@aglyn/aglyn 1.0.0-beta.244 → 1.0.0-beta.247

package/src/lib/app-utils/element-pick-protocol.d.ts

@@ -0,0 +1,54 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The live-page element picker's wire protocol (AGL-3758).
+ *
+ * The console's Actions card opens a site page in a frame with
+ * {@link ELEMENT_PICK_PARAM}; the page's pick mode highlights elements under
+ * the pointer and, on a click, posts the element's selector to the console —
+ * the same `[data-aglyn="leaf:<id>"]` selector the Besigner's Interactions
+ * "Pick element" stores, which the site runtime resolves through
+ * `expandLeafSelector`. Import-free on purpose: the tenant's admin-bar stub,
+ * on every published page, reads the param from here.
+ */
+/** Query param that arms pick mode on a framed published page. */
+export declare const ELEMENT_PICK_PARAM = "aglyn-pick";
+/** `postMessage` type every pick-mode message carries. */
+export declare const ELEMENT_PICK_MESSAGE_TYPE = "aglyn-pick-element";
+export type ElementPickMessage = 
+/** Pick mode loaded and is waiting for a click. */
+{
+    type: typeof ELEMENT_PICK_MESSAGE_TYPE;
+    event: 'ready';
+}
+/** The builder clicked an element. */
+ | {
+    type: typeof ELEMENT_PICK_MESSAGE_TYPE;
+    event: 'picked';
+    selector: string;
+    /** What the element reads as, for the console's chip. */
+    label: string;
+}
+/** Escape on the page. */
+ | {
+    type: typeof ELEMENT_PICK_MESSAGE_TYPE;
+    event: 'cancel';
+};
+/** Whether a `message` event's data is one of ours, shaped as promised. */
+export declare function isElementPickMessage(data: unknown): data is ElementPickMessage;
+/** `pageUrl` with pick mode armed, keeping any query it already has. */
+export declare function elementPickUrl(pageUrl: string): string;

package/src/lib/app-utils/element-pick-protocol.js

@@ -0,0 +1,41 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The live-page element picker's wire protocol (AGL-3758).
+ *
+ * The console's Actions card opens a site page in a frame with
+ * {@link ELEMENT_PICK_PARAM}; the page's pick mode highlights elements under
+ * the pointer and, on a click, posts the element's selector to the console —
+ * the same `[data-aglyn="leaf:<id>"]` selector the Besigner's Interactions
+ * "Pick element" stores, which the site runtime resolves through
+ * `expandLeafSelector`. Import-free on purpose: the tenant's admin-bar stub,
+ * on every published page, reads the param from here.
+ */ /** Query param that arms pick mode on a framed published page. */ export const ELEMENT_PICK_PARAM = 'aglyn-pick';
+/** `postMessage` type every pick-mode message carries. */ export const ELEMENT_PICK_MESSAGE_TYPE = 'aglyn-pick-element';
+/** Whether a `message` event's data is one of ours, shaped as promised. */ export function isElementPickMessage(data) {
+    if (!data || typeof data !== 'object') return false;
+    const message = data;
+    if (message['type'] !== ELEMENT_PICK_MESSAGE_TYPE) return false;
+    if (message['event'] === 'ready' || message['event'] === 'cancel') return true;
+    return message['event'] === 'picked' && typeof message['selector'] === 'string' && message['selector'] !== '' && typeof message['label'] === 'string';
+}
+/** `pageUrl` with pick mode armed, keeping any query it already has. */ export function elementPickUrl(pageUrl) {
+    const url = new URL(pageUrl);
+    url.searchParams.set(ELEMENT_PICK_PARAM, '1');
+    return url.toString();
+}
+
+//# sourceMappingURL=element-pick-protocol.js.map

package/src/lib/app-utils/element-pick-protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/element-pick-protocol.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The live-page element picker's wire protocol (AGL-3758).\n *\n * The console's Actions card opens a site page in a frame with\n * {@link ELEMENT_PICK_PARAM}; the page's pick mode highlights elements under\n * the pointer and, on a click, posts the element's selector to the console —\n * the same `[data-aglyn=\"leaf:<id>\"]` selector the Besigner's Interactions\n * \"Pick element\" stores, which the site runtime resolves through\n * `expandLeafSelector`. Import-free on purpose: the tenant's admin-bar stub,\n * on every published page, reads the param from here.\n */\n\n/** Query param that arms pick mode on a framed published page. */\nexport const ELEMENT_PICK_PARAM = 'aglyn-pick'\n\n/** `postMessage` type every pick-mode message carries. */\nexport const ELEMENT_PICK_MESSAGE_TYPE = 'aglyn-pick-element'\n\nexport type ElementPickMessage =\n  /** Pick mode loaded and is waiting for a click. */\n  | { type: typeof ELEMENT_PICK_MESSAGE_TYPE; event: 'ready' }\n  /** The builder clicked an element. */\n  | {\n      type: typeof ELEMENT_PICK_MESSAGE_TYPE\n      event: 'picked'\n      selector: string\n      /** What the element reads as, for the console's chip. */\n      label: string\n    }\n  /** Escape on the page. */\n  | { type: typeof ELEMENT_PICK_MESSAGE_TYPE; event: 'cancel' }\n\n/** Whether a `message` event's data is one of ours, shaped as promised. */\nexport function isElementPickMessage(data: unknown): data is ElementPickMessage {\n  if (!data || typeof data !== 'object') return false\n  const message = data as Record<string, unknown>\n  if (message['type'] !== ELEMENT_PICK_MESSAGE_TYPE) return false\n  if (message['event'] === 'ready' || message['event'] === 'cancel') return true\n  return (\n    message['event'] === 'picked' &&\n    typeof message['selector'] === 'string' &&\n    message['selector'] !== '' &&\n    typeof message['label'] === 'string'\n  )\n}\n\n/** `pageUrl` with pick mode armed, keeping any query it already has. */\nexport function elementPickUrl(pageUrl: string): string {\n  const url = new URL(pageUrl)\n  url.searchParams.set(ELEMENT_PICK_PARAM, '1')\n  return url.toString()\n}\n"],"names":["ELEMENT_PICK_PARAM","ELEMENT_PICK_MESSAGE_TYPE","isElementPickMessage","data","message","elementPickUrl","pageUrl","url","URL","searchParams","set","toString"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;CAUC,GAED,gEAAgE,GAChE,OAAO,MAAMA,qBAAqB,aAAY;AAE9C,wDAAwD,GACxD,OAAO,MAAMC,4BAA4B,qBAAoB;AAgB7D,yEAAyE,GACzE,OAAO,SAASC,qBAAqBC,IAAa;IAChD,IAAI,CAACA,QAAQ,OAAOA,SAAS,UAAU,OAAO;IAC9C,MAAMC,UAAUD;IAChB,IAAIC,OAAO,CAAC,OAAO,KAAKH,2BAA2B,OAAO;IAC1D,IAAIG,OAAO,CAAC,QAAQ,KAAK,WAAWA,OAAO,CAAC,QAAQ,KAAK,UAAU,OAAO;IAC1E,OACEA,OAAO,CAAC,QAAQ,KAAK,YACrB,OAAOA,OAAO,CAAC,WAAW,KAAK,YAC/BA,OAAO,CAAC,WAAW,KAAK,MACxB,OAAOA,OAAO,CAAC,QAAQ,KAAK;AAEhC;AAEA,sEAAsE,GACtE,OAAO,SAASC,eAAeC,OAAe;IAC5C,MAAMC,MAAM,IAAIC,IAAIF;IACpBC,IAAIE,YAAY,CAACC,GAAG,CAACV,oBAAoB;IACzC,OAAOO,IAAII,QAAQ;AACrB"}

package/src/lib/app-utils/element-pick-target.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export interface ElementPickTarget {
+    /** The stamped element the click resolves to. */
+    element: Element;
+    /** The selector stored for it — the Besigner picker's form. */
+    selector: string;
+    /** What it reads as: its accessible name or text, else its tag. */
+    label: string;
+}
+/**
+ * The element a pick resolves to (AGL-3758): the nearest ancestor-or-self the
+ * renderer stamped, its stored selector, and a label. A layout's namespace is
+ * stripped off the id, exactly as the Besigner picker stores the raw canvas
+ * id; the runtime's `expandLeafSelector` matches it on every page again.
+ * `null` for a point on nothing Aglyn drew.
+ */
+export declare function elementPickTarget(from: Element | null): ElementPickTarget | null;

package/src/lib/app-utils/element-pick-target.js

@@ -0,0 +1,47 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { normalizeLeafId } from "./element-ui.js";
+/** The stamp the node renderer's `Leaf` puts on every element it draws. */ const LEAF_STAMP_SELECTOR = '[data-aglyn^="leaf:"]';
+function readableLabel(element) {
+    var _element_textContent;
+    const named = element.getAttribute('aria-label') || element.getAttribute('alt') || element.getAttribute('title') || ((_element_textContent = element.textContent) != null ? _element_textContent : '');
+    const text = named.replace(/\s+/g, ' ').trim();
+    const tag = element.tagName.toLowerCase();
+    if (!text) return tag === 'img' ? 'Image' : `Element (${tag})`;
+    return text.length > 40 ? `“${text.slice(0, 39)}…”` : `“${text}”`;
+}
+/**
+ * The element a pick resolves to (AGL-3758): the nearest ancestor-or-self the
+ * renderer stamped, its stored selector, and a label. A layout's namespace is
+ * stripped off the id, exactly as the Besigner picker stores the raw canvas
+ * id; the runtime's `expandLeafSelector` matches it on every page again.
+ * `null` for a point on nothing Aglyn drew.
+ */ export function elementPickTarget(from) {
+    var _ref, _element_getAttribute;
+    var _from_closest;
+    const element = (_ref = from == null ? void 0 : (_from_closest = from.closest) == null ? void 0 : _from_closest.call(from, LEAF_STAMP_SELECTOR)) != null ? _ref : null;
+    if (!element) return null;
+    const stamp = (_element_getAttribute = element.getAttribute('data-aglyn')) != null ? _element_getAttribute : '';
+    const id = normalizeLeafId(stamp.slice('leaf:'.length));
+    if (!id || id.includes('"') || id.includes('\\')) return null;
+    return {
+        element,
+        selector: `[data-aglyn="leaf:${id}"]`,
+        label: readableLabel(element)
+    };
+}
+
+//# sourceMappingURL=element-pick-target.js.map

package/src/lib/app-utils/element-pick-target.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/element-pick-target.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { normalizeLeafId } from './element-ui'\n\n/** The stamp the node renderer's `Leaf` puts on every element it draws. */\nconst LEAF_STAMP_SELECTOR = '[data-aglyn^=\"leaf:\"]'\n\nexport interface ElementPickTarget {\n  /** The stamped element the click resolves to. */\n  element: Element\n  /** The selector stored for it — the Besigner picker's form. */\n  selector: string\n  /** What it reads as: its accessible name or text, else its tag. */\n  label: string\n}\n\nfunction readableLabel(element: Element): string {\n  const named =\n    element.getAttribute('aria-label') ||\n    element.getAttribute('alt') ||\n    element.getAttribute('title') ||\n    (element.textContent ?? '')\n  const text = named.replace(/\\s+/g, ' ').trim()\n  const tag = element.tagName.toLowerCase()\n  if (!text) return tag === 'img' ? 'Image' : `Element (${tag})`\n  return text.length > 40 ? `“${text.slice(0, 39)}…”` : `“${text}”`\n}\n\n/**\n * The element a pick resolves to (AGL-3758): the nearest ancestor-or-self the\n * renderer stamped, its stored selector, and a label. A layout's namespace is\n * stripped off the id, exactly as the Besigner picker stores the raw canvas\n * id; the runtime's `expandLeafSelector` matches it on every page again.\n * `null` for a point on nothing Aglyn drew.\n */\nexport function elementPickTarget(from: Element | null): ElementPickTarget | null {\n  const element = from?.closest?.(LEAF_STAMP_SELECTOR) ?? null\n  if (!element) return null\n  const stamp = element.getAttribute('data-aglyn') ?? ''\n  const id = normalizeLeafId(stamp.slice('leaf:'.length))\n  if (!id || id.includes('\"') || id.includes('\\\\')) return null\n  return {\n    element,\n    selector: `[data-aglyn=\"leaf:${id}\"]`,\n    label: readableLabel(element),\n  }\n}\n"],"names":["normalizeLeafId","LEAF_STAMP_SELECTOR","readableLabel","element","named","getAttribute","textContent","text","replace","trim","tag","tagName","toLowerCase","length","slice","elementPickTarget","from","closest","stamp","id","includes","selector","label"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,eAAe,QAAQ,kBAAc;AAE9C,yEAAyE,GACzE,MAAMC,sBAAsB;AAW5B,SAASC,cAAcC,OAAgB;QAKlCA;IAJH,MAAMC,QACJD,QAAQE,YAAY,CAAC,iBACrBF,QAAQE,YAAY,CAAC,UACrBF,QAAQE,YAAY,CAAC,cACpBF,uBAAAA,QAAQG,WAAW,YAAnBH,uBAAuB;IAC1B,MAAMI,OAAOH,MAAMI,OAAO,CAAC,QAAQ,KAAKC,IAAI;IAC5C,MAAMC,MAAMP,QAAQQ,OAAO,CAACC,WAAW;IACvC,IAAI,CAACL,MAAM,OAAOG,QAAQ,QAAQ,UAAU,CAAC,SAAS,EAAEA,IAAI,CAAC,CAAC;IAC9D,OAAOH,KAAKM,MAAM,GAAG,KAAK,CAAC,CAAC,EAAEN,KAAKO,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAEP,KAAK,CAAC,CAAC;AACnE;AAEA;;;;;;CAMC,GACD,OAAO,SAASQ,kBAAkBC,IAAoB;cAGtCb;QAFEa;IAAhB,MAAMb,kBAAUa,yBAAAA,gBAAAA,KAAMC,OAAO,qBAAbD,mBAAAA,MAAgBf,uCAAwB;IACxD,IAAI,CAACE,SAAS,OAAO;IACrB,MAAMe,SAAQf,wBAAAA,QAAQE,YAAY,CAAC,yBAArBF,wBAAsC;IACpD,MAAMgB,KAAKnB,gBAAgBkB,MAAMJ,KAAK,CAAC,QAAQD,MAAM;IACrD,IAAI,CAACM,MAAMA,GAAGC,QAAQ,CAAC,QAAQD,GAAGC,QAAQ,CAAC,OAAO,OAAO;IACzD,OAAO;QACLjB;QACAkB,UAAU,CAAC,kBAAkB,EAAEF,GAAG,EAAE,CAAC;QACrCG,OAAOpB,cAAcC;IACvB;AACF"}

package/src/lib/app-utils/error-beacon.d.ts

@@ -14,6 +14,36 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+/**
+ * First-party browser error beacon (AGL-1538).
+ *
+ * Crashlytics does not exist for web, and adding a third-party error vendor
+ * is a subprocessor-list decision that was explicitly deferred. This is the
+ * first-party alternative: `window.onerror` / `unhandledrejection` handlers
+ * that batch uncaught failures to the app's own `/api/errors` route, which
+ * forwards them to Google Cloud Error Reporting — a processor already on the
+ * list, alerting through the GCP stack that already pages (AGL-1502).
+ *
+ * Design constraints, in order:
+ *
+ * - **It must never become the outage.** Everything is wrapped; a failure to
+ *   report is silence, not a thrown error. Batches are capped per page so an
+ *   error thrown in a loop cannot DDoS our own API — after `maxPerPage`
+ *   events the beacon disarms for the rest of the pageview.
+ * - **No PII.** URLs are scrubbed to origin + pathname (query strings and
+ *   fragments carry tokens and search terms), no user id, no cookies —
+ *   the payload is the error text and where in the CODE it happened.
+ *   Cross-origin scripts surface as the browser's opaque "Script error."
+ *   with no stack; those are dropped since they cannot be acted on.
+ * - **Dedupe.** One page throwing the same error on every frame reports it
+ *   once.
+ *
+ * Framework-free on purpose: the console mounts it from its root layout, the
+ * tenant runtime from its own, and neither needs React here. Deliberately NO
+ * 'use client' directive — inside this shared lib the directive forks the
+ * module graph (AGL-52); every importer is already a client module.
+ */
+import { type BrowserFamily } from './browser-family';
 export interface ErrorBeaconEvent {
     /**
      * Which handler caught it — 'error' | 'unhandledrejection' — or the
@@ -33,14 +63,21 @@ export interface ErrorBeaconEvent {
     /** Page URL, scrubbed to origin + pathname. */
     url: string;
     /**
-     * On a `hydration` event only: the page translator whose rewrite is
-     * visible in the document when React gave up — see
-     * {@link pageTranslationSignal}. Absent when nothing visibly translated
-     * the page, which is the case that is worth reading.
+     * On a `hydration` event from builds before AGL-3738 only: the page
+     * translator whose rewrite was visible in the document when React gave up
+     * — see {@link pageTranslationSignal}. Today's beacon drops a mismatch on a
+     * translated page instead of sending it, so the field stays only for what
+     * older tabs still report.
      */
     translated?: string;
     /** On a `hydration` event only: `navigator.language`, clamped. */
     language?: string;
+    /**
+     * On every event: the coarse browser family — one of seven, see
+     * {@link browserFamily} (AGL-3732). Never the user agent, never a version.
+     * Stamped by the queue, so a caller never sets it.
+     */
+    browser?: BrowserFamily;
 }
 export interface ErrorBeaconOptions {
     /** POST target; same-origin. Default `/api/errors`. */
@@ -109,6 +146,50 @@ export declare function isInjectedThirdPartyFrame(stack: string, documentUrl: st
 /** How many frames of this stack are in a script with no URL at all. */
 export declare function anonymousScriptFrameCount(stack: string): number;
 export declare function isBenignBrowserNotice(message: string): boolean;
+/**
+ * Whether the document is a page a visitor navigated to over the web
+ * (AGL-3759).
+ *
+ * Only `http:` and `https:` qualify. A document at `about:blank` or
+ * `about:srcdoc` is a COPY of our page: a translator extension or a site that
+ * frames our markup renders it into a fresh document with no URL of its own,
+ * and our scripts run there too. Next.js's app router then throws
+ * `Failed to construct 'URL': Invalid URL` resolving its canonical URL against
+ * `window.location.href`, which no code of ours can prevent and no visitor on
+ * the real page ever sees. `file:` (a saved page) and an extension's own
+ * scheme are copies in the same sense.
+ *
+ * A missing or unreadable location is not a web document either: nothing
+ * from it can be traced to a page we serve.
+ */
+export declare function isWebDocument(location: {
+    protocol?: string;
+} | null | undefined): boolean;
+/**
+ * A rejection that says only "this was cancelled" (AGL-3734).
+ *
+ * `AbortError` is what a request rejects with when its `AbortSignal` fires —
+ * a deadline we set, a component that unmounted, a search the author typed
+ * past — and what the browser rejects every in-flight fetch with when the
+ * document goes away under it. On 2026-10-10 one arrived from
+ * `/edit-access`, the page a published site opens in a popup or a hidden
+ * iframe and then CLOSES itself the moment it has its answer. The report had
+ * no stack and no message past the name, so there was no call site to fix:
+ * the page's own mint was already caught, and whatever else the console shell
+ * had in flight was cut off by the site ending the page, which is the flow
+ * working.
+ *
+ * Why the classifier rather than each call site: every request on every
+ * console page can be the one in flight when a page is torn down, and the
+ * abort is the intended outcome in every case. There is nothing a fix of ours
+ * could change, and nothing in the report to locate it by.
+ *
+ * Narrow on purpose. Only `name === 'AbortError'`, and only for an UNHANDLED
+ * REJECTION — not `TimeoutError`, which is `AbortSignal.timeout` saying a
+ * deadline was MISSED (a real slowness), and not an uncaught `error` event or
+ * a `reportHandledError` call, where somebody chose to report it.
+ */
+export declare function isAbortRejection(reason: unknown): boolean;
 /**
  * `kind` for Firebase's `auth/tenant-id-mismatch` — a sibling tab signed in to
  * another account pool (AGL-3280). The console recovers the tab by reloading
@@ -164,6 +245,36 @@ export declare function isHydrationMismatch(message: string): boolean;
  * Never throws: it runs inside the error handler.
  */
 export declare function pageTranslationSignal(doc: Document, servedLang: string | null | undefined): string | undefined;
+/**
+ * A TRANSLATOR'S MARK, REMEMBERED FROM THE MOMENT IT APPEARS (AGL-3738).
+ *
+ * {@link pageTranslationSignal} read at the moment React reports a mismatch
+ * is reading a document the translator no longer owns. React reports a
+ * hydration mismatch only after it has client-rendered the root to recover,
+ * and that render resets `<html>`'s attributes to the ones it rendered —
+ * Chrome's `translated-ltr` class goes, `lang` returns to the served value —
+ * and replaces every `<font>` wrapper and hash-stamped element with fresh
+ * nodes. Measured 2026-10-12 by hydrating aglyn.com/ with a Chrome-style
+ * rewrite of one heading: the report fired with `<html lang="en">`, no class
+ * and no `<font>` left anywhere. Six es-US #418s arrived that day on
+ * aglyn.com/ and orbita-digital.aglyn.app/ (a Spanish site served as `en`);
+ * one carried `lang:en` — the beacon had been installed after the translator
+ * set `lang="es"`, so React's reset was the only rewrite left to see, and the
+ * same simulation reproduces exactly that label — and the other five carried
+ * nothing. The same two pages hydrated cleanly under es-US, en-GB and ru
+ * locales and time zones: nothing on them formats by the visitor's locale.
+ *
+ * So the mark is read when the translator LEAVES it: once at install, for a
+ * translator that ran first, and then from a `MutationObserver` until one is
+ * seen. A translator rewrites the page before React reaches it — that is what
+ * makes it a mismatch — so its mutations are delivered before the report.
+ *
+ * Cheap on purpose: one observer on `<html>`'s own `class`/`lang`, and one on
+ * the tree that looks only at added `<font>` elements and Microsoft's hash
+ * attributes, both disconnected as soon as a mark is found. Never throws, and
+ * a browser without `MutationObserver` gets the read-at-report behavior.
+ */
+export declare function watchPageTranslation(doc: Document, servedLang: string | null | undefined): () => string | undefined;
 /**
  * WHAT A REJECTED PROMISE ACTUALLY CARRIED (AGL-3279).
  *

package/src/lib/app-utils/error-beacon.js

@@ -42,7 +42,8 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * tenant runtime from its own, and neither needs React here. Deliberately NO
  * 'use client' directive — inside this shared lib the directive forks the
  * module graph (AGL-52); every importer is already a client module.
- */ import { isCrossPoolDesync } from "./cross-pool-desync.js";
+ */ import { browserFamily } from "./browser-family.js";
+import { isCrossPoolDesync } from "./cross-pool-desync.js";
 import { isForeignScriptUrl, stackFrameUrls } from "./foreign-script.js";
 import { isStaleBuildError, recoverStaleBuildRejection } from "./stale-build-error.js";
 const MAX_MESSAGE = 1024;
@@ -164,6 +165,60 @@ function clamp(value, max) {
 export function isBenignBrowserNotice(message) {
     return BENIGN_BROWSER_NOTICE.test(message);
 }
+/**
+ * Whether the document is a page a visitor navigated to over the web
+ * (AGL-3759).
+ *
+ * Only `http:` and `https:` qualify. A document at `about:blank` or
+ * `about:srcdoc` is a COPY of our page: a translator extension or a site that
+ * frames our markup renders it into a fresh document with no URL of its own,
+ * and our scripts run there too. Next.js's app router then throws
+ * `Failed to construct 'URL': Invalid URL` resolving its canonical URL against
+ * `window.location.href`, which no code of ours can prevent and no visitor on
+ * the real page ever sees. `file:` (a saved page) and an extension's own
+ * scheme are copies in the same sense.
+ *
+ * A missing or unreadable location is not a web document either: nothing
+ * from it can be traced to a page we serve.
+ */ export function isWebDocument(location) {
+    try {
+        const protocol = location == null ? void 0 : location.protocol;
+        return protocol === 'http:' || protocol === 'https:';
+    } catch (unused) {
+        return false;
+    }
+}
+/**
+ * A rejection that says only "this was cancelled" (AGL-3734).
+ *
+ * `AbortError` is what a request rejects with when its `AbortSignal` fires —
+ * a deadline we set, a component that unmounted, a search the author typed
+ * past — and what the browser rejects every in-flight fetch with when the
+ * document goes away under it. On 2026-10-10 one arrived from
+ * `/edit-access`, the page a published site opens in a popup or a hidden
+ * iframe and then CLOSES itself the moment it has its answer. The report had
+ * no stack and no message past the name, so there was no call site to fix:
+ * the page's own mint was already caught, and whatever else the console shell
+ * had in flight was cut off by the site ending the page, which is the flow
+ * working.
+ *
+ * Why the classifier rather than each call site: every request on every
+ * console page can be the one in flight when a page is torn down, and the
+ * abort is the intended outcome in every case. There is nothing a fix of ours
+ * could change, and nothing in the report to locate it by.
+ *
+ * Narrow on purpose. Only `name === 'AbortError'`, and only for an UNHANDLED
+ * REJECTION — not `TimeoutError`, which is `AbortSignal.timeout` saying a
+ * deadline was MISSED (a real slowness), and not an uncaught `error` event or
+ * a `reportHandledError` call, where somebody chose to report it.
+ */ export function isAbortRejection(reason) {
+    try {
+        return typeof reason === 'object' && reason !== null && reason.name === 'AbortError';
+    } catch (unused) {
+        // A getter that throws leaves the rejection reported, never dropped.
+        return false;
+    }
+}
 /**
  * `kind` for Firebase's `auth/tenant-id-mismatch` — a sibling tab signed in to
  * another account pool (AGL-3280). The console recovers the tab by reloading
@@ -275,6 +330,96 @@ export function isHydrationMismatch(message) {
     }
     return undefined;
 }
+/**
+ * A TRANSLATOR'S MARK, REMEMBERED FROM THE MOMENT IT APPEARS (AGL-3738).
+ *
+ * {@link pageTranslationSignal} read at the moment React reports a mismatch
+ * is reading a document the translator no longer owns. React reports a
+ * hydration mismatch only after it has client-rendered the root to recover,
+ * and that render resets `<html>`'s attributes to the ones it rendered —
+ * Chrome's `translated-ltr` class goes, `lang` returns to the served value —
+ * and replaces every `<font>` wrapper and hash-stamped element with fresh
+ * nodes. Measured 2026-10-12 by hydrating aglyn.com/ with a Chrome-style
+ * rewrite of one heading: the report fired with `<html lang="en">`, no class
+ * and no `<font>` left anywhere. Six es-US #418s arrived that day on
+ * aglyn.com/ and orbita-digital.aglyn.app/ (a Spanish site served as `en`);
+ * one carried `lang:en` — the beacon had been installed after the translator
+ * set `lang="es"`, so React's reset was the only rewrite left to see, and the
+ * same simulation reproduces exactly that label — and the other five carried
+ * nothing. The same two pages hydrated cleanly under es-US, en-GB and ru
+ * locales and time zones: nothing on them formats by the visitor's locale.
+ *
+ * So the mark is read when the translator LEAVES it: once at install, for a
+ * translator that ran first, and then from a `MutationObserver` until one is
+ * seen. A translator rewrites the page before React reaches it — that is what
+ * makes it a mismatch — so its mutations are delivered before the report.
+ *
+ * Cheap on purpose: one observer on `<html>`'s own `class`/`lang`, and one on
+ * the tree that looks only at added `<font>` elements and Microsoft's hash
+ * attributes, both disconnected as soon as a mark is found. Never throws, and
+ * a browser without `MutationObserver` gets the read-at-report behavior.
+ */ export function watchPageTranslation(doc, servedLang) {
+    let seen = pageTranslationSignal(doc, servedLang);
+    const observers = [];
+    const stop = ()=>{
+        for (const observer of observers.splice(0))observer.disconnect();
+    };
+    const inspect = (records)=>{
+        if (seen) return;
+        let relevant = false;
+        for (const record of records){
+            if (record.type === 'attributes') {
+                relevant = true;
+                break;
+            }
+            for (const node of Array.from(record.addedNodes)){
+                if (node.nodeName === 'FONT') {
+                    relevant = true;
+                    break;
+                }
+            }
+            if (relevant) break;
+        }
+        if (!relevant) return;
+        seen = pageTranslationSignal(doc, servedLang);
+        if (seen) stop();
+    };
+    try {
+        const root = doc.documentElement;
+        if (!seen && root && typeof MutationObserver === 'function') {
+            const onRoot = new MutationObserver(inspect);
+            onRoot.observe(root, {
+                attributes: true,
+                attributeFilter: [
+                    'class',
+                    'lang'
+                ]
+            });
+            const onTree = new MutationObserver(inspect);
+            onTree.observe(root, {
+                childList: true,
+                subtree: true,
+                attributes: true,
+                attributeFilter: [
+                    '_msttexthash',
+                    '_msthash'
+                ]
+            });
+            observers.push(onRoot, onTree);
+        }
+    } catch (unused) {
+    // No observer: the report falls back to reading the document as it is.
+    }
+    return ()=>{
+        try {
+            // A rewrite in the same task as the report has not been delivered yet.
+            for (const observer of observers)inspect(observer.takeRecords());
+            return seen != null ? seen : pageTranslationSignal(doc, servedLang);
+        } catch (unused) {
+            return undefined;
+        }
+    };
+}
 /**
  * WHAT A REJECTED PROMISE ACTUALLY CARRIED (AGL-3279).
  *
@@ -408,10 +553,24 @@ let installed = false;
     // (the rejection handler below), because a tab left on a dead deploy is a
     // visitor's problem whether or not its errors are counted.
     const sampled = Math.random() < sampleRate;
+    // A copy of the page in a document that is not on the web reports nothing
+    // by either door, whatever it throws: see `isWebDocument`.
+    const reporting = sampled && isWebDocument(window.location);
     // The document's language as SERVED, read before hydration and before any
     // translator has had a chance to rewrite it (`pageTranslationSignal`).
     const servedLang = (_ref3 = (_document_documentElement = document.documentElement) == null ? void 0 : _document_documentElement.getAttribute('lang')) != null ? _ref3 : null;
-    if (sampled) raiseStackTraceLimit(BEACON_STACK_TRACE_LIMIT);
+    // Watched from now, because React's recovery erases the translator's marks
+    // before a mismatch is reported (`watchPageTranslation`, AGL-3738).
+    const translation = watchPageTranslation(document, servedLang);
+    if (reporting) raiseStackTraceLimit(BEACON_STACK_TRACE_LIMIT);
+    // Classified once, here, and only the family is kept: the user-agent
+    // string itself never reaches the queue (AGL-3732).
+    let browser = 'other';
+    try {
+        browser = browserFamily(navigator.userAgent);
+    } catch (unused) {
+    // An unreadable navigator is just `other`.
+    }
     const seen = new Set();
     let queued = [];
     let sent = 0;
@@ -443,19 +602,21 @@ let installed = false;
     };
     const enqueue = (event)=>{
         var _event_stack;
-        if (!sampled || sent >= maxPerPage) return;
+        if (!reporting || sent >= maxPerPage) return;
         // Message + first stack line: enough identity to collapse a render loop
         // without collapsing distinct errors that share a message.
         const key = `${event.message}\x00${((_event_stack = event.stack) != null ? _event_stack : '').split('\n', 2).join('\n')}`;
         if (seen.has(key)) return;
         seen.add(key);
         sent += 1;
-        queued.push(event);
+        queued.push(_extends({}, event, {
+            browser
+        }));
         if (!timer) timer = setTimeout(flush, FLUSH_DELAY_MS);
     };
-    // Null on an unsampled pageview, so it reports nothing by either door
-    // rather than one by one and none by the other.
-    publishEvent = sampled ? enqueue : null;
+    // Null on a pageview that does not report, so it reports nothing by either
+    // door rather than one by one and none by the other.
+    publishEvent = reporting ? enqueue : null;
     window.addEventListener('error', (event)=>{
         try {
             var _ref, _recoveredErrorKind;
@@ -481,7 +642,14 @@ let installed = false;
             const kind = (_recoveredErrorKind = recoveredErrorKind(error != null ? error : {
                 message
             })) != null ? _recoveredErrorKind : isHydrationMismatch(message) ? 'hydration' : 'error';
-            const translated = kind === 'hydration' ? pageTranslationSignal(document, servedLang) : undefined;
+            const translated = kind === 'hydration' ? translation() : undefined;
+            // A mismatch on a page a translator rewrote is the translator's, not
+            // ours (AGL-3738): React compared our render with text we did not
+            // write, recovered, and the visitor has a working page. Nothing we ship
+            // can change in response, so it goes the way of an injected stack. The
+            // mark is evidence on the document, not a guess about the visitor — an
+            // unmarked mismatch is still reported, and still the one to read.
+            if (translated) return;
             enqueue(_extends({
                 kind,
                 message,
@@ -490,9 +658,7 @@ let installed = false;
                 line: typeof event.lineno === 'number' ? event.lineno : undefined,
                 col: typeof event.colno === 'number' ? event.colno : undefined,
                 url: pageUrl
-            }, translated ? {
-                translated
-            } : {}, kind === 'hydration' && navigator.language ? {
+            }, kind === 'hydration' && navigator.language ? {
                 language: clamp(navigator.language, 16)
             } : {}));
         } catch (unused) {
@@ -508,6 +674,9 @@ let installed = false;
             // `recoverStaleBuildRejection`. A tab whose recovery is spent still
             // reports it, as `chunk-load`.
             if (recoverStaleBuildRejection(event.reason)) return;
+            // A cancelled request, ours or the browser's on teardown: see
+            // `isAbortRejection` for why this is dropped and how narrowly.
+            if (isAbortRejection(event.reason)) return;
             const reason = event.reason;
             const message = clamp(describeRejectionReason(event.reason), MAX_MESSAGE);
             if (!message) return;