@scalebun-release/web 2.2.2

package/dist/transport/sign.d.ts

@@ -0,0 +1,25 @@
+/**
+ * HMAC batch signing (W1a) — tamper-evident ingestion. Produces `x-scalebun-signature` byte-identical to the
+ * RN SDK (`crypto/hmacSha256.ts`) and the backend verify (`sdk-key.guard.ts verifySignature`):
+ *
+ *   sig = hex( HMAC-SHA256( key = utf8(clientKey), message = utf8(exact request body string) ) )
+ *
+ * The client key ships in the bundle, so this is **integrity + casual-spoof raising + a fraud signal**
+ * (an invalid signature marks an attributed install `sdk_spoofing` server-side) — NOT authentication.
+ * No anti-replay (timestamp/nonce) in v1: RN parity; adding one is a coordinated RN+backend change.
+ *
+ * LAZY: imported only on the first flush (core-bundle headroom is tiny). Fail-open everywhere — signing
+ * must never block, drop, or delay a batch; a null return means "send unsigned" (the backend treats an
+ * absent signature as an old SDK, no penalty).
+ */
+/** Signing-scheme version → `x-scalebun-sdk-version` header (matches RN `SDK_SIGNING_VERSION`). */
+export declare const SDK_SIGNING_VERSION = "1";
+/**
+ * HMAC-SHA256 hex over the exact body string, keyed by the client key. Returns null when SubtleCrypto is
+ * unavailable (insecure `http://` origin, ancient browser) or on any failure — the caller then sends the
+ * batch unsigned. Never throws.
+ */
+export declare function signBody(clientKey: string, body: string): Promise<string | null>;
+/** Build the signing headers for a body, merged onto a base header set. Empty when signing is unavailable. */
+export declare function signatureHeaders(clientKey: string, body: string): Promise<Record<string, string>>;
+//# sourceMappingURL=sign.d.ts.map

package/dist/transport/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../src/transport/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,mGAAmG;AACnG,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAsBvC;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUtF;AAED,8GAA8G;AAC9G,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAGvG"}

package/dist/transport/sign.js

@@ -0,0 +1,58 @@
+/**
+ * HMAC batch signing (W1a) — tamper-evident ingestion. Produces `x-scalebun-signature` byte-identical to the
+ * RN SDK (`crypto/hmacSha256.ts`) and the backend verify (`sdk-key.guard.ts verifySignature`):
+ *
+ *   sig = hex( HMAC-SHA256( key = utf8(clientKey), message = utf8(exact request body string) ) )
+ *
+ * The client key ships in the bundle, so this is **integrity + casual-spoof raising + a fraud signal**
+ * (an invalid signature marks an attributed install `sdk_spoofing` server-side) — NOT authentication.
+ * No anti-replay (timestamp/nonce) in v1: RN parity; adding one is a coordinated RN+backend change.
+ *
+ * LAZY: imported only on the first flush (core-bundle headroom is tiny). Fail-open everywhere — signing
+ * must never block, drop, or delay a batch; a null return means "send unsigned" (the backend treats an
+ * absent signature as an old SDK, no penalty).
+ */
+/** Signing-scheme version → `x-scalebun-sdk-version` header (matches RN `SDK_SIGNING_VERSION`). */
+export const SDK_SIGNING_VERSION = '1';
+// Import the HMAC key once per clientKey (import is async + non-trivial; sign is called every flush).
+const keyCache = new Map();
+function importKey(subtle, clientKey) {
+    let p = keyCache.get(clientKey);
+    if (!p) {
+        p = subtle.importKey('raw', new TextEncoder().encode(clientKey), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+        // If the import rejects (shouldn't for HMAC/raw), drop it so a later call can retry rather than cache a rejection.
+        p.catch(() => keyCache.delete(clientKey));
+        keyCache.set(clientKey, p);
+    }
+    return p;
+}
+function toHex(bytes) {
+    let hex = '';
+    for (let i = 0; i < bytes.length; i++)
+        hex += bytes[i].toString(16).padStart(2, '0');
+    return hex;
+}
+/**
+ * HMAC-SHA256 hex over the exact body string, keyed by the client key. Returns null when SubtleCrypto is
+ * unavailable (insecure `http://` origin, ancient browser) or on any failure — the caller then sends the
+ * batch unsigned. Never throws.
+ */
+export async function signBody(clientKey, body) {
+    try {
+        const subtle = globalThis.crypto?.subtle;
+        if (!subtle || !clientKey)
+            return null;
+        const key = await importKey(subtle, clientKey);
+        const mac = await subtle.sign('HMAC', key, new TextEncoder().encode(body));
+        return toHex(new Uint8Array(mac));
+    }
+    catch {
+        return null;
+    }
+}
+/** Build the signing headers for a body, merged onto a base header set. Empty when signing is unavailable. */
+export async function signatureHeaders(clientKey, body) {
+    const sig = await signBody(clientKey, body);
+    return sig ? { 'x-scalebun-signature': sig, 'x-scalebun-sdk-version': SDK_SIGNING_VERSION } : {};
+}
+//# sourceMappingURL=sign.js.map

package/dist/transport/sign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../src/transport/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,mGAAmG;AACnG,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC,sGAAsG;AACtG,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAC;AAEvD,SAAS,SAAS,CAAC,MAAoB,EAAE,SAAiB;IACxD,IAAI,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QACrH,mHAAmH;QACnH,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1C,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,SAAiB,EAAE,IAAY;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAI,UAAU,CAAC,MAA6B,EAAE,MAAM,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3E,OAAO,KAAK,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8GAA8G;AAC9G,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,SAAiB,EAAE,IAAY;IACpE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,GAAG,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACnG,CAAC"}

package/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "@scalebun-release/web",
+  "version": "2.2.2",
+  "description": "The ScaleBun web SDK — unified-session observability for the browser (errors, network, performance, replay, sessions). Framework-agnostic core.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "unpkg": "./dist/scalebun.min.js",
+  "jsdelivr": "./dist/scalebun.min.js",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./inapp": {
+      "types": "./dist/inapp.d.ts",
+      "default": "./dist/inapp.js"
+    },
+    "./browser": {
+      "default": "./dist/scalebun.min.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "node scripts/gen-version.mjs && tsc -p tsconfig.json && node ../../scripts/fix-esm-extensions.mjs dist && node scripts/copy-assets.mjs && node scripts/build-browser.mjs",
+    "build:browser": "node scripts/build-browser.mjs",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "size:check": "node scripts/size-check.mjs",
+    "e2e:offline": "node e2e/offline.mjs",
+    "e2e:p4": "node e2e/p4-capture.mjs",
+    "e2e:inapp": "node e2e/inapp-render.mjs",
+    "e2e:p2": "node e2e/p2-capture-matrix.mjs",
+    "e2e:p4d": "node e2e/p4-keyframe-durability.mjs",
+    "e2e:p5": "node e2e/p5-capture-floor.mjs",
+    "e2e:p13": "node e2e/p13-post-change-cohort.mjs",
+    "e2e:layout": "node e2e/inapp-layout.mjs",
+    "gallery": "node scripts/variant-gallery.mjs",
+    "capture:golden": "node scripts/capture-golden.mjs"
+  },
+  "dependencies": {
+    "@scalebun/protocol": "npm:@scalebun-release/protocol@2.0.3",
+    "@scalebun/sdk-contracts": "npm:@scalebun-release/sdk-contracts@2.0.3"
+  },
+  "devDependencies": {
+    "esbuild": "^0.21.5",
+    "jsdom": "^25.0.0",
+    "typescript": "^5.6.0",
+    "vitest": "^2.1.0"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/scalebun/scalebun-web-sdk.git",
+    "directory": "packages/web"
+  },
+  "homepage": "https://scalebun.com/docs/web-sdk/install",
+  "bugs": {
+    "url": "https://github.com/scalebun/scalebun-web-sdk/issues"
+  }
+}