@atlaskit/rovo-triggers 10.37.0 → 11.0.0

package/CHANGELOG.md

@@ -1,5 +1,58 @@
 # @atlaskit/rovo-triggers
 
+## 11.0.0
+
+### Major Changes
+
+- [`de8897276a43e`](https://bitbucket.org/atlassian/atlassian-frontend-monorepo/commits/de8897276a43e) -
+  Replace the `rovo-ext_context_bridge` feature gate with the `rovo-ext_context_bridge_exp`
+  experiment, read through its boolean `isEnabled` parameter.
+
+  **Breaking:** `@atlaskit/rovo-triggers/extension-context-bridge/constants` no longer exports
+  `BRIDGE_FEATURE_GATE`. Use `EXT_CONTEXT_BRIDGE_EXPERIMENT` instead, which holds the experiment key
+  rather than the gate key:
+
+  ```diff
+  - import { BRIDGE_FEATURE_GATE } from '@atlaskit/rovo-triggers/extension-context-bridge/constants';
+  + import { EXT_CONTEXT_BRIDGE_EXPERIMENT } from '@atlaskit/rovo-triggers/extension-context-bridge/constants';
+  ```
+
+  `ExtensionContextBridgeHost`, `ExtensionContextBridgeClient` and `ChatOpenerSubscriber` read the
+  experiment through `UNSAFE_expValNoExposure`, so none of them log exposure: the Host mounts at the
+  root of every page of an opted-in product, and exposure there would count product page loads
+  rather than extension users. The Rovo browser extension owns the single exposure call.
+
+  No behaviour change for consumers beyond the assignment source. The
+  `extensionContextBridgeEnabled` prop on `ChatOpenerSubscriber` is unchanged and still required to
+  opt in.
+
+### Minor Changes
+
+- [`487372cfb38b7`](https://bitbucket.org/atlassian/atlassian-frontend-monorepo/commits/487372cfb38b7) -
+  Send the `remix_custom_edit` experience, source page ID, and required editor context for editor
+  Custom Remix requests behind the `aifc_remix_custom_page_edit` gate.
+
+## 10.38.0
+
+### Minor Changes
+
+- [`2124250692aba`](https://bitbucket.org/atlassian/atlassian-frontend-monorepo/commits/2124250692aba) -
+  ASIMO-5048: report what the extension context bridge's inbound relay policy decided for each
+  payload a product publishes, so a refusal is observable instead of silent.
+
+  `ExtensionContextBridgeHost` takes a new optional `onRelayDecision` callback, with its contract on
+  a new `./extension-context-bridge/analytics` entrypoint, and the serializer now returns a
+  discriminated result so a refusal names its reason. `ChatOpenerSubscriber` wires the callback to
+  the analytics client it already holds, emitting a `rovoExtensionBridgePayload evaluated`
+  operational event into the host product's stream.
+
+  Product to extension direction only. Deduplicated to one report per distinct outcome per mount,
+  and only active while `rovo-ext_context_bridge` is on.
+
+### Patch Changes
+
+- Updated dependencies
+
 ## 10.37.0
 
 ### Minor Changes

package/dist/cjs/common/utils/extension-context-bridge/ExtensionContextBridgeClient.js

@@ -7,7 +7,7 @@ Object.defineProperty(exports, "__esModule", {
 exports.ExtensionContextBridgeClient = void 0;
 var _defineProperty2 = _interopRequireDefault(require("@babel/runtime/helpers/defineProperty"));
 var _react = require("react");
-var _fg = require("@atlaskit/platform-feature-flags/fg");
+var _unsafeExpValNoExposure = require("@atlaskit/platform-feature-experiments/unsafe-exp-val-no-exposure");
 var _main = require("../../../main");
 var _constants = require("./constants");
 var _policy = require("./policy");
@@ -60,8 +60,9 @@ var isChatFocused = function isChatFocused() {
 var ExtensionContextBridgeClient = exports.ExtensionContextBridgeClient = function ExtensionContextBridgeClient(_ref) {
   var transport = _ref.transport,
     allowedOrigins = _ref.allowedOrigins;
-  // Self-gated. Matches `BRIDGE_FEATURE_GATE` in `./constants`.
-  var active = (0, _fg.fg)('rovo-ext_context_bridge');
+  // Self-gated. Matches `EXT_CONTEXT_BRIDGE_EXPERIMENT` in `./constants`. No-exposure read: the
+  // extension decides whether to mount this and owns the exposure call.
+  var active = (0, _unsafeExpValNoExposure.UNSAFE_expValNoExposure)('rovo-ext_context_bridge_exp', 'isEnabled', false) === true;
   var publish = (0, _main.usePublish)('ai-mate');
   var lastKnownSelectionRef = (0, _react.useRef)(null);
   var activeTransport = (0, _react.useMemo)(function () {
@@ -161,12 +162,12 @@ var ExtensionContextBridgeClient = exports.ExtensionContextBridgeClient = functi
     if (!(0, _policy.shouldRelayToProduct)(payload.type)) {
       return;
     }
-    var serialized = (0, _registry.serializePayload)(payload);
-    if (!serialized) {
+    var result = (0, _registry.serializePayload)(payload);
+    if (!result.ok) {
       return;
     }
     try {
-      activeTransport.send((0, _defineProperty2.default)((0, _defineProperty2.default)((0, _defineProperty2.default)({}, _constants.BRIDGE_MESSAGE_MARKER, true), "direction", _constants.BRIDGE_TO_PRODUCT), "payload", serialized));
+      activeTransport.send((0, _defineProperty2.default)((0, _defineProperty2.default)((0, _defineProperty2.default)({}, _constants.BRIDGE_MESSAGE_MARKER, true), "direction", _constants.BRIDGE_TO_PRODUCT), "payload", result.payload));
     } catch (_unused3) {
       // Never let bridging break the chat iframe.
     }

package/dist/cjs/common/utils/extension-context-bridge/ExtensionContextBridgeHost.js

@@ -6,10 +6,10 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.ExtensionContextBridgeHost = void 0;
 var _defineProperty2 = _interopRequireDefault(require("@babel/runtime/helpers/defineProperty"));
-var _typeof2 = _interopRequireDefault(require("@babel/runtime/helpers/typeof"));
 var _react = require("react");
-var _fg = require("@atlaskit/platform-feature-flags/fg");
+var _unsafeExpValNoExposure = require("@atlaskit/platform-feature-experiments/unsafe-exp-val-no-exposure");
 var _main = require("../../../main");
+var _analytics = require("./analytics");
 var _constants = require("./constants");
 var _policy = require("./policy");
 var _registry = require("./registry");
@@ -40,14 +40,8 @@ var stampProductContentId = function stampProductContentId(serialized, targetCon
  * else is keyed by payload type, of which there is one live instance at a time.
  */
 var getContextSlotKey = function getContextSlotKey(payload) {
-  if (payload.type === 'set-message-context') {
-    var data = payload.data;
-    var contextKey = (0, _typeof2.default)(data) === 'object' && data !== null && 'contextKey' in data ? data.contextKey : undefined;
-    if (typeof contextKey === 'string') {
-      return "".concat(payload.type, ":").concat(contextKey);
-    }
-  }
-  return payload.type;
+  var contextKey = (0, _analytics.getContextKey)(payload);
+  return contextKey === undefined ? payload.type : "".concat(payload.type, ":").concat(contextKey);
 };
 /**
  * Product-window half of the bridge. Observes the `ai-mate` bus and mirrors allowlisted context out
@@ -59,10 +53,15 @@ var getContextSlotKey = function getContextSlotKey(payload) {
 var ExtensionContextBridgeHost = exports.ExtensionContextBridgeHost = function ExtensionContextBridgeHost(_ref) {
   var transport = _ref.transport,
     getContentId = _ref.getContentId,
-    isAiEnabled = _ref.isAiEnabled;
+    isAiEnabled = _ref.isAiEnabled,
+    onRelayDecision = _ref.onRelayDecision;
   // Self-gated (not taken from the consumer) so this cannot mount by mistake wherever
-  // `ChatOpenerSubscriber` renders. Matches `BRIDGE_FEATURE_GATE` in `./constants`.
-  var active = (0, _fg.fg)('rovo-ext_context_bridge');
+  // `ChatOpenerSubscriber` renders. Matches `EXT_CONTEXT_BRIDGE_EXPERIMENT` in `./constants`.
+  //
+  // No-exposure read on purpose: this component mounts on every page of an opted-in product, so
+  // firing exposure here would measure product page loads instead of extension users. The
+  // extension logs the one exposure. See `./constants`.
+  var active = (0, _unsafeExpValNoExposure.UNSAFE_expValNoExposure)('rovo-ext_context_bridge_exp', 'isEnabled', false) === true;
   var activeTransport = (0, _react.useMemo)(function () {
     if (!active) {
       return undefined;
@@ -87,6 +86,9 @@ var ExtensionContextBridgeHost = exports.ExtensionContextBridgeHost = function E
    */
   var lastRelayedRef = (0, _react.useRef)(new Map());
 
+  /** Reported decisions, so a per-keystroke payload yields one event rather than thousands. */
+  var reportedDecisionsRef = (0, _react.useRef)(new Set());
+
   // Answers `request-context` from the chat, which cannot observe context published before it
   // mounted. Products such as Jira publish once per navigation, so without this a chat opened after
   // the page settled would describe the wrong view — or none at all.
@@ -124,17 +126,32 @@ var ExtensionContextBridgeHost = exports.ExtensionContextBridgeHost = function E
     if (isAiEnabled === false) {
       return;
     }
-    // Loop guard.
+    // Loop guard. Not reported: our own echo, not a decision about the product.
     if (payload.interactionSource === _constants.BRIDGE_SOURCE) {
       return;
     }
-    if ((0, _policy.getInboundDecision)(payload.type) !== 'allow') {
+    var report = function report(decision) {
+      (0, _analytics.reportRelayDecision)(reportedDecisionsRef.current, onRelayDecision, {
+        payloadType: payload.type,
+        contextKey: (0, _analytics.getContextKey)(payload),
+        relayed: decision === 'allow',
+        decision: decision,
+        publisherSource: payload.source,
+        payloadProduct: payload.product
+      });
+    };
+    var inboundDecision = (0, _policy.getInboundDecision)(payload.type);
+    if (inboundDecision !== 'allow') {
+      report(inboundDecision);
       return;
     }
-    var serialized = (0, _registry.serializePayload)(payload);
-    if (!serialized) {
+    var result = (0, _registry.serializePayload)(payload);
+    if (!result.ok) {
+      report(result.reason);
       return;
     }
+    report('allow');
+    var serialized = result.payload;
     stampProductContentId(serialized, getContentId === null || getContentId === void 0 ? void 0 : getContentId());
     var message = (0, _defineProperty2.default)((0, _defineProperty2.default)((0, _defineProperty2.default)({}, _constants.BRIDGE_MESSAGE_MARKER, true), "direction", _constants.BRIDGE_TO_EXTENSION), "payload", serialized);
     // Keyed by context slot, not by message, so a re-publish replaces rather than accumulates.

package/dist/cjs/common/utils/extension-context-bridge/analytics.js

@@ -0,0 +1,87 @@
+"use strict";
+
+var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault");
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.reportRelayDecision = exports.getContextKey = void 0;
+var _defineProperty2 = _interopRequireDefault(require("@babel/runtime/helpers/defineProperty"));
+var _typeof2 = _interopRequireDefault(require("@babel/runtime/helpers/typeof"));
+function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { (0, _defineProperty2.default)(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+/**
+ * Inbound relay decision reporting: what the product asked the bridge to relay, and what the policy
+ * in `./policy` / `./registry` decided. Every refusal is otherwise silent, so the allowlist can only
+ * be widened from data with this.
+ *
+ * Product → extension only, hence no direction field. The outbound allowlist has one entry and is
+ * owned by the chat, so products cannot drift into it.
+ *
+ * Consumer-supplied callback rather than an event fired here, for the same reason as the Host's
+ * `getContentId`: this package has no analytics dependency.
+ */
+
+/**
+ * Why `./registry` refused to serialise a payload. Kept distinct because the fixes differ:
+ * `context-key-not-allowlisted` is a list we can widen, the rest are publisher-side shape problems.
+ */
+
+/** Every outcome the bridge can reach for a payload it was asked to relay. */
+
+/** A slot identifier by contract, capped in case a publisher ever interpolates an id into one. */
+var MAX_CONTEXT_KEY_LENGTH = 80;
+
+/**
+ * (payload types × decisions) is finite and far below this; the cap is for `contextKey`, which is
+ * not. A publisher generating keys would otherwise grow the dedupe set for the life of the page.
+ */
+var MAX_REPORTED_DECISIONS = 50;
+/**
+ * The context slot a `set-message-context` payload addresses. Shape-checked rather than cast: runs
+ * against the raw bus payload, the serialized form, and types carrying neither. The Host also keys
+ * its replay map on this.
+ */
+var getContextKey = exports.getContextKey = function getContextKey(payload) {
+  if (payload.type !== 'set-message-context') {
+    return undefined;
+  }
+  var data = payload.data;
+  var contextKey = (0, _typeof2.default)(data) === 'object' && data !== null && 'contextKey' in data ? data.contextKey : undefined;
+  return typeof contextKey === 'string' ? contextKey : undefined;
+};
+
+/** Identity of a decision for deduplication purposes. */
+var getDecisionKey = function getDecisionKey(_ref) {
+  var payloadType = _ref.payloadType,
+    contextKey = _ref.contextKey,
+    decision = _ref.decision;
+  return "".concat(payloadType, "|").concat(contextKey !== null && contextKey !== void 0 ? contextKey : '', "|").concat(decision);
+};
+
+/**
+ * Report a relay decision at most once per distinct outcome. Deduplicated because the bridge sees
+ * the whole product bus and `editor-context-payload` recurs on roughly every keystroke; which keys
+ * exist and how they were decided is the question, not how often each recurred.
+ *
+ * `seen` is caller-owned (a ref in the Host), so the window is one mount. Never throws.
+ */
+var reportRelayDecision = exports.reportRelayDecision = function reportRelayDecision(seen, onRelayDecision, decision) {
+  var _decision$contextKey;
+  if (!onRelayDecision) {
+    return;
+  }
+  var truncatedContextKey = (_decision$contextKey = decision.contextKey) === null || _decision$contextKey === void 0 ? void 0 : _decision$contextKey.slice(0, MAX_CONTEXT_KEY_LENGTH);
+  var reportable = _objectSpread(_objectSpread({}, decision), {}, {
+    contextKey: truncatedContextKey
+  });
+  var key = getDecisionKey(reportable);
+  if (seen.has(key) || seen.size >= MAX_REPORTED_DECISIONS) {
+    return;
+  }
+  seen.add(key);
+  try {
+    onRelayDecision(reportable);
+  } catch (_unused) {
+    // Reporting is observability, never a reason for the relay to fail.
+  }
+};

package/dist/cjs/common/utils/extension-context-bridge/constants.js

@@ -3,13 +3,19 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.BRIDGE_TO_PRODUCT = exports.BRIDGE_TO_EXTENSION = exports.BRIDGE_SOURCE = exports.BRIDGE_MESSAGE_MARKER = exports.BRIDGE_FEATURE_GATE = exports.BRIDGE_CONTROL_REQUEST_CONTEXT = void 0;
+exports.EXT_CONTEXT_BRIDGE_EXPERIMENT = exports.BRIDGE_TO_PRODUCT = exports.BRIDGE_TO_EXTENSION = exports.BRIDGE_SOURCE = exports.BRIDGE_MESSAGE_MARKER = exports.BRIDGE_CONTROL_REQUEST_CONTEXT = void 0;
 /**
- * Feature gate for the extension context bridge; both Host and Client self-gate on it.
- * `fg()` requires a static literal, so call sites inline this value rather than importing it;
- * tests resolve the gate through this constant so the two cannot drift apart.
+ * Statsig experiment for the extension context bridge; both Host and Client self-gate on its
+ * boolean `isEnabled` parameter. Call sites inline this value rather than importing it, since the
+ * experiment runtime takes a static literal; tests resolve the experiment through this constant so
+ * the two cannot drift apart.
+ *
+ * Read here **without** logging exposure. Host mounts at the root of every page of an opted-in
+ * product, so an exposure-firing read would count product page loads rather than extension users.
+ * The extension owns the single exposure call, at the point the user is on a page the bridge can
+ * act on.
  */
-var BRIDGE_FEATURE_GATE = exports.BRIDGE_FEATURE_GATE = 'rovo-ext_context_bridge';
+var EXT_CONTEXT_BRIDGE_EXPERIMENT = exports.EXT_CONTEXT_BRIDGE_EXPERIMENT = 'rovo-ext_context_bridge_exp';
 
 /** Marker on every bridge `postMessage`, so listeners can ignore unrelated messages. */
 var BRIDGE_MESSAGE_MARKER = exports.BRIDGE_MESSAGE_MARKER = '__rovoExtContextBridge';

package/dist/cjs/common/utils/extension-context-bridge/registry.js

@@ -11,6 +11,18 @@ var _constants = require("./constants");
 var _policy = require("./policy");
 function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
 function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { (0, _defineProperty2.default)(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+/**
+ * Outcome of serialising a payload for the wire. A bare `| null` would collapse five distinct
+ * refusals into one, notably a non-allowlisted context key versus a merge-style publisher, which
+ * need different fixes. `reason` is reported as analytics (see `./analytics`).
+ */
+
+var dropped = function dropped(reason) {
+  return {
+    ok: false,
+    reason: reason
+  };
+};
 var base = function base(payload) {
   return {
     type: payload.type,
@@ -50,33 +62,36 @@ var SHIMS = {
     serialize: function serialize(payload) {
       var data = payload.data;
       if (!data || typeof data.setContext !== 'function') {
-        return null;
+        return dropped('missing-set-context');
       }
       // Checked before `setContext` runs, so a non-allowlisted key never invokes product code.
       if (!(0, _policy.isRelayableContextKey)(data.contextKey)) {
-        return null;
+        return dropped('context-key-not-allowlisted');
       }
       var value;
       try {
         value = data.setContext((0, _defineProperty2.default)({}, MERGE_PROBE_KEY, true));
       } catch (_unused) {
-        return null;
+        return dropped('set-context-threw');
       }
       // Sentinel survived: merge-style, cannot be resolved to a standalone value.
       if ((0, _typeof2.default)(value) === 'object' && value !== null && MERGE_PROBE_KEY in value) {
-        return null;
+        return dropped('merge-style-publisher');
       }
       try {
         JSON.stringify(value);
       } catch (_unused2) {
-        return null;
+        return dropped('not-serializable');
       }
-      return _objectSpread(_objectSpread({}, base(payload)), {}, {
-        data: {
-          contextKey: data.contextKey,
-          value: value
-        }
-      });
+      return {
+        ok: true,
+        payload: _objectSpread(_objectSpread({}, base(payload)), {}, {
+          data: {
+            contextKey: data.contextKey,
+            value: value
+          }
+        })
+      };
     },
     deserialize: function deserialize(serialized) {
       var _serialized$source;
@@ -115,11 +130,14 @@ var serializePayload = exports.serializePayload = function serializePayload(payl
   try {
     data = rawData === undefined ? undefined : JSON.parse(JSON.stringify(rawData));
   } catch (_unused3) {
-    return null;
+    return dropped('not-serializable');
   }
-  return _objectSpread(_objectSpread({}, base(payload)), {}, {
-    data: data
-  });
+  return {
+    ok: true,
+    payload: _objectSpread(_objectSpread({}, base(payload)), {}, {
+      data: data
+    })
+  };
 };
 
 /** Reconstruct a payload from the wire, stamping the loop-guard sentinel. */

package/dist/es2019/common/utils/extension-context-bridge/ExtensionContextBridgeClient.js

@@ -1,5 +1,5 @@
 import { useEffect, useMemo, useRef } from 'react';
-import { fg } from '@atlaskit/platform-feature-flags/fg';
+import { UNSAFE_expValNoExposure } from '@atlaskit/platform-feature-experiments/unsafe-exp-val-no-exposure';
 import { usePublish, useSubscribeAll } from '../../../main';
 import { BRIDGE_CONTROL_REQUEST_CONTEXT, BRIDGE_MESSAGE_MARKER, BRIDGE_SOURCE, BRIDGE_TO_EXTENSION, BRIDGE_TO_PRODUCT } from './constants';
 import { shouldRelayToProduct } from './policy';
@@ -52,8 +52,9 @@ export const ExtensionContextBridgeClient = ({
   transport,
   allowedOrigins
 }) => {
-  // Self-gated. Matches `BRIDGE_FEATURE_GATE` in `./constants`.
-  const active = fg('rovo-ext_context_bridge');
+  // Self-gated. Matches `EXT_CONTEXT_BRIDGE_EXPERIMENT` in `./constants`. No-exposure read: the
+  // extension decides whether to mount this and owns the exposure call.
+  const active = UNSAFE_expValNoExposure('rovo-ext_context_bridge_exp', 'isEnabled', false) === true;
   const publish = usePublish('ai-mate');
   const lastKnownSelectionRef = useRef(null);
   const activeTransport = useMemo(() => {
@@ -159,15 +160,15 @@ export const ExtensionContextBridgeClient = ({
     if (!shouldRelayToProduct(payload.type)) {
       return;
     }
-    const serialized = serializePayload(payload);
-    if (!serialized) {
+    const result = serializePayload(payload);
+    if (!result.ok) {
       return;
     }
     try {
       activeTransport.send({
         [BRIDGE_MESSAGE_MARKER]: true,
         direction: BRIDGE_TO_PRODUCT,
-        payload: serialized
+        payload: result.payload
       });
     } catch {
       // Never let bridging break the chat iframe.

package/dist/es2019/common/utils/extension-context-bridge/ExtensionContextBridgeHost.js

@@ -1,6 +1,7 @@
 import { useEffect, useMemo, useRef } from 'react';
-import { fg } from '@atlaskit/platform-feature-flags/fg';
+import { UNSAFE_expValNoExposure } from '@atlaskit/platform-feature-experiments/unsafe-exp-val-no-exposure';
 import { useSubscribeAll } from '../../../main';
+import { getContextKey, reportRelayDecision } from './analytics';
 import { BRIDGE_CONTROL_REQUEST_CONTEXT, BRIDGE_MESSAGE_MARKER, BRIDGE_SOURCE, BRIDGE_TO_EXTENSION, BRIDGE_TO_PRODUCT } from './constants';
 import { getInboundDecision } from './policy';
 import { serializePayload } from './registry';
@@ -31,14 +32,8 @@ const stampProductContentId = (serialized, targetContentId) => {
  * else is keyed by payload type, of which there is one live instance at a time.
  */
 const getContextSlotKey = payload => {
-  if (payload.type === 'set-message-context') {
-    const data = payload.data;
-    const contextKey = typeof data === 'object' && data !== null && 'contextKey' in data ? data.contextKey : undefined;
-    if (typeof contextKey === 'string') {
-      return `${payload.type}:${contextKey}`;
-    }
-  }
-  return payload.type;
+  const contextKey = getContextKey(payload);
+  return contextKey === undefined ? payload.type : `${payload.type}:${contextKey}`;
 };
 /**
  * Product-window half of the bridge. Observes the `ai-mate` bus and mirrors allowlisted context out
@@ -50,11 +45,16 @@ const getContextSlotKey = payload => {
 export const ExtensionContextBridgeHost = ({
   transport,
   getContentId,
-  isAiEnabled
+  isAiEnabled,
+  onRelayDecision
 }) => {
   // Self-gated (not taken from the consumer) so this cannot mount by mistake wherever
-  // `ChatOpenerSubscriber` renders. Matches `BRIDGE_FEATURE_GATE` in `./constants`.
-  const active = fg('rovo-ext_context_bridge');
+  // `ChatOpenerSubscriber` renders. Matches `EXT_CONTEXT_BRIDGE_EXPERIMENT` in `./constants`.
+  //
+  // No-exposure read on purpose: this component mounts on every page of an opted-in product, so
+  // firing exposure here would measure product page loads instead of extension users. The
+  // extension logs the one exposure. See `./constants`.
+  const active = UNSAFE_expValNoExposure('rovo-ext_context_bridge_exp', 'isEnabled', false) === true;
   const activeTransport = useMemo(() => {
     if (!active) {
       return undefined;
@@ -79,6 +79,9 @@ export const ExtensionContextBridgeHost = ({
    */
   const lastRelayedRef = useRef(new Map());
 
+  /** Reported decisions, so a per-keystroke payload yields one event rather than thousands. */
+  const reportedDecisionsRef = useRef(new Set());
+
   // Answers `request-context` from the chat, which cannot observe context published before it
   // mounted. Products such as Jira publish once per navigation, so without this a chat opened after
   // the page settled would describe the wrong view — or none at all.
@@ -116,17 +119,32 @@ export const ExtensionContextBridgeHost = ({
     if (isAiEnabled === false) {
       return;
     }
-    // Loop guard.
+    // Loop guard. Not reported: our own echo, not a decision about the product.
     if (payload.interactionSource === BRIDGE_SOURCE) {
       return;
     }
-    if (getInboundDecision(payload.type) !== 'allow') {
+    const report = decision => {
+      reportRelayDecision(reportedDecisionsRef.current, onRelayDecision, {
+        payloadType: payload.type,
+        contextKey: getContextKey(payload),
+        relayed: decision === 'allow',
+        decision,
+        publisherSource: payload.source,
+        payloadProduct: payload.product
+      });
+    };
+    const inboundDecision = getInboundDecision(payload.type);
+    if (inboundDecision !== 'allow') {
+      report(inboundDecision);
       return;
     }
-    const serialized = serializePayload(payload);
-    if (!serialized) {
+    const result = serializePayload(payload);
+    if (!result.ok) {
+      report(result.reason);
       return;
     }
+    report('allow');
+    const serialized = result.payload;
     stampProductContentId(serialized, getContentId === null || getContentId === void 0 ? void 0 : getContentId());
     const message = {
       [BRIDGE_MESSAGE_MARKER]: true,

package/dist/es2019/common/utils/extension-context-bridge/analytics.js

@@ -0,0 +1,76 @@
+/**
+ * Inbound relay decision reporting: what the product asked the bridge to relay, and what the policy
+ * in `./policy` / `./registry` decided. Every refusal is otherwise silent, so the allowlist can only
+ * be widened from data with this.
+ *
+ * Product → extension only, hence no direction field. The outbound allowlist has one entry and is
+ * owned by the chat, so products cannot drift into it.
+ *
+ * Consumer-supplied callback rather than an event fired here, for the same reason as the Host's
+ * `getContentId`: this package has no analytics dependency.
+ */
+
+/**
+ * Why `./registry` refused to serialise a payload. Kept distinct because the fixes differ:
+ * `context-key-not-allowlisted` is a list we can widen, the rest are publisher-side shape problems.
+ */
+
+/** Every outcome the bridge can reach for a payload it was asked to relay. */
+
+/** A slot identifier by contract, capped in case a publisher ever interpolates an id into one. */
+const MAX_CONTEXT_KEY_LENGTH = 80;
+
+/**
+ * (payload types × decisions) is finite and far below this; the cap is for `contextKey`, which is
+ * not. A publisher generating keys would otherwise grow the dedupe set for the life of the page.
+ */
+const MAX_REPORTED_DECISIONS = 50;
+/**
+ * The context slot a `set-message-context` payload addresses. Shape-checked rather than cast: runs
+ * against the raw bus payload, the serialized form, and types carrying neither. The Host also keys
+ * its replay map on this.
+ */
+export const getContextKey = payload => {
+  if (payload.type !== 'set-message-context') {
+    return undefined;
+  }
+  const data = payload.data;
+  const contextKey = typeof data === 'object' && data !== null && 'contextKey' in data ? data.contextKey : undefined;
+  return typeof contextKey === 'string' ? contextKey : undefined;
+};
+
+/** Identity of a decision for deduplication purposes. */
+const getDecisionKey = ({
+  payloadType,
+  contextKey,
+  decision
+}) => `${payloadType}|${contextKey !== null && contextKey !== void 0 ? contextKey : ''}|${decision}`;
+
+/**
+ * Report a relay decision at most once per distinct outcome. Deduplicated because the bridge sees
+ * the whole product bus and `editor-context-payload` recurs on roughly every keystroke; which keys
+ * exist and how they were decided is the question, not how often each recurred.
+ *
+ * `seen` is caller-owned (a ref in the Host), so the window is one mount. Never throws.
+ */
+export const reportRelayDecision = (seen, onRelayDecision, decision) => {
+  var _decision$contextKey;
+  if (!onRelayDecision) {
+    return;
+  }
+  const truncatedContextKey = (_decision$contextKey = decision.contextKey) === null || _decision$contextKey === void 0 ? void 0 : _decision$contextKey.slice(0, MAX_CONTEXT_KEY_LENGTH);
+  const reportable = {
+    ...decision,
+    contextKey: truncatedContextKey
+  };
+  const key = getDecisionKey(reportable);
+  if (seen.has(key) || seen.size >= MAX_REPORTED_DECISIONS) {
+    return;
+  }
+  seen.add(key);
+  try {
+    onRelayDecision(reportable);
+  } catch {
+    // Reporting is observability, never a reason for the relay to fail.
+  }
+};

package/dist/es2019/common/utils/extension-context-bridge/constants.js

@@ -1,9 +1,15 @@
 /**
- * Feature gate for the extension context bridge; both Host and Client self-gate on it.
- * `fg()` requires a static literal, so call sites inline this value rather than importing it;
- * tests resolve the gate through this constant so the two cannot drift apart.
+ * Statsig experiment for the extension context bridge; both Host and Client self-gate on its
+ * boolean `isEnabled` parameter. Call sites inline this value rather than importing it, since the
+ * experiment runtime takes a static literal; tests resolve the experiment through this constant so
+ * the two cannot drift apart.
+ *
+ * Read here **without** logging exposure. Host mounts at the root of every page of an opted-in
+ * product, so an exposure-firing read would count product page loads rather than extension users.
+ * The extension owns the single exposure call, at the point the user is on a page the bridge can
+ * act on.
  */
-export const BRIDGE_FEATURE_GATE = 'rovo-ext_context_bridge';
+export const EXT_CONTEXT_BRIDGE_EXPERIMENT = 'rovo-ext_context_bridge_exp';
 
 /** Marker on every bridge `postMessage`, so listeners can ignore unrelated messages. */
 export const BRIDGE_MESSAGE_MARKER = '__rovoExtContextBridge';

package/dist/es2019/common/utils/extension-context-bridge/registry.js

@@ -1,5 +1,16 @@
 import { BRIDGE_SOURCE } from './constants';
 import { isRelayableContextKey } from './policy';
+
+/**
+ * Outcome of serialising a payload for the wire. A bare `| null` would collapse five distinct
+ * refusals into one, notably a non-allowlisted context key versus a merge-style publisher, which
+ * need different fixes. `reason` is reported as analytics (see `./analytics`).
+ */
+
+const dropped = reason => ({
+  ok: false,
+  reason
+});
 const base = payload => ({
   type: payload.type,
   source: payload.source,
@@ -36,11 +47,11 @@ const SHIMS = {
     serialize: payload => {
       const data = payload.data;
       if (!data || typeof data.setContext !== 'function') {
-        return null;
+        return dropped('missing-set-context');
       }
       // Checked before `setContext` runs, so a non-allowlisted key never invokes product code.
       if (!isRelayableContextKey(data.contextKey)) {
-        return null;
+        return dropped('context-key-not-allowlisted');
       }
       let value;
       try {
@@ -48,22 +59,25 @@ const SHIMS = {
           [MERGE_PROBE_KEY]: true
         });
       } catch {
-        return null;
+        return dropped('set-context-threw');
       }
       // Sentinel survived: merge-style, cannot be resolved to a standalone value.
       if (typeof value === 'object' && value !== null && MERGE_PROBE_KEY in value) {
-        return null;
+        return dropped('merge-style-publisher');
       }
       try {
         JSON.stringify(value);
       } catch {
-        return null;
+        return dropped('not-serializable');
       }
       return {
-        ...base(payload),
-        data: {
-          contextKey: data.contextKey,
-          value
+        ok: true,
+        payload: {
+          ...base(payload),
+          data: {
+            contextKey: data.contextKey,
+            value
+          }
         }
       };
     },
@@ -100,11 +114,14 @@ export const serializePayload = payload => {
   try {
     data = rawData === undefined ? undefined : JSON.parse(JSON.stringify(rawData));
   } catch {
-    return null;
+    return dropped('not-serializable');
   }
   return {
-    ...base(payload),
-    data
+    ok: true,
+    payload: {
+      ...base(payload),
+      data
+    }
   };
 };
 

package/dist/esm/common/utils/extension-context-bridge/ExtensionContextBridgeClient.js

@@ -2,7 +2,7 @@ import _defineProperty from "@babel/runtime/helpers/defineProperty";
 function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
 function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 import { useEffect, useMemo, useRef } from 'react';
-import { fg } from '@atlaskit/platform-feature-flags/fg';
+import { UNSAFE_expValNoExposure } from '@atlaskit/platform-feature-experiments/unsafe-exp-val-no-exposure';
 import { usePublish, useSubscribeAll } from '../../../main';
 import { BRIDGE_CONTROL_REQUEST_CONTEXT, BRIDGE_MESSAGE_MARKER, BRIDGE_SOURCE, BRIDGE_TO_EXTENSION, BRIDGE_TO_PRODUCT } from './constants';
 import { shouldRelayToProduct } from './policy';
@@ -54,8 +54,9 @@ var isChatFocused = function isChatFocused() {
 export var ExtensionContextBridgeClient = function ExtensionContextBridgeClient(_ref) {
   var transport = _ref.transport,
     allowedOrigins = _ref.allowedOrigins;
-  // Self-gated. Matches `BRIDGE_FEATURE_GATE` in `./constants`.
-  var active = fg('rovo-ext_context_bridge');
+  // Self-gated. Matches `EXT_CONTEXT_BRIDGE_EXPERIMENT` in `./constants`. No-exposure read: the
+  // extension decides whether to mount this and owns the exposure call.
+  var active = UNSAFE_expValNoExposure('rovo-ext_context_bridge_exp', 'isEnabled', false) === true;
   var publish = usePublish('ai-mate');
   var lastKnownSelectionRef = useRef(null);
   var activeTransport = useMemo(function () {
@@ -155,12 +156,12 @@ export var ExtensionContextBridgeClient = function ExtensionContextBridgeClient(
     if (!shouldRelayToProduct(payload.type)) {
       return;
     }
-    var serialized = serializePayload(payload);
-    if (!serialized) {
+    var result = serializePayload(payload);
+    if (!result.ok) {
       return;
     }
     try {
-      activeTransport.send(_defineProperty(_defineProperty(_defineProperty({}, BRIDGE_MESSAGE_MARKER, true), "direction", BRIDGE_TO_PRODUCT), "payload", serialized));
+      activeTransport.send(_defineProperty(_defineProperty(_defineProperty({}, BRIDGE_MESSAGE_MARKER, true), "direction", BRIDGE_TO_PRODUCT), "payload", result.payload));
     } catch (_unused3) {
       // Never let bridging break the chat iframe.
     }

package/dist/esm/common/utils/extension-context-bridge/ExtensionContextBridgeHost.js

@@ -1,8 +1,8 @@
 import _defineProperty from "@babel/runtime/helpers/defineProperty";
-import _typeof from "@babel/runtime/helpers/typeof";
 import { useEffect, useMemo, useRef } from 'react';
-import { fg } from '@atlaskit/platform-feature-flags/fg';
+import { UNSAFE_expValNoExposure } from '@atlaskit/platform-feature-experiments/unsafe-exp-val-no-exposure';
 import { useSubscribeAll } from '../../../main';
+import { getContextKey, reportRelayDecision } from './analytics';
 import { BRIDGE_CONTROL_REQUEST_CONTEXT, BRIDGE_MESSAGE_MARKER, BRIDGE_SOURCE, BRIDGE_TO_EXTENSION, BRIDGE_TO_PRODUCT } from './constants';
 import { getInboundDecision } from './policy';
 import { serializePayload } from './registry';
@@ -33,14 +33,8 @@ var stampProductContentId = function stampProductContentId(serialized, targetCon
  * else is keyed by payload type, of which there is one live instance at a time.
  */
 var getContextSlotKey = function getContextSlotKey(payload) {
-  if (payload.type === 'set-message-context') {
-    var data = payload.data;
-    var contextKey = _typeof(data) === 'object' && data !== null && 'contextKey' in data ? data.contextKey : undefined;
-    if (typeof contextKey === 'string') {
-      return "".concat(payload.type, ":").concat(contextKey);
-    }
-  }
-  return payload.type;
+  var contextKey = getContextKey(payload);
+  return contextKey === undefined ? payload.type : "".concat(payload.type, ":").concat(contextKey);
 };
 /**
  * Product-window half of the bridge. Observes the `ai-mate` bus and mirrors allowlisted context out
@@ -52,10 +46,15 @@ var getContextSlotKey = function getContextSlotKey(payload) {
 export var ExtensionContextBridgeHost = function ExtensionContextBridgeHost(_ref) {
   var transport = _ref.transport,
     getContentId = _ref.getContentId,
-    isAiEnabled = _ref.isAiEnabled;
+    isAiEnabled = _ref.isAiEnabled,
+    onRelayDecision = _ref.onRelayDecision;
   // Self-gated (not taken from the consumer) so this cannot mount by mistake wherever
-  // `ChatOpenerSubscriber` renders. Matches `BRIDGE_FEATURE_GATE` in `./constants`.
-  var active = fg('rovo-ext_context_bridge');
+  // `ChatOpenerSubscriber` renders. Matches `EXT_CONTEXT_BRIDGE_EXPERIMENT` in `./constants`.
+  //
+  // No-exposure read on purpose: this component mounts on every page of an opted-in product, so
+  // firing exposure here would measure product page loads instead of extension users. The
+  // extension logs the one exposure. See `./constants`.
+  var active = UNSAFE_expValNoExposure('rovo-ext_context_bridge_exp', 'isEnabled', false) === true;
   var activeTransport = useMemo(function () {
     if (!active) {
       return undefined;
@@ -80,6 +79,9 @@ export var ExtensionContextBridgeHost = function ExtensionContextBridgeHost(_ref
    */
   var lastRelayedRef = useRef(new Map());
 
+  /** Reported decisions, so a per-keystroke payload yields one event rather than thousands. */
+  var reportedDecisionsRef = useRef(new Set());
+
   // Answers `request-context` from the chat, which cannot observe context published before it
   // mounted. Products such as Jira publish once per navigation, so without this a chat opened after
   // the page settled would describe the wrong view — or none at all.
@@ -117,17 +119,32 @@ export var ExtensionContextBridgeHost = function ExtensionContextBridgeHost(_ref
     if (isAiEnabled === false) {
       return;
     }
-    // Loop guard.
+    // Loop guard. Not reported: our own echo, not a decision about the product.
     if (payload.interactionSource === BRIDGE_SOURCE) {
       return;
     }
-    if (getInboundDecision(payload.type) !== 'allow') {
+    var report = function report(decision) {
+      reportRelayDecision(reportedDecisionsRef.current, onRelayDecision, {
+        payloadType: payload.type,
+        contextKey: getContextKey(payload),
+        relayed: decision === 'allow',
+        decision: decision,
+        publisherSource: payload.source,
+        payloadProduct: payload.product
+      });
+    };
+    var inboundDecision = getInboundDecision(payload.type);
+    if (inboundDecision !== 'allow') {
+      report(inboundDecision);
       return;
     }
-    var serialized = serializePayload(payload);
-    if (!serialized) {
+    var result = serializePayload(payload);
+    if (!result.ok) {
+      report(result.reason);
       return;
     }
+    report('allow');
+    var serialized = result.payload;
     stampProductContentId(serialized, getContentId === null || getContentId === void 0 ? void 0 : getContentId());
     var message = _defineProperty(_defineProperty(_defineProperty({}, BRIDGE_MESSAGE_MARKER, true), "direction", BRIDGE_TO_EXTENSION), "payload", serialized);
     // Keyed by context slot, not by message, so a re-publish replaces rather than accumulates.

package/dist/esm/common/utils/extension-context-bridge/analytics.js

@@ -0,0 +1,80 @@
+import _defineProperty from "@babel/runtime/helpers/defineProperty";
+import _typeof from "@babel/runtime/helpers/typeof";
+function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+/**
+ * Inbound relay decision reporting: what the product asked the bridge to relay, and what the policy
+ * in `./policy` / `./registry` decided. Every refusal is otherwise silent, so the allowlist can only
+ * be widened from data with this.
+ *
+ * Product → extension only, hence no direction field. The outbound allowlist has one entry and is
+ * owned by the chat, so products cannot drift into it.
+ *
+ * Consumer-supplied callback rather than an event fired here, for the same reason as the Host's
+ * `getContentId`: this package has no analytics dependency.
+ */
+
+/**
+ * Why `./registry` refused to serialise a payload. Kept distinct because the fixes differ:
+ * `context-key-not-allowlisted` is a list we can widen, the rest are publisher-side shape problems.
+ */
+
+/** Every outcome the bridge can reach for a payload it was asked to relay. */
+
+/** A slot identifier by contract, capped in case a publisher ever interpolates an id into one. */
+var MAX_CONTEXT_KEY_LENGTH = 80;
+
+/**
+ * (payload types × decisions) is finite and far below this; the cap is for `contextKey`, which is
+ * not. A publisher generating keys would otherwise grow the dedupe set for the life of the page.
+ */
+var MAX_REPORTED_DECISIONS = 50;
+/**
+ * The context slot a `set-message-context` payload addresses. Shape-checked rather than cast: runs
+ * against the raw bus payload, the serialized form, and types carrying neither. The Host also keys
+ * its replay map on this.
+ */
+export var getContextKey = function getContextKey(payload) {
+  if (payload.type !== 'set-message-context') {
+    return undefined;
+  }
+  var data = payload.data;
+  var contextKey = _typeof(data) === 'object' && data !== null && 'contextKey' in data ? data.contextKey : undefined;
+  return typeof contextKey === 'string' ? contextKey : undefined;
+};
+
+/** Identity of a decision for deduplication purposes. */
+var getDecisionKey = function getDecisionKey(_ref) {
+  var payloadType = _ref.payloadType,
+    contextKey = _ref.contextKey,
+    decision = _ref.decision;
+  return "".concat(payloadType, "|").concat(contextKey !== null && contextKey !== void 0 ? contextKey : '', "|").concat(decision);
+};
+
+/**
+ * Report a relay decision at most once per distinct outcome. Deduplicated because the bridge sees
+ * the whole product bus and `editor-context-payload` recurs on roughly every keystroke; which keys
+ * exist and how they were decided is the question, not how often each recurred.
+ *
+ * `seen` is caller-owned (a ref in the Host), so the window is one mount. Never throws.
+ */
+export var reportRelayDecision = function reportRelayDecision(seen, onRelayDecision, decision) {
+  var _decision$contextKey;
+  if (!onRelayDecision) {
+    return;
+  }
+  var truncatedContextKey = (_decision$contextKey = decision.contextKey) === null || _decision$contextKey === void 0 ? void 0 : _decision$contextKey.slice(0, MAX_CONTEXT_KEY_LENGTH);
+  var reportable = _objectSpread(_objectSpread({}, decision), {}, {
+    contextKey: truncatedContextKey
+  });
+  var key = getDecisionKey(reportable);
+  if (seen.has(key) || seen.size >= MAX_REPORTED_DECISIONS) {
+    return;
+  }
+  seen.add(key);
+  try {
+    onRelayDecision(reportable);
+  } catch (_unused) {
+    // Reporting is observability, never a reason for the relay to fail.
+  }
+};

package/dist/esm/common/utils/extension-context-bridge/constants.js

@@ -1,9 +1,15 @@
 /**
- * Feature gate for the extension context bridge; both Host and Client self-gate on it.
- * `fg()` requires a static literal, so call sites inline this value rather than importing it;
- * tests resolve the gate through this constant so the two cannot drift apart.
+ * Statsig experiment for the extension context bridge; both Host and Client self-gate on its
+ * boolean `isEnabled` parameter. Call sites inline this value rather than importing it, since the
+ * experiment runtime takes a static literal; tests resolve the experiment through this constant so
+ * the two cannot drift apart.
+ *
+ * Read here **without** logging exposure. Host mounts at the root of every page of an opted-in
+ * product, so an exposure-firing read would count product page loads rather than extension users.
+ * The extension owns the single exposure call, at the point the user is on a page the bridge can
+ * act on.
  */
-export var BRIDGE_FEATURE_GATE = 'rovo-ext_context_bridge';
+export var EXT_CONTEXT_BRIDGE_EXPERIMENT = 'rovo-ext_context_bridge_exp';
 
 /** Marker on every bridge `postMessage`, so listeners can ignore unrelated messages. */
 export var BRIDGE_MESSAGE_MARKER = '__rovoExtContextBridge';

package/dist/esm/common/utils/extension-context-bridge/registry.js

@@ -4,6 +4,19 @@ function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbol
 function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 import { BRIDGE_SOURCE } from './constants';
 import { isRelayableContextKey } from './policy';
+
+/**
+ * Outcome of serialising a payload for the wire. A bare `| null` would collapse five distinct
+ * refusals into one, notably a non-allowlisted context key versus a merge-style publisher, which
+ * need different fixes. `reason` is reported as analytics (see `./analytics`).
+ */
+
+var dropped = function dropped(reason) {
+  return {
+    ok: false,
+    reason: reason
+  };
+};
 var base = function base(payload) {
   return {
     type: payload.type,
@@ -43,33 +56,36 @@ var SHIMS = {
     serialize: function serialize(payload) {
       var data = payload.data;
       if (!data || typeof data.setContext !== 'function') {
-        return null;
+        return dropped('missing-set-context');
       }
       // Checked before `setContext` runs, so a non-allowlisted key never invokes product code.
       if (!isRelayableContextKey(data.contextKey)) {
-        return null;
+        return dropped('context-key-not-allowlisted');
       }
       var value;
       try {
         value = data.setContext(_defineProperty({}, MERGE_PROBE_KEY, true));
       } catch (_unused) {
-        return null;
+        return dropped('set-context-threw');
       }
       // Sentinel survived: merge-style, cannot be resolved to a standalone value.
       if (_typeof(value) === 'object' && value !== null && MERGE_PROBE_KEY in value) {
-        return null;
+        return dropped('merge-style-publisher');
       }
       try {
         JSON.stringify(value);
       } catch (_unused2) {
-        return null;
+        return dropped('not-serializable');
       }
-      return _objectSpread(_objectSpread({}, base(payload)), {}, {
-        data: {
-          contextKey: data.contextKey,
-          value: value
-        }
-      });
+      return {
+        ok: true,
+        payload: _objectSpread(_objectSpread({}, base(payload)), {}, {
+          data: {
+            contextKey: data.contextKey,
+            value: value
+          }
+        })
+      };
     },
     deserialize: function deserialize(serialized) {
       var _serialized$source;
@@ -108,11 +124,14 @@ export var serializePayload = function serializePayload(payload) {
   try {
     data = rawData === undefined ? undefined : JSON.parse(JSON.stringify(rawData));
   } catch (_unused3) {
-    return null;
+    return dropped('not-serializable');
   }
-  return _objectSpread(_objectSpread({}, base(payload)), {}, {
-    data: data
-  });
+  return {
+    ok: true,
+    payload: _objectSpread(_objectSpread({}, base(payload)), {}, {
+      data: data
+    })
+  };
 };
 
 /** Reconstruct a payload from the wire, stamping the loop-guard sentinel. */

package/dist/types/common/utils/extension-context-bridge/ExtensionContextBridgeHost.d.ts

@@ -1,3 +1,4 @@
+import { type OnBridgeRelayDecision } from './analytics';
 import { type Transport } from './transport';
 type Props = {
     /** Override the transport (tests). Defaults to same-window `postMessage`. */
@@ -14,6 +15,12 @@ type Props = {
      * mount passes it explicitly, so that only covers bespoke embeddings.
      */
     isAiEnabled?: boolean;
+    /**
+     * Called with what the relay policy decided for each payload this product published, at most once
+     * per distinct outcome per mount. Consumer-supplied because the analytics client lives outside
+     * this package. Omitted, nothing is reported. See `./analytics`.
+     */
+    onRelayDecision?: OnBridgeRelayDecision;
 };
 /**
  * Product-window half of the bridge. Observes the `ai-mate` bus and mirrors allowlisted context out
@@ -22,5 +29,5 @@ type Props = {
  * The reverse direction is handled by the sibling `RovoPostMessagePubsubListener` in
  * `ChatOpenerSubscriber`, not here. Headless; mounts at product root via `ChatOpenerSubscriber`.
  */
-export declare const ExtensionContextBridgeHost: ({ transport, getContentId, isAiEnabled, }: Props) => null;
+export declare const ExtensionContextBridgeHost: ({ transport, getContentId, isAiEnabled, onRelayDecision, }: Props) => null;
 export {};

package/dist/types/common/utils/extension-context-bridge/analytics.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Inbound relay decision reporting: what the product asked the bridge to relay, and what the policy
+ * in `./policy` / `./registry` decided. Every refusal is otherwise silent, so the allowlist can only
+ * be widened from data with this.
+ *
+ * Product → extension only, hence no direction field. The outbound allowlist has one entry and is
+ * owned by the chat, so products cannot drift into it.
+ *
+ * Consumer-supplied callback rather than an event fired here, for the same reason as the Host's
+ * `getContentId`: this package has no analytics dependency.
+ */
+import { type Payload } from '../../../types';
+import { type InboundDecision } from './policy';
+/**
+ * Why `./registry` refused to serialise a payload. Kept distinct because the fixes differ:
+ * `context-key-not-allowlisted` is a list we can widen, the rest are publisher-side shape problems.
+ */
+export type SerializationDropReason = 'missing-set-context' | 'context-key-not-allowlisted' | 'set-context-threw' | 'merge-style-publisher' | 'not-serializable';
+/** Every outcome the bridge can reach for a payload it was asked to relay. */
+export type RelayDecision = InboundDecision | SerializationDropReason;
+export type BridgeRelayDecision = {
+    /** The bus payload type, e.g. `editor-context-payload`. */
+    payloadType: Payload['type'];
+    /** Context slot for `set-message-context`; undefined for every other type. */
+    contextKey?: string;
+    /**
+     * Whether the policy admitted it. Reported before the `postMessage`, so a throwing transport
+     * reads as a broken channel elsewhere rather than a policy refusal here.
+     */
+    relayed: boolean;
+    /** Why, in the policy's own vocabulary. */
+    decision: RelayDecision;
+    /** The surface that published it, i.e. the payload's own `source`. */
+    publisherSource?: string;
+    /** The product the publisher stamped on the payload. */
+    payloadProduct?: string;
+};
+export type OnBridgeRelayDecision = (decision: BridgeRelayDecision) => void;
+/**
+ * The context slot a `set-message-context` payload addresses. Shape-checked rather than cast: runs
+ * against the raw bus payload, the serialized form, and types carrying neither. The Host also keys
+ * its replay map on this.
+ */
+export declare const getContextKey: (payload: {
+    type: string;
+    data?: unknown;
+}) => string | undefined;
+/**
+ * Report a relay decision at most once per distinct outcome. Deduplicated because the bridge sees
+ * the whole product bus and `editor-context-payload` recurs on roughly every keystroke; which keys
+ * exist and how they were decided is the question, not how often each recurred.
+ *
+ * `seen` is caller-owned (a ref in the Host), so the window is one mount. Never throws.
+ */
+export declare const reportRelayDecision: (seen: Set<string>, onRelayDecision: OnBridgeRelayDecision | undefined, decision: BridgeRelayDecision) => void;

package/dist/types/common/utils/extension-context-bridge/constants.d.ts

@@ -1,9 +1,15 @@
 /**
- * Feature gate for the extension context bridge; both Host and Client self-gate on it.
- * `fg()` requires a static literal, so call sites inline this value rather than importing it;
- * tests resolve the gate through this constant so the two cannot drift apart.
+ * Statsig experiment for the extension context bridge; both Host and Client self-gate on its
+ * boolean `isEnabled` parameter. Call sites inline this value rather than importing it, since the
+ * experiment runtime takes a static literal; tests resolve the experiment through this constant so
+ * the two cannot drift apart.
+ *
+ * Read here **without** logging exposure. Host mounts at the root of every page of an opted-in
+ * product, so an exposure-firing read would count product page loads rather than extension users.
+ * The extension owns the single exposure call, at the point the user is on a page the bridge can
+ * act on.
  */
-export declare const BRIDGE_FEATURE_GATE = "rovo-ext_context_bridge";
+export declare const EXT_CONTEXT_BRIDGE_EXPERIMENT = "rovo-ext_context_bridge_exp";
 /** Marker on every bridge `postMessage`, so listeners can ignore unrelated messages. */
 export declare const BRIDGE_MESSAGE_MARKER: '__rovoExtContextBridge';
 /** Read context flows product -> extension; actions flow extension -> product. */

package/dist/types/common/utils/extension-context-bridge/policy.d.ts

@@ -2,9 +2,8 @@ import { type Payload } from '../../../types';
 /** True if a `set-message-context` payload carrying this `contextKey` may cross to the extension. */
 export declare const isRelayableContextKey: (contextKey: string) => boolean;
 /** Why a product-bus payload was or was not relayed. */
-type InboundDecision = 'allow' | 'not-allowlisted' | 'denylisted';
+export type InboundDecision = 'allow' | 'not-allowlisted' | 'denylisted';
 /** Classify a product-bus payload. Relay iff `allow`. */
 export declare const getInboundDecision: (type: Payload['type']) => InboundDecision;
 /** True if a chat-bus payload of this type may be relayed back to the product. */
 export declare const shouldRelayToProduct: (type: Payload['type']) => boolean;
-export {};

package/dist/types/common/utils/extension-context-bridge/registry.d.ts

@@ -1,6 +1,19 @@
 import { type Payload } from '../../../types';
+import { type SerializationDropReason } from './analytics';
 import { type SerializedPayload } from './transport';
+/**
+ * Outcome of serialising a payload for the wire. A bare `| null` would collapse five distinct
+ * refusals into one, notably a non-allowlisted context key versus a merge-style publisher, which
+ * need different fixes. `reason` is reported as analytics (see `./analytics`).
+ */
+export type SerializationResult = {
+    ok: true;
+    payload: SerializedPayload;
+} | {
+    ok: false;
+    reason: SerializationDropReason;
+};
 /** Serialise a payload for the wire, using a shim if one exists, else a generic JSON round-trip. */
-export declare const serializePayload: (payload: Payload) => SerializedPayload | null;
+export declare const serializePayload: (payload: Payload) => SerializationResult;
 /** Reconstruct a payload from the wire, stamping the loop-guard sentinel. */
 export declare const deserializePayload: (serialized: SerializedPayload) => Payload | null;

package/dist/types/types.d.ts

@@ -100,7 +100,7 @@ export type ChatCreationContextParams = {
     source?: string;
     shouldUseExistingContent?: boolean;
     isViewMode?: boolean;
-    experience?: 'cwr' | 'cwr_type' | 'cwr_edit' | 'cwr_existing' | 'inline_edit' | 'remix' | 'remix_edit' | 'remix_object' | 'remix_custom' | 'chat_edit' | 'chat_view' | 'keep_existing_page_structure';
+    experience?: 'cwr' | 'cwr_type' | 'cwr_edit' | 'cwr_existing' | 'inline_edit' | 'remix' | 'remix_edit' | 'remix_object' | 'remix_custom' | 'remix_custom_edit' | 'chat_edit' | 'chat_view' | 'keep_existing_page_structure';
     contentTypes?: string[];
     blocks?: string[];
     spaceKey?: string;

package/extension-context-bridge/analytics/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "@atlaskit/rovo-triggers/extension-context-bridge/analytics",
+  "main": "../../dist/cjs/common/utils/extension-context-bridge/analytics.js",
+  "module": "../../dist/esm/common/utils/extension-context-bridge/analytics.js",
+  "module:es2019": "../../dist/es2019/common/utils/extension-context-bridge/analytics.js",
+  "sideEffects": [
+    "*.compiled.css"
+  ],
+  "types": "../../dist/types/common/utils/extension-context-bridge/analytics.d.ts"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@atlaskit/rovo-triggers",
-	"version": "10.37.0",
+	"version": "11.0.0",
 	"description": "Provides various trigger events to drive Rovo Chat functionality, such as a publish-subscribe and URL parameter hooks",
 	"author": "Atlassian Pty Ltd",
 	"publishConfig": {
@@ -29,6 +29,7 @@
 	"atlaskit:src": "src/index.ts",
 	"dependencies": {
 		"@atlaskit/adf-schema": "^57.4.0",
+		"@atlaskit/platform-feature-experiments": "^0.3.0",
 		"@atlaskit/platform-feature-flags": "^2.2.0",
 		"@atlaskit/react-compiler-gating": "^0.2.0",
 		"@babel/runtime": "^7.0.0",
@@ -44,7 +45,8 @@
 		"@atlaskit/primitives": "^22.5.0",
 		"@atlaskit/ssr": "workspace:^",
 		"@atlassian/a11y-jest-testing": "^0.17.0",
-		"@atlassian/conversation-assistant-service-api": "^17.12.0",
+		"@atlassian/conversation-assistant-service-api": "^18.0.0",
+		"@atlassian/experiment-test-utils": "^0.2.0",
 		"@atlassian/feature-flags-test-utils": "^1.3.0",
 		"@atlassian/testing-library": "^0.11.0",
 		"@atlassian/workbench": "workspace:*",
@@ -54,9 +56,6 @@
 		"wait-for-expect": "^1.2.0"
 	},
 	"platform-feature-flags": {
-		"rovo-ext_context_bridge": {
-			"type": "boolean"
-		},
 		"rovo_chat_replace_url_param_history": {
 			"type": "boolean"
 		}