getSessionId() returns session ids the tracker has already expired

Describe the bug

The SDK helper getSessionId() (packages/sdk/src/core/tracker.ts) reads did_session from sessionStorage and returns it as-is, without checking the did_session_timestamp that the tracker writes alongside it.

The tracker itself rotates sessions after 30 minutes of inactivity — getOrCreateSessionId() compares did_session_timestamp against that window, discards the stale pair, and generates a new id. But the SDK helper ignores the timestamp, so between expiry and the tracker's next visit it returns a session id that is no longer the current one.

getTrackingIds() and getTrackingParams() inherit the problem since they delegate to getSessionId().

To Reproduce

1. Load a page with the tracker and @databuddy/sdk.
2. After the tracker initializes, backdate the timestamp past the expiry window:

sessionStorage.setItem("did_session_timestamp", String(Date.now() - 31 * 60 * 1000));
getSessionId(); // returns the stale id

3. The tracker treats this session as expired and rotates it on the next init, but getSessionId() keeps returning the old id. Same result if did_session_timestamp is missing entirely.

Expected behavior

getSessionId() should apply the same rule as the tracker: null when the timestamp is missing or older than 30 minutes. Fresh sessions still return the stored id, and URL params keep priority.

Screenshots

Not applicable. The failure is a logically stale return value.

Environment (please complete the following information):

• SDK: @databuddy/sdk at current staging
• Browser-agnostic; reproduced through the SDK's Playwright suite

Additional context

The expiry logic lives in the tracker: packages/tracker/src/core/tracker.ts — getOrCreateSessionId() uses sessionAge < 30 * 60 * 1000. The SDK helper currently has no awareness of it.

Affected code: getSessionId() in packages/sdk/src/core/tracker.ts.

Existing tests cover empty storage, populated storage, and URL-parameter precedence, but not the expiry timestamp.

AI usage disclosure

This report was drafted with AI assistance (Claude via Qoder) for research and writing. I read the tracker and SDK sources, reproduced the mismatch in the SDK's test setup, and reviewed/edited the report before submitting.

Start with getSessionId() in packages/sdk/src/core/tracker.ts and compare its storage handling with getOrCreateSessionId() in packages/tracker/src/core/tracker.ts. Extend the SDK test coverage for missing and expired did_session_timestamp values, while preserving fresh-session behavior and URL-parameter precedence. Run the SDK's Playwright suite and confirm getSessionId(), getTrackingIds(), and getTrackingParams() no longer expose expired sessions.