@cross-deck/web 1.0.0 → 1.1.0

package/dist/index.mjs

@@ -65,7 +65,7 @@ function typeMapForStatus(status) {
 
 // src/http.ts
 var SDK_NAME = "@cross-deck/web";
-var SDK_VERSION = "1.0.0";
+var SDK_VERSION = "1.1.0";
 var DEFAULT_BASE_URL = "https://api.cross-deck.com/v1";
 var DEFAULT_TIMEOUT_MS = 15e3;
 var HttpClient = class {
@@ -313,70 +313,120 @@ function randomChars(count) {
 }
 
 // src/entitlement-cache.ts
+var DEFAULT_STALE_AFTER_MS = 24 * 60 * 60 * 1e3;
 var EntitlementCache = class {
-  constructor() {
-    this.active = /* @__PURE__ */ new Set();
+  /**
+   * @param storage      Device storage adapter. When omitted (tests) or
+   *                     a MemoryStorage (strict-consent / no-persistence
+   *                     mode) the cache is session-only — durability is
+   *                     simply absent, never wrong.
+   * @param storageKey   Full key the persisted blob lives under.
+   * @param staleAfterMs Age past which last-known-good is flagged stale
+   *                     even without a failed refresh. Default 24h.
+   */
+  constructor(storage, storageKey = "crossdeck:entitlements", staleAfterMs = DEFAULT_STALE_AFTER_MS) {
     this.all = [];
     this.lastUpdated = 0;
+    this.lastRefreshFailedAt = 0;
     this.listeners = /* @__PURE__ */ new Set();
     this.listenerErrorCount = 0;
+    this.storage = storage;
+    this.storageKey = storageKey;
+    this.staleAfterMs = staleAfterMs;
+    this.hydrate();
   }
-  /** Sync read — true iff the entitlement key is currently active. */
+  /**
+   * Sync read — true iff the entitlement is currently granting access.
+   *
+   * Served from last-known-good: a stale cache (server unreachable since
+   * the last successful fetch) still answers true for a still-valid
+   * entitlement. The ONLY thing that turns it false is the entitlement's
+   * own expiry (validUntil) — never overall cache staleness.
+   */
   isEntitled(key) {
-    return this.active.has(key);
+    const nowSec = Date.now() / 1e3;
+    return this.all.some(
+      (e) => e.key === key && e.isActive && (e.validUntil == null || e.validUntil > nowSec)
+    );
   }
   /** Full snapshot for callers that need source / validUntil details. */
   list() {
     return this.all.slice();
   }
-  /** When the cache was last refreshed. 0 means "never". */
+  /** When the cache was last refreshed from the server. 0 means "never". */
   get freshness() {
     return this.lastUpdated;
   }
   /**
-   * Cumulative count of listener invocations that threw. Listener errors
-   * are swallowed (a buggy consumer must not crash the SDK) but the
-   * counter lets diagnostics() surface "you have a broken subscriber"
-   * without putting the developer in a debug session.
+   * Whether the cache is knowingly serving older-than-trustworthy data.
+   *
+   * True when the most recent refresh ATTEMPT failed (Crossdeck
+   * unreachable since the last success — the outage case, distinct from
+   * a benign idle tab that simply hasn't re-fetched), OR when
+   * last-known-good has aged past staleAfterMs.
+   *
+   * isStale never changes what isEntitled() returns — the cache still
+   * serves last-known-good. It exists so the staleness is observable
+   * (diagnostics()) instead of an unbounded silent window where a
+   * revoked customer holds access with nobody able to see it.
    */
+  get isStale() {
+    if (this.lastRefreshFailedAt > this.lastUpdated) return true;
+    return this.lastUpdated > 0 && Date.now() - this.lastUpdated > this.staleAfterMs;
+  }
+  /** Epoch ms of the last failed refresh attempt. 0 if none since the last success. */
+  get refreshFailedAt() {
+    return this.lastRefreshFailedAt;
+  }
   get listenerErrors() {
     return this.listenerErrorCount;
   }
   /**
-   * Replace the cache with a fresh server response. The backend already
-   * filters to active + env-matching, so we don't re-filter — just trust
-   * what we got.
+   * Record that a refresh attempt failed (Crossdeck unreachable / a
+   * transient error). The SDK's getEntitlements() calls this in its
+   * catch path. It does NOT touch the cached entitlements — last-known-
+   * good keeps serving — it only flips isStale so the staleness shows
+   * up in diagnostics() rather than being silent.
+   */
+  markRefreshFailed() {
+    this.lastRefreshFailedAt = Date.now();
+  }
+  /**
+   * Replace the cache with a fresh server response and persist it to
+   * device storage so it survives a reload / app restart.
    *
-   * Fires listeners AFTER the mutation so each listener sees the new state.
+   * Called ONLY after a successful server read — a failed fetch throws
+   * before it reaches here, so last-known-good is preserved through an
+   * outage. A success also clears the stale flag.
    */
   setFromList(entitlements) {
     this.all = entitlements.slice();
-    this.active = new Set(entitlements.filter((e) => e.isActive).map((e) => e.key));
     this.lastUpdated = Date.now();
+    this.lastRefreshFailedAt = 0;
+    this.persist();
     this.notify();
   }
   /**
-   * Wipe — used on reset() (logout). The SDK forgets everything until
-   * the next identify + read.
-   *
-   * Fires listeners so React/SwiftUI/etc bindings re-render to the
-   * logged-out state immediately.
+   * Wipe — used on reset() (logout) and on an identity switch. Clears
+   * BOTH memory and durable storage so a prior user's entitlements can
+   * never leak to the next person on this device.
    */
   clear() {
-    this.active.clear();
     this.all = [];
     this.lastUpdated = 0;
+    this.lastRefreshFailedAt = 0;
+    if (this.storage) {
+      try {
+        this.storage.removeItem(this.storageKey);
+      } catch {
+      }
+    }
     this.notify();
   }
   /**
-   * Subscribe to cache mutations. Returns an unsubscribe function.
-   *
-   * The listener is invoked AFTER setFromList() or clear() with the
-   * current snapshot. Throwing inside a listener is non-fatal — the
-   * error is swallowed and subsequent listeners still run.
-   *
-   * Used by `@cross-deck/web/react`'s `useEntitlement` hook to
-   * trigger re-renders when entitlements change.
+   * Subscribe to cache mutations. Returns an idempotent unsubscribe fn.
+   * The listener fires AFTER setFromList() or clear() with the current
+   * snapshot. Used by `@cross-deck/web/react`'s `useEntitlement` hook.
    */
   subscribe(listener) {
     this.listeners.add(listener);
@@ -387,6 +437,39 @@ var EntitlementCache = class {
       this.listeners.delete(listener);
     };
   }
+  // ----- Durable persistence -----
+  /**
+   * Load last-known-good from device storage. Runs once in the
+   * constructor, synchronously, so isEntitled() is correct from boot.
+   * Any corrupt / unparseable blob degrades silently to an empty cache —
+   * boot must never throw.
+   */
+  hydrate() {
+    if (!this.storage) return;
+    try {
+      const raw = this.storage.getItem(this.storageKey);
+      if (!raw) return;
+      const parsed = JSON.parse(raw);
+      if (parsed && parsed.v === 1 && Array.isArray(parsed.entitlements)) {
+        this.all = parsed.entitlements;
+        this.lastUpdated = typeof parsed.lastUpdated === "number" ? parsed.lastUpdated : 0;
+      }
+    } catch {
+    }
+  }
+  /** Write last-known-good to device storage. Best-effort. */
+  persist() {
+    if (!this.storage) return;
+    try {
+      const blob = {
+        v: 1,
+        entitlements: this.all,
+        lastUpdated: this.lastUpdated
+      };
+      this.storage.setItem(this.storageKey, JSON.stringify(blob));
+    } catch {
+    }
+  }
   notify() {
     if (this.listeners.size === 0) return;
     const snapshot = this.all.slice();
@@ -1183,11 +1266,50 @@ function isInsidePasswordField(el) {
   return false;
 }
 function extractText(el) {
+  const clean = (s) => s.replace(/\s+/g, " ").trim();
+  const explicit = el.getAttribute("data-cd-track") || el.getAttribute("data-track") || el.getAttribute("data-testid");
+  if (explicit) {
+    const t = clean(explicit);
+    if (t) return t;
+  }
   const aria = el.getAttribute("aria-label");
-  if (aria) return aria.replace(/\s+/g, " ").trim();
-  if (el instanceof HTMLInputElement && el.value) return el.value;
-  const text = (el.textContent || "").replace(/\s+/g, " ").trim();
-  return text;
+  if (aria) {
+    const t = clean(aria);
+    if (t) return t;
+  }
+  const labelledBy = el.getAttribute("aria-labelledby");
+  if (labelledBy && typeof el.ownerDocument?.getElementById === "function") {
+    const parts = [];
+    for (const id of labelledBy.split(/\s+/)) {
+      const ref = el.ownerDocument.getElementById(id);
+      const t = ref?.textContent ? clean(ref.textContent) : "";
+      if (t) parts.push(t);
+    }
+    if (parts.length > 0) return parts.join(" ");
+  }
+  if (el instanceof HTMLInputElement && el.value) {
+    const t = clean(el.value);
+    if (t) return t;
+  }
+  const text = clean(el.textContent || "");
+  if (text) return text;
+  const title = el.getAttribute("title");
+  if (title) {
+    const t = clean(title);
+    if (t) return t;
+  }
+  const img = el.querySelector("img[alt]");
+  if (img) {
+    const alt = img.getAttribute("alt") ?? "";
+    const t = clean(alt);
+    if (t) return t;
+  }
+  const svgTitle = el.querySelector("svg title");
+  if (svgTitle?.textContent) {
+    const t = clean(svgTitle.textContent);
+    if (t) return t;
+  }
+  return "";
 }
 function trimText(s, cap) {
   if (s.length <= cap) return s;
@@ -1892,13 +2014,22 @@ function isInAppFrame(filename) {
   if (/\/crossdeck\.umd\.min\.js$/.test(filename)) return false;
   return true;
 }
-function fingerprintError(message, frames) {
+function fingerprintError(message, frames, location) {
   const inAppFrames = frames.filter((f) => f.in_app).slice(0, 3);
-  const key = [
+  const parts = [
     (message || "").slice(0, 200),
     ...inAppFrames.map((f) => `${f.function}@${f.filename}:${f.lineno}`)
-  ].join("|");
-  return djb2Hex(key);
+  ];
+  if (inAppFrames.length === 0 && location) {
+    const loc = [
+      location.errorType ?? "",
+      location.filename ?? "",
+      location.lineno ?? "",
+      location.colno ?? ""
+    ].join(":");
+    if (loc !== ":::") parts.push(loc);
+  }
+  return djb2Hex(parts.join("|"));
 }
 function djb2Hex(input) {
   let h = 5381;
@@ -1920,11 +2051,17 @@ var DEFAULT_ERROR_CAPTURE = {
     // Classic browser noise. These aren't application bugs.
     "ResizeObserver loop limit exceeded",
     "ResizeObserver loop completed with undelivered notifications",
-    "Non-Error promise rejection captured",
-    // Cross-origin script errors that the browser strips — no info,
-    // no way to act on them, just noise.
-    "Script error.",
-    "Script error"
+    "Non-Error promise rejection captured"
+    // NOTE: We deliberately do NOT drop cross-origin "Script error."
+    // events here. They used to be silently filtered as noise, but
+    // silent drops are the opposite of "developer sleeps well at
+    // night". We now capture them with a clear label and the
+    // `cross_origin` tag so the dashboard surfaces them as a
+    // distinct, actionable category (the fix is always the same —
+    // add `crossorigin="anonymous"` to the script tag + CORS
+    // headers on the script's origin). Apps that genuinely want
+    // them muted can re-add "Script error" to ignoreErrors via
+    // init config.
   ],
   allowUrls: [],
   denyUrls: [
@@ -2164,61 +2301,84 @@ var ErrorTracker = class {
   // ============================================================
   buildFromErrorEvent(event) {
     const err = event.error;
-    const message = event.message || (err instanceof Error ? err.message : "Unknown error");
+    const filename = event.filename || null;
+    const lineno = typeof event.lineno === "number" && event.lineno > 0 ? event.lineno : null;
+    const colno = typeof event.colno === "number" && event.colno > 0 ? event.colno : null;
+    const isCrossOriginStripped = err == null && !filename && lineno == null && (event.message === "Script error." || event.message === "Script error" || !event.message);
+    if (isCrossOriginStripped) {
+      const message2 = "Cross-origin script error (browser hid details \u2014 script needs crossorigin attribute + CORS headers)";
+      return {
+        timestamp: Date.now(),
+        kind: "error.unhandled",
+        level: "error",
+        message: message2,
+        errorType: "ScriptError",
+        frames: [],
+        rawStack: null,
+        filename: null,
+        lineno: null,
+        colno: null,
+        // No location to fingerprint by — all of these will share one
+        // group, which is correct: developer fixes them all with the
+        // same CORS change.
+        fingerprint: fingerprintError(message2, []),
+        breadcrumbs: this.opts.breadcrumbs.snapshot(),
+        context: this.opts.getContext(),
+        tags: { ...this.opts.getTags(), cross_origin: "true" }
+      };
+    }
+    const payload = coerceErrorPayload(err);
+    const message = (payload.message || event.message || "Unknown error").slice(0, 1024);
     const stack = err instanceof Error ? err.stack ?? null : null;
     const frames = parseStack(stack);
+    const errorType = payload.errorType ?? null;
+    const context = payload.extras ? { ...this.opts.getContext(), __error_extras: payload.extras } : this.opts.getContext();
     return {
       timestamp: Date.now(),
       kind: "error.unhandled",
       level: "error",
-      message: String(message).slice(0, 1024),
-      errorType: err instanceof Error ? err.name : null,
+      message,
+      errorType,
       frames,
       rawStack: stack,
-      filename: event.filename || null,
-      lineno: typeof event.lineno === "number" ? event.lineno : null,
-      colno: typeof event.colno === "number" ? event.colno : null,
-      fingerprint: fingerprintError(message, frames),
+      filename,
+      lineno,
+      colno,
+      // Location fallback ensures distinct call sites stay separate
+      // even when the message is generic ("Unknown error",
+      // "[object Object]") and there are no parseable frames.
+      fingerprint: fingerprintError(message, frames, {
+        filename,
+        lineno,
+        colno,
+        errorType
+      }),
       breadcrumbs: this.opts.breadcrumbs.snapshot(),
-      context: this.opts.getContext(),
+      context,
       tags: this.opts.getTags()
     };
   }
   buildFromUnknown(err, kind, level) {
-    if (err instanceof Error) {
-      const frames = parseStack(err.stack);
-      return {
-        timestamp: Date.now(),
-        kind,
-        level,
-        message: String(err.message).slice(0, 1024),
-        errorType: err.name,
-        frames,
-        rawStack: err.stack ?? null,
-        filename: null,
-        lineno: null,
-        colno: null,
-        fingerprint: fingerprintError(err.message, frames),
-        breadcrumbs: this.opts.breadcrumbs.snapshot(),
-        context: this.opts.getContext(),
-        tags: this.opts.getTags()
-      };
-    }
-    const message = safeStringify2(err).slice(0, 1024);
+    const payload = coerceErrorPayload(err);
+    const message = (payload.message || "Unknown error").slice(0, 1024);
+    const stack = err instanceof Error ? err.stack ?? null : null;
+    const frames = parseStack(stack);
+    const errorType = payload.errorType ?? null;
+    const context = payload.extras ? { ...this.opts.getContext(), __error_extras: payload.extras } : this.opts.getContext();
     return {
       timestamp: Date.now(),
       kind,
       level,
       message,
-      errorType: null,
-      frames: [],
-      rawStack: null,
+      errorType,
+      frames,
+      rawStack: stack,
       filename: null,
       lineno: null,
       colno: null,
-      fingerprint: fingerprintError(message, []),
+      fingerprint: fingerprintError(message, frames, { errorType }),
       breadcrumbs: this.opts.breadcrumbs.snapshot(),
-      context: this.opts.getContext(),
+      context,
       tags: this.opts.getTags()
     };
   }
@@ -2236,7 +2396,10 @@ var ErrorTracker = class {
         filename: info.url,
         lineno: null,
         colno: null,
-        fingerprint: fingerprintError(`HTTP ${info.status} ${info.method}`, []),
+        fingerprint: fingerprintError(`HTTP ${info.status} ${info.method}`, [], {
+          filename: info.url,
+          errorType: "HTTPError"
+        }),
         breadcrumbs: this.opts.breadcrumbs.snapshot(),
         context: this.opts.getContext(),
         tags: this.opts.getTags(),
@@ -2315,16 +2478,131 @@ var ErrorTracker = class {
     return true;
   }
 };
-function safeStringify2(v) {
-  if (v == null) return String(v);
-  if (typeof v === "string") return v;
-  if (typeof v === "number" || typeof v === "boolean") return String(v);
+function coerceErrorPayload(v) {
+  if (v === null) return { message: "(thrown: null)", errorType: null, extras: null };
+  if (v === void 0) return { message: "(thrown: undefined)", errorType: null, extras: null };
+  if (typeof v === "string") {
+    return { message: v, errorType: null, extras: null };
+  }
+  if (typeof v === "number" || typeof v === "boolean" || typeof v === "bigint") {
+    return { message: String(v), errorType: typeof v, extras: null };
+  }
+  if (typeof v === "symbol") {
+    return { message: v.toString(), errorType: "symbol", extras: null };
+  }
+  if (typeof v === "function") {
+    return { message: `(thrown function: ${v.name || "anonymous"})`, errorType: "function", extras: null };
+  }
+  if (v instanceof Error) {
+    const errorType = v.name || v.constructor?.name || "Error";
+    const message = typeof v.message === "string" && v.message.length > 0 ? v.message : safeToString(v) || errorType;
+    const extras = {};
+    const causeChain = collectCauseChain(v);
+    if (causeChain.length > 0) extras.cause = causeChain;
+    for (const key of ["code", "status", "statusCode", "errno", "response", "data", "detail", "details"]) {
+      const val = v[key];
+      if (val !== void 0 && typeof val !== "function") {
+        extras[key] = safeClone(val);
+      }
+    }
+    for (const key of Object.keys(v)) {
+      if (key === "message" || key === "stack" || key === "name" || key === "cause") continue;
+      if (key in extras) continue;
+      const val = v[key];
+      if (typeof val === "function") continue;
+      extras[key] = safeClone(val);
+    }
+    return {
+      message,
+      errorType,
+      extras: Object.keys(extras).length > 0 ? extras : null
+    };
+  }
+  if (typeof Response !== "undefined" && v instanceof Response) {
+    return {
+      message: `HTTP ${v.status} ${v.statusText || ""}${v.url ? ` ${v.url}` : ""}`.trim(),
+      errorType: "Response",
+      extras: { status: v.status, statusText: v.statusText, url: v.url, type: v.type }
+    };
+  }
+  if (typeof v === "object") {
+    const obj = v;
+    const ctorName = obj.constructor && typeof obj.constructor === "function" && obj.constructor.name || null;
+    const ownMessage = typeof obj.message === "string" && obj.message ? obj.message : null;
+    const ownName = typeof obj.name === "string" && obj.name ? obj.name : null;
+    let jsonForm = null;
+    try {
+      const serialised = JSON.stringify(obj);
+      jsonForm = serialised === "{}" ? null : serialised;
+    } catch {
+      jsonForm = null;
+    }
+    const fallbackString = safeToString(obj);
+    const message = ownMessage ?? jsonForm ?? (fallbackString && fallbackString !== "[object Object]" ? fallbackString : null) ?? (ctorName ? `(thrown ${ctorName} with no message)` : "(thrown object with no message)");
+    const errorType = ownName ?? ctorName ?? null;
+    const extras = {};
+    let count = 0;
+    for (const key of Object.keys(obj)) {
+      if (count >= 20) break;
+      if (key === "message" || key === "name") continue;
+      const val = obj[key];
+      if (typeof val === "function") continue;
+      extras[key] = safeClone(val);
+      count++;
+    }
+    return {
+      message,
+      errorType,
+      extras: Object.keys(extras).length > 0 ? extras : null
+    };
+  }
+  return { message: safeToString(v) || "(unstringifiable thrown value)", errorType: null, extras: null };
+}
+function collectCauseChain(err) {
+  const out = [];
+  let cur = err.cause;
+  let depth = 0;
+  while (cur != null && depth < 5) {
+    if (cur instanceof Error) {
+      out.push({ name: cur.name || "Error", message: cur.message || "" });
+      cur = cur.cause;
+    } else {
+      out.push({ name: "non-Error", message: safeToString(cur) });
+      cur = null;
+    }
+    depth++;
+  }
+  return out;
+}
+function safeToString(v) {
   try {
-    return JSON.stringify(v);
+    const s = Object.prototype.toString.call(v);
+    if (s !== "[object Object]") return s;
+    const own = v?.toString;
+    if (typeof own === "function" && own !== Object.prototype.toString) {
+      const r = own.call(v);
+      if (typeof r === "string") return r;
+    }
+    return s;
   } catch {
-    return Object.prototype.toString.call(v);
+    return "(throwing toString)";
   }
 }
+function safeClone(v) {
+  if (v == null) return v;
+  const t = typeof v;
+  if (t === "string" || t === "number" || t === "boolean") return v;
+  if (t === "bigint") return String(v);
+  try {
+    const s = JSON.stringify(v);
+    return s === void 0 ? safeToString(v) : JSON.parse(s);
+  } catch {
+    return safeToString(v);
+  }
+}
+function safeStringify2(v) {
+  return coerceErrorPayload(v).message;
+}
 
 // src/crossdeck.ts
 var CrossdeckClient = class {
@@ -2414,7 +2692,10 @@ var CrossdeckClient = class {
     typeof globalThis.document !== "undefined";
     const cookieStore = useCookieRedundancy ? new CookieStorage() : void 0;
     const identity = new IdentityStore(effectiveStorage, opts.storagePrefix, cookieStore);
-    const entitlements = new EntitlementCache();
+    const entitlements = new EntitlementCache(
+      effectiveStorage,
+      opts.storagePrefix + "entitlements"
+    );
     const persistentEvents = persistIdentity ? new PersistentEventStore({ storage: effectiveStorage, prefix: opts.storagePrefix }) : null;
     if (persistentEvents) {
       debug.emit(
@@ -2594,6 +2875,10 @@ var CrossdeckClient = class {
     const result = await s.http.request("POST", "/identity/alias", {
       body
     });
+    const priorCdcust = s.identity.crossdeckCustomerId;
+    if (priorCdcust && result.crossdeckCustomerId && priorCdcust !== result.crossdeckCustomerId) {
+      s.entitlements.clear();
+    }
     s.identity.setCrossdeckCustomerId(result.crossdeckCustomerId);
     s.developerUserId = userId;
     return result;
@@ -2828,11 +3113,17 @@ var CrossdeckClient = class {
   async getEntitlements() {
     const s = this.requireStarted();
     const query = this.identityQueryParams();
-    const result = await s.http.request(
-      "GET",
-      "/entitlements",
-      { query }
-    );
+    let result;
+    try {
+      result = await s.http.request(
+        "GET",
+        "/entitlements",
+        { query }
+      );
+    } catch (err) {
+      s.entitlements.markRefreshFailed();
+      throw err;
+    }
     if (result.crossdeckCustomerId) {
       s.identity.setCrossdeckCustomerId(result.crossdeckCustomerId);
     }
@@ -2840,8 +3131,12 @@ var CrossdeckClient = class {
     return result.data;
   }
   /**
-   * Synchronous read from the local cache. Returns false if the cache
-   * has never been populated (call getEntitlements first to warm it).
+   * Synchronous read from the durable local cache — answers from
+   * last-known-good. The cache hydrates from device storage on boot and
+   * survives a Crossdeck outage, so a returning paying customer reads
+   * true even before the session's first network round-trip. Returns
+   * false only for a genuinely new install that has never completed a
+   * getEntitlements(), or for an entitlement past its own validUntil.
    */
   isEntitled(key) {
     const s = this.requireStarted();
@@ -3117,7 +3412,7 @@ var CrossdeckClient = class {
         sdkVersion: null,
         baseUrl: null,
         clock: { lastServerTime: null, lastClientTime: null, skewMs: null },
-        entitlements: { count: 0, lastUpdated: 0, listenerErrors: 0 },
+        entitlements: { count: 0, lastUpdated: 0, stale: false, listenerErrors: 0 },
         events: {
           buffered: 0,
           dropped: 0,
@@ -3146,6 +3441,7 @@ var CrossdeckClient = class {
       entitlements: {
         count: s.entitlements.list().length,
         lastUpdated: s.entitlements.freshness,
+        stale: s.entitlements.isStale,
         listenerErrors: s.entitlements.listenerErrors
       },
       events: s.events.getStats()