@corbado/observe 1.15.0 → 1.15.1

package/dist/manifest/index.d.mts

@@ -67,17 +67,32 @@ interface CapabilityDescriptor {
         adds: string;
     }[];
     /** What the capability does on the page beyond reading; `when` = the build switch that enables it. */
-    sideEffects?: {
-        id: string;
-        text: string;
-        when?: string;
-    }[];
+    sideEffects?: SideEffect[];
     review?: string;
     /** Additive (WP2): short plain-language line shown under the card, e.g. "used on: input fields". */
     usedOn?: string;
     /** Additive (WP2): the build switch that removes the whole capability from builds that turn it off. */
     when?: string;
 }
+/**
+ * Conditions shared by descriptor entries (all additive, all optional):
+ * - `when`: the build switch or config flag (static config / `build.config`) the entry depends on; `"!<name>"` = only
+ *   when it is off (e.g. `"!static"`: only with a downloaded config).
+ * - `requires`: the never-ship item (id of the tools' never-ship list, e.g. `"cross-origin-session"`,
+ *   `"sdk-operations"`) whose optional code produces the entry; omit the entry when that code is not in the bundle.
+ */
+interface Conditional {
+    when?: string;
+    requires?: string;
+}
+/** Something a capability does on the page beyond reading (shown in the overview's behavior list). */
+interface SideEffect extends Conditional {
+    /** `<area>.<slug>`, stable across versions. Entries of several capabilities with the same id describe one effect. */
+    id: string;
+    text: string;
+    /** Build switch / config flag that enables it, e.g. `"aap"`, `"privateMode"`, `"pmd"`. */
+    when?: string;
+}
 /** Gateways without an algorithm and the output gateways (sections 4 and 6). */
 interface GatewayDescriptor {
     key: string;
@@ -98,7 +113,7 @@ interface GatewayDescriptor {
     /** Additive (WP2): transport facts (`transport:<fact>`), only on the transport gateway. */
     transport?: TransportFact[];
 }
-interface GatewayField {
+interface GatewayField extends Conditional {
     path: string;
     /** A category, or `"role"`: inherit the category of the input role the field is read from. */
     category: Category | "role" | string;
@@ -122,7 +137,7 @@ interface GatewayField {
  * - `exposedTo`: who besides Corbado can see it, e.g. `"corbado"`, `"page scripts (getSessionId)"`,
  *   `"page scripts (local storage)"`.
  */
-interface GeneratedEntry {
+interface GeneratedEntry extends Conditional {
     id: string;
     category: Category | string;
     pointsTo: string;
@@ -142,8 +157,10 @@ interface GeneratedEntry {
  *   `"persistent"`.
  * - `owner`: `"sdk"`, `"project"`, `"third-party (<package>)"`.
  * - `contents`: field and generated ids (typed references); `"sent:events"` = the whole queued event as sent.
+ * - `when` (see {@link Conditional}): without `otherwise` the entry is absent when `when` does not hold; with
+ *   `otherwise` the entry stays, merged with `otherwise` (e.g. a cache a build does not write but still removes).
  */
-interface StoredEntry {
+interface StoredEntry extends Conditional {
     id: string;
     area: string;
     scope: string;
@@ -158,7 +175,18 @@ interface StoredEntry {
     enforced?: boolean;
     /** Additive (WP2): build switch / config flag the entry depends on. */
     when?: string;
+    /**
+     * Additive (v2 descriptors): the bundle never writes the entry, it only removes it when found (keys of older
+     * versions). Such an entry keeps nothing (`contents` empty); its `retention` is `"PT0S"` for older tools.
+     */
+    deleteOnly?: boolean;
+    /** Additive (v2 descriptors): a plain-language remark shown with the entry. */
+    note?: string;
+    /** Additive (v2 descriptors): what the entry becomes when its `when` does not hold (merged over the entry). */
+    otherwise?: StoredVariant;
 }
+/** Additive (v2 descriptors): the fields of a {@link StoredEntry} that its `otherwise` variant may replace. */
+type StoredVariant = Partial<Pick<StoredEntry, "retention" | "enforced" | "contents" | "label" | "deleteOnly" | "note" | "keys">>;
 interface TelemetryEntry {
     kind: string;
     fields: string[];
@@ -178,6 +206,9 @@ interface TransportFact {
  * `ac:ceremony@1` (SDK part): the WebAuthn allowlist (`src/utils/webauthn-ceremony.ts`), used by the sanitizers in
  * builds that define `__CBO_DATA_CEREMONY__ = true` (build switch `ceremony`). The library's credentials wrapper and
  * its endpoint reductions are the callers (second entry point: WebAuthn payloads in request and response bodies).
+ * The side effects are the library's (`@corbado/autocapture` `src/readers/credentials.ts`): it wraps the two methods;
+ * the container proxy is used only where the runtime's server config allows it (`aap` = `"c1"`) and the methods
+ * themselves cannot be wrapped.
  */
 declare const AC_CEREMONY: CapabilityDescriptor;
 
@@ -214,6 +245,10 @@ declare const SDK_RECORD: GatewayDescriptor;
  * the email-link notes only in builds with `__CBO_DATA_RETENTION__` (build switch `retention`); without it the
  * outboxes keep entries up to their caps (500 events, 1000 low events) and expired email-link notes stay until the
  * next write. Contents reference field and generated ids; `sent:events` = whole queued records as they are sent.
+ *
+ * Not listed: the private-mode library's temporary test databases, test directory and `test` entry (removed at once,
+ * nothing kept on the device): a side effect of `sdk:private-mode@1`. Entries with `otherwise` stay in the manifest
+ * when their `when` does not hold, merged with the variant (contract `StoredEntry.otherwise`).
  */
 declare const SDK_OWN_STORAGE: GatewayDescriptor;
 
@@ -230,6 +265,8 @@ declare const SDK_PAGE: GatewayDescriptor;
  * `src/low-events/`), declared as it behaves today (v1). Inside the gateway it reads the field's LENGTH (and a
  * checkbox's checked state) to tell typing, pasting, clearing and several-characters-at-once changes apart; neither
  * the value nor the length leaves it. A value-free v2 comes later (model section 13, "Later").
+ * Side effect: the library's input reader (`@corbado/autocapture` `onInput`, `src/readers/inputs.ts`) watches the
+ * document for added fields; `ac:element@1` lists the same effect (same id) for element roles.
  */
 declare const SDK_INPUT: CapabilityDescriptor;
 
@@ -242,6 +279,8 @@ declare const SDK_PASSWORD_MANAGERS: CapabilityDescriptor;
 /**
  * `sdk:private-mode@1`: private-mode detection (`src/readers/private-mode.ts`, the third-party library
  * detectincognitojs). Compiled out with `__CBO_DATA_PRIVATE_MODE__ = false` (build switch `privateMode`).
+ * The library's temporary test databases, test directory and `test` storage entry are only this side effect: they
+ * are removed at once, so `sdk:own-storage` does not list them (nothing is kept on the device).
  */
 declare const SDK_PRIVATE_MODE: CapabilityDescriptor;
 
@@ -267,4 +306,4 @@ declare const SDK_GATEWAYS: readonly GatewayDescriptor[];
 declare const capabilities: CapabilityDescriptor[];
 declare const gateways: GatewayDescriptor[];
 
-export { AC_CEREMONY, CATEGORIES, CATEGORY_VALUE_LEVELS, type CapabilityDescriptor, type Category, type CollectionLevel, type GatewayDescriptor, type GatewayField, type GeneratedEntry, KIND_LADDERS, type ManifestId, NON_VALUE_LEVELS, type NonValueLevel, SDK_API, SDK_CAPABILITIES, SDK_DEVICE, SDK_GATEWAYS, SDK_GENERATED, SDK_INPUT, SDK_OWN_STORAGE, SDK_PAGE, SDK_PASSWORD_MANAGERS, SDK_PRIVATE_MODE, SDK_RECORD, SDK_TRANSPORT, SDK_WINDOW, type SourceKind, type StoredEntry, type TelemetryEntry, type TransportFact, VALUE_LEVELS, type ValueLevel, capabilities, gateways };
+export { AC_CEREMONY, CATEGORIES, CATEGORY_VALUE_LEVELS, type CapabilityDescriptor, type Category, type CollectionLevel, type Conditional, type GatewayDescriptor, type GatewayField, type GeneratedEntry, KIND_LADDERS, type ManifestId, NON_VALUE_LEVELS, type NonValueLevel, SDK_API, SDK_CAPABILITIES, SDK_DEVICE, SDK_GATEWAYS, SDK_GENERATED, SDK_INPUT, SDK_OWN_STORAGE, SDK_PAGE, SDK_PASSWORD_MANAGERS, SDK_PRIVATE_MODE, SDK_RECORD, SDK_TRANSPORT, SDK_WINDOW, type SideEffect, type SourceKind, type StoredEntry, type StoredVariant, type TelemetryEntry, type TransportFact, VALUE_LEVELS, type ValueLevel, capabilities, gateways };

package/dist/manifest/index.d.ts

@@ -67,17 +67,32 @@ interface CapabilityDescriptor {
         adds: string;
     }[];
     /** What the capability does on the page beyond reading; `when` = the build switch that enables it. */
-    sideEffects?: {
-        id: string;
-        text: string;
-        when?: string;
-    }[];
+    sideEffects?: SideEffect[];
     review?: string;
     /** Additive (WP2): short plain-language line shown under the card, e.g. "used on: input fields". */
     usedOn?: string;
     /** Additive (WP2): the build switch that removes the whole capability from builds that turn it off. */
     when?: string;
 }
+/**
+ * Conditions shared by descriptor entries (all additive, all optional):
+ * - `when`: the build switch or config flag (static config / `build.config`) the entry depends on; `"!<name>"` = only
+ *   when it is off (e.g. `"!static"`: only with a downloaded config).
+ * - `requires`: the never-ship item (id of the tools' never-ship list, e.g. `"cross-origin-session"`,
+ *   `"sdk-operations"`) whose optional code produces the entry; omit the entry when that code is not in the bundle.
+ */
+interface Conditional {
+    when?: string;
+    requires?: string;
+}
+/** Something a capability does on the page beyond reading (shown in the overview's behavior list). */
+interface SideEffect extends Conditional {
+    /** `<area>.<slug>`, stable across versions. Entries of several capabilities with the same id describe one effect. */
+    id: string;
+    text: string;
+    /** Build switch / config flag that enables it, e.g. `"aap"`, `"privateMode"`, `"pmd"`. */
+    when?: string;
+}
 /** Gateways without an algorithm and the output gateways (sections 4 and 6). */
 interface GatewayDescriptor {
     key: string;
@@ -98,7 +113,7 @@ interface GatewayDescriptor {
     /** Additive (WP2): transport facts (`transport:<fact>`), only on the transport gateway. */
     transport?: TransportFact[];
 }
-interface GatewayField {
+interface GatewayField extends Conditional {
     path: string;
     /** A category, or `"role"`: inherit the category of the input role the field is read from. */
     category: Category | "role" | string;
@@ -122,7 +137,7 @@ interface GatewayField {
  * - `exposedTo`: who besides Corbado can see it, e.g. `"corbado"`, `"page scripts (getSessionId)"`,
  *   `"page scripts (local storage)"`.
  */
-interface GeneratedEntry {
+interface GeneratedEntry extends Conditional {
     id: string;
     category: Category | string;
     pointsTo: string;
@@ -142,8 +157,10 @@ interface GeneratedEntry {
  *   `"persistent"`.
  * - `owner`: `"sdk"`, `"project"`, `"third-party (<package>)"`.
  * - `contents`: field and generated ids (typed references); `"sent:events"` = the whole queued event as sent.
+ * - `when` (see {@link Conditional}): without `otherwise` the entry is absent when `when` does not hold; with
+ *   `otherwise` the entry stays, merged with `otherwise` (e.g. a cache a build does not write but still removes).
  */
-interface StoredEntry {
+interface StoredEntry extends Conditional {
     id: string;
     area: string;
     scope: string;
@@ -158,7 +175,18 @@ interface StoredEntry {
     enforced?: boolean;
     /** Additive (WP2): build switch / config flag the entry depends on. */
     when?: string;
+    /**
+     * Additive (v2 descriptors): the bundle never writes the entry, it only removes it when found (keys of older
+     * versions). Such an entry keeps nothing (`contents` empty); its `retention` is `"PT0S"` for older tools.
+     */
+    deleteOnly?: boolean;
+    /** Additive (v2 descriptors): a plain-language remark shown with the entry. */
+    note?: string;
+    /** Additive (v2 descriptors): what the entry becomes when its `when` does not hold (merged over the entry). */
+    otherwise?: StoredVariant;
 }
+/** Additive (v2 descriptors): the fields of a {@link StoredEntry} that its `otherwise` variant may replace. */
+type StoredVariant = Partial<Pick<StoredEntry, "retention" | "enforced" | "contents" | "label" | "deleteOnly" | "note" | "keys">>;
 interface TelemetryEntry {
     kind: string;
     fields: string[];
@@ -178,6 +206,9 @@ interface TransportFact {
  * `ac:ceremony@1` (SDK part): the WebAuthn allowlist (`src/utils/webauthn-ceremony.ts`), used by the sanitizers in
  * builds that define `__CBO_DATA_CEREMONY__ = true` (build switch `ceremony`). The library's credentials wrapper and
  * its endpoint reductions are the callers (second entry point: WebAuthn payloads in request and response bodies).
+ * The side effects are the library's (`@corbado/autocapture` `src/readers/credentials.ts`): it wraps the two methods;
+ * the container proxy is used only where the runtime's server config allows it (`aap` = `"c1"`) and the methods
+ * themselves cannot be wrapped.
  */
 declare const AC_CEREMONY: CapabilityDescriptor;
 
@@ -214,6 +245,10 @@ declare const SDK_RECORD: GatewayDescriptor;
  * the email-link notes only in builds with `__CBO_DATA_RETENTION__` (build switch `retention`); without it the
  * outboxes keep entries up to their caps (500 events, 1000 low events) and expired email-link notes stay until the
  * next write. Contents reference field and generated ids; `sent:events` = whole queued records as they are sent.
+ *
+ * Not listed: the private-mode library's temporary test databases, test directory and `test` entry (removed at once,
+ * nothing kept on the device): a side effect of `sdk:private-mode@1`. Entries with `otherwise` stay in the manifest
+ * when their `when` does not hold, merged with the variant (contract `StoredEntry.otherwise`).
  */
 declare const SDK_OWN_STORAGE: GatewayDescriptor;
 
@@ -230,6 +265,8 @@ declare const SDK_PAGE: GatewayDescriptor;
  * `src/low-events/`), declared as it behaves today (v1). Inside the gateway it reads the field's LENGTH (and a
  * checkbox's checked state) to tell typing, pasting, clearing and several-characters-at-once changes apart; neither
  * the value nor the length leaves it. A value-free v2 comes later (model section 13, "Later").
+ * Side effect: the library's input reader (`@corbado/autocapture` `onInput`, `src/readers/inputs.ts`) watches the
+ * document for added fields; `ac:element@1` lists the same effect (same id) for element roles.
  */
 declare const SDK_INPUT: CapabilityDescriptor;
 
@@ -242,6 +279,8 @@ declare const SDK_PASSWORD_MANAGERS: CapabilityDescriptor;
 /**
  * `sdk:private-mode@1`: private-mode detection (`src/readers/private-mode.ts`, the third-party library
  * detectincognitojs). Compiled out with `__CBO_DATA_PRIVATE_MODE__ = false` (build switch `privateMode`).
+ * The library's temporary test databases, test directory and `test` storage entry are only this side effect: they
+ * are removed at once, so `sdk:own-storage` does not list them (nothing is kept on the device).
  */
 declare const SDK_PRIVATE_MODE: CapabilityDescriptor;
 
@@ -267,4 +306,4 @@ declare const SDK_GATEWAYS: readonly GatewayDescriptor[];
 declare const capabilities: CapabilityDescriptor[];
 declare const gateways: GatewayDescriptor[];
 
-export { AC_CEREMONY, CATEGORIES, CATEGORY_VALUE_LEVELS, type CapabilityDescriptor, type Category, type CollectionLevel, type GatewayDescriptor, type GatewayField, type GeneratedEntry, KIND_LADDERS, type ManifestId, NON_VALUE_LEVELS, type NonValueLevel, SDK_API, SDK_CAPABILITIES, SDK_DEVICE, SDK_GATEWAYS, SDK_GENERATED, SDK_INPUT, SDK_OWN_STORAGE, SDK_PAGE, SDK_PASSWORD_MANAGERS, SDK_PRIVATE_MODE, SDK_RECORD, SDK_TRANSPORT, SDK_WINDOW, type SourceKind, type StoredEntry, type TelemetryEntry, type TransportFact, VALUE_LEVELS, type ValueLevel, capabilities, gateways };
+export { AC_CEREMONY, CATEGORIES, CATEGORY_VALUE_LEVELS, type CapabilityDescriptor, type Category, type CollectionLevel, type Conditional, type GatewayDescriptor, type GatewayField, type GeneratedEntry, KIND_LADDERS, type ManifestId, NON_VALUE_LEVELS, type NonValueLevel, SDK_API, SDK_CAPABILITIES, SDK_DEVICE, SDK_GATEWAYS, SDK_GENERATED, SDK_INPUT, SDK_OWN_STORAGE, SDK_PAGE, SDK_PASSWORD_MANAGERS, SDK_PRIVATE_MODE, SDK_RECORD, SDK_TRANSPORT, SDK_WINDOW, type SideEffect, type SourceKind, type StoredEntry, type StoredVariant, type TelemetryEntry, type TransportFact, VALUE_LEVELS, type ValueLevel, capabilities, gateways };

package/dist/manifest/index.js

@@ -83,6 +83,17 @@ var AC_CEREMONY = {
       adds: "the passkey's random id, to recognize the same passkey across sign-ins. Its own field, category opaque-identifier, level raw. Without it the ids are replaced by random stand-ins that only match within one page load, so projects that track credentials (passkey KPIs, passkey provider at sign-in) declare passkeyReference: true (adx, vg, vr, adb). A runtime option (not a build switch): the autocapture runtime passes it from the static config, the manifest records its value from build.config."
     }
   ],
+  sideEffects: [
+    {
+      id: "ceremony.wrap-credentials",
+      text: "wraps navigator.credentials.get and navigator.credentials.create, so every passkey prompt of the page passes through it"
+    },
+    {
+      id: "ceremony.credentials-proxy",
+      text: "navigator.credentials is replaced by a proxy that forwards to the original",
+      when: "aap"
+    }
+  ],
   usedOn: "passkey prompts, passkey data in request bodies and page attributes (fields declared via ac:ceremony@1); default set: technical and device facts only",
   when: "ceremony"
 };
@@ -105,7 +116,9 @@ var SDK_API = {
       path: "emailLink.transactionId",
       level: "pseudonym",
       category: "personal-identifier",
-      label: "Transaction reference of an email link, as the integration passes it (a projects' declaration narrows it)"
+      label: "Transaction reference of an email link, as the integration passes it (a projects' declaration narrows it)",
+      // email-link typed operation (`utils/email-link-operation-full.ts`), optional code
+      requires: "sdk-operations"
     }
   ]
 };
@@ -342,7 +355,13 @@ var SDK_OWN_STORAGE = {
       enforced: true,
       owner: "sdk",
       contents: ["sent:events"],
-      label: "Field and window interaction records not yet delivered; never kept longer than 7 days"
+      label: "Field and window interaction records not yet delivered; never kept longer than 7 days",
+      // queue.ts enqueueLow writes only with durableLowOutbox; the queue always opens the low outbox to recover and
+      // resend (or drop after 7 days / on rejection) what an earlier load left
+      when: "durableLowOutbox",
+      otherwise: {
+        note: "Not written by this build (durableLowOutbox is off): low events are sent from memory; entries left by an older build are sent or removed."
+      }
     },
     {
       id: "storage:sdk.session",
@@ -406,8 +425,10 @@ var SDK_OWN_STORAGE = {
       enforced: false,
       owner: "sdk",
       contents: [],
-      label: "Corbado's settings for the script (no personal data); refreshed at most daily. Absent with a static config",
-      when: "serverConfig"
+      label: "Corbado's settings for the script (no personal data); refreshed at most daily",
+      // only ConfigManager (absent from static-config builds) reads, writes or removes it; nothing removes an older
+      // cache in a static build (storage/migration.ts may still copy a pre-multi-project `cbo_sdk_config` once)
+      when: "!static"
     },
     {
       id: "storage:sdk.private-mode",
@@ -450,7 +471,9 @@ var SDK_OWN_STORAGE = {
       enforced: true,
       owner: "sdk",
       contents: [`${API}#emailLink.transactionId`, "generated:sdk.event", "generated:sdk.session"],
-      label: "Started email links (at most 10), to continue them on the link's page; deleted after 24 hours"
+      label: "Started email links (at most 10), to continue them on the link's page; deleted after 24 hours",
+      // written only by the email-link typed operation (`utils/email-link-operation-full.ts`)
+      requires: "sdk-operations"
     },
     {
       id: "storage:sdk.storage-schema",
@@ -474,14 +497,18 @@ var SDK_OWN_STORAGE = {
     },
     {
       id: "storage:sdk.legacy-debug",
-      keys: ["cbo_visibility_change_debug", "cbo_pagehide_debug"],
+      // queue.ts removes the project-scoped keys at start (a one-time storage/migration.ts copy of a pre-multi-project
+      // unscoped key included, removed in the same start); the unscoped originals are left untouched
+      keys: ["cbo_visibility_change_debug_*", "cbo_pagehide_debug_*"],
       area: "local",
       scope: "origin",
       retention: "PT0S",
       enforced: true,
+      deleteOnly: true,
       owner: "sdk",
       contents: [],
-      label: "Debug output older script versions wrote in debug mode (it held the full page address): no longer written, deleted when the script starts"
+      label: "Debug keys of older versions",
+      note: "Debug keys of older versions (they held the unmasked page address); removed when found, never written."
     },
     {
       id: "storage:sdk.cross-origin-session",
@@ -492,43 +519,8 @@ var SDK_OWN_STORAGE = {
       owner: "sdk",
       contents: ["generated:sdk.session", "record:sdk.event#seq"],
       label: "Visit shared across the site's subdomains (first-party cookie); only with the cross-origin session plugin",
-      when: "crossOriginSession"
-    },
-    {
-      id: "storage:sdk.private-mode-probe-local",
-      keys: ["test"],
-      area: "local",
-      scope: "origin",
-      retention: "PT0S",
-      enforced: true,
-      owner: "third-party (detectincognitojs)",
-      contents: [],
-      label: "Test entry of the private-mode check (value 1), removed at once",
-      when: "privateMode"
-    },
-    {
-      id: "storage:sdk.private-mode-probe-indexeddb",
-      keys: ["<random>", "__di_<random>", "inPrivate"],
-      area: "indexeddb",
-      scope: "origin",
-      retention: "PT0S",
-      enforced: true,
-      owner: "third-party (detectincognitojs)",
-      contents: [],
-      label: "Test databases of the private-mode check (no data), deleted at once",
-      when: "privateMode"
-    },
-    {
-      id: "storage:sdk.private-mode-probe-opfs",
-      keys: ["origin private file system root (opened, nothing written)"],
-      area: "opfs",
-      scope: "origin",
-      retention: "PT0S",
-      enforced: true,
-      owner: "third-party (detectincognitojs)",
-      contents: [],
-      label: "Private-mode check opens the origin's private file system, writes nothing",
-      when: "privateMode"
+      when: "crossOriginSession",
+      requires: "cross-origin-session"
     }
   ]
 };
@@ -582,6 +574,12 @@ var SDK_INPUT = {
     single: "per field",
     group: "Group (one-time codes): only whether all fields are empty; no moves between the fields"
   },
+  sideEffects: [
+    {
+      id: "dom.mutation-observers",
+      text: "watches the whole document for added elements (MutationObserver, child list and subtree) to find declared elements and fields when the page changes"
+    }
+  ],
   usedOn: "input fields",
   review: "SEC-input-v1"
 };
@@ -591,10 +589,10 @@ var SDK_PASSWORD_MANAGERS = {
   key: "sdk:password-managers",
   version: 1,
   title: "Installed password managers",
-  why: "Helps explain autofill behaviour and failures.",
+  why: "Helps explain autofill behavior and failures.",
   collects: ["names of detected password managers from a fixed list"],
   never: [
-    { text: "whether you are signed in to them", proof: "sdk:password-managers@1#never.signed-in" },
+    { text: "whether the person is signed in to them", proof: "sdk:password-managers@1#never.signed-in" },
     { text: "anything stored in them", proof: "sdk:password-managers@1#never.contents" }
   ],
   sideEffects: [
@@ -652,8 +650,16 @@ var SDK_TRANSPORT = {
       addedBy: "browser"
     },
     { id: "transport:origin", label: "The page's origin (Origin header)", addedBy: "browser" },
-    { id: "transport:client-hints", label: "Browser client hints, where the browser sends them", addedBy: "browser" },
-    { id: "transport:ip-address", label: "IP address (seen by Corbado's servers)", addedBy: "browser" },
+    {
+      id: "transport:client-hints",
+      label: "The browser's default client hints (brand and version, mobile or not, operating system), if the browser sends them; the detailed device facts (for example the model) are read separately and listed under device information.",
+      addedBy: "browser"
+    },
+    {
+      id: "transport:ip-address",
+      label: "The visitor's IP address reaches Corbado's backend with every request, as with any web request. It is discarded there and not stored with the data; it is only kept for a limited time (90 days) in firewall logs when the request was flagged as suspicious.",
+      addedBy: "browser"
+    },
     {
       id: "transport:beacon-cookies",
       label: "Cookies of the ingestion host, on requests sent while the page is closing",

package/dist/manifest/index.mjs

@@ -37,6 +37,17 @@ var AC_CEREMONY = {
       adds: "the passkey's random id, to recognize the same passkey across sign-ins. Its own field, category opaque-identifier, level raw. Without it the ids are replaced by random stand-ins that only match within one page load, so projects that track credentials (passkey KPIs, passkey provider at sign-in) declare passkeyReference: true (adx, vg, vr, adb). A runtime option (not a build switch): the autocapture runtime passes it from the static config, the manifest records its value from build.config."
     }
   ],
+  sideEffects: [
+    {
+      id: "ceremony.wrap-credentials",
+      text: "wraps navigator.credentials.get and navigator.credentials.create, so every passkey prompt of the page passes through it"
+    },
+    {
+      id: "ceremony.credentials-proxy",
+      text: "navigator.credentials is replaced by a proxy that forwards to the original",
+      when: "aap"
+    }
+  ],
   usedOn: "passkey prompts, passkey data in request bodies and page attributes (fields declared via ac:ceremony@1); default set: technical and device facts only",
   when: "ceremony"
 };
@@ -59,7 +70,9 @@ var SDK_API = {
       path: "emailLink.transactionId",
       level: "pseudonym",
       category: "personal-identifier",
-      label: "Transaction reference of an email link, as the integration passes it (a projects' declaration narrows it)"
+      label: "Transaction reference of an email link, as the integration passes it (a projects' declaration narrows it)",
+      // email-link typed operation (`utils/email-link-operation-full.ts`), optional code
+      requires: "sdk-operations"
     }
   ]
 };
@@ -296,7 +309,13 @@ var SDK_OWN_STORAGE = {
       enforced: true,
       owner: "sdk",
       contents: ["sent:events"],
-      label: "Field and window interaction records not yet delivered; never kept longer than 7 days"
+      label: "Field and window interaction records not yet delivered; never kept longer than 7 days",
+      // queue.ts enqueueLow writes only with durableLowOutbox; the queue always opens the low outbox to recover and
+      // resend (or drop after 7 days / on rejection) what an earlier load left
+      when: "durableLowOutbox",
+      otherwise: {
+        note: "Not written by this build (durableLowOutbox is off): low events are sent from memory; entries left by an older build are sent or removed."
+      }
     },
     {
       id: "storage:sdk.session",
@@ -360,8 +379,10 @@ var SDK_OWN_STORAGE = {
       enforced: false,
       owner: "sdk",
       contents: [],
-      label: "Corbado's settings for the script (no personal data); refreshed at most daily. Absent with a static config",
-      when: "serverConfig"
+      label: "Corbado's settings for the script (no personal data); refreshed at most daily",
+      // only ConfigManager (absent from static-config builds) reads, writes or removes it; nothing removes an older
+      // cache in a static build (storage/migration.ts may still copy a pre-multi-project `cbo_sdk_config` once)
+      when: "!static"
     },
     {
       id: "storage:sdk.private-mode",
@@ -404,7 +425,9 @@ var SDK_OWN_STORAGE = {
       enforced: true,
       owner: "sdk",
       contents: [`${API}#emailLink.transactionId`, "generated:sdk.event", "generated:sdk.session"],
-      label: "Started email links (at most 10), to continue them on the link's page; deleted after 24 hours"
+      label: "Started email links (at most 10), to continue them on the link's page; deleted after 24 hours",
+      // written only by the email-link typed operation (`utils/email-link-operation-full.ts`)
+      requires: "sdk-operations"
     },
     {
       id: "storage:sdk.storage-schema",
@@ -428,14 +451,18 @@ var SDK_OWN_STORAGE = {
     },
     {
       id: "storage:sdk.legacy-debug",
-      keys: ["cbo_visibility_change_debug", "cbo_pagehide_debug"],
+      // queue.ts removes the project-scoped keys at start (a one-time storage/migration.ts copy of a pre-multi-project
+      // unscoped key included, removed in the same start); the unscoped originals are left untouched
+      keys: ["cbo_visibility_change_debug_*", "cbo_pagehide_debug_*"],
       area: "local",
       scope: "origin",
       retention: "PT0S",
       enforced: true,
+      deleteOnly: true,
       owner: "sdk",
       contents: [],
-      label: "Debug output older script versions wrote in debug mode (it held the full page address): no longer written, deleted when the script starts"
+      label: "Debug keys of older versions",
+      note: "Debug keys of older versions (they held the unmasked page address); removed when found, never written."
     },
     {
       id: "storage:sdk.cross-origin-session",
@@ -446,43 +473,8 @@ var SDK_OWN_STORAGE = {
       owner: "sdk",
       contents: ["generated:sdk.session", "record:sdk.event#seq"],
       label: "Visit shared across the site's subdomains (first-party cookie); only with the cross-origin session plugin",
-      when: "crossOriginSession"
-    },
-    {
-      id: "storage:sdk.private-mode-probe-local",
-      keys: ["test"],
-      area: "local",
-      scope: "origin",
-      retention: "PT0S",
-      enforced: true,
-      owner: "third-party (detectincognitojs)",
-      contents: [],
-      label: "Test entry of the private-mode check (value 1), removed at once",
-      when: "privateMode"
-    },
-    {
-      id: "storage:sdk.private-mode-probe-indexeddb",
-      keys: ["<random>", "__di_<random>", "inPrivate"],
-      area: "indexeddb",
-      scope: "origin",
-      retention: "PT0S",
-      enforced: true,
-      owner: "third-party (detectincognitojs)",
-      contents: [],
-      label: "Test databases of the private-mode check (no data), deleted at once",
-      when: "privateMode"
-    },
-    {
-      id: "storage:sdk.private-mode-probe-opfs",
-      keys: ["origin private file system root (opened, nothing written)"],
-      area: "opfs",
-      scope: "origin",
-      retention: "PT0S",
-      enforced: true,
-      owner: "third-party (detectincognitojs)",
-      contents: [],
-      label: "Private-mode check opens the origin's private file system, writes nothing",
-      when: "privateMode"
+      when: "crossOriginSession",
+      requires: "cross-origin-session"
     }
   ]
 };
@@ -536,6 +528,12 @@ var SDK_INPUT = {
     single: "per field",
     group: "Group (one-time codes): only whether all fields are empty; no moves between the fields"
   },
+  sideEffects: [
+    {
+      id: "dom.mutation-observers",
+      text: "watches the whole document for added elements (MutationObserver, child list and subtree) to find declared elements and fields when the page changes"
+    }
+  ],
   usedOn: "input fields",
   review: "SEC-input-v1"
 };
@@ -545,10 +543,10 @@ var SDK_PASSWORD_MANAGERS = {
   key: "sdk:password-managers",
   version: 1,
   title: "Installed password managers",
-  why: "Helps explain autofill behaviour and failures.",
+  why: "Helps explain autofill behavior and failures.",
   collects: ["names of detected password managers from a fixed list"],
   never: [
-    { text: "whether you are signed in to them", proof: "sdk:password-managers@1#never.signed-in" },
+    { text: "whether the person is signed in to them", proof: "sdk:password-managers@1#never.signed-in" },
     { text: "anything stored in them", proof: "sdk:password-managers@1#never.contents" }
   ],
   sideEffects: [
@@ -606,8 +604,16 @@ var SDK_TRANSPORT = {
       addedBy: "browser"
     },
     { id: "transport:origin", label: "The page's origin (Origin header)", addedBy: "browser" },
-    { id: "transport:client-hints", label: "Browser client hints, where the browser sends them", addedBy: "browser" },
-    { id: "transport:ip-address", label: "IP address (seen by Corbado's servers)", addedBy: "browser" },
+    {
+      id: "transport:client-hints",
+      label: "The browser's default client hints (brand and version, mobile or not, operating system), if the browser sends them; the detailed device facts (for example the model) are read separately and listed under device information.",
+      addedBy: "browser"
+    },
+    {
+      id: "transport:ip-address",
+      label: "The visitor's IP address reaches Corbado's backend with every request, as with any web request. It is discarded there and not stored with the data; it is only kept for a limited time (90 days) in firewall logs when the request was flagged as suspicious.",
+      addedBy: "browser"
+    },
     {
       id: "transport:beacon-cookies",
       label: "Cookies of the ingestion host, on requests sent while the page is closing",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corbado/observe",
-  "version": "1.15.0",
+  "version": "1.15.1",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
   "types": "./dist/index.d.ts",