@bazariodev/docket 0.0.0-stage → 0.0.0

package/CHANGELOG.md

@@ -0,0 +1 @@
+# Changelog

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Bazario
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,444 @@
-# Temporary Holding Version
+# @bazariodev/docket
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Record structured diagnostic data. Remove private values before delivery, keep bounded history,
+and build ZIP files for download or application upload.
+
+## Install
+
+```sh
+pnpm add @bazariodev/docket
+```
+
+Docket has no runtime dependencies, optional dependencies, or peer dependencies.
+Its runtime files and declarations do not import provider packages. The application selects
+providers and supplies their capabilities. History, conversion, persistence, SIP, and ZIP support
+are optional. Import only the entries that the application uses.
+
+The usage example selects [Winnow](https://www.npmjs.com/package/@bazariodev/winnow) for bounded
+conversion and [Hopper](https://www.npmjs.com/package/@bazariodev/hopper) for memory storage:
+
+```sh
+pnpm add @bazariodev/winnow @bazariodev/hopper
+```
+
+Other providers can implement the same structural ports. A selected provider can install its own
+dependencies. Docket does not change that provider's package graph. Optional examples below also
+select Baler for ZIP files and Baton for application ownership.
+Install these packages only for the corresponding application composition.
+
+Node.js support is `^22.12.0 || ^24.0.0 || >=26.0.0`. Browser persistence needs the selected storage
+provider's platform APIs. The Hopper IndexedDB composition uses IndexedDB and Web Locks.
+Managed history uses Web Crypto and defaults to localStorage for its metadata.
+
+## Usage
+
+```js
+import { createLogging } from '@bazariodev/docket';
+import { createRedactor } from '@bazariodev/docket/redaction';
+import { createMemoryStore } from '@bazariodev/hopper';
+import * as conversion from '@bazariodev/winnow';
+const redactor = createRedactor(
+  { fields: { password: 'drop', accessToken: 'drop' } },
+  conversion,
+);
+const store = createMemoryStore();
+const logging = createLogging({
+  areas: [{ id: 'application' }, { id: 'network', level: 'warn' }],
+  redactor,
+  sinks: [store],
+});
+const log = logging.getLogger('application', 'Connection');
+log.info('Connection ready', { state: 'online' });
+```
+
+The later examples reuse `conversion`, `redactor`, and `store` from this example.
+Supply your application's area list and privacy policy. The default text rules are a starting
+point. They do not identify every private field in an application.
+
+## Consumer redaction policy
+
+The application selects which values to keep, remove, mask, or hash. Redaction is the complete
+process; masking and hashing are two possible actions. The package does not require hashing for
+core logging, SIP, storage, or export.
+
+```js
+import { createRedactor } from '@bazariodev/docket/redaction';
+
+const redactor = createRedactor({
+  fields: { password: 'drop', email: 'mask', state: 'keep' },
+  unknownFields: 'drop',
+}, conversion);
+```
+
+Field names match without case at every data depth, including context and Error properties.
+
+| Action | Result |
+| --- | --- |
+| `keep` | Keep the field and apply nested and text rules. This does not bypass text redaction. |
+| `drop` | Remove the field. |
+| `mask` | Hide part of the value. Short strings are hidden completely. Longer digit strings keep the last four digits; other strings keep the first and last character. |
+| `hash` | Replace the value with the result of the application's hash function. |
+
+Use `text` rules to replace selected text with a fixed value such as `[redacted]`, or to apply
+another application rule. Custom `policy.text` rules receive the Docket record API. An explicit
+`text` list replaces the default list. `text: []` disables text rules. Provider defaults belong in
+`conversion.TEXT_RULES`; their callbacks receive the value engine API. To select a provider subset,
+supply a dictionary such as `{ email: TEXT_RULES.email }` as `TEXT_RULES` and omit `policy.text`.
+Unknown fields default to `keep`; use `unknownFields: 'drop'` when only named fields are permitted.
+
+Field mask/hash actions convert numbers and bigint to text. Other non-string values use a fixed
+redaction marker without a hash call. Error schema field rules use the same actions. Captured runtime
+accessors supply Error stacks and DOMException fields. Runtime stack formatting can call an
+application `Error.prepareStackTrace` function.
+
+Hashing is optional. The application supplies the function and owns its algorithm and key.
+For example, the application can call this factory with its synchronous keyed hasher:
+
+```js
+import { createRedactor } from '@bazariodev/docket/redaction';
+
+export function createApplicationRedactor(hashPrivateValue, conversion) {
+  return createRedactor({
+    hash: hashPrivateValue,
+    fields: { customerId: 'hash', password: 'drop' },
+    unknownFields: 'drop',
+  }, conversion);
+}
+```
+
+Text-rule methods use the compiled rule as their receiver and receive the Docket redactor API.
+Docket captures the hash function at construction and calls it with the original policy as its receiver.
+Prototype hash methods are supported. Later changes to `policy.hash` do not replace the captured
+function; the captured method can still read current policy state.
+
+The hash function must return a string synchronously. A Promise is not supported. A hash rule
+without a function rejects policy creation. The package checks the output type and limits; it
+does not verify the algorithm's security. Keep secret keys out of records and exports. Keyed
+tokens can connect equal values under the same key; they do not encrypt the logs.
+
+An application can also supply its own `Redactor`. The hub still validates, copies, and freezes
+its output within the declared limits. These checks do not prove that a privacy policy removes
+all private data. Select the policy before recording. Export cannot restore removed values.
+
+Managed history's account-owner digest is separate from record redaction. It uses native Web
+Crypto. A history redactor can ignore the supplied history key when its policy does not use it.
+
+## SIP display names
+
+```js
+import { createRedactor } from '@bazariodev/docket/redaction';
+import { createSipTools } from '@bazariodev/docket/sip';
+import { TEXT_RULES } from '@bazariodev/winnow';
+
+const { redactSipMessage } = createSipTools(TEXT_RULES);
+const redactor = createRedactor({}, conversion);
+const message = 'SIP/2.0 200 OK\r\nFrom: "Alice" <sip:alice@example.com>\r\n\r\n';
+const fixed = redactSipMessage(message, { redactor });
+const masked = redactSipMessage(message, {
+  redactor,
+  redactDisplayName: (value) => redactor.mask(value),
+});
+```
+
+The SIP factory needs five match-only rules: `ipv4`, `ipv6`, `urlCredentials`, `sipUri`, and
+`telUri`. Winnow supplies these rules directly. Other providers must supply replacements that
+use only the matched text. The helper applies each address rule once. The returned SDP rules
+belong only in a SIP-specific policy. Do not add them to the general provider defaults.
+
+Without a callback, each non-empty display name becomes `[redacted]`. The callback receives the
+name once, without source quotes and with quoted escapes decoded. It returns plain text. The
+helper escapes quotes and backslashes and writes a quoted name. An empty result removes the name.
+An identity callback, `(value) => value`, keeps the name value. A consumer can pass its injected
+hash function as `redactDisplayName`; the helper does not select `redactor.hash` automatically.
+Other SIP, credential, address, and SDP rules still apply.
+
+The callback must return a string synchronously, without control characters, within
+`redactor.limits.maxStringLength`. Invalid results throw; callback errors propagate. Malformed
+identity lists use a fixed replacement without calling the callback. There is no raw-input fallback.
+The helper limits input and complete output to four times `maxStringLength`. Oversized input
+becomes `[truncated]`. Output growth throws `RangeError`. It counts escaped callback output across
+headers before assembly and stops at the limit. Custom callbacks are trusted application code.
+
+## Export and application upload
+
+```js
+import { createLogBundle } from '@bazariodev/docket/export';
+import { downloadBlob } from '@bazariodev/docket/browser';
+import * as archive from '@bazariodev/baler';
+
+const bundle = await createLogBundle({
+  source: store,
+  redactor,
+  files: [{ name: 'application.log', areas: ['application', 'network'] }],
+}, archive);
+downloadBlob(bundle.blob, bundle.fileName);
+```
+
+The application owns upload. It supplies the endpoint, credentials, request format, response
+checks, cancellation, and timeout. A manual upload does not clear history. The package has no
+HTTP client, retry service, delivery acknowledgement, or durable upload queue.
+
+```ts
+import type { LogRecord } from '@bazariodev/docket';
+import { createMemoryStore } from '@bazariodev/hopper';
+import * as archive from '@bazariodev/baler';
+import { createLogBundle } from '@bazariodev/docket/export';
+
+// The application supplies sendFile and reportError.
+const store = createMemoryStore<LogRecord>({
+  overflowStrategy: 'rotate',
+  async onRotate(source) {
+    const file = await createLogBundle({
+      source,
+      redactor,
+      files: [{ name: 'application.log', areas: ['application'] }],
+    }, archive);
+    await sendFile(file);
+  },
+  onError: reportError,
+});
+```
+
+Here, `redactor` is the same policy used for recording. Rotation removes a retained batch before
+it calls the application. Recording continues while that callback is pending. Further capacity
+pressure uses oldest-record eviction until the callback settles. A failed upload reports
+`rotation`; it does not restore records or retry. Clear and stop invalidate the snapshot without
+waiting for networking. An upload that already started belongs to the application.
+
+## Persistent storage
+
+```js
+import { createIndexedDbLogStore } from '@bazariodev/docket/indexeddb';
+import { createIndexedDbStore } from '@bazariodev/hopper/indexeddb';
+
+const store = createIndexedDbLogStore(
+  { databaseName: 'example-diagnostics' },
+  createIndexedDbStore,
+);
+// Attach the store to a logging hub before recording.
+await store.flush();
+const status = store.getStatus();
+```
+
+The supplied Hopper store first tries an exclusive database lock. A blocked or unavailable lock selects memory
+fallback for that instance's lifetime. It cannot later replay that fallback into another owner's
+history. A new instance can try ownership again. With `allowUnprotected: true`, failed acquisition
+permits IndexedDB access without a lease. The store still tries the lock first.
+
+Unprotected access cannot prevent another writer from recording after clear. It cannot establish
+stable account history. Read `unprotected` and `unavailableHistory` from status after an operation.
+Status reads are synchronous; initial acquisition is asynchronous.
+
+An open or write failure with permitted access starts bounded memory fallback. Recovery retries
+every ten minutes. A failed write batch is lost and its flush rejects. Other pending records move
+to fallback. Successful recovery removes copied fallback records only after commit.
+
+## Account history
+
+Use `/history` when the package must own account cleanup, keys, and reload state. Acquire an
+application lease first. Use a stable key for each application, environment, and tenant.
+
+```js
+import { createBaton } from '@bazariodev/baton';
+import { createRedactor } from '@bazariodev/docket/redaction';
+import { createLogHistory } from '@bazariodev/docket/history';
+import { createIndexedDbLogStore } from '@bazariodev/docket/indexeddb';
+import { copyRecords, createMemoryStore, validateStoreOptions } from '@bazariodev/hopper';
+import { createIndexedDbStore } from '@bazariodev/hopper/indexeddb';
+
+let history;
+const baton = createBaton({
+  key: JSON.stringify(['example-app', 'production', 'example-tenant']),
+  async beforeRelease() { await history?.stop(); },
+});
+const claim = await baton.take();
+if (claim.state !== 'owner') throw new Error('Application ownership is unavailable');
+history = createLogHistory({
+  lease: claim.lease,
+  logging: { areas: [{ id: 'application' }] },
+  createRedactor: () => createRedactor({ fields: { password: 'drop' } }, conversion),
+  stores: {
+    createMemoryStore,
+    createIndexedDbStore: (options) => createIndexedDbLogStore(options, createIndexedDbStore),
+    validateStoreOptions,
+    copyRecords,
+  },
+});
+const log = history.getLogger('application', 'Connection');
+log.info('Application startup');
+await history.setOwner('example-tenant:example-account');
+log.info('Account ready');
+```
+
+History owns each supplied store and its private serial queue. It stops each store.
+The `stores` object groups the two factories, `validateStoreOptions`, and `copyRecords`.
+Managed hubs create their own run IDs and admission guard. `logging.createRunId` and
+`logging.isActive` are rejected. The helper must control record identity and session validity.
+Forwarding child loggers capture scope and context when created. Later changes to the supplied
+binding do not change that snapshot. Invalid bindings remain contained.
+The persistent factory must support cleanup even in memory or off mode. A prior account can
+have records on disk. Missing cleanup must not be reported as successful erasure. For standalone
+memory logging without account-history coordination, use the root with a memory sink.
+
+The helper generates history keys internally. The redactor factory can ignore the key, or pass
+it to an application-selected synchronous hasher. Use `resume(ownerId)` after reload with a verified
+current account. Use `setOwner(ownerId)` for explicit sign-in or account replacement.
+
+| Application event | Helper call | Application work |
+| --- | --- | --- |
+| Startup after lease acquisition | Create history; keep `history.getLogger(area, scope)` | Supply recording policy before producers start. |
+| Export before sign-in | `getSession()`; use its source and redactor | Startup recording needs no account ID. |
+| Reload with a verified account | `resume(ownerId)` | Supply the current authenticated identity. |
+| Explicit sign-in or account replacement | `setOwner(ownerId)` | Wait for authentication first. |
+| Manual logout | `logout()` | Show cleanup failure; do not claim erasure until success. |
+| Forced authentication failure | Keep the helper | Retain history and key; stop only if recording must stop. |
+| Clear history | `clear()` | Refresh status in the view. |
+| Recording or persistence setting | `setMode(mode)` | Supply the permitted mode. |
+| Failed deletion | `retryCleanup()` | Show the resulting status. |
+| Environment or tenant change | Stop the old baton; create a new baton and helper | Await release before acquisition. |
+| Teardown | `stop()` | Stop application producers. |
+| Intentional navigation | Await `baton.pass()` | Its release callback stops producers and history. |
+
+Keep helper loggers in page-lifetime modules. They select the current session on each call.
+Session loggers and sources remain bound to one session. After replacement, old logger writes do
+nothing; old sources, redactors, and controls fail with `stale`. `onChange` refreshes export views
+and producers that need session-bound handles. Stop and lease loss permanently disable the helper.
+
+Startup recording uses memory only, with 250,000 JSON characters per area and 1,000,000 total by
+default. `startup: false` disables it. Saved off mode also disables it. Its records transfer once
+into the first owner session. Transfer uses stored redacted records and preserves their identities
+and policy tags. Clear, logout, off, and stop discard the startup buffer.
+
+The default database name is `bazario-logging:history:` followed by the application lease key.
+The helper keeps one localStorage metadata record for that database. It contains the application
+key, a random salt and full SHA-256 owner digest, mode, revision, cleanup marker, and level
+overrides. Raw owner IDs stay in memory. A key is saved only for clean persistent history.
+Startup, memory-only, and temporary cleanup-failure keys stay in the page. A memory reload uses
+a new key. Promotion to persistence saves its key only after copying commits.
+
+Destructive changes save pending cleanup before deletion. A failed clear keeps that marker and
+uses a fresh, isolated memory session. Successful retry discards that temporary history and rotates
+its key. Metadata failure blocks recording. Managed history rejects unprotected persistence.
+Never attach a raw store beside its managed store. Pass `history.clear` to developer controls.
+Cancel application work that holds snapshots when the account changes; returned data cannot be recalled.
+
+## Behavior
+
+`isActive` is an optional admission guard. Returning `false` stops a record before conversion or
+delivery. The hub checks it again after application callbacks. Managed history supplies this guard.
+
+- Levels are `debug`, `info`, `warn`, and `error`. Default area level is `info`.
+- Data functions run only after admission. No sinks, stop, levels, and storm limits can prevent admission.
+- The first 1,000 root loggers are cached by area and scope. Further pairs are uncached; one
+  `scope` diagnostic reports the limit. Put correlation IDs in child context.
+- Each record is redacted once, then validated, copied, and deeply frozen before sink delivery.
+- Custom redactors must return JSON with dense arrays. Invalid output is dropped and reports `redactor`.
+- Conversion does not call getters or `toJSON`. It bounds strings, structure, and serialized size.
+- Error causes and aggregate errors become structured data. Non-finite numbers become null.
+- Console and default file text include custom Error fields as compact JSON. Their keys and
+  values use the same control-character escaping as other Error details.
+- Record validation checks fixed record and Error fields separately from application data. The full
+  serialized record must fit `maxRecordSize`. Fixed level values remain intact at small text limits.
+- Default storm allowance is 100 records per area/scope each second. One timer reports suppression.
+- Sink failures do not stop other sinks. Recursive logging from sinks and reporters is rejected.
+
+The store defaults and recovery rules below describe the Hopper composition shown above.
+Other providers must state their supported behavior.
+
+- Queries use inclusive time bounds and order by time, run ID, then sequence. Empty areas select nothing.
+- Both stores keep the first retained `(runId, seq)` record. Eviction releases its identity.
+- Default budgets are 1,000,000 JSON characters per area, 16,000,000 total, and 24-hour age.
+- IndexedDB also defaults to 20,000 records per area, 250 records per batch, and a one-second flush interval.
+- IndexedDB recovery uses oldest-record eviction for copied and queued fallback records. This replay does not call `onRotate`.
+- Pending plus active database records are limited to 1,000 records and 4,000,000 JSON characters.
+- Expired data is excluded from queries. Disk expiry cleanup runs at open and write, without a timer.
+- `flush()` means local transaction commit. Page exit is best effort; crash survival is not guaranteed.
+- Detach removes sink delivery. The sink's lifecycle owner must stop it separately.
+- A stopped store ignores writes. Its query and clear remain available under their access rules.
+
+## API
+
+| Entry | Exports |
+| --- | --- |
+| Root | `createLogging`, `createConsoleSink`, `formatRecord` |
+| `/redaction` | `createRedactor(policy, winnow)` |
+| `/indexeddb` | `createIndexedDbLogStore(options, createStore)` |
+| `/history` | `createLogHistory` |
+| `/export` | `createLogBundle(options, archive)` |
+| `/browser` | `captureGlobalErrors`, `flushOnPageHide`, `collectBrowserEnvironment`, `downloadBlob` |
+| `/sip` | `createSipTools(textRules)`, `describeSipMessage`. The tools expose `redactSipMessage`, `describeSipMessage`, and `SDP_TEXT_RULES`. |
+| `/devtools` | `installConsoleApi` |
+
+| Component | Options and methods |
+| --- | --- |
+| Hub | Required `areas`, `redactor`; optional `sinks`, `context`, `levelStorage`, `maxOverrideMs`, `stormLimit`, `scheduler`, clocks, `createRunId`, `onError`, `isActive`. Methods: `getLogger`, `setContext`, `setLevel`, `resetLevel`, `reloadLevels`, `getLevels`, `addSink`, `flush`, `stop`. |
+| Logger | `debug`, `info`, `warn`, `error` accept `(message, data?)`. `child({ scope?, context? })` adds bindings. |
+| Redactor | Policy: `version`, `hash`, `fields`, `unknownFields`, `text`, `limits`. Methods: `redact`, `redactValue`, `redactText`, `mask`, optional `hash`. Resolved `limits` and `version` are public. |
+| Memory store | `maxSizePerArea`, `defaultMaxSizePerArea`, `maxTotalSize`, `maxAgeMs`, `now`, `overflowStrategy`, `onRotate`, `scheduler`, `onError`. Methods: `write`, `query`, `flush`, `clear`, `stop`, `getStatus`. |
+| IndexedDB store | Memory options plus `databaseName`, `indexedDB`, `locks`, `allowUnprotected`, batch/queue/interval/count limits, and `fallback`. |
+| History | Required `lease`, `logging`, `createRedactor`, and `stores`. Optional `createSinks`, `initialMode`, database/storage ports, `memory`, `startup`, `persistent`, rotation callbacks, `onChange`, `onError`. Methods: `getLogger`, `resume`, `setOwner`, `logout`, `setMode`, `clear`, `retryCleanup`, `getSession`, `getStatus`, `stop`. |
+| Bundle | Required `source`, `redactor`, `files`, and the separate archive capability. Optional time bounds, `manifest`, `fileName`, `maxInputSize`, clock, scheduler. Returns `blob`, `fileName`, file counts. |
+| Supplied Hopper copy helper | `copyRecords(from, to, { maxChunkRecords?, maxChunkSize? })`; defaults are 100 records and 1,000,000 JSON characters. It flushes between chunks. |
+| Console sink | Optional minimum `level` and injected `console`. |
+| Custom sink | Implement `LogSink.write(record)`. Optional `flush` and `stop` return promises. |
+| Console API | Inject level controls and optional `clear` and `exportBundle`. Optional `name`, `target`. Returns cleanup. |
+
+Redaction defaults: depth 6; strings 16,384 characters; arrays 100 entries; objects 100 keys;
+1,000 nodes; 65,536 JSON characters per record. Field rules are case-insensitive at every depth:
+`keep`, `drop`, `mask`, `hash`. Unknown fields default to keep. Hash rules require an injected hash.
+An explicit `text: []` disables default text rules. Global non-sticky regular expressions are required.
+Custom patterns and callbacks are trusted application code.
+
+SIP redaction preserves protocol structure and replaces identity and credential values. Unknown
+SIP bodies become content-type and byte-count markers. The application owns any selected hasher
+and its dependency. The package does not implement a cryptographic algorithm.
+
+Bundle filenames cannot contain paths, reserved device names, or manifest variants. Comparison
+uses NFC and ignores case. Empty files are omitted; the manifest retains their zero counts.
+File names, each file's area list, and the download name are checked before the source query. Its default timestamp is
+the call's start time. The manifest build time is recorded after rendering.
+Custom renderers are synchronous. Built-in formatting yields during large files. Input is limited
+to 32,000,000 UTF-8 bytes by default, including the manifest. Baler checks this limit after
+rendering and before compression. It does not bound renderer allocations or peak heap use.
+The supplied Baler implementation uses raw deflate when available and stored entries otherwise.
+The manifest contains ranges, counts, truncation, warnings, policy versions, store status, and
+redacted application metadata. It contains no history key.
+
+Browser listeners are explicit and return cleanup. Environment defaults are language, UTC offset,
+display mode, and online state. Extra fields need explicit selection. Optional reads use a 500 ms
+deadline by default. Unknown field names reject before platform reads. Collection never requests capture or permission and omits device IDs and labels.
+
+External services use an application-owned `LogSink.write(record)` implementation. Pass it to
+`sinks` or `addSink`. It receives redacted, frozen records. The application owns service mapping,
+network delivery, and SDK lifecycle. No additional event interface is required.
+
+## Errors
+
+Logger writes never throw. Configuration errors and missing capabilities can throw `TypeError`. The hub reports sources
+`data`, `redactor`, `sink`, `storage`, `scope`, and `reentry` through `onError`. Flush and stop attempt
+all sinks and reject with an aggregate error on failure. Hub-generated diagnostics use codes
+`recursive-logging`, `root-logger-cache-limit`, and `stopped`. Callback failures keep their original errors.
+
+Store errors have codes `open`, `write`, `read`, `quota`, `overflow`, `ownership`, `clear`, `upgrade`,
+and `rotation`. History errors use `metadata`, `cleanup`, `stale`, `setup`, `migration`, `stopped`,
+and `rotation`. Degraded history cleanup resolves with `cleanupPending: true` and reports the error.
+Failed migration rejects and keeps the previous session. Export and developer actions reject to the caller.
+All acquired stores stay under history cleanup, including setup and temporary cleanup stores.
+A failed store stop remains available for retry and prevents application lease release.
+Managed history reports application sink-stop failures as `setup` errors after its store stops.
+The error cause retains the hub's AggregateError and its original sink errors. Store flush and
+stop reports also retain their original failures as the cause.
+These failures do not prevent account erasure or application lease release. If the store cannot
+stop, history rejects cleanup and retains the lease. Pending source queries drain before retirement ends.
+
+## TypeScript
+
+Declarations are provided for ESM and CommonJS. Core declarations need only ES2022 types.
+No entry declaration imports a provider package. Browser, persistence, history, and export entries need DOM types. The logger satisfies the existing
+workspace logger ports without an adapter. Area inference rejects unknown area names.
+Use `createMemoryStore<LogRecord>` for a store that supplies rotation snapshots to Docket export.
+Import `LogRecord` from `@bazariodev/docket`. The export source receives a query argument.
+
+## License
+
+[MIT](./LICENSE)

package/dist/browser/constants.d.cts

@@ -0,0 +1,14 @@
+export const ENVIRONMENT_FIELDS: Readonly<{
+    LANGUAGE: "language";
+    UTC_OFFSET_MINUTES: "utcOffsetMinutes";
+    DISPLAY_MODE: "displayMode";
+    ONLINE: "online";
+    USER_AGENT: "userAgent";
+    CLIENT_HINTS: "clientHints";
+    TIME_ZONE: "timeZone";
+    CONNECTION: "connection";
+    PERMISSIONS: "permissions";
+    DEVICE_COUNTS: "deviceCounts";
+    STORAGE: "storage";
+    SCREEN: "screen";
+}>;

package/dist/browser/constants.d.ts

@@ -0,0 +1,14 @@
+export const ENVIRONMENT_FIELDS: Readonly<{
+    LANGUAGE: "language";
+    UTC_OFFSET_MINUTES: "utcOffsetMinutes";
+    DISPLAY_MODE: "displayMode";
+    ONLINE: "online";
+    USER_AGENT: "userAgent";
+    CLIENT_HINTS: "clientHints";
+    TIME_ZONE: "timeZone";
+    CONNECTION: "connection";
+    PERMISSIONS: "permissions";
+    DEVICE_COUNTS: "deviceCounts";
+    STORAGE: "storage";
+    SCREEN: "screen";
+}>;