# 2.7.1 (2026-08-02)

- **Producer attribution (Phase 0A.3 §1):** every log batch now carries
  `producer: "@tracescout/browser/<version>"` in the request **body**, so the
  ingestion API can attribute an operation to an exact producer + version
  instead of an anonymous legacy blob.

  It travels in the body — **not** as a custom request header — for the same
  reason `batchId` does: the browser SDK posts cross-origin from customer
  sites, and a header outside the API's CORS preflight allow-list fails the
  preflight and silently kills ALL browser log capture. A body field needs no
  preflight and is additive against every deployed API version (an older
  server simply ignores the unknown field — verified).

  Purely diagnostic: the server never uses it for authorization, quota,
  billing amount, or operation identity. Retries reuse the same `batchId`
  AND the same producer label; a new logical batch still mints a new id.

- **One source of truth for the shipped version.** `SDK_VERSION` moved into
  `src/core/producer.js` and is consumed by both `SDKContext.sdkVersion` and
  the producer label, so the two can never disagree. The session-metadata test
  now reads `package.json` instead of hardcoding a version string.

- **Build-sync safety.** The postbuild CDN sync no longer creates its
  destination. It previously resolved a cwd-relative `../../TraceScout-CDN`
  and `mkdir -p`'d it, so building from an isolated release worktree silently
  manufactured a bogus directory and reported success. It now uses an explicit
  `TRACESCOUT_CDN_DIR` or an existing sibling checkout, and otherwise skips
  with a reason. Regression guard: `tests/build-sync-safety.test.mjs`.

  No change to the operation-ID / parked-batch / retry logic, which was
  already correct in 2.7.0.

# 2.6.0 (2026-07-30)

- **Source-map build identity (B2):** `TraceScout.init(projectId, { release, dist, debugId })` —
  two new OPTIONAL identity fields carried on every v1 envelope so the platform
  can match private source maps at read time. `debugId` may also be injected at
  build time via the `__TRACESCOUT_DEBUG_ID__` global (explicit option wins).
  Format-validated (`CONFIG_INVALID_DIST`, `CONFIG_INVALID_DEBUG_ID`); no
  network use in the error path; raw stacks are never rewritten in the browser.
- Additive schema change only: 2.5.0 events without `dist`/`debugId` remain
  fully accepted (verified against the deployed validator).
- `js_error.schema.json` corrected to describe the shipped fingerprint format
  (readable `name::message::stackLine` string, not a hex hash) — matches the
  API's vendored copy byte-for-byte.

# Changelog

## 2.2.0-beta.1 — 2026-07-15

### Changed
- **License changed to Apache License 2.0.** The SDK is now licensed under the
  Apache License 2.0 (the previous 2.2.0-beta.0 release used a proprietary beta
  license). This is the first Apache-2.0-licensed artifact of
  `@tracescout/browser`. Published live: `beta: 2.2.0-beta.1`, `license: Apache-2.0`; `latest` remains `2.2.0-beta.0` (unchanged). Registry tarball sha256 `9dae53316a8f310db39f7542fe204cb07273fc5d23368056bf673a7a0b6c86a0`; npm `dist/tracescout.min.js` byte-matches the versioned CDN artifact from commit `9355345`. Added a `NOTICE` file. "TraceScout" names/logos/
  trademarks remain reserved.

No runtime, public-API, telemetry-contract, packaging, minification, or
source-map-policy changes. The already-published `@tracescout/browser@2.2.0-beta.0`
retains its original license; this is a new immutable version, not a relicensing
of the old one.

## 2.2.0-beta.0 — 2026-07-15

First public npm release (`@tracescout/browser`), published publicly under the
`beta` dist-tag from release commit `9355345` (tarball sha256
`2436b422fe0da12ae9fa1c3c60e1ce75d58570bea011dfd95e14b3c57e483bcf`). As with
`@tracescout/node@0.2.0`, npm auto-assigned `latest` on this first publish, so
the version currently carries BOTH `beta` and `latest` tags; it was NOT
deliberately promoted, and `latest` cannot be cleanly removed (only re-pointed
when a stable release lands). The published npm `dist/tracescout.min.js` is
byte-identical to the versioned CDN artifact built from the same commit.

### Fixed
- **SSR-import safety:** the fetch interceptor no longer binds `window.fetch` at
  module load, so `import '@tracescout/browser'` is safe in a Node/SSR context
  (e.g. Next.js). Runtime behavior in the browser is unchanged. Required for
  correct npm packaging; no other runtime change.

### Included from 2.1.x
- Same-origin-only trace/baggage propagation (third-party origins and the SDK's
  own ingest endpoints receive neither; existing `traceparent` preserved).
- Session replay, console/error capture, Web Vitals, fetch/XHR capture with
  header sanitization; v1 project-scoped event contract.

### Packaging
- Distributed as compiled, minified bundles: `dist/tracescout.esm.min.js` (ESM)
  and `dist/tracescout.min.js` (UMD). Function/class names preserved; no
  property-name mangling; no source maps in the package; no TypeScript sources,
  tests, or internal docs shipped. The npm package and the versioned CDN artifact
  are built from the same release commit.