@adobe/helix-rum-enhancer 2.47.3 → 2.49.0

package/CHANGELOG.md

@@ -1,3 +1,18 @@
+# [2.49.0](https://github.com/adobe/helix-rum-enhancer/compare/v2.48.0...v2.49.0) (2026-07-10)
+
+
+### Features
+
+* flag untrusted (synthetic) clicks as bots ([94b2893](https://github.com/adobe/helix-rum-enhancer/commit/94b289333d0c8a33435752c8f48f080b5dfa203d))
+
+# [2.48.0](https://github.com/adobe/helix-rum-enhancer/compare/v2.47.3...v2.48.0) (2026-07-08)
+
+
+### Features
+
+* report source for the largest CLS layout shift ([53a0432](https://github.com/adobe/helix-rum-enhancer/commit/53a04321044b444b8f883b63f71dd4394814877b))
+* report source for the largest CLS layout shift ([a74c6f4](https://github.com/adobe/helix-rum-enhancer/commit/a74c6f453b639504b82874750d247b27c5a78f21))
+
 ## [2.47.3](https://github.com/adobe/helix-rum-enhancer/compare/v2.47.2...v2.47.3) (2026-05-13)
 
 

package/modules/defaults.js

@@ -11,6 +11,6 @@
  */
 import { fflags } from './fflags.js';
 
-export const KNOWN_PROPERTIES = ['weight', 'id', 'referer', 'checkpoint', 't', 'source', 'target', 'cwv', 'CLS', 'FID', 'LCP', 'INP', 'TTFB'];
+export const KNOWN_PROPERTIES = ['weight', 'id', 'referer', 'checkpoint', 't', 'source', 'target', 'cwv', 'CLS', 'FID', 'LCP', 'INP', 'TTFB', 'ua'];
 export const DEFAULT_TRACKING_EVENTS = ['click', 'cwv', 'form', 'viewblock', 'viewmedia', 'loadresource', 'utm', 'paid', 'email', 'consent'];
 fflags.enabled('example', () => DEFAULT_TRACKING_EVENTS.push('example'));

package/modules/dom.js

@@ -32,12 +32,20 @@ export const targetSelector = (el) => {
   }
 };
 
-function walk(el, checkFn) {
+export const untrustedClickPayload = (event) => {
+  if (event && event.isTrusted === false) {
+    const ua = navigator.userAgent;
+    return { ua: ua.includes('+http') ? ua : `${ua} +http://event.untrusted` };
+  }
+  return {};
+};
+
+function walk(el, check) {
   if (!el || el === document.body || el === document.documentElement) {
     return undefined;
   }
 
-  return checkFn(el) || walk(el.parentElement || (el.parentNode && el.parentNode.host), checkFn);
+  return check(el) || walk(el.parentElement || (el.parentNode && el.parentNode.host), check);
 }
 
 function isDialog(el) {
@@ -53,19 +61,19 @@ function isButton(el) {
     return true;
   }
   if (el.tagName === 'A') {
-    return Array.from(el.classList).some((className) => className.match(/button|cta/));
+    return Array.from(el.classList).some((cls) => cls.match(/button|cta/));
   }
   return el.getAttribute('role') === 'button';
 }
 
-function getSourceContext(el) {
-  const formEl = el.closest('form');
-  if (formEl) {
-    const id = formEl.getAttribute('id');
+function srcContext(el) {
+  const form = el.closest('form');
+  if (form) {
+    const id = form.getAttribute('id');
     if (id) {
       return `form#${CSS.escape(id)}`;
     }
-    return `form${formEl.classList.length > 0 ? `.${CSS.escape(formEl.classList[0])}` : ''}`;
+    return `form${form.classList.length > 0 ? `.${CSS.escape(form.classList[0])}` : ''}`;
   }
   const block = el.closest('.block[data-block-name]');
   return ((block && `.${block.getAttribute('data-block-name')}`)
@@ -75,7 +83,7 @@ function getSourceContext(el) {
     || walk(el, (e) => e.id && `#${CSS.escape(e.id)}`));
 }
 
-function getSourceElement(el) {
+function srcElement(el) {
   const f = el.closest('form');
   if (f && Array.from(f.elements).includes(el)) {
     return (el.tagName.toLowerCase()
@@ -87,7 +95,7 @@ function getSourceElement(el) {
     || (el.tagName.toLowerCase().match(/^(a|img|video|form)$/) && el.tagName.toLowerCase());
 }
 
-function getSourceIdentifier(el) {
+function srcId(el) {
   return (el.id && `#${CSS.escape(el.id)}`)
     || (el.getAttribute('data-block-name') && `.${el.getAttribute('data-block-name')}`)
     || (el.classList.length > 0 && `.${CSS.escape(el.classList[0])}`);
@@ -101,9 +109,9 @@ export const sourceSelector = (el) => {
     if (el.getAttribute('data-rum-source')) {
       return el.getAttribute('data-rum-source');
     }
-    const ctx = getSourceContext(el.parentElement) || '';
-    const name = getSourceElement(el) || '';
-    const id = getSourceIdentifier(el) || '';
+    const ctx = srcContext(el.parentElement) || '';
+    const name = srcElement(el) || '';
+    const id = srcId(el) || '';
     return `${ctx} ${name}${id}`.trim() || `"${el.textContent.substring(0, 10)}"`;
     /* c8 ignore next 3 */
   } catch (error) {

package/modules/index.js

@@ -13,7 +13,7 @@
 
 import { KNOWN_PROPERTIES, DEFAULT_TRACKING_EVENTS } from './defaults.js';
 import { urlSanitizers } from './utils.js';
-import { targetSelector, sourceSelector } from './dom.js';
+import { targetSelector, sourceSelector, untrustedClickPayload } from './dom.js';
 import { fflags } from './fflags.js';
 
 const { sampleRUM, queue, isSelected } = (window.hlx && window.hlx.rum) ? window.hlx.rum
@@ -27,19 +27,19 @@ const createMO = (cb) => (window.MutationObserver ? new MutationObserver(cb)
 const [blocksMO, mediaMO] = [blocksMCB, mediaMCB].map(createMO);
 
 // Check for the presence of a given cookie
-const hasCookieKey = (key) => document.cookie.split(';').some((c) => c.trim().startsWith(`${key}=`));
+const hasCookie = (key) => document.cookie.split(';').some((c) => c.trim().startsWith(`${key}=`));
 
 // Set the base path for the plugins
-const pluginBasePath = new URL(document.currentScript.src).href.replace(/index(\.map)?\.js/, 'plugins');
+const pluginBase = new URL(document.currentScript.src).href.replace(/index(\.map)?\.js/, 'plugins');
 
 const CONSENT_PROVIDERS = [
   {
     name: 'onetrust',
-    detect: () => hasCookieKey('OptanonAlertBoxClosed') || document.querySelector('#onetrust-banner-sdk, #onetrust-pc-sdk'),
+    detect: () => hasCookie('OptanonAlertBoxClosed') || document.querySelector('#onetrust-banner-sdk, #onetrust-pc-sdk'),
   },
   {
     name: 'trustarc',
-    detect: () => ['notice_gdpr_prefs', 'notice_preferences'].some(hasCookieKey) || document.querySelector('#truste-consent-track'),
+    detect: () => ['notice_gdpr_prefs', 'notice_preferences'].some(hasCookie) || document.querySelector('#truste-consent-track'),
   },
   {
     name: 'usercentrics',
@@ -47,40 +47,40 @@ const CONSENT_PROVIDERS = [
   },
 ];
 
-const getConsentProvider = () => CONSENT_PROVIDERS.find(({ detect }) => detect());
+const getConsent = () => CONSENT_PROVIDERS.find(({ detect }) => detect());
 const bodyChildMO = {
   target: document.body,
   options: { attributes: false, childList: true, subtree: false },
 };
 
 const PLUGINS = {
-  cwv: `${pluginBasePath}/cwv.js`,
-  a11y: `${pluginBasePath}/a11y.js`,
+  cwv: `${pluginBase}/cwv.js`,
+  a11y: `${pluginBase}/a11y.js`,
   // Interactive elements
   form: {
-    url: `${pluginBasePath}/form.js`,
+    url: `${pluginBase}/form.js`,
     when: () => document.querySelector('form'),
     isBlockDependent: true,
-    mutationObserverParams: bodyChildMO,
+    moParams: bodyChildMO,
   },
   redirect: {
-    url: `${pluginBasePath}/redirect.js`,
+    url: `${pluginBase}/redirect.js`,
     when: ({ perfEntry: pe, urlParameters: usp }) => (
       pe && (usp.get('redirect_from') || pe.redirectCount > 0 || pe.fetchStart > 50)
     ),
   },
-  video: { url: `${pluginBasePath}/video.js`, when: () => document.querySelector('video'), isBlockDependent: true },
+  video: { url: `${pluginBase}/video.js`, when: () => document.querySelector('video'), isBlockDependent: true },
   webcomponent: {
-    url: `${pluginBasePath}/webcomponent.js`,
+    url: `${pluginBase}/webcomponent.js`,
     when: () => [...document.querySelectorAll('*')].some((el) => el.tagName && el.tagName.includes('-')),
     isBlockDependent: true,
   },
   // Martech
-  martech: { url: `${pluginBasePath}/martech.js`, when: ({ urlParameters }) => urlParameters.size > 0 },
+  martech: { url: `${pluginBase}/martech.js`, when: ({ urlParameters }) => urlParameters.size > 0 },
   consent: {
-    when: () => getConsentProvider(),
+    when: () => getConsent(),
     isBlockDependent: true,
-    mutationObserverParams: bodyChildMO,
+    moParams: bodyChildMO,
   },
   // test: broken-plugin
 };
@@ -94,12 +94,12 @@ function getIntersectionObserver(checkpoint) {
   if (!window.IntersectionObserver) {
     return null;
   }
-  const observer = new IntersectionObserver((entries) => {
+  const obs = new IntersectionObserver((entries) => {
     try {
       entries
         .filter((e) => e.isIntersecting)
         .forEach((e) => {
-          observer.unobserve(e.target); // observe only once
+          obs.unobserve(e.target); // observe only once
           const target = targetSelector(e.target);
           const source = sourceSelector(e.target);
           if (checkpoint === 'viewmedia') {
@@ -118,15 +118,16 @@ function getIntersectionObserver(checkpoint) {
       // something went wrong
     }
   });
-  return observer;
+  return obs;
 }
 
-const PLUGIN_PARAMETERS = {
+const PLUGIN_PARAMS = {
   context: document.body,
   fflags,
   sampleRUM,
   sourceSelector,
   targetSelector,
+  untrustedClickPayload,
   getIntersectionObserver,
   createMO,
 };
@@ -137,14 +138,14 @@ function loadPlugin(key, params) {
   const plugin = PLUGINS[key];
   const usp = new URLSearchParams(window.location.search);
   if (!pluginCache.has(key) && plugin.when && !plugin.when({ ...params, urlParameters: usp })) {
-    if (plugin.mutationObserverParams && !plugin.isBeingObserved) {
+    if (plugin.moParams && !plugin.isBeingObserved) {
       // eslint-disable-next-line no-use-before-define
       createPluginMO(key, params, usp);
     }
     return null;
   }
   if (key === 'consent') {
-    plugin.url = `${pluginBasePath}/${getConsentProvider().name}.js`;
+    plugin.url = `${pluginBase}/${getConsent().name}.js`;
   }
 
   if (!pluginCache.has(key)) {
@@ -156,7 +157,7 @@ function loadPlugin(key, params) {
     .catch(() => { /* silent plugin error catching */ });
 }
 
-function loadPlugins(filter = () => true, params = PLUGIN_PARAMETERS) {
+function loadPlugins(filter = () => true, params = PLUGIN_PARAMS) {
   Object.entries(PLUGINS)
     .filter(([, plugin]) => filter(plugin))
     .map(([key]) => loadPlugin(key, params));
@@ -164,19 +165,19 @@ function loadPlugins(filter = () => true, params = PLUGIN_PARAMETERS) {
 
 function createPluginMO(key, params, usp) {
   const plugin = PLUGINS[key];
-  const observer = createMO(() => {
+  const obs = createMO(() => {
     if (plugin.when({ urlParameters: usp })) {
       plugin.isBeingObserved = false;
-      observer.disconnect();
+      obs.disconnect();
       loadPlugin(key, params);
     }
   });
 
-  if (observer instanceof MutationObserver) {
+  if (obs instanceof MutationObserver) {
     plugin.isBeingObserved = true;
-    observer.observe(
-      plugin.mutationObserverParams.target,
-      plugin.mutationObserverParams.options,
+    obs.observe(
+      plugin.moParams.target,
+      plugin.moParams.options,
     );
   }
 }
@@ -242,7 +243,7 @@ function addNavigationTracking() {
     } else {
       sampleRUM('enter', payload); // enter site
     }
-    loadPlugin('redirect', { ...PLUGIN_PARAMETERS, perfEntry });
+    loadPlugin('redirect', { ...PLUGIN_PARAMS, perfEntry });
   };
   const processed = new Set(); // avoid processing duplicate types
   new PerformanceObserver((list) => list
@@ -257,7 +258,7 @@ function addNavigationTracking() {
 }
 
 function addLoadResourceTracking() {
-  const observer = new PerformanceObserver((list) => {
+  const obs = new PerformanceObserver((list) => {
     try {
       const entries = list.getEntries();
       entries
@@ -265,14 +266,14 @@ function addLoadResourceTracking() {
         .filter((e) => window.location.hostname === new URL(e.name).hostname || fflags.has('allresources'))
         .filter((e) => {
           const { pathname, hostname } = new URL(e.name);
-          const extensionMatch = pathname.match(
+          const extMatch = pathname.match(
             hostname !== window.location.hostname
               ? '.*(\\.html$|\\.json|\\.js|graphql|api)'
               : '.*(\\.plain\\.html$|\\.json|graphql|api)',
           );
           const isDropIn = fflags.has('allresources') && (pathname.includes('__dropins__/storefront-') || pathname.includes('scripts/dropins/storefront-'));
           const isImage = fflags.has('allresources') && pathname.match(/\.(png|jpe?g|svg)$/i);
-          return extensionMatch || isDropIn || isImage;
+          return extMatch || isDropIn || isImage;
         })
         .forEach((e) => {
           sampleRUM('loadresource', { source: e.name, target: Math.round(e.duration) });
@@ -288,7 +289,7 @@ function addLoadResourceTracking() {
       // something went wrong
     }
   });
-  observer.observe({ type: 'resource', buffered: true });
+  obs.observe({ type: 'resource', buffered: true });
 }
 
 // activate blocks mutation observer
@@ -317,22 +318,22 @@ function activateMediaMO() {
   );
 }
 
-function addViewBlockTracking(element) {
-  const blockobserver = getIntersectionObserver('viewblock');
-  if (blockobserver) {
-    const blocks = element.getAttribute('data-block-status') ? [element] : element.querySelectorAll('div[data-block-status="loaded"]');
-    blocks.forEach((b) => blockobserver.observe(b));
+function addViewBlockTracking(el) {
+  const blockObs = getIntersectionObserver('viewblock');
+  if (blockObs) {
+    const blocks = el.getAttribute('data-block-status') ? [el] : el.querySelectorAll('div[data-block-status="loaded"]');
+    blocks.forEach((b) => blockObs.observe(b));
   }
 }
 
 const observedMedia = new Set();
 function addViewMediaTracking(parent) {
-  const mediaobserver = getIntersectionObserver('viewmedia');
-  if (mediaobserver) {
+  const mediaObs = getIntersectionObserver('viewmedia');
+  if (mediaObs) {
     parent.querySelectorAll('img, video, audio, iframe').forEach((m) => {
       if (!observedMedia.has(m)) {
         observedMedia.add(m);
-        mediaobserver.observe(m);
+        mediaObs.observe(m);
       }
     });
   }
@@ -349,7 +350,7 @@ function blocksMCB(mutations) {
     .filter((m) => m.type === 'attributes' && m.attributeName === 'data-block-status')
     .filter((m) => m.target.dataset.blockStatus === 'loaded')
     .forEach((m) => {
-      addObserver('form', (el) => loadPlugins((p) => p.isBlockDependent, { ...PLUGIN_PARAMETERS, context: el }), m.target);
+      addObserver('form', (el) => loadPlugins((p) => p.isBlockDependent, { ...PLUGIN_PARAMS, context: el }), m.target);
       addObserver('viewblock', addViewBlockTracking, m.target);
     });
 }
@@ -371,7 +372,8 @@ function addTrackingFromConfig() {
     if (event.optelHandled) {
       return;
     }
-    sampleRUM('click', { target: targetSelector(event.target), source: sourceSelector(event.target) });
+    // eslint-disable-next-line max-len
+    sampleRUM('click', { target: targetSelector(event.target), source: sourceSelector(event.target), ...untrustedClickPayload(event) });
   });
 
   // Core tracking

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/helix-rum-enhancer",
-  "version": "2.47.3",
+  "version": "2.49.0",
   "description": "Helix RUM Enhancer",
   "main": "src/index.js",
   "type": "module",
@@ -33,12 +33,12 @@
     "reporter-options": "configFile=.mocha-multi.json"
   },
   "devDependencies": {
-    "@adobe/eslint-config-helix": "3.0.26",
-    "@adobe/helix-rum-js": "2.14.3",
+    "@adobe/eslint-config-helix": "3.0.28",
+    "@adobe/helix-rum-js": "2.15.3",
     "@adobe/rollup-plugin-checksum": "1.2.0",
-    "@eslint/config-helpers": "0.5.5",
+    "@eslint/config-helpers": "0.6.0",
     "@esm-bundle/chai": "4.3.4-fix.0",
-    "@rollup/plugin-babel": "7.0.0",
+    "@rollup/plugin-babel": "7.1.0",
     "@semantic-release/changelog": "6.0.3",
     "@semantic-release/exec": "7.1.0",
     "@semantic-release/git": "10.0.1",
@@ -53,18 +53,18 @@
     "eslint": "9.30.1",
     "eslint-plugin-header": "3.1.1",
     "eslint-plugin-import": "2.32.0",
-    "globals": "17.5.0",
+    "globals": "17.6.0",
     "husky": "9.1.7",
     "jsdoc-to-markdown": "9.1.3",
     "junit-report-builder": "5.1.2",
     "lint-staged": "16.4.0",
-    "mocha": "11.7.5",
+    "mocha": "11.7.6",
     "mocha-multi-reporters": "1.5.1",
-    "rollup": "4.60.2",
+    "rollup": "4.62.2",
     "rollup-plugin-eslint-bundle": "9.0.0",
-    "semantic-release": "25.0.3",
+    "semantic-release": "25.0.5",
     "semantic-release-slack-bot": "^4.0.2",
-    "web-vitals": "5.2.0"
+    "web-vitals": "5.3.0"
   },
   "lint-staged": {
     "*.js": "eslint",

package/plugins/cwv.js

@@ -35,6 +35,17 @@ export default function addCWVTracking({
             data.target = targetSelector(element);
             data.source = sourceSelector(element) || (element && element.outerHTML.slice(0, 30));
           }
+          if (measurement.name === 'CLS' && measurement.entries.length > 0) {
+            // Attribute CLS to the element of the single largest layout shift
+            // (mirrors web-vitals' `largestShiftTarget`, derived from the standard entries).
+            const largest = measurement.entries
+              .reduce((a, b) => (b.value > (a ? a.value : 0) ? b : a), undefined);
+            const node = largest && largest.sources
+              && largest.sources.map((s) => s.node).find((n) => n && n.nodeType === 1);
+            if (node) {
+              data.source = sourceSelector(node) || node.outerHTML.slice(0, 30);
+            }
+          }
           sampleRUM('cwv', data);
         };
 

package/plugins/webcomponent.js

@@ -23,6 +23,7 @@ export default function addWebComponentTracking({
   sampleRUM,
   sourceSelector,
   targetSelector,
+  untrustedClickPayload,
   createMO,
 }) {
   /**
@@ -90,7 +91,8 @@ export default function addWebComponentTracking({
           }
           // eslint-disable-next-line no-param-reassign
           event.optelHandled = true;
-          sampleRUM('click', { target: targetSelector(event.target), source: sourceSelector(event.target) });
+          // eslint-disable-next-line max-len
+          sampleRUM('click', { target: targetSelector(event.target), source: sourceSelector(event.target), ...untrustedClickPayload(event) });
         });
       }
       // look for web components below this element