@kanca-app/ikas 0.2.0 → 0.3.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Kanca
+Copyright (c) 2026 Onurhan Demir
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -23,7 +23,7 @@ pnpm add @kanca-app/ikas
 
 Without `KANCA_KEY` the SDK is a silent no-op, so local dev and CI need no setup.
 
-## Integrate the ikas starter app (3 steps)
+## Integrate the ikas starter app (5 steps)
 
 Create the client once — `src/lib/kanca.ts`:
 
@@ -37,12 +37,8 @@ export const kanca = createKanca({ key: process.env.KANCA_KEY });
 Wrap your route handler. Each delivery records scope, delivery id, merchant id,
 your response status and duration.
 
-Uninstalls: ikas does not document an app-uninstall webhook scope. If a
-`store/app/deleted`, `store/app/uninstalled` or `store/authorizedApp/deleted`
-delivery ever arrives, the SDK records it as an uninstall too. Kanca
-additionally infers **access revoked** for a store when its Admin API calls
-keep failing with an authorization error (see step 3 and
-[`docs/PROTOCOL.md`](../../docs/PROTOCOL.md)).
+ikas has no app-uninstall webhook, so no scope is recorded as an uninstall:
+see step 4.
 
 ```ts
 import { kanca } from '@/lib/kanca';
@@ -107,9 +103,62 @@ uninstall event. `kanca.fetch` calls carry no merchant id, so they don't count.
 const res = await kanca.fetch('https://api.myikas.com/api/v1/admin/graphql', { method: 'POST', headers, body });
 ```
 
-ikas GraphQL URLs (`*.myikas.com/…graphql`) become `graphql` events; any other URL
+ikas GraphQL URLs (`*.myikas.com/…graphql`) become `graphql` events; the ikas OAuth
+token endpoint becomes `oauth:refresh` / `oauth:token` (step 5); any other URL
 becomes a `rest` event named `"POST api.example.com/v1/items"` (no query string).
 
+### 4. Uninstalls — a daily job
+
+ikas has no app-uninstall webhook (`saveWebhooks` rejects `store/app/*` scopes
+with `INVALID_SCOPE`). After a merchant removes the app, its access token keeps
+working but `getAuthorizedApp` returns `null`. `checkInstall` asks exactly
+that, twice, 3 s apart, and records an `uninstall` only when both answers are
+`null`. Network errors, 401, 403, 429 and 5xx never count.
+
+```ts
+const result = await kanca.checkInstall(getIkas(token), { merchantId: token.merchantId });
+if (result.state === 'uninstalled') await removeStore(token); // your cleanup
+```
+
+For a cron over all stores use `checkInstalls`. It refuses to record anything
+when at least 5 stores and more than half of them look uninstalled at once
+(an ikas-side problem must not wipe every store); those come back as `unknown`
+with reason `MASS_REVOCATION`.
+
+```ts
+const tokens = await listStoreTokens(); // your stored tokens
+const { results, massRevocation } = await kanca.checkInstalls(
+  tokens.map((token) => ({ merchantId: token.merchantId, client: getIkas(token) })),
+  { concurrency: 3 },
+);
+for (const r of results) if (r.state === 'uninstalled') await removeStore(r.merchantId);
+await kanca.flush();
+```
+
+Each result is `{ merchantId, state: 'installed' | 'uninstalled' | 'unknown', reason? }`
+and never throws. Stop checking a store once it is `uninstalled` (e.g. delete
+its token): every `uninstalled` result records a new uninstall. Without
+`KANCA_KEY` the check still runs and returns results; nothing is sent. With an
+instrumented client the probe is also recorded as a `getAuthorizedApp` call.
+
+### 5. Token refreshes — `src/helpers/api-helpers.ts`
+
+`@ikas/admin-api-client` calls the global `fetch` for OAuth, so wrap the refresh:
+
+```ts
+const response = await kanca.trackRefresh(
+  () => OAuthAPI.refreshToken({ refresh_token: token.refreshToken, client_id, client_secret }, { storeName: 'api' }),
+  { merchantId: token.merchantId },
+);
+```
+
+The result and any error pass through unchanged. It is recorded as a `rest`
+event named `oauth:refresh` with the HTTP status, duration and, on failure, the
+OAuth error code (`invalid_grant`, …) or `HTTP_<status>` / `NETWORK`. Tokens,
+the client secret and the response body are never read or sent. Calls you make
+through `kanca.fetch` to `https://<store>.myikas.com/api/admin/oauth/token` are
+recorded the same way.
+
 Full example files: [`examples/starter-app`](./examples/starter-app).
 
 ## Admin UI web vitals
@@ -234,9 +283,9 @@ attempts). Every event has a UUID, so retries never double count.
 ## Privacy
 
 What is sent: event type, name (webhook scope / GraphQL operation name /
-`METHOD host/path`), HTTP status, ok, duration, error code, error message
-(≤ 500 chars), merchant id, webhook delivery id, and for installs the store
-name. Vitals send metric name, value, rating and pathname. For storefront
+`METHOD host/path` / `oauth:refresh`), HTTP status, ok, duration, error code,
+error message (≤ 500 chars; never for OAuth calls), merchant id, webhook
+delivery id, and for installs and OAuth calls the store name. Vitals send metric name, value, rating and pathname. For storefront
 events see [Storefront script](#storefront-script).
 
 What is never sent: webhook bodies, the webhook signature, GraphQL queries,
@@ -251,9 +300,10 @@ customer or order data. Kanca never asks for your ikas client secret.
 - For `instrument()`, `@ikas/admin-api-client` does not expose the HTTP status
   of successful calls, so those events carry `ok: true` without a status. Use
   `kanca.fetch` if you need exact statuses.
-- ikas does not document an app-uninstall webhook, so uninstall events may
-  never arrive. "Access revoked" is inferred from Admin API authorization
-  failures and only appears once your app calls the Admin API for that store.
+- ikas has no app-uninstall webhook, so uninstalls only arrive if you run
+  `checkInstall` / `checkInstalls` (step 4). "Access revoked" is inferred
+  from Admin API authorization failures and only appears once your app calls the
+  Admin API for that store; a removed app's token may keep working.
 - Events buffered in memory are lost if the process is killed hard (SIGKILL,
   OOM) before the next send.
 

package/dist/browser.cjs

@@ -28,7 +28,7 @@ var import_web_vitals = require("web-vitals");
 
 // src/shared.ts
 var SDK_NAME = "@kanca-app/ikas";
-var SDK_VERSION = "0.2.0";
+var SDK_VERSION = "0.3.0";
 var DEFAULT_ENDPOINT = "https://kanca.onurhan.dev";
 var MAX_NAME = 200;
 var MAX_ERROR_MESSAGE = 500;

package/dist/browser.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/browser.ts","../src/shared.ts"],"sourcesContent":["// @kanca-app/ikas/browser — Core Web Vitals for the ikas admin iframe.\n// Sends only { name, value, rating, pathname } per metric. Uses a public key (kp_...).\n\nimport { onCLS, onFCP, onINP, onLCP, onTTFB, type Metric } from \"web-vitals\";\nimport { DEFAULT_ENDPOINT, SDK_NAME, SDK_VERSION, joinUrl, sanitizeEvent, uuid, type KancaEvent } from \"./shared\";\n\nexport interface ReportVitalsOptions {\n  /** Public key (`kp_...`). Safe to expose in the browser; only accepts `vital` events. */\n  publicKey: string | undefined;\n  /** Kanca base URL. Default `https://kanca.onurhan.dev`. */\n  endpoint?: string;\n  debug?: boolean;\n}\n\nconst VITALS = [\"LCP\", \"INP\", \"CLS\", \"FCP\", \"TTFB\"] as const;\n\n// Global (not module) flag so duplicate copies (ESM + CJS, browser + react bundles) still start once.\nconst FLAG = \"__kancaVitalsStarted\";\nconst g = globalThis as { [FLAG]?: boolean };\n\n/**\n * Starts collecting LCP, INP, CLS, FCP and TTFB (final values, once per page\n * load per metric) and sends them when the page is hidden or unloaded.\n * Safe to call more than once — only the first call has an effect.\n */\nexport function reportVitals(options: ReportVitalsOptions): void {\n  try {\n    if (g[FLAG] || typeof window === \"undefined\" || typeof document === \"undefined\") return;\n    const key = typeof options?.publicKey === \"string\" ? options.publicKey.trim() : \"\";\n    const debug = !!options?.debug;\n    if (!key.startsWith(\"kp_\")) {\n      if (debug || key) console.warn(\"[kanca] reportVitals(): a public key (kp_...) is required; vitals disabled.\");\n      return;\n    }\n    g[FLAG] = true;\n\n    const url = `${joinUrl(options.endpoint || DEFAULT_ENDPOINT, \"/api/ingest/browser\")}?key=${encodeURIComponent(key)}`;\n    const path = location.pathname;\n    const ts =\n      typeof performance !== \"undefined\" && typeof performance.timeOrigin === \"number\" && performance.timeOrigin > 0\n        ? Math.round(performance.timeOrigin)\n        : Date.now();\n    const queue: KancaEvent[] = [];\n    const seen = new Set<string>();\n\n    const send = () => {\n      if (!queue.length) return;\n      const events = queue.splice(0, queue.length);\n      const body = JSON.stringify({ sdk: { name: SDK_NAME, version: SDK_VERSION }, events });\n      if (debug) console.debug(\"[kanca] vitals\", events);\n      // fetch+keepalive first: content blockers drop sendBeacon (\"ping\") requests\n      // while sendBeacon still returns true, so vitals would vanish silently.\n      // A text/plain body keeps it a simple request (no CORS preflight).\n      try {\n        if (typeof fetch === \"function\") {\n          void fetch(url, { method: \"POST\", body, keepalive: true, mode: \"cors\", credentials: \"omit\", headers: { \"content-type\": \"text/plain\" } }).catch(() => undefined);\n          return;\n        }\n      } catch {\n        /* fall through */\n      }\n      try {\n        if (typeof navigator !== \"undefined\" && typeof navigator.sendBeacon === \"function\") navigator.sendBeacon(url, body);\n      } catch {\n        /* never throw */\n      }\n    };\n\n    const onMetric = (m: Metric) => {\n      try {\n        if (!(VITALS as readonly string[]).includes(m.name) || seen.has(m.name)) return;\n        seen.add(m.name);\n        queue.push(sanitizeEvent({ id: uuid(), type: \"vital\", ts, name: m.name, value: m.value, attrs: { path, rating: m.rating } }));\n      } catch {\n        /* ignore */\n      }\n    };\n\n    // Without reportAllChanges, web-vitals reports each metric's final value.\n    onLCP(onMetric);\n    onINP(onMetric);\n    onCLS(onMetric);\n    onFCP(onMetric);\n    onTTFB(onMetric);\n\n    // Registered after web-vitals' own listeners, so final values are queued before we send.\n    addEventListener(\n      \"visibilitychange\",\n      () => {\n        // Microtask: lets any report web-vitals triggers on this same event land first.\n        if (document.visibilityState === \"hidden\") queueMicrotask(send);\n      },\n      true,\n    );\n    addEventListener(\"pagehide\", send, true);\n  } catch {\n    /* never break the host page */\n  }\n}\n\n/** @internal for tests */\nexport function __resetVitalsForTests(): void {\n  g[FLAG] = false;\n}\n","// Shared, runtime-agnostic helpers (used by both the Node and browser entries).\n// Wire format: see docs/PROTOCOL.md (v1).\n\nexport const SDK_NAME = \"@kanca-app/ikas\";\nexport const SDK_VERSION = \"0.2.0\";\nexport const DEFAULT_ENDPOINT = \"https://kanca.onurhan.dev\";\n\nexport const MAX_NAME = 200;\nexport const MAX_ERROR_MESSAGE = 500;\nexport const MAX_ERROR_CODE = 100;\nexport const MAX_ATTR_KEYS = 20;\nexport const MAX_ATTR_STRING = 500;\nexport const MAX_ATTR_KEY = 64;\nexport const MAX_EVENTS_PER_BATCH = 500;\n/** Protocol limit is 512 KB; keep headroom for the envelope. */\nexport const MAX_BATCH_BYTES = 480 * 1024;\n\nexport type EventType = \"webhook\" | \"graphql\" | \"rest\" | \"install\" | \"uninstall\" | \"vital\" | \"storefront\";\n\nexport type AttrValue = string | number | boolean;\n\nexport interface KancaError {\n  code: string;\n  message?: string;\n}\n\n/** A single wire event (PROTOCOL.md → Event). */\nexport interface KancaEvent {\n  id: string;\n  type: EventType;\n  ts: number;\n  name: string;\n  status?: number;\n  ok?: boolean;\n  durationMs?: number;\n  value?: number;\n  error?: KancaError;\n  merchantId?: string;\n  deliveryId?: string;\n  attrs?: Record<string, AttrValue>;\n}\n\nexport interface Batch {\n  sdk: { name: string; version: string };\n  events: KancaEvent[];\n}\n\nexport function truncate(s: string, max: number): string {\n  return s.length > max ? s.slice(0, max) : s;\n}\n\nfunction hex(bytes: Uint8Array): string {\n  let out = \"\";\n  for (const b of bytes) out += b.toString(16).padStart(2, \"0\");\n  return out;\n}\n\n/** UUID v4 via crypto.randomUUID, with a getRandomValues fallback (non-secure browser contexts). */\nexport function uuid(): string {\n  const c = (globalThis as { crypto?: Crypto }).crypto;\n  if (c && typeof c.randomUUID === \"function\") return c.randomUUID();\n  const b = new Uint8Array(16);\n  if (c && typeof c.getRandomValues === \"function\") c.getRandomValues(b);\n  else for (let i = 0; i < 16; i++) b[i] = Math.floor(Math.random() * 256);\n  b[6] = (b[6]! & 0x0f) | 0x40;\n  b[8] = (b[8]! & 0x3f) | 0x80;\n  const h = hex(b);\n  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;\n}\n\nfunction isFiniteNumber(v: unknown): v is number {\n  return typeof v === \"number\" && Number.isFinite(v);\n}\n\nfunction cleanAttrs(attrs: unknown): Record<string, AttrValue> | undefined {\n  if (!attrs || typeof attrs !== \"object\") return undefined;\n  const out: Record<string, AttrValue> = {};\n  let n = 0;\n  for (const [k, v] of Object.entries(attrs as Record<string, unknown>)) {\n    if (n >= MAX_ATTR_KEYS) break;\n    if (v === undefined || v === null || !k) continue;\n    let val: AttrValue;\n    if (typeof v === \"boolean\") val = v;\n    else if (typeof v === \"number\") {\n      if (!Number.isFinite(v)) continue;\n      val = v;\n    } else if (typeof v === \"string\") val = truncate(v, MAX_ATTR_STRING);\n    else continue; // attrs are flat: nested values are dropped, never stringified\n    out[truncate(k, MAX_ATTR_KEY)] = val;\n    n++;\n  }\n  return n > 0 ? out : undefined;\n}\n\n/**\n * Normalises an event so it always satisfies the protocol limits. Unknown\n * fields are dropped — only the whitelisted metadata below ever leaves the process.\n */\nexport function sanitizeEvent(e: KancaEvent): KancaEvent {\n  const out: KancaEvent = {\n    id: typeof e.id === \"string\" && e.id ? e.id : uuid(),\n    type: e.type,\n    ts: isFiniteNumber(e.ts) ? Math.round(e.ts) : Date.now(),\n    name: truncate(typeof e.name === \"string\" && e.name ? e.name : \"unknown\", MAX_NAME),\n  };\n  if (isFiniteNumber(e.status) && e.status >= 100 && e.status <= 599) out.status = Math.trunc(e.status);\n  if (typeof e.ok === \"boolean\") out.ok = e.ok;\n  if (isFiniteNumber(e.durationMs)) out.durationMs = Math.min(86_400_000, Math.max(0, Math.round(e.durationMs * 10) / 10));\n  if (isFiniteNumber(e.value)) out.value = e.value;\n  if (e.error && typeof e.error.code === \"string\") {\n    out.error = { code: truncate(e.error.code, MAX_ERROR_CODE) };\n    if (typeof e.error.message === \"string\" && e.error.message) {\n      out.error.message = truncate(e.error.message, MAX_ERROR_MESSAGE);\n    }\n  }\n  if (typeof e.merchantId === \"string\" && e.merchantId) out.merchantId = truncate(e.merchantId, 200);\n  if (typeof e.deliveryId === \"string\" && e.deliveryId) out.deliveryId = truncate(e.deliveryId, 200);\n  const attrs = cleanAttrs(e.attrs);\n  if (attrs) out.attrs = attrs;\n  return out;\n}\n\nexport function errorMessage(err: unknown): string | undefined {\n  try {\n    if (err instanceof Error) return truncate(err.message || err.name, MAX_ERROR_MESSAGE);\n    if (typeof err === \"string\") return truncate(err, MAX_ERROR_MESSAGE);\n  } catch {\n    /* ignore */\n  }\n  return undefined;\n}\n\nexport function joinUrl(endpoint: string, path: string): string {\n  return endpoint.replace(/\\/+$/, \"\") + path;\n}\n\nconst encoder = typeof TextEncoder !== \"undefined\" ? /* @__PURE__ */ new TextEncoder() : undefined;\nexport function byteLength(s: string): number {\n  return encoder ? encoder.encode(s).length : s.length * 3;\n}\n\n/**\n * Splits events into protocol-sized batches (<= maxEvents events and\n * <= MAX_BATCH_BYTES serialized). Returns serialized bodies.\n */\nexport function buildBodies(events: KancaEvent[], maxEvents: number): { body: string; events: KancaEvent[] }[] {\n  const sdk = { name: SDK_NAME, version: SDK_VERSION };\n  const envelope = byteLength(JSON.stringify({ sdk, events: [] }));\n  const out: { body: string; events: KancaEvent[] }[] = [];\n  let cur: KancaEvent[] = [];\n  let size = envelope;\n  const push = () => {\n    if (cur.length) out.push({ body: JSON.stringify({ sdk, events: cur } satisfies Batch), events: cur });\n    cur = [];\n    size = envelope;\n  };\n  for (const ev of events) {\n    const len = byteLength(JSON.stringify(ev)) + 1;\n    if (cur.length && (cur.length >= maxEvents || size + len > MAX_BATCH_BYTES)) push();\n    cur.push(ev);\n    size += len;\n  }\n  push();\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAGA,wBAAgE;;;ACAzD,IAAM,WAAW;AACjB,IAAM,cAAc;AACpB,IAAM,mBAAmB;AAEzB,IAAM,WAAW;AACjB,IAAM,oBAAoB;AAC1B,IAAM,iBAAiB;AACvB,IAAM,gBAAgB;AACtB,IAAM,kBAAkB;AACxB,IAAM,eAAe;AAGrB,IAAM,kBAAkB,MAAM;AAgC9B,SAAS,SAAS,GAAW,KAAqB;AACvD,SAAO,EAAE,SAAS,MAAM,EAAE,MAAM,GAAG,GAAG,IAAI;AAC5C;AAEA,SAAS,IAAI,OAA2B;AACtC,MAAI,MAAM;AACV,aAAW,KAAK,MAAO,QAAO,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAC5D,SAAO;AACT;AAGO,SAAS,OAAe;AAC7B,QAAM,IAAK,WAAmC;AAC9C,MAAI,KAAK,OAAO,EAAE,eAAe,WAAY,QAAO,EAAE,WAAW;AACjE,QAAM,IAAI,IAAI,WAAW,EAAE;AAC3B,MAAI,KAAK,OAAO,EAAE,oBAAoB,WAAY,GAAE,gBAAgB,CAAC;AAAA,MAChE,UAAS,IAAI,GAAG,IAAI,IAAI,IAAK,GAAE,CAAC,IAAI,KAAK,MAAM,KAAK,OAAO,IAAI,GAAG;AACvE,IAAE,CAAC,IAAK,EAAE,CAAC,IAAK,KAAQ;AACxB,IAAE,CAAC,IAAK,EAAE,CAAC,IAAK,KAAQ;AACxB,QAAM,IAAI,IAAI,CAAC;AACf,SAAO,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;AAChG;AAEA,SAAS,eAAe,GAAyB;AAC/C,SAAO,OAAO,MAAM,YAAY,OAAO,SAAS,CAAC;AACnD;AAEA,SAAS,WAAW,OAAuD;AACzE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,MAAiC,CAAC;AACxC,MAAI,IAAI;AACR,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAgC,GAAG;AACrE,QAAI,KAAK,cAAe;AACxB,QAAI,MAAM,UAAa,MAAM,QAAQ,CAAC,EAAG;AACzC,QAAI;AACJ,QAAI,OAAO,MAAM,UAAW,OAAM;AAAA,aACzB,OAAO,MAAM,UAAU;AAC9B,UAAI,CAAC,OAAO,SAAS,CAAC,EAAG;AACzB,YAAM;AAAA,IACR,WAAW,OAAO,MAAM,SAAU,OAAM,SAAS,GAAG,eAAe;AAAA,QAC9D;AACL,QAAI,SAAS,GAAG,YAAY,CAAC,IAAI;AACjC;AAAA,EACF;AACA,SAAO,IAAI,IAAI,MAAM;AACvB;AAMO,SAAS,cAAc,GAA2B;AACvD,QAAM,MAAkB;AAAA,IACtB,IAAI,OAAO,EAAE,OAAO,YAAY,EAAE,KAAK,EAAE,KAAK,KAAK;AAAA,IACnD,MAAM,EAAE;AAAA,IACR,IAAI,eAAe,EAAE,EAAE,IAAI,KAAK,MAAM,EAAE,EAAE,IAAI,KAAK,IAAI;AAAA,IACvD,MAAM,SAAS,OAAO,EAAE,SAAS,YAAY,EAAE,OAAO,EAAE,OAAO,WAAW,QAAQ;AAAA,EACpF;AACA,MAAI,eAAe,EAAE,MAAM,KAAK,EAAE,UAAU,OAAO,EAAE,UAAU,IAAK,KAAI,SAAS,KAAK,MAAM,EAAE,MAAM;AACpG,MAAI,OAAO,EAAE,OAAO,UAAW,KAAI,KAAK,EAAE;AAC1C,MAAI,eAAe,EAAE,UAAU,EAAG,KAAI,aAAa,KAAK,IAAI,OAAY,KAAK,IAAI,GAAG,KAAK,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AACvH,MAAI,eAAe,EAAE,KAAK,EAAG,KAAI,QAAQ,EAAE;AAC3C,MAAI,EAAE,SAAS,OAAO,EAAE,MAAM,SAAS,UAAU;AAC/C,QAAI,QAAQ,EAAE,MAAM,SAAS,EAAE,MAAM,MAAM,cAAc,EAAE;AAC3D,QAAI,OAAO,EAAE,MAAM,YAAY,YAAY,EAAE,MAAM,SAAS;AAC1D,UAAI,MAAM,UAAU,SAAS,EAAE,MAAM,SAAS,iBAAiB;AAAA,IACjE;AAAA,EACF;AACA,MAAI,OAAO,EAAE,eAAe,YAAY,EAAE,WAAY,KAAI,aAAa,SAAS,EAAE,YAAY,GAAG;AACjG,MAAI,OAAO,EAAE,eAAe,YAAY,EAAE,WAAY,KAAI,aAAa,SAAS,EAAE,YAAY,GAAG;AACjG,QAAM,QAAQ,WAAW,EAAE,KAAK;AAChC,MAAI,MAAO,KAAI,QAAQ;AACvB,SAAO;AACT;AAYO,SAAS,QAAQ,UAAkB,MAAsB;AAC9D,SAAO,SAAS,QAAQ,QAAQ,EAAE,IAAI;AACxC;;;ADxHA,IAAM,SAAS,CAAC,OAAO,OAAO,OAAO,OAAO,MAAM;AAGlD,IAAM,OAAO;AACb,IAAM,IAAI;AAOH,SAAS,aAAa,SAAoC;AAC/D,MAAI;AACF,QAAI,EAAE,IAAI,KAAK,OAAO,WAAW,eAAe,OAAO,aAAa,YAAa;AACjF,UAAM,MAAM,OAAO,SAAS,cAAc,WAAW,QAAQ,UAAU,KAAK,IAAI;AAChF,UAAM,QAAQ,CAAC,CAAC,SAAS;AACzB,QAAI,CAAC,IAAI,WAAW,KAAK,GAAG;AAC1B,UAAI,SAAS,IAAK,SAAQ,KAAK,6EAA6E;AAC5G;AAAA,IACF;AACA,MAAE,IAAI,IAAI;AAEV,UAAM,MAAM,GAAG,QAAQ,QAAQ,YAAY,kBAAkB,qBAAqB,CAAC,QAAQ,mBAAmB,GAAG,CAAC;AAClH,UAAM,OAAO,SAAS;AACtB,UAAM,KACJ,OAAO,gBAAgB,eAAe,OAAO,YAAY,eAAe,YAAY,YAAY,aAAa,IACzG,KAAK,MAAM,YAAY,UAAU,IACjC,KAAK,IAAI;AACf,UAAM,QAAsB,CAAC;AAC7B,UAAM,OAAO,oBAAI,IAAY;AAE7B,UAAM,OAAO,MAAM;AACjB,UAAI,CAAC,MAAM,OAAQ;AACnB,YAAM,SAAS,MAAM,OAAO,GAAG,MAAM,MAAM;AAC3C,YAAM,OAAO,KAAK,UAAU,EAAE,KAAK,EAAE,MAAM,UAAU,SAAS,YAAY,GAAG,OAAO,CAAC;AACrF,UAAI,MAAO,SAAQ,MAAM,kBAAkB,MAAM;AAIjD,UAAI;AACF,YAAI,OAAO,UAAU,YAAY;AAC/B,eAAK,MAAM,KAAK,EAAE,QAAQ,QAAQ,MAAM,WAAW,MAAM,MAAM,QAAQ,aAAa,QAAQ,SAAS,EAAE,gBAAgB,aAAa,EAAE,CAAC,EAAE,MAAM,MAAM,MAAS;AAC9J;AAAA,QACF;AAAA,MACF,QAAQ;AAAA,MAER;AACA,UAAI;AACF,YAAI,OAAO,cAAc,eAAe,OAAO,UAAU,eAAe,WAAY,WAAU,WAAW,KAAK,IAAI;AAAA,MACpH,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,UAAM,WAAW,CAAC,MAAc;AAC9B,UAAI;AACF,YAAI,CAAE,OAA6B,SAAS,EAAE,IAAI,KAAK,KAAK,IAAI,EAAE,IAAI,EAAG;AACzE,aAAK,IAAI,EAAE,IAAI;AACf,cAAM,KAAK,cAAc,EAAE,IAAI,KAAK,GAAG,MAAM,SAAS,IAAI,MAAM,EAAE,MAAM,OAAO,EAAE,OAAO,OAAO,EAAE,MAAM,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;AAAA,MAC9H,QAAQ;AAAA,MAER;AAAA,IACF;AAGA,iCAAM,QAAQ;AACd,iCAAM,QAAQ;AACd,iCAAM,QAAQ;AACd,iCAAM,QAAQ;AACd,kCAAO,QAAQ;AAGf;AAAA,MACE;AAAA,MACA,MAAM;AAEJ,YAAI,SAAS,oBAAoB,SAAU,gBAAe,IAAI;AAAA,MAChE;AAAA,MACA;AAAA,IACF;AACA,qBAAiB,YAAY,MAAM,IAAI;AAAA,EACzC,QAAQ;AAAA,EAER;AACF;AAGO,SAAS,wBAA8B;AAC5C,IAAE,IAAI,IAAI;AACZ;","names":[]}
+{"version":3,"sources":["../src/browser.ts","../src/shared.ts"],"sourcesContent":["// @kanca-app/ikas/browser — Core Web Vitals for the ikas admin iframe.\n// Sends only { name, value, rating, pathname } per metric. Uses a public key (kp_...).\n\nimport { onCLS, onFCP, onINP, onLCP, onTTFB, type Metric } from \"web-vitals\";\nimport { DEFAULT_ENDPOINT, SDK_NAME, SDK_VERSION, joinUrl, sanitizeEvent, uuid, type KancaEvent } from \"./shared\";\n\nexport interface ReportVitalsOptions {\n  /** Public key (`kp_...`). Safe to expose in the browser; only accepts `vital` events. */\n  publicKey: string | undefined;\n  /** Kanca base URL. Default `https://kanca.onurhan.dev`. */\n  endpoint?: string;\n  debug?: boolean;\n}\n\nconst VITALS = [\"LCP\", \"INP\", \"CLS\", \"FCP\", \"TTFB\"] as const;\n\n// Global (not module) flag so duplicate copies (ESM + CJS, browser + react bundles) still start once.\nconst FLAG = \"__kancaVitalsStarted\";\nconst g = globalThis as { [FLAG]?: boolean };\n\n/**\n * Starts collecting LCP, INP, CLS, FCP and TTFB (final values, once per page\n * load per metric) and sends them when the page is hidden or unloaded.\n * Safe to call more than once — only the first call has an effect.\n */\nexport function reportVitals(options: ReportVitalsOptions): void {\n  try {\n    if (g[FLAG] || typeof window === \"undefined\" || typeof document === \"undefined\") return;\n    const key = typeof options?.publicKey === \"string\" ? options.publicKey.trim() : \"\";\n    const debug = !!options?.debug;\n    if (!key.startsWith(\"kp_\")) {\n      if (debug || key) console.warn(\"[kanca] reportVitals(): a public key (kp_...) is required; vitals disabled.\");\n      return;\n    }\n    g[FLAG] = true;\n\n    const url = `${joinUrl(options.endpoint || DEFAULT_ENDPOINT, \"/api/ingest/browser\")}?key=${encodeURIComponent(key)}`;\n    const path = location.pathname;\n    const ts =\n      typeof performance !== \"undefined\" && typeof performance.timeOrigin === \"number\" && performance.timeOrigin > 0\n        ? Math.round(performance.timeOrigin)\n        : Date.now();\n    const queue: KancaEvent[] = [];\n    const seen = new Set<string>();\n\n    const send = () => {\n      if (!queue.length) return;\n      const events = queue.splice(0, queue.length);\n      const body = JSON.stringify({ sdk: { name: SDK_NAME, version: SDK_VERSION }, events });\n      if (debug) console.debug(\"[kanca] vitals\", events);\n      // fetch+keepalive first: content blockers drop sendBeacon (\"ping\") requests\n      // while sendBeacon still returns true, so vitals would vanish silently.\n      // A text/plain body keeps it a simple request (no CORS preflight).\n      try {\n        if (typeof fetch === \"function\") {\n          void fetch(url, { method: \"POST\", body, keepalive: true, mode: \"cors\", credentials: \"omit\", headers: { \"content-type\": \"text/plain\" } }).catch(() => undefined);\n          return;\n        }\n      } catch {\n        /* fall through */\n      }\n      try {\n        if (typeof navigator !== \"undefined\" && typeof navigator.sendBeacon === \"function\") navigator.sendBeacon(url, body);\n      } catch {\n        /* never throw */\n      }\n    };\n\n    const onMetric = (m: Metric) => {\n      try {\n        if (!(VITALS as readonly string[]).includes(m.name) || seen.has(m.name)) return;\n        seen.add(m.name);\n        queue.push(sanitizeEvent({ id: uuid(), type: \"vital\", ts, name: m.name, value: m.value, attrs: { path, rating: m.rating } }));\n      } catch {\n        /* ignore */\n      }\n    };\n\n    // Without reportAllChanges, web-vitals reports each metric's final value.\n    onLCP(onMetric);\n    onINP(onMetric);\n    onCLS(onMetric);\n    onFCP(onMetric);\n    onTTFB(onMetric);\n\n    // Registered after web-vitals' own listeners, so final values are queued before we send.\n    addEventListener(\n      \"visibilitychange\",\n      () => {\n        // Microtask: lets any report web-vitals triggers on this same event land first.\n        if (document.visibilityState === \"hidden\") queueMicrotask(send);\n      },\n      true,\n    );\n    addEventListener(\"pagehide\", send, true);\n  } catch {\n    /* never break the host page */\n  }\n}\n\n/** @internal for tests */\nexport function __resetVitalsForTests(): void {\n  g[FLAG] = false;\n}\n","// Shared, runtime-agnostic helpers (used by both the Node and browser entries).\n// Wire format: see docs/PROTOCOL.md (v1).\n\nexport const SDK_NAME = \"@kanca-app/ikas\";\nexport const SDK_VERSION = \"0.3.0\";\nexport const DEFAULT_ENDPOINT = \"https://kanca.onurhan.dev\";\n\nexport const MAX_NAME = 200;\nexport const MAX_ERROR_MESSAGE = 500;\nexport const MAX_ERROR_CODE = 100;\nexport const MAX_ATTR_KEYS = 20;\nexport const MAX_ATTR_STRING = 500;\nexport const MAX_ATTR_KEY = 64;\nexport const MAX_EVENTS_PER_BATCH = 500;\n/** Protocol limit is 512 KB; keep headroom for the envelope. */\nexport const MAX_BATCH_BYTES = 480 * 1024;\n\nexport type EventType = \"webhook\" | \"graphql\" | \"rest\" | \"install\" | \"uninstall\" | \"vital\" | \"storefront\";\n\nexport type AttrValue = string | number | boolean;\n\nexport interface KancaError {\n  code: string;\n  message?: string;\n}\n\n/** A single wire event (PROTOCOL.md → Event). */\nexport interface KancaEvent {\n  id: string;\n  type: EventType;\n  ts: number;\n  name: string;\n  status?: number;\n  ok?: boolean;\n  durationMs?: number;\n  value?: number;\n  error?: KancaError;\n  merchantId?: string;\n  deliveryId?: string;\n  attrs?: Record<string, AttrValue>;\n}\n\nexport interface Batch {\n  sdk: { name: string; version: string };\n  events: KancaEvent[];\n}\n\nexport function truncate(s: string, max: number): string {\n  return s.length > max ? s.slice(0, max) : s;\n}\n\nfunction hex(bytes: Uint8Array): string {\n  let out = \"\";\n  for (const b of bytes) out += b.toString(16).padStart(2, \"0\");\n  return out;\n}\n\n/** UUID v4 via crypto.randomUUID, with a getRandomValues fallback (non-secure browser contexts). */\nexport function uuid(): string {\n  const c = (globalThis as { crypto?: Crypto }).crypto;\n  if (c && typeof c.randomUUID === \"function\") return c.randomUUID();\n  const b = new Uint8Array(16);\n  if (c && typeof c.getRandomValues === \"function\") c.getRandomValues(b);\n  else for (let i = 0; i < 16; i++) b[i] = Math.floor(Math.random() * 256);\n  b[6] = (b[6]! & 0x0f) | 0x40;\n  b[8] = (b[8]! & 0x3f) | 0x80;\n  const h = hex(b);\n  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;\n}\n\nfunction isFiniteNumber(v: unknown): v is number {\n  return typeof v === \"number\" && Number.isFinite(v);\n}\n\nfunction cleanAttrs(attrs: unknown): Record<string, AttrValue> | undefined {\n  if (!attrs || typeof attrs !== \"object\") return undefined;\n  const out: Record<string, AttrValue> = {};\n  let n = 0;\n  for (const [k, v] of Object.entries(attrs as Record<string, unknown>)) {\n    if (n >= MAX_ATTR_KEYS) break;\n    if (v === undefined || v === null || !k) continue;\n    let val: AttrValue;\n    if (typeof v === \"boolean\") val = v;\n    else if (typeof v === \"number\") {\n      if (!Number.isFinite(v)) continue;\n      val = v;\n    } else if (typeof v === \"string\") val = truncate(v, MAX_ATTR_STRING);\n    else continue; // attrs are flat: nested values are dropped, never stringified\n    out[truncate(k, MAX_ATTR_KEY)] = val;\n    n++;\n  }\n  return n > 0 ? out : undefined;\n}\n\n/**\n * Normalises an event so it always satisfies the protocol limits. Unknown\n * fields are dropped — only the whitelisted metadata below ever leaves the process.\n */\nexport function sanitizeEvent(e: KancaEvent): KancaEvent {\n  const out: KancaEvent = {\n    id: typeof e.id === \"string\" && e.id ? e.id : uuid(),\n    type: e.type,\n    ts: isFiniteNumber(e.ts) ? Math.round(e.ts) : Date.now(),\n    name: truncate(typeof e.name === \"string\" && e.name ? e.name : \"unknown\", MAX_NAME),\n  };\n  if (isFiniteNumber(e.status) && e.status >= 100 && e.status <= 599) out.status = Math.trunc(e.status);\n  if (typeof e.ok === \"boolean\") out.ok = e.ok;\n  if (isFiniteNumber(e.durationMs)) out.durationMs = Math.min(86_400_000, Math.max(0, Math.round(e.durationMs * 10) / 10));\n  if (isFiniteNumber(e.value)) out.value = e.value;\n  if (e.error && typeof e.error.code === \"string\") {\n    out.error = { code: truncate(e.error.code, MAX_ERROR_CODE) };\n    if (typeof e.error.message === \"string\" && e.error.message) {\n      out.error.message = truncate(e.error.message, MAX_ERROR_MESSAGE);\n    }\n  }\n  if (typeof e.merchantId === \"string\" && e.merchantId) out.merchantId = truncate(e.merchantId, 200);\n  if (typeof e.deliveryId === \"string\" && e.deliveryId) out.deliveryId = truncate(e.deliveryId, 200);\n  const attrs = cleanAttrs(e.attrs);\n  if (attrs) out.attrs = attrs;\n  return out;\n}\n\nexport function errorMessage(err: unknown): string | undefined {\n  try {\n    if (err instanceof Error) return truncate(err.message || err.name, MAX_ERROR_MESSAGE);\n    if (typeof err === \"string\") return truncate(err, MAX_ERROR_MESSAGE);\n  } catch {\n    /* ignore */\n  }\n  return undefined;\n}\n\nexport function joinUrl(endpoint: string, path: string): string {\n  return endpoint.replace(/\\/+$/, \"\") + path;\n}\n\nconst encoder = typeof TextEncoder !== \"undefined\" ? /* @__PURE__ */ new TextEncoder() : undefined;\nexport function byteLength(s: string): number {\n  return encoder ? encoder.encode(s).length : s.length * 3;\n}\n\n/**\n * Splits events into protocol-sized batches (<= maxEvents events and\n * <= MAX_BATCH_BYTES serialized). Returns serialized bodies.\n */\nexport function buildBodies(events: KancaEvent[], maxEvents: number): { body: string; events: KancaEvent[] }[] {\n  const sdk = { name: SDK_NAME, version: SDK_VERSION };\n  const envelope = byteLength(JSON.stringify({ sdk, events: [] }));\n  const out: { body: string; events: KancaEvent[] }[] = [];\n  let cur: KancaEvent[] = [];\n  let size = envelope;\n  const push = () => {\n    if (cur.length) out.push({ body: JSON.stringify({ sdk, events: cur } satisfies Batch), events: cur });\n    cur = [];\n    size = envelope;\n  };\n  for (const ev of events) {\n    const len = byteLength(JSON.stringify(ev)) + 1;\n    if (cur.length && (cur.length >= maxEvents || size + len > MAX_BATCH_BYTES)) push();\n    cur.push(ev);\n    size += len;\n  }\n  push();\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAGA,wBAAgE;;;ACAzD,IAAM,WAAW;AACjB,IAAM,cAAc;AACpB,IAAM,mBAAmB;AAEzB,IAAM,WAAW;AACjB,IAAM,oBAAoB;AAC1B,IAAM,iBAAiB;AACvB,IAAM,gBAAgB;AACtB,IAAM,kBAAkB;AACxB,IAAM,eAAe;AAGrB,IAAM,kBAAkB,MAAM;AAgC9B,SAAS,SAAS,GAAW,KAAqB;AACvD,SAAO,EAAE,SAAS,MAAM,EAAE,MAAM,GAAG,GAAG,IAAI;AAC5C;AAEA,SAAS,IAAI,OAA2B;AACtC,MAAI,MAAM;AACV,aAAW,KAAK,MAAO,QAAO,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAC5D,SAAO;AACT;AAGO,SAAS,OAAe;AAC7B,QAAM,IAAK,WAAmC;AAC9C,MAAI,KAAK,OAAO,EAAE,eAAe,WAAY,QAAO,EAAE,WAAW;AACjE,QAAM,IAAI,IAAI,WAAW,EAAE;AAC3B,MAAI,KAAK,OAAO,EAAE,oBAAoB,WAAY,GAAE,gBAAgB,CAAC;AAAA,MAChE,UAAS,IAAI,GAAG,IAAI,IAAI,IAAK,GAAE,CAAC,IAAI,KAAK,MAAM,KAAK,OAAO,IAAI,GAAG;AACvE,IAAE,CAAC,IAAK,EAAE,CAAC,IAAK,KAAQ;AACxB,IAAE,CAAC,IAAK,EAAE,CAAC,IAAK,KAAQ;AACxB,QAAM,IAAI,IAAI,CAAC;AACf,SAAO,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;AAChG;AAEA,SAAS,eAAe,GAAyB;AAC/C,SAAO,OAAO,MAAM,YAAY,OAAO,SAAS,CAAC;AACnD;AAEA,SAAS,WAAW,OAAuD;AACzE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,MAAiC,CAAC;AACxC,MAAI,IAAI;AACR,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAgC,GAAG;AACrE,QAAI,KAAK,cAAe;AACxB,QAAI,MAAM,UAAa,MAAM,QAAQ,CAAC,EAAG;AACzC,QAAI;AACJ,QAAI,OAAO,MAAM,UAAW,OAAM;AAAA,aACzB,OAAO,MAAM,UAAU;AAC9B,UAAI,CAAC,OAAO,SAAS,CAAC,EAAG;AACzB,YAAM;AAAA,IACR,WAAW,OAAO,MAAM,SAAU,OAAM,SAAS,GAAG,eAAe;AAAA,QAC9D;AACL,QAAI,SAAS,GAAG,YAAY,CAAC,IAAI;AACjC;AAAA,EACF;AACA,SAAO,IAAI,IAAI,MAAM;AACvB;AAMO,SAAS,cAAc,GAA2B;AACvD,QAAM,MAAkB;AAAA,IACtB,IAAI,OAAO,EAAE,OAAO,YAAY,EAAE,KAAK,EAAE,KAAK,KAAK;AAAA,IACnD,MAAM,EAAE;AAAA,IACR,IAAI,eAAe,EAAE,EAAE,IAAI,KAAK,MAAM,EAAE,EAAE,IAAI,KAAK,IAAI;AAAA,IACvD,MAAM,SAAS,OAAO,EAAE,SAAS,YAAY,EAAE,OAAO,EAAE,OAAO,WAAW,QAAQ;AAAA,EACpF;AACA,MAAI,eAAe,EAAE,MAAM,KAAK,EAAE,UAAU,OAAO,EAAE,UAAU,IAAK,KAAI,SAAS,KAAK,MAAM,EAAE,MAAM;AACpG,MAAI,OAAO,EAAE,OAAO,UAAW,KAAI,KAAK,EAAE;AAC1C,MAAI,eAAe,EAAE,UAAU,EAAG,KAAI,aAAa,KAAK,IAAI,OAAY,KAAK,IAAI,GAAG,KAAK,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AACvH,MAAI,eAAe,EAAE,KAAK,EAAG,KAAI,QAAQ,EAAE;AAC3C,MAAI,EAAE,SAAS,OAAO,EAAE,MAAM,SAAS,UAAU;AAC/C,QAAI,QAAQ,EAAE,MAAM,SAAS,EAAE,MAAM,MAAM,cAAc,EAAE;AAC3D,QAAI,OAAO,EAAE,MAAM,YAAY,YAAY,EAAE,MAAM,SAAS;AAC1D,UAAI,MAAM,UAAU,SAAS,EAAE,MAAM,SAAS,iBAAiB;AAAA,IACjE;AAAA,EACF;AACA,MAAI,OAAO,EAAE,eAAe,YAAY,EAAE,WAAY,KAAI,aAAa,SAAS,EAAE,YAAY,GAAG;AACjG,MAAI,OAAO,EAAE,eAAe,YAAY,EAAE,WAAY,KAAI,aAAa,SAAS,EAAE,YAAY,GAAG;AACjG,QAAM,QAAQ,WAAW,EAAE,KAAK;AAChC,MAAI,MAAO,KAAI,QAAQ;AACvB,SAAO;AACT;AAYO,SAAS,QAAQ,UAAkB,MAAsB;AAC9D,SAAO,SAAS,QAAQ,QAAQ,EAAE,IAAI;AACxC;;;ADxHA,IAAM,SAAS,CAAC,OAAO,OAAO,OAAO,OAAO,MAAM;AAGlD,IAAM,OAAO;AACb,IAAM,IAAI;AAOH,SAAS,aAAa,SAAoC;AAC/D,MAAI;AACF,QAAI,EAAE,IAAI,KAAK,OAAO,WAAW,eAAe,OAAO,aAAa,YAAa;AACjF,UAAM,MAAM,OAAO,SAAS,cAAc,WAAW,QAAQ,UAAU,KAAK,IAAI;AAChF,UAAM,QAAQ,CAAC,CAAC,SAAS;AACzB,QAAI,CAAC,IAAI,WAAW,KAAK,GAAG;AAC1B,UAAI,SAAS,IAAK,SAAQ,KAAK,6EAA6E;AAC5G;AAAA,IACF;AACA,MAAE,IAAI,IAAI;AAEV,UAAM,MAAM,GAAG,QAAQ,QAAQ,YAAY,kBAAkB,qBAAqB,CAAC,QAAQ,mBAAmB,GAAG,CAAC;AAClH,UAAM,OAAO,SAAS;AACtB,UAAM,KACJ,OAAO,gBAAgB,eAAe,OAAO,YAAY,eAAe,YAAY,YAAY,aAAa,IACzG,KAAK,MAAM,YAAY,UAAU,IACjC,KAAK,IAAI;AACf,UAAM,QAAsB,CAAC;AAC7B,UAAM,OAAO,oBAAI,IAAY;AAE7B,UAAM,OAAO,MAAM;AACjB,UAAI,CAAC,MAAM,OAAQ;AACnB,YAAM,SAAS,MAAM,OAAO,GAAG,MAAM,MAAM;AAC3C,YAAM,OAAO,KAAK,UAAU,EAAE,KAAK,EAAE,MAAM,UAAU,SAAS,YAAY,GAAG,OAAO,CAAC;AACrF,UAAI,MAAO,SAAQ,MAAM,kBAAkB,MAAM;AAIjD,UAAI;AACF,YAAI,OAAO,UAAU,YAAY;AAC/B,eAAK,MAAM,KAAK,EAAE,QAAQ,QAAQ,MAAM,WAAW,MAAM,MAAM,QAAQ,aAAa,QAAQ,SAAS,EAAE,gBAAgB,aAAa,EAAE,CAAC,EAAE,MAAM,MAAM,MAAS;AAC9J;AAAA,QACF;AAAA,MACF,QAAQ;AAAA,MAER;AACA,UAAI;AACF,YAAI,OAAO,cAAc,eAAe,OAAO,UAAU,eAAe,WAAY,WAAU,WAAW,KAAK,IAAI;AAAA,MACpH,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,UAAM,WAAW,CAAC,MAAc;AAC9B,UAAI;AACF,YAAI,CAAE,OAA6B,SAAS,EAAE,IAAI,KAAK,KAAK,IAAI,EAAE,IAAI,EAAG;AACzE,aAAK,IAAI,EAAE,IAAI;AACf,cAAM,KAAK,cAAc,EAAE,IAAI,KAAK,GAAG,MAAM,SAAS,IAAI,MAAM,EAAE,MAAM,OAAO,EAAE,OAAO,OAAO,EAAE,MAAM,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;AAAA,MAC9H,QAAQ;AAAA,MAER;AAAA,IACF;AAGA,iCAAM,QAAQ;AACd,iCAAM,QAAQ;AACd,iCAAM,QAAQ;AACd,iCAAM,QAAQ;AACd,kCAAO,QAAQ;AAGf;AAAA,MACE;AAAA,MACA,MAAM;AAEJ,YAAI,SAAS,oBAAoB,SAAU,gBAAe,IAAI;AAAA,MAChE;AAAA,MACA;AAAA,IACF;AACA,qBAAiB,YAAY,MAAM,IAAI;AAAA,EACzC,QAAQ;AAAA,EAER;AACF;AAGO,SAAS,wBAA8B;AAC5C,IAAE,IAAI,IAAI;AACZ;","names":[]}

package/dist/browser.js

@@ -3,7 +3,7 @@ import { onCLS, onFCP, onINP, onLCP, onTTFB } from "web-vitals";
 
 // src/shared.ts
 var SDK_NAME = "@kanca-app/ikas";
-var SDK_VERSION = "0.2.0";
+var SDK_VERSION = "0.3.0";
 var DEFAULT_ENDPOINT = "https://kanca.onurhan.dev";
 var MAX_NAME = 200;
 var MAX_ERROR_MESSAGE = 500;

package/dist/browser.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/browser.ts","../src/shared.ts"],"sourcesContent":["// @kanca-app/ikas/browser — Core Web Vitals for the ikas admin iframe.\n// Sends only { name, value, rating, pathname } per metric. Uses a public key (kp_...).\n\nimport { onCLS, onFCP, onINP, onLCP, onTTFB, type Metric } from \"web-vitals\";\nimport { DEFAULT_ENDPOINT, SDK_NAME, SDK_VERSION, joinUrl, sanitizeEvent, uuid, type KancaEvent } from \"./shared\";\n\nexport interface ReportVitalsOptions {\n  /** Public key (`kp_...`). Safe to expose in the browser; only accepts `vital` events. */\n  publicKey: string | undefined;\n  /** Kanca base URL. Default `https://kanca.onurhan.dev`. */\n  endpoint?: string;\n  debug?: boolean;\n}\n\nconst VITALS = [\"LCP\", \"INP\", \"CLS\", \"FCP\", \"TTFB\"] as const;\n\n// Global (not module) flag so duplicate copies (ESM + CJS, browser + react bundles) still start once.\nconst FLAG = \"__kancaVitalsStarted\";\nconst g = globalThis as { [FLAG]?: boolean };\n\n/**\n * Starts collecting LCP, INP, CLS, FCP and TTFB (final values, once per page\n * load per metric) and sends them when the page is hidden or unloaded.\n * Safe to call more than once — only the first call has an effect.\n */\nexport function reportVitals(options: ReportVitalsOptions): void {\n  try {\n    if (g[FLAG] || typeof window === \"undefined\" || typeof document === \"undefined\") return;\n    const key = typeof options?.publicKey === \"string\" ? options.publicKey.trim() : \"\";\n    const debug = !!options?.debug;\n    if (!key.startsWith(\"kp_\")) {\n      if (debug || key) console.warn(\"[kanca] reportVitals(): a public key (kp_...) is required; vitals disabled.\");\n      return;\n    }\n    g[FLAG] = true;\n\n    const url = `${joinUrl(options.endpoint || DEFAULT_ENDPOINT, \"/api/ingest/browser\")}?key=${encodeURIComponent(key)}`;\n    const path = location.pathname;\n    const ts =\n      typeof performance !== \"undefined\" && typeof performance.timeOrigin === \"number\" && performance.timeOrigin > 0\n        ? Math.round(performance.timeOrigin)\n        : Date.now();\n    const queue: KancaEvent[] = [];\n    const seen = new Set<string>();\n\n    const send = () => {\n      if (!queue.length) return;\n      const events = queue.splice(0, queue.length);\n      const body = JSON.stringify({ sdk: { name: SDK_NAME, version: SDK_VERSION }, events });\n      if (debug) console.debug(\"[kanca] vitals\", events);\n      // fetch+keepalive first: content blockers drop sendBeacon (\"ping\") requests\n      // while sendBeacon still returns true, so vitals would vanish silently.\n      // A text/plain body keeps it a simple request (no CORS preflight).\n      try {\n        if (typeof fetch === \"function\") {\n          void fetch(url, { method: \"POST\", body, keepalive: true, mode: \"cors\", credentials: \"omit\", headers: { \"content-type\": \"text/plain\" } }).catch(() => undefined);\n          return;\n        }\n      } catch {\n        /* fall through */\n      }\n      try {\n        if (typeof navigator !== \"undefined\" && typeof navigator.sendBeacon === \"function\") navigator.sendBeacon(url, body);\n      } catch {\n        /* never throw */\n      }\n    };\n\n    const onMetric = (m: Metric) => {\n      try {\n        if (!(VITALS as readonly string[]).includes(m.name) || seen.has(m.name)) return;\n        seen.add(m.name);\n        queue.push(sanitizeEvent({ id: uuid(), type: \"vital\", ts, name: m.name, value: m.value, attrs: { path, rating: m.rating } }));\n      } catch {\n        /* ignore */\n      }\n    };\n\n    // Without reportAllChanges, web-vitals reports each metric's final value.\n    onLCP(onMetric);\n    onINP(onMetric);\n    onCLS(onMetric);\n    onFCP(onMetric);\n    onTTFB(onMetric);\n\n    // Registered after web-vitals' own listeners, so final values are queued before we send.\n    addEventListener(\n      \"visibilitychange\",\n      () => {\n        // Microtask: lets any report web-vitals triggers on this same event land first.\n        if (document.visibilityState === \"hidden\") queueMicrotask(send);\n      },\n      true,\n    );\n    addEventListener(\"pagehide\", send, true);\n  } catch {\n    /* never break the host page */\n  }\n}\n\n/** @internal for tests */\nexport function __resetVitalsForTests(): void {\n  g[FLAG] = false;\n}\n","// Shared, runtime-agnostic helpers (used by both the Node and browser entries).\n// Wire format: see docs/PROTOCOL.md (v1).\n\nexport const SDK_NAME = \"@kanca-app/ikas\";\nexport const SDK_VERSION = \"0.2.0\";\nexport const DEFAULT_ENDPOINT = \"https://kanca.onurhan.dev\";\n\nexport const MAX_NAME = 200;\nexport const MAX_ERROR_MESSAGE = 500;\nexport const MAX_ERROR_CODE = 100;\nexport const MAX_ATTR_KEYS = 20;\nexport const MAX_ATTR_STRING = 500;\nexport const MAX_ATTR_KEY = 64;\nexport const MAX_EVENTS_PER_BATCH = 500;\n/** Protocol limit is 512 KB; keep headroom for the envelope. */\nexport const MAX_BATCH_BYTES = 480 * 1024;\n\nexport type EventType = \"webhook\" | \"graphql\" | \"rest\" | \"install\" | \"uninstall\" | \"vital\" | \"storefront\";\n\nexport type AttrValue = string | number | boolean;\n\nexport interface KancaError {\n  code: string;\n  message?: string;\n}\n\n/** A single wire event (PROTOCOL.md → Event). */\nexport interface KancaEvent {\n  id: string;\n  type: EventType;\n  ts: number;\n  name: string;\n  status?: number;\n  ok?: boolean;\n  durationMs?: number;\n  value?: number;\n  error?: KancaError;\n  merchantId?: string;\n  deliveryId?: string;\n  attrs?: Record<string, AttrValue>;\n}\n\nexport interface Batch {\n  sdk: { name: string; version: string };\n  events: KancaEvent[];\n}\n\nexport function truncate(s: string, max: number): string {\n  return s.length > max ? s.slice(0, max) : s;\n}\n\nfunction hex(bytes: Uint8Array): string {\n  let out = \"\";\n  for (const b of bytes) out += b.toString(16).padStart(2, \"0\");\n  return out;\n}\n\n/** UUID v4 via crypto.randomUUID, with a getRandomValues fallback (non-secure browser contexts). */\nexport function uuid(): string {\n  const c = (globalThis as { crypto?: Crypto }).crypto;\n  if (c && typeof c.randomUUID === \"function\") return c.randomUUID();\n  const b = new Uint8Array(16);\n  if (c && typeof c.getRandomValues === \"function\") c.getRandomValues(b);\n  else for (let i = 0; i < 16; i++) b[i] = Math.floor(Math.random() * 256);\n  b[6] = (b[6]! & 0x0f) | 0x40;\n  b[8] = (b[8]! & 0x3f) | 0x80;\n  const h = hex(b);\n  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;\n}\n\nfunction isFiniteNumber(v: unknown): v is number {\n  return typeof v === \"number\" && Number.isFinite(v);\n}\n\nfunction cleanAttrs(attrs: unknown): Record<string, AttrValue> | undefined {\n  if (!attrs || typeof attrs !== \"object\") return undefined;\n  const out: Record<string, AttrValue> = {};\n  let n = 0;\n  for (const [k, v] of Object.entries(attrs as Record<string, unknown>)) {\n    if (n >= MAX_ATTR_KEYS) break;\n    if (v === undefined || v === null || !k) continue;\n    let val: AttrValue;\n    if (typeof v === \"boolean\") val = v;\n    else if (typeof v === \"number\") {\n      if (!Number.isFinite(v)) continue;\n      val = v;\n    } else if (typeof v === \"string\") val = truncate(v, MAX_ATTR_STRING);\n    else continue; // attrs are flat: nested values are dropped, never stringified\n    out[truncate(k, MAX_ATTR_KEY)] = val;\n    n++;\n  }\n  return n > 0 ? out : undefined;\n}\n\n/**\n * Normalises an event so it always satisfies the protocol limits. Unknown\n * fields are dropped — only the whitelisted metadata below ever leaves the process.\n */\nexport function sanitizeEvent(e: KancaEvent): KancaEvent {\n  const out: KancaEvent = {\n    id: typeof e.id === \"string\" && e.id ? e.id : uuid(),\n    type: e.type,\n    ts: isFiniteNumber(e.ts) ? Math.round(e.ts) : Date.now(),\n    name: truncate(typeof e.name === \"string\" && e.name ? e.name : \"unknown\", MAX_NAME),\n  };\n  if (isFiniteNumber(e.status) && e.status >= 100 && e.status <= 599) out.status = Math.trunc(e.status);\n  if (typeof e.ok === \"boolean\") out.ok = e.ok;\n  if (isFiniteNumber(e.durationMs)) out.durationMs = Math.min(86_400_000, Math.max(0, Math.round(e.durationMs * 10) / 10));\n  if (isFiniteNumber(e.value)) out.value = e.value;\n  if (e.error && typeof e.error.code === \"string\") {\n    out.error = { code: truncate(e.error.code, MAX_ERROR_CODE) };\n    if (typeof e.error.message === \"string\" && e.error.message) {\n      out.error.message = truncate(e.error.message, MAX_ERROR_MESSAGE);\n    }\n  }\n  if (typeof e.merchantId === \"string\" && e.merchantId) out.merchantId = truncate(e.merchantId, 200);\n  if (typeof e.deliveryId === \"string\" && e.deliveryId) out.deliveryId = truncate(e.deliveryId, 200);\n  const attrs = cleanAttrs(e.attrs);\n  if (attrs) out.attrs = attrs;\n  return out;\n}\n\nexport function errorMessage(err: unknown): string | undefined {\n  try {\n    if (err instanceof Error) return truncate(err.message || err.name, MAX_ERROR_MESSAGE);\n    if (typeof err === \"string\") return truncate(err, MAX_ERROR_MESSAGE);\n  } catch {\n    /* ignore */\n  }\n  return undefined;\n}\n\nexport function joinUrl(endpoint: string, path: string): string {\n  return endpoint.replace(/\\/+$/, \"\") + path;\n}\n\nconst encoder = typeof TextEncoder !== \"undefined\" ? /* @__PURE__ */ new TextEncoder() : undefined;\nexport function byteLength(s: string): number {\n  return encoder ? encoder.encode(s).length : s.length * 3;\n}\n\n/**\n * Splits events into protocol-sized batches (<= maxEvents events and\n * <= MAX_BATCH_BYTES serialized). Returns serialized bodies.\n */\nexport function buildBodies(events: KancaEvent[], maxEvents: number): { body: string; events: KancaEvent[] }[] {\n  const sdk = { name: SDK_NAME, version: SDK_VERSION };\n  const envelope = byteLength(JSON.stringify({ sdk, events: [] }));\n  const out: { body: string; events: KancaEvent[] }[] = [];\n  let cur: KancaEvent[] = [];\n  let size = envelope;\n  const push = () => {\n    if (cur.length) out.push({ body: JSON.stringify({ sdk, events: cur } satisfies Batch), events: cur });\n    cur = [];\n    size = envelope;\n  };\n  for (const ev of events) {\n    const len = byteLength(JSON.stringify(ev)) + 1;\n    if (cur.length && (cur.length >= maxEvents || size + len > MAX_BATCH_BYTES)) push();\n    cur.push(ev);\n    size += len;\n  }\n  push();\n  return out;\n}\n"],"mappings":";AAGA,SAAS,OAAO,OAAO,OAAO,OAAO,cAA2B;;;ACAzD,IAAM,WAAW;AACjB,IAAM,cAAc;AACpB,IAAM,mBAAmB;AAEzB,IAAM,WAAW;AACjB,IAAM,oBAAoB;AAC1B,IAAM,iBAAiB;AACvB,IAAM,gBAAgB;AACtB,IAAM,kBAAkB;AACxB,IAAM,eAAe;AAGrB,IAAM,kBAAkB,MAAM;AAgC9B,SAAS,SAAS,GAAW,KAAqB;AACvD,SAAO,EAAE,SAAS,MAAM,EAAE,MAAM,GAAG,GAAG,IAAI;AAC5C;AAEA,SAAS,IAAI,OAA2B;AACtC,MAAI,MAAM;AACV,aAAW,KAAK,MAAO,QAAO,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAC5D,SAAO;AACT;AAGO,SAAS,OAAe;AAC7B,QAAM,IAAK,WAAmC;AAC9C,MAAI,KAAK,OAAO,EAAE,eAAe,WAAY,QAAO,EAAE,WAAW;AACjE,QAAM,IAAI,IAAI,WAAW,EAAE;AAC3B,MAAI,KAAK,OAAO,EAAE,oBAAoB,WAAY,GAAE,gBAAgB,CAAC;AAAA,MAChE,UAAS,IAAI,GAAG,IAAI,IAAI,IAAK,GAAE,CAAC,IAAI,KAAK,MAAM,KAAK,OAAO,IAAI,GAAG;AACvE,IAAE,CAAC,IAAK,EAAE,CAAC,IAAK,KAAQ;AACxB,IAAE,CAAC,IAAK,EAAE,CAAC,IAAK,KAAQ;AACxB,QAAM,IAAI,IAAI,CAAC;AACf,SAAO,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;AAChG;AAEA,SAAS,eAAe,GAAyB;AAC/C,SAAO,OAAO,MAAM,YAAY,OAAO,SAAS,CAAC;AACnD;AAEA,SAAS,WAAW,OAAuD;AACzE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,MAAiC,CAAC;AACxC,MAAI,IAAI;AACR,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAgC,GAAG;AACrE,QAAI,KAAK,cAAe;AACxB,QAAI,MAAM,UAAa,MAAM,QAAQ,CAAC,EAAG;AACzC,QAAI;AACJ,QAAI,OAAO,MAAM,UAAW,OAAM;AAAA,aACzB,OAAO,MAAM,UAAU;AAC9B,UAAI,CAAC,OAAO,SAAS,CAAC,EAAG;AACzB,YAAM;AAAA,IACR,WAAW,OAAO,MAAM,SAAU,OAAM,SAAS,GAAG,eAAe;AAAA,QAC9D;AACL,QAAI,SAAS,GAAG,YAAY,CAAC,IAAI;AACjC;AAAA,EACF;AACA,SAAO,IAAI,IAAI,MAAM;AACvB;AAMO,SAAS,cAAc,GAA2B;AACvD,QAAM,MAAkB;AAAA,IACtB,IAAI,OAAO,EAAE,OAAO,YAAY,EAAE,KAAK,EAAE,KAAK,KAAK;AAAA,IACnD,MAAM,EAAE;AAAA,IACR,IAAI,eAAe,EAAE,EAAE,IAAI,KAAK,MAAM,EAAE,EAAE,IAAI,KAAK,IAAI;AAAA,IACvD,MAAM,SAAS,OAAO,EAAE,SAAS,YAAY,EAAE,OAAO,EAAE,OAAO,WAAW,QAAQ;AAAA,EACpF;AACA,MAAI,eAAe,EAAE,MAAM,KAAK,EAAE,UAAU,OAAO,EAAE,UAAU,IAAK,KAAI,SAAS,KAAK,MAAM,EAAE,MAAM;AACpG,MAAI,OAAO,EAAE,OAAO,UAAW,KAAI,KAAK,EAAE;AAC1C,MAAI,eAAe,EAAE,UAAU,EAAG,KAAI,aAAa,KAAK,IAAI,OAAY,KAAK,IAAI,GAAG,KAAK,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AACvH,MAAI,eAAe,EAAE,KAAK,EAAG,KAAI,QAAQ,EAAE;AAC3C,MAAI,EAAE,SAAS,OAAO,EAAE,MAAM,SAAS,UAAU;AAC/C,QAAI,QAAQ,EAAE,MAAM,SAAS,EAAE,MAAM,MAAM,cAAc,EAAE;AAC3D,QAAI,OAAO,EAAE,MAAM,YAAY,YAAY,EAAE,MAAM,SAAS;AAC1D,UAAI,MAAM,UAAU,SAAS,EAAE,MAAM,SAAS,iBAAiB;AAAA,IACjE;AAAA,EACF;AACA,MAAI,OAAO,EAAE,eAAe,YAAY,EAAE,WAAY,KAAI,aAAa,SAAS,EAAE,YAAY,GAAG;AACjG,MAAI,OAAO,EAAE,eAAe,YAAY,EAAE,WAAY,KAAI,aAAa,SAAS,EAAE,YAAY,GAAG;AACjG,QAAM,QAAQ,WAAW,EAAE,KAAK;AAChC,MAAI,MAAO,KAAI,QAAQ;AACvB,SAAO;AACT;AAYO,SAAS,QAAQ,UAAkB,MAAsB;AAC9D,SAAO,SAAS,QAAQ,QAAQ,EAAE,IAAI;AACxC;;;ADxHA,IAAM,SAAS,CAAC,OAAO,OAAO,OAAO,OAAO,MAAM;AAGlD,IAAM,OAAO;AACb,IAAM,IAAI;AAOH,SAAS,aAAa,SAAoC;AAC/D,MAAI;AACF,QAAI,EAAE,IAAI,KAAK,OAAO,WAAW,eAAe,OAAO,aAAa,YAAa;AACjF,UAAM,MAAM,OAAO,SAAS,cAAc,WAAW,QAAQ,UAAU,KAAK,IAAI;AAChF,UAAM,QAAQ,CAAC,CAAC,SAAS;AACzB,QAAI,CAAC,IAAI,WAAW,KAAK,GAAG;AAC1B,UAAI,SAAS,IAAK,SAAQ,KAAK,6EAA6E;AAC5G;AAAA,IACF;AACA,MAAE,IAAI,IAAI;AAEV,UAAM,MAAM,GAAG,QAAQ,QAAQ,YAAY,kBAAkB,qBAAqB,CAAC,QAAQ,mBAAmB,GAAG,CAAC;AAClH,UAAM,OAAO,SAAS;AACtB,UAAM,KACJ,OAAO,gBAAgB,eAAe,OAAO,YAAY,eAAe,YAAY,YAAY,aAAa,IACzG,KAAK,MAAM,YAAY,UAAU,IACjC,KAAK,IAAI;AACf,UAAM,QAAsB,CAAC;AAC7B,UAAM,OAAO,oBAAI,IAAY;AAE7B,UAAM,OAAO,MAAM;AACjB,UAAI,CAAC,MAAM,OAAQ;AACnB,YAAM,SAAS,MAAM,OAAO,GAAG,MAAM,MAAM;AAC3C,YAAM,OAAO,KAAK,UAAU,EAAE,KAAK,EAAE,MAAM,UAAU,SAAS,YAAY,GAAG,OAAO,CAAC;AACrF,UAAI,MAAO,SAAQ,MAAM,kBAAkB,MAAM;AAIjD,UAAI;AACF,YAAI,OAAO,UAAU,YAAY;AAC/B,eAAK,MAAM,KAAK,EAAE,QAAQ,QAAQ,MAAM,WAAW,MAAM,MAAM,QAAQ,aAAa,QAAQ,SAAS,EAAE,gBAAgB,aAAa,EAAE,CAAC,EAAE,MAAM,MAAM,MAAS;AAC9J;AAAA,QACF;AAAA,MACF,QAAQ;AAAA,MAER;AACA,UAAI;AACF,YAAI,OAAO,cAAc,eAAe,OAAO,UAAU,eAAe,WAAY,WAAU,WAAW,KAAK,IAAI;AAAA,MACpH,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,UAAM,WAAW,CAAC,MAAc;AAC9B,UAAI;AACF,YAAI,CAAE,OAA6B,SAAS,EAAE,IAAI,KAAK,KAAK,IAAI,EAAE,IAAI,EAAG;AACzE,aAAK,IAAI,EAAE,IAAI;AACf,cAAM,KAAK,cAAc,EAAE,IAAI,KAAK,GAAG,MAAM,SAAS,IAAI,MAAM,EAAE,MAAM,OAAO,EAAE,OAAO,OAAO,EAAE,MAAM,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;AAAA,MAC9H,QAAQ;AAAA,MAER;AAAA,IACF;AAGA,UAAM,QAAQ;AACd,UAAM,QAAQ;AACd,UAAM,QAAQ;AACd,UAAM,QAAQ;AACd,WAAO,QAAQ;AAGf;AAAA,MACE;AAAA,MACA,MAAM;AAEJ,YAAI,SAAS,oBAAoB,SAAU,gBAAe,IAAI;AAAA,MAChE;AAAA,MACA;AAAA,IACF;AACA,qBAAiB,YAAY,MAAM,IAAI;AAAA,EACzC,QAAQ;AAAA,EAER;AACF;AAGO,SAAS,wBAA8B;AAC5C,IAAE,IAAI,IAAI;AACZ;","names":[]}
+{"version":3,"sources":["../src/browser.ts","../src/shared.ts"],"sourcesContent":["// @kanca-app/ikas/browser — Core Web Vitals for the ikas admin iframe.\n// Sends only { name, value, rating, pathname } per metric. Uses a public key (kp_...).\n\nimport { onCLS, onFCP, onINP, onLCP, onTTFB, type Metric } from \"web-vitals\";\nimport { DEFAULT_ENDPOINT, SDK_NAME, SDK_VERSION, joinUrl, sanitizeEvent, uuid, type KancaEvent } from \"./shared\";\n\nexport interface ReportVitalsOptions {\n  /** Public key (`kp_...`). Safe to expose in the browser; only accepts `vital` events. */\n  publicKey: string | undefined;\n  /** Kanca base URL. Default `https://kanca.onurhan.dev`. */\n  endpoint?: string;\n  debug?: boolean;\n}\n\nconst VITALS = [\"LCP\", \"INP\", \"CLS\", \"FCP\", \"TTFB\"] as const;\n\n// Global (not module) flag so duplicate copies (ESM + CJS, browser + react bundles) still start once.\nconst FLAG = \"__kancaVitalsStarted\";\nconst g = globalThis as { [FLAG]?: boolean };\n\n/**\n * Starts collecting LCP, INP, CLS, FCP and TTFB (final values, once per page\n * load per metric) and sends them when the page is hidden or unloaded.\n * Safe to call more than once — only the first call has an effect.\n */\nexport function reportVitals(options: ReportVitalsOptions): void {\n  try {\n    if (g[FLAG] || typeof window === \"undefined\" || typeof document === \"undefined\") return;\n    const key = typeof options?.publicKey === \"string\" ? options.publicKey.trim() : \"\";\n    const debug = !!options?.debug;\n    if (!key.startsWith(\"kp_\")) {\n      if (debug || key) console.warn(\"[kanca] reportVitals(): a public key (kp_...) is required; vitals disabled.\");\n      return;\n    }\n    g[FLAG] = true;\n\n    const url = `${joinUrl(options.endpoint || DEFAULT_ENDPOINT, \"/api/ingest/browser\")}?key=${encodeURIComponent(key)}`;\n    const path = location.pathname;\n    const ts =\n      typeof performance !== \"undefined\" && typeof performance.timeOrigin === \"number\" && performance.timeOrigin > 0\n        ? Math.round(performance.timeOrigin)\n        : Date.now();\n    const queue: KancaEvent[] = [];\n    const seen = new Set<string>();\n\n    const send = () => {\n      if (!queue.length) return;\n      const events = queue.splice(0, queue.length);\n      const body = JSON.stringify({ sdk: { name: SDK_NAME, version: SDK_VERSION }, events });\n      if (debug) console.debug(\"[kanca] vitals\", events);\n      // fetch+keepalive first: content blockers drop sendBeacon (\"ping\") requests\n      // while sendBeacon still returns true, so vitals would vanish silently.\n      // A text/plain body keeps it a simple request (no CORS preflight).\n      try {\n        if (typeof fetch === \"function\") {\n          void fetch(url, { method: \"POST\", body, keepalive: true, mode: \"cors\", credentials: \"omit\", headers: { \"content-type\": \"text/plain\" } }).catch(() => undefined);\n          return;\n        }\n      } catch {\n        /* fall through */\n      }\n      try {\n        if (typeof navigator !== \"undefined\" && typeof navigator.sendBeacon === \"function\") navigator.sendBeacon(url, body);\n      } catch {\n        /* never throw */\n      }\n    };\n\n    const onMetric = (m: Metric) => {\n      try {\n        if (!(VITALS as readonly string[]).includes(m.name) || seen.has(m.name)) return;\n        seen.add(m.name);\n        queue.push(sanitizeEvent({ id: uuid(), type: \"vital\", ts, name: m.name, value: m.value, attrs: { path, rating: m.rating } }));\n      } catch {\n        /* ignore */\n      }\n    };\n\n    // Without reportAllChanges, web-vitals reports each metric's final value.\n    onLCP(onMetric);\n    onINP(onMetric);\n    onCLS(onMetric);\n    onFCP(onMetric);\n    onTTFB(onMetric);\n\n    // Registered after web-vitals' own listeners, so final values are queued before we send.\n    addEventListener(\n      \"visibilitychange\",\n      () => {\n        // Microtask: lets any report web-vitals triggers on this same event land first.\n        if (document.visibilityState === \"hidden\") queueMicrotask(send);\n      },\n      true,\n    );\n    addEventListener(\"pagehide\", send, true);\n  } catch {\n    /* never break the host page */\n  }\n}\n\n/** @internal for tests */\nexport function __resetVitalsForTests(): void {\n  g[FLAG] = false;\n}\n","// Shared, runtime-agnostic helpers (used by both the Node and browser entries).\n// Wire format: see docs/PROTOCOL.md (v1).\n\nexport const SDK_NAME = \"@kanca-app/ikas\";\nexport const SDK_VERSION = \"0.3.0\";\nexport const DEFAULT_ENDPOINT = \"https://kanca.onurhan.dev\";\n\nexport const MAX_NAME = 200;\nexport const MAX_ERROR_MESSAGE = 500;\nexport const MAX_ERROR_CODE = 100;\nexport const MAX_ATTR_KEYS = 20;\nexport const MAX_ATTR_STRING = 500;\nexport const MAX_ATTR_KEY = 64;\nexport const MAX_EVENTS_PER_BATCH = 500;\n/** Protocol limit is 512 KB; keep headroom for the envelope. */\nexport const MAX_BATCH_BYTES = 480 * 1024;\n\nexport type EventType = \"webhook\" | \"graphql\" | \"rest\" | \"install\" | \"uninstall\" | \"vital\" | \"storefront\";\n\nexport type AttrValue = string | number | boolean;\n\nexport interface KancaError {\n  code: string;\n  message?: string;\n}\n\n/** A single wire event (PROTOCOL.md → Event). */\nexport interface KancaEvent {\n  id: string;\n  type: EventType;\n  ts: number;\n  name: string;\n  status?: number;\n  ok?: boolean;\n  durationMs?: number;\n  value?: number;\n  error?: KancaError;\n  merchantId?: string;\n  deliveryId?: string;\n  attrs?: Record<string, AttrValue>;\n}\n\nexport interface Batch {\n  sdk: { name: string; version: string };\n  events: KancaEvent[];\n}\n\nexport function truncate(s: string, max: number): string {\n  return s.length > max ? s.slice(0, max) : s;\n}\n\nfunction hex(bytes: Uint8Array): string {\n  let out = \"\";\n  for (const b of bytes) out += b.toString(16).padStart(2, \"0\");\n  return out;\n}\n\n/** UUID v4 via crypto.randomUUID, with a getRandomValues fallback (non-secure browser contexts). */\nexport function uuid(): string {\n  const c = (globalThis as { crypto?: Crypto }).crypto;\n  if (c && typeof c.randomUUID === \"function\") return c.randomUUID();\n  const b = new Uint8Array(16);\n  if (c && typeof c.getRandomValues === \"function\") c.getRandomValues(b);\n  else for (let i = 0; i < 16; i++) b[i] = Math.floor(Math.random() * 256);\n  b[6] = (b[6]! & 0x0f) | 0x40;\n  b[8] = (b[8]! & 0x3f) | 0x80;\n  const h = hex(b);\n  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;\n}\n\nfunction isFiniteNumber(v: unknown): v is number {\n  return typeof v === \"number\" && Number.isFinite(v);\n}\n\nfunction cleanAttrs(attrs: unknown): Record<string, AttrValue> | undefined {\n  if (!attrs || typeof attrs !== \"object\") return undefined;\n  const out: Record<string, AttrValue> = {};\n  let n = 0;\n  for (const [k, v] of Object.entries(attrs as Record<string, unknown>)) {\n    if (n >= MAX_ATTR_KEYS) break;\n    if (v === undefined || v === null || !k) continue;\n    let val: AttrValue;\n    if (typeof v === \"boolean\") val = v;\n    else if (typeof v === \"number\") {\n      if (!Number.isFinite(v)) continue;\n      val = v;\n    } else if (typeof v === \"string\") val = truncate(v, MAX_ATTR_STRING);\n    else continue; // attrs are flat: nested values are dropped, never stringified\n    out[truncate(k, MAX_ATTR_KEY)] = val;\n    n++;\n  }\n  return n > 0 ? out : undefined;\n}\n\n/**\n * Normalises an event so it always satisfies the protocol limits. Unknown\n * fields are dropped — only the whitelisted metadata below ever leaves the process.\n */\nexport function sanitizeEvent(e: KancaEvent): KancaEvent {\n  const out: KancaEvent = {\n    id: typeof e.id === \"string\" && e.id ? e.id : uuid(),\n    type: e.type,\n    ts: isFiniteNumber(e.ts) ? Math.round(e.ts) : Date.now(),\n    name: truncate(typeof e.name === \"string\" && e.name ? e.name : \"unknown\", MAX_NAME),\n  };\n  if (isFiniteNumber(e.status) && e.status >= 100 && e.status <= 599) out.status = Math.trunc(e.status);\n  if (typeof e.ok === \"boolean\") out.ok = e.ok;\n  if (isFiniteNumber(e.durationMs)) out.durationMs = Math.min(86_400_000, Math.max(0, Math.round(e.durationMs * 10) / 10));\n  if (isFiniteNumber(e.value)) out.value = e.value;\n  if (e.error && typeof e.error.code === \"string\") {\n    out.error = { code: truncate(e.error.code, MAX_ERROR_CODE) };\n    if (typeof e.error.message === \"string\" && e.error.message) {\n      out.error.message = truncate(e.error.message, MAX_ERROR_MESSAGE);\n    }\n  }\n  if (typeof e.merchantId === \"string\" && e.merchantId) out.merchantId = truncate(e.merchantId, 200);\n  if (typeof e.deliveryId === \"string\" && e.deliveryId) out.deliveryId = truncate(e.deliveryId, 200);\n  const attrs = cleanAttrs(e.attrs);\n  if (attrs) out.attrs = attrs;\n  return out;\n}\n\nexport function errorMessage(err: unknown): string | undefined {\n  try {\n    if (err instanceof Error) return truncate(err.message || err.name, MAX_ERROR_MESSAGE);\n    if (typeof err === \"string\") return truncate(err, MAX_ERROR_MESSAGE);\n  } catch {\n    /* ignore */\n  }\n  return undefined;\n}\n\nexport function joinUrl(endpoint: string, path: string): string {\n  return endpoint.replace(/\\/+$/, \"\") + path;\n}\n\nconst encoder = typeof TextEncoder !== \"undefined\" ? /* @__PURE__ */ new TextEncoder() : undefined;\nexport function byteLength(s: string): number {\n  return encoder ? encoder.encode(s).length : s.length * 3;\n}\n\n/**\n * Splits events into protocol-sized batches (<= maxEvents events and\n * <= MAX_BATCH_BYTES serialized). Returns serialized bodies.\n */\nexport function buildBodies(events: KancaEvent[], maxEvents: number): { body: string; events: KancaEvent[] }[] {\n  const sdk = { name: SDK_NAME, version: SDK_VERSION };\n  const envelope = byteLength(JSON.stringify({ sdk, events: [] }));\n  const out: { body: string; events: KancaEvent[] }[] = [];\n  let cur: KancaEvent[] = [];\n  let size = envelope;\n  const push = () => {\n    if (cur.length) out.push({ body: JSON.stringify({ sdk, events: cur } satisfies Batch), events: cur });\n    cur = [];\n    size = envelope;\n  };\n  for (const ev of events) {\n    const len = byteLength(JSON.stringify(ev)) + 1;\n    if (cur.length && (cur.length >= maxEvents || size + len > MAX_BATCH_BYTES)) push();\n    cur.push(ev);\n    size += len;\n  }\n  push();\n  return out;\n}\n"],"mappings":";AAGA,SAAS,OAAO,OAAO,OAAO,OAAO,cAA2B;;;ACAzD,IAAM,WAAW;AACjB,IAAM,cAAc;AACpB,IAAM,mBAAmB;AAEzB,IAAM,WAAW;AACjB,IAAM,oBAAoB;AAC1B,IAAM,iBAAiB;AACvB,IAAM,gBAAgB;AACtB,IAAM,kBAAkB;AACxB,IAAM,eAAe;AAGrB,IAAM,kBAAkB,MAAM;AAgC9B,SAAS,SAAS,GAAW,KAAqB;AACvD,SAAO,EAAE,SAAS,MAAM,EAAE,MAAM,GAAG,GAAG,IAAI;AAC5C;AAEA,SAAS,IAAI,OAA2B;AACtC,MAAI,MAAM;AACV,aAAW,KAAK,MAAO,QAAO,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAC5D,SAAO;AACT;AAGO,SAAS,OAAe;AAC7B,QAAM,IAAK,WAAmC;AAC9C,MAAI,KAAK,OAAO,EAAE,eAAe,WAAY,QAAO,EAAE,WAAW;AACjE,QAAM,IAAI,IAAI,WAAW,EAAE;AAC3B,MAAI,KAAK,OAAO,EAAE,oBAAoB,WAAY,GAAE,gBAAgB,CAAC;AAAA,MAChE,UAAS,IAAI,GAAG,IAAI,IAAI,IAAK,GAAE,CAAC,IAAI,KAAK,MAAM,KAAK,OAAO,IAAI,GAAG;AACvE,IAAE,CAAC,IAAK,EAAE,CAAC,IAAK,KAAQ;AACxB,IAAE,CAAC,IAAK,EAAE,CAAC,IAAK,KAAQ;AACxB,QAAM,IAAI,IAAI,CAAC;AACf,SAAO,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;AAChG;AAEA,SAAS,eAAe,GAAyB;AAC/C,SAAO,OAAO,MAAM,YAAY,OAAO,SAAS,CAAC;AACnD;AAEA,SAAS,WAAW,OAAuD;AACzE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,MAAiC,CAAC;AACxC,MAAI,IAAI;AACR,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAgC,GAAG;AACrE,QAAI,KAAK,cAAe;AACxB,QAAI,MAAM,UAAa,MAAM,QAAQ,CAAC,EAAG;AACzC,QAAI;AACJ,QAAI,OAAO,MAAM,UAAW,OAAM;AAAA,aACzB,OAAO,MAAM,UAAU;AAC9B,UAAI,CAAC,OAAO,SAAS,CAAC,EAAG;AACzB,YAAM;AAAA,IACR,WAAW,OAAO,MAAM,SAAU,OAAM,SAAS,GAAG,eAAe;AAAA,QAC9D;AACL,QAAI,SAAS,GAAG,YAAY,CAAC,IAAI;AACjC;AAAA,EACF;AACA,SAAO,IAAI,IAAI,MAAM;AACvB;AAMO,SAAS,cAAc,GAA2B;AACvD,QAAM,MAAkB;AAAA,IACtB,IAAI,OAAO,EAAE,OAAO,YAAY,EAAE,KAAK,EAAE,KAAK,KAAK;AAAA,IACnD,MAAM,EAAE;AAAA,IACR,IAAI,eAAe,EAAE,EAAE,IAAI,KAAK,MAAM,EAAE,EAAE,IAAI,KAAK,IAAI;AAAA,IACvD,MAAM,SAAS,OAAO,EAAE,SAAS,YAAY,EAAE,OAAO,EAAE,OAAO,WAAW,QAAQ;AAAA,EACpF;AACA,MAAI,eAAe,EAAE,MAAM,KAAK,EAAE,UAAU,OAAO,EAAE,UAAU,IAAK,KAAI,SAAS,KAAK,MAAM,EAAE,MAAM;AACpG,MAAI,OAAO,EAAE,OAAO,UAAW,KAAI,KAAK,EAAE;AAC1C,MAAI,eAAe,EAAE,UAAU,EAAG,KAAI,aAAa,KAAK,IAAI,OAAY,KAAK,IAAI,GAAG,KAAK,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AACvH,MAAI,eAAe,EAAE,KAAK,EAAG,KAAI,QAAQ,EAAE;AAC3C,MAAI,EAAE,SAAS,OAAO,EAAE,MAAM,SAAS,UAAU;AAC/C,QAAI,QAAQ,EAAE,MAAM,SAAS,EAAE,MAAM,MAAM,cAAc,EAAE;AAC3D,QAAI,OAAO,EAAE,MAAM,YAAY,YAAY,EAAE,MAAM,SAAS;AAC1D,UAAI,MAAM,UAAU,SAAS,EAAE,MAAM,SAAS,iBAAiB;AAAA,IACjE;AAAA,EACF;AACA,MAAI,OAAO,EAAE,eAAe,YAAY,EAAE,WAAY,KAAI,aAAa,SAAS,EAAE,YAAY,GAAG;AACjG,MAAI,OAAO,EAAE,eAAe,YAAY,EAAE,WAAY,KAAI,aAAa,SAAS,EAAE,YAAY,GAAG;AACjG,QAAM,QAAQ,WAAW,EAAE,KAAK;AAChC,MAAI,MAAO,KAAI,QAAQ;AACvB,SAAO;AACT;AAYO,SAAS,QAAQ,UAAkB,MAAsB;AAC9D,SAAO,SAAS,QAAQ,QAAQ,EAAE,IAAI;AACxC;;;ADxHA,IAAM,SAAS,CAAC,OAAO,OAAO,OAAO,OAAO,MAAM;AAGlD,IAAM,OAAO;AACb,IAAM,IAAI;AAOH,SAAS,aAAa,SAAoC;AAC/D,MAAI;AACF,QAAI,EAAE,IAAI,KAAK,OAAO,WAAW,eAAe,OAAO,aAAa,YAAa;AACjF,UAAM,MAAM,OAAO,SAAS,cAAc,WAAW,QAAQ,UAAU,KAAK,IAAI;AAChF,UAAM,QAAQ,CAAC,CAAC,SAAS;AACzB,QAAI,CAAC,IAAI,WAAW,KAAK,GAAG;AAC1B,UAAI,SAAS,IAAK,SAAQ,KAAK,6EAA6E;AAC5G;AAAA,IACF;AACA,MAAE,IAAI,IAAI;AAEV,UAAM,MAAM,GAAG,QAAQ,QAAQ,YAAY,kBAAkB,qBAAqB,CAAC,QAAQ,mBAAmB,GAAG,CAAC;AAClH,UAAM,OAAO,SAAS;AACtB,UAAM,KACJ,OAAO,gBAAgB,eAAe,OAAO,YAAY,eAAe,YAAY,YAAY,aAAa,IACzG,KAAK,MAAM,YAAY,UAAU,IACjC,KAAK,IAAI;AACf,UAAM,QAAsB,CAAC;AAC7B,UAAM,OAAO,oBAAI,IAAY;AAE7B,UAAM,OAAO,MAAM;AACjB,UAAI,CAAC,MAAM,OAAQ;AACnB,YAAM,SAAS,MAAM,OAAO,GAAG,MAAM,MAAM;AAC3C,YAAM,OAAO,KAAK,UAAU,EAAE,KAAK,EAAE,MAAM,UAAU,SAAS,YAAY,GAAG,OAAO,CAAC;AACrF,UAAI,MAAO,SAAQ,MAAM,kBAAkB,MAAM;AAIjD,UAAI;AACF,YAAI,OAAO,UAAU,YAAY;AAC/B,eAAK,MAAM,KAAK,EAAE,QAAQ,QAAQ,MAAM,WAAW,MAAM,MAAM,QAAQ,aAAa,QAAQ,SAAS,EAAE,gBAAgB,aAAa,EAAE,CAAC,EAAE,MAAM,MAAM,MAAS;AAC9J;AAAA,QACF;AAAA,MACF,QAAQ;AAAA,MAER;AACA,UAAI;AACF,YAAI,OAAO,cAAc,eAAe,OAAO,UAAU,eAAe,WAAY,WAAU,WAAW,KAAK,IAAI;AAAA,MACpH,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,UAAM,WAAW,CAAC,MAAc;AAC9B,UAAI;AACF,YAAI,CAAE,OAA6B,SAAS,EAAE,IAAI,KAAK,KAAK,IAAI,EAAE,IAAI,EAAG;AACzE,aAAK,IAAI,EAAE,IAAI;AACf,cAAM,KAAK,cAAc,EAAE,IAAI,KAAK,GAAG,MAAM,SAAS,IAAI,MAAM,EAAE,MAAM,OAAO,EAAE,OAAO,OAAO,EAAE,MAAM,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;AAAA,MAC9H,QAAQ;AAAA,MAER;AAAA,IACF;AAGA,UAAM,QAAQ;AACd,UAAM,QAAQ;AACd,UAAM,QAAQ;AACd,UAAM,QAAQ;AACd,WAAO,QAAQ;AAGf;AAAA,MACE;AAAA,MACA,MAAM;AAEJ,YAAI,SAAS,oBAAoB,SAAU,gBAAe,IAAI;AAAA,MAChE;AAAA,MACA;AAAA,IACF;AACA,qBAAiB,YAAY,MAAM,IAAI;AAAA,EACzC,QAAQ;AAAA,EAER;AACF;AAGO,SAAS,wBAA8B;AAC5C,IAAE,IAAI,IAAI;AACZ;","names":[]}

package/dist/index.cjs

@@ -22,7 +22,6 @@ var src_exports = {};
 __export(src_exports, {
   SDK_NAME: () => SDK_NAME,
   SDK_VERSION: () => SDK_VERSION,
-  UNINSTALL_SCOPES: () => UNINSTALL_SCOPES,
   createKanca: () => createKanca,
   operationName: () => operationName
 });
@@ -175,7 +174,7 @@ function classifyGraphql(status, json) {
 
 // src/shared.ts
 var SDK_NAME = "@kanca-app/ikas";
-var SDK_VERSION = "0.2.0";
+var SDK_VERSION = "0.3.0";
 var DEFAULT_ENDPOINT = "https://kanca.onurhan.dev";
 var MAX_NAME = 200;
 var MAX_ERROR_MESSAGE = 500;
@@ -408,6 +407,126 @@ var Transport = class {
   }
 };
 
+// src/install.ts
+var INSTALL_RECHECK_DELAY_MS = 3e3;
+var MASS_REVOCATION_MIN = 5;
+var PROBE = "query getAuthorizedApp { getAuthorizedApp { id } }";
+async function probe(client) {
+  const c = client;
+  if (!c || typeof c !== "object" || !c._client || typeof c._client.request !== "function") {
+    return { state: "unknown", reason: "UNSUPPORTED_CLIENT" };
+  }
+  if (typeof c._checkToken === "function") {
+    try {
+      await c._checkToken();
+    } catch {
+      return { state: "unknown", reason: "TOKEN_CHECK_FAILED" };
+    }
+  }
+  let data;
+  try {
+    data = await c._client.request({ document: PROBE });
+  } catch (err) {
+    const resp = err?.response;
+    const status = resp?.status;
+    if (typeof status !== "number") return { state: "unknown", reason: "NETWORK" };
+    const first = Array.isArray(resp.errors) ? resp.errors[0] : void 0;
+    const code = first?.extensions?.code;
+    return { state: "unknown", reason: typeof code === "string" && code ? code.slice(0, 100) : `HTTP_${status}` };
+  }
+  if (data && typeof data === "object" && "getAuthorizedApp" in data) {
+    const app = data.getAuthorizedApp;
+    if (app === null) return { state: "removed" };
+    const id = app && typeof app === "object" ? app.id : void 0;
+    if (typeof id === "string" && id) return { state: "installed" };
+  }
+  return { state: "unknown", reason: "UNEXPECTED_RESPONSE" };
+}
+var sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
+async function checkInstallState(merchantId, client, recheckDelayMs) {
+  if (typeof merchantId !== "string" || !merchantId) return { merchantId: "", state: "unknown", reason: "MISSING_MERCHANT_ID" };
+  try {
+    const first = await probe(client);
+    if (first.state === "installed") return { merchantId, state: "installed" };
+    if (first.state === "unknown") return { merchantId, state: "unknown", reason: first.reason };
+    await sleep2(recheckDelayMs);
+    const second = await probe(client);
+    if (second.state === "removed") return { merchantId, state: "uninstalled" };
+    if (second.state === "installed") return { merchantId, state: "installed" };
+    return { merchantId, state: "unknown", reason: second.reason };
+  } catch {
+    return { merchantId, state: "unknown", reason: "UNEXPECTED_RESPONSE" };
+  }
+}
+function isMassRevocation(uninstalled, checked) {
+  return uninstalled >= MASS_REVOCATION_MIN && uninstalled * 2 > checked;
+}
+async function checkInstallStates(stores, concurrency, recheckDelayMs) {
+  const list = Array.isArray(stores) ? stores : [];
+  const results = new Array(list.length);
+  let next = 0;
+  const worker = async () => {
+    while (next < list.length) {
+      const i = next++;
+      const store = list[i];
+      results[i] = await checkInstallState(store?.merchantId, store?.client, recheckDelayMs);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(concurrency, list.length) }, worker));
+  const uninstalled = results.filter((r) => r.state === "uninstalled").length;
+  if (!isMassRevocation(uninstalled, results.length)) return { results, massRevocation: false };
+  return {
+    massRevocation: true,
+    results: results.map((r) => r.state === "uninstalled" ? { merchantId: r.merchantId, state: "unknown", reason: "MASS_REVOCATION" } : r)
+  };
+}
+
+// src/oauth.ts
+var OAUTH_REFRESH = "oauth:refresh";
+var OAUTH_TOKEN = "oauth:token";
+var STORE_SUFFIXES = [".myikas.com", ".myikas.dev"];
+var OAUTH_ERROR = /^[a-z0-9_]{1,64}$/;
+function ikasTokenUrl(url) {
+  const host = url.hostname.toLowerCase();
+  const suffix = STORE_SUFFIXES.find((s) => host.endsWith(s));
+  if (!suffix) return void 0;
+  if (url.pathname.replace(/\/+$/, "") !== "/api/admin/oauth/token") return void 0;
+  const store = host.slice(0, -suffix.length);
+  if (!store || store.includes(".")) return void 0;
+  return store === "api" ? {} : { storeName: store };
+}
+function oauthNameFromBody(body) {
+  try {
+    let params;
+    if (body instanceof URLSearchParams) params = body;
+    else if (typeof body === "string") params = new URLSearchParams(body);
+    return params?.get("grant_type") === "refresh_token" ? OAUTH_REFRESH : OAUTH_TOKEN;
+  } catch {
+    return OAUTH_TOKEN;
+  }
+}
+function oauthErrorCode(data, status) {
+  const code = data && typeof data === "object" ? data.error : void 0;
+  return typeof code === "string" && OAUTH_ERROR.test(code) ? code : `HTTP_${status}`;
+}
+function fromStatus(status, data) {
+  const ok = status < 400;
+  return ok ? { status, ok } : { status, ok, error: { code: oauthErrorCode(data, status) } };
+}
+function validStatus(v) {
+  return typeof v === "number" && Number.isInteger(v) && v >= 100 && v <= 599;
+}
+function refreshResultOutcome(result) {
+  const r = result;
+  if (r && typeof r === "object" && validStatus(r.status)) return fromStatus(r.status, r.data);
+  return {};
+}
+function refreshErrorOutcome(err) {
+  const resp = err?.response;
+  if (resp && typeof resp === "object" && validStatus(resp.status)) return fromStatus(resp.status, resp.data);
+  return { ok: false, error: { code: "NETWORK" } };
+}
+
 // src/index.ts
 var exitFlushers = /* @__PURE__ */ new Set();
 var exitHookInstalled = false;
@@ -425,11 +544,6 @@ function registerExitFlush(fn) {
   } catch {
   }
 }
-var UNINSTALL_SCOPES = [
-  "store/app/deleted",
-  "store/app/uninstalled",
-  "store/authorizedApp/deleted"
-];
 var MARK = /* @__PURE__ */ Symbol.for("kanca.instrumented");
 var now = () => typeof performance !== "undefined" && typeof performance.now === "function" ? performance.now() : Date.now();
 function clampInt(v, def, min, max) {
@@ -471,12 +585,18 @@ function parseWebhookMeta(text) {
     return null;
   }
 }
-function noopKanca() {
+function checkInstallsOptions(options) {
+  return clampInt(options?.concurrency, 3, 1, 10);
+}
+function noopKanca(recheckDelayMs) {
   return {
     webhook: (handler) => async (req, ...rest) => handler(req, ...rest),
     fetch: ((input, init) => globalThis.fetch(input, init)),
     instrument: (client) => client,
     track: () => void 0,
+    checkInstall: (client, fields) => checkInstallState(fields?.merchantId, client, recheckDelayMs),
+    checkInstalls: (stores, options) => checkInstallStates(stores, checkInstallsOptions(options), recheckDelayMs),
+    trackRefresh: async (call) => await call(),
     flush: () => Promise.resolve(),
     enabled: false
   };
@@ -487,20 +607,21 @@ function createKanca(options = {}) {
     if (debug) console.debug(`[kanca] ${msg}`, ...args);
   };
   const warn = (msg) => console.warn(msg);
+  const recheckDelayMs = clampInt(options.installRecheckDelayMs, INSTALL_RECHECK_DELAY_MS, 0, 6e4);
   if (options.disabled) {
     log("disabled; SDK is a no-op");
-    return noopKanca();
+    return noopKanca(recheckDelayMs);
   }
   const key = typeof options.key === "string" ? options.key.trim() : "";
   if (!key) {
     log("no key (KANCA_KEY) configured; SDK is a no-op");
-    return noopKanca();
+    return noopKanca(recheckDelayMs);
   }
   if (!key.startsWith("kk_")) {
     warn(
       key.startsWith("kp_") ? "[kanca] createKanca() needs a server key (kk_...), got a public key (kp_...). Public keys are for reportVitals()/<KancaVitals/> only. SDK disabled." : "[kanca] KANCA_KEY must start with kk_. SDK disabled."
     );
-    return noopKanca();
+    return noopKanca(recheckDelayMs);
   }
   const maxBatchSize = clampInt(options.maxBatchSize, 100, 1, MAX_EVENTS_PER_BATCH);
   const transport = new Transport({
@@ -587,7 +708,6 @@ function createKanca(options = {}) {
             durationMs,
             error
           });
-          if (m?.scope && UNINSTALL_SCOPES.includes(m.scope)) emit({ ...base, type: "uninstall", name: "uninstall" });
         })
       );
       afterDelivery();
@@ -615,11 +735,17 @@ function createKanca(options = {}) {
     let method = "GET";
     let gql = false;
     let opName;
+    let tokenUrl;
     try {
       url = toUrl(input);
       method = (init?.method ?? (isRequest(input) ? input.method : "GET")).toUpperCase();
       gql = !!url && isIkasGraphqlUrl(url);
-      if (gql) {
+      tokenUrl = url ? ikasTokenUrl(url) : void 0;
+      if (tokenUrl) {
+        if (init && init.body != null) opName = Promise.resolve(oauthNameFromBody(bodyToString(init.body) ?? init.body));
+        else if (isRequest(input) && input.body) opName = input.clone().text().then(oauthNameFromBody, () => oauthNameFromBody(void 0));
+        else opName = Promise.resolve(oauthNameFromBody(void 0));
+      } else if (gql) {
         if (init && init.body != null) opName = Promise.resolve(operationNameFromBody(bodyToString(init.body)));
         else if (isRequest(input) && input.body) opName = input.clone().text().then(operationNameFromBody, () => "anonymous");
         else opName = Promise.resolve("anonymous");
@@ -637,7 +763,8 @@ function createKanca(options = {}) {
       const durationMs2 = now() - t0;
       try {
         const error = { code: "NETWORK", message: errorMessage(err) };
-        if (gql) observe((opName ?? Promise.resolve("anonymous")).then((name) => emit({ type: "graphql", name, ts, ok: false, durationMs: durationMs2, error })));
+        if (tokenUrl) recordOAuth(opName, ts, durationMs2, tokenUrl.storeName, { ok: false, error: { code: "NETWORK" } }, void 0);
+        else if (gql) observe((opName ?? Promise.resolve("anonymous")).then((name) => emit({ type: "graphql", name, ts, ok: false, durationMs: durationMs2, error })));
         else emit({ type: "rest", name: `${method} ${url.host}${url.pathname}`, ts, ok: false, durationMs: durationMs2, error });
       } catch {
       }
@@ -646,7 +773,15 @@ function createKanca(options = {}) {
     const durationMs = now() - t0;
     try {
       const status = res.status;
-      if (gql) {
+      if (tokenUrl) {
+        let clone;
+        try {
+          clone = status >= 400 ? res.clone() : void 0;
+        } catch {
+          clone = void 0;
+        }
+        recordOAuth(opName, ts, durationMs, tokenUrl.storeName, { status, ok: status < 400 }, clone);
+      } else if (gql) {
         let clone;
         try {
           clone = res.clone();
@@ -682,6 +817,32 @@ function createKanca(options = {}) {
     }
     return res;
   };
+  const recordOAuth = (name, ts, durationMs, storeName, outcome, errorBody) => {
+    observe(
+      (async () => {
+        let error = outcome.error;
+        if (errorBody && typeof outcome.status === "number") {
+          let data;
+          try {
+            data = JSON.parse(await errorBody.text());
+          } catch {
+            data = void 0;
+          }
+          error = { code: oauthErrorCode(data, outcome.status) };
+        }
+        emit({
+          type: "rest",
+          name: await (name ?? Promise.resolve(OAUTH_REFRESH)),
+          ts,
+          status: outcome.status,
+          ok: outcome.ok,
+          durationMs,
+          error,
+          attrs: storeName ? { storeName } : void 0
+        });
+      })()
+    );
+  };
   let warnedInstrument = false;
   const instrument = (client, opts) => {
     const c = client;
@@ -790,12 +951,52 @@ function createKanca(options = {}) {
       log("track failed", e);
     }
   };
+  const recordUninstall = (result) => {
+    if (result.state !== "uninstalled") return;
+    emit({ type: "uninstall", name: "uninstall", ts: Date.now(), merchantId: result.merchantId, attrs: { source: "check" } });
+    transport.scheduleSoon();
+  };
+  const checkInstall = async (client, fields) => {
+    const result = await checkInstallState(fields?.merchantId, client, recheckDelayMs);
+    recordUninstall(result);
+    return result;
+  };
+  const checkInstalls = async (stores, opts) => {
+    const out = await checkInstallStates(stores, checkInstallsOptions(opts), recheckDelayMs);
+    for (const r of out.results) recordUninstall(r);
+    return out;
+  };
+  const trackRefresh = async (call, fields) => {
+    const ts = Date.now();
+    const t0 = now();
+    const record = (outcome) => {
+      try {
+        const attrs = {};
+        if (typeof fields?.storeName === "string" && fields.storeName) attrs.storeName = fields.storeName;
+        emit({ type: "rest", name: OAUTH_REFRESH, ts, durationMs: now() - t0, merchantId: fields?.merchantId, attrs, ...outcome });
+      } catch (e) {
+        log("trackRefresh failed", e);
+      }
+    };
+    let result;
+    try {
+      result = await call();
+    } catch (err) {
+      record(refreshErrorOutcome(err));
+      throw err;
+    }
+    record(refreshResultOutcome(result));
+    return result;
+  };
   log(`enabled \u2192 ${options.endpoint || DEFAULT_ENDPOINT}`);
   return {
     webhook,
     fetch: kfetch,
     instrument,
     track,
+    checkInstall,
+    checkInstalls,
+    trackRefresh,
     flush,
     enabled: true
   };