mBAAmB;AAEzB,IAAM,WAAW;AACjB,IAAM,oBAAoB;AAC1B,IAAM,iBAAiB;AACvB,IAAM,gBAAgB;AACtB,IAAM,kBAAkB;AACxB,IAAM,eAAe;AAGrB,IAAM,kBAAkB,MAAM;AAgC9B,SAAS,SAAS,GAAW,KAAqB;AACvD,SAAO,EAAE,SAAS,MAAM,EAAE,MAAM,GAAG,GAAG,IAAI;AAC5C;AAEA,SAAS,IAAI,OAA2B;AACtC,MAAI,MAAM;AACV,aAAW,KAAK,MAAO,QAAO,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAC5D,SAAO;AACT;AAGO,SAAS,OAAe;AAC7B,QAAM,IAAK,WAAmC;AAC9C,MAAI,KAAK,OAAO,EAAE,eAAe,WAAY,QAAO,EAAE,WAAW;AACjE,QAAM,IAAI,IAAI,WAAW,EAAE;AAC3B,MAAI,KAAK,OAAO,EAAE,oBAAoB,WAAY,GAAE,gBAAgB,CAAC;AAAA,MAChE,UAAS,IAAI,GAAG,IAAI,IAAI,IAAK,GAAE,CAAC,IAAI,KAAK,MAAM,KAAK,OAAO,IAAI,GAAG;AACvE,IAAE,CAAC,IAAK,EAAE,CAAC,IAAK,KAAQ;AACxB,IAAE,CAAC,IAAK,EAAE,CAAC,IAAK,KAAQ;AACxB,QAAM,IAAI,IAAI,CAAC;AACf,SAAO,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;AAChG;AAEA,SAAS,eAAe,GAAyB;AAC/C,SAAO,OAAO,MAAM,YAAY,OAAO,SAAS,CAAC;AACnD;AAEA,SAAS,WAAW,OAAuD;AACzE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,MAAiC,CAAC;AACxC,MAAI,IAAI;AACR,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAgC,GAAG;AACrE,QAAI,KAAK,cAAe;AACxB,QAAI,MAAM,UAAa,MAAM,QAAQ,CAAC,EAAG;AACzC,QAAI;AACJ,QAAI,OAAO,MAAM,UAAW,OAAM;AAAA,aACzB,OAAO,MAAM,UAAU;AAC9B,UAAI,CAAC,OAAO,SAAS,CAAC,EAAG;AACzB,YAAM;AAAA,IACR,WAAW,OAAO,MAAM,SAAU,OAAM,SAAS,GAAG,eAAe;AAAA,QAC9D;AACL,QAAI,SAAS,GAAG,YAAY,CAAC,IAAI;AACjC;AAAA,EACF;AACA,SAAO,IAAI,IAAI,MAAM;AACvB;AAMO,SAAS,cAAc,GAA2B;AACvD,QAAM,MAAkB;AAAA,IACtB,IAAI,OAAO,EAAE,OAAO,YAAY,EAAE,KAAK,EAAE,KAAK,KAAK;AAAA,IACnD,MAAM,EAAE;AAAA,IACR,IAAI,eAAe,EAAE,EAAE,IAAI,KAAK,MAAM,EAAE,EAAE,IAAI,KAAK,IAAI;AAAA,IACvD,MAAM,SAAS,OAAO,EAAE,SAAS,YAAY,EAAE,OAAO,EAAE,OAAO,WAAW,QAAQ;AAAA,EACpF;AACA,MAAI,eAAe,EAAE,MAAM,KAAK,EAAE,UAAU,OAAO,EAAE,UAAU,IAAK,KAAI,SAAS,KAAK,MAAM,EAAE,MAAM;AACpG,MAAI,OAAO,EAAE,OAAO,UAAW,KAAI,KAAK,EAAE;AAC1C,MAAI,eAAe,EAAE,UAAU,EAAG,KAAI,aAAa,KAAK,IAAI,OAAY,KAAK,IAAI,GAAG,KAAK,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AACvH,MAAI,eAAe,EAAE,KAAK,EAAG,KAAI,QAAQ,EAAE;AAC3C,MAAI,EAAE,SAAS,OAAO,EAAE,MAAM,SAAS,UAAU;AAC/C,QAAI,QAAQ,EAAE,MAAM,SAAS,EAAE,MAAM,MAAM,cAAc,EAAE;AAC3D,QAAI,OAAO,EAAE,MAAM,YAAY,YAAY,EAAE,MAAM,SAAS;AAC1D,UAAI,MAAM,UAAU,SAAS,EAAE,MAAM,SAAS,iBAAiB;AAAA,IACjE;AAAA,EACF;AACA,MAAI,OAAO,EAAE,eAAe,YAAY,EAAE,WAAY,KAAI,aAAa,SAAS,EAAE,YAAY,GAAG;AACjG,MAAI,OAAO,EAAE,eAAe,YAAY,EAAE,WAAY,KAAI,aAAa,SAAS,EAAE,YAAY,GAAG;AACjG,QAAM,QAAQ,WAAW,EAAE,KAAK;AAChC,MAAI,MAAO,KAAI,QAAQ;AACvB,SAAO;AACT;AAYO,SAAS,QAAQ,UAAkB,MAAsB;AAC9D,SAAO,SAAS,QAAQ,QAAQ,EAAE,IAAI;AACxC;AAEA,IAAM,UAAU,OAAO,gBAAgB,cAAc,IAAI,YAAY,IAAI;;;AD1HzE,IAAM,SAAS,CAAC,OAAO,OAAO,OAAO,OAAO,MAAM;AAGlD,IAAM,OAAO;AACb,IAAM,IAAI;AAOH,SAAS,aAAa,SAAoC;AAC/D,MAAI;AACF,QAAI,EAAE,IAAI,KAAK,OAAO,WAAW,eAAe,OAAO,aAAa,YAAa;AACjF,UAAM,MAAM,OAAO,SAAS,cAAc,WAAW,QAAQ,UAAU,KAAK,IAAI;AAChF,UAAM,QAAQ,CAAC,CAAC,SAAS;AACzB,QAAI,CAAC,IAAI,WAAW,KAAK,GAAG;AAC1B,UAAI,SAAS,IAAK,SAAQ,KAAK,6EAA6E;AAC5G;AAAA,IACF;AACA,MAAE,IAAI,IAAI;AAEV,UAAM,MAAM,GAAG,QAAQ,QAAQ,YAAY,kBAAkB,qBAAqB,CAAC,QAAQ,mBAAmB,GAAG,CAAC;AAClH,UAAM,OAAO,SAAS;AACtB,UAAM,KACJ,OAAO,gBAAgB,eAAe,OAAO,YAAY,eAAe,YAAY,YAAY,aAAa,IACzG,KAAK,MAAM,YAAY,UAAU,IACjC,KAAK,IAAI;AACf,UAAM,QAAsB,CAAC;AAC7B,UAAM,OAAO,oBAAI,IAAY;AAE7B,UAAM,OAAO,MAAM;AACjB,UAAI,CAAC,MAAM,OAAQ;AACnB,YAAM,SAAS,MAAM,OAAO,GAAG,MAAM,MAAM;AAC3C,YAAM,OAAO,KAAK,UAAU,EAAE,KAAK,EAAE,MAAM,UAAU,SAAS,YAAY,GAAG,OAAO,CAAC;AACrF,UAAI,MAAO,SAAQ,MAAM,kBAAkB,MAAM;AAIjD,UAAI;AACF,YAAI,OAAO,UAAU,YAAY;AAC/B,eAAK,MAAM,KAAK,EAAE,QAAQ,QAAQ,MAAM,WAAW,MAAM,MAAM,QAAQ,aAAa,QAAQ,SAAS,EAAE,gBAAgB,aAAa,EAAE,CAAC,EAAE,MAAM,MAAM,MAAS;AAC9J;AAAA,QACF;AAAA,MACF,QAAQ;AAAA,MAER;AACA,UAAI;AACF,YAAI,OAAO,cAAc,eAAe,OAAO,UAAU,eAAe,WAAY,WAAU,WAAW,KAAK,IAAI;AAAA,MACpH,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,UAAM,WAAW,CAAC,MAAc;AAC9B,UAAI;AACF,YAAI,CAAE,OAA6B,SAAS,EAAE,IAAI,KAAK,KAAK,IAAI,EAAE,IAAI,EAAG;AACzE,aAAK,IAAI,EAAE,IAAI;AACf,cAAM,KAAK,cAAc,EAAE,IAAI,KAAK,GAAG,MAAM,SAAS,IAAI,MAAM,EAAE,MAAM,OAAO,EAAE,OAAO,OAAO,EAAE,MAAM,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;AAAA,MAC9H,QAAQ;AAAA,MAER;AAAA,IACF;AAGA,UAAM,QAAQ;AACd,UAAM,QAAQ;AACd,UAAM,QAAQ;AACd,UAAM,QAAQ;AACd,WAAO,QAAQ;AAGf;AAAA,MACE;AAAA,MACA,MAAM;AAEJ,YAAI,SAAS,oBAAoB,SAAU,gBAAe,IAAI;AAAA,MAChE;AAAA,MACA;AAAA,IACF;AACA,qBAAiB,YAAY,MAAM,IAAI;AAAA,EACzC,QAAQ;AAAA,EAER;AACF;AAGO,SAAS,wBAA8B;AAC5C,IAAE,IAAI,IAAI;AACZ;","names":[]}