feat(core): consent queue guardrails — size limits, drop telemetry, flush drain

[tyssejc]

Summary

Closes #5 — three related consent queue gaps identified during adversarial review:

• Queue size limits: New maxQueueSize option on ConsentConfig. When exceeded, oldest events are dropped (drop-oldest strategy, consistent with ring buffer semantics).
• Queue expiry telemetry: queue:drop event emitted with { count, reason: "timeout" | "overflow" } whenever events are lost. Feeds into debug panel and application monitoring.
• Flush drains consent queue: flush() now drains the consent queue for any now-permitted events, not just the event buffer. Critical for page unload — the client calls flush() on pagehide, and previously queued events that gained consent would have been silently lost.

Files changed

• packages/core/src/types.ts — maxQueueSize on ConsentConfig, queue:drop on CollectorEvent
• packages/core/src/consent.ts — onDrop listener, overflow enforcement in enqueue(), drop notification in cleanup timer
• packages/core/src/collector.ts — wire queue:drop emission, enhance flush() to drain consent queue

Test plan

• All 179 tests pass (10 new tests added)
• Consent: drop telemetry on timeout expiry (emits count + reason)
• Consent: drop telemetry on queue overflow (emits count + reason)
• Consent: drop listener unsubscribe works
• Consent: maxQueueSize drops oldest, preserves newest
• Consent: no limit enforced when maxQueueSize not set
• Collector: queue:drop event emitted on timeout
• Collector: queue:drop event emitted on overflow
• Collector: flush() dispatches consent-queued events when consent now granted
• Manual: verify debug panel shows queue:drop events

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
junctionjs	Ready	Preview, Comment	Mar 24, 2026 0:07am