@scalebun-release/web 2.2.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ScaleBun
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,57 @@
+# @scalebun/web
+
+The **ScaleBun web SDK** — unified-session observability for the browser: errors, network,
+performance, replay, and analytics, all captured under one session model. Framework-agnostic core;
+framework adapters (`@scalebun/web-react`, `-vue`, `-angular`, `-next`, `-svelte`) layer on top.
+
+## Install
+
+```bash
+npm install @scalebun/web
+# or: pnpm add @scalebun/web / yarn add @scalebun/web
+```
+
+## Quick start
+
+```ts
+import { ScaleBun } from '@scalebun/web';
+
+await ScaleBun.init({
+  clientKey: 'your-client-key',
+});
+
+// Track product events
+ScaleBun.track('checkout_completed', { plan: 'pro', amount: 49 });
+
+// Attach a user identity
+ScaleBun.identify('user_123', { email: 'jane@example.com' });
+
+// Let a user file a bug report
+await ScaleBun.reportBug({ message: 'The export button does nothing' });
+```
+
+Errors, network requests, performance metrics, and replay frames are captured automatically once
+`init()` resolves (subject to your config).
+
+## Script-tag / CDN usage
+
+A prebuilt browser bundle is published for `unpkg`/`jsDelivr`. Configure via `data-` attributes:
+
+```html
+<script
+  src="https://unpkg.com/@scalebun/web/dist/scalebun.min.js"
+  data-client-key="your-client-key"
+></script>
+```
+
+## Entry points
+
+| Import | Purpose |
+|---|---|
+| `@scalebun/web` | Main SDK (ESM) — the `ScaleBun` facade + typed tracking helpers. |
+| `@scalebun/web/inapp` | In-app messaging / widget surface. |
+| `@scalebun/web/browser` | Prebuilt minified browser bundle (IIFE, for `<script>` tags). |
+
+## License
+
+[MIT](./LICENSE)

package/dist/bootstrap/FeatureRegistry.d.ts

@@ -0,0 +1,44 @@
+/**
+ * FeatureRegistry — stores features and sets them up fail-isolated (one feature throwing never
+ * stops the others). Mirrors the RN SDK's cleanest abstraction. Infra only — no features here.
+ */
+import type { IFeature, FeatureContext } from '@scalebun/sdk-contracts';
+/**
+ * Does this failure look like a dynamic `import()` that never arrived?
+ *
+ * The three engines word it differently and none of them expose a typed error, so the message is the
+ * only signal available:
+ *   Chrome/Edge  "Failed to fetch dynamically imported module: <url>"
+ *   Firefox      "error loading dynamically imported module"
+ *   Safari       "Importing a module script failed."
+ *
+ * Worth classifying rather than leaving to whoever reads the string later: it separates "the feature's
+ * own setup threw" from "the chunk never loaded" (CSP `script-src`, a 404 after a deploy, chunk-hash
+ * skew, a dropped request), and those have completely different fixes.
+ */
+export declare function isModuleLoadFailure(message: string): boolean;
+export declare class FeatureRegistry {
+    private readonly features;
+    add(feature: IFeature): void;
+    /** Look up a registered feature by name (e.g. the facade delegating to ErrorsFeature). */
+    get(name: string): IFeature | undefined;
+    /**
+     * Set every feature up, fail-isolated — and REPORT each failure, don't just log it.
+     *
+     * The log line alone was a blind spot with a measured cost. `ctx.log` is a debug channel, off in
+     * production, so a feature that failed to set up was indistinguishable from one that ran and found
+     * nothing to say. Replay is where that bit: 46 of 231 live web sessions (`npm run replay:diagnose`)
+     * lasted long enough to record and stored zero frames, and 43 of those 46 carried events and perf
+     * metrics — proving the SDK loaded, authenticated and uploaded fine. Capture is lazy-imported while
+     * events/perf sit in the eager core, so a chunk that never arrives kills replay ALONE and leaves no
+     * trace anywhere: nothing was sent, so the backend cannot see it either.
+     *
+     * The diagnostic rides `trackEvent` (kind:'event') on purpose. That is the one lane those 43 sessions
+     * prove works, it is ungated by the 0-cost-closed entitlement map (which only gates frame/network/
+     * error/performance kinds), and the pipeline queues it durably — `setupAll` runs BEFORE
+     * `pipeline.start`, so the event is flushed rather than dropped.
+     */
+    setupAll(ctx: FeatureContext): Promise<void>;
+    teardownAll(): void;
+}
+//# sourceMappingURL=FeatureRegistry.d.ts.map

package/dist/bootstrap/FeatureRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FeatureRegistry.d.ts","sourceRoot":"","sources":["../../src/bootstrap/FeatureRegistry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+B;IAExD,GAAG,CAAC,OAAO,EAAE,QAAQ,GAAG,IAAI;IAI5B,0FAA0F;IAC1F,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS;IAIvC;;;;;;;;;;;;;;;OAeG;IACG,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBlD,WAAW,IAAI,IAAI;CAUpB"}

package/dist/bootstrap/FeatureRegistry.js

@@ -0,0 +1,85 @@
+/**
+ * FeatureRegistry — stores features and sets them up fail-isolated (one feature throwing never
+ * stops the others). Mirrors the RN SDK's cleanest abstraction. Infra only — no features here.
+ */
+/**
+ * Does this failure look like a dynamic `import()` that never arrived?
+ *
+ * The three engines word it differently and none of them expose a typed error, so the message is the
+ * only signal available:
+ *   Chrome/Edge  "Failed to fetch dynamically imported module: <url>"
+ *   Firefox      "error loading dynamically imported module"
+ *   Safari       "Importing a module script failed."
+ *
+ * Worth classifying rather than leaving to whoever reads the string later: it separates "the feature's
+ * own setup threw" from "the chunk never loaded" (CSP `script-src`, a 404 after a deploy, chunk-hash
+ * skew, a dropped request), and those have completely different fixes.
+ */
+export function isModuleLoadFailure(message) {
+    return /dynamically imported module|module script failed|error loading dynamically/i.test(message);
+}
+export class FeatureRegistry {
+    constructor() {
+        this.features = new Map();
+    }
+    add(feature) {
+        this.features.set(feature.name, feature);
+    }
+    /** Look up a registered feature by name (e.g. the facade delegating to ErrorsFeature). */
+    get(name) {
+        return this.features.get(name);
+    }
+    /**
+     * Set every feature up, fail-isolated — and REPORT each failure, don't just log it.
+     *
+     * The log line alone was a blind spot with a measured cost. `ctx.log` is a debug channel, off in
+     * production, so a feature that failed to set up was indistinguishable from one that ran and found
+     * nothing to say. Replay is where that bit: 46 of 231 live web sessions (`npm run replay:diagnose`)
+     * lasted long enough to record and stored zero frames, and 43 of those 46 carried events and perf
+     * metrics — proving the SDK loaded, authenticated and uploaded fine. Capture is lazy-imported while
+     * events/perf sit in the eager core, so a chunk that never arrives kills replay ALONE and leaves no
+     * trace anywhere: nothing was sent, so the backend cannot see it either.
+     *
+     * The diagnostic rides `trackEvent` (kind:'event') on purpose. That is the one lane those 43 sessions
+     * prove works, it is ungated by the 0-cost-closed entitlement map (which only gates frame/network/
+     * error/performance kinds), and the pipeline queues it durably — `setupAll` runs BEFORE
+     * `pipeline.start`, so the event is flushed rather than dropped.
+     */
+    async setupAll(ctx) {
+        for (const f of this.features.values()) {
+            try {
+                await f.setup(ctx);
+            }
+            catch (err) {
+                ctx.log(`[scalebun] feature "${f.name}" failed to set up:`, err);
+                try {
+                    const e = err;
+                    // Truncated, but generously: a module-load message carries the failing chunk URL, which is
+                    // the single most useful field here — it names which chunk to go look for.
+                    const message = String(e?.message ?? err).slice(0, 300);
+                    ctx.trackEvent('sdk_feature_setup_failed', {
+                        feature: f.name,
+                        error: e?.name || 'Error',
+                        message,
+                        moduleLoad: isModuleLoadFailure(message),
+                    });
+                }
+                catch {
+                    /* A diagnostic must never be the thing that breaks setup. */
+                }
+            }
+        }
+    }
+    teardownAll() {
+        for (const f of this.features.values()) {
+            try {
+                f.teardown();
+            }
+            catch {
+                /* ignore */
+            }
+        }
+        this.features.clear();
+    }
+}
+//# sourceMappingURL=FeatureRegistry.js.map

package/dist/bootstrap/FeatureRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FeatureRegistry.js","sourceRoot":"","sources":["../../src/bootstrap/FeatureRegistry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,OAAO,6EAA6E,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACrG,CAAC;AAED,MAAM,OAAO,eAAe;IAA5B;QACmB,aAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IA6D1D,CAAC;IA3DC,GAAG,CAAC,OAAiB;QACnB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,0FAA0F;IAC1F,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,QAAQ,CAAC,GAAmB;QAChC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,IAAI,qBAAqB,EAAE,GAAG,CAAC,CAAC;gBACjE,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,GAAsD,CAAC;oBACjE,2FAA2F;oBAC3F,2EAA2E;oBAC3E,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;oBACxD,GAAG,CAAC,UAAU,CAAC,0BAA0B,EAAE;wBACzC,OAAO,EAAE,CAAC,CAAC,IAAI;wBACf,KAAK,EAAE,CAAC,EAAE,IAAI,IAAI,OAAO;wBACzB,OAAO;wBACP,UAAU,EAAE,mBAAmB,CAAC,OAAO,CAAC;qBACzC,CAAC,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC;oBACP,6DAA6D;gBAC/D,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,WAAW;QACT,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,CAAC,CAAC,QAAQ,EAAE,CAAC;YACf,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/bootstrap/SDKBootstrapper.d.ts

@@ -0,0 +1,37 @@
+/**
+ * SDKBootstrapper — the single real init path (mirrors the RN SDK's bootstrap).
+ * Flow: validate config → build the unified pipeline + transport + session → register features from
+ * the manifest → setup features → start the pipeline (which opens the session + flush loop).
+ */
+import type { ScaleBunInitConfig } from '@scalebun/sdk-contracts';
+import { type ResolvedConfig } from '../config/schema.js';
+import { type ConsentStatus } from '../core/index.js';
+import { SessionManager } from '../features/session/sessionManager.js';
+import { HttpClient } from '../transport/httpClient.js';
+import { Pipeline } from '../pipeline/pipeline.js';
+import { FeatureRegistry } from './FeatureRegistry.js';
+export declare function entitlementForKind(k: string | undefined): string;
+export interface SdkRuntime {
+    config: ResolvedConfig;
+    session: SessionManager;
+    pipeline: Pipeline;
+    transport: HttpClient;
+    registry: FeatureRegistry;
+    log: (...args: unknown[]) => void;
+    /** Resolve consent (typically from a CMP callback). Granting activates capture; denying purges. */
+    setConsent: (granted: boolean) => void;
+    /** Current consent state. */
+    readonly consentStatus: ConsentStatus;
+}
+export declare class SDKBootstrapper {
+    /**
+     * `opts.edge` = the edge/worker LITE lane: analytics + config only (via the P2 capability gate),
+     * transport-only. The session/replay pipeline stays inert (no startSession, no flush timer, no DOM
+     * lifecycle listeners) — its egress gate is left closed so facade session-lane emits drop instead of
+     * buffering unsent. The analytics lane self-manages its own /batch egress and works fine on edge.
+     */
+    static bootstrap(input: ScaleBunInitConfig, opts?: {
+        edge?: boolean;
+    }): Promise<SdkRuntime>;
+}
+//# sourceMappingURL=SDKBootstrapper.d.ts.map

package/dist/bootstrap/SDKBootstrapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SDKBootstrapper.d.ts","sourceRoot":"","sources":["../../src/bootstrap/SDKBootstrapper.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAkB,MAAM,yBAAyB,CAAC;AAElF,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAwJ,KAAK,aAAa,EAAE,MAAM,SAAS,CAAC;AACnM,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAkBpD,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAUhE;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,cAAc,CAAC;IACxB,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,UAAU,CAAC;IACtB,QAAQ,EAAE,eAAe,CAAC;IAC1B,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IAClC,mGAAmG;IACnG,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACvC,6BAA6B;IAC7B,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;CACvC;AAED,qBAAa,eAAe;IAC1B;;;;;OAKG;WACU,SAAS,CAAC,KAAK,EAAE,kBAAkB,EAAE,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC;CAmTlG"}

package/dist/bootstrap/SDKBootstrapper.js

@@ -0,0 +1,346 @@
+/**
+ * SDKBootstrapper — the single real init path (mirrors the RN SDK's bootstrap).
+ * Flow: validate config → build the unified pipeline + transport + session → register features from
+ * the manifest → setup features → start the pipeline (which opens the session + flush loop).
+ */
+import { resolveConfig } from '../config/schema.js';
+import { createLogger, ConsentGate, recordBreadcrumb, clearBreadcrumbs, breadcrumbs, setBeforeBreadcrumb, noteReplayFrame, clearReplayCoord, patchEvalContext } from '../core/index.js';
+import { SessionManager } from '../features/session/sessionManager.js';
+import { HttpClient } from '../transport/httpClient.js';
+import { Pipeline } from '../pipeline/pipeline.js';
+import { FeatureRegistry } from './FeatureRegistry.js';
+import { FEATURES, OPTIONAL_FEATURES, featureRequirements } from '../features/manifest.js';
+import { can } from '../core/index.js';
+/**
+ * How often the session bounds are re-checked while the page stays open.
+ *
+ * A minute is far finer than the shortest bound it feeds (a 30-minute idle window), and the check is
+ * a storage read plus two subtractions — the same cost `touchSession` already pays on the envelope
+ * path once a minute. Anything finer would buy nothing a viewer could perceive.
+ */
+const SESSION_CHECK_MS = 60000;
+// 0-cost-closed: map an item kind → the SDK-suppressible entitlement that gates it (or '' if
+// ungated). When the org has CLOSED one of these features (admin dashboard → /config entitlements),
+// the SDK drops the item BEFORE egress — the request never leaves the browser (true 0 cost, not just
+// a server-side reject). Fail-open: only drops when the entitlement is explicitly `false`. Mirrors
+// the backend's FEATURE_ENFORCEMENT `sdk` tier.
+export function entitlementForKind(k) {
+    return k === 'frame'
+        ? 'replay'
+        : k === 'network'
+            ? 'networkMonitoring'
+            : k === 'error'
+                ? 'crashReporting'
+                : k === 'performance' || k === 'resource' || k === 'trace' || k === 'transaction'
+                    ? 'performanceMonitoring'
+                    : '';
+}
+export class SDKBootstrapper {
+    /**
+     * `opts.edge` = the edge/worker LITE lane: analytics + config only (via the P2 capability gate),
+     * transport-only. The session/replay pipeline stays inert (no startSession, no flush timer, no DOM
+     * lifecycle listeners) — its egress gate is left closed so facade session-lane emits drop instead of
+     * buffering unsent. The analytics lane self-manages its own /batch egress and works fine on edge.
+     */
+    static async bootstrap(input, opts) {
+        const config = resolveConfig(input);
+        const log = createLogger(config.debug);
+        const session = new SessionManager(config);
+        const transport = new HttpClient(config);
+        const pipeline = new Pipeline(config, session, transport);
+        if (opts?.edge)
+            pipeline.setConsentGranted(false); // keep the session lane inert on edge
+        const registry = new FeatureRegistry();
+        // Breadcrumbs: fresh ring for this session, sized from config. Every item flowing through the
+        // pipeline is mirrored into the ring (the ONE place auto-breadcrumbs are captured).
+        clearBreadcrumbs();
+        clearReplayCoord();
+        if (typeof config.errors?.maxBreadcrumbs === 'number')
+            breadcrumbs.setMax(config.errors.maxBreadcrumbs);
+        // Cast across the contract↔core boundary: the config type uses the protocol (passthrough)
+        // Breadcrumb, core uses its structural twin — same runtime shape.
+        setBeforeBreadcrumb(config.errors?.beforeBreadcrumb);
+        const emitWithCrumb = (item) => {
+            // 0-cost-closed: drop items whose feature the org has closed, before they ever hit egress.
+            const ekey = entitlementForKind(item.kind);
+            if (ekey && registry.get('config')?.entitlement?.(ekey) === false)
+                return;
+            recordBreadcrumb(item);
+            noteReplayFrame(item); // track the live replay coordinate for error↔frame correlation
+            pipeline.emit(item);
+        };
+        // Capture-signal bus: features raise signals ('error'/'rage'/'report'); capture-on-signal
+        // features (replay) subscribe and flush their buffer.
+        const signalListeners = new Set();
+        // The narrow surface features get — emit Items, track events, read state, log, signal.
+        const ctx = {
+            sessionId: session.sessionId,
+            clientKey: config.clientKey,
+            deviceId: session.deviceId,
+            appVersion: config.appVersion, // E0 — Engage sends it as the config-query appVersion
+            // Resolved lazily: identity arrives when the host calls identify(), long after this context is
+            // built. Engage/IAM send it as the config-query `endUserId` so the backend can resolve segment
+            // targeting; while anonymous it stays undefined and a segment-targeted campaign fails closed.
+            getUserId: () => registry.get('analytics')?.identity?.userId,
+            emit: emitWithCrumb,
+            // No breadcrumb wrapper: this item belongs to a session that has already ended, so THIS
+            // session's breadcrumb trail would be the wrong context to attach to it.
+            emitFor: (sid, item) => pipeline.emitFor(sid, item),
+            egressPending: () => pipeline.pendingCount,
+            egressDropped: () => pipeline.dropped,
+            trackEvent: (name, props) => emitWithCrumb({ kind: 'event', name, props, timestamp: Date.now() }),
+            getAppState: () => (can('visibility') && document.visibilityState === 'hidden' ? 'background' : 'active'),
+            log,
+            apiBaseUrl: config.apiBaseUrl,
+            signal: (reason, detail) => {
+                for (const l of signalListeners) {
+                    try {
+                        l(reason, detail);
+                    }
+                    catch {
+                        /* never let a listener break the signaller */
+                    }
+                }
+            },
+            onSignal: (cb) => {
+                signalListeners.add(cb);
+                return () => signalListeners.delete(cb);
+            },
+            replaySampling: config.replay,
+            // The gamified-outcome resolver. Passed through untouched; the engage runtime types it.
+            ...(config.onInAppGameRequest
+                ? { onInAppGameRequest: config.onInAppGameRequest }
+                : {}),
+            errorsOptions: config.errors,
+            networkOptions: config.network,
+            performanceOptions: config.performance,
+            watchdogOptions: config.watchdog, // W5.2 — Resource Watchdog tuning
+            analyticsOptions: config.analytics,
+            flagsBootstrap: config.flags?.bootstrap, // F3 — seed flags before the network responds
+            flagsRealtime: config.flags?.realtime, // F4 — subscribe to the realtime config stream (default on)
+            replayCanvas: config.replayCanvas,
+            replayDirectUpload: config.replayDirectUpload,
+            replayFrameOrigins: config.replayFrameOrigins,
+            autocapture: config.autocapture,
+            // Resolve the traceparent allowlist: same-origin + configured cross-origins, or [] when off.
+            traceOrigins: config.tracePropagation
+                ? [...(typeof location !== 'undefined' ? [location.origin] : []), ...config.tracePropagationOrigins]
+                : [],
+            maskReplayText: config.privacy.maskReplayText,
+            maskEventText: config.privacy.maskEventText,
+            maskSelectors: config.privacy.maskSelectors,
+            maskInputs: config.privacy.maskInputs,
+            respectDnt: config.privacy.respectDnt,
+            exitIntent: config.exitIntent, // #25 P2 — host-tunable scroll-reversal thresholds
+        };
+        // Register a feature only when (a) it's enabled (config.features[name] !== false) AND (b) the current
+        // runtime has the capabilities it fundamentally needs (§P2 eligibility gate). In a browser every
+        // capability is present so this is a no-op (all enabled features register, unchanged); on an edge/
+        // worker runtime the DOM features are skipped and only the network-eligible surface (analytics/config)
+        // registers. Idempotent (Map by name) so it's safe to call again after a consent-deny teardownAll().
+        const enabled = config.features;
+        const registerFeatures = () => {
+            for (const f of FEATURES) {
+                if (enabled[f.name] === false)
+                    continue;
+                if (!featureRequirements(f.name).every((cap) => can(cap)))
+                    continue;
+                registry.add(f);
+            }
+        };
+        registerFeatures();
+        /**
+         * P5a — register the OFF-BY-DEFAULT features, which are lazy-imported.
+         *
+         * Only reached for a name the host explicitly enabled: all five default to `false`, so the common
+         * page never issues any of these imports and never pays for them. That is the whole point — their
+         * shells used to sit in the eager core on every page load whether or not the site used them
+         * (measured: 1,383 B gzipped).
+         *
+         * Awaited inside `activate()` BEFORE `setupAll`, so an enabled feature is registered and set up in
+         * exactly the same order an eager one would be, and the setup-before-`pipeline.start` contract that
+         * F-VIT depends on is untouched.
+         *
+         * `Promise.all`, not sequential: two opted-in features are independent, and serialising their
+         * imports would put a second round trip in front of session start for no reason.
+         *
+         * A failed import must not stop the others or abort activation — a feature that cannot load is a
+         * missing feature, not a broken SDK. `FeatureRegistry.setupAll` already reports per-feature setup
+         * failures; this reports the earlier, rarer case where the chunk itself never arrives.
+         */
+        const registerOptional = async () => {
+            await Promise.all(Object.entries(OPTIONAL_FEATURES).map(async ([name, load]) => {
+                if (enabled[name] !== true)
+                    return;
+                if (!featureRequirements(name).every((cap) => can(cap)))
+                    return;
+                if (registry.get(name))
+                    return; // idempotent, like registerFeatures()
+                try {
+                    registry.add(await load());
+                }
+                catch (err) {
+                    log(`[scalebun] optional feature "${name}" failed to load:`, err);
+                }
+            }));
+        };
+        // Consent-mode (F-CNS): when consent is required and not yet granted, DEFER activation — no
+        // feature setup (no observers installed) and no pipeline start (no session opened, no flush).
+        // Capture begins only on the first grant. Default (not required) → activate immediately.
+        const consent = new ConsentGate(config.consent.initial);
+        /**
+         * MAKE THE SESSION BOUNDS FIRE WHILE THE PAGE IS OPEN.
+         *
+         * Both bounds — the 30-minute idle window and the absolute cap — were only ever evaluated in the
+         * `SessionManager` constructor, i.e. once per document load. A single-page app that is opened and
+         * never reloaded was never re-evaluated, so neither could fire. Production, over 14 days: 141 web
+         * sessions ran past the four-hour cap and 2 were capped by it; the rest were held open until the
+         * server's reaper clamped them at 24 hours, on real spans of 24 to 28 hours carrying a single
+         * event apiece. This does not change the policy — the cap is unchanged and still configurable. It
+         * makes the policy that is already written down actually run.
+         *
+         * ORDER IS THE WHOLE DESIGN. Everything still queued belongs to the session that just ended, so
+         * it drains under the OLD id before the swap. Then the new row is opened server-side, because a
+         * batch filed against a session the server has never heard of is answered 200 and dropped —
+         * `unknown_session` is already the largest rejection reason in production at 13,385 items, and
+         * rotating without this would make it the largest by far. Replay is re-armed last: deltas
+         * reconstruct against a keyframe, and the new session has none until one is taken.
+         *
+         * Both a timer and a visibility check, because the two shapes of a long session are different: a
+         * backgrounded tab is caught on return, and a tab parked in the FOREGROUND — the clinic
+         * workstation that prompted the four-hour cap — is only ever caught by the timer.
+         */
+        const installSessionRotation = () => {
+            const rotate = async () => {
+                if (!session.expired())
+                    return;
+                await pipeline.drain(); // the queue belongs to the session that is ending
+                const prev = session.rotate();
+                if (!prev)
+                    return; // raced another rotation; the winner has already done all of this
+                clearBreadcrumbs();
+                clearReplayCoord(); // a coordinate into the previous session's frames means nothing here
+                await pipeline.restart();
+                // pause() then resume() re-arms capture on a FRESH keyframe — see RecorderController.resume,
+                // which exists for exactly this "the DOM moved on and old deltas cannot rebase" case.
+                const replay = registry.get('replay');
+                replay?.pause?.();
+                replay?.resume?.();
+                log('[session] rotated', prev, '->', session.sessionId);
+            };
+            const timer = setInterval(() => void rotate(), SESSION_CHECK_MS);
+            // Unref where the host runtime supports it, so a Node/SSR consumer is not held open by us.
+            timer.unref?.();
+            if (can('visibility')) {
+                document.addEventListener('visibilitychange', () => {
+                    if (document.visibilityState === 'visible')
+                        void rotate();
+                });
+            }
+        };
+        let activated = false;
+        const activate = async () => {
+            if (activated)
+                return;
+            activated = true;
+            registerFeatures(); // re-register after a prior deny teardownAll() cleared the registry
+            await registerOptional(); // P5a — opted-in lazy features, before setup so ordering is unchanged
+            // Order matters: setupAll BEFORE pipeline.start (F-VIT relies on it — see its header).
+            await registry.setupAll(ctx);
+            // Edge-lite: skip the session-lane pipeline (no startSession fetch, no flush timer, no DOM
+            // lifecycle listeners). Analytics/config already self-manage their own /batch egress in setup().
+            if (!opts?.edge) {
+                await pipeline.start();
+                installSessionRotation();
+            }
+            /**
+             * Re-assert a REMEMBERED identity so this session is attributed to the user.
+             *                                                  (SESSIONS-REAL-DATA-PLAN §2b)
+             * identify() persists the user id, but the backend links a user to a session only when it
+             * RECEIVES an identify item — it stamps `endUserId` on the session named in the request. A
+             * restored id sitting in memory would therefore label events while leaving every session after
+             * the first one Anonymous, which is the symptom this is here to remove. Emitting it once on
+             * activation costs one item and makes the link before anything else is sent.
+             */
+            const ident = registry.get('analytics')?.identity;
+            if (ident?.userId && !opts?.edge) {
+                pipeline.emit({
+                    kind: 'identify',
+                    userId: ident.userId,
+                    anonymousId: ident.anonymousId,
+                    timestamp: Date.now(),
+                });
+            }
+            /**
+             * Re-publish the persisted TARGETING context (F0) — not just the identity item above.
+             *
+             * `evalContext` is an in-memory bag and only ConfigFeature's `deviceId` was re-patched at boot.
+             * The user id (localStorage `scalebun_user_id`), super-properties and group memberships all
+             * survive a reload INSIDE AnalyticsFeature, but nothing republished them here — so after a
+             * refresh a flag / experiment / in-app rule targeting `userId`, a super-prop or a `group_*`
+             * attribute evaluated against a bag holding `deviceId` alone and silently resolved to the
+             * default, until the host app happened to call identify()/register() again on that page load.
+             * An app that identifies once at login (rather than from auth state on every mount) therefore
+             * lost user-scoped targeting on every navigation.
+             *
+             * Runs BEFORE the first host-app flag read but AFTER `setupAll`, because AnalyticsFeature loads
+             * super-props and groups from storage in its own setup() — earlier and the bag would be empty.
+             * Not gated on `opts.edge` (config/flags are live on the edge lane) and not gated on `userId`
+             * (super-props and groups are not identity-scoped — an anonymous visitor can carry both).
+             *
+             * Order is deliberate: super-props first, identity last, so a stale persisted super-prop named
+             * `userId` cannot shadow the real one. Group keys use the same `group_<type>` spelling the
+             * facade's group() writes, or restored memberships would not match existing rules.
+             *
+             * NOTE: identify() TRAITS are not restored — unlike super-props they are never persisted. To
+             * target a trait across reloads the host app must register() it or re-identify on each load.
+             */
+            if (ident) {
+                patchEvalContext(ident.superProps);
+                const groups = ident.groups;
+                if (groups) {
+                    for (const type of Object.keys(groups))
+                        patchEvalContext({ [`group_${type}`]: groups[type] });
+                }
+                if (ident.userId)
+                    patchEvalContext({ userId: ident.userId });
+            }
+            log(opts?.edge ? 'activated (edge-lite)' : 'activated', { sessionId: session.sessionId });
+        };
+        const setConsent = (granted) => {
+            consent.set(granted ? 'granted' : 'denied');
+            if (granted) {
+                pipeline.setConsentGranted(true);
+                void activate();
+            }
+            else {
+                pipeline.setConsentGranted(false);
+                if (activated)
+                    registry.teardownAll();
+                activated = false; // allow re-activation on a later grant (decline → change mind → accept)
+                void pipeline.discard(); // purge in-memory + persisted buffer; never sends
+            }
+        };
+        const runtime = {
+            config,
+            session,
+            pipeline,
+            transport,
+            registry,
+            log,
+            setConsent,
+            get consentStatus() {
+                return consent.value;
+            },
+        };
+        if (!config.consent.required || consent.granted) {
+            await activate();
+        }
+        else {
+            log('consent required — capture deferred until setConsent(true)');
+        }
+        log('initialized', { sessionId: session.sessionId, consent: consent.value });
+        return runtime;
+    }
+}
+//# sourceMappingURL=SDKBootstrapper.js.map

package/dist/bootstrap/SDKBootstrapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SDKBootstrapper.js","sourceRoot":"","sources":["../../src/bootstrap/SDKBootstrapper.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,aAAa,EAAuB,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,WAAW,EAAE,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAsB,MAAM,SAAS,CAAC;AACnM,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,CAAC;AAE9B;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,KAAM,CAAC;AAEhC,6FAA6F;AAC7F,oGAAoG;AACpG,qGAAqG;AACrG,mGAAmG;AACnG,gDAAgD;AAChD,MAAM,UAAU,kBAAkB,CAAC,CAAqB;IACtD,OAAO,CAAC,KAAK,OAAO;QAClB,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,CAAC,KAAK,SAAS;YACf,CAAC,CAAC,mBAAmB;YACrB,CAAC,CAAC,CAAC,KAAK,OAAO;gBACb,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,CAAC,KAAK,aAAa,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,aAAa;oBAC/E,CAAC,CAAC,uBAAuB;oBACzB,CAAC,CAAC,EAAE,CAAC;AACf,CAAC;AAeD,MAAM,OAAO,eAAe;IAC1B;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,KAAyB,EAAE,IAAyB;QACzE,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC1D,IAAI,IAAI,EAAE,IAAI;YAAE,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,sCAAsC;QACzF,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;QAEvC,8FAA8F;QAC9F,oFAAoF;QACpF,gBAAgB,EAAE,CAAC;QACnB,gBAAgB,EAAE,CAAC;QACnB,IAAI,OAAO,MAAM,CAAC,MAAM,EAAE,cAAc,KAAK,QAAQ;YAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACxG,0FAA0F;QAC1F,kEAAkE;QAClE,mBAAmB,CAAC,MAAM,CAAC,MAAM,EAAE,gBAA6D,CAAC,CAAC;QAClG,MAAM,aAAa,GAAG,CAAC,IAAU,EAAQ,EAAE;YACzC,2FAA2F;YAC3F,MAAM,IAAI,GAAG,kBAAkB,CAAE,IAA0B,CAAC,IAAI,CAAC,CAAC;YAClE,IAAI,IAAI,IAAK,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAA0D,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK;gBAAE,OAAO;YACpI,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACvB,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,+DAA+D;YACtF,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC,CAAC;QAEF,0FAA0F;QAC1F,sDAAsD;QACtD,MAAM,eAAe,GAAG,IAAI,GAAG,EAA8D,CAAC;QAE9F,uFAAuF;QACvF,MAAM,GAAG,GAAmB;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,sDAAsD;YACrF,+FAA+F;YAC/F,+FAA+F;YAC/F,8FAA8F;YAC9F,SAAS,EAAE,GAAG,EAAE,CACb,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAoD,EAAE,QAAQ,EAAE,MAAM;YAEjG,IAAI,EAAE,aAAa;YACnB,wFAAwF;YACxF,yEAAyE;YACzE,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC;YACnD,aAAa,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY;YAC1C,aAAa,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO;YACrC,UAAU,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACjG,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;YACzG,GAAG;YACH,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;gBACzB,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;oBAChC,IAAI,CAAC;wBACH,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;oBACpB,CAAC;oBAAC,MAAM,CAAC;wBACP,8CAA8C;oBAChD,CAAC;gBACH,CAAC;YACH,CAAC;YACD,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE;gBACf,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxB,OAAO,GAAG,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1C,CAAC;YACD,cAAc,EAAE,MAAM,CAAC,MAAM;YAC7B,wFAAwF;YACxF,GAAG,CAAC,MAAM,CAAC,kBAAkB;gBAC3B,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE;gBACnD,CAAC,CAAC,EAAE,CAAC;YACP,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,cAAc,EAAE,MAAM,CAAC,OAAO;YAC9B,kBAAkB,EAAE,MAAM,CAAC,WAAW;YACtC,eAAe,EAAE,MAAM,CAAC,QAAQ,EAAE,kCAAkC;YACpE,gBAAgB,EAAE,MAAM,CAAC,SAAS;YAClC,cAAc,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,8CAA8C;YACvF,aAAa,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,4DAA4D;YACnG,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,6FAA6F;YAC7F,YAAY,EAAE,MAAM,CAAC,gBAAgB;gBACnC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,uBAAuB,CAAC;gBACpG,CAAC,CAAC,EAAE;YACN,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,cAAc;YAC7C,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa;YAC3C,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa;YAC3C,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;YACrC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;YACrC,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,mDAAmD;SACnF,CAAC;QAEF,sGAAsG;QACtG,iGAAiG;QACjG,mGAAmG;QACnG,uGAAuG;QACvG,qGAAqG;QACrG,MAAM,OAAO,GAAG,MAAM,CAAC,QAA8C,CAAC;QACtE,MAAM,gBAAgB,GAAG,GAAS,EAAE;YAClC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK;oBAAE,SAAS;gBACxC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAAE,SAAS;gBACpE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC,CAAC;QACF,gBAAgB,EAAE,CAAC;QAEnB;;;;;;;;;;;;;;;;;;WAkBG;QACH,MAAM,gBAAgB,GAAG,KAAK,IAAmB,EAAE;YACjD,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;gBAC3D,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI;oBAAE,OAAO;gBACnC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAAE,OAAO;gBAChE,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,OAAO,CAAC,sCAAsC;gBACtE,IAAI,CAAC;oBACH,QAAQ,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;gBAC7B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,gCAAgC,IAAI,mBAAmB,EAAE,GAAG,CAAC,CAAC;gBACpE,CAAC;YACH,CAAC,CAAC,CACH,CAAC;QACJ,CAAC,CAAC;QAEF,4FAA4F;QAC5F,8FAA8F;QAC9F,yFAAyF;QACzF,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxD;;;;;;;;;;;;;;;;;;;;;WAqBG;QACH,MAAM,sBAAsB,GAAG,GAAS,EAAE;YACxC,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;gBACvC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE;oBAAE,OAAO;gBAC/B,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,kDAAkD;gBAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC9B,IAAI,CAAC,IAAI;oBAAE,OAAO,CAAC,kEAAkE;gBACrF,gBAAgB,EAAE,CAAC;gBACnB,gBAAgB,EAAE,CAAC,CAAC,qEAAqE;gBACzF,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACzB,6FAA6F;gBAC7F,sFAAsF;gBACtF,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAA4D,CAAC;gBACjG,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;gBAClB,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;gBACnB,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YAC1D,CAAC,CAAC;YACF,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC;YACjE,2FAA2F;YAC1F,KAA2C,CAAC,KAAK,EAAE,EAAE,CAAC;YACvD,IAAI,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBACtB,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,GAAG,EAAE;oBACjD,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;wBAAE,KAAK,MAAM,EAAE,CAAC;gBAC5D,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QAEF,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,QAAQ,GAAG,KAAK,IAAmB,EAAE;YACzC,IAAI,SAAS;gBAAE,OAAO;YACtB,SAAS,GAAG,IAAI,CAAC;YACjB,gBAAgB,EAAE,CAAC,CAAC,oEAAoE;YACxF,MAAM,gBAAgB,EAAE,CAAC,CAAC,sEAAsE;YAChG,uFAAuF;YACvF,MAAM,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC7B,2FAA2F;YAC3F,iGAAiG;YACjG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;gBAChB,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACvB,sBAAsB,EAAE,CAAC;YAC3B,CAAC;YACD;;;;;;;;eAQG;YACH,MAAM,KAAK,GACT,QAAQ,CAAC,GAAG,CAAC,WAAW,CAUzB,EAAE,QAAQ,CAAC;YACZ,IAAI,KAAK,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;gBACjC,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;iBACb,CAAC,CAAC;YACd,CAAC;YACD;;;;;;;;;;;;;;;;;;;;;;;eAuBG;YACH,IAAI,KAAK,EAAE,CAAC;gBACV,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACnC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;gBAC5B,IAAI,MAAM,EAAE,CAAC;oBACX,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;wBAAE,gBAAgB,CAAC,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAChG,CAAC;gBACD,IAAI,KAAK,CAAC,MAAM;oBAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5F,CAAC,CAAC;QAEF,MAAM,UAAU,GAAG,CAAC,OAAgB,EAAQ,EAAE;YAC5C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,OAAO,EAAE,CAAC;gBACZ,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBACjC,KAAK,QAAQ,EAAE,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAClC,IAAI,SAAS;oBAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACtC,SAAS,GAAG,KAAK,CAAC,CAAC,wEAAwE;gBAC3F,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,kDAAkD;YAC7E,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,OAAO,GAAe;YAC1B,MAAM;YACN,OAAO;YACP,QAAQ;YACR,SAAS;YACT,QAAQ;YACR,GAAG;YACH,UAAU;YACV,IAAI,aAAa;gBACf,OAAO,OAAO,CAAC,KAAK,CAAC;YACvB,CAAC;SACF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAChD,MAAM,QAAQ,EAAE,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,4DAA4D,CAAC,CAAC;QACpE,CAAC;QAED,GAAG,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7E,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}