@scalebun-release/web 2.2.2

package/dist/storage/idb.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Minimal IndexedDB durability for the pending queue. A single record holds the pending-items
+ * array, so unsent items survive a reload. Graceful no-op when IndexedDB is unavailable (private
+ * mode / SSR / blocked). Not a general KV store — just queue persistence.
+ */
+export declare class PersistentBuffer {
+    private readonly key;
+    private dbp;
+    /** @param key record key within the shared object store (default: the pipeline's 'pending'). */
+    constructor(key?: string);
+    private db;
+    load(): Promise<unknown[]>;
+    save(items: unknown[]): Promise<void>;
+    clear(): Promise<void>;
+}
+//# sourceMappingURL=idb.d.ts.map

package/dist/storage/idb.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idb.d.ts","sourceRoot":"","sources":["../../src/storage/idb.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAyBH,qBAAa,gBAAgB;IAIf,OAAO,CAAC,QAAQ,CAAC,GAAG;IAHhC,OAAO,CAAC,GAAG,CAA4C;IAEvD,gGAAgG;gBACnE,GAAG,GAAE,MAAoB;IAEtD,OAAO,CAAC,EAAE;IAKJ,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAc1B,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAerC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}

package/dist/storage/idb.js

@@ -0,0 +1,76 @@
+/**
+ * Minimal IndexedDB durability for the pending queue. A single record holds the pending-items
+ * array, so unsent items survive a reload. Graceful no-op when IndexedDB is unavailable (private
+ * mode / SSR / blocked). Not a general KV store — just queue persistence.
+ */
+const DB = 'scalebun';
+const STORE = 'queue';
+/** Default record key — the session pipeline's pending queue. Other lanes (e.g. the analytics
+ *  /batch lane) pass their own key so each persists independently in the same object store. */
+const DEFAULT_KEY = 'pending';
+function openDb() {
+    return new Promise((resolve) => {
+        try {
+            if (typeof indexedDB === 'undefined')
+                return resolve(null);
+            const req = indexedDB.open(DB, 1);
+            req.onupgradeneeded = () => {
+                const db = req.result;
+                if (!db.objectStoreNames.contains(STORE))
+                    db.createObjectStore(STORE);
+            };
+            req.onsuccess = () => resolve(req.result);
+            req.onerror = () => resolve(null);
+        }
+        catch {
+            resolve(null);
+        }
+    });
+}
+export class PersistentBuffer {
+    /** @param key record key within the shared object store (default: the pipeline's 'pending'). */
+    constructor(key = DEFAULT_KEY) {
+        this.key = key;
+        this.dbp = null;
+    }
+    db() {
+        if (!this.dbp)
+            this.dbp = openDb();
+        return this.dbp;
+    }
+    async load() {
+        const db = await this.db();
+        if (!db)
+            return [];
+        return new Promise((resolve) => {
+            try {
+                const req = db.transaction(STORE, 'readonly').objectStore(STORE).get(this.key);
+                req.onsuccess = () => resolve(Array.isArray(req.result) ? req.result : []);
+                req.onerror = () => resolve([]);
+            }
+            catch {
+                resolve([]);
+            }
+        });
+    }
+    async save(items) {
+        const db = await this.db();
+        if (!db)
+            return;
+        return new Promise((resolve) => {
+            try {
+                const tx = db.transaction(STORE, 'readwrite');
+                tx.objectStore(STORE).put(items, this.key);
+                tx.oncomplete = () => resolve();
+                tx.onerror = () => resolve();
+            }
+            catch {
+                resolve();
+            }
+        });
+    }
+    async clear() {
+        return this.save([]);
+    }
+}
+//# sourceMappingURL=idb.js.map

package/dist/storage/idb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idb.js","sourceRoot":"","sources":["../../src/storage/idb.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,EAAE,GAAG,UAAU,CAAC;AACtB,MAAM,KAAK,GAAG,OAAO,CAAC;AACtB;+FAC+F;AAC/F,MAAM,WAAW,GAAG,SAAS,CAAC;AAE9B,SAAS,MAAM;IACb,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,CAAC;YACH,IAAI,OAAO,SAAS,KAAK,WAAW;gBAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;YAC3D,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAClC,GAAG,CAAC,eAAe,GAAG,GAAG,EAAE;gBACzB,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;gBACtB,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACxE,CAAC,CAAC;YACF,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,gBAAgB;IAG3B,gGAAgG;IAChG,YAA6B,MAAc,WAAW;QAAzB,QAAG,GAAH,GAAG,CAAsB;QAH9C,QAAG,GAAuC,IAAI,CAAC;IAGE,CAAC;IAElD,EAAE;QACR,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,IAAI,CAAC,GAAG,GAAG,MAAM,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACnB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC/E,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC3E,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,EAAE,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,EAAE;YAAE,OAAO;QAChB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;gBAC9C,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC3C,EAAE,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;gBAChC,EAAE,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;CACF"}

package/dist/storage/index.d.ts

@@ -0,0 +1,3 @@
+/** storage/ — durable queue persistence (IndexedDB) so unsent items survive a reload. */
+export * from './idb.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/storage/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,cAAc,OAAO,CAAC"}

package/dist/storage/index.js

@@ -0,0 +1,3 @@
+/** storage/ — durable queue persistence (IndexedDB) so unsent items survive a reload. */
+export * from './idb.js';
+//# sourceMappingURL=index.js.map

package/dist/storage/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,cAAc,OAAO,CAAC"}

package/dist/transport/gzip.d.ts

@@ -0,0 +1,2 @@
+export declare function gzipString(s: string): Promise<ArrayBuffer | null>;
+//# sourceMappingURL=gzip.d.ts.map

package/dist/transport/gzip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gzip.d.ts","sourceRoot":"","sources":["../../src/transport/gzip.ts"],"names":[],"mappings":"AAKA,wBAAsB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAWvE"}

package/dist/transport/gzip.js

@@ -0,0 +1,20 @@
+// W4 4.6 — lazy gzip for the egress. Dynamically imported (kept OUT of the core bundle, like sign.ts)
+// and used only for large, non-keepalive batches — exactly the replay-heavy uploads where delta JSON
+// and repeated tag/class/attr strings compress well. The backend's body-parser inflates transparently
+// (Content-Encoding: gzip), and it exposes the INFLATED body as rawBody, so opt-in HMAC signing (which
+// signs the uncompressed JSON) still verifies. Fail-soft: returns null on any error → caller sends raw.
+export async function gzipString(s) {
+    if (typeof CompressionStream === 'undefined')
+        return null;
+    try {
+        const cs = new CompressionStream('gzip');
+        const writer = cs.writable.getWriter();
+        void writer.write(new TextEncoder().encode(s));
+        void writer.close();
+        return await new Response(cs.readable).arrayBuffer();
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=gzip.js.map

package/dist/transport/gzip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gzip.js","sourceRoot":"","sources":["../../src/transport/gzip.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,qGAAqG;AACrG,sGAAsG;AACtG,uGAAuG;AACvG,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,CAAS;IACxC,IAAI,OAAO,iBAAiB,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,OAAO,MAAM,IAAI,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/transport/httpClient.d.ts

@@ -0,0 +1,156 @@
+/**
+ * The single egress. Everything leaves as a unified SessionEnvelope to
+ * `POST /ingestion/sessions/:id/batch`. `keepalive` lets an unload flush survive.
+ */
+import type { SessionEnvelope, ClientInfo, DeviceInfo, AppInfo, ContextInfo } from '@scalebun/protocol';
+import type { ResolvedConfig } from '../config/schema.js';
+interface SessionHead {
+    sessionId: string;
+    client: ClientInfo;
+    device: DeviceInfo;
+    app?: AppInfo;
+    context?: ContextInfo;
+}
+/** What `presignFrames` gets back. `enabled:false` means storage is off server-side. */
+export interface PresignResult {
+    enabled: boolean;
+    frames?: Array<{
+        frameId: string;
+        uploadUrl: string;
+        storageKey: string;
+        contentType: string;
+        payloadKind?: string;
+    }>;
+    css?: Array<{
+        contentId: string;
+        uploadUrl: string;
+        storageKey: string;
+        contentType: string;
+    }>;
+}
+export declare class HttpClient {
+    private readonly config;
+    constructor(config: ResolvedConfig);
+    /**
+     * Epoch ms until which the workspace is known-suspended. While this is in the future we skip
+     * ALL egress — the "don't even make the call" behaviour. Armed when the backend rejects with its
+     * structured suspend verdict (403 `{ code:'workspace_suspended', enabled:false, retryAfterSeconds }`,
+     * mirrored to `Retry-After`). The server stays the source of truth; this only avoids wasted round
+     * trips for a suspended/expired workspace. It self-heals: once the backoff elapses the next send
+     * probes the network again and, if the workspace is active, sending resumes.
+     */
+    private suspendedUntil;
+    private isSuspended;
+    private headers;
+    /**
+     * W1a — session-lane HMAC signing, OPT-IN via `config.signSessionLane` (default off). Off by default
+     * because signing the (often multi-MB) replay uploads re-enables server-side rawBody double-buffering
+     * (the backend only captures rawBody when the signature header is present). The analytics lane always
+     * signs; enable this to sign replay/session batches too. Fail-open — unsigned on any signer failure.
+     */
+    private signedHeaders;
+    /** Open the session (parity with the current backend's start-session). */
+    startSession(head: SessionHead): Promise<void>;
+    /**
+     * Send one batched envelope, and return WHAT THE SERVER DID WITH IT — not whether the request
+     * completed.
+     *
+     * THE BUG THIS FIXES. This returned `res.ok`, and the backend answers `200 {ok:true}` even when a
+     * whole item kind was rejected: `BatchService.ingest` catches per-kind handler failures so one bad
+     * kind cannot fail the envelope, then reports success anyway. So a `frame` group refused for an
+     * unknown session, a closed entitlement, the 100-frame cap or the 8 MB domPayload cap was cleared
+     * from the queue AND from the IndexedDB mirror, while `event`/`performance` in the same envelope
+     * landed normally. That is exactly the shape of the `missing` replay bucket — SDK demonstrably ran,
+     * other lanes uploaded, zero frames stored — and it was invisible from both ends.
+     *
+     * Returns `null` when the REQUEST failed (network, non-2xx, suspended): unchanged meaning, retry
+     * everything. Otherwise the server's per-kind verdict, where a kind absent from the map was stored
+     * fine. Parsing is guarded: a 200 whose body is not the expected JSON is treated as full acceptance,
+     * which is the pre-existing behaviour and the right fallback for an older backend that does not
+     * send `results` at all.
+     */
+    sendBatch(envelope: SessionEnvelope, opts?: {
+        keepalive?: boolean;
+    }): Promise<Record<string, {
+        ok: boolean;
+        retry?: boolean;
+        reason?: string;
+    }> | null>;
+    /**
+     * Close the session server-side. Called from `pipeline.stop()` — a HOST-INITIATED shutdown — and
+     * from nowhere else.
+     *
+     * ⚠️ DO NOT WIRE THIS TO `pagehide` OR `visibilitychange`. It reads like the obvious fix for
+     * "sessions sit in `recording` for half an hour after the tab closes", and it is not.
+     *
+     * `pagehide` fires on every same-tab NAVIGATION, not only on tab close, and a web session
+     * deliberately survives navigation (see features/session/sessionStore.ts — persisting the id across
+     * refreshes and navigations is the entire reason that file exists). Finalizing here would therefore
+     * stamp `endedAt` at the visitor's first page change while the SAME session id keeps sending
+     * batches from every page after it.
+     *
+     * The server then makes that permanent in two ways. `bumpActivityAndCounters` freezes
+     * `lastActivityAt` once `endedAt` is set but keeps incrementing the counters (its "D3" comment),
+     * and `finalizeSession` is idempotent, so the row can never reopen. The rows this produced when it
+     * last happened are recorded in that comment: `durationMs` 98.1 min against a real span of 813.0
+     * min — a negative idle tail, which is impossible and silently poisons anything reading both
+     * columns.
+     *
+     * The 30-minute gap is not a defect that needs closing here. `IngestionService.reapStaleSessions`
+     * runs every 5 minutes and closes anything idle past `STALE_SESSION_MINUTES`, writing
+     * `endedAt = COALESCE(lastActivityAt, startedAt)` — the correct value, just later. A browser cannot
+     * distinguish "closing this tab" from "going to the next page", so the server, which can simply
+     * wait and see, is the right place to decide.
+     */
+    finalize(sessionId: string): Promise<void>;
+    /**
+     * Submit a bug report (F-BUG). Interactive (not batched) — returns the created report's id so the
+     * widget can ack the reporter. Returns null on failure.
+     */
+    submitBugReport(sessionId: string, payload: unknown): Promise<{
+        id?: string;
+    } | null>;
+    private static readonly GZIP_MIN_BYTES;
+    /**
+     * Returns the Response on 2xx, or `null` for every failure (suspended, non-2xx, thrown).
+     *
+     * It returned `boolean`. `sendBatch` needs the BODY — the per-kind delivery verdict lives there, and
+     * the status code does not describe it (see sendBatch). Callers that only care whether it worked
+     * read the result as truthy, which is what `startSession`/`finalize` already do by ignoring it.
+     */
+    /**
+     * Ask the backend where to PUT frame bytes, so they never travel through it.
+     *
+     * Measured on production: 154,235 of 163,644 frames stored in a 32h window are web DOM payloads,
+     * and every one of them arrived inline in the batch envelope and was PUT to object storage BY
+     * THE SERVER, on the request path, at 25-70ms per round trip — plus a PUT per CSS asset. That
+     * relay is most of a slow ingest request; the database work inside it is about 4%.
+     *
+     * Returns null on any failure, and `enabled:false` when the backend has no storage configured.
+     * Both mean the same thing to the caller: send the bytes inline, exactly as before.
+     */
+    presignFrames(sessionId: string, frames: Array<{
+        frameId: string;
+        payloadKind?: string;
+    }>, cssIds?: string[]): Promise<PresignResult | null>;
+    /**
+     * PUT bytes at a presigned URL.
+     *
+     * DELIBERATELY NOT `post()`: that signs the body and attaches SDK auth headers, and a presigned
+     * URL already carries its own signature in the query string. Sending ours as well makes the
+     * request signature invalid and the upload fails with a 403 that looks like an auth bug.
+     *
+     * No keepalive: an unload flush must not wait on a second network hop. Never throws.
+     */
+    putSigned(url: string, body: BodyInit, contentType: string): Promise<boolean>;
+    private post;
+    /**
+     * Arm the suspend backoff from a 403. Only the backend's workspace-suspend verdict
+     * (`code:'workspace_suspended'` or `enabled:false`) counts — any other 403 is ignored so a
+     * one-off authz error can't silently mute the SDK. Reads the JSON body when present, else falls
+     * back to the `Retry-After` header, else a 1h default. Best-effort: never throws into the caller.
+     */
+    private maybeEnterSuspended;
+}
+export {};
+//# sourceMappingURL=httpClient.d.ts.map

package/dist/transport/httpClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpClient.d.ts","sourceRoot":"","sources":["../../src/transport/httpClient.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACxG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAOvD,UAAU,WAAW;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,UAAU,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AAED,wFAAwF;AACxF,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,KAAK,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,KAAK,CAAC;QACV,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;CACJ;AAED,qBAAa,UAAU;IACT,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,cAAc;IAEnD;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc,CAAK;IAE3B,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,OAAO;IAIf;;;;;OAKG;YACW,aAAa;IAO3B,0EAA0E;IACpE,YAAY,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAgDpD;;;;;;;;;;;;;;;;;OAiBG;IACG,SAAS,CACb,QAAQ,EAAE,eAAe,EACzB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAWpF;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhD;;;OAGG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAoB3F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAQ;IAE9C;;;;;;OAMG;IACH;;;;;;;;;;OAUG;IACG,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,EACxD,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAWhC;;;;;;;;OAQG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;YAYrE,IAAI;IAuBlB;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;CAgB5B"}

package/dist/transport/httpClient.js

@@ -0,0 +1,277 @@
+/**
+ * The single egress. Everything leaves as a unified SessionEnvelope to
+ * `POST /ingestion/sessions/:id/batch`. `keepalive` lets an unload flush survive.
+ */
+import { DEFAULT_SESSION_TIMEOUT_MS } from '../features/session/sessionStore.js';
+/** `fetch` as it was when the SDK loaded — before NetworkFeature wraps it. Bound: a bare reference
+ *  to a browser's fetch throws "Illegal invocation" when called off `window`. */
+const rawFetch = typeof fetch == 'function' ? fetch.bind(globalThis) : undefined;
+export class HttpClient {
+    constructor(config) {
+        this.config = config;
+        /**
+         * Epoch ms until which the workspace is known-suspended. While this is in the future we skip
+         * ALL egress — the "don't even make the call" behaviour. Armed when the backend rejects with its
+         * structured suspend verdict (403 `{ code:'workspace_suspended', enabled:false, retryAfterSeconds }`,
+         * mirrored to `Retry-After`). The server stays the source of truth; this only avoids wasted round
+         * trips for a suspended/expired workspace. It self-heals: once the backoff elapses the next send
+         * probes the network again and, if the workspace is active, sending resumes.
+         */
+        this.suspendedUntil = 0;
+    }
+    isSuspended() {
+        return Date.now() < this.suspendedUntil;
+    }
+    headers() {
+        return { 'content-type': 'application/json', 'x-scalebun-client-key': this.config.clientKey };
+    }
+    /**
+     * W1a — session-lane HMAC signing, OPT-IN via `config.signSessionLane` (default off). Off by default
+     * because signing the (often multi-MB) replay uploads re-enables server-side rawBody double-buffering
+     * (the backend only captures rawBody when the signature header is present). The analytics lane always
+     * signs; enable this to sign replay/session batches too. Fail-open — unsigned on any signer failure.
+     */
+    async signedHeaders(body) {
+        const base = this.headers();
+        if (!this.config.signSessionLane)
+            return base;
+        const { signatureHeaders } = await import('./sign.js');
+        return { ...base, ...(await signatureHeaders(this.config.clientKey, body)) };
+    }
+    /** Open the session (parity with the current backend's start-session). */
+    async startSession(head) {
+        await this.post(`${this.config.apiBaseUrl}/ingestion/sessions`, {
+            sessionId: head.sessionId,
+            deviceId: head.device.id,
+            platform: head.client.platform,
+            // `release` backs up `version`: an app typically sets one or the other, and sending only
+            // `version` meant every session from an app configured with `release` (the Sentry-style name,
+            // and what the Joint app uses) stored appVersion NULL — the "—" beside the browser name in
+            // the sessions table. (SESSIONS-REAL-DATA-PLAN §8b)
+            appVersion: head.app?.version ?? head.app?.release,
+            osVersion: head.device.osVersion,
+            deviceModel: head.device.model ?? head.device.browser,
+            locale: head.context?.locale,
+            timezone: head.context?.timezone,
+            /**
+             * D1 — the inactivity threshold this session was recorded under. WEB PARITY GAP, now closed.
+             *
+             * The backend column, its DTO and the dashboard's idle-band maths all existed already, and the
+             * MOBILE SDK has always sent this (`idleThresholdMs` in its SDKBootstrapper). Web never did, so
+             * every web row stored NULL and any reader had to fall back to raw wall-clock — which is why a
+             * clinic tab open across a shift displayed as one 200-minute session.
+             *
+             * Sent as the threshold ACTUALLY in force (config override or the default), not the constant, so
+             * a host that widens `sessionTimeoutMs` gets bands drawn against its own value rather than ours.
+             */
+            idleThresholdMs: this.config.sessionTimeoutMs ?? DEFAULT_SESSION_TIMEOUT_MS,
+            /**
+             * P1b — the SDK BUILD that recorded this session, and the reason it was missing is instructive.
+             *
+             * `buildClient()` has always produced `{ platform, renderer, sdk:{ name, version } }`, and the
+             * batch envelope carries it — so "the SDK already sends its version" was true, and led straight
+             * to a wrong conclusion: this method does not send `head.client`. It ENUMERATES a flat payload,
+             * which is exactly the enumerating-hook failure CLAUDE.md §2 warns about, here on the client
+             * side. Every field added to `ClientInfo` after this method was written is silently absent from
+             * session start, with no error anywhere.
+             *
+             * Found by the Phase 2 browser harness, not by reading: the backend read `client.sdk.version`,
+             * the unit-level harness hand-fed that shape and passed, and only a real page proved the wire
+             * never carries it. Sent flat here to match how every other field on this payload is sent.
+             *
+             * `appVersion` above stays the HOST app's version. They are different facts and a single column
+             * cannot answer "did SDK 1.2.3 improve the ready rate".
+             */
+            sdkVersion: head.client.sdk?.version,
+            startedAt: Date.now(),
+        });
+    }
+    /**
+     * Send one batched envelope, and return WHAT THE SERVER DID WITH IT — not whether the request
+     * completed.
+     *
+     * THE BUG THIS FIXES. This returned `res.ok`, and the backend answers `200 {ok:true}` even when a
+     * whole item kind was rejected: `BatchService.ingest` catches per-kind handler failures so one bad
+     * kind cannot fail the envelope, then reports success anyway. So a `frame` group refused for an
+     * unknown session, a closed entitlement, the 100-frame cap or the 8 MB domPayload cap was cleared
+     * from the queue AND from the IndexedDB mirror, while `event`/`performance` in the same envelope
+     * landed normally. That is exactly the shape of the `missing` replay bucket — SDK demonstrably ran,
+     * other lanes uploaded, zero frames stored — and it was invisible from both ends.
+     *
+     * Returns `null` when the REQUEST failed (network, non-2xx, suspended): unchanged meaning, retry
+     * everything. Otherwise the server's per-kind verdict, where a kind absent from the map was stored
+     * fine. Parsing is guarded: a 200 whose body is not the expected JSON is treated as full acceptance,
+     * which is the pre-existing behaviour and the right fallback for an older backend that does not
+     * send `results` at all.
+     */
+    async sendBatch(envelope, opts) {
+        const url = `${this.config.apiBaseUrl}/ingestion/sessions/${encodeURIComponent(envelope.sessionId)}/batch`;
+        const res = await this.post(url, envelope, opts?.keepalive);
+        if (!res)
+            return null;
+        try {
+            return (await res.json())?.results ?? {};
+        }
+        catch {
+            return {};
+        }
+    }
+    /**
+     * Close the session server-side. Called from `pipeline.stop()` — a HOST-INITIATED shutdown — and
+     * from nowhere else.
+     *
+     * ⚠️ DO NOT WIRE THIS TO `pagehide` OR `visibilitychange`. It reads like the obvious fix for
+     * "sessions sit in `recording` for half an hour after the tab closes", and it is not.
+     *
+     * `pagehide` fires on every same-tab NAVIGATION, not only on tab close, and a web session
+     * deliberately survives navigation (see features/session/sessionStore.ts — persisting the id across
+     * refreshes and navigations is the entire reason that file exists). Finalizing here would therefore
+     * stamp `endedAt` at the visitor's first page change while the SAME session id keeps sending
+     * batches from every page after it.
+     *
+     * The server then makes that permanent in two ways. `bumpActivityAndCounters` freezes
+     * `lastActivityAt` once `endedAt` is set but keeps incrementing the counters (its "D3" comment),
+     * and `finalizeSession` is idempotent, so the row can never reopen. The rows this produced when it
+     * last happened are recorded in that comment: `durationMs` 98.1 min against a real span of 813.0
+     * min — a negative idle tail, which is impossible and silently poisons anything reading both
+     * columns.
+     *
+     * The 30-minute gap is not a defect that needs closing here. `IngestionService.reapStaleSessions`
+     * runs every 5 minutes and closes anything idle past `STALE_SESSION_MINUTES`, writing
+     * `endedAt = COALESCE(lastActivityAt, startedAt)` — the correct value, just later. A browser cannot
+     * distinguish "closing this tab" from "going to the next page", so the server, which can simply
+     * wait and see, is the right place to decide.
+     */
+    async finalize(sessionId) {
+        const url = `${this.config.apiBaseUrl}/ingestion/sessions/${encodeURIComponent(sessionId)}/finalize`;
+        await this.post(url, { endedAt: Date.now() }, true);
+    }
+    /**
+     * Submit a bug report (F-BUG). Interactive (not batched) — returns the created report's id so the
+     * widget can ack the reporter. Returns null on failure.
+     */
+    async submitBugReport(sessionId, payload) {
+        if (this.isSuspended())
+            return null;
+        const url = `${this.config.apiBaseUrl}/ingestion/sessions/${encodeURIComponent(sessionId)}/bug-reports`;
+        try {
+            const serialized = JSON.stringify(payload);
+            const res = await fetch(url, {
+                method: 'POST',
+                headers: await this.signedHeaders(serialized),
+                body: serialized,
+            });
+            if (!res.ok)
+                return null;
+            return (await res.json().catch(() => ({})));
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Returns the Response on 2xx, or `null` for every failure (suspended, non-2xx, thrown).
+     *
+     * It returned `boolean`. `sendBatch` needs the BODY — the per-kind delivery verdict lives there, and
+     * the status code does not describe it (see sendBatch). Callers that only care whether it worked
+     * read the result as truthy, which is what `startSession`/`finalize` already do by ignoring it.
+     */
+    /**
+     * Ask the backend where to PUT frame bytes, so they never travel through it.
+     *
+     * Measured on production: 154,235 of 163,644 frames stored in a 32h window are web DOM payloads,
+     * and every one of them arrived inline in the batch envelope and was PUT to object storage BY
+     * THE SERVER, on the request path, at 25-70ms per round trip — plus a PUT per CSS asset. That
+     * relay is most of a slow ingest request; the database work inside it is about 4%.
+     *
+     * Returns null on any failure, and `enabled:false` when the backend has no storage configured.
+     * Both mean the same thing to the caller: send the bytes inline, exactly as before.
+     */
+    async presignFrames(sessionId, frames, cssIds) {
+        const url = `${this.config.apiBaseUrl}/ingestion/sessions/${encodeURIComponent(sessionId)}/frames/presign`;
+        const res = await this.post(url, { frames, cssIds });
+        if (!res)
+            return null;
+        try {
+            return (await res.json());
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * PUT bytes at a presigned URL.
+     *
+     * DELIBERATELY NOT `post()`: that signs the body and attaches SDK auth headers, and a presigned
+     * URL already carries its own signature in the query string. Sending ours as well makes the
+     * request signature invalid and the upload fails with a 403 that looks like an auth bug.
+     *
+     * No keepalive: an unload flush must not wait on a second network hop. Never throws.
+     */
+    async putSigned(url, body, contentType) {
+        try {
+            // The fetch from BEFORE network capture wrapped it: a presigned URL is our own storage, not the
+            // app's API, and capture only recognises the API host as ours — every frame upload was being
+            // stored as one of the customer's network requests. (The backend also drops these at ingest.)
+            const res = await (rawFetch || fetch)(url, { method: 'PUT', body, headers: { 'content-type': contentType } });
+            return res.ok;
+        }
+        catch {
+            return false;
+        }
+    }
+    async post(url, body, keepalive = false) {
+        // Suspended workspace: short-circuit before touching the network.
+        if (this.isSuspended())
+            return null;
+        try {
+            const serialized = JSON.stringify(body);
+            const headers = await this.signedHeaders(serialized); // sign the UNCOMPRESSED JSON (backend inflates → verifies)
+            let payload = serialized;
+            if (!keepalive && serialized.length > HttpClient.GZIP_MIN_BYTES) {
+                const { gzipString } = await import('./gzip.js'); // lazy — stays out of the core bundle
+                const gz = await gzipString(serialized);
+                if (gz) {
+                    payload = new Blob([gz]); // ArrayBuffer → valid BlobPart
+                    headers['content-encoding'] = 'gzip';
+                }
+            }
+            const res = await fetch(url, { method: 'POST', headers, body: payload, keepalive });
+            if (res.status === 403)
+                this.maybeEnterSuspended(res);
+            return res.ok ? res : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Arm the suspend backoff from a 403. Only the backend's workspace-suspend verdict
+     * (`code:'workspace_suspended'` or `enabled:false`) counts — any other 403 is ignored so a
+     * one-off authz error can't silently mute the SDK. Reads the JSON body when present, else falls
+     * back to the `Retry-After` header, else a 1h default. Best-effort: never throws into the caller.
+     */
+    maybeEnterSuspended(res) {
+        const headerSeconds = Number(res.headers.get('retry-after')) || 0;
+        void res
+            .clone()
+            .json()
+            .then((v) => {
+            const suspended = v?.code === 'workspace_suspended' || v?.enabled === false;
+            if (!suspended && !headerSeconds)
+                return;
+            const seconds = Number(v?.retryAfterSeconds) || headerSeconds || 3600;
+            this.suspendedUntil = Date.now() + seconds * 1000;
+        })
+            .catch(() => {
+            // No/unparseable body: trust an explicit Retry-After only.
+            if (headerSeconds)
+                this.suspendedUntil = Date.now() + headerSeconds * 1000;
+        });
+    }
+}
+// W4 4.6 — gzip payloads above this size. Tiny bodies don't benefit; replay/session batches (often
+// multi-KB to multi-MB of delta JSON) do. keepalive bodies are small + on the unload path, so they
+// stay uncompressed.
+HttpClient.GZIP_MIN_BYTES = 1024;
+//# sourceMappingURL=httpClient.js.map

package/dist/transport/httpClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpClient.js","sourceRoot":"","sources":["../../src/transport/httpClient.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAE9E;iFACiF;AACjF,MAAM,QAAQ,GAAG,OAAO,KAAK,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AA4BjF,MAAM,OAAO,UAAU;IACrB,YAA6B,MAAsB;QAAtB,WAAM,GAAN,MAAM,CAAgB;QAEnD;;;;;;;WAOG;QACK,mBAAc,GAAG,CAAC,CAAC;IAV2B,CAAC;IAY/C,WAAW;QACjB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC;IAC1C,CAAC;IAEO,OAAO;QACb,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;IAChG,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,aAAa,CAAC,IAAY;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,YAAY,CAAC,IAAiB;QAClC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,qBAAqB,EAAE;YAC9D,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;YACxB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,yFAAyF;YACzF,8FAA8F;YAC9F,2FAA2F;YAC3F,oDAAoD;YACpD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,OAAO;YAClD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;YACrD,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM;YAC5B,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ;YAChC;;;;;;;;;;eAUG;YACH,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,0BAA0B;YAC3E;;;;;;;;;;;;;;;;eAgBG;YACH,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO;YACpC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,SAAS,CACb,QAAyB,EACzB,IAA8B;QAE9B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,uBAAuB,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC;QAC3G,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC9B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,WAAW,CAAC;QACrG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,OAAgB;QACvD,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,cAAc,CAAC;QACxG,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC3B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;gBAC7C,IAAI,EAAE,UAAU;aACjB,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACzB,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAoB,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAOD;;;;;;OAMG;IACH;;;;;;;;;;OAUG;IACH,KAAK,CAAC,aAAa,CACjB,SAAiB,EACjB,MAAwD,EACxD,MAAiB;QAEjB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,iBAAiB,CAAC;QAC3G,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkB,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,IAAc,EAAE,WAAmB;QAC9D,IAAI,CAAC;YACH,gGAAgG;YAChG,6FAA6F;YAC7F,8FAA8F;YAC9F,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;YAC9G,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,IAAa,EAAE,SAAS,GAAG,KAAK;QAC9D,kEAAkE;QAClE,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,2DAA2D;YACjH,IAAI,OAAO,GAAa,UAAU,CAAC;YACnC,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,cAAc,EAAE,CAAC;gBAChE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,sCAAsC;gBACrF,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;gBACxC,IAAI,EAAE,EAAE,CAAC;oBACP,OAAO,GAAG,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,+BAA+B;oBACzD,OAAO,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC;gBACvC,CAAC;YACH,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YACpF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACtD,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,mBAAmB,CAAC,GAAa;QACvC,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC;QAClE,KAAK,GAAG;aACL,KAAK,EAAE;aACP,IAAI,EAAE;aACN,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE;YACf,MAAM,SAAS,GAAG,CAAC,EAAE,IAAI,KAAK,qBAAqB,IAAI,CAAC,EAAE,OAAO,KAAK,KAAK,CAAC;YAC5E,IAAI,CAAC,SAAS,IAAI,CAAC,aAAa;gBAAE,OAAO;YACzC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,EAAE,iBAAiB,CAAC,IAAI,aAAa,IAAI,IAAI,CAAC;YACtE,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC;QACpD,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACV,2DAA2D;YAC3D,IAAI,aAAa;gBAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,IAAI,CAAC;QAC7E,CAAC,CAAC,CAAC;IACP,CAAC;;AAvGD,mGAAmG;AACnG,mGAAmG;AACnG,qBAAqB;AACG,yBAAc,GAAG,IAAI,AAAP,CAAQ"}

package/dist/transport/index.d.ts

@@ -0,0 +1,3 @@
+/** transport/ — HTTP client + endpoints (POST /ingestion/sessions/:id/batch). */
+export * from './httpClient.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/transport/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,cAAc,cAAc,CAAC"}

package/dist/transport/index.js

@@ -0,0 +1,3 @@
+/** transport/ — HTTP client + endpoints (POST /ingestion/sessions/:id/batch). */
+export * from './httpClient.js';
+//# sourceMappingURL=index.js.map

package/dist/transport/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,cAAc,cAAc,CAAC"}