@palbase/web 1.7.0 → 1.9.0

package/dist/next/index.cjs

@@ -531,14 +531,47 @@ function unwrap(res) {
   return res.data;
 }
 
+// src/perf/url-redactor.ts
+var ID_SEGMENT = /^(?:\d+|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/;
+var EMAIL_SEGMENT = /(?:@|%40)/i;
+function isSensitiveSegment(seg2) {
+  return ID_SEGMENT.test(seg2) || EMAIL_SEGMENT.test(seg2);
+}
+function redactUrl(rawUrl) {
+  let path = rawUrl;
+  try {
+    path = new URL(rawUrl).pathname;
+  } catch {
+    const q = path.indexOf("?");
+    if (q >= 0) path = path.slice(0, q);
+  }
+  return path.split("/").map((seg2) => isSensitiveSegment(seg2) ? ":id" : seg2).join("/");
+}
+
 // src/request.ts
 var MUTATING = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+var PERF_EXCLUDED_PREFIX = "/v1/analytics/";
+function isSelfTraced(path) {
+  return path.startsWith(PERF_EXCLUDED_PREFIX);
+}
+function nowMs() {
+  return typeof performance !== "undefined" && typeof performance.now === "function" ? performance.now() : Date.now();
+}
+function isAbort(e) {
+  return e instanceof Error && e.name === "AbortError";
+}
 async function palbeRequest(rt, method, path, spec = {}) {
   const headers = { ...spec.headers };
   const callerHasKey = Object.keys(headers).some((k) => k.toLowerCase() === "idempotency-key");
   if (MUTATING.has(method) && !callerHasKey) {
     headers["Idempotency-Key"] = crypto.randomUUID();
   }
+  if (rt.appIdentifier !== "") {
+    const callerHasBundle = Object.keys(headers).some(
+      (k) => k.toLowerCase() === "x-palbase-bundle"
+    );
+    if (!callerHasBundle) headers["X-Palbase-Bundle"] = rt.appIdentifier;
+  }
   const attempt = async () => {
     try {
       return await rt.http.request(method, path, {
@@ -551,21 +584,38 @@ async function palbeRequest(rt, method, path, spec = {}) {
       throw pe ? fromPalbaseError(pe) : e;
     }
   };
-  let res = await attempt();
-  if (res.error?.status === 401 && rt.tokenManager.getRefreshToken() && rt.tokenManager.refreshFunction) {
-    try {
-      await rt.tokenManager.refreshSession();
-    } catch (refreshErr) {
-      const pe = asPalbaseError(refreshErr);
-      const status = pe?.status ?? 0;
-      if (status === 400 || status === 401 || status === 403) {
-        rt.tokenManager.clearSession();
-        throw fromPalbaseError(res.error);
+  const traced = !isSelfTraced(path) && rt.perf !== void 0;
+  const startedAt = traced ? nowMs() : 0;
+  let recorded = false;
+  const record = (status) => {
+    if (!traced || recorded) return;
+    recorded = true;
+    rt.perf.recordNetwork(method, redactUrl(path), status, nowMs() - startedAt);
+  };
+  let res;
+  try {
+    res = await attempt();
+    if (res.error?.status === 401 && rt.tokenManager.getRefreshToken() && rt.tokenManager.refreshFunction) {
+      try {
+        await rt.tokenManager.refreshSession();
+      } catch (refreshErr) {
+        const pe = asPalbaseError(refreshErr);
+        const status = pe?.status ?? 0;
+        if (status === 400 || status === 401 || status === 403) {
+          rt.tokenManager.clearSession();
+          record(res.error.status);
+          throw fromPalbaseError(res.error);
+        }
+        record(pe?.status ?? 0);
+        throw pe ? fromPalbaseError(pe) : refreshErr;
       }
-      throw pe ? fromPalbaseError(pe) : refreshErr;
+      res = await attempt();
     }
-    res = await attempt();
+  } catch (e) {
+    if (!isAbort(e)) record(asPalbaseError(e)?.status ?? 0);
+    throw e;
   }
+  record(res.error?.status ?? 200);
   return unwrap(res);
 }
 
@@ -1415,6 +1465,23 @@ var PalbeAnalytics = class {
   }
 };
 
+// src/app-config.ts
+function loadAppConfig(raw) {
+  if (typeof raw !== "object" || raw === null) {
+    throw new Error("app_config_invalid: expected a JSON object");
+  }
+  const r = raw;
+  const str = (k) => typeof r[k] === "string" ? r[k] : "";
+  return { appId: str("app_id"), identifier: str("identifier"), envPreset: str("env_preset") };
+}
+function assertOriginMatches(cfg, runtimeOrigin) {
+  if (cfg.identifier === "") return;
+  if (runtimeOrigin === "") return;
+  if (runtimeOrigin !== cfg.identifier) {
+    throw new Error(`app_config_mismatch: expected origin ${cfg.identifier}, got ${runtimeOrigin}`);
+  }
+}
+
 // src/auth-facade.ts
 function mapWireUser(raw) {
   return {
@@ -1460,6 +1527,8 @@ var PalbeAuth = class {
   // suppresses AuthClient's TOKEN_REFRESHED during re-signIn
   signedInState = false;
   // dedupes AuthClient's repeated SIGNED_OUT events
+  hydratingUser = false;
+  // guards hydrateUser() to a single boot fetch
   stateListeners = /* @__PURE__ */ new Set();
   eventListeners = /* @__PURE__ */ new Set();
   userListeners = /* @__PURE__ */ new Set();
@@ -1512,13 +1581,37 @@ var PalbeAuth = class {
     if (changed) for (const cb of this.userListeners) this.safeInvoke(() => cb(user));
     return user;
   }
+  /**
+   * Restore the user after a session was rehydrated from storage (page reload).
+   * Hydration in buildRuntime restores the TOKENS synchronously, but the access
+   * token JWT does not carry emailVerified/createdAt, so the full AuthUser can't
+   * be reconstructed offline — this fetches GET /auth/user once and announces
+   * `signedIn`, so the app no longer has to `await pb.auth.refreshUser()` itself
+   * on boot. Idempotent (runs once), browser-safe (no-op when not signed in or
+   * a user is already cached), and never throws (a boot-time network failure
+   * must not break app startup — isSignedIn stays true, the app can retry).
+   */
+  hydrateUser() {
+    if (this.hydratingUser || this.cachedUser || !this.isSignedIn) return;
+    this.hydratingUser = true;
+    void this.refreshUser().then((user) => {
+      if (this.isSignedIn) {
+        this.signedInState = true;
+        this.emitState({ status: "signedIn", user });
+      }
+    }).catch(() => {
+    }).finally(() => {
+      this.hydratingUser = false;
+    });
+  }
   // ── listeners ──────────────────────────────────────────
   /**
    * Subscribe to signed-in/signed-out state. Fires immediately with the
-   * current snapshot (iOS parity). NOTE: a restored session (page reload) has
-   * no cached user yet, so the immediate snapshot reports signedOut even when
-   * `isSignedIn` is true — call `refreshUser()` on boot to populate the user
-   * and rely on `isSignedIn` for the session truth.
+   * current snapshot (iOS parity). A restored session (page reload) hydrates
+   * the user asynchronously via `hydrateUser()` (fired once at boot), so the
+   * FIRST snapshot may report signedOut for a tick even when `isSignedIn` is
+   * true; the listener then fires again with `signedIn` once the user lands.
+   * Rely on `isSignedIn` for the session truth if you need it synchronously.
    */
   onAuthStateChange(callback) {
     this.stateListeners.add(callback);
@@ -7722,6 +7815,469 @@ var PalbeMessaging = class {
   }
 };
 
+// src/perf/app-start.ts
+function measureAppStart(nav) {
+  if (!(nav.fcp > 0)) return null;
+  const value = nav.fcp - nav.startTime;
+  if (value <= 0) return null;
+  return {
+    row_id: crypto.randomUUID(),
+    trace_type: "app_start",
+    name: "cold_start",
+    value,
+    timestamp: Date.now()
+  };
+}
+
+// src/perf/perf-config-client.ts
+var PERF_CONFIG_PATH = "/v1/analytics/perf/config";
+var FNV_OFFSET_BASIS_32 = 2166136261;
+var FNV_PRIME_32 = 16777619;
+var utf82 = typeof TextEncoder !== "undefined" ? new TextEncoder() : { encode: (s) => Uint8Array.from(Buffer.from(s, "utf-8")) };
+function perfSampleBucket(rowId) {
+  let hash = FNV_OFFSET_BASIS_32;
+  for (const byte of utf82.encode(rowId)) {
+    hash ^= byte;
+    hash = Math.imul(hash, FNV_PRIME_32);
+  }
+  return (hash >>> 0) % 100;
+}
+function isPerfConfig(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const o = value;
+  return typeof o.sample_pct === "number";
+}
+function isRawResponse(value) {
+  return typeof value === "object" && value !== null && "data" in value;
+}
+function headerValue(headers, name) {
+  if (!headers) return void 0;
+  const lower = name.toLowerCase();
+  for (const [k, v] of Object.entries(headers)) {
+    if (k.toLowerCase() === lower) return v;
+  }
+  return void 0;
+}
+var PerfConfigClient = class {
+  etag;
+  async fetchConfig(rt, perf) {
+    const headers = {};
+    if (this.etag) headers["If-None-Match"] = this.etag;
+    try {
+      const res = await rt.http.request("GET", PERF_CONFIG_PATH, { headers });
+      if (!isRawResponse(res)) return;
+      if (res.status === 304 || res.error && res.error.status === 304) return;
+      if (res.error) return;
+      const newEtag = headerValue(res.headers, "etag");
+      if (newEtag) this.etag = newEtag;
+      if (isPerfConfig(res.data)) {
+        perf.setSamplePct(res.data.sample_pct);
+      }
+    } catch {
+    }
+  }
+};
+
+// src/perf/fetch-swizzle.ts
+var PERF_EXCLUDED_PREFIX2 = "/v1/analytics/";
+function nowMs2() {
+  return typeof performance !== "undefined" && typeof performance.now === "function" ? performance.now() : Date.now();
+}
+function describeRequest(input, init) {
+  let url;
+  let method = "GET";
+  if (typeof input === "string") {
+    url = input;
+  } else if (input instanceof URL) {
+    url = input.href;
+  } else {
+    url = input.url;
+    method = input.method;
+  }
+  if (init?.method) method = init.method;
+  return { url, method: method.toUpperCase() };
+}
+function pathOf(url) {
+  try {
+    return new URL(url, "http://_local").pathname;
+  } catch {
+    return url;
+  }
+}
+function installFetchSwizzle(perf) {
+  if (typeof fetch !== "function") return () => {
+  };
+  const original = fetch;
+  const wrapped = async (input, init) => {
+    const { url, method } = describeRequest(input, init);
+    const traced = !pathOf(url).startsWith(PERF_EXCLUDED_PREFIX2);
+    const startedAt = traced ? nowMs2() : 0;
+    try {
+      const res = await original(input, init);
+      if (traced) perf.recordNetwork(method, redactUrl(url), res.status, nowMs2() - startedAt);
+      return res;
+    } catch (err) {
+      if (traced) perf.recordNetwork(method, redactUrl(url), 0, nowMs2() - startedAt);
+      throw err;
+    }
+  };
+  globalThis.fetch = wrapped;
+  return () => {
+    globalThis.fetch = original;
+  };
+}
+
+// src/perf/offline-queue.ts
+var PERF_QUEUE_KEY = "palbe.perf.queue";
+var DEFAULT_MAX_ITEMS = 500;
+function canPersist() {
+  return typeof document !== "undefined" && typeof localStorage !== "undefined";
+}
+function isPerfItem(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const o = value;
+  return typeof o.row_id === "string" && typeof o.trace_type === "string" && typeof o.name === "string" && typeof o.value === "number" && typeof o.timestamp === "number";
+}
+function readPersisted() {
+  if (!canPersist()) return [];
+  try {
+    const raw = localStorage.getItem(PERF_QUEUE_KEY);
+    if (!raw) return [];
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed)) return [];
+    return parsed.filter(isPerfItem);
+  } catch {
+    return [];
+  }
+}
+var PerfOfflineQueue = class {
+  items;
+  _dropped = 0;
+  maxItems;
+  constructor(maxItems = DEFAULT_MAX_ITEMS) {
+    this.maxItems = Math.max(1, maxItems);
+    this.items = readPersisted();
+    this.trim();
+  }
+  /** Append items; FIFO-evict the oldest when over `maxItems`. */
+  enqueue(items) {
+    if (items.length === 0) return;
+    this.items.push(...items);
+    this.trim();
+    this.persist();
+  }
+  /** Return all queued items (oldest-first) and clear the queue + store. */
+  drainAll() {
+    if (this.items.length === 0) return [];
+    const out = this.items;
+    this.items = [];
+    this.clearStore();
+    return out;
+  }
+  /** Current queue depth. */
+  get count() {
+    return this.items.length;
+  }
+  /** Cumulative count of FIFO-evicted items (a `dropped` metric, not silent). */
+  get dropped() {
+    return this._dropped;
+  }
+  /** Drop the oldest items until at most `maxItems` remain, counting each. */
+  trim() {
+    const overflow = this.items.length - this.maxItems;
+    if (overflow > 0) {
+      this.items.splice(0, overflow);
+      this._dropped += overflow;
+    }
+  }
+  persist() {
+    if (!canPersist()) return;
+    try {
+      localStorage.setItem(PERF_QUEUE_KEY, JSON.stringify(this.items));
+    } catch {
+    }
+  }
+  clearStore() {
+    if (!canPersist()) return;
+    try {
+      localStorage.removeItem(PERF_QUEUE_KEY);
+    } catch {
+    }
+  }
+};
+
+// src/perf/perf-state.ts
+var MAX_PERF_BATCH = 100;
+var PerfState = class {
+  /** Pending, un-flushed perf items (FIFO). */
+  buffer = [];
+  /** When true, every flush carries `X-Palbase-Test-Device: 1`. */
+  testDevice = false;
+  enqueue(item) {
+    this.buffer.push(item);
+  }
+  /** Detach up to `MAX_PERF_BATCH` items for one POST (FIFO order preserved). */
+  take(limit = MAX_PERF_BATCH) {
+    return this.buffer.splice(0, limit);
+  }
+  get size() {
+    return this.buffer.length;
+  }
+};
+
+// src/perf/perf-wire.ts
+function encodePerfBatch(items) {
+  return { items };
+}
+
+// src/perf/perf-facade.ts
+var FLUSH_AT2 = 20;
+var FLUSH_INTERVAL_MS2 = 1e4;
+var TEST_DEVICE_HEADER = "X-Palbase-Test-Device";
+function nowMs3() {
+  return typeof performance !== "undefined" && typeof performance.now === "function" ? performance.now() : Date.now();
+}
+var PerfTrace = class {
+  constructor(name, onStop) {
+    this.name = name;
+    this.onStop = onStop;
+  }
+  name;
+  onStop;
+  attrs = {};
+  counters = {};
+  startedAt = nowMs3();
+  stopped = false;
+  putAttribute(key, value) {
+    this.attrs[key] = value;
+  }
+  incrementMetric(name, by = 1) {
+    this.counters[name] = (this.counters[name] ?? 0) + by;
+  }
+  stop() {
+    if (this.stopped) return;
+    this.stopped = true;
+    const item = {
+      row_id: crypto.randomUUID(),
+      trace_type: "custom",
+      name: this.name,
+      value: Math.max(0, nowMs3() - this.startedAt),
+      timestamp: Date.now()
+    };
+    if (Object.keys(this.attrs).length > 0) item.attrs = this.attrs;
+    if (Object.keys(this.counters).length > 0) item.counters = this.counters;
+    this.onStop(item);
+  }
+};
+var PalbePerf = class {
+  constructor(rt, state = new PerfState(), queue = new PerfOfflineQueue()) {
+    this.rt = rt;
+    this.state = state;
+    this.queue = queue;
+    if (typeof window !== "undefined" && typeof window.addEventListener === "function") {
+      window.addEventListener("online", this.onOnline);
+    }
+  }
+  rt;
+  state;
+  queue;
+  flushTimer = null;
+  /** Browser → buffer + size/timer flush. Server (no document) → immediate
+   * per-item flush, zero timers (nothing leaks into RSC/route handlers). */
+  browser = typeof document !== "undefined";
+  /** Bound `online` handler so it can be removed on `dispose()` (no leak). */
+  onOnline = () => {
+    void this.flush();
+  };
+  /** Server-controlled client-side sample rate (0..100). 100 until the config
+   * client fetches `/v1/analytics/perf/config` — the SDK obeys this ceiling and
+   * never raises its own rate (invariant 3). `record` drops an item whose
+   * deterministic `row_id` bucket is >= this pct, mirroring the server's
+   * `SampleDecision` so client + server keep the SAME rows. */
+  samplePct = 100;
+  /** Remove the `online` listener. Called when the runtime is replaced so the
+   * handler does not outlive this facade. No-op outside the browser. */
+  dispose() {
+    if (typeof window !== "undefined" && typeof window.removeEventListener === "function") {
+      window.removeEventListener("online", this.onOnline);
+    }
+  }
+  /** Mark (or unmark) this client's traffic as test — the server tags the rows
+   * when the `X-Palbase-Test-Device: 1` header rides along on flush. */
+  setTestDevice(on) {
+    this.state.testDevice = on;
+  }
+  /** Apply the server-resolved client-side sample rate (0..100), clamped. Called
+   * by `PerfConfigClient` after fetching `/v1/analytics/perf/config`. The SDK
+   * OBEYS this value — it is a ceiling, never raised locally. */
+  setSamplePct(pct) {
+    this.samplePct = Math.max(0, Math.min(100, Math.trunc(pct)));
+  }
+  /** Pending (un-flushed) buffer depth. Test-only visibility into the buffer so
+   * the remote-sampling tests can assert how many items were sampled in. */
+  get bufferSizeForTest() {
+    return this.state.size;
+  }
+  /** Opt-in: wrap the global `fetch` so every app-level request is recorded as a
+   * redacted `network` perf item (the `/v1/analytics/*` ingest paths are
+   * self-excluded). OFF by default — swizzling a global is a page-wide side
+   * effect. Returns an `uninstall` that restores the original `fetch`. */
+  enableFetchCapture() {
+    return installFetchSwizzle(this);
+  }
+  /** Start a custom trace; the returned handle records a `custom` item on
+   * `.stop()`. */
+  startTrace(name) {
+    return new PerfTrace(name, (item) => this.record(item));
+  }
+  /** Buffer one perf item. In the browser, flush on size/timer; on the server
+   * flush immediately (no timers). Never throws.
+   *
+   * Client-side remote sampling: an item whose deterministic `row_id` bucket is
+   * NOT below the server-controlled `samplePct` is dropped before buffering —
+   * the SAME FNV-1a-mod-100 decision the server applies at ingest, so the two
+   * keep identical rows and the SDK saves the upload (defense-in-depth: the
+   * server re-samples authoritatively). */
+  record(item) {
+    if (perfSampleBucket(item.row_id) >= this.samplePct) return;
+    this.state.enqueue(item);
+    if (!this.browser) {
+      void this.flush();
+      return;
+    }
+    if (this.state.size >= FLUSH_AT2) void this.flush();
+    else this.startTimer();
+  }
+  /** Buffer a network trace — called by `request.ts` around `rt.http.request`
+   * (the analytics ingest path is excluded by the caller to avoid recursion). */
+  recordNetwork(method, url, status, durationMs, requestId) {
+    const item = {
+      row_id: crypto.randomUUID(),
+      trace_type: "network",
+      name: `${method} ${url}`,
+      value: durationMs,
+      attrs: { status: String(status) },
+      timestamp: Date.now()
+    };
+    if (requestId) item.request_id = requestId;
+    this.record(item);
+  }
+  /** Drain the offline queue (oldest-first) and the live buffer to
+   * `/v1/analytics/perf` (≤100 items per request, sequential). Resolves when
+   * delivery finished; NEVER rejects. A failed slice is NOT dropped — it goes
+   * to the offline queue (persist-on-fail) so the next flush (size/timer or the
+   * `online` reconnect event) retries it. Items keep their original `row_id`,
+   * so a redelivery dedups server-side (ReplacingMergeTree). */
+  async flush() {
+    this.cancelTimer();
+    const pending = this.queue.drainAll();
+    if (pending.length === 0 && this.state.size === 0) return;
+    const headers = this.state.testDevice ? { [TEST_DEVICE_HEADER]: "1" } : void 0;
+    const remaining = [...pending];
+    while (this.state.size > 0) remaining.push(...this.state.take(MAX_PERF_BATCH));
+    for (let i = 0; i < remaining.length; i += MAX_PERF_BATCH) {
+      const slice = remaining.slice(i, i + MAX_PERF_BATCH);
+      try {
+        await palbeRequest(
+          this.rt,
+          "POST",
+          "/v1/analytics/perf",
+          { body: encodePerfBatch(slice), headers }
+        );
+      } catch {
+        this.queue.enqueue(slice);
+      }
+    }
+  }
+  startTimer() {
+    if (this.flushTimer !== null) return;
+    this.flushTimer = setTimeout(() => {
+      this.flushTimer = null;
+      void this.flush();
+    }, FLUSH_INTERVAL_MS2);
+  }
+  cancelTimer() {
+    if (this.flushTimer !== null) {
+      clearTimeout(this.flushTimer);
+      this.flushTimer = null;
+    }
+  }
+};
+
+// src/perf/web-vitals.ts
+function webVitalItem(name, value) {
+  return {
+    row_id: crypto.randomUUID(),
+    trace_type: "web_vital",
+    name,
+    value: Math.max(0, value),
+    timestamp: Date.now()
+  };
+}
+function isLayoutShift(e) {
+  return e.entryType === "layout-shift" && "value" in e && "hadRecentInput" in e;
+}
+function isEventTiming(e) {
+  return e.entryType === "event" || e.entryType === "first-input";
+}
+function safeObserve(type, cb) {
+  if (typeof PerformanceObserver === "undefined") return null;
+  try {
+    const obs = new PerformanceObserver((list) => cb(list.getEntries()));
+    obs.observe({ type, buffered: true });
+    return obs;
+  } catch {
+    return null;
+  }
+}
+function observeWebVitals(record) {
+  if (typeof document === "undefined" || typeof document.addEventListener !== "function" || typeof document.removeEventListener !== "function" || typeof performance === "undefined" || typeof performance.getEntriesByType !== "function") {
+    return () => {
+    };
+  }
+  let cls = 0;
+  let lcp = 0;
+  let inp = 0;
+  const observers = [
+    // LCP: keep the largest/last reported render.
+    safeObserve("largest-contentful-paint", (entries) => {
+      for (const e of entries) lcp = Math.max(lcp, e.startTime);
+    }),
+    // CLS: sum shift values that weren't caused by recent input.
+    safeObserve("layout-shift", (entries) => {
+      for (const e of entries) if (isLayoutShift(e) && !e.hadRecentInput) cls += e.value;
+    }),
+    // INP: approximate as the worst interaction duration observed.
+    safeObserve("event", (entries) => {
+      for (const e of entries) if (isEventTiming(e)) inp = Math.max(inp, e.duration);
+    }),
+    // FCP: one-shot.
+    safeObserve("paint", (entries) => {
+      for (const e of entries)
+        if (e.name === "first-contentful-paint") record(webVitalItem("FCP", e.startTime));
+    })
+  ];
+  const nav = performance.getEntriesByType("navigation")[0];
+  if (nav && nav.responseStart > 0) record(webVitalItem("TTFB", nav.responseStart));
+  let flushed = false;
+  const flush = () => {
+    if (flushed) return;
+    flushed = true;
+    if (lcp > 0) record(webVitalItem("LCP", lcp));
+    record(webVitalItem("CLS", cls));
+    if (inp > 0) record(webVitalItem("INP", inp));
+  };
+  const onHide = () => {
+    if (document.visibilityState === "hidden") flush();
+  };
+  document.addEventListener("visibilitychange", onHide);
+  return () => {
+    flush();
+    document.removeEventListener("visibilitychange", onHide);
+    for (const o of observers) o?.disconnect();
+  };
+}
+
 // src/realtime/anon-token.ts
 var REFRESH_SKEW_MS = 6e4;
 var AnonTokenProvider = class {
@@ -8409,10 +8965,13 @@ function defaultSessionStorage(key) {
 }
 
 // src/version.ts
-var VERSION = "1.7.0";
+var VERSION = "1.9.0";
 
 // src/runtime.ts
 function buildRuntime(config) {
+  const appIdentifier = config.identifier ?? "";
+  const runtimeOrigin = typeof window !== "undefined" && typeof window.location !== "undefined" ? window.location.origin : "";
+  assertOriginMatches(loadAppConfig({ identifier: appIdentifier }), runtimeOrigin);
   const http = new HttpClient(config.apiKey, {
     url: config.url,
     headers: { "X-Client-Info": `palbe-web/${VERSION}`, ...config.headers }
@@ -8462,8 +9021,10 @@ function buildRuntime(config) {
   let analytics;
   let calls;
   let messaging;
+  let perf;
   const rt = {
     config,
+    appIdentifier,
     http,
     tokenManager,
     authClient,
@@ -8499,11 +9060,19 @@ function buildRuntime(config) {
     destroyRealtime() {
       realtime?.destroy();
       realtime = void 0;
+      perf?.dispose();
     },
     // The buffering facade is lazy; its identity state is NOT (below).
     get analytics() {
       if (!analytics) analytics = new PalbeAnalytics(rt, analyticsState);
       return analytics;
+    },
+    // PalPerf is constructed up front (touched below): `request.ts` records a
+    // network trace on EVERY fetch, so it can't be lazy. The memo here only
+    // guards against re-construction.
+    get perf() {
+      if (!perf) perf = new PalbePerf(rt);
+      return perf;
     }
   };
   const analyticsState = new AnalyticsState(rt);
@@ -8511,8 +9080,43 @@ function buildRuntime(config) {
     const hasOwn = Object.keys(request.headers).some((k) => k.toLowerCase() === "x-distinct-id");
     if (!hasOwn) request.headers["X-Distinct-Id"] = analyticsState.distinctId();
   });
+  void rt.perf;
+  if (typeof document !== "undefined") {
+    void new PerfConfigClient().fetchConfig(rt, rt.perf);
+    rt.auth.hydrateUser();
+  }
+  recordColdStart(rt);
+  observeWebVitals((item) => rt.perf.record(item));
   return rt;
 }
+function recordColdStart(rt) {
+  if (typeof document === "undefined" || typeof performance === "undefined") return;
+  try {
+    const navEntry = performance.getEntriesByType("navigation")[0];
+    const startTime = navEntry?.startTime ?? 0;
+    const recordFromFcp = (fcp) => {
+      const item = measureAppStart({ startTime, fcp });
+      if (item) rt.perf.record(item);
+    };
+    const existing = performance.getEntriesByName("first-contentful-paint").find((e) => e.startTime > 0);
+    if (existing) {
+      recordFromFcp(existing.startTime);
+      return;
+    }
+    if (typeof PerformanceObserver === "undefined") return;
+    const observer = new PerformanceObserver((list) => {
+      for (const entry of list.getEntries()) {
+        if (entry.name === "first-contentful-paint") {
+          observer.disconnect();
+          recordFromFcp(entry.startTime);
+          return;
+        }
+      }
+    });
+    observer.observe({ type: "paint", buffered: true });
+  } catch {
+  }
+}
 
 // src/call.ts
 async function callEndpoint(resolveRt, name, input, options) {
@@ -8691,6 +9295,12 @@ function createClientProxy(resolveRt, nsAccessor) {
     },
     get messaging() {
       return resolveRt().messaging;
+    },
+    get perf() {
+      return resolveRt().perf;
+    },
+    setTestDevice(on) {
+      resolveRt().perf.setTestDevice(on);
     }
   };
   return new Proxy(base, {