@shware/analytics 11.11.2 → 11.13.0

package/dist/attribution/vocabulary.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"vocabulary.mjs","names":[],"sources":["../../src/attribution/vocabulary.ts"],"sourcesContent":["import type { AdvertisingInfo } from '../track/types';\n\n/**\n * The vocabulary attribution is built from, shared by every product's `session` table and by the\n * dashboards that read it. Data for `classifyTouch` (./classify), which turns it into a channel;\n * a product's dashboards read the same names back. What stays with the product is its own hostnames\n * (referrer exclusions) and its landing-page conventions.\n */\n\n/** A session that arrived through nothing we can name. GA's spelling, so dashboards read as GA. */\nexport const DIRECT_CHANNEL = '(direct)';\n/** The medium of a direct session. */\nexport const NO_MEDIUM = '(none)';\n/** The medium of a tagged link that named a source but no medium. */\nexport const MEDIUM_NOT_SET = '(not set)';\n\n/** The channels the rules below can name. A `utm_source` outside this list is its own channel. */\nexport const CHANNELS = [\n  'meta',\n  'google',\n  'dv360',\n  'microsoft',\n  'tiktok',\n  'reddit',\n  'linkedin',\n  'snapchat',\n  'x',\n  'kakao',\n  'yandex',\n  'yahoo',\n  'duckduckgo',\n  'baidu',\n  'ecosia',\n  'naver',\n  'brave',\n  'pinterest',\n  'youtube',\n  'telegram',\n  /** Gmail's web and Android app: a link in a mail that carried no utm. */\n  'gmail',\n  /** AI assistants that send people to sites: ChatGPT tags its links `utm_source=chatgpt.com`, the\n   * others show as a referrer. Their own channel group, `organic_ai`, since GA4's default groups\n   * would file them under Referral / Unassigned and the question \"how much does AI bring\" comes up. */\n  'chatgpt',\n  'perplexity',\n  'gemini',\n  'claude',\n  'copilot',\n  'grok',\n  /** and the Chinese ones — DeepSeek, 豆包, Kimi, 通义, 腾讯元宝, 文心一言, 智谱清言 */\n  'deepseek',\n  'doubao',\n  'kimi',\n  'qwen',\n  'yuanbao',\n  'ernie',\n  'zhipu',\n  /** the product's own referral programme: the session came through a member's link or code.\n   * How a product recognises one (a `/refer/<code>` path, a code at sign-up) is its own rule. Not\n   * `referral`: that word is the channel group of any outside site, and a channel of the same name\n   * would be impossible to tell apart in queries. */\n  'referral_program',\n] as const;\n\nexport type Channel = (typeof CHANNELS)[number];\n\n/** GA4's default channel groups, as identifiers; a dashboard maps them to display names. */\nexport const CHANNEL_GROUPS = [\n  'direct',\n  'paid_search',\n  'paid_social',\n  'paid_other',\n  'display',\n  'organic_search',\n  'organic_social',\n  'organic_video',\n  /** not in GA4's default grouping: sessions an AI assistant sent, by referrer or by ChatGPT's utm */\n  'organic_ai',\n  'referral',\n  'email',\n  'affiliate',\n  /** GA4's SMS: `sms` as the source or the medium */\n  'sms',\n  /** GA4's Mobile Push Notifications: a medium ending in `push` or naming mobile or a notification, or `firebase` as the source */\n  'mobile_push',\n  'unassigned',\n] as const;\n\nexport type ChannelGroup = (typeof CHANNEL_GROUPS)[number];\n\n/** `utm_source` spellings that mean the same channel: Meta's `{{site_source_name}}` values and the usual synonyms. */\nexport const SOURCE_ALIASES = {\n  fb: 'meta',\n  ig: 'meta',\n  an: 'meta',\n  msg: 'meta',\n  th: 'meta',\n  facebook: 'meta',\n  instagram: 'meta',\n  bing: 'microsoft',\n  twitter: 'x',\n  'google ads': 'google',\n  googleads: 'google',\n  adwords: 'google',\n  'chatgpt.com': 'chatgpt',\n  'chat.openai.com': 'chatgpt',\n  openai: 'chatgpt',\n  'perplexity.ai': 'perplexity',\n  'claude.ai': 'claude',\n  'copilot.com': 'copilot',\n  'deepseek.com': 'deepseek',\n  'doubao.com': 'doubao',\n  'kimi.com': 'kimi',\n} as const satisfies Record<string, Channel>;\n\n/**\n * Which click id belongs to which channel, in priority order, and whether the platform puts it on\n * its ad clicks only (`'ads'`) or on other links as well (`'any'`). Every key is a field this SDK\n * collects (`AdvertisingInfo`).\n *\n * The third column decides whether the id can say a click was paid when a `utm_source` names the\n * channel but no `utm_medium` says how (a Reddit ad tagged `utm_source=reddit` and nothing more).\n * `fbclid` is `'any'`: Meta decorates every outbound link with it, organic posts, profile links\n * and shares included. `twclid` and `ko_click_id` are `'any'` until it is clear they never\n * decorate an organic link.\n *\n * Only URL parameters, never the cookies the tags keep beside them (`_fbc`, `_gcl_aw`, … — every\n * underscore key of `AdvertisingInfo`): a click cookie lives up to 90 days after the click, so\n * counting it named every later visit — typed in, from search, from an email — a new ad click.\n */\nexport const CLICK_ID_CHANNELS = [\n  ['fbclid', 'meta', 'any'],\n  ['gclid', 'google', 'ads'],\n  ['gbraid', 'google', 'ads'],\n  ['wbraid', 'google', 'ads'],\n  ['gad_source', 'google', 'ads'],\n  ['gad_campaignid', 'google', 'ads'],\n  ['dclid', 'dv360', 'ads'],\n  ['msclkid', 'microsoft', 'ads'],\n  ['ttclid', 'tiktok', 'ads'],\n  ['rdt_cid', 'reddit', 'ads'],\n  ['li_fat_id', 'linkedin', 'ads'],\n  ['ScCid', 'snapchat', 'ads'],\n  ['twclid', 'x', 'any'],\n  ['ko_click_id', 'kakao', 'any'],\n  ['yclid', 'yandex', 'ads'],\n  ['oppref', 'chatgpt', 'ads'],\n  ['epik', 'pinterest', 'ads'],\n] as const satisfies readonly (readonly [keyof AdvertisingInfo, Channel, 'ads' | 'any'])[];\n\n/**\n * A landing page reserved for one channel's ads, for ads that lost their parameters:\n * `/lp/<channel>`, with or without host, query and hash; the capture is the channel. A product\n * that names its landing pages differently replaces this.\n */\nexport const AD_LANDING_PAGE = /^(?:https?:\\/\\/[^/]+)?\\/lp\\/([a-z]+)(?:[/?#]|$)/;\n\nexport type ReferrerMedium = 'organic' | 'social' | 'video' | 'ai' | 'email';\n\n/**\n * Referrer hosts that name a channel, as regular expressions over the lower-cased host,\n * with the medium GA4 gives that kind of site. Anything else that refers is `referral`, kept as\n * its host. A country TLD is one or two labels (`google.com`, `google.co.uk`, `google.com.hk`),\n * never an open tail, so `google.com.evil.io` is not Google. In match order: the AI assistants\n * first, because `gemini.google.com`, `copilot.microsoft.com` and `yiyan.baidu.com` would\n * otherwise be Google, Microsoft and Baidu search.\n */\nexport const REFERRER_SITES = [\n  ['chatgpt', 'ai', /(^|\\.)(chatgpt\\.com|chat\\.openai\\.com)$/],\n  ['perplexity', 'ai', /(^|\\.)perplexity\\.ai$/],\n  ['gemini', 'ai', /^gemini\\.google\\.com$/],\n  ['claude', 'ai', /(^|\\.)claude\\.ai$/],\n  ['copilot', 'ai', /^copilot\\.microsoft\\.com$|(^|\\.)copilot\\.com$/],\n  ['grok', 'ai', /(^|\\.)(grok\\.com|x\\.ai)$/],\n  ['deepseek', 'ai', /(^|\\.)deepseek\\.com$/],\n  ['doubao', 'ai', /(^|\\.)doubao\\.com$/],\n  ['kimi', 'ai', /(^|\\.)(kimi\\.com|kimi\\.moonshot\\.cn|moonshot\\.cn)$/],\n  ['qwen', 'ai', /^tongyi\\.aliyun\\.com$|(^|\\.)(tongyi\\.com|qianwen\\.com|qwen\\.ai)$/],\n  ['yuanbao', 'ai', /^yuanbao\\.tencent\\.com$/],\n  ['ernie', 'ai', /^yiyan\\.baidu\\.com$|(^|\\.)ernie\\.baidu\\.com$/],\n  ['zhipu', 'ai', /(^|\\.)(chatglm\\.cn|zhipuai\\.cn|bigmodel\\.cn)$/],\n  // Before google, whose pattern it would match.\n  ['gmail', 'email', /^mail\\.google\\.com$/],\n  ['google', 'organic', /(^|\\.)google\\.[a-z]{2,}(\\.[a-z]{2,3})?$/],\n  ['microsoft', 'organic', /(^|\\.)bing\\.com$/],\n  ['yahoo', 'organic', /(^|\\.)yahoo\\.[a-z]{2,}(\\.[a-z]{2,3})?$/],\n  ['duckduckgo', 'organic', /(^|\\.)duckduckgo\\.com$/],\n  ['baidu', 'organic', /(^|\\.)baidu\\.com$/],\n  ['yandex', 'organic', /(^|\\.)yandex\\.[a-z]{2,}(\\.[a-z]{2,3})?$/],\n  ['ecosia', 'organic', /(^|\\.)ecosia\\.org$/],\n  ['naver', 'organic', /(^|\\.)naver\\.com$/],\n  ['brave', 'organic', /^search\\.brave\\.com$/],\n  ['meta', 'social', /(^|\\.)(facebook\\.com|instagram\\.com|fb\\.com|threads\\.net)$/],\n  ['x', 'social', /(^|\\.)(twitter\\.com|x\\.com|t\\.co)$/],\n  ['linkedin', 'social', /(^|\\.)(linkedin\\.com|lnkd\\.in)$/],\n  ['reddit', 'social', /(^|\\.)reddit\\.com$/],\n  ['tiktok', 'social', /(^|\\.)tiktok\\.com$/],\n  ['pinterest', 'social', /(^|\\.)pinterest\\.[a-z]{2,}(\\.[a-z]{2,3})?$/],\n  ['snapchat', 'social', /(^|\\.)snapchat\\.com$/],\n  ['telegram', 'social', /^(t\\.me|telegram\\.me|(web\\.)?telegram\\.org)$/],\n  ['youtube', 'video', /(^|\\.)(youtube\\.com|youtu\\.be)$/],\n] as const satisfies readonly (readonly [Channel, ReferrerMedium, RegExp])[];\n\n/**\n * The site an Android app's referrer stands for. A link opened from an app on Android arrives with\n * `android-app://<package>/` as its referrer rather than the site's URL; the apps below are read as\n * their sites, so the Google app is a Google search and the LinkedIn app is LinkedIn. A package\n * not listed is kept as the referring host, as GA4 shows it; Meta's apps send their mobile host\n * (`android-app://m.facebook.com`), which needs no entry.\n */\nexport const ANDROID_APP_HOSTS: Readonly<Record<string, string>> = {\n  'com.google.android.googlequicksearchbox': 'www.google.com',\n  'com.google.android.gm': 'mail.google.com',\n  'com.google.android.youtube': 'www.youtube.com',\n  'com.facebook.katana': 'www.facebook.com',\n  'com.instagram.android': 'www.instagram.com',\n  'com.linkedin.android': 'www.linkedin.com',\n  'com.reddit.frontpage': 'www.reddit.com',\n  'com.twitter.android': 'x.com',\n  'com.zhiliaoapp.musically': 'www.tiktok.com',\n  'com.ss.android.ugc.trill': 'www.tiktok.com',\n  'com.pinterest': 'www.pinterest.com',\n  'com.snapchat.android': 'www.snapchat.com',\n  'org.telegram.messenger': 't.me',\n};\n\n/**\n * Referrer hosts that are navigation, not acquisition, when a session happens to start on the way\n * back from them: the local dev host; the payment providers a visitor is bounced through; the\n * bot challenges (Cloudflare Turnstile, hCaptcha) a visitor passes before the page; the\n * sign-in providers whose login lives on a host of its own (Google, Apple, Microsoft, WeChat,\n * Kakao, LINE, Naver, Yahoo, Twitch, X's OAuth 1.0a endpoint); and the hosted auth services a\n * product may sit behind (Auth0, Okta, Supabase, Firebase, Clerk). A product appends its own\n * hostnames — a session that starts from an internal link after the session timeout refers to\n * them. Matched before `REFERRER_SITES`, so `nid.naver.com` and `login.yahoo.com` are not read as\n * a search. Providers whose login shares the host with their content — Facebook, X's OAuth 2.0,\n * LinkedIn, GitHub, Discord — cannot be told apart by host (referrer policies strip the path) and\n * are left as the referrers they usually are. Regular expressions over the lower-cased host.\n */\nexport const REFERRERS_NOT_A_TOUCH = [\n  /^localhost(:|$)/,\n  /^127\\.0\\.0\\.1$/,\n  // payment\n  /(^|\\.)stripe\\.com$/,\n  // Link, Stripe's wallet: a customer opens a merchant's site from their purchases on app.link.com\n  /(^|\\.)link\\.com$/,\n  /^pay\\.google\\.com$/,\n  /(^|\\.)paypal\\.com$/,\n  /(^|\\.)alipay\\.com$/,\n  /(^|\\.)paddle\\.com$/,\n  /(^|\\.)lemonsqueezy\\.com$/,\n  /^pay\\.amazon\\.com$/,\n  /^pay\\.weixin\\.qq\\.com$/,\n  // bot challenges a visitor is sent through before the page\n  /^challenges\\.cloudflare\\.com$/,\n  /(^|\\.)hcaptcha\\.com$/,\n  // app stores\n  /^apps\\.apple\\.com$/,\n  /^play\\.google\\.com$/,\n  // sign-in providers with a login host of their own\n  /^accounts\\.google\\.com$/,\n  /^appleid\\.apple\\.com$/,\n  /^login\\.(microsoftonline|live)\\.com$/,\n  /^open\\.weixin\\.qq\\.com$/,\n  /^(kauth|accounts)\\.kakao\\.com$/,\n  /^access\\.line\\.me$/,\n  /^nid\\.naver\\.com$/,\n  /^login\\.yahoo\\.com$/,\n  /^id\\.twitch\\.tv$/,\n  /^api\\.twitter\\.com$/,\n  // hosted auth services\n  /(^|\\.)auth0\\.com$/,\n  /(^|\\.)okta\\.com$/,\n  /(^|\\.)supabase\\.co$/,\n  /(^|\\.)firebaseapp\\.com$/,\n  /(^|\\.)clerk\\.accounts\\.dev$/,\n] as const;\n\n/** GA4's paid mediums — cpc, cpm, ppc, retargeting, paid_social, … — plus Performance Max. */\nexport const PAID_MEDIUM = /^(.*cp.*|ppc|retargeting|paid.*|pmax|performance_max)$/;\n/**\n * Meta's `{{placement}}` values, lower-cased, which an ad URL template of `utm_medium={{placement}}`\n * puts in the medium. Only an ad carries one — an organic post arrives as a referrer, with no utm\n * at all — so a medium in this list is a paid Meta click whatever the source says (a template with\n * `utm_source=meta-websitekeyinfo` was seen). Listed one by one rather than matched by prefix, so\n * that a hand-tagged `instagram_stories` post cannot be mistaken for an ad only because of how it\n * is spelled … which means a placement Meta adds later shows up as organic social (or unassigned,\n * under a source that is no social site) until it is added here. Meta's documented values plus the\n * ones seen in the wild (`facebook_mobile_reels`, `facebook_notification`, `an`), and the literal\n * macro for a template that did not expand it.\n *\n * Accepted for the ads already running with that template; new ads should rather send\n * `utm_medium=cpc` and the placement in a `placement` parameter of its own (collected as the\n * `placement` tag): GA4 matches its paid rule on the medium alone, and files a placement medium\n * under Organic Social.\n */\nexport const META_PLACEMENTS = [\n  'facebook_feed',\n  'facebook_instream',\n  'facebook_desktop_feed',\n  'facebook_mobile_feed',\n  'facebook_mobile_reels',\n  'facebook_reels',\n  'facebook_reels_overlay',\n  'facebook_right_column',\n  'facebook_marketplace',\n  'facebook_video_feeds',\n  'facebook_stories',\n  'facebook_search',\n  'facebook_instream_video',\n  'facebook_instant_article',\n  'facebook_groups_feed',\n  'facebook_profile_feed',\n  'facebook_notification',\n  'facebook_notifications',\n  'facebook_business_explore',\n  'instagram_feed',\n  'instagram_stories',\n  'instagram_reels',\n  'instagram_reels_overlay',\n  'instagram_explore',\n  'instagram_explore_home',\n  'instagram_search',\n  'instagram_shop',\n  'instagram_profile_feed',\n  'instagram_profile_reels',\n  'instagram_igtv',\n  'messenger_inbox',\n  'messenger_stories',\n  'messenger_sponsored_messages',\n  'threads_feed',\n  'threads_stream',\n  'whatsapp_status',\n  'audience_network_classic',\n  'audience_network_rewarded_video',\n  'audience_network_native_banner_and_interstitial',\n  'an',\n  'others',\n  /** the macro itself, when Meta did not expand it (written in a field it does not substitute, or a\n   * preview click): still only ever produced by a Meta ad URL, so still a paid Meta click */\n  '{{placement}}',\n] as const;\nexport const DISPLAY_MEDIUMS = ['display', 'banner', 'expandable', 'interstitial'] as const;\n/** GA4's email spellings, as a source or a medium. */\nexport const EMAIL_MEDIUMS = ['email', 'e-mail', 'e_mail', 'e mail'] as const;\n/** GA4's Mobile Push Notifications medium: ending in `push`, or containing `mobile` or `notification`. */\nexport const PUSH_MEDIUM = /(push$|mobile|notification)/;\n/** A medium that says email or newsletter anywhere in it: `outbound email`, `cold_email`, `newsletter`, and GA4's four. */\nexport const EMAIL_MEDIUM = /(^|[^a-z])(e[-_ ]?mail|newsletter)([^a-z]|$)/;\n\n/** Where a touch came from: a tracked session, or a report by the user or staff. */\nexport const TOUCH_SOURCES = ['tracked', 'reported'] as const;\nexport type TouchSource = (typeof TOUCH_SOURCES)[number];\n\n/**\n * How a reported touch was learned:\n * - survey: the user answered \"how did you hear about us\" (onboarding, checkout)\n * - promo_code: the user redeemed a code that belongs to a channel\n * - phone: a call came in on a channel's dedicated number, marked by staff or the phone system\n * - manual: staff recorded what a customer told them\n */\nexport const REPORTED_TOUCH_KINDS = ['survey', 'promo_code', 'phone', 'manual'] as const;\nexport type ReportedTouchKind = (typeof REPORTED_TOUCH_KINDS)[number];\n\n/**\n * How much a touch is worth against another when attribution has to choose between sessions;\n * lower wins, and the latest wins among equals. Stored on the session when it is classified, so\n * renumbering means reclassifying.\n *\n * This ranks touches against each other. Within one session the rules that name its channel have\n * their own order — `utm_source`, then a click id, then the ad landing page, then the referrer —\n * and the first that says something wins; the session's priority is then the tier of that rule\n * (a campaign rule whose touch is organic by its own tag ranking as a referrer, see `classifyTouch`).\n * So two sessions tagged with utm and gclid respectively are equal here (both `campaign`) and the\n * later one is credited, while one session carrying both is named by its utm.\n */\nexport const TOUCH_PRIORITY = {\n  /**\n   * utm, click id, ad landing page: someone tagged that link (in that order within a session) —\n   * unless the tag itself calls the touch organic, a referral or email, which then ranks as `referrer`\n   */\n  campaign: 1,\n  /** a reported touch staff stand behind: a call on a channel's number, a recorded conversation */\n  verified: 1,\n  /** the browser said where the visitor came from; nobody chose it */\n  referrer: 2,\n  /** a reported touch that is the user's claim: a survey answer, a code that may have been shared */\n  claimed: 3,\n} as const satisfies Record<string, number>;\n\n/** Which reported kinds are staff facts and which are the user's claims. */\nexport const REPORTED_TOUCH_PRIORITY = {\n  phone: TOUCH_PRIORITY.verified,\n  manual: TOUCH_PRIORITY.verified,\n  survey: TOUCH_PRIORITY.claimed,\n  promo_code: TOUCH_PRIORITY.claimed,\n} as const satisfies Record<ReportedTouchKind, number>;\n"],"mappings":";;;;;;;;AAUA,MAAa,iBAAiB;;AAE9B,MAAa,YAAY;;AAEzB,MAAa,iBAAiB;;AAG9B,MAAa,WAAW;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA;CAIA;CACA;CACA;CACA;CACA;CACA;CAEA;CACA;CACA;CACA;CACA;CACA;CACA;CAKA;AACF;;AAKA,MAAa,iBAAiB;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA;CACA;CACA;CACA;CAEA;CAEA;CACA;AACF;;AAKA,MAAa,iBAAiB;CAC5B,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,KAAK;CACL,IAAI;CACJ,UAAU;CACV,WAAW;CACX,MAAM;CACN,SAAS;CACT,cAAc;CACd,WAAW;CACX,SAAS;CACT,eAAe;CACf,mBAAmB;CACnB,QAAQ;CACR,iBAAiB;CACjB,aAAa;CACb,eAAe;CACf,gBAAgB;CAChB,cAAc;CACd,YAAY;AACd;;;;;;;;;;;;;;;;AAiBA,MAAa,oBAAoB;CAC/B;EAAC;EAAU;EAAQ;CAAK;CACxB;EAAC;EAAS;EAAU;CAAK;CACzB;EAAC;EAAU;EAAU;CAAK;CAC1B;EAAC;EAAU;EAAU;CAAK;CAC1B;EAAC;EAAc;EAAU;CAAK;CAC9B;EAAC;EAAkB;EAAU;CAAK;CAClC;EAAC;EAAS;EAAS;CAAK;CACxB;EAAC;EAAW;EAAa;CAAK;CAC9B;EAAC;EAAU;EAAU;CAAK;CAC1B;EAAC;EAAW;EAAU;CAAK;CAC3B;EAAC;EAAa;EAAY;CAAK;CAC/B;EAAC;EAAS;EAAY;CAAK;CAC3B;EAAC;EAAU;EAAK;CAAK;CACrB;EAAC;EAAe;EAAS;CAAK;CAC9B;EAAC;EAAS;EAAU;CAAK;CACzB;EAAC;EAAU;EAAW;CAAK;CAC3B;EAAC;EAAQ;EAAa;CAAK;AAC7B;;;;;;AAOA,MAAa,kBAAkB;;;;;;;;;AAY/B,MAAa,iBAAiB;CAC5B;EAAC;EAAW;EAAM;CAAyC;CAC3D;EAAC;EAAc;EAAM;CAAuB;CAC5C;EAAC;EAAU;EAAM;CAAuB;CACxC;EAAC;EAAU;EAAM;CAAmB;CACpC;EAAC;EAAW;EAAM;CAA+C;CACjE;EAAC;EAAQ;EAAM;CAA0B;CACzC;EAAC;EAAY;EAAM;CAAsB;CACzC;EAAC;EAAU;EAAM;CAAoB;CACrC;EAAC;EAAQ;EAAM;CAAoD;CACnE;EAAC;EAAQ;EAAM;CAAkE;CACjF;EAAC;EAAW;EAAM;CAAyB;CAC3C;EAAC;EAAS;EAAM;CAA8C;CAC9D;EAAC;EAAS;EAAM;CAA+C;CAE/D;EAAC;EAAS;EAAS;CAAqB;CACxC;EAAC;EAAU;EAAW;CAAyC;CAC/D;EAAC;EAAa;EAAW;CAAkB;CAC3C;EAAC;EAAS;EAAW;CAAwC;CAC7D;EAAC;EAAc;EAAW;CAAwB;CAClD;EAAC;EAAS;EAAW;CAAmB;CACxC;EAAC;EAAU;EAAW;CAAyC;CAC/D;EAAC;EAAU;EAAW;CAAoB;CAC1C;EAAC;EAAS;EAAW;CAAmB;CACxC;EAAC;EAAS;EAAW;CAAsB;CAC3C;EAAC;EAAQ;EAAU;CAA4D;CAC/E;EAAC;EAAK;EAAU;CAAoC;CACpD;EAAC;EAAY;EAAU;CAAiC;CACxD;EAAC;EAAU;EAAU;CAAoB;CACzC;EAAC;EAAU;EAAU;CAAoB;CACzC;EAAC;EAAa;EAAU;CAA4C;CACpE;EAAC;EAAY;EAAU;CAAsB;CAC7C;EAAC;EAAY;EAAU;CAA8C;CACrE;EAAC;EAAW;EAAS;CAAiC;AACxD;;;;;;;;AASA,MAAa,oBAAsD;CACjE,2CAA2C;CAC3C,yBAAyB;CACzB,8BAA8B;CAC9B,uBAAuB;CACvB,yBAAyB;CACzB,wBAAwB;CACxB,wBAAwB;CACxB,uBAAuB;CACvB,4BAA4B;CAC5B,4BAA4B;CAC5B,iBAAiB;CACjB,wBAAwB;CACxB,0BAA0B;AAC5B;;;;;;;;;;;;;;AAeA,MAAa,wBAAwB;CACnC;CACA;CAEA;CAEA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA;CACA;CAEA;CACA;CAEA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA;CACA;CACA;CACA;CACA;AACF;;AAGA,MAAa,cAAc;;;;;;;;;;;;;;;;;AAiB3B,MAAa,kBAAkB;CAC7B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;AACF;AACA,MAAa,kBAAkB;CAAC;CAAW;CAAU;CAAc;AAAc;;AAEjF,MAAa,gBAAgB;CAAC;CAAS;CAAU;CAAU;AAAQ;;AAEnE,MAAa,cAAc;;AAE3B,MAAa,eAAe;;AAG5B,MAAa,gBAAgB,CAAC,WAAW,UAAU;;;;;;;;AAUnD,MAAa,uBAAuB;CAAC;CAAU;CAAc;CAAS;AAAQ;;;;;;;;;;;;;AAe9E,MAAa,iBAAiB;;;;;CAK5B,UAAU;;CAEV,UAAU;;CAEV,UAAU;;CAEV,SAAS;AACX;;AAGA,MAAa,0BAA0B;CACrC,OAAO,eAAe;CACtB,QAAQ,eAAe;CACvB,QAAQ,eAAe;CACvB,YAAY,eAAe;AAC7B"}
+{"version":3,"file":"vocabulary.mjs","names":[],"sources":["../../src/attribution/vocabulary.ts"],"sourcesContent":["import type { AdvertisingInfo } from '../track/types';\n\n/**\n * The vocabulary attribution is built from, shared by every product's `session` table and by the\n * dashboards that read it. Data for `classifyTouch` (./classify), which turns it into a channel;\n * a product's dashboards read the same names back. What stays with the product is its own hostnames\n * (referrer exclusions) and its landing-page conventions.\n */\n\n/** A session that arrived through nothing we can name. GA's spelling, so dashboards read as GA. */\nexport const DIRECT_CHANNEL = '(direct)';\n/** The medium of a direct session. */\nexport const NO_MEDIUM = '(none)';\n/** The medium of a tagged link that named a source but no medium. */\nexport const MEDIUM_NOT_SET = '(not set)';\n\n/** The channels the rules below can name. A `utm_source` outside this list is its own channel. */\nexport const CHANNELS = [\n  'meta',\n  'google',\n  'dv360',\n  'microsoft',\n  'tiktok',\n  'reddit',\n  'linkedin',\n  'snapchat',\n  'x',\n  'kakao',\n  'yandex',\n  'yahoo',\n  'duckduckgo',\n  'baidu',\n  'ecosia',\n  'naver',\n  'brave',\n  'qwant',\n  'pinterest',\n  'youtube',\n  'telegram',\n  /** Webmail, by its web and Android app: a link in a mail that carried no utm. Outlook includes\n   * Microsoft 365's new `outlook.cloud.microsoft` and the links its Safe Links rewrote. */\n  'gmail',\n  'outlook',\n  'yahoo_mail',\n  'yandex_mail',\n  'naver_mail',\n  'qq_mail',\n  'netease_mail',\n  'proton_mail',\n  'seznam_mail',\n  /** GMX and WEB.DE, one company's webmail, whose links leave through its `deref-*` redirector */\n  'gmx',\n  'aol_mail',\n  'zoho_mail',\n  /** A mail whose client cannot be told: the link was rewritten by an email security gateway\n   * (Proofpoint URL Defense, Mimecast, Barracuda, …). */\n  'email',\n  /** AI assistants that send people to sites: ChatGPT tags its links `utm_source=chatgpt.com`, the\n   * others show as a referrer. Their own channel group, `organic_ai`, since GA4's default groups\n   * would file them under Referral / Unassigned and the question \"how much does AI bring\" comes up. */\n  'chatgpt',\n  'perplexity',\n  'gemini',\n  'claude',\n  'copilot',\n  'grok',\n  /** and the Chinese ones — DeepSeek, 豆包, Kimi, 通义, 腾讯元宝, 文心一言, 智谱清言 */\n  'deepseek',\n  'doubao',\n  'kimi',\n  'qwen',\n  'yuanbao',\n  'ernie',\n  'zhipu',\n  /** the product's own referral programme: the session came through a member's link or code.\n   * How a product recognises one (a `/refer/<code>` path, a code at sign-up) is its own rule. Not\n   * `referral`: that word is the channel group of any outside site, and a channel of the same name\n   * would be impossible to tell apart in queries. */\n  'referral_program',\n] as const;\n\nexport type Channel = (typeof CHANNELS)[number];\n\n/** GA4's default channel groups, as identifiers; a dashboard maps them to display names. */\nexport const CHANNEL_GROUPS = [\n  'direct',\n  'paid_search',\n  'paid_social',\n  'paid_other',\n  'display',\n  'organic_search',\n  'organic_social',\n  'organic_video',\n  /** not in GA4's default grouping: sessions an AI assistant sent, by referrer or by ChatGPT's utm */\n  'organic_ai',\n  'referral',\n  'email',\n  'affiliate',\n  /** GA4's SMS: `sms` as the source or the medium */\n  'sms',\n  /** GA4's Mobile Push Notifications: a medium ending in `push` or naming mobile or a notification, or `firebase` as the source */\n  'mobile_push',\n  'unassigned',\n] as const;\n\nexport type ChannelGroup = (typeof CHANNEL_GROUPS)[number];\n\n/** `utm_source` spellings that mean the same channel: Meta's `{{site_source_name}}` values and the usual synonyms. */\nexport const SOURCE_ALIASES = {\n  fb: 'meta',\n  ig: 'meta',\n  an: 'meta',\n  msg: 'meta',\n  th: 'meta',\n  facebook: 'meta',\n  instagram: 'meta',\n  bing: 'microsoft',\n  twitter: 'x',\n  'google ads': 'google',\n  googleads: 'google',\n  adwords: 'google',\n  'chatgpt.com': 'chatgpt',\n  'chat.openai.com': 'chatgpt',\n  openai: 'chatgpt',\n  'perplexity.ai': 'perplexity',\n  'claude.ai': 'claude',\n  'copilot.com': 'copilot',\n  'deepseek.com': 'deepseek',\n  'doubao.com': 'doubao',\n  'kimi.com': 'kimi',\n} as const satisfies Record<string, Channel>;\n\n/**\n * Which click id belongs to which channel, in priority order, and whether the platform puts it on\n * its ad clicks only (`'ads'`) or on other links as well (`'any'`). Every key is a field this SDK\n * collects (`AdvertisingInfo`).\n *\n * The third column decides whether the id can say a click was paid when a `utm_source` names the\n * channel but no `utm_medium` says how (a Reddit ad tagged `utm_source=reddit` and nothing more).\n * `fbclid` is `'any'`: Meta decorates every outbound link with it, organic posts, profile links\n * and shares included. `twclid` and `ko_click_id` are `'any'` until it is clear they never\n * decorate an organic link.\n *\n * Only URL parameters, never the cookies the tags keep beside them (`_fbc`, `_gcl_aw`, … — every\n * underscore key of `AdvertisingInfo`): a click cookie lives up to 90 days after the click, so\n * counting it named every later visit — typed in, from search, from an email — a new ad click.\n */\nexport const CLICK_ID_CHANNELS = [\n  ['fbclid', 'meta', 'any'],\n  ['gclid', 'google', 'ads'],\n  ['gbraid', 'google', 'ads'],\n  ['wbraid', 'google', 'ads'],\n  ['gad_source', 'google', 'ads'],\n  ['gad_campaignid', 'google', 'ads'],\n  ['dclid', 'dv360', 'ads'],\n  ['msclkid', 'microsoft', 'ads'],\n  ['ttclid', 'tiktok', 'ads'],\n  ['rdt_cid', 'reddit', 'ads'],\n  ['li_fat_id', 'linkedin', 'ads'],\n  ['ScCid', 'snapchat', 'ads'],\n  ['twclid', 'x', 'any'],\n  ['ko_click_id', 'kakao', 'any'],\n  ['yclid', 'yandex', 'ads'],\n  ['oppref', 'chatgpt', 'ads'],\n  ['epik', 'pinterest', 'ads'],\n] as const satisfies readonly (readonly [keyof AdvertisingInfo, Channel, 'ads' | 'any'])[];\n\n/**\n * A landing page reserved for one channel's ads, for ads that lost their parameters:\n * `/lp/<channel>`, with or without host, query and hash; the capture is the channel. A product\n * that names its landing pages differently replaces this.\n */\nexport const AD_LANDING_PAGE = /^(?:https?:\\/\\/[^/]+)?\\/lp\\/([a-z]+)(?:[/?#]|$)/;\n\nexport type ReferrerMedium = 'organic' | 'social' | 'video' | 'ai' | 'email';\n\n/**\n * Referrer hosts that name a channel, as regular expressions over the lower-cased host,\n * with the medium GA4 gives that kind of site. Anything else that refers is `referral`, kept as\n * its host. A country TLD is one or two labels (`google.com`, `google.co.uk`, `google.com.hk`),\n * never an open tail, so `google.com.evil.io` is not Google. In match order: the AI assistants\n * first, because `gemini.google.com`, `copilot.microsoft.com` and `yiyan.baidu.com` would\n * otherwise be Google, Microsoft and Baidu search.\n */\nexport const REFERRER_SITES = [\n  ['chatgpt', 'ai', /(^|\\.)(chatgpt\\.com|chat\\.openai\\.com)$/],\n  ['perplexity', 'ai', /(^|\\.)perplexity\\.ai$/],\n  ['gemini', 'ai', /^gemini\\.google\\.com$/],\n  ['claude', 'ai', /(^|\\.)claude\\.ai$/],\n  ['copilot', 'ai', /^copilot\\.microsoft\\.com$|(^|\\.)copilot\\.com$/],\n  ['grok', 'ai', /(^|\\.)(grok\\.com|x\\.ai)$/],\n  ['deepseek', 'ai', /(^|\\.)deepseek\\.com$/],\n  ['doubao', 'ai', /(^|\\.)doubao\\.com$/],\n  ['kimi', 'ai', /(^|\\.)(kimi\\.com|kimi\\.moonshot\\.cn|moonshot\\.cn)$/],\n  ['qwen', 'ai', /^tongyi\\.aliyun\\.com$|(^|\\.)(tongyi\\.com|qianwen\\.com|qwen\\.ai)$/],\n  ['yuanbao', 'ai', /^yuanbao\\.tencent\\.com$/],\n  ['ernie', 'ai', /^yiyan\\.baidu\\.com$|(^|\\.)ernie\\.baidu\\.com$/],\n  ['zhipu', 'ai', /(^|\\.)(chatglm\\.cn|zhipuai\\.cn|bigmodel\\.cn)$/],\n  // Webmail before the search engines whose patterns would match it: Gmail is on google.*,\n  // Yahoo Mail on yahoo.*, Yandex Mail on yandex.*, Naver Mail on naver.com.\n  ['gmail', 'email', /^mail\\.google\\.com$/],\n  [\n    'outlook',\n    'email',\n    /^outlook\\.(live|office|office365)\\.com$|^outlook\\.cloud\\.microsoft$|(^|\\.)safelinks\\.protection\\.outlook\\.com$/,\n  ],\n  ['yahoo_mail', 'email', /^mail\\.yahoo\\.[a-z]{2,}(\\.[a-z]{2,3})?$/],\n  ['yandex_mail', 'email', /^mail\\.yandex\\.[a-z]{2,}(\\.[a-z]{2,3})?$/],\n  ['naver_mail', 'email', /^mail\\.naver\\.com$/],\n  ['qq_mail', 'email', /^(wx\\.)?mail\\.qq\\.com$|^exmail\\.qq\\.com$/],\n  ['netease_mail', 'email', /^mail\\.(163|126)\\.com$/],\n  ['proton_mail', 'email', /^mail\\.proton(mail)?\\.(me|com)$/],\n  ['seznam_mail', 'email', /^email\\.seznam\\.cz$/],\n  ['gmx', 'email', /^deref-(gmx|web|mail)(-\\d+)?\\.(net|de|com)$|^navigator\\.(gmx\\.net|web\\.de)$/],\n  ['aol_mail', 'email', /^mail\\.aol\\.com$/],\n  ['zoho_mail', 'email', /^mail\\.zoho\\.[a-z]{2,}(\\.[a-z]{2,3})?$/],\n  [\n    'email',\n    'email',\n    /^urldefense\\.(com|proofpoint\\.com)$|^protect(-[a-z]+)?\\.mimecast\\.com$|(^|\\.)mimecastprotect\\.com$|^linkprotect\\.cudasvc\\.com$|^url\\.emailprotection\\.link$/,\n  ],\n  ['google', 'organic', /(^|\\.)google\\.[a-z]{2,}(\\.[a-z]{2,3})?$/],\n  ['microsoft', 'organic', /(^|\\.)bing\\.com$/],\n  ['yahoo', 'organic', /(^|\\.)yahoo\\.[a-z]{2,}(\\.[a-z]{2,3})?$/],\n  ['duckduckgo', 'organic', /(^|\\.)duckduckgo\\.com$/],\n  ['baidu', 'organic', /(^|\\.)baidu\\.com$/],\n  ['yandex', 'organic', /(^|\\.)yandex\\.[a-z]{2,}(\\.[a-z]{2,3})?$/],\n  ['ecosia', 'organic', /(^|\\.)ecosia\\.org$/],\n  ['naver', 'organic', /(^|\\.)naver\\.com$/],\n  ['brave', 'organic', /^search\\.brave\\.com$/],\n  ['qwant', 'organic', /(^|\\.)qwant\\.com$/],\n  ['meta', 'social', /(^|\\.)(facebook\\.com|instagram\\.com|fb\\.com|threads\\.net)$/],\n  ['x', 'social', /(^|\\.)(twitter\\.com|x\\.com|t\\.co)$/],\n  ['linkedin', 'social', /(^|\\.)(linkedin\\.com|lnkd\\.in)$/],\n  ['reddit', 'social', /(^|\\.)reddit\\.com$/],\n  ['tiktok', 'social', /(^|\\.)tiktok\\.com$/],\n  ['pinterest', 'social', /(^|\\.)pinterest\\.[a-z]{2,}(\\.[a-z]{2,3})?$/],\n  ['snapchat', 'social', /(^|\\.)snapchat\\.com$/],\n  ['telegram', 'social', /^(t\\.me|telegram\\.me|(web\\.)?telegram\\.org)$/],\n  ['youtube', 'video', /(^|\\.)(youtube\\.com|youtu\\.be)$/],\n] as const satisfies readonly (readonly [Channel, ReferrerMedium, RegExp])[];\n\n/**\n * The site an Android app's referrer stands for. A link opened from an app on Android arrives with\n * `android-app://<package>/` as its referrer rather than the site's URL; the apps below are read as\n * their sites, so the Google app is a Google search and the LinkedIn app is LinkedIn. A package\n * not listed is kept as the referring host, as GA4 shows it; Meta's apps send their mobile host\n * (`android-app://m.facebook.com`), which needs no entry.\n */\nexport const ANDROID_APP_HOSTS: Readonly<Record<string, string>> = {\n  'com.google.android.googlequicksearchbox': 'www.google.com',\n  'com.google.android.gm': 'mail.google.com',\n  'com.microsoft.office.outlook': 'outlook.live.com',\n  'com.yahoo.mobile.client.android.mail': 'mail.yahoo.com',\n  'ru.yandex.mail': 'mail.yandex.ru',\n  'com.tencent.androidqqmail': 'mail.qq.com',\n  'ch.protonmail.android': 'mail.proton.me',\n  'com.google.android.youtube': 'www.youtube.com',\n  'com.facebook.katana': 'www.facebook.com',\n  'com.instagram.android': 'www.instagram.com',\n  'com.linkedin.android': 'www.linkedin.com',\n  'com.reddit.frontpage': 'www.reddit.com',\n  'com.twitter.android': 'x.com',\n  'com.zhiliaoapp.musically': 'www.tiktok.com',\n  'com.ss.android.ugc.trill': 'www.tiktok.com',\n  'com.pinterest': 'www.pinterest.com',\n  'com.snapchat.android': 'www.snapchat.com',\n  'org.telegram.messenger': 't.me',\n};\n\n/**\n * Referrer hosts that are navigation, not acquisition, when a session happens to start on the way\n * back from them: the local dev host; the payment providers a visitor is bounced through; the\n * bot challenges (Cloudflare Turnstile, hCaptcha) a visitor passes before the page; the\n * sign-in providers whose login lives on a host of its own (Google, Apple, Microsoft, WeChat,\n * Kakao, LINE, Naver, Yahoo, Twitch, X's OAuth 1.0a endpoint); and the hosted auth services a\n * product may sit behind (Auth0, Okta, Supabase, Firebase, Clerk). A product appends its own\n * hostnames — a session that starts from an internal link after the session timeout refers to\n * them. Matched before `REFERRER_SITES`, so `nid.naver.com` and `login.yahoo.com` are not read as\n * a search. Providers whose login shares the host with their content — Facebook, X's OAuth 2.0,\n * LinkedIn, GitHub, Discord — cannot be told apart by host (referrer policies strip the path) and\n * are left as the referrers they usually are. Regular expressions over the lower-cased host.\n */\nexport const REFERRERS_NOT_A_TOUCH = [\n  /^localhost(:|$)/,\n  /^127\\.0\\.0\\.1$/,\n  // payment\n  /(^|\\.)stripe\\.com$/,\n  // Link, Stripe's wallet: a customer opens a merchant's site from their purchases on app.link.com\n  /(^|\\.)link\\.com$/,\n  /^pay\\.google\\.com$/,\n  /(^|\\.)paypal\\.com$/,\n  /(^|\\.)alipay\\.com$/,\n  /(^|\\.)paddle\\.com$/,\n  /(^|\\.)lemonsqueezy\\.com$/,\n  /^pay\\.amazon\\.com$/,\n  /^pay\\.weixin\\.qq\\.com$/,\n  // bot challenges a visitor is sent through before the page\n  /^challenges\\.cloudflare\\.com$/,\n  /(^|\\.)hcaptcha\\.com$/,\n  // app stores\n  /^apps\\.apple\\.com$/,\n  /^play\\.google\\.com$/,\n  // sign-in providers with a login host of their own\n  /^accounts\\.google\\.com$/,\n  /^appleid\\.apple\\.com$/,\n  /^login\\.(microsoftonline|live)\\.com$/,\n  /^open\\.weixin\\.qq\\.com$/,\n  /^(kauth|accounts)\\.kakao\\.com$/,\n  /^access\\.line\\.me$/,\n  /^nid\\.naver\\.com$/,\n  /^login\\.yahoo\\.com$/,\n  /^id\\.twitch\\.tv$/,\n  /^api\\.twitter\\.com$/,\n  // hosted auth services\n  /(^|\\.)auth0\\.com$/,\n  /(^|\\.)okta\\.com$/,\n  /(^|\\.)supabase\\.co$/,\n  /(^|\\.)firebaseapp\\.com$/,\n  /(^|\\.)clerk\\.accounts\\.dev$/,\n] as const;\n\n/** GA4's paid mediums — cpc, cpm, ppc, retargeting, paid_social, … — plus Performance Max. */\nexport const PAID_MEDIUM = /^(.*cp.*|ppc|retargeting|paid.*|pmax|performance_max)$/;\n/**\n * Meta's `{{placement}}` values, lower-cased, which an ad URL template of `utm_medium={{placement}}`\n * puts in the medium. Only an ad carries one — an organic post arrives as a referrer, with no utm\n * at all — so a medium in this list is a paid Meta click whatever the source says (a template with\n * `utm_source=meta-websitekeyinfo` was seen). Listed one by one rather than matched by prefix, so\n * that a hand-tagged `instagram_stories` post cannot be mistaken for an ad only because of how it\n * is spelled … which means a placement Meta adds later shows up as organic social (or unassigned,\n * under a source that is no social site) until it is added here. Meta's documented values plus the\n * ones seen in the wild (`facebook_mobile_reels`, `facebook_notification`, `an`), and the literal\n * macro for a template that did not expand it.\n *\n * Accepted for the ads already running with that template; new ads should rather send\n * `utm_medium=cpc` and the placement in a `placement` parameter of its own (collected as the\n * `placement` tag): GA4 matches its paid rule on the medium alone, and files a placement medium\n * under Organic Social.\n */\nexport const META_PLACEMENTS = [\n  'facebook_feed',\n  'facebook_instream',\n  'facebook_desktop_feed',\n  'facebook_mobile_feed',\n  'facebook_mobile_reels',\n  'facebook_reels',\n  'facebook_reels_overlay',\n  'facebook_right_column',\n  'facebook_marketplace',\n  'facebook_video_feeds',\n  'facebook_stories',\n  'facebook_search',\n  'facebook_instream_video',\n  'facebook_instant_article',\n  'facebook_groups_feed',\n  'facebook_profile_feed',\n  'facebook_notification',\n  'facebook_notifications',\n  'facebook_business_explore',\n  'instagram_feed',\n  'instagram_stories',\n  'instagram_reels',\n  'instagram_reels_overlay',\n  'instagram_explore',\n  'instagram_explore_home',\n  'instagram_search',\n  'instagram_shop',\n  'instagram_profile_feed',\n  'instagram_profile_reels',\n  'instagram_igtv',\n  'messenger_inbox',\n  'messenger_stories',\n  'messenger_sponsored_messages',\n  'threads_feed',\n  'threads_stream',\n  'whatsapp_status',\n  'audience_network_classic',\n  'audience_network_rewarded_video',\n  'audience_network_native_banner_and_interstitial',\n  'an',\n  'others',\n  /** the macro itself, when Meta did not expand it (written in a field it does not substitute, or a\n   * preview click): still only ever produced by a Meta ad URL, so still a paid Meta click */\n  '{{placement}}',\n] as const;\nexport const DISPLAY_MEDIUMS = ['display', 'banner', 'expandable', 'interstitial'] as const;\n/** GA4's email spellings, as a source or a medium. */\nexport const EMAIL_MEDIUMS = ['email', 'e-mail', 'e_mail', 'e mail'] as const;\n/** GA4's Mobile Push Notifications medium: ending in `push`, or containing `mobile` or `notification`. */\nexport const PUSH_MEDIUM = /(push$|mobile|notification)/;\n/** A medium that says email or newsletter anywhere in it: `outbound email`, `cold_email`, `newsletter`, and GA4's four. */\nexport const EMAIL_MEDIUM = /(^|[^a-z])(e[-_ ]?mail|newsletter)([^a-z]|$)/;\n\n/** Where a touch came from: a tracked session, or a report by the user or staff. */\nexport const TOUCH_SOURCES = ['tracked', 'reported'] as const;\nexport type TouchSource = (typeof TOUCH_SOURCES)[number];\n\n/**\n * How a reported touch was learned:\n * - survey: the user answered \"how did you hear about us\" (onboarding, checkout)\n * - promo_code: the user redeemed a code that belongs to a channel\n * - phone: a call came in on a channel's dedicated number, marked by staff or the phone system\n * - manual: staff recorded what a customer told them\n */\nexport const REPORTED_TOUCH_KINDS = ['survey', 'promo_code', 'phone', 'manual'] as const;\nexport type ReportedTouchKind = (typeof REPORTED_TOUCH_KINDS)[number];\n\n/**\n * How much a touch is worth against another when attribution has to choose between sessions;\n * lower wins, and the latest wins among equals. Stored on the session when it is classified, so\n * renumbering means reclassifying.\n *\n * This ranks touches against each other. Within one session the rules that name its channel have\n * their own order — `utm_source`, then a click id, then the ad landing page, then the referrer —\n * and the first that says something wins; the session's priority is then the tier of that rule\n * (a campaign rule whose touch is organic by its own tag ranking as a referrer, see `classifyTouch`).\n * So two sessions tagged with utm and gclid respectively are equal here (both `campaign`) and the\n * later one is credited, while one session carrying both is named by its utm.\n */\nexport const TOUCH_PRIORITY = {\n  /**\n   * utm, click id, ad landing page: someone tagged that link (in that order within a session) —\n   * unless the tag itself calls the touch organic, a referral or email, which then ranks as `referrer`\n   */\n  campaign: 1,\n  /** a reported touch staff stand behind: a call on a channel's number, a recorded conversation */\n  verified: 1,\n  /** the browser said where the visitor came from; nobody chose it */\n  referrer: 2,\n  /** a reported touch that is the user's claim: a survey answer, a code that may have been shared */\n  claimed: 3,\n} as const satisfies Record<string, number>;\n\n/** Which reported kinds are staff facts and which are the user's claims. */\nexport const REPORTED_TOUCH_PRIORITY = {\n  phone: TOUCH_PRIORITY.verified,\n  manual: TOUCH_PRIORITY.verified,\n  survey: TOUCH_PRIORITY.claimed,\n  promo_code: TOUCH_PRIORITY.claimed,\n} as const satisfies Record<ReportedTouchKind, number>;\n"],"mappings":";;;;;;;;AAUA,MAAa,iBAAiB;;AAE9B,MAAa,YAAY;;AAEzB,MAAa,iBAAiB;;AAG9B,MAAa,WAAW;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA;CACA;CACA;CAGA;CAIA;CACA;CACA;CACA;CACA;CACA;CAEA;CACA;CACA;CACA;CACA;CACA;CACA;CAKA;AACF;;AAKA,MAAa,iBAAiB;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA;CACA;CACA;CACA;CAEA;CAEA;CACA;AACF;;AAKA,MAAa,iBAAiB;CAC5B,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,KAAK;CACL,IAAI;CACJ,UAAU;CACV,WAAW;CACX,MAAM;CACN,SAAS;CACT,cAAc;CACd,WAAW;CACX,SAAS;CACT,eAAe;CACf,mBAAmB;CACnB,QAAQ;CACR,iBAAiB;CACjB,aAAa;CACb,eAAe;CACf,gBAAgB;CAChB,cAAc;CACd,YAAY;AACd;;;;;;;;;;;;;;;;AAiBA,MAAa,oBAAoB;CAC/B;EAAC;EAAU;EAAQ;CAAK;CACxB;EAAC;EAAS;EAAU;CAAK;CACzB;EAAC;EAAU;EAAU;CAAK;CAC1B;EAAC;EAAU;EAAU;CAAK;CAC1B;EAAC;EAAc;EAAU;CAAK;CAC9B;EAAC;EAAkB;EAAU;CAAK;CAClC;EAAC;EAAS;EAAS;CAAK;CACxB;EAAC;EAAW;EAAa;CAAK;CAC9B;EAAC;EAAU;EAAU;CAAK;CAC1B;EAAC;EAAW;EAAU;CAAK;CAC3B;EAAC;EAAa;EAAY;CAAK;CAC/B;EAAC;EAAS;EAAY;CAAK;CAC3B;EAAC;EAAU;EAAK;CAAK;CACrB;EAAC;EAAe;EAAS;CAAK;CAC9B;EAAC;EAAS;EAAU;CAAK;CACzB;EAAC;EAAU;EAAW;CAAK;CAC3B;EAAC;EAAQ;EAAa;CAAK;AAC7B;;;;;;AAOA,MAAa,kBAAkB;;;;;;;;;AAY/B,MAAa,iBAAiB;CAC5B;EAAC;EAAW;EAAM;CAAyC;CAC3D;EAAC;EAAc;EAAM;CAAuB;CAC5C;EAAC;EAAU;EAAM;CAAuB;CACxC;EAAC;EAAU;EAAM;CAAmB;CACpC;EAAC;EAAW;EAAM;CAA+C;CACjE;EAAC;EAAQ;EAAM;CAA0B;CACzC;EAAC;EAAY;EAAM;CAAsB;CACzC;EAAC;EAAU;EAAM;CAAoB;CACrC;EAAC;EAAQ;EAAM;CAAoD;CACnE;EAAC;EAAQ;EAAM;CAAkE;CACjF;EAAC;EAAW;EAAM;CAAyB;CAC3C;EAAC;EAAS;EAAM;CAA8C;CAC9D;EAAC;EAAS;EAAM;CAA+C;CAG/D;EAAC;EAAS;EAAS;CAAqB;CACxC;EACE;EACA;EACA;CACF;CACA;EAAC;EAAc;EAAS;CAAyC;CACjE;EAAC;EAAe;EAAS;CAA0C;CACnE;EAAC;EAAc;EAAS;CAAoB;CAC5C;EAAC;EAAW;EAAS;CAA0C;CAC/D;EAAC;EAAgB;EAAS;CAAwB;CAClD;EAAC;EAAe;EAAS;CAAiC;CAC1D;EAAC;EAAe;EAAS;CAAqB;CAC9C;EAAC;EAAO;EAAS;CAA6E;CAC9F;EAAC;EAAY;EAAS;CAAkB;CACxC;EAAC;EAAa;EAAS;CAAwC;CAC/D;EACE;EACA;EACA;CACF;CACA;EAAC;EAAU;EAAW;CAAyC;CAC/D;EAAC;EAAa;EAAW;CAAkB;CAC3C;EAAC;EAAS;EAAW;CAAwC;CAC7D;EAAC;EAAc;EAAW;CAAwB;CAClD;EAAC;EAAS;EAAW;CAAmB;CACxC;EAAC;EAAU;EAAW;CAAyC;CAC/D;EAAC;EAAU;EAAW;CAAoB;CAC1C;EAAC;EAAS;EAAW;CAAmB;CACxC;EAAC;EAAS;EAAW;CAAsB;CAC3C;EAAC;EAAS;EAAW;CAAmB;CACxC;EAAC;EAAQ;EAAU;CAA4D;CAC/E;EAAC;EAAK;EAAU;CAAoC;CACpD;EAAC;EAAY;EAAU;CAAiC;CACxD;EAAC;EAAU;EAAU;CAAoB;CACzC;EAAC;EAAU;EAAU;CAAoB;CACzC;EAAC;EAAa;EAAU;CAA4C;CACpE;EAAC;EAAY;EAAU;CAAsB;CAC7C;EAAC;EAAY;EAAU;CAA8C;CACrE;EAAC;EAAW;EAAS;CAAiC;AACxD;;;;;;;;AASA,MAAa,oBAAsD;CACjE,2CAA2C;CAC3C,yBAAyB;CACzB,gCAAgC;CAChC,wCAAwC;CACxC,kBAAkB;CAClB,6BAA6B;CAC7B,yBAAyB;CACzB,8BAA8B;CAC9B,uBAAuB;CACvB,yBAAyB;CACzB,wBAAwB;CACxB,wBAAwB;CACxB,uBAAuB;CACvB,4BAA4B;CAC5B,4BAA4B;CAC5B,iBAAiB;CACjB,wBAAwB;CACxB,0BAA0B;AAC5B;;;;;;;;;;;;;;AAeA,MAAa,wBAAwB;CACnC;CACA;CAEA;CAEA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA;CACA;CAEA;CACA;CAEA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA;CACA;CACA;CACA;CACA;AACF;;AAGA,MAAa,cAAc;;;;;;;;;;;;;;;;;AAiB3B,MAAa,kBAAkB;CAC7B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;AACF;AACA,MAAa,kBAAkB;CAAC;CAAW;CAAU;CAAc;AAAc;;AAEjF,MAAa,gBAAgB;CAAC;CAAS;CAAU;CAAU;AAAQ;;AAEnE,MAAa,cAAc;;AAE3B,MAAa,eAAe;;AAG5B,MAAa,gBAAgB,CAAC,WAAW,UAAU;;;;;;;;AAUnD,MAAa,uBAAuB;CAAC;CAAU;CAAc;CAAS;AAAQ;;;;;;;;;;;;;AAe9E,MAAa,iBAAiB;;;;;CAK5B,UAAU;;CAEV,UAAU;;CAEV,UAAU;;CAEV,SAAS;AACX;;AAGA,MAAa,0BAA0B;CACrC,OAAO,eAAe;CACtB,QAAQ,eAAe;CACvB,QAAQ,eAAe;CACvB,YAAY,eAAe;AAC7B"}

package/dist/click-id/index.cjs

@@ -211,16 +211,16 @@ function resolveClickIdCookies(input) {
 		urlClickId: params.get("wbraid") || void 0,
 		assign: (value) => result.wbraid = value
 	}];
-	for (const { cookie: cookie$1, urlClickId, assign } of google) {
-		const existing = parseGcl(jar[cookie$1], now);
+	for (const { cookie, urlClickId, assign } of google) {
+		const existing = parseGcl(jar[cookie], now);
 		if (urlClickId && GCL_CLICK_ID.test(urlClickId) && urlClickId !== existing?.clickId) {
-			set(cookie$1, formatGcl(urlClickId, now), GCL_TTL_MS);
+			set(cookie, formatGcl(urlClickId, now), GCL_TTL_MS);
 			assign(urlClickId);
 		} else if (existing) {
 			const remainingMs = existing.creationTime + GCL_TTL_MS - now;
 			if (remainingMs > 0) {
 				assign(existing.clickId);
-				if (refresh) set(cookie$1, existing.raw, remainingMs);
+				if (refresh) set(cookie, existing.raw, remainingMs);
 			}
 		}
 	}
@@ -258,7 +258,7 @@ function resolveClickIdCookies(input) {
 }
 /** Serialize the resolved cookies into `Set-Cookie` header values. */
 function toSetCookieHeaders(cookies) {
-	return cookies.map((cookie$2) => (0, cookie.stringifySetCookie)(cookie$2));
+	return cookies.map((cookie$1) => (0, cookie.stringifySetCookie)(cookie$1));
 }
 //#endregion
 exports.FBC_COOKIE = FBC_COOKIE;

package/dist/click-id/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["parseCookie","cookie","stringifySetCookie"],"sources":["../../src/click-id/index.ts"],"sourcesContent":["import { type SetCookie, parseCookie, stringifySetCookie } from 'cookie';\n\n/**\n * Server-side resolution of ad-click-id cookies (`_fbc`, `_gcl_aw`/`_gcl_gb`, `_rdt_cid`,\n * `_uetmsclkid`) from the incoming request.\n *\n * This is the framework-agnostic core meant to run on the *document* response (e.g. TanStack Start\n * server middleware, Next middleware). Setting `_fbc` via an HTTP `Set-Cookie` header on the top\n * document — rather than `document.cookie` on the client — is what Meta officially recommends and is\n * the only reliable way to keep the cookie alive for 90 days in Safari: ITP caps JavaScript-set\n * cookies on a fbclid-decorated landing page to 24 hours, and the document response is never\n * classified as CNAME/IP cloaking (it is the reference the browser measures cloaking against).\n *\n * The Google pair follows the same architecture Google itself ships for server containers —\n * sGTM's Conversion Linker sets FPGCLAW via Set-Cookie for 90 days — and the sGTM ecosystem\n * productized for gtag's own cookies (stape Cookie Keeper re-issues `_gcl_*` over HTTP; vendor\n * case studies report 5–20% of Google Ads conversions recovered, up to +44% on the Safari\n * slice). One deployment caveat from WebKit's rules: the HTTP-cookie exemption holds only for\n * responses from the site's own infrastructure — a CNAME or third-party-IP host (a tagging\n * subdomain on someone else's cloud) gets its Set-Cookie silently capped to 7 days. This module\n * runs on the host's own document response, which is exactly the exempt case.\n *\n * references:\n * - https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/fbp-and-fbc\n * - https://webkit.org/tracking-prevention/ (7d JS cookies, 24h on ad-decorated landings,\n *   CNAME/third-party-IP HTTP cookies capped to 7d, same-origin HTTP cookies exempt)\n * - https://www.simoahava.com/analytics/google-ads-server-side-tagging-google-tag-manager/\n *   (Conversion Linker → FPGCLAW via Set-Cookie, Google's own server-side equivalent)\n * - https://stape.io/helpdesk/documentation/cookie-keeper-power-up (the productized re-issue)\n */\n\n// Meta's recommended _fbc cookie expiry. Events Manager warns (\"Server sending expired fbclid\")\n// when the embedded creationTime is older than 90 days and match quality/attribution may degrade;\n// no hard drop is documented.\nconst FBC_TTL_MS = 90 * 24 * 60 * 60 * 1000;\n// Reddit's pixel.js rewrites `_rdt_cid` and `_rdt_uuid` for 90 days on every page load.\nconst RDT_CID_TTL_MS = 90 * 24 * 60 * 60 * 1000;\nconst RDT_UUID_TTL_MS = 90 * 24 * 60 * 60 * 1000;\n// Meta's pixel rewrites `_fbp` for 90 days on every page load.\nconst FBP_TTL_MS = 90 * 24 * 60 * 60 * 1000;\n// OpenAI's oaiq: `__oppref` for 30 days (`720*60*60` s), `__obref` for 365 days.\nconst OPPREF_TTL_MS = 30 * 24 * 60 * 60 * 1000;\nconst OBREF_TTL_MS = 365 * 24 * 60 * 60 * 1000;\n// bat.js's own expiry for _uetmsclkid (`msClkIdExpirationTime`), the Microsoft Ads click window.\nconst MSCLKID_TTL_MS = 90 * 24 * 60 * 60 * 1000;\n// gtag's own expiry for _gcl_* — 90 days, the length of a Google Ads click's upload window.\nconst GCL_TTL_MS = 90 * 24 * 60 * 60 * 1000;\n// Tolerate a little clock skew when validating a creationTime against \"now\".\nconst CLOCK_SKEW_MS = 24 * 60 * 60 * 1000;\n\nexport const FBC_COOKIE = '_fbc';\nexport const RDT_CID_COOKIE = '_rdt_cid';\nexport const GCL_AW_COOKIE = '_gcl_aw';\nexport const GCL_GB_COOKIE = '_gcl_gb';\nexport const UET_MSCLKID_COOKIE = '_uetmsclkid';\nexport const RDT_UUID_COOKIE = '_rdt_uuid';\nexport const FBP_COOKIE = '_fbp';\nexport const OPPREF_COOKIE = '__oppref';\nexport const OBREF_COOKIE = '__obref';\n/** OpenAI's consent cookie; `false` is the visitor's opt-out, on which oaiq deletes its cookies. */\nexport const OAIQ_CONSENT_COOKIE = '__oaiq_consent';\n\nexport type ParsedFbc = { raw: string; creationTime: number; fbclid: string };\n\n/**\n * Parse `fb.<subdomainIndex>.<creationTime>.<fbclid>[.<appendix>]`. The appendix is what Meta's\n * Parameter Builder adds to the values it writes (\"an appendix field at the end of each\n * parameter\"); it is not part of the click id, so `fbclid` is the fourth segment alone and the\n * value is passed on as `raw`, unchanged. Returns undefined for anything malformed.\n * ref: https://developers.facebook.com/docs/marketing-api/conversions-api/parameter-builder-library\n */\nexport function parseFbc(\n  raw: string | undefined | null,\n  now: number = Date.now()\n): ParsedFbc | undefined {\n  if (!raw) return undefined;\n  const parts = raw.split('.');\n  if (parts.length < 4 || parts.length > 5 || parts[0] !== 'fb') return undefined;\n  if (parts.length === 5 && !parts[4]) return undefined;\n\n  const creationTime = Number(parts[2]);\n  const fbclid = parts[3];\n  if (!fbclid) return undefined;\n  // creationTime is UNIX ms; reject seconds-precision or future-dated values as malformed.\n  if (!Number.isFinite(creationTime)) return undefined;\n  if (creationTime < 1e12 || creationTime > now + CLOCK_SKEW_MS) return undefined;\n\n  return { raw, creationTime, fbclid };\n}\n\n/**\n * Build a fresh `_fbc` value. subdomainIndex is the cookie's domain level (com=0, example.com=1,\n * www.example.com=2); 1 is correct for an apex-hosted cookie.\n */\nexport function formatFbc(fbclid: string, now: number, subdomainIndex = 1): string {\n  return `fb.${subdomainIndex}.${now}.${fbclid}`;\n}\n\nexport type ParsedGcl = { raw: string; creationTime: number; clickId: string };\n\n/**\n * Whether a URL's `gclid` is a Google Ads click, by its `gclsrc` — gtag's own gating: absent or\n * `aw.ds` is Google Ads; `ds` / `3p.ds` are Search Ads 360's (a click on another engine, or on\n * Google with auto-tagging off), which gtag keeps in `_gcl_dc` and not `_gcl_aw`.\n * ref: https://support.google.com/sa360/answer/7342044\n */\nexport function isGoogleAdsGclid(gclsrc: string | null | undefined): boolean {\n  return !gclsrc || gclsrc === 'aw.ds';\n}\n\n// gtag's own value validator, extracted from the live gtag.js bundle (2026-09): its parser\n// accepts version \"GCL\" or \"1\", a /^\\d+$/ seconds timestamp, and a click id matching this.\n// Re-verify against gtag.js before changing anything here — the format is gtag's, not ours.\nconst GCL_CLICK_ID = /^[\\w-]+$/;\n\n/**\n * Parse a `_gcl_aw`/`_gcl_gb` value: `GCL.<seconds>.<clickId>[.<labels…>]` — note the timestamp\n * is in SECONDS, unlike `_fbc`'s milliseconds. gtag's parser accepts version `GCL` or `1` and\n * validates the segments exactly this way (`/^\\d+$/` timestamp, `/^[\\w-]+$/` click id); any\n * labels tail is preserved through `raw` so a re-issue stays byte-identical.\n */\nexport function parseGcl(\n  raw: string | undefined | null,\n  now: number = Date.now()\n): ParsedGcl | undefined {\n  if (!raw) return undefined;\n  const parts = raw.split('.');\n  if (parts.length < 3) return undefined;\n  if (parts[0] !== 'GCL' && parts[0] !== '1') return undefined;\n  const seconds = parts[1];\n  const clickId = parts[2];\n  if (seconds === undefined || !/^\\d+$/.test(seconds)) return undefined;\n  if (clickId === undefined || !GCL_CLICK_ID.test(clickId)) return undefined;\n  const creationTime = Number(seconds) * 1000;\n  // Reject millisecond-precision or future-dated values as malformed.\n  if (creationTime >= 1e15 || creationTime > now + CLOCK_SKEW_MS) return undefined;\n  return { raw, creationTime, clickId };\n}\n\n/** Build a fresh `_gcl_aw`/`_gcl_gb` value in gtag's own format. */\nexport function formatGcl(clickId: string, now: number): string {\n  return `GCL.${Math.floor(now / 1000)}.${clickId}`;\n}\n\n// bat.js writes the click id as `_uet<msclkid>` and reads it back only when what follows the\n// prefix is at most 32 characters (`msClkIdCookieValuePrefix`, `lengthMsClkId`); a msclkid is a\n// 32-hex-digit UUID without dashes. Re-verify against bat.js before changing anything here —\n// the format is UET's, not ours.\nconst UET_MSCLKID_PREFIX = '_uet';\nconst MSCLKID = /^[0-9a-f]{32}$/i;\n\n/** Whether a value has the shape of a Microsoft click id: 32 hex digits, no dashes. */\nexport function isMsclkid(value: string | null | undefined): value is string {\n  return !!value && MSCLKID.test(value);\n}\n\n/**\n * Parse a `_uetmsclkid` value: `_uet<32 hex>`. Returns the click id, lowercased, or undefined\n * for anything bat.js itself would not read back.\n */\nexport function parseUetMsclkid(raw: string | undefined | null): string | undefined {\n  if (!raw || !raw.startsWith(UET_MSCLKID_PREFIX)) return undefined;\n  const clickId = raw.slice(UET_MSCLKID_PREFIX.length);\n  return MSCLKID.test(clickId) ? clickId.toLowerCase() : undefined;\n}\n\n/** Build a `_uetmsclkid` value in bat.js's own format. */\nexport function formatUetMsclkid(clickId: string): string {\n  return `${UET_MSCLKID_PREFIX}${clickId.toLowerCase()}`;\n}\n\n/**\n * The click id as the Conversions API wants it: a dashed, lowercase UUID. The URL and the cookie\n * carry the 32-hex form; a value in any other shape is returned untouched for the API to judge.\n */\nexport function formatMsclkid(clickId: string): string {\n  const id = clickId.trim().toLowerCase();\n  if (!MSCLKID.test(id)) return id;\n  return `${id.slice(0, 8)}-${id.slice(8, 12)}-${id.slice(12, 16)}-${id.slice(16, 20)}-${id.slice(20)}`;\n}\n\nexport type ResolveClickIdCookiesInput = {\n  /** The absolute request URL (must include the query string). */\n  url: string;\n  /** The raw `Cookie` request header, if any. */\n  cookieHeader?: string | null;\n  /** Overridable clock, primarily for tests. Defaults to `Date.now()`. */\n  now?: number;\n  /**\n   * `Domain` attribute for the emitted cookies: the site's registrable domain, e.g.\n   * `.shware.io`, where the pixels write theirs. Required in production: a host-only cookie is a\n   * second cookie of the same name next to the pixel's, which the pixel then reads — or deletes,\n   * as Reddit's does at every subdomain level before writing its own. `null` for a host-only\n   * cookie, which only a local `localhost` setup should ask for.\n   */\n  domain: string | null;\n  /** `Secure` attribute, default true. Set false only for local http testing. */\n  secure?: boolean;\n  /** subdomainIndex for a freshly built `_fbc` (see {@link formatFbc}). Default 1. */\n  subdomainIndex?: number;\n  /**\n   * Re-issue the stored click and browser ids on every call. On by default, as an ITP self-heal:\n   * cookies follow last-writer-wins, so when a pixel has rewritten one through `document.cookie`\n   * (Safari caps JS-written cookies at 7 days, 24h on an ad-decorated landing), re-issuing the\n   * long-lived HTTP cookie on the next navigation restores it — the same continuous-re-issue\n   * mitigation the sGTM ecosystem uses (stape Cookie Keeper, Cookie Monster). `_fbc` and\n   * `_gcl_*` are re-issued byte-for-byte at their *remaining* lifetime, so their window never\n   * slides (Meta warns on a moved fbclid); the others at the lifetime their pixel itself gives\n   * them on every page load (see each below).\n   *\n   * Set false to strictly follow Meta's documented conditional-write rule (\"only set the cookie if\n   * it doesn't exist or the fbclid changed\") — e.g. to keep pages CDN-cacheable, since the\n   * re-issue attaches a per-user `Set-Cookie` (forcing `no-store`) to every response carrying an\n   * `_fbc`.\n   */\n  refresh?: boolean;\n};\n\nexport type ResolveClickIdCookiesResult = {\n  /**\n   * Cookies to emit on the response, ready for `Set-Cookie`. Empty when nothing needs to change.\n   * A `value: ''`, `maxAge: 0` entry is a deletion (an expired or malformed leftover).\n   */\n  cookies: SetCookie[];\n  /** The resolved `_fbc` value, for immediate server-side use (e.g. Conversions API). */\n  fbc?: string;\n  /** The resolved `_rdt_cid` value. */\n  rdt_cid?: string;\n  /** The resolved Google Ads click id (from the URL or a still-valid `_gcl_aw`). */\n  gclid?: string;\n  /** The resolved iOS web-to-app click id (from the URL or a still-valid `_gcl_gb`). */\n  wbraid?: string;\n  /** The resolved Microsoft Ads click id (from the URL or `_uetmsclkid`), 32-hex form. */\n  msclkid?: string;\n};\n\nfunction searchParams(url: string): URLSearchParams {\n  try {\n    return new URL(url).searchParams;\n  } catch {\n    // Fall back to a manual split so a relative or slightly malformed URL still yields the query.\n    const q = url.indexOf('?');\n    return new URLSearchParams(q !== -1 ? url.slice(q + 1) : '');\n  }\n}\n\n/**\n * Resolve the click-id cookies to set on the current document response.\n *\n * `_fbc` follows Meta's documented conditional-write rule value-wise: a new fbclid (or an absent\n * cookie) opens a fresh 90-day window; a same-fbclid cookie keeps its original value and\n * `creationTime`. Expired (>90d) or malformed values are cleared instead of forwarded. By default,\n * ({@link ResolveClickIdCookiesInput.refresh}) a still-valid cookie is re-issued unchanged at its\n * *remaining* lifetime — never `now + 90d` — so a returning visitor's window cannot slide forward\n * (which is what makes Meta flag an expired fbclid).\n */\nexport function resolveClickIdCookies(\n  input: ResolveClickIdCookiesInput\n): ResolveClickIdCookiesResult {\n  const { url, cookieHeader, domain, secure = true, subdomainIndex = 1, refresh = true } = input;\n  const now = input.now ?? Date.now();\n\n  const params = searchParams(url);\n  const jar = parseCookie(cookieHeader ?? '');\n  const cookies: SetCookie[] = [];\n  const result: ResolveClickIdCookiesResult = { cookies };\n\n  const base = { path: '/', secure, sameSite: 'lax', domain: domain ?? undefined } as const;\n  const set = (name: string, value: string, ttlMs: number) =>\n    cookies.push({ name, value, maxAge: Math.floor(ttlMs / 1000), ...base });\n  const del = (name: string) => cookies.push({ name, value: '', maxAge: 0, ...base });\n\n  // --- Meta _fbc ---\n  const urlFbclid = params.get('fbclid') || undefined;\n  const existingFbc = parseFbc(jar[FBC_COOKIE], now);\n\n  if (urlFbclid && urlFbclid !== existingFbc?.fbclid) {\n    // A new click always wins and opens a fresh 90-day window.\n    const raw = formatFbc(urlFbclid, now, subdomainIndex);\n    set(FBC_COOKIE, raw, FBC_TTL_MS);\n    result.fbc = raw;\n  } else if (existingFbc) {\n    const remainingMs = existingFbc.creationTime + FBC_TTL_MS - now;\n    if (remainingMs <= 0) {\n      del(FBC_COOKIE);\n    } else {\n      // Same fbclid: the value and creationTime are preserved (Meta's rule); refresh (default)\n      // re-issues it unchanged at its remaining lifetime as an ITP self-heal.\n      result.fbc = existingFbc.raw;\n      if (refresh) set(FBC_COOKIE, existingFbc.raw, remainingMs);\n    }\n  } else if (jar[FBC_COOKIE]) {\n    // Malformed leftover — clear it rather than forwarding it to Meta.\n    del(FBC_COOKIE);\n  }\n\n  // --- Google Ads _gcl_aw / _gcl_gb ---\n  // The same first-party HTTP persistence Google's own server-side Conversion Linker performs\n  // (it sets FPGCLAW via Set-Cookie for 90 days), applied to gtag's cookies the way the sGTM\n  // ecosystem does (stape Cookie Keeper re-issues _gcl_* over HTTP). Ownership is shared with\n  // gtag, so the rules are stricter than for _fbc: a value this module cannot parse is left\n  // untouched — never rewritten, never deleted — and a re-issue is byte-identical (labels tail\n  // included) at the window's REMAINING lifetime, so the 90-day click window never slides.\n  const gclsrc = params.get('gclsrc') || undefined;\n  const google = [\n    {\n      cookie: GCL_AW_COOKIE,\n      // gtag's own gating (`isGoogleAdsGclid`): a gclid enters _gcl_aw only when gclsrc is\n      // absent or 'aw.ds' — 'ds'/'3p.ds' clicks are Search Ads 360's and belong to _gcl_dc.\n      urlClickId: isGoogleAdsGclid(gclsrc) ? params.get('gclid') || undefined : undefined,\n      assign: (value: string) => (result.gclid = value),\n    },\n    {\n      cookie: GCL_GB_COOKIE,\n      urlClickId: params.get('wbraid') || undefined,\n      assign: (value: string) => (result.wbraid = value),\n    },\n  ];\n  for (const { cookie, urlClickId, assign } of google) {\n    const existing = parseGcl(jar[cookie], now);\n    if (urlClickId && GCL_CLICK_ID.test(urlClickId) && urlClickId !== existing?.clickId) {\n      // A new click always wins and opens a fresh 90-day window, in gtag's exact format.\n      set(cookie, formatGcl(urlClickId, now), GCL_TTL_MS);\n      assign(urlClickId);\n    } else if (existing) {\n      const remainingMs = existing.creationTime + GCL_TTL_MS - now;\n      if (remainingMs > 0) {\n        assign(existing.clickId);\n        if (refresh) set(cookie, existing.raw, remainingMs);\n      }\n      // Expired: not returned and not re-issued, but gtag owns the deletion.\n    }\n  }\n\n  // --- Reddit _rdt_cid / _rdt_uuid ---\n  // Reddit's pixel.js rewrites both on every page load through `document.cookie` — the click id\n  // from the URL, else the stored one, and the browser id — each for a fresh 90 days. So Reddit\n  // slides the window itself, and the re-issue (default on, see `refresh`) does the same over\n  // HTTP: without it the pixel's JS copy, capped at 7 days in Safari, is the only one left.\n  const urlRdtCid = params.get('rdt_cid') || undefined;\n  const existingRdtCid = jar[RDT_CID_COOKIE] || undefined;\n  if (urlRdtCid && urlRdtCid !== existingRdtCid) {\n    set(RDT_CID_COOKIE, urlRdtCid, RDT_CID_TTL_MS);\n    result.rdt_cid = urlRdtCid;\n  } else if (existingRdtCid) {\n    result.rdt_cid = existingRdtCid;\n    if (refresh) set(RDT_CID_COOKIE, existingRdtCid, RDT_CID_TTL_MS);\n  }\n  const existingRdtUuid = jar[RDT_UUID_COOKIE] || undefined;\n  if (existingRdtUuid && refresh) set(RDT_UUID_COOKIE, existingRdtUuid, RDT_UUID_TTL_MS);\n\n  // --- Meta _fbp ---\n  // The pixel's browser id: created by the pixel, which rewrites it for 90 days on every page\n  // load, as Reddit's does its own. Re-issued as it is, never created here.\n  const existingFbp = jar[FBP_COOKIE] || undefined;\n  if (existingFbp && refresh) set(FBP_COOKIE, existingFbp, FBP_TTL_MS);\n\n  // --- OpenAI __oppref / __obref ---\n  // oaiq writes `__oppref` only when the URL carries `oppref` (30 days), and `__obref` — its\n  // browser reference — only when there is none (365 days); otherwise it reads them, through\n  // `document.cookie`, so in Safari each is gone after 7 days and the browser starts over with a\n  // new reference. The first is captured here from the URL as well, and both are re-issued as\n  // they are, `__obref` never created. Unlike oaiq, the re-issue restarts their windows: their\n  // values carry no creation time to count a remaining lifetime from, and OpenAI applies its own\n  // attribution window to the click whatever the cookie's age. Nothing is written once the\n  // visitor has opted out of oaiq, which deletes both cookies then.\n  if (jar[OAIQ_CONSENT_COOKIE] !== 'false') {\n    const urlOppref = params.get('oppref') || undefined;\n    const existingOppref = jar[OPPREF_COOKIE] || undefined;\n    if (urlOppref) set(OPPREF_COOKIE, urlOppref, OPPREF_TTL_MS);\n    else if (existingOppref && refresh) set(OPPREF_COOKIE, existingOppref, OPPREF_TTL_MS);\n    const existingObref = jar[OBREF_COOKIE] || undefined;\n    if (existingObref && refresh) set(OBREF_COOKIE, existingObref, OBREF_TTL_MS);\n  }\n\n  // --- Microsoft Ads _uetmsclkid ---\n  // The UET tag's own cookie, in its own format, so the tag and this module read each other's\n  // writes. Microsoft's ITP answer is this first-party cookie (plus a localStorage backup), but\n  // bat.js writes it through `document.cookie`, which Safari caps at 7 days — 24 hours on a\n  // landing page decorated by a classified domain, and a bing.com ad click is exactly that.\n  // Persisting it here over HTTP on the document response restores the 90-day window.\n  //\n  // The re-issue (default on, see `refresh`) is the same self-heal as for `_fbc`, and it matters\n  // more here: bat.js rewrites this cookie on EVERY page load, so without the re-issue the HTTP\n  // copy is downgraded to a JS cookie on the very next page. There is no embedded timestamp to\n  // compute a remaining lifetime from, so it is re-issued at a fresh 90 days — which is exactly\n  // what bat.js itself does on each page (`msClkIdExpirationTime` from now), so the window\n  // slides no more than the tag already slides it. A value this module cannot parse belongs to\n  // the tag: never rewritten, never deleted.\n  const urlMsclkid = params.get('msclkid')?.trim();\n  const existingMsclkid = parseUetMsclkid(jar[UET_MSCLKID_COOKIE]);\n  if (urlMsclkid && MSCLKID.test(urlMsclkid) && urlMsclkid.toLowerCase() !== existingMsclkid) {\n    set(UET_MSCLKID_COOKIE, formatUetMsclkid(urlMsclkid), MSCLKID_TTL_MS);\n    result.msclkid = urlMsclkid.toLowerCase();\n  } else if (existingMsclkid) {\n    result.msclkid = existingMsclkid;\n    if (refresh) set(UET_MSCLKID_COOKIE, formatUetMsclkid(existingMsclkid), MSCLKID_TTL_MS);\n  }\n\n  return result;\n}\n\n/** Serialize the resolved cookies into `Set-Cookie` header values. */\nexport function toSetCookieHeaders(cookies: SetCookie[]): string[] {\n  return cookies.map((cookie) => stringifySetCookie(cookie));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,MAAM,aAAa;AAEnB,MAAM,iBAAiB;AACvB,MAAM,kBAAkB;AAExB,MAAM,aAAa;AAEnB,MAAM,gBAAgB;AACtB,MAAM,eAAe;AAErB,MAAM,iBAAiB;AAEvB,MAAM,aAAa;AAEnB,MAAM,gBAAgB;AAEtB,MAAa,aAAa;AAC1B,MAAa,iBAAiB;AAC9B,MAAa,gBAAgB;AAC7B,MAAa,gBAAgB;AAC7B,MAAa,qBAAqB;AAClC,MAAa,kBAAkB;AAC/B,MAAa,aAAa;AAC1B,MAAa,gBAAgB;AAC7B,MAAa,eAAe;;AAE5B,MAAa,sBAAsB;;;;;;;;AAWnC,SAAgB,SACd,KACA,MAAc,KAAK,IAAI,GACA;CACvB,IAAI,CAAC,KAAK,OAAO,KAAA;CACjB,MAAM,QAAQ,IAAI,MAAM,GAAG;CAC3B,IAAI,MAAM,SAAS,KAAK,MAAM,SAAS,KAAK,MAAM,OAAO,MAAM,OAAO,KAAA;CACtE,IAAI,MAAM,WAAW,KAAK,CAAC,MAAM,IAAI,OAAO,KAAA;CAE5C,MAAM,eAAe,OAAO,MAAM,EAAE;CACpC,MAAM,SAAS,MAAM;CACrB,IAAI,CAAC,QAAQ,OAAO,KAAA;CAEpB,IAAI,CAAC,OAAO,SAAS,YAAY,GAAG,OAAO,KAAA;CAC3C,IAAI,eAAe,gBAAQ,eAAe,MAAM,eAAe,OAAO,KAAA;CAEtE,OAAO;EAAE;EAAK;EAAc;CAAO;AACrC;;;;;AAMA,SAAgB,UAAU,QAAgB,KAAa,iBAAiB,GAAW;CACjF,OAAO,MAAM,eAAe,GAAG,IAAI,GAAG;AACxC;;;;;;;AAUA,SAAgB,iBAAiB,QAA4C;CAC3E,OAAO,CAAC,UAAU,WAAW;AAC/B;AAKA,MAAM,eAAe;;;;;;;AAQrB,SAAgB,SACd,KACA,MAAc,KAAK,IAAI,GACA;CACvB,IAAI,CAAC,KAAK,OAAO,KAAA;CACjB,MAAM,QAAQ,IAAI,MAAM,GAAG;CAC3B,IAAI,MAAM,SAAS,GAAG,OAAO,KAAA;CAC7B,IAAI,MAAM,OAAO,SAAS,MAAM,OAAO,KAAK,OAAO,KAAA;CACnD,MAAM,UAAU,MAAM;CACtB,MAAM,UAAU,MAAM;CACtB,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,KAAK,OAAO,GAAG,OAAO,KAAA;CAC5D,IAAI,YAAY,KAAA,KAAa,CAAC,aAAa,KAAK,OAAO,GAAG,OAAO,KAAA;CACjE,MAAM,eAAe,OAAO,OAAO,IAAI;CAEvC,IAAI,gBAAgB,mBAAQ,eAAe,MAAM,eAAe,OAAO,KAAA;CACvE,OAAO;EAAE;EAAK;EAAc;CAAQ;AACtC;;AAGA,SAAgB,UAAU,SAAiB,KAAqB;CAC9D,OAAO,OAAO,KAAK,MAAM,MAAM,GAAI,EAAE,GAAG;AAC1C;AAMA,MAAM,qBAAqB;AAC3B,MAAM,UAAU;;AAGhB,SAAgB,UAAU,OAAmD;CAC3E,OAAO,CAAC,CAAC,SAAS,QAAQ,KAAK,KAAK;AACtC;;;;;AAMA,SAAgB,gBAAgB,KAAoD;CAClF,IAAI,CAAC,OAAO,CAAC,IAAI,WAAW,kBAAkB,GAAG,OAAO,KAAA;CACxD,MAAM,UAAU,IAAI,MAAM,CAAyB;CACnD,OAAO,QAAQ,KAAK,OAAO,IAAI,QAAQ,YAAY,IAAI,KAAA;AACzD;;AAGA,SAAgB,iBAAiB,SAAyB;CACxD,OAAO,GAAG,qBAAqB,QAAQ,YAAY;AACrD;;;;;AAMA,SAAgB,cAAc,SAAyB;CACrD,MAAM,KAAK,QAAQ,KAAK,CAAC,CAAC,YAAY;CACtC,IAAI,CAAC,QAAQ,KAAK,EAAE,GAAG,OAAO;CAC9B,OAAO,GAAG,GAAG,MAAM,GAAG,CAAC,EAAE,GAAG,GAAG,MAAM,GAAG,EAAE,EAAE,GAAG,GAAG,MAAM,IAAI,EAAE,EAAE,GAAG,GAAG,MAAM,IAAI,EAAE,EAAE,GAAG,GAAG,MAAM,EAAE;AACpG;AAyDA,SAAS,aAAa,KAA8B;CAClD,IAAI;EACF,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC;CACtB,QAAQ;EAEN,MAAM,IAAI,IAAI,QAAQ,GAAG;EACzB,OAAO,IAAI,gBAAgB,MAAM,KAAK,IAAI,MAAM,IAAI,CAAC,IAAI,EAAE;CAC7D;AACF;;;;;;;;;;;AAYA,SAAgB,sBACd,OAC6B;CAC7B,MAAM,EAAE,KAAK,cAAc,QAAQ,SAAS,MAAM,iBAAiB,GAAG,UAAU,SAAS;CACzF,MAAM,MAAM,MAAM,OAAO,KAAK,IAAI;CAElC,MAAM,SAAS,aAAa,GAAG;CAC/B,MAAM,OAAA,GAAMA,OAAAA,YAAAA,CAAY,gBAAgB,EAAE;CAC1C,MAAM,UAAuB,CAAC;CAC9B,MAAM,SAAsC,EAAE,QAAQ;CAEtD,MAAM,OAAO;EAAE,MAAM;EAAK;EAAQ,UAAU;EAAO,QAAQ,UAAU,KAAA;CAAU;CAC/E,MAAM,OAAO,MAAc,OAAe,UACxC,QAAQ,KAAK;EAAE;EAAM;EAAO,QAAQ,KAAK,MAAM,QAAQ,GAAI;EAAG,GAAG;CAAK,CAAC;CACzE,MAAM,OAAO,SAAiB,QAAQ,KAAK;EAAE;EAAM,OAAO;EAAI,QAAQ;EAAG,GAAG;CAAK,CAAC;CAGlF,MAAM,YAAY,OAAO,IAAI,QAAQ,KAAK,KAAA;CAC1C,MAAM,cAAc,SAAS,IAAI,aAAa,GAAG;CAEjD,IAAI,aAAa,cAAc,aAAa,QAAQ;EAElD,MAAM,MAAM,UAAU,WAAW,KAAK,cAAc;EACpD,IAAI,YAAY,KAAK,UAAU;EAC/B,OAAO,MAAM;CACf,OAAO,IAAI,aAAa;EACtB,MAAM,cAAc,YAAY,eAAe,aAAa;EAC5D,IAAI,eAAe,GACjB,IAAI,UAAU;OACT;GAGL,OAAO,MAAM,YAAY;GACzB,IAAI,SAAS,IAAI,YAAY,YAAY,KAAK,WAAW;EAC3D;CACF,OAAO,IAAI,IAAA,SAET,IAAI,UAAU;CAUhB,MAAM,SAAS,OAAO,IAAI,QAAQ,KAAK,KAAA;CACvC,MAAM,SAAS,CACb;EACE,QAAQ;EAGR,YAAY,iBAAiB,MAAM,IAAI,OAAO,IAAI,OAAO,KAAK,KAAA,IAAY,KAAA;EAC1E,SAAS,UAAmB,OAAO,QAAQ;CAC7C,GACA;EACE,QAAQ;EACR,YAAY,OAAO,IAAI,QAAQ,KAAK,KAAA;EACpC,SAAS,UAAmB,OAAO,SAAS;CAC9C,CACF;CACA,KAAK,MAAM,EAAE,QAAA,UAAQ,YAAY,YAAY,QAAQ;EACnD,MAAM,WAAW,SAAS,IAAIC,WAAS,GAAG;EAC1C,IAAI,cAAc,aAAa,KAAK,UAAU,KAAK,eAAe,UAAU,SAAS;GAEnF,IAAIA,UAAQ,UAAU,YAAY,GAAG,GAAG,UAAU;GAClD,OAAO,UAAU;EACnB,OAAO,IAAI,UAAU;GACnB,MAAM,cAAc,SAAS,eAAe,aAAa;GACzD,IAAI,cAAc,GAAG;IACnB,OAAO,SAAS,OAAO;IACvB,IAAI,SAAS,IAAIA,UAAQ,SAAS,KAAK,WAAW;GACpD;EAEF;CACF;CAOA,MAAM,YAAY,OAAO,IAAI,SAAS,KAAK,KAAA;CAC3C,MAAM,iBAAiB,IAAA,eAAuB,KAAA;CAC9C,IAAI,aAAa,cAAc,gBAAgB;EAC7C,IAAI,gBAAgB,WAAW,cAAc;EAC7C,OAAO,UAAU;CACnB,OAAO,IAAI,gBAAgB;EACzB,OAAO,UAAU;EACjB,IAAI,SAAS,IAAI,gBAAgB,gBAAgB,cAAc;CACjE;CACA,MAAM,kBAAkB,IAAA,gBAAwB,KAAA;CAChD,IAAI,mBAAmB,SAAS,IAAI,iBAAiB,iBAAiB,eAAe;CAKrF,MAAM,cAAc,IAAA,WAAmB,KAAA;CACvC,IAAI,eAAe,SAAS,IAAI,YAAY,aAAa,UAAU;CAWnE,IAAI,IAAA,sBAA6B,SAAS;EACxC,MAAM,YAAY,OAAO,IAAI,QAAQ,KAAK,KAAA;EAC1C,MAAM,iBAAiB,IAAA,eAAsB,KAAA;EAC7C,IAAI,WAAW,IAAI,eAAe,WAAW,aAAa;OACrD,IAAI,kBAAkB,SAAS,IAAI,eAAe,gBAAgB,aAAa;EACpF,MAAM,gBAAgB,IAAA,cAAqB,KAAA;EAC3C,IAAI,iBAAiB,SAAS,IAAI,cAAc,eAAe,YAAY;CAC7E;CAgBA,MAAM,aAAa,OAAO,IAAI,SAAS,CAAC,EAAE,KAAK;CAC/C,MAAM,kBAAkB,gBAAgB,IAAI,mBAAmB;CAC/D,IAAI,cAAc,QAAQ,KAAK,UAAU,KAAK,WAAW,YAAY,MAAM,iBAAiB;EAC1F,IAAI,oBAAoB,iBAAiB,UAAU,GAAG,cAAc;EACpE,OAAO,UAAU,WAAW,YAAY;CAC1C,OAAO,IAAI,iBAAiB;EAC1B,OAAO,UAAU;EACjB,IAAI,SAAS,IAAI,oBAAoB,iBAAiB,eAAe,GAAG,cAAc;CACxF;CAEA,OAAO;AACT;;AAGA,SAAgB,mBAAmB,SAAgC;CACjE,OAAO,QAAQ,KAAK,cAAA,GAAWC,OAAAA,mBAAAA,CAAmBD,QAAM,CAAC;AAC3D"}
+{"version":3,"file":"index.cjs","names":["parseCookie","stringifySetCookie","cookie"],"sources":["../../src/click-id/index.ts"],"sourcesContent":["import { type SetCookie, parseCookie, stringifySetCookie } from 'cookie';\n\n/**\n * Server-side resolution of ad-click-id cookies (`_fbc`, `_gcl_aw`/`_gcl_gb`, `_rdt_cid`,\n * `_uetmsclkid`) from the incoming request.\n *\n * This is the framework-agnostic core meant to run on the *document* response (e.g. TanStack Start\n * server middleware, Next middleware). Setting `_fbc` via an HTTP `Set-Cookie` header on the top\n * document — rather than `document.cookie` on the client — is what Meta officially recommends and is\n * the only reliable way to keep the cookie alive for 90 days in Safari: ITP caps JavaScript-set\n * cookies on a fbclid-decorated landing page to 24 hours, and the document response is never\n * classified as CNAME/IP cloaking (it is the reference the browser measures cloaking against).\n *\n * The Google pair follows the same architecture Google itself ships for server containers —\n * sGTM's Conversion Linker sets FPGCLAW via Set-Cookie for 90 days — and the sGTM ecosystem\n * productized for gtag's own cookies (stape Cookie Keeper re-issues `_gcl_*` over HTTP; vendor\n * case studies report 5–20% of Google Ads conversions recovered, up to +44% on the Safari\n * slice). One deployment caveat from WebKit's rules: the HTTP-cookie exemption holds only for\n * responses from the site's own infrastructure — a CNAME or third-party-IP host (a tagging\n * subdomain on someone else's cloud) gets its Set-Cookie silently capped to 7 days. This module\n * runs on the host's own document response, which is exactly the exempt case.\n *\n * references:\n * - https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/fbp-and-fbc\n * - https://webkit.org/tracking-prevention/ (7d JS cookies, 24h on ad-decorated landings,\n *   CNAME/third-party-IP HTTP cookies capped to 7d, same-origin HTTP cookies exempt)\n * - https://www.simoahava.com/analytics/google-ads-server-side-tagging-google-tag-manager/\n *   (Conversion Linker → FPGCLAW via Set-Cookie, Google's own server-side equivalent)\n * - https://stape.io/helpdesk/documentation/cookie-keeper-power-up (the productized re-issue)\n */\n\n// Meta's recommended _fbc cookie expiry. Events Manager warns (\"Server sending expired fbclid\")\n// when the embedded creationTime is older than 90 days and match quality/attribution may degrade;\n// no hard drop is documented.\nconst FBC_TTL_MS = 90 * 24 * 60 * 60 * 1000;\n// Reddit's pixel.js rewrites `_rdt_cid` and `_rdt_uuid` for 90 days on every page load.\nconst RDT_CID_TTL_MS = 90 * 24 * 60 * 60 * 1000;\nconst RDT_UUID_TTL_MS = 90 * 24 * 60 * 60 * 1000;\n// Meta's pixel rewrites `_fbp` for 90 days on every page load.\nconst FBP_TTL_MS = 90 * 24 * 60 * 60 * 1000;\n// OpenAI's oaiq: `__oppref` for 30 days (`720*60*60` s), `__obref` for 365 days.\nconst OPPREF_TTL_MS = 30 * 24 * 60 * 60 * 1000;\nconst OBREF_TTL_MS = 365 * 24 * 60 * 60 * 1000;\n// bat.js's own expiry for _uetmsclkid (`msClkIdExpirationTime`), the Microsoft Ads click window.\nconst MSCLKID_TTL_MS = 90 * 24 * 60 * 60 * 1000;\n// gtag's own expiry for _gcl_* — 90 days, the length of a Google Ads click's upload window.\nconst GCL_TTL_MS = 90 * 24 * 60 * 60 * 1000;\n// Tolerate a little clock skew when validating a creationTime against \"now\".\nconst CLOCK_SKEW_MS = 24 * 60 * 60 * 1000;\n\nexport const FBC_COOKIE = '_fbc';\nexport const RDT_CID_COOKIE = '_rdt_cid';\nexport const GCL_AW_COOKIE = '_gcl_aw';\nexport const GCL_GB_COOKIE = '_gcl_gb';\nexport const UET_MSCLKID_COOKIE = '_uetmsclkid';\nexport const RDT_UUID_COOKIE = '_rdt_uuid';\nexport const FBP_COOKIE = '_fbp';\nexport const OPPREF_COOKIE = '__oppref';\nexport const OBREF_COOKIE = '__obref';\n/** OpenAI's consent cookie; `false` is the visitor's opt-out, on which oaiq deletes its cookies. */\nexport const OAIQ_CONSENT_COOKIE = '__oaiq_consent';\n\nexport type ParsedFbc = { raw: string; creationTime: number; fbclid: string };\n\n/**\n * Parse `fb.<subdomainIndex>.<creationTime>.<fbclid>[.<appendix>]`. The appendix is what Meta's\n * Parameter Builder adds to the values it writes (\"an appendix field at the end of each\n * parameter\"); it is not part of the click id, so `fbclid` is the fourth segment alone and the\n * value is passed on as `raw`, unchanged. Returns undefined for anything malformed.\n * ref: https://developers.facebook.com/docs/marketing-api/conversions-api/parameter-builder-library\n */\nexport function parseFbc(\n  raw: string | undefined | null,\n  now: number = Date.now()\n): ParsedFbc | undefined {\n  if (!raw) return undefined;\n  const parts = raw.split('.');\n  if (parts.length < 4 || parts.length > 5 || parts[0] !== 'fb') return undefined;\n  if (parts.length === 5 && !parts[4]) return undefined;\n\n  const creationTime = Number(parts[2]);\n  const fbclid = parts[3];\n  if (!fbclid) return undefined;\n  // creationTime is UNIX ms; reject seconds-precision or future-dated values as malformed.\n  if (!Number.isFinite(creationTime)) return undefined;\n  if (creationTime < 1e12 || creationTime > now + CLOCK_SKEW_MS) return undefined;\n\n  return { raw, creationTime, fbclid };\n}\n\n/**\n * Build a fresh `_fbc` value. subdomainIndex is the cookie's domain level (com=0, example.com=1,\n * www.example.com=2); 1 is correct for an apex-hosted cookie.\n */\nexport function formatFbc(fbclid: string, now: number, subdomainIndex = 1): string {\n  return `fb.${subdomainIndex}.${now}.${fbclid}`;\n}\n\nexport type ParsedGcl = { raw: string; creationTime: number; clickId: string };\n\n/**\n * Whether a URL's `gclid` is a Google Ads click, by its `gclsrc` — gtag's own gating: absent or\n * `aw.ds` is Google Ads; `ds` / `3p.ds` are Search Ads 360's (a click on another engine, or on\n * Google with auto-tagging off), which gtag keeps in `_gcl_dc` and not `_gcl_aw`.\n * ref: https://support.google.com/sa360/answer/7342044\n */\nexport function isGoogleAdsGclid(gclsrc: string | null | undefined): boolean {\n  return !gclsrc || gclsrc === 'aw.ds';\n}\n\n// gtag's own value validator, extracted from the live gtag.js bundle (2026-09): its parser\n// accepts version \"GCL\" or \"1\", a /^\\d+$/ seconds timestamp, and a click id matching this.\n// Re-verify against gtag.js before changing anything here — the format is gtag's, not ours.\nconst GCL_CLICK_ID = /^[\\w-]+$/;\n\n/**\n * Parse a `_gcl_aw`/`_gcl_gb` value: `GCL.<seconds>.<clickId>[.<labels…>]` — note the timestamp\n * is in SECONDS, unlike `_fbc`'s milliseconds. gtag's parser accepts version `GCL` or `1` and\n * validates the segments exactly this way (`/^\\d+$/` timestamp, `/^[\\w-]+$/` click id); any\n * labels tail is preserved through `raw` so a re-issue stays byte-identical.\n */\nexport function parseGcl(\n  raw: string | undefined | null,\n  now: number = Date.now()\n): ParsedGcl | undefined {\n  if (!raw) return undefined;\n  const parts = raw.split('.');\n  if (parts.length < 3) return undefined;\n  if (parts[0] !== 'GCL' && parts[0] !== '1') return undefined;\n  const seconds = parts[1];\n  const clickId = parts[2];\n  if (seconds === undefined || !/^\\d+$/.test(seconds)) return undefined;\n  if (clickId === undefined || !GCL_CLICK_ID.test(clickId)) return undefined;\n  const creationTime = Number(seconds) * 1000;\n  // Reject millisecond-precision or future-dated values as malformed.\n  if (creationTime >= 1e15 || creationTime > now + CLOCK_SKEW_MS) return undefined;\n  return { raw, creationTime, clickId };\n}\n\n/** Build a fresh `_gcl_aw`/`_gcl_gb` value in gtag's own format. */\nexport function formatGcl(clickId: string, now: number): string {\n  return `GCL.${Math.floor(now / 1000)}.${clickId}`;\n}\n\n// bat.js writes the click id as `_uet<msclkid>` and reads it back only when what follows the\n// prefix is at most 32 characters (`msClkIdCookieValuePrefix`, `lengthMsClkId`); a msclkid is a\n// 32-hex-digit UUID without dashes. Re-verify against bat.js before changing anything here —\n// the format is UET's, not ours.\nconst UET_MSCLKID_PREFIX = '_uet';\nconst MSCLKID = /^[0-9a-f]{32}$/i;\n\n/** Whether a value has the shape of a Microsoft click id: 32 hex digits, no dashes. */\nexport function isMsclkid(value: string | null | undefined): value is string {\n  return !!value && MSCLKID.test(value);\n}\n\n/**\n * Parse a `_uetmsclkid` value: `_uet<32 hex>`. Returns the click id, lowercased, or undefined\n * for anything bat.js itself would not read back.\n */\nexport function parseUetMsclkid(raw: string | undefined | null): string | undefined {\n  if (!raw || !raw.startsWith(UET_MSCLKID_PREFIX)) return undefined;\n  const clickId = raw.slice(UET_MSCLKID_PREFIX.length);\n  return MSCLKID.test(clickId) ? clickId.toLowerCase() : undefined;\n}\n\n/** Build a `_uetmsclkid` value in bat.js's own format. */\nexport function formatUetMsclkid(clickId: string): string {\n  return `${UET_MSCLKID_PREFIX}${clickId.toLowerCase()}`;\n}\n\n/**\n * The click id as the Conversions API wants it: a dashed, lowercase UUID. The URL and the cookie\n * carry the 32-hex form; a value in any other shape is returned untouched for the API to judge.\n */\nexport function formatMsclkid(clickId: string): string {\n  const id = clickId.trim().toLowerCase();\n  if (!MSCLKID.test(id)) return id;\n  return `${id.slice(0, 8)}-${id.slice(8, 12)}-${id.slice(12, 16)}-${id.slice(16, 20)}-${id.slice(20)}`;\n}\n\nexport type ResolveClickIdCookiesInput = {\n  /** The absolute request URL (must include the query string). */\n  url: string;\n  /** The raw `Cookie` request header, if any. */\n  cookieHeader?: string | null;\n  /** Overridable clock, primarily for tests. Defaults to `Date.now()`. */\n  now?: number;\n  /**\n   * `Domain` attribute for the emitted cookies: the site's registrable domain, e.g.\n   * `.shware.io`, where the pixels write theirs. Required in production: a host-only cookie is a\n   * second cookie of the same name next to the pixel's, which the pixel then reads — or deletes,\n   * as Reddit's does at every subdomain level before writing its own. `null` for a host-only\n   * cookie, which only a local `localhost` setup should ask for.\n   */\n  domain: string | null;\n  /** `Secure` attribute, default true. Set false only for local http testing. */\n  secure?: boolean;\n  /** subdomainIndex for a freshly built `_fbc` (see {@link formatFbc}). Default 1. */\n  subdomainIndex?: number;\n  /**\n   * Re-issue the stored click and browser ids on every call. On by default, as an ITP self-heal:\n   * cookies follow last-writer-wins, so when a pixel has rewritten one through `document.cookie`\n   * (Safari caps JS-written cookies at 7 days, 24h on an ad-decorated landing), re-issuing the\n   * long-lived HTTP cookie on the next navigation restores it — the same continuous-re-issue\n   * mitigation the sGTM ecosystem uses (stape Cookie Keeper, Cookie Monster). `_fbc` and\n   * `_gcl_*` are re-issued byte-for-byte at their *remaining* lifetime, so their window never\n   * slides (Meta warns on a moved fbclid); the others at the lifetime their pixel itself gives\n   * them on every page load (see each below).\n   *\n   * Set false to strictly follow Meta's documented conditional-write rule (\"only set the cookie if\n   * it doesn't exist or the fbclid changed\") — e.g. to keep pages CDN-cacheable, since the\n   * re-issue attaches a per-user `Set-Cookie` (forcing `no-store`) to every response carrying an\n   * `_fbc`.\n   */\n  refresh?: boolean;\n};\n\nexport type ResolveClickIdCookiesResult = {\n  /**\n   * Cookies to emit on the response, ready for `Set-Cookie`. Empty when nothing needs to change.\n   * A `value: ''`, `maxAge: 0` entry is a deletion (an expired or malformed leftover).\n   */\n  cookies: SetCookie[];\n  /** The resolved `_fbc` value, for immediate server-side use (e.g. Conversions API). */\n  fbc?: string;\n  /** The resolved `_rdt_cid` value. */\n  rdt_cid?: string;\n  /** The resolved Google Ads click id (from the URL or a still-valid `_gcl_aw`). */\n  gclid?: string;\n  /** The resolved iOS web-to-app click id (from the URL or a still-valid `_gcl_gb`). */\n  wbraid?: string;\n  /** The resolved Microsoft Ads click id (from the URL or `_uetmsclkid`), 32-hex form. */\n  msclkid?: string;\n};\n\nfunction searchParams(url: string): URLSearchParams {\n  try {\n    return new URL(url).searchParams;\n  } catch {\n    // Fall back to a manual split so a relative or slightly malformed URL still yields the query.\n    const q = url.indexOf('?');\n    return new URLSearchParams(q !== -1 ? url.slice(q + 1) : '');\n  }\n}\n\n/**\n * Resolve the click-id cookies to set on the current document response.\n *\n * `_fbc` follows Meta's documented conditional-write rule value-wise: a new fbclid (or an absent\n * cookie) opens a fresh 90-day window; a same-fbclid cookie keeps its original value and\n * `creationTime`. Expired (>90d) or malformed values are cleared instead of forwarded. By default,\n * ({@link ResolveClickIdCookiesInput.refresh}) a still-valid cookie is re-issued unchanged at its\n * *remaining* lifetime — never `now + 90d` — so a returning visitor's window cannot slide forward\n * (which is what makes Meta flag an expired fbclid).\n */\nexport function resolveClickIdCookies(\n  input: ResolveClickIdCookiesInput\n): ResolveClickIdCookiesResult {\n  const { url, cookieHeader, domain, secure = true, subdomainIndex = 1, refresh = true } = input;\n  const now = input.now ?? Date.now();\n\n  const params = searchParams(url);\n  const jar = parseCookie(cookieHeader ?? '');\n  const cookies: SetCookie[] = [];\n  const result: ResolveClickIdCookiesResult = { cookies };\n\n  const base = { path: '/', secure, sameSite: 'lax', domain: domain ?? undefined } as const;\n  const set = (name: string, value: string, ttlMs: number) =>\n    cookies.push({ name, value, maxAge: Math.floor(ttlMs / 1000), ...base });\n  const del = (name: string) => cookies.push({ name, value: '', maxAge: 0, ...base });\n\n  // --- Meta _fbc ---\n  const urlFbclid = params.get('fbclid') || undefined;\n  const existingFbc = parseFbc(jar[FBC_COOKIE], now);\n\n  if (urlFbclid && urlFbclid !== existingFbc?.fbclid) {\n    // A new click always wins and opens a fresh 90-day window.\n    const raw = formatFbc(urlFbclid, now, subdomainIndex);\n    set(FBC_COOKIE, raw, FBC_TTL_MS);\n    result.fbc = raw;\n  } else if (existingFbc) {\n    const remainingMs = existingFbc.creationTime + FBC_TTL_MS - now;\n    if (remainingMs <= 0) {\n      del(FBC_COOKIE);\n    } else {\n      // Same fbclid: the value and creationTime are preserved (Meta's rule); refresh (default)\n      // re-issues it unchanged at its remaining lifetime as an ITP self-heal.\n      result.fbc = existingFbc.raw;\n      if (refresh) set(FBC_COOKIE, existingFbc.raw, remainingMs);\n    }\n  } else if (jar[FBC_COOKIE]) {\n    // Malformed leftover — clear it rather than forwarding it to Meta.\n    del(FBC_COOKIE);\n  }\n\n  // --- Google Ads _gcl_aw / _gcl_gb ---\n  // The same first-party HTTP persistence Google's own server-side Conversion Linker performs\n  // (it sets FPGCLAW via Set-Cookie for 90 days), applied to gtag's cookies the way the sGTM\n  // ecosystem does (stape Cookie Keeper re-issues _gcl_* over HTTP). Ownership is shared with\n  // gtag, so the rules are stricter than for _fbc: a value this module cannot parse is left\n  // untouched — never rewritten, never deleted — and a re-issue is byte-identical (labels tail\n  // included) at the window's REMAINING lifetime, so the 90-day click window never slides.\n  const gclsrc = params.get('gclsrc') || undefined;\n  const google = [\n    {\n      cookie: GCL_AW_COOKIE,\n      // gtag's own gating (`isGoogleAdsGclid`): a gclid enters _gcl_aw only when gclsrc is\n      // absent or 'aw.ds' — 'ds'/'3p.ds' clicks are Search Ads 360's and belong to _gcl_dc.\n      urlClickId: isGoogleAdsGclid(gclsrc) ? params.get('gclid') || undefined : undefined,\n      assign: (value: string) => (result.gclid = value),\n    },\n    {\n      cookie: GCL_GB_COOKIE,\n      urlClickId: params.get('wbraid') || undefined,\n      assign: (value: string) => (result.wbraid = value),\n    },\n  ];\n  for (const { cookie, urlClickId, assign } of google) {\n    const existing = parseGcl(jar[cookie], now);\n    if (urlClickId && GCL_CLICK_ID.test(urlClickId) && urlClickId !== existing?.clickId) {\n      // A new click always wins and opens a fresh 90-day window, in gtag's exact format.\n      set(cookie, formatGcl(urlClickId, now), GCL_TTL_MS);\n      assign(urlClickId);\n    } else if (existing) {\n      const remainingMs = existing.creationTime + GCL_TTL_MS - now;\n      if (remainingMs > 0) {\n        assign(existing.clickId);\n        if (refresh) set(cookie, existing.raw, remainingMs);\n      }\n      // Expired: not returned and not re-issued, but gtag owns the deletion.\n    }\n  }\n\n  // --- Reddit _rdt_cid / _rdt_uuid ---\n  // Reddit's pixel.js rewrites both on every page load through `document.cookie` — the click id\n  // from the URL, else the stored one, and the browser id — each for a fresh 90 days. So Reddit\n  // slides the window itself, and the re-issue (default on, see `refresh`) does the same over\n  // HTTP: without it the pixel's JS copy, capped at 7 days in Safari, is the only one left.\n  const urlRdtCid = params.get('rdt_cid') || undefined;\n  const existingRdtCid = jar[RDT_CID_COOKIE] || undefined;\n  if (urlRdtCid && urlRdtCid !== existingRdtCid) {\n    set(RDT_CID_COOKIE, urlRdtCid, RDT_CID_TTL_MS);\n    result.rdt_cid = urlRdtCid;\n  } else if (existingRdtCid) {\n    result.rdt_cid = existingRdtCid;\n    if (refresh) set(RDT_CID_COOKIE, existingRdtCid, RDT_CID_TTL_MS);\n  }\n  const existingRdtUuid = jar[RDT_UUID_COOKIE] || undefined;\n  if (existingRdtUuid && refresh) set(RDT_UUID_COOKIE, existingRdtUuid, RDT_UUID_TTL_MS);\n\n  // --- Meta _fbp ---\n  // The pixel's browser id: created by the pixel, which rewrites it for 90 days on every page\n  // load, as Reddit's does its own. Re-issued as it is, never created here.\n  const existingFbp = jar[FBP_COOKIE] || undefined;\n  if (existingFbp && refresh) set(FBP_COOKIE, existingFbp, FBP_TTL_MS);\n\n  // --- OpenAI __oppref / __obref ---\n  // oaiq writes `__oppref` only when the URL carries `oppref` (30 days), and `__obref` — its\n  // browser reference — only when there is none (365 days); otherwise it reads them, through\n  // `document.cookie`, so in Safari each is gone after 7 days and the browser starts over with a\n  // new reference. The first is captured here from the URL as well, and both are re-issued as\n  // they are, `__obref` never created. Unlike oaiq, the re-issue restarts their windows: their\n  // values carry no creation time to count a remaining lifetime from, and OpenAI applies its own\n  // attribution window to the click whatever the cookie's age. Nothing is written once the\n  // visitor has opted out of oaiq, which deletes both cookies then.\n  if (jar[OAIQ_CONSENT_COOKIE] !== 'false') {\n    const urlOppref = params.get('oppref') || undefined;\n    const existingOppref = jar[OPPREF_COOKIE] || undefined;\n    if (urlOppref) set(OPPREF_COOKIE, urlOppref, OPPREF_TTL_MS);\n    else if (existingOppref && refresh) set(OPPREF_COOKIE, existingOppref, OPPREF_TTL_MS);\n    const existingObref = jar[OBREF_COOKIE] || undefined;\n    if (existingObref && refresh) set(OBREF_COOKIE, existingObref, OBREF_TTL_MS);\n  }\n\n  // --- Microsoft Ads _uetmsclkid ---\n  // The UET tag's own cookie, in its own format, so the tag and this module read each other's\n  // writes. Microsoft's ITP answer is this first-party cookie (plus a localStorage backup), but\n  // bat.js writes it through `document.cookie`, which Safari caps at 7 days — 24 hours on a\n  // landing page decorated by a classified domain, and a bing.com ad click is exactly that.\n  // Persisting it here over HTTP on the document response restores the 90-day window.\n  //\n  // The re-issue (default on, see `refresh`) is the same self-heal as for `_fbc`, and it matters\n  // more here: bat.js rewrites this cookie on EVERY page load, so without the re-issue the HTTP\n  // copy is downgraded to a JS cookie on the very next page. There is no embedded timestamp to\n  // compute a remaining lifetime from, so it is re-issued at a fresh 90 days — which is exactly\n  // what bat.js itself does on each page (`msClkIdExpirationTime` from now), so the window\n  // slides no more than the tag already slides it. A value this module cannot parse belongs to\n  // the tag: never rewritten, never deleted.\n  const urlMsclkid = params.get('msclkid')?.trim();\n  const existingMsclkid = parseUetMsclkid(jar[UET_MSCLKID_COOKIE]);\n  if (urlMsclkid && MSCLKID.test(urlMsclkid) && urlMsclkid.toLowerCase() !== existingMsclkid) {\n    set(UET_MSCLKID_COOKIE, formatUetMsclkid(urlMsclkid), MSCLKID_TTL_MS);\n    result.msclkid = urlMsclkid.toLowerCase();\n  } else if (existingMsclkid) {\n    result.msclkid = existingMsclkid;\n    if (refresh) set(UET_MSCLKID_COOKIE, formatUetMsclkid(existingMsclkid), MSCLKID_TTL_MS);\n  }\n\n  return result;\n}\n\n/** Serialize the resolved cookies into `Set-Cookie` header values. */\nexport function toSetCookieHeaders(cookies: SetCookie[]): string[] {\n  return cookies.map((cookie) => stringifySetCookie(cookie));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,MAAM,aAAa;AAEnB,MAAM,iBAAiB;AACvB,MAAM,kBAAkB;AAExB,MAAM,aAAa;AAEnB,MAAM,gBAAgB;AACtB,MAAM,eAAe;AAErB,MAAM,iBAAiB;AAEvB,MAAM,aAAa;AAEnB,MAAM,gBAAgB;AAEtB,MAAa,aAAa;AAC1B,MAAa,iBAAiB;AAC9B,MAAa,gBAAgB;AAC7B,MAAa,gBAAgB;AAC7B,MAAa,qBAAqB;AAClC,MAAa,kBAAkB;AAC/B,MAAa,aAAa;AAC1B,MAAa,gBAAgB;AAC7B,MAAa,eAAe;;AAE5B,MAAa,sBAAsB;;;;;;;;AAWnC,SAAgB,SACd,KACA,MAAc,KAAK,IAAI,GACA;CACvB,IAAI,CAAC,KAAK,OAAO,KAAA;CACjB,MAAM,QAAQ,IAAI,MAAM,GAAG;CAC3B,IAAI,MAAM,SAAS,KAAK,MAAM,SAAS,KAAK,MAAM,OAAO,MAAM,OAAO,KAAA;CACtE,IAAI,MAAM,WAAW,KAAK,CAAC,MAAM,IAAI,OAAO,KAAA;CAE5C,MAAM,eAAe,OAAO,MAAM,EAAE;CACpC,MAAM,SAAS,MAAM;CACrB,IAAI,CAAC,QAAQ,OAAO,KAAA;CAEpB,IAAI,CAAC,OAAO,SAAS,YAAY,GAAG,OAAO,KAAA;CAC3C,IAAI,eAAe,gBAAQ,eAAe,MAAM,eAAe,OAAO,KAAA;CAEtE,OAAO;EAAE;EAAK;EAAc;CAAO;AACrC;;;;;AAMA,SAAgB,UAAU,QAAgB,KAAa,iBAAiB,GAAW;CACjF,OAAO,MAAM,eAAe,GAAG,IAAI,GAAG;AACxC;;;;;;;AAUA,SAAgB,iBAAiB,QAA4C;CAC3E,OAAO,CAAC,UAAU,WAAW;AAC/B;AAKA,MAAM,eAAe;;;;;;;AAQrB,SAAgB,SACd,KACA,MAAc,KAAK,IAAI,GACA;CACvB,IAAI,CAAC,KAAK,OAAO,KAAA;CACjB,MAAM,QAAQ,IAAI,MAAM,GAAG;CAC3B,IAAI,MAAM,SAAS,GAAG,OAAO,KAAA;CAC7B,IAAI,MAAM,OAAO,SAAS,MAAM,OAAO,KAAK,OAAO,KAAA;CACnD,MAAM,UAAU,MAAM;CACtB,MAAM,UAAU,MAAM;CACtB,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,KAAK,OAAO,GAAG,OAAO,KAAA;CAC5D,IAAI,YAAY,KAAA,KAAa,CAAC,aAAa,KAAK,OAAO,GAAG,OAAO,KAAA;CACjE,MAAM,eAAe,OAAO,OAAO,IAAI;CAEvC,IAAI,gBAAgB,mBAAQ,eAAe,MAAM,eAAe,OAAO,KAAA;CACvE,OAAO;EAAE;EAAK;EAAc;CAAQ;AACtC;;AAGA,SAAgB,UAAU,SAAiB,KAAqB;CAC9D,OAAO,OAAO,KAAK,MAAM,MAAM,GAAI,EAAE,GAAG;AAC1C;AAMA,MAAM,qBAAqB;AAC3B,MAAM,UAAU;;AAGhB,SAAgB,UAAU,OAAmD;CAC3E,OAAO,CAAC,CAAC,SAAS,QAAQ,KAAK,KAAK;AACtC;;;;;AAMA,SAAgB,gBAAgB,KAAoD;CAClF,IAAI,CAAC,OAAO,CAAC,IAAI,WAAW,kBAAkB,GAAG,OAAO,KAAA;CACxD,MAAM,UAAU,IAAI,MAAM,CAAyB;CACnD,OAAO,QAAQ,KAAK,OAAO,IAAI,QAAQ,YAAY,IAAI,KAAA;AACzD;;AAGA,SAAgB,iBAAiB,SAAyB;CACxD,OAAO,GAAG,qBAAqB,QAAQ,YAAY;AACrD;;;;;AAMA,SAAgB,cAAc,SAAyB;CACrD,MAAM,KAAK,QAAQ,KAAK,CAAC,CAAC,YAAY;CACtC,IAAI,CAAC,QAAQ,KAAK,EAAE,GAAG,OAAO;CAC9B,OAAO,GAAG,GAAG,MAAM,GAAG,CAAC,EAAE,GAAG,GAAG,MAAM,GAAG,EAAE,EAAE,GAAG,GAAG,MAAM,IAAI,EAAE,EAAE,GAAG,GAAG,MAAM,IAAI,EAAE,EAAE,GAAG,GAAG,MAAM,EAAE;AACpG;AAyDA,SAAS,aAAa,KAA8B;CAClD,IAAI;EACF,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC;CACtB,QAAQ;EAEN,MAAM,IAAI,IAAI,QAAQ,GAAG;EACzB,OAAO,IAAI,gBAAgB,MAAM,KAAK,IAAI,MAAM,IAAI,CAAC,IAAI,EAAE;CAC7D;AACF;;;;;;;;;;;AAYA,SAAgB,sBACd,OAC6B;CAC7B,MAAM,EAAE,KAAK,cAAc,QAAQ,SAAS,MAAM,iBAAiB,GAAG,UAAU,SAAS;CACzF,MAAM,MAAM,MAAM,OAAO,KAAK,IAAI;CAElC,MAAM,SAAS,aAAa,GAAG;CAC/B,MAAM,OAAA,GAAMA,OAAAA,YAAAA,CAAY,gBAAgB,EAAE;CAC1C,MAAM,UAAuB,CAAC;CAC9B,MAAM,SAAsC,EAAE,QAAQ;CAEtD,MAAM,OAAO;EAAE,MAAM;EAAK;EAAQ,UAAU;EAAO,QAAQ,UAAU,KAAA;CAAU;CAC/E,MAAM,OAAO,MAAc,OAAe,UACxC,QAAQ,KAAK;EAAE;EAAM;EAAO,QAAQ,KAAK,MAAM,QAAQ,GAAI;EAAG,GAAG;CAAK,CAAC;CACzE,MAAM,OAAO,SAAiB,QAAQ,KAAK;EAAE;EAAM,OAAO;EAAI,QAAQ;EAAG,GAAG;CAAK,CAAC;CAGlF,MAAM,YAAY,OAAO,IAAI,QAAQ,KAAK,KAAA;CAC1C,MAAM,cAAc,SAAS,IAAI,aAAa,GAAG;CAEjD,IAAI,aAAa,cAAc,aAAa,QAAQ;EAElD,MAAM,MAAM,UAAU,WAAW,KAAK,cAAc;EACpD,IAAI,YAAY,KAAK,UAAU;EAC/B,OAAO,MAAM;CACf,OAAO,IAAI,aAAa;EACtB,MAAM,cAAc,YAAY,eAAe,aAAa;EAC5D,IAAI,eAAe,GACjB,IAAI,UAAU;OACT;GAGL,OAAO,MAAM,YAAY;GACzB,IAAI,SAAS,IAAI,YAAY,YAAY,KAAK,WAAW;EAC3D;CACF,OAAO,IAAI,IAAA,SAET,IAAI,UAAU;CAUhB,MAAM,SAAS,OAAO,IAAI,QAAQ,KAAK,KAAA;CACvC,MAAM,SAAS,CACb;EACE,QAAQ;EAGR,YAAY,iBAAiB,MAAM,IAAI,OAAO,IAAI,OAAO,KAAK,KAAA,IAAY,KAAA;EAC1E,SAAS,UAAmB,OAAO,QAAQ;CAC7C,GACA;EACE,QAAQ;EACR,YAAY,OAAO,IAAI,QAAQ,KAAK,KAAA;EACpC,SAAS,UAAmB,OAAO,SAAS;CAC9C,CACF;CACA,KAAK,MAAM,EAAE,QAAQ,YAAY,YAAY,QAAQ;EACnD,MAAM,WAAW,SAAS,IAAI,SAAS,GAAG;EAC1C,IAAI,cAAc,aAAa,KAAK,UAAU,KAAK,eAAe,UAAU,SAAS;GAEnF,IAAI,QAAQ,UAAU,YAAY,GAAG,GAAG,UAAU;GAClD,OAAO,UAAU;EACnB,OAAO,IAAI,UAAU;GACnB,MAAM,cAAc,SAAS,eAAe,aAAa;GACzD,IAAI,cAAc,GAAG;IACnB,OAAO,SAAS,OAAO;IACvB,IAAI,SAAS,IAAI,QAAQ,SAAS,KAAK,WAAW;GACpD;EAEF;CACF;CAOA,MAAM,YAAY,OAAO,IAAI,SAAS,KAAK,KAAA;CAC3C,MAAM,iBAAiB,IAAA,eAAuB,KAAA;CAC9C,IAAI,aAAa,cAAc,gBAAgB;EAC7C,IAAI,gBAAgB,WAAW,cAAc;EAC7C,OAAO,UAAU;CACnB,OAAO,IAAI,gBAAgB;EACzB,OAAO,UAAU;EACjB,IAAI,SAAS,IAAI,gBAAgB,gBAAgB,cAAc;CACjE;CACA,MAAM,kBAAkB,IAAA,gBAAwB,KAAA;CAChD,IAAI,mBAAmB,SAAS,IAAI,iBAAiB,iBAAiB,eAAe;CAKrF,MAAM,cAAc,IAAA,WAAmB,KAAA;CACvC,IAAI,eAAe,SAAS,IAAI,YAAY,aAAa,UAAU;CAWnE,IAAI,IAAA,sBAA6B,SAAS;EACxC,MAAM,YAAY,OAAO,IAAI,QAAQ,KAAK,KAAA;EAC1C,MAAM,iBAAiB,IAAA,eAAsB,KAAA;EAC7C,IAAI,WAAW,IAAI,eAAe,WAAW,aAAa;OACrD,IAAI,kBAAkB,SAAS,IAAI,eAAe,gBAAgB,aAAa;EACpF,MAAM,gBAAgB,IAAA,cAAqB,KAAA;EAC3C,IAAI,iBAAiB,SAAS,IAAI,cAAc,eAAe,YAAY;CAC7E;CAgBA,MAAM,aAAa,OAAO,IAAI,SAAS,CAAC,EAAE,KAAK;CAC/C,MAAM,kBAAkB,gBAAgB,IAAI,mBAAmB;CAC/D,IAAI,cAAc,QAAQ,KAAK,UAAU,KAAK,WAAW,YAAY,MAAM,iBAAiB;EAC1F,IAAI,oBAAoB,iBAAiB,UAAU,GAAG,cAAc;EACpE,OAAO,UAAU,WAAW,YAAY;CAC1C,OAAO,IAAI,iBAAiB;EAC1B,OAAO,UAAU;EACjB,IAAI,SAAS,IAAI,oBAAoB,iBAAiB,eAAe,GAAG,cAAc;CACxF;CAEA,OAAO;AACT;;AAGA,SAAgB,mBAAmB,SAAgC;CACjE,OAAO,QAAQ,KAAK,cAAA,GAAWC,OAAAA,mBAAAA,CAAmBC,QAAM,CAAC;AAC3D"}

package/dist/next/index.d.cts

@@ -31,4 +31,5 @@ interface Props {
 }
 export declare function Analytics({ gaId, gaSrc, nonce, debugMode, metaPixelId, hotjarId, redditPixelId, linkedInPartnerId, uetTagId, uetCustomerId, uetConsent, facebookAppId, reportWebVitals }: Props): import("react").JSX.Element;
 //#endregion
+export {};
 //# sourceMappingURL=index.d.cts.map

package/dist/next/index.d.mts

@@ -31,4 +31,5 @@ interface Props {
 }
 export declare function Analytics({ gaId, gaSrc, nonce, debugMode, metaPixelId, hotjarId, redditPixelId, linkedInPartnerId, uetTagId, uetCustomerId, uetConsent, facebookAppId, reportWebVitals }: Props): import("react").JSX.Element;
 //#endregion
+export {};
 //# sourceMappingURL=index.d.mts.map

package/dist/node_modules/.pnpm/bowser@2.14.1/node_modules/bowser/es5.cjs

@@ -1,8 +1,8 @@
 //#region ../../node_modules/.pnpm/bowser@2.14.1/node_modules/bowser/es5.js
-var require_es5 = /* @__PURE__ */ require("../../../../../_virtual/_rolldown/runtime.cjs").__commonJSMin(((exports, module) => {
+var require_es5 = /* @__PURE__ */ require("../../../../../_virtual/_rolldown/runtime.cjs").__commonJSMin(((exports, module, this$1) => {
 	(function(e, t) {
 		"object" == typeof exports && "object" == typeof module ? module.exports = t() : "function" == typeof define && define.amd ? define([], t) : "object" == typeof exports ? exports.bowser = t() : e.bowser = t();
-	})(exports, (function() {
+	})(this$1, (function() {
 		return function(e) {
 			var t = {};
 			function r(i) {