@luckystack/core 0.10.2 → 0.12.0

package/AGENTS.md

@@ -0,0 +1,11 @@
+# @luckystack/core — design context
+
+Core owns the shared transport contracts and registration seams used by framework packages. Register infrastructure at boot and read it at call time; do not copy config defaults into consumers or bypass registries. Source: `src/projectConfig.ts`, `src/createRegistry.ts`, `src/index.ts`, `src/client.ts`.
+
+Keep the server barrel out of browser bundles; use `@luckystack/core/client`. Extend session types in the consumer rather than editing shared base types. Do not let observability adapters break request handling; redact sensitive fields before emitting context. Source: `src/errorTrackerRegistry.ts`, `src/redactedLogKeys.ts`.
+
+Security boundaries: cookie sessions use CSRF protection; token-mode bearer credentials are supplied explicitly. Do not enable bearer fallback in cookie mode without reviewing CSRF implications (`src/extractToken.ts`). Trust forwarded IP headers only when the reverse proxy and hop count are configured (`src/resolveClientIp.ts`); rate limits depend on this identity. Never relax origin checks for convenience (`src/checkOrigin.ts`). Redis keys and socket room names must remain isolated across tenants (`src/redisKeyFormatter.ts`, `src/roomNameFormatterRegistry.ts`).
+
+Multi-instance: the per-instance socket maps must stay unreachable from consumer code by default — use the cross-instance room helper, and take the raw server only for deliberate per-instance work with a lint opt-out that says why (ADR 0061, `src/roomSockets.ts`). A room-name formatter's `userId` is context, never part of a content room's physical name (ADR 0060). The Redis-adapter key, not the Redis server, defines the socket cluster; it separates environments but not their data (`src/socketRedisAdapter.ts`).
+
+Design discussions: `docs/` in this package and repository `docs/ARCHITECTURE_AUTH.md`, `docs/ARCHITECTURE_MULTI_INSTANCE.md`. Signatures and defaults live in source, not this file.

package/CHANGELOG.md

@@ -5,6 +5,24 @@ All notable changes to `@luckystack/core` are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.12.0] - 2026-10-15
+
+### Added
+
+- **ESLint rule `luckystack/no-untranslated-jsx-text`** (`@luckystack/core/eslint`, on as a warning): text in JSX goes through the project translator. It replaces `react/jsx-no-literals` from `eslint-plugin-react`, which stopped at ESLint 9 and was kept for this one rule. Same behaviour as the options the scaffold ran it with: JSX text and string/template literals in a child `{…}` are reported, attribute values are not, and punctuation, digits and units such as `px` are allowed. `allowedStrings` replaces that allow-list. A disable for `react/jsx-no-literals` becomes `luckystack/no-untranslated-jsx-text`.
+
+### Changed
+
+- The optional `eslint` peer accepts ESLint 9 and 10 (`^9.0.0 || ^10.0.0`), so a project already on ESLint 10 installs without a peer conflict. The bundled rules use no API that ESLint 10 removed.
+- Requires Node.js 22.13 or newer (was 20). Node 20 stopped receiving security updates in April 2026, and the scaffold's lint toolchain (ESLint 10) needs 22.13.
+
+## [0.11.0] - 2026-10-14
+
+### Changed
+
+- Type declarations are emitted per source file by TypeScript 7 (`tsc -b`) instead of one bundled `.d.ts` per entry, so the framework build no longer runs package by package. The exported types are unchanged; relative imports inside the declarations carry `.js`, so `moduleResolution: "node16"`/`"nodenext"` projects resolve them as before. The `prisma` export carries an explicit `PrismaClient` type, so its declaration references `@prisma/client` instead of Prisma's generated `.prisma/client` folder.
+- Package design guidance now ships as `AGENTS.md`, not `CLAUDE.md`. Handwritten docs focus on rationale and safety; exact API contracts remain in installed declarations/source.
+
 ## [0.10.2] - 2026-10-09
 
 ### Added

package/README.md

@@ -1,91 +1,5 @@
 # @luckystack/core
 
-> Foundation package for [LuckyStack](https://github.com/ItsLucky23/LuckyStack-v2). Socket-first transport contracts, Redis adapter, project-config registry, hooks registry, response normalization, rate limiting, and shared session types.
+Shared foundation for LuckyStack transport, configuration, session types and framework extension points. Install with `npm install @luckystack/core ioredis socket.io socket.io-client zod`. Add the optional `@prisma/client` only when using the default Prisma integration (see `package.json`). Import browser code from `@luckystack/core/client`, never the server barrel.
 
-Every other `@luckystack/*` package depends on this one.
-
-## Install
-
-```bash
-npm install @luckystack/core
-```
-
-Required peer dependencies you must install separately:
-
-```bash
-npm install ioredis socket.io socket.io-client zod
-```
-
-`@prisma/client` is an optional peer. Install it only when the project uses the default Prisma client; a registered custom database client or a DB-less project does not need it.
-
-## Quickstart
-
-The core package is mostly consumed transitively through `@luckystack/server`, `@luckystack/api`, etc. You typically only touch it directly to register your project config and to call low-level utilities.
-
-```ts
-import { registerProjectConfig, getProjectConfig, notify, redis, prisma } from '@luckystack/core';
-
-registerProjectConfig({
-  defaultLanguage: 'en',
-  session: { expiryDays: 30, basedToken: false, perUser: 'multiple' },
-  auth: {
-    emailMaxLength: 254,
-    passwordMinLength: 8,
-    passwordMaxLength: 128,
-    nameMaxLength: 64,
-    oauthStateTtlSeconds: 600,
-  },
-  // ...see ProjectConfig type for the full surface
-});
-
-const config = getProjectConfig();
-```
-
-## Subpath: `@luckystack/core/client`
-
-Browser-safe surface for the React/Vite bundle. Re-exports the pieces consumed by `@luckystack/sync`'s client transport (`projectConfig`, `notifier`, `socketState`, `offlineQueue`, `responseNormalizer`, `serviceRoute`, `socketEvents`, `socketStatusTypes`, `apiTypeStubs`, `sessionTypes`).
-
-```ts
-import { socket, isOnline, enqueueApiRequest } from '@luckystack/core/client';
-```
-
-## Public API (server entry)
-
-| Group | Exports |
-| --- | --- |
-| Project config | `registerProjectConfig`, `getProjectConfig`, `getProjectName`, `isProjectConfigRegistered`, `DEFAULT_PROJECT_CONFIG`. Types: `ProjectConfig`, `ProjectConfigInput`, `LoggingConfig`, `RateLimitingConfig`, `SessionConfig`, `SentryConfig`, `SentrySampleRates`, `HttpConfig`, `HttpStreamConfig`, `SecurityHeadersConfig`, `CorsConfig`, `AuthConfig`, `SocketConfig`, `SyncConfig`, `SyncStreamThrottleConfig`, `OfflineQueueConfig`, `DevConfig`, `PathsConfig`, `EmailConfig`, `EmailLoggingConfig`, `EmailEnvVarsConfig`, `EmailDefaultsConfig`. **`getProjectName()`** is the canonical way to read the project's Redis-prefix string — it resolves at call time in this order: (1) `projectConfig.session.projectName` if a consumer set it, (2) `process.env.PROJECT_NAME` (read after `dotenv` has loaded), (3) literal `'luckystack'` as the absolute fallback. Reach for it from any framework or project code that needs the prefix instead of duplicating the env-read pattern. |
-| Deploy + services config | `registerDeployConfig`, `getDeployConfig`, `isDeployConfigRegistered`, `registerServicesConfig`, `getServicesConfig`, `isServicesConfigRegistered`. Types: `DeployConfigShape`, `DeployResourceShape`, `DeployEnvironmentShape`, `DeployRoutingShape`, `DeployDevelopmentShape`, `ServicesConfigShape`, `ServiceDefinition`, `PresetDefinition` |
-| Runtime maps | `registerRuntimeMapsProvider`, `getRuntimeApiMaps`, `getRuntimeSyncMaps`. Types: `RuntimeMapsProvider`, `RuntimeApiMapsResult`, `RuntimeSyncMapsResult` |
-| DI clients | `registerPrismaClient`, `registerRedisClient`, `getPrismaClient`, `getRedisClient`, `isPrismaClientRegistered`, `isRedisClientRegistered` |
-| Notifier | `registerNotifier`, `getNotifier`, `notify`. Types: `Notifier`, `NotifyInput`, `NotifyParam` |
-| Email registry | `registerEmailSender`, `getEmailSender`, `isEmailSenderRegistered`. Types: `EmailSender`, `EmailMessage`, `EmailResult` (re-exported from `@luckystack/email` for convenience) |
-| Logger | `registerLogger`, `getLogger`, `isLoggerRegistered`, `resetLoggerForTests`, `createDevLogger`. Types: `Logger`, `LoggerContext`. Default logger is a thin wrapper over `console.{debug,info,warn,error}` with no color codes — safe in production. Call `registerLogger(createDevLogger())` from a dev-only entry to opt into the colored terminal output (which still depends on `initConsolelog()` to render the trailing color string). Plug in Pino / Winston / Datadog by registering an object that satisfies `Logger`. |
-| Redacted log keys | `registerRedactedLogKeys`, `getRedactedLogKeys`, `isRedactedLogKey`, `resetRedactedLogKeysForTests` |
-| Avatar / uploads | `registerAvatarConfig`, `getAvatarConfig`, `DEFAULT_AVATAR_CONFIG`, `serveAvatar`, `processUpload`. Types: `AvatarConfig`, `AvatarConfigInput`, `ProcessUploadInput`, `ProcessUploadResult`. **Path-traversal guard:** `serveAvatar` rejects any `fileId` that does not match `/^[A-Za-z0-9_-]{1,128}$/` with a 400 before touching the filesystem — `..`, slashes, and other path-separator characters cannot escape the configured upload directory. **`processUpload`** wraps the project-supplied encode/save callback with the framework's `onUploadStart` (stoppable) and `onUploadComplete` hook contract so consumer upload routes don't need to plumb the hooks themselves. Returns `{ status: 'success', sizeBytes }`, `{ status: 'rejected', errorCode }` (when `onUploadStart` returned a stop signal), or `{ status: 'error', reason, cause? }`. See [`src/settings/_api/updateUser_v1.ts`](../../src/settings/_api/updateUser_v1.ts) for the canonical avatar usage. |
-| Bind address | `registerBindAddress({ ip, port })` stores the intended pre-listen address; `registerBoundAddress({ ip, port })` stores `node:http`'s successful address; `getBindAddress() → { ip, port: string }` returns the actually-bound value. `resolveDevCallbackUrl(url)` rewrites only a stale direct loopback OAuth callback from intended → bound port, preserving explicit local router/reverse-proxy ingress. Env values remain legacy fallbacks. |
-| Locale reloader | `registerLocaleReloader`, `getLocaleReloader`. Type: `LocaleReloader` |
-| Hooks (async) | `registerHook`, `dispatchHook`, `clearAllHooks`. Types: `HookName`, `HookHandler`, `HookResult`, `HookStopSignal`, `HookPayloads`, `DispatchResult`, `HookSessionShape`. Canonical payload types: `PreApiValidatePayload`, `PostApiValidatePayload`, `PreApiExecutePayload`, `PostApiExecutePayload`, `PreApiRespondPayload`, `PostApiRespondPayload`, `ApiResponseEnvelope`, `PreSyncFanoutPayload`, `PostSyncFanoutPayload`, `ApiErrorPayload`, `SyncErrorPayload`, `RateLimitExceededPayload`, `CorsRejectedPayload`, `CsrfMismatchPayload`, `PreSessionRefreshPayload`, `PostSessionRefreshPayload`, `OnUploadStartPayload`, `OnUploadCompletePayload`. Feature-package payloads (`Pre/PostLogin`, `Pre/PostRegister`, `Pre/PostLogout`, `Pre/PostSessionCreate`, `Pre/PostSessionDelete`, `Pre/PostEmailSend`, `Pre/PostPresenceUpdate`, socket lifecycle, etc.) augment `HookPayloads` from their owning packages — see those packages' READMEs. |
-| Hooks (sync, mutators) | `registerSyncHook`, `dispatchSyncHook`. Types: `SyncHookName`, `SyncHookHandler`, `SyncHookPayloads`, `PreErrorNormalizePayload`, `PostErrorNormalizePayload`. Sync hook handlers must be synchronous (no `async`), mutate the payload object in place, and cannot stop the flow. Use them only for hot-path mutators like error-code remapping. |
-| Session types | `BaseSessionLayout`, `SessionLocation`, `AuthProps` |
-| Socket | `setIoInstance`, `getIoInstance`, `attachSocketRedisAdapter`, `socket`, `setSocket`, `incrementResponseIndex`, `waitForSocket`. Types: `SOCKETSTATUS`, `statusContent`, `apiMessage`, `syncMessage` |
-| Auth helpers | `extractTokenFromSocket`, `extractTokenFromRequest`, `validateRequest`, `isFalsy`, `allowedOrigin`. Types: `ValidationResult` |
-| Rate limiting | `checkRateLimit`, `getRateLimitStatus`, `clearRateLimit`, `clearAllRateLimits` |
-| Validation | `validateInputByType` (resolves to `@luckystack/devkit` lazily in dev) |
-| Persistence + env | `redis`, `prisma`, `db` exports, `env` exports |
-| Boot | `writeBootUuid`, `readBootUuid`, `resolveEnvKey`, `collectSynchronizedEnvKeys`, `computeSynchronizedEnvHashes`, `hashSynchronizedValue`, `initConsolelog` |
-| Offline queue | `isOnline`, `enqueueApiRequest`, `enqueueSyncRequest`, `removeApiQueueItem`, `removeSyncQueueItem`, `removeApiQueueItemsByKey`, `flushApiQueue`, `flushSyncQueue`, `getApiQueueSize`, `getSyncQueueSize` |
-| CSRF | `getCsrfToken`, `clearCsrfToken`, `httpFetch` |
-| Cookies + paths | All exports of `./cookies`, `./httpApiUtils`, and `./paths` (`getGeneratedApiDocsPath`, `getApiMethodMapPath`, etc.) |
-| Misc | `tryCatch`, `sleep`, `getParams`, response normalizers (`normalizeErrorResponse`, `extractLanguageFromHeader`, …), service-route helpers, socket-event constants |
-
-> Note: `apiRequest` is exported from `@luckystack/core/client`, not from the server entry. The server barrel does not pull React-coupled code.
-
-## Dependencies
-
-- Runtime: `@socket.io/redis-adapter`, `dotenv`
-- Required peers: `ioredis@^5.10.0`, `socket.io@^4.8.0`, `socket.io-client@^4.8.0`, `zod@^4.0.0`
-- Optional peer: `@prisma/client@^6.19.0` — only needed when the default Prisma client is used.
-
-## License
-
-MIT — see [LICENSE](../../LICENSE).
+Register project infrastructure before starting the server; let `@luckystack/server` handle ordinary bootstrapping. Keep cookie and bearer session modes distinct: cookie-backed writes require origin and CSRF protection. See [design context](./AGENTS.md), [configuration rationale](./docs/config-registry.md), and [security rationale](./docs/socket-bootstrap.md). Types, exports and defaults are in `src/` and `package.json`.

package/dist/apiInterceptors.d.ts

@@ -0,0 +1,36 @@
+export interface ApiRequestInterceptorContext {
+    /** Resolved route name (`<page>/<api>` or `system/<api>`). */
+    name: string;
+    /** Route version literal (e.g. `'v1'`). */
+    version: string;
+    /**
+     * Outgoing request payload. Mutate this object in place to augment the
+     * request (correlation id, feature-flag context, ...). Replacing the
+     * reference has no effect — mutate keys on the existing object.
+     */
+    data: Record<string, unknown>;
+}
+export interface ApiResponseInterceptorContext {
+    name: string;
+    version: string;
+    /** The response envelope the caller is about to receive (read-only intent). */
+    response: {
+        status: 'success' | 'error';
+        [key: string]: unknown;
+    };
+}
+export type ApiRequestInterceptor = (ctx: ApiRequestInterceptorContext) => void | Promise<void>;
+export type ApiResponseInterceptor = (ctx: ApiResponseInterceptorContext) => void | Promise<void>;
+/**
+ * Register an outgoing-request interceptor. Returns an unsubscribe function.
+ * Multiple interceptors run in registration order; each may mutate `ctx.data`.
+ */
+export declare function registerApiRequestInterceptor(interceptor: ApiRequestInterceptor): () => void;
+/**
+ * Register an incoming-response interceptor. Returns an unsubscribe function.
+ */
+export declare function registerApiResponseInterceptor(interceptor: ApiResponseInterceptor): () => void;
+export declare function dispatchApiRequestInterceptors(ctx: ApiRequestInterceptorContext): Promise<void>;
+export declare function dispatchApiResponseInterceptors(ctx: ApiResponseInterceptorContext): void;
+/** Test helper — drop every registered interceptor. Not part of the public API. */
+export declare function _resetApiInterceptorsForTests(): void;

package/dist/apiMethodMapRegistry.d.ts

@@ -0,0 +1,5 @@
+export type HttpMethodLiteral = 'GET' | 'POST' | 'PUT' | 'DELETE';
+export type ApiMethodMap = Record<string, Record<string, Record<string, HttpMethodLiteral>>>;
+export declare const registerApiMethodMap: (map: ApiMethodMap) => void;
+export declare const getRegisteredApiMethod: (pagePath: string, apiName: string, version: string) => HttpMethodLiteral | undefined;
+export declare const isApiMethodMapRegistered: () => boolean;

package/dist/apiRequest.d.ts

@@ -0,0 +1,71 @@
+import type { ApiTypeMap, StreamPayload } from './apiTypeStubs.js';
+export type ApiStreamEvent<T extends StreamPayload = StreamPayload> = T;
+export declare const resolveApiRequestHttpMethod: (apiName: string, version: string) => "DELETE" | "GET" | "POST" | "PUT";
+type DataRequired<T> = Record<string, never> extends T ? false : true;
+type UnionToIntersection<U> = (U extends unknown ? (arg: U) => void : never) extends ((arg: infer I) => void) ? I : never;
+type ApiRouteRecord = UnionToIntersection<{
+    [P in keyof ApiTypeMap]: {
+        [N in keyof ApiTypeMap[P] as P extends 'root' ? `system/${Extract<N, string>}` : `${Extract<P, string>}/${Extract<N, string>}`]: ApiTypeMap[P][N];
+    };
+}[keyof ApiTypeMap]>;
+type ApiFullName = Extract<keyof ApiRouteRecord, string>;
+type VersionsForFullName<F extends ApiFullName> = keyof ApiRouteRecord[F] & string;
+type Prettify<T> = {
+    [K in keyof T]: T[K];
+} & {};
+type InputForFullName<F extends ApiFullName, V extends VersionsForFullName<F>> = ApiRouteRecord[F][V] extends {
+    input: infer I;
+} ? I : never;
+type OutputForFullName<F extends ApiFullName, V extends VersionsForFullName<F>> = ApiRouteRecord[F][V] extends {
+    output: infer O;
+} ? O : never;
+type StreamForFullName<F extends ApiFullName, V extends VersionsForFullName<F>> = ApiRouteRecord[F][V] extends {
+    stream: infer S;
+} ? S : never;
+type ApiStreamCallbackForFullName<F extends ApiFullName, V extends VersionsForFullName<F>> = [
+    StreamForFullName<F, V>
+] extends [never] ? never : (event: ApiStreamEvent<Prettify<StreamForFullName<F, V> extends StreamPayload ? StreamForFullName<F, V> : StreamPayload>>) => void;
+type ApiParamsForFullName<F extends ApiFullName, V extends VersionsForFullName<F>> = DataRequired<InputForFullName<F, V>> extends true ? {
+    name: F;
+    version: V;
+    data: Prettify<InputForFullName<F, V>>;
+    abortable?: boolean;
+    disableErrorMessage?: boolean;
+    onStream?: ApiStreamCallbackForFullName<F, V>;
+    signal?: AbortSignal;
+    timeoutMs?: number | false;
+} : {
+    name: F;
+    version: V;
+    data?: Prettify<InputForFullName<F, V>>;
+    abortable?: boolean;
+    disableErrorMessage?: boolean;
+    onStream?: ApiStreamCallbackForFullName<F, V>;
+    signal?: AbortSignal;
+    timeoutMs?: number | false;
+};
+export interface ApiErrorResponse extends Record<string, unknown> {
+    status: 'error';
+    httpStatus: number;
+    message: string;
+    errorCode: string;
+    errorParams?: {
+        key: string;
+        value: string | number | boolean;
+    }[];
+}
+/**
+ * Type-safe API request function.
+ *
+ * @example
+ * ```typescript
+ * // Full name usage - includes page in the name
+ * const result = await apiRequest({ name: 'examples/publicApi', version: 'v1', data: { message: 'hello' } });
+ * // result is typed correctly for publicApi
+ *
+ * // Global APIs use service-first naming
+ * await apiRequest({ name: 'system/session', version: 'v1' });
+ * ```
+ */
+export declare function apiRequest<F extends ApiFullName, V extends VersionsForFullName<F>>(params: ApiParamsForFullName<F, V>): Promise<Prettify<OutputForFullName<F, V>> | ApiErrorResponse>;
+export {};

package/dist/apiTypeStubs.d.ts

@@ -1,7 +1,5 @@
-interface ApiTypeMap {
+export interface ApiTypeMap {
 }
-interface SyncTypeMap {
+export interface SyncTypeMap {
 }
-type StreamPayload = Record<string, unknown>;
-
-export type { ApiTypeMap, StreamPayload, SyncTypeMap };
+export type StreamPayload = Record<string, unknown>;

package/dist/avatarConfig.d.ts

@@ -0,0 +1,22 @@
+import { type DeepPartial } from './configUtils.js';
+export interface AvatarConfig {
+    /**
+     * File format(s) the framework will look for on disk, in order. The first
+     * one that exists wins. Each entry is `{ extension, contentType }` so the
+     * `Content-Type` response header matches what the file actually is.
+     * Default: `[{ extension: 'webp', contentType: 'image/webp' }]`.
+     */
+    formats: {
+        extension: string;
+        contentType: string;
+    }[];
+    /**
+     * `Cache-Control` value sent with the avatar response.
+     * Default: `'public, max-age=86400'` (24 hours).
+     */
+    cacheControl: string;
+}
+export declare const DEFAULT_AVATAR_CONFIG: AvatarConfig;
+export type AvatarConfigInput = DeepPartial<AvatarConfig>;
+export declare const registerAvatarConfig: (config: AvatarConfigInput) => void;
+export declare const getAvatarConfig: () => AvatarConfig;

package/dist/bindAddress.d.ts

@@ -0,0 +1,15 @@
+interface BindAddress {
+    ip: string;
+    port: number;
+}
+interface IntendedBindAddress extends BindAddress {
+    configuredPort?: number;
+}
+export declare const registerBindAddress: (address: IntendedBindAddress) => void;
+export declare const registerBoundAddress: (address: BindAddress) => void;
+export declare const getBindAddress: () => {
+    ip: string;
+    port: string;
+};
+export declare const resolveDevCallbackUrl: (callbackUrl: string) => string;
+export {};

package/dist/bootUuid.d.ts

@@ -0,0 +1,24 @@
+export declare const BOOT_KEY_PREFIX = "luckystack:boot:";
+export declare const resolveEnvKey: () => string;
+export declare const writeBootUuid: (envKey?: string) => Promise<string>;
+export declare const readBootUuid: (envKey?: string) => Promise<string | null>;
+/**
+ * Extends the current environment boot UUID without rotating its value.
+ *
+ * Every healthy backend may renew the environment-level key, so multi-instance
+ * deployments do not depend on whichever process happened to write it last. If
+ * Redis recovered after the key expired, the first refresher writes a new UUID.
+ */
+export declare const refreshBootUuid: (envKey?: string) => Promise<void>;
+export interface BootUuidHeartbeat {
+    stop: () => void;
+}
+/**
+ * Keeps the Redis boot UUID alive for as long as this backend is running.
+ *
+ * The self-rescheduling timeout waits for each Redis operation to settle before
+ * scheduling another, so an outage cannot accumulate overlapping refreshes.
+ * The timer is unref'd and therefore never keeps an otherwise-finished process
+ * alive. Failures are logged and retried on the next interval.
+ */
+export declare const startBootUuidHeartbeat: (envKey?: string) => BootUuidHeartbeat;

package/dist/cancelRegistry.d.ts

@@ -0,0 +1,7 @@
+export declare const registerSyncAbortController: (socketId: string, cb: string, controller: AbortController) => string;
+export declare const unregisterSyncAbortController: (key: string) => void;
+export declare const abortSyncByCb: (socketId: string, cb: string) => boolean;
+export declare const registerApiAbortController: (socketId: string, responseIndex: number | string, controller: AbortController) => string;
+export declare const unregisterApiAbortController: (key: string) => void;
+export declare const abortApiByResponseIndex: (socketId: string, responseIndex: number | string) => boolean;
+export declare const abortAllForSocket: (socketId: string) => void;

package/dist/checkOrigin.d.ts

@@ -0,0 +1,6 @@
+export declare const normalizeOrigin: ({ value, secure }: {
+    value: string;
+    secure: boolean;
+}) => string;
+declare const allowedOrigin: (origin: string) => boolean;
+export default allowedOrigin;

package/dist/{chunk-IJYNVM2W.js → chunk-P3SSLA3E.js}

@@ -163,7 +163,7 @@ var sanitizeErrorString = (value) => {
   let result = value;
   for (const key of getRedactedLogKeys()) {
     const { urlParam, logLabel } = buildScrubPattern(key);
-    result = result.replace(urlParam, REDACTED_PLACEHOLDER).replace(logLabel, REDACTED_PLACEHOLDER);
+    result = result.replace(urlParam, () => REDACTED_PLACEHOLDER).replace(logLabel, () => REDACTED_PLACEHOLDER);
   }
   return result;
 };
@@ -368,4 +368,4 @@ export {
   setSentryUser,
   startSpan
 };
-//# sourceMappingURL=chunk-IJYNVM2W.js.map
+//# sourceMappingURL=chunk-P3SSLA3E.js.map

package/dist/chunk-P3SSLA3E.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/redactedLogKeys.ts","../src/loggerRegistry.ts","../src/errorTrackerRegistry.ts","../src/sentrySetup.ts"],"sourcesContent":["//? Registry of log keys that get masked when the framework prints request /\n//? response payloads. Feature packages register their domain-specific\n//? sensitive keys at boot (login → `password`, email → `apiKey`, etc.) so a\n//? consumer of the package never has to remember to extend a static list in\n//? core to keep their own data out of logs.\n//?\n//? Lookups are case-insensitive. Keys are merged with the framework defaults;\n//? `registerRedactedLogKeys` is additive — duplicate calls are idempotent.\n\nexport const DEFAULT_REDACTED_LOG_KEYS: readonly string[] = [\n  'password',\n  'confirmpassword',\n  'token',\n  'newtoken',\n  'authorization',\n  'cookie',\n  'set-cookie',\n  'csrftoken',\n  'apikey',\n  'secret',\n  //? 2FA (ADR 0024). `totpSecret` already matches the `secret` suffix, but\n  //? `recoveryCodes` matches neither the exact set nor any suffix — list it\n  //? explicitly so the log-redaction floor mirrors the session sanitizer,\n  //? which strips both `totpSecret` and `recoveryCodes`.\n  'recoverycodes',\n];\n\nconst redactedKeys = new Set<string>(DEFAULT_REDACTED_LOG_KEYS.map((key) => key.toLowerCase()));\n\n//? Sensitive SUFFIXES (0.2.0 widening). Exact-match alone missed compound keys\n//? a project naturally produces — `targetToken`, `sessionToken`, `clientSecret`,\n//? `stripeApiKey` — leaving real secrets in logs/breadcrumbs. A key whose\n//? lowercased form ENDS WITH one of these is redacted in addition to the exact\n//? set above. Suffix (not arbitrary substring) is deliberate: it catches the\n//? `<qualifier><Sensitive>` naming convention while a plain `substring` test\n//? would over-redact benign keys (e.g. a `tokenCount` metric, a `secretSanta`\n//? field). Kept conservative on purpose — register extra keys explicitly via\n//? `registerRedactedLogKeys` for project-specific names that don't fit.\nconst SENSITIVE_KEY_SUFFIXES: readonly string[] = ['token', 'secret', 'apikey', 'password'];\n\nexport const registerRedactedLogKeys = (keys: readonly string[]): void => {\n  for (const key of keys) {\n    redactedKeys.add(key.toLowerCase());\n  }\n};\n\nexport const getRedactedLogKeys = (): readonly string[] => [...redactedKeys];\n\nexport const isRedactedLogKey = (key: string): boolean => {\n  const lower = key.toLowerCase();\n  if (redactedKeys.has(lower)) return true;\n  return SENSITIVE_KEY_SUFFIXES.some((suffix) => lower.endsWith(suffix));\n};\n\n//? Test-only helper — restore the default seed set between integration tests.\n//? Never call from production code; framework packages register their own\n//? keys at boot and clearing would re-expose them.\nexport const resetRedactedLogKeysForTests = (): void => {\n  redactedKeys.clear();\n  for (const key of DEFAULT_REDACTED_LOG_KEYS) {\n    redactedKeys.add(key.toLowerCase());\n  }\n};\n\n/** Placeholder substituted for a redacted value. */\nexport const REDACTED_PLACEHOLDER = '[redacted]';\n\n//? Distinct from REDACTED_PLACEHOLDER so an over-deep BENIGN value (a numeric id,\n//? a timestamp) isn't mislabeled as a masked secret — the marker reads as\n//? structural truncation, not redaction.\nexport const DEPTH_TRUNCATED_PLACEHOLDER = '[truncated: max depth]';\n\n//? Depth cap so a self-referential / pathologically deep object can't make the\n//? sanitize pass blow the stack on a hot log/capture path.\nconst MAX_SANITIZE_DEPTH = 8;\n\n/**\n * Recursively deep-copy `value`, replacing any property whose key matches the\n * registered redacted-keys set (case-insensitive) with {@link REDACTED_PLACEHOLDER}\n * (SYNC-17 defense-in-depth). Use it at raw log / `captureException` context\n * sites so a token/password nested anywhere in a payload never lands verbatim in\n * a logger sink or error-tracker breadcrumb.\n *\n * - Primitives pass through unchanged.\n * - Arrays are mapped element-wise (array indices are never \"keys\", so an\n *   element is only redacted by its own nested object keys).\n * - Cycles / over-deep graphs are cut at {@link MAX_SANITIZE_DEPTH} with\n *   {@link DEPTH_TRUNCATED_PLACEHOLDER}; the input is never mutated.\n */\nexport const sanitizeForLog = (value: unknown, depth = 0, _seen?: WeakSet<object>): unknown => {\n  if (depth > MAX_SANITIZE_DEPTH) return DEPTH_TRUNCATED_PLACEHOLDER;\n  if (value === null || typeof value !== 'object') return value;\n\n  //? Cycle detection: if we have already visited this reference higher up in the\n  //? call stack, replace it with a marker rather than recursing into it — this\n  //? prevents a stack overflow when `value` contains a circular reference (e.g.\n  //? an Error whose `.cause` links back to itself, or a Node IncomingMessage\n  //? with circular HTTP-socket references).\n  const seen = _seen ?? new WeakSet<object>();\n  if (seen.has(value)) return '[circular]';\n  seen.add(value);\n\n  if (Array.isArray(value)) {\n    return value.map((item) => sanitizeForLog(item, depth + 1, seen));\n  }\n\n  const out: Record<string, unknown> = {};\n  for (const [key, nested] of Object.entries(value as Record<string, unknown>)) {\n    out[key] = isRedactedLogKey(key) ? REDACTED_PLACEHOLDER : sanitizeForLog(nested, depth + 1, seen);\n  }\n  return out;\n};\n","//? Pluggable logger so framework code does not have to write directly to\n//? stdout. The default implementation uses `console.{debug,info,warn,error}`\n//? directly with no trailing color-code argument — that argument was only\n//? meaningful when `initConsolelog()` (a dev-only monkey-patch) had been\n//? installed, but the default logger needs to be safe in production too.\n//?\n//? Installers route framework logs to Pino / Winston / Datadog / etc. by\n//? calling `registerLogger({ debug, info, warn, error })` once at boot,\n//? mirroring the rest of the registry pattern in this package. Dev installs\n//? that want colored output should call `registerLogger(createDevLogger())`.\n//?\n//? Read at call-time via `getLogger()` so registration order does not matter\n//? — same contract as `getProjectConfig()` and friends.\n\nimport { createRegistry } from './createRegistry';\nimport { getProjectConfig } from './projectConfig';\n\nexport type LoggerContext = Record<string, unknown>;\n\nexport interface Logger {\n  debug: (message: string, context?: LoggerContext) => void;\n  info: (message: string, context?: LoggerContext) => void;\n  warn: (message: string, context?: LoggerContext) => void;\n  error: (message: string, error?: unknown, context?: LoggerContext) => void;\n}\n\n//? Prefix a log message with an ISO-8601 UTC timestamp when\n//? `logging.timestamps` is on (the default). Read at call time so a consumer's\n//? config registration order doesn't matter, and so it can be toggled off under\n//? a log aggregator that stamps its own time. Only the framework's BUILT-IN\n//? loggers use this — a registered custom logger owns its own formatting.\nconst withTimestamp = (message: string): string =>\n  getProjectConfig().logging.timestamps ? `[${new Date().toISOString()}] ${message}` : message;\n\nconst defaultLogger: Logger = {\n  debug: (message, context) => {\n    if (context === undefined) {console.debug(withTimestamp(message));}\n    else {console.debug(withTimestamp(message), context);}\n  },\n  info: (message, context) => {\n    if (context === undefined) {console.info(withTimestamp(message));}\n    else {console.info(withTimestamp(message), context);}\n  },\n  warn: (message, context) => {\n    if (context === undefined) {console.warn(withTimestamp(message));}\n    else {console.warn(withTimestamp(message), context);}\n  },\n  error: (message, error, context) => {\n    if (error !== undefined && context !== undefined) console.error(withTimestamp(message), error, context);\n    else if (error !== undefined) console.error(withTimestamp(message), error);\n    else if (context === undefined) {console.error(withTimestamp(message));}\n    else {console.error(withTimestamp(message), context);}\n  },\n};\n\n//? Dev-mode logger factory: wraps the default behavior with the colored\n//? terminal output that `initConsolelog()` produces. Install via\n//? `registerLogger(createDevLogger())` from a dev-only entry. Note: this\n//? still depends on `initConsolelog()` having been called to interpret the\n//? trailing color string — without it, the codes will appear as literal\n//? text. Use the default logger when running in production or unsure.\nexport const createDevLogger = (): Logger => ({\n  debug: (message, context) => {\n    if (context === undefined) {console.log(withTimestamp(message), 'cyan');}\n    else {console.log(withTimestamp(message), context, 'cyan');}\n  },\n  info: (message, context) => {\n    if (context === undefined) {console.log(withTimestamp(message));}\n    else {console.log(withTimestamp(message), context);}\n  },\n  warn: (message, context) => {\n    if (context === undefined) {console.log(withTimestamp(message), 'yellow');}\n    else {console.log(withTimestamp(message), context, 'yellow');}\n  },\n  error: (message, error, context) => {\n    if (error !== undefined && context !== undefined) console.log(withTimestamp(message), error, context, 'red');\n    else if (error !== undefined) console.log(withTimestamp(message), error, 'red');\n    else if (context === undefined) {console.log(withTimestamp(message), 'red');}\n    else {console.log(withTimestamp(message), context, 'red');}\n  },\n});\n\nconst registry = createRegistry<Logger>(defaultLogger);\n\nexport const registerLogger = (logger: Logger): void => {\n  registry.register(logger);\n};\n\nexport const getLogger = (): Logger => registry.get();\n\nexport const isLoggerRegistered = (): boolean => registry.isRegistered();\n\n//? Test-only helper — restore the default logger between integration tests.\n//? Never call from production code.\nexport const resetLoggerForTests = (): void => {\n  registry.reset();\n};\n","//? Backend-agnostic error-tracker registry. Lives in @luckystack/core\n//? (not @luckystack/error-tracking) because framework code in core /\n//? api / sync needs to call it without taking a hard dep on a specific\n//? observability backend. The error-tracking package provides adapter\n//? IMPLEMENTATIONS (Sentry, Datadog, PostHog); the slot lives here.\n//?\n//? Multiple adapters can be registered at once via `registerErrorTrackers([...])` —\n//? every event fans out to all of them. Per-adapter errors are swallowed\n//? so one buggy tracker can't break the chain.\n\n//? The AsyncLocalStorage identity scope deliberately lives in the separate\n//? server-only errorTrackerIdentity.ts module. This registry is also reached by\n//? the browser-safe legacy capture seam, so it must remain free of node:* imports.\nimport type { ErrorTrackerUser } from './errorTrackerIdentity';\nimport { getRedactedLogKeys, REDACTED_PLACEHOLDER, sanitizeForLog } from './redactedLogKeys';\nimport { getLogger } from './loggerRegistry';\n\nexport type { ErrorTrackerUser } from './errorTrackerIdentity';\n\nexport type ErrorTrackerContext = Record<string, unknown>;\n\n//? SYNC-17 defense-in-depth: scrub registered redacted keys (tokens, passwords,\n//? auth/cookie headers) from the context object before it fans out to any\n//? adapter, so a raw token nested in a capture context never reaches Sentry /\n//? Datadog / PostHog breadcrumbs. Returns the original reference when there is\n//? nothing to sanitize (no context) to avoid needless allocation on the hot path.\nconst sanitizeContext = (context?: ErrorTrackerContext): ErrorTrackerContext | undefined => {\n  if (!context) return context;\n  return sanitizeForLog(context) as ErrorTrackerContext;\n};\n\n//? ET-O2 value-level scrub: error.message and error.stack can contain\n//? interpolated secrets (\"token=abc123\") that bypass the key-based context\n//? scrub. Replace `key=value` and `key: value` patterns for every registered\n//? redacted key so the string never reaches an adapter verbatim.\n//? Runs at capture time (not on every Error construction) to stay off the\n//? hot path; the result is cached on the sanitized context so each adapter\n//? fan-out step reads the same pre-scrubbed string.\n//? BOOT-TIME ONLY: `registerRedactedLogKeys` must be called at boot with a\n//? static key set (framework package init / project boot). Calling it with\n//? dynamically generated strings (route names, tenant IDs, etc.) at request\n//? time will cause this cache to grow without bound. A hard cap (200 entries)\n//? logs a warning when exceeded so misuse is immediately diagnosable.\nconst REDACTED_VALUE_RE_CACHE_MAX = 200;\ninterface ScrubPatternPair {\n  urlParam: RegExp;   // matches <key>=<value> (URL-param style)\n  logLabel: RegExp;   // matches <key>: <value> (log-label style)\n}\nconst REDACTED_VALUE_RE_CACHE = new Map<string, ScrubPatternPair>();\n\nconst buildScrubPattern = (key: string): ScrubPatternPair => {\n  const cached = REDACTED_VALUE_RE_CACHE.get(key);\n  if (cached) return cached;\n  if (REDACTED_VALUE_RE_CACHE.size >= REDACTED_VALUE_RE_CACHE_MAX) {\n    try {\n      getLogger().warn(`errorTracker: REDACTED_VALUE_RE_CACHE exceeded ${String(REDACTED_VALUE_RE_CACHE_MAX)} entries — registerRedactedLogKeys must only be called at boot with a static key set, not with dynamic/runtime-varying strings.`);\n    } catch {\n      // last-resort swallow\n    }\n  }\n  const escaped = key.replaceAll(/[.*+?^${}()|[\\]\\\\]/g, String.raw`\\$&`);\n  //? Two separate passes — one for `key=value` (URL-param style), one for\n  //? `key: value` (log-label style) — to avoid alternation complexity and the\n  //? subtle behaviours that arise when mixing capturing and non-capturing groups\n  //? inside a single pattern (ET-O2 alternation fix).\n  //? `+` (not `*`) for the value portion so `key=` with an empty value is NOT\n  //? replaced (empty parameters are not secrets worth scrubbing and a `*` match\n  //? would turn innocent `foo=` markers into `[redacted]`).\n  const pair: ScrubPatternPair = {\n    urlParam: new RegExp(String.raw`${escaped}=[^\\s,;\"'&]+`, 'gi'),\n    logLabel: new RegExp(String.raw`${escaped}:\\s*[^\\s,;\"']+`, 'gi'),\n  };\n  REDACTED_VALUE_RE_CACHE.set(key, pair);\n  return pair;\n};\n\nexport const sanitizeErrorString = (value: string): string => {\n  let result = value;\n  // Scrub matching `key=value` / `key: value` patterns for every registered\n  // redacted key so interpolated secrets (e.g. \"token=abc\") never reach an adapter.\n  for (const key of getRedactedLogKeys()) {\n    const { urlParam, logLabel } = buildScrubPattern(key);\n    result = result.replace(urlParam, () => REDACTED_PLACEHOLDER).replace(logLabel, () => REDACTED_PLACEHOLDER);\n  }\n  return result;\n};\n\n//? Produce a sanitized version of an Error's message and stack so adapters\n//? can emit pre-scrubbed strings without touching the original Error object.\nexport const sanitizeErrorStrings = (\n  error: unknown,\n): { message: string; stack: string | undefined } | null => {\n  if (!(error instanceof Error)) return null;\n  return {\n    message: sanitizeErrorString(error.message),\n    stack: error.stack === undefined ? undefined : sanitizeErrorString(error.stack),\n  };\n};\n\nexport interface ErrorTrackerEvent {\n  /** When false, the adapter must not forward this event (beforeSend opt-out). */\n  forwarded: boolean;\n  kind: 'exception' | 'message';\n  payload: Record<string, unknown>;\n}\n\n//? `SpanResult<T>` was a conditional unwrap of Promise. It's now an alias\n//? for `T` directly because the conditional collapsed to T in both branches\n//? and tsup's dts emit choked on the conditional widening. Kept as an\n//? exported alias so adapter authors can still annotate with `SpanResult<T>`\n//? for documentation intent.\nexport type SpanResult<T> = T;\n\nexport interface ErrorTracker {\n  /** Human-readable identifier (logs, diagnostics). */\n  name: string;\n  captureException: (error: unknown, context?: ErrorTrackerContext) => void;\n  captureMessage: (\n    message: string,\n    level: 'info' | 'warning' | 'error' | 'fatal',\n    context?: ErrorTrackerContext,\n  ) => void;\n  setUser: (user: ErrorTrackerUser | null) => void;\n  setContext?: (key: string, context: ErrorTrackerContext | null) => void;\n  startSpan?: <T>(name: string, op: string, fn: () => T) => T;\n  /**\n   * Optional handle-style span (#62): open a span NOW and close it later via the\n   * returned handle's `finish()`. Unlike {@link startSpan} (which wraps a single\n   * synchronous `fn`), this fits an open-at-preExecute / close-at-postExecute\n   * request lifecycle that spans awaits. When present, the registry-level\n   * {@link startSpanHandle} delegates to the FIRST registered adapter that\n   * implements it so the request span reaches an adapter-only backend\n   * (Datadog/PostHog/custom), not just the legacy Sentry SDK path.\n   */\n  startSpanHandle?: (name: string, op: string) => { finish: () => void };\n  recordMetric?: (name: string, value: number, tags?: Record<string, string>) => void;\n  beforeSend?: (event: ErrorTrackerEvent) => ErrorTrackerEvent | null;\n  /**\n   * Optional flush lifecycle hook (error-tracking ET batch). Called by\n   * {@link flushErrorTrackers} on graceful shutdown so a buffered adapter\n   * (PostHog batch, Sentry transport) can drain in-flight events before exit.\n   * Returns a promise that resolves when the adapter has flushed.\n   */\n  flush?: () => Promise<void>;\n}\n\n//? Pre-capture filter (error-tracking ET batch). A registered filter runs on\n//? EVERY event just before fan-out; returning `false` DROPS the event entirely\n//? (e.g. suppress known-noisy errors, sample, or honour a per-event opt-out).\n//? Distinct from a per-adapter `beforeSend` (which transforms a single adapter's\n//? payload) — this gates the whole fan-out. Last-write-wins; `null` clears it.\nexport type PreCaptureFilter = (event: ErrorTrackerEvent) => boolean;\nlet preCaptureFilter: PreCaptureFilter | null = null;\n\nexport const registerPreCaptureFilter = (filter: PreCaptureFilter | null): void => {\n  preCaptureFilter = filter;\n};\n\nconst passesPreCaptureFilter = (kind: 'exception' | 'message', payload: Record<string, unknown>): boolean => {\n  if (!preCaptureFilter) return true;\n  try {\n    return preCaptureFilter({ forwarded: true, kind, payload });\n  } catch {\n    //? A throwing filter must not swallow telemetry — fail OPEN (forward).\n    return true;\n  }\n};\n\n//? ET-O6: the pre-capture filter payload now includes the error / message\n//? so filters can drop noisy errors by type/message (the documented use case).\n//? Separate helpers per kind so the call site stays type-safe.\nconst exceptionFilterPayload = (\n  error: unknown,\n  context: ErrorTrackerContext | undefined,\n): Record<string, unknown> => ({ error, context: context ?? null });\n\nconst messageFilterPayload = (\n  message: string,\n  level: string,\n  context: ErrorTrackerContext | undefined,\n): Record<string, unknown> => ({ message, level, context: context ?? null });\n\nlet activeTrackers: ErrorTracker[] = [];\n\n//? REPLACE semantics — last-write-wins (ET-24 confirmed standard). Use\n//? `appendErrorTracker` when you need accumulate-not-replace (ET-05).\nexport const registerErrorTracker = (tracker: ErrorTracker): void => {\n  activeTrackers = [tracker];\n};\n\nexport const registerErrorTrackers = (trackers: ErrorTracker[]): void => {\n  activeTrackers = [...trackers];\n};\n\n/**\n * APPEND primitive (ET-05): add a tracker WITHOUT clobbering already-registered\n * ones. Fixes the async-PostHog-vs-consumer-overlay race where the loser of\n * `registerErrorTracker`'s replace silently vanished. De-duplicates by `name`\n * (re-appending the same adapter name replaces that one entry in place) so a\n * lazy adapter that registers a proxy then the real client doesn't double-fire.\n */\nexport const appendErrorTracker = (tracker: ErrorTracker): void => {\n  const withoutSameName = activeTrackers.filter((t) => t.name !== tracker.name);\n  activeTrackers = [...withoutSameName, tracker];\n};\n\nexport const getActiveErrorTrackers = (): ErrorTracker[] => activeTrackers;\n\n/**\n * Flush lifecycle (error-tracking ET batch): drain every adapter that exposes a\n * `flush()` before shutdown. Per-adapter failures are swallowed + logged so one\n * stuck adapter can't block graceful shutdown. Safe to call when no adapter has\n * `flush`.\n */\nexport const flushErrorTrackers = async (): Promise<void> => {\n  await Promise.all(\n    activeTrackers.map(async (tracker) => {\n      if (!tracker.flush) return;\n      try {\n        await tracker.flush();\n      } catch (error) {\n        //? ET-O7: route to the shared failure logger (but never re-throw — a\n        //? failing flush must not block graceful shutdown).\n        logTrackerFailure(tracker.name, 'flush', error);\n      }\n    }),\n  );\n};\n\nexport const captureExceptionAcrossTrackers = (\n  error: unknown,\n  context?: ErrorTrackerContext,\n): void => {\n  const safeContext = sanitizeContext(context);\n  if (!passesPreCaptureFilter('exception', exceptionFilterPayload(error, safeContext))) return;\n  for (const tracker of activeTrackers) {\n    try {\n      tracker.captureException(error, safeContext);\n    } catch (trackerError) {\n      //? Fan-out error logging (error-tracking ET batch): a buggy tracker must\n      //? not break the chain, but its failure was previously invisible. Log it\n      //? (best-effort) so a misbehaving adapter is diagnosable.\n      logTrackerFailure(tracker.name, 'captureException', trackerError);\n    }\n  }\n};\n\nexport const captureMessageAcrossTrackers = (\n  message: string,\n  level: 'info' | 'warning' | 'error' | 'fatal',\n  context?: ErrorTrackerContext,\n): void => {\n  const safeContext = sanitizeContext(context);\n  if (!passesPreCaptureFilter('message', messageFilterPayload(message, level, safeContext))) return;\n  for (const tracker of activeTrackers) {\n    try {\n      tracker.captureMessage(message, level, safeContext);\n    } catch (trackerError) {\n      logTrackerFailure(tracker.name, 'captureMessage', trackerError);\n    }\n  }\n};\n\n//? Best-effort fan-out failure logger. Wrapped in its own try/catch because the\n//? logger itself could throw on a broken sink, and a capture path must never\n//? throw.\nconst logTrackerFailure = (trackerName: string, op: string, error: unknown): void => {\n  try {\n    getLogger().warn(`errorTracker: \"${trackerName}\" threw in ${op}`, { error });\n  } catch {\n    // Last-resort swallow.\n  }\n};\n\nexport const setErrorTrackerUser = (user: ErrorTrackerUser | null): void => {\n  for (const tracker of activeTrackers) {\n    try {\n      tracker.setUser(user);\n    } catch (error) {\n      //? ET-O7: route to the shared failure logger so a misbehaving tracker is diagnosable.\n      logTrackerFailure(tracker.name, 'setUser', error);\n    }\n  }\n};\n\nexport const recordMetricAcrossTrackers = (\n  name: string,\n  value: number,\n  tags?: Record<string, string>,\n): void => {\n  for (const tracker of activeTrackers) {\n    if (tracker.recordMetric) {\n      try {\n        tracker.recordMetric(name, value, tags);\n      } catch (error) {\n        //? ET-O7: route to the shared failure logger so a misbehaving tracker is diagnosable.\n        logTrackerFailure(tracker.name, 'recordMetric', error);\n      }\n    }\n  }\n};\n\nexport const startSpanAcrossTrackers = <T>(name: string, op: string, fn: () => T): T => {\n  //? Spans don't fan out cleanly to multiple backends — they're nested\n  //? execution scopes. We only invoke the FIRST registered tracker's\n  //? startSpan (others get notified via captureException paths if they\n  //? want to instrument). When no tracker supports spans, run the fn directly.\n  const first = activeTrackers.find((t) => t.startSpan);\n  if (!first?.startSpan) return fn();\n  return first.startSpan(name, op, fn);\n};\n\n/**\n * Handle-style span (error-tracking ET batch): for callers that can't wrap the\n * measured work in a single synchronous `fn` (streaming, cross-await spans).\n * Returns a handle whose `finish()` resolves the span's duration. The default\n * implementation is a lightweight wall-clock timer (works with any backend);\n * an adapter can supply a richer span via the existing `startSpan` callback\n * form when it needs native instrumentation. `finish()` is idempotent.\n */\nexport interface SpanHandle {\n  /** Stop the span; safe to call more than once (subsequent calls are no-ops). */\n  finish: () => void;\n  /** Milliseconds elapsed at the moment `finish()` first ran (0 before). */\n  readonly durationMs: number;\n}\n\n//? #62: open a handle-style span on the FIRST registered adapter that implements\n//? `startSpanHandle`, swallowing a throwing adapter so the wall-clock handle still\n//? works (telemetry must never break the request path). Returns `null` when no\n//? adapter supports handle-style spans.\nconst openDelegateSpanHandle = (name: string, op: string): { finish: () => void } | null => {\n  const tracker = activeTrackers.find((t) => t.startSpanHandle);\n  if (!tracker?.startSpanHandle) return null;\n  try {\n    return tracker.startSpanHandle(name, op);\n  } catch (error) {\n    logTrackerFailure(tracker.name, 'startSpanHandle', error);\n    return null;\n  }\n};\n\n//? #62: delegate the handle to the first adapter that supports `startSpanHandle`\n//? (so an adapter-only consumer — Datadog/PostHog/custom, no legacy Sentry SDK —\n//? actually gets request-timing spans), and ALWAYS keep the wall-clock timer as a\n//? backend-agnostic fallback + `durationMs` source. `finish()` is idempotent and\n//? closes the delegated span exactly once.\n//? ET-O9: removed the per-call `recordMetricAcrossTrackers` that fired on every\n//? startSpanHandle invocation — `durationMs` is available for callers that want to\n//? emit their own metric.\nexport const startSpanHandle = (name: string, op: string): SpanHandle => {\n  const startedAt = Date.now();\n  let finishedAt: number | null = null;\n  const delegate = openDelegateSpanHandle(name, op);\n  return {\n    finish: () => {\n      if (finishedAt !== null) return;\n      finishedAt = Date.now();\n      if (delegate) {\n        try {\n          delegate.finish();\n        } catch (error) {\n          logTrackerFailure('startSpanHandle', 'finish', error);\n        }\n      }\n    },\n    get durationMs() {\n      return finishedAt === null ? 0 : finishedAt - startedAt;\n    },\n  };\n};\n","//? Legacy Sentry single-instance slot. Predates the multi-adapter\n//? ErrorTracker registry. New code should `registerErrorTracker(...)`\n//? from `@luckystack/error-tracking`; this file keeps backwards\n//? compatibility AND fans out events through any registered adapters so\n//? a project can mix legacy `initSharedSentry` + new `registerErrorTracker`\n//? during migration.\n//?\n//? The framework's own call sites (`captureException`, `captureMessage`,\n//? `setSentryUser`, `startSpan`) keep working unchanged — they now route\n//? through both the legacy slot and the new adapter list.\n\nimport {\n  captureExceptionAcrossTrackers,\n  captureMessageAcrossTrackers,\n  setErrorTrackerUser,\n  startSpanAcrossTrackers,\n} from './errorTrackerRegistry';\nimport { sanitizeForLog } from './redactedLogKeys';\n\ninterface SentryInstance {\n  captureException: (exception: unknown, ...args: unknown[]) => string;\n  captureMessage: (message: string, ...args: unknown[]) => string;\n  setUser: (user: unknown) => void;\n  setContext: (key: string, context: unknown) => void;\n  startInactiveSpan?: (context: unknown) => unknown;\n}\n\nlet sentry: SentryInstance | undefined;\n\n/**\n * @deprecated Use `registerErrorTracker` from `@luckystack/error-tracking` instead.\n * Will be removed in a future major version.\n */\nexport const initSharedSentry = (instance: SentryInstance): void => {\n  sentry = instance;\n};\n\n//? Pass `extra` inline via Sentry's hint-shaped second argument so contexts\n//? don't leak across concurrent captures. Previously we called\n//? `sentry.setContext('additional', context)` which is process-global until\n//? cleared — under concurrent captures the first context could leak into the\n//? second's report.\n//? CORE-O4: sanitize context before passing to the legacy Sentry slot so raw\n//? tokens/passwords don't reach `extra` when a consumer mixes initSharedSentry\n//? with framework capture. The multi-adapter path already sanitizes in\n//? errorTrackerRegistry.ts; this brings the legacy path into parity.\nexport const captureException = (\n  error: unknown,\n  context?: Record<string, unknown>,\n): void => {\n  if (sentry) {\n    if (context) {\n      sentry.captureException(error, { extra: sanitizeForLog(context) as Record<string, unknown> });\n    } else {\n      sentry.captureException(error);\n    }\n  }\n  //? Multi-adapter fan-out. When no adapter is registered this is a no-op.\n  captureExceptionAcrossTrackers(error, context);\n};\n\nexport const captureMessage = (\n  message: string,\n  level: 'info' | 'warning' | 'error' | 'fatal' = 'info',\n  context?: Record<string, unknown>,\n): void => {\n  if (sentry) {\n    if (context) {\n      sentry.captureMessage(message, { level, extra: sanitizeForLog(context) as Record<string, unknown> });\n    } else {\n      sentry.captureMessage(message, level);\n    }\n  }\n  captureMessageAcrossTrackers(message, level, context);\n};\n\nexport const setSentryUser = (user: {\n  id?: string;\n  email?: string;\n  username?: string;\n} | null): void => {\n  sentry?.setUser(user);\n  setErrorTrackerUser(user);\n};\n\nexport const startSpan = (name: string, op: string): unknown => {\n  //? Multi-adapter span coordination: first registered adapter that\n  //? supports spans wins (spans don't fan out cleanly). Legacy Sentry\n  //? single-instance path still creates the inactive span for backwards\n  //? compatibility on consumers that haven't migrated.\n  if (sentry?.startInactiveSpan) {\n    return sentry.startInactiveSpan({ name, op });\n  }\n  //? No-op span body is intentional — this is the legacy inactive-span shape\n  //? consumers built against; the real span lifecycle is managed elsewhere.\n  // eslint-disable-next-line @typescript-eslint/no-empty-function -- legacy inactive-span shape\n  startSpanAcrossTrackers(name, op, () => {});\n};\n"],"mappings":";;;;;;AASO,IAAM,4BAA+C;AAAA,EAC1D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AACF;AAEA,IAAM,eAAe,IAAI,IAAY,0BAA0B,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAC;AAW9F,IAAM,yBAA4C,CAAC,SAAS,UAAU,UAAU,UAAU;AAEnF,IAAM,0BAA0B,CAAC,SAAkC;AACxE,aAAW,OAAO,MAAM;AACtB,iBAAa,IAAI,IAAI,YAAY,CAAC;AAAA,EACpC;AACF;AAEO,IAAM,qBAAqB,MAAyB,CAAC,GAAG,YAAY;AAEpE,IAAM,mBAAmB,CAAC,QAAyB;AACxD,QAAM,QAAQ,IAAI,YAAY;AAC9B,MAAI,aAAa,IAAI,KAAK,EAAG,QAAO;AACpC,SAAO,uBAAuB,KAAK,CAAC,WAAW,MAAM,SAAS,MAAM,CAAC;AACvE;AAKO,IAAM,+BAA+B,MAAY;AACtD,eAAa,MAAM;AACnB,aAAW,OAAO,2BAA2B;AAC3C,iBAAa,IAAI,IAAI,YAAY,CAAC;AAAA,EACpC;AACF;AAGO,IAAM,uBAAuB;AAK7B,IAAM,8BAA8B;AAI3C,IAAM,qBAAqB;AAepB,IAAM,iBAAiB,CAAC,OAAgB,QAAQ,GAAG,UAAqC;AAC7F,MAAI,QAAQ,mBAAoB,QAAO;AACvC,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AAOxD,QAAM,OAAO,SAAS,oBAAI,QAAgB;AAC1C,MAAI,KAAK,IAAI,KAAK,EAAG,QAAO;AAC5B,OAAK,IAAI,KAAK;AAEd,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAI,CAAC,SAAS,eAAe,MAAM,QAAQ,GAAG,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,KAAgC,GAAG;AAC5E,QAAI,GAAG,IAAI,iBAAiB,GAAG,IAAI,uBAAuB,eAAe,QAAQ,QAAQ,GAAG,IAAI;AAAA,EAClG;AACA,SAAO;AACT;;;AChFA,IAAM,gBAAgB,CAAC,YACrB,iBAAiB,EAAE,QAAQ,aAAa,KAAI,oBAAI,KAAK,GAAE,YAAY,CAAC,KAAK,OAAO,KAAK;AAEvF,IAAM,gBAAwB;AAAA,EAC5B,OAAO,CAAC,SAAS,YAAY;AAC3B,QAAI,YAAY,QAAW;AAAC,cAAQ,MAAM,cAAc,OAAO,CAAC;AAAA,IAAE,OAC7D;AAAC,cAAQ,MAAM,cAAc,OAAO,GAAG,OAAO;AAAA,IAAE;AAAA,EACvD;AAAA,EACA,MAAM,CAAC,SAAS,YAAY;AAC1B,QAAI,YAAY,QAAW;AAAC,cAAQ,KAAK,cAAc,OAAO,CAAC;AAAA,IAAE,OAC5D;AAAC,cAAQ,KAAK,cAAc,OAAO,GAAG,OAAO;AAAA,IAAE;AAAA,EACtD;AAAA,EACA,MAAM,CAAC,SAAS,YAAY;AAC1B,QAAI,YAAY,QAAW;AAAC,cAAQ,KAAK,cAAc,OAAO,CAAC;AAAA,IAAE,OAC5D;AAAC,cAAQ,KAAK,cAAc,OAAO,GAAG,OAAO;AAAA,IAAE;AAAA,EACtD;AAAA,EACA,OAAO,CAAC,SAAS,OAAO,YAAY;AAClC,QAAI,UAAU,UAAa,YAAY,OAAW,SAAQ,MAAM,cAAc,OAAO,GAAG,OAAO,OAAO;AAAA,aAC7F,UAAU,OAAW,SAAQ,MAAM,cAAc,OAAO,GAAG,KAAK;AAAA,aAChE,YAAY,QAAW;AAAC,cAAQ,MAAM,cAAc,OAAO,CAAC;AAAA,IAAE,OAClE;AAAC,cAAQ,MAAM,cAAc,OAAO,GAAG,OAAO;AAAA,IAAE;AAAA,EACvD;AACF;AAQO,IAAM,kBAAkB,OAAe;AAAA,EAC5C,OAAO,CAAC,SAAS,YAAY;AAC3B,QAAI,YAAY,QAAW;AAAC,cAAQ,IAAI,cAAc,OAAO,GAAG,MAAM;AAAA,IAAE,OACnE;AAAC,cAAQ,IAAI,cAAc,OAAO,GAAG,SAAS,MAAM;AAAA,IAAE;AAAA,EAC7D;AAAA,EACA,MAAM,CAAC,SAAS,YAAY;AAC1B,QAAI,YAAY,QAAW;AAAC,cAAQ,IAAI,cAAc,OAAO,CAAC;AAAA,IAAE,OAC3D;AAAC,cAAQ,IAAI,cAAc,OAAO,GAAG,OAAO;AAAA,IAAE;AAAA,EACrD;AAAA,EACA,MAAM,CAAC,SAAS,YAAY;AAC1B,QAAI,YAAY,QAAW;AAAC,cAAQ,IAAI,cAAc,OAAO,GAAG,QAAQ;AAAA,IAAE,OACrE;AAAC,cAAQ,IAAI,cAAc,OAAO,GAAG,SAAS,QAAQ;AAAA,IAAE;AAAA,EAC/D;AAAA,EACA,OAAO,CAAC,SAAS,OAAO,YAAY;AAClC,QAAI,UAAU,UAAa,YAAY,OAAW,SAAQ,IAAI,cAAc,OAAO,GAAG,OAAO,SAAS,KAAK;AAAA,aAClG,UAAU,OAAW,SAAQ,IAAI,cAAc,OAAO,GAAG,OAAO,KAAK;AAAA,aACrE,YAAY,QAAW;AAAC,cAAQ,IAAI,cAAc,OAAO,GAAG,KAAK;AAAA,IAAE,OACvE;AAAC,cAAQ,IAAI,cAAc,OAAO,GAAG,SAAS,KAAK;AAAA,IAAE;AAAA,EAC5D;AACF;AAEA,IAAM,WAAW,eAAuB,aAAa;AAE9C,IAAM,iBAAiB,CAAC,WAAyB;AACtD,WAAS,SAAS,MAAM;AAC1B;AAEO,IAAM,YAAY,MAAc,SAAS,IAAI;AAE7C,IAAM,qBAAqB,MAAe,SAAS,aAAa;AAIhE,IAAM,sBAAsB,MAAY;AAC7C,WAAS,MAAM;AACjB;;;ACtEA,IAAM,kBAAkB,CAAC,YAAmE;AAC1F,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,eAAe,OAAO;AAC/B;AAcA,IAAM,8BAA8B;AAKpC,IAAM,0BAA0B,oBAAI,IAA8B;AAElE,IAAM,oBAAoB,CAAC,QAAkC;AAC3D,QAAM,SAAS,wBAAwB,IAAI,GAAG;AAC9C,MAAI,OAAQ,QAAO;AACnB,MAAI,wBAAwB,QAAQ,6BAA6B;AAC/D,QAAI;AACF,gBAAU,EAAE,KAAK,kDAAkD,OAAO,2BAA2B,CAAC,sIAAiI;AAAA,IACzO,QAAQ;AAAA,IAER;AAAA,EACF;AACA,QAAM,UAAU,IAAI,WAAW,uBAAuB,OAAO,QAAQ;AAQrE,QAAM,OAAyB;AAAA,IAC7B,UAAU,IAAI,OAAO,OAAO,MAAM,OAAO,gBAAgB,IAAI;AAAA,IAC7D,UAAU,IAAI,OAAO,OAAO,MAAM,OAAO,kBAAkB,IAAI;AAAA,EACjE;AACA,0BAAwB,IAAI,KAAK,IAAI;AACrC,SAAO;AACT;AAEO,IAAM,sBAAsB,CAAC,UAA0B;AAC5D,MAAI,SAAS;AAGb,aAAW,OAAO,mBAAmB,GAAG;AACtC,UAAM,EAAE,UAAU,SAAS,IAAI,kBAAkB,GAAG;AACpD,aAAS,OAAO,QAAQ,UAAU,MAAM,oBAAoB,EAAE,QAAQ,UAAU,MAAM,oBAAoB;AAAA,EAC5G;AACA,SAAO;AACT;AAIO,IAAM,uBAAuB,CAClC,UAC0D;AAC1D,MAAI,EAAE,iBAAiB,OAAQ,QAAO;AACtC,SAAO;AAAA,IACL,SAAS,oBAAoB,MAAM,OAAO;AAAA,IAC1C,OAAO,MAAM,UAAU,SAAY,SAAY,oBAAoB,MAAM,KAAK;AAAA,EAChF;AACF;AAuDA,IAAI,mBAA4C;AAEzC,IAAM,2BAA2B,CAAC,WAA0C;AACjF,qBAAmB;AACrB;AAEA,IAAM,yBAAyB,CAAC,MAA+B,YAA8C;AAC3G,MAAI,CAAC,iBAAkB,QAAO;AAC9B,MAAI;AACF,WAAO,iBAAiB,EAAE,WAAW,MAAM,MAAM,QAAQ,CAAC;AAAA,EAC5D,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAKA,IAAM,yBAAyB,CAC7B,OACA,aAC6B,EAAE,OAAO,SAAS,WAAW,KAAK;AAEjE,IAAM,uBAAuB,CAC3B,SACA,OACA,aAC6B,EAAE,SAAS,OAAO,SAAS,WAAW,KAAK;AAE1E,IAAI,iBAAiC,CAAC;AAI/B,IAAM,uBAAuB,CAAC,YAAgC;AACnE,mBAAiB,CAAC,OAAO;AAC3B;AAEO,IAAM,wBAAwB,CAAC,aAAmC;AACvE,mBAAiB,CAAC,GAAG,QAAQ;AAC/B;AASO,IAAM,qBAAqB,CAAC,YAAgC;AACjE,QAAM,kBAAkB,eAAe,OAAO,CAAC,MAAM,EAAE,SAAS,QAAQ,IAAI;AAC5E,mBAAiB,CAAC,GAAG,iBAAiB,OAAO;AAC/C;AAEO,IAAM,yBAAyB,MAAsB;AAQrD,IAAM,qBAAqB,YAA2B;AAC3D,QAAM,QAAQ;AAAA,IACZ,eAAe,IAAI,OAAO,YAAY;AACpC,UAAI,CAAC,QAAQ,MAAO;AACpB,UAAI;AACF,cAAM,QAAQ,MAAM;AAAA,MACtB,SAAS,OAAO;AAGd,0BAAkB,QAAQ,MAAM,SAAS,KAAK;AAAA,MAChD;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEO,IAAM,iCAAiC,CAC5C,OACA,YACS;AACT,QAAM,cAAc,gBAAgB,OAAO;AAC3C,MAAI,CAAC,uBAAuB,aAAa,uBAAuB,OAAO,WAAW,CAAC,EAAG;AACtF,aAAW,WAAW,gBAAgB;AACpC,QAAI;AACF,cAAQ,iBAAiB,OAAO,WAAW;AAAA,IAC7C,SAAS,cAAc;AAIrB,wBAAkB,QAAQ,MAAM,oBAAoB,YAAY;AAAA,IAClE;AAAA,EACF;AACF;AAEO,IAAM,+BAA+B,CAC1C,SACA,OACA,YACS;AACT,QAAM,cAAc,gBAAgB,OAAO;AAC3C,MAAI,CAAC,uBAAuB,WAAW,qBAAqB,SAAS,OAAO,WAAW,CAAC,EAAG;AAC3F,aAAW,WAAW,gBAAgB;AACpC,QAAI;AACF,cAAQ,eAAe,SAAS,OAAO,WAAW;AAAA,IACpD,SAAS,cAAc;AACrB,wBAAkB,QAAQ,MAAM,kBAAkB,YAAY;AAAA,IAChE;AAAA,EACF;AACF;AAKA,IAAM,oBAAoB,CAAC,aAAqB,IAAY,UAAyB;AACnF,MAAI;AACF,cAAU,EAAE,KAAK,kBAAkB,WAAW,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC;AAAA,EAC7E,QAAQ;AAAA,EAER;AACF;AAEO,IAAM,sBAAsB,CAAC,SAAwC;AAC1E,aAAW,WAAW,gBAAgB;AACpC,QAAI;AACF,cAAQ,QAAQ,IAAI;AAAA,IACtB,SAAS,OAAO;AAEd,wBAAkB,QAAQ,MAAM,WAAW,KAAK;AAAA,IAClD;AAAA,EACF;AACF;AAEO,IAAM,6BAA6B,CACxC,MACA,OACA,SACS;AACT,aAAW,WAAW,gBAAgB;AACpC,QAAI,QAAQ,cAAc;AACxB,UAAI;AACF,gBAAQ,aAAa,MAAM,OAAO,IAAI;AAAA,MACxC,SAAS,OAAO;AAEd,0BAAkB,QAAQ,MAAM,gBAAgB,KAAK;AAAA,MACvD;AAAA,IACF;AAAA,EACF;AACF;AAEO,IAAM,0BAA0B,CAAI,MAAc,IAAY,OAAmB;AAKtF,QAAM,QAAQ,eAAe,KAAK,CAAC,MAAM,EAAE,SAAS;AACpD,MAAI,CAAC,OAAO,UAAW,QAAO,GAAG;AACjC,SAAO,MAAM,UAAU,MAAM,IAAI,EAAE;AACrC;AAqBA,IAAM,yBAAyB,CAAC,MAAc,OAA8C;AAC1F,QAAM,UAAU,eAAe,KAAK,CAAC,MAAM,EAAE,eAAe;AAC5D,MAAI,CAAC,SAAS,gBAAiB,QAAO;AACtC,MAAI;AACF,WAAO,QAAQ,gBAAgB,MAAM,EAAE;AAAA,EACzC,SAAS,OAAO;AACd,sBAAkB,QAAQ,MAAM,mBAAmB,KAAK;AACxD,WAAO;AAAA,EACT;AACF;AAUO,IAAM,kBAAkB,CAAC,MAAc,OAA2B;AACvE,QAAM,YAAY,KAAK,IAAI;AAC3B,MAAI,aAA4B;AAChC,QAAM,WAAW,uBAAuB,MAAM,EAAE;AAChD,SAAO;AAAA,IACL,QAAQ,MAAM;AACZ,UAAI,eAAe,KAAM;AACzB,mBAAa,KAAK,IAAI;AACtB,UAAI,UAAU;AACZ,YAAI;AACF,mBAAS,OAAO;AAAA,QAClB,SAAS,OAAO;AACd,4BAAkB,mBAAmB,UAAU,KAAK;AAAA,QACtD;AAAA,MACF;AAAA,IACF;AAAA,IACA,IAAI,aAAa;AACf,aAAO,eAAe,OAAO,IAAI,aAAa;AAAA,IAChD;AAAA,EACF;AACF;;;ACvVA,IAAI;AAMG,IAAM,mBAAmB,CAAC,aAAmC;AAClE,WAAS;AACX;AAWO,IAAM,mBAAmB,CAC9B,OACA,YACS;AACT,MAAI,QAAQ;AACV,QAAI,SAAS;AACX,aAAO,iBAAiB,OAAO,EAAE,OAAO,eAAe,OAAO,EAA6B,CAAC;AAAA,IAC9F,OAAO;AACL,aAAO,iBAAiB,KAAK;AAAA,IAC/B;AAAA,EACF;AAEA,iCAA+B,OAAO,OAAO;AAC/C;AAEO,IAAM,iBAAiB,CAC5B,SACA,QAAgD,QAChD,YACS;AACT,MAAI,QAAQ;AACV,QAAI,SAAS;AACX,aAAO,eAAe,SAAS,EAAE,OAAO,OAAO,eAAe,OAAO,EAA6B,CAAC;AAAA,IACrG,OAAO;AACL,aAAO,eAAe,SAAS,KAAK;AAAA,IACtC;AAAA,EACF;AACA,+BAA6B,SAAS,OAAO,OAAO;AACtD;AAEO,IAAM,gBAAgB,CAAC,SAIX;AACjB,UAAQ,QAAQ,IAAI;AACpB,sBAAoB,IAAI;AAC1B;AAEO,IAAM,YAAY,CAAC,MAAc,OAAwB;AAK9D,MAAI,QAAQ,mBAAmB;AAC7B,WAAO,OAAO,kBAAkB,EAAE,MAAM,GAAG,CAAC;AAAA,EAC9C;AAIA,0BAAwB,MAAM,IAAI,MAAM;AAAA,EAAC,CAAC;AAC5C;","names":[]}

package/dist/{chunk-5FXBTGYL.js → chunk-XDX5MV54.js}

@@ -1,7 +1,7 @@
 import {
   captureException,
   getLogger
-} from "./chunk-IJYNVM2W.js";
+} from "./chunk-P3SSLA3E.js";
 import {
   createRegistry,
   getProjectConfig
@@ -726,4 +726,4 @@ export {
   DEFAULT_PAGE_ROUTE_RULES,
   validatePagePath
 };
-//# sourceMappingURL=chunk-5FXBTGYL.js.map
+//# sourceMappingURL=chunk-XDX5MV54.js.map