@tracescout/browser 2.6.0 → 2.7.1

package/CHANGELOG.md

@@ -1,3 +1,36 @@
+# 2.7.1 (2026-08-02)
+
+- **Producer attribution (Phase 0A.3 §1):** every log batch now carries
+  `producer: "@tracescout/browser/<version>"` in the request **body**, so the
+  ingestion API can attribute an operation to an exact producer + version
+  instead of an anonymous legacy blob.
+
+  It travels in the body — **not** as a custom request header — for the same
+  reason `batchId` does: the browser SDK posts cross-origin from customer
+  sites, and a header outside the API's CORS preflight allow-list fails the
+  preflight and silently kills ALL browser log capture. A body field needs no
+  preflight and is additive against every deployed API version (an older
+  server simply ignores the unknown field — verified).
+
+  Purely diagnostic: the server never uses it for authorization, quota,
+  billing amount, or operation identity. Retries reuse the same `batchId`
+  AND the same producer label; a new logical batch still mints a new id.
+
+- **One source of truth for the shipped version.** `SDK_VERSION` moved into
+  `src/core/producer.js` and is consumed by both `SDKContext.sdkVersion` and
+  the producer label, so the two can never disagree. The session-metadata test
+  now reads `package.json` instead of hardcoding a version string.
+
+- **Build-sync safety.** The postbuild CDN sync no longer creates its
+  destination. It previously resolved a cwd-relative `../../TraceScout-CDN`
+  and `mkdir -p`'d it, so building from an isolated release worktree silently
+  manufactured a bogus directory and reported success. It now uses an explicit
+  `TRACESCOUT_CDN_DIR` or an existing sibling checkout, and otherwise skips
+  with a reason. Regression guard: `tests/build-sync-safety.test.mjs`.
+
+  No change to the operation-ID / parked-batch / retry logic, which was
+  already correct in 2.7.0.
+
 # 2.6.0 (2026-07-30)
 
 - **Source-map build identity (B2):** `TraceScout.init(projectId, { release, dist, debugId })` —