@maple-dev/browser 0.4.0 → 0.8.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Maple Tech Labs
+Copyright (c) 2026 Makisuo, Inc.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -33,10 +33,28 @@ That single call:
   gzipping them with the native `CompressionStream`, and uploading to
   `POST /v1/sessionReplays/blob`. rrweb ships in a lazy code-split chunk loaded
   only once a session is sampled in, so a `sampleRate` below 1 costs the
-  unsampled visitors nothing beyond the ~8 kB gzipped base SDK;
+  unsampled visitors nothing beyond the base SDK (see [Bundle size](#bundle-size));
 - writes session metadata at start (`active`) and on page hide (`ended`),
   including the trace ids observed during the session.
 
+## Bundle size
+
+Bundled, minified and gzipped, as your bundler would ship it:
+
+|                  | gzipped | what it is                                                |
+| ---------------- | ------- | --------------------------------------------------------- |
+| **eager**        | ~32 kB  | every page load, before any sampling decision             |
+| ↳ our code alone | ~3.5 kB | the marginal cost if your app already ships OpenTelemetry |
+| **lazy**         | ~61 kB  | rrweb — downloaded only by sessions sampled into replay   |
+
+The eager figure is ~90% OpenTelemetry. If your app already uses the OTel web
+SDK, your bundler should dedupe it and you pay closer to the second row; if it
+doesn't dedupe, you will ship two copies, so pin matching versions.
+
+Run `bun run size` in this package for the current numbers. It fails past a
+budget, so a regression has to be argued for in review rather than discovered
+in production.
+
 ## Identifying users
 
 Pass `userId` to `init()` when you already know the signed-in user, or call

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-//#region ../browser-session/src/identity.d.ts
+//#region ../browser-session/src/identity/identity.d.ts
 /**
  * Who the current visitor is.
  *
@@ -26,7 +26,7 @@ interface MapleIdentity {
  */
 type IdentifyInput = string | null | undefined | MapleIdentity;
 //#endregion
-//#region ../browser-session/src/track.d.ts
+//#region ../browser-session/src/events/track.d.ts
 /** Properties a host app may attach to a custom event. */
 type TrackProps = Readonly<Record<string, unknown>>;
 //#endregion

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { S as setVisitorTracking, a as recordTraceId, b as postSessionMetaRow, c as clearPendingEvents, d as setActiveTraceIdProvider, f as startEventSink, g as rotateSession, i as readSessionSink, l as getActiveSink, n as getObservedTraceIds, o as startSessionLifecycle, p as getSession, r as publishSessionSink, t as clearSessionSink, u as queuePending, x as configureVisitorCookie } from "./sink-DHTfvFgl.mjs";
+import { C as setActiveTraceIdProvider, T as setVisitorTracking, a as recordTraceId, b as sdkHint, c as getActiveSink, d as getSession, g as SDK_HINT_HEADER, h as postSessionMetaRow, i as readSessionSink, l as queuePending, m as rotateSession, n as getObservedTraceIds, o as startSessionLifecycle, r as publishSessionSink, s as clearPendingEvents, t as clearSessionSink, u as startEventSink, w as configureVisitorCookie } from "./sink-D9w1kg0Q.mjs";
 import { trace } from "@opentelemetry/api";
 import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";
 import { registerInstrumentations } from "@opentelemetry/instrumentation";
@@ -7,7 +7,7 @@ import { resourceFromAttributes } from "@opentelemetry/resources";
 import { BatchSpanProcessor } from "@opentelemetry/sdk-trace-base";
 import { WebTracerProvider } from "@opentelemetry/sdk-trace-web";
 import { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION } from "@opentelemetry/semantic-conventions";
-//#region ../browser-session/src/consent.ts
+//#region ../browser-session/src/identity/consent.ts
 /**
 * Consent gating for session capture.
 *
@@ -27,7 +27,7 @@ import { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION } from "@opentelemetry/semantic
 */
 /**
 * Consent lives on `globalThis`, for the same reason the event sink does
-* (`events-sink.ts`): an app that bundles both `@maple-dev/browser` and the
+* (`events/events-sink.ts`): an app that bundles both `@maple-dev/browser` and the
 * Effect SDK gets **two copies** of this module, and per-copy state would mean
 * `setConsent(true)` on one never releases the other copy's exporters — or, the
 * other way round, one copy capturing while the other believes consent is
@@ -120,7 +120,7 @@ function mayPersistIdentifier() {
 	return true;
 }
 //#endregion
-//#region ../browser-session/src/identity.ts
+//#region ../browser-session/src/identity/identity.ts
 /**
 * Trait caps. The warehouse column is `Map(String, String)` — plain keys
 * precisely because they are arbitrary — so the cost of a unique key per user
@@ -189,7 +189,7 @@ function normalizeIdentity(input) {
 	return resolved.id || resolved.email || resolved.username || resolved.groupId || resolved.groupName || Object.keys(resolved.traits).length > 0 ? resolved : void 0;
 }
 //#endregion
-//#region ../browser-session/src/metadata-session.ts
+//#region ../browser-session/src/session/metadata-session.ts
 /**
 * Metadata-only session lifecycle used whenever rrweb is disabled or unsampled.
 * It is the shared lifecycle driver with no capture of its own: the distilled
@@ -200,7 +200,7 @@ function startMetadataSession(options) {
 	return startSessionLifecycle(options, {
 		recorded: false,
 		post: (row, keepalive) => {
-			postSessionMetaRow(options.endpoint, options.ingestKey, row, keepalive);
+			postSessionMetaRow(options, row, keepalive);
 		},
 		onSuspend: ({ flush, keepalive }) => {
 			if (flush && keepalive) getActiveSink()?.flush(true);
@@ -209,7 +209,7 @@ function startMetadataSession(options) {
 	});
 }
 //#endregion
-//#region ../browser-session/src/track.ts
+//#region ../browser-session/src/events/track.ts
 /**
 * Caps mirroring what the ingest gateway enforces. Applying them here too means
 * an over-sized event is trimmed before it costs bandwidth, and the developer
@@ -324,6 +324,11 @@ function resolveConfig(config) {
 	};
 }
 //#endregion
+//#region src/version.ts
+const SDK_VERSION = "0.8.0";
+/** The `x-maple-sdk` value this build sends. */
+const SDK_NAME = "maple-browser";
+//#endregion
 //#region src/tracing.ts
 /**
 * Captures every span's trace id into the session sink. Lightweight — runs
@@ -381,6 +386,15 @@ var ConsentSpanExporter = class {
 	}
 };
 /**
+* How long a span may sit in the batch queue before export.
+*
+* Shorter than OTel's 5s default: in a browser the queue is only as durable as
+* the tab, and the unload flush below is a best-effort catch rather than a
+* guarantee (a crashed or killed tab fires neither event). 2s trades a few more
+* requests for a materially smaller loss window.
+*/
+const EXPORT_INTERVAL_MS = 2e3;
+/**
 * Set up browser OTel tracing exporting to Maple's ingest. When
 * `tracingInstrumentFetch` is true, fetch() calls are auto-instrumented and
 * their trace ids feed the session. Disable it when an external tracer (e.g.
@@ -410,15 +424,33 @@ function setupTracing(config) {
 	}
 	const exporter = new ConsentSpanExporter(new OTLPTraceExporter({
 		url: `${config.endpoint}/v1/traces`,
-		headers: { Authorization: `Bearer ${config.ingestKey}` }
+		headers: {
+			Authorization: `Bearer ${config.ingestKey}`,
+			[SDK_HINT_HEADER]: sdkHint(SDK_NAME, SDK_VERSION)
+		}
 	}));
 	const provider = new WebTracerProvider({
 		resource: resourceFromAttributes(attributes),
-		spanProcessors: [new TraceIdCollector(() => config.identity?.id), new BatchSpanProcessor(exporter)]
+		spanProcessors: [new TraceIdCollector(() => config.identity?.id), new BatchSpanProcessor(exporter, { scheduledDelayMillis: EXPORT_INTERVAL_MS })]
 	});
 	provider.register();
+	const onExit = () => {
+		provider.forceFlush().catch(() => {});
+	};
+	const onVisibilityChange = () => {
+		if (document.visibilityState === "hidden") onExit();
+	};
+	const canListen = typeof document !== "undefined" && typeof document.addEventListener === "function";
+	if (canListen) {
+		document.addEventListener("visibilitychange", onVisibilityChange);
+		window.addEventListener("pagehide", onExit);
+	}
 	const unregisterInstrumentations = config.tracingInstrumentFetch ? registerInstrumentations({ instrumentations: [new FetchInstrumentation({ ignoreUrls: [new RegExp(`${escapeRegExp(config.endpoint)}/v1/`)] })] }) : void 0;
 	return async () => {
+		if (canListen) {
+			document.removeEventListener("visibilitychange", onVisibilityChange);
+			window.removeEventListener("pagehide", onExit);
+		}
 		unregisterInstrumentations?.();
 		await provider.shutdown();
 	};
@@ -428,6 +460,8 @@ function escapeRegExp(value) {
 }
 //#endregion
 //#region src/init.ts
+/** `x-maple-sdk` value for every request this build makes to ingest. */
+const SDK_HINT = sdkHint(SDK_NAME, SDK_VERSION);
 let active;
 let activeConfig;
 /**
@@ -461,6 +495,7 @@ function init(rawConfig) {
 		const sink = startEventSink({
 			endpoint: config.endpoint,
 			ingestKey: config.ingestKey,
+			sdk: SDK_HINT,
 			maskAllInputs: config.maskAllInputs,
 			maskAllText: config.maskAllText
 		}, session.id);
@@ -468,6 +503,7 @@ function init(rawConfig) {
 		const shared = {
 			endpoint: config.endpoint,
 			ingestKey: config.ingestKey,
+			sdk: SDK_HINT,
 			serviceName: config.serviceName,
 			environment: config.environment,
 			serviceVersion: config.serviceVersion,
@@ -494,7 +530,7 @@ function init(rawConfig) {
 		runtime = next;
 		const ownGeneration = ++generation;
 		const stale = () => stopped || !hasConsent() || generation !== ownGeneration || runtime !== next;
-		next.replayPending = import("./replay-session-B_ACRogX.mjs").then(({ startReplaySession }) => {
+		next.replayPending = import("./replay-session-BYZfi3iZ.mjs").then(({ startReplaySession }) => {
 			if (stale()) return;
 			next.replay = startReplaySession({
 				...shared,

package/dist/{replay-session-B_ACRogX.mjs → replay-session-BYZfi3iZ.mjs}

@@ -1,13 +1,5 @@
-import { _ as gzip, f as startEventSink, h as nextChunkSeq, m as markActivity, n as getObservedTraceIds, o as startSessionLifecycle, r as publishSessionSink, s as activeTraceId, v as postSessionBlob, y as postSessionMeta } from "./sink-DHTfvFgl.mjs";
+import { S as activeTraceId, _ as gzip, f as markActivity, n as getObservedTraceIds, o as startSessionLifecycle, p as nextChunkSeq, r as publishSessionSink, u as startEventSink, v as postSessionBlob, x as safeEmit, y as postSessionMeta } from "./sink-D9w1kg0Q.mjs";
 import { record } from "rrweb";
-//#region ../browser-session/src/replay/capture/shared.ts
-/** Emit best-effort: capture must never throw into the host app's call site. */
-function safeEmit(emit, ev) {
-	try {
-		emit(ev);
-	} catch {}
-}
-//#endregion
 //#region ../browser-session/src/replay/capture/console.ts
 const LEVELS = [
 	"log",
@@ -56,84 +48,6 @@ function formatArgs(args) {
 	return text.length > MAX_MESSAGE ? `${text.slice(0, MAX_MESSAGE)}…` : text;
 }
 //#endregion
-//#region ../browser-session/src/replay/capture/errors.ts
-const MAX_STACK = 4e3;
-/** Capture uncaught errors + unhandled promise rejections as session events. */
-function installErrorCapture(emit) {
-	const onError = (event) => {
-		safeEmit(emit, {
-			type: "error",
-			level: "error",
-			message: event.message || String(event.error ?? "Error"),
-			errorStack: truncate(event.error?.stack),
-			traceId: activeTraceId()
-		});
-	};
-	const onRejection = (event) => {
-		const reason = event.reason;
-		safeEmit(emit, {
-			type: "error",
-			level: "error",
-			message: typeof reason === "string" ? reason : reason?.message ?? "Unhandled promise rejection",
-			errorStack: truncate(typeof reason === "object" ? reason?.stack : void 0),
-			traceId: activeTraceId()
-		});
-	};
-	window.addEventListener("error", onError);
-	window.addEventListener("unhandledrejection", onRejection);
-	return () => {
-		window.removeEventListener("error", onError);
-		window.removeEventListener("unhandledrejection", onRejection);
-	};
-}
-function truncate(stack) {
-	if (!stack) return void 0;
-	return stack.length > MAX_STACK ? `${stack.slice(0, MAX_STACK)}…` : stack;
-}
-//#endregion
-//#region ../browser-session/src/replay/capture/interactions.ts
-const MAX_TEXT = 120;
-/**
-* Capture clicks and input events as session events. Listens in the capture
-* phase so it sees interactions even when the host app calls
-* `stopPropagation()`. Input *values* are never recorded; only the target
-* element. Click target text is omitted when `maskAllText` is set.
-*/
-function installInteractionCapture(emit, maskAllText) {
-	const onClick = (event) => {
-		const target = event.target;
-		if (!(target instanceof Element)) return;
-		safeEmit(emit, {
-			type: "click",
-			targetSelector: selectorOf(target),
-			targetText: maskAllText ? void 0 : textOf(target)
-		});
-	};
-	const onInput = (event) => {
-		const target = event.target;
-		if (!(target instanceof Element)) return;
-		safeEmit(emit, {
-			type: "input",
-			targetSelector: selectorOf(target)
-		});
-	};
-	document.addEventListener("click", onClick, true);
-	document.addEventListener("input", onInput, true);
-	return () => {
-		document.removeEventListener("click", onClick, true);
-		document.removeEventListener("input", onInput, true);
-	};
-}
-/** A short, human-readable selector: tag + #id + .first-class. */
-function selectorOf(el) {
-	return `${el.tagName.toLowerCase()}${el.id ? `#${el.id}` : ""}${typeof el.className === "string" && el.className.trim() ? `.${el.className.trim().split(/\s+/)[0]}` : ""}`;
-}
-function textOf(el) {
-	const text = (el.textContent ?? "").trim().replace(/\s+/g, " ");
-	if (!text) return void 0;
-	return text.length > MAX_TEXT ? `${text.slice(0, MAX_TEXT)}…` : text;
-}
-//#endregion
 //#region ../browser-session/src/replay/capture/network.ts
 /**
 * Capture fetch + XHR requests as session events, tagged with the active trace
@@ -167,7 +81,7 @@ function installNetworkCapture(emit, ignoreUrl) {
 				durationMs: Math.round(performance.now() - start)
 			},
 			traceId,
-			...error ? { attrs: { error } } : {}
+			...error ? { attrs: { error } } : void 0
 		});
 	};
 	const XHR = typeof window !== "undefined" ? window.XMLHttpRequest : void 0;
@@ -210,22 +124,18 @@ function requestMethod(input, init) {
 //#endregion
 //#region ../browser-session/src/replay/events.ts
 /**
-* Install the capture modules that turn browser activity (console, network,
-* errors, interactions) into distilled session events.
+* Install the capture modules that turn console output and network requests
+* into distilled session events.
 *
-* Navigation is deliberately absent: the sink observes it, because page views
-* have to be counted even when replay is unsampled, and a second history patch
-* here would double-count every SPA transition.
+* Navigation, errors and interactions are deliberately absent: the sink
+* installs those itself (see `startBaselineCapture`), because page views, error
+* counts and click counts have to be counted even when replay is unsampled —
+* and a second listener here would double-count every one of them.
 */
 function startEventCapture(config, sessionId) {
 	const sink = startEventSink(config, sessionId);
 	const emit = sink.emit;
-	const uninstall = [
-		installInteractionCapture(emit, config.maskAllText),
-		installConsoleCapture(emit),
-		installNetworkCapture(emit, sink.ignoreUrl),
-		installErrorCapture(emit)
-	];
+	const uninstall = [installConsoleCapture(emit), installNetworkCapture(emit, sink.ignoreUrl)];
 	return {
 		stop: () => {
 			for (const off of uninstall) off();
@@ -243,6 +153,9 @@ const FLUSH_INTERVAL_MS = 5e3;
 const FLUSH_BYTES = 102400;
 const CHECKOUT_EVERY_MS = 3e5;
 const MAX_BUFFER_BYTES = 4194304;
+function warnExhausted(sessionId) {
+	console.warn(`[maple] session replay ${sessionId} reached its maximum recorded size; recording stopped for this session (metadata and events continue)`);
+}
 let lastDropWarnAt = 0;
 function warnBufferDropped(bytes) {
 	const now = Date.now();
@@ -258,6 +171,8 @@ function startRecording(config, sessionId) {
 	let lastTimestamp = 0;
 	let droppedChunk = false;
 	let clickCount = 0;
+	let stopped = false;
+	let exhausted = false;
 	const resetBuffer = () => {
 		parts = [];
 		bufferBytes = 0;
@@ -266,7 +181,7 @@ function startRecording(config, sessionId) {
 		lastTimestamp = 0;
 	};
 	const flush = async (keepalive = false) => {
-		if (parts.length === 0) return;
+		if (stopped || exhausted || parts.length === 0) return;
 		const body = `[${parts.join(",")}]`;
 		const isCheckpoint = bufferHasCheckpoint;
 		const eventCount = parts.length;
@@ -274,14 +189,19 @@ function startRecording(config, sessionId) {
 		const seq = nextChunkSeq();
 		resetBuffer();
 		const gzipped = await gzip(new TextEncoder().encode(body));
-		await postSessionBlob(config, {
+		if (await postSessionBlob(config, {
 			sessionId,
 			chunkSeq: seq,
 			isCheckpoint,
 			eventCount,
 			durationMs
-		}, gzipped, keepalive);
+		}, gzipped, keepalive) === "exhausted" && !exhausted) {
+			exhausted = true;
+			warnExhausted(sessionId);
+			haltCapture();
+		}
 	};
+	let haltCapture = () => {};
 	const stop = record({
 		emit: (event, isCheckpoint) => {
 			const active = markActivity();
@@ -311,25 +231,41 @@ function startRecording(config, sessionId) {
 			if (bufferBytes >= FLUSH_BYTES) flush();
 		},
 		maskAllInputs: config.maskAllInputs,
-		...config.maskAllText ? { maskTextSelector: "*" } : {},
+		...config.maskAllText ? { maskTextSelector: "*" } : void 0,
 		checkoutEveryNms: CHECKOUT_EVERY_MS
 	});
+	let idleHandle;
 	const scheduleFlush = () => {
-		if (typeof requestIdleCallback === "function") requestIdleCallback(() => void flush(), { timeout: 2e3 });
+		if (typeof requestIdleCallback === "function") idleHandle = requestIdleCallback(() => {
+			idleHandle = void 0;
+			flush();
+		}, { timeout: 2e3 });
 		else flush();
 	};
 	const flushTimer = setInterval(scheduleFlush, FLUSH_INTERVAL_MS);
+	let halted = false;
+	haltCapture = () => {
+		if (halted) return;
+		halted = true;
+		clearInterval(flushTimer);
+		if (idleHandle !== void 0 && typeof cancelIdleCallback === "function") {
+			cancelIdleCallback(idleHandle);
+			idleHandle = void 0;
+		}
+		resetBuffer();
+		stop?.();
+	};
 	return {
 		stop: () => {
-			clearInterval(flushTimer);
-			stop?.();
+			stopped = true;
+			haltCapture();
 		},
 		flush,
 		getClickCount: () => clickCount
 	};
 }
 //#endregion
-//#region ../browser-session/src/replay-session.ts
+//#region ../browser-session/src/session/replay-session.ts
 /**
 * Start recording the current browser session. Publishes the session sink,
 * posts an `active` metadata row, and installs visibility handlers:
@@ -345,6 +281,7 @@ function startReplaySession(options) {
 	const engineConfig = {
 		endpoint: options.endpoint.replace(/\/$/, ""),
 		ingestKey: options.ingestKey,
+		sdk: options.sdk,
 		maskAllInputs: options.maskAllInputs,
 		maskAllText: options.maskAllText
 	};

package/dist/{sink-DHTfvFgl.mjs → sink-D9w1kg0Q.mjs}

@@ -1,4 +1,48 @@
-//#region ../browser-session/src/visitor.ts
+//#region ../browser-session/src/platform/json.ts
+/**
+* Minimal structural guards for records read back out of browser storage.
+*
+* These replace what was an `effect/Schema` decoder. This package is *bundled*
+* into `@maple-dev/browser`, whose eager chunk every visitor downloads before
+* any sampling decision runs — and pulling Schema in to validate two flat
+* records cost ~30 kB gzipped, most of that SDK's entire page-load budget, for
+* shapes the callers already declare in TypeScript. Schema earns its size where
+* the input is genuinely unknown and the errors need to be legible; here the
+* only question is "did we write this, and is it still the shape we write",
+* and the only answer anyone acts on is yes/no.
+*
+* The semantics deliberately match what the Schema decoders did, because the
+* records in the wild were written by them:
+*
+* - unknown keys are dropped rather than rejected (callers rebuild an explicit
+*   object from the keys they know),
+* - a required key that is absent or wrongly typed rejects the whole record,
+* - an optional key must be either absent or correctly typed — `null` is not
+*   an accepted stand-in for absent, matching `Schema.optionalKey`.
+*/
+/** A non-null, non-array object — the only JSON shape these records take. */
+function isJsonObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Parse a storage string into a plain object, or `undefined` if it is not
+* valid JSON or not an object. Never throws: every caller here treats a
+* corrupt record as a cache miss, not as an error worth surfacing.
+*/
+function parseJsonObject(raw) {
+	try {
+		const parsed = JSON.parse(raw);
+		return isJsonObject(parsed) ? parsed : void 0;
+	} catch {
+		return;
+	}
+}
+/** A `Record<string, string>` — every value a string, as `Schema.Record` required. */
+function isStringRecord(value) {
+	return isJsonObject(value) && Object.values(value).every((entry) => typeof entry === "string");
+}
+//#endregion
+//#region ../browser-session/src/identity/visitor.ts
 /**
 * A persistent per-browser visitor id.
 *
@@ -147,14 +191,15 @@ function cookieDomain() {
 }
 function parseRecord(raw) {
 	if (!raw) return void 0;
-	try {
-		const parsed = JSON.parse(raw);
-		if (typeof parsed.id !== "string" || typeof parsed.mintedAt !== "number") return void 0;
-		if (Date.now() - parsed.mintedAt > MAX_AGE_MS) return void 0;
-		return parsed;
-	} catch {
-		return;
-	}
+	const value = parseJsonObject(raw);
+	if (!value) return void 0;
+	const { id, mintedAt } = value;
+	if (typeof id !== "string" || typeof mintedAt !== "number") return void 0;
+	if (Date.now() - mintedAt > MAX_AGE_MS) return void 0;
+	return {
+		id,
+		mintedAt
+	};
 }
 function readFromStorage() {
 	try {
@@ -259,7 +304,245 @@ function setVisitorTracking(nextEnabled) {
 	if (domain) setRawCookie(COOKIE_NAME, "", "", 0);
 }
 //#endregion
-//#region ../browser-session/src/user-agent.ts
+//#region ../browser-session/src/events/trace-id.ts
+const ZERO_TRACE_ID = "00000000000000000000000000000000";
+let traceIdProvider = () => void 0;
+/** Wire the host SDK's active-trace-id lookup into event capture. */
+function setActiveTraceIdProvider(provider) {
+	traceIdProvider = provider;
+}
+/** The trace id of the active span, or undefined when none is active. */
+function activeTraceId() {
+	const id = traceIdProvider();
+	return id && id !== ZERO_TRACE_ID ? id : void 0;
+}
+//#endregion
+//#region ../browser-session/src/capture/shared.ts
+/** Emit best-effort: capture must never throw into the host app's call site. */
+function safeEmit(emit, ev) {
+	try {
+		emit(ev);
+	} catch {}
+}
+//#endregion
+//#region ../browser-session/src/capture/errors.ts
+const MAX_STACK = 4e3;
+/** Capture uncaught errors + unhandled promise rejections as session events. */
+function installErrorCapture(emit) {
+	const onError = (event) => {
+		safeEmit(emit, {
+			type: "error",
+			level: "error",
+			message: event.message || String(event.error ?? "Error"),
+			errorStack: truncate(event.error?.stack),
+			traceId: activeTraceId()
+		});
+	};
+	const onRejection = (event) => {
+		const reason = event.reason;
+		safeEmit(emit, {
+			type: "error",
+			level: "error",
+			message: typeof reason === "string" ? reason : reason?.message ?? "Unhandled promise rejection",
+			errorStack: truncate(typeof reason === "object" ? reason?.stack : void 0),
+			traceId: activeTraceId()
+		});
+	};
+	window.addEventListener("error", onError);
+	window.addEventListener("unhandledrejection", onRejection);
+	return () => {
+		window.removeEventListener("error", onError);
+		window.removeEventListener("unhandledrejection", onRejection);
+	};
+}
+function truncate(stack) {
+	if (!stack) return void 0;
+	return stack.length > MAX_STACK ? `${stack.slice(0, MAX_STACK)}…` : stack;
+}
+//#endregion
+//#region ../browser-session/src/capture/interactions.ts
+const MAX_TEXT = 120;
+/**
+* Capture clicks and input events as session events. Listens in the capture
+* phase so it sees interactions even when the host app calls
+* `stopPropagation()`. Input *values* are never recorded; only the target
+* element. Click target text is omitted when `maskAllText` is set.
+*/
+function installInteractionCapture(emit, maskAllText) {
+	const onClick = (event) => {
+		const target = event.target;
+		if (!(target instanceof Element)) return;
+		safeEmit(emit, {
+			type: "click",
+			targetSelector: selectorOf(target),
+			targetText: maskAllText ? void 0 : textOf(target)
+		});
+	};
+	const onInput = (event) => {
+		const target = event.target;
+		if (!(target instanceof Element)) return;
+		safeEmit(emit, {
+			type: "input",
+			targetSelector: selectorOf(target)
+		});
+	};
+	document.addEventListener("click", onClick, true);
+	document.addEventListener("input", onInput, true);
+	return () => {
+		document.removeEventListener("click", onClick, true);
+		document.removeEventListener("input", onInput, true);
+	};
+}
+/** A short, human-readable selector: tag + #id + .first-class. */
+function selectorOf(el) {
+	return `${el.tagName.toLowerCase()}${el.id ? `#${el.id}` : ""}${typeof el.className === "string" && el.className.trim() ? `.${el.className.trim().split(/\s+/)[0]}` : ""}`;
+}
+function textOf(el) {
+	const text = (el.textContent ?? "").trim().replace(/\s+/g, " ");
+	if (!text) return void 0;
+	return text.length > MAX_TEXT ? `${text.slice(0, MAX_TEXT)}…` : text;
+}
+//#endregion
+//#region ../browser-session/src/capture/baseline.ts
+/**
+* The capture that runs on **every** page load, sampled for replay or not.
+*
+* Errors and clicks are the analytics substrate, for the same reason navigation
+* is: `error_count` drives the Sessions UI "has errors" filter and `click_count`
+* separates a real visit from a bounce, so gating them behind replay sampling
+* makes both a sample rather than a count — and a session row that reports zero
+* errors because nothing was listening is worse than one that reports none,
+* because it looks complete.
+*
+* Console and network capture stay on the sampled replay path: they patch
+* `console.*`, `window.fetch` and `XMLHttpRequest`, which is a cost (and a
+* surface) worth paying only for sessions that get a recording to attach it to.
+*
+* Owned by the sink rather than by the replay lifecycle, which is also what
+* keeps the listeners installed exactly once — the recorder starting and
+* stopping across visibility changes must not re-register them.
+*/
+function startBaselineCapture(emit, maskAllText) {
+	if (typeof window === "undefined" || typeof document === "undefined") return () => {};
+	const uninstall = [installErrorCapture(emit), installInteractionCapture(emit, maskAllText)];
+	return () => {
+		for (const off of uninstall) off();
+	};
+}
+//#endregion
+//#region ../browser-session/src/platform/browser-globals.ts
+const browserNavigator = () => globalThis.navigator;
+const browserLocation = () => globalThis.window?.location;
+const browserDocument = () => globalThis.document;
+//#endregion
+//#region ../browser-session/src/platform/transport.ts
+/**
+* Header stamped on every request to ingest: `<sdk-name>/<version>`, e.g.
+* `maple-browser/0.3.0`. Browsers refuse to let a page set `user-agent`, so
+* without this a rejected request carried nothing that said which SDK build
+* produced it. Ingest records it as `maple.sdk` on the request span. Every
+* gateway that receives browser traffic must allow it in CORS (`apps/ingest`
+* and the CLI's local listener do) — a header the SDK always sends and
+* preflight refuses blocks the whole SDK, not just the header.
+*/
+const SDK_HINT_HEADER = "x-maple-sdk";
+/** `<name>/<version>` — the one shape ingest expects in `x-maple-sdk`. */
+const sdkHint = (name, version) => `${name}/${version}`;
+/** Auth + identity headers shared by every ingest request. */
+function ingestHeaders(config) {
+	return {
+		Authorization: `Bearer ${config.ingestKey}`,
+		[SDK_HINT_HEADER]: config.sdk
+	};
+}
+const lastWarnAt = /* @__PURE__ */ new Map();
+function warnDropped(what, error) {
+	const now = Date.now();
+	if (now - (lastWarnAt.get(what) ?? 0) < 3e4) return;
+	lastWarnAt.set(what, now);
+	console.warn(`[maple] session replay ${what} failed (dropping; will retry on next chunk):`, error);
+}
+/**
+* Largest body we will hand to a `keepalive` fetch.
+*
+* The Fetch spec caps the *combined* inflight keepalive body at 64 KiB, and on
+* the way out we issue up to three of these at once (metadata row, final events
+* batch, last replay chunk). Over the budget the browser rejects the request
+* outright, so a normal request — which the page may or may not survive long
+* enough to finish — is strictly the better bet than a guaranteed rejection.
+*/
+const MAX_KEEPALIVE_BYTES = 49152;
+/** Whether a body of `bytes` may still ride the keepalive budget. */
+function keepaliveFor(requested, bytes) {
+	return requested && bytes <= MAX_KEEPALIVE_BYTES;
+}
+/** gzip a byte buffer using the native CompressionStream (no library). */
+async function gzip(bytes) {
+	const stream = new CompressionStream("gzip");
+	const writer = stream.writable.getWriter();
+	writer.write(bytes);
+	writer.close();
+	const buffer = await new Response(stream.readable).arrayBuffer();
+	return new Uint8Array(buffer);
+}
+/** POST session metadata (NDJSON, single row). `keepalive` for the final unload write. */
+async function postSessionMeta(config, row, keepalive = false) {
+	const body = `${JSON.stringify(row)}\n`;
+	await fetch(`${config.endpoint}/v1/sessionReplays/meta`, {
+		method: "POST",
+		headers: {
+			...ingestHeaders(config),
+			"content-type": "application/x-ndjson"
+		},
+		body,
+		keepalive: keepaliveFor(keepalive, body.length)
+	}).catch((error) => {
+		warnDropped("metadata POST", error);
+	});
+}
+/** POST distilled session events (NDJSON, one row per event). Best-effort. */
+async function postSessionEvents(config, rows, keepalive = false) {
+	if (rows.length === 0) return;
+	const body = `${rows.map((row) => JSON.stringify(row)).join("\n")}\n`;
+	await fetch(`${config.endpoint}/v1/sessionEvents`, {
+		method: "POST",
+		headers: {
+			...ingestHeaders(config),
+			"content-type": "application/x-ndjson"
+		},
+		body,
+		keepalive: keepaliveFor(keepalive, body.length)
+	}).catch((error) => {
+		warnDropped("events POST", error);
+	});
+}
+const SESSION_EXHAUSTED_STATUS = 413;
+/** POST a gzipped rrweb event chunk. */
+async function postSessionBlob(config, meta, gzipped, keepalive = false) {
+	try {
+		const response = await fetch(`${config.endpoint}/v1/sessionReplays/blob`, {
+			method: "POST",
+			headers: {
+				...ingestHeaders(config),
+				"content-type": "application/octet-stream",
+				"x-maple-session-id": meta.sessionId,
+				"x-maple-chunk-seq": String(meta.chunkSeq),
+				"x-maple-is-checkpoint": meta.isCheckpoint ? "1" : "0",
+				"x-maple-event-count": String(meta.eventCount),
+				"x-maple-duration-ms": String(meta.durationMs)
+			},
+			body: gzipped,
+			keepalive: keepaliveFor(keepalive, gzipped.byteLength)
+		});
+		if (response.ok) return "accepted";
+		return response.status === SESSION_EXHAUSTED_STATUS ? "exhausted" : "rejected";
+	} catch (error) {
+		warnDropped("blob PUT", error);
+		return "failed";
+	}
+}
+//#endregion
+//#region ../browser-session/src/platform/user-agent.ts
 let memo;
 /** Best-effort UA parse — enough to populate filterable session facets. */
 function parseUserAgent(ua) {
@@ -279,7 +562,7 @@ function parse(ua) {
 	};
 }
 //#endregion
-//#region ../browser-session/src/meta-row.ts
+//#region ../browser-session/src/events/meta-row.ts
 /** ClickHouse-style `YYYY-MM-DD HH:MM:SS.mmm` in UTC (matches the ingest gateway). */
 function formatCHDateTime(date) {
 	const pad = (n, width = 2) => String(n).padStart(width, "0");
@@ -292,11 +575,10 @@ function formatCHDateTime(date) {
 * exotic embedders) they fall back to empty strings.
 */
 function buildSessionMetaRow(input) {
-	const g = globalThis;
-	const userAgent = g["navigator"]?.userAgent ?? "";
+	const userAgent = browserNavigator()?.userAgent ?? "";
 	const ua = parseUserAgent(userAgent);
 	const now = /* @__PURE__ */ new Date();
-	const location = g["window"]?.location;
+	const location = browserLocation();
 	const identity = input.identity;
 	const entryUrl = input.entry?.entryUrl ?? location?.href ?? "";
 	const referrer = input.entry?.referrer ?? "";
@@ -315,12 +597,13 @@ function buildSessionMetaRow(input) {
 		service_name: input.serviceName,
 		resource_attributes: {
 			"maple.session.recorded": input.recorded ? "true" : "false",
-			...input.visitorId && input.visitorIdPersisted === false ? { "maple.visitor.persisted": "false" } : {},
+			"maple.session.replay_format": "rrweb",
+			...input.visitorId && input.visitorIdPersisted === false ? { "maple.visitor.persisted": "false" } : void 0,
 			...input.environment ? {
 				"deployment.environment": input.environment,
 				"deployment.environment.name": input.environment
-			} : {},
-			...input.serviceVersion ? { "deployment.commit_sha": input.serviceVersion } : {}
+			} : void 0,
+			...input.serviceVersion ? { "deployment.commit_sha": input.serviceVersion } : void 0
 		},
 		visitor_id: input.visitorId ?? "",
 		visitor_is_new: input.visitorIsNew ? 1 : 0,
@@ -338,7 +621,7 @@ function buildSessionMetaRow(input) {
 		host: location?.host ?? "",
 		entry_path: pathOf(entryUrl),
 		exit_path: pathOf(input.lastUrl ?? location?.href ?? ""),
-		language: g["navigator"]?.language ?? "",
+		language: browserNavigator()?.language ?? "",
 		last_activity_at: formatCHDateTime(now),
 		click_count: input.clickCount ?? 0,
 		page_views: input.pageViews ?? 0,
@@ -367,87 +650,20 @@ function pathOf(url) {
 	}
 }
 /** POST one session metadata row (NDJSON). Best-effort — never throws. */
-async function postSessionMetaRow(endpoint, ingestKey, row, keepalive = false) {
-	await fetch(`${endpoint.replace(/\/$/, "")}/v1/sessionReplays/meta`, {
-		method: "POST",
-		headers: {
-			Authorization: `Bearer ${ingestKey}`,
-			"content-type": "application/x-ndjson"
-		},
-		body: `${JSON.stringify(row)}\n`,
-		keepalive
-	}).catch(() => {});
-}
-//#endregion
-//#region ../browser-session/src/replay/transport.ts
-let lastWarnAt = 0;
-function warnDropped(what, error) {
-	const now = Date.now();
-	if (now - lastWarnAt < 3e4) return;
-	lastWarnAt = now;
-	console.warn(`[maple] session replay ${what} failed (dropping; will retry on next chunk):`, error);
-}
-/** gzip a byte buffer using the native CompressionStream (no library). */
-async function gzip(bytes) {
-	const stream = new CompressionStream("gzip");
-	const writer = stream.writable.getWriter();
-	writer.write(bytes);
-	writer.close();
-	const buffer = await new Response(stream.readable).arrayBuffer();
-	return new Uint8Array(buffer);
-}
-/** POST session metadata (NDJSON, single row). `keepalive` for the final unload write. */
-async function postSessionMeta(config, row, keepalive = false) {
+async function postSessionMetaRow(target, row, keepalive = false) {
 	const body = `${JSON.stringify(row)}\n`;
-	await fetch(`${config.endpoint}/v1/sessionReplays/meta`, {
-		method: "POST",
-		headers: {
-			Authorization: `Bearer ${config.ingestKey}`,
-			"content-type": "application/x-ndjson"
-		},
-		body,
-		keepalive
-	}).catch((error) => {
-		warnDropped("metadata POST", error);
-	});
-}
-/** POST distilled session events (NDJSON, one row per event). Best-effort. */
-async function postSessionEvents(config, rows, keepalive = false) {
-	if (rows.length === 0) return;
-	const body = `${rows.map((row) => JSON.stringify(row)).join("\n")}\n`;
-	await fetch(`${config.endpoint}/v1/sessionEvents`, {
+	await fetch(`${target.endpoint.replace(/\/$/, "")}/v1/sessionReplays/meta`, {
 		method: "POST",
 		headers: {
-			Authorization: `Bearer ${config.ingestKey}`,
+			...ingestHeaders(target),
 			"content-type": "application/x-ndjson"
 		},
 		body,
-		keepalive
-	}).catch((error) => {
-		warnDropped("events POST", error);
-	});
-}
-/** PUT a gzipped rrweb event chunk. */
-async function postSessionBlob(config, meta, gzipped, keepalive = false) {
-	await fetch(`${config.endpoint}/v1/sessionReplays/blob`, {
-		method: "POST",
-		headers: {
-			Authorization: `Bearer ${config.ingestKey}`,
-			"content-type": "application/octet-stream",
-			"x-maple-session-id": meta.sessionId,
-			"x-maple-chunk-seq": String(meta.chunkSeq),
-			"x-maple-is-checkpoint": meta.isCheckpoint ? "1" : "0",
-			"x-maple-event-count": String(meta.eventCount),
-			"x-maple-duration-ms": String(meta.durationMs)
-		},
-		body: gzipped,
-		keepalive
-	}).catch((error) => {
-		warnDropped("blob PUT", error);
-	});
+		keepalive: keepaliveFor(keepalive, body.length)
+	}).catch(() => {});
 }
 //#endregion
-//#region ../browser-session/src/replay/util.ts
+//#region ../browser-session/src/platform/approximate-size.ts
 /** Approximate byte size of an event for flush-threshold accounting. Falls back
 *  to a fixed estimate for values that can't be serialized (e.g. cycles). */
 function approximateSize(value) {
@@ -458,7 +674,7 @@ function approximateSize(value) {
 	}
 }
 //#endregion
-//#region ../browser-session/src/session.ts
+//#region ../browser-session/src/session/session.ts
 const STORAGE_KEY = "maple.session";
 /** Rotate the session after this much inactivity (PostHog's default). */
 const IDLE_TIMEOUT_MS = 18e5;
@@ -471,6 +687,60 @@ const MAX_SESSION_MS = 864e5;
 * — rotation correctness only needs sub-idle-timeout granularity.
 */
 const ACTIVITY_TOUCH_THROTTLE_MS = 5e3;
+/** Optional keys carrying a plain number. Absent is fine; wrongly typed is not. */
+const OPTIONAL_NUMBERS = [
+	"metaVersion",
+	"pageViews",
+	"clickCount",
+	"errorCount"
+];
+/** Optional keys carrying a plain string. */
+const OPTIONAL_STRINGS = [
+	"entryUrl",
+	"entryReferrer",
+	"lastUrl"
+];
+/**
+* Validate a persisted session record. Deliberately still accepts records
+* written by older SDKs, which have none of the optional fields — see the
+* `SessionRecord` field comments.
+*
+* Returns `undefined` rather than throwing: the sole caller treats a corrupt
+* record exactly as it treats unreadable storage.
+*/
+function parseSessionRecord(raw) {
+	const value = parseJsonObject(raw);
+	if (!value) return void 0;
+	const { id, startedAt, lastActivityAt, chunkSeq } = value;
+	if (typeof id !== "string" || typeof startedAt !== "number" || typeof lastActivityAt !== "number" || typeof chunkSeq !== "number") return;
+	const record = {
+		id,
+		startedAt,
+		lastActivityAt,
+		chunkSeq
+	};
+	for (const key of OPTIONAL_NUMBERS) {
+		const entry = value[key];
+		if (entry === void 0) continue;
+		if (typeof entry !== "number") return void 0;
+		record[key] = entry;
+	}
+	for (const key of OPTIONAL_STRINGS) {
+		const entry = value[key];
+		if (entry === void 0) continue;
+		if (typeof entry !== "string") return void 0;
+		record[key] = entry;
+	}
+	if (value.visitorIsNew !== void 0) {
+		if (typeof value.visitorIsNew !== "boolean") return void 0;
+		record.visitorIsNew = value.visitorIsNew;
+	}
+	if (value.utm !== void 0) {
+		if (!isStringRecord(value.utm)) return void 0;
+		record.utm = value.utm;
+	}
+	return record;
+}
 const UTM_KEYS = [
 	"utm_source",
 	"utm_medium",
@@ -523,9 +793,7 @@ function readRecord() {
 	try {
 		const raw = window.sessionStorage.getItem(STORAGE_KEY);
 		if (!raw) return void 0;
-		const parsed = JSON.parse(raw);
-		if (typeof parsed.id === "string" && typeof parsed.startedAt === "number" && typeof parsed.lastActivityAt === "number" && typeof parsed.chunkSeq === "number") return parsed;
-		return;
+		return parseSessionRecord(raw) ?? ephemeral;
 	} catch {
 		return ephemeral;
 	}
@@ -699,20 +967,9 @@ function nextMetaVersion() {
 	return version;
 }
 //#endregion
-//#region ../browser-session/src/events-sink.ts
+//#region ../browser-session/src/events/events-sink.ts
 const FLUSH_INTERVAL_MS = 5e3;
 const FLUSH_BYTES = 65536;
-const ZERO_TRACE_ID = "00000000000000000000000000000000";
-let traceIdProvider = () => void 0;
-/** Wire the host SDK's active-trace-id lookup into event capture. */
-function setActiveTraceIdProvider(provider) {
-	traceIdProvider = provider;
-}
-/** The trace id of the active span, or undefined when none is active. */
-function activeTraceId() {
-	const id = traceIdProvider();
-	return id && id !== ZERO_TRACE_ID ? id : void 0;
-}
 /**
 * The sink is a per-session singleton, published on `globalThis` rather than a
 * module-level variable.
@@ -784,6 +1041,7 @@ function startEventSink(config, sessionId) {
 			url
 		});
 	});
+	const stopBaselineCapture = startBaselineCapture(emit, config.maskAllText);
 	const flushTimer = setInterval(() => void flush(), FLUSH_INTERVAL_MS);
 	const sink = {
 		sessionId,
@@ -792,6 +1050,7 @@ function startEventSink(config, sessionId) {
 		stop: () => {
 			clearInterval(flushTimer);
 			stopNavigation();
+			stopBaselineCapture();
 			if (holder()[SINK_KEY]?.sink === sink) holder()[SINK_KEY] = void 0;
 		},
 		getPageViews: () => pageViews,
@@ -913,7 +1172,7 @@ function toRow(sessionId, ev, seq) {
 	};
 }
 //#endregion
-//#region ../browser-session/src/session-lifecycle.ts
+//#region ../browser-session/src/session/lifecycle.ts
 /**
 * How often a visible tab re-posts its `active` row.
 *
@@ -1056,7 +1315,7 @@ function startSessionLifecycle(options, hooks) {
 		keepalive: true
 	});
 	const onVisibilityChange = () => {
-		const doc = globalThis["document"];
+		const doc = browserDocument();
 		if (!doc) return;
 		if (doc.visibilityState === "hidden") {
 			endRun({
@@ -1095,9 +1354,24 @@ function startSessionLifecycle(options, hooks) {
 	};
 }
 //#endregion
-//#region ../browser-session/src/sink.ts
+//#region ../browser-session/src/session/sink.ts
 const SESSION_SINK_KEY = "__MAPLE_BROWSER_SESSION__";
 const observedTraceIdsBySession = /* @__PURE__ */ new Map();
+/**
+* Ceiling on trace ids retained per session.
+*
+* A session lives up to 24h and every span feeds this, so it is otherwise
+* unbounded — and the whole set is serialized into the `ended` metadata row,
+* which is written with `keepalive` on the way out. The Fetch spec caps the
+* *combined* keepalive body across in-flight requests at 64 KiB, shared here
+* with the final events flush and the last replay chunk, so an app emitting a
+* span a second would silently lose its entire session row after ~30 minutes.
+*
+* Keep-first rather than keep-last: the ids are a join key for "show me this
+* session's traces", the UI paginates them anyway, and dropping the tail of a
+* long session is a smaller loss than dropping the row.
+*/
+const MAX_TRACE_IDS_PER_SESSION = 200;
 /** Record a trace id seen during the session. Idempotent per id. */
 function recordTraceId(traceId, sessionId = readSessionSink()?.sessionId) {
 	if (!sessionId) return;
@@ -1106,6 +1380,7 @@ function recordTraceId(traceId, sessionId = readSessionSink()?.sessionId) {
 		ids = /* @__PURE__ */ new Set();
 		observedTraceIdsBySession.set(sessionId, ids);
 	}
+	if (ids.size >= MAX_TRACE_IDS_PER_SESSION && !ids.has(traceId)) return;
 	ids.add(traceId);
 }
 function getObservedTraceIds(sessionId = readSessionSink()?.sessionId) {
@@ -1146,4 +1421,4 @@ function readSessionSink() {
 	return globalThis[SESSION_SINK_KEY];
 }
 //#endregion
-export { setVisitorTracking as S, gzip as _, recordTraceId as a, postSessionMetaRow as b, clearPendingEvents as c, setActiveTraceIdProvider as d, startEventSink as f, rotateSession as g, nextChunkSeq as h, readSessionSink as i, getActiveSink as l, markActivity as m, getObservedTraceIds as n, startSessionLifecycle as o, getSession as p, publishSessionSink as r, activeTraceId as s, clearSessionSink as t, queuePending as u, postSessionBlob as v, configureVisitorCookie as x, postSessionMeta as y };
+export { setActiveTraceIdProvider as C, activeTraceId as S, setVisitorTracking as T, gzip as _, recordTraceId as a, sdkHint as b, getActiveSink as c, getSession as d, markActivity as f, SDK_HINT_HEADER as g, postSessionMetaRow as h, readSessionSink as i, queuePending as l, rotateSession as m, getObservedTraceIds as n, startSessionLifecycle as o, nextChunkSeq as p, publishSessionSink as r, clearPendingEvents as s, clearSessionSink as t, startEventSink as u, postSessionBlob as v, configureVisitorCookie as w, safeEmit as x, postSessionMeta as y };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@maple-dev/browser",
-	"version": "0.4.0",
+	"version": "0.8.0",
 	"description": "Maple browser SDK — OpenTelemetry tracing and rrweb session replay in one package. Every span and replay event shares a session id for trace↔replay correlation.",
 	"keywords": [
 		"maple",
@@ -10,22 +10,36 @@
 		"rum",
 		"session-replay"
 	],
+	"homepage": "https://github.com/MapleTechLabs/maple/tree/main/packages/browser#readme",
+	"bugs": {
+		"url": "https://github.com/MapleTechLabs/maple/issues"
+	},
 	"license": "MIT",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/MapleTechLabs/maple.git",
+		"directory": "packages/browser"
+	},
 	"files": [
 		"dist",
 		"README.md"
 	],
 	"type": "module",
+	"sideEffects": false,
 	"exports": {
 		".": {
 			"types": "./dist/index.d.mts",
 			"import": "./dist/index.mjs"
 		}
 	},
+	"publishConfig": {
+		"access": "public"
+	},
 	"scripts": {
 		"build": "tsdown",
 		"typecheck": "tsc --noEmit",
-		"test": "vitest run"
+		"test": "vitest run",
+		"size": "bun scripts/size.ts"
 	},
 	"dependencies": {
 		"@opentelemetry/api": "^1.9.0",
@@ -40,6 +54,7 @@
 	},
 	"devDependencies": {
 		"@maple/browser-session": "0.1.0",
+		"jsdom": "^29.1.1",
 		"tsdown": "^0.22.14",
 		"typescript": "^6.0.3",
 		"vitest": "^4.1.9"