[BackStacked]

Requested by Himanshu · project thread

What and why

Before: the SDK had its own device-signal code in src/graphql/device.ts, and it sent the full user agent and about a dozen raw browser values as info.

After: the signals come from @mgpl-diagnostics/security-kit/browser, the shared kit for both sides. info is now security-kit's coarse device info (os, browser, major browserVersion, mobile, language, timezone, screen, plus extraInfo), and the fingerprint leaves out the browser version, so updates don't change it.

• Same GraphQL contract: login and refresh still send DeviceInput { deviceId, fingerprint, clientSessionId, info }, so the api needs no change.
• No forced sign-outs: the storage keys are unchanged (mgpl.deviceId, mgpl.tabId), and ids created by 1.2.0 are kept.
• Still zero runtime dependencies: security-kit is a dev dependency bundled into dist (noExternal), and the public types don't import it. The new signals option takes a security-kit collector structurally, so an app can share one collector with signalFetch / useDeviceSignals.
• The first refresh after upgrading logs one fingerprint change, because the format changed. It is logged, not blocked.

How: the dev dependency is the published @mgpl-diagnostics/security-kit@^0.2.0 from GitHub Packages.

Type

• Feature
• Docs

Checklist

• On a branch (not main)
• npm run typecheck passes
• npm run build passes; dist/ imports nothing from security-kit (checked)
• Docs updated (docs/session.md "Device signals", AGENTS.md, llms-full.txt)
• HTTP / GraphQL contract unchanged
• No real patient data, contact details or signatures

🤖 Generated with Claude Code

https://claude.ai/code/session_01L5Py9guKQFcFPmdme7bRjo

[BackStacked]

CI is red at npm install: mgpl-diagnostics/security-kit is the only private repository in the org, so the runner can't fetch the git dev dependency (npm tries SSH, then there are no HTTPS credentials). The code itself is not at fault (typecheck and build pass locally).

Fix needs the owner: make security-kit public like the other kits (its LICENSE is all rights reserved, same as theirs), or publish it to GitHub Packages and give this repo read access. After either, re-run this check.

---

Generated by Claude Code