@shware/analytics 10.0.0 → 10.0.1

package/dist/tanstack/middleware.cjs

@@ -3,6 +3,18 @@ const require_click_id_index = require("../click-id/index.cjs");
 let _tanstack_react_start = require("@tanstack/react-start");
 //#region src/tanstack/middleware.ts
 /**
+* Whether a response could be stored by a shared cache (a CDN) under its `Cache-Control`. One
+* that is `private` or `no-store` already cannot, so a per-user `Set-Cookie` on it is safe as it
+* is, and its own caching is kept — the gtag.js loader served through a first-party Google Tag
+* Gateway (`private, max-age=…`) stays in the browser cache, where a browser never replays a
+* `Set-Cookie`. Anything else — `public`, `s-maxage`, no header at all — might be shared, and is
+* made uncacheable.
+*/
+function sharedCacheable(value) {
+	if (!value) return true;
+	return !value.toLowerCase().split(",").map((directive) => directive.trim()).some((directive) => directive === "private" || directive.startsWith("private=") || directive === "no-store");
+}
+/**
 * TanStack Start request middleware that persists the ad platforms' first-party cookies on the
 * document response: `_fbc`, `_fbp`, `_gcl_aw` / `_gcl_gb`, `_rdt_cid`, `_rdt_uuid`,
 * `_uetmsclkid`, `__oppref` and `__obref`.
@@ -43,7 +55,7 @@ function createClickIdMiddleware(options) {
 		});
 		if (cookies.length > 0) {
 			for (const header of require_click_id_index.toSetCookieHeaders(cookies)) result.response.headers.append("set-cookie", header);
-			if (cacheControl !== false) result.response.headers.set("cache-control", cacheControl);
+			if (cacheControl !== false && sharedCacheable(result.response.headers.get("cache-control"))) result.response.headers.set("cache-control", cacheControl);
 		}
 		return result;
 	});

package/dist/tanstack/middleware.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.cjs","names":["createMiddleware","resolveClickIdCookies","toSetCookieHeaders"],"sources":["../../src/tanstack/middleware.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start';\nimport { resolveClickIdCookies, toSetCookieHeaders } from '../click-id/index';\n\nexport interface ClickIdMiddlewareOptions {\n  /**\n   * `Domain` attribute for the cookies: the site's registrable domain, e.g. `.shware.io`, where the\n   * pixels write theirs. Required — set it in production; `null` (host-only) is for `localhost`.\n   * See `ResolveClickIdCookiesInput.domain`.\n   */\n  domain: string | null;\n  /** `Secure` attribute, default true. Set false only for local http testing. */\n  secure?: boolean;\n  /** subdomainIndex for a freshly built `_fbc` (com=0, example.com=1, www.example.com=2). Default 1. */\n  subdomainIndex?: number;\n  /**\n   * Re-issue the stored click and browser ids on every request as an ITP self-heal: the pixels\n   * rewrite them through `document.cookie`, which Safari caps at 7 days (24 hours on an\n   * ad-decorated landing), and the re-issue restores the long-lived HTTP cookie. On by default.\n   * Note it attaches a per-user `Set-Cookie` — and thus `no-store` — to every page response of a\n   * visitor carrying one; set false to keep those pages CDN-cacheable. See\n   * {@link resolveClickIdCookies}.\n   */\n  refresh?: boolean;\n  /**\n   * Override the `Cache-Control` of a response we attach cookies to (default `private, no-store`).\n   * A per-user `Set-Cookie` must never end up on a shared-cache entry, or one visitor's `_fbc` would\n   * be served to everyone. Only set this false if you guarantee these responses are never cached.\n   */\n  cacheControl?: string | false;\n  /**\n   * Consent gate. Return false to skip setting cookies for this request (e.g. before the visitor has\n   * granted consent where required). Runs per request with the incoming `Request`.\n   */\n  shouldPersist?: (request: Request) => boolean;\n}\n\n/**\n * TanStack Start request middleware that persists the ad platforms' first-party cookies on the\n * document response: `_fbc`, `_fbp`, `_gcl_aw` / `_gcl_gb`, `_rdt_cid`, `_rdt_uuid`,\n * `_uetmsclkid`, `__oppref` and `__obref`.\n *\n * Setting `_fbc` here — on the top document via an HTTP `Set-Cookie` header, before any client JS\n * runs — is what Meta officially recommends and the only reliable way to keep the cookie alive for\n * 90 days in Safari: ITP caps JavaScript-set cookies on a fbclid-decorated landing page to 24\n * hours, and a document response is never classified as CNAME/IP cloaking (it is the reference the\n * browser measures cloaking against).\n *\n * Register it as a global request middleware:\n * ```ts\n * // start.ts\n * import { createStart } from '@tanstack/react-start'\n * import { createClickIdMiddleware } from '@shware/analytics/tanstack'\n * const clickIdMiddleware = createClickIdMiddleware({\n *   domain: import.meta.env.DEV ? null : '.example.com',\n *   secure: !import.meta.env.DEV,\n * })\n * export const startInstance = createStart(() => ({ requestMiddleware: [clickIdMiddleware] }))\n * ```\n *\n * reference: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/fbp-and-fbc\n */\nexport function createClickIdMiddleware(options: ClickIdMiddlewareOptions) {\n  const { cacheControl = 'private, no-store' } = options;\n\n  return createMiddleware({ type: 'request' }).server(async ({ request, next, handlerType }) => {\n    const result = await next();\n\n    // Skip serverFn RPC responses. 'router' covers SSR document requests *and* custom server\n    // routes (API endpoints) — those also get cookies when the URL carries a click id.\n    if (handlerType !== 'router') return result;\n    if (options.shouldPersist && !options.shouldPersist(request)) return result;\n\n    const { cookies } = resolveClickIdCookies({\n      url: request.url,\n      cookieHeader: request.headers.get('cookie'),\n      domain: options.domain,\n      secure: options.secure,\n      subdomainIndex: options.subdomainIndex,\n      refresh: options.refresh ?? true,\n    });\n\n    if (cookies.length > 0) {\n      for (const header of toSetCookieHeaders(cookies)) {\n        result.response.headers.append('set-cookie', header);\n      }\n      if (cacheControl !== false) {\n        result.response.headers.set('cache-control', cacheControl);\n      }\n    }\n\n    return result;\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6DA,SAAgB,wBAAwB,SAAmC;CACzE,MAAM,EAAE,eAAe,wBAAwB;CAE/C,QAAA,GAAOA,sBAAAA,iBAAAA,CAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,SAAS,MAAM,kBAAkB;EAC5F,MAAM,SAAS,MAAM,KAAK;EAI1B,IAAI,gBAAgB,UAAU,OAAO;EACrC,IAAI,QAAQ,iBAAiB,CAAC,QAAQ,cAAc,OAAO,GAAG,OAAO;EAErE,MAAM,EAAE,YAAYC,uBAAAA,sBAAsB;GACxC,KAAK,QAAQ;GACb,cAAc,QAAQ,QAAQ,IAAI,QAAQ;GAC1C,QAAQ,QAAQ;GAChB,QAAQ,QAAQ;GAChB,gBAAgB,QAAQ;GACxB,SAAS,QAAQ,WAAW;EAC9B,CAAC;EAED,IAAI,QAAQ,SAAS,GAAG;GACtB,KAAK,MAAM,UAAUC,uBAAAA,mBAAmB,OAAO,GAC7C,OAAO,SAAS,QAAQ,OAAO,cAAc,MAAM;GAErD,IAAI,iBAAiB,OACnB,OAAO,SAAS,QAAQ,IAAI,iBAAiB,YAAY;EAE7D;EAEA,OAAO;CACT,CAAC;AACH"}
+{"version":3,"file":"middleware.cjs","names":["createMiddleware","resolveClickIdCookies","toSetCookieHeaders"],"sources":["../../src/tanstack/middleware.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start';\nimport { resolveClickIdCookies, toSetCookieHeaders } from '../click-id/index';\n\nexport interface ClickIdMiddlewareOptions {\n  /**\n   * `Domain` attribute for the cookies: the site's registrable domain, e.g. `.shware.io`, where the\n   * pixels write theirs. Required — set it in production; `null` (host-only) is for `localhost`.\n   * See `ResolveClickIdCookiesInput.domain`.\n   */\n  domain: string | null;\n  /** `Secure` attribute, default true. Set false only for local http testing. */\n  secure?: boolean;\n  /** subdomainIndex for a freshly built `_fbc` (com=0, example.com=1, www.example.com=2). Default 1. */\n  subdomainIndex?: number;\n  /**\n   * Re-issue the stored click and browser ids on every request as an ITP self-heal: the pixels\n   * rewrite them through `document.cookie`, which Safari caps at 7 days (24 hours on an\n   * ad-decorated landing), and the re-issue restores the long-lived HTTP cookie. On by default.\n   * Note it attaches a per-user `Set-Cookie` — and thus `no-store` — to every page response of a\n   * visitor carrying one; set false to keep those pages CDN-cacheable. See\n   * {@link resolveClickIdCookies}.\n   */\n  refresh?: boolean;\n  /**\n   * The `Cache-Control` for a response we attach cookies to when it could otherwise be stored by a\n   * shared cache (default `private, no-store`): a per-user `Set-Cookie` must never end up on a\n   * shared-cache entry, or one visitor's `_fbc` would be served to everyone. A response already\n   * `private` or `no-store` keeps its own. Only set this false if you guarantee these responses\n   * are never cached.\n   */\n  cacheControl?: string | false;\n  /**\n   * Consent gate. Return false to skip setting cookies for this request (e.g. before the visitor has\n   * granted consent where required). Runs per request with the incoming `Request`.\n   */\n  shouldPersist?: (request: Request) => boolean;\n}\n\n/**\n * Whether a response could be stored by a shared cache (a CDN) under its `Cache-Control`. One\n * that is `private` or `no-store` already cannot, so a per-user `Set-Cookie` on it is safe as it\n * is, and its own caching is kept — the gtag.js loader served through a first-party Google Tag\n * Gateway (`private, max-age=…`) stays in the browser cache, where a browser never replays a\n * `Set-Cookie`. Anything else — `public`, `s-maxage`, no header at all — might be shared, and is\n * made uncacheable.\n */\nfunction sharedCacheable(value: string | null): boolean {\n  if (!value) return true;\n  const directives = value\n    .toLowerCase()\n    .split(',')\n    .map((directive) => directive.trim());\n  return !directives.some(\n    (directive) =>\n      directive === 'private' || directive.startsWith('private=') || directive === 'no-store'\n  );\n}\n\n/**\n * TanStack Start request middleware that persists the ad platforms' first-party cookies on the\n * document response: `_fbc`, `_fbp`, `_gcl_aw` / `_gcl_gb`, `_rdt_cid`, `_rdt_uuid`,\n * `_uetmsclkid`, `__oppref` and `__obref`.\n *\n * Setting `_fbc` here — on the top document via an HTTP `Set-Cookie` header, before any client JS\n * runs — is what Meta officially recommends and the only reliable way to keep the cookie alive for\n * 90 days in Safari: ITP caps JavaScript-set cookies on a fbclid-decorated landing page to 24\n * hours, and a document response is never classified as CNAME/IP cloaking (it is the reference the\n * browser measures cloaking against).\n *\n * Register it as a global request middleware:\n * ```ts\n * // start.ts\n * import { createStart } from '@tanstack/react-start'\n * import { createClickIdMiddleware } from '@shware/analytics/tanstack'\n * const clickIdMiddleware = createClickIdMiddleware({\n *   domain: import.meta.env.DEV ? null : '.example.com',\n *   secure: !import.meta.env.DEV,\n * })\n * export const startInstance = createStart(() => ({ requestMiddleware: [clickIdMiddleware] }))\n * ```\n *\n * reference: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/fbp-and-fbc\n */\nexport function createClickIdMiddleware(options: ClickIdMiddlewareOptions) {\n  const { cacheControl = 'private, no-store' } = options;\n\n  return createMiddleware({ type: 'request' }).server(async ({ request, next, handlerType }) => {\n    const result = await next();\n\n    // Skip serverFn RPC responses. 'router' covers SSR document requests *and* custom server\n    // routes (API endpoints) — those also get cookies when the URL carries a click id.\n    if (handlerType !== 'router') return result;\n    if (options.shouldPersist && !options.shouldPersist(request)) return result;\n\n    const { cookies } = resolveClickIdCookies({\n      url: request.url,\n      cookieHeader: request.headers.get('cookie'),\n      domain: options.domain,\n      secure: options.secure,\n      subdomainIndex: options.subdomainIndex,\n      refresh: options.refresh ?? true,\n    });\n\n    if (cookies.length > 0) {\n      for (const header of toSetCookieHeaders(cookies)) {\n        result.response.headers.append('set-cookie', header);\n      }\n      if (cacheControl !== false && sharedCacheable(result.response.headers.get('cache-control'))) {\n        result.response.headers.set('cache-control', cacheControl);\n      }\n    }\n\n    return result;\n  });\n}\n"],"mappings":";;;;;;;;;;;;AA8CA,SAAS,gBAAgB,OAA+B;CACtD,IAAI,CAAC,OAAO,OAAO;CAKnB,OAAO,CAJY,MAChB,YAAY,CAAC,CACb,MAAM,GAAG,CAAC,CACV,KAAK,cAAc,UAAU,KAAK,CACpB,CAAC,CAAC,MAChB,cACC,cAAc,aAAa,UAAU,WAAW,UAAU,KAAK,cAAc,UACjF;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,SAAgB,wBAAwB,SAAmC;CACzE,MAAM,EAAE,eAAe,wBAAwB;CAE/C,QAAA,GAAOA,sBAAAA,iBAAAA,CAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,SAAS,MAAM,kBAAkB;EAC5F,MAAM,SAAS,MAAM,KAAK;EAI1B,IAAI,gBAAgB,UAAU,OAAO;EACrC,IAAI,QAAQ,iBAAiB,CAAC,QAAQ,cAAc,OAAO,GAAG,OAAO;EAErE,MAAM,EAAE,YAAYC,uBAAAA,sBAAsB;GACxC,KAAK,QAAQ;GACb,cAAc,QAAQ,QAAQ,IAAI,QAAQ;GAC1C,QAAQ,QAAQ;GAChB,QAAQ,QAAQ;GAChB,gBAAgB,QAAQ;GACxB,SAAS,QAAQ,WAAW;EAC9B,CAAC;EAED,IAAI,QAAQ,SAAS,GAAG;GACtB,KAAK,MAAM,UAAUC,uBAAAA,mBAAmB,OAAO,GAC7C,OAAO,SAAS,QAAQ,OAAO,cAAc,MAAM;GAErD,IAAI,iBAAiB,SAAS,gBAAgB,OAAO,SAAS,QAAQ,IAAI,eAAe,CAAC,GACxF,OAAO,SAAS,QAAQ,IAAI,iBAAiB,YAAY;EAE7D;EAEA,OAAO;CACT,CAAC;AACH"}

package/dist/tanstack/middleware.d.cts

@@ -20,9 +20,11 @@ export interface ClickIdMiddlewareOptions {
    */
   refresh?: boolean;
   /**
-   * Override the `Cache-Control` of a response we attach cookies to (default `private, no-store`).
-   * A per-user `Set-Cookie` must never end up on a shared-cache entry, or one visitor's `_fbc` would
-   * be served to everyone. Only set this false if you guarantee these responses are never cached.
+   * The `Cache-Control` for a response we attach cookies to when it could otherwise be stored by a
+   * shared cache (default `private, no-store`): a per-user `Set-Cookie` must never end up on a
+   * shared-cache entry, or one visitor's `_fbc` would be served to everyone. A response already
+   * `private` or `no-store` keeps its own. Only set this false if you guarantee these responses
+   * are never cached.
    */
   cacheControl?: string | false;
   /**

package/dist/tanstack/middleware.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.cts","names":[],"sources":["../../src/tanstack/middleware.ts"],"mappings":";iBAGiB;;;;;;EAMf;;EAEA;;EAEA;;;;;;;;;EASA;;;;;;EAMA;;;;;EAKA,iBAAiB,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA4BZ,wBAAwB,SAAS,2DAAwB"}
+{"version":3,"file":"middleware.d.cts","names":[],"sources":["../../src/tanstack/middleware.ts"],"mappings":";iBAGiB;;;;;;EAMf;;EAEA;;EAEA;;;;;;;;;EASA;;;;;;;;EAQA;;;;;EAKA,iBAAiB,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAgDZ,wBAAwB,SAAS,2DAAwB"}

package/dist/tanstack/middleware.d.mts

@@ -20,9 +20,11 @@ export interface ClickIdMiddlewareOptions {
    */
   refresh?: boolean;
   /**
-   * Override the `Cache-Control` of a response we attach cookies to (default `private, no-store`).
-   * A per-user `Set-Cookie` must never end up on a shared-cache entry, or one visitor's `_fbc` would
-   * be served to everyone. Only set this false if you guarantee these responses are never cached.
+   * The `Cache-Control` for a response we attach cookies to when it could otherwise be stored by a
+   * shared cache (default `private, no-store`): a per-user `Set-Cookie` must never end up on a
+   * shared-cache entry, or one visitor's `_fbc` would be served to everyone. A response already
+   * `private` or `no-store` keeps its own. Only set this false if you guarantee these responses
+   * are never cached.
    */
   cacheControl?: string | false;
   /**

package/dist/tanstack/middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.mts","names":[],"sources":["../../src/tanstack/middleware.ts"],"mappings":";iBAGiB;;;;;;EAMf;;EAEA;;EAEA;;;;;;;;;EASA;;;;;;EAMA;;;;;EAKA,iBAAiB,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA4BZ,wBAAwB,SAAS,2DAAwB"}
+{"version":3,"file":"middleware.d.mts","names":[],"sources":["../../src/tanstack/middleware.ts"],"mappings":";iBAGiB;;;;;;EAMf;;EAEA;;EAEA;;;;;;;;;EASA;;;;;;;;EAQA;;;;;EAKA,iBAAiB,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAgDZ,wBAAwB,SAAS,2DAAwB"}

package/dist/tanstack/middleware.mjs

@@ -2,6 +2,18 @@ import { resolveClickIdCookies, toSetCookieHeaders } from "../click-id/index.mjs
 import { createMiddleware } from "@tanstack/react-start";
 //#region src/tanstack/middleware.ts
 /**
+* Whether a response could be stored by a shared cache (a CDN) under its `Cache-Control`. One
+* that is `private` or `no-store` already cannot, so a per-user `Set-Cookie` on it is safe as it
+* is, and its own caching is kept — the gtag.js loader served through a first-party Google Tag
+* Gateway (`private, max-age=…`) stays in the browser cache, where a browser never replays a
+* `Set-Cookie`. Anything else — `public`, `s-maxage`, no header at all — might be shared, and is
+* made uncacheable.
+*/
+function sharedCacheable(value) {
+	if (!value) return true;
+	return !value.toLowerCase().split(",").map((directive) => directive.trim()).some((directive) => directive === "private" || directive.startsWith("private=") || directive === "no-store");
+}
+/**
 * TanStack Start request middleware that persists the ad platforms' first-party cookies on the
 * document response: `_fbc`, `_fbp`, `_gcl_aw` / `_gcl_gb`, `_rdt_cid`, `_rdt_uuid`,
 * `_uetmsclkid`, `__oppref` and `__obref`.
@@ -42,7 +54,7 @@ function createClickIdMiddleware(options) {
 		});
 		if (cookies.length > 0) {
 			for (const header of toSetCookieHeaders(cookies)) result.response.headers.append("set-cookie", header);
-			if (cacheControl !== false) result.response.headers.set("cache-control", cacheControl);
+			if (cacheControl !== false && sharedCacheable(result.response.headers.get("cache-control"))) result.response.headers.set("cache-control", cacheControl);
 		}
 		return result;
 	});

package/dist/tanstack/middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.mjs","names":[],"sources":["../../src/tanstack/middleware.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start';\nimport { resolveClickIdCookies, toSetCookieHeaders } from '../click-id/index';\n\nexport interface ClickIdMiddlewareOptions {\n  /**\n   * `Domain` attribute for the cookies: the site's registrable domain, e.g. `.shware.io`, where the\n   * pixels write theirs. Required — set it in production; `null` (host-only) is for `localhost`.\n   * See `ResolveClickIdCookiesInput.domain`.\n   */\n  domain: string | null;\n  /** `Secure` attribute, default true. Set false only for local http testing. */\n  secure?: boolean;\n  /** subdomainIndex for a freshly built `_fbc` (com=0, example.com=1, www.example.com=2). Default 1. */\n  subdomainIndex?: number;\n  /**\n   * Re-issue the stored click and browser ids on every request as an ITP self-heal: the pixels\n   * rewrite them through `document.cookie`, which Safari caps at 7 days (24 hours on an\n   * ad-decorated landing), and the re-issue restores the long-lived HTTP cookie. On by default.\n   * Note it attaches a per-user `Set-Cookie` — and thus `no-store` — to every page response of a\n   * visitor carrying one; set false to keep those pages CDN-cacheable. See\n   * {@link resolveClickIdCookies}.\n   */\n  refresh?: boolean;\n  /**\n   * Override the `Cache-Control` of a response we attach cookies to (default `private, no-store`).\n   * A per-user `Set-Cookie` must never end up on a shared-cache entry, or one visitor's `_fbc` would\n   * be served to everyone. Only set this false if you guarantee these responses are never cached.\n   */\n  cacheControl?: string | false;\n  /**\n   * Consent gate. Return false to skip setting cookies for this request (e.g. before the visitor has\n   * granted consent where required). Runs per request with the incoming `Request`.\n   */\n  shouldPersist?: (request: Request) => boolean;\n}\n\n/**\n * TanStack Start request middleware that persists the ad platforms' first-party cookies on the\n * document response: `_fbc`, `_fbp`, `_gcl_aw` / `_gcl_gb`, `_rdt_cid`, `_rdt_uuid`,\n * `_uetmsclkid`, `__oppref` and `__obref`.\n *\n * Setting `_fbc` here — on the top document via an HTTP `Set-Cookie` header, before any client JS\n * runs — is what Meta officially recommends and the only reliable way to keep the cookie alive for\n * 90 days in Safari: ITP caps JavaScript-set cookies on a fbclid-decorated landing page to 24\n * hours, and a document response is never classified as CNAME/IP cloaking (it is the reference the\n * browser measures cloaking against).\n *\n * Register it as a global request middleware:\n * ```ts\n * // start.ts\n * import { createStart } from '@tanstack/react-start'\n * import { createClickIdMiddleware } from '@shware/analytics/tanstack'\n * const clickIdMiddleware = createClickIdMiddleware({\n *   domain: import.meta.env.DEV ? null : '.example.com',\n *   secure: !import.meta.env.DEV,\n * })\n * export const startInstance = createStart(() => ({ requestMiddleware: [clickIdMiddleware] }))\n * ```\n *\n * reference: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/fbp-and-fbc\n */\nexport function createClickIdMiddleware(options: ClickIdMiddlewareOptions) {\n  const { cacheControl = 'private, no-store' } = options;\n\n  return createMiddleware({ type: 'request' }).server(async ({ request, next, handlerType }) => {\n    const result = await next();\n\n    // Skip serverFn RPC responses. 'router' covers SSR document requests *and* custom server\n    // routes (API endpoints) — those also get cookies when the URL carries a click id.\n    if (handlerType !== 'router') return result;\n    if (options.shouldPersist && !options.shouldPersist(request)) return result;\n\n    const { cookies } = resolveClickIdCookies({\n      url: request.url,\n      cookieHeader: request.headers.get('cookie'),\n      domain: options.domain,\n      secure: options.secure,\n      subdomainIndex: options.subdomainIndex,\n      refresh: options.refresh ?? true,\n    });\n\n    if (cookies.length > 0) {\n      for (const header of toSetCookieHeaders(cookies)) {\n        result.response.headers.append('set-cookie', header);\n      }\n      if (cacheControl !== false) {\n        result.response.headers.set('cache-control', cacheControl);\n      }\n    }\n\n    return result;\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6DA,SAAgB,wBAAwB,SAAmC;CACzE,MAAM,EAAE,eAAe,wBAAwB;CAE/C,OAAO,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,SAAS,MAAM,kBAAkB;EAC5F,MAAM,SAAS,MAAM,KAAK;EAI1B,IAAI,gBAAgB,UAAU,OAAO;EACrC,IAAI,QAAQ,iBAAiB,CAAC,QAAQ,cAAc,OAAO,GAAG,OAAO;EAErE,MAAM,EAAE,YAAY,sBAAsB;GACxC,KAAK,QAAQ;GACb,cAAc,QAAQ,QAAQ,IAAI,QAAQ;GAC1C,QAAQ,QAAQ;GAChB,QAAQ,QAAQ;GAChB,gBAAgB,QAAQ;GACxB,SAAS,QAAQ,WAAW;EAC9B,CAAC;EAED,IAAI,QAAQ,SAAS,GAAG;GACtB,KAAK,MAAM,UAAU,mBAAmB,OAAO,GAC7C,OAAO,SAAS,QAAQ,OAAO,cAAc,MAAM;GAErD,IAAI,iBAAiB,OACnB,OAAO,SAAS,QAAQ,IAAI,iBAAiB,YAAY;EAE7D;EAEA,OAAO;CACT,CAAC;AACH"}
+{"version":3,"file":"middleware.mjs","names":[],"sources":["../../src/tanstack/middleware.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start';\nimport { resolveClickIdCookies, toSetCookieHeaders } from '../click-id/index';\n\nexport interface ClickIdMiddlewareOptions {\n  /**\n   * `Domain` attribute for the cookies: the site's registrable domain, e.g. `.shware.io`, where the\n   * pixels write theirs. Required — set it in production; `null` (host-only) is for `localhost`.\n   * See `ResolveClickIdCookiesInput.domain`.\n   */\n  domain: string | null;\n  /** `Secure` attribute, default true. Set false only for local http testing. */\n  secure?: boolean;\n  /** subdomainIndex for a freshly built `_fbc` (com=0, example.com=1, www.example.com=2). Default 1. */\n  subdomainIndex?: number;\n  /**\n   * Re-issue the stored click and browser ids on every request as an ITP self-heal: the pixels\n   * rewrite them through `document.cookie`, which Safari caps at 7 days (24 hours on an\n   * ad-decorated landing), and the re-issue restores the long-lived HTTP cookie. On by default.\n   * Note it attaches a per-user `Set-Cookie` — and thus `no-store` — to every page response of a\n   * visitor carrying one; set false to keep those pages CDN-cacheable. See\n   * {@link resolveClickIdCookies}.\n   */\n  refresh?: boolean;\n  /**\n   * The `Cache-Control` for a response we attach cookies to when it could otherwise be stored by a\n   * shared cache (default `private, no-store`): a per-user `Set-Cookie` must never end up on a\n   * shared-cache entry, or one visitor's `_fbc` would be served to everyone. A response already\n   * `private` or `no-store` keeps its own. Only set this false if you guarantee these responses\n   * are never cached.\n   */\n  cacheControl?: string | false;\n  /**\n   * Consent gate. Return false to skip setting cookies for this request (e.g. before the visitor has\n   * granted consent where required). Runs per request with the incoming `Request`.\n   */\n  shouldPersist?: (request: Request) => boolean;\n}\n\n/**\n * Whether a response could be stored by a shared cache (a CDN) under its `Cache-Control`. One\n * that is `private` or `no-store` already cannot, so a per-user `Set-Cookie` on it is safe as it\n * is, and its own caching is kept — the gtag.js loader served through a first-party Google Tag\n * Gateway (`private, max-age=…`) stays in the browser cache, where a browser never replays a\n * `Set-Cookie`. Anything else — `public`, `s-maxage`, no header at all — might be shared, and is\n * made uncacheable.\n */\nfunction sharedCacheable(value: string | null): boolean {\n  if (!value) return true;\n  const directives = value\n    .toLowerCase()\n    .split(',')\n    .map((directive) => directive.trim());\n  return !directives.some(\n    (directive) =>\n      directive === 'private' || directive.startsWith('private=') || directive === 'no-store'\n  );\n}\n\n/**\n * TanStack Start request middleware that persists the ad platforms' first-party cookies on the\n * document response: `_fbc`, `_fbp`, `_gcl_aw` / `_gcl_gb`, `_rdt_cid`, `_rdt_uuid`,\n * `_uetmsclkid`, `__oppref` and `__obref`.\n *\n * Setting `_fbc` here — on the top document via an HTTP `Set-Cookie` header, before any client JS\n * runs — is what Meta officially recommends and the only reliable way to keep the cookie alive for\n * 90 days in Safari: ITP caps JavaScript-set cookies on a fbclid-decorated landing page to 24\n * hours, and a document response is never classified as CNAME/IP cloaking (it is the reference the\n * browser measures cloaking against).\n *\n * Register it as a global request middleware:\n * ```ts\n * // start.ts\n * import { createStart } from '@tanstack/react-start'\n * import { createClickIdMiddleware } from '@shware/analytics/tanstack'\n * const clickIdMiddleware = createClickIdMiddleware({\n *   domain: import.meta.env.DEV ? null : '.example.com',\n *   secure: !import.meta.env.DEV,\n * })\n * export const startInstance = createStart(() => ({ requestMiddleware: [clickIdMiddleware] }))\n * ```\n *\n * reference: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/fbp-and-fbc\n */\nexport function createClickIdMiddleware(options: ClickIdMiddlewareOptions) {\n  const { cacheControl = 'private, no-store' } = options;\n\n  return createMiddleware({ type: 'request' }).server(async ({ request, next, handlerType }) => {\n    const result = await next();\n\n    // Skip serverFn RPC responses. 'router' covers SSR document requests *and* custom server\n    // routes (API endpoints) — those also get cookies when the URL carries a click id.\n    if (handlerType !== 'router') return result;\n    if (options.shouldPersist && !options.shouldPersist(request)) return result;\n\n    const { cookies } = resolveClickIdCookies({\n      url: request.url,\n      cookieHeader: request.headers.get('cookie'),\n      domain: options.domain,\n      secure: options.secure,\n      subdomainIndex: options.subdomainIndex,\n      refresh: options.refresh ?? true,\n    });\n\n    if (cookies.length > 0) {\n      for (const header of toSetCookieHeaders(cookies)) {\n        result.response.headers.append('set-cookie', header);\n      }\n      if (cacheControl !== false && sharedCacheable(result.response.headers.get('cache-control'))) {\n        result.response.headers.set('cache-control', cacheControl);\n      }\n    }\n\n    return result;\n  });\n}\n"],"mappings":";;;;;;;;;;;AA8CA,SAAS,gBAAgB,OAA+B;CACtD,IAAI,CAAC,OAAO,OAAO;CAKnB,OAAO,CAJY,MAChB,YAAY,CAAC,CACb,MAAM,GAAG,CAAC,CACV,KAAK,cAAc,UAAU,KAAK,CACpB,CAAC,CAAC,MAChB,cACC,cAAc,aAAa,UAAU,WAAW,UAAU,KAAK,cAAc,UACjF;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,SAAgB,wBAAwB,SAAmC;CACzE,MAAM,EAAE,eAAe,wBAAwB;CAE/C,OAAO,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,SAAS,MAAM,kBAAkB;EAC5F,MAAM,SAAS,MAAM,KAAK;EAI1B,IAAI,gBAAgB,UAAU,OAAO;EACrC,IAAI,QAAQ,iBAAiB,CAAC,QAAQ,cAAc,OAAO,GAAG,OAAO;EAErE,MAAM,EAAE,YAAY,sBAAsB;GACxC,KAAK,QAAQ;GACb,cAAc,QAAQ,QAAQ,IAAI,QAAQ;GAC1C,QAAQ,QAAQ;GAChB,QAAQ,QAAQ;GAChB,gBAAgB,QAAQ;GACxB,SAAS,QAAQ,WAAW;EAC9B,CAAC;EAED,IAAI,QAAQ,SAAS,GAAG;GACtB,KAAK,MAAM,UAAU,mBAAmB,OAAO,GAC7C,OAAO,SAAS,QAAQ,OAAO,cAAc,MAAM;GAErD,IAAI,iBAAiB,SAAS,gBAAgB,OAAO,SAAS,QAAQ,IAAI,eAAe,CAAC,GACxF,OAAO,SAAS,QAAQ,IAAI,iBAAiB,YAAY;EAE7D;EAEA,OAAO;CACT,CAAC;AACH"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shware/analytics",
-  "version": "10.0.0",
+  "version": "10.0.1",
   "private": false,
   "repository": {
     "type": "git",