@sazabi/react-native 0.1.0 → 0.1.1

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,287 @@
+# @sazabi/react-native
+
+Capture what happens in your mobile app with `@sazabi/react-native`, the official Sazabi React Native SDK. It emits a session-scoped stream of screen changes, touches, console output, JavaScript errors, and network calls as OTLP log records, and injects W3C trace context into your API requests so a symptom in the app and its backend cause share a trace id.
+
+`@sazabi/react-native` is a pure JavaScript library you install in your own React Native or Expo app. No native module, no config plugin, and it runs in Expo Go. It lets you:
+
+- Follow a single user's session from launch to error, across launches when you give it a storage adapter
+- Catch uncaught JavaScript errors, fatal ones and React render errors included, and unhandled promise rejections with stack traces
+- See every touch as an episode, with taps and rage taps derived from them
+- Join mobile network calls to backend logs on a shared `trace_id`
+- Use AI to investigate a mobile session end to end
+
+Designed to never break your app: every hook is wrapped, every patch is reversible, and typed text is never captured.
+
+## Install
+
+```sh
+npm install @sazabi/react-native
+# or: bun add / pnpm add / yarn add
+```
+
+Needs React Native 0.76 or later (Expo SDK 52 or later).
+
+The package ships ES modules with a `react-native` field, so `@sazabi/react-native/register` resolves on Metro with or without package exports (React Native 0.76 to 0.78 and Expo SDK 52 have them off by default). Jest does not transform `node_modules` unless told to; React Native's Jest preset only transforms React Native's own packages, so add the SDK to the exception in your Jest config:
+
+```js
+transformIgnorePatterns: [
+  "node_modules/(?!((jest-)?react-native|@react-native(-community)?|@sazabi/react-native)/)",
+],
+```
+
+## Get your intake URL
+
+Sign in to Sazabi, go to **Settings > Log streams**, choose **Sazabi React Native SDK**, and click **Add**. Sazabi shows your complete intake URL at the top of the setup screen.
+
+That URL is all the SDK needs. It embeds a write-only public key, which is why it is safe to ship in your app bundle: it can write telemetry into your project and never read from it.
+
+## Quick start
+
+```ts
+// Import first: a module that runs earlier can capture the native
+// XMLHttpRequest methods before the SDK wraps them.
+import "@sazabi/react-native/register";
+
+import AsyncStorage from "@react-native-async-storage/async-storage";
+import { init } from "@sazabi/react-native";
+
+init({
+  intakeUrl: "https://<your-intake-host>.intake.sazabi.com",
+  serviceName: "my-mobile-app",
+  storage: AsyncStorage, // optional: sessions across launches, crash outbox
+});
+```
+
+Wrap your app in `<SazabiRoot>` once, as the outermost component (outside your own error boundaries and providers): it observes touches and records render errors that would otherwise crash the app unrecorded.
+
+```tsx
+import { SazabiRoot, trackNavigation } from "@sazabi/react-native";
+
+export default function App() {
+  const navigationRef = useNavigationContainerRef();
+  useEffect(() => trackNavigation(navigationRef), [navigationRef]);
+  return (
+    <SazabiRoot>
+      <NavigationContainer ref={navigationRef}>{/* screens */}</NavigationContainer>
+    </SazabiRoot>
+  );
+}
+```
+
+## Configuration
+
+`init()` takes one object. Only `serviceName` and `intakeUrl` are needed; every other option has a default.
+
+| Option | Default | What it does |
+|--------|---------|--------------|
+| `intakeUrl` | none | Your intake URL from the setup screen, with or without `/v1/logs` |
+| `serviceName` | required | The name your app's events are filed under |
+| `serviceVersion` | none | Your app version, such as the marketing version or a git SHA |
+| `environment` | none | Deployment environment, such as `production` |
+| `storage` | none | Key-value store for sessions across launches, the crash outbox, and the saved queue (see [Crashes](#crashes)). Without it, a session lasts one launch |
+| `publicKey` | from `intakeUrl` | Set only for a proxy or custom endpoint whose hostname carries no key |
+| `consent` | none | Function returning `true` or a promise of it; capture waits until it resolves `true` and stays off on `false` |
+| `network.capture` | `true` | Record `fetch` and `XMLHttpRequest` calls |
+| `network.propagateTraceContext` | `true` | Inject `traceparent` into outgoing requests |
+| `network.allowlist` | every request | Hosts that get `traceparent` (see [Correlate with your backend](#correlate-with-your-backend)) |
+| `network.redactQueryParams` | built-in list | Extra query parameter names to redact (see [Captured URLs](#captured-urls)) |
+| `network.requestIdHeaders` | `["x-request-id", "cf-ray", "x-vercel-id", "x-amz-cf-id", "fly-request-id"]` | Response headers to read a request id from, recorded as `app.network.request_id`; set `[]` to turn this off |
+| `network.sampledFlag` | `false` | Mark SDK-started traces as sampled (`-01`) for backends that sample on the parent's flag |
+| `console.capture` | `true` | Mirror console output |
+| `console.levels` | `["error", "warn"]` | Console levels to mirror |
+| `pointer.capture` | `true` | Record touches and the taps derived from them |
+| `errors.unhandledRejections` | `true` | Track unhandled promise rejections (see [Other crash reporters](#other-crash-reporters)) |
+| `errors.previousRejectionTracker` | none | Another library's rejection tracker to keep running |
+| `beforeSend` | none | Edit or drop each event before it is queued (see [Edit or drop events](#edit-or-drop-events)) |
+| `flushIntervalMs` | `5000` | How often batches are sent |
+| `maxBatchBytes` | `57344` | Soft cap on each request body, in bytes |
+| `maxQueuedEvents` | `500` | Events held while the intake is unreachable, at most 1 MiB |
+
+The package also exports `log()` and `addEvent()` for your own rows, `identify()` and `reset()` for users, `flush()` to send now, and `shutdown()` to stop capture and restore everything the SDK patched.
+
+## What gets captured
+
+Every event carries `session.id`, a per-launch `session.window_id`, `session.distinct_id`, and the current screen, so one user's activity reads as a single ordered timeline. The `app.event_type` attribute names the kind:
+
+| `app.event_type` | Contents |
+|------------------|----------|
+| `navigation` | Screen changes from your navigation container: route name, pathname, param keys (never values) |
+| `pointer` | One episode per touch from down to up: coordinates, distance, duration, pressure, concurrent touches, a shared gesture id, and a once-per-second path sample; long touches emit partial rows every ten seconds. A touch a native scroll view takes over ends there with `app.pointer.ended_by: cancel` |
+| `click` / `rage_click` | Taps derived from short, still touches, named from `sazabiName`, `accessibilityLabel`, or `testID` (`app.widget.name`), and the rapid repeat taps that signal frustration |
+| `error` | JavaScript errors with `exception.type`, `exception.message`, and `exception.stacktrace`; `app.error.kind` is `uncaught`, `fatal`, or `unhandledrejection`. `fatal` and `uncaught` are React Native's own `isFatal` flag: a development build reports an uncaught error as fatal even though the red box keeps the app alive. A render error caught by `<SazabiRoot>` is always `fatal`. One row per error: the `console.error` line React Native prints for it is not recorded again as a `log` row |
+| `network` | Every `fetch` and `XMLHttpRequest` call with method, status, and duration, plus the trace context injected into it; sensitive query parameters are redacted in `url.full` (see [Captured URLs](#captured-urls)). Uploads to the Sazabi intake are never rows, and in development neither is traffic to the Metro dev server (LogBox symbolication, bundle status) |
+| `log` | Mirrored `console.error` / `console.warn` output, plus anything you send with `log()` |
+| `custom` | Marks you add with `addEvent()` |
+| `lifecycle` | The app going to the background and coming back |
+| `sdk_health` | The SDK's own delivery trouble, once per condition per launch (see [SDK health](#sdk-health)) |
+
+## Correlate with your backend
+
+By default the SDK injects a W3C `traceparent` header into every request your app makes: a native app has no origin and no CORS preflight, so there is no same-origin default to fall back on. Requests to the Sazabi intake are never injected, and in development neither are requests to the Metro dev server. Use `network.allowlist` to choose which hosts get the header, so third-party APIs never see one:
+
+```ts
+init({
+  // …
+  network: {
+    allowlist: ["api.example.com", ".internal.example.com", /^https:\/\/edge-\d+\.example\.net\//],
+  },
+});
+```
+
+A string entry is a host (`api.example.com`; add the port when it is not the default), a domain with every subdomain (`.example.com` matches `example.com` and `api.example.com`), or an origin with an optional path prefix (`https://api.example.com`, `https://example.com/api`). It never matches a URL that merely contains it, so `https://evil.test/?next=api.example.com` gets no header. A RegExp is tested against the full URL. The intake exclusion works the same way: only requests to the intake's own origin are skipped.
+
+`network.propagateTraceContext: false` turns injection off and keeps capture. `@sazabi/browser` takes the same `allowlist` option; there it defaults to same-origin requests only.
+
+Backend log lines that run inside the extracted trace context then share a `trace_id` with the originating request. If your backend runs OpenTelemetry, that extraction already happens by default.
+
+## Captured URLs
+
+Network rows keep the query string in `url.full`, and navigation rows keep a deep link's query string in `url.path` and `app.screen.url`, but replace the value of every sensitive parameter with `[redacted]`: `token`, `access_token`, `refresh_token`, `id_token`, `api_key`, `apikey`, `key`, `secret`, `password`, `signature`, `sig`, `x-amz-signature`, `x-amz-credential`, `x-goog-signature`, `sentry_key`, `authorization`, `auth`, `session`, `sid`, and `code`. Names match case-insensitively, in the query and in the fragment. Credentials in the URL (`user:pass@`) are never recorded. Add your own parameter names with `network.redactQueryParams` (strings match a name exactly, RegExps are tested against the name, from the start each time, so a `g` flag is safe):
+
+```ts
+init({
+  // …
+  network: { redactQueryParams: ["tenant", /^x-myco-/i] },
+});
+```
+
+`@sazabi/browser` takes the same option.
+
+## Name what users touch
+
+Taps are named from `accessibilityLabel` or `testID`. To give an element a name of your own, or to keep a name out of telemetry, set `sazabiName` or `sazabiMask` on it. Both are typed on `View`, `Pressable`, `Text`, and the `Touchable*` components as soon as you import the SDK:
+
+```tsx
+<Pressable sazabiName="Pay now" onPress={pay}>…</Pressable>
+<View sazabiMask>{/* names inside here are never sent */}</View>
+```
+
+## Identify users
+
+```ts
+import { identify, reset } from "@sazabi/react-native";
+
+identify("user_123", { plan: "pro" }); // on sign-in, use your internal id, not an email
+reset(); // on sign-out
+```
+
+## Crashes
+
+A fatal JavaScript error terminates the app once React Native's handler returns, and so does an error thrown while React renders your components. `<SazabiRoot>` catches a render error, records it as `fatal`, and rethrows it, so React Native handles it exactly as before; only errors inside `<SazabiRoot>` are seen.
+
+With a `storage` adapter, the SDK writes the pending events (the error included) to an outbox before the app terminates, and the next launch posts them; whatever the intake does not accept stays for the launch after. A crash before the stored session has been read is saved under a fresh session.
+
+Each crash is written under its own key (`sazabi.outbox.<id>`) and only then listed in the outbox index, so a crash writes a few kilobytes rather than rewriting every stored report.
+
+- **Synchronous store (MMKV):** the write is on disk before the app terminates, so the crash is delivered exactly once. The dying app sends nothing it could not clear afterwards; if it is still running two seconds after the error (a development build, a handler that does not terminate), it posts the outbox itself. This is the reliable choice for crash reports.
+- **AsyncStorage:** writes are asynchronous and React Native terminates the process within milliseconds of a fatal error, so a crash that happens within tens of milliseconds of a prior large write (another crash report, a big app write queued ahead of it) can be lost. The SDK also sends the batch at once. When both the write and the send land, the next launch posts the batch again; every row of one crash batch carries the same `app.outbox.id`, so the copy is recognizable.
+
+The crash's own key and the index are two writes, and the process can die between them (seen on Android), leaving a report under its key that no index lists. When the adapter has `getAllKeys` (AsyncStorage and MMKV both do), the next launch lists the store's keys once, beside its read of the index, and treats every `sazabi.outbox.<id>` key the index does not name as a stored report: it is listed, posted, and removed like any other, and one that is not valid JSON is deleted with the same warning. Keys outside the `sazabi.outbox.` prefix are never read or touched. Without `getAllKeys` such a report is not found.
+
+That works because every store keeps one order: a report's key is written before the index lists it and removed before the index stops listing it. A delivered report whose cleanup the process did not finish therefore leaves a listed id with no key, which the next launch drops, never an unlisted key it would post again. A key the store refuses to remove is overwritten with an empty list and goes on the next launch; only a key the store refuses to touch at all stays listed with its contents and is posted again, under the same `app.outbox.id`.
+
+The `storage` option takes any object with `getItem`, `setItem`, and `removeItem`, plus `getAllKeys` when it has one. To use [`react-native-mmkv`](https://github.com/mrousavy/react-native-mmkv), wrap it in that shape:
+
+```ts
+import { MMKV } from "react-native-mmkv";
+import { init } from "@sazabi/react-native";
+
+const mmkv = new MMKV({ id: "sazabi" });
+
+init({
+  // …
+  storage: {
+    getItem: (key) => mmkv.getString(key) ?? null,
+    setItem: (key, value) => mmkv.set(key, value),
+    removeItem: (key) => mmkv.delete(key),
+    getAllKeys: () => mmkv.getAllKeys(),
+  },
+});
+```
+
+Without a `storage` adapter, the SDK only attempts an immediate send.
+
+## Other crash reporters
+
+React Native has one slot for unhandled promise rejection tracking, and the last library to claim it silences the others. Hermes gives no way to read or wrap that slot (`HermesInternal` is frozen and its global cannot be reassigned), so `init()` replaces whatever holds it, and a library initialized after `init()` replaces the SDK's tracker in turn; neither side can tell. Your options:
+
+- Hand the SDK a tracker to run after its own on every rejection. Most crash reporters (Sentry, Bugsnag) install theirs inline and do not expose it, so write the hand-off yourself against their capture API:
+
+  ```ts
+  init({
+    // …
+    errors: {
+      previousRejectionTracker: {
+        allRejections: true,
+        onUnhandled: (id, rejection) => Sentry.captureException(rejection),
+      },
+    },
+  });
+  ```
+
+- Leave the slot to the other SDK with `errors: { unhandledRejections: false }`; the SDK then records no `unhandledrejection` rows.
+- Initialize the other SDK after `init()` and accept that the SDK records no `unhandledrejection` rows.
+
+In development the SDK prints one note when it takes the slot with neither option set. Global error handlers (`ErrorUtils`) always chain, in any order.
+
+Anything thrown is recorded once and never throws back into your app: a string, a plain or circular object, an `Error` with a circular `cause`, or a 300 KB message. Message and stack are cut to 4,096 characters.
+
+Native crashes, ANRs, and app-start metrics are not captured, and release-build stack traces are Hermes bytecode offsets: the SDK does not upload source maps.
+
+## Delivery and offline behavior
+
+Events are batched and posted every five seconds, and whenever the app leaves the foreground. What the SDK does with a batch depends on the intake's answer:
+
+| Intake answer | What the SDK does |
+|---------------|-------------------|
+| 2xx | Done |
+| 408, 429, 5xx, network error, no answer in 30 s | Keeps the batch and retries with exponential backoff (1 s doubling to a 60 s cap, with jitter), or after `Retry-After` when that is longer (up to 5 minutes). `flush()` sends nothing during the backoff |
+| 413 | Splits the batch in half and sends each half; a single event that is still too large is dropped. If the first half gets a retryable answer, the second half waits out the same backoff |
+| Any other 4xx (400, 401, 403, 404, ...) | Drops the batch; it is never retried |
+
+Delivery is at least once: a batch that timed out may have been accepted and is sent again.
+
+While the device is offline, the SDK holds at most `maxQueuedEvents` events (default 500) and at most 1 MiB, and drops the oldest first; a single event larger than 1 MiB is dropped when it is captured. A dropped batch, a full queue, and an oversized event each print one `[@sazabi/react-native]` console warning per launch, and the first event delivered after a drop carries `app.sdk.dropped_events` with the number lost.
+
+Every upload names the SDK in an `x-sazabi-sdk` header (`@sazabi/react-native/<version>`), so Sazabi can tell a misconfigured app from random traffic even when it rejects the request.
+
+### Edit or drop events
+
+`beforeSend` runs on every event before it is queued; return the event (edited or as given) to send it, or `null` to drop it. A request that fails with no response looks the same to the runtime whether the connection dropped or a policy refused it, so the SDK records every such failure at `ERROR`; your app can decide otherwise:
+
+```ts
+init({
+  intakeUrl: "https://<key>.us-west-2.intake.sazabi.com",
+  serviceName: "my-app",
+  beforeSend: (event) =>
+    event.type === "network" &&
+    event.attributes["http.response.status_code"] === undefined &&
+    Number(event.attributes["app.network.duration_ms"]) >= 10_000
+      ? { ...event, severity: "DEBUG" }
+      : event,
+});
+```
+
+A hook that throws drops the event and prints one `[@sazabi/react-native]` console warning per launch; an event captured synchronously while the hook runs (a `log()` inside it) is dropped rather than fed back into the hook. A request the hook makes produces its own network event once it completes, which the hook sees like any other, so a hook that forwards events must exclude its own requests.
+
+### SDK health
+
+The SDK reports its own delivery trouble as `app.event_type: sdk_health` rows, INFO severity, with `app.sdk.diagnostic` naming the condition: `intake_rejected` (a batch refused for good with a 4xx other than 408 and 429; `app.sdk.http_status` carries the status), `intake_unreachable` (uploads failed on the network or timed out and the intake later answered; `app.sdk.attempts` counts the failed tries, with uploads that failed together counted once), `outbox_discarded` (stored crash reports dropped by the outbox caps or because they were not valid reports, reported by the launch that found them; `app.sdk.outbox_discarded` counts what is known lost, and `app.sdk.outbox_unsaved` counts events a saved queue had left out at its caps, which may or may not have been uploaded before the app was killed), and `outbox_persist_failed` (the storage adapter refused to write the crash outbox or the saved queue). Each condition is reported at most once per launch, so a row the intake refuses is never reported again and a flapping network produces one row, not one per outage. A crash that overfilled the store in a dying process is reported by the next launch; one that refused a write in a dying process is not. Nothing here changes how your events are handled, and the rows never throw into your app.
+
+The crash outbox follows the same rules across launches. A stored report the intake refuses with a 4xx other than 408 and 429 is deleted with the same warning, and so is a stored entry that is not valid JSON. Anything retryable stays for the next launch. The outbox keeps at most 20 envelopes and 512 KB, newest first.
+
+With a `storage` adapter, the SDK also saves the queue each time the app leaves the foreground, before it flushes, because the OS can kill a backgrounded app without warning, and an offline queue would die with it. The copy is removed as soon as everything queued has been delivered; otherwise the next launch posts it. Events whose upload is still out when the app leaves the foreground a second time (iOS passes through `inactive` to `background`) stay in the copy, and a copy whose events were dropped undelivered (a full queue, or `shutdown()` while offline) is kept for the next launch. The saved copy holds at most the newest 20 envelopes and 512 KB of the queue (a launch that replays a copy the caps cut reports how many events were left out as `app.sdk.outbox_unsaved` on its `outbox_discarded` row: the live upload sends the oldest first, so they may have reached the intake before the kill, and nothing is known lost), and events captured after the app went to the background are saved only the next time it does. If the live upload reached the intake but the app was killed before the answer came back, the next launch posts the copy too; both carry the same `app.outbox.id`.
+
+## Device attributes
+
+Every request carries `os.name` (`ios` or `android`) and `os.version`. On Android it also carries `device.manufacturer` and `device.model.identifier` from `Platform.constants`. On iOS it carries `device.manufacturer: "Apple"` and `device.type` (`phone`, `pad`, `tv`, `mac`, `vision`, or `carplay`): iOS exposes no model to JavaScript without a native module.
+
+## Web builds
+
+Under react-native-web the SDK installs nothing and warns once per launch; use [`@sazabi/browser`](https://www.npmjs.com/package/@sazabi/browser) for that build. A universal app can initialize both, and exactly one activates per platform.
+
+## Support
+
+Sazabi documentation is at [docs.sazabi.com](https://docs.sazabi.com). For help, email [support@sazabi.ai](mailto:support@sazabi.ai).
+
+This package is developed in Sazabi's private monorepo. Each release is published to npm from [github.com/sazabi/react-native](https://github.com/sazabi/react-native), its release mirror.

package/dist/chunk-h2nxjrr9.js

@@ -0,0 +1,5 @@
+var n=(h)=>{try{Object.defineProperty(h,"__sazabiBrowserWrapped",{value:!0})}catch{}},i=(h)=>typeof h==="function"&&h.__sazabiBrowserWrapped===!0;var ee=/^([a-z][a-z0-9+.-]*):\/\/([^/?#]*)([^?#]*)(\?[^#]*)?(#.*)?$/i,te={"https:":":443","http:":":80"},re=({host:h,protocol:g})=>{let m=te[g];return m&&h.endsWith(m)?h.slice(0,-m.length):h},e=(h)=>{let g=ee.exec(h.trim());if(!g)return;let[,m,w,y,v="",R=""]=g;if(!m||w===void 0)return;let S=w.lastIndexOf("@"),x=`${m.toLowerCase()}:`,k=re({host:(S===-1?w:w.slice(S+1)).toLowerCase(),protocol:x});if(!k)return;let C=k.startsWith("[")?k.slice(0,k.indexOf("]")+1):k.replace(/:\d*$/,""),E=y||"/",X=`${x}//${k}`;return{protocol:x,host:k,hostname:C,pathname:E,search:v,hash:R,origin:X,href:`${X}${E}${v}${R}`}},r=({url:h,base:g})=>{let m=e(h),w=e(g);if(!m||!w||m.origin!==w.origin)return!1;let y=w.pathname.replace(/\/+$/,"");return!y||m.pathname===y||m.pathname.startsWith(`${y}/`)};var t=()=>{let h=globalThis.performance;return typeof h?.now==="function"?h.now():Date.now()};var q,N=(h)=>{q=h},T=()=>{q=void 0};var D=(h,g)=>{let m=e(h);if(!m)return h;return g!==void 0&&m.origin===g?m.pathname:`${m.host}${m.pathname}`},j=(h)=>{if(h===0||h>=500)return"ERROR";if(h>=400)return"WARN";return"INFO"},ne=new Set(["token","access_token","refresh_token","id_token","api_key","apikey","key","secret","password","signature","sig","x-amz-signature","x-amz-credential","x-goog-signature","sentry_key","authorization","auth","session","sid","code"]),B=(h,g)=>{if(h.global||h.sticky)h.lastIndex=0;return h.test(g)},a=(h,g=[])=>{let m=h.search(/[?#]/);if(m===-1)return h;let w=(y)=>{let v=y;try{v=decodeURIComponent(y)}catch{}return v=v.toLowerCase(),ne.has(v)||g.some((R)=>typeof R==="string"?R.toLowerCase()===v:B(R,v))};return h.slice(0,m)+h.slice(m).replace(/([?#&])([^=&#?]+)=([^&#]*)/g,(y,v,R)=>w(R)?`${v}${R}=[redacted]`:y)},oe=(h,g)=>{if(typeof g!=="string")return B(g,h);if(g.includes("://"))return r({url:h,base:g});let m=e(h);if(!m)return!1;let w=g.toLowerCase();if(w.startsWith("."))return m.hostname===w.slice(1)||m.hostname.endsWith(w);return(w.includes(":")?m.host:m.hostname)===w},F=(h,g)=>{if(h.allowlist.length===0)try{return h.isDefaultInjectionTarget(g)}catch{return!1}return h.allowlist.some((m)=>oe(g,m))};var M=300,O=[],K=(h)=>{if(O.push({url:h,startTime:t()}),O.length>M)O=O.slice(-M)};var P=()=>{O=[]},z=(h,g)=>{try{let m=D(g.resolvedUrl,h.displayOrigin),w=g.status>0?String(g.status):"failed",y={type:"network",body:`${g.method} ${m} → ${w}`,severity:g.severity??j(g.status),timeUnixMs:Date.now(),attributes:{"http.request.method":g.method,"http.response.status_code":g.status>0?g.status:void 0,"url.full":a(g.resolvedUrl,h.redactQueryParams),"app.network.kind":g.kind,"app.network.duration_ms":Math.round(g.durationMs),"app.network.error":g.failureMessage,"app.network.request_id":g.requestId,"app.network.request_id_header":g.requestIdHeader}};if(g.injected)y.traceId=g.injected.traceId,y.spanId=g.injected.spanId;h.emit(y)}catch{}},V=(h,g)=>{try{for(let m of h.requestIdHeaders){let w=g(m);if(w)return{requestId:w,requestIdHeader:m}}}catch{}return{}},G=(h,g,m)=>{if(g||m)return!0;let w=h;return w?.name==="AbortError"||typeof w?.message==="string"&&/abort|cancel/i.test(w.message)},Q=4,H=new WeakMap,Y=(h,g)=>({status:h.status,end:t(),requestId:V(g,(m)=>h.getResponseHeader(m))}),I=new WeakMap,W=(h,g)=>{let m=h?.owner;if(!h||!m||m!==q)return;try{let{status:w,end:y,requestId:v}=g(m),R=w===0&&(h.aborted||G(void 0,!1,m.isOffline?.()));z(m,{kind:"xhr",method:h.method,resolvedUrl:h.resolvedUrl,status:w,durationMs:y-h.start,severity:R?"DEBUG":void 0,injected:h.injected,...v})}catch{}},se=(h)=>{let g=I.get(h);if(g)return g;let m={};return h.addEventListener("abort",()=>{if(m.current)m.current.aborted=!0}),h.addEventListener("loadend",()=>{let w=m.finished;if(m.finished=void 0,w){if(W(w.tracked,()=>w.outcome),h.readyState!==Q)return}let y=m.current;m.current=void 0,W(y,(v)=>Y(h,v))}),I.set(h,m),m},b,ie=(h)=>{let{open:g,send:m,setRequestHeader:w}=h;return{originalOpen:g,originalSend:m,originalSetRequestHeader:w,wrappedOpen:function(...S){let x=q;if(x)try{let[k,C]=S;H.set(this,{method:String(k).toUpperCase(),resolvedUrl:x.resolveUrl(String(C)),customTraceparent:!1,start:0,processed:!1})}catch{}try{let k=I.get(this),C=k?.current;if(k&&C?.owner&&this.readyState===Q)k.finished={tracked:C,outcome:Y(this,C.owner)},k.current=void 0}catch{}g.apply(this,S)},wrappedSend:function(S){let x=q;if(x)try{let k=H.get(this);if(k?.resolvedUrl&&!k.processed){k.processed=!0;let C=x.isInternalUrl(k.resolvedUrl);if(!C&&x.propagateTraceContext&&!k.customTraceparent&&F(x,k.resolvedUrl))try{let E=x.traceContext.forRequest();for(let[X,Z]of Object.entries(E.headers))w.call(this,X,Z);k.injected=E}catch{k.injected=void 0}if(!C)K(k.resolvedUrl);if(!C&&x.capture)k.start=t(),k.owner=x,se(this).current=k}}catch{}m.call(this,S)},wrappedSetRequestHeader:function(S,x){if(q)try{if(S.toLowerCase()==="traceparent"){let k=H.get(this);if(k)k.customTraceparent=!0}}catch{}w.call(this,S,x)}}},J=()=>globalThis.XMLHttpRequest?.prototype,A=()=>{let h=J();if(!h||i(h.open))return;let g=ie(h);n(g.wrappedOpen),n(g.wrappedSetRequestHeader),n(g.wrappedSend);try{h.open=g.wrappedOpen,h.setRequestHeader=g.wrappedSetRequestHeader,h.send=g.wrappedSend}catch{try{h.open=g.originalOpen,h.setRequestHeader=g.originalSetRequestHeader,h.send=g.originalSend}catch{}return}b=g},_=()=>{let h=J();if(h&&b){if(h.open===b.wrappedOpen)h.open=b.originalOpen;if(h.setRequestHeader===b.wrappedSetRequestHeader)h.setRequestHeader=b.originalSetRequestHeader;if(h.send===b.wrappedSend)h.send=b.originalSend}b=void 0};import{NativeModules as ae,Platform as U,TurboModuleRegistry as pe}from"react-native";var s=()=>U.OS==="web",L=(h)=>typeof h==="string"&&h.length>0?h:void 0,c=()=>{let h=U.constants??{},g=U.OS==="ios";return{"os.name":U.OS,"os.version":L(String(U.Version??"")),"device.manufacturer":g?"Apple":L(h.Brand)??L(h.Manufacturer),"device.model.identifier":L(h.Model),"device.type":g?L(h.interfaceIdiom):void 0}},o=()=>globalThis.__DEV__===!0,u=()=>{if(!o())return;try{let h=pe?.get?.("SourceCode")??ae?.SourceCode,g=h?.getConstants?.().scriptURL??h?.scriptURL,m=typeof g==="string"?e(g):void 0;return m&&m.protocol.startsWith("http")?`${m.origin}/`:void 0}catch{return}},l=(h)=>e(h)?.href;var d=()=>{A()},p=()=>{_(),P()},f=(h)=>(d(),N(h),{teardown(){T()}});
+export{n,i,e,r,t,a,s,c,o,u,l,d,p,f};
+
+//# debugId=18E31BFF7909E41E64756E2164756E21
+//# sourceMappingURL=chunk-h2nxjrr9.js.map

package/dist/chunk-h2nxjrr9.js.map

@@ -0,0 +1,15 @@
+{
+  "version": 3,
+  "sources": ["../../client-sdk-core/src/patch-marker.ts", "../../client-sdk-core/src/url.ts", "../../client-sdk-core/src/clock.ts", "../../client-sdk-core/src/network-capture.ts", "../src/host.ts", "../src/network.ts"],
+  "sourcesContent": [
+    "/**\n * Shared across every Sazabi client SDK so two SDKs bundled into one app\n * recognize each other's wrappers and never double-wrap a primitive.\n */\nexport const WRAPPED_MARKER = \"__sazabiBrowserWrapped\";\n\n/** Best-effort idempotency marker on wrapper functions. */\nexport const markWrapped = (fn: object): void => {\n  try {\n    Object.defineProperty(fn, WRAPPED_MARKER, { value: true });\n  } catch {\n    // Non-extensible function object: the idempotency guard degrades gracefully.\n  }\n};\n\nexport const isWrapped = (fn: unknown): boolean =>\n  typeof fn === \"function\" &&\n  (fn as unknown as Record<string, unknown>)[WRAPPED_MARKER] === true;\n",
+    "/**\n * Absolute-URL parsing with no `URL` global. React Native's built-in `URL`\n * throws \"not implemented\" for `hostname`, `pathname`, and `origin`, and the\n * core must work there unpolyfilled, so the few fields the SDKs read are\n * parsed here. Only absolute http(s)-style URLs resolve; a binding resolves\n * relative references against its own base before calling in.\n */\n\nexport interface ParsedUrl {\n  /** e.g. `https:` */\n  protocol: string;\n  /** host with port, no credentials */\n  host: string;\n  hostname: string;\n  pathname: string;\n  search: string;\n  hash: string;\n  origin: string;\n  /** Normalized absolute URL with credentials stripped. */\n  href: string;\n}\n\nconst ABSOLUTE_URL =\n  /^([a-z][a-z0-9+.-]*):\\/\\/([^/?#]*)([^?#]*)(\\?[^#]*)?(#.*)?$/i;\n\nconst DEFAULT_PORTS: Record<string, string> = {\n  \"https:\": \":443\",\n  \"http:\": \":80\",\n};\n\n/**\n * `https://host:443` and `https://host` are one origin to every URL parser,\n * so they must be one here too: the browser binding compares a request URL\n * the host normalized against an intake base parsed here, and a default port\n * left in place would let the SDK's own uploads pass as app traffic.\n */\nconst withoutDefaultPort = ({\n  host,\n  protocol,\n}: {\n  host: string;\n  protocol: string;\n}): string => {\n  const suffix = DEFAULT_PORTS[protocol];\n  return suffix && host.endsWith(suffix) ? host.slice(0, -suffix.length) : host;\n};\n\nexport const parseAbsoluteUrl = (raw: string): ParsedUrl | undefined => {\n  const match = ABSOLUTE_URL.exec(raw.trim());\n  if (!match) return undefined;\n  const [, scheme, authority, path, search = \"\", hash = \"\"] = match;\n  if (!scheme || authority === undefined) return undefined;\n  const at = authority.lastIndexOf(\"@\");\n  const protocol = `${scheme.toLowerCase()}:`;\n  const host = withoutDefaultPort({\n    host: (at === -1 ? authority : authority.slice(at + 1)).toLowerCase(),\n    protocol,\n  });\n  if (!host) return undefined;\n  const hostname = host.startsWith(\"[\")\n    ? host.slice(0, host.indexOf(\"]\") + 1)\n    : host.replace(/:\\d*$/, \"\");\n  const pathname = path || \"/\";\n  const origin = `${protocol}//${host}`;\n  return {\n    protocol,\n    host,\n    hostname,\n    pathname,\n    search,\n    hash,\n    origin,\n    href: `${origin}${pathname}${search}${hash}`,\n  };\n};\n\n/**\n * Whether `url` is `base` or lies under it: the same origin (scheme, host,\n * port) and, when the base has a path, that path as whole segments. A string\n * prefix would also match `https://intake.example.com.evil.test/`.\n */\nexport const isUnderBase = ({\n  url,\n  base,\n}: {\n  url: string;\n  base: string;\n}): boolean => {\n  const target = parseAbsoluteUrl(url);\n  const root = parseAbsoluteUrl(base);\n  if (!target || !root || target.origin !== root.origin) return false;\n  const prefix = root.pathname.replace(/\\/+$/, \"\");\n  return (\n    !prefix ||\n    target.pathname === prefix ||\n    target.pathname.startsWith(`${prefix}/`)\n  );\n};\n",
+    "/**\n * Monotonic milliseconds for durations and ordering. `performance.now()` where\n * the host has it (every browser, React Native on Hermes); `Date.now()` as the\n * fallback so the core never assumes a global.\n */\nexport const monotonicNow = (): number => {\n  const perf = (globalThis as { performance?: { now?: () => number } })\n    .performance;\n  return typeof perf?.now === \"function\" ? perf.now() : Date.now();\n};\n",
+    "import { monotonicNow } from \"./clock\";\nimport { isWrapped, markWrapped } from \"./patch-marker\";\nimport type { RequestTraceContext, TraceContextManager } from \"./trace-context\";\nimport type { ClientEvent, EventSeverity } from \"./types\";\nimport { isUnderBase, parseAbsoluteUrl } from \"./url\";\n\n/**\n * Everything the network patches need at request time. A binding builds one\n * at init and activates it; the patches themselves install dormant (possibly\n * before init, via a register entrypoint) and consult the active slot per\n * call. Undefined slot = transparent passthrough.\n */\nexport interface NetworkCaptureOptions {\n  emit(event: ClientEvent): void;\n  traceContext: TraceContextManager;\n  /** Emit network events. */\n  capture: boolean;\n  /** Inject `traceparent` into allowlisted requests. */\n  propagateTraceContext: boolean;\n  /** Injection allowlist; empty defers to `isDefaultInjectionTarget`. */\n  allowlist: (string | RegExp)[];\n  /** Query parameter names redacted from `url.full` beside the default list. */\n  redactQueryParams?: (string | RegExp)[];\n  /** Response headers probed for a platform request id, in priority order. */\n  requestIdHeaders: string[];\n  /** SDK-internal endpoints: never captured, never injected. */\n  isInternalUrl(url: string): boolean;\n  /**\n   * Absolute URL for a request target as the host resolves it, with embedded\n   * credentials stripped; undefined when the input cannot be parsed.\n   */\n  resolveUrl(raw: string): string | undefined;\n  /** Injection policy when the allowlist is empty (same-origin on the web). */\n  isDefaultInjectionTarget(resolved: string): boolean;\n  /** Origin elided from the display path in event bodies, if the host has one. */\n  displayOrigin?: string;\n  /** Host-reported offline state; a failure while offline reads as an abort. */\n  isOffline?(): boolean;\n}\n\nlet active: NetworkCaptureOptions | undefined;\n\nexport const activateNetworkCapture = (\n  options: NetworkCaptureOptions,\n): void => {\n  active = options;\n};\n\nexport const deactivateNetworkCapture = (): void => {\n  active = undefined;\n};\n\nexport const getActiveNetworkCapture = (): NetworkCaptureOptions | undefined =>\n  active;\n\n// --------------------------------------------------------------- display --\n\n/** Compact display path: pathname when on the display origin, host+path otherwise. */\nexport const urlPath = (resolved: string, displayOrigin?: string): string => {\n  const url = parseAbsoluteUrl(resolved);\n  if (!url) return resolved;\n  return displayOrigin !== undefined && url.origin === displayOrigin\n    ? url.pathname\n    : `${url.host}${url.pathname}`;\n};\n\n/** Status 0 means transport failure. */\nexport const severityForStatus = (status: number): EventSeverity => {\n  if (status === 0 || status >= 500) return \"ERROR\";\n  if (status >= 400) return \"WARN\";\n  return \"INFO\";\n};\n\n/**\n * Query and fragment parameters whose values never leave the device: bearer\n * tokens, OAuth codes, API keys, and presigned-URL signatures. Matched by\n * name, case-insensitively; `network.redactQueryParams` adds to the list.\n */\nconst REDACTED_QUERY_PARAMS = new Set([\n  \"token\",\n  \"access_token\",\n  \"refresh_token\",\n  \"id_token\",\n  \"api_key\",\n  \"apikey\",\n  \"key\",\n  \"secret\",\n  \"password\",\n  \"signature\",\n  \"sig\",\n  \"x-amz-signature\",\n  \"x-amz-credential\",\n  \"x-goog-signature\",\n  \"sentry_key\",\n  \"authorization\",\n  \"auth\",\n  \"session\",\n  \"sid\",\n  \"code\",\n]);\n\n/**\n * `RegExp#test` from the start of `value` every time. A global or sticky\n * pattern resumes from the `lastIndex` its previous match left, so an app's\n * `/^tenant$/g` would match one parameter and let the next one through.\n * Reset only for those flags: a frozen plain RegExp stays untouched.\n */\nconst testPattern = (pattern: RegExp, value: string): boolean => {\n  if (pattern.global || pattern.sticky) pattern.lastIndex = 0;\n  return pattern.test(value);\n};\n\n/**\n * A recorded URL: the value of every sensitive parameter after the path\n * replaced with `[redacted]`, in the query and in the fragment. `?` separates\n * inside the fragment as well, so a hash router's `#/reset?token=…` is\n * covered. Credentials in the authority are already gone (`resolveUrl`\n * strips them). Applied to `url.full` of requests, resource rows and\n * navigations, and to the page URL the browser SDK stamps on every event.\n */\nexport const redactUrl = (\n  url: string,\n  extra: (string | RegExp)[] = [],\n): string => {\n  const start = url.search(/[?#]/);\n  if (start === -1) return url;\n  const sensitive = (raw: string): boolean => {\n    let name = raw;\n    try {\n      name = decodeURIComponent(raw);\n    } catch {\n      // Keep the raw name.\n    }\n    name = name.toLowerCase();\n    return (\n      REDACTED_QUERY_PARAMS.has(name) ||\n      extra.some((pattern) =>\n        typeof pattern === \"string\"\n          ? pattern.toLowerCase() === name\n          : testPattern(pattern, name),\n      )\n    );\n  };\n  return (\n    url.slice(0, start) +\n    url\n      .slice(start)\n      .replace(/([?#&])([^=&#?]+)=([^&#]*)/g, (param, separator, name) =>\n        sensitive(name) ? `${separator}${name}=[redacted]` : param,\n      )\n  );\n};\n\n// ------------------------------------------------------------- injection --\n\n/**\n * One allowlist entry against a request URL. A RegExp is tested against the\n * full URL; a string with a scheme is an origin (plus an optional path\n * prefix); any other string is a host (`api.example.com`, with a port when it\n * names one) or, with a leading dot, a domain and its subdomains\n * (`.example.com`).\n */\nconst matchesAllowlistEntry = (\n  resolved: string,\n  entry: string | RegExp,\n): boolean => {\n  if (typeof entry !== \"string\") return testPattern(entry, resolved);\n  if (entry.includes(\"://\")) {\n    return isUnderBase({ url: resolved, base: entry });\n  }\n  const url = parseAbsoluteUrl(resolved);\n  if (!url) return false;\n  const host = entry.toLowerCase();\n  if (host.startsWith(\".\")) {\n    return url.hostname === host.slice(1) || url.hostname.endsWith(host);\n  }\n  return (host.includes(\":\") ? url.host : url.hostname) === host;\n};\n\nexport const isAllowedForInjection = (\n  options: NetworkCaptureOptions,\n  resolved: string,\n): boolean => {\n  if (options.allowlist.length === 0) {\n    try {\n      return options.isDefaultInjectionTarget(resolved);\n    } catch {\n      return false;\n    }\n  }\n  return options.allowlist.some((entry) =>\n    matchesAllowlistEntry(resolved, entry),\n  );\n};\n\n/** Injection eligibility for the active config; used by the browser's resource\n * observer to decide whether a bypassed request is a diagnosable gap. */\nexport const isActiveInjectionTarget = (resolved: string): boolean => {\n  const options = active;\n  if (!options?.propagateTraceContext) return false;\n  if (options.isInternalUrl(resolved)) return false;\n  return isAllowedForInjection(options, resolved);\n};\n\n// ----------------------------------------------------- wrapper-seen ledger --\n// Every request processed by an active wrapper is recorded so a passive\n// observer (resource timing in the browser) can tell wrapper-captured traffic\n// from traffic that bypassed the patches entirely.\n\ninterface SeenRequest {\n  url: string;\n  /** monotonicNow() timebase, comparable to PerformanceEntry.startTime. */\n  startTime: number;\n}\n\nconst SEEN_MATCH_WINDOW_MS = 5_000;\nconst SEEN_MAX_ENTRIES = 300;\nlet seenByWrapper: SeenRequest[] = [];\n\nexport const recordWrapperRequest = (url: string): void => {\n  seenByWrapper.push({ url, startTime: monotonicNow() });\n  if (seenByWrapper.length > SEEN_MAX_ENTRIES) {\n    seenByWrapper = seenByWrapper.slice(-SEEN_MAX_ENTRIES);\n  }\n};\n\n/** Consume a wrapper-seen record matching this request, if any. */\nexport const consumeWrapperSeen = (url: string, startTime: number): boolean => {\n  const index = seenByWrapper.findIndex(\n    (seen) =>\n      seen.url === url &&\n      Math.abs(seen.startTime - startTime) <= SEEN_MATCH_WINDOW_MS,\n  );\n  if (index === -1) return false;\n  seenByWrapper.splice(index, 1);\n  return true;\n};\n\nexport const resetWrapperLedger = (): void => {\n  seenByWrapper = [];\n};\n\n// ---------------------------------------------------------------- events --\n\nexport interface NetworkEventDetails {\n  kind: \"fetch\" | \"xhr\";\n  method: string;\n  resolvedUrl: string;\n  status: number;\n  durationMs: number;\n  severity?: EventSeverity;\n  failureMessage?: string;\n  injected?: RequestTraceContext;\n  requestId?: string;\n  requestIdHeader?: string;\n}\n\nexport const emitNetworkEvent = (\n  options: NetworkCaptureOptions,\n  details: NetworkEventDetails,\n): void => {\n  try {\n    const path = urlPath(details.resolvedUrl, options.displayOrigin);\n    const outcome = details.status > 0 ? String(details.status) : \"failed\";\n    const event: ClientEvent = {\n      type: \"network\",\n      body: `${details.method} ${path} → ${outcome}`,\n      severity: details.severity ?? severityForStatus(details.status),\n      timeUnixMs: Date.now(),\n      attributes: {\n        \"http.request.method\": details.method,\n        \"http.response.status_code\":\n          details.status > 0 ? details.status : undefined,\n        \"url.full\": redactUrl(details.resolvedUrl, options.redactQueryParams),\n        \"app.network.kind\": details.kind,\n        \"app.network.duration_ms\": Math.round(details.durationMs),\n        \"app.network.error\": details.failureMessage,\n        \"app.network.request_id\": details.requestId,\n        \"app.network.request_id_header\": details.requestIdHeader,\n      },\n    };\n    if (details.injected) {\n      event.traceId = details.injected.traceId;\n      event.spanId = details.injected.spanId;\n    }\n    options.emit(event);\n  } catch {\n    // Capture failures must never surface to the host.\n  }\n};\n\nexport const readRequestId = (\n  options: NetworkCaptureOptions,\n  getHeader: (name: string) => string | null | undefined,\n): { requestId?: string; requestIdHeader?: string } => {\n  try {\n    for (const name of options.requestIdHeaders) {\n      const value = getHeader(name);\n      if (value) return { requestId: value, requestIdHeader: name };\n    }\n  } catch {}\n  return {};\n};\n\nexport const isAborted = (\n  error: unknown,\n  signalAborted?: boolean,\n  offline?: boolean,\n): boolean => {\n  if (signalAborted || offline) {\n    return true;\n  }\n  const e = error as { name?: string; message?: string } | undefined;\n  return (\n    e?.name === \"AbortError\" ||\n    (typeof e?.message === \"string\" && /abort|cancel/i.test(e.message))\n  );\n};\n\n// ------------------------------------------------------------------ XHR --\n// The one network patch every host shares: browsers have XMLHttpRequest\n// natively, and React Native's fetch is a polyfill over its own\n// XMLHttpRequest class, so this patch alone sees every mobile request.\n\ninterface XhrRequestState {\n  method: string;\n  resolvedUrl?: string;\n  customTraceparent: boolean;\n  injected?: RequestTraceContext;\n  start: number;\n  /** Set by the outermost of our send wrappers in a third-party sandwich. */\n  processed: boolean;\n  aborted?: boolean;\n  /** The capture instance that sent the request; only it may emit the row. */\n  owner?: NetworkCaptureOptions;\n}\n\n/**\n * The XMLHttpRequest surface the patch touches, declared structurally so the\n * same source typechecks against the DOM lib (browser SDK) and against no\n * lib at all (this package).\n */\ninterface XhrLike {\n  open(...args: unknown[]): void;\n  send(body?: unknown): void;\n  setRequestHeader(name: string, value: string): void;\n  getResponseHeader(name: string): string | null;\n  addEventListener(type: string, listener: () => void): void;\n  readonly status: number;\n  readonly readyState: number;\n}\n\nconst XHR_DONE = 4;\n\nconst xhrState = new WeakMap<XhrLike, XhrRequestState>();\n\ninterface XhrOutcome {\n  status: number;\n  end: number;\n  requestId: { requestId?: string; requestIdHeader?: string };\n}\n\nconst outcomeOf = (xhr: XhrLike, owner: NetworkCaptureOptions): XhrOutcome => ({\n  status: xhr.status,\n  end: monotonicNow(),\n  requestId: readRequestId(owner, (name) => xhr.getResponseHeader(name)),\n});\n\n/**\n * One `abort`/`loadend` listener pair per XHR object, reading the request the\n * object is carrying now. An object reused for a second request (open, send,\n * open, send) gets no second pair, so a finished request's listener never\n * emits again with its stale state.\n */\ninterface XhrListenerSlot {\n  current?: XhrRequestState;\n  /**\n   * A finished request whose `loadend` had not reached our listener when the\n   * app opened the next request on the object: an app listener added before\n   * ours may start that request from inside the event. Its outcome is read\n   * before `open()` resets the status and response headers.\n   */\n  finished?: { tracked: XhrRequestState; outcome: XhrOutcome };\n}\n\nconst xhrListeners = new WeakMap<XhrLike, XhrListenerSlot>();\n\nconst emitXhr = (\n  tracked: XhrRequestState | undefined,\n  outcome: (owner: NetworkCaptureOptions) => XhrOutcome,\n): void => {\n  const owner = tracked?.owner;\n  // A request belongs to the instance that sent it: one that completes\n  // after shutdown(), or after a later init(), emits nowhere.\n  if (!tracked || !owner || owner !== active) {\n    return;\n  }\n  try {\n    const { status, end, requestId } = outcome(owner);\n    const aborted =\n      status === 0 &&\n      (tracked.aborted || isAborted(undefined, false, owner.isOffline?.()));\n    emitNetworkEvent(owner, {\n      kind: \"xhr\",\n      method: tracked.method,\n      resolvedUrl: tracked.resolvedUrl as string,\n      status,\n      durationMs: end - tracked.start,\n      severity: aborted ? \"DEBUG\" : undefined,\n      injected: tracked.injected,\n      ...requestId,\n    });\n  } catch {\n    // Capture failures must never surface to the host.\n  }\n};\n\nconst listenTo = (xhr: XhrLike): XhrListenerSlot => {\n  const existing = xhrListeners.get(xhr);\n  if (existing) {\n    return existing;\n  }\n  const slot: XhrListenerSlot = {};\n  xhr.addEventListener(\"abort\", () => {\n    if (slot.current) {\n      slot.current.aborted = true;\n    }\n  });\n  xhr.addEventListener(\"loadend\", () => {\n    const finished = slot.finished;\n    slot.finished = undefined;\n    if (finished) {\n      emitXhr(finished.tracked, () => finished.outcome);\n      // The request in `current` was opened during this event and its own\n      // `loadend` is still to come.\n      if (xhr.readyState !== XHR_DONE) {\n        return;\n      }\n    }\n    const tracked = slot.current;\n    slot.current = undefined;\n    emitXhr(tracked, (owner) => outcomeOf(xhr, owner));\n  });\n  xhrListeners.set(xhr, slot);\n  return slot;\n};\n\ninterface XhrPatch {\n  originalOpen: XhrLike[\"open\"];\n  originalSend: XhrLike[\"send\"];\n  originalSetRequestHeader: XhrLike[\"setRequestHeader\"];\n  wrappedOpen: XhrLike[\"open\"];\n  wrappedSend: XhrLike[\"send\"];\n  wrappedSetRequestHeader: XhrLike[\"setRequestHeader\"];\n}\n\nlet xhrPatch: XhrPatch | undefined;\n\nconst makeXhrPatch = (proto: XhrLike): XhrPatch => {\n  const originalOpen = proto.open;\n  const originalSend = proto.send;\n  const originalSetRequestHeader = proto.setRequestHeader;\n\n  // Forward `open` arguments with exact arity: `open(m, u, undefined)` would\n  // coerce async to false (sync XHR), which is not equivalent to the 2-arg call.\n  const wrappedOpen = function (this: XhrLike, ...args: unknown[]): void {\n    const options = active;\n    if (options) {\n      try {\n        const [method, url] = args;\n        xhrState.set(this, {\n          method: String(method).toUpperCase(),\n          resolvedUrl: options.resolveUrl(String(url)),\n          customTraceparent: false,\n          start: 0,\n          processed: false,\n        });\n      } catch {\n        // Tracking failure must not affect the request.\n      }\n    }\n    try {\n      // A tracked request on a finished object is inside its completion\n      // events, before our `loadend` listener ran: keep its outcome.\n      const slot = xhrListeners.get(this);\n      const tracked = slot?.current;\n      if (slot && tracked?.owner && this.readyState === XHR_DONE) {\n        slot.finished = { tracked, outcome: outcomeOf(this, tracked.owner) };\n        slot.current = undefined;\n      }\n    } catch {\n      // Tracking failure must not affect the request.\n    }\n    originalOpen.apply(this, args);\n  };\n\n  const wrappedSetRequestHeader = function (\n    this: XhrLike,\n    name: string,\n    value: string,\n  ): void {\n    if (active) {\n      try {\n        if (name.toLowerCase() === \"traceparent\") {\n          const tracked = xhrState.get(this);\n          if (tracked) {\n            tracked.customTraceparent = true;\n          }\n        }\n      } catch {\n        // Ignore.\n      }\n    }\n    originalSetRequestHeader.call(this, name, value);\n  };\n\n  const wrappedSend = function (this: XhrLike, body?: unknown): void {\n    const options = active;\n    if (options) {\n      try {\n        const tracked = xhrState.get(this);\n        // `processed` = an outer copy of our wrapper already handled this\n        // send (third-party sandwich); inner copies must not re-inject or\n        // attach a second loadend emitter.\n        if (tracked?.resolvedUrl && !tracked.processed) {\n          tracked.processed = true;\n          const internal = options.isInternalUrl(tracked.resolvedUrl);\n\n          if (\n            !internal &&\n            options.propagateTraceContext &&\n            !tracked.customTraceparent &&\n            isAllowedForInjection(options, tracked.resolvedUrl)\n          ) {\n            try {\n              const requestContext = options.traceContext.forRequest();\n              for (const [name, value] of Object.entries(\n                requestContext.headers,\n              )) {\n                originalSetRequestHeader.call(this, name, value);\n              }\n              tracked.injected = requestContext;\n            } catch {\n              tracked.injected = undefined;\n            }\n          }\n\n          if (!internal) {\n            recordWrapperRequest(tracked.resolvedUrl);\n          }\n\n          if (!internal && options.capture) {\n            tracked.start = monotonicNow();\n            tracked.owner = options;\n            listenTo(this).current = tracked;\n          }\n        }\n      } catch {\n        // Fall through to the untouched send.\n      }\n    }\n    originalSend.call(this, body);\n  };\n\n  return {\n    originalOpen,\n    originalSend,\n    originalSetRequestHeader,\n    wrappedOpen,\n    wrappedSend,\n    wrappedSetRequestHeader,\n  };\n};\n\nconst xhrPrototype = (): XhrLike | undefined => {\n  const ctor = (globalThis as { XMLHttpRequest?: { prototype: XhrLike } })\n    .XMLHttpRequest;\n  return ctor?.prototype;\n};\n\n/**\n * Install the dormant XMLHttpRequest patch around whatever implementation is\n * currently live. Idempotent, and re-wraps when a later actor replaced the\n * prototype methods after an earlier install (the displaced wrapper is an\n * inert passthrough, so single-processing holds).\n */\nexport const ensureXhrPatch = (): void => {\n  const proto = xhrPrototype();\n  if (!proto || isWrapped(proto.open)) {\n    return;\n  }\n  const patch = makeXhrPatch(proto);\n  markWrapped(patch.wrappedOpen);\n  markWrapped(patch.wrappedSetRequestHeader);\n  markWrapped(patch.wrappedSend);\n  try {\n    proto.open = patch.wrappedOpen;\n    proto.setRequestHeader = patch.wrappedSetRequestHeader;\n    proto.send = patch.wrappedSend;\n  } catch {\n    // A frozen prototype stays native: put back whatever was assigned\n    // before the refusal, capture no requests, and let init() carry on.\n    try {\n      proto.open = patch.originalOpen;\n      proto.setRequestHeader = patch.originalSetRequestHeader;\n      proto.send = patch.originalSend;\n    } catch {\n      // Nothing was assigned.\n    }\n    return;\n  }\n  xhrPatch = patch;\n};\n\n/**\n * Restore the natives if the current implementations are still ours; if\n * someone patched on top of us, restoring would clobber them, and the\n * inactive wrappers pass through.\n */\nexport const uninstallXhrPatch = (): void => {\n  const proto = xhrPrototype();\n  if (proto && xhrPatch) {\n    if (proto.open === xhrPatch.wrappedOpen) {\n      proto.open = xhrPatch.originalOpen;\n    }\n    if (proto.setRequestHeader === xhrPatch.wrappedSetRequestHeader) {\n      proto.setRequestHeader = xhrPatch.originalSetRequestHeader;\n    }\n    if (proto.send === xhrPatch.wrappedSend) {\n      proto.send = xhrPatch.originalSend;\n    }\n  }\n  xhrPatch = undefined;\n};\n",
+    "import {\n  type EventAttributes,\n  parseAbsoluteUrl,\n} from \"@sazabi/client-sdk-core\";\nimport { NativeModules, Platform, TurboModuleRegistry } from \"react-native\";\n\n/**\n * react-native-web renders in a real browser, where `@sazabi/browser` owns\n * capture. This SDK installs nothing there.\n */\nexport const isWebHost = (): boolean => Platform.OS === \"web\";\n\nconst stringOrUndefined = (value: unknown): string | undefined =>\n  typeof value === \"string\" && value.length > 0 ? value : undefined;\n\n/**\n * Resource attributes the host can report without a native module: OTEL\n * `os.*` from `Platform`, the `device.*` fields Android's\n * `Platform.constants` carries (`Brand`, `Manufacturer`, `Model`), and on iOS\n * the manufacturer plus `device.type` from `interfaceIdiom` (`phone`, `pad`,\n * `tv`, `carplay`, `mac`, `vision`). iOS reports no model through JavaScript.\n * `os.name` stays `Platform.OS` (`ios`, `android`) on both, so queries match\n * one casing; iPadOS shows as `device.type: \"pad\"`.\n */\nexport const hostResourceAttributes = (): EventAttributes => {\n  const constants = (Platform.constants ?? {}) as Record<string, unknown>;\n  const ios = Platform.OS === \"ios\";\n  return {\n    \"os.name\": Platform.OS,\n    \"os.version\": stringOrUndefined(String(Platform.Version ?? \"\")),\n    \"device.manufacturer\": ios\n      ? \"Apple\"\n      : (stringOrUndefined(constants.Brand) ??\n        stringOrUndefined(constants.Manufacturer)),\n    \"device.model.identifier\": stringOrUndefined(constants.Model),\n    \"device.type\": ios\n      ? stringOrUndefined(constants.interfaceIdiom)\n      : undefined,\n  };\n};\n\nexport const isDevHost = (): boolean =>\n  (globalThis as { __DEV__?: unknown }).__DEV__ === true;\n\n/**\n * The Metro (or Expo) development server this bundle was loaded from, as\n * `<origin>/`, read from `SourceCode.scriptURL` the way React Native's own\n * `getDevServer()` does. Only under `__DEV__`, and only for an http(s)\n * bundle URL: a release bundle loads from a file.\n */\nexport const devServerOrigin = (): string | undefined => {\n  if (!isDevHost()) return undefined;\n  try {\n    type SourceCode = {\n      scriptURL?: unknown;\n      getConstants?(): { scriptURL?: unknown };\n    };\n    const module = (TurboModuleRegistry?.get?.(\"SourceCode\") ??\n      NativeModules?.SourceCode) as SourceCode | null | undefined;\n    const scriptURL = module?.getConstants?.().scriptURL ?? module?.scriptURL;\n    const url =\n      typeof scriptURL === \"string\" ? parseAbsoluteUrl(scriptURL) : undefined;\n    return url && url.protocol.startsWith(\"http\")\n      ? `${url.origin}/`\n      : undefined;\n  } catch {\n    return undefined;\n  }\n};\n\n/**\n * A request URL as the core expects it: absolute, credentials stripped.\n * Relative references are not requests on a native host, so they resolve to\n * nothing and are neither captured nor injected.\n */\nexport const resolveUrl = (raw: string): string | undefined =>\n  parseAbsoluteUrl(raw)?.href;\n",
+    "import {\n  activateNetworkCapture,\n  deactivateNetworkCapture,\n  ensureXhrPatch,\n  type NetworkCaptureOptions,\n  resetWrapperLedger,\n  uninstallXhrPatch,\n} from \"@sazabi/client-sdk-core\";\n\nexport interface NetworkCaptureHandle {\n  teardown(): void;\n}\n\n/**\n * React Native's `fetch` is a polyfill over its own `XMLHttpRequest`, so the\n * core's XHR patch alone sees every request this host makes (`fetch`,\n * `axios`, direct XHR) and a `fetch` wrapper would emit each one twice.\n */\nexport const ensureNetworkPatches = (): void => {\n  ensureXhrPatch();\n};\n\nexport const uninstallNetworkPatches = (): void => {\n  uninstallXhrPatch();\n  resetWrapperLedger();\n};\n\nexport const installNetworkCapture = (\n  options: NetworkCaptureOptions,\n): NetworkCaptureHandle => {\n  ensureNetworkPatches();\n  activateNetworkCapture(options);\n  return {\n    teardown() {\n      deactivateNetworkCapture();\n    },\n  };\n};\n"
+  ],
+  "mappings": "AAOO,IAAM,EAAc,CAAC,IAAqB,CAC/C,GAAI,CACF,OAAO,eAAe,EALI,yBAKgB,CAAE,MAAO,EAAK,CAAC,EACzD,KAAM,IAKG,EAAY,CAAC,IACxB,OAAO,IAAO,YACb,EAb2B,yBAamC,GCKjE,IAAM,GACJ,+DAEI,GAAwC,CAC5C,SAAU,OACV,QAAS,KACX,EAQM,GAAqB,EACzB,OACA,cAIY,CACZ,IAAM,EAAS,GAAc,GAC7B,OAAO,GAAU,EAAK,SAAS,CAAM,EAAI,EAAK,MAAM,EAAG,CAAC,EAAO,MAAM,EAAI,GAG9D,EAAmB,CAAC,IAAuC,CACtE,IAAM,EAAQ,GAAa,KAAK,EAAI,KAAK,CAAC,EAC1C,GAAI,CAAC,EAAO,OACZ,KAAS,EAAQ,EAAW,EAAM,EAAS,GAAI,EAAO,IAAM,EAC5D,GAAI,CAAC,GAAU,IAAc,OAAW,OACxC,IAAM,EAAK,EAAU,YAAY,GAAG,EAC9B,EAAW,GAAG,EAAO,YAAY,KACjC,EAAO,GAAmB,CAC9B,MAAO,IAAO,GAAK,EAAY,EAAU,MAAM,EAAK,CAAC,GAAG,YAAY,EACpE,UACF,CAAC,EACD,GAAI,CAAC,EAAM,OACX,IAAM,EAAW,EAAK,WAAW,GAAG,EAChC,EAAK,MAAM,EAAG,EAAK,QAAQ,GAAG,EAAI,CAAC,EACnC,EAAK,QAAQ,QAAS,EAAE,EACtB,EAAW,GAAQ,IACnB,EAAS,GAAG,MAAa,IAC/B,MAAO,CACL,WACA,OACA,WACA,WACA,SACA,OACA,SACA,KAAM,GAAG,IAAS,IAAW,IAAS,GACxC,GAQW,EAAc,EACzB,MACA,UAIa,CACb,IAAM,EAAS,EAAiB,CAAG,EAC7B,EAAO,EAAiB,CAAI,EAClC,GAAI,CAAC,GAAU,CAAC,GAAQ,EAAO,SAAW,EAAK,OAAQ,MAAO,GAC9D,IAAM,EAAS,EAAK,SAAS,QAAQ,OAAQ,EAAE,EAC/C,MACE,CAAC,GACD,EAAO,WAAa,GACpB,EAAO,SAAS,WAAW,GAAG,IAAS,GC1FpC,IAAM,EAAe,IAAc,CACxC,IAAM,EAAQ,WACX,YACH,OAAO,OAAO,GAAM,MAAQ,WAAa,EAAK,IAAI,EAAI,KAAK,IAAI,GCgCjE,IAAI,EAES,EAAyB,CACpC,IACS,CACT,EAAS,GAGE,EAA2B,IAAY,CAClD,EAAS,QASJ,IAAM,EAAU,CAAC,EAAkB,IAAmC,CAC3E,IAAM,EAAM,EAAiB,CAAQ,EACrC,GAAI,CAAC,EAAK,OAAO,EACjB,OAAO,IAAkB,QAAa,EAAI,SAAW,EACjD,EAAI,SACJ,GAAG,EAAI,OAAO,EAAI,YAIX,EAAoB,CAAC,IAAkC,CAClE,GAAI,IAAW,GAAK,GAAU,IAAK,MAAO,QAC1C,GAAI,GAAU,IAAK,MAAO,OAC1B,MAAO,QAQH,GAAwB,IAAI,IAAI,CACpC,QACA,eACA,gBACA,WACA,UACA,SACA,MACA,SACA,WACA,YACA,MACA,kBACA,mBACA,mBACA,aACA,gBACA,OACA,UACA,MACA,MACF,CAAC,EAQK,EAAc,CAAC,EAAiB,IAA2B,CAC/D,GAAI,EAAQ,QAAU,EAAQ,OAAQ,EAAQ,UAAY,EAC1D,OAAO,EAAQ,KAAK,CAAK,GAWd,EAAY,CACvB,EACA,EAA6B,CAAC,IACnB,CACX,IAAM,EAAQ,EAAI,OAAO,MAAM,EAC/B,GAAI,IAAU,GAAI,OAAO,EACzB,IAAM,EAAY,CAAC,IAAyB,CAC1C,IAAI,EAAO,EACX,GAAI,CACF,EAAO,mBAAmB,CAAG,EAC7B,KAAM,EAIR,OADA,EAAO,EAAK,YAAY,EAEtB,GAAsB,IAAI,CAAI,GAC9B,EAAM,KAAK,CAAC,IACV,OAAO,IAAY,SACf,EAAQ,YAAY,IAAM,EAC1B,EAAY,EAAS,CAAI,CAC/B,GAGJ,OACE,EAAI,MAAM,EAAG,CAAK,EAClB,EACG,MAAM,CAAK,EACX,QAAQ,8BAA+B,CAAC,EAAO,EAAW,IACzD,EAAU,CAAI,EAAI,GAAG,IAAY,eAAoB,CACvD,GAaA,GAAwB,CAC5B,EACA,IACY,CACZ,GAAI,OAAO,IAAU,SAAU,OAAO,EAAY,EAAO,CAAQ,EACjE,GAAI,EAAM,SAAS,KAAK,EACtB,OAAO,EAAY,CAAE,IAAK,EAAU,KAAM,CAAM,CAAC,EAEnD,IAAM,EAAM,EAAiB,CAAQ,EACrC,GAAI,CAAC,EAAK,MAAO,GACjB,IAAM,EAAO,EAAM,YAAY,EAC/B,GAAI,EAAK,WAAW,GAAG,EACrB,OAAO,EAAI,WAAa,EAAK,MAAM,CAAC,GAAK,EAAI,SAAS,SAAS,CAAI,EAErE,OAAQ,EAAK,SAAS,GAAG,EAAI,EAAI,KAAO,EAAI,YAAc,GAG/C,EAAwB,CACnC,EACA,IACY,CACZ,GAAI,EAAQ,UAAU,SAAW,EAC/B,GAAI,CACF,OAAO,EAAQ,yBAAyB,CAAQ,EAChD,KAAM,CACN,MAAO,GAGX,OAAO,EAAQ,UAAU,KAAK,CAAC,IAC7B,GAAsB,EAAU,CAAK,CACvC,GAwBF,IAAM,EAAmB,IACrB,EAA+B,CAAC,EAEvB,EAAuB,CAAC,IAAsB,CAEzD,GADA,EAAc,KAAK,CAAE,MAAK,UAAW,EAAa,CAAE,CAAC,EACjD,EAAc,OAAS,EACzB,EAAgB,EAAc,MAAM,CAAC,CAAgB,GAgBlD,IAAM,EAAqB,IAAY,CAC5C,EAAgB,CAAC,GAkBN,EAAmB,CAC9B,EACA,IACS,CACT,GAAI,CACF,IAAM,EAAO,EAAQ,EAAQ,YAAa,EAAQ,aAAa,EACzD,EAAU,EAAQ,OAAS,EAAI,OAAO,EAAQ,MAAM,EAAI,SACxD,EAAqB,CACzB,KAAM,UACN,KAAM,GAAG,EAAQ,UAAU,OAAU,IACrC,SAAU,EAAQ,UAAY,EAAkB,EAAQ,MAAM,EAC9D,WAAY,KAAK,IAAI,EACrB,WAAY,CACV,sBAAuB,EAAQ,OAC/B,4BACE,EAAQ,OAAS,EAAI,EAAQ,OAAS,OACxC,WAAY,EAAU,EAAQ,YAAa,EAAQ,iBAAiB,EACpE,mBAAoB,EAAQ,KAC5B,0BAA2B,KAAK,MAAM,EAAQ,UAAU,EACxD,oBAAqB,EAAQ,eAC7B,yBAA0B,EAAQ,UAClC,gCAAiC,EAAQ,eAC3C,CACF,EACA,GAAI,EAAQ,SACV,EAAM,QAAU,EAAQ,SAAS,QACjC,EAAM,OAAS,EAAQ,SAAS,OAElC,EAAQ,KAAK,CAAK,EAClB,KAAM,IAKG,EAAgB,CAC3B,EACA,IACqD,CACrD,GAAI,CACF,QAAW,KAAQ,EAAQ,iBAAkB,CAC3C,IAAM,EAAQ,EAAU,CAAI,EAC5B,GAAI,EAAO,MAAO,CAAE,UAAW,EAAO,gBAAiB,CAAK,GAE9D,KAAM,EACR,MAAO,CAAC,GAGG,EAAY,CACvB,EACA,EACA,IACY,CACZ,GAAI,GAAiB,EACnB,MAAO,GAET,IAAM,EAAI,EACV,OACE,GAAG,OAAS,cACX,OAAO,GAAG,UAAY,UAAY,gBAAgB,KAAK,EAAE,OAAO,GAqC/D,EAAW,EAEX,EAAW,IAAI,QAQf,EAAY,CAAC,EAAc,KAA8C,CAC7E,OAAQ,EAAI,OACZ,IAAK,EAAa,EAClB,UAAW,EAAc,EAAO,CAAC,IAAS,EAAI,kBAAkB,CAAI,CAAC,CACvE,GAmBM,EAAe,IAAI,QAEnB,EAAU,CACd,EACA,IACS,CACT,IAAM,EAAQ,GAAS,MAGvB,GAAI,CAAC,GAAW,CAAC,GAAS,IAAU,EAClC,OAEF,GAAI,CACF,IAAQ,SAAQ,MAAK,aAAc,EAAQ,CAAK,EAC1C,EACJ,IAAW,IACV,EAAQ,SAAW,EAAU,OAAW,GAAO,EAAM,YAAY,CAAC,GACrE,EAAiB,EAAO,CACtB,KAAM,MACN,OAAQ,EAAQ,OAChB,YAAa,EAAQ,YACrB,SACA,WAAY,EAAM,EAAQ,MAC1B,SAAU,EAAU,QAAU,OAC9B,SAAU,EAAQ,YACf,CACL,CAAC,EACD,KAAM,IAKJ,GAAW,CAAC,IAAkC,CAClD,IAAM,EAAW,EAAa,IAAI,CAAG,EACrC,GAAI,EACF,OAAO,EAET,IAAM,EAAwB,CAAC,EAsB/B,OArBA,EAAI,iBAAiB,QAAS,IAAM,CAClC,GAAI,EAAK,QACP,EAAK,QAAQ,QAAU,GAE1B,EACD,EAAI,iBAAiB,UAAW,IAAM,CACpC,IAAM,EAAW,EAAK,SAEtB,GADA,EAAK,SAAW,OACZ,GAIF,GAHA,EAAQ,EAAS,QAAS,IAAM,EAAS,OAAO,EAG5C,EAAI,aAAe,EACrB,OAGJ,IAAM,EAAU,EAAK,QACrB,EAAK,QAAU,OACf,EAAQ,EAAS,CAAC,IAAU,EAAU,EAAK,CAAK,CAAC,EAClD,EACD,EAAa,IAAI,EAAK,CAAI,EACnB,GAYL,EAEE,GAAe,CAAC,IAA6B,CACjD,IAA2B,KAArB,EACqB,KAArB,EACiC,iBAAjC,GADe,EAwGrB,MAAO,CACL,eACA,eACA,2BACA,YAvGkB,QAAS,IAAmB,EAAuB,CACrE,IAAM,EAAU,EAChB,GAAI,EACF,GAAI,CACF,IAAO,EAAQ,GAAO,EACtB,EAAS,IAAI,KAAM,CACjB,OAAQ,OAAO,CAAM,EAAE,YAAY,EACnC,YAAa,EAAQ,WAAW,OAAO,CAAG,CAAC,EAC3C,kBAAmB,GACnB,MAAO,EACP,UAAW,EACb,CAAC,EACD,KAAM,EAIV,GAAI,CAGF,IAAM,EAAO,EAAa,IAAI,IAAI,EAC5B,EAAU,GAAM,QACtB,GAAI,GAAQ,GAAS,OAAS,KAAK,aAAe,EAChD,EAAK,SAAW,CAAE,UAAS,QAAS,EAAU,KAAM,EAAQ,KAAK,CAAE,EACnE,EAAK,QAAU,OAEjB,KAAM,EAGR,EAAa,MAAM,KAAM,CAAI,GA4E7B,YArDkB,QAAS,CAAgB,EAAsB,CACjE,IAAM,EAAU,EAChB,GAAI,EACF,GAAI,CACF,IAAM,EAAU,EAAS,IAAI,IAAI,EAIjC,GAAI,GAAS,aAAe,CAAC,EAAQ,UAAW,CAC9C,EAAQ,UAAY,GACpB,IAAM,EAAW,EAAQ,cAAc,EAAQ,WAAW,EAE1D,GACE,CAAC,GACD,EAAQ,uBACR,CAAC,EAAQ,mBACT,EAAsB,EAAS,EAAQ,WAAW,EAElD,GAAI,CACF,IAAM,EAAiB,EAAQ,aAAa,WAAW,EACvD,QAAY,EAAM,KAAU,OAAO,QACjC,EAAe,OACjB,EACE,EAAyB,KAAK,KAAM,EAAM,CAAK,EAEjD,EAAQ,SAAW,EACnB,KAAM,CACN,EAAQ,SAAW,OAIvB,GAAI,CAAC,EACH,EAAqB,EAAQ,WAAW,EAG1C,GAAI,CAAC,GAAY,EAAQ,QACvB,EAAQ,MAAQ,EAAa,EAC7B,EAAQ,MAAQ,EAChB,GAAS,IAAI,EAAE,QAAU,GAG7B,KAAM,EAIV,EAAa,KAAK,KAAM,CAAI,GAS5B,wBA1E8B,QAAS,CAEvC,EACA,EACM,CACN,GAAI,EACF,GAAI,CACF,GAAI,EAAK,YAAY,IAAM,cAAe,CACxC,IAAM,EAAU,EAAS,IAAI,IAAI,EACjC,GAAI,EACF,EAAQ,kBAAoB,IAGhC,KAAM,EAIV,EAAyB,KAAK,KAAM,EAAM,CAAK,EA0DjD,GAGI,EAAe,IACL,WACX,gBACU,UASF,EAAiB,IAAY,CACxC,IAAM,EAAQ,EAAa,EAC3B,GAAI,CAAC,GAAS,EAAU,EAAM,IAAI,EAChC,OAEF,IAAM,EAAQ,GAAa,CAAK,EAChC,EAAY,EAAM,WAAW,EAC7B,EAAY,EAAM,uBAAuB,EACzC,EAAY,EAAM,WAAW,EAC7B,GAAI,CACF,EAAM,KAAO,EAAM,YACnB,EAAM,iBAAmB,EAAM,wBAC/B,EAAM,KAAO,EAAM,YACnB,KAAM,CAGN,GAAI,CACF,EAAM,KAAO,EAAM,aACnB,EAAM,iBAAmB,EAAM,yBAC/B,EAAM,KAAO,EAAM,aACnB,KAAM,EAGR,OAEF,EAAW,GAQA,EAAoB,IAAY,CAC3C,IAAM,EAAQ,EAAa,EAC3B,GAAI,GAAS,EAAU,CACrB,GAAI,EAAM,OAAS,EAAS,YAC1B,EAAM,KAAO,EAAS,aAExB,GAAI,EAAM,mBAAqB,EAAS,wBACtC,EAAM,iBAAmB,EAAS,yBAEpC,GAAI,EAAM,OAAS,EAAS,YAC1B,EAAM,KAAO,EAAS,aAG1B,EAAW,QCpnBb,wBAAS,eAAe,yBAAU,sBAM3B,IAAM,EAAY,IAAe,EAAS,KAAO,MAElD,EAAoB,CAAC,IACzB,OAAO,IAAU,UAAY,EAAM,OAAS,EAAI,EAAQ,OAW7C,EAAyB,IAAuB,CAC3D,IAAM,EAAa,EAAS,WAAa,CAAC,EACpC,EAAM,EAAS,KAAO,MAC5B,MAAO,CACL,UAAW,EAAS,GACpB,aAAc,EAAkB,OAAO,EAAS,SAAW,EAAE,CAAC,EAC9D,sBAAuB,EACnB,QACC,EAAkB,EAAU,KAAK,GAClC,EAAkB,EAAU,YAAY,EAC5C,0BAA2B,EAAkB,EAAU,KAAK,EAC5D,cAAe,EACX,EAAkB,EAAU,cAAc,EAC1C,MACN,GAGW,EAAY,IACtB,WAAqC,UAAY,GAQvC,EAAkB,IAA0B,CACvD,GAAI,CAAC,EAAU,EAAG,OAClB,GAAI,CAKF,IAAM,EAAU,IAAqB,MAAM,YAAY,GACrD,IAAe,WACX,EAAY,GAAQ,eAAe,EAAE,WAAa,GAAQ,UAC1D,EACJ,OAAO,IAAc,SAAW,EAAiB,CAAS,EAAI,OAChE,OAAO,GAAO,EAAI,SAAS,WAAW,MAAM,EACxC,GAAG,EAAI,UACP,OACJ,KAAM,CACN,SASS,EAAa,CAAC,IACzB,EAAiB,CAAG,GAAG,KC1DlB,IAAM,EAAuB,IAAY,CAC9C,EAAe,GAGJ,EAA0B,IAAY,CACjD,EAAkB,EAClB,EAAmB,GAGR,EAAwB,CACnC,KAEA,EAAqB,EACrB,EAAuB,CAAO,EACvB,CACL,QAAQ,EAAG,CACT,EAAyB,EAE7B",
+  "debugId": "18E31BFF7909E41E64756E2164756E21",
+  "names": []
+}

package/dist/client-sdk-core/before-send.d.ts

@@ -0,0 +1,15 @@
+import type { BeforeSend, ClientEvent } from "./types.js";
+/**
+ * The host's `beforeSend` hook, run so that it can never break the SDK: a
+ * hook that throws or returns something other than an event drops the event
+ * (a hook that redacts must not fail open) and warns once per reason. An
+ * event captured synchronously while the hook runs (a `log()` or
+ * `addEvent()` call inside it) is dropped rather than sent around the hook
+ * or fed back into it, so a hook can never recurse. A request the hook
+ * starts completes later and produces an ordinary network event the hook
+ * sees like any other; the hook is responsible for excluding it.
+ */
+export declare const createBeforeSendGate: (hook: BeforeSend | undefined, warnOnce: (warning: {
+    reason: string;
+    message: string;
+}) => void) => ((event: ClientEvent) => ClientEvent | null);