@scalebun/web 1.0.0

package/dist/core/consent.d.ts

@@ -0,0 +1,17 @@
+/**
+ * ConsentGate — tracks consent state and fires one-shot callbacks the first time consent is granted.
+ * Pure + dependency-free so the bootstrap activation logic stays unit-testable without a browser.
+ */
+export type ConsentStatus = 'granted' | 'denied' | 'unknown';
+export declare class ConsentGate {
+    private status;
+    private readonly onGrant;
+    constructor(initial?: ConsentStatus);
+    get value(): ConsentStatus;
+    get granted(): boolean;
+    /** Update consent. Granting (the first time) fires + clears the pending one-shot callbacks. */
+    set(status: ConsentStatus): void;
+    /** Run `cb` once, as soon as consent is (or becomes) granted. */
+    whenGranted(cb: () => void): void;
+}
+//# sourceMappingURL=consent.d.ts.map

package/dist/core/consent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.d.ts","sourceRoot":"","sources":["../../src/core/consent.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE7D,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;gBAErC,OAAO,GAAE,aAAyB;IAI9C,IAAI,KAAK,IAAI,aAAa,CAEzB;IAED,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,+FAA+F;IAC/F,GAAG,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAgBhC,iEAAiE;IACjE,WAAW,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI;CAOlC"}

package/dist/core/consent.js

@@ -0,0 +1,38 @@
+export class ConsentGate {
+    constructor(initial = 'unknown') {
+        this.onGrant = new Set();
+        this.status = initial;
+    }
+    get value() {
+        return this.status;
+    }
+    get granted() {
+        return this.status === 'granted';
+    }
+    /** Update consent. Granting (the first time) fires + clears the pending one-shot callbacks. */
+    set(status) {
+        const becameGranted = status === 'granted' && this.status !== 'granted';
+        this.status = status;
+        if (becameGranted) {
+            const cbs = [...this.onGrant];
+            this.onGrant.clear();
+            for (const cb of cbs) {
+                try {
+                    cb();
+                }
+                catch {
+                    /* a listener must never break the gate */
+                }
+            }
+        }
+    }
+    /** Run `cb` once, as soon as consent is (or becomes) granted. */
+    whenGranted(cb) {
+        if (this.granted) {
+            cb();
+            return;
+        }
+        this.onGrant.add(cb);
+    }
+}
+//# sourceMappingURL=consent.js.map

package/dist/core/consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.js","sourceRoot":"","sources":["../../src/core/consent.ts"],"names":[],"mappings":"AAMA,MAAM,OAAO,WAAW;IAItB,YAAY,UAAyB,SAAS;QAF7B,YAAO,GAAG,IAAI,GAAG,EAAc,CAAC;QAG/C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;IACxB,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;IACnC,CAAC;IAED,+FAA+F;IAC/F,GAAG,CAAC,MAAqB;QACvB,MAAM,aAAa,GAAG,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;QACxE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACrB,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;gBACrB,IAAI,CAAC;oBACH,EAAE,EAAE,CAAC;gBACP,CAAC;gBAAC,MAAM,CAAC;oBACP,0CAA0C;gBAC5C,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,WAAW,CAAC,EAAc;QACxB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,EAAE,EAAE,CAAC;YACL,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;CACF"}

package/dist/core/csp.d.ts

@@ -0,0 +1,31 @@
+/**
+ * CSP support — the ONE place the SDK's injected <style>/<script> pick up a nonce, so strict-CSP sites
+ * (script-src/style-src without 'unsafe-inline') work. Mirrors core/runtime.ts: tiny, import-safe,
+ * dependency-free, memoized.
+ *
+ * Bundle: only `setNonce`/`getNonce`/`applyNonce` are eager-reachable (the facade's init() calls
+ * setNonce). `applyNonce` is used by LAZY widget/injector code, so nothing heavy enters the eager core.
+ * (adoptedStyleSheets generalization lands in Phase 2.)
+ */
+/** Set the CSP nonce applied to injected <style>/<script>. No-ops on empty so callers can pass through
+ *  an absent config field. Source: init({ csp: { nonce } }) or the loader's auto-detect. */
+export declare function setNonce(value: string | null | undefined): void;
+/** The nonce currently applied to injected elements, or null when none is set. */
+export declare function getNonce(): string | null;
+/**
+ * Apply the CSP nonce to a freshly-created injected element (<style> or <script>). Uses the IDL
+ * property `el.nonce` — browsers HIDE the `nonce` attribute value (returns '' via getAttribute) but the
+ * property still applies for the CSP check. No-op when no nonce is set (so today's behavior is unchanged).
+ * Returns the element for chaining.
+ */
+export declare function applyNonce<T extends Element>(el: T): T;
+/**
+ * The ONE blessed way to inject CSS. Prefers **constructable stylesheets** (`adoptedStyleSheets`) on a
+ * Document/ShadowRoot — those are NOT subject to `style-src`, so they work under strict CSP with NO
+ * nonce at all. Falls back to a nonce'd `<style>` element where constructable sheets are unavailable
+ * (older Safari, jsdom). New injectors should use this so CSP "just works" without per-feature effort.
+ *
+ * Lazy-only (widget/injector code) — never referenced by eager init, so it stays out of the core bundle.
+ */
+export declare function injectStyle(root: Document | ShadowRoot | HTMLElement, css: string): void;
+//# sourceMappingURL=csp.d.ts.map

package/dist/core/csp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp.d.ts","sourceRoot":"","sources":["../../src/core/csp.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH;4FAC4F;AAC5F,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAE/D;AAED,kFAAkF;AAClF,wBAAgB,QAAQ,IAAI,MAAM,GAAG,IAAI,CAExC;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAStD;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,GAAG,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CA0BxF"}

package/dist/core/csp.js

@@ -0,0 +1,74 @@
+/**
+ * CSP support — the ONE place the SDK's injected <style>/<script> pick up a nonce, so strict-CSP sites
+ * (script-src/style-src without 'unsafe-inline') work. Mirrors core/runtime.ts: tiny, import-safe,
+ * dependency-free, memoized.
+ *
+ * Bundle: only `setNonce`/`getNonce`/`applyNonce` are eager-reachable (the facade's init() calls
+ * setNonce). `applyNonce` is used by LAZY widget/injector code, so nothing heavy enters the eager core.
+ * (adoptedStyleSheets generalization lands in Phase 2.)
+ */
+let nonce = null;
+/** Set the CSP nonce applied to injected <style>/<script>. No-ops on empty so callers can pass through
+ *  an absent config field. Source: init({ csp: { nonce } }) or the loader's auto-detect. */
+export function setNonce(value) {
+    if (value)
+        nonce = value;
+}
+/** The nonce currently applied to injected elements, or null when none is set. */
+export function getNonce() {
+    return nonce;
+}
+/**
+ * Apply the CSP nonce to a freshly-created injected element (<style> or <script>). Uses the IDL
+ * property `el.nonce` — browsers HIDE the `nonce` attribute value (returns '' via getAttribute) but the
+ * property still applies for the CSP check. No-op when no nonce is set (so today's behavior is unchanged).
+ * Returns the element for chaining.
+ */
+export function applyNonce(el) {
+    if (nonce) {
+        try {
+            el.nonce = nonce;
+        }
+        catch {
+            /* nonce is read-only on some engines — ignore */
+        }
+    }
+    return el;
+}
+/**
+ * The ONE blessed way to inject CSS. Prefers **constructable stylesheets** (`adoptedStyleSheets`) on a
+ * Document/ShadowRoot — those are NOT subject to `style-src`, so they work under strict CSP with NO
+ * nonce at all. Falls back to a nonce'd `<style>` element where constructable sheets are unavailable
+ * (older Safari, jsdom). New injectors should use this so CSP "just works" without per-feature effort.
+ *
+ * Lazy-only (widget/injector code) — never referenced by eager init, so it stays out of the core bundle.
+ */
+export function injectStyle(root, css) {
+    const canAdopt = typeof CSSStyleSheet !== 'undefined' &&
+        'adoptedStyleSheets' in root &&
+        (root instanceof Document || (typeof ShadowRoot !== 'undefined' && root instanceof ShadowRoot));
+    if (canAdopt) {
+        try {
+            const sheet = new CSSStyleSheet();
+            sheet.replaceSync(css);
+            const target = root;
+            target.adoptedStyleSheets = [...target.adoptedStyleSheets, sheet];
+            return;
+        }
+        catch {
+            /* not constructable in this engine — fall through to a nonce'd <style> */
+        }
+    }
+    const doc = root instanceof Document
+        ? root
+        : (root.ownerDocument ?? (typeof document !== 'undefined' ? document : null));
+    if (!doc)
+        return;
+    const style = applyNonce(doc.createElement('style'));
+    style.textContent = css;
+    // A Document node accepts only ONE element child (<html>), so a <style> must go into <head>, not the
+    // document itself. Shadow roots / elements take the <style> directly.
+    const target = root instanceof Document ? (root.head ?? root.documentElement ?? doc.body ?? root) : root;
+    target.appendChild(style);
+}
+//# sourceMappingURL=csp.js.map

package/dist/core/csp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp.js","sourceRoot":"","sources":["../../src/core/csp.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,IAAI,KAAK,GAAkB,IAAI,CAAC;AAEhC;4FAC4F;AAC5F,MAAM,UAAU,QAAQ,CAAC,KAAgC;IACvD,IAAI,KAAK;QAAE,KAAK,GAAG,KAAK,CAAC;AAC3B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,QAAQ;IACtB,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAoB,EAAK;IACjD,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACF,EAAoC,CAAC,KAAK,GAAG,KAAK,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,iDAAiD;QACnD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,IAAyC,EAAE,GAAW;IAChF,MAAM,QAAQ,GACZ,OAAO,aAAa,KAAK,WAAW;QACpC,oBAAoB,IAAI,IAAI;QAC5B,CAAC,IAAI,YAAY,QAAQ,IAAI,CAAC,OAAO,UAAU,KAAK,WAAW,IAAI,IAAI,YAAY,UAAU,CAAC,CAAC,CAAC;IAClG,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,aAAa,EAAE,CAAC;YAClC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,IAA0D,CAAC;YAC1E,MAAM,CAAC,kBAAkB,GAAG,CAAC,GAAG,MAAM,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,YAAY,QAAQ;QAClC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAE,IAA4C,CAAC,aAAa,IAAI,CAAC,OAAO,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACzH,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACrD,KAAK,CAAC,WAAW,GAAG,GAAG,CAAC;IACxB,qGAAqG;IACrG,sEAAsE;IACtE,MAAM,MAAM,GAAS,IAAI,YAAY,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,eAAe,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/G,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC"}

package/dist/core/evalContext.d.ts

@@ -0,0 +1,7 @@
+/** Merge attributes into the context (later writes win). No-op for non-objects. */
+export declare function patchEvalContext(patch: Record<string, unknown> | undefined): void;
+/** Current attributes flags/experiments target against. */
+export declare function getEvalContext(): Record<string, unknown>;
+/** Reset (logout) — clears user-scoped attributes but keeps the stable device attr. */
+export declare function clearEvalContext(): void;
+//# sourceMappingURL=evalContext.d.ts.map

package/dist/core/evalContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evalContext.d.ts","sourceRoot":"","sources":["../../src/core/evalContext.ts"],"names":[],"mappings":"AAQA,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,IAAI,CAEjF;AAED,2DAA2D;AAC3D,wBAAgB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAExD;AAED,uFAAuF;AACvF,wBAAgB,gBAAgB,IAAI,IAAI,CAGvC"}

package/dist/core/evalContext.js

@@ -0,0 +1,22 @@
+/**
+ * F0 — evaluation context. The flat attribute bag targeting rules evaluate against: identity traits
+ * (from identify), super-properties (register), group memberships, and device attributes. A tiny module
+ * singleton — like replayCoord — so ConfigFeature can read the current user context without coupling to
+ * AnalyticsFeature. Updated by the facade's identify/register/group and by ConfigFeature's setup.
+ */
+let ctx = {};
+/** Merge attributes into the context (later writes win). No-op for non-objects. */
+export function patchEvalContext(patch) {
+    if (patch && typeof patch === 'object')
+        ctx = { ...ctx, ...patch };
+}
+/** Current attributes flags/experiments target against. */
+export function getEvalContext() {
+    return ctx;
+}
+/** Reset (logout) — clears user-scoped attributes but keeps the stable device attr. */
+export function clearEvalContext() {
+    const deviceId = ctx.deviceId;
+    ctx = deviceId != null ? { deviceId } : {};
+}
+//# sourceMappingURL=evalContext.js.map

package/dist/core/evalContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evalContext.js","sourceRoot":"","sources":["../../src/core/evalContext.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,IAAI,GAAG,GAA4B,EAAE,CAAC;AAEtC,mFAAmF;AACnF,MAAM,UAAU,gBAAgB,CAAC,KAA0C;IACzE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;AACrE,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,cAAc;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9B,GAAG,GAAG,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7C,CAAC"}

package/dist/core/ids.d.ts

@@ -0,0 +1,6 @@
+/** Ids + time + device-id persistence. Dependency-free, SSR-safe. */
+export declare function uuid(): string;
+export declare function now(): number;
+/** Stable per-browser device id, persisted in localStorage when available. */
+export declare function getOrCreateDeviceId(): string;
+//# sourceMappingURL=ids.d.ts.map

package/dist/core/ids.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../../src/core/ids.ts"],"names":[],"mappings":"AAAA,qEAAqE;AAErE,wBAAgB,IAAI,IAAI,MAAM,CAU7B;AAED,wBAAgB,GAAG,IAAI,MAAM,CAE5B;AAID,8EAA8E;AAC9E,wBAAgB,mBAAmB,IAAI,MAAM,CAa5C"}

package/dist/core/ids.js

@@ -0,0 +1,35 @@
+/** Ids + time + device-id persistence. Dependency-free, SSR-safe. */
+export function uuid() {
+    const c = typeof crypto !== 'undefined' ? crypto : undefined;
+    if (c && typeof c.randomUUID === 'function')
+        return c.randomUUID();
+    // Non-crypto fallback (ancient browsers / SSR). Uses performance.now for some entropy.
+    const seed = typeof performance !== 'undefined' ? performance.now() : 0;
+    return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (ch) => {
+        const r = (Math.floor(seed) + Math.floor(Math.random() * 16)) % 16;
+        const v = ch === 'x' ? r : (r & 0x3) | 0x8;
+        return v.toString(16);
+    });
+}
+export function now() {
+    return Date.now();
+}
+const DEVICE_ID_KEY = 'scalebun_device_id';
+/** Stable per-browser device id, persisted in localStorage when available. */
+export function getOrCreateDeviceId() {
+    try {
+        if (typeof localStorage !== 'undefined') {
+            const existing = localStorage.getItem(DEVICE_ID_KEY);
+            if (existing)
+                return existing;
+            const id = `web_${uuid()}`;
+            localStorage.setItem(DEVICE_ID_KEY, id);
+            return id;
+        }
+    }
+    catch {
+        /* storage blocked (private mode / partitioned) → ephemeral id */
+    }
+    return `web_${uuid()}`;
+}
+//# sourceMappingURL=ids.js.map

package/dist/core/ids.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../../src/core/ids.ts"],"names":[],"mappings":"AAAA,qEAAqE;AAErE,MAAM,UAAU,IAAI;IAClB,MAAM,CAAC,GAAuB,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC,UAAU,EAAE,CAAC;IACnE,uFAAuF;IACvF,MAAM,IAAI,GAAG,OAAO,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,sCAAsC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE;QACpE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;QACnE,MAAM,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;QAC3C,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,GAAG;IACjB,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAE3C,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC;QACH,IAAI,OAAO,YAAY,KAAK,WAAW,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACrD,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC9B,MAAM,EAAE,GAAG,OAAO,IAAI,EAAE,EAAE,CAAC;YAC3B,YAAY,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;YACxC,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;IACD,OAAO,OAAO,IAAI,EAAE,EAAE,CAAC;AACzB,CAAC"}

package/dist/core/index.d.ts

@@ -0,0 +1,15 @@
+/** core/ — DI-free shared primitives: ids, logger, lifecycle, page-context, redaction. */
+export * from './ids';
+export * from './logger';
+export * from './lifecycle';
+export * from './pageContext';
+export * from './redact';
+export * from './observe';
+export * from './consent';
+export * from './breadcrumbs';
+export * from './replayCoord';
+export * from './evalContext';
+export * from './runtime';
+export * from './capabilities';
+export * from './csp';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,cAAc,OAAO,CAAC;AACtB,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,OAAO,CAAC"}

package/dist/core/index.js

@@ -0,0 +1,15 @@
+/** core/ — DI-free shared primitives: ids, logger, lifecycle, page-context, redaction. */
+export * from './ids';
+export * from './logger';
+export * from './lifecycle';
+export * from './pageContext';
+export * from './redact';
+export * from './observe';
+export * from './consent';
+export * from './breadcrumbs';
+export * from './replayCoord';
+export * from './evalContext';
+export * from './runtime';
+export * from './capabilities';
+export * from './csp';
+//# sourceMappingURL=index.js.map

package/dist/core/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,cAAc,OAAO,CAAC;AACtB,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,OAAO,CAAC"}

package/dist/core/lifecycle.d.ts

@@ -0,0 +1,4 @@
+/** Crash-safe wrappers — the SDK must never throw into the host app. */
+export declare function noThrow<T extends (...args: any[]) => any>(fn: T, onError?: (e: unknown) => void): T;
+export declare function safeAsync<T extends (...args: any[]) => Promise<any>>(fn: T, onError?: (e: unknown) => void): T;
+//# sourceMappingURL=lifecycle.d.ts.map

package/dist/core/lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../src/core/lifecycle.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE,wBAAgB,OAAO,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,IAAI,GAAG,CAAC,CASnG;AAED,wBAAgB,SAAS,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,EAClE,EAAE,EAAE,CAAC,EACL,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,IAAI,GAC7B,CAAC,CASH"}

package/dist/core/lifecycle.js

@@ -0,0 +1,24 @@
+/** Crash-safe wrappers — the SDK must never throw into the host app. */
+export function noThrow(fn, onError) {
+    return ((...args) => {
+        try {
+            return fn(...args);
+        }
+        catch (e) {
+            onError?.(e);
+            return undefined;
+        }
+    });
+}
+export function safeAsync(fn, onError) {
+    return (async (...args) => {
+        try {
+            return await fn(...args);
+        }
+        catch (e) {
+            onError?.(e);
+            return undefined;
+        }
+    });
+}
+//# sourceMappingURL=lifecycle.js.map

package/dist/core/lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../../src/core/lifecycle.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE,MAAM,UAAU,OAAO,CAAoC,EAAK,EAAE,OAA8B;IAC9F,OAAO,CAAC,CAAC,GAAG,IAAW,EAAE,EAAE;QACzB,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACb,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAM,CAAC;AACV,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,EAAK,EACL,OAA8B;IAE9B,OAAO,CAAC,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE;QAC/B,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACb,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAM,CAAC;AACV,CAAC"}

package/dist/core/logger.d.ts

@@ -0,0 +1,12 @@
+/** Debug-gated logger. No-op unless `debug` is enabled in config. */
+export interface Logger {
+    (...args: unknown[]): void;
+}
+/**
+ * The prefix every SDK diagnostic log carries as `args[0]`. The console feature's feedback-loop guard
+ * skips logs starting with this exact value — keep the two bound together (don't inline the literal in
+ * either place, or they can drift and the console feature starts capturing its own diagnostics).
+ */
+export declare const WZB_LOG_PREFIX = "[scalebun]";
+export declare function createLogger(debug: boolean): Logger;
+//# sourceMappingURL=logger.d.ts.map

package/dist/core/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/core/logger.ts"],"names":[],"mappings":"AAAA,qEAAqE;AAErE,MAAM,WAAW,MAAM;IACrB,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;CAC5B;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,eAAe,CAAC;AAE3C,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAInD"}

package/dist/core/logger.js

@@ -0,0 +1,14 @@
+/** Debug-gated logger. No-op unless `debug` is enabled in config. */
+/**
+ * The prefix every SDK diagnostic log carries as `args[0]`. The console feature's feedback-loop guard
+ * skips logs starting with this exact value — keep the two bound together (don't inline the literal in
+ * either place, or they can drift and the console feature starts capturing its own diagnostics).
+ */
+export const WZB_LOG_PREFIX = '[scalebun]';
+export function createLogger(debug) {
+    return (...args) => {
+        if (debug && typeof console !== 'undefined')
+            console.info(WZB_LOG_PREFIX, ...args);
+    };
+}
+//# sourceMappingURL=logger.js.map

package/dist/core/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/core/logger.ts"],"names":[],"mappings":"AAAA,qEAAqE;AAMrE;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC;AAE3C,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;QAC5B,IAAI,KAAK,IAAI,OAAO,OAAO,KAAK,WAAW;YAAE,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,CAAC;IACrF,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/observe.d.ts

@@ -0,0 +1,3 @@
+/** Safely subscribe to a PerformanceObserver entry type. Unsupported types just no-op. */
+export declare function safeObserve(type: string, cb: (entries: PerformanceEntryList) => void, init?: PerformanceObserverInit): () => void;
+//# sourceMappingURL=observe.d.ts.map

package/dist/core/observe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"observe.d.ts","sourceRoot":"","sources":["../../src/core/observe.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAI1F,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,IAAI,EAC3C,IAAI,CAAC,EAAE,uBAAuB,GAC7B,MAAM,IAAI,CAeZ"}

package/dist/core/observe.js

@@ -0,0 +1,22 @@
+/** Safely subscribe to a PerformanceObserver entry type. Unsupported types just no-op. */
+import { can } from './capabilities'; // sibling import (not the barrel) to avoid a core/index cycle
+export function safeObserve(type, cb, init) {
+    if (!can('performanceObserver'))
+        return () => { };
+    try {
+        const po = new PerformanceObserver((list) => cb(list.getEntries()));
+        po.observe({ type, buffered: true, ...init });
+        return () => {
+            try {
+                po.disconnect();
+            }
+            catch {
+                /* ignore */
+            }
+        };
+    }
+    catch {
+        return () => { }; // entry type not supported in this browser
+    }
+}
+//# sourceMappingURL=observe.js.map

package/dist/core/observe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"observe.js","sourceRoot":"","sources":["../../src/core/observe.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAE1F,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC,CAAC,8DAA8D;AAEpG,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,EAA2C,EAC3C,IAA8B;IAE9B,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,IAAI,mBAAmB,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACpE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,EAA6B,CAAC,CAAC;QACzE,OAAO,GAAG,EAAE;YACV,IAAI,CAAC;gBACH,EAAE,CAAC,UAAU,EAAE,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,2CAA2C;IAC9D,CAAC;AACH,CAAC"}

package/dist/core/pageContext.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Builds the envelope header blocks (client/device/app/context) from the browser environment.
+ * Pure reads of navigator/location/Intl — all best-effort and SSR-safe.
+ */
+import type { ClientInfo, DeviceInfo, AppInfo, ContextInfo } from '@scalebun/protocol';
+import type { ResolvedConfig } from '../config/schema';
+export declare const SDK_NAME = "@scalebun/web";
+export declare const SDK_VERSION: string;
+export declare function buildClient(): ClientInfo;
+export declare function buildDevice(deviceId: string): DeviceInfo;
+export declare function buildApp(config: ResolvedConfig): AppInfo;
+export declare function buildContext(): ContextInfo;
+//# sourceMappingURL=pageContext.d.ts.map

package/dist/core/pageContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pageContext.d.ts","sourceRoot":"","sources":["../../src/core/pageContext.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAKvD,eAAO,MAAM,QAAQ,kBAAkB,CAAC;AACxC,eAAO,MAAM,WAAW,EAAE,MAAqF,CAAC;AAEhH,wBAAgB,WAAW,IAAI,UAAU,CAExC;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAUxD;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAExD;AAED,wBAAgB,YAAY,IAAI,WAAW,CAa1C"}

package/dist/core/pageContext.js

@@ -0,0 +1,73 @@
+/**
+ * Builds the envelope header blocks (client/device/app/context) from the browser environment.
+ * Pure reads of navigator/location/Intl — all best-effort and SSR-safe.
+ */
+export const SDK_NAME = '@scalebun/web';
+export const SDK_VERSION = typeof __SCALEBUN_VERSION__ !== 'undefined' ? __SCALEBUN_VERSION__ : '0.0.0';
+export function buildClient() {
+    return { platform: 'web', renderer: 'dom', sdk: { name: SDK_NAME, version: SDK_VERSION } };
+}
+export function buildDevice(deviceId) {
+    const ua = typeof navigator !== 'undefined' ? navigator.userAgent : '';
+    const { browser, os } = parseUserAgent(ua);
+    return {
+        id: deviceId,
+        browser: browser.name,
+        browserVersion: browser.version,
+        os: os.name,
+        osVersion: os.version,
+    };
+}
+export function buildApp(config) {
+    return { version: config.appVersion, environment: config.environment, release: config.release };
+}
+export function buildContext() {
+    const ctx = {};
+    try {
+        if (typeof navigator !== 'undefined')
+            ctx.locale = navigator.language;
+        ctx.timezone = Intl.DateTimeFormat().resolvedOptions().timeZone;
+        if (typeof location !== 'undefined')
+            ctx.url = location.href;
+        if (typeof window !== 'undefined')
+            ctx.viewport = { width: window.innerWidth, height: window.innerHeight };
+        const conn = navigator?.connection;
+        if (conn?.effectiveType)
+            ctx.networkType = conn.effectiveType;
+    }
+    catch {
+        /* best-effort */
+    }
+    return ctx;
+}
+/** Allocation-light UA parse — good enough for a "Chrome on macOS"-style label. */
+function parseUserAgent(ua) {
+    const browser = {};
+    const os = {};
+    const b = /(Edg|OPR|Chrome|Firefox|Safari)\/([\d.]+)/.exec(ua);
+    if (b && b[1]) {
+        browser.name = { Edg: 'Edge', OPR: 'Opera' }[b[1]] ?? b[1];
+        browser.version = b[2]?.split('.')[0];
+    }
+    if (/Windows NT ([\d.]+)/.test(ua)) {
+        os.name = 'Windows';
+        os.version = /Windows NT ([\d.]+)/.exec(ua)?.[1];
+    }
+    else if (/Mac OS X ([\d_]+)/.test(ua)) {
+        os.name = 'macOS';
+        os.version = /Mac OS X ([\d_]+)/.exec(ua)?.[1]?.replace(/_/g, '.');
+    }
+    else if (/Android ([\d.]+)/.test(ua)) {
+        os.name = 'Android';
+        os.version = /Android ([\d.]+)/.exec(ua)?.[1];
+    }
+    else if (/(iPhone|iPad).+OS ([\d_]+)/.test(ua)) {
+        os.name = 'iOS';
+        os.version = /OS ([\d_]+)/.exec(ua)?.[1]?.replace(/_/g, '.');
+    }
+    else if (/Linux/.test(ua)) {
+        os.name = 'Linux';
+    }
+    return { browser, os };
+}
+//# sourceMappingURL=pageContext.js.map

package/dist/core/pageContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pageContext.js","sourceRoot":"","sources":["../../src/core/pageContext.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,MAAM,CAAC,MAAM,QAAQ,GAAG,eAAe,CAAC;AACxC,MAAM,CAAC,MAAM,WAAW,GAAW,OAAO,oBAAoB,KAAK,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC;AAEhH,MAAM,UAAU,WAAW;IACzB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,MAAM,EAAE,GAAG,OAAO,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;IAC3C,OAAO;QACL,EAAE,EAAE,QAAQ;QACZ,OAAO,EAAE,OAAO,CAAC,IAAI;QACrB,cAAc,EAAE,OAAO,CAAC,OAAO;QAC/B,EAAE,EAAE,EAAE,CAAC,IAAI;QACX,SAAS,EAAE,EAAE,CAAC,OAAO;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAsB;IAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AAClG,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,IAAI,OAAO,SAAS,KAAK,WAAW;YAAE,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC;QACtE,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC;QAChE,IAAI,OAAO,QAAQ,KAAK,WAAW;YAAE,GAAG,CAAC,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC7D,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,GAAG,CAAC,QAAQ,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QAC3G,MAAM,IAAI,GAAI,SAAoE,EAAE,UAAU,CAAC;QAC/F,IAAI,IAAI,EAAE,aAAa;YAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,SAAS,cAAc,CAAC,EAAU;IAIhC,MAAM,OAAO,GAAwC,EAAE,CAAC;IACxD,MAAM,EAAE,GAAwC,EAAE,CAAC;IAEnD,MAAM,CAAC,GAAG,2CAA2C,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACd,OAAO,CAAC,IAAI,GAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAA6B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACnC,EAAE,CAAC,IAAI,GAAG,SAAS,CAAC;QACpB,EAAE,CAAC,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;SAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACxC,EAAE,CAAC,IAAI,GAAG,OAAO,CAAC;QAClB,EAAE,CAAC,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;SAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACvC,EAAE,CAAC,IAAI,GAAG,SAAS,CAAC;QACpB,EAAE,CAAC,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;SAAM,IAAI,4BAA4B,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACjD,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC;QAChB,EAAE,CAAC,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5B,EAAE,CAAC,IAAI,GAAG,OAAO,CAAC;IACpB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AACzB,CAAC"}

package/dist/core/prune.d.ts

@@ -0,0 +1,7 @@
+/** Keep only items younger than the max age (by getTime). Items with no timestamp are kept. */
+export declare function freshOnly<T>(items: T[], getTime: (it: T) => number | undefined, nowMs: number): T[];
+/** Trim a queue to the persisted-byte budget: shed heavy (replay-frame) items first, then oldest.
+ *  Always returns a fresh array (a synchronous snapshot) so the async IDB write can't capture a
+ *  reference that a concurrent flush() splices out from under it (pagehide save-vs-flush race). */
+export declare function capBytes<T>(items: T[], isHeavy?: (it: T) => boolean): T[];
+//# sourceMappingURL=prune.d.ts.map

package/dist/core/prune.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prune.d.ts","sourceRoot":"","sources":["../../src/core/prune.ts"],"names":[],"mappings":"AAcA,+FAA+F;AAC/F,wBAAgB,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC,EAAE,CAKnG;AAED;;mGAEmG;AACnG,wBAAgB,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,OAAO,GAAG,CAAC,EAAE,CAKzE"}

package/dist/core/prune.js

@@ -0,0 +1,31 @@
+/**
+ * Bounds for the PERSISTED egress buffer (IndexedDB), shared by both lanes. Keeps unsent data
+ * durable without letting it grow unbounded or replay data the app sat on for days. Zero deps.
+ *
+ * - freshOnly: applied when DRAINING — drop items older than the max age so a reload doesn't replay
+ *   stale data.
+ * - capBytes: applied when SAVING — trim to a byte budget (shed heavy replay frames first, then
+ *   oldest) so a few large frames can't blow the IndexedDB quota.
+ */
+const MAX_AGE_MS = 24 * 60 * 60 * 1000; // 24h
+const MAX_BYTES = 2000000; // ~2MB — well under typical IndexedDB quotas
+const size = (items) => JSON.stringify(items).length;
+/** Keep only items younger than the max age (by getTime). Items with no timestamp are kept. */
+export function freshOnly(items, getTime, nowMs) {
+    return items.filter((it) => {
+        const t = getTime(it);
+        return t == null || nowMs - t <= MAX_AGE_MS;
+    });
+}
+/** Trim a queue to the persisted-byte budget: shed heavy (replay-frame) items first, then oldest.
+ *  Always returns a fresh array (a synchronous snapshot) so the async IDB write can't capture a
+ *  reference that a concurrent flush() splices out from under it (pagehide save-vs-flush race). */
+export function capBytes(items, isHeavy) {
+    if (size(items) <= MAX_BYTES)
+        return items.slice();
+    let kept = isHeavy ? items.filter((it) => !isHeavy(it)) : items.slice();
+    while (kept.length && size(kept) > MAX_BYTES)
+        kept.shift();
+    return kept;
+}
+//# sourceMappingURL=prune.js.map

package/dist/core/prune.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prune.js","sourceRoot":"","sources":["../../src/core/prune.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,MAAM;AAC9C,MAAM,SAAS,GAAG,OAAS,CAAC,CAAC,6CAA6C;AAE1E,MAAM,IAAI,GAAG,CAAC,KAAgB,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;AAExE,+FAA+F;AAC/F,MAAM,UAAU,SAAS,CAAI,KAAU,EAAE,OAAsC,EAAE,KAAa;IAC5F,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;QACzB,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QACtB,OAAO,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,UAAU,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;mGAEmG;AACnG,MAAM,UAAU,QAAQ,CAAI,KAAU,EAAE,OAA4B;IAClE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;IACnD,IAAI,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACxE,OAAO,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS;QAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/core/redact.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Shared text redaction. A minimal, dependency-free scrub used by features that ship free-text
+ * (errors, console) so they never drift. Deliberately light — strips the obvious PII/secrets that
+ * must never leave the client by default; a full redaction policy can deepen later. The network
+ * feature has its own structured (header/body) denylist; this is for human-readable strings.
+ */
+/** Strip obvious emails + long opaque tokens from a free-text string. */
+export declare function scrubText(msg: string): string;
+/**
+ * Scrub PII/secrets from a structured props object (analytics `track()` props, super-properties).
+ * Denylisted KEYS → fully redacted; string VALUES → emails + long digit runs stripped. Bounded
+ * depth/breadth (cycle- & blowup-safe); returns a NEW value, never mutates the caller's object.
+ */
+export declare function scrubProps<T>(value: T, depth?: number): T;
+//# sourceMappingURL=redact.d.ts.map

package/dist/core/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/core/redact.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,yEAAyE;AACzE,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAI7C;AAaD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,SAAI,GAAG,CAAC,CAkBpD"}