better-ship 0.13.0 → 0.14.0

package/dist/sentry/client.d.ts

@@ -0,0 +1,22 @@
+import { f as LoggerErrorHook } from "../index-G1QG0P5g.js";
+import * as Sentry from "@sentry/tanstackstart-react";
+//#region src/infrastructure/sentry/client.d.ts
+/** Application settings use Sentry's names; enablement and environment belong to the application. */
+export type SentryClientOptions = Sentry.BrowserOptions & {
+  readonly dsn: string;
+  readonly environment: string;
+  readonly enabled: boolean;
+};
+/** Privacy defaults from Porte and browser noise filtering from Typist; explicit SDK options take precedence. */
+export declare function createSentryClientOptions(options: SentryClientOptions): Sentry.BrowserOptions;
+/** Forward logged browser errors once, excluding TanStack navigation control flow. */
+export declare function createSentryLoggerErrorHook(): LoggerErrorHook;
+/** Initialize once in the browser entrypoint before hydration; server imports have no side effects. */
+export declare function initializeSentry(options: SentryClientOptions): ReturnType<typeof Sentry.init>;
+/** Attach tracing once after creating the browser router, as Porte does in getRouter. */
+export declare function instrumentSentryRouter(router: Parameters<typeof Sentry.tanstackRouterBrowserTracingIntegration>[0]): void;
+/** The SDK error boundary; the application supplies its fallback component. */
+export declare const ErrorBoundary: typeof Sentry.ErrorBoundary;
+//#endregion
+export { Sentry };
+//# sourceMappingURL=client.d.ts.map

package/dist/sentry/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","names":[],"sources":["../../src/infrastructure/sentry/client.ts"],"mappings":";;;;YAMY,sBAAsB,OAAO;WAC9B;WACA;WACA;;;wBAIK,0BAA0B,SAAS,sBAAsB,OAAO;;wBAehE,+BAA+B;;wBAS/B,iBAAiB,SAAS,sBAAsB,kBAAkB,OAAO;;wBAOzE,uBACd,QAAQ,kBAAkB,OAAO;;qBAOtB,sBAAsB,OAAO"}

package/dist/sentry/client.js

@@ -0,0 +1,48 @@
+import { s as setLoggerErrorHook } from "../core-hdaNiCOU.js";
+import * as Sentry from "@sentry/tanstackstart-react";
+import { isNotFound, isRedirect } from "@tanstack/react-router";
+
+//#region src/infrastructure/sentry/client.ts
+/** Privacy defaults from Porte and browser noise filtering from Typist; explicit SDK options take precedence. */
+function createSentryClientOptions(options) {
+	return {
+		enableLogs: true,
+		ignoreErrors: [/Failed to execute '(insertBefore|removeChild)' on 'Node'/],
+		...options,
+		dataCollection: {
+			userInfo: false,
+			httpBodies: [],
+			...options.dataCollection,
+			genAI: {
+				inputs: false,
+				outputs: false,
+				...options.dataCollection?.genAI
+			}
+		}
+	};
+}
+/** Forward logged browser errors once, excluding TanStack navigation control flow. */
+function createSentryLoggerErrorHook() {
+	return ({ error, context }) => {
+		if (isNotFound(error) || isRedirect(error)) return;
+		const captured = error instanceof Error ? error : /* @__PURE__ */ new Error("Logger received a non-Error value");
+		Sentry.captureException(captured, { extra: context });
+	};
+}
+/** Initialize once in the browser entrypoint before hydration; server imports have no side effects. */
+function initializeSentry(options) {
+	const client = Sentry.init(createSentryClientOptions(options));
+	setLoggerErrorHook(createSentryLoggerErrorHook());
+	return client;
+}
+/** Attach tracing once after creating the browser router, as Porte does in getRouter. */
+function instrumentSentryRouter(router) {
+	if (router.isServer) return;
+	Sentry.addIntegration(Sentry.tanstackRouterBrowserTracingIntegration(router));
+}
+/** The SDK error boundary; the application supplies its fallback component. */
+const ErrorBoundary = Sentry.ErrorBoundary;
+
+//#endregion
+export { ErrorBoundary, Sentry, createSentryClientOptions, createSentryLoggerErrorHook, initializeSentry, instrumentSentryRouter };
+//# sourceMappingURL=client.js.map

package/dist/sentry/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","names":[],"sources":["../../src/infrastructure/sentry/client.ts"],"sourcesContent":["import * as Sentry from '@sentry/tanstackstart-react'\nimport { isNotFound, isRedirect } from '@tanstack/react-router'\n\nimport { setLoggerErrorHook, type LoggerErrorHook } from '@/core'\n\n/** Application settings use Sentry's names; enablement and environment belong to the application. */\nexport type SentryClientOptions = Sentry.BrowserOptions & {\n  readonly dsn: string\n  readonly environment: string\n  readonly enabled: boolean\n}\n\n/** Privacy defaults from Porte and browser noise filtering from Typist; explicit SDK options take precedence. */\nexport function createSentryClientOptions(options: SentryClientOptions): Sentry.BrowserOptions {\n  return {\n    enableLogs: true,\n    ignoreErrors: [/Failed to execute '(insertBefore|removeChild)' on 'Node'/],\n    ...options,\n    dataCollection: {\n      userInfo: false,\n      httpBodies: [],\n      ...options.dataCollection,\n      genAI: { inputs: false, outputs: false, ...options.dataCollection?.genAI },\n    },\n  }\n}\n\n/** Forward logged browser errors once, excluding TanStack navigation control flow. */\nexport function createSentryLoggerErrorHook(): LoggerErrorHook {\n  return ({ error, context }) => {\n    if (isNotFound(error) || isRedirect(error)) return\n    const captured = error instanceof Error ? error : new Error('Logger received a non-Error value')\n    Sentry.captureException(captured, { extra: context })\n  }\n}\n\n/** Initialize once in the browser entrypoint before hydration; server imports have no side effects. */\nexport function initializeSentry(options: SentryClientOptions): ReturnType<typeof Sentry.init> {\n  const client = Sentry.init(createSentryClientOptions(options))\n  setLoggerErrorHook(createSentryLoggerErrorHook())\n  return client\n}\n\n/** Attach tracing once after creating the browser router, as Porte does in getRouter. */\nexport function instrumentSentryRouter(\n  router: Parameters<typeof Sentry.tanstackRouterBrowserTracingIntegration>[0],\n): void {\n  if (router.isServer) return\n  Sentry.addIntegration(Sentry.tanstackRouterBrowserTracingIntegration(router))\n}\n\n/** The SDK error boundary; the application supplies its fallback component. */\nexport const ErrorBoundary: typeof Sentry.ErrorBoundary = Sentry.ErrorBoundary\n\nexport { Sentry }\n"],"mappings":";;;;;;AAaA,SAAgB,0BAA0B,SAAqD;CAC7F,OAAO;EACL,YAAY;EACZ,cAAc,CAAC,0DAA0D;EACzE,GAAG;EACH,gBAAgB;GACd,UAAU;GACV,YAAY,CAAC;GACb,GAAG,QAAQ;GACX,OAAO;IAAE,QAAQ;IAAO,SAAS;IAAO,GAAG,QAAQ,gBAAgB;GAAM;EAC3E;CACF;AACF;;AAGA,SAAgB,8BAA+C;CAC7D,QAAQ,EAAE,OAAO,cAAc;EAC7B,IAAI,WAAW,KAAK,KAAK,WAAW,KAAK,GAAG;EAC5C,MAAM,WAAW,iBAAiB,QAAQ,wBAAQ,IAAI,MAAM,mCAAmC;EAC/F,OAAO,iBAAiB,UAAU,EAAE,OAAO,QAAQ,CAAC;CACtD;AACF;;AAGA,SAAgB,iBAAiB,SAA8D;CAC7F,MAAM,SAAS,OAAO,KAAK,0BAA0B,OAAO,CAAC;CAC7D,mBAAmB,4BAA4B,CAAC;CAChD,OAAO;AACT;;AAGA,SAAgB,uBACd,QACM;CACN,IAAI,OAAO,UAAU;CACrB,OAAO,eAAe,OAAO,wCAAwC,MAAM,CAAC;AAC9E;;AAGA,MAAa,gBAA6C,OAAO"}

package/dist/sentry/server.d.ts

@@ -0,0 +1,24 @@
+import { f as LoggerErrorHook } from "../index-G1QG0P5g.js";
+import { H as ObservabilityScope, U as ObservabilityService, W as ObservabilityUser } from "../index-C28HgVfY.js";
+import * as Sentry from "@sentry/cloudflare";
+//#region src/infrastructure/sentry/server.d.ts
+/** Application-owned deployment settings with the full Cloudflare SDK option contract. */
+export type SentryServerOptions = Sentry.CloudflareOptions & {
+  readonly dsn: string;
+  readonly environment: string;
+  readonly enabled: boolean;
+};
+/** Options for Workers, Durable Objects, and Workflows, ported from Typist and Porte. */
+export declare function createSentryOptions(options: SentryServerOptions): Sentry.CloudflareOptions;
+/** Register with setLoggerErrorHook once at startup; an explicit user applies only to this report. */
+export declare function createSentryLoggerErrorHook(): LoggerErrorHook;
+/** Identity and scope adapter from Typist and Porte; call inside Sentry's instrumented runtime. */
+export declare class SentryObservabilityService implements ObservabilityService {
+  /** Attribute subsequent reports in the current isolation scope. */
+  setUser(user: ObservabilityUser): void;
+  /** Await work in a separate scope for each queue message or concurrent operation. */
+  withIsolationScope<T>(callback: (scope: ObservabilityScope) => T | Promise<T>): Promise<T>;
+}
+//#endregion
+export { Sentry };
+//# sourceMappingURL=server.d.ts.map

package/dist/sentry/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","names":[],"sources":["../../src/infrastructure/sentry/server.ts"],"mappings":";;;;;YAMY,sBAAsB,OAAO;WAC9B;WACA;WACA;;;wBAIK,oBAAoB,SAAS,sBAAsB,OAAO;;wBAc1D,+BAA+B;;qBAWlC,sCAAsC;;EAEjD,QAAQ,MAAM;;EAKR,mBAAmB,GAAG,WAAW,OAAO,uBAAuB,IAAI,QAAQ,KAAK,QAAQ"}

package/dist/sentry/server.js

@@ -0,0 +1,48 @@
+import * as Sentry from "@sentry/cloudflare";
+
+//#region src/infrastructure/sentry/server.ts
+/** Options for Workers, Durable Objects, and Workflows, ported from Typist and Porte. */
+function createSentryOptions(options) {
+	return {
+		enableLogs: true,
+		...options,
+		dataCollection: {
+			userInfo: false,
+			httpBodies: [],
+			...options.dataCollection,
+			genAI: {
+				inputs: false,
+				outputs: false,
+				...options.dataCollection?.genAI
+			}
+		}
+	};
+}
+/** Register with setLoggerErrorHook once at startup; an explicit user applies only to this report. */
+function createSentryLoggerErrorHook() {
+	return ({ error, distinctId, context }) => {
+		if (distinctId !== void 0) {
+			Sentry.captureException(error, {
+				extra: context,
+				user: { id: distinctId }
+			});
+			return;
+		}
+		Sentry.captureException(error, { extra: context });
+	};
+}
+/** Identity and scope adapter from Typist and Porte; call inside Sentry's instrumented runtime. */
+var SentryObservabilityService = class {
+	/** Attribute subsequent reports in the current isolation scope. */
+	setUser(user) {
+		Sentry.setUser(user);
+	}
+	/** Await work in a separate scope for each queue message or concurrent operation. */
+	async withIsolationScope(callback) {
+		return await Sentry.withIsolationScope(callback);
+	}
+};
+
+//#endregion
+export { Sentry, SentryObservabilityService, createSentryLoggerErrorHook, createSentryOptions };
+//# sourceMappingURL=server.js.map

package/dist/sentry/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","names":[],"sources":["../../src/infrastructure/sentry/server.ts"],"sourcesContent":["import * as Sentry from '@sentry/cloudflare'\n\nimport type { ObservabilityScope, ObservabilityService, ObservabilityUser } from '@/application'\nimport type { LoggerErrorHook } from '@/core'\n\n/** Application-owned deployment settings with the full Cloudflare SDK option contract. */\nexport type SentryServerOptions = Sentry.CloudflareOptions & {\n  readonly dsn: string\n  readonly environment: string\n  readonly enabled: boolean\n}\n\n/** Options for Workers, Durable Objects, and Workflows, ported from Typist and Porte. */\nexport function createSentryOptions(options: SentryServerOptions): Sentry.CloudflareOptions {\n  return {\n    enableLogs: true,\n    ...options,\n    dataCollection: {\n      userInfo: false,\n      httpBodies: [],\n      ...options.dataCollection,\n      genAI: { inputs: false, outputs: false, ...options.dataCollection?.genAI },\n    },\n  }\n}\n\n/** Register with setLoggerErrorHook once at startup; an explicit user applies only to this report. */\nexport function createSentryLoggerErrorHook(): LoggerErrorHook {\n  return ({ error, distinctId, context }) => {\n    if (distinctId !== undefined) {\n      Sentry.captureException(error, { extra: context, user: { id: distinctId } })\n      return\n    }\n    Sentry.captureException(error, { extra: context })\n  }\n}\n\n/** Identity and scope adapter from Typist and Porte; call inside Sentry's instrumented runtime. */\nexport class SentryObservabilityService implements ObservabilityService {\n  /** Attribute subsequent reports in the current isolation scope. */\n  setUser(user: ObservabilityUser): void {\n    Sentry.setUser(user)\n  }\n\n  /** Await work in a separate scope for each queue message or concurrent operation. */\n  async withIsolationScope<T>(callback: (scope: ObservabilityScope) => T | Promise<T>): Promise<T> {\n    return await Sentry.withIsolationScope(callback)\n  }\n}\n\nexport { Sentry }\n"],"mappings":";;;;AAaA,SAAgB,oBAAoB,SAAwD;CAC1F,OAAO;EACL,YAAY;EACZ,GAAG;EACH,gBAAgB;GACd,UAAU;GACV,YAAY,CAAC;GACb,GAAG,QAAQ;GACX,OAAO;IAAE,QAAQ;IAAO,SAAS;IAAO,GAAG,QAAQ,gBAAgB;GAAM;EAC3E;CACF;AACF;;AAGA,SAAgB,8BAA+C;CAC7D,QAAQ,EAAE,OAAO,YAAY,cAAc;EACzC,IAAI,eAAe,QAAW;GAC5B,OAAO,iBAAiB,OAAO;IAAE,OAAO;IAAS,MAAM,EAAE,IAAI,WAAW;GAAE,CAAC;GAC3E;EACF;EACA,OAAO,iBAAiB,OAAO,EAAE,OAAO,QAAQ,CAAC;CACnD;AACF;;AAGA,IAAa,6BAAb,MAAwE;;CAEtE,QAAQ,MAA+B;EACrC,OAAO,QAAQ,IAAI;CACrB;;CAGA,MAAM,mBAAsB,UAAqE;EAC/F,OAAO,MAAM,OAAO,mBAAmB,QAAQ;CACjD;AACF"}

package/dist/sentry/vite.d.ts

@@ -0,0 +1,11 @@
+import { SentryTanstackStartOptions, sentryTanstackStart as sentryTanstackStart$1 } from "@sentry/tanstackstart-react/vite";
+//#region src/infrastructure/sentry/vite.d.ts
+/** Sentry's Vite options; the SDK creates the tunnel route and sets the browser tunnel URL. */
+export type SentryViteOptions = SentryTanstackStartOptions;
+/**
+ * Add after tanstackStart() in Vite. The SDK enables a same-origin tunnel by default here.
+ * Set tunnelRoute.allowedDsns when the browser and Worker use different Sentry projects.
+ */
+export declare function sentryTanstackStart(options?: SentryViteOptions): ReturnType<typeof sentryTanstackStart$1>;
+//#endregion
+//# sourceMappingURL=vite.d.ts.map

package/dist/sentry/vite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vite.d.ts","names":[],"sources":["../../src/infrastructure/sentry/vite.ts"],"mappings":";;;YAMY,oBAAoB;;;;;wBAMhB,oBACd,UAAS,oBACR,kBAAkB"}

package/dist/sentry/vite.js

@@ -0,0 +1,17 @@
+import { sentryTanstackStart as sentryTanstackStart$1 } from "@sentry/tanstackstart-react/vite";
+
+//#region src/infrastructure/sentry/vite.ts
+/**
+* Add after tanstackStart() in Vite. The SDK enables a same-origin tunnel by default here.
+* Set tunnelRoute.allowedDsns when the browser and Worker use different Sentry projects.
+*/
+function sentryTanstackStart(options = {}) {
+	return sentryTanstackStart$1({
+		...options,
+		tunnelRoute: options.tunnelRoute ?? true
+	});
+}
+
+//#endregion
+export { sentryTanstackStart };
+//# sourceMappingURL=vite.js.map

package/dist/sentry/vite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vite.js","names":["sentryPlugin"],"sources":["../../src/infrastructure/sentry/vite.ts"],"sourcesContent":["import {\n  sentryTanstackStart as sentryPlugin,\n  type SentryTanstackStartOptions,\n} from '@sentry/tanstackstart-react/vite'\n\n/** Sentry's Vite options; the SDK creates the tunnel route and sets the browser tunnel URL. */\nexport type SentryViteOptions = SentryTanstackStartOptions\n\n/**\n * Add after tanstackStart() in Vite. The SDK enables a same-origin tunnel by default here.\n * Set tunnelRoute.allowedDsns when the browser and Worker use different Sentry projects.\n */\nexport function sentryTanstackStart(\n  options: SentryViteOptions = {},\n): ReturnType<typeof sentryPlugin> {\n  return sentryPlugin({ ...options, tunnelRoute: options.tunnelRoute ?? true })\n}\n"],"mappings":";;;;;;;AAYA,SAAgB,oBACd,UAA6B,CAAC,GACG;CACjC,OAAOA,sBAAa;EAAE,GAAG;EAAS,aAAa,QAAQ,eAAe;CAAK,CAAC;AAC9E"}

package/dist/tanstack.d.ts

@@ -1,4 +1,4 @@
-import { st as ErrorTable } from "./index-B5O6mNjZ.js";
+import { st as ErrorTable } from "./index-G1QG0P5g.js";
 import { Register } from "@tanstack/react-start";
 import { BetterAuthCookies } from "better-auth";
 //#region src/infrastructure/tanstack/request-context.d.ts

package/dist/tanstack.js

@@ -1,9 +1,9 @@
-import { $ as AppError, L as ValidationError, U as AuthenticationError, V as StaleSessionError, a as createLogger } from "./core-BiqdOMwU.js";
+import { L as ValidationError, U as AuthenticationError, V as StaleSessionError, a as createLogger, tt as AppError } from "./core-hdaNiCOU.js";
 import { z } from "zod";
 import { getReasonPhrase } from "http-status-codes";
+import { isNotFound, isRedirect, redirect } from "@tanstack/react-router";
 import { createMiddleware } from "@tanstack/react-start";
 import { getSessionCookie, parseCookies } from "better-auth/cookies";
-import { isNotFound, isRedirect, redirect } from "@tanstack/react-router";
 
 //#region src/infrastructure/tanstack/auth.middleware.ts
 const logger$1 = createLogger("auth-middleware");

package/dist/testing/outbox-repository.d.ts

@@ -1,5 +1,5 @@
-import { G as DomainEvent } from "../index-B5O6mNjZ.js";
-import { A as IOutboxRepository } from "../index-DG4jkwad.js";
+import { G as DomainEvent } from "../index-G1QG0P5g.js";
+import { A as IOutboxRepository } from "../index-C28HgVfY.js";
 //#region src/infrastructure/testing/outbox-repository-contract.d.ts
 /** Stored fields observed by the adapter contract, independent of a database library. */
 export type OutboxContractRow = {

package/dist/{webhook-verification-CyBoERFz.d.ts → webhook-verification-D7DIhH6C.d.ts}

@@ -1,4 +1,4 @@
-import { Wt as AppError } from "./index-B5O6mNjZ.js";
+import { Zt as AppError } from "./index-G1QG0P5g.js";
 //#region src/infrastructure/http/webhook-verification.d.ts
 /** A webhook cannot be trusted or parsed. The HTTP handler logs the rejection once. */
 declare class WebhookVerificationError extends AppError {
@@ -26,4 +26,4 @@ interface WebhookVerifier<Event> {
 }
 //#endregion
 export { WebhookVerificationError as n, WebhookVerifier as r, WebhookVerification as t };
-//# sourceMappingURL=webhook-verification-CyBoERFz.d.ts.map
+//# sourceMappingURL=webhook-verification-D7DIhH6C.d.ts.map

package/dist/{webhook-verification-CyBoERFz.d.ts.map → webhook-verification-D7DIhH6C.d.ts.map}

@@ -1 +1 @@
-{"version":3,"file":"webhook-verification-CyBoERFz.d.ts","names":[],"sources":["../src/infrastructure/http/webhook-verification.ts"],"mappings":";;;cAGa,iCAAiC;WAMjC;WALF;WACA;;EAGT,YACW,qEACT;;;KAOQ,oBAAoB;WACjB;WAA2B,OAAO;;WAClC;WAA6B;;WAC7B;WAA8B,OAAO;;;UAGnC,gBAAgB;;EAE/B,OAAO,cAAc,SAAS,UAAU,QAAQ,oBAAoB"}
+{"version":3,"file":"webhook-verification-D7DIhH6C.d.ts","names":[],"sources":["../src/infrastructure/http/webhook-verification.ts"],"mappings":";;;cAGa,iCAAiC;WAMjC;WALF;WACA;;EAGT,YACW,qEACT;;;KAOQ,oBAAoB;WACjB;WAA2B,OAAO;;WAClC;WAA6B;;WAC7B;WAA8B,OAAO;;;UAGnC,gBAAgB;;EAE/B,OAAO,cAAc,SAAS,UAAU,QAAQ,oBAAoB"}

package/dist/{webhook-verification-CeXUJXVP.js → webhook-verification-trEgyz7I.js}

@@ -1,4 +1,4 @@
-import { $ as AppError } from "./core-BiqdOMwU.js";
+import { tt as AppError } from "./core-hdaNiCOU.js";
 
 //#region src/infrastructure/http/webhook-verification.ts
 /** A webhook cannot be trusted or parsed. The HTTP handler logs the rejection once. */
@@ -15,4 +15,4 @@ var WebhookVerificationError = class extends AppError {
 
 //#endregion
 export { WebhookVerificationError as t };
-//# sourceMappingURL=webhook-verification-CeXUJXVP.js.map
+//# sourceMappingURL=webhook-verification-trEgyz7I.js.map

package/dist/{webhook-verification-CeXUJXVP.js.map → webhook-verification-trEgyz7I.js.map}

@@ -1 +1 @@
-{"version":3,"file":"webhook-verification-CeXUJXVP.js","names":[],"sources":["../src/infrastructure/http/webhook-verification.ts"],"sourcesContent":["import { AppError } from '@/core'\n\n/** A webhook cannot be trusted or parsed. The HTTP handler logs the rejection once. */\nexport class WebhookVerificationError extends AppError {\n  readonly _tag = 'WebhookVerificationError'\n  readonly classification = 'terminal'\n\n  /** Keep secrets and payload details out of the public message. */\n  constructor(\n    readonly reason: 'missing_headers' | 'invalid_signature' | 'invalid_payload',\n    cause?: unknown,\n  ) {\n    super(`Webhook rejected: ${reason}`, { cause })\n  }\n}\n\n/** A verified event, an ignored event, or an invalid request. */\nexport type WebhookVerification<Event> =\n  | { readonly outcome: 'event'; readonly event: Event }\n  | { readonly outcome: 'ignored'; readonly type: string }\n  | { readonly outcome: 'rejected'; readonly error: WebhookVerificationError }\n\n/** The provider owns signature verification, timestamp tolerance, and payload parsing. */\nexport interface WebhookVerifier<Event> {\n  /** Verify the exact body before parsing it. Return invalid requests; throw operational failures. */\n  verify(body: string, headers: Headers): Promise<WebhookVerification<Event>>\n}\n"],"mappings":";;;;AAGA,IAAa,2BAAb,cAA8C,SAAS;CAM1C;CALX,AAAS,OAAO;CAChB,AAAS,iBAAiB;;CAG1B,YACE,AAAS,QACT,OACA;EACA,MAAM,qBAAqB,UAAU,EAAE,MAAM,CAAC;EAHrC;CAIX;AACF"}
+{"version":3,"file":"webhook-verification-trEgyz7I.js","names":[],"sources":["../src/infrastructure/http/webhook-verification.ts"],"sourcesContent":["import { AppError } from '@/core'\n\n/** A webhook cannot be trusted or parsed. The HTTP handler logs the rejection once. */\nexport class WebhookVerificationError extends AppError {\n  readonly _tag = 'WebhookVerificationError'\n  readonly classification = 'terminal'\n\n  /** Keep secrets and payload details out of the public message. */\n  constructor(\n    readonly reason: 'missing_headers' | 'invalid_signature' | 'invalid_payload',\n    cause?: unknown,\n  ) {\n    super(`Webhook rejected: ${reason}`, { cause })\n  }\n}\n\n/** A verified event, an ignored event, or an invalid request. */\nexport type WebhookVerification<Event> =\n  | { readonly outcome: 'event'; readonly event: Event }\n  | { readonly outcome: 'ignored'; readonly type: string }\n  | { readonly outcome: 'rejected'; readonly error: WebhookVerificationError }\n\n/** The provider owns signature verification, timestamp tolerance, and payload parsing. */\nexport interface WebhookVerifier<Event> {\n  /** Verify the exact body before parsing it. Return invalid requests; throw operational failures. */\n  verify(body: string, headers: Headers): Promise<WebhookVerification<Event>>\n}\n"],"mappings":";;;;AAGA,IAAa,2BAAb,cAA8C,SAAS;CAM1C;CALX,AAAS,OAAO;CAChB,AAAS,iBAAiB;;CAG1B,YACE,AAAS,QACT,OACA;EACA,MAAM,qBAAqB,UAAU,EAAE,MAAM,CAAC;EAHrC;CAIX;AACF"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://www.schemastore.org/package.json",
   "name": "better-ship",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Foundation for applications on Cloudflare Workers: logger, errors, message bus, infrastructure adapters, and UI primitives",
   "license": "Apache-2.0",
   "repository": {
@@ -29,7 +29,14 @@
     "./core": "./dist/core.js",
     "./http": "./dist/http.js",
     "./postgres": "./dist/postgres.js",
+    "./posthog/client": "./dist/posthog/client.js",
+    "./posthog/metrics": "./dist/posthog/metrics.js",
+    "./posthog/proxy": "./dist/posthog/proxy.js",
+    "./posthog/server": "./dist/posthog/server.js",
     "./resend": "./dist/resend.js",
+    "./sentry/client": "./dist/sentry/client.js",
+    "./sentry/server": "./dist/sentry/server.js",
+    "./sentry/vite": "./dist/sentry/vite.js",
     "./tanstack": "./dist/tanstack.js",
     "./tanstack/server": "./dist/tanstack/server.js",
     "./testing/outbox-repository": "./dist/testing/outbox-repository.js",
@@ -58,7 +65,7 @@
     "@tanstack/start-storage-context": "^1.167.31",
     "@types/node": "^26.5.1",
     "@types/react": "^19.3.0",
-    "@vitest/browser-playwright": "^5.0.0",
+    "@vitest/browser-playwright": "^4.1.11",
     "auth": "^1.7.4",
     "better-auth": "^1.7.4",
     "drizzle-kit": "^0.31.10",

package/src/application/analytics-service.ts

@@ -0,0 +1,21 @@
+import type { AnalyticsEventIdentity, AnalyticsEventInput, AnalyticsProperties } from '@/core'
+
+/** Product analytics without an SDK dependency, ported from Typist and Porte. */
+export interface AnalyticsService<TEvent extends AnalyticsEventInput = AnalyticsEventInput> {
+  /** Attach traits to one person. */
+  identify(distinctId: string, properties?: AnalyticsProperties): void
+  /** Merge a previous ID into this person; the application must establish that both identify the same person. */
+  alias(distinctId: string, previousDistinctId: string): void
+  /** Schedule an event for a person; returning does not confirm remote acceptance. */
+  track(event: TEvent, distinctId: string, identity?: AnalyticsEventIdentity): void
+  /** Schedule an event without creating a person profile for its distinct ID. */
+  trackAnonymous(event: TEvent, distinctId: string, identity?: AnalyticsEventIdentity): void
+}
+
+/** Reports to nobody. The composition root selects this service when analytics is disabled. */
+export const NULL_ANALYTICS: AnalyticsService = {
+  identify: () => {},
+  alias: () => {},
+  track: () => {},
+  trackAnonymous: () => {},
+}

package/src/application/index.ts

@@ -1,4 +1,17 @@
 export type { CommandHandler, EventHandler, QueryHandler } from './handlers.ts'
+export { NULL_ANALYTICS, type AnalyticsService } from './analytics-service.ts'
+export {
+  NULL_METRICS_SERVICE,
+  type MetricsService,
+  type MetricOptions,
+  type MetricAttributes,
+  type MetricAttributeValue,
+} from './metrics-service.ts'
+export type {
+  ObservabilityService,
+  ObservabilityScope,
+  ObservabilityUser,
+} from './observability-service.ts'
 export {
   RecordingEmailService,
   type IEmailService,

package/src/application/metrics-service.ts

@@ -0,0 +1,28 @@
+/** A metric dimension; use a small, bounded value set and never user or request IDs. */
+export type MetricAttributeValue = string | number | boolean
+
+/** Dimensions shared by observations in one time series. */
+export type MetricAttributes = Readonly<Record<string, MetricAttributeValue>>
+
+/** Unit and dimensions for an operational measurement. */
+export interface MetricOptions {
+  readonly attributes?: MetricAttributes
+  readonly unit?: string
+}
+
+/** Operational measurements, ported from Typist's metrics-service.ts; applications own metric names. */
+export interface MetricsService<TName extends string = string> {
+  /** Add a nonnegative value to a total; the default increment is one. */
+  count(name: TName, value?: number, options?: MetricOptions): void
+  /** Record a current value. */
+  gauge(name: TName, value: number, options?: MetricOptions): void
+  /** Record one observation in a distribution. */
+  histogram(name: TName, value: number, options?: MetricOptions): void
+}
+
+/** Records nothing when the composition root disables metrics. */
+export const NULL_METRICS_SERVICE: MetricsService = {
+  count: () => {},
+  gauge: () => {},
+  histogram: () => {},
+}

package/src/application/observability-service.ts

@@ -0,0 +1,16 @@
+/** The identity an error report belongs to. */
+export interface ObservabilityUser {
+  readonly id: string
+}
+
+/** Identity within one isolated execution. */
+export interface ObservabilityScope {
+  /** Attribute reports in this scope to one person. */
+  setUser(user: ObservabilityUser): void
+}
+
+/** Error identity and isolation, ported from Porte's sentry-observability-service.ts. */
+export interface ObservabilityService extends ObservabilityScope {
+  /** Await work in its own scope so concurrent executions do not share identity. */
+  withIsolationScope<T>(callback: (scope: ObservabilityScope) => T | Promise<T>): Promise<T>
+}

package/src/core/analytics-event.ts

@@ -0,0 +1,37 @@
+import { z } from 'zod'
+
+/** An event name and its application-owned properties, ported from Typist's analytics/types.ts. */
+export interface AnalyticsEventInput<
+  TName extends string = string,
+  TProperties extends object = object,
+> {
+  readonly name: TName
+  readonly properties: TProperties
+}
+
+/** A value supported by analytics person properties. */
+export type AnalyticsProperty =
+  | string
+  | number
+  | boolean
+  | null
+  | undefined
+  | readonly AnalyticsProperty[]
+  | AnalyticsProperties
+
+/** Person properties supplied by the application. */
+export interface AnalyticsProperties {
+  readonly [name: string]: AnalyticsProperty
+}
+
+/** Parse a persisted analytics event UUID; the SDK generates ordinary event UUIDs itself. */
+export const AnalyticsEventIdSchema = z.uuid().brand<'AnalyticsEventId'>()
+
+/** The identity of one analytics event across repeated application deliveries. */
+export type AnalyticsEventId = z.infer<typeof AnalyticsEventIdSchema>
+
+/** Supply both original values when replaying one event; never share them across different occurrences. */
+export interface AnalyticsEventIdentity {
+  readonly uuid: AnalyticsEventId
+  readonly timestamp: Date
+}

package/src/core/index.ts

@@ -1,4 +1,13 @@
 export { AppError } from './app-error.ts'
+export { MissingConfigurationError } from './missing-configuration.error.ts'
+export {
+  AnalyticsEventIdSchema,
+  type AnalyticsEventId,
+  type AnalyticsEventIdentity,
+  type AnalyticsEventInput,
+  type AnalyticsProperties,
+  type AnalyticsProperty,
+} from './analytics-event.ts'
 export { EmailAddressSchema, type EmailAddress } from './email-address.ts'
 export {
   emailIdempotencyKey,

package/src/core/missing-configuration.error.ts

@@ -0,0 +1,12 @@
+import { AppError } from './app-error.ts'
+
+/** Required configuration is absent. Ported from Porte's configuration.errors.ts. */
+export class MissingConfigurationError extends AppError {
+  readonly _tag = 'MissingConfigurationError'
+  readonly classification = 'terminal'
+
+  /** Name the missing setting without including its value. */
+  constructor(readonly key: string) {
+    super(`${key} is required`)
+  }
+}

package/src/infrastructure/posthog/client.ts

@@ -0,0 +1,41 @@
+import posthog, { type PostHog, type PostHogConfig } from 'posthog-js'
+
+/** The application controls enablement; disabled initialization needs no project key. */
+export type PostHogClientConfig =
+  | { readonly enabled: false }
+  | {
+      readonly enabled: true
+      readonly apiKey: string
+      readonly environment: string
+      readonly source: string
+      readonly options?: Partial<PostHogConfig>
+    }
+
+/** Browser options from Typist and Porte; SDK option names and application overrides stay intact. */
+export function createPostHogClientOptions(
+  config: Extract<PostHogClientConfig, { enabled: true }>,
+): Partial<PostHogConfig> {
+  return {
+    api_host: '/relay',
+    ui_host: 'https://us.posthog.com',
+    person_profiles: 'identified_only',
+    defaults: '2026-08-29',
+    disable_surveys: true,
+    advanced_disable_feature_flags: true,
+    capture_performance: { web_vitals: false },
+    ...config.options,
+    loaded: (client) => {
+      client.register({ environment: config.environment, source: config.source })
+      config.options?.loaded?.(client)
+    },
+  }
+}
+
+/** Initialize once in the browser entrypoint; pass the returned SDK client to PostHogProvider. */
+export function initializePostHog(config: PostHogClientConfig): PostHog {
+  if (!config.enabled) return posthog
+  posthog.init(config.apiKey, createPostHogClientOptions(config))
+  return posthog
+}
+
+export { PostHogProvider, usePostHog } from '@posthog/react'

package/src/infrastructure/posthog/metrics.ts

@@ -0,0 +1,30 @@
+import type { PostHog } from 'posthog-node'
+
+import type { MetricOptions, MetricsService } from '@/application'
+
+/** PostHog Metrics with Worker lifetime management, ported from Typist's metrics-service.ts. */
+export class PostHogMetricsService implements MetricsService {
+  /** Use the analytics client's metrics; the runtime owns each flush promise. */
+  constructor(
+    private readonly client: Pick<PostHog, 'metrics'>,
+    private readonly waitUntil: (promise: Promise<unknown>) => void,
+  ) {}
+
+  /** Record a total and schedule its flush. */
+  count(name: string, value = 1, options?: MetricOptions): void {
+    this.client.metrics.count(name, value, options)
+    this.waitUntil(this.client.metrics.flush())
+  }
+
+  /** Record a current value and schedule its flush. */
+  gauge(name: string, value: number, options?: MetricOptions): void {
+    this.client.metrics.gauge(name, value, options)
+    this.waitUntil(this.client.metrics.flush())
+  }
+
+  /** Record an observation and schedule its flush. */
+  histogram(name: string, value: number, options?: MetricOptions): void {
+    this.client.metrics.histogram(name, value, options)
+    this.waitUntil(this.client.metrics.flush())
+  }
+}

package/src/infrastructure/posthog/proxy.ts

@@ -0,0 +1,47 @@
+/** Runtime resources and deployment hosts for Typist's same-origin proxy. */
+export interface PostHogProxyOptions {
+  readonly cache: Pick<Cache, 'match' | 'put'>
+  readonly waitUntil: (promise: Promise<void>) => void
+  readonly basePath?: string
+  readonly ingestHost?: string
+  readonly assetHost?: string
+  readonly fetch?: typeof globalThis.fetch
+}
+
+/**
+ * Mount at /relay/$ with GET, POST, and OPTIONS handlers. Supply Cloudflare's asset cache and waitUntil.
+ * The application must use the same base path in the browser's api_host option.
+ */
+export async function proxyPostHogRequest(
+  request: Request,
+  options: PostHogProxyOptions,
+): Promise<Response> {
+  const url = new URL(request.url)
+  const basePath = options.basePath ?? '/relay'
+  if (!url.pathname.startsWith(`${basePath}/`)) return new Response(null, { status: 404 })
+  const pathname = url.pathname.slice(basePath.length)
+  const pathWithSearch = pathname + url.search
+  const send = options.fetch ?? globalThis.fetch
+
+  if (pathname.startsWith('/static/') || pathname.startsWith('/array/')) {
+    const cached = await options.cache.match(request)
+    if (cached) return cached
+    const response = await send(
+      `https://${options.assetHost ?? 'us-assets.i.posthog.com'}${pathWithSearch}`,
+    )
+    options.waitUntil(options.cache.put(request, response.clone()))
+    return response
+  }
+
+  const headers = new Headers(request.headers)
+  headers.delete('cookie')
+  headers.delete('authorization')
+  headers.set('X-Forwarded-For', request.headers.get('CF-Connecting-IP') ?? '')
+  return await send(`https://${options.ingestHost ?? 'us.i.posthog.com'}${pathWithSearch}`, {
+    method: request.method,
+    headers,
+    body:
+      request.method !== 'GET' && request.method !== 'HEAD' ? await request.arrayBuffer() : null,
+    redirect: request.redirect,
+  })
+}