@scalebun-release/web 2.2.2

package/dist/features/session/sessionManager.js

@@ -0,0 +1,67 @@
+/**
+ * Owns the session identity + the static client/device/app/context blocks for every envelope.
+ *
+ * The session id is PERSISTED (see ./sessionStore) rather than minted per document, so a refresh or
+ * a second tab continues the same session instead of starting a new one. Boundary rules live in the
+ * store; this stays a thin header source.
+ */
+import { getOrCreateDeviceId, buildClient, buildDevice, buildApp, buildContext } from '../../core/index.js';
+import { resolveSession, sessionExpired, touchSession, DEFAULT_SESSION_TIMEOUT_MS, DEFAULT_SESSION_MAX_MS, } from './sessionStore.js';
+export class SessionManager {
+    /** The session every envelope is filed under. A GETTER, not a field: `rotate()` can replace it
+     *  while the page is open, and every reader picks the new id up on its next envelope. */
+    get sessionId() {
+        return this.id;
+    }
+    get timeoutMs() {
+        return this.config.sessionTimeoutMs ?? DEFAULT_SESSION_TIMEOUT_MS;
+    }
+    get maxMs() {
+        return this.config.sessionMaxDurationMs ?? DEFAULT_SESSION_MAX_MS;
+    }
+    constructor(config) {
+        this.config = config;
+        this.id = resolveSession(this.timeoutMs, this.maxMs).id;
+        this.deviceId = getOrCreateDeviceId();
+    }
+    /** Has this session crossed the idle window or the absolute cap? Pure read — see sessionStore. */
+    expired() {
+        return sessionExpired(this.timeoutMs, this.maxMs);
+    }
+    /**
+     * End the current session and begin a new one, returning the id that just ended (or null when the
+     * bounds have not been crossed and nothing changed).
+     *
+     * The caller owns the ORDER, and it matters: whatever is still queued belongs to the session that
+     * just ended and has to leave under the old id, so the drain happens before this is called. See
+     * `installSessionRotation` in the bootstrap, which is the only caller.
+     */
+    rotate() {
+        if (!this.expired())
+            return null;
+        const prev = this.id;
+        // Expired, so this mints a fresh record rather than resuming — new id, and `seq` back to 0,
+        // which is what keeps the new session's replay frames from sorting against the old one's.
+        this.id = resolveSession(this.timeoutMs, this.maxMs).id;
+        return prev;
+    }
+    client() {
+        return buildClient();
+    }
+    device() {
+        return buildDevice(this.deviceId);
+    }
+    app() {
+        return buildApp(this.config);
+    }
+    /**
+     * Called once per outgoing envelope, which makes it the one hook that runs for EVERY feature
+     * without needing a listener of its own — so activity slides the inactivity window even in an
+     * SPA that never reloads and never records replay. `touchSession` throttles the write.
+     */
+    context() {
+        touchSession();
+        return buildContext();
+    }
+}
+//# sourceMappingURL=sessionManager.js.map

package/dist/features/session/sessionManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionManager.js","sourceRoot":"","sources":["../../../src/features/session/sessionManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACnG,OAAO,EACL,cAAc,EACd,cAAc,EACd,YAAY,EACZ,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAExB,MAAM,OAAO,cAAc;IAIzB;6FACyF;IACzF,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED,IAAY,SAAS;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IACpE,CAAC;IACD,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI,sBAAsB,CAAC;IACpE,CAAC;IAED,YAA6B,MAAsB;QAAtB,WAAM,GAAN,MAAM,CAAgB;QACjD,IAAI,CAAC,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACxC,CAAC;IAED,kGAAkG;IAClG,OAAO;QACL,OAAO,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;OAOG;IACH,MAAM;QACJ,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACrB,4FAA4F;QAC5F,0FAA0F;QAC1F,IAAI,CAAC,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM;QACJ,OAAO,WAAW,EAAE,CAAC;IACvB,CAAC;IACD,MAAM;QACJ,OAAO,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IACD,GAAG;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD;;;;OAIG;IACH,OAAO;QACL,YAAY,EAAE,CAAC;QACf,OAAO,YAAY,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/features/session/sessionStore.d.ts

@@ -0,0 +1,137 @@
+/**
+ * Persisted web session identity.
+ *
+ * THE BUG THIS FIXES
+ * `SessionManager` minted `sess_${uuid()}` in its constructor and stored it nowhere, so EVERY
+ * document load started a new session. A refresh, a hard navigation, or opening the same app in a
+ * second tab each produced a separate "visit" — session replay showed a user's single journey as a
+ * pile of disconnected 10-second sessions, and every session-scoped metric (duration, events per
+ * session, rage-click grouping) was measured against the wrong denominator.
+ *
+ * WHAT A SESSION IS NOW
+ * One session continues across refreshes and navigations within a browsing context, and ends when
+ * that context goes away (the tab or browser is closed), after a period of inactivity (default 30
+ * minutes), or once it hits an absolute cap (default 24 hours, so a tab left open for days cannot
+ * produce an infinite session).
+ *
+ * WHY sessionStorage AND NOT localStorage
+ * This first shipped on localStorage, following the GA/analytics definition of a session: storage
+ * that outlives the browsing context, expired purely by a 30-minute idle timer. That is correct for
+ * analytics and WRONG here — it meant closing the site and returning a minute later resumed the old
+ * session, because "closed the browser" is not an end signal in that model. For session REPLAY a
+ * visit ends when the visit ends.
+ *
+ * sessionStorage is scoped to the browsing context: it survives refreshes and same-tab navigations
+ * (the actual bug this file exists to fix) and is dropped when the tab closes. The idle timeout is
+ * kept on top of it so a tab left open overnight still rolls over.
+ *
+ * The tradeoff, stated plainly: sessionStorage is per-TAB, so opening a link in a new tab starts a
+ * new session. For replay that is arguably the better shape anyway — frames are per-document, and
+ * two tabs sharing one session means two writers interleaving into a single `seq` space (see below).
+ * Caveat: browsers that restore tabs after a crash also restore sessionStorage, so crash → "restore
+ * tabs" can resume; crash → reopening manually starts fresh.
+ *
+ * THE SEQUENCE COUNTER LIVES HERE TOO, DELIBERATELY
+ * Replay frames carry a per-session `seq`, and the backend both orders frames by it
+ * (`orderBy: { sequenceNumber: 'asc' }`) and resolves a keyframe's deltas as the frames in
+ * `[seq, nextSeq)`. The recorder's counter is per-INSTANCE and restarts at 0 on every page load, so
+ * resuming a session without also resuming the counter would emit a second frame 0, 1, 2… that
+ * sorts *before* the first load's later frames and scrambles the replay. Persisting the id without
+ * the counter would have traded a visible bug for a subtler one.
+ */
+/** Inactivity that ends a session. 30 min is the de-facto standard (GA, and most RUM tools). */
+export declare const DEFAULT_SESSION_TIMEOUT_MS: number;
+/**
+ * Hard cap so a tab left open for days does not report one endless session.
+ *
+ * 4 HOURS, lowered from 24. A 24-hour cap describes a DEVICE, not a visit: measured on live Joint
+ * Clinic data, clinic workstations left open across a shift produced single sessions of 100, 98 and 79
+ * minutes, and the cap was the only thing bounding them. Four hours is longer than any genuine sitting
+ * while still splitting a shift into a handful of sessions instead of one.
+ *
+ * ⚠️ This moves SESSION COUNTS, and therefore every per-session metric (sessions/day, per-session
+ * averages, conversion-per-session). It is a deliberate product change, not a refactor — hosts who
+ * want the old behaviour set `sessionMaxDurationMs: 86_400_000`.
+ */
+export declare const DEFAULT_SESSION_MAX_MS: number;
+export interface SessionRecord {
+    id: string;
+    /** When this session began — drives the absolute cap. */
+    startedAt: number;
+    /** Last activity we observed — drives the inactivity timeout. */
+    lastSeenAt: number;
+    /** Next replay frame sequence number for this session. */
+    seq: number;
+}
+/**
+ * Resume the stored session when it is still live, otherwise start a fresh one.
+ *
+ * Clock note: `lastSeenAt` is wall-clock, so a large system-clock change can expire a session early
+ * or hold one open. Expiring early is the safe direction, and a negative delta (clock moved
+ * backwards) is treated as "no time passed" rather than as a huge idle gap.
+ */
+export declare function resolveSession(timeoutMs?: number, maxMs?: number): SessionRecord;
+/**
+ * Has the stored session crossed a boundary? The same rule `resolveSession` applies at load, asked
+ * at any moment — and it is a pure read, so asking cannot itself extend the session.
+ *
+ * WHY THIS EXISTS. `resolveSession` is called exactly once, from the `SessionManager` constructor,
+ * so both bounds were only ever evaluated at document load. A single-page app that is opened and
+ * never reloaded was therefore never re-evaluated, and neither bound could fire. Measured on
+ * production over 14 days: 141 web sessions ran past the four-hour cap and exactly 2 were capped by
+ * it. The rest were held open until the server's reaper clamped them at 24 hours — real spans of 24
+ * to 28 hours, each carrying a single event and one or two frames. Parked tabs, reported as visits.
+ *
+ * `read()` first because it is the persisted truth; `live` covers a host that has cleared storage
+ * out from under us (see the note below), where the in-memory copy is all that is left.
+ */
+export declare function sessionExpired(timeoutMs?: number, maxMs?: number): boolean;
+/** Test seam — drop the in-memory copy so a case can simulate a fresh document. */
+export declare function __resetLiveSessionForTests(): void;
+/**
+ * Mark activity so the inactivity window slides forward.
+ *
+ * Called on the per-envelope path, so it is THROTTLED: without this a busy page would do a
+ * JSON parse + sessionStorage write per event, and sessionStorage is synchronous — that is main-thread
+ * work on the hot path. Once a minute is far finer than the 30-minute window it feeds.
+ */
+export declare function touchSession(): void;
+/**
+ * Reserve `count` sequence numbers and return the first.
+ *
+ * Read-modify-write against storage rather than a purely in-memory counter, so the counter SURVIVES
+ * a refresh: a resumed session must keep numbering upward instead of restarting at 0 and sorting its
+ * new frames before the old ones.
+ *
+ * Since the move to sessionStorage the store is per-tab, so the cross-tab contention this used to
+ * guard against cannot arise — two tabs now hold two different sessions, each with its own counter.
+ */
+export declare function reserveSeq(count?: number): number;
+/**
+ * Raise the next-sequence floor, returning it.
+ *
+ * Crash recovery replays a pre-roll buffer whose frames ALREADY consumed sequence numbers, but those
+ * frames were written by a previous document and the store knows nothing about them. Without this the
+ * counter would hand the same numbers out again and the recovered frames would collide with the new
+ * session's — the exact ordering corruption the persisted counter exists to prevent.
+ */
+export declare function ensureSeqAtLeast(next: number): number;
+/**
+ * Drop the stored session so the next `resolveSession()` mints a new id.
+ *
+ * ⚠️ NOT called by `reset()`, and it must not be. The docstring here used to claim "Used by
+ * `reset()` / logout", which is false in both halves — it has no callers at all, and wiring it to
+ * logout would reintroduce the exact bug the `live` copy and the self-heal in `touchSession` were
+ * built to prevent: see the WHY A SECOND COPY note above, where "I logged out in the same tab and
+ * got a new session" is the report being fixed.
+ *
+ * Signing out does not end a visit. The person is still in the same tab, and `AnalyticsFeature.reset()`
+ * already does the part that genuinely must change — a fresh anonymous id, cleared user id,
+ * super-properties and groups — so the next user is never attributed to the previous one. The session
+ * is the visit, not the identity.
+ *
+ * This exists for a host that wants an explicit hard boundary and knows it is asking for one. It is
+ * currently unused; keep it, but reach for it deliberately.
+ */
+export declare function clearSession(): void;
+//# sourceMappingURL=sessionStore.d.ts.map

package/dist/features/session/sessionStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionStore.d.ts","sourceRoot":"","sources":["../../../src/features/session/sessionStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAMH,gGAAgG;AAChG,eAAO,MAAM,0BAA0B,QAAiB,CAAC;AACzD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,QAAqB,CAAC;AAEzD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAC;CACb;AAwDD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,SAAS,GAAE,MAAmC,EAC9C,KAAK,GAAE,MAA+B,GACrC,aAAa,CAgBf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAC5B,SAAS,GAAE,MAAmC,EAC9C,KAAK,GAAE,MAA+B,GACrC,OAAO,CAOT;AAoBD,mFAAmF;AACnF,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAMD;;;;;;GAMG;AACH,wBAAgB,YAAY,IAAI,IAAI,CAgDnC;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,KAAK,SAAI,GAAG,MAAM,CAkC5C;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAWrD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,IAAI,IAAI,CAMnC"}

package/dist/features/session/sessionStore.js

@@ -0,0 +1,323 @@
+/**
+ * Persisted web session identity.
+ *
+ * THE BUG THIS FIXES
+ * `SessionManager` minted `sess_${uuid()}` in its constructor and stored it nowhere, so EVERY
+ * document load started a new session. A refresh, a hard navigation, or opening the same app in a
+ * second tab each produced a separate "visit" — session replay showed a user's single journey as a
+ * pile of disconnected 10-second sessions, and every session-scoped metric (duration, events per
+ * session, rage-click grouping) was measured against the wrong denominator.
+ *
+ * WHAT A SESSION IS NOW
+ * One session continues across refreshes and navigations within a browsing context, and ends when
+ * that context goes away (the tab or browser is closed), after a period of inactivity (default 30
+ * minutes), or once it hits an absolute cap (default 24 hours, so a tab left open for days cannot
+ * produce an infinite session).
+ *
+ * WHY sessionStorage AND NOT localStorage
+ * This first shipped on localStorage, following the GA/analytics definition of a session: storage
+ * that outlives the browsing context, expired purely by a 30-minute idle timer. That is correct for
+ * analytics and WRONG here — it meant closing the site and returning a minute later resumed the old
+ * session, because "closed the browser" is not an end signal in that model. For session REPLAY a
+ * visit ends when the visit ends.
+ *
+ * sessionStorage is scoped to the browsing context: it survives refreshes and same-tab navigations
+ * (the actual bug this file exists to fix) and is dropped when the tab closes. The idle timeout is
+ * kept on top of it so a tab left open overnight still rolls over.
+ *
+ * The tradeoff, stated plainly: sessionStorage is per-TAB, so opening a link in a new tab starts a
+ * new session. For replay that is arguably the better shape anyway — frames are per-document, and
+ * two tabs sharing one session means two writers interleaving into a single `seq` space (see below).
+ * Caveat: browsers that restore tabs after a crash also restore sessionStorage, so crash → "restore
+ * tabs" can resume; crash → reopening manually starts fresh.
+ *
+ * THE SEQUENCE COUNTER LIVES HERE TOO, DELIBERATELY
+ * Replay frames carry a per-session `seq`, and the backend both orders frames by it
+ * (`orderBy: { sequenceNumber: 'asc' }`) and resolves a keyframe's deltas as the frames in
+ * `[seq, nextSeq)`. The recorder's counter is per-INSTANCE and restarts at 0 on every page load, so
+ * resuming a session without also resuming the counter would emit a second frame 0, 1, 2… that
+ * sorts *before* the first load's later frames and scrambles the replay. Persisting the id without
+ * the counter would have traded a visible bug for a subtler one.
+ */
+import { uuid, now } from '../../core/index.js';
+const SESSION_KEY = 'scalebun_session';
+/** Inactivity that ends a session. 30 min is the de-facto standard (GA, and most RUM tools). */
+export const DEFAULT_SESSION_TIMEOUT_MS = 30 * 60 * 1000;
+/**
+ * Hard cap so a tab left open for days does not report one endless session.
+ *
+ * 4 HOURS, lowered from 24. A 24-hour cap describes a DEVICE, not a visit: measured on live Joint
+ * Clinic data, clinic workstations left open across a shift produced single sessions of 100, 98 and 79
+ * minutes, and the cap was the only thing bounding them. Four hours is longer than any genuine sitting
+ * while still splitting a shift into a handful of sessions instead of one.
+ *
+ * ⚠️ This moves SESSION COUNTS, and therefore every per-session metric (sessions/day, per-session
+ * averages, conversion-per-session). It is a deliberate product change, not a refactor — hosts who
+ * want the old behaviour set `sessionMaxDurationMs: 86_400_000`.
+ */
+export const DEFAULT_SESSION_MAX_MS = 4 * 60 * 60 * 1000;
+function read() {
+    try {
+        const raw = typeof sessionStorage !== 'undefined' && sessionStorage.getItem(SESSION_KEY);
+        if (!raw)
+            return null;
+        const a = JSON.parse(raw);
+        // A truncated or hand-edited record must not resurrect a broken session.
+        if (!Array.isArray(a) || typeof a[0] !== 'string' || !a[0] || typeof a[2] !== 'number')
+            return null;
+        /**
+         * `startedAt` gets the SAME scrutiny as `lastSeenAt`, and falls back to `lastSeenAt` — never 0.
+         *
+         * It used to be `+a[1] || 0`, which was validated by nothing. A record whose startedAt did not
+         * parse therefore resolved to epoch 0, and `resolveSession`'s absolute-cap check
+         * (`t - startedAt <= maxMs`) then measured ~56 YEARS and killed the session on the very next load
+         * — silently, and forever, because each replacement was written by the same code path. The visible
+         * symptom is a brand-new session id seconds after a perfectly good one, which is indistinguishable
+         * from "the SDK does not persist sessions at all".
+         *
+         * Falling back to `lastSeenAt` keeps the session alive and merely under-measures its age, which is
+         * the safe direction: the worst case is one session that runs to the idle timeout instead of the
+         * cap, rather than a user's whole visit shattered into fragments.
+         */
+        const started = typeof a[1] === 'number' && isFinite(a[1]) && a[1] > 0 ? a[1] : a[2];
+        return { id: a[0], startedAt: started, lastSeenAt: a[2], seq: a[3] > 0 ? a[3] : 0 };
+    }
+    catch {
+        return null; // storage blocked (private mode / partitioned) or unparsable
+    }
+}
+function write(r) {
+    // Every persist keeps the in-memory copy current, so a restore can never write back a STALER record
+    // than the one in use. Doing this anywhere but here drifts: `reserveSeq` advances the frame counter
+    // far more often than the throttled `touchSession` runs, so a restore that had only seen the load-time
+    // record would reset `seq` to 0 — and frames numbered from 0 sort BEFORE the earlier ones, which is
+    // the exact replay scramble this file's header warns about.
+    live = r;
+    try {
+        if (typeof sessionStorage !== 'undefined') {
+            sessionStorage.setItem(SESSION_KEY, JSON.stringify([r.id, r.startedAt, r.lastSeenAt, r.seq]));
+        }
+    }
+    catch {
+        /* quota or blocked storage → session stays in-memory for this document */
+    }
+}
+/**
+ * Resume the stored session when it is still live, otherwise start a fresh one.
+ *
+ * Clock note: `lastSeenAt` is wall-clock, so a large system-clock change can expire a session early
+ * or hold one open. Expiring early is the safe direction, and a negative delta (clock moved
+ * backwards) is treated as "no time passed" rather than as a huge idle gap.
+ */
+export function resolveSession(timeoutMs = DEFAULT_SESSION_TIMEOUT_MS, maxMs = DEFAULT_SESSION_MAX_MS) {
+    const t = now();
+    const prev = read();
+    // Math.max(0, …) so a backwards clock jump reads as "no time passed" rather than a huge idle gap.
+    if (prev && Math.max(0, t - prev.lastSeenAt) <= timeoutMs && Math.max(0, t - prev.startedAt) <= maxMs) {
+        prev.lastSeenAt = t;
+        write(prev);
+        live = prev;
+        return prev;
+    }
+    const fresh = { id: `sess_${uuid()}`, startedAt: t, lastSeenAt: t, seq: 0 };
+    write(fresh);
+    live = fresh;
+    return fresh;
+}
+/**
+ * Has the stored session crossed a boundary? The same rule `resolveSession` applies at load, asked
+ * at any moment — and it is a pure read, so asking cannot itself extend the session.
+ *
+ * WHY THIS EXISTS. `resolveSession` is called exactly once, from the `SessionManager` constructor,
+ * so both bounds were only ever evaluated at document load. A single-page app that is opened and
+ * never reloaded was therefore never re-evaluated, and neither bound could fire. Measured on
+ * production over 14 days: 141 web sessions ran past the four-hour cap and exactly 2 were capped by
+ * it. The rest were held open until the server's reaper clamped them at 24 hours — real spans of 24
+ * to 28 hours, each carrying a single event and one or two frames. Parked tabs, reported as visits.
+ *
+ * `read()` first because it is the persisted truth; `live` covers a host that has cleared storage
+ * out from under us (see the note below), where the in-memory copy is all that is left.
+ */
+export function sessionExpired(timeoutMs = DEFAULT_SESSION_TIMEOUT_MS, maxMs = DEFAULT_SESSION_MAX_MS) {
+    const rec = read() ?? live;
+    if (!rec)
+        return false; // nothing resolved yet — there is no session to have expired
+    const t = now();
+    // Math.max(0, …) for the same reason resolveSession uses it: a backwards clock jump is "no time
+    // passed", not a huge idle gap that would end a session the visitor is still using.
+    return Math.max(0, t - rec.lastSeenAt) > timeoutMs || Math.max(0, t - rec.startedAt) > maxMs;
+}
+/**
+ * The session this document is running, held in memory as well as in storage.
+ *
+ * WHY A SECOND COPY. `sessionStorage` belongs to the page, not to us, and hosts wipe it. Clearing
+ * storage on sign-out is the single most common auth pattern there is — `sessionStorage.clear()` in a
+ * logout handler is meant to drop the app's own auth state and takes `scalebun_session` with it as
+ * collateral. From the SDK's side the session then simply vanishes mid-visit, and the next resolve
+ * mints a new id: one continuous visit is reported as two sessions, which is exactly the "I logged out
+ * in the same tab and got a new session" report. The same thing happens on sign-IN for apps that clear
+ * storage before establishing the new identity.
+ *
+ * This copy lets `touchSession` notice the record has disappeared and put it back, so a host clearing
+ * storage no longer silently splits the visit. It is deliberately NOT a second source of truth: a real
+ * boundary (idle timeout, absolute cap, tab close) still ends the session, because those are decided in
+ * `resolveSession` at load time and this only ever restores the id the document is already using.
+ */
+let live = null;
+/** Test seam — drop the in-memory copy so a case can simulate a fresh document. */
+export function __resetLiveSessionForTests() {
+    live = null;
+}
+let lastTouch = 0;
+/** Sequence counter used when no record can be persisted (see reserveSeq). */
+let memSeq = 0;
+/**
+ * Mark activity so the inactivity window slides forward.
+ *
+ * Called on the per-envelope path, so it is THROTTLED: without this a busy page would do a
+ * JSON parse + sessionStorage write per event, and sessionStorage is synchronous — that is main-thread
+ * work on the hot path. Once a minute is far finer than the 30-minute window it feeds.
+ */
+export function touchSession() {
+    /**
+     * D5 — a HIDDEN document does not slide the inactivity window.
+     *
+     * This runs on the per-envelope path, which means TELEMETRY kept the session alive, not the visitor:
+     * a parked background tab still flushes a queue and refreshes config, so `lastSeenAt` advanced every
+     * minute and the 30-minute timeout was never reached. That is why the only thing bounding a
+     * shift-long tab was the hard cap. Freezing `lastSeenAt` while hidden lets the timeout actually fire,
+     * so returning after 30+ minutes away resolves to a NEW session on the next load.
+     *
+     * A hidden tab playing media is the honest edge case here — it is genuinely doing something, and
+     * this will let its session expire. Treating "hidden" as "not present" is the right default for a
+     * clinic workstation, which is the case that prompted this; a host that needs otherwise can raise
+     * `sessionTimeoutMs`.
+     */
+    if (typeof document !== 'undefined' && document.visibilityState === 'hidden')
+        return;
+    const t = now();
+    /**
+     * Self-heal, checked on EVERY call rather than behind the throttle.
+     *
+     * The throttle exists so a busy page does not do a parse + write per envelope — but the window it
+     * creates is the whole problem here: a host that clears storage in its logout handler usually
+     * navigates or reloads immediately afterwards, well inside 60 seconds, so a throttled restore would
+     * run only after the session had already been lost. This guard is a bare `getItem` with no parse —
+     * the cheapest read available — and it only does work in the case that is actually broken.
+     */
+    if (live) {
+        try {
+            if (typeof sessionStorage !== 'undefined' && sessionStorage.getItem(SESSION_KEY) === null) {
+                live.lastSeenAt = t;
+                write(live);
+                lastTouch = t;
+                return;
+            }
+        }
+        catch {
+            /* storage blocked — nothing to restore into */
+        }
+    }
+    if (t - lastTouch < 60000)
+        return;
+    lastTouch = t;
+    const rec = read();
+    if (!rec)
+        return;
+    rec.lastSeenAt = t;
+    write(rec);
+    live = rec;
+}
+/**
+ * Reserve `count` sequence numbers and return the first.
+ *
+ * Read-modify-write against storage rather than a purely in-memory counter, so the counter SURVIVES
+ * a refresh: a resumed session must keep numbering upward instead of restarting at 0 and sorting its
+ * new frames before the old ones.
+ *
+ * Since the move to sessionStorage the store is per-tab, so the cross-tab contention this used to
+ * guard against cannot arise — two tabs now hold two different sessions, each with its own counter.
+ */
+export function reserveSeq(count = 1) {
+    const rec = read();
+    // No usable record (storage blocked, private mode, or a session that could not be written): fall
+    // back to an in-memory counter. Returning a constant 0 here would stamp EVERY frame as seq 0 and
+    // destroy replay ordering outright — far worse than the per-document counter this replaced.
+    if (!rec) {
+        const s = memSeq;
+        memSeq += count;
+        return s;
+    }
+    const start = rec.seq;
+    rec.seq = start + count;
+    /**
+     * D5b — NUMBERING A FRAME IS NOT ACTIVITY, and this used to write `rec.lastSeenAt = now()` here.
+     *
+     * `touchSession` is the activity path and it carries two rules deliberately: it returns early
+     * while the document is hidden (D5 — "a HIDDEN document does not slide the inactivity window")
+     * and it throttles to once a minute. This line had neither, so the sequence counter quietly
+     * overrode both, and a tab that was RECORDING could never idle-expire at all.
+     *
+     * MEASURED, on the production session that prompted it
+     * (`sess_f41ae2db-6c33-4729-886c-f6d66117628b`, SDK 2.0.0): the visitor left for a Google
+     * sign-in, came back 62 minutes later against a 30-minute timeout, and the recorder's first
+     * frame refreshed `lastSeenAt` before the 60-second rotation timer next looked. `sessionExpired`
+     * then answered false forever after, so the tab carried on under an id the SERVER had already
+     * retired — the row said 3 min 10 s while the frames ran to 71 minutes. Across 14 days: 556 web
+     * sessions and 27,082 frames stored, counted and invisible.
+     *
+     * Nothing is starved by removing it. Frames travel the same envelope path as everything else, so
+     * `SessionManager.context()` still calls `touchSession()` for them — with the visibility rule
+     * applied, which is the whole point.
+     */
+    write(rec);
+    return start;
+}
+/**
+ * Raise the next-sequence floor, returning it.
+ *
+ * Crash recovery replays a pre-roll buffer whose frames ALREADY consumed sequence numbers, but those
+ * frames were written by a previous document and the store knows nothing about them. Without this the
+ * counter would hand the same numbers out again and the recovered frames would collide with the new
+ * session's — the exact ordering corruption the persisted counter exists to prevent.
+ */
+export function ensureSeqAtLeast(next) {
+    const rec = read();
+    if (!rec) {
+        if (memSeq < next)
+            memSeq = next;
+        return memSeq;
+    }
+    if (rec.seq < next) {
+        rec.seq = next;
+        write(rec);
+    }
+    return rec.seq;
+}
+/**
+ * Drop the stored session so the next `resolveSession()` mints a new id.
+ *
+ * ⚠️ NOT called by `reset()`, and it must not be. The docstring here used to claim "Used by
+ * `reset()` / logout", which is false in both halves — it has no callers at all, and wiring it to
+ * logout would reintroduce the exact bug the `live` copy and the self-heal in `touchSession` were
+ * built to prevent: see the WHY A SECOND COPY note above, where "I logged out in the same tab and
+ * got a new session" is the report being fixed.
+ *
+ * Signing out does not end a visit. The person is still in the same tab, and `AnalyticsFeature.reset()`
+ * already does the part that genuinely must change — a fresh anonymous id, cleared user id,
+ * super-properties and groups — so the next user is never attributed to the previous one. The session
+ * is the visit, not the identity.
+ *
+ * This exists for a host that wants an explicit hard boundary and knows it is asking for one. It is
+ * currently unused; keep it, but reach for it deliberately.
+ */
+export function clearSession() {
+    try {
+        if (typeof sessionStorage !== 'undefined')
+            sessionStorage.removeItem(SESSION_KEY);
+    }
+    catch {
+        /* nothing we can do */
+    }
+}
+//# sourceMappingURL=sessionStore.js.map

package/dist/features/session/sessionStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionStore.js","sourceRoot":"","sources":["../../../src/features/session/sessionStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAEvC,gGAAgG;AAChG,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACzD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAsBzD,SAAS,IAAI;IACX,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,cAAc,KAAK,WAAW,IAAI,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACzF,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,CAAC;QACpC,yEAAyE;QACzE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpG;;;;;;;;;;;;;WAaG;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrF,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,6DAA6D;IAC5E,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,CAAgB;IAC7B,oGAAoG;IACpG,oGAAoG;IACpG,uGAAuG;IACvG,oGAAoG;IACpG,4DAA4D;IAC5D,IAAI,GAAG,CAAC,CAAC;IACT,IAAI,CAAC;QACH,IAAI,OAAO,cAAc,KAAK,WAAW,EAAE,CAAC;YAC1C,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,YAAoB,0BAA0B,EAC9C,QAAgB,sBAAsB;IAEtC,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;IAChB,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC;IAEpB,kGAAkG;IAClG,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,EAAE,CAAC;QACtG,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,GAAG,IAAI,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAkB,EAAE,EAAE,EAAE,QAAQ,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC3F,KAAK,CAAC,KAAK,CAAC,CAAC;IACb,IAAI,GAAG,KAAK,CAAC;IACb,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAC5B,YAAoB,0BAA0B,EAC9C,QAAgB,sBAAsB;IAEtC,MAAM,GAAG,GAAG,IAAI,EAAE,IAAI,IAAI,CAAC;IAC3B,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC,CAAC,6DAA6D;IACrF,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;IAChB,gGAAgG;IAChG,oFAAoF;IACpF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;AAC/F,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,IAAI,IAAI,GAAyB,IAAI,CAAC;AAEtC,mFAAmF;AACnF,MAAM,UAAU,0BAA0B;IACxC,IAAI,GAAG,IAAI,CAAC;AACd,CAAC;AAED,IAAI,SAAS,GAAG,CAAC,CAAC;AAClB,8EAA8E;AAC9E,IAAI,MAAM,GAAG,CAAC,CAAC;AAEf;;;;;;GAMG;AACH,MAAM,UAAU,YAAY;IAC1B;;;;;;;;;;;;;OAaG;IACH,IAAI,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,eAAe,KAAK,QAAQ;QAAE,OAAO;IAErF,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;IAEhB;;;;;;;;OAQG;IACH,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,IAAI,OAAO,cAAc,KAAK,WAAW,IAAI,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC1F,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC,CAAC;gBACZ,SAAS,GAAG,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,SAAS,GAAG,KAAM;QAAE,OAAO;IACnC,SAAS,GAAG,CAAC,CAAC;IACd,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC;IACnB,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,CAAC,GAAG,CAAC,CAAC;IACX,IAAI,GAAG,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,KAAK,GAAG,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC;IACnB,iGAAiG;IACjG,iGAAiG;IACjG,4FAA4F;IAC5F,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,CAAC,GAAG,MAAM,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC;QAChB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC;IACtB,GAAG,CAAC,GAAG,GAAG,KAAK,GAAG,KAAK,CAAC;IACxB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,GAAG,CAAC,CAAC;IACX,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC;IACnB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,MAAM,GAAG,IAAI;YAAE,MAAM,GAAG,IAAI,CAAC;QACjC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC;QACnB,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC;QACf,KAAK,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC,GAAG,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC;QACH,IAAI,OAAO,cAAc,KAAK,WAAW;YAAE,cAAc,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,uBAAuB;IACzB,CAAC;AACH,CAAC"}

package/dist/features/watchdog/WatchdogFeature.d.ts

@@ -0,0 +1,23 @@
+/**
+ * F-WDOG (W5.2) — Resource Watchdog. Ultra-thin eager shell: feature-detect, then lazy-load the engine
+ * (sampling gate + collectors + incident detector + rollup + emit). A production watchdog — continuous
+ * low-cost resource sampling → local incident detection → only rollups + incidents egress, replay-
+ * correlated on the existing `kind:'performance'` lane (ZERO backend migration). Off by default.
+ *
+ * Distinct from `profiler` (JS Self-Profiling flame capture): mobile's profiler is desktop-only and
+ * never reaches the backend — this watchdog persists incidents. Everything but the detect+import lives
+ * in the lazy chunk to keep the core bundle gate.
+ */
+import type { IFeature, FeatureContext } from '@scalebun/sdk-contracts';
+import type { WatchdogStats } from './engine.js';
+export declare class WatchdogFeature implements IFeature {
+    readonly name = "watchdog";
+    private active;
+    private handle?;
+    get isActive(): boolean;
+    setup(ctx: FeatureContext): Promise<void>;
+    /** Self-observability (`scalebun.watchdog.stats()`), matching errorStats/perfStats. */
+    stats(): WatchdogStats;
+    teardown(): void;
+}
+//# sourceMappingURL=WatchdogFeature.d.ts.map

package/dist/features/watchdog/WatchdogFeature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WatchdogFeature.d.ts","sourceRoot":"","sources":["../../../src/features/watchdog/WatchdogFeature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,KAAK,EAAkB,aAAa,EAAE,MAAM,UAAU,CAAC;AAI9D,qBAAa,eAAgB,YAAW,QAAQ;IAC9C,QAAQ,CAAC,IAAI,cAAc;IAC3B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,MAAM,CAAC,CAAiB;IAEhC,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAEK,KAAK,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ/C,uFAAuF;IACvF,KAAK,IAAI,aAAa;IAItB,QAAQ,IAAI,IAAI;CAKjB"}

package/dist/features/watchdog/WatchdogFeature.js

@@ -0,0 +1,29 @@
+const EMPTY_STATS = { incidents: 0, droppedIncidents: 0, rollups: 0, tiers: { pressure: false, memory: false } };
+export class WatchdogFeature {
+    constructor() {
+        this.name = 'watchdog';
+        this.active = false;
+    }
+    get isActive() {
+        return this.active;
+    }
+    async setup(ctx) {
+        if (typeof window === 'undefined' || typeof performance === 'undefined')
+            return;
+        this.active = true;
+        const { startWatchdog } = await import('./engine.js');
+        if (!this.active)
+            return; // torn down while the chunk loaded
+        this.handle = startWatchdog(ctx);
+    }
+    /** Self-observability (`scalebun.watchdog.stats()`), matching errorStats/perfStats. */
+    stats() {
+        return this.handle?.stats() ?? EMPTY_STATS;
+    }
+    teardown() {
+        this.active = false;
+        this.handle?.stop();
+        this.handle = undefined;
+    }
+}
+//# sourceMappingURL=WatchdogFeature.js.map

package/dist/features/watchdog/WatchdogFeature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WatchdogFeature.js","sourceRoot":"","sources":["../../../src/features/watchdog/WatchdogFeature.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,GAAkB,EAAE,SAAS,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;AAEhI,MAAM,OAAO,eAAe;IAA5B;QACW,SAAI,GAAG,UAAU,CAAC;QACnB,WAAM,GAAG,KAAK,CAAC;IAyBzB,CAAC;IAtBC,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAmB;QAC7B,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,WAAW,KAAK,WAAW;YAAE,OAAO;QAChF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,mCAAmC;QAC7D,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,uFAAuF;IACvF,KAAK;QACH,OAAO,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,WAAW,CAAC;IAC7C,CAAC;IAED,QAAQ;QACN,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QACpB,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IAC1B,CAAC;CACF"}

package/dist/features/watchdog/collectors.d.ts

@@ -0,0 +1,18 @@
+import type { PressureState } from './incidents.js';
+export interface CollectorSinks {
+    onHeartbeat: (lagMs: number) => void;
+    onPressure: (state: PressureState) => void;
+    onMemory: (usedBytes: number, limitBytes: number) => void;
+}
+export interface CollectorHandle {
+    stop: () => void;
+    /** Whether Compute Pressure is present (decides the incident engine's cpu_spike model). */
+    pressureAvailable: boolean;
+    /** Whether performance.memory is present (Chromium) — drives the rollup's honest tier map. */
+    memoryAvailable: boolean;
+}
+export declare function startCollectors(sinks: CollectorSinks, opts: {
+    heartbeatMs: number;
+    memorySampleMs: number;
+}): CollectorHandle;
+//# sourceMappingURL=collectors.d.ts.map

package/dist/features/watchdog/collectors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collectors.d.ts","sourceRoot":"","sources":["../../../src/features/watchdog/collectors.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,UAAU,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;IAC3C,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3D;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,IAAI,CAAC;IACjB,2FAA2F;IAC3F,iBAAiB,EAAE,OAAO,CAAC;IAC3B,8FAA8F;IAC9F,eAAe,EAAE,OAAO,CAAC;CAC1B;AAwBD,wBAAgB,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GAAG,eAAe,CAmF7H"}