@polishd/next 0.2.2-dev.0 → 0.2.2-dev.2

package/dist/server/telemetry.js

@@ -0,0 +1,60 @@
+/**
+ * Polishd — dogfood telemetry state (server only).
+ *
+ * Polishd can report anonymous usage of its *own dashboard* back to the
+ * polishd project, so the dashboard is improved by the same signals it
+ * preaches. This module owns everything about whether that happens:
+ *
+ *   • Consent, stored in `polishd_meta` — asked once on the dashboard, opt-in,
+ *     nothing is ever sent before the owner says yes.
+ *   • The endpoint — the polishd site's `@polishd/next/telemetry` route,
+ *     overridable for testing via `POLISHD_TELEMETRY_ENDPOINT`.
+ *   • The kill switch — `POLISHD_TELEMETRY=off` (or 0/false/no) disables the
+ *     whole feature, banner included, regardless of stored consent.
+ *
+ * The installation carries no id of its own: the collecting side names it by
+ * the hostname in the request's Origin header, which the browser sets and the
+ * consent prompt discloses. What gets sent is decided by the emitter
+ * (`dashboard/telemetry.tsx`), and is only ever dashboard interaction — never
+ * the host site's analytics, never its visitors' events.
+ */
+import { getMeta, setMeta, storeReady } from "./store";
+/** Where telemetry lands: the polishd site's own installation. */
+export const DEFAULT_TELEMETRY_ENDPOINT = "https://polishd.muskanvaswan.xyz/api/polishd-telemetry";
+const CONSENT_KEY = "telemetry_consent";
+export function telemetryDisabledByEnv() {
+    const v = process.env.POLISHD_TELEMETRY;
+    return v !== undefined && /^(0|false|off|no)$/i.test(v.trim());
+}
+export function resolveTelemetryEndpoint() {
+    return process.env.POLISHD_TELEMETRY_ENDPOINT || DEFAULT_TELEMETRY_ENDPOINT;
+}
+/** Record the owner's decision. Overwrites any previous one. */
+export async function saveTelemetryConsent(granted) {
+    await setMeta(CONSENT_KEY, JSON.stringify({ status: granted ? "granted" : "denied", at: Date.now() }));
+}
+/** What the dashboard should do about telemetry on this render. */
+export async function loadPolishdTelemetryState() {
+    const endpoint = resolveTelemetryEndpoint();
+    if (telemetryDisabledByEnv())
+        return { status: "disabled", endpoint };
+    // Without a writable store there is nowhere to keep the answer, so asking
+    // would mean asking on every single render. Stay quiet instead.
+    if (!(await storeReady()))
+        return { status: "disabled", endpoint };
+    const raw = await getMeta(CONSENT_KEY);
+    if (!raw)
+        return { status: "unset", endpoint };
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed.status === "granted")
+            return { status: "granted", endpoint };
+        if (parsed.status === "denied")
+            return { status: "denied", endpoint };
+    }
+    catch {
+        // Unreadable record — treat as never asked rather than silently sending.
+    }
+    return { status: "unset", endpoint };
+}
+//# sourceMappingURL=telemetry.js.map

package/dist/server/telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../../src/server/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEvD,kEAAkE;AAClE,MAAM,CAAC,MAAM,0BAA0B,GACrC,wDAAwD,CAAC;AAE3D,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAiBxC,MAAM,UAAU,sBAAsB;IACpC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACxC,OAAO,CAAC,KAAK,SAAS,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,0BAA0B,CAAC;AAC9E,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAgB;IACzD,MAAM,OAAO,CACX,WAAW,EACX,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAC7C,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,IAAI,sBAAsB,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IACtE,0EAA0E;IAC1E,gEAAgE;IAChE,IAAI,CAAC,CAAC,MAAM,UAAU,EAAE,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IAEnE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QACvD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QACxE,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC"}

package/dist/shared/types.d.ts

@@ -44,12 +44,30 @@ export interface PolishdIngestBody {
     /** Page that produced this batch, for sanity/debugging. */
     page?: string;
 }
+/**
+ * What a telemetry emitter POSTs to a `@polishd/next/telemetry` route.
+ *
+ * Unlike first-party ingest, the session id travels in the body: the session
+ * cookie is httpOnly and first-party, so a cross-origin POST arrives without
+ * it. The *installation's* identity does not travel in the body at all — the
+ * receiving route derives it from the request's `Origin` header (the
+ * emitter's hostname), which the browser sets and page script cannot forge.
+ */
+export interface PolishdTelemetryBody extends PolishdIngestBody {
+    /** Anonymous session id minted by the emitter (no cookie crosses origins). */
+    sessionId: string;
+}
 /** A stored event row, as it comes back from the database. */
 export interface PolishdEventRow extends PolishdEvent {
     id: number;
     session_id: string;
     /** Server receive time, ms since epoch — authoritative for retention. */
     received_at: number;
+    /**
+     * Hostname of the installation that sent this event (from the request's
+     * Origin header). Only set on telemetry-ingested rows; null on first-party.
+     */
+    install_id?: string;
 }
 /** The set of event types the client is allowed to send. */
 export declare const CLIENT_EVENT_TYPES: ReadonlySet<PolishdEventType>;

package/dist/shared/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/shared/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,2EAA2E;AAC3E,MAAM,MAAM,gBAAgB,GACxB,WAAW,GACX,OAAO,GACP,YAAY,GACZ,YAAY,GACZ,cAAc,GACd,UAAU,GACV,UAAU,GACV,WAAW,GACX,OAAO,GACP,gBAAgB,GAChB,OAAO,GACP,aAAa,GACb,aAAa,CAAC;AAElB;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,gBAAgB,CAAC;IACvB,8EAA8E;IAC9E,EAAE,EAAE,MAAM,CAAC;IACX,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;CACzD;AAED,iDAAiD;AACjD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,8DAA8D;AAC9D,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,4DAA4D;AAC5D,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,gBAAgB,CAc3D,CAAC;AASH,2DAA2D;AAC3D,MAAM,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC/E,mBAAmB;AACnB,MAAM,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAChD,2DAA2D;AAC3D,MAAM,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACtE,+DAA+D;AAC/D,MAAM,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACjD,yBAAyB;AACzB,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE9C,MAAM,WAAW,wBAAwB;IACvC,8BAA8B;IAC9B,CAAC,EAAE,CAAC,CAAC;IACL,oCAAoC;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,oEAAoE;IACpE,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,sDAAsD;IACtD,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACzB,kEAAkE;IAClE,EAAE,EAAE,gBAAgB,EAAE,CAAC;IACvB,mDAAmD;IACnD,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,uDAAuD;IACvD,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,gEAAgE;IAChE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,kEAAkE;IAClE,GAAG,EAAE,cAAc,EAAE,CAAC;CACvB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/shared/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,2EAA2E;AAC3E,MAAM,MAAM,gBAAgB,GACxB,WAAW,GACX,OAAO,GACP,YAAY,GACZ,YAAY,GACZ,cAAc,GACd,UAAU,GACV,UAAU,GACV,WAAW,GACX,OAAO,GACP,gBAAgB,GAChB,OAAO,GACP,aAAa,GACb,aAAa,CAAC;AAElB;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,gBAAgB,CAAC;IACvB,8EAA8E;IAC9E,EAAE,EAAE,MAAM,CAAC;IACX,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;CACzD;AAED,iDAAiD;AACjD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC7D,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,8DAA8D;AAC9D,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,4DAA4D;AAC5D,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,gBAAgB,CAc3D,CAAC;AASH,2DAA2D;AAC3D,MAAM,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC/E,mBAAmB;AACnB,MAAM,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAChD,2DAA2D;AAC3D,MAAM,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACtE,+DAA+D;AAC/D,MAAM,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACjD,yBAAyB;AACzB,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE9C,MAAM,WAAW,wBAAwB;IACvC,8BAA8B;IAC9B,CAAC,EAAE,CAAC,CAAC;IACL,oCAAoC;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,oEAAoE;IACpE,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,sDAAsD;IACtD,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACzB,kEAAkE;IAClE,EAAE,EAAE,gBAAgB,EAAE,CAAC;IACvB,mDAAmD;IACnD,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,uDAAuD;IACvD,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,gEAAgE;IAChE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,kEAAkE;IAClE,GAAG,EAAE,cAAc,EAAE,CAAC;CACvB"}

package/dist/shared/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/shared/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA6DH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,kBAAkB,GAAkC,IAAI,GAAG,CAAmB;IACzF,WAAW;IACX,OAAO;IACP,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,UAAU;IACV,UAAU;IACV,WAAW;IACX,OAAO;IACP,gBAAgB;IAChB,OAAO;IACP,aAAa;IACb,aAAa;CACd,CAAC,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/shared/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAgFH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,kBAAkB,GAAkC,IAAI,GAAG,CAAmB;IACzF,WAAW;IACX,OAAO;IACP,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,UAAU;IACV,UAAU;IACV,WAAW;IACX,OAAO;IACP,gBAAgB;IAChB,OAAO;IACP,aAAa;IACb,aAAa;CACd,CAAC,CAAC"}

package/dist/telemetry.d.ts

@@ -0,0 +1,43 @@
+/**
+ * @polishd/next/telemetry — the cross-install ingest endpoint.
+ *
+ * Mount this in the app that *collects* telemetry from other polishd
+ * installations (for polishd itself, the landing site). It differs from the
+ * first-party `@polishd/next/route` in that it accepts POSTs from any origin:
+ * remote dashboards live on other people's domains, so the endpoint answers
+ * CORS preflights and takes identity from the request body instead of the
+ * first-party session cookie (see `ingestTelemetry` for the full contrast).
+ *
+ * Consumers wire it up with a one-line re-export:
+ *
+ *   // src/app/api/polishd-telemetry/route.ts
+ *   export { POST, OPTIONS, runtime, dynamic } from "@polishd/next/telemetry";
+ *
+ * Or build a configured handler:
+ *
+ *   const { POST, OPTIONS } = createPolishdTelemetryRoute({
+ *     allowedOrigins: ["https://example.com"],
+ *   });
+ */
+import { NextResponse, type NextRequest } from "next/server";
+import { type PolishdConfig } from "./config";
+export declare const runtime = "nodejs";
+export declare const dynamic = "force-dynamic";
+export interface PolishdTelemetryRouteOptions {
+    /**
+     * Origins allowed to POST telemetry. Omit to accept any origin — the right
+     * default here, since dashboards report in from domains that can't be known
+     * in advance. The endpoint never uses cookies or credentialed CORS, so a
+     * wildcard exposes nothing; an allowlist merely narrows who may write.
+     */
+    allowedOrigins?: string[];
+    /** Host-app config overrides (only `enabled` matters to this route). */
+    config?: Partial<PolishdConfig>;
+}
+export declare function createPolishdTelemetryRoute(options?: PolishdTelemetryRouteOptions): {
+    POST: (req: NextRequest) => Promise<NextResponse<import("./server").IngestResult>>;
+    OPTIONS: (req: NextRequest) => Promise<NextResponse<unknown>>;
+};
+/** Default handlers — used by the one-line re-export. */
+export declare const POST: (req: NextRequest) => Promise<NextResponse<import("./server").IngestResult>>, OPTIONS: (req: NextRequest) => Promise<NextResponse<unknown>>;
+//# sourceMappingURL=telemetry.d.ts.map

package/dist/telemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAIpE,eAAO,MAAM,OAAO,WAAW,CAAC;AAEhC,eAAO,MAAM,OAAO,kBAAkB,CAAC;AAEvC,MAAM,WAAW,4BAA4B;IAC3C;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,wEAAwE;IACxE,MAAM,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;CACjC;AAmBD,wBAAgB,2BAA2B,CAAC,OAAO,GAAE,4BAAiC;gBAmB3D,WAAW;mBAdR,WAAW;EAyCxC;AAED,yDAAyD;AACzD,eAAO,MAAQ,IAAI,QA9BQ,WAAW,6DA8BjB,OAAO,QA5CE,WAAW,mCA4CqB,CAAC"}

package/dist/telemetry.js

@@ -0,0 +1,84 @@
+/**
+ * @polishd/next/telemetry — the cross-install ingest endpoint.
+ *
+ * Mount this in the app that *collects* telemetry from other polishd
+ * installations (for polishd itself, the landing site). It differs from the
+ * first-party `@polishd/next/route` in that it accepts POSTs from any origin:
+ * remote dashboards live on other people's domains, so the endpoint answers
+ * CORS preflights and takes identity from the request body instead of the
+ * first-party session cookie (see `ingestTelemetry` for the full contrast).
+ *
+ * Consumers wire it up with a one-line re-export:
+ *
+ *   // src/app/api/polishd-telemetry/route.ts
+ *   export { POST, OPTIONS, runtime, dynamic } from "@polishd/next/telemetry";
+ *
+ * Or build a configured handler:
+ *
+ *   const { POST, OPTIONS } = createPolishdTelemetryRoute({
+ *     allowedOrigins: ["https://example.com"],
+ *   });
+ */
+import { NextResponse } from "next/server";
+import { defaultPolishdConfig } from "./config";
+import { ingestTelemetry, telemetryInstallId } from "./server/ingest";
+// node:sqlite / pg need the Node runtime — never the Edge runtime.
+export const runtime = "nodejs";
+// This route mutates per-request; it must never be statically cached.
+export const dynamic = "force-dynamic";
+/**
+ * CORS response headers for this request, or null when the origin is
+ * disallowed. A request with no Origin header (same-origin, server-to-server)
+ * is outside CORS entirely and passes with no headers added.
+ */
+function corsHeaders(origin, allowedOrigins) {
+    if (!origin)
+        return {};
+    if (!allowedOrigins)
+        return { "Access-Control-Allow-Origin": "*" };
+    if (allowedOrigins.includes(origin)) {
+        return { "Access-Control-Allow-Origin": origin, Vary: "Origin" };
+    }
+    return null;
+}
+export function createPolishdTelemetryRoute(options = {}) {
+    const { allowedOrigins } = options;
+    const cfg = { ...defaultPolishdConfig, ...options.config };
+    /** Answers the browser's CORS preflight for the cross-origin POST. */
+    async function OPTIONS(req) {
+        const cors = corsHeaders(req.headers.get("origin"), allowedOrigins);
+        if (!cors)
+            return new NextResponse(null, { status: 403 });
+        return new NextResponse(null, {
+            status: 204,
+            headers: {
+                ...cors,
+                "Access-Control-Allow-Methods": "POST, OPTIONS",
+                "Access-Control-Allow-Headers": "Content-Type",
+                "Access-Control-Max-Age": "86400",
+            },
+        });
+    }
+    async function POST(req) {
+        const cors = corsHeaders(req.headers.get("origin"), allowedOrigins);
+        if (!cors) {
+            return NextResponse.json({ ok: false, stored: 0, reason: "origin_not_allowed" }, { status: 403 });
+        }
+        let body;
+        try {
+            body = await req.json();
+        }
+        catch {
+            return NextResponse.json({ ok: false, stored: 0, reason: "bad_json" }, { status: 400, headers: cors });
+        }
+        // The reporting installation is named by where the request came from —
+        // the browser-set Origin header — not by anything the payload claims.
+        const install = telemetryInstallId(req.headers.get("origin"), req.headers.get("host"));
+        const result = await ingestTelemetry(body, install, cfg);
+        return NextResponse.json(result, { status: result.ok ? 200 : 400, headers: cors });
+    }
+    return { POST, OPTIONS };
+}
+/** Default handlers — used by the one-line re-export. */
+export const { POST, OPTIONS } = createPolishdTelemetryRoute();
+//# sourceMappingURL=telemetry.js.map

package/dist/telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,YAAY,EAAoB,MAAM,aAAa,CAAC;AAE7D,OAAO,EAAE,oBAAoB,EAAsB,MAAM,UAAU,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAEtE,mEAAmE;AACnE,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC;AAChC,sEAAsE;AACtE,MAAM,CAAC,MAAM,OAAO,GAAG,eAAe,CAAC;AAcvC;;;;GAIG;AACH,SAAS,WAAW,CAClB,MAAqB,EACrB,cAAyB;IAEzB,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAC;IACnE,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,6BAA6B,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,UAAwC,EAAE;IACpF,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IACnC,MAAM,GAAG,GAAG,EAAE,GAAG,oBAAoB,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAE3D,sEAAsE;IACtE,KAAK,UAAU,OAAO,CAAC,GAAgB;QACrC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1D,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE;YAC5B,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,GAAG,IAAI;gBACP,8BAA8B,EAAE,eAAe;gBAC/C,8BAA8B,EAAE,cAAc;gBAC9C,wBAAwB,EAAE,OAAO;aAClC;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,IAAI,CAAC,GAAgB;QAClC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,EACtD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QAED,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAC5C,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAC/B,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,2BAA2B,EAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polishd/next",
-  "version": "0.2.2-dev.0",
+  "version": "0.2.2-dev.2",
   "description": "Drop-in product analytics for Next.js — capture real user behavioral signals (rage/dead clicks, scroll depth, errors, web vitals) and explore them on a built-in dashboard. What gets measured gets improved.",
   "type": "module",
   "license": "MIT",
@@ -57,6 +57,10 @@
       "types": "./dist/route.d.ts",
       "default": "./dist/route.js"
     },
+    "./telemetry": {
+      "types": "./dist/telemetry.d.ts",
+      "default": "./dist/telemetry.js"
+    },
     "./proxy": {
       "types": "./dist/proxy.d.ts",
       "default": "./dist/proxy.js"