`@idebug/core`

Shared building blocks for server SDKs.

Responsibilities

TraceEvent / session types
runWithContext / getSessionId (AsyncLocalStorage)
createTraceStore / getDefaultStore ring buffer
redact / redactTraceEvent
createIdebugHandler — framework-agnostic UI + API host

Minimal usage

import {
  createTraceStore,
  createIdebugHandler,
  createTraceEvent,
  redactTraceEvent,
  runWithContext,
  nextSessionId,
} from '@idebug/core';
import path from 'node:path';
import { createRequire } from 'node:module';
 
const store = createTraceStore({ maxSessions: 100 });
const require = createRequire(import.meta.url);
const staticDir = path.join(
  path.dirname(require.resolve('@idebug/ui/package.json')),
  'dist',
);
 
const handler = createIdebugHandler({
  store,
  staticDir,
  basePath: '/__idebug',
  appName: 'raw-http',
  security: {
    hostCheck: true,
    localRemoteOnly: true,
    accessToken: process.env.IDEBUG_TOKEN ?? null,
  },
});
 
// mount on node:http or Express without path stripping

Most apps should use @idebug/node or @idebug/nest instead of calling core directly. Security defaults and threat model: Security posture.

Key exports

Export	Purpose
`createTraceStore` / `getDefaultStore`	Event storage
`runWithContext` / `getSessionId`	Request context
`createTraceEvent` / `nextEventId` / `nextSessionId`	Event helpers
`redact` / `redactTraceEvent`	Secret scrubbing
`createIdebugHandler`	SPA + JSON + SSE (+ security gate)
`checkRequestSecurity` / `defaultSecurityPolicy`	Host / remote / token checks
`DEFAULT_BASE_PATH`	`'/__idebug'`
`resolveCoreConfig`	Merge partials with defaults

Overview @idebug/node