*diagnostics

Load dist/adapters/diagnostics.js, then opt one host into structured diagnostics by declaring an application-owned endpoint.

<serc-rod *diagnostics="{ endpoint: '/api/diagnostics' }">
  ...
</serc-rod>

The adapter collects host-owned sercrod-error events. Document-wide browser errors, promise rejections, resource failures, CSP violations, and browser reports require explicit browser opt-in. It cannot read all DevTools console output or native logs.

Manual reports

<button *diagnostics.send="{
  level: 'error',
  code: 'checkout-state',
  message: 'Payment processing started',
  data: { order_id: order.id }
}">Try payment</button>

Manual send and *diagnostics.clear run on click or Enter/Space. There is no *response contract because delivery is best effort.

<button *diagnostics.clear>Stop diagnostics</button>

Explicit clear makes one final best-effort delivery attempt. Host teardown is silent: it removes listeners and timers, discards unsent queued records, and does not start a send or retry.

Privacy and delivery

Built-in redaction, URL normalization, duplicate aggregation, UTF-8 record, batch and queue limits, and rate limits apply before records are queued. Whole host data, DOM, cookies, storage, authorization headers, request bodies, passwords, tokens, and file contents are not collected by default.

Transport order is a project bridge, navigator.sendBeacon(), then keepalive fetch(). Only an exact bridge result of false allows fallback; errors and timeouts end that attempt without retry. Capacitor uses this WebView path unless an application bridge is supplied. Use Playwright or device tools when the structured record is insufficient.

Demonstration receiver

The app/diagnostics sample sends to the small PHP receiver under app/diagnostics/server/php. It accepts a size-limited JSON batch, appends it to a size-capped private JSON Lines file with locking, and never exposes stored records through HTTP GET.

This demonstrates transport only. Production deployments still need application-owned authentication, retention limits, rotation, monitoring, and a privacy policy. Credentials do not belong in diagnostic records or public HTML.