@scalebun-release/web 2.2.2

package/dist/browser.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Browser global entry — the no-build install target.
+ *
+ * esbuild bundles this as an IIFE (see scripts/build-browser.mjs) so a plain
+ *   <script src="https://cdn…/scalebun.min.js"></script>
+ * exposes `window.ScaleBun` and `ScaleBun.init({...})` works with NO bundler. It is the SAME facade as
+ * the npm/ESM build — one runtime, no fork.
+ *
+ * IMPORTANT: this module is NOT imported by src/index.ts, so it never enters the eager-core bundle the
+ * `size:check` gate measures. The 30 KB ESM gate is unaffected by anything here.
+ *
+ * Two no-build install shapes are supported:
+ *
+ *  1. ASYNC LOADER SNIPPET (recommended) — an inline stub queues early calls, then loads this bundle:
+ *       <script>
+ *         !function(w,d){w.ScaleBun=w.ScaleBun||{q:[]};
+ *           ['init','track','identify','trackPurchase','setConsent','reset','register','group','alias']
+ *             .forEach(function(m){w.ScaleBun[m]=w.ScaleBun[m]||function(){w.ScaleBun.q.push([m,arguments]);};});
+ *           var s=d.createElement('script');s.async=true;
+ *           s.src='https://cdn.jsdelivr.net/npm/@scalebun/web@1/dist/scalebun.min.js';
+ *           d.head.appendChild(s);}(window,document);
+ *         ScaleBun.init({clientKey:'…'});
+ *       </script>
+ *     On load we replace the stub, replay `ScaleBun.q` in order — no race, no lost calls.
+ *
+ *  2. DECLARATIVE TAG (CSP-clean, zero inline JS) — config via data-* on the tag itself:
+ *       <script async src="…/scalebun.min.js" data-client-key="…"></script>
+ *     We read the loading script's dataset and auto-init.
+ */
+import { ScaleBun } from './public/ScaleBunFacade.js';
+/** The async-loader stub captures pre-load calls as `[method, args]` on `.q`. */
+interface ScaleBunStub {
+    q?: Array<[string, unknown[]]>;
+}
+declare global {
+    interface Window {
+        ScaleBun?: typeof ScaleBun | ScaleBunStub;
+    }
+}
+/**
+ * Install the real facade as `window.ScaleBun`: (1) drain any queued calls the loader stub captured
+ * before this bundle loaded, then (2) auto-init from the loading `<script>`'s data-* attributes.
+ * Exported for unit tests; the module runs it once on load below.
+ */
+export declare function installBrowserGlobal(win: {
+    ScaleBun?: typeof ScaleBun | ScaleBunStub;
+}, currentScript: {
+    dataset?: DOMStringMap;
+} | null): void;
+export { ScaleBun as default, ScaleBun };
+//# sourceMappingURL=browser.d.ts.map

package/dist/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAGnD,iFAAiF;AACjF,UAAU,YAAY;IACpB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;CAChC;AAED,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,MAAM;QACd,QAAQ,CAAC,EAAE,OAAO,QAAQ,GAAG,YAAY,CAAC;KAC3C;CACF;AAID;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,QAAQ,GAAG,YAAY,CAAA;CAAE,EAClD,aAAa,EAAE;IAAE,OAAO,CAAC,EAAE,YAAY,CAAA;CAAE,GAAG,IAAI,GAC/C,IAAI,CAqCN;AAaD,OAAO,EAAE,QAAQ,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC"}

package/dist/browser.js

@@ -0,0 +1,86 @@
+/**
+ * Browser global entry — the no-build install target.
+ *
+ * esbuild bundles this as an IIFE (see scripts/build-browser.mjs) so a plain
+ *   <script src="https://cdn…/scalebun.min.js"></script>
+ * exposes `window.ScaleBun` and `ScaleBun.init({...})` works with NO bundler. It is the SAME facade as
+ * the npm/ESM build — one runtime, no fork.
+ *
+ * IMPORTANT: this module is NOT imported by src/index.ts, so it never enters the eager-core bundle the
+ * `size:check` gate measures. The 30 KB ESM gate is unaffected by anything here.
+ *
+ * Two no-build install shapes are supported:
+ *
+ *  1. ASYNC LOADER SNIPPET (recommended) — an inline stub queues early calls, then loads this bundle:
+ *       <script>
+ *         !function(w,d){w.ScaleBun=w.ScaleBun||{q:[]};
+ *           ['init','track','identify','trackPurchase','setConsent','reset','register','group','alias']
+ *             .forEach(function(m){w.ScaleBun[m]=w.ScaleBun[m]||function(){w.ScaleBun.q.push([m,arguments]);};});
+ *           var s=d.createElement('script');s.async=true;
+ *           s.src='https://cdn.jsdelivr.net/npm/@scalebun/web@1/dist/scalebun.min.js';
+ *           d.head.appendChild(s);}(window,document);
+ *         ScaleBun.init({clientKey:'…'});
+ *       </script>
+ *     On load we replace the stub, replay `ScaleBun.q` in order — no race, no lost calls.
+ *
+ *  2. DECLARATIVE TAG (CSP-clean, zero inline JS) — config via data-* on the tag itself:
+ *       <script async src="…/scalebun.min.js" data-client-key="…"></script>
+ *     We read the loading script's dataset and auto-init.
+ */
+import { ScaleBun } from './public/ScaleBunFacade.js';
+import { setNonce } from './core/index.js';
+/**
+ * Install the real facade as `window.ScaleBun`: (1) drain any queued calls the loader stub captured
+ * before this bundle loaded, then (2) auto-init from the loading `<script>`'s data-* attributes.
+ * Exported for unit tests; the module runs it once on load below.
+ */
+export function installBrowserGlobal(win, currentScript) {
+    const existing = win.ScaleBun;
+    win.ScaleBun = ScaleBun;
+    // (1) Replay the pre-load queue in order — generic over any facade method.
+    let queuedInit = false;
+    if (existing && Array.isArray(existing.q)) {
+        for (const entry of existing.q) {
+            const [method, args] = entry;
+            if (method === 'init')
+                queuedInit = true;
+            const fn = ScaleBun[method];
+            if (typeof fn === 'function') {
+                // `args` is array-LIKE: a real array (GTM createQueue pushes `['init', [cfg]]`) or an
+                // `arguments` object (the inline snippet pushes `[m, arguments]`). Normalize both.
+                const argv = args ? Array.prototype.slice.call(args) : [];
+                try {
+                    fn.apply(ScaleBun, argv);
+                }
+                catch {
+                    /* one bad queued call must never break the rest of the drain */
+                }
+            }
+        }
+    }
+    // (2) Declarative auto-init (skipped if init already came through the queue). Only clientKey is
+    // required. `data-api-base-url` is forwarded VERBATIM — the lock lives in resolveConfig, the one
+    // enforcement point: a remote value is discarded there in favour of the cloud endpoint, while a
+    // loopback value is honoured for local development. Duplicating the lock here would just hide
+    // the loopback path from script-tag installs without adding any protection.
+    const ds = currentScript?.dataset;
+    if (!queuedInit && ds?.clientKey) {
+        const cfg = { clientKey: ds.clientKey };
+        if (ds.apiBaseUrl)
+            cfg.apiBaseUrl = ds.apiBaseUrl;
+        if (ds.environment)
+            cfg.environment = ds.environment;
+        if (ds.autocapture != null)
+            cfg.autocapture = ds.autocapture !== 'false';
+        void ScaleBun.init(cfg);
+    }
+}
+if (typeof window !== 'undefined') {
+    const currentScript = typeof document !== 'undefined' ? document.currentScript : null;
+    // CSP: auto-detect the nonce from the SDK's own <script> tag (script-tag install). An explicit
+    // init({ csp: { nonce } }) still wins — it runs setNonce() afterwards and only overrides when set.
+    setNonce(currentScript?.nonce);
+    installBrowserGlobal(window, currentScript);
+}
+export { ScaleBun as default, ScaleBun };
+//# sourceMappingURL=browser.js.map

package/dist/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAelC;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAkD,EAClD,aAAgD;IAEhD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAoC,CAAC;IAC1D,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAExB,2EAA2E;IAC3E,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;YAC7B,IAAI,MAAM,KAAK,MAAM;gBAAE,UAAU,GAAG,IAAI,CAAC;YACzC,MAAM,EAAE,GAAI,QAA+C,CAAC,MAAM,CAAC,CAAC;YACpE,IAAI,OAAO,EAAE,KAAK,UAAU,EAAE,CAAC;gBAC7B,sFAAsF;gBACtF,mFAAmF;gBACnF,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,IAAI,CAAC;oBACF,EAAmC,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC7D,CAAC;gBAAC,MAAM,CAAC;oBACP,gEAAgE;gBAClE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,gGAAgG;IAChG,iGAAiG;IACjG,gGAAgG;IAChG,8FAA8F;IAC9F,4EAA4E;IAC5E,MAAM,EAAE,GAAG,aAAa,EAAE,OAAO,CAAC;IAClC,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAe,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC;QACpD,IAAI,EAAE,CAAC,UAAU;YAAE,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC;QAClD,IAAI,EAAE,CAAC,WAAW;YAAE,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC,WAAW,CAAC;QACrD,IAAI,EAAE,CAAC,WAAW,IAAI,IAAI;YAAE,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC,WAAW,KAAK,OAAO,CAAC;QACzE,KAAK,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;IAClC,MAAM,aAAa,GAAG,OAAO,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;IACtF,+FAA+F;IAC/F,mGAAmG;IACnG,QAAQ,CAAE,aAA2C,EAAE,KAAK,CAAC,CAAC;IAC9D,oBAAoB,CAClB,MAAkE,EAClE,aAAkD,CACnD,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,QAAQ,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC"}

package/dist/config/endpoints.d.ts

@@ -0,0 +1,12 @@
+/**
+ * ScaleBun cloud API base URL.
+ *
+ * Default for `apiBaseUrl` when a consumer does not supply one, so the common
+ * "just give me a client key" integration works without knowing the server
+ * address. Includes the `/api/v1` path segment because every SDK endpoint is
+ * built relative to this base (e.g. `${apiBaseUrl}/ingestion/sessions`,
+ * `${apiBaseUrl}/batch`). Override `apiBaseUrl` in init config to point at a
+ * staging environment or a self-hosted backend.
+ */
+export declare const DEFAULT_API_BASE_URL = "https://api.scalebun.com/api/v1";
+//# sourceMappingURL=endpoints.d.ts.map

package/dist/config/endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.d.ts","sourceRoot":"","sources":["../../src/config/endpoints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,oCAAoC,CAAC"}

package/dist/config/endpoints.js

@@ -0,0 +1,12 @@
+/**
+ * ScaleBun cloud API base URL.
+ *
+ * Default for `apiBaseUrl` when a consumer does not supply one, so the common
+ * "just give me a client key" integration works without knowing the server
+ * address. Includes the `/api/v1` path segment because every SDK endpoint is
+ * built relative to this base (e.g. `${apiBaseUrl}/ingestion/sessions`,
+ * `${apiBaseUrl}/batch`). Override `apiBaseUrl` in init config to point at a
+ * staging environment or a self-hosted backend.
+ */
+export const DEFAULT_API_BASE_URL = 'https://api.scalebun.com/api/v1';
+//# sourceMappingURL=endpoints.js.map

package/dist/config/endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.js","sourceRoot":"","sources":["../../src/config/endpoints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,iCAAiC,CAAC"}

package/dist/config/schema.d.ts

@@ -0,0 +1,120 @@
+/**
+ * config/schema — runtime config validation + defaults (mirrors RN core/config/schema).
+ * Public input types live in @scalebun/sdk-contracts; this produces the resolved internal config.
+ */
+import type { ScaleBunInitConfig } from '@scalebun/sdk-contracts';
+export interface ResolvedConfig {
+    clientKey: string;
+    apiBaseUrl: string;
+    environment?: string;
+    release?: string;
+    appVersion?: string;
+    flushIntervalMs: number;
+    /** Inactivity after which the next page load starts a NEW session. Default 30 min. */
+    sessionTimeoutMs?: number;
+    /** Absolute cap on a single session, so a permanently-open tab cannot report one endless
+     *  session. Default 24 h. */
+    sessionMaxDurationMs?: number;
+    maxBatchSize: number;
+    maxQueueSize: number;
+    /** Raw replay sampling config — defaults/clamping are applied lazily in `decideSampling` (keeps
+     *  the resolution logic out of the core bundle; undefined = the 'sampled' @ rate-1 default). */
+    replay: ScaleBunInitConfig['replay'];
+    /** Opt-in: capture <canvas> pixels in replay (off by default — pixels can't be masked). */
+    replayCanvas: boolean;
+    /**
+     * Upload a DOM frame’s payload straight to object storage instead of inline in the batch.
+     *
+     * OFF BY DEFAULT, and it stays off until a deployment has the backend half: the presign
+     * endpoint must sign DOM keys and the ingest path must accept a client-supplied
+     * `domStorageKey`. Against an older backend the presign simply reports storage disabled and
+     * every frame goes inline, so the flag is safe to enable early — it just does nothing.
+     *
+     * Measured motivation: 154,235 of 163,644 frames stored in a 32h window are web DOM payloads
+     * that the SERVER uploaded on the request path, at 25-70ms per round trip.
+     */
+    replayDirectUpload: boolean;
+    /** W1a — HMAC-sign the session/replay batches too (analytics lane always signs). Off by default:
+     *  signing the (often multi-MB) replay uploads re-enables server-side rawBody double-buffering. */
+    signSessionLane: boolean;
+    /** Origin allowlist for cross-origin replay stitching (F-IFR P2). Default []. */
+    replayFrameOrigins: string[];
+    /** Error capture options — passthrough from cfg.errors; defaults resolved in ErrorsFeature. */
+    errors: ScaleBunInitConfig['errors'];
+    /** Network capture options — passthrough from cfg.network; defaults resolved in NetworkFeature. */
+    network: ScaleBunInitConfig['network'];
+    /** Performance/RUM options — passthrough from cfg.performance; defaults resolved in PerformanceFeature. */
+    performance: ScaleBunInitConfig['performance'];
+    /** Product-analytics options (tracking plan) — passthrough; read by AnalyticsFeature. */
+    analytics: ScaleBunInitConfig['analytics'];
+    /** F3 — flags/config options (bootstrap seed) — passthrough; read by ConfigFeature. */
+    flags: ScaleBunInitConfig['flags'];
+    /** Autocapture DOM interactions as analytics events (on by default; text is masked). */
+    autocapture: boolean;
+    /** Inject a W3C traceparent into outbound requests (FE→BE correlation). Default on (same-origin). */
+    tracePropagation: boolean;
+    /** Extra cross-origin origins to propagate the traceparent to (must CORS-allow it). Default []. */
+    tracePropagationOrigins: string[];
+    debug: boolean;
+    features: {
+        errors: boolean;
+        network: boolean;
+        console: boolean;
+        webVitals: boolean;
+        performance: boolean;
+        journey: boolean;
+        replay: boolean;
+        bugReport: boolean;
+        crash: boolean;
+        config: boolean;
+        engage: boolean;
+        analytics: boolean;
+        webPerf: boolean;
+        profiler: boolean;
+        watchdog: boolean;
+        inbox: boolean;
+        inapp2: boolean;
+    };
+    /** W5.2 — Resource Watchdog options passthrough (defaults resolved in WatchdogFeature). */
+    watchdog: ScaleBunInitConfig['watchdog'];
+    /** #25 P2 — exit-intent thresholds passthrough; defaults resolved in the engine (REVERSAL_DEFAULTS).
+     *  Host-tunable so a site can retune from its own data without waiting for an SDK release. */
+    exitIntent: ScaleBunInitConfig['exitIntent'];
+    privacy: {
+        captureNetworkBodies: boolean;
+        denylist: string[];
+        maskSelectors: string[];
+        /** Mask all STATIC replay text. Default FALSE — text is captured so replays are readable. Set
+         *  true to mask every text node. Form input values have their own flag (maskInputs). */
+        maskReplayText: boolean;
+        /** Mask form input VALUES in replay. Default TRUE, INDEPENDENT of maskReplayText (typed input is
+         *  the real PII, so it stays masked even when static text is shown). Passwords always blanked. */
+        maskInputs: boolean;
+        /** Honor GPC / Do-Not-Track by not recording replay for opted-out users. Default false. */
+        respectDnt: boolean;
+        /** Mask the text LABEL on interaction events (USER_ACTION.label + $autocapture props.text).
+         *  Default FALSE — the real label is sent, so clicks group per element instead of collapsing
+         *  into one row. Was unconditional masking before. */
+        maskEventText: boolean;
+    };
+    consent: {
+        /** When true, capture + egress are deferred until consent is granted. */
+        required: boolean;
+        /** Initial consent state (host may pre-resolve via SSR/cookie). */
+        initial: 'granted' | 'denied' | 'unknown';
+    };
+    bugReport: {
+        /** Mount the floating launcher widget. */
+        launcher: boolean;
+        position: 'bottom-right' | 'bottom-left' | 'top-right' | 'top-left';
+        label: string;
+    };
+    /**
+     * Host resolver for the 8 gamified in-app formats. Passed through verbatim and NEVER given a
+     * default — a default here would be the SDK choosing a prize, which is the one thing it must not
+     * do. Absent → those formats render their unavailable state.
+     */
+    onInAppGameRequest?: (request: unknown) => Promise<unknown>;
+}
+export declare function resolveConfig(cfg: ScaleBunInitConfig): ResolvedConfig;
+//# sourceMappingURL=schema.d.ts.map

package/dist/config/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAGlE,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,sFAAsF;IACtF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;iCAC6B;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB;oGACgG;IAChG,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACrC,2FAA2F;IAC3F,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;OAUG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B;uGACmG;IACnG,eAAe,EAAE,OAAO,CAAC;IACzB,iFAAiF;IACjF,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,+FAA+F;IAC/F,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACrC,mGAAmG;IACnG,OAAO,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACvC,2GAA2G;IAC3G,WAAW,EAAE,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAC/C,yFAAyF;IACzF,SAAS,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAC3C,uFAAuF;IACvF,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACnC,wFAAwF;IACxF,WAAW,EAAE,OAAO,CAAC;IACrB,qGAAqG;IACrG,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mGAAmG;IACnG,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE;QACR,MAAM,EAAE,OAAO,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC;QACjB,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,OAAO,CAAC;QACnB,WAAW,EAAE,OAAO,CAAC;QACrB,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,OAAO,CAAC;QAChB,SAAS,EAAE,OAAO,CAAC;QACnB,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,EAAE,OAAO,CAAC;QAChB,MAAM,EAAE,OAAO,CAAC;QAChB,SAAS,EAAE,OAAO,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,OAAO,CAAC;QAClB,QAAQ,EAAE,OAAO,CAAC;QAClB,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;IACF,2FAA2F;IAC3F,QAAQ,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACzC;kGAC8F;IAC9F,UAAU,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC7C,OAAO,EAAE;QACP,oBAAoB,EAAE,OAAO,CAAC;QAC9B,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB;gGACwF;QACxF,cAAc,EAAE,OAAO,CAAC;QACxB;0GACkG;QAClG,UAAU,EAAE,OAAO,CAAC;QACpB,2FAA2F;QAC3F,UAAU,EAAE,OAAO,CAAC;QACpB;;8DAEsD;QACtD,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IACF,OAAO,EAAE;QACP,yEAAyE;QACzE,QAAQ,EAAE,OAAO,CAAC;QAClB,mEAAmE;QACnE,OAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;KAC3C,CAAC;IACF,SAAS,EAAE;QACT,0CAA0C;QAC1C,QAAQ,EAAE,OAAO,CAAC;QAClB,QAAQ,EAAE,cAAc,GAAG,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;QACpE,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7D;AAcD,wBAAgB,aAAa,CAAC,GAAG,EAAE,kBAAkB,GAAG,cAAc,CAmGrE"}

package/dist/config/schema.js

@@ -0,0 +1,117 @@
+/**
+ * config/schema — runtime config validation + defaults (mirrors RN core/config/schema).
+ * Public input types live in @scalebun/sdk-contracts; this produces the resolved internal config.
+ */
+import { DEFAULT_API_BASE_URL } from './endpoints.js';
+// Header/body keys stripped before send, by default — denylist-by-default privacy.
+const DEFAULT_DENYLIST = [
+    'authorization',
+    'cookie',
+    'set-cookie',
+    'x-api-key',
+    'x-csrf-token',
+    'password',
+    'token',
+    'secret',
+];
+export function resolveConfig(cfg) {
+    if (!cfg || !cfg.clientKey)
+        throw new Error('[scalebun] clientKey is required');
+    // apiBaseUrl is LOCKED to the ScaleBun cloud endpoint — a REMOTE value passed in
+    // `cfg.apiBaseUrl` is deliberately ignored so integrators cannot repoint the SDK.
+    // The single exception is LOOPBACK (localhost / 127.0.0.1; IPv6 [::1] deliberately
+    // omitted — the core size gate is byte-tight and no test or dev flow uses it):
+    // local mock servers are how the SDK's own integration tests and local development
+    // drive the full egress path, and a loopback target cannot repoint anyone's
+    // production data anywhere. To target a different real backend, change
+    // DEFAULT_API_BASE_URL at build time (keep it slash-free: it is used verbatim; a
+    // supplied loopback URL gets its trailing slash trimmed).
+    const supplied = cfg.apiBaseUrl?.replace(/\/$/, '');
+    const apiBaseUrl = supplied && /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?([/?#]|$)/.test(supplied)
+        ? supplied
+        : DEFAULT_API_BASE_URL;
+    return {
+        clientKey: cfg.clientKey,
+        apiBaseUrl,
+        environment: cfg.environment,
+        release: cfg.release,
+        appVersion: cfg.appVersion,
+        flushIntervalMs: cfg.flushIntervalMs ?? 5000,
+        sessionTimeoutMs: cfg.sessionTimeoutMs,
+        sessionMaxDurationMs: cfg.sessionMaxDurationMs,
+        replay: cfg.replay, // passthrough — resolved lazily in decideSampling
+        errors: cfg.errors, // passthrough — defaults resolved in ErrorsFeature
+        network: cfg.network, // passthrough — defaults resolved in NetworkFeature
+        performance: cfg.performance, // passthrough — defaults resolved in PerformanceFeature
+        analytics: cfg.analytics, // passthrough — tracking plan read in AnalyticsFeature
+        flags: cfg.flags, // passthrough — bootstrap seed read in ConfigFeature (F3)
+        replayCanvas: cfg.replayCanvas ?? false,
+        replayDirectUpload: cfg.replayDirectUpload ?? false,
+        signSessionLane: cfg.signSessionLane ?? false,
+        replayFrameOrigins: cfg.replayFrameOrigins ?? [],
+        autocapture: cfg.autocapture ?? true,
+        tracePropagation: cfg.tracePropagation ?? true,
+        tracePropagationOrigins: cfg.tracePropagationOrigins ?? [],
+        maxBatchSize: cfg.maxBatchSize ?? 50,
+        maxQueueSize: cfg.maxQueueSize ?? 1000,
+        debug: cfg.debug ?? false,
+        features: {
+            errors: cfg.features?.errors ?? true,
+            network: cfg.features?.network ?? true,
+            console: cfg.features?.console ?? true,
+            webVitals: cfg.features?.webVitals ?? true,
+            performance: cfg.features?.performance ?? true,
+            journey: cfg.features?.journey ?? true,
+            replay: cfg.features?.replay ?? false, // lazy/opt-in until capture-on-signal lands
+            bugReport: cfg.features?.bugReport ?? true,
+            crash: cfg.features?.crash ?? true,
+            config: cfg.features?.config ?? true,
+            engage: cfg.features?.engage ?? true,
+            analytics: cfg.features?.analytics ?? true,
+            webPerf: cfg.features?.webPerf ?? true,
+            profiler: cfg.features?.profiler ?? false, // opt-in (CPU cost + needs Document-Policy header)
+            watchdog: cfg.features?.watchdog ?? false, // W5.2 — opt-in until dogfooded (see WAVE5-DESIGN §18)
+            inbox: cfg.features?.inbox ?? false, // opt-in until GA (see INBOX-COACHMARKS-ARCHITECTURE.md)
+            inapp2: cfg.features?.inapp2 ?? false, // IAM 2.0 engine — opt-in until GA
+        },
+        watchdog: cfg.watchdog, // passthrough — defaults resolved in WatchdogFeature
+        exitIntent: cfg.exitIntent, // passthrough — defaults resolved in the exit-intent engine
+        privacy: {
+            captureNetworkBodies: cfg.privacy?.captureNetworkBodies ?? false,
+            denylist: [...DEFAULT_DENYLIST, ...(cfg.privacy?.denylist ?? [])].map((s) => s.toLowerCase()),
+            maskSelectors: cfg.privacy?.maskSelectors ?? [],
+            // STATIC text is SHOWN by default (maskReplayText: false) so replays are readable — matching
+            // the documented contract. Set true to mask every text node for a fully-redacted recording.
+            maskReplayText: cfg.privacy?.maskReplayText ?? false,
+            // Form INPUT values are masked by default and INDEPENDENTLY of maskReplayText: user-typed data
+            // is the real PII exposure, so it stays masked even when static text is shown. Set maskInputs
+            // false to capture raw input (dev/internal apps only). Passwords are ALWAYS blanked regardless.
+            maskInputs: cfg.privacy?.maskInputs ?? true,
+            respectDnt: cfg.privacy?.respectDnt ?? false,
+            // Deliberately does NOT follow maskReplayText the way maskInputs does. Replay text and an event
+            // label are different exposures: replay is a recording someone opens deliberately, whereas the
+            // label is an aggregate dimension shown on every dashboard. Coupling them would mean turning on
+            // replay masking silently also collapsed the Events explorer back to one row per element shape.
+            maskEventText: cfg.privacy?.maskEventText ?? false,
+        },
+        consent: {
+            // Consent mode is OPT-IN (requireConsent: true), not the default. A required-by-default
+            // gate silently stops ALL capture (sessions, replay, analytics) for every existing
+            // integrator the moment they upgrade, until they discover setConsent(true) — dashboards go
+            // dark with no error anywhere. The "default activates immediately — no regression" test
+            // pins this contract. PII protection lives in masking (maskInputs defaults true, so typed
+            // input is masked; static text stays readable), which protects PII without turning capture off.
+            required: cfg.requireConsent ?? false,
+            initial: cfg.initialConsent ?? 'unknown',
+        },
+        bugReport: {
+            launcher: cfg.bugReportOptions?.launcher ?? false,
+            position: cfg.bugReportOptions?.position ?? 'bottom-right',
+            label: cfg.bugReportOptions?.label ?? 'Report a bug',
+        },
+        ...(cfg.engageOptions?.onInAppGameRequest
+            ? { onInAppGameRequest: cfg.engageOptions.onInAppGameRequest }
+            : {}),
+    };
+}
+//# sourceMappingURL=schema.js.map

package/dist/config/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAoHnD,mFAAmF;AACnF,MAAM,gBAAgB,GAAG;IACvB,eAAe;IACf,QAAQ;IACR,YAAY;IACZ,WAAW;IACX,cAAc;IACd,UAAU;IACV,OAAO;IACP,QAAQ;CACT,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,GAAuB;IACnD,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAChF,iFAAiF;IACjF,kFAAkF;IAClF,mFAAmF;IACnF,+EAA+E;IAC/E,mFAAmF;IACnF,4EAA4E;IAC5E,uEAAuE;IACvE,iFAAiF;IACjF,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,UAAU,GACd,QAAQ,IAAI,sDAAsD,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC/E,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,oBAAoB,CAAC;IAC3B,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,UAAU;QACV,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI;QAC5C,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;QAC9C,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,kDAAkD;QACtE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,mDAAmD;QACvE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,oDAAoD;QAC1E,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,wDAAwD;QACtF,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,uDAAuD;QACjF,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,0DAA0D;QAC5E,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,KAAK;QACvC,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,IAAI,KAAK;QACnD,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,KAAK;QAC7C,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,IAAI,EAAE;QAChD,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACpC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,IAAI,IAAI;QAC9C,uBAAuB,EAAE,GAAG,CAAC,uBAAuB,IAAI,EAAE;QAC1D,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,EAAE;QACpC,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;QACtC,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,KAAK;QACzB,QAAQ,EAAE;YACR,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,IAAI;YACpC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,IAAI;YACtC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,IAAI;YACtC,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,IAAI,IAAI;YAC1C,WAAW,EAAE,GAAG,CAAC,QAAQ,EAAE,WAAW,IAAI,IAAI;YAC9C,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,IAAI;YACtC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,KAAK,EAAE,4CAA4C;YACnF,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,IAAI,IAAI;YAC1C,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,IAAI;YAClC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,IAAI;YACpC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,IAAI;YACpC,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,IAAI,IAAI;YAC1C,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,IAAI;YACtC,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,KAAK,EAAE,mDAAmD;YAC9F,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,KAAK,EAAE,uDAAuD;YAClG,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,KAAK,EAAE,yDAAyD;YAC9F,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,KAAK,EAAE,mCAAmC;SAC3E;QACD,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,qDAAqD;QAC7E,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,4DAA4D;QACxF,OAAO,EAAE;YACP,oBAAoB,EAAE,GAAG,CAAC,OAAO,EAAE,oBAAoB,IAAI,KAAK;YAChE,QAAQ,EAAE,CAAC,GAAG,gBAAgB,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7F,aAAa,EAAE,GAAG,CAAC,OAAO,EAAE,aAAa,IAAI,EAAE;YAC/C,6FAA6F;YAC7F,4FAA4F;YAC5F,cAAc,EAAE,GAAG,CAAC,OAAO,EAAE,cAAc,IAAI,KAAK;YACpD,+FAA+F;YAC/F,8FAA8F;YAC9F,gGAAgG;YAChG,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI;YAC3C,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,UAAU,IAAI,KAAK;YAC5C,gGAAgG;YAChG,+FAA+F;YAC/F,gGAAgG;YAChG,gGAAgG;YAChG,aAAa,EAAE,GAAG,CAAC,OAAO,EAAE,aAAa,IAAI,KAAK;SACnD;QACD,OAAO,EAAE;YACP,wFAAwF;YACxF,mFAAmF;YACnF,2FAA2F;YAC3F,wFAAwF;YACxF,0FAA0F;YAC1F,gGAAgG;YAChG,QAAQ,EAAE,GAAG,CAAC,cAAc,IAAI,KAAK;YACrC,OAAO,EAAE,GAAG,CAAC,cAAc,IAAI,SAAS;SACzC;QACD,SAAS,EAAE;YACT,QAAQ,EAAE,GAAG,CAAC,gBAAgB,EAAE,QAAQ,IAAI,KAAK;YACjD,QAAQ,EAAE,GAAG,CAAC,gBAAgB,EAAE,QAAQ,IAAI,cAAc;YAC1D,KAAK,EAAE,GAAG,CAAC,gBAAgB,EAAE,KAAK,IAAI,cAAc;SACrD;QACD,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,kBAAkB;YACvC,CAAC,CAAC,EAAE,kBAAkB,EAAE,GAAG,CAAC,aAAa,CAAC,kBAAkB,EAAE;YAC9D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC"}

package/dist/core/breadcrumbs.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Breadcrumbs (M3) — the trail of what happened BEFORE an error, the single most useful context for
+ * "why did this break". Best-in-class design choices:
+ *
+ *  - **Auto-captured at the ONE emit boundary** (the bootstrap routes every pipeline item through
+ *    `recordBreadcrumb`), so console / network / navigation / clicks / custom events / prior errors
+ *    all become crumbs automatically, in true chronological order, with ZERO per-feature wiring.
+ *  - **Pre-redacted** — messages are scrubbed and network URLs lose their query string at capture, so
+ *    PII never sits in the ring.
+ *  - **Consecutive-dedup** — a burst of identical crumbs (e.g. a render-loop console.error) collapses
+ *    to one with a `count`, keeping the trail readable and the ring useful.
+ *  - **Bounded + configurable** — a fixed-size ring (default 50) snapshotted onto each error.
+ *  - **Manual API** — `ScaleBun.addBreadcrumb(...)` for app-level milestones.
+ *
+ * Frame/performance items are intentionally NOT crumbs (too frequent; the mapper early-returns).
+ */
+import type { Item } from '@scalebun/protocol';
+export type BreadcrumbLevel = 'debug' | 'info' | 'warning' | 'error';
+export interface Breadcrumb {
+    /** epoch ms */
+    ts: number;
+    /** coarse source: 'console' | 'navigation' | 'network' | 'ui.click' | 'error' | 'custom' */
+    category: string;
+    /** finer type, e.g. 'http' | 'event' */
+    type?: string;
+    level?: BreadcrumbLevel;
+    message?: string;
+    data?: Record<string, unknown>;
+    /** consecutive identical crumbs collapsed into one */
+    count?: number;
+}
+/** Map a pipeline Item → a compact, redacted Breadcrumb (or null for kinds that aren't crumbs). */
+export declare function crumbFromItem(item: Item): Breadcrumb | null;
+/** A bounded ring of crumbs with consecutive-dedup. One instance per page (module singleton). */
+declare class BreadcrumbBuffer {
+    private ring;
+    private max;
+    setMax(n: number): void;
+    add(c: Breadcrumb): void;
+    /** Chronological copy for attaching to an error (oldest → newest). */
+    snapshot(): Breadcrumb[];
+    clear(): void;
+    private trim;
+}
+/** The process-wide breadcrumb ring (single SDK instance per page). */
+export declare const breadcrumbs: BreadcrumbBuffer;
+export declare function setBeforeBreadcrumb(fn?: (c: Breadcrumb) => Breadcrumb | null): void;
+/** Add a pre-formed crumb (manual API path fills `ts`/defaults before calling this). The host's
+ *  message is scrubbed + clipped here so app-supplied crumbs are as PII-safe as the auto ones. */
+export declare function addBreadcrumb(c: Breadcrumb): void;
+/** Derive + record a crumb from a pipeline item (called at the emit boundary). Cheap no-op for
+ *  non-crumb kinds (frame/performance) so it's safe on the hot replay path. */
+export declare function recordBreadcrumb(item: Item): void;
+export declare function clearBreadcrumbs(): void;
+export {};
+//# sourceMappingURL=breadcrumbs.d.ts.map

package/dist/core/breadcrumbs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"breadcrumbs.d.ts","sourceRoot":"","sources":["../../src/core/breadcrumbs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAG/C,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;AAErE,MAAM,WAAW,UAAU;IACzB,eAAe;IACf,EAAE,EAAE,MAAM,CAAC;IACX,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA4BD,mGAAmG;AACnG,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,UAAU,GAAG,IAAI,CA0B3D;AAkBD,iGAAiG;AACjG,cAAM,gBAAgB;IACpB,OAAO,CAAC,IAAI,CAAoB;IAChC,OAAO,CAAC,GAAG,CAAe;IAE1B,MAAM,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI;IAKvB,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,IAAI;IAWxB,sEAAsE;IACtE,QAAQ,IAAI,UAAU,EAAE;IAIxB,KAAK,IAAI,IAAI;IAIb,OAAO,CAAC,IAAI;CAGb;AAED,uEAAuE;AACvE,eAAO,MAAM,WAAW,kBAAyB,CAAC;AAIlD,wBAAgB,mBAAmB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,UAAU,GAAG,IAAI,GAAG,IAAI,CAEnF;AAWD;kGACkG;AAClG,wBAAgB,aAAa,CAAC,CAAC,EAAE,UAAU,GAAG,IAAI,CAIjD;AAED;+EAC+E;AAC/E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAKjD;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC"}

package/dist/core/breadcrumbs.js

@@ -0,0 +1,141 @@
+import { scrubText } from './redact.js';
+const DEFAULT_MAX = 50;
+const HARD_MAX = 200;
+const MSG_CAP = 256;
+function clip(s) {
+    return s.length > MSG_CAP ? s.slice(0, MSG_CAP) : s;
+}
+function stripQuery(url) {
+    return url.replace(/[?#].*$/, '');
+}
+function levelFor(l) {
+    return l === 'warn' ? 'warning' : l === 'debug' || l === 'info' || l === 'error' ? l : 'info';
+}
+/** Drop undefined values so crumb `data` stays compact on the wire. */
+function prune(d) {
+    const out = {};
+    let any = false;
+    for (const k in d) {
+        if (d[k] !== undefined && d[k] !== null) {
+            out[k] = d[k];
+            any = true;
+        }
+    }
+    return any ? out : undefined;
+}
+/** Map a pipeline Item → a compact, redacted Breadcrumb (or null for kinds that aren't crumbs). */
+export function crumbFromItem(item) {
+    // Hot path: frame (replay) + performance (RUM) items stream at high frequency and are never
+    // crumbs — bail before any allocation so the emit boundary stays cheap.
+    if (item.kind === 'frame' || item.kind === 'performance')
+        return null;
+    const ts = typeof item.timestamp === 'number' ? item.timestamp : Date.now();
+    switch (item.kind) {
+        case 'log':
+            return { ts, category: 'console', level: levelFor(item.level), message: clip(scrubText(item.message)) };
+        case 'network': {
+            const status = item.status;
+            return {
+                ts,
+                category: 'network',
+                type: 'http',
+                level: typeof status === 'number' && status >= 400 ? 'error' : 'info',
+                message: clip(scrubText(`${item.method} ${stripQuery(item.url)}`)),
+                data: prune({ status, duration: item.duration }),
+            };
+        }
+        case 'event':
+            return eventCrumb(item.name, (item.props ?? {}), ts);
+        case 'error':
+            return { ts, category: 'error', type: item.type, level: 'error', message: clip(scrubText(item.message)) };
+        default:
+            return null; // frame / performance / rating / identify are not breadcrumbs
+    }
+}
+function eventCrumb(name, p, ts) {
+    if (name === 'SCREEN_VIEW') {
+        return { ts, category: 'navigation', message: `${p.from ?? '?'} → ${p.to ?? '?'}` };
+    }
+    if (name === 'USER_ACTION') {
+        const action = typeof p.action === 'string' ? p.action : 'action';
+        return {
+            ts,
+            category: `ui.${action}`,
+            message: clip(scrubText(String(p.selector ?? p.label ?? action))),
+            data: prune({ dead: p.dead, rage: p.rage }),
+        };
+    }
+    return { ts, category: 'custom', type: 'event', message: clip(scrubText(name)) };
+}
+/** A bounded ring of crumbs with consecutive-dedup. One instance per page (module singleton). */
+class BreadcrumbBuffer {
+    constructor() {
+        this.ring = [];
+        this.max = DEFAULT_MAX;
+    }
+    setMax(n) {
+        this.max = Math.max(1, Math.min(HARD_MAX, Math.floor(n)));
+        this.trim();
+    }
+    add(c) {
+        const last = this.ring[this.ring.length - 1];
+        if (last && last.category === c.category && last.message === c.message && last.level === c.level) {
+            last.count = (last.count ?? 1) + 1; // collapse a burst of identical crumbs
+            last.ts = c.ts;
+            return;
+        }
+        this.ring.push(c);
+        this.trim();
+    }
+    /** Chronological copy for attaching to an error (oldest → newest). */
+    snapshot() {
+        return this.ring.slice();
+    }
+    clear() {
+        this.ring = [];
+    }
+    trim() {
+        while (this.ring.length > this.max)
+            this.ring.shift();
+    }
+}
+/** The process-wide breadcrumb ring (single SDK instance per page). */
+export const breadcrumbs = new BreadcrumbBuffer();
+/** Host hook: inspect/modify a crumb before it enters the ring, or return null to drop it. */
+let beforeCrumb;
+export function setBeforeBreadcrumb(fn) {
+    beforeCrumb = fn;
+}
+/** Run the host hook (sandboxed). Returns the (possibly modified) crumb, or null to drop. */
+function applyHook(c) {
+    if (!beforeCrumb)
+        return c;
+    try {
+        return beforeCrumb(c);
+    }
+    catch {
+        return c; // a throwing hook must not lose the crumb
+    }
+}
+/** Add a pre-formed crumb (manual API path fills `ts`/defaults before calling this). The host's
+ *  message is scrubbed + clipped here so app-supplied crumbs are as PII-safe as the auto ones. */
+export function addBreadcrumb(c) {
+    const scrubbed = c.message ? { ...c, message: clip(scrubText(c.message)) } : c;
+    const final = applyHook(scrubbed);
+    if (final)
+        breadcrumbs.add(final);
+}
+/** Derive + record a crumb from a pipeline item (called at the emit boundary). Cheap no-op for
+ *  non-crumb kinds (frame/performance) so it's safe on the hot replay path. */
+export function recordBreadcrumb(item) {
+    const c = crumbFromItem(item);
+    if (!c)
+        return;
+    const final = applyHook(c);
+    if (final)
+        breadcrumbs.add(final);
+}
+export function clearBreadcrumbs() {
+    breadcrumbs.clear();
+}
+//# sourceMappingURL=breadcrumbs.js.map