@fixback/sdk-core

The runtime-agnostic core shared by every Fixback SDK — @fixback/sdk, @fixback/expo, @fixback/node, and the build-time @fixback/cli. It holds the capture logic none of them should own privately, so every surface computes it the same way (ADR-0028):

• Fingerprinting — fingerprint v2 (ADR 2026-10-15): computeFingerprint and fingerprintKeys over the language-neutral fingerprintOf, with keyFramesOf, isInAppFile, frameKey, normalize and compactFrameFile behind them. An error groups by its type with its causes' types, the app's own top frames by function and file (never a line; an anonymous frame by the named function enclosing it), and its message — every number collapsed — only when those frames cannot name the throw site, hashed to 64 bits. resolveFingerprint and resolveErrorSignature apply a custom fingerprint ({{ default }} standing for the computed key) after beforeSend, and computeFingerprintV1 keeps the frozen v1 key every SDK sends beside the v2 one while Issues filed under v1 switch over. The .NET SDK ports the same rules, pinned by parity vectors.
• Stack parsing — one frame tokenizer (parseStackLine) behind the fingerprint, the console call site, and extractStructuredFrames (the frames server-side symbolication consumes).
• Scrubbing — scrubUrl, redactPii, and the runBeforeSend choke point.
• The trace buffer — createBreadcrumbBuffer's three per-stream rings, the crumb builders (consoleCrumb, networkCrumb, navigationCrumb, errorCrumb, …), the structured console-arg caps, instrumentConsole, and instrumentXhr — the one XMLHttpRequest patch, each SDK passing its own Correlation id rule and opt-ins.
• The Correlation id — the W3C traceparent carrier (mintTraceparent / parseTraceparent) and the one reading of the capture SDKs' propagateTo option (readPropagateTo, ignoredPropagateToWarning), with each runtime's origin parser injected.
• Automatic error capture — createAutoCapture: the dedup, token-bucket burst limiter, session cap, causal error crumb, and occurrence flush each SDK's installErrorCapture binds its runtime's error seam to — and autoReportContent, the source: error content each report ships.
• Backoff — AutoReportBackoff + parseRetryAfter, honouring ingest's 429 / Retry-After backpressure.
• The ingest boot contract — requestBoot, bootEndpoint / feedbackEndpoint, BootAnswer, and isFixbackApiRequest — and what an answer settles for a Reporter session: reconcileBoot, reporterIdentityOf, and maintenance mode's recheck (createMaintenanceRecheck).
• The feedback POST's tail — backpressureHold, postFeedback and the SubmitResult it answers, over fetchWithTimeout and readJsonBody; the multipart envelope stays each SDK's own.
• Report content — assembleReportContent and captureEnvironmentOf, the rules that drop an empty piece rather than send a blank.
• The shared init vocabulary — DEFAULT_API_URL, CommonInitOptions, streamEnabled, normaliseRelease and readReleaseOption, the warning prefix every SDK prints (WARN_PREFIX), and the anonymous-id key + generator.
• Wire shapes — ReportContent, CapturedFrame, the Annotation / Breadcrumb value types (and arrowHeadPoints, the arrow geometry the dashboard's composite mirrors), and the provenance vocabulary (FeedbackSource, Platform).

It is deliberately runtime-agnostic: no DOM, no Node built-ins, no rrweb. Every runtime touchpoint is either injected (a console, a fetch, an XHR constructor, a storage binding) or probed defensively off globalThis (performance, TextEncoder, crypto, setTimeout) — see ADR 2026-10-08, which amends ADR-0028's scope to every capture SDK's runtime-agnostic logic, transports included. This is an internal implementation package for the Fixback SDK family, not a public API.

📖 Documentation for the SDKs that build on this core: docs.fixback.dev.