feat(mobile): track device models and OS versions

apps/mobile/package.json

@@ -81,6 +81,7 @@
     "expo-constants": "~56.0.18",
     "expo-crypto": "~56.0.4",
     "expo-dev-client": "~56.0.20",
+    "expo-device": "~56.0.4",
     "expo-file-system": "~56.0.8",
     "expo-font": "~56.0.7",
     "expo-glass-effect": "~56.0.4",

apps/mobile/src/features/cloud/linkEnvironment.test.ts

@@ -33,6 +33,11 @@ vi.mock("expo-constants", () => ({
   },
 }));
 
+vi.mock("expo-device", () => ({
+  osVersion: "18.4.1",
+  modelName: "iPhone 15 Pro",
+}));
+
 vi.mock("react-native", () => ({
   Platform: {
     OS: "ios",

apps/mobile/src/lib/authClientMetadata.ts

@@ -1,11 +1,17 @@
 import type { AuthClientPresentationMetadata } from "@t3tools/contracts";
+import * as Device from "expo-device";
 import { Platform } from "react-native";
 
 export function authClientMetadata(appVersion?: string): AuthClientPresentationMetadata {
+  const osMajorVersion = Number.parseInt(Device.osVersion?.split(".")[0] ?? "", 10);
+  const deviceModel = Device.modelName?.trim();
+
   return {
     label: "T3 Code Mobile",
     deviceType: "mobile",
     ...(Platform.OS === "ios" ? { os: "iOS" } : Platform.OS === "android" ? { os: "Android" } : {}),
+    ...(Number.isFinite(osMajorVersion) && osMajorVersion > 0 ? { osMajorVersion } : {}),
+    ...(deviceModel ? { deviceModel } : {}),
     surface: "mobile",
     ...(appVersion ? { appVersion } : {}),
   };

apps/mobile/src/lib/connection.test.ts

@@ -1,12 +1,18 @@
-import { describe, expect, it, vi } from "vite-plus/test";
+import { afterEach, describe, expect, it, vi } from "vite-plus/test";
 import { EnvironmentId } from "@t3tools/contracts";
 
 import {
   isRelayManagedConnection,
-  authClientMetadata,
   redactPairingCredential,
   toStableSavedRemoteConnection,
 } from "./connection";
+import { authClientMetadata } from "./authClientMetadata";
+
+const mobilePlatform = vi.hoisted(() => ({ OS: "ios" as "ios" | "android" }));
+const mobileDevice = vi.hoisted(() => ({
+  osVersion: "18.4.1",
+  modelName: "iPhone 15 Pro",
+}));
 
 vi.mock("./runtime", () => ({
   runtime: {
@@ -15,21 +21,41 @@ vi.mock("./runtime", () => ({
 }));
 
 vi.mock("react-native", () => ({
-  Platform: {
-    OS: "ios",
-  },
+  Platform: mobilePlatform,
 }));
 
+vi.mock("expo-device", () => mobileDevice);
+
 describe("mobile remote connection records", () => {
+  afterEach(() => {
+    mobilePlatform.OS = "ios";
+    mobileDevice.osVersion = "18.4.1";
+    mobileDevice.modelName = "iPhone 15 Pro";
+  });
+
   it("identifies mobile token exchanges for authorized-client presentation", () => {
     expect(authClientMetadata()).toEqual({
       label: "T3 Code Mobile",
       deviceType: "mobile",
       os: "iOS",
+      osMajorVersion: 18,
+      deviceModel: "iPhone 15 Pro",
       surface: "mobile",
     });
   });
 
+  it("includes only the Android major version and hardware model", () => {
+    mobilePlatform.OS = "android";
+    mobileDevice.osVersion = "15.2.1";
+    mobileDevice.modelName = "Pixel 9";
+
+    expect(authClientMetadata()).toMatchObject({
+      os: "Android",
+      osMajorVersion: 15,
+      deviceModel: "Pixel 9",
+    });
+  });
+
   it("includes the mobile app version when the client provides it", () => {
     expect(authClientMetadata("1.2.3")).toMatchObject({
       surface: "mobile",

apps/mobile/src/lib/connection.ts

@@ -2,8 +2,6 @@ import { EnvironmentId } from "@t3tools/contracts";
 import { stripPairingTokenFromUrl } from "@t3tools/shared/remote";
 import { type EnvironmentConnectionPhase } from "@t3tools/client-runtime/connection";
 
-export { authClientMetadata } from "./authClientMetadata";
-
 export interface SavedRemoteConnection {
   readonly environmentId: EnvironmentId;
   readonly environmentLabel: string;

apps/server/src/server.test.ts

@@ -5209,7 +5209,9 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
           createdAt: "2026-01-01T00:00:00.000Z",
         }) as const;
 
-      const wsUrl = yield* getWsServerUrl("/ws?clientSurface=mobile&clientAppVersion=1.2.3");
+      const wsUrl = yield* getWsServerUrl(
+        "/ws?clientSurface=mobile&clientAppVersion=1.2.3&clientOs=iOS&clientOsMajorVersion=18&clientDeviceModel=iPhone+15+Pro",
+      );
       yield* Effect.scoped(
         withWsRpcClient(wsUrl, (client) =>
           Effect.gen(function* () {
@@ -5242,7 +5244,13 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
         "analytics:client.thread.started",
       ]);
       assert.deepEqual(analyticsProperties, [
-        { surface: "mobile", appVersion: "1.2.3" },
+        {
+          surface: "mobile",
+          appVersion: "1.2.3",
+          os: "iOS",
+          osMajorVersion: 18,
+          deviceModel: "iPhone 15 Pro",
+        },
         { surface: "mobile", appVersion: "1.2.3" },
       ]);
     }).pipe(Effect.provide(NodeHttpServer.layerTest)),

apps/server/src/ws.ts

@@ -360,6 +360,7 @@ function toAuthAccessStreamEvent(
 
 const isClientSurface = Schema.is(ClientSurface);
 const MAX_CLIENT_APP_VERSION_LENGTH = 64;
+const MAX_CLIENT_DEVICE_MODEL_LENGTH = 80;
 
 // Optional client identity announced on the /ws upgrade URL next to wsTicket.
 // Lenient by design: absent or malformed values degrade to {} so a connection
@@ -386,6 +387,28 @@ const clientOriginAnalyticsProps = (origin: OrchestrationClientOrigin) => ({
   ...(origin.appVersion !== undefined ? { appVersion: origin.appVersion } : {}),
 });
 
+function readMobileDeviceAnalyticsProps(request: HttpServerRequest.HttpServerRequest) {
+  const url = HttpServerRequest.toURL(request);
+  if (Option.isNone(url) || url.value.searchParams.get("clientSurface") !== "mobile") {
+    return {};
+  }
+
+  const os = url.value.searchParams.get("clientOs");
+  const rawOsMajorVersion = url.value.searchParams.get("clientOsMajorVersion") ?? "";
+  const osMajorVersion = Number(rawOsMajorVersion);
+  const deviceModel = url.value.searchParams.get("clientDeviceModel")?.trim() ?? "";
+
+  return {
+    ...(os === "iOS" || os === "Android" ? { os } : {}),
+    ...(rawOsMajorVersion !== "" && Number.isInteger(osMajorVersion) && osMajorVersion > 0
+      ? { osMajorVersion }
+      : {}),
+    ...(deviceModel !== "" && deviceModel.length <= MAX_CLIENT_DEVICE_MODEL_LENGTH
+      ? { deviceModel }
+      : {}),
+  };
+}
+
 const makeWsRpcLayer = (
   currentSession: EnvironmentAuth.AuthenticatedSession,
   clientOrigin: OrchestrationClientOrigin,
@@ -2434,7 +2457,10 @@ export const websocketRpcRouteLayer = Layer.unwrap(
         );
         const clientOrigin = readClientConnectionOrigin(request);
         yield* sessions.recordClientConnection(session.sessionId, clientOrigin);
-        yield* analytics.record("client.connected", clientOriginAnalyticsProps(clientOrigin));
+        yield* analytics.record("client.connected", {
+          ...clientOriginAnalyticsProps(clientOrigin),
+          ...readMobileDeviceAnalyticsProps(request),
+        });
         const rpcWebSocketHttpEffect = yield* RpcServer.toHttpEffectWebsocket(WsRpcGroup, {
           disableTracing: true,
         }).pipe(

packages/client-runtime/src/authorization/remote.test.ts

@@ -467,9 +467,18 @@ describe("remote environment authorization", () => {
         wsBaseUrl: "wss://remote.example.com/",
         httpBaseUrl: "https://remote.example.com/",
         bearerToken: "bearer-token",
+        clientMetadata: {
+          surface: "mobile",
+          appVersion: "1.2.3",
+          os: "Android",
+          osMajorVersion: 15,
+          deviceModel: "Pixel 9",
+        },
       }).pipe(provideRemoteHttp(fetch.fetchFn));
 
-      expect(url).toBe("wss://remote.example.com/ws?wsTicket=ws-ticket");
+      expect(url).toBe(
+        "wss://remote.example.com/ws?wsTicket=ws-ticket&clientSurface=mobile&clientAppVersion=1.2.3&clientOs=Android&clientOsMajorVersion=15&clientDeviceModel=Pixel+9",
+      );
     }),
   );
 });

packages/client-runtime/src/authorization/remote.ts

@@ -44,6 +44,17 @@ export const appendClientConnectionParams = (
   if (clientMetadata?.appVersion) {
     url.searchParams.set("clientAppVersion", clientMetadata.appVersion);
   }
+  if (clientMetadata?.surface === "mobile") {
+    if (clientMetadata.os) {
+      url.searchParams.set("clientOs", clientMetadata.os);
+    }
+    if (clientMetadata.osMajorVersion !== undefined) {
+      url.searchParams.set("clientOsMajorVersion", String(clientMetadata.osMajorVersion));
+    }
+    if (clientMetadata.deviceModel) {
+      url.searchParams.set("clientDeviceModel", clientMetadata.deviceModel);
+    }
+  }
 };
 
 export const exchangeRemoteDpopAccessToken = Effect.fn(

packages/contracts/src/auth.ts

@@ -169,6 +169,8 @@ export const AuthClientPresentationMetadata = Schema.Struct({
   label: Schema.optionalKey(TrimmedNonEmptyString),
   deviceType: Schema.optionalKey(AuthClientMetadataDeviceType),
   os: Schema.optionalKey(TrimmedNonEmptyString),
+  osMajorVersion: Schema.optionalKey(Schema.Int),
+  deviceModel: Schema.optionalKey(TrimmedNonEmptyString),
   surface: Schema.optionalKey(ClientSurface),
   appVersion: Schema.optionalKey(TrimmedNonEmptyString),
 });