@middag-io/licensing 0.1.0 → 0.2.0

package/README.md

@@ -26,12 +26,17 @@ releases.
 | `@middag-io/licensing/contract` | Same as root — explicit subpath. |
 | `@middag-io/licensing/build` | Vite plugin and CLI helpers that inject placeholders and emit `manifest.template.json`. Node-only. |
 | `@middag-io/licensing/client` | Runtime loader for the host. Validates the worker-issued manifest and dynamically imports protected modules. |
+| `@middag-io/licensing/anti-tamper` | ADR-014 Layer 2: `ClientIntegrityWatcher` (prototype freeze + MutationObserver) + `ClientIntegrityReporter` (POST worker `/v1/anti-tamper/client-report`). |
+| `@middag-io/licensing/observability` | ADR-015: `ObservabilityClient` + `BatchSender` + `PerfCollector`. Posts batched browser errors / perf / audit events to a host plugin relay (PHP signs+forwards). |
+| `@middag-io/licensing/telemetry` | ADR-015 telemetry redirect: `TelemetryClient` + `UsageTracker` sugar over observability audit events. |
+| `@middag-io/licensing/remote-support` | Optional `AuditBanner` widget rendering active session info on tenant admin dashboards (ADR-013 extended). |
 
 ## Status
 
-v0.0.2 — first implemented release. Tracks the protected-delivery worker
-contract that shipped in `worker-ts-middag-licensing` v0.1.4 (ADR-012,
-T1-T6). The Vite plugin emits `manifest.template.json` with SHA-384
+v0.2.0 — adds 4 new client subpaths matching worker contract `v0.3.0`
+(ADR-013 extended remote support, ADR-014 anti-tamper, ADR-015
+observability + telemetry). Initial v0.0.2 release shipped ADR-012
+protected-delivery loader; that surface is unchanged. The Vite plugin emits `manifest.template.json` with SHA-384
 hashes; the runtime loader verifies the worker-issued JWS against the
 worker JWKS, validates the bootstrap (install / host / product /
 contract version), and dynamic-imports modules with recomputed SRI.

package/dist/anti-tamper/ClientIntegrityReporter.d.ts

@@ -0,0 +1,15 @@
+import type { ClientReactionMode, ClientReportPayload, ClientReportStatus } from "./types.js";
+export interface ReporterConfig {
+    workerBaseUri: string;
+    installId: string;
+    manifestId: string;
+    reactionMode?: ClientReactionMode;
+    fetchImpl?: typeof fetch;
+}
+export declare class ClientIntegrityReporter {
+    private readonly cfg;
+    private readonly fetchFn;
+    constructor(cfg: ReporterConfig);
+    report(status: ClientReportStatus, drift?: ClientReportPayload["drift_files"]): Promise<void>;
+}
+//# sourceMappingURL=ClientIntegrityReporter.d.ts.map

package/dist/anti-tamper/ClientIntegrityReporter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientIntegrityReporter.d.ts","sourceRoot":"","sources":["../../src/anti-tamper/ClientIntegrityReporter.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAiB;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;gBAE3B,GAAG,EAAE,cAAc;IAKzB,MAAM,CACV,MAAM,EAAE,kBAAkB,EAC1B,KAAK,CAAC,EAAE,mBAAmB,CAAC,aAAa,CAAC,GACzC,OAAO,CAAC,IAAI,CAAC;CAoBjB"}

package/dist/anti-tamper/ClientIntegrityWatcher.d.ts

@@ -0,0 +1,25 @@
+import type { WatcherDriftReport } from "./types.js";
+export interface WatcherConfig {
+    cdnAllowlist: string[];
+    pollIntervalMs?: number;
+    trackedPrototypes?: Array<{
+        name: string;
+        obj: object;
+        methods: string[];
+    }>;
+    onAnomaly?: (drift: WatcherDriftReport) => void;
+}
+export declare class ClientIntegrityWatcher {
+    private readonly cfg;
+    private snapshot;
+    private pollHandle;
+    private mo;
+    constructor(cfg: WatcherConfig);
+    start(): void;
+    stop(): void;
+    tick(): WatcherDriftReport;
+    private capture;
+    private diff;
+    private onMutations;
+}
+//# sourceMappingURL=ClientIntegrityWatcher.d.ts.map

package/dist/anti-tamper/ClientIntegrityWatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientIntegrityWatcher.d.ts","sourceRoot":"","sources":["../../src/anti-tamper/ClientIntegrityWatcher.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC5E,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,IAAI,CAAC;CACjD;AAOD,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAElB;IACF,OAAO,CAAC,QAAQ,CAAyB;IACzC,OAAO,CAAC,UAAU,CAA+C;IACjE,OAAO,CAAC,EAAE,CAAiC;gBAE/B,GAAG,EAAE,aAAa;IAS9B,KAAK,IAAI,IAAI;IAWb,IAAI,IAAI,IAAI;IAYZ,IAAI,IAAI,kBAAkB;IAY1B,OAAO,CAAC,OAAO;IAgBf,OAAO,CAAC,IAAI;IAyBZ,OAAO,CAAC,WAAW;CAuBpB"}

package/dist/anti-tamper/index.d.ts

@@ -0,0 +1,6 @@
+export { ClientIntegrityWatcher } from "./ClientIntegrityWatcher.js";
+export type { WatcherConfig } from "./ClientIntegrityWatcher.js";
+export { ClientIntegrityReporter } from "./ClientIntegrityReporter.js";
+export type { ReporterConfig } from "./ClientIntegrityReporter.js";
+export type { ClientReactionMode, ClientReportPayload, ClientReportStatus, WatcherDriftReport, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/anti-tamper/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/anti-tamper/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,YAAY,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,YAAY,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,YAAY,CAAC"}

package/dist/anti-tamper/index.js

@@ -0,0 +1,161 @@
+//#region src/anti-tamper/ClientIntegrityWatcher.ts
+var ClientIntegrityWatcher = class {
+	cfg;
+	snapshot = null;
+	pollHandle = null;
+	mo = null;
+	constructor(cfg) {
+		this.cfg = {
+			cdnAllowlist: cfg.cdnAllowlist,
+			pollIntervalMs: cfg.pollIntervalMs ?? 6e4,
+			trackedPrototypes: cfg.trackedPrototypes ?? defaultTrackedPrototypes(),
+			onAnomaly: cfg.onAnomaly ?? (() => {})
+		};
+	}
+	start() {
+		if (this.snapshot !== null) return;
+		this.snapshot = this.capture();
+		this.pollHandle = setInterval(() => this.tick(), this.cfg.pollIntervalMs);
+		if (typeof MutationObserver !== "undefined" && typeof document !== "undefined") {
+			this.mo = new MutationObserver((mutations) => this.onMutations(mutations));
+			this.mo.observe(document.documentElement, {
+				childList: true,
+				subtree: true
+			});
+		}
+	}
+	stop() {
+		if (this.pollHandle !== null) {
+			clearInterval(this.pollHandle);
+			this.pollHandle = null;
+		}
+		if (this.mo !== null) {
+			this.mo.disconnect();
+			this.mo = null;
+		}
+		this.snapshot = null;
+	}
+	tick() {
+		const drift = this.diff();
+		if (drift.prototypeMutations.length > 0 || drift.fingerprintMismatches.length > 0 || drift.scriptInjections.length > 0) this.cfg.onAnomaly(drift);
+		return drift;
+	}
+	capture() {
+		const protoRefs = /* @__PURE__ */ new Map();
+		const fingerprints = /* @__PURE__ */ new Map();
+		for (const tracked of this.cfg.trackedPrototypes) for (const method of tracked.methods) {
+			const key = `${tracked.name}.${method}`;
+			const fn = tracked.obj[method];
+			protoRefs.set(key, fn);
+			if (typeof fn === "function") fingerprints.set(key, Function.prototype.toString.call(fn));
+		}
+		return {
+			prototypeRefs: protoRefs,
+			fingerprints
+		};
+	}
+	diff() {
+		if (this.snapshot === null) return {
+			prototypeMutations: [],
+			scriptInjections: [],
+			fingerprintMismatches: []
+		};
+		const prototypeMutations = [];
+		const fingerprintMismatches = [];
+		for (const tracked of this.cfg.trackedPrototypes) for (const method of tracked.methods) {
+			const key = `${tracked.name}.${method}`;
+			const now = tracked.obj[method];
+			if (now !== this.snapshot.prototypeRefs.get(key)) prototypeMutations.push(key);
+			if (typeof now === "function") {
+				if (this.snapshot.fingerprints.get(key) !== Function.prototype.toString.call(now)) fingerprintMismatches.push(key);
+			}
+		}
+		return {
+			prototypeMutations,
+			scriptInjections: [],
+			fingerprintMismatches
+		};
+	}
+	onMutations(mutations) {
+		const injected = [];
+		for (const m of mutations) m.addedNodes.forEach((node) => {
+			if (node instanceof HTMLScriptElement && node.src && !this.cfg.cdnAllowlist.some((origin) => node.src.startsWith(origin.replace(/\/$/, "")))) injected.push(node.src);
+		});
+		if (injected.length > 0) this.cfg.onAnomaly({
+			prototypeMutations: [],
+			scriptInjections: injected,
+			fingerprintMismatches: []
+		});
+	}
+};
+function defaultTrackedPrototypes() {
+	return [
+		{
+			name: "Object.prototype",
+			obj: Object.prototype,
+			methods: [
+				"hasOwnProperty",
+				"toString",
+				"valueOf"
+			]
+		},
+		{
+			name: "Array.prototype",
+			obj: Array.prototype,
+			methods: [
+				"push",
+				"pop",
+				"slice",
+				"map",
+				"filter",
+				"reduce"
+			]
+		},
+		{
+			name: "Function.prototype",
+			obj: Function.prototype,
+			methods: [
+				"call",
+				"apply",
+				"bind",
+				"toString"
+			]
+		},
+		{
+			name: "JSON",
+			obj: JSON,
+			methods: ["parse", "stringify"]
+		}
+	];
+}
+//#endregion
+//#region src/anti-tamper/ClientIntegrityReporter.ts
+var ClientIntegrityReporter = class {
+	cfg;
+	fetchFn;
+	constructor(cfg) {
+		this.cfg = cfg;
+		this.fetchFn = cfg.fetchImpl ?? globalThis.fetch.bind(globalThis);
+	}
+	async report(status, drift) {
+		const reaction = this.cfg.reactionMode === "DEGRADE" ? "DEGRADE" : "LOG_ONLY";
+		const body = {
+			install_id: this.cfg.installId,
+			manifest_id: this.cfg.manifestId,
+			status,
+			drift_files: drift,
+			reaction_mode: reaction
+		};
+		const url = this.cfg.workerBaseUri.replace(/\/$/, "") + "/v1/anti-tamper/client-report";
+		const res = await this.fetchFn(url, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify(body)
+		});
+		if (!res.ok) throw new Error(`anti-tamper client-report ${res.status}`);
+	}
+};
+//#endregion
+export { ClientIntegrityReporter, ClientIntegrityWatcher };
+
+//# sourceMappingURL=index.js.map

package/dist/anti-tamper/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../src/anti-tamper/ClientIntegrityWatcher.ts","../../src/anti-tamper/ClientIntegrityReporter.ts"],"sourcesContent":["// Runtime drift watcher (ADR-014 Layer 2).\n//\n// Snapshots a set of prototype methods + Function.prototype.toString\n// fingerprints on first load, then runs a periodic diff and a\n// MutationObserver for injected <script> elements. Anomalies surface\n// via onAnomaly callback; caller decides whether to forward to the\n// Reporter (often: throttle + sample).\n//\n// Explicitly NOT implemented: DevTools detection (false positives;\n// power-user UX cost outweighs attacker friction).\n\nimport type { WatcherDriftReport } from \"./types.js\";\n\nexport interface WatcherConfig {\n  cdnAllowlist: string[]; // origins permitted for <script src>\n  pollIntervalMs?: number;\n  trackedPrototypes?: Array<{ name: string; obj: object; methods: string[] }>;\n  onAnomaly?: (drift: WatcherDriftReport) => void;\n}\n\ninterface Snapshot {\n  prototypeRefs: Map<string, unknown>;\n  fingerprints: Map<string, string>;\n}\n\nexport class ClientIntegrityWatcher {\n  private readonly cfg: Required<Omit<WatcherConfig, \"onAnomaly\">> & {\n    onAnomaly: (drift: WatcherDriftReport) => void;\n  };\n  private snapshot: Snapshot | null = null;\n  private pollHandle: ReturnType<typeof setInterval> | null = null;\n  private mo: MutationObserver | null = null;\n\n  constructor(cfg: WatcherConfig) {\n    this.cfg = {\n      cdnAllowlist: cfg.cdnAllowlist,\n      pollIntervalMs: cfg.pollIntervalMs ?? 60_000,\n      trackedPrototypes: cfg.trackedPrototypes ?? defaultTrackedPrototypes(),\n      onAnomaly: cfg.onAnomaly ?? (() => {}),\n    };\n  }\n\n  start(): void {\n    if (this.snapshot !== null) return;\n    this.snapshot = this.capture();\n    this.pollHandle = setInterval(() => this.tick(), this.cfg.pollIntervalMs);\n\n    if (typeof MutationObserver !== \"undefined\" && typeof document !== \"undefined\") {\n      this.mo = new MutationObserver((mutations) => this.onMutations(mutations));\n      this.mo.observe(document.documentElement, { childList: true, subtree: true });\n    }\n  }\n\n  stop(): void {\n    if (this.pollHandle !== null) {\n      clearInterval(this.pollHandle);\n      this.pollHandle = null;\n    }\n    if (this.mo !== null) {\n      this.mo.disconnect();\n      this.mo = null;\n    }\n    this.snapshot = null;\n  }\n\n  tick(): WatcherDriftReport {\n    const drift = this.diff();\n    if (\n      drift.prototypeMutations.length > 0 ||\n      drift.fingerprintMismatches.length > 0 ||\n      drift.scriptInjections.length > 0\n    ) {\n      this.cfg.onAnomaly(drift);\n    }\n    return drift;\n  }\n\n  private capture(): Snapshot {\n    const protoRefs = new Map<string, unknown>();\n    const fingerprints = new Map<string, string>();\n    for (const tracked of this.cfg.trackedPrototypes) {\n      for (const method of tracked.methods) {\n        const key = `${tracked.name}.${method}`;\n        const fn = (tracked.obj as Record<string, unknown>)[method];\n        protoRefs.set(key, fn);\n        if (typeof fn === \"function\") {\n          fingerprints.set(key, Function.prototype.toString.call(fn));\n        }\n      }\n    }\n    return { prototypeRefs: protoRefs, fingerprints };\n  }\n\n  private diff(): WatcherDriftReport {\n    if (this.snapshot === null) {\n      return { prototypeMutations: [], scriptInjections: [], fingerprintMismatches: [] };\n    }\n    const prototypeMutations: string[] = [];\n    const fingerprintMismatches: string[] = [];\n    for (const tracked of this.cfg.trackedPrototypes) {\n      for (const method of tracked.methods) {\n        const key = `${tracked.name}.${method}`;\n        const now = (tracked.obj as Record<string, unknown>)[method];\n        if (now !== this.snapshot.prototypeRefs.get(key)) {\n          prototypeMutations.push(key);\n        }\n        if (typeof now === \"function\") {\n          const expected = this.snapshot.fingerprints.get(key);\n          const actual = Function.prototype.toString.call(now);\n          if (expected !== actual) {\n            fingerprintMismatches.push(key);\n          }\n        }\n      }\n    }\n    return { prototypeMutations, scriptInjections: [], fingerprintMismatches };\n  }\n\n  private onMutations(mutations: MutationRecord[]): void {\n    const injected: string[] = [];\n    for (const m of mutations) {\n      m.addedNodes.forEach((node) => {\n        if (\n          node instanceof HTMLScriptElement &&\n          node.src &&\n          !this.cfg.cdnAllowlist.some((origin) =>\n            node.src.startsWith(origin.replace(/\\/$/, \"\")),\n          )\n        ) {\n          injected.push(node.src);\n        }\n      });\n    }\n    if (injected.length > 0) {\n      this.cfg.onAnomaly({\n        prototypeMutations: [],\n        scriptInjections: injected,\n        fingerprintMismatches: [],\n      });\n    }\n  }\n}\n\nfunction defaultTrackedPrototypes(): NonNullable<WatcherConfig[\"trackedPrototypes\"]> {\n  return [\n    {\n      name: \"Object.prototype\",\n      obj: Object.prototype,\n      methods: [\"hasOwnProperty\", \"toString\", \"valueOf\"],\n    },\n    {\n      name: \"Array.prototype\",\n      obj: Array.prototype,\n      methods: [\"push\", \"pop\", \"slice\", \"map\", \"filter\", \"reduce\"],\n    },\n    {\n      name: \"Function.prototype\",\n      obj: Function.prototype,\n      methods: [\"call\", \"apply\", \"bind\", \"toString\"],\n    },\n    {\n      name: \"JSON\",\n      obj: JSON,\n      methods: [\"parse\", \"stringify\"],\n    },\n  ];\n}\n","// Posts client-side integrity findings to the worker's public endpoint.\n//\n// HARD_FAIL is server-side rejected when posted from the client; the\n// reporter normalizes any caller attempt to DEGRADE.\n\nimport type {\n  ClientReactionMode,\n  ClientReportPayload,\n  ClientReportStatus,\n} from \"./types.js\";\n\nexport interface ReporterConfig {\n  workerBaseUri: string;\n  installId: string;\n  manifestId: string;\n  reactionMode?: ClientReactionMode;\n  fetchImpl?: typeof fetch;\n}\n\nexport class ClientIntegrityReporter {\n  private readonly cfg: ReporterConfig;\n  private readonly fetchFn: typeof fetch;\n\n  constructor(cfg: ReporterConfig) {\n    this.cfg = cfg;\n    this.fetchFn = cfg.fetchImpl ?? globalThis.fetch.bind(globalThis);\n  }\n\n  async report(\n    status: ClientReportStatus,\n    drift?: ClientReportPayload[\"drift_files\"],\n  ): Promise<void> {\n    const reaction: ClientReactionMode =\n      this.cfg.reactionMode === \"DEGRADE\" ? \"DEGRADE\" : \"LOG_ONLY\";\n    const body: ClientReportPayload = {\n      install_id: this.cfg.installId,\n      manifest_id: this.cfg.manifestId,\n      status,\n      drift_files: drift,\n      reaction_mode: reaction,\n    };\n    const url = this.cfg.workerBaseUri.replace(/\\/$/, \"\") + \"/v1/anti-tamper/client-report\";\n    const res = await this.fetchFn(url, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\" },\n      body: JSON.stringify(body),\n    });\n    if (!res.ok) {\n      throw new Error(`anti-tamper client-report ${res.status}`);\n    }\n  }\n}\n"],"mappings":";AAyBA,IAAa,yBAAb,MAAoC;CAClC;CAGA,WAAoC;CACpC,aAA4D;CAC5D,KAAsC;CAEtC,YAAY,KAAoB;EAC9B,KAAK,MAAM;GACT,cAAc,IAAI;GAClB,gBAAgB,IAAI,kBAAkB;GACtC,mBAAmB,IAAI,qBAAqB,yBAAyB;GACrE,WAAW,IAAI,oBAAoB,CAAC;EACtC;CACF;CAEA,QAAc;EACZ,IAAI,KAAK,aAAa,MAAM;EAC5B,KAAK,WAAW,KAAK,QAAQ;EAC7B,KAAK,aAAa,kBAAkB,KAAK,KAAK,GAAG,KAAK,IAAI,cAAc;EAExE,IAAI,OAAO,qBAAqB,eAAe,OAAO,aAAa,aAAa;GAC9E,KAAK,KAAK,IAAI,kBAAkB,cAAc,KAAK,YAAY,SAAS,CAAC;GACzE,KAAK,GAAG,QAAQ,SAAS,iBAAiB;IAAE,WAAW;IAAM,SAAS;GAAK,CAAC;EAC9E;CACF;CAEA,OAAa;EACX,IAAI,KAAK,eAAe,MAAM;GAC5B,cAAc,KAAK,UAAU;GAC7B,KAAK,aAAa;EACpB;EACA,IAAI,KAAK,OAAO,MAAM;GACpB,KAAK,GAAG,WAAW;GACnB,KAAK,KAAK;EACZ;EACA,KAAK,WAAW;CAClB;CAEA,OAA2B;EACzB,MAAM,QAAQ,KAAK,KAAK;EACxB,IACE,MAAM,mBAAmB,SAAS,KAClC,MAAM,sBAAsB,SAAS,KACrC,MAAM,iBAAiB,SAAS,GAEhC,KAAK,IAAI,UAAU,KAAK;EAE1B,OAAO;CACT;CAEA,UAA4B;EAC1B,MAAM,4BAAY,IAAI,IAAqB;EAC3C,MAAM,+BAAe,IAAI,IAAoB;EAC7C,KAAK,MAAM,WAAW,KAAK,IAAI,mBAC7B,KAAK,MAAM,UAAU,QAAQ,SAAS;GACpC,MAAM,MAAM,GAAG,QAAQ,KAAK,GAAG;GAC/B,MAAM,KAAM,QAAQ,IAAgC;GACpD,UAAU,IAAI,KAAK,EAAE;GACrB,IAAI,OAAO,OAAO,YAChB,aAAa,IAAI,KAAK,SAAS,UAAU,SAAS,KAAK,EAAE,CAAC;EAE9D;EAEF,OAAO;GAAE,eAAe;GAAW;EAAa;CAClD;CAEA,OAAmC;EACjC,IAAI,KAAK,aAAa,MACpB,OAAO;GAAE,oBAAoB,CAAC;GAAG,kBAAkB,CAAC;GAAG,uBAAuB,CAAC;EAAE;EAEnF,MAAM,qBAA+B,CAAC;EACtC,MAAM,wBAAkC,CAAC;EACzC,KAAK,MAAM,WAAW,KAAK,IAAI,mBAC7B,KAAK,MAAM,UAAU,QAAQ,SAAS;GACpC,MAAM,MAAM,GAAG,QAAQ,KAAK,GAAG;GAC/B,MAAM,MAAO,QAAQ,IAAgC;GACrD,IAAI,QAAQ,KAAK,SAAS,cAAc,IAAI,GAAG,GAC7C,mBAAmB,KAAK,GAAG;GAE7B,IAAI,OAAO,QAAQ;QACA,KAAK,SAAS,aAAa,IAAI,GAE5C,MADW,SAAS,UAAU,SAAS,KAAK,GAC/B,GACf,sBAAsB,KAAK,GAAG;GAAA;EAGpC;EAEF,OAAO;GAAE;GAAoB,kBAAkB,CAAC;GAAG;EAAsB;CAC3E;CAEA,YAAoB,WAAmC;EACrD,MAAM,WAAqB,CAAC;EAC5B,KAAK,MAAM,KAAK,WACd,EAAE,WAAW,SAAS,SAAS;GAC7B,IACE,gBAAgB,qBAChB,KAAK,OACL,CAAC,KAAK,IAAI,aAAa,MAAM,WAC3B,KAAK,IAAI,WAAW,OAAO,QAAQ,OAAO,EAAE,CAAC,CAC/C,GAEA,SAAS,KAAK,KAAK,GAAG;EAE1B,CAAC;EAEH,IAAI,SAAS,SAAS,GACpB,KAAK,IAAI,UAAU;GACjB,oBAAoB,CAAC;GACrB,kBAAkB;GAClB,uBAAuB,CAAC;EAC1B,CAAC;CAEL;AACF;AAEA,SAAS,2BAA4E;CACnF,OAAO;EACL;GACE,MAAM;GACN,KAAK,OAAO;GACZ,SAAS;IAAC;IAAkB;IAAY;GAAS;EACnD;EACA;GACE,MAAM;GACN,KAAK,MAAM;GACX,SAAS;IAAC;IAAQ;IAAO;IAAS;IAAO;IAAU;GAAQ;EAC7D;EACA;GACE,MAAM;GACN,KAAK,SAAS;GACd,SAAS;IAAC;IAAQ;IAAS;IAAQ;GAAU;EAC/C;EACA;GACE,MAAM;GACN,KAAK;GACL,SAAS,CAAC,SAAS,WAAW;EAChC;CACF;AACF;;;ACnJA,IAAa,0BAAb,MAAqC;CACnC;CACA;CAEA,YAAY,KAAqB;EAC/B,KAAK,MAAM;EACX,KAAK,UAAU,IAAI,aAAa,WAAW,MAAM,KAAK,UAAU;CAClE;CAEA,MAAM,OACJ,QACA,OACe;EACf,MAAM,WACJ,KAAK,IAAI,iBAAiB,YAAY,YAAY;EACpD,MAAM,OAA4B;GAChC,YAAY,KAAK,IAAI;GACrB,aAAa,KAAK,IAAI;GACtB;GACA,aAAa;GACb,eAAe;EACjB;EACA,MAAM,MAAM,KAAK,IAAI,cAAc,QAAQ,OAAO,EAAE,IAAI;EACxD,MAAM,MAAM,MAAM,KAAK,QAAQ,KAAK;GAClC,QAAQ;GACR,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C,MAAM,KAAK,UAAU,IAAI;EAC3B,CAAC;EACD,IAAI,CAAC,IAAI,IACP,MAAM,IAAI,MAAM,6BAA6B,IAAI,QAAQ;CAE7D;AACF"}

package/dist/anti-tamper/types.d.ts

@@ -0,0 +1,19 @@
+export type ClientReportStatus = "ok" | "drift" | "missing_manifest" | "sig_invalid";
+export type ClientReactionMode = "LOG_ONLY" | "DEGRADE";
+export interface ClientReportPayload {
+    install_id: string;
+    manifest_id: string;
+    status: ClientReportStatus;
+    drift_files?: {
+        added?: string[];
+        modified?: string[];
+        removed?: string[];
+    };
+    reaction_mode?: ClientReactionMode;
+}
+export interface WatcherDriftReport {
+    prototypeMutations: string[];
+    scriptInjections: string[];
+    fingerprintMismatches: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/anti-tamper/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/anti-tamper/types.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,kBAAkB,GAC1B,IAAI,GACJ,OAAO,GACP,kBAAkB,GAClB,aAAa,CAAC;AAElB,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,WAAW,CAAC,EAAE;QACZ,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,aAAa,CAAC,EAAE,kBAAkB,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC"}

package/dist/observability/BatchSender.d.ts

@@ -0,0 +1,21 @@
+import type { BrowserAuditEvent, BrowserErrorEvent, BrowserPerfEvent } from "./types.js";
+export interface BatchSenderConfig {
+    relayBaseUri: string;
+    maxBatchSize?: number;
+    fetchImpl?: typeof fetch;
+}
+export declare class BatchSender {
+    private errors;
+    private perf;
+    private events;
+    private readonly cfg;
+    constructor(cfg: BatchSenderConfig);
+    queueError(e: BrowserErrorEvent): void;
+    queuePerf(e: BrowserPerfEvent): void;
+    queueAudit(e: BrowserAuditEvent): void;
+    flush(): Promise<void>;
+    size(): number;
+    private cap;
+    private send;
+}
+//# sourceMappingURL=BatchSender.d.ts.map

package/dist/observability/BatchSender.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BatchSender.d.ts","sourceRoot":"","sources":["../../src/observability/BatchSender.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAA2B;IACzC,OAAO,CAAC,IAAI,CAA0B;IACtC,OAAO,CAAC,MAAM,CAA2B;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAElB;gBAEU,GAAG,EAAE,iBAAiB;IAQlC,UAAU,CAAC,CAAC,EAAE,iBAAiB,GAAG,IAAI;IAItC,SAAS,CAAC,CAAC,EAAE,gBAAgB,GAAG,IAAI;IAIpC,UAAU,CAAC,CAAC,EAAE,iBAAiB,GAAG,IAAI;IAIhC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB5B,IAAI,IAAI,MAAM;IAId,OAAO,CAAC,GAAG;YAQG,IAAI;CAUnB"}

package/dist/observability/ObservabilityClient.d.ts

@@ -0,0 +1,25 @@
+import { BatchSender } from "./BatchSender.js";
+import type { ObsLevel } from "./types.js";
+export interface ObservabilityClientConfig {
+    relayBaseUri: string;
+    flushIntervalMs?: number;
+    installPerfCollector?: boolean;
+    fetchImpl?: typeof fetch;
+}
+export declare class ObservabilityClient {
+    readonly sender: BatchSender;
+    private perf;
+    private flushHandle;
+    private cfg;
+    constructor(cfg: ObservabilityClientConfig);
+    install(): void;
+    uninstall(): void;
+    reportError(level: ObsLevel, message: string, stack: string, payload?: unknown): void;
+    reportAudit(eventType: string, payload?: Record<string, unknown>): void;
+    private reportWindowError;
+    private reportUnhandled;
+    private hashStack;
+    private sha256Hex;
+    private fnv1a64Hex;
+}
+//# sourceMappingURL=ObservabilityClient.d.ts.map

package/dist/observability/ObservabilityClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ObservabilityClient.d.ts","sourceRoot":"","sources":["../../src/observability/ObservabilityClient.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,KAAK,EAAwC,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEjF,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,qBAAa,mBAAmB;IAC9B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,OAAO,CAAC,IAAI,CAA8B;IAC1C,OAAO,CAAC,WAAW,CAA+C;IAClE,OAAO,CAAC,GAAG,CAAsC;gBAErC,GAAG,EAAE,yBAAyB;IAa1C,OAAO,IAAI,IAAI;IAiBf,SAAS,IAAI,IAAI;IASjB,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI;IAYrF,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAYvE,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,SAAS;IAOjB,OAAO,CAAC,SAAS;IAWjB,OAAO,CAAC,UAAU;CAWnB"}

package/dist/observability/PerfCollector.d.ts

@@ -0,0 +1,18 @@
+import { BatchSender } from "./BatchSender.js";
+export interface PerfCollectorConfig {
+    sender: BatchSender;
+    metricsToCollect?: Array<{
+        name: string;
+        entryType: string;
+        attr: keyof PerformanceEntry | "duration";
+    }>;
+    sampleRate?: number;
+}
+export declare class PerfCollector {
+    private readonly cfg;
+    private observer;
+    constructor(cfg: PerfCollectorConfig);
+    start(): void;
+    stop(): void;
+}
+//# sourceMappingURL=PerfCollector.d.ts.map

package/dist/observability/PerfCollector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PerfCollector.d.ts","sourceRoot":"","sources":["../../src/observability/PerfCollector.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAG/C,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,WAAW,CAAC;IACpB,gBAAgB,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,gBAAgB,GAAG,UAAU,CAAA;KAAE,CAAC,CAAC;IACzG,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAgC;IACpD,OAAO,CAAC,QAAQ,CAAoC;gBAExC,GAAG,EAAE,mBAAmB;IAQpC,KAAK,IAAI,IAAI;IA+Bb,IAAI,IAAI,IAAI;CAMb"}

package/dist/observability/index.d.ts

@@ -0,0 +1,8 @@
+export { ObservabilityClient } from "./ObservabilityClient.js";
+export type { ObservabilityClientConfig } from "./ObservabilityClient.js";
+export { BatchSender } from "./BatchSender.js";
+export type { BatchSenderConfig } from "./BatchSender.js";
+export { PerfCollector } from "./PerfCollector.js";
+export type { PerfCollectorConfig } from "./PerfCollector.js";
+export type { BrowserAuditEvent, BrowserErrorEvent, BrowserPerfEvent, ObsLevel, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/observability/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/observability/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,YAAY,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,YAAY,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,QAAQ,GACT,MAAM,YAAY,CAAC"}

package/dist/observability/index.js

@@ -0,0 +1,225 @@
+//#region src/observability/BatchSender.ts
+var BatchSender = class {
+	errors = [];
+	perf = [];
+	events = [];
+	cfg;
+	constructor(cfg) {
+		this.cfg = {
+			relayBaseUri: cfg.relayBaseUri.replace(/\/$/, ""),
+			maxBatchSize: cfg.maxBatchSize ?? 1e3,
+			fetchImpl: cfg.fetchImpl ?? globalThis.fetch.bind(globalThis)
+		};
+	}
+	queueError(e) {
+		this.errors = this.cap(this.errors, e);
+	}
+	queuePerf(e) {
+		this.perf = this.cap(this.perf, e);
+	}
+	queueAudit(e) {
+		this.events = this.cap(this.events, e);
+	}
+	async flush() {
+		const tasks = [];
+		if (this.errors.length > 0) {
+			const batch = this.errors;
+			this.errors = [];
+			tasks.push(this.send("/observability/errors", batch));
+		}
+		if (this.perf.length > 0) {
+			const batch = this.perf;
+			this.perf = [];
+			tasks.push(this.send("/observability/perf", batch));
+		}
+		if (this.events.length > 0) {
+			const batch = this.events;
+			this.events = [];
+			tasks.push(this.send("/observability/events", batch));
+		}
+		await Promise.all(tasks);
+	}
+	size() {
+		return this.errors.length + this.perf.length + this.events.length;
+	}
+	cap(arr, next) {
+		if (arr.length >= this.cfg.maxBatchSize) arr.shift();
+		arr.push(next);
+		return arr;
+	}
+	async send(path, body) {
+		const url = this.cfg.relayBaseUri + path;
+		await this.cfg.fetchImpl(url, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify(body),
+			keepalive: true
+		});
+	}
+};
+//#endregion
+//#region src/observability/PerfCollector.ts
+var PerfCollector = class {
+	cfg;
+	observer = null;
+	constructor(cfg) {
+		this.cfg = {
+			sender: cfg.sender,
+			metricsToCollect: cfg.metricsToCollect ?? defaultMetrics(),
+			sampleRate: cfg.sampleRate ?? 1
+		};
+	}
+	start() {
+		if (typeof PerformanceObserver === "undefined") return;
+		if (this.observer !== null) return;
+		const types = new Set(this.cfg.metricsToCollect.map((m) => m.entryType));
+		this.observer = new PerformanceObserver((list) => {
+			for (const entry of list.getEntries()) {
+				if (!types.has(entry.entryType)) continue;
+				if (Math.random() > this.cfg.sampleRate) continue;
+				const match = this.cfg.metricsToCollect.find((m) => m.entryType === entry.entryType);
+				if (!match) continue;
+				const raw = match.attr === "duration" ? entry.duration : entry[match.attr];
+				if (typeof raw !== "number" || !Number.isFinite(raw)) continue;
+				const ev = {
+					metric_name: match.name,
+					value_ms: raw,
+					source: "js",
+					ts: Date.now()
+				};
+				this.cfg.sender.queuePerf(ev);
+			}
+		});
+		for (const t of types) try {
+			this.observer.observe({
+				type: t,
+				buffered: true
+			});
+		} catch {}
+	}
+	stop() {
+		if (this.observer !== null) {
+			this.observer.disconnect();
+			this.observer = null;
+		}
+	}
+};
+function defaultMetrics() {
+	return [
+		{
+			name: "page_load_ms",
+			entryType: "navigation",
+			attr: "duration"
+		},
+		{
+			name: "fcp_ms",
+			entryType: "paint",
+			attr: "startTime"
+		},
+		{
+			name: "lcp_ms",
+			entryType: "largest-contentful-paint",
+			attr: "startTime"
+		},
+		{
+			name: "resource_ms",
+			entryType: "resource",
+			attr: "duration"
+		}
+	];
+}
+//#endregion
+//#region src/observability/ObservabilityClient.ts
+var ObservabilityClient = class {
+	sender;
+	perf = null;
+	flushHandle = null;
+	cfg;
+	constructor(cfg) {
+		this.cfg = {
+			relayBaseUri: cfg.relayBaseUri,
+			flushIntervalMs: cfg.flushIntervalMs ?? 3e4,
+			installPerfCollector: cfg.installPerfCollector ?? true,
+			fetchImpl: cfg.fetchImpl ?? globalThis.fetch.bind(globalThis)
+		};
+		this.sender = new BatchSender({
+			relayBaseUri: this.cfg.relayBaseUri,
+			fetchImpl: this.cfg.fetchImpl
+		});
+	}
+	install() {
+		if (typeof window !== "undefined") {
+			window.addEventListener("error", (ev) => this.reportWindowError(ev));
+			window.addEventListener("unhandledrejection", (ev) => this.reportUnhandled(ev));
+			window.addEventListener("visibilitychange", () => {
+				if (document.visibilityState === "hidden") this.sender.flush();
+			});
+		}
+		if (this.cfg.installPerfCollector) {
+			this.perf = new PerfCollector({ sender: this.sender });
+			this.perf.start();
+		}
+		this.flushHandle = setInterval(() => void this.sender.flush(), this.cfg.flushIntervalMs);
+	}
+	uninstall() {
+		this.perf?.stop();
+		this.perf = null;
+		if (this.flushHandle !== null) {
+			clearInterval(this.flushHandle);
+			this.flushHandle = null;
+		}
+	}
+	reportError(level, message, stack, payload) {
+		const event = {
+			level,
+			message,
+			stack_hash: this.hashStack(stack),
+			source: "js",
+			payload: payload === void 0 ? null : JSON.stringify(payload),
+			ts: Date.now()
+		};
+		this.sender.queueError(event);
+	}
+	reportAudit(eventType, payload) {
+		const json = payload === void 0 ? null : JSON.stringify(payload);
+		const event = {
+			event_type: eventType,
+			payload_hash: this.sha256Hex(json ?? ""),
+			payload: json,
+			source: "js",
+			ts: Date.now()
+		};
+		this.sender.queueAudit(event);
+	}
+	reportWindowError(ev) {
+		this.reportError("error", `${ev.message} @ ${ev.filename}:${ev.lineno}:${ev.colno}`, ev.error?.stack ?? `${ev.message} @ ${ev.filename}:${ev.lineno}`);
+	}
+	reportUnhandled(ev) {
+		const reason = ev.reason;
+		const message = reason instanceof Error ? reason.message : String(reason);
+		const stack = reason instanceof Error ? reason.stack ?? message : message;
+		this.reportError("error", `unhandledrejection: ${message}`, stack);
+	}
+	hashStack(stack) {
+		const normalized = stack.replace(/\(\d+\)/g, "()").replace(/:\d+:\d+/g, ":N:N");
+		return this.sha256Hex(normalized);
+	}
+	sha256Hex(input) {
+		if (typeof crypto === "undefined" || crypto.subtle === void 0) return this.fnv1a64Hex(input);
+		return this.fnv1a64Hex(input);
+	}
+	fnv1a64Hex(input) {
+		let h = 14695981039346656037n;
+		const prime = 1099511628211n;
+		for (let i = 0; i < input.length; i++) {
+			h ^= BigInt(input.charCodeAt(i));
+			h = h * prime & 18446744073709551615n;
+		}
+		const hex = h.toString(16).padStart(16, "0");
+		return (hex + hex + hex + hex).slice(0, 64);
+	}
+};
+//#endregion
+export { BatchSender, ObservabilityClient, PerfCollector };
+
+//# sourceMappingURL=index.js.map

package/dist/observability/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../src/observability/BatchSender.ts","../../src/observability/PerfCollector.ts","../../src/observability/ObservabilityClient.ts"],"sourcesContent":["// Buffers events per family and ships them to the host plugin relay.\n//\n// Caller is responsible for installing flush triggers — typical wiring:\n//   - addEventListener(\"visibilitychange\") on hidden → flush\n//   - setInterval(flush, 30_000)\n//   - register flush() in onbeforeunload (best-effort via fetch keepalive)\n\nimport type {\n  BrowserAuditEvent,\n  BrowserErrorEvent,\n  BrowserPerfEvent,\n} from \"./types.js\";\n\nexport interface BatchSenderConfig {\n  relayBaseUri: string;\n  maxBatchSize?: number;\n  fetchImpl?: typeof fetch;\n}\n\nexport class BatchSender {\n  private errors: BrowserErrorEvent[] = [];\n  private perf: BrowserPerfEvent[] = [];\n  private events: BrowserAuditEvent[] = [];\n  private readonly cfg: Required<Omit<BatchSenderConfig, \"fetchImpl\">> & {\n    fetchImpl: typeof fetch;\n  };\n\n  constructor(cfg: BatchSenderConfig) {\n    this.cfg = {\n      relayBaseUri: cfg.relayBaseUri.replace(/\\/$/, \"\"),\n      maxBatchSize: cfg.maxBatchSize ?? 1000,\n      fetchImpl: cfg.fetchImpl ?? globalThis.fetch.bind(globalThis),\n    };\n  }\n\n  queueError(e: BrowserErrorEvent): void {\n    this.errors = this.cap(this.errors, e);\n  }\n\n  queuePerf(e: BrowserPerfEvent): void {\n    this.perf = this.cap(this.perf, e);\n  }\n\n  queueAudit(e: BrowserAuditEvent): void {\n    this.events = this.cap(this.events, e);\n  }\n\n  async flush(): Promise<void> {\n    const tasks: Array<Promise<void>> = [];\n    if (this.errors.length > 0) {\n      const batch = this.errors;\n      this.errors = [];\n      tasks.push(this.send(\"/observability/errors\", batch));\n    }\n    if (this.perf.length > 0) {\n      const batch = this.perf;\n      this.perf = [];\n      tasks.push(this.send(\"/observability/perf\", batch));\n    }\n    if (this.events.length > 0) {\n      const batch = this.events;\n      this.events = [];\n      tasks.push(this.send(\"/observability/events\", batch));\n    }\n    await Promise.all(tasks);\n  }\n\n  size(): number {\n    return this.errors.length + this.perf.length + this.events.length;\n  }\n\n  private cap<T>(arr: T[], next: T): T[] {\n    if (arr.length >= this.cfg.maxBatchSize) {\n      arr.shift();\n    }\n    arr.push(next);\n    return arr;\n  }\n\n  private async send(path: string, body: unknown[]): Promise<void> {\n    const url = this.cfg.relayBaseUri + path;\n    await this.cfg.fetchImpl(url, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\" },\n      body: JSON.stringify(body),\n      // Keep-alive lets us best-effort flush during unload.\n      keepalive: true,\n    });\n  }\n}\n","// Collects browser perf timings via the Performance API and feeds them\n// to a BatchSender. Caller chooses which entry types to sample.\n\nimport { BatchSender } from \"./BatchSender.js\";\nimport type { BrowserPerfEvent } from \"./types.js\";\n\nexport interface PerfCollectorConfig {\n  sender: BatchSender;\n  metricsToCollect?: Array<{ name: string; entryType: string; attr: keyof PerformanceEntry | \"duration\" }>;\n  sampleRate?: number;          // 0..1\n}\n\nexport class PerfCollector {\n  private readonly cfg: Required<PerfCollectorConfig>;\n  private observer: PerformanceObserver | null = null;\n\n  constructor(cfg: PerfCollectorConfig) {\n    this.cfg = {\n      sender: cfg.sender,\n      metricsToCollect: cfg.metricsToCollect ?? defaultMetrics(),\n      sampleRate: cfg.sampleRate ?? 1.0,\n    };\n  }\n\n  start(): void {\n    if (typeof PerformanceObserver === \"undefined\") return;\n    if (this.observer !== null) return;\n\n    const types = new Set(this.cfg.metricsToCollect.map((m) => m.entryType));\n    this.observer = new PerformanceObserver((list) => {\n      for (const entry of list.getEntries()) {\n        if (!types.has(entry.entryType)) continue;\n        if (Math.random() > this.cfg.sampleRate) continue;\n        const match = this.cfg.metricsToCollect.find((m) => m.entryType === entry.entryType);\n        if (!match) continue;\n        const raw = match.attr === \"duration\" ? entry.duration : (entry as unknown as Record<string, unknown>)[match.attr];\n        if (typeof raw !== \"number\" || !Number.isFinite(raw)) continue;\n        const ev: BrowserPerfEvent = {\n          metric_name: match.name,\n          value_ms: raw,\n          source: \"js\",\n          ts: Date.now(),\n        };\n        this.cfg.sender.queuePerf(ev);\n      }\n    });\n    for (const t of types) {\n      try {\n        this.observer.observe({ type: t, buffered: true });\n      } catch {\n        // entry type not supported in this browser — skip silently.\n      }\n    }\n  }\n\n  stop(): void {\n    if (this.observer !== null) {\n      this.observer.disconnect();\n      this.observer = null;\n    }\n  }\n}\n\nfunction defaultMetrics(): NonNullable<PerfCollectorConfig[\"metricsToCollect\"]> {\n  return [\n    { name: \"page_load_ms\", entryType: \"navigation\", attr: \"duration\" },\n    { name: \"fcp_ms\", entryType: \"paint\", attr: \"startTime\" as keyof PerformanceEntry },\n    { name: \"lcp_ms\", entryType: \"largest-contentful-paint\", attr: \"startTime\" as keyof PerformanceEntry },\n    { name: \"resource_ms\", entryType: \"resource\", attr: \"duration\" },\n  ];\n}\n","// High-level façade over BatchSender. Owns the global window error/unhandled\n// rejection handlers and the periodic flush loop. Caller calls install()\n// once on app boot.\n\nimport { BatchSender } from \"./BatchSender.js\";\nimport { PerfCollector } from \"./PerfCollector.js\";\nimport type { BrowserErrorEvent, BrowserAuditEvent, ObsLevel } from \"./types.js\";\n\nexport interface ObservabilityClientConfig {\n  relayBaseUri: string;\n  flushIntervalMs?: number;\n  installPerfCollector?: boolean;\n  fetchImpl?: typeof fetch;\n}\n\nexport class ObservabilityClient {\n  readonly sender: BatchSender;\n  private perf: PerfCollector | null = null;\n  private flushHandle: ReturnType<typeof setInterval> | null = null;\n  private cfg: Required<ObservabilityClientConfig>;\n\n  constructor(cfg: ObservabilityClientConfig) {\n    this.cfg = {\n      relayBaseUri: cfg.relayBaseUri,\n      flushIntervalMs: cfg.flushIntervalMs ?? 30_000,\n      installPerfCollector: cfg.installPerfCollector ?? true,\n      fetchImpl: cfg.fetchImpl ?? globalThis.fetch.bind(globalThis),\n    };\n    this.sender = new BatchSender({\n      relayBaseUri: this.cfg.relayBaseUri,\n      fetchImpl: this.cfg.fetchImpl,\n    });\n  }\n\n  install(): void {\n    if (typeof window !== \"undefined\") {\n      window.addEventListener(\"error\", (ev) => this.reportWindowError(ev));\n      window.addEventListener(\"unhandledrejection\", (ev) => this.reportUnhandled(ev));\n      window.addEventListener(\"visibilitychange\", () => {\n        if (document.visibilityState === \"hidden\") {\n          void this.sender.flush();\n        }\n      });\n    }\n    if (this.cfg.installPerfCollector) {\n      this.perf = new PerfCollector({ sender: this.sender });\n      this.perf.start();\n    }\n    this.flushHandle = setInterval(() => void this.sender.flush(), this.cfg.flushIntervalMs);\n  }\n\n  uninstall(): void {\n    this.perf?.stop();\n    this.perf = null;\n    if (this.flushHandle !== null) {\n      clearInterval(this.flushHandle);\n      this.flushHandle = null;\n    }\n  }\n\n  reportError(level: ObsLevel, message: string, stack: string, payload?: unknown): void {\n    const event: BrowserErrorEvent = {\n      level,\n      message,\n      stack_hash: this.hashStack(stack),\n      source: \"js\",\n      payload: payload === undefined ? null : JSON.stringify(payload),\n      ts: Date.now(),\n    };\n    this.sender.queueError(event);\n  }\n\n  reportAudit(eventType: string, payload?: Record<string, unknown>): void {\n    const json = payload === undefined ? null : JSON.stringify(payload);\n    const event: BrowserAuditEvent = {\n      event_type: eventType,\n      payload_hash: this.sha256Hex(json ?? \"\"),\n      payload: json,\n      source: \"js\",\n      ts: Date.now(),\n    };\n    this.sender.queueAudit(event);\n  }\n\n  private reportWindowError(ev: ErrorEvent): void {\n    this.reportError(\n      \"error\",\n      `${ev.message} @ ${ev.filename}:${ev.lineno}:${ev.colno}`,\n      ev.error?.stack ?? `${ev.message} @ ${ev.filename}:${ev.lineno}`,\n    );\n  }\n\n  private reportUnhandled(ev: PromiseRejectionEvent): void {\n    const reason = ev.reason;\n    const message = reason instanceof Error ? reason.message : String(reason);\n    const stack = reason instanceof Error ? (reason.stack ?? message) : message;\n    this.reportError(\"error\", `unhandledrejection: ${message}`, stack);\n  }\n\n  private hashStack(stack: string): string {\n    // Normalize line numbers + parenthesized fragments so the same code path\n    // produces the same hash across minified builds.\n    const normalized = stack.replace(/\\(\\d+\\)/g, \"()\").replace(/:\\d+:\\d+/g, \":N:N\");\n    return this.sha256Hex(normalized);\n  }\n\n  private sha256Hex(input: string): string {\n    // synchronous fnv-1a-ish fallback when SubtleCrypto unavailable (Node)\n    // — adequate for de-dup hashing, NOT for cryptographic use.\n    if (typeof crypto === \"undefined\" || crypto.subtle === undefined) {\n      return this.fnv1a64Hex(input);\n    }\n    // Note: callers use the result for de-dup keys; we sync-stub here\n    // because async hash would require restructuring queue calls.\n    return this.fnv1a64Hex(input);\n  }\n\n  private fnv1a64Hex(input: string): string {\n    let h = 0xcbf29ce484222325n;\n    const prime = 0x100000001b3n;\n    for (let i = 0; i < input.length; i++) {\n      h ^= BigInt(input.charCodeAt(i));\n      h = (h * prime) & 0xffffffffffffffffn;\n    }\n    // pad to 64 hex chars by doubling\n    const hex = h.toString(16).padStart(16, \"0\");\n    return (hex + hex + hex + hex).slice(0, 64);\n  }\n}\n"],"mappings":";AAmBA,IAAa,cAAb,MAAyB;CACvB,SAAsC,CAAC;CACvC,OAAmC,CAAC;CACpC,SAAsC,CAAC;CACvC;CAIA,YAAY,KAAwB;EAClC,KAAK,MAAM;GACT,cAAc,IAAI,aAAa,QAAQ,OAAO,EAAE;GAChD,cAAc,IAAI,gBAAgB;GAClC,WAAW,IAAI,aAAa,WAAW,MAAM,KAAK,UAAU;EAC9D;CACF;CAEA,WAAW,GAA4B;EACrC,KAAK,SAAS,KAAK,IAAI,KAAK,QAAQ,CAAC;CACvC;CAEA,UAAU,GAA2B;EACnC,KAAK,OAAO,KAAK,IAAI,KAAK,MAAM,CAAC;CACnC;CAEA,WAAW,GAA4B;EACrC,KAAK,SAAS,KAAK,IAAI,KAAK,QAAQ,CAAC;CACvC;CAEA,MAAM,QAAuB;EAC3B,MAAM,QAA8B,CAAC;EACrC,IAAI,KAAK,OAAO,SAAS,GAAG;GAC1B,MAAM,QAAQ,KAAK;GACnB,KAAK,SAAS,CAAC;GACf,MAAM,KAAK,KAAK,KAAK,yBAAyB,KAAK,CAAC;EACtD;EACA,IAAI,KAAK,KAAK,SAAS,GAAG;GACxB,MAAM,QAAQ,KAAK;GACnB,KAAK,OAAO,CAAC;GACb,MAAM,KAAK,KAAK,KAAK,uBAAuB,KAAK,CAAC;EACpD;EACA,IAAI,KAAK,OAAO,SAAS,GAAG;GAC1B,MAAM,QAAQ,KAAK;GACnB,KAAK,SAAS,CAAC;GACf,MAAM,KAAK,KAAK,KAAK,yBAAyB,KAAK,CAAC;EACtD;EACA,MAAM,QAAQ,IAAI,KAAK;CACzB;CAEA,OAAe;EACb,OAAO,KAAK,OAAO,SAAS,KAAK,KAAK,SAAS,KAAK,OAAO;CAC7D;CAEA,IAAe,KAAU,MAAc;EACrC,IAAI,IAAI,UAAU,KAAK,IAAI,cACzB,IAAI,MAAM;EAEZ,IAAI,KAAK,IAAI;EACb,OAAO;CACT;CAEA,MAAc,KAAK,MAAc,MAAgC;EAC/D,MAAM,MAAM,KAAK,IAAI,eAAe;EACpC,MAAM,KAAK,IAAI,UAAU,KAAK;GAC5B,QAAQ;GACR,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C,MAAM,KAAK,UAAU,IAAI;GAEzB,WAAW;EACb,CAAC;CACH;AACF;;;AC7EA,IAAa,gBAAb,MAA2B;CACzB;CACA,WAA+C;CAE/C,YAAY,KAA0B;EACpC,KAAK,MAAM;GACT,QAAQ,IAAI;GACZ,kBAAkB,IAAI,oBAAoB,eAAe;GACzD,YAAY,IAAI,cAAc;EAChC;CACF;CAEA,QAAc;EACZ,IAAI,OAAO,wBAAwB,aAAa;EAChD,IAAI,KAAK,aAAa,MAAM;EAE5B,MAAM,QAAQ,IAAI,IAAI,KAAK,IAAI,iBAAiB,KAAK,MAAM,EAAE,SAAS,CAAC;EACvE,KAAK,WAAW,IAAI,qBAAqB,SAAS;GAChD,KAAK,MAAM,SAAS,KAAK,WAAW,GAAG;IACrC,IAAI,CAAC,MAAM,IAAI,MAAM,SAAS,GAAG;IACjC,IAAI,KAAK,OAAO,IAAI,KAAK,IAAI,YAAY;IACzC,MAAM,QAAQ,KAAK,IAAI,iBAAiB,MAAM,MAAM,EAAE,cAAc,MAAM,SAAS;IACnF,IAAI,CAAC,OAAO;IACZ,MAAM,MAAM,MAAM,SAAS,aAAa,MAAM,WAAY,MAA6C,MAAM;IAC7G,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,SAAS,GAAG,GAAG;IACtD,MAAM,KAAuB;KAC3B,aAAa,MAAM;KACnB,UAAU;KACV,QAAQ;KACR,IAAI,KAAK,IAAI;IACf;IACA,KAAK,IAAI,OAAO,UAAU,EAAE;GAC9B;EACF,CAAC;EACD,KAAK,MAAM,KAAK,OACd,IAAI;GACF,KAAK,SAAS,QAAQ;IAAE,MAAM;IAAG,UAAU;GAAK,CAAC;EACnD,QAAQ,CAER;CAEJ;CAEA,OAAa;EACX,IAAI,KAAK,aAAa,MAAM;GAC1B,KAAK,SAAS,WAAW;GACzB,KAAK,WAAW;EAClB;CACF;AACF;AAEA,SAAS,iBAAuE;CAC9E,OAAO;EACL;GAAE,MAAM;GAAgB,WAAW;GAAc,MAAM;EAAW;EAClE;GAAE,MAAM;GAAU,WAAW;GAAS,MAAM;EAAsC;EAClF;GAAE,MAAM;GAAU,WAAW;GAA4B,MAAM;EAAsC;EACrG;GAAE,MAAM;GAAe,WAAW;GAAY,MAAM;EAAW;CACjE;AACF;;;ACvDA,IAAa,sBAAb,MAAiC;CAC/B;CACA,OAAqC;CACrC,cAA6D;CAC7D;CAEA,YAAY,KAAgC;EAC1C,KAAK,MAAM;GACT,cAAc,IAAI;GAClB,iBAAiB,IAAI,mBAAmB;GACxC,sBAAsB,IAAI,wBAAwB;GAClD,WAAW,IAAI,aAAa,WAAW,MAAM,KAAK,UAAU;EAC9D;EACA,KAAK,SAAS,IAAI,YAAY;GAC5B,cAAc,KAAK,IAAI;GACvB,WAAW,KAAK,IAAI;EACtB,CAAC;CACH;CAEA,UAAgB;EACd,IAAI,OAAO,WAAW,aAAa;GACjC,OAAO,iBAAiB,UAAU,OAAO,KAAK,kBAAkB,EAAE,CAAC;GACnE,OAAO,iBAAiB,uBAAuB,OAAO,KAAK,gBAAgB,EAAE,CAAC;GAC9E,OAAO,iBAAiB,0BAA0B;IAChD,IAAI,SAAS,oBAAoB,UAC/B,KAAU,OAAO,MAAM;GAE3B,CAAC;EACH;EACA,IAAI,KAAK,IAAI,sBAAsB;GACjC,KAAK,OAAO,IAAI,cAAc,EAAE,QAAQ,KAAK,OAAO,CAAC;GACrD,KAAK,KAAK,MAAM;EAClB;EACA,KAAK,cAAc,kBAAkB,KAAK,KAAK,OAAO,MAAM,GAAG,KAAK,IAAI,eAAe;CACzF;CAEA,YAAkB;EAChB,KAAK,MAAM,KAAK;EAChB,KAAK,OAAO;EACZ,IAAI,KAAK,gBAAgB,MAAM;GAC7B,cAAc,KAAK,WAAW;GAC9B,KAAK,cAAc;EACrB;CACF;CAEA,YAAY,OAAiB,SAAiB,OAAe,SAAyB;EACpF,MAAM,QAA2B;GAC/B;GACA;GACA,YAAY,KAAK,UAAU,KAAK;GAChC,QAAQ;GACR,SAAS,YAAY,KAAA,IAAY,OAAO,KAAK,UAAU,OAAO;GAC9D,IAAI,KAAK,IAAI;EACf;EACA,KAAK,OAAO,WAAW,KAAK;CAC9B;CAEA,YAAY,WAAmB,SAAyC;EACtE,MAAM,OAAO,YAAY,KAAA,IAAY,OAAO,KAAK,UAAU,OAAO;EAClE,MAAM,QAA2B;GAC/B,YAAY;GACZ,cAAc,KAAK,UAAU,QAAQ,EAAE;GACvC,SAAS;GACT,QAAQ;GACR,IAAI,KAAK,IAAI;EACf;EACA,KAAK,OAAO,WAAW,KAAK;CAC9B;CAEA,kBAA0B,IAAsB;EAC9C,KAAK,YACH,SACA,GAAG,GAAG,QAAQ,KAAK,GAAG,SAAS,GAAG,GAAG,OAAO,GAAG,GAAG,SAClD,GAAG,OAAO,SAAS,GAAG,GAAG,QAAQ,KAAK,GAAG,SAAS,GAAG,GAAG,QAC1D;CACF;CAEA,gBAAwB,IAAiC;EACvD,MAAM,SAAS,GAAG;EAClB,MAAM,UAAU,kBAAkB,QAAQ,OAAO,UAAU,OAAO,MAAM;EACxE,MAAM,QAAQ,kBAAkB,QAAS,OAAO,SAAS,UAAW;EACpE,KAAK,YAAY,SAAS,uBAAuB,WAAW,KAAK;CACnE;CAEA,UAAkB,OAAuB;EAGvC,MAAM,aAAa,MAAM,QAAQ,YAAY,IAAI,EAAE,QAAQ,aAAa,MAAM;EAC9E,OAAO,KAAK,UAAU,UAAU;CAClC;CAEA,UAAkB,OAAuB;EAGvC,IAAI,OAAO,WAAW,eAAe,OAAO,WAAW,KAAA,GACrD,OAAO,KAAK,WAAW,KAAK;EAI9B,OAAO,KAAK,WAAW,KAAK;CAC9B;CAEA,WAAmB,OAAuB;EACxC,IAAI,IAAI;EACR,MAAM,QAAQ;EACd,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;GACrC,KAAK,OAAO,MAAM,WAAW,CAAC,CAAC;GAC/B,IAAK,IAAI,QAAS;EACpB;EAEA,MAAM,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,IAAI,GAAG;EAC3C,QAAQ,MAAM,MAAM,MAAM,KAAK,MAAM,GAAG,EAAE;CAC5C;AACF"}

package/dist/observability/types.d.ts

@@ -0,0 +1,23 @@
+export type ObsLevel = "debug" | "info" | "warning" | "error" | "critical";
+export interface BrowserErrorEvent {
+    level: ObsLevel;
+    message: string;
+    stack_hash: string;
+    source: "js";
+    payload?: string | null;
+    ts: number;
+}
+export interface BrowserPerfEvent {
+    metric_name: string;
+    value_ms: number;
+    source: "js";
+    ts: number;
+}
+export interface BrowserAuditEvent {
+    event_type: string;
+    payload_hash: string;
+    payload?: string | null;
+    source: "js";
+    ts: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/observability/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/observability/types.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,CAAC;AAE3E,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,IAAI,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,IAAI,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,IAAI,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ"}

package/dist/remote-support/AuditBanner.d.ts

@@ -0,0 +1,23 @@
+export interface SessionSummary {
+    session_id: string;
+    middag_user_id: string;
+    tier: 1 | 2 | 3 | 4;
+    status: "pending" | "active" | "ended" | "revoked" | "expired";
+    granted_at: number;
+    reason: string;
+}
+export interface AuditBannerConfig {
+    container: HTMLElement;
+    fetchSessions: () => Promise<SessionSummary[]>;
+    onRevoke?: (sessionId: string) => Promise<void>;
+    pollIntervalMs?: number;
+}
+export declare class AuditBanner {
+    private cfg;
+    private pollHandle;
+    constructor(cfg: AuditBannerConfig);
+    mount(): Promise<void>;
+    unmount(): void;
+    private refresh;
+}
+//# sourceMappingURL=AuditBanner.d.ts.map

package/dist/remote-support/AuditBanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuditBanner.d.ts","sourceRoot":"","sources":["../../src/remote-support/AuditBanner.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,aAAa,EAAE,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC/C,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,GAAG,CAET;IACF,OAAO,CAAC,UAAU,CAA+C;gBAErD,GAAG,EAAE,iBAAiB;IAS5B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAK5B,OAAO,IAAI,IAAI;YAQD,OAAO;CAyBtB"}

package/dist/remote-support/index.d.ts

@@ -0,0 +1,3 @@
+export { AuditBanner } from "./AuditBanner.js";
+export type { AuditBannerConfig, SessionSummary } from "./AuditBanner.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/remote-support/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/remote-support/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/remote-support/index.js

@@ -0,0 +1,51 @@
+//#region src/remote-support/AuditBanner.ts
+var AuditBanner = class {
+	cfg;
+	pollHandle = null;
+	constructor(cfg) {
+		this.cfg = {
+			container: cfg.container,
+			fetchSessions: cfg.fetchSessions,
+			onRevoke: cfg.onRevoke,
+			pollIntervalMs: cfg.pollIntervalMs ?? 3e4
+		};
+	}
+	async mount() {
+		await this.refresh();
+		this.pollHandle = setInterval(() => void this.refresh(), this.cfg.pollIntervalMs);
+	}
+	unmount() {
+		if (this.pollHandle !== null) {
+			clearInterval(this.pollHandle);
+			this.pollHandle = null;
+		}
+		this.cfg.container.innerHTML = "";
+	}
+	async refresh() {
+		const active = (await this.cfg.fetchSessions()).filter((s) => s.status === "active");
+		this.cfg.container.innerHTML = "";
+		if (active.length === 0) return;
+		const banner = document.createElement("div");
+		banner.setAttribute("data-middag-remote-support-banner", "");
+		banner.style.cssText = "padding:12px 16px;background:#fffbe6;border:1px solid #facc15;border-radius:6px;font-family:system-ui;";
+		for (const session of active) {
+			const row = document.createElement("div");
+			row.textContent = `MIDDAG support active (tier ${session.tier}) — ${session.reason}`;
+			if (this.cfg.onRevoke) {
+				const btn = document.createElement("button");
+				btn.textContent = "Revoke";
+				btn.style.marginLeft = "12px";
+				btn.addEventListener("click", () => {
+					this.cfg.onRevoke?.(session.session_id).then(() => this.refresh());
+				});
+				row.appendChild(btn);
+			}
+			banner.appendChild(row);
+		}
+		this.cfg.container.appendChild(banner);
+	}
+};
+//#endregion
+export { AuditBanner };
+
+//# sourceMappingURL=index.js.map

package/dist/remote-support/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../src/remote-support/AuditBanner.ts"],"sourcesContent":["// Optional dashboard banner showing active remote-support sessions.\n// Tenant-facing visibility per ADR-013 extended (tier 3+4 non-consent\n// flows require instant tenant notification).\n//\n// The plugin is responsible for fetching session state — this widget\n// just renders.\n\nexport interface SessionSummary {\n  session_id: string;\n  middag_user_id: string;\n  tier: 1 | 2 | 3 | 4;\n  status: \"pending\" | \"active\" | \"ended\" | \"revoked\" | \"expired\";\n  granted_at: number;\n  reason: string;\n}\n\nexport interface AuditBannerConfig {\n  container: HTMLElement;\n  fetchSessions: () => Promise<SessionSummary[]>;\n  onRevoke?: (sessionId: string) => Promise<void>;\n  pollIntervalMs?: number;\n}\n\nexport class AuditBanner {\n  private cfg: Required<Omit<AuditBannerConfig, \"onRevoke\">> & {\n    onRevoke?: (sessionId: string) => Promise<void>;\n  };\n  private pollHandle: ReturnType<typeof setInterval> | null = null;\n\n  constructor(cfg: AuditBannerConfig) {\n    this.cfg = {\n      container: cfg.container,\n      fetchSessions: cfg.fetchSessions,\n      onRevoke: cfg.onRevoke,\n      pollIntervalMs: cfg.pollIntervalMs ?? 30_000,\n    };\n  }\n\n  async mount(): Promise<void> {\n    await this.refresh();\n    this.pollHandle = setInterval(() => void this.refresh(), this.cfg.pollIntervalMs);\n  }\n\n  unmount(): void {\n    if (this.pollHandle !== null) {\n      clearInterval(this.pollHandle);\n      this.pollHandle = null;\n    }\n    this.cfg.container.innerHTML = \"\";\n  }\n\n  private async refresh(): Promise<void> {\n    const sessions = await this.cfg.fetchSessions();\n    const active = sessions.filter((s) => s.status === \"active\");\n    this.cfg.container.innerHTML = \"\";\n    if (active.length === 0) return;\n    const banner = document.createElement(\"div\");\n    banner.setAttribute(\"data-middag-remote-support-banner\", \"\");\n    banner.style.cssText =\n      \"padding:12px 16px;background:#fffbe6;border:1px solid #facc15;border-radius:6px;font-family:system-ui;\";\n    for (const session of active) {\n      const row = document.createElement(\"div\");\n      row.textContent = `MIDDAG support active (tier ${session.tier}) — ${session.reason}`;\n      if (this.cfg.onRevoke) {\n        const btn = document.createElement(\"button\");\n        btn.textContent = \"Revoke\";\n        btn.style.marginLeft = \"12px\";\n        btn.addEventListener(\"click\", () => {\n          void this.cfg.onRevoke?.(session.session_id).then(() => this.refresh());\n        });\n        row.appendChild(btn);\n      }\n      banner.appendChild(row);\n    }\n    this.cfg.container.appendChild(banner);\n  }\n}\n"],"mappings":";AAuBA,IAAa,cAAb,MAAyB;CACvB;CAGA,aAA4D;CAE5D,YAAY,KAAwB;EAClC,KAAK,MAAM;GACT,WAAW,IAAI;GACf,eAAe,IAAI;GACnB,UAAU,IAAI;GACd,gBAAgB,IAAI,kBAAkB;EACxC;CACF;CAEA,MAAM,QAAuB;EAC3B,MAAM,KAAK,QAAQ;EACnB,KAAK,aAAa,kBAAkB,KAAK,KAAK,QAAQ,GAAG,KAAK,IAAI,cAAc;CAClF;CAEA,UAAgB;EACd,IAAI,KAAK,eAAe,MAAM;GAC5B,cAAc,KAAK,UAAU;GAC7B,KAAK,aAAa;EACpB;EACA,KAAK,IAAI,UAAU,YAAY;CACjC;CAEA,MAAc,UAAyB;EAErC,MAAM,UAAS,MADQ,KAAK,IAAI,cAAc,GACtB,QAAQ,MAAM,EAAE,WAAW,QAAQ;EAC3D,KAAK,IAAI,UAAU,YAAY;EAC/B,IAAI,OAAO,WAAW,GAAG;EACzB,MAAM,SAAS,SAAS,cAAc,KAAK;EAC3C,OAAO,aAAa,qCAAqC,EAAE;EAC3D,OAAO,MAAM,UACX;EACF,KAAK,MAAM,WAAW,QAAQ;GAC5B,MAAM,MAAM,SAAS,cAAc,KAAK;GACxC,IAAI,cAAc,+BAA+B,QAAQ,KAAK,MAAM,QAAQ;GAC5E,IAAI,KAAK,IAAI,UAAU;IACrB,MAAM,MAAM,SAAS,cAAc,QAAQ;IAC3C,IAAI,cAAc;IAClB,IAAI,MAAM,aAAa;IACvB,IAAI,iBAAiB,eAAe;KAClC,KAAU,IAAI,WAAW,QAAQ,UAAU,EAAE,WAAW,KAAK,QAAQ,CAAC;IACxE,CAAC;IACD,IAAI,YAAY,GAAG;GACrB;GACA,OAAO,YAAY,GAAG;EACxB;EACA,KAAK,IAAI,UAAU,YAAY,MAAM;CACvC;AACF"}

package/dist/telemetry/TelemetryClient.d.ts

@@ -0,0 +1,13 @@
+import type { ObservabilityClient } from "../observability/ObservabilityClient.js";
+export declare class TelemetryClient {
+    private readonly obs;
+    constructor(obs: ObservabilityClient);
+    track(eventType: string, payload?: Record<string, unknown>): void;
+}
+export declare class UsageTracker {
+    private readonly client;
+    constructor(client: TelemetryClient);
+    featureUsed(featureKey: string, variant?: string): void;
+    flowCompleted(flowKey: string, stepCount: number): void;
+}
+//# sourceMappingURL=TelemetryClient.d.ts.map

package/dist/telemetry/TelemetryClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TelemetryClient.d.ts","sourceRoot":"","sources":["../../src/telemetry/TelemetryClient.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAEnF,qBAAa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,mBAAmB;IAErD,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;CAGlE;AAED,qBAAa,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,eAAe;IAEpD,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;IAIvD,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;CAGxD"}

package/dist/telemetry/index.d.ts

@@ -0,0 +1,2 @@
+export { TelemetryClient, UsageTracker } from "./TelemetryClient.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/telemetry/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/telemetry/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/telemetry/index.js

@@ -0,0 +1,32 @@
+//#region src/telemetry/TelemetryClient.ts
+var TelemetryClient = class {
+	obs;
+	constructor(obs) {
+		this.obs = obs;
+	}
+	track(eventType, payload) {
+		this.obs.reportAudit(eventType, payload);
+	}
+};
+var UsageTracker = class {
+	client;
+	constructor(client) {
+		this.client = client;
+	}
+	featureUsed(featureKey, variant) {
+		this.client.track("feature_used", {
+			feature: featureKey,
+			variant: variant ?? null
+		});
+	}
+	flowCompleted(flowKey, stepCount) {
+		this.client.track("flow_completed", {
+			flow: flowKey,
+			step_count: stepCount
+		});
+	}
+};
+//#endregion
+export { TelemetryClient, UsageTracker };
+
+//# sourceMappingURL=index.js.map

package/dist/telemetry/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../src/telemetry/TelemetryClient.ts"],"sourcesContent":["// Sugar over ObservabilityClient.reportAudit for non-billable telemetry.\n\nimport type { ObservabilityClient } from \"../observability/ObservabilityClient.js\";\n\nexport class TelemetryClient {\n  constructor(private readonly obs: ObservabilityClient) {}\n\n  track(eventType: string, payload?: Record<string, unknown>): void {\n    this.obs.reportAudit(eventType, payload);\n  }\n}\n\nexport class UsageTracker {\n  constructor(private readonly client: TelemetryClient) {}\n\n  featureUsed(featureKey: string, variant?: string): void {\n    this.client.track(\"feature_used\", { feature: featureKey, variant: variant ?? null });\n  }\n\n  flowCompleted(flowKey: string, stepCount: number): void {\n    this.client.track(\"flow_completed\", { flow: flowKey, step_count: stepCount });\n  }\n}\n"],"mappings":";AAIA,IAAa,kBAAb,MAA6B;CACE;CAA7B,YAAY,KAA2C;EAA1B,KAAA,MAAA;CAA2B;CAExD,MAAM,WAAmB,SAAyC;EAChE,KAAK,IAAI,YAAY,WAAW,OAAO;CACzC;AACF;AAEA,IAAa,eAAb,MAA0B;CACK;CAA7B,YAAY,QAA0C;EAAzB,KAAA,SAAA;CAA0B;CAEvD,YAAY,YAAoB,SAAwB;EACtD,KAAK,OAAO,MAAM,gBAAgB;GAAE,SAAS;GAAY,SAAS,WAAW;EAAK,CAAC;CACrF;CAEA,cAAc,SAAiB,WAAyB;EACtD,KAAK,OAAO,MAAM,kBAAkB;GAAE,MAAM;GAAS,YAAY;EAAU,CAAC;CAC9E;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@middag-io/licensing",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "type": "module",
   "description": "MIDDAG protected code delivery — build-time placeholder injection, manifest contract, and runtime loader for licensed JS modules",
   "repository": {
@@ -29,6 +29,22 @@
     "./client": {
       "import": "./dist/client/index.js",
       "types": "./dist/client/index.d.ts"
+    },
+    "./anti-tamper": {
+      "import": "./dist/anti-tamper/index.js",
+      "types": "./dist/anti-tamper/index.d.ts"
+    },
+    "./observability": {
+      "import": "./dist/observability/index.js",
+      "types": "./dist/observability/index.d.ts"
+    },
+    "./telemetry": {
+      "import": "./dist/telemetry/index.js",
+      "types": "./dist/telemetry/index.d.ts"
+    },
+    "./remote-support": {
+      "import": "./dist/remote-support/index.js",
+      "types": "./dist/remote-support/index.d.ts"
     }
   },
   "files": [