@reliantlabs/forge-web-runtime 0.12.0 → 0.13.1

package/README.md

@@ -107,6 +107,18 @@ an opaque external."
 
 ## Browser telemetry (`/telemetry`)
 
+Raw DOM events (including `mousedown`, `mouseup` and `click`) stay in masked
+session replay rather than creating automatic interaction spans. Document loads,
+fetch/XHR requests and explicitly instrumented meaningful actions still create
+spans. The interceptor stack preserves the caller's OTel context across its own
+authentication and telemetry-startup waits; the SDK propagates the actual network
+span's context to configured API origins.
+
+The real Chromium SDK contract test is a separate slow tier:
+`npm run build && npx playwright install chromium && npm run test:browser`.
+It verifies exact action → fetch parent IDs and wire `traceparent`, retains
+mouse events in replay, and checks private text/input sentinels are masked.
+
 `initBrowserTelemetry` starts the HyperDX browser SDK once per page load
 (errors, console, fetch/XHR, page loads, web vitals, optional replay) and ships
 to this origin's `/_otel`. It is a no-op without a DOM or an endpoint and never
@@ -126,6 +138,13 @@ await initBrowserTelemetry({
 });
 ```
 
+One visit is one session (`rum.sessionId`), ending after 15 minutes without
+activity or 4 hours. The SDK keeps the session only in a cookie, so on an origin
+that drops cookies (an Electron renderer served from `app://`) it used to start a
+new session every minute. Init now probes whether cookies persist and, when they
+do not, keeps that one cookie in localStorage under the same limits
+(`installSessionCookieFallback`). Origins whose cookies work are untouched.
+
 `track`, `setTelemetryUser` and `disableTelemetry` come from the barrel, so a
 component can call them without importing the SDK. They are safe anywhere: no-ops
 on the server, and calls made while the SDK chunk is still loading are held
@@ -163,6 +182,38 @@ on the server, and calls made while the SDK chunk is still loading are held
   and the visitor id key; `getAttribution()` is the captured record, for a site
   that stamps campaign values on its own events.
 
+- Client context: init puts the low-entropy client hints of
+  `navigator.userAgentData` on the resource (`browser.brands` as
+  `"Google Chrome 131, Chromium 131"` with GREASE brands dropped,
+  `browser.platform`, `browser.mobile`), and the viewport and screen in CSS
+  pixels on every span (`app.viewport.width|height`, `app.screen.width|height`,
+  restamped once a resize settles). Every value is validated and a malformed
+  one is dropped. Browser, OS and device type are deliberately not reported:
+  the ingest side derives them from the request's `User-Agent` and `Sec-CH-UA*`
+  headers, which page script cannot set. A desktop app's preload exposes its
+  versions as `window.forgeDesktop` (`contextBridge.exposeInMainWorld("forgeDesktop",
+{ appVersion, electronVersion: process.versions.electron, chromiumVersion:
+process.versions.chrome })`), which init stamps as `app.desktop.version`,
+  `app.desktop.electron.version` and `app.desktop.chromium.version`; `/node`
+  stamps the same three on an Electron main process (`app.desktop.version` is
+  its `serviceVersion`).
+
+- Benign browser errors (`classifyBenignError`, `forge.errors_filtered`): an
+  `AbortError` (a cancelled request, an unmounted component, a navigation) and
+  the browser's generic fetch failure (a `TypeError` reading exactly `Failed to
+fetch`, `Load failed` or `NetworkError when attempting to fetch resource.`)
+  are kept out of the error pipeline, whether they arrive as an unhandled
+  rejection, an uncaught error, `console.error` or `reportException`. A
+  `ConnectError` is never filtered. Each filtered error is counted, and the
+  counts go out as `forge.errors_filtered` actions (`kind`, `source`, `count`)
+  at most once a minute and when the page is hidden, so a real wave of network
+  failures still shows. The filter acts on what the SDK RECORDS, never on what
+  the app sees: `window.onerror`, `onunhandledrejection`, every `error` /
+  `unhandledrejection` listener and the console receive every event exactly as
+  without telemetry. `classifyBenignError: () => null` records everything; any
+  `(error) => kind | null` replaces the default (for an unhandled rejection or
+  uncaught error it is handed `{ name, message }` as the SDK recorded them).
+
 Privacy is forced, not configurable: when replay records, all text and inputs
 are masked, canvas is never recorded, `img, picture, video, audio, iframe,
 object, embed` are blocked, images are not inlined and fonts are not collected.

package/dist/benign-errors.d.ts

@@ -0,0 +1,33 @@
+/** Why an error was filtered. */
+export type BenignErrorKind = "abort" | "network";
+/** Where a filtered error was seen. */
+export type BenignErrorSource = "unhandledrejection" | "error" | "console.error" | "reportException";
+/** A classifier: the kind of a benign error, or null for one to keep. */
+export type BenignErrorClassifier = (error: unknown) => string | null;
+/** The action name the counts are emitted under. */
+export declare const FILTERED_ERRORS_ACTION = "forge.errors_filtered";
+/** How often, at most, the counts are flushed while the page is visible. */
+export declare const FILTERED_ERRORS_FLUSH_MS = 60000;
+/**
+ * The default classifier. See the module header for exactly what it filters
+ * and what it never does.
+ */
+export declare function classifyBenignError(error: unknown): BenignErrorKind | null;
+/** Emits one action. Never throws on the caller's behalf: the caller guards it. */
+type Emit = (name: string, attributes: Record<string, string | number>) => void;
+/**
+ * Counts filtered errors and emits them as `forge.errors_filtered` actions.
+ * One instance per running SDK.
+ */
+export declare class FilteredErrorCounter {
+    private readonly emit;
+    private readonly flushMs;
+    private counts;
+    private timer;
+    constructor(emit: Emit, flushMs?: number);
+    /** Count one filtered error. */
+    note(kind: string, source: BenignErrorSource): void;
+    /** Emit every pending count and reset. A no-op with nothing counted. */
+    flush(): void;
+}
+export {};

package/dist/benign-errors.js

@@ -0,0 +1,115 @@
+// Part of @reliantlabs/forge-web-runtime — the web twin of forge/pkg.
+//
+// Errors a browser raises that are not defects, kept out of the error pipeline
+// and counted instead.
+//
+// Two shapes made up most of a real app's browser error_events once Sentry's
+// defaults stopped filtering them (reliant, 2026-10-29: 41 of 45 rows):
+//
+//   - ABORT. An `AbortError` is a cancelled operation: the user navigated away,
+//     a component unmounted, a newer request superseded an older one. When
+//     nobody awaited the promise it surfaces as an unhandled rejection
+//     ("signal is aborted without reason"), and it describes nothing that broke.
+//   - NETWORK. The browser's own generic fetch failure — a TypeError reading
+//     "Failed to fetch" (Chromium, now with " (host)" appended), "Load failed"
+//     (Safari) or "NetworkError when attempting to fetch resource." (Firefox).
+//     The browser says only that the request did not complete: offline, a
+//     captive portal, a tab suspended mid-request. One flaky connection writes
+//     dozens, and they bury the errors that are bugs.
+//
+// A filtered error is not discarded silently: each one is COUNTED, by kind and
+// by where it was seen, and the counts are emitted as one
+// `forge.errors_filtered` action per kind and source at most once a minute (and
+// when the page is hidden), so a real wave of network failures — an outage, a
+// bad deploy of an API — still shows as a spike in that count.
+//
+// What is never filtered: anything that is not exactly those shapes. A
+// ConnectError (a Connect RPC's error, including one that wraps a failed fetch)
+// is the app's own request failing and carries a code and a server trace; it is
+// kept even when its message reads "Failed to fetch". So is a TypeError with
+// any other message, and a non-Error value.
+//
+// The classifier is a seam: BrowserTelemetryConfig.classifyBenignError replaces
+// it, and `() => null` turns filtering off.
+/** The action name the counts are emitted under. */
+export const FILTERED_ERRORS_ACTION = "forge.errors_filtered";
+/** How often, at most, the counts are flushed while the page is visible. */
+export const FILTERED_ERRORS_FLUSH_MS = 60_000;
+// The browsers' generic fetch failures, whole message only. Chromium appends
+// the host in parentheses ("Failed to fetch (api.example.com)").
+const GENERIC_NETWORK_MESSAGE = /^(?:Failed to fetch|Load failed|NetworkError when attempting to fetch resource\.?|Network request failed)(?: \([^()]*\))?$/;
+function nameOf(error) {
+    const name = error.name;
+    return typeof name === "string" ? name : "";
+}
+/**
+ * The default classifier. See the module header for exactly what it filters
+ * and what it never does.
+ */
+export function classifyBenignError(error) {
+    if (typeof error !== "object" || error === null) {
+        return null;
+    }
+    const name = nameOf(error);
+    // A ConnectError is the app's own RPC failing: always kept.
+    if (name === "ConnectError" || name === "ConnectClientError") {
+        return null;
+    }
+    if (name === "AbortError") {
+        return "abort";
+    }
+    if (name === "TypeError") {
+        const message = error.message;
+        if (typeof message === "string" &&
+            GENERIC_NETWORK_MESSAGE.test(message.trim())) {
+            return "network";
+        }
+    }
+    return null;
+}
+/**
+ * Counts filtered errors and emits them as `forge.errors_filtered` actions.
+ * One instance per running SDK.
+ */
+export class FilteredErrorCounter {
+    emit;
+    flushMs;
+    counts = new Map();
+    timer = null;
+    constructor(emit, flushMs = FILTERED_ERRORS_FLUSH_MS) {
+        this.emit = emit;
+        this.flushMs = flushMs;
+    }
+    /** Count one filtered error. */
+    note(kind, source) {
+        const key = `${kind}\u0000${source}`;
+        const entry = this.counts.get(key);
+        if (entry) {
+            entry.count += 1;
+        }
+        else {
+            this.counts.set(key, { kind, source, count: 1 });
+        }
+        if (this.timer === null) {
+            this.timer = setTimeout(() => this.flush(), this.flushMs);
+        }
+    }
+    /** Emit every pending count and reset. A no-op with nothing counted. */
+    flush() {
+        if (this.timer !== null) {
+            clearTimeout(this.timer);
+            this.timer = null;
+        }
+        const pending = [...this.counts.values()];
+        this.counts.clear();
+        for (const { kind, source, count } of pending) {
+            try {
+                this.emit(FILTERED_ERRORS_ACTION, { kind, source, count });
+            }
+            catch {
+                // Telemetry must never break the app.
+            }
+        }
+    }
+}
+//# sourceMappingURL=benign-errors.js.map

package/dist/benign-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"benign-errors.js","sourceRoot":"","sources":["../src/benign-errors.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,+EAA+E;AAC/E,uBAAuB;AACvB,EAAE;AACF,6EAA6E;AAC7E,wEAAwE;AACxE,EAAE;AACF,gFAAgF;AAChF,2EAA2E;AAC3E,uEAAuE;AACvE,iFAAiF;AACjF,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,0EAA0E;AAC1E,+EAA+E;AAC/E,sDAAsD;AACtD,EAAE;AACF,+EAA+E;AAC/E,0DAA0D;AAC1D,gFAAgF;AAChF,8EAA8E;AAC9E,+DAA+D;AAC/D,EAAE;AACF,uEAAuE;AACvE,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,4CAA4C;AAC5C,EAAE;AACF,gFAAgF;AAChF,4CAA4C;AAe5C,oDAAoD;AACpD,MAAM,CAAC,MAAM,sBAAsB,GAAG,uBAAuB,CAAC;AAE9D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C,6EAA6E;AAC7E,iEAAiE;AACjE,MAAM,uBAAuB,GAC3B,4HAA4H,CAAC;AAE/H,SAAS,MAAM,CAAC,KAAa;IAC3B,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;IAChD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,4DAA4D;IAC5D,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAC;QACzD,IACE,OAAO,OAAO,KAAK,QAAQ;YAC3B,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAC5C,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAKD;;;GAGG;AACH,MAAM,OAAO,oBAAoB;IAQZ;IACA;IARX,MAAM,GAAG,IAAI,GAAG,EAGrB,CAAC;IACI,KAAK,GAAyC,IAAI,CAAC;IAE3D,YACmB,IAAU,EACV,UAAkB,wBAAwB;QAD1C,SAAI,GAAJ,IAAI,CAAM;QACV,YAAO,GAAP,OAAO,CAAmC;IAC1D,CAAC;IAEJ,gCAAgC;IAChC,IAAI,CAAC,IAAY,EAAE,MAAyB;QAC1C,MAAM,GAAG,GAAG,GAAG,IAAI,SAAS,MAAM,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,KAAK;QACH,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,sCAAsC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;CACF","sourcesContent":["// Part of @reliantlabs/forge-web-runtime — the web twin of forge/pkg.\n//\n// Errors a browser raises that are not defects, kept out of the error pipeline\n// and counted instead.\n//\n// Two shapes made up most of a real app's browser error_events once Sentry's\n// defaults stopped filtering them (reliant, 2026-10-29: 41 of 45 rows):\n//\n//   - ABORT. An `AbortError` is a cancelled operation: the user navigated away,\n//     a component unmounted, a newer request superseded an older one. When\n//     nobody awaited the promise it surfaces as an unhandled rejection\n//     (\"signal is aborted without reason\"), and it describes nothing that broke.\n//   - NETWORK. The browser's own generic fetch failure — a TypeError reading\n//     \"Failed to fetch\" (Chromium, now with \" (host)\" appended), \"Load failed\"\n//     (Safari) or \"NetworkError when attempting to fetch resource.\" (Firefox).\n//     The browser says only that the request did not complete: offline, a\n//     captive portal, a tab suspended mid-request. One flaky connection writes\n//     dozens, and they bury the errors that are bugs.\n//\n// A filtered error is not discarded silently: each one is COUNTED, by kind and\n// by where it was seen, and the counts are emitted as one\n// `forge.errors_filtered` action per kind and source at most once a minute (and\n// when the page is hidden), so a real wave of network failures — an outage, a\n// bad deploy of an API — still shows as a spike in that count.\n//\n// What is never filtered: anything that is not exactly those shapes. A\n// ConnectError (a Connect RPC's error, including one that wraps a failed fetch)\n// is the app's own request failing and carries a code and a server trace; it is\n// kept even when its message reads \"Failed to fetch\". So is a TypeError with\n// any other message, and a non-Error value.\n//\n// The classifier is a seam: BrowserTelemetryConfig.classifyBenignError replaces\n// it, and `() => null` turns filtering off.\n\n/** Why an error was filtered. */\nexport type BenignErrorKind = \"abort\" | \"network\";\n\n/** Where a filtered error was seen. */\nexport type BenignErrorSource =\n  | \"unhandledrejection\"\n  | \"error\"\n  | \"console.error\"\n  | \"reportException\";\n\n/** A classifier: the kind of a benign error, or null for one to keep. */\nexport type BenignErrorClassifier = (error: unknown) => string | null;\n\n/** The action name the counts are emitted under. */\nexport const FILTERED_ERRORS_ACTION = \"forge.errors_filtered\";\n\n/** How often, at most, the counts are flushed while the page is visible. */\nexport const FILTERED_ERRORS_FLUSH_MS = 60_000;\n\n// The browsers' generic fetch failures, whole message only. Chromium appends\n// the host in parentheses (\"Failed to fetch (api.example.com)\").\nconst GENERIC_NETWORK_MESSAGE =\n  /^(?:Failed to fetch|Load failed|NetworkError when attempting to fetch resource\\.?|Network request failed)(?: \\([^()]*\\))?$/;\n\nfunction nameOf(error: object): string {\n  const name = (error as { name?: unknown }).name;\n  return typeof name === \"string\" ? name : \"\";\n}\n\n/**\n * The default classifier. See the module header for exactly what it filters\n * and what it never does.\n */\nexport function classifyBenignError(error: unknown): BenignErrorKind | null {\n  if (typeof error !== \"object\" || error === null) {\n    return null;\n  }\n  const name = nameOf(error);\n  // A ConnectError is the app's own RPC failing: always kept.\n  if (name === \"ConnectError\" || name === \"ConnectClientError\") {\n    return null;\n  }\n  if (name === \"AbortError\") {\n    return \"abort\";\n  }\n  if (name === \"TypeError\") {\n    const message = (error as { message?: unknown }).message;\n    if (\n      typeof message === \"string\" &&\n      GENERIC_NETWORK_MESSAGE.test(message.trim())\n    ) {\n      return \"network\";\n    }\n  }\n  return null;\n}\n\n/** Emits one action. Never throws on the caller's behalf: the caller guards it. */\ntype Emit = (name: string, attributes: Record<string, string | number>) => void;\n\n/**\n * Counts filtered errors and emits them as `forge.errors_filtered` actions.\n * One instance per running SDK.\n */\nexport class FilteredErrorCounter {\n  private counts = new Map<\n    string,\n    { kind: string; source: string; count: number }\n  >();\n  private timer: ReturnType<typeof setTimeout> | null = null;\n\n  constructor(\n    private readonly emit: Emit,\n    private readonly flushMs: number = FILTERED_ERRORS_FLUSH_MS,\n  ) {}\n\n  /** Count one filtered error. */\n  note(kind: string, source: BenignErrorSource): void {\n    const key = `${kind}\\u0000${source}`;\n    const entry = this.counts.get(key);\n    if (entry) {\n      entry.count += 1;\n    } else {\n      this.counts.set(key, { kind, source, count: 1 });\n    }\n    if (this.timer === null) {\n      this.timer = setTimeout(() => this.flush(), this.flushMs);\n    }\n  }\n\n  /** Emit every pending count and reset. A no-op with nothing counted. */\n  flush(): void {\n    if (this.timer !== null) {\n      clearTimeout(this.timer);\n      this.timer = null;\n    }\n    const pending = [...this.counts.values()];\n    this.counts.clear();\n    for (const { kind, source, count } of pending) {\n      try {\n        this.emit(FILTERED_ERRORS_ACTION, { kind, source, count });\n      } catch {\n        // Telemetry must never break the app.\n      }\n    }\n  }\n}\n"]}

package/dist/client-context.d.ts

@@ -0,0 +1,35 @@
+/** What a desktop preload exposes as `window.forgeDesktop`. */
+export interface ForgeDesktopInfo {
+    appVersion?: string;
+    electronVersion?: string;
+    chromiumVersion?: string;
+}
+/** How long the window must stop resizing before the new size is stamped. */
+export declare const VIEWPORT_DEBOUNCE_MS = 1000;
+/**
+ * The resource attributes a page reports about its client: client hints
+ * and, inside a desktop app, its versions. Pure given its inputs; every value
+ * is validated and anything malformed is dropped, never truncated into
+ * something it was not.
+ */
+export declare function clientResourceAttributes(source: {
+    userAgentData?: unknown;
+    desktop?: unknown;
+}): Record<string, string>;
+/** The span attributes naming this page's viewport and screen, in CSS pixels. */
+export declare function viewportAttributes(win: {
+    innerWidth?: number;
+    innerHeight?: number;
+    screen?: {
+        width?: number;
+        height?: number;
+    };
+}): Record<string, string>;
+/** The client attributes of the running page: never throws, empty without a DOM. */
+export declare function pageClientResourceAttributes(): Record<string, string>;
+/**
+ * Calls `stamp` with the page's viewport attributes now and again, debounced,
+ * whenever the window is resized to a different size. Returns the function
+ * that stops watching. Never throws.
+ */
+export declare function watchViewport(stamp: (attributes: Record<string, string>) => void, win?: Window | undefined): () => void;

package/dist/client-context.js

@@ -0,0 +1,204 @@
+// What a page reports about the client it runs in: its client hints, its
+// viewport and screen, and, inside a desktop app, the app's versions.
+//
+// ── What the page reports, and what it does not ──────────────────────────
+//
+// The structured device facts a console filters on — browser name and
+// version, OS name and version, device type — are NOT reported here. The
+// ingest side derives them from the request's own User-Agent and the
+// browser-set `Sec-CH-UA*` headers (which page script cannot set), and
+// deletes any `user_agent.*`, `os.*` or `reliant.device.type` a page sent
+// before stamping its own. A page can claim anything; the request's headers
+// are the browser's.
+//
+// What only the page can know is reported here, sanitized, under the
+// conventions that say it is page-reported:
+//
+//   browser.brands, browser.platform, browser.mobile   (resource)
+//       navigator.userAgentData, the low-entropy client hints. Brands are
+//       "Name Version" strings with GREASE brands ("Not A;Brand") dropped.
+//       Absent outside Chromium.
+//   app.desktop.version, app.desktop.electron.version,
+//   app.desktop.chromium.version                       (resource)
+//       inside a desktop app, from the preload bridge (below).
+//   app.viewport.width/height, app.screen.width/height (span attributes)
+//       CSS pixels, refreshed (debounced) when the window resizes.
+//
+// browser.language is not repeated: the SDK already stamps it.
+//
+// Nothing here is high-entropy: no getHighEntropyValues() call (it prompts
+// no one but is a fingerprinting surface), no model, no full version list.
+//
+// ── The desktop bridge ───────────────────────────────────────────────────
+//
+// A desktop app's renderer is a page like any other; the app's own version is
+// known only to its main process. The preload exposes it with
+//
+//   contextBridge.exposeInMainWorld("forgeDesktop", {
+//     appVersion,                         // app.getVersion(), from main
+//     electronVersion: process.versions.electron,
+//     chromiumVersion: process.versions.chrome,
+//   });
+//
+// and the runtime reads `window.forgeDesktop` once at startup. A sandboxed
+// preload cannot require this package, so the contract is the global, not a
+// helper. Each value must look like a version (VERSION_RE) or it is dropped.
+/** A version string: `1.8.16`, `1.8.16-dev+7d787d80`, `33.2.1`. */
+const VERSION_RE = /^[0-9A-Za-z][0-9A-Za-z.+_-]{0,63}$/;
+/** A client-hint brand or platform: printable, short, no separators that would confuse a join. */
+const HINT_RE = /^[\x20-\x7e]{1,48}$/;
+/** At most this many brands are kept. Browsers send three. */
+const MAX_BRANDS = 5;
+/** Larger than any real screen in CSS pixels; anything beyond is a lie or a bug. */
+const MAX_PIXELS = 32768;
+/** How long the window must stop resizing before the new size is stamped. */
+export const VIEWPORT_DEBOUNCE_MS = 1000;
+function version(value) {
+    return typeof value === "string" && VERSION_RE.test(value)
+        ? value
+        : undefined;
+}
+function hint(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const v = value.trim();
+    return HINT_RE.test(v) ? v : undefined;
+}
+/**
+ * A GREASE brand: Chromium's deliberately bogus entry ("Not A;Brand",
+ * "Not)A;Brand", "Not_A Brand") that exists to break naive parsers.
+ */
+function isGrease(brand) {
+    return /^not[^a-z]*a[^a-z]*brand$/i.test(brand.replace(/\s+/g, " ").trim());
+}
+/**
+ * The resource attributes a page reports about its client: client hints
+ * and, inside a desktop app, its versions. Pure given its inputs; every value
+ * is validated and anything malformed is dropped, never truncated into
+ * something it was not.
+ */
+export function clientResourceAttributes(source) {
+    const out = {};
+    const ua = source.userAgentData;
+    if (ua && typeof ua === "object") {
+        if (Array.isArray(ua.brands)) {
+            const brands = [];
+            for (const b of ua.brands.slice(0, MAX_BRANDS * 2)) {
+                const name = hint(b?.brand);
+                const v = version(b?.version);
+                if (name && v && !isGrease(name) && !name.includes(",")) {
+                    brands.push(`${name} ${v}`);
+                }
+            }
+            if (brands.length > 0) {
+                // Resource attributes are strings on this SDK; a comma-joined list
+                // is the encoding (brand names never contain one; see above).
+                out["browser.brands"] = brands.slice(0, MAX_BRANDS).join(", ");
+            }
+        }
+        const platform = hint(ua.platform);
+        if (platform) {
+            out["browser.platform"] = platform;
+        }
+        if (typeof ua.mobile === "boolean") {
+            out["browser.mobile"] = String(ua.mobile);
+        }
+    }
+    const desktop = source.desktop;
+    if (desktop && typeof desktop === "object") {
+        const app = version(desktop.appVersion);
+        const electron = version(desktop.electronVersion);
+        const chromium = version(desktop.chromiumVersion);
+        if (app)
+            out["app.desktop.version"] = app;
+        if (electron)
+            out["app.desktop.electron.version"] = electron;
+        if (chromium)
+            out["app.desktop.chromium.version"] = chromium;
+    }
+    return out;
+}
+function pixels(value) {
+    if (typeof value !== "number" || !Number.isFinite(value)) {
+        return undefined;
+    }
+    const n = Math.round(value);
+    return n > 0 && n <= MAX_PIXELS ? String(n) : undefined;
+}
+/** The span attributes naming this page's viewport and screen, in CSS pixels. */
+export function viewportAttributes(win) {
+    const out = {};
+    const vw = pixels(win.innerWidth);
+    const vh = pixels(win.innerHeight);
+    const sw = pixels(win.screen?.width);
+    const sh = pixels(win.screen?.height);
+    // A dimension is kept only with its pair: "1440 x ?" is not a size.
+    if (vw && vh) {
+        out["app.viewport.width"] = vw;
+        out["app.viewport.height"] = vh;
+    }
+    if (sw && sh) {
+        out["app.screen.width"] = sw;
+        out["app.screen.height"] = sh;
+    }
+    return out;
+}
+/** The client attributes of the running page: never throws, empty without a DOM. */
+export function pageClientResourceAttributes() {
+    if (typeof window === "undefined") {
+        return {};
+    }
+    try {
+        return clientResourceAttributes({
+            userAgentData: typeof navigator !== "undefined"
+                ? navigator.userAgentData
+                : undefined,
+            desktop: window.forgeDesktop,
+        });
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Calls `stamp` with the page's viewport attributes now and again, debounced,
+ * whenever the window is resized to a different size. Returns the function
+ * that stops watching. Never throws.
+ */
+export function watchViewport(stamp, win = typeof window !== "undefined" ? window : undefined) {
+    if (!win) {
+        return () => { };
+    }
+    let last = "";
+    const emit = () => {
+        try {
+            const attrs = viewportAttributes(win);
+            const key = JSON.stringify(attrs);
+            if (key !== last && Object.keys(attrs).length > 0) {
+                last = key;
+                stamp(attrs);
+            }
+        }
+        catch {
+            // Telemetry must never break the app.
+        }
+    };
+    emit();
+    if (typeof win.addEventListener !== "function") {
+        return () => { };
+    }
+    let timer;
+    const onResize = () => {
+        if (timer !== undefined)
+            clearTimeout(timer);
+        timer = setTimeout(emit, VIEWPORT_DEBOUNCE_MS);
+    };
+    win.addEventListener("resize", onResize, { passive: true });
+    return () => {
+        if (timer !== undefined)
+            clearTimeout(timer);
+        win.removeEventListener("resize", onResize);
+    };
+}
+//# sourceMappingURL=client-context.js.map

package/dist/client-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-context.js","sourceRoot":"","sources":["../src/client-context.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,sEAAsE;AACtE,EAAE;AACF,4EAA4E;AAC5E,EAAE;AACF,sEAAsE;AACtE,yEAAyE;AACzE,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,4EAA4E;AAC5E,qBAAqB;AACrB,EAAE;AACF,qEAAqE;AACrE,4CAA4C;AAC5C,EAAE;AACF,kEAAkE;AAClE,0EAA0E;AAC1E,2EAA2E;AAC3E,iCAAiC;AACjC,uDAAuD;AACvD,kEAAkE;AAClE,+DAA+D;AAC/D,yEAAyE;AACzE,mEAAmE;AACnE,EAAE;AACF,+DAA+D;AAC/D,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,EAAE;AACF,4EAA4E;AAC5E,EAAE;AACF,8EAA8E;AAC9E,8DAA8D;AAC9D,EAAE;AACF,sDAAsD;AACtD,yEAAyE;AACzE,kDAAkD;AAClD,gDAAgD;AAChD,QAAQ;AACR,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAS7E,mEAAmE;AACnE,MAAM,UAAU,GAAG,oCAAoC,CAAC;AAExD,kGAAkG;AAClG,MAAM,OAAO,GAAG,qBAAqB,CAAC;AAEtC,8DAA8D;AAC9D,MAAM,UAAU,GAAG,CAAC,CAAC;AAErB,oFAAoF;AACpF,MAAM,UAAU,GAAG,KAAK,CAAC;AAEzB,6EAA6E;AAC7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAazC,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QACxD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAGxC;IACC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,EAAE,GAAG,MAAM,CAAC,aAAmC,CAAC;IACtD,IAAI,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAkB,EAAE,CAAC;gBACpE,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC5B,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBAC9B,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,mEAAmE;gBACnE,8DAA8D;gBAC9D,GAAG,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,QAAQ,EAAE,CAAC;YACb,GAAG,CAAC,kBAAkB,CAAC,GAAG,QAAQ,CAAC;QACrC,CAAC;QACD,IAAI,OAAO,EAAE,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACnC,GAAG,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAuC,CAAC;IAC/D,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAClD,IAAI,GAAG;YAAE,GAAG,CAAC,qBAAqB,CAAC,GAAG,GAAG,CAAC;QAC1C,IAAI,QAAQ;YAAE,GAAG,CAAC,8BAA8B,CAAC,GAAG,QAAQ,CAAC;QAC7D,IAAI,QAAQ;YAAE,GAAG,CAAC,8BAA8B,CAAC,GAAG,QAAQ,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,GAIlC;IACC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,oEAAoE;IACpE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QACb,GAAG,CAAC,oBAAoB,CAAC,GAAG,EAAE,CAAC;QAC/B,GAAG,CAAC,qBAAqB,CAAC,GAAG,EAAE,CAAC;IAClC,CAAC;IACD,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QACb,GAAG,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC;QAC7B,GAAG,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,4BAA4B;IAC1C,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,wBAAwB,CAAC;YAC9B,aAAa,EACX,OAAO,SAAS,KAAK,WAAW;gBAC9B,CAAC,CAAE,SAAoD,CAAC,aAAa;gBACrE,CAAC,CAAC,SAAS;YACf,OAAO,EAAG,MAAgD,CAAC,YAAY;SACxE,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAmD,EACnD,MAA0B,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;IAE5E,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,IAAI,GAAG,GAAG,CAAC;gBACX,KAAK,CAAC,KAAK,CAAC,CAAC;YACf,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC,CAAC;IACF,IAAI,EAAE,CAAC;IACP,IAAI,OAAO,GAAG,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;QAC/C,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,KAAgD,CAAC;IACrD,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IACjD,CAAC,CAAC;IACF,GAAG,CAAC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,OAAO,GAAG,EAAE;QACV,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,GAAG,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC,CAAC;AACJ,CAAC","sourcesContent":["// What a page reports about the client it runs in: its client hints, its\n// viewport and screen, and, inside a desktop app, the app's versions.\n//\n// ── What the page reports, and what it does not ──────────────────────────\n//\n// The structured device facts a console filters on — browser name and\n// version, OS name and version, device type — are NOT reported here. The\n// ingest side derives them from the request's own User-Agent and the\n// browser-set `Sec-CH-UA*` headers (which page script cannot set), and\n// deletes any `user_agent.*`, `os.*` or `reliant.device.type` a page sent\n// before stamping its own. A page can claim anything; the request's headers\n// are the browser's.\n//\n// What only the page can know is reported here, sanitized, under the\n// conventions that say it is page-reported:\n//\n//   browser.brands, browser.platform, browser.mobile   (resource)\n//       navigator.userAgentData, the low-entropy client hints. Brands are\n//       \"Name Version\" strings with GREASE brands (\"Not A;Brand\") dropped.\n//       Absent outside Chromium.\n//   app.desktop.version, app.desktop.electron.version,\n//   app.desktop.chromium.version                       (resource)\n//       inside a desktop app, from the preload bridge (below).\n//   app.viewport.width/height, app.screen.width/height (span attributes)\n//       CSS pixels, refreshed (debounced) when the window resizes.\n//\n// browser.language is not repeated: the SDK already stamps it.\n//\n// Nothing here is high-entropy: no getHighEntropyValues() call (it prompts\n// no one but is a fingerprinting surface), no model, no full version list.\n//\n// ── The desktop bridge ───────────────────────────────────────────────────\n//\n// A desktop app's renderer is a page like any other; the app's own version is\n// known only to its main process. The preload exposes it with\n//\n//   contextBridge.exposeInMainWorld(\"forgeDesktop\", {\n//     appVersion,                         // app.getVersion(), from main\n//     electronVersion: process.versions.electron,\n//     chromiumVersion: process.versions.chrome,\n//   });\n//\n// and the runtime reads `window.forgeDesktop` once at startup. A sandboxed\n// preload cannot require this package, so the contract is the global, not a\n// helper. Each value must look like a version (VERSION_RE) or it is dropped.\n\n/** What a desktop preload exposes as `window.forgeDesktop`. */\nexport interface ForgeDesktopInfo {\n  appVersion?: string;\n  electronVersion?: string;\n  chromiumVersion?: string;\n}\n\n/** A version string: `1.8.16`, `1.8.16-dev+7d787d80`, `33.2.1`. */\nconst VERSION_RE = /^[0-9A-Za-z][0-9A-Za-z.+_-]{0,63}$/;\n\n/** A client-hint brand or platform: printable, short, no separators that would confuse a join. */\nconst HINT_RE = /^[\\x20-\\x7e]{1,48}$/;\n\n/** At most this many brands are kept. Browsers send three. */\nconst MAX_BRANDS = 5;\n\n/** Larger than any real screen in CSS pixels; anything beyond is a lie or a bug. */\nconst MAX_PIXELS = 32768;\n\n/** How long the window must stop resizing before the new size is stamped. */\nexport const VIEWPORT_DEBOUNCE_MS = 1000;\n\ninterface UADataBrand {\n  brand?: unknown;\n  version?: unknown;\n}\n\ninterface UAData {\n  brands?: unknown;\n  mobile?: unknown;\n  platform?: unknown;\n}\n\nfunction version(value: unknown): string | undefined {\n  return typeof value === \"string\" && VERSION_RE.test(value)\n    ? value\n    : undefined;\n}\n\nfunction hint(value: unknown): string | undefined {\n  if (typeof value !== \"string\") {\n    return undefined;\n  }\n  const v = value.trim();\n  return HINT_RE.test(v) ? v : undefined;\n}\n\n/**\n * A GREASE brand: Chromium's deliberately bogus entry (\"Not A;Brand\",\n * \"Not)A;Brand\", \"Not_A Brand\") that exists to break naive parsers.\n */\nfunction isGrease(brand: string): boolean {\n  return /^not[^a-z]*a[^a-z]*brand$/i.test(brand.replace(/\\s+/g, \" \").trim());\n}\n\n/**\n * The resource attributes a page reports about its client: client hints\n * and, inside a desktop app, its versions. Pure given its inputs; every value\n * is validated and anything malformed is dropped, never truncated into\n * something it was not.\n */\nexport function clientResourceAttributes(source: {\n  userAgentData?: unknown;\n  desktop?: unknown;\n}): Record<string, string> {\n  const out: Record<string, string> = {};\n  const ua = source.userAgentData as UAData | undefined;\n  if (ua && typeof ua === \"object\") {\n    if (Array.isArray(ua.brands)) {\n      const brands: string[] = [];\n      for (const b of ua.brands.slice(0, MAX_BRANDS * 2) as UADataBrand[]) {\n        const name = hint(b?.brand);\n        const v = version(b?.version);\n        if (name && v && !isGrease(name) && !name.includes(\",\")) {\n          brands.push(`${name} ${v}`);\n        }\n      }\n      if (brands.length > 0) {\n        // Resource attributes are strings on this SDK; a comma-joined list\n        // is the encoding (brand names never contain one; see above).\n        out[\"browser.brands\"] = brands.slice(0, MAX_BRANDS).join(\", \");\n      }\n    }\n    const platform = hint(ua.platform);\n    if (platform) {\n      out[\"browser.platform\"] = platform;\n    }\n    if (typeof ua.mobile === \"boolean\") {\n      out[\"browser.mobile\"] = String(ua.mobile);\n    }\n  }\n  const desktop = source.desktop as ForgeDesktopInfo | undefined;\n  if (desktop && typeof desktop === \"object\") {\n    const app = version(desktop.appVersion);\n    const electron = version(desktop.electronVersion);\n    const chromium = version(desktop.chromiumVersion);\n    if (app) out[\"app.desktop.version\"] = app;\n    if (electron) out[\"app.desktop.electron.version\"] = electron;\n    if (chromium) out[\"app.desktop.chromium.version\"] = chromium;\n  }\n  return out;\n}\n\nfunction pixels(value: unknown): string | undefined {\n  if (typeof value !== \"number\" || !Number.isFinite(value)) {\n    return undefined;\n  }\n  const n = Math.round(value);\n  return n > 0 && n <= MAX_PIXELS ? String(n) : undefined;\n}\n\n/** The span attributes naming this page's viewport and screen, in CSS pixels. */\nexport function viewportAttributes(win: {\n  innerWidth?: number;\n  innerHeight?: number;\n  screen?: { width?: number; height?: number };\n}): Record<string, string> {\n  const out: Record<string, string> = {};\n  const vw = pixels(win.innerWidth);\n  const vh = pixels(win.innerHeight);\n  const sw = pixels(win.screen?.width);\n  const sh = pixels(win.screen?.height);\n  // A dimension is kept only with its pair: \"1440 x ?\" is not a size.\n  if (vw && vh) {\n    out[\"app.viewport.width\"] = vw;\n    out[\"app.viewport.height\"] = vh;\n  }\n  if (sw && sh) {\n    out[\"app.screen.width\"] = sw;\n    out[\"app.screen.height\"] = sh;\n  }\n  return out;\n}\n\n/** The client attributes of the running page: never throws, empty without a DOM. */\nexport function pageClientResourceAttributes(): Record<string, string> {\n  if (typeof window === \"undefined\") {\n    return {};\n  }\n  try {\n    return clientResourceAttributes({\n      userAgentData:\n        typeof navigator !== \"undefined\"\n          ? (navigator as unknown as { userAgentData?: unknown }).userAgentData\n          : undefined,\n      desktop: (window as unknown as { forgeDesktop?: unknown }).forgeDesktop,\n    });\n  } catch {\n    return {};\n  }\n}\n\n/**\n * Calls `stamp` with the page's viewport attributes now and again, debounced,\n * whenever the window is resized to a different size. Returns the function\n * that stops watching. Never throws.\n */\nexport function watchViewport(\n  stamp: (attributes: Record<string, string>) => void,\n  win: Window | undefined = typeof window !== \"undefined\" ? window : undefined,\n): () => void {\n  if (!win) {\n    return () => {};\n  }\n  let last = \"\";\n  const emit = () => {\n    try {\n      const attrs = viewportAttributes(win);\n      const key = JSON.stringify(attrs);\n      if (key !== last && Object.keys(attrs).length > 0) {\n        last = key;\n        stamp(attrs);\n      }\n    } catch {\n      // Telemetry must never break the app.\n    }\n  };\n  emit();\n  if (typeof win.addEventListener !== \"function\") {\n    return () => {};\n  }\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  const onResize = () => {\n    if (timer !== undefined) clearTimeout(timer);\n    timer = setTimeout(emit, VIEWPORT_DEBOUNCE_MS);\n  };\n  win.addEventListener(\"resize\", onResize, { passive: true });\n  return () => {\n    if (timer !== undefined) clearTimeout(timer);\n    win.removeEventListener(\"resize\", onResize);\n  };\n}\n"]}

package/dist/index.d.ts

@@ -35,7 +35,7 @@ export { RuntimeToastHost, type RuntimeToast, type RuntimeToastHostProps, type R
 /** Route guarding: render a page only to a signed-in caller. */
 export { RouteGuard, type RouteGuardProps } from "./route-guard.js";
 /** Generic data-table container: the tristate ladder, filter and cursor pagination. */
-export { Resource, type ResourceColumn, type ResourceProps, type ResourceStatus, } from "./resource.js";
+export { Resource, type ResourceColumn, type ResourceSort, type ResourceProps, type ResourceStatus, } from "./resource.js";
 /**
  * Record a caught error with the browser telemetry SDK, when one is running.
  * A no-op otherwise, so it is safe in any catch block. The SDK itself arrives

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,yEAAyE;AACzE,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,8EAA8E;AAC9E,gEAAgE;AAChE,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,4CAA4C;AAE5C,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,sEAAsE;AAEtE,mCAAmC;AACnC,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,yBAAyB,EACzB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,GAEjB,MAAM,mBAAmB,CAAC;AAE3B;;;GAGG;AACH,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,yBAAyB,EACzB,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,WAAW,GACZ,MAAM,aAAa,CAAC;AAErB;;;;;;GAMG;AACH,OAAO,EACL,cAAc,EACd,YAAY,EACZ,iBAAiB,GAElB,MAAM,eAAe,CAAC;AAEvB;;;;;;;GAOG;AACH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,GAKhB,MAAM,YAAY,CAAC;AAEpB,qCAAqC;AACrC,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,cAAc,EACd,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAEpB,qFAAqF;AACrF,OAAO,EACL,SAAS,EACT,eAAe,EACf,UAAU,GAIX,MAAM,cAAc,CAAC;AAEtB,gFAAgF;AAChF,OAAO,EAAE,YAAY,EAA0B,MAAM,gBAAgB,CAAC;AAEtE,+EAA+E;AAC/E,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,yEAAyE;AACzE,OAAO,EACL,gBAAgB,GAMjB,MAAM,iBAAiB,CAAC;AAEzB,gEAAgE;AAChE,OAAO,EAAE,UAAU,EAAwB,MAAM,kBAAkB,CAAC;AAEpE,uFAAuF;AACvF,OAAO,EACL,QAAQ,GAIT,MAAM,eAAe,CAAC;AAEvB;;;;GAIG;AACH,OAAO,EACL,eAAe,EACf,oBAAoB,GAErB,MAAM,qBAAqB,CAAC;AAE7B,qFAAqF;AACrF,OAAO,EAAE,yBAAyB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAE3E;;;;;;GAMG;AACH,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,GAGN,MAAM,YAAY,CAAC;AAEpB;;;;;;;GAOG;AACH,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,UAAU,EACV,sBAAsB,EACtB,cAAc,EACd,eAAe,GAIhB,MAAM,kBAAkB,CAAC;AAE1B;;;;;;GAMG;AACH,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GAGpB,MAAM,aAAa,CAAC","sourcesContent":["// @reliantlabs/forge-web-runtime — the web twin of forge/pkg.\n//\n// Public barrel. Import batteries from \"@reliantlabs/forge-web-runtime\".\n//\n// Everything here is MECHANISM: the transport interceptor stack, the session,\n// the error boundary, the toast queue, the <Resource> tristate ladder, W3C\n// trace propagation, client RUM. Nothing here reaches into an application —\n// app-shaped values (auth state, event subscriptions, toast markup) arrive as\n// props, so an app can restyle or replace its own files freely.\n//\n// Presentation that a project is meant to own — the component library under\n// src/components/ui, globals.css, nav, layout — deliberately stays in the\n// scaffold and is NOT part of this package.\n\n// The per-group docs below are JSDoc, not `//`, on purpose: TypeScript's\n// declaration emit preserves JSDoc and DROPS line comments, and dist/ is now\n// the whole of what this package publishes. `forge project libraries` reads\n// this inventory out of the published barrel, and a consumer's editor shows\n// it on hover — both would get symbols with no explanation otherwise.\n\n/** Transport interceptor stack. */\nexport {\n  authInterceptor,\n  buildRuntimeInterceptors,\n  errorNormalizeInterceptor,\n  headerInterceptor,\n  retryInterceptor,\n  traceInterceptor,\n  type RuntimeInterceptorConfig,\n} from \"./interceptors.js\";\n\n/**\n * Typed client errors, and the backend-framing strippers every surface that\n * SHOWS an error goes through.\n */\nexport {\n  codeName,\n  ConnectClientError,\n  FORGE_ERROR_REASON_HEADER,\n  isRetryableCode,\n  normalizeError,\n  stripServerFraming,\n  userMessage,\n} from \"./errors.js\";\n\n/**\n * Mount-prefix helpers, for the URLs Next.js's router never sees — absolute\n * URLs handed to external systems that round-trip back into the app.\n *\n * Barrel-exported rather than behind a subpath: three string functions with\n * no imports, so there is no dependency footprint for a subpath to fence off.\n */\nexport {\n  createBasePath,\n  joinBasePath,\n  normalizeBasePath,\n  type BasePathHelpers,\n} from \"./basepath.js\";\n\n/**\n * Money and basis points as integers: format minor units through Intl, and\n * parse form input back to minor units without rounding.\n *\n * The web counterpart of forge/pkg/money — an int64 count of the currency's\n * minor unit plus an ISO 4217 code, exact past 2^53. Barrel-exported for the\n * same reason as the base-path helpers: it imports nothing.\n */\nexport {\n  basisPointsToInput,\n  currencyMinorDigits,\n  formatBasisPoints,\n  formatMinorUnits,\n  minorUnitsToInput,\n  parseBasisPoints,\n  parseMinorUnits,\n  type BasisPointsOptions,\n  type MoneyOptions,\n  type ParseBasisPointsOptions,\n  type ParseMoneyOptions,\n} from \"./money.js\";\n\n/** W3C trace-context propagation. */\nexport {\n  freshTraceparent,\n  injectTraceContext,\n  setTraceSampled,\n  traceIdFrom,\n  TRACEPARENT_RE,\n  TRACERESPONSE_HEADER,\n} from \"./trace.js\";\n\n/** Session: the signed-in user, derived from the app's auth state and JWT claims. */\nexport {\n  decodeJwt,\n  SessionProvider,\n  useSession,\n  type JwtClaims,\n  type Session,\n  type SessionAuth,\n} from \"./session.js\";\n\n/** The app-shell provider set: session + error boundary + toast host in one. */\nexport { RuntimeShell, type RuntimeShellProps } from \"./providers.js\";\n\n/** Error boundary with a designed crash fallback, for a route or a subtree. */\nexport {\n  DefaultErrorFallback,\n  RuntimeErrorBoundary,\n} from \"./error-boundary.js\";\n\n/** The toast queue. The app supplies the event source and the markup. */\nexport {\n  RuntimeToastHost,\n  type RuntimeToast,\n  type RuntimeToastHostProps,\n  type RuntimeToastPayload,\n  type RuntimeToastSink,\n  type RuntimeToastVariant,\n} from \"./toast-host.js\";\n\n/** Route guarding: render a page only to a signed-in caller. */\nexport { RouteGuard, type RouteGuardProps } from \"./route-guard.js\";\n\n/** Generic data-table container: the tristate ladder, filter and cursor pagination. */\nexport {\n  Resource,\n  type ResourceColumn,\n  type ResourceProps,\n  type ResourceStatus,\n} from \"./resource.js\";\n\n/**\n * Record a caught error with the browser telemetry SDK, when one is running.\n * A no-op otherwise, so it is safe in any catch block. The SDK itself arrives\n * through the \"/telemetry\" subpath, never the barrel.\n */\nexport {\n  reportException,\n  setExceptionReporter,\n  type ExceptionAttributes,\n} from \"./error-reporter.js\";\n\n/** The server trace id a failed RPC's error carries (ConnectClientError.traceId). */\nexport { SERVER_TRACE_ID_ATTRIBUTE, serverTraceIdOf } from \"./trace-id.js\";\n\n/**\n * Product events, the signed-in user and the consent kill-switch for browser\n * telemetry. Like reportException these are safe to call anywhere — no-ops on\n * the server and when telemetry is off — and calls made while the SDK is still\n * loading are held and replayed. The SDK itself arrives through the\n * \"/telemetry\" subpath, never the barrel.\n */\nexport {\n  disableTelemetry,\n  setTelemetryUser,\n  track,\n  type TrackProps,\n  type TrackValue,\n} from \"./track.js\";\n\n/**\n * Visitor identity and campaign attribution: `withAttribution(url)` appends\n * this browser's `rid` and captured `utm_*` to an outbound link (a marketing\n * site pointing at the app); the runtime reads them on arrival and emits one\n * `user_identified` event at first sign-in. Consent-gated like track().\n * `getAttribution()` is the captured record (to stamp on a site's own events);\n * the storage keys are exported so a site that withdraws consent can erase them.\n */\nexport {\n  ATTRIBUTION_STORAGE_KEY,\n  IDENTIFIED_USER_STORAGE_KEY,\n  UTM_PARAMS,\n  VISITOR_ID_STORAGE_KEY,\n  getAttribution,\n  withAttribution,\n  type AppClient,\n  type Attribution,\n  type AttributionTouch,\n} from \"./attribution.js\";\n\n/**\n * Dev-only browser log forwarding: mirrors console output and uncaught errors\n * to the dev server, which prints them into\n * `.forge/logs/<env>/frontend_<name>.log`. No-ops unless `dev: true`, and the\n * receiving endpoint exists only in a dev server — so a production bundle\n * neither posts nor has anywhere to post to.\n */\nexport {\n  DEV_LOG_ENDPOINT,\n  devLoggingInstalled,\n  installDevLogging,\n  uninstallDevLogging,\n  type DevLoggingOptions,\n  type DevLogPayload,\n} from \"./devlog.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,yEAAyE;AACzE,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,8EAA8E;AAC9E,gEAAgE;AAChE,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,4CAA4C;AAE5C,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,sEAAsE;AAEtE,mCAAmC;AACnC,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,yBAAyB,EACzB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,GAEjB,MAAM,mBAAmB,CAAC;AAE3B;;;GAGG;AACH,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,yBAAyB,EACzB,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,WAAW,GACZ,MAAM,aAAa,CAAC;AAErB;;;;;;GAMG;AACH,OAAO,EACL,cAAc,EACd,YAAY,EACZ,iBAAiB,GAElB,MAAM,eAAe,CAAC;AAEvB;;;;;;;GAOG;AACH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,GAKhB,MAAM,YAAY,CAAC;AAEpB,qCAAqC;AACrC,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,cAAc,EACd,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAEpB,qFAAqF;AACrF,OAAO,EACL,SAAS,EACT,eAAe,EACf,UAAU,GAIX,MAAM,cAAc,CAAC;AAEtB,gFAAgF;AAChF,OAAO,EAAE,YAAY,EAA0B,MAAM,gBAAgB,CAAC;AAEtE,+EAA+E;AAC/E,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,yEAAyE;AACzE,OAAO,EACL,gBAAgB,GAMjB,MAAM,iBAAiB,CAAC;AAEzB,gEAAgE;AAChE,OAAO,EAAE,UAAU,EAAwB,MAAM,kBAAkB,CAAC;AAEpE,uFAAuF;AACvF,OAAO,EACL,QAAQ,GAKT,MAAM,eAAe,CAAC;AAEvB;;;;GAIG;AACH,OAAO,EACL,eAAe,EACf,oBAAoB,GAErB,MAAM,qBAAqB,CAAC;AAE7B,qFAAqF;AACrF,OAAO,EAAE,yBAAyB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAE3E;;;;;;GAMG;AACH,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,GAGN,MAAM,YAAY,CAAC;AAEpB;;;;;;;GAOG;AACH,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,UAAU,EACV,sBAAsB,EACtB,cAAc,EACd,eAAe,GAIhB,MAAM,kBAAkB,CAAC;AAE1B;;;;;;GAMG;AACH,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GAGpB,MAAM,aAAa,CAAC","sourcesContent":["// @reliantlabs/forge-web-runtime — the web twin of forge/pkg.\n//\n// Public barrel. Import batteries from \"@reliantlabs/forge-web-runtime\".\n//\n// Everything here is MECHANISM: the transport interceptor stack, the session,\n// the error boundary, the toast queue, the <Resource> tristate ladder, W3C\n// trace propagation, client RUM. Nothing here reaches into an application —\n// app-shaped values (auth state, event subscriptions, toast markup) arrive as\n// props, so an app can restyle or replace its own files freely.\n//\n// Presentation that a project is meant to own — the component library under\n// src/components/ui, globals.css, nav, layout — deliberately stays in the\n// scaffold and is NOT part of this package.\n\n// The per-group docs below are JSDoc, not `//`, on purpose: TypeScript's\n// declaration emit preserves JSDoc and DROPS line comments, and dist/ is now\n// the whole of what this package publishes. `forge project libraries` reads\n// this inventory out of the published barrel, and a consumer's editor shows\n// it on hover — both would get symbols with no explanation otherwise.\n\n/** Transport interceptor stack. */\nexport {\n  authInterceptor,\n  buildRuntimeInterceptors,\n  errorNormalizeInterceptor,\n  headerInterceptor,\n  retryInterceptor,\n  traceInterceptor,\n  type RuntimeInterceptorConfig,\n} from \"./interceptors.js\";\n\n/**\n * Typed client errors, and the backend-framing strippers every surface that\n * SHOWS an error goes through.\n */\nexport {\n  codeName,\n  ConnectClientError,\n  FORGE_ERROR_REASON_HEADER,\n  isRetryableCode,\n  normalizeError,\n  stripServerFraming,\n  userMessage,\n} from \"./errors.js\";\n\n/**\n * Mount-prefix helpers, for the URLs Next.js's router never sees — absolute\n * URLs handed to external systems that round-trip back into the app.\n *\n * Barrel-exported rather than behind a subpath: three string functions with\n * no imports, so there is no dependency footprint for a subpath to fence off.\n */\nexport {\n  createBasePath,\n  joinBasePath,\n  normalizeBasePath,\n  type BasePathHelpers,\n} from \"./basepath.js\";\n\n/**\n * Money and basis points as integers: format minor units through Intl, and\n * parse form input back to minor units without rounding.\n *\n * The web counterpart of forge/pkg/money — an int64 count of the currency's\n * minor unit plus an ISO 4217 code, exact past 2^53. Barrel-exported for the\n * same reason as the base-path helpers: it imports nothing.\n */\nexport {\n  basisPointsToInput,\n  currencyMinorDigits,\n  formatBasisPoints,\n  formatMinorUnits,\n  minorUnitsToInput,\n  parseBasisPoints,\n  parseMinorUnits,\n  type BasisPointsOptions,\n  type MoneyOptions,\n  type ParseBasisPointsOptions,\n  type ParseMoneyOptions,\n} from \"./money.js\";\n\n/** W3C trace-context propagation. */\nexport {\n  freshTraceparent,\n  injectTraceContext,\n  setTraceSampled,\n  traceIdFrom,\n  TRACEPARENT_RE,\n  TRACERESPONSE_HEADER,\n} from \"./trace.js\";\n\n/** Session: the signed-in user, derived from the app's auth state and JWT claims. */\nexport {\n  decodeJwt,\n  SessionProvider,\n  useSession,\n  type JwtClaims,\n  type Session,\n  type SessionAuth,\n} from \"./session.js\";\n\n/** The app-shell provider set: session + error boundary + toast host in one. */\nexport { RuntimeShell, type RuntimeShellProps } from \"./providers.js\";\n\n/** Error boundary with a designed crash fallback, for a route or a subtree. */\nexport {\n  DefaultErrorFallback,\n  RuntimeErrorBoundary,\n} from \"./error-boundary.js\";\n\n/** The toast queue. The app supplies the event source and the markup. */\nexport {\n  RuntimeToastHost,\n  type RuntimeToast,\n  type RuntimeToastHostProps,\n  type RuntimeToastPayload,\n  type RuntimeToastSink,\n  type RuntimeToastVariant,\n} from \"./toast-host.js\";\n\n/** Route guarding: render a page only to a signed-in caller. */\nexport { RouteGuard, type RouteGuardProps } from \"./route-guard.js\";\n\n/** Generic data-table container: the tristate ladder, filter and cursor pagination. */\nexport {\n  Resource,\n  type ResourceColumn,\n  type ResourceSort,\n  type ResourceProps,\n  type ResourceStatus,\n} from \"./resource.js\";\n\n/**\n * Record a caught error with the browser telemetry SDK, when one is running.\n * A no-op otherwise, so it is safe in any catch block. The SDK itself arrives\n * through the \"/telemetry\" subpath, never the barrel.\n */\nexport {\n  reportException,\n  setExceptionReporter,\n  type ExceptionAttributes,\n} from \"./error-reporter.js\";\n\n/** The server trace id a failed RPC's error carries (ConnectClientError.traceId). */\nexport { SERVER_TRACE_ID_ATTRIBUTE, serverTraceIdOf } from \"./trace-id.js\";\n\n/**\n * Product events, the signed-in user and the consent kill-switch for browser\n * telemetry. Like reportException these are safe to call anywhere — no-ops on\n * the server and when telemetry is off — and calls made while the SDK is still\n * loading are held and replayed. The SDK itself arrives through the\n * \"/telemetry\" subpath, never the barrel.\n */\nexport {\n  disableTelemetry,\n  setTelemetryUser,\n  track,\n  type TrackProps,\n  type TrackValue,\n} from \"./track.js\";\n\n/**\n * Visitor identity and campaign attribution: `withAttribution(url)` appends\n * this browser's `rid` and captured `utm_*` to an outbound link (a marketing\n * site pointing at the app); the runtime reads them on arrival and emits one\n * `user_identified` event at first sign-in. Consent-gated like track().\n * `getAttribution()` is the captured record (to stamp on a site's own events);\n * the storage keys are exported so a site that withdraws consent can erase them.\n */\nexport {\n  ATTRIBUTION_STORAGE_KEY,\n  IDENTIFIED_USER_STORAGE_KEY,\n  UTM_PARAMS,\n  VISITOR_ID_STORAGE_KEY,\n  getAttribution,\n  withAttribution,\n  type AppClient,\n  type Attribution,\n  type AttributionTouch,\n} from \"./attribution.js\";\n\n/**\n * Dev-only browser log forwarding: mirrors console output and uncaught errors\n * to the dev server, which prints them into\n * `.forge/logs/<env>/frontend_<name>.log`. No-ops unless `dev: true`, and the\n * receiving endpoint exists only in a dev server — so a production bundle\n * neither posts nor has anywhere to post to.\n */\nexport {\n  DEV_LOG_ENDPOINT,\n  devLoggingInstalled,\n  installDevLogging,\n  uninstallDevLogging,\n  type DevLoggingOptions,\n  type DevLogPayload,\n} from \"./devlog.js\";\n"]}

package/dist/interceptors.js

@@ -33,6 +33,7 @@
 // stack two retry layers AND retry non-idempotent mutations — the bug this
 // split fixed.
 import { MethodOptions_IdempotencyLevel } from "@bufbuild/protobuf/wkt";
+import { context } from "@opentelemetry/api";
 import { ConnectClientError, normalizeError } from "./errors.js";
 import { telemetryReady } from "./telemetry-gate.js";
 import { injectTraceContext, traceIdFrom } from "./trace.js";
@@ -40,11 +41,14 @@ const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 /** Attaches the bearer token from the app's auth provider. */
 export function authInterceptor(cfg) {
     return (next) => async (req) => {
+        const parent = context.active();
         const token = cfg.getToken ? await cfg.getToken() : null;
         if (token) {
             req.header.set("Authorization", `Bearer ${token}`);
         }
-        return next(req);
+        // Browser stack context managers cannot carry context through native
+        // await. Restore the caller's context before entering the next boundary.
+        return context.with(parent, () => next(req));
     };
 }
 /** Attaches brand context headers when the app supplies them. */
@@ -67,9 +71,12 @@ export function headerInterceptor(cfg) {
  */
 export function traceInterceptor() {
     return (next) => async (req) => {
+        const parent = context.active();
         await telemetryReady();
-        injectTraceContext(req.header);
-        return next(req);
+        return context.with(parent, () => {
+            injectTraceContext(req.header);
+            return next(req);
+        });
     };
 }
 /** Converts any thrown failure into a typed ConnectClientError. */