@scalebun-release/web 2.2.2

package/dist/core/pageContext.js

@@ -0,0 +1,90 @@
+/**
+ * Builds the envelope header blocks (client/device/app/context) from the browser environment.
+ * Pure reads of navigator/location/Intl — all best-effort and SSR-safe.
+ */
+import { PKG_VERSION } from './version.generated.js';
+export const SDK_NAME = '@scalebun/web';
+export const SDK_VERSION = typeof __SCALEBUN_VERSION__ !== 'undefined' ? __SCALEBUN_VERSION__ : PKG_VERSION;
+export function buildClient() {
+    return { platform: 'web', renderer: 'dom', sdk: { name: SDK_NAME, version: SDK_VERSION } };
+}
+export function buildDevice(deviceId) {
+    const ua = typeof navigator !== 'undefined' ? navigator.userAgent : '';
+    const { browser, os } = parseUserAgent(ua);
+    return {
+        id: deviceId,
+        browser: browser.name,
+        browserVersion: browser.version,
+        os: os.name,
+        osVersion: os.version,
+    };
+}
+export function buildApp(config) {
+    return { version: config.appVersion, environment: config.environment, release: config.release };
+}
+export function buildContext() {
+    const ctx = {};
+    try {
+        if (typeof navigator !== 'undefined')
+            ctx.locale = navigator.language;
+        ctx.timezone = Intl.DateTimeFormat().resolvedOptions().timeZone;
+        if (typeof location !== 'undefined')
+            ctx.url = location.href;
+        if (typeof window !== 'undefined')
+            ctx.viewport = { width: window.innerWidth, height: window.innerHeight };
+        const conn = navigator?.connection;
+        if (conn?.effectiveType)
+            ctx.networkType = conn.effectiveType;
+    }
+    catch {
+        /* best-effort */
+    }
+    return ctx;
+}
+/** Allocation-light UA parse — good enough for a "Chrome on macOS"-style label. */
+function parseUserAgent(ua) {
+    const browser = {};
+    const os = {};
+    /**
+     * Chromium FORKS FIRST, in their own pass.
+     *
+     * Alternation only decides between branches at the SAME position — `exec` returns the leftmost
+     * match in the string. Edge and Opera both append their token AFTER Chrome's:
+     *
+     *   … Chrome/120.0.0.0 Safari/537.36 Edg/120.0.2210.91
+     *
+     * so a single `(Edg|OPR|Chrome|…)` pattern matched `Chrome/` every time and the Edg→Edge mapping
+     * below was unreachable dead code. Every Edge and Opera visitor was recorded as Chrome. Two passes
+     * is the fix: ask for a fork, fall back to the base engines.
+     *
+     * Brave still reports Chrome, and that is correct — it ships a byte-identical UA deliberately.
+     * The backend's deviceLabel and the dashboard's security page already test `Edg/` separately,
+     * which is why login sessions named Edge correctly while SDK-captured sessions did not.
+     */
+    const b = /(Edg|OPR)\/([\d.]+)/.exec(ua) ?? /(Chrome|Firefox|Safari)\/([\d.]+)/.exec(ua);
+    if (b && b[1]) {
+        browser.name = { Edg: 'Edge', OPR: 'Opera' }[b[1]] ?? b[1];
+        browser.version = b[2]?.split('.')[0];
+    }
+    if (/Windows NT ([\d.]+)/.test(ua)) {
+        os.name = 'Windows';
+        os.version = /Windows NT ([\d.]+)/.exec(ua)?.[1];
+    }
+    else if (/Mac OS X ([\d_]+)/.test(ua)) {
+        os.name = 'macOS';
+        os.version = /Mac OS X ([\d_]+)/.exec(ua)?.[1]?.replace(/_/g, '.');
+    }
+    else if (/Android ([\d.]+)/.test(ua)) {
+        os.name = 'Android';
+        os.version = /Android ([\d.]+)/.exec(ua)?.[1];
+    }
+    else if (/(iPhone|iPad).+OS ([\d_]+)/.test(ua)) {
+        os.name = 'iOS';
+        os.version = /OS ([\d_]+)/.exec(ua)?.[1]?.replace(/_/g, '.');
+    }
+    else if (/Linux/.test(ua)) {
+        os.name = 'Linux';
+    }
+    return { browser, os };
+}
+//# sourceMappingURL=pageContext.js.map

package/dist/core/pageContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pageContext.js","sourceRoot":"","sources":["../../src/core/pageContext.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAelD,MAAM,CAAC,MAAM,QAAQ,GAAG,eAAe,CAAC;AACxC,MAAM,CAAC,MAAM,WAAW,GACtB,OAAO,oBAAoB,KAAK,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC;AAEnF,MAAM,UAAU,WAAW;IACzB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,MAAM,EAAE,GAAG,OAAO,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;IAC3C,OAAO;QACL,EAAE,EAAE,QAAQ;QACZ,OAAO,EAAE,OAAO,CAAC,IAAI;QACrB,cAAc,EAAE,OAAO,CAAC,OAAO;QAC/B,EAAE,EAAE,EAAE,CAAC,IAAI;QACX,SAAS,EAAE,EAAE,CAAC,OAAO;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAsB;IAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AAClG,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,IAAI,OAAO,SAAS,KAAK,WAAW;YAAE,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC;QACtE,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC;QAChE,IAAI,OAAO,QAAQ,KAAK,WAAW;YAAE,GAAG,CAAC,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC7D,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,GAAG,CAAC,QAAQ,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QAC3G,MAAM,IAAI,GAAI,SAAoE,EAAE,UAAU,CAAC;QAC/F,IAAI,IAAI,EAAE,aAAa;YAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,SAAS,cAAc,CAAC,EAAU;IAIhC,MAAM,OAAO,GAAwC,EAAE,CAAC;IACxD,MAAM,EAAE,GAAwC,EAAE,CAAC;IAEnD;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,mCAAmC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACd,OAAO,CAAC,IAAI,GAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAA6B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACnC,EAAE,CAAC,IAAI,GAAG,SAAS,CAAC;QACpB,EAAE,CAAC,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;SAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACxC,EAAE,CAAC,IAAI,GAAG,OAAO,CAAC;QAClB,EAAE,CAAC,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;SAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACvC,EAAE,CAAC,IAAI,GAAG,SAAS,CAAC;QACpB,EAAE,CAAC,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;SAAM,IAAI,4BAA4B,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACjD,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC;QAChB,EAAE,CAAC,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5B,EAAE,CAAC,IAAI,GAAG,OAAO,CAAC;IACpB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AACzB,CAAC"}

package/dist/core/prune.d.ts

@@ -0,0 +1,31 @@
+/** The persisted-buffer budget. Exported so producers can size their own buffers against the budget
+ *  their data has to survive, instead of guessing — see `MAX_BUFFER_BYTES` in the replay recorder,
+ *  which was 3MB against this 2MB and so could never be persisted whole. */
+export declare const PERSIST_MAX_BYTES = 2000000;
+/** Keep only items younger than the max age (by getTime). Items with no timestamp are kept. */
+export declare function freshOnly<T>(items: T[], getTime: (it: T) => number | undefined, nowMs: number): T[];
+/**
+ * Trim a queue to the persisted-byte budget.
+ *
+ * Sheds the OLDEST heavy (replay-frame) items until it fits, so what survives is the most recent
+ * replay plus every light item. Light telemetry is never traded for a frame: events, perf and
+ * network entries are two orders of magnitude smaller, so dropping them to keep a keyframe is a
+ * bad exchange in both directions.
+ *
+ * WHY THIS IS NOT `filter(not heavy)`:
+ * it used to be. One byte over budget removed EVERY frame in a single pass — keyframe included —
+ * while events/perf/network sailed through. That is precisely the failure signature measured on a
+ * live app: 44 of 164 sessions arrived complete in every other lane with not one frame stored
+ * (`npm run replay:diagnose`, the `missing` state). Its keyframes average 109 kB and reach 1.17 MB,
+ * and `persistQueue()` runs on every pagehide AND every failed flush, so a single transient 500
+ * mid-session was enough to discard a whole session's replay.
+ *
+ * `isBase` marks a keyframe. A delta whose keyframe was shed reconstructs nothing, so it goes too —
+ * storing it would only convert a `missing` session into an `orphaned` one, which is no better and
+ * costs bytes to find out.
+ *
+ * Always returns a fresh array (a synchronous snapshot) so the async IDB write can't capture a
+ * reference that a concurrent flush() splices out from under it (pagehide save-vs-flush race).
+ */
+export declare function capBytes<T>(items: T[], isHeavy?: (it: T) => boolean, isBase?: (it: T) => boolean): T[];
+//# sourceMappingURL=prune.d.ts.map

package/dist/core/prune.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prune.d.ts","sourceRoot":"","sources":["../../src/core/prune.ts"],"names":[],"mappings":"AAWA;;4EAE4E;AAC5E,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAO3C,+FAA+F;AAC/F,wBAAgB,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC,EAAE,CAKnG;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,OAAO,GAAG,CAAC,EAAE,CAuDtG"}

package/dist/core/prune.js

@@ -0,0 +1,112 @@
+/**
+ * Bounds for the PERSISTED egress buffer (IndexedDB), shared by both lanes. Keeps unsent data
+ * durable without letting it grow unbounded or replay data the app sat on for days. Zero deps.
+ *
+ * - freshOnly: applied when DRAINING — drop items older than the max age so a reload doesn't replay
+ *   stale data.
+ * - capBytes: applied when SAVING — trim to a byte budget (shed heavy replay frames first, then
+ *   oldest) so a few large frames can't blow the IndexedDB quota.
+ */
+const MAX_AGE_MS = 24 * 60 * 60 * 1000; // 24h
+/** The persisted-buffer budget. Exported so producers can size their own buffers against the budget
+ *  their data has to survive, instead of guessing — see `MAX_BUFFER_BYTES` in the replay recorder,
+ *  which was 3MB against this 2MB and so could never be persisted whole. */
+export const PERSIST_MAX_BYTES = 2000000; // ~2MB — well under typical IndexedDB quotas
+/** Per-item cost, +1 for the separating comma. Summed once instead of re-stringifying the whole
+ *  array per drop: the old shed loop was O(n) full stringifies, which on a 1000-item queue holding
+ *  MB-scale keyframes is real main-thread time — spent on `pagehide`, of all moments. */
+const itemSize = (it) => JSON.stringify(it).length + 1;
+/** Keep only items younger than the max age (by getTime). Items with no timestamp are kept. */
+export function freshOnly(items, getTime, nowMs) {
+    return items.filter((it) => {
+        const t = getTime(it);
+        return t == null || nowMs - t <= MAX_AGE_MS;
+    });
+}
+/**
+ * Trim a queue to the persisted-byte budget.
+ *
+ * Sheds the OLDEST heavy (replay-frame) items until it fits, so what survives is the most recent
+ * replay plus every light item. Light telemetry is never traded for a frame: events, perf and
+ * network entries are two orders of magnitude smaller, so dropping them to keep a keyframe is a
+ * bad exchange in both directions.
+ *
+ * WHY THIS IS NOT `filter(not heavy)`:
+ * it used to be. One byte over budget removed EVERY frame in a single pass — keyframe included —
+ * while events/perf/network sailed through. That is precisely the failure signature measured on a
+ * live app: 44 of 164 sessions arrived complete in every other lane with not one frame stored
+ * (`npm run replay:diagnose`, the `missing` state). Its keyframes average 109 kB and reach 1.17 MB,
+ * and `persistQueue()` runs on every pagehide AND every failed flush, so a single transient 500
+ * mid-session was enough to discard a whole session's replay.
+ *
+ * `isBase` marks a keyframe. A delta whose keyframe was shed reconstructs nothing, so it goes too —
+ * storing it would only convert a `missing` session into an `orphaned` one, which is no better and
+ * costs bytes to find out.
+ *
+ * Always returns a fresh array (a synchronous snapshot) so the async IDB write can't capture a
+ * reference that a concurrent flush() splices out from under it (pagehide save-vs-flush race).
+ */
+export function capBytes(items, isHeavy, isBase) {
+    const rows = items.map((it) => ({ it, n: itemSize(it), gone: false }));
+    let total = rows.reduce((a, r) => a + r.n, 0);
+    if (total <= PERSIST_MAX_BYTES)
+        return items.slice();
+    // Oldest-first over whatever `pick` selects, stopping the moment the budget is met.
+    const shed = (pick) => {
+        for (const r of rows) {
+            if (total <= PERSIST_MAX_BYTES)
+                return;
+            if (r.gone || !pick(r.it))
+                continue;
+            r.gone = true;
+            total -= r.n;
+        }
+    };
+    /**
+     * Pass 1 — frames, oldest first, BUT never the last surviving keyframe.
+     *
+     * Oldest-first alone is right whenever two segments exist: dropping the older base (and, via pass 3,
+     * its orphaned deltas) leaves a recent replay that still has motion, which beats keeping two static
+     * snapshots. That policy is preserved exactly.
+     *
+     * It breaks on the SINGLE-segment case. Early in a session there is one keyframe with deltas behind
+     * it; oldest-first sheds the base first, pass 3 then correctly drops the orphaned deltas, and the
+     * whole replay is gone — where shedding the deltas would have left a playable single-frame replay.
+     * That is the early/short session that dominates the `missing` bucket, and `persistQueue()` runs on
+     * every pagehide and every failed flush, so a visitor simply leaving is enough to reach it.
+     *
+     * The guard is "more than one keyframe left", not "is this the first": after the older bases have
+     * gone the survivor becomes protected in turn, so the rule needs no lookahead and cannot strand a
+     * session with deltas and no base.
+     */
+    if (isHeavy && isBase) {
+        let basesLeft = rows.reduce((n, r) => n + (isBase(r.it) ? 1 : 0), 0);
+        for (const r of rows) {
+            if (total <= PERSIST_MAX_BYTES)
+                break;
+            if (r.gone || !isHeavy(r.it))
+                continue;
+            const isTheBase = isBase(r.it);
+            if (isTheBase && basesLeft <= 1)
+                continue; // the last thing that makes any of this playable
+            r.gone = true;
+            total -= r.n;
+            if (isTheBase)
+                basesLeft--;
+        }
+    }
+    else if (isHeavy) {
+        shed(isHeavy); // no base predicate — nothing to protect, old behaviour
+    }
+    // Pass 2 — light items alone still over budget, or a lone keyframe that cannot fit on its own. This
+    // is the genuine last resort and may take the protected base with it; at that point there is no
+    // playable replay to save either way.
+    shed(() => true);
+    const kept = rows.filter((r) => !r.gone).map((r) => r.it);
+    if (!isHeavy || !isBase)
+        return kept;
+    // Pass 3 — drop deltas left with no keyframe ahead of them.
+    let based = false;
+    return kept.filter((it) => (!isHeavy(it) ? true : isBase(it) ? ((based = true), true) : based));
+}
+//# sourceMappingURL=prune.js.map

package/dist/core/prune.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prune.js","sourceRoot":"","sources":["../../src/core/prune.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,MAAM;AAE9C;;4EAE4E;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAS,CAAC,CAAC,6CAA6C;AAEzF;;yFAEyF;AACzF,MAAM,QAAQ,GAAG,CAAC,EAAW,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAExE,+FAA+F;AAC/F,MAAM,UAAU,SAAS,CAAI,KAAU,EAAE,OAAsC,EAAE,KAAa;IAC5F,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;QACzB,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QACtB,OAAO,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,UAAU,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,QAAQ,CAAI,KAAU,EAAE,OAA4B,EAAE,MAA2B;IAC/F,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACvE,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9C,IAAI,KAAK,IAAI,iBAAiB;QAAE,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;IAErD,oFAAoF;IACpF,MAAM,IAAI,GAAG,CAAC,IAAwB,EAAQ,EAAE;QAC9C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,KAAK,IAAI,iBAAiB;gBAAE,OAAO;YACvC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAE,SAAS;YACpC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;YACd,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IACF;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACtB,IAAI,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrE,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,KAAK,IAAI,iBAAiB;gBAAE,MAAM;YACtC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAE,SAAS;YACvC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,SAAS,IAAI,SAAS,IAAI,CAAC;gBAAE,SAAS,CAAC,iDAAiD;YAC5F,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;YACd,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC;YACb,IAAI,SAAS;gBAAE,SAAS,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,wDAAwD;IACzE,CAAC;IACD,oGAAoG;IACpG,gGAAgG;IAChG,sCAAsC;IACtC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAEjB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACrC,4DAA4D;IAC5D,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAClG,CAAC"}

package/dist/core/redact.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Shared text redaction. A minimal, dependency-free scrub used by features that ship free-text
+ * (errors, console) so they never drift. Deliberately light — strips the obvious PII/secrets that
+ * must never leave the client by default; a full redaction policy can deepen later. The network
+ * feature has its own structured (header/body) denylist; this is for human-readable strings.
+ */
+/** Strip obvious emails + long opaque tokens from a free-text string. */
+export declare function scrubText(msg: string): string;
+/**
+ * Scrub PII/secrets from a structured props object (analytics `track()` props, super-properties).
+ * Denylisted KEYS → fully redacted; string VALUES → emails + long digit runs stripped. Bounded
+ * depth/breadth (cycle- & blowup-safe); returns a NEW value, never mutates the caller's object.
+ */
+export declare function scrubProps<T>(value: T, depth?: number): T;
+//# sourceMappingURL=redact.d.ts.map

package/dist/core/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/core/redact.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,yEAAyE;AACzE,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAI7C;AA+BD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,SAAI,GAAG,CAAC,CAsBpD"}

package/dist/core/redact.js

@@ -0,0 +1,72 @@
+/**
+ * Shared text redaction. A minimal, dependency-free scrub used by features that ship free-text
+ * (errors, console) so they never drift. Deliberately light — strips the obvious PII/secrets that
+ * must never leave the client by default; a full redaction policy can deepen later. The network
+ * feature has its own structured (header/body) denylist; this is for human-readable strings.
+ */
+/** Strip obvious emails + long opaque tokens from a free-text string. */
+export function scrubText(msg) {
+    return msg
+        .replace(/[\w.+-]+@[\w-]+\.[\w.-]+/g, '[email]')
+        .replace(/\b[A-Za-z0-9_-]{24,}\b/g, '[token]');
+}
+// A3 — structured-props PII scrub. Keys matching secrets are fully redacted; string values lose
+// emails + long digit runs (cards/SSNs/phones). Intentionally does NOT apply scrubText's aggressive
+// 24+ token rule — that would nuke legitimate ids/uuids that belong in analytics properties.
+const PII_KEY = /pass(word|wd)?|secret|token|api[_-]?key|authorization|auth|ssn|social|credit|card[_-]?(number|num)|cardnum|cvv|cvc/i;
+const EMAIL_RE = /[\w.+-]+@[\w-]+\.[\w.-]+/g;
+const LONGNUM_RE = /\b\d[\d -]{11,18}\d\b/g; // 13–20 digit sequences
+/**
+ * Keys whose value is set by the ADVERTISER in their own ad URL, never typed by a person.
+ *
+ * Meta and TikTok pass numeric campaign / adset / ad ids through `utm_campaign`, `utm_content` and
+ * `utm_term` — 15–18 digits, which `LONGNUM_RE` cannot tell apart from a card or phone number. It
+ * replaced them, so every paid visit arrived carrying `campaign: '[redacted]'` and the ad's identity
+ * was destroyed in the browser, before the event was ever sent. Measured on production before this
+ * was fixed: 47,066 events on one site since 2026-07-25, ~2,300 a day, its largest paid channel —
+ * unrecoverable, because nothing server-side ever saw the original value.
+ *
+ * These keys are exempt from the DIGIT rule only. The `PII_KEY` denylist still redacts them whole if
+ * one is ever named like a secret, emails in them are still stripped, and every other property keeps
+ * `LONGNUM_RE` — which is what protects a genuine `phone` or `card_number` prop.
+ *
+ * Click ids (`gclid`, `fbclid`, …) need no exemption: their values are alphanumeric, so the digit
+ * rule never matched them. Left out on purpose rather than carried as dead bytes.
+ */
+const AD_PARAM_KEY = /^utm_/i;
+function scrubValue(v) {
+    return v.replace(EMAIL_RE, '[email]').replace(LONGNUM_RE, '[redacted]');
+}
+/**
+ * Scrub PII/secrets from a structured props object (analytics `track()` props, super-properties).
+ * Denylisted KEYS → fully redacted; string VALUES → emails + long digit runs stripped. Bounded
+ * depth/breadth (cycle- & blowup-safe); returns a NEW value, never mutates the caller's object.
+ */
+export function scrubProps(value, depth = 0) {
+    if (value == null || depth > 4)
+        return value;
+    if (typeof value === 'string')
+        return scrubValue(value);
+    if (Array.isArray(value)) {
+        return value.slice(0, 1000).map((v) => scrubProps(v, depth + 1));
+    }
+    if (typeof value === 'object') {
+        const out = {};
+        let n = 0;
+        for (const k in value) {
+            if (n++ > 200)
+                break;
+            if (!Object.prototype.hasOwnProperty.call(value, k))
+                continue;
+            const v = value[k];
+            out[k] = PII_KEY.test(k)
+                ? '[redacted]'
+                : AD_PARAM_KEY.test(k) && typeof v === 'string'
+                    ? v.replace(EMAIL_RE, '[email]')
+                    : scrubProps(v, depth + 1);
+        }
+        return out;
+    }
+    return value;
+}
+//# sourceMappingURL=redact.js.map

package/dist/core/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/core/redact.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,yEAAyE;AACzE,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,GAAG;SACP,OAAO,CAAC,2BAA2B,EAAE,SAAS,CAAC;SAC/C,OAAO,CAAC,yBAAyB,EAAE,SAAS,CAAC,CAAC;AACnD,CAAC;AAED,gGAAgG;AAChG,oGAAoG;AACpG,6FAA6F;AAC7F,MAAM,OAAO,GAAG,qHAAqH,CAAC;AACtI,MAAM,QAAQ,GAAG,2BAA2B,CAAC;AAC7C,MAAM,UAAU,GAAG,wBAAwB,CAAC,CAAC,wBAAwB;AACrE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,YAAY,GAAG,QAAQ,CAAC;AAE9B,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AAC1E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAI,KAAQ,EAAE,KAAK,GAAG,CAAC;IAC/C,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,KAAK,CAAiB,CAAC;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAiB,CAAC;IACnF,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,KAAgC,EAAE,CAAC;YACjD,IAAI,CAAC,EAAE,GAAG,GAAG;gBAAE,MAAM;YACrB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBAAE,SAAS;YAC9D,MAAM,CAAC,GAAI,KAAiC,CAAC,CAAC,CAAC,CAAC;YAChD,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;gBACtB,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAC7C,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC;oBAChC,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,GAAmB,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/core/replayCoord.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Replay coordinate tracking (M5) — the ScaleBun differentiator: stamp each error with WHERE the
+ * session replay was when it fired, so the dashboard can deep-link the player to the exact frame
+ * (not just "open the session"). Competitors link error↔session; we link error↔frame.
+ *
+ * Zero new coupling: replay frame items already flow through the bootstrap emit boundary, so we just
+ * remember the latest frame's `seq` + the current segment (last keyframe's id) as they pass. Errors
+ * read it at capture time. Cheap (a kind-check + two assignments) so it's safe on the streaming path.
+ */
+import type { Item } from '@scalebun/protocol';
+export interface ReplayCoord {
+    /** Monotonic frame sequence at error time — the player seeks here. */
+    seq?: number;
+    /** Current segment = the last keyframe's id (segment-aware seeking). */
+    segmentId?: string;
+}
+/** Note a frame as it passes the emit boundary (no-op for non-frame items). */
+export declare function noteReplayFrame(item: Item): void;
+/** The current replay coordinate, or undefined when replay isn't producing frames. */
+export declare function getReplayCoord(): ReplayCoord | undefined;
+export declare function clearReplayCoord(): void;
+//# sourceMappingURL=replayCoord.d.ts.map

package/dist/core/replayCoord.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replayCoord.d.ts","sourceRoot":"","sources":["../../src/core/replayCoord.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,WAAW,WAAW;IAC1B,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAKD,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAIhD;AAED,sFAAsF;AACtF,wBAAgB,cAAc,IAAI,WAAW,GAAG,SAAS,CAExD;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAGvC"}

package/dist/core/replayCoord.js

@@ -0,0 +1,20 @@
+let seq;
+let segmentId;
+/** Note a frame as it passes the emit boundary (no-op for non-frame items). */
+export function noteReplayFrame(item) {
+    if (item.kind !== 'frame')
+        return;
+    if (typeof item.seq === 'number')
+        seq = item.seq;
+    if (item.frameType === 'keyframe' && item.frameId)
+        segmentId = item.frameId;
+}
+/** The current replay coordinate, or undefined when replay isn't producing frames. */
+export function getReplayCoord() {
+    return seq != null || segmentId != null ? { seq, segmentId } : undefined;
+}
+export function clearReplayCoord() {
+    seq = undefined;
+    segmentId = undefined;
+}
+//# sourceMappingURL=replayCoord.js.map

package/dist/core/replayCoord.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replayCoord.js","sourceRoot":"","sources":["../../src/core/replayCoord.ts"],"names":[],"mappings":"AAkBA,IAAI,GAAuB,CAAC;AAC5B,IAAI,SAA6B,CAAC;AAElC,+EAA+E;AAC/E,MAAM,UAAU,eAAe,CAAC,IAAU;IACxC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO;IAClC,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;QAAE,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACjD,IAAI,IAAI,CAAC,SAAS,KAAK,UAAU,IAAI,IAAI,CAAC,OAAO;QAAE,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;AAC9E,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,cAAc;IAC5B,OAAO,GAAG,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,GAAG,GAAG,SAAS,CAAC;IAChB,SAAS,GAAG,SAAS,CAAC;AACxB,CAAC"}

package/dist/core/retry.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Shared retry primitives for the egress lanes (session pipeline + analytics /batch). Zero deps.
+ *
+ * - Exponential backoff with full jitter so a struggling/offline server isn't hit every flush tick.
+ * - Tiny online helpers so a reconnect flushes immediately instead of waiting for the next tick.
+ *
+ * Applied to the AUTO (timer/reconnect-driven) flush only; explicit/keepalive flushes still attempt
+ * unconditionally so ScaleBun.flush() and page-hide sends are never gated.
+ */
+/** navigator.onLine is false ONLY when the browser is sure it's offline; treat unknown as online. */
+export declare function isOnline(): boolean;
+/** Subscribe to the browser regaining connectivity. Returns an unsubscribe (no-op when off-DOM). */
+export declare function onOnline(cb: () => void): () => void;
+/** Exponential backoff (1s base → 30s cap, full jitter). Gates the auto-flush during an outage. */
+export declare class Backoff {
+    private fails;
+    private nextAt;
+    /** True once the backoff window has elapsed and a send may be attempted. */
+    ready(nowMs: number): boolean;
+    /** Record a failed send → widen the window (capped, full jitter de-correlates retries). */
+    fail(nowMs: number): void;
+    /** Collapse the window so the next attempt fires immediately (on success or reconnect). */
+    reset(): void;
+}
+//# sourceMappingURL=retry.d.ts.map

package/dist/core/retry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.d.ts","sourceRoot":"","sources":["../../src/core/retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,qGAAqG;AACrG,wBAAgB,QAAQ,IAAI,OAAO,CAElC;AAED,oGAAoG;AACpG,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAInD;AAKD,mGAAmG;AACnG,qBAAa,OAAO;IAClB,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,MAAM,CAAK;IAEnB,4EAA4E;IAC5E,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI7B,2FAA2F;IAC3F,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAKzB,2FAA2F;IAC3F,KAAK,IAAI,IAAI;CAId"}

package/dist/core/retry.js

@@ -0,0 +1,44 @@
+/**
+ * Shared retry primitives for the egress lanes (session pipeline + analytics /batch). Zero deps.
+ *
+ * - Exponential backoff with full jitter so a struggling/offline server isn't hit every flush tick.
+ * - Tiny online helpers so a reconnect flushes immediately instead of waiting for the next tick.
+ *
+ * Applied to the AUTO (timer/reconnect-driven) flush only; explicit/keepalive flushes still attempt
+ * unconditionally so ScaleBun.flush() and page-hide sends are never gated.
+ */
+/** navigator.onLine is false ONLY when the browser is sure it's offline; treat unknown as online. */
+export function isOnline() {
+    return typeof navigator === 'undefined' || navigator.onLine !== false;
+}
+/** Subscribe to the browser regaining connectivity. Returns an unsubscribe (no-op when off-DOM). */
+export function onOnline(cb) {
+    if (typeof window === 'undefined')
+        return () => { };
+    window.addEventListener('online', cb);
+    return () => window.removeEventListener('online', cb);
+}
+const BASE_MS = 1000;
+const MAX_MS = 30000;
+/** Exponential backoff (1s base → 30s cap, full jitter). Gates the auto-flush during an outage. */
+export class Backoff {
+    constructor() {
+        this.fails = 0;
+        this.nextAt = 0;
+    }
+    /** True once the backoff window has elapsed and a send may be attempted. */
+    ready(nowMs) {
+        return nowMs >= this.nextAt;
+    }
+    /** Record a failed send → widen the window (capped, full jitter de-correlates retries). */
+    fail(nowMs) {
+        const exp = Math.min(MAX_MS, BASE_MS * 2 ** this.fails++);
+        this.nextAt = nowMs + Math.random() * exp;
+    }
+    /** Collapse the window so the next attempt fires immediately (on success or reconnect). */
+    reset() {
+        this.fails = 0;
+        this.nextAt = 0;
+    }
+}
+//# sourceMappingURL=retry.js.map

package/dist/core/retry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.js","sourceRoot":"","sources":["../../src/core/retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,qGAAqG;AACrG,MAAM,UAAU,QAAQ;IACtB,OAAO,OAAO,SAAS,KAAK,WAAW,IAAI,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC;AACxE,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,QAAQ,CAAC,EAAc;IACrC,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IACnD,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACtC,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,CAAC;AACrB,MAAM,MAAM,GAAG,KAAK,CAAC;AAErB,mGAAmG;AACnG,MAAM,OAAO,OAAO;IAApB;QACU,UAAK,GAAG,CAAC,CAAC;QACV,WAAM,GAAG,CAAC,CAAC;IAkBrB,CAAC;IAhBC,4EAA4E;IAC5E,KAAK,CAAC,KAAa;QACjB,OAAO,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC;IAC9B,CAAC;IAED,2FAA2F;IAC3F,IAAI,CAAC,KAAa;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,GAAG,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC;IAC5C,CAAC;IAED,2FAA2F;IAC3F,KAAK;QACH,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAClB,CAAC;CACF"}

package/dist/core/runtime.d.ts

@@ -0,0 +1,28 @@
+/**
+ * core/runtime.ts — the ONE place the SDK decides which JavaScript runtime it is executing in.
+ *
+ * Replaces scattered `typeof window !== 'undefined'` checks with a single, memoized detection so every
+ * feature can reason about the ENVIRONMENT (browser / SSR-node / edge / worker) instead of probing
+ * globals ad-hoc. Import-safe: detection is LAZY (first call), so importing this module touches no
+ * global. Conservative: anything not confidently a browser is treated as a server, so the SDK never
+ * runs DOM code in an ambiguous runtime.
+ *
+ * Nothing consumes this yet (P0 foundation) — `init()`/features wire into it in later phases.
+ */
+export type Runtime = 'browser' | 'ssr-node' | 'edge' | 'worker' | 'unknown';
+/** The current runtime, detected once and memoized. */
+export declare function getRuntime(): Runtime;
+/** True only in a real browser (DOM present). Everything else is a server-side runtime. */
+export declare function isBrowser(): boolean;
+/** True on any non-browser runtime (SSR-node, edge, worker, unknown). */
+export declare function isServer(): boolean;
+/** True on an edge / WinterCG runtime (Vercel Edge, Cloudflare Workers). */
+export declare function isEdge(): boolean;
+/** Test-only: clear the memoized runtime so a suite can re-detect under mocked globals. */
+export declare function __resetRuntimeForTests(): void;
+/**
+ * Test-only: force the runtime, bypassing detection. Lets node-based integration suites (real `fetch`
+ * + a local http server) drive the browser `init()` path without a DOM. Pair with `__resetRuntimeForTests`.
+ */
+export declare function __setRuntimeForTests(rt: Runtime): void;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/core/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/core/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;AAmC7E,uDAAuD;AACvD,wBAAgB,UAAU,IAAI,OAAO,CAGpC;AAED,2FAA2F;AAC3F,wBAAgB,SAAS,IAAI,OAAO,CAEnC;AAED,yEAAyE;AACzE,wBAAgB,QAAQ,IAAI,OAAO,CAElC;AAED,4EAA4E;AAC5E,wBAAgB,MAAM,IAAI,OAAO,CAEhC;AAED,2FAA2F;AAC3F,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,OAAO,GAAG,IAAI,CAEtD"}

package/dist/core/runtime.js

@@ -0,0 +1,67 @@
+/**
+ * core/runtime.ts — the ONE place the SDK decides which JavaScript runtime it is executing in.
+ *
+ * Replaces scattered `typeof window !== 'undefined'` checks with a single, memoized detection so every
+ * feature can reason about the ENVIRONMENT (browser / SSR-node / edge / worker) instead of probing
+ * globals ad-hoc. Import-safe: detection is LAZY (first call), so importing this module touches no
+ * global. Conservative: anything not confidently a browser is treated as a server, so the SDK never
+ * runs DOM code in an ambiguous runtime.
+ *
+ * Nothing consumes this yet (P0 foundation) — `init()`/features wire into it in later phases.
+ */
+let cached = null;
+function detect() {
+    const g = globalThis;
+    // Browser: a real DOM (document) + window. The only runtime that runs the full capture pipeline.
+    if (typeof window !== 'undefined' && typeof document !== 'undefined')
+        return 'browser';
+    // Edge / WinterCG (Vercel Edge, Cloudflare Workers) — no DOM, fetch present. Checked before the
+    // worker heuristic so a CF Worker classifies as 'edge', not 'worker'.
+    const nav = g.navigator;
+    const caches = g.caches;
+    if (typeof g.EdgeRuntime !== 'undefined' ||
+        nav?.userAgent === 'Cloudflare-Workers' ||
+        typeof g.WebSocketPair !== 'undefined' ||
+        (caches !== undefined && typeof caches.default !== 'undefined')) {
+        return 'edge';
+    }
+    // Dedicated / service worker (worker global scope; no document).
+    if (typeof g.importScripts === 'function' || typeof g.ServiceWorkerGlobalScope !== 'undefined') {
+        return 'worker';
+    }
+    // Node SSR (Next SSR/RSC/SSG/ISR, Node servers).
+    const proc = g.process;
+    if (proc?.versions?.node)
+        return 'ssr-node';
+    return 'unknown';
+}
+/** The current runtime, detected once and memoized. */
+export function getRuntime() {
+    if (cached === null)
+        cached = detect();
+    return cached;
+}
+/** True only in a real browser (DOM present). Everything else is a server-side runtime. */
+export function isBrowser() {
+    return getRuntime() === 'browser';
+}
+/** True on any non-browser runtime (SSR-node, edge, worker, unknown). */
+export function isServer() {
+    return !isBrowser();
+}
+/** True on an edge / WinterCG runtime (Vercel Edge, Cloudflare Workers). */
+export function isEdge() {
+    return getRuntime() === 'edge';
+}
+/** Test-only: clear the memoized runtime so a suite can re-detect under mocked globals. */
+export function __resetRuntimeForTests() {
+    cached = null;
+}
+/**
+ * Test-only: force the runtime, bypassing detection. Lets node-based integration suites (real `fetch`
+ * + a local http server) drive the browser `init()` path without a DOM. Pair with `__resetRuntimeForTests`.
+ */
+export function __setRuntimeForTests(rt) {
+    cached = rt;
+}
+//# sourceMappingURL=runtime.js.map

package/dist/core/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/core/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,IAAI,MAAM,GAAmB,IAAI,CAAC;AAElC,SAAS,MAAM;IACb,MAAM,CAAC,GAAG,UAAqC,CAAC;IAEhD,iGAAiG;IACjG,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,QAAQ,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IAEvF,gGAAgG;IAChG,sEAAsE;IACtE,MAAM,GAAG,GAAG,CAAC,CAAC,SAA+C,CAAC;IAC9D,MAAM,MAAM,GAAG,CAAC,CAAC,MAA2C,CAAC;IAC7D,IACE,OAAO,CAAC,CAAC,WAAW,KAAK,WAAW;QACpC,GAAG,EAAE,SAAS,KAAK,oBAAoB;QACvC,OAAO,CAAC,CAAC,aAAa,KAAK,WAAW;QACtC,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,WAAW,CAAC,EAC/D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,iEAAiE;IACjE,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,wBAAwB,KAAK,WAAW,EAAE,CAAC;QAC/F,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,iDAAiD;IACjD,MAAM,IAAI,GAAG,CAAC,CAAC,OAAuD,CAAC;IACvE,IAAI,IAAI,EAAE,QAAQ,EAAE,IAAI;QAAE,OAAO,UAAU,CAAC;IAE5C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,UAAU;IACxB,IAAI,MAAM,KAAK,IAAI;QAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,SAAS;IACvB,OAAO,UAAU,EAAE,KAAK,SAAS,CAAC;AACpC,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,QAAQ;IACtB,OAAO,CAAC,SAAS,EAAE,CAAC;AACtB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,MAAM;IACpB,OAAO,UAAU,EAAE,KAAK,MAAM,CAAC;AACjC,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,sBAAsB;IACpC,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAAW;IAC9C,MAAM,GAAG,EAAE,CAAC;AACd,CAAC"}