@shware/analytics 7.1.1 → 7.3.0

package/dist/schema/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/schema/index.ts"],"mappings":";;cAwEa;cAUA;cAEA,YAAU,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqErB,EAAA,KAAA;cAEW,kBAAgB,EAAA,gBAAA,EAAA,YAAA,EAAA,cAAA,EAAA,uBAAA,EAAA,uBAAA,EAAA,YAAA,EAAA,uBAAA,EAAA,mCAAA,EAAA,uBAAA,EAAA,yBAAA,EAAA,aAAA,EAAA,aAAA,EAAA,YAAA,EAAA,cAAA,EAAA,uBAAA,EAAA,uBAAA,EAAA,YAAA,EAAA,uBAAA,EAAA,mCAAA,EAAA,uBAAA,EAAA,yBAAA,EAAA,gBAAA,EAAA,iBAAA,kDAAA,wDAAA,EAAA,iBAAA,2CAAA,4DAAA,2CAAA;cAehB,wBAAsB,EAAA,aAAA,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAWE,EAAA,KAAA;cAExB,qBAAmB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAM9B,EAAA,KAAA;;;;;;;;;;;cA6BW,wBAAsB,EAAA;;;;;;;;;;;;;;;;;;;;GAIjC,EAAA,KAAA;cAEW,qBAAmB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAM9B,EAAA,KAAA;cAEW,sBAAoB,EAAA;;;;GAI/B,EAAA,KAAA;;;;;cAWW,kBAAgB,EAAA;;;;;;;;;;;GA+C3B,EAAA,KAAA;KAEU,sBAAsB,EAAE,cAAc;KACtC,oBAAoB,EAAE,cAAc;KACpC,gBAAgB,EAAE,cAAc;KAChC,mBAAmB,EAAE,cAAc;KACnC,sBAAsB,EAAE,cAAc;KACtC,mBAAmB,EAAE,cAAc"}
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/schema/index.ts"],"mappings":";;cAyEa;cAUA;cAEA,YAAU,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqErB,EAAA,KAAA;cAEW,kBAAgB,EAAA,gBAAA,EAAA,YAAA,EAAA,cAAA,EAAA,uBAAA,EAAA,uBAAA,EAAA,YAAA,EAAA,uBAAA,EAAA,mCAAA,EAAA,uBAAA,EAAA,yBAAA,EAAA,aAAA,EAAA,aAAA,EAAA,YAAA,EAAA,cAAA,EAAA,uBAAA,EAAA,uBAAA,EAAA,YAAA,EAAA,uBAAA,EAAA,mCAAA,EAAA,uBAAA,EAAA,yBAAA,EAAA,gBAAA,EAAA,iBAAA,kDAAA,wDAAA,EAAA,iBAAA,2CAAA,4DAAA,2CAAA;cAehB,wBAAsB,EAAA,aAAA,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAWE,EAAA,KAAA;cAExB,qBAAmB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAM9B,EAAA,KAAA;;;;;;;;;;;cA6BW,wBAAsB,EAAA;;;;;;;;;;;;;;;;;;;;GAIjC,EAAA,KAAA;cAEW,qBAAmB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAM9B,EAAA,KAAA;cAEW,sBAAoB,EAAA;;;;GAI/B,EAAA,KAAA;;;;;cAWW,kBAAgB,EAAA;;;;;;;;;;;GA+C3B,EAAA,KAAA;KAEU,sBAAsB,EAAE,cAAc;KACtC,oBAAoB,EAAE,cAAc;KACpC,gBAAgB,EAAE,cAAc;KAChC,mBAAmB,EAAE,cAAc;KACnC,sBAAsB,EAAE,cAAc;KACtC,mBAAmB,EAAE,cAAc"}

package/dist/schema/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/schema/index.ts"],"mappings":";;cAwEa;cAUA;cAEA,YAAU,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqErB,EAAA,KAAA;cAEW,kBAAgB,EAAA,gBAAA,EAAA,YAAA,EAAA,cAAA,EAAA,uBAAA,EAAA,uBAAA,EAAA,YAAA,EAAA,uBAAA,EAAA,mCAAA,EAAA,uBAAA,EAAA,yBAAA,EAAA,aAAA,EAAA,aAAA,EAAA,YAAA,EAAA,cAAA,EAAA,uBAAA,EAAA,uBAAA,EAAA,YAAA,EAAA,uBAAA,EAAA,mCAAA,EAAA,uBAAA,EAAA,yBAAA,EAAA,gBAAA,EAAA,iBAAA,kDAAA,wDAAA,EAAA,iBAAA,2CAAA,4DAAA,2CAAA;cAehB,wBAAsB,EAAA,aAAA,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAWE,EAAA,KAAA;cAExB,qBAAmB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAM9B,EAAA,KAAA;;;;;;;;;;;cA6BW,wBAAsB,EAAA;;;;;;;;;;;;;;;;;;;;GAIjC,EAAA,KAAA;cAEW,qBAAmB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAM9B,EAAA,KAAA;cAEW,sBAAoB,EAAA;;;;GAI/B,EAAA,KAAA;;;;;cAWW,kBAAgB,EAAA;;;;;;;;;;;GA+C3B,EAAA,KAAA;KAEU,sBAAsB,EAAE,cAAc;KACtC,oBAAoB,EAAE,cAAc;KACpC,gBAAgB,EAAE,cAAc;KAChC,mBAAmB,EAAE,cAAc;KACnC,sBAAsB,EAAE,cAAc;KACtC,mBAAmB,EAAE,cAAc"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/schema/index.ts"],"mappings":";;cAyEa;cAUA;cAEA,YAAU,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqErB,EAAA,KAAA;cAEW,kBAAgB,EAAA,gBAAA,EAAA,YAAA,EAAA,cAAA,EAAA,uBAAA,EAAA,uBAAA,EAAA,YAAA,EAAA,uBAAA,EAAA,mCAAA,EAAA,uBAAA,EAAA,yBAAA,EAAA,aAAA,EAAA,aAAA,EAAA,YAAA,EAAA,cAAA,EAAA,uBAAA,EAAA,uBAAA,EAAA,YAAA,EAAA,uBAAA,EAAA,mCAAA,EAAA,uBAAA,EAAA,yBAAA,EAAA,gBAAA,EAAA,iBAAA,kDAAA,wDAAA,EAAA,iBAAA,2CAAA,4DAAA,2CAAA;cAehB,wBAAsB,EAAA,aAAA,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAWE,EAAA,KAAA;cAExB,qBAAmB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAM9B,EAAA,KAAA;;;;;;;;;;;cA6BW,wBAAsB,EAAA;;;;;;;;;;;;;;;;;;;;GAIjC,EAAA,KAAA;cAEW,qBAAmB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAM9B,EAAA,KAAA;cAEW,sBAAoB,EAAA;;;;GAI/B,EAAA,KAAA;;;;;cAWW,kBAAgB,EAAA;;;;;;;;;;;GA+C3B,EAAA,KAAA;KAEU,sBAAsB,EAAE,cAAc;KACtC,oBAAoB,EAAE,cAAc;KACpC,gBAAgB,EAAE,cAAc;KAChC,mBAAmB,EAAE,cAAc;KACnC,sBAAsB,EAAE,cAAc;KACtC,mBAAmB,EAAE,cAAc"}

package/dist/schema/index.mjs

@@ -5,7 +5,7 @@ const MAX_VALUE_LENGTH = 512;
 const MAX_PROPERTIES = 64;
 /**
 * Truncated rather than rejected. These schemas validate a whole batch at once, so refusing one
-* oversized value costs every event that travelled with it — and the values that overrun are the
+* oversized value costs every event that traveled with it — and the values that overrun are the
 * ones derived from the page (a link's text, a URL carrying a long query), which no client can
 * bound in advance. A shortened value is worth more than a lost batch.
 */
@@ -22,11 +22,13 @@ const propertyText = pipe(string(), transform((value) => value.slice(0, MAX_VALU
 */
 function takeProperties(data) {
 	const result = {};
+	let count = 0;
 	for (const [rawKey, value] of Object.entries(data)) {
+		if (count >= MAX_PROPERTIES) break;
 		const key = rawKey.trim();
 		if (!key || key.length > MAX_KEY_LENGTH) continue;
-		if (Object.keys(result).length >= MAX_PROPERTIES) break;
 		result[key] = value;
+		count++;
 	}
 	return result;
 }

package/dist/schema/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":["_null","_enum"],"sources":["../../src/schema/index.ts"],"sourcesContent":["import {\n  enum as _enum,\n  null as _null,\n  array,\n  boolean,\n  e164,\n  email,\n  iso,\n  maxLength,\n  minLength,\n  number,\n  object,\n  optional,\n  pipe,\n  record,\n  refine,\n  regex,\n  string,\n  toLowerCase,\n  toUpperCase,\n  transform,\n  trim,\n  union,\n  url,\n  uuid,\n  type z,\n} from 'zod/mini';\nimport type { Environment, Platform } from '../track/types';\n\nconst MAX_KEY_LENGTH = 128;\nconst MAX_VALUE_LENGTH = 512;\nconst MAX_PROPERTIES = 64;\n\n/**\n * Truncated rather than rejected. These schemas validate a whole batch at once, so refusing one\n * oversized value costs every event that travelled with it — and the values that overrun are the\n * ones derived from the page (a link's text, a URL carrying a long query), which no client can\n * bound in advance. A shortened value is worth more than a lost batch.\n */\nconst propertyText = pipe(\n  string(),\n  transform((value) => value.slice(0, MAX_VALUE_LENGTH))\n);\n\n/**\n * Keys are written by hand in instrumentation code, so an unusable one is a mistake in the host\n * rather than something the visitor typed. It is still dropped rather than rejected, for the same\n * reason: the mistake should cost that property, not the batch it happens to be in. Truncating a\n * key is not an option — two long keys would silently become one field.\n *\n * The key schema below is deliberately permissive so that this transform is reached at all; the\n * trimming it used to do happens here instead. `MAX_PROPERTIES` keeps the first N in insertion\n * order.\n */\nfunction takeProperties<T>(data: Record<string, T>): Record<string, T> {\n  const result: Record<string, T> = {};\n  for (const [rawKey, value] of Object.entries(data)) {\n    const key = rawKey.trim();\n    if (!key || key.length > MAX_KEY_LENGTH) continue;\n    if (Object.keys(result).length >= MAX_PROPERTIES) break;\n    result[key] = value;\n  }\n  return result;\n}\n\nconst items = array(\n  pipe(\n    record(string(), union([propertyText, number(), boolean(), _null()])),\n    transform(takeProperties)\n  )\n);\n\nexport const ALL_PLATFORMS = [\n  'ios',\n  'android',\n  'web',\n  'macos',\n  'windows',\n  'linux',\n  'unknown',\n] as const satisfies Platform[];\n\nexport const ALL_ENVIRONMENTS = ['development', 'production'] as const satisfies Environment[];\n\nexport const tagsSchema = object({\n  os: optional(string()),\n  os_name: optional(string()),\n  os_version: optional(string()),\n  browser: optional(string()),\n  browser_name: optional(string()),\n  browser_version: optional(string()),\n  device: optional(string()),\n  device_id: optional(string().check(trim(), minLength(1), maxLength(36))),\n  device_type: optional(string()),\n  device_vendor: optional(string()),\n  device_pixel_ratio: optional(number()),\n  screen_width: optional(number()),\n  screen_height: optional(number()),\n  screen_resolution: optional(\n    pipe(\n      string().check(regex(/^\\d+x\\d+$/)),\n      transform((v) => v as `${number}x${number}`)\n    )\n  ),\n  release: optional(string()),\n  language: optional(string()),\n  time_zone: optional(string()),\n  page_location: optional(string()),\n  page_referrer: optional(string()),\n  page_title: optional(string()),\n  // app info\n  advertising_id: optional(string()),\n  install_referrer: optional(string()),\n  // Meta Ads\n  fbc: optional(string()),\n  fbp: optional(string()),\n  fbclid: optional(string()),\n  ad_id: optional(string()),\n  ad_name: optional(string()),\n  adset_id: optional(string()),\n  adset_name: optional(string()),\n  campaign_id: optional(string()),\n  campaign_name: optional(string()),\n  placement: optional(string()),\n  site_source_name: optional(string()),\n  // Google Ads\n  gclid: optional(string()),\n  gclsrc: optional(string()),\n  gad_source: optional(string()),\n  gad_campaignid: optional(string()),\n  // Reddit ads\n  rdt_cid: optional(string()),\n  rdt_uuid: optional(string()),\n  // click ids\n  dclid: optional(string()),\n  ko_click_id: optional(string()),\n  li_fat_id: optional(string()),\n  msclkid: optional(string()),\n  sccid: optional(string()),\n  ttclid: optional(string()),\n  twclid: optional(string()),\n  wbraid: optional(string()),\n  yclid: optional(string()),\n  // utm params\n  utm_source: optional(string()),\n  utm_medium: optional(string()),\n  utm_campaign: optional(string()),\n  utm_term: optional(string()),\n  utm_content: optional(string()),\n  utm_id: optional(string()),\n  utm_source_platform: optional(string()),\n  utm_creative_format: optional(string()),\n  utm_marketing_tactic: optional(string()),\n});\n\nexport const propertiesSchema = optional(\n  pipe(\n    record(string(), union([propertyText, number(), boolean(), _null(), items])),\n    transform(takeProperties)\n  )\n);\n\n/** Visitor properties differ from event properties only in taking no nested item lists. */\nconst visitorPropertiesSchema = optional(\n  pipe(\n    record(string(), union([propertyText, number(), boolean(), _null()])),\n    transform(takeProperties)\n  )\n);\n\nexport const createTrackEventSchema = array(\n  object({\n    name: string().check(trim(), minLength(1), maxLength(64)),\n    visitor_id: uuid(),\n    session_id: uuid(),\n    platform: _enum(ALL_PLATFORMS),\n    environment: _enum(ALL_ENVIRONMENTS),\n    timestamp: iso.datetime(),\n    tags: tagsSchema,\n    properties: propertiesSchema,\n  })\n).check(minLength(1), maxLength(100));\n\nexport const createVisitorSchema = object({\n  device_id: string().check(trim(), minLength(1), maxLength(36)),\n  platform: _enum(ALL_PLATFORMS),\n  environment: _enum(ALL_ENVIRONMENTS),\n  tags: tagsSchema,\n  properties: visitorPropertiesSchema,\n});\n\nconst emailValue = pipe(string().check(trim(), toLowerCase(), maxLength(320)), email());\n\n/** E.164: a plus sign (+) prefix, country code, then digits only, no dashes/parens/spaces. */\nconst phoneValue = pipe(string().check(trim()), e164());\n\nconst addressValue = object({\n  first_name: optional(string().check(trim(), maxLength(128))),\n  last_name: optional(string().check(trim(), maxLength(128))),\n  street: optional(string().check(trim(), maxLength(256))),\n  city: optional(string().check(trim(), maxLength(128))),\n  /** User province, state, or region. Example: `Hampshire` */\n  region: optional(string().check(trim(), maxLength(128))),\n  postal_code: optional(string().check(trim(), maxLength(32))),\n  /** 2-letter country code, per the ISO 3166-1 alpha-2 standard. Example: `UK` */\n  country: optional(string().check(trim(), toUpperCase(), regex(/^[A-Z]{2}$/))),\n});\n\n/**\n * User-provided data (UPD) used for enhanced conversions, Customer Match, and demographics.\n * Values are sent unhashed; Google normalizes and hashes them before they reach its servers.\n *\n * Multiple values may be sent to increase the match rate: up to 3 emails, 3 phone numbers, and\n * 2 addresses.\n *\n * @see https://support.google.com/analytics/answer/14078702\n * @see https://support.google.com/google-ads/answer/13258081\n */\nexport const userProvidedDataSchema = object({\n  email: optional(union([emailValue, array(emailValue).check(minLength(1), maxLength(3))])),\n  phone_number: optional(union([phoneValue, array(phoneValue).check(minLength(1), maxLength(3))])),\n  address: optional(union([addressValue, array(addressValue).check(minLength(1), maxLength(2))])),\n});\n\nexport const updateVisitorSchema = object({\n  user_id: optional(uuid()),\n  user_data: optional(userProvidedDataSchema),\n  distinct_id: optional(string().check(trim(), minLength(1), maxLength(36))),\n  tags: tagsSchema,\n  properties: visitorPropertiesSchema,\n});\n\nexport const createFeedbackSchema = object({\n  name: string().check(minLength(1), maxLength(256)),\n  email: email().check(maxLength(320)),\n  message: string().check(minLength(1), maxLength(65536)),\n});\n\nconst noEmptyString = pipe(\n  string().check(maxLength(256)),\n  transform((v) => (v ? v : undefined))\n);\n\n/**\n * The schema for creating a link.\n * @see https://support.google.com/analytics/answer/10917952\n * */\nexport const createLinkSchema = object({\n  /** The URL that the user is redirected to. */\n  url: url().check(minLength(1), maxLength(1024)), // required\n\n  /**\n   * Campaign ID. Used to identify a specific campaign or promotion. This is a required key for GA4\n   * data import. Use the same IDs that you use when uploading campaign cost data.\n   */\n  utm_id: optional(noEmptyString),\n\n  /** Referrer, for example: google, newsletter4, billboard */\n  utm_source: string().check(minLength(1), maxLength(256)), // required\n\n  /** Marketing medium, for example: cpc, banner, email */\n  utm_medium: string().check(minLength(1), maxLength(256)), // required\n\n  /** Product, slogan, promo code, for example, spring_sale */\n  utm_campaign: string().check(minLength(1), maxLength(256)), // required\n\n  /** Paid keyword */\n  utm_term: optional(noEmptyString),\n\n  /**\n   * Use to differentiate creatives. For example, if you have two call-to-action links within the\n   * same email message, you can use utm_content and set different values for each so you can tell\n   * which version is more effective.\n   */\n  utm_content: optional(noEmptyString),\n\n  /**\n   * The platform responsible for directing traffic to a given Analytics property (such as a buying\n   * platform that sets budgets and targeting criteria or a platform that manages organic traffic\n   * data). For example, Search Ads 360 or Display & Video 360.\n   */\n  utm_source_platform: optional(noEmptyString),\n\n  /**\n   * Type of creative, for example, display, native, video, search, utm_creative_format is not\n   * currently reported in Google Analytics 4 properties.\n   */\n  utm_creative_format: optional(noEmptyString),\n\n  /**\n   * Targeting criteria applied to a campaign, for example, remarketing, prospecting,\n   * utm_marketing_tactic is not currently reported in Google Analytics 4 properties.\n   * */\n  utm_marketing_tactic: optional(noEmptyString),\n});\n\nexport type CreateTrackEventDTO = z.output<typeof createTrackEventSchema>;\nexport type CreateFeedbackDTO = z.output<typeof createFeedbackSchema>;\nexport type CreateLinkDTO = z.output<typeof createLinkSchema>;\nexport type CreateVisitorDTO = z.output<typeof createVisitorSchema>;\nexport type UserProvidedDataDTO = z.output<typeof userProvidedDataSchema>;\nexport type UpdateVisitorDTO = z.output<typeof updateVisitorSchema>;\n"],"mappings":";;AA6BA,MAAM,iBAAiB;AACvB,MAAM,mBAAmB;AACzB,MAAM,iBAAiB;;;;;;;AAQvB,MAAM,eAAe,KACnB,OAAO,GACP,WAAW,UAAU,MAAM,MAAM,GAAG,gBAAgB,CAAC,CACvD;;;;;;;;;;;AAYA,SAAS,eAAkB,MAA4C;CACrE,MAAM,SAA4B,CAAC;CACnC,KAAK,MAAM,CAAC,QAAQ,UAAU,OAAO,QAAQ,IAAI,GAAG;EAClD,MAAM,MAAM,OAAO,KAAK;EACxB,IAAI,CAAC,OAAO,IAAI,SAAS,gBAAgB;EACzC,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,UAAU,gBAAgB;EAClD,OAAO,OAAO;CAChB;CACA,OAAO;AACT;AAEA,MAAM,QAAQ,MACZ,KACE,OAAO,OAAO,GAAG,MAAM;CAAC;CAAc,OAAO;CAAG,QAAQ;CAAGA,OAAM;AAAC,CAAC,CAAC,GACpE,UAAU,cAAc,CAC1B,CACF;AAEA,MAAa,gBAAgB;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAa,mBAAmB,CAAC,eAAe,YAAY;AAE5D,MAAa,aAAa,OAAO;CAC/B,IAAI,SAAS,OAAO,CAAC;CACrB,SAAS,SAAS,OAAO,CAAC;CAC1B,YAAY,SAAS,OAAO,CAAC;CAC7B,SAAS,SAAS,OAAO,CAAC;CAC1B,cAAc,SAAS,OAAO,CAAC;CAC/B,iBAAiB,SAAS,OAAO,CAAC;CAClC,QAAQ,SAAS,OAAO,CAAC;CACzB,WAAW,SAAS,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,UAAU,EAAE,CAAC,CAAC;CACvE,aAAa,SAAS,OAAO,CAAC;CAC9B,eAAe,SAAS,OAAO,CAAC;CAChC,oBAAoB,SAAS,OAAO,CAAC;CACrC,cAAc,SAAS,OAAO,CAAC;CAC/B,eAAe,SAAS,OAAO,CAAC;CAChC,mBAAmB,SACjB,KACE,OAAO,CAAC,CAAC,MAAM,MAAM,WAAW,CAAC,GACjC,WAAW,MAAM,CAA0B,CAC7C,CACF;CACA,SAAS,SAAS,OAAO,CAAC;CAC1B,UAAU,SAAS,OAAO,CAAC;CAC3B,WAAW,SAAS,OAAO,CAAC;CAC5B,eAAe,SAAS,OAAO,CAAC;CAChC,eAAe,SAAS,OAAO,CAAC;CAChC,YAAY,SAAS,OAAO,CAAC;CAE7B,gBAAgB,SAAS,OAAO,CAAC;CACjC,kBAAkB,SAAS,OAAO,CAAC;CAEnC,KAAK,SAAS,OAAO,CAAC;CACtB,KAAK,SAAS,OAAO,CAAC;CACtB,QAAQ,SAAS,OAAO,CAAC;CACzB,OAAO,SAAS,OAAO,CAAC;CACxB,SAAS,SAAS,OAAO,CAAC;CAC1B,UAAU,SAAS,OAAO,CAAC;CAC3B,YAAY,SAAS,OAAO,CAAC;CAC7B,aAAa,SAAS,OAAO,CAAC;CAC9B,eAAe,SAAS,OAAO,CAAC;CAChC,WAAW,SAAS,OAAO,CAAC;CAC5B,kBAAkB,SAAS,OAAO,CAAC;CAEnC,OAAO,SAAS,OAAO,CAAC;CACxB,QAAQ,SAAS,OAAO,CAAC;CACzB,YAAY,SAAS,OAAO,CAAC;CAC7B,gBAAgB,SAAS,OAAO,CAAC;CAEjC,SAAS,SAAS,OAAO,CAAC;CAC1B,UAAU,SAAS,OAAO,CAAC;CAE3B,OAAO,SAAS,OAAO,CAAC;CACxB,aAAa,SAAS,OAAO,CAAC;CAC9B,WAAW,SAAS,OAAO,CAAC;CAC5B,SAAS,SAAS,OAAO,CAAC;CAC1B,OAAO,SAAS,OAAO,CAAC;CACxB,QAAQ,SAAS,OAAO,CAAC;CACzB,QAAQ,SAAS,OAAO,CAAC;CACzB,QAAQ,SAAS,OAAO,CAAC;CACzB,OAAO,SAAS,OAAO,CAAC;CAExB,YAAY,SAAS,OAAO,CAAC;CAC7B,YAAY,SAAS,OAAO,CAAC;CAC7B,cAAc,SAAS,OAAO,CAAC;CAC/B,UAAU,SAAS,OAAO,CAAC;CAC3B,aAAa,SAAS,OAAO,CAAC;CAC9B,QAAQ,SAAS,OAAO,CAAC;CACzB,qBAAqB,SAAS,OAAO,CAAC;CACtC,qBAAqB,SAAS,OAAO,CAAC;CACtC,sBAAsB,SAAS,OAAO,CAAC;AACzC,CAAC;AAED,MAAa,mBAAmB,SAC9B,KACE,OAAO,OAAO,GAAG,MAAM;CAAC;CAAc,OAAO;CAAG,QAAQ;CAAGA,OAAM;CAAG;AAAK,CAAC,CAAC,GAC3E,UAAU,cAAc,CAC1B,CACF;;AAGA,MAAM,0BAA0B,SAC9B,KACE,OAAO,OAAO,GAAG,MAAM;CAAC;CAAc,OAAO;CAAG,QAAQ;CAAGA,OAAM;AAAC,CAAC,CAAC,GACpE,UAAU,cAAc,CAC1B,CACF;AAEA,MAAa,yBAAyB,MACpC,OAAO;CACL,MAAM,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,UAAU,EAAE,CAAC;CACxD,YAAY,KAAK;CACjB,YAAY,KAAK;CACjB,UAAUC,OAAM,aAAa;CAC7B,aAAaA,OAAM,gBAAgB;CACnC,WAAW,IAAI,SAAS;CACxB,MAAM;CACN,YAAY;AACd,CAAC,CACH,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC;AAEpC,MAAa,sBAAsB,OAAO;CACxC,WAAW,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,UAAU,EAAE,CAAC;CAC7D,UAAUA,OAAM,aAAa;CAC7B,aAAaA,OAAM,gBAAgB;CACnC,MAAM;CACN,YAAY;AACd,CAAC;AAED,MAAM,aAAa,KAAK,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,YAAY,GAAG,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC;;AAGtF,MAAM,aAAa,KAAK,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,KAAK,CAAC;AAEtD,MAAM,eAAe,OAAO;CAC1B,YAAY,SAAS,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,UAAU,GAAG,CAAC,CAAC;CAC3D,WAAW,SAAS,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,UAAU,GAAG,CAAC,CAAC;CAC1D,QAAQ,SAAS,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,UAAU,GAAG,CAAC,CAAC;CACvD,MAAM,SAAS,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,UAAU,GAAG,CAAC,CAAC;;CAErD,QAAQ,SAAS,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,UAAU,GAAG,CAAC,CAAC;CACvD,aAAa,SAAS,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,CAAC;;CAE3D,SAAS,SAAS,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,YAAY,GAAG,MAAM,YAAY,CAAC,CAAC;AAC9E,CAAC;;;;;;;;;;;AAYD,MAAa,yBAAyB,OAAO;CAC3C,OAAO,SAAS,MAAM,CAAC,YAAY,MAAM,UAAU,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;CACxF,cAAc,SAAS,MAAM,CAAC,YAAY,MAAM,UAAU,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/F,SAAS,SAAS,MAAM,CAAC,cAAc,MAAM,YAAY,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,MAAa,sBAAsB,OAAO;CACxC,SAAS,SAAS,KAAK,CAAC;CACxB,WAAW,SAAS,sBAAsB;CAC1C,aAAa,SAAS,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,UAAU,EAAE,CAAC,CAAC;CACzE,MAAM;CACN,YAAY;AACd,CAAC;AAED,MAAa,uBAAuB,OAAO;CACzC,MAAM,OAAO,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC;CACjD,OAAO,MAAM,CAAC,CAAC,MAAM,UAAU,GAAG,CAAC;CACnC,SAAS,OAAO,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,UAAU,KAAK,CAAC;AACxD,CAAC;AAED,MAAM,gBAAgB,KACpB,OAAO,CAAC,CAAC,MAAM,UAAU,GAAG,CAAC,GAC7B,WAAW,MAAO,IAAI,IAAI,KAAA,CAAU,CACtC;;;;;AAMA,MAAa,mBAAmB,OAAO;;CAErC,KAAK,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,UAAU,IAAI,CAAC;;;;;CAM9C,QAAQ,SAAS,aAAa;;CAG9B,YAAY,OAAO,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC;;CAGvD,YAAY,OAAO,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC;;CAGvD,cAAc,OAAO,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC;;CAGzD,UAAU,SAAS,aAAa;;;;;;CAOhC,aAAa,SAAS,aAAa;;;;;;CAOnC,qBAAqB,SAAS,aAAa;;;;;CAM3C,qBAAqB,SAAS,aAAa;;;;;CAM3C,sBAAsB,SAAS,aAAa;AAC9C,CAAC"}
+{"version":3,"file":"index.mjs","names":["_null","_enum"],"sources":["../../src/schema/index.ts"],"sourcesContent":["import {\n  enum as _enum,\n  null as _null,\n  array,\n  boolean,\n  e164,\n  email,\n  iso,\n  maxLength,\n  minLength,\n  number,\n  object,\n  optional,\n  pipe,\n  record,\n  regex,\n  string,\n  toLowerCase,\n  toUpperCase,\n  transform,\n  trim,\n  union,\n  url,\n  uuid,\n  type z,\n} from 'zod/mini';\nimport type { Environment, Platform } from '../track/types';\n\nconst MAX_KEY_LENGTH = 128;\nconst MAX_VALUE_LENGTH = 512;\nconst MAX_PROPERTIES = 64;\n\n/**\n * Truncated rather than rejected. These schemas validate a whole batch at once, so refusing one\n * oversized value costs every event that traveled with it — and the values that overrun are the\n * ones derived from the page (a link's text, a URL carrying a long query), which no client can\n * bound in advance. A shortened value is worth more than a lost batch.\n */\nconst propertyText = pipe(\n  string(),\n  transform((value) => value.slice(0, MAX_VALUE_LENGTH))\n);\n\n/**\n * Keys are written by hand in instrumentation code, so an unusable one is a mistake in the host\n * rather than something the visitor typed. It is still dropped rather than rejected, for the same\n * reason: the mistake should cost that property, not the batch it happens to be in. Truncating a\n * key is not an option — two long keys would silently become one field.\n *\n * The key schema below is deliberately permissive so that this transform is reached at all; the\n * trimming it used to do happens here instead. `MAX_PROPERTIES` keeps the first N in insertion\n * order.\n */\nfunction takeProperties<T>(data: Record<string, T>): Record<string, T> {\n  const result: Record<string, T> = {};\n  let count = 0;\n  for (const [rawKey, value] of Object.entries(data)) {\n    if (count >= MAX_PROPERTIES) break;\n    const key = rawKey.trim();\n    if (!key || key.length > MAX_KEY_LENGTH) continue;\n    result[key] = value;\n    count++;\n  }\n  return result;\n}\n\nconst items = array(\n  pipe(\n    record(string(), union([propertyText, number(), boolean(), _null()])),\n    transform(takeProperties)\n  )\n);\n\nexport const ALL_PLATFORMS = [\n  'ios',\n  'android',\n  'web',\n  'macos',\n  'windows',\n  'linux',\n  'unknown',\n] as const satisfies Platform[];\n\nexport const ALL_ENVIRONMENTS = ['development', 'production'] as const satisfies Environment[];\n\nexport const tagsSchema = object({\n  os: optional(string()),\n  os_name: optional(string()),\n  os_version: optional(string()),\n  browser: optional(string()),\n  browser_name: optional(string()),\n  browser_version: optional(string()),\n  device: optional(string()),\n  device_id: optional(string().check(trim(), minLength(1), maxLength(36))),\n  device_type: optional(string()),\n  device_vendor: optional(string()),\n  device_pixel_ratio: optional(number()),\n  screen_width: optional(number()),\n  screen_height: optional(number()),\n  screen_resolution: optional(\n    pipe(\n      string().check(regex(/^\\d+x\\d+$/)),\n      transform((v) => v as `${number}x${number}`)\n    )\n  ),\n  release: optional(string()),\n  language: optional(string()),\n  time_zone: optional(string()),\n  page_location: optional(string()),\n  page_referrer: optional(string()),\n  page_title: optional(string()),\n  // app info\n  advertising_id: optional(string()),\n  install_referrer: optional(string()),\n  // Meta Ads\n  fbc: optional(string()),\n  fbp: optional(string()),\n  fbclid: optional(string()),\n  ad_id: optional(string()),\n  ad_name: optional(string()),\n  adset_id: optional(string()),\n  adset_name: optional(string()),\n  campaign_id: optional(string()),\n  campaign_name: optional(string()),\n  placement: optional(string()),\n  site_source_name: optional(string()),\n  // Google Ads\n  gclid: optional(string()),\n  gclsrc: optional(string()),\n  gad_source: optional(string()),\n  gad_campaignid: optional(string()),\n  // Reddit ads\n  rdt_cid: optional(string()),\n  rdt_uuid: optional(string()),\n  // click ids\n  dclid: optional(string()),\n  ko_click_id: optional(string()),\n  li_fat_id: optional(string()),\n  msclkid: optional(string()),\n  sccid: optional(string()),\n  ttclid: optional(string()),\n  twclid: optional(string()),\n  wbraid: optional(string()),\n  yclid: optional(string()),\n  // utm params\n  utm_source: optional(string()),\n  utm_medium: optional(string()),\n  utm_campaign: optional(string()),\n  utm_term: optional(string()),\n  utm_content: optional(string()),\n  utm_id: optional(string()),\n  utm_source_platform: optional(string()),\n  utm_creative_format: optional(string()),\n  utm_marketing_tactic: optional(string()),\n});\n\nexport const propertiesSchema = optional(\n  pipe(\n    record(string(), union([propertyText, number(), boolean(), _null(), items])),\n    transform(takeProperties)\n  )\n);\n\n/** Visitor properties differ from event properties only in taking no nested item lists. */\nconst visitorPropertiesSchema = optional(\n  pipe(\n    record(string(), union([propertyText, number(), boolean(), _null()])),\n    transform(takeProperties)\n  )\n);\n\nexport const createTrackEventSchema = array(\n  object({\n    name: string().check(trim(), minLength(1), maxLength(64)),\n    visitor_id: uuid(),\n    session_id: uuid(),\n    platform: _enum(ALL_PLATFORMS),\n    environment: _enum(ALL_ENVIRONMENTS),\n    timestamp: iso.datetime(),\n    tags: tagsSchema,\n    properties: propertiesSchema,\n  })\n).check(minLength(1), maxLength(100));\n\nexport const createVisitorSchema = object({\n  device_id: string().check(trim(), minLength(1), maxLength(36)),\n  platform: _enum(ALL_PLATFORMS),\n  environment: _enum(ALL_ENVIRONMENTS),\n  tags: tagsSchema,\n  properties: visitorPropertiesSchema,\n});\n\nconst emailValue = pipe(string().check(trim(), toLowerCase(), maxLength(320)), email());\n\n/** E.164: a plus sign (+) prefix, country code, then digits only, no dashes/parens/spaces. */\nconst phoneValue = pipe(string().check(trim()), e164());\n\nconst addressValue = object({\n  first_name: optional(string().check(trim(), maxLength(128))),\n  last_name: optional(string().check(trim(), maxLength(128))),\n  street: optional(string().check(trim(), maxLength(256))),\n  city: optional(string().check(trim(), maxLength(128))),\n  /** User province, state, or region. Example: `Hampshire` */\n  region: optional(string().check(trim(), maxLength(128))),\n  postal_code: optional(string().check(trim(), maxLength(32))),\n  /** 2-letter country code, per the ISO 3166-1 alpha-2 standard. Example: `UK` */\n  country: optional(string().check(trim(), toUpperCase(), regex(/^[A-Z]{2}$/))),\n});\n\n/**\n * User-provided data (UPD) used for enhanced conversions, Customer Match, and demographics.\n * Values are sent unhashed; Google normalizes and hashes them before they reach its servers.\n *\n * Multiple values may be sent to increase the match rate: up to 3 emails, 3 phone numbers, and\n * 2 addresses.\n *\n * @see https://support.google.com/analytics/answer/14078702\n * @see https://support.google.com/google-ads/answer/13258081\n */\nexport const userProvidedDataSchema = object({\n  email: optional(union([emailValue, array(emailValue).check(minLength(1), maxLength(3))])),\n  phone_number: optional(union([phoneValue, array(phoneValue).check(minLength(1), maxLength(3))])),\n  address: optional(union([addressValue, array(addressValue).check(minLength(1), maxLength(2))])),\n});\n\nexport const updateVisitorSchema = object({\n  user_id: optional(uuid()),\n  user_data: optional(userProvidedDataSchema),\n  distinct_id: optional(string().check(trim(), minLength(1), maxLength(36))),\n  tags: tagsSchema,\n  properties: visitorPropertiesSchema,\n});\n\nexport const createFeedbackSchema = object({\n  name: string().check(minLength(1), maxLength(256)),\n  email: email().check(maxLength(320)),\n  message: string().check(minLength(1), maxLength(65536)),\n});\n\nconst noEmptyString = pipe(\n  string().check(maxLength(256)),\n  transform((v) => (v ? v : undefined))\n);\n\n/**\n * The schema for creating a link.\n * @see https://support.google.com/analytics/answer/10917952\n * */\nexport const createLinkSchema = object({\n  /** The URL that the user is redirected to. */\n  url: url().check(minLength(1), maxLength(1024)), // required\n\n  /**\n   * Campaign ID. Used to identify a specific campaign or promotion. This is a required key for GA4\n   * data import. Use the same IDs that you use when uploading campaign cost data.\n   */\n  utm_id: optional(noEmptyString),\n\n  /** Referrer, for example: google, newsletter4, billboard */\n  utm_source: string().check(minLength(1), maxLength(256)), // required\n\n  /** Marketing medium, for example: cpc, banner, email */\n  utm_medium: string().check(minLength(1), maxLength(256)), // required\n\n  /** Product, slogan, promo code, for example, spring_sale */\n  utm_campaign: string().check(minLength(1), maxLength(256)), // required\n\n  /** Paid keyword */\n  utm_term: optional(noEmptyString),\n\n  /**\n   * Use to differentiate creatives. For example, if you have two call-to-action links within the\n   * same email message, you can use utm_content and set different values for each so you can tell\n   * which version is more effective.\n   */\n  utm_content: optional(noEmptyString),\n\n  /**\n   * The platform responsible for directing traffic to a given Analytics property (such as a buying\n   * platform that sets budgets and targeting criteria or a platform that manages organic traffic\n   * data). For example, Search Ads 360 or Display & Video 360.\n   */\n  utm_source_platform: optional(noEmptyString),\n\n  /**\n   * Type of creative, for example, display, native, video, search, utm_creative_format is not\n   * currently reported in Google Analytics 4 properties.\n   */\n  utm_creative_format: optional(noEmptyString),\n\n  /**\n   * Targeting criteria applied to a campaign, for example, remarketing, prospecting,\n   * utm_marketing_tactic is not currently reported in Google Analytics 4 properties.\n   * */\n  utm_marketing_tactic: optional(noEmptyString),\n});\n\nexport type CreateTrackEventDTO = z.output<typeof createTrackEventSchema>;\nexport type CreateFeedbackDTO = z.output<typeof createFeedbackSchema>;\nexport type CreateLinkDTO = z.output<typeof createLinkSchema>;\nexport type CreateVisitorDTO = z.output<typeof createVisitorSchema>;\nexport type UserProvidedDataDTO = z.output<typeof userProvidedDataSchema>;\nexport type UpdateVisitorDTO = z.output<typeof updateVisitorSchema>;\n"],"mappings":";;AA4BA,MAAM,iBAAiB;AACvB,MAAM,mBAAmB;AACzB,MAAM,iBAAiB;;;;;;;AAQvB,MAAM,eAAe,KACnB,OAAO,GACP,WAAW,UAAU,MAAM,MAAM,GAAG,gBAAgB,CAAC,CACvD;;;;;;;;;;;AAYA,SAAS,eAAkB,MAA4C;CACrE,MAAM,SAA4B,CAAC;CACnC,IAAI,QAAQ;CACZ,KAAK,MAAM,CAAC,QAAQ,UAAU,OAAO,QAAQ,IAAI,GAAG;EAClD,IAAI,SAAS,gBAAgB;EAC7B,MAAM,MAAM,OAAO,KAAK;EACxB,IAAI,CAAC,OAAO,IAAI,SAAS,gBAAgB;EACzC,OAAO,OAAO;EACd;CACF;CACA,OAAO;AACT;AAEA,MAAM,QAAQ,MACZ,KACE,OAAO,OAAO,GAAG,MAAM;CAAC;CAAc,OAAO;CAAG,QAAQ;CAAGA,OAAM;AAAC,CAAC,CAAC,GACpE,UAAU,cAAc,CAC1B,CACF;AAEA,MAAa,gBAAgB;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAa,mBAAmB,CAAC,eAAe,YAAY;AAE5D,MAAa,aAAa,OAAO;CAC/B,IAAI,SAAS,OAAO,CAAC;CACrB,SAAS,SAAS,OAAO,CAAC;CAC1B,YAAY,SAAS,OAAO,CAAC;CAC7B,SAAS,SAAS,OAAO,CAAC;CAC1B,cAAc,SAAS,OAAO,CAAC;CAC/B,iBAAiB,SAAS,OAAO,CAAC;CAClC,QAAQ,SAAS,OAAO,CAAC;CACzB,WAAW,SAAS,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,UAAU,EAAE,CAAC,CAAC;CACvE,aAAa,SAAS,OAAO,CAAC;CAC9B,eAAe,SAAS,OAAO,CAAC;CAChC,oBAAoB,SAAS,OAAO,CAAC;CACrC,cAAc,SAAS,OAAO,CAAC;CAC/B,eAAe,SAAS,OAAO,CAAC;CAChC,mBAAmB,SACjB,KACE,OAAO,CAAC,CAAC,MAAM,MAAM,WAAW,CAAC,GACjC,WAAW,MAAM,CAA0B,CAC7C,CACF;CACA,SAAS,SAAS,OAAO,CAAC;CAC1B,UAAU,SAAS,OAAO,CAAC;CAC3B,WAAW,SAAS,OAAO,CAAC;CAC5B,eAAe,SAAS,OAAO,CAAC;CAChC,eAAe,SAAS,OAAO,CAAC;CAChC,YAAY,SAAS,OAAO,CAAC;CAE7B,gBAAgB,SAAS,OAAO,CAAC;CACjC,kBAAkB,SAAS,OAAO,CAAC;CAEnC,KAAK,SAAS,OAAO,CAAC;CACtB,KAAK,SAAS,OAAO,CAAC;CACtB,QAAQ,SAAS,OAAO,CAAC;CACzB,OAAO,SAAS,OAAO,CAAC;CACxB,SAAS,SAAS,OAAO,CAAC;CAC1B,UAAU,SAAS,OAAO,CAAC;CAC3B,YAAY,SAAS,OAAO,CAAC;CAC7B,aAAa,SAAS,OAAO,CAAC;CAC9B,eAAe,SAAS,OAAO,CAAC;CAChC,WAAW,SAAS,OAAO,CAAC;CAC5B,kBAAkB,SAAS,OAAO,CAAC;CAEnC,OAAO,SAAS,OAAO,CAAC;CACxB,QAAQ,SAAS,OAAO,CAAC;CACzB,YAAY,SAAS,OAAO,CAAC;CAC7B,gBAAgB,SAAS,OAAO,CAAC;CAEjC,SAAS,SAAS,OAAO,CAAC;CAC1B,UAAU,SAAS,OAAO,CAAC;CAE3B,OAAO,SAAS,OAAO,CAAC;CACxB,aAAa,SAAS,OAAO,CAAC;CAC9B,WAAW,SAAS,OAAO,CAAC;CAC5B,SAAS,SAAS,OAAO,CAAC;CAC1B,OAAO,SAAS,OAAO,CAAC;CACxB,QAAQ,SAAS,OAAO,CAAC;CACzB,QAAQ,SAAS,OAAO,CAAC;CACzB,QAAQ,SAAS,OAAO,CAAC;CACzB,OAAO,SAAS,OAAO,CAAC;CAExB,YAAY,SAAS,OAAO,CAAC;CAC7B,YAAY,SAAS,OAAO,CAAC;CAC7B,cAAc,SAAS,OAAO,CAAC;CAC/B,UAAU,SAAS,OAAO,CAAC;CAC3B,aAAa,SAAS,OAAO,CAAC;CAC9B,QAAQ,SAAS,OAAO,CAAC;CACzB,qBAAqB,SAAS,OAAO,CAAC;CACtC,qBAAqB,SAAS,OAAO,CAAC;CACtC,sBAAsB,SAAS,OAAO,CAAC;AACzC,CAAC;AAED,MAAa,mBAAmB,SAC9B,KACE,OAAO,OAAO,GAAG,MAAM;CAAC;CAAc,OAAO;CAAG,QAAQ;CAAGA,OAAM;CAAG;AAAK,CAAC,CAAC,GAC3E,UAAU,cAAc,CAC1B,CACF;;AAGA,MAAM,0BAA0B,SAC9B,KACE,OAAO,OAAO,GAAG,MAAM;CAAC;CAAc,OAAO;CAAG,QAAQ;CAAGA,OAAM;AAAC,CAAC,CAAC,GACpE,UAAU,cAAc,CAC1B,CACF;AAEA,MAAa,yBAAyB,MACpC,OAAO;CACL,MAAM,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,UAAU,EAAE,CAAC;CACxD,YAAY,KAAK;CACjB,YAAY,KAAK;CACjB,UAAUC,OAAM,aAAa;CAC7B,aAAaA,OAAM,gBAAgB;CACnC,WAAW,IAAI,SAAS;CACxB,MAAM;CACN,YAAY;AACd,CAAC,CACH,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC;AAEpC,MAAa,sBAAsB,OAAO;CACxC,WAAW,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,UAAU,EAAE,CAAC;CAC7D,UAAUA,OAAM,aAAa;CAC7B,aAAaA,OAAM,gBAAgB;CACnC,MAAM;CACN,YAAY;AACd,CAAC;AAED,MAAM,aAAa,KAAK,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,YAAY,GAAG,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC;;AAGtF,MAAM,aAAa,KAAK,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,KAAK,CAAC;AAEtD,MAAM,eAAe,OAAO;CAC1B,YAAY,SAAS,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,UAAU,GAAG,CAAC,CAAC;CAC3D,WAAW,SAAS,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,UAAU,GAAG,CAAC,CAAC;CAC1D,QAAQ,SAAS,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,UAAU,GAAG,CAAC,CAAC;CACvD,MAAM,SAAS,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,UAAU,GAAG,CAAC,CAAC;;CAErD,QAAQ,SAAS,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,UAAU,GAAG,CAAC,CAAC;CACvD,aAAa,SAAS,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,CAAC;;CAE3D,SAAS,SAAS,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,YAAY,GAAG,MAAM,YAAY,CAAC,CAAC;AAC9E,CAAC;;;;;;;;;;;AAYD,MAAa,yBAAyB,OAAO;CAC3C,OAAO,SAAS,MAAM,CAAC,YAAY,MAAM,UAAU,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;CACxF,cAAc,SAAS,MAAM,CAAC,YAAY,MAAM,UAAU,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/F,SAAS,SAAS,MAAM,CAAC,cAAc,MAAM,YAAY,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,MAAa,sBAAsB,OAAO;CACxC,SAAS,SAAS,KAAK,CAAC;CACxB,WAAW,SAAS,sBAAsB;CAC1C,aAAa,SAAS,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,UAAU,EAAE,CAAC,CAAC;CACzE,MAAM;CACN,YAAY;AACd,CAAC;AAED,MAAa,uBAAuB,OAAO;CACzC,MAAM,OAAO,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC;CACjD,OAAO,MAAM,CAAC,CAAC,MAAM,UAAU,GAAG,CAAC;CACnC,SAAS,OAAO,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,UAAU,KAAK,CAAC;AACxD,CAAC;AAED,MAAM,gBAAgB,KACpB,OAAO,CAAC,CAAC,MAAM,UAAU,GAAG,CAAC,GAC7B,WAAW,MAAO,IAAI,IAAI,KAAA,CAAU,CACtC;;;;;AAMA,MAAa,mBAAmB,OAAO;;CAErC,KAAK,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,UAAU,IAAI,CAAC;;;;;CAM9C,QAAQ,SAAS,aAAa;;CAG9B,YAAY,OAAO,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC;;CAGvD,YAAY,OAAO,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC;;CAGvD,cAAc,OAAO,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC;;CAGzD,UAAU,SAAS,aAAa;;;;;;CAOhC,aAAa,SAAS,aAAa;;;;;;CAOnC,qBAAqB,SAAS,aAAa;;;;;CAM3C,qBAAqB,SAAS,aAAa;;;;;CAM3C,sBAAsB,SAAS,aAAa;AAC9C,CAAC"}

package/dist/setup/session.cjs

@@ -1,24 +1,76 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_setup_index = require("./index.cjs");
+const require_constants_storage = require("../constants/storage.cjs");
 let uuid = require("uuid");
 //#region src/setup/session.ts
 const SESSION_TIMEOUT = 1800 * 1e3;
+/**
+* `<version>.<id>.<lastEventTime>`, compact and cookie-safe rather than JSON: `{`, `"`
+* and `,` all have to be percent-encoded in a cookie, and a host that wants one session across
+* its subdomains will hand `setupAnalytics` a cookie-backed `storage`, where this has to survive
+* unchanged. A uuidv7 contains no dots, so the record splits cleanly.
+*
+* The version guards a change the parser could not otherwise survive. A field appended to the end
+* does not need one — a short record simply leaves it undefined.
+*/
+const VERSION = "1";
+function readSession() {
+	const raw = require_setup_index.config.storage.getItem(require_constants_storage.keys.session);
+	if (!raw) return void 0;
+	const [version, id, lastEventTime] = raw.split(".");
+	if (version !== VERSION || !id) return void 0;
+	const parsed = {
+		id,
+		lastEventTime: Number(lastEventTime)
+	};
+	if (!Number.isFinite(parsed.lastEventTime)) return void 0;
+	return parsed;
+}
+function writeSession({ id, lastEventTime }) {
+	require_setup_index.config.storage.setItem(require_constants_storage.keys.session, `${VERSION}.${id}.${lastEventTime}`);
+}
 var Session = class {
 	constructor() {
-		this.getId = () => this.id;
+		this.touch = (eventTime, lastEventTime = eventTime) => {
+			const stored = readSession();
+			if (stored && eventTime - stored.lastEventTime <= 18e5) {
+				writeSession({
+					...stored,
+					lastEventTime: Math.max(stored.lastEventTime, lastEventTime)
+				});
+				return {
+					id: stored.id,
+					started: false
+				};
+			}
+			this.accumulatedTime = 0;
+			this.startTime = Date.now();
+			const session = {
+				id: (0, uuid.v7)(),
+				lastEventTime
+			};
+			writeSession(session);
+			return {
+				id: session.id,
+				started: true
+			};
+		};
+		this.extend = () => {
+			const stored = readSession();
+			if (!stored) return this.touch(Date.now()).id;
+			const now = Date.now();
+			if (now - stored.lastEventTime <= 18e5) writeSession({
+				...stored,
+				lastEventTime: now
+			});
+			return stored.id;
+		};
 		this.isActive = () => this.active;
 		this.isVisible = () => this.visible;
 		this.isFocused = () => this.focused;
-		this.isExpired = () => Date.now() - this.lastActiveTime > SESSION_TIMEOUT;
-		this.updateLastActiveTime = () => {
-			this.lastActiveTime = Date.now();
-		};
 		this.updateActive = (active) => {
 			this.active = active;
 		};
-		this.refresh = () => {
-			this.id = (0, uuid.v7)();
-			this.lastActiveTime = Date.now();
-		};
 		this.updateAccumulator = () => {
 			const now = Date.now();
 			if (this.focused && this.visible && this.active) {
@@ -29,7 +81,6 @@ var Session = class {
 		};
 		this.focus = () => {
 			this.updateAccumulator();
-			this.updateLastActiveTime();
 			this.focused = true;
 		};
 		this.blur = () => {
@@ -38,7 +89,6 @@ var Session = class {
 		};
 		this.pageshow = () => {
 			this.updateAccumulator();
-			this.updateLastActiveTime();
 			this.active = true;
 		};
 		this.pagehide = () => {
@@ -47,7 +97,6 @@ var Session = class {
 		};
 		this.visibilitychange = (state) => {
 			this.updateAccumulator();
-			if (state === "visible") this.updateLastActiveTime();
 			this.visible = state === "visible";
 		};
 		this.flush = () => {
@@ -56,9 +105,7 @@ var Session = class {
 			this.accumulatedTime = 0;
 			return engagementTime;
 		};
-		this.id = (0, uuid.v7)();
 		this.startTime = Date.now();
-		this.lastActiveTime = Date.now();
 		this.accumulatedTime = 0;
 		this.active = true;
 		this.visible = typeof document !== "undefined" ? document.visibilityState === "visible" : true;

package/dist/setup/session.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"session.cjs","names":[],"sources":["../../src/setup/session.ts"],"sourcesContent":["import { v7 as uuidv7 } from 'uuid';\n\nexport const SESSION_TIMEOUT = 30 * 60 * 1000;\n\nclass Session {\n  private id: string;\n  private startTime: number;\n  private lastActiveTime: number;\n  private accumulatedTime: number;\n\n  private active: boolean;\n  private visible: boolean;\n  private focused: boolean;\n\n  constructor() {\n    this.id = uuidv7();\n    this.startTime = Date.now();\n    this.lastActiveTime = Date.now();\n    this.accumulatedTime = 0;\n\n    this.active = true;\n    this.visible = typeof document !== 'undefined' ? document.visibilityState === 'visible' : true;\n    this.focused = typeof document !== 'undefined' ? document.hasFocus() : true;\n  }\n\n  getId = () => this.id;\n\n  isActive = () => this.active;\n  isVisible = () => this.visible;\n  isFocused = () => this.focused;\n  isExpired = () => Date.now() - this.lastActiveTime > SESSION_TIMEOUT;\n\n  updateLastActiveTime = () => {\n    this.lastActiveTime = Date.now();\n  };\n\n  updateActive = (active: boolean) => {\n    this.active = active;\n  };\n\n  refresh = () => {\n    this.id = uuidv7();\n    this.lastActiveTime = Date.now();\n  };\n\n  updateAccumulator = () => {\n    const now = Date.now();\n    if (this.focused && this.visible && this.active) {\n      const delta = now - this.startTime;\n      if (delta > 0 && delta < SESSION_TIMEOUT) {\n        this.accumulatedTime += delta;\n      }\n    }\n    this.startTime = now;\n  };\n\n  focus = () => {\n    this.updateAccumulator();\n    this.updateLastActiveTime();\n    this.focused = true;\n  };\n\n  blur = () => {\n    this.updateAccumulator();\n    this.focused = false;\n  };\n\n  pageshow = () => {\n    this.updateAccumulator();\n    this.updateLastActiveTime();\n    this.active = true;\n  };\n\n  pagehide = () => {\n    this.updateAccumulator();\n    this.active = false;\n  };\n\n  visibilitychange = (state: DocumentVisibilityState) => {\n    this.updateAccumulator();\n    if (state === 'visible') {\n      this.updateLastActiveTime();\n    }\n    this.visible = state === 'visible';\n  };\n\n  flush = () => {\n    this.updateAccumulator();\n    const engagementTime = this.accumulatedTime;\n    this.accumulatedTime = 0;\n    return engagementTime;\n  };\n}\n\nlet session: Session | undefined;\n\n/**\n * The session, built the first time something asks for it.\n *\n * Deliberately not a module-scope `new Session()`. The constructor calls\n * `uuidv7()`, `uuid` draws its bytes from `crypto.getRandomValues`, and\n * Cloudflare Workers reject that outside a request handler:\n *\n *   Disallowed operation called within global scope. Asynchronous I/O\n *   (ex: fetch() or connect()), setting a timeout, and generating random\n *   values are not allowed within global scope.\n *\n * Module scope in a Worker is evaluated once when the isolate boots and is\n * then shared by every request that isolate serves, so a random value drawn\n * there would be the same for all of them — which is why the runtime refuses\n * to produce one. A host that server-renders on Workers reaches this module\n * through `track()` on the server as well, and the throw happened as the\n * isolate booted, taking down every route before a component rendered.\n *\n * Everything here is per-visitor browser or app state, so deferring the\n * construction costs nothing and buys two things: the server bundle can be\n * evaluated, and `startTime` marks when the session actually began rather\n * than when the isolate happened to start.\n */\nexport function getSession() {\n  return (session ??= new Session());\n}\n"],"mappings":";;;AAEA,MAAa,kBAAkB,OAAU;AAEzC,IAAM,UAAN,MAAc;CAUZ,cAAc;EAWA,KAAA,cAAA,KAAK;EAEF,KAAA,iBAAA,KAAK;EACJ,KAAA,kBAAA,KAAK;EACL,KAAA,kBAAA,KAAK;EACL,KAAA,kBAAA,KAAK,IAAI,IAAI,KAAK,iBAAiB;EAExB,KAAA,6BAAA;GAC3B,KAAK,iBAAiB,KAAK,IAAI;EACjC;EAEgB,KAAA,gBAAA,WAAoB;GAClC,KAAK,SAAS;EAChB;EAEgB,KAAA,gBAAA;GACd,KAAK,MAAA,GAAA,KAAA,GAAA,CAAY;GACjB,KAAK,iBAAiB,KAAK,IAAI;EACjC;EAE0B,KAAA,0BAAA;GACxB,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,KAAK,WAAW,KAAK,WAAW,KAAK,QAAQ;IAC/C,MAAM,QAAQ,MAAM,KAAK;IACzB,IAAI,QAAQ,KAAK,QAAA,MACf,KAAK,mBAAmB;GAE5B;GACA,KAAK,YAAY;EACnB;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,KAAK,qBAAqB;GAC1B,KAAK,UAAU;EACjB;EAEa,KAAA,aAAA;GACX,KAAK,kBAAkB;GACvB,KAAK,UAAU;EACjB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,qBAAqB;GAC1B,KAAK,SAAS;EAChB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,SAAS;EAChB;EAEoB,KAAA,oBAAA,UAAmC;GACrD,KAAK,kBAAkB;GACvB,IAAI,UAAU,WACZ,KAAK,qBAAqB;GAE5B,KAAK,UAAU,UAAU;EAC3B;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,MAAM,iBAAiB,KAAK;GAC5B,KAAK,kBAAkB;GACvB,OAAO;EACT;EA5EE,KAAK,MAAA,GAAA,KAAA,GAAA,CAAY;EACjB,KAAK,YAAY,KAAK,IAAI;EAC1B,KAAK,iBAAiB,KAAK,IAAI;EAC/B,KAAK,kBAAkB;EAEvB,KAAK,SAAS;EACd,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,oBAAoB,YAAY;EAC1F,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,SAAS,IAAI;CACzE;AAqEF;AAEA,IAAI;;;;;;;;;;;;;;;;;;;;;;;;AAyBJ,SAAgB,aAAa;CAC3B,OAAQ,YAAY,IAAI,QAAQ;AAClC"}
+{"version":3,"file":"session.cjs","names":["config","keys"],"sources":["../../src/setup/session.ts"],"sourcesContent":["import { v7 as uuidv7 } from 'uuid';\nimport { keys } from '../constants/storage';\nimport { config } from './index';\n\nexport const SESSION_TIMEOUT = 30 * 60 * 1000;\n\n/**\n * The part of a session that outlives the page: its identity, and the clock the timeout is\n * measured against. GA4 keeps these in its `_ga_<container>` cookie — alongside the engaged flag,\n * which arrives with `session_engaged` later — and rereads them for every event, which is what\n * makes a session survive a reload, span a whole multipage visit, and stay shared between two\n * tabs of the same site. Holding them in memory instead, as this did, starts a new session on\n * every full navigation and gives every tab one of its own.\n */\ninterface StoredSession {\n  id: string;\n  /** When the last event was sent. The timeout is measured from here, and only from here. */\n  lastEventTime: number;\n}\n\n/** The session an event belongs to, and whether that event is the one that started it. */\ninterface SessionForEvent {\n  id: string;\n  started: boolean;\n}\n\n/**\n * `<version>.<id>.<lastEventTime>`, compact and cookie-safe rather than JSON: `{`, `\"`\n * and `,` all have to be percent-encoded in a cookie, and a host that wants one session across\n * its subdomains will hand `setupAnalytics` a cookie-backed `storage`, where this has to survive\n * unchanged. A uuidv7 contains no dots, so the record splits cleanly.\n *\n * The version guards a change the parser could not otherwise survive. A field appended to the end\n * does not need one — a short record simply leaves it undefined.\n */\nconst VERSION = '1';\n\nfunction readSession(): StoredSession | undefined {\n  const raw = config.storage.getItem(keys.session);\n  if (!raw) return undefined;\n\n  const [version, id, lastEventTime] = raw.split('.');\n  if (version !== VERSION || !id) return undefined;\n\n  const parsed = { id, lastEventTime: Number(lastEventTime) };\n  if (!Number.isFinite(parsed.lastEventTime)) return undefined;\n  return parsed;\n}\n\nfunction writeSession({ id, lastEventTime }: StoredSession) {\n  config.storage.setItem(keys.session, `${VERSION}.${id}.${lastEventTime}`);\n}\n\nclass Session {\n  /**\n   * Engagement is deliberately not stored: it is the time this page has accrued and not yet\n   * reported, so it belongs to the page, not to the session. GA4 draws the same line — its cookie\n   * carries the session, while the engagement timer lives and dies with the document.\n   */\n  private startTime: number;\n  private accumulatedTime: number;\n\n  private active: boolean;\n  private visible: boolean;\n  private focused: boolean;\n\n  constructor() {\n    this.startTime = Date.now();\n    this.accumulatedTime = 0;\n\n    this.active = true;\n    this.visible = typeof document !== 'undefined' ? document.visibilityState === 'visible' : true;\n    this.focused = typeof document !== 'undefined' ? document.hasFocus() : true;\n  }\n\n  /**\n   * The session a batch of events belongs to: read the stored one, start a new one if it has\n   * timed out or there is none, stamp it with when those events happened and write it back. Every\n   * event goes through here, exactly as GA4 rereads and rewrites its cookie per event — caching\n   * the session in memory would put the tabs back out of step with each other.\n   */\n  touch = (eventTime: number, lastEventTime = eventTime): SessionForEvent => {\n    const stored = readSession();\n\n    if (stored && eventTime - stored.lastEventTime <= SESSION_TIMEOUT) {\n      // `Math.max`, because a batch that waited in a frozen tab can be older than what another\n      // tab has since written, and a session must never be shortened by a late arrival.\n      writeSession({ ...stored, lastEventTime: Math.max(stored.lastEventTime, lastEventTime) });\n      return { id: stored.id, started: false };\n    }\n\n    // Engagement the previous session accrued but never reported dies with it rather than being\n    // handed to its successor. GA4 does the same on `session_start`.\n    this.accumulatedTime = 0;\n    // Wall clock, not `eventTime`: this anchors the engagement timer for the page in front of the\n    // visitor now, which a batch describing something that happened an hour ago says nothing about.\n    this.startTime = Date.now();\n\n    const session: StoredSession = { id: uuidv7(), lastEventTime };\n    writeSession(session);\n    return { id: session.id, started: true };\n  };\n\n  /**\n   * The id for an event that must not start a session — the `pagehide` beacon, which reports what\n   * the session now ending accrued. A live session is extended, as any event extends it; one\n   * already past its timeout still owns that engagement, so its id comes back without being\n   * revived into a session no `session_start` ever announced.\n   */\n  extend = (): string => {\n    const stored = readSession();\n    if (!stored) return this.touch(Date.now()).id;\n\n    const now = Date.now();\n    if (now - stored.lastEventTime <= SESSION_TIMEOUT) {\n      writeSession({ ...stored, lastEventTime: now });\n    }\n    return stored.id;\n  };\n\n  isActive = () => this.active;\n  isVisible = () => this.visible;\n  isFocused = () => this.focused;\n\n  updateActive = (active: boolean) => {\n    this.active = active;\n  };\n\n  updateAccumulator = () => {\n    const now = Date.now();\n    if (this.focused && this.visible && this.active) {\n      const delta = now - this.startTime;\n      if (delta > 0 && delta < SESSION_TIMEOUT) {\n        this.accumulatedTime += delta;\n      }\n    }\n    this.startTime = now;\n  };\n\n  focus = () => {\n    this.updateAccumulator();\n    this.focused = true;\n  };\n\n  blur = () => {\n    this.updateAccumulator();\n    this.focused = false;\n  };\n\n  pageshow = () => {\n    this.updateAccumulator();\n    this.active = true;\n  };\n\n  pagehide = () => {\n    this.updateAccumulator();\n    this.active = false;\n  };\n\n  visibilitychange = (state: DocumentVisibilityState) => {\n    this.updateAccumulator();\n    this.visible = state === 'visible';\n  };\n\n  flush = () => {\n    this.updateAccumulator();\n    const engagementTime = this.accumulatedTime;\n    this.accumulatedTime = 0;\n    return engagementTime;\n  };\n}\n\nlet session: Session | undefined;\n\n/**\n * The session, built the first time something asks for it.\n *\n * Deliberately not a module-scope `new Session()`. The constructor calls\n * `uuidv7()`, `uuid` draws its bytes from `crypto.getRandomValues`, and\n * Cloudflare Workers reject that outside a request handler:\n *\n *   Disallowed operation called within global scope. Asynchronous I/O\n *   (ex: fetch() or connect()), setting a timeout, and generating random\n *   values are not allowed within global scope.\n *\n * Module scope in a Worker is evaluated once when the isolate boots and is\n * then shared by every request that isolate serves, so a random value drawn\n * there would be the same for all of them — which is why the runtime refuses\n * to produce one. A host that server-renders on Workers reaches this module\n * through `track()` on the server as well, and the throw happened as the\n * isolate booted, taking down every route before a component rendered.\n *\n * Everything here is per-visitor browser or app state, so deferring the\n * construction costs nothing and buys two things: the server bundle can be\n * evaluated, and `startTime` marks when the session actually began rather\n * than when the isolate happened to start.\n */\nexport function getSession() {\n  return (session ??= new Session());\n}\n"],"mappings":";;;;;AAIA,MAAa,kBAAkB,OAAU;;;;;;;;;;AA+BzC,MAAM,UAAU;AAEhB,SAAS,cAAyC;CAChD,MAAM,MAAMA,oBAAAA,OAAO,QAAQ,QAAQC,0BAAAA,KAAK,OAAO;CAC/C,IAAI,CAAC,KAAK,OAAO,KAAA;CAEjB,MAAM,CAAC,SAAS,IAAI,iBAAiB,IAAI,MAAM,GAAG;CAClD,IAAI,YAAY,WAAW,CAAC,IAAI,OAAO,KAAA;CAEvC,MAAM,SAAS;EAAE;EAAI,eAAe,OAAO,aAAa;CAAE;CAC1D,IAAI,CAAC,OAAO,SAAS,OAAO,aAAa,GAAG,OAAO,KAAA;CACnD,OAAO;AACT;AAEA,SAAS,aAAa,EAAE,IAAI,iBAAgC;CAC1D,oBAAA,OAAO,QAAQ,QAAQA,0BAAAA,KAAK,SAAS,GAAG,QAAQ,GAAG,GAAG,GAAG,eAAe;AAC1E;AAEA,IAAM,UAAN,MAAc;CAaZ,cAAc;EAeL,KAAA,SAAA,WAAmB,gBAAgB,cAA+B;GACzE,MAAM,SAAS,YAAY;GAE3B,IAAI,UAAU,YAAY,OAAO,iBAAA,MAAkC;IAGjE,aAAa;KAAE,GAAG;KAAQ,eAAe,KAAK,IAAI,OAAO,eAAe,aAAa;IAAE,CAAC;IACxF,OAAO;KAAE,IAAI,OAAO;KAAI,SAAS;IAAM;GACzC;GAIA,KAAK,kBAAkB;GAGvB,KAAK,YAAY,KAAK,IAAI;GAE1B,MAAM,UAAyB;IAAE,KAAA,GAAA,KAAA,GAAA,CAAW;IAAG;GAAc;GAC7D,aAAa,OAAO;GACpB,OAAO;IAAE,IAAI,QAAQ;IAAI,SAAS;GAAK;EACzC;EAQuB,KAAA,eAAA;GACrB,MAAM,SAAS,YAAY;GAC3B,IAAI,CAAC,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC;GAE3C,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,MAAM,OAAO,iBAAA,MACf,aAAa;IAAE,GAAG;IAAQ,eAAe;GAAI,CAAC;GAEhD,OAAO,OAAO;EAChB;EAEiB,KAAA,iBAAA,KAAK;EACJ,KAAA,kBAAA,KAAK;EACL,KAAA,kBAAA,KAAK;EAEP,KAAA,gBAAA,WAAoB;GAClC,KAAK,SAAS;EAChB;EAE0B,KAAA,0BAAA;GACxB,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,KAAK,WAAW,KAAK,WAAW,KAAK,QAAQ;IAC/C,MAAM,QAAQ,MAAM,KAAK;IACzB,IAAI,QAAQ,KAAK,QAAA,MACf,KAAK,mBAAmB;GAE5B;GACA,KAAK,YAAY;EACnB;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,KAAK,UAAU;EACjB;EAEa,KAAA,aAAA;GACX,KAAK,kBAAkB;GACvB,KAAK,UAAU;EACjB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,SAAS;EAChB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,SAAS;EAChB;EAEoB,KAAA,oBAAA,UAAmC;GACrD,KAAK,kBAAkB;GACvB,KAAK,UAAU,UAAU;EAC3B;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,MAAM,iBAAiB,KAAK;GAC5B,KAAK,kBAAkB;GACvB,OAAO;EACT;EAtGE,KAAK,YAAY,KAAK,IAAI;EAC1B,KAAK,kBAAkB;EAEvB,KAAK,SAAS;EACd,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,oBAAoB,YAAY;EAC1F,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,SAAS,IAAI;CACzE;AAiGF;AAEA,IAAI;;;;;;;;;;;;;;;;;;;;;;;;AAyBJ,SAAgB,aAAa;CAC3B,OAAQ,YAAY,IAAI,QAAQ;AAClC"}

package/dist/setup/session.d.cts

@@ -1,22 +1,40 @@
 //#region src/setup/session.d.ts
 declare const SESSION_TIMEOUT: number;
+/** The session an event belongs to, and whether that event is the one that started it. */
+interface SessionForEvent {
+  id: string;
+  started: boolean;
+}
 declare class Session {
-  private id;
+  /**
+   * Engagement is deliberately not stored: it is the time this page has accrued and not yet
+   * reported, so it belongs to the page, not to the session. GA4 draws the same line — its cookie
+   * carries the session, while the engagement timer lives and dies with the document.
+   */
   private startTime;
-  private lastActiveTime;
   private accumulatedTime;
   private active;
   private visible;
   private focused;
   constructor();
-  getId: () => string;
+  /**
+   * The session a batch of events belongs to: read the stored one, start a new one if it has
+   * timed out or there is none, stamp it with when those events happened and write it back. Every
+   * event goes through here, exactly as GA4 rereads and rewrites its cookie per event — caching
+   * the session in memory would put the tabs back out of step with each other.
+   */
+  touch: (eventTime: number, lastEventTime?: number) => SessionForEvent;
+  /**
+   * The id for an event that must not start a session — the `pagehide` beacon, which reports what
+   * the session now ending accrued. A live session is extended, as any event extends it; one
+   * already past its timeout still owns that engagement, so its id comes back without being
+   * revived into a session no `session_start` ever announced.
+   */
+  extend: () => string;
   isActive: () => boolean;
   isVisible: () => boolean;
   isFocused: () => boolean;
-  isExpired: () => boolean;
-  updateLastActiveTime: () => void;
   updateActive: (active: boolean) => void;
-  refresh: () => void;
   updateAccumulator: () => void;
   focus: () => void;
   blur: () => void;

package/dist/setup/session.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.cts","names":[],"sources":["../../src/setup/session.ts"],"mappings":";cAEa;cAEP;UACI;UACA;UACA;UACA;UAEA;UACA;UACA;EAER;EAWA;EAEA;EACA;EACA;EACA;EAEA;EAIA,eAAY;EAIZ;EAKA;EAWA;EAMA;EAKA;EAMA;EAKA,mBAAgB,OAAW;EAQ3B;;;;;;;;;;;;;;;;;;;;;;;;;iBAiCc,cAAU"}
+{"version":3,"file":"session.d.cts","names":[],"sources":["../../src/setup/session.ts"],"mappings":";cAIa;;UAiBH;EACR;EACA;;cA8BI;;;;;;UAMI;UACA;UAEA;UACA;UACA;EAER;;;;;;;EAeA,QAAK,mBAAqB,2BAA8B;;;;;;;EA4BxD;EAWA;EACA;EACA;EAEA,eAAY;EAIZ;EAWA;EAKA;EAKA;EAKA;EAKA,mBAAgB,OAAW;EAK3B;;;;;;;;;;;;;;;;;;;;;;;;;iBAiCc,cAAU"}

package/dist/setup/session.d.mts

@@ -1,22 +1,40 @@
 //#region src/setup/session.d.ts
 declare const SESSION_TIMEOUT: number;
+/** The session an event belongs to, and whether that event is the one that started it. */
+interface SessionForEvent {
+  id: string;
+  started: boolean;
+}
 declare class Session {
-  private id;
+  /**
+   * Engagement is deliberately not stored: it is the time this page has accrued and not yet
+   * reported, so it belongs to the page, not to the session. GA4 draws the same line — its cookie
+   * carries the session, while the engagement timer lives and dies with the document.
+   */
   private startTime;
-  private lastActiveTime;
   private accumulatedTime;
   private active;
   private visible;
   private focused;
   constructor();
-  getId: () => string;
+  /**
+   * The session a batch of events belongs to: read the stored one, start a new one if it has
+   * timed out or there is none, stamp it with when those events happened and write it back. Every
+   * event goes through here, exactly as GA4 rereads and rewrites its cookie per event — caching
+   * the session in memory would put the tabs back out of step with each other.
+   */
+  touch: (eventTime: number, lastEventTime?: number) => SessionForEvent;
+  /**
+   * The id for an event that must not start a session — the `pagehide` beacon, which reports what
+   * the session now ending accrued. A live session is extended, as any event extends it; one
+   * already past its timeout still owns that engagement, so its id comes back without being
+   * revived into a session no `session_start` ever announced.
+   */
+  extend: () => string;
   isActive: () => boolean;
   isVisible: () => boolean;
   isFocused: () => boolean;
-  isExpired: () => boolean;
-  updateLastActiveTime: () => void;
   updateActive: (active: boolean) => void;
-  refresh: () => void;
   updateAccumulator: () => void;
   focus: () => void;
   blur: () => void;

package/dist/setup/session.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.mts","names":[],"sources":["../../src/setup/session.ts"],"mappings":";cAEa;cAEP;UACI;UACA;UACA;UACA;UAEA;UACA;UACA;EAER;EAWA;EAEA;EACA;EACA;EACA;EAEA;EAIA,eAAY;EAIZ;EAKA;EAWA;EAMA;EAKA;EAMA;EAKA,mBAAgB,OAAW;EAQ3B;;;;;;;;;;;;;;;;;;;;;;;;;iBAiCc,cAAU"}
+{"version":3,"file":"session.d.mts","names":[],"sources":["../../src/setup/session.ts"],"mappings":";cAIa;;UAiBH;EACR;EACA;;cA8BI;;;;;;UAMI;UACA;UAEA;UACA;UACA;EAER;;;;;;;EAeA,QAAK,mBAAqB,2BAA8B;;;;;;;EA4BxD;EAWA;EACA;EACA;EAEA,eAAY;EAIZ;EAWA;EAKA;EAKA;EAKA;EAKA,mBAAgB,OAAW;EAK3B;;;;;;;;;;;;;;;;;;;;;;;;;iBAiCc,cAAU"}

package/dist/setup/session.mjs

@@ -1,23 +1,75 @@
+import { config } from "./index.mjs";
+import { keys } from "../constants/storage.mjs";
 import { v7 } from "uuid";
 //#region src/setup/session.ts
 const SESSION_TIMEOUT = 1800 * 1e3;
+/**
+* `<version>.<id>.<lastEventTime>`, compact and cookie-safe rather than JSON: `{`, `"`
+* and `,` all have to be percent-encoded in a cookie, and a host that wants one session across
+* its subdomains will hand `setupAnalytics` a cookie-backed `storage`, where this has to survive
+* unchanged. A uuidv7 contains no dots, so the record splits cleanly.
+*
+* The version guards a change the parser could not otherwise survive. A field appended to the end
+* does not need one — a short record simply leaves it undefined.
+*/
+const VERSION = "1";
+function readSession() {
+	const raw = config.storage.getItem(keys.session);
+	if (!raw) return void 0;
+	const [version, id, lastEventTime] = raw.split(".");
+	if (version !== VERSION || !id) return void 0;
+	const parsed = {
+		id,
+		lastEventTime: Number(lastEventTime)
+	};
+	if (!Number.isFinite(parsed.lastEventTime)) return void 0;
+	return parsed;
+}
+function writeSession({ id, lastEventTime }) {
+	config.storage.setItem(keys.session, `${VERSION}.${id}.${lastEventTime}`);
+}
 var Session = class {
 	constructor() {
-		this.getId = () => this.id;
+		this.touch = (eventTime, lastEventTime = eventTime) => {
+			const stored = readSession();
+			if (stored && eventTime - stored.lastEventTime <= 18e5) {
+				writeSession({
+					...stored,
+					lastEventTime: Math.max(stored.lastEventTime, lastEventTime)
+				});
+				return {
+					id: stored.id,
+					started: false
+				};
+			}
+			this.accumulatedTime = 0;
+			this.startTime = Date.now();
+			const session = {
+				id: v7(),
+				lastEventTime
+			};
+			writeSession(session);
+			return {
+				id: session.id,
+				started: true
+			};
+		};
+		this.extend = () => {
+			const stored = readSession();
+			if (!stored) return this.touch(Date.now()).id;
+			const now = Date.now();
+			if (now - stored.lastEventTime <= 18e5) writeSession({
+				...stored,
+				lastEventTime: now
+			});
+			return stored.id;
+		};
 		this.isActive = () => this.active;
 		this.isVisible = () => this.visible;
 		this.isFocused = () => this.focused;
-		this.isExpired = () => Date.now() - this.lastActiveTime > SESSION_TIMEOUT;
-		this.updateLastActiveTime = () => {
-			this.lastActiveTime = Date.now();
-		};
 		this.updateActive = (active) => {
 			this.active = active;
 		};
-		this.refresh = () => {
-			this.id = v7();
-			this.lastActiveTime = Date.now();
-		};
 		this.updateAccumulator = () => {
 			const now = Date.now();
 			if (this.focused && this.visible && this.active) {
@@ -28,7 +80,6 @@ var Session = class {
 		};
 		this.focus = () => {
 			this.updateAccumulator();
-			this.updateLastActiveTime();
 			this.focused = true;
 		};
 		this.blur = () => {
@@ -37,7 +88,6 @@ var Session = class {
 		};
 		this.pageshow = () => {
 			this.updateAccumulator();
-			this.updateLastActiveTime();
 			this.active = true;
 		};
 		this.pagehide = () => {
@@ -46,7 +96,6 @@ var Session = class {
 		};
 		this.visibilitychange = (state) => {
 			this.updateAccumulator();
-			if (state === "visible") this.updateLastActiveTime();
 			this.visible = state === "visible";
 		};
 		this.flush = () => {
@@ -55,9 +104,7 @@ var Session = class {
 			this.accumulatedTime = 0;
 			return engagementTime;
 		};
-		this.id = v7();
 		this.startTime = Date.now();
-		this.lastActiveTime = Date.now();
 		this.accumulatedTime = 0;
 		this.active = true;
 		this.visible = typeof document !== "undefined" ? document.visibilityState === "visible" : true;

package/dist/setup/session.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"session.mjs","names":["uuidv7"],"sources":["../../src/setup/session.ts"],"sourcesContent":["import { v7 as uuidv7 } from 'uuid';\n\nexport const SESSION_TIMEOUT = 30 * 60 * 1000;\n\nclass Session {\n  private id: string;\n  private startTime: number;\n  private lastActiveTime: number;\n  private accumulatedTime: number;\n\n  private active: boolean;\n  private visible: boolean;\n  private focused: boolean;\n\n  constructor() {\n    this.id = uuidv7();\n    this.startTime = Date.now();\n    this.lastActiveTime = Date.now();\n    this.accumulatedTime = 0;\n\n    this.active = true;\n    this.visible = typeof document !== 'undefined' ? document.visibilityState === 'visible' : true;\n    this.focused = typeof document !== 'undefined' ? document.hasFocus() : true;\n  }\n\n  getId = () => this.id;\n\n  isActive = () => this.active;\n  isVisible = () => this.visible;\n  isFocused = () => this.focused;\n  isExpired = () => Date.now() - this.lastActiveTime > SESSION_TIMEOUT;\n\n  updateLastActiveTime = () => {\n    this.lastActiveTime = Date.now();\n  };\n\n  updateActive = (active: boolean) => {\n    this.active = active;\n  };\n\n  refresh = () => {\n    this.id = uuidv7();\n    this.lastActiveTime = Date.now();\n  };\n\n  updateAccumulator = () => {\n    const now = Date.now();\n    if (this.focused && this.visible && this.active) {\n      const delta = now - this.startTime;\n      if (delta > 0 && delta < SESSION_TIMEOUT) {\n        this.accumulatedTime += delta;\n      }\n    }\n    this.startTime = now;\n  };\n\n  focus = () => {\n    this.updateAccumulator();\n    this.updateLastActiveTime();\n    this.focused = true;\n  };\n\n  blur = () => {\n    this.updateAccumulator();\n    this.focused = false;\n  };\n\n  pageshow = () => {\n    this.updateAccumulator();\n    this.updateLastActiveTime();\n    this.active = true;\n  };\n\n  pagehide = () => {\n    this.updateAccumulator();\n    this.active = false;\n  };\n\n  visibilitychange = (state: DocumentVisibilityState) => {\n    this.updateAccumulator();\n    if (state === 'visible') {\n      this.updateLastActiveTime();\n    }\n    this.visible = state === 'visible';\n  };\n\n  flush = () => {\n    this.updateAccumulator();\n    const engagementTime = this.accumulatedTime;\n    this.accumulatedTime = 0;\n    return engagementTime;\n  };\n}\n\nlet session: Session | undefined;\n\n/**\n * The session, built the first time something asks for it.\n *\n * Deliberately not a module-scope `new Session()`. The constructor calls\n * `uuidv7()`, `uuid` draws its bytes from `crypto.getRandomValues`, and\n * Cloudflare Workers reject that outside a request handler:\n *\n *   Disallowed operation called within global scope. Asynchronous I/O\n *   (ex: fetch() or connect()), setting a timeout, and generating random\n *   values are not allowed within global scope.\n *\n * Module scope in a Worker is evaluated once when the isolate boots and is\n * then shared by every request that isolate serves, so a random value drawn\n * there would be the same for all of them — which is why the runtime refuses\n * to produce one. A host that server-renders on Workers reaches this module\n * through `track()` on the server as well, and the throw happened as the\n * isolate booted, taking down every route before a component rendered.\n *\n * Everything here is per-visitor browser or app state, so deferring the\n * construction costs nothing and buys two things: the server bundle can be\n * evaluated, and `startTime` marks when the session actually began rather\n * than when the isolate happened to start.\n */\nexport function getSession() {\n  return (session ??= new Session());\n}\n"],"mappings":";;AAEA,MAAa,kBAAkB,OAAU;AAEzC,IAAM,UAAN,MAAc;CAUZ,cAAc;EAWA,KAAA,cAAA,KAAK;EAEF,KAAA,iBAAA,KAAK;EACJ,KAAA,kBAAA,KAAK;EACL,KAAA,kBAAA,KAAK;EACL,KAAA,kBAAA,KAAK,IAAI,IAAI,KAAK,iBAAiB;EAExB,KAAA,6BAAA;GAC3B,KAAK,iBAAiB,KAAK,IAAI;EACjC;EAEgB,KAAA,gBAAA,WAAoB;GAClC,KAAK,SAAS;EAChB;EAEgB,KAAA,gBAAA;GACd,KAAK,KAAKA,GAAO;GACjB,KAAK,iBAAiB,KAAK,IAAI;EACjC;EAE0B,KAAA,0BAAA;GACxB,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,KAAK,WAAW,KAAK,WAAW,KAAK,QAAQ;IAC/C,MAAM,QAAQ,MAAM,KAAK;IACzB,IAAI,QAAQ,KAAK,QAAA,MACf,KAAK,mBAAmB;GAE5B;GACA,KAAK,YAAY;EACnB;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,KAAK,qBAAqB;GAC1B,KAAK,UAAU;EACjB;EAEa,KAAA,aAAA;GACX,KAAK,kBAAkB;GACvB,KAAK,UAAU;EACjB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,qBAAqB;GAC1B,KAAK,SAAS;EAChB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,SAAS;EAChB;EAEoB,KAAA,oBAAA,UAAmC;GACrD,KAAK,kBAAkB;GACvB,IAAI,UAAU,WACZ,KAAK,qBAAqB;GAE5B,KAAK,UAAU,UAAU;EAC3B;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,MAAM,iBAAiB,KAAK;GAC5B,KAAK,kBAAkB;GACvB,OAAO;EACT;EA5EE,KAAK,KAAKA,GAAO;EACjB,KAAK,YAAY,KAAK,IAAI;EAC1B,KAAK,iBAAiB,KAAK,IAAI;EAC/B,KAAK,kBAAkB;EAEvB,KAAK,SAAS;EACd,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,oBAAoB,YAAY;EAC1F,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,SAAS,IAAI;CACzE;AAqEF;AAEA,IAAI;;;;;;;;;;;;;;;;;;;;;;;;AAyBJ,SAAgB,aAAa;CAC3B,OAAQ,YAAY,IAAI,QAAQ;AAClC"}
+{"version":3,"file":"session.mjs","names":["uuidv7"],"sources":["../../src/setup/session.ts"],"sourcesContent":["import { v7 as uuidv7 } from 'uuid';\nimport { keys } from '../constants/storage';\nimport { config } from './index';\n\nexport const SESSION_TIMEOUT = 30 * 60 * 1000;\n\n/**\n * The part of a session that outlives the page: its identity, and the clock the timeout is\n * measured against. GA4 keeps these in its `_ga_<container>` cookie — alongside the engaged flag,\n * which arrives with `session_engaged` later — and rereads them for every event, which is what\n * makes a session survive a reload, span a whole multipage visit, and stay shared between two\n * tabs of the same site. Holding them in memory instead, as this did, starts a new session on\n * every full navigation and gives every tab one of its own.\n */\ninterface StoredSession {\n  id: string;\n  /** When the last event was sent. The timeout is measured from here, and only from here. */\n  lastEventTime: number;\n}\n\n/** The session an event belongs to, and whether that event is the one that started it. */\ninterface SessionForEvent {\n  id: string;\n  started: boolean;\n}\n\n/**\n * `<version>.<id>.<lastEventTime>`, compact and cookie-safe rather than JSON: `{`, `\"`\n * and `,` all have to be percent-encoded in a cookie, and a host that wants one session across\n * its subdomains will hand `setupAnalytics` a cookie-backed `storage`, where this has to survive\n * unchanged. A uuidv7 contains no dots, so the record splits cleanly.\n *\n * The version guards a change the parser could not otherwise survive. A field appended to the end\n * does not need one — a short record simply leaves it undefined.\n */\nconst VERSION = '1';\n\nfunction readSession(): StoredSession | undefined {\n  const raw = config.storage.getItem(keys.session);\n  if (!raw) return undefined;\n\n  const [version, id, lastEventTime] = raw.split('.');\n  if (version !== VERSION || !id) return undefined;\n\n  const parsed = { id, lastEventTime: Number(lastEventTime) };\n  if (!Number.isFinite(parsed.lastEventTime)) return undefined;\n  return parsed;\n}\n\nfunction writeSession({ id, lastEventTime }: StoredSession) {\n  config.storage.setItem(keys.session, `${VERSION}.${id}.${lastEventTime}`);\n}\n\nclass Session {\n  /**\n   * Engagement is deliberately not stored: it is the time this page has accrued and not yet\n   * reported, so it belongs to the page, not to the session. GA4 draws the same line — its cookie\n   * carries the session, while the engagement timer lives and dies with the document.\n   */\n  private startTime: number;\n  private accumulatedTime: number;\n\n  private active: boolean;\n  private visible: boolean;\n  private focused: boolean;\n\n  constructor() {\n    this.startTime = Date.now();\n    this.accumulatedTime = 0;\n\n    this.active = true;\n    this.visible = typeof document !== 'undefined' ? document.visibilityState === 'visible' : true;\n    this.focused = typeof document !== 'undefined' ? document.hasFocus() : true;\n  }\n\n  /**\n   * The session a batch of events belongs to: read the stored one, start a new one if it has\n   * timed out or there is none, stamp it with when those events happened and write it back. Every\n   * event goes through here, exactly as GA4 rereads and rewrites its cookie per event — caching\n   * the session in memory would put the tabs back out of step with each other.\n   */\n  touch = (eventTime: number, lastEventTime = eventTime): SessionForEvent => {\n    const stored = readSession();\n\n    if (stored && eventTime - stored.lastEventTime <= SESSION_TIMEOUT) {\n      // `Math.max`, because a batch that waited in a frozen tab can be older than what another\n      // tab has since written, and a session must never be shortened by a late arrival.\n      writeSession({ ...stored, lastEventTime: Math.max(stored.lastEventTime, lastEventTime) });\n      return { id: stored.id, started: false };\n    }\n\n    // Engagement the previous session accrued but never reported dies with it rather than being\n    // handed to its successor. GA4 does the same on `session_start`.\n    this.accumulatedTime = 0;\n    // Wall clock, not `eventTime`: this anchors the engagement timer for the page in front of the\n    // visitor now, which a batch describing something that happened an hour ago says nothing about.\n    this.startTime = Date.now();\n\n    const session: StoredSession = { id: uuidv7(), lastEventTime };\n    writeSession(session);\n    return { id: session.id, started: true };\n  };\n\n  /**\n   * The id for an event that must not start a session — the `pagehide` beacon, which reports what\n   * the session now ending accrued. A live session is extended, as any event extends it; one\n   * already past its timeout still owns that engagement, so its id comes back without being\n   * revived into a session no `session_start` ever announced.\n   */\n  extend = (): string => {\n    const stored = readSession();\n    if (!stored) return this.touch(Date.now()).id;\n\n    const now = Date.now();\n    if (now - stored.lastEventTime <= SESSION_TIMEOUT) {\n      writeSession({ ...stored, lastEventTime: now });\n    }\n    return stored.id;\n  };\n\n  isActive = () => this.active;\n  isVisible = () => this.visible;\n  isFocused = () => this.focused;\n\n  updateActive = (active: boolean) => {\n    this.active = active;\n  };\n\n  updateAccumulator = () => {\n    const now = Date.now();\n    if (this.focused && this.visible && this.active) {\n      const delta = now - this.startTime;\n      if (delta > 0 && delta < SESSION_TIMEOUT) {\n        this.accumulatedTime += delta;\n      }\n    }\n    this.startTime = now;\n  };\n\n  focus = () => {\n    this.updateAccumulator();\n    this.focused = true;\n  };\n\n  blur = () => {\n    this.updateAccumulator();\n    this.focused = false;\n  };\n\n  pageshow = () => {\n    this.updateAccumulator();\n    this.active = true;\n  };\n\n  pagehide = () => {\n    this.updateAccumulator();\n    this.active = false;\n  };\n\n  visibilitychange = (state: DocumentVisibilityState) => {\n    this.updateAccumulator();\n    this.visible = state === 'visible';\n  };\n\n  flush = () => {\n    this.updateAccumulator();\n    const engagementTime = this.accumulatedTime;\n    this.accumulatedTime = 0;\n    return engagementTime;\n  };\n}\n\nlet session: Session | undefined;\n\n/**\n * The session, built the first time something asks for it.\n *\n * Deliberately not a module-scope `new Session()`. The constructor calls\n * `uuidv7()`, `uuid` draws its bytes from `crypto.getRandomValues`, and\n * Cloudflare Workers reject that outside a request handler:\n *\n *   Disallowed operation called within global scope. Asynchronous I/O\n *   (ex: fetch() or connect()), setting a timeout, and generating random\n *   values are not allowed within global scope.\n *\n * Module scope in a Worker is evaluated once when the isolate boots and is\n * then shared by every request that isolate serves, so a random value drawn\n * there would be the same for all of them — which is why the runtime refuses\n * to produce one. A host that server-renders on Workers reaches this module\n * through `track()` on the server as well, and the throw happened as the\n * isolate booted, taking down every route before a component rendered.\n *\n * Everything here is per-visitor browser or app state, so deferring the\n * construction costs nothing and buys two things: the server bundle can be\n * evaluated, and `startTime` marks when the session actually began rather\n * than when the isolate happened to start.\n */\nexport function getSession() {\n  return (session ??= new Session());\n}\n"],"mappings":";;;;AAIA,MAAa,kBAAkB,OAAU;;;;;;;;;;AA+BzC,MAAM,UAAU;AAEhB,SAAS,cAAyC;CAChD,MAAM,MAAM,OAAO,QAAQ,QAAQ,KAAK,OAAO;CAC/C,IAAI,CAAC,KAAK,OAAO,KAAA;CAEjB,MAAM,CAAC,SAAS,IAAI,iBAAiB,IAAI,MAAM,GAAG;CAClD,IAAI,YAAY,WAAW,CAAC,IAAI,OAAO,KAAA;CAEvC,MAAM,SAAS;EAAE;EAAI,eAAe,OAAO,aAAa;CAAE;CAC1D,IAAI,CAAC,OAAO,SAAS,OAAO,aAAa,GAAG,OAAO,KAAA;CACnD,OAAO;AACT;AAEA,SAAS,aAAa,EAAE,IAAI,iBAAgC;CAC1D,OAAO,QAAQ,QAAQ,KAAK,SAAS,GAAG,QAAQ,GAAG,GAAG,GAAG,eAAe;AAC1E;AAEA,IAAM,UAAN,MAAc;CAaZ,cAAc;EAeL,KAAA,SAAA,WAAmB,gBAAgB,cAA+B;GACzE,MAAM,SAAS,YAAY;GAE3B,IAAI,UAAU,YAAY,OAAO,iBAAA,MAAkC;IAGjE,aAAa;KAAE,GAAG;KAAQ,eAAe,KAAK,IAAI,OAAO,eAAe,aAAa;IAAE,CAAC;IACxF,OAAO;KAAE,IAAI,OAAO;KAAI,SAAS;IAAM;GACzC;GAIA,KAAK,kBAAkB;GAGvB,KAAK,YAAY,KAAK,IAAI;GAE1B,MAAM,UAAyB;IAAE,IAAIA,GAAO;IAAG;GAAc;GAC7D,aAAa,OAAO;GACpB,OAAO;IAAE,IAAI,QAAQ;IAAI,SAAS;GAAK;EACzC;EAQuB,KAAA,eAAA;GACrB,MAAM,SAAS,YAAY;GAC3B,IAAI,CAAC,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC;GAE3C,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,MAAM,OAAO,iBAAA,MACf,aAAa;IAAE,GAAG;IAAQ,eAAe;GAAI,CAAC;GAEhD,OAAO,OAAO;EAChB;EAEiB,KAAA,iBAAA,KAAK;EACJ,KAAA,kBAAA,KAAK;EACL,KAAA,kBAAA,KAAK;EAEP,KAAA,gBAAA,WAAoB;GAClC,KAAK,SAAS;EAChB;EAE0B,KAAA,0BAAA;GACxB,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,KAAK,WAAW,KAAK,WAAW,KAAK,QAAQ;IAC/C,MAAM,QAAQ,MAAM,KAAK;IACzB,IAAI,QAAQ,KAAK,QAAA,MACf,KAAK,mBAAmB;GAE5B;GACA,KAAK,YAAY;EACnB;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,KAAK,UAAU;EACjB;EAEa,KAAA,aAAA;GACX,KAAK,kBAAkB;GACvB,KAAK,UAAU;EACjB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,SAAS;EAChB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,SAAS;EAChB;EAEoB,KAAA,oBAAA,UAAmC;GACrD,KAAK,kBAAkB;GACvB,KAAK,UAAU,UAAU;EAC3B;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,MAAM,iBAAiB,KAAK;GAC5B,KAAK,kBAAkB;GACvB,OAAO;EACT;EAtGE,KAAK,YAAY,KAAK,IAAI;EAC1B,KAAK,kBAAkB;EAEvB,KAAK,SAAS;EACd,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,oBAAoB,YAAY;EAC1F,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,SAAS,IAAI;CACzE;AAiGF;AAEA,IAAI;;;;;;;;;;;;;;;;;;;;;;;;AAyBJ,SAAgB,aAAa;CAC3B,OAAQ,YAAY,IAAI,QAAQ;AAClC"}

package/dist/tanstack/middleware.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.cjs","names":["resolveClickIdCookies","toSetCookieHeaders"],"sources":["../../src/tanstack/middleware.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start';\nimport { resolveClickIdCookies, toSetCookieHeaders } from '../click-id/index';\n\nexport interface ClickIdMiddlewareOptions {\n  /** `Domain` attribute for the cookies, e.g. `.edensign.io`. Omit for a host-only cookie. */\n  domain?: string;\n  /** `Secure` attribute, default true. Set false only for local http testing. */\n  secure?: boolean;\n  /** subdomainIndex for a freshly built `_fbc` (com=0, example.com=1, www.example.com=2). Default 1. */\n  subdomainIndex?: number;\n  /**\n   * Re-issue a still-valid `_fbc` on every request as an ITP self-heal (restores the long-lived\n   * HTTP cookie if the Meta Pixel's `document.cookie` write re-capped it to 24h in Safari). On by\n   * default. Note it attaches a per-user `Set-Cookie` — and thus `no-store` — to every page\n   * response carrying an `_fbc`, defeating CDN caching of those pages; set false to strictly follow\n   * Meta's conditional-write rule and keep them cacheable. See {@link resolveClickIdCookies}.\n   */\n  refresh?: boolean;\n  /**\n   * Override the `Cache-Control` of a response we attach cookies to (default `private, no-store`).\n   * A per-user `Set-Cookie` must never end up on a shared-cache entry, or one visitor's `_fbc` would\n   * be served to everyone. Only set this false if you guarantee these responses are never cached.\n   */\n  cacheControl?: string | false;\n  /**\n   * Consent gate. Return false to skip setting cookies for this request (e.g. before the visitor has\n   * granted consent where required). Runs per request with the incoming `Request`.\n   */\n  shouldPersist?: (request: Request) => boolean;\n}\n\n/**\n * TanStack Start request middleware that persists ad click-id cookies (`_fbc`, `_rdt_cid`) on the\n * document response.\n *\n * Setting `_fbc` here — on the top document via an HTTP `Set-Cookie` header, before any client JS\n * runs — is what Meta officially recommends and the only reliable way to keep the cookie alive for\n * 90 days in Safari: ITP caps JavaScript-set cookies on a fbclid-decorated landing page to 24\n * hours, and a document response is never classified as CNAME/IP cloaking (it is the reference the\n * browser measures cloaking against).\n *\n * Register it as a global request middleware:\n * ```ts\n * // start.ts\n * import { createStart } from '@tanstack/react-start'\n * import { clickIdMiddleware } from '@shware/analytics/tanstack'\n * export const startInstance = createStart(() => ({ requestMiddleware: [clickIdMiddleware] }))\n * ```\n *\n * reference: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/fbp-and-fbc\n */\nexport function createClickIdMiddleware(options: ClickIdMiddlewareOptions = {}) {\n  const { cacheControl = 'private, no-store' } = options;\n\n  return createMiddleware({ type: 'request' }).server(async ({ request, next, handlerType }) => {\n    const result = await next();\n\n    // Skip serverFn RPC responses. 'router' covers SSR document requests *and* custom server\n    // routes (API endpoints) — those also get cookies when the URL carries a click id.\n    if (handlerType !== 'router') return result;\n    if (options.shouldPersist && !options.shouldPersist(request)) return result;\n\n    const { cookies } = resolveClickIdCookies({\n      url: request.url,\n      cookieHeader: request.headers.get('cookie'),\n      domain: options.domain,\n      secure: options.secure,\n      subdomainIndex: options.subdomainIndex,\n      refresh: options.refresh ?? true,\n    });\n\n    if (cookies.length > 0) {\n      for (const header of toSetCookieHeaders(cookies)) {\n        result.response.headers.append('set-cookie', header);\n      }\n      if (cacheControl !== false) {\n        result.response.headers.set('cache-control', cacheControl);\n      }\n    }\n\n    return result;\n  });\n}\n\n/** Ready-to-register middleware with default options. */\nexport const clickIdMiddleware = createClickIdMiddleware();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,wBAAwB,UAAoC,CAAC,GAAG;CAC9E,MAAM,EAAE,eAAe,wBAAwB;CAE/C,QAAA,GAAA,sBAAA,iBAAA,CAAwB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,SAAS,MAAM,kBAAkB;EAC5F,MAAM,SAAS,MAAM,KAAK;EAI1B,IAAI,gBAAgB,UAAU,OAAO;EACrC,IAAI,QAAQ,iBAAiB,CAAC,QAAQ,cAAc,OAAO,GAAG,OAAO;EAErE,MAAM,EAAE,YAAYA,uBAAAA,sBAAsB;GACxC,KAAK,QAAQ;GACb,cAAc,QAAQ,QAAQ,IAAI,QAAQ;GAC1C,QAAQ,QAAQ;GAChB,QAAQ,QAAQ;GAChB,gBAAgB,QAAQ;GACxB,SAAS,QAAQ,WAAW;EAC9B,CAAC;EAED,IAAI,QAAQ,SAAS,GAAG;GACtB,KAAK,MAAM,UAAUC,uBAAAA,mBAAmB,OAAO,GAC7C,OAAO,SAAS,QAAQ,OAAO,cAAc,MAAM;GAErD,IAAI,iBAAiB,OACnB,OAAO,SAAS,QAAQ,IAAI,iBAAiB,YAAY;EAE7D;EAEA,OAAO;CACT,CAAC;AACH;;AAGA,MAAa,oBAAoB,wBAAwB"}
+{"version":3,"file":"middleware.cjs","names":["resolveClickIdCookies","toSetCookieHeaders"],"sources":["../../src/tanstack/middleware.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start';\nimport { resolveClickIdCookies, toSetCookieHeaders } from '../click-id/index';\n\nexport interface ClickIdMiddlewareOptions {\n  /** `Domain` attribute for the cookies, e.g. `.shware.io`. Omit for a host-only cookie. */\n  domain?: string;\n  /** `Secure` attribute, default true. Set false only for local http testing. */\n  secure?: boolean;\n  /** subdomainIndex for a freshly built `_fbc` (com=0, example.com=1, www.example.com=2). Default 1. */\n  subdomainIndex?: number;\n  /**\n   * Re-issue a still-valid `_fbc` on every request as an ITP self-heal (restores the long-lived\n   * HTTP cookie if the Meta Pixel's `document.cookie` write re-capped it to 24h in Safari). On by\n   * default. Note it attaches a per-user `Set-Cookie` — and thus `no-store` — to every page\n   * response carrying an `_fbc`, defeating CDN caching of those pages; set false to strictly follow\n   * Meta's conditional-write rule and keep them cacheable. See {@link resolveClickIdCookies}.\n   */\n  refresh?: boolean;\n  /**\n   * Override the `Cache-Control` of a response we attach cookies to (default `private, no-store`).\n   * A per-user `Set-Cookie` must never end up on a shared-cache entry, or one visitor's `_fbc` would\n   * be served to everyone. Only set this false if you guarantee these responses are never cached.\n   */\n  cacheControl?: string | false;\n  /**\n   * Consent gate. Return false to skip setting cookies for this request (e.g. before the visitor has\n   * granted consent where required). Runs per request with the incoming `Request`.\n   */\n  shouldPersist?: (request: Request) => boolean;\n}\n\n/**\n * TanStack Start request middleware that persists ad click-id cookies (`_fbc`, `_rdt_cid`) on the\n * document response.\n *\n * Setting `_fbc` here — on the top document via an HTTP `Set-Cookie` header, before any client JS\n * runs — is what Meta officially recommends and the only reliable way to keep the cookie alive for\n * 90 days in Safari: ITP caps JavaScript-set cookies on a fbclid-decorated landing page to 24\n * hours, and a document response is never classified as CNAME/IP cloaking (it is the reference the\n * browser measures cloaking against).\n *\n * Register it as a global request middleware:\n * ```ts\n * // start.ts\n * import { createStart } from '@tanstack/react-start'\n * import { clickIdMiddleware } from '@shware/analytics/tanstack'\n * export const startInstance = createStart(() => ({ requestMiddleware: [clickIdMiddleware] }))\n * ```\n *\n * reference: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/fbp-and-fbc\n */\nexport function createClickIdMiddleware(options: ClickIdMiddlewareOptions = {}) {\n  const { cacheControl = 'private, no-store' } = options;\n\n  return createMiddleware({ type: 'request' }).server(async ({ request, next, handlerType }) => {\n    const result = await next();\n\n    // Skip serverFn RPC responses. 'router' covers SSR document requests *and* custom server\n    // routes (API endpoints) — those also get cookies when the URL carries a click id.\n    if (handlerType !== 'router') return result;\n    if (options.shouldPersist && !options.shouldPersist(request)) return result;\n\n    const { cookies } = resolveClickIdCookies({\n      url: request.url,\n      cookieHeader: request.headers.get('cookie'),\n      domain: options.domain,\n      secure: options.secure,\n      subdomainIndex: options.subdomainIndex,\n      refresh: options.refresh ?? true,\n    });\n\n    if (cookies.length > 0) {\n      for (const header of toSetCookieHeaders(cookies)) {\n        result.response.headers.append('set-cookie', header);\n      }\n      if (cacheControl !== false) {\n        result.response.headers.set('cache-control', cacheControl);\n      }\n    }\n\n    return result;\n  });\n}\n\n/** Ready-to-register middleware with default options. */\nexport const clickIdMiddleware = createClickIdMiddleware();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,wBAAwB,UAAoC,CAAC,GAAG;CAC9E,MAAM,EAAE,eAAe,wBAAwB;CAE/C,QAAA,GAAA,sBAAA,iBAAA,CAAwB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,SAAS,MAAM,kBAAkB;EAC5F,MAAM,SAAS,MAAM,KAAK;EAI1B,IAAI,gBAAgB,UAAU,OAAO;EACrC,IAAI,QAAQ,iBAAiB,CAAC,QAAQ,cAAc,OAAO,GAAG,OAAO;EAErE,MAAM,EAAE,YAAYA,uBAAAA,sBAAsB;GACxC,KAAK,QAAQ;GACb,cAAc,QAAQ,QAAQ,IAAI,QAAQ;GAC1C,QAAQ,QAAQ;GAChB,QAAQ,QAAQ;GAChB,gBAAgB,QAAQ;GACxB,SAAS,QAAQ,WAAW;EAC9B,CAAC;EAED,IAAI,QAAQ,SAAS,GAAG;GACtB,KAAK,MAAM,UAAUC,uBAAAA,mBAAmB,OAAO,GAC7C,OAAO,SAAS,QAAQ,OAAO,cAAc,MAAM;GAErD,IAAI,iBAAiB,OACnB,OAAO,SAAS,QAAQ,IAAI,iBAAiB,YAAY;EAE7D;EAEA,OAAO;CACT,CAAC;AACH;;AAGA,MAAa,oBAAoB,wBAAwB"}

package/dist/tanstack/middleware.d.cts

@@ -1,6 +1,6 @@
 //#region src/tanstack/middleware.d.ts
 interface ClickIdMiddlewareOptions {
-  /** `Domain` attribute for the cookies, e.g. `.edensign.io`. Omit for a host-only cookie. */
+  /** `Domain` attribute for the cookies, e.g. `.shware.io`. Omit for a host-only cookie. */
   domain?: string;
   /** `Secure` attribute, default true. Set false only for local http testing. */
   secure?: boolean;

package/dist/tanstack/middleware.d.mts

@@ -1,6 +1,6 @@
 //#region src/tanstack/middleware.d.ts
 interface ClickIdMiddlewareOptions {
-  /** `Domain` attribute for the cookies, e.g. `.edensign.io`. Omit for a host-only cookie. */
+  /** `Domain` attribute for the cookies, e.g. `.shware.io`. Omit for a host-only cookie. */
   domain?: string;
   /** `Secure` attribute, default true. Set false only for local http testing. */
   secure?: boolean;

package/dist/tanstack/middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.mjs","names":[],"sources":["../../src/tanstack/middleware.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start';\nimport { resolveClickIdCookies, toSetCookieHeaders } from '../click-id/index';\n\nexport interface ClickIdMiddlewareOptions {\n  /** `Domain` attribute for the cookies, e.g. `.edensign.io`. Omit for a host-only cookie. */\n  domain?: string;\n  /** `Secure` attribute, default true. Set false only for local http testing. */\n  secure?: boolean;\n  /** subdomainIndex for a freshly built `_fbc` (com=0, example.com=1, www.example.com=2). Default 1. */\n  subdomainIndex?: number;\n  /**\n   * Re-issue a still-valid `_fbc` on every request as an ITP self-heal (restores the long-lived\n   * HTTP cookie if the Meta Pixel's `document.cookie` write re-capped it to 24h in Safari). On by\n   * default. Note it attaches a per-user `Set-Cookie` — and thus `no-store` — to every page\n   * response carrying an `_fbc`, defeating CDN caching of those pages; set false to strictly follow\n   * Meta's conditional-write rule and keep them cacheable. See {@link resolveClickIdCookies}.\n   */\n  refresh?: boolean;\n  /**\n   * Override the `Cache-Control` of a response we attach cookies to (default `private, no-store`).\n   * A per-user `Set-Cookie` must never end up on a shared-cache entry, or one visitor's `_fbc` would\n   * be served to everyone. Only set this false if you guarantee these responses are never cached.\n   */\n  cacheControl?: string | false;\n  /**\n   * Consent gate. Return false to skip setting cookies for this request (e.g. before the visitor has\n   * granted consent where required). Runs per request with the incoming `Request`.\n   */\n  shouldPersist?: (request: Request) => boolean;\n}\n\n/**\n * TanStack Start request middleware that persists ad click-id cookies (`_fbc`, `_rdt_cid`) on the\n * document response.\n *\n * Setting `_fbc` here — on the top document via an HTTP `Set-Cookie` header, before any client JS\n * runs — is what Meta officially recommends and the only reliable way to keep the cookie alive for\n * 90 days in Safari: ITP caps JavaScript-set cookies on a fbclid-decorated landing page to 24\n * hours, and a document response is never classified as CNAME/IP cloaking (it is the reference the\n * browser measures cloaking against).\n *\n * Register it as a global request middleware:\n * ```ts\n * // start.ts\n * import { createStart } from '@tanstack/react-start'\n * import { clickIdMiddleware } from '@shware/analytics/tanstack'\n * export const startInstance = createStart(() => ({ requestMiddleware: [clickIdMiddleware] }))\n * ```\n *\n * reference: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/fbp-and-fbc\n */\nexport function createClickIdMiddleware(options: ClickIdMiddlewareOptions = {}) {\n  const { cacheControl = 'private, no-store' } = options;\n\n  return createMiddleware({ type: 'request' }).server(async ({ request, next, handlerType }) => {\n    const result = await next();\n\n    // Skip serverFn RPC responses. 'router' covers SSR document requests *and* custom server\n    // routes (API endpoints) — those also get cookies when the URL carries a click id.\n    if (handlerType !== 'router') return result;\n    if (options.shouldPersist && !options.shouldPersist(request)) return result;\n\n    const { cookies } = resolveClickIdCookies({\n      url: request.url,\n      cookieHeader: request.headers.get('cookie'),\n      domain: options.domain,\n      secure: options.secure,\n      subdomainIndex: options.subdomainIndex,\n      refresh: options.refresh ?? true,\n    });\n\n    if (cookies.length > 0) {\n      for (const header of toSetCookieHeaders(cookies)) {\n        result.response.headers.append('set-cookie', header);\n      }\n      if (cacheControl !== false) {\n        result.response.headers.set('cache-control', cacheControl);\n      }\n    }\n\n    return result;\n  });\n}\n\n/** Ready-to-register middleware with default options. */\nexport const clickIdMiddleware = createClickIdMiddleware();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,wBAAwB,UAAoC,CAAC,GAAG;CAC9E,MAAM,EAAE,eAAe,wBAAwB;CAE/C,OAAO,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,SAAS,MAAM,kBAAkB;EAC5F,MAAM,SAAS,MAAM,KAAK;EAI1B,IAAI,gBAAgB,UAAU,OAAO;EACrC,IAAI,QAAQ,iBAAiB,CAAC,QAAQ,cAAc,OAAO,GAAG,OAAO;EAErE,MAAM,EAAE,YAAY,sBAAsB;GACxC,KAAK,QAAQ;GACb,cAAc,QAAQ,QAAQ,IAAI,QAAQ;GAC1C,QAAQ,QAAQ;GAChB,QAAQ,QAAQ;GAChB,gBAAgB,QAAQ;GACxB,SAAS,QAAQ,WAAW;EAC9B,CAAC;EAED,IAAI,QAAQ,SAAS,GAAG;GACtB,KAAK,MAAM,UAAU,mBAAmB,OAAO,GAC7C,OAAO,SAAS,QAAQ,OAAO,cAAc,MAAM;GAErD,IAAI,iBAAiB,OACnB,OAAO,SAAS,QAAQ,IAAI,iBAAiB,YAAY;EAE7D;EAEA,OAAO;CACT,CAAC;AACH;;AAGA,MAAa,oBAAoB,wBAAwB"}
+{"version":3,"file":"middleware.mjs","names":[],"sources":["../../src/tanstack/middleware.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start';\nimport { resolveClickIdCookies, toSetCookieHeaders } from '../click-id/index';\n\nexport interface ClickIdMiddlewareOptions {\n  /** `Domain` attribute for the cookies, e.g. `.shware.io`. Omit for a host-only cookie. */\n  domain?: string;\n  /** `Secure` attribute, default true. Set false only for local http testing. */\n  secure?: boolean;\n  /** subdomainIndex for a freshly built `_fbc` (com=0, example.com=1, www.example.com=2). Default 1. */\n  subdomainIndex?: number;\n  /**\n   * Re-issue a still-valid `_fbc` on every request as an ITP self-heal (restores the long-lived\n   * HTTP cookie if the Meta Pixel's `document.cookie` write re-capped it to 24h in Safari). On by\n   * default. Note it attaches a per-user `Set-Cookie` — and thus `no-store` — to every page\n   * response carrying an `_fbc`, defeating CDN caching of those pages; set false to strictly follow\n   * Meta's conditional-write rule and keep them cacheable. See {@link resolveClickIdCookies}.\n   */\n  refresh?: boolean;\n  /**\n   * Override the `Cache-Control` of a response we attach cookies to (default `private, no-store`).\n   * A per-user `Set-Cookie` must never end up on a shared-cache entry, or one visitor's `_fbc` would\n   * be served to everyone. Only set this false if you guarantee these responses are never cached.\n   */\n  cacheControl?: string | false;\n  /**\n   * Consent gate. Return false to skip setting cookies for this request (e.g. before the visitor has\n   * granted consent where required). Runs per request with the incoming `Request`.\n   */\n  shouldPersist?: (request: Request) => boolean;\n}\n\n/**\n * TanStack Start request middleware that persists ad click-id cookies (`_fbc`, `_rdt_cid`) on the\n * document response.\n *\n * Setting `_fbc` here — on the top document via an HTTP `Set-Cookie` header, before any client JS\n * runs — is what Meta officially recommends and the only reliable way to keep the cookie alive for\n * 90 days in Safari: ITP caps JavaScript-set cookies on a fbclid-decorated landing page to 24\n * hours, and a document response is never classified as CNAME/IP cloaking (it is the reference the\n * browser measures cloaking against).\n *\n * Register it as a global request middleware:\n * ```ts\n * // start.ts\n * import { createStart } from '@tanstack/react-start'\n * import { clickIdMiddleware } from '@shware/analytics/tanstack'\n * export const startInstance = createStart(() => ({ requestMiddleware: [clickIdMiddleware] }))\n * ```\n *\n * reference: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/fbp-and-fbc\n */\nexport function createClickIdMiddleware(options: ClickIdMiddlewareOptions = {}) {\n  const { cacheControl = 'private, no-store' } = options;\n\n  return createMiddleware({ type: 'request' }).server(async ({ request, next, handlerType }) => {\n    const result = await next();\n\n    // Skip serverFn RPC responses. 'router' covers SSR document requests *and* custom server\n    // routes (API endpoints) — those also get cookies when the URL carries a click id.\n    if (handlerType !== 'router') return result;\n    if (options.shouldPersist && !options.shouldPersist(request)) return result;\n\n    const { cookies } = resolveClickIdCookies({\n      url: request.url,\n      cookieHeader: request.headers.get('cookie'),\n      domain: options.domain,\n      secure: options.secure,\n      subdomainIndex: options.subdomainIndex,\n      refresh: options.refresh ?? true,\n    });\n\n    if (cookies.length > 0) {\n      for (const header of toSetCookieHeaders(cookies)) {\n        result.response.headers.append('set-cookie', header);\n      }\n      if (cacheControl !== false) {\n        result.response.headers.set('cache-control', cacheControl);\n      }\n    }\n\n    return result;\n  });\n}\n\n/** Ready-to-register middleware with default options. */\nexport const clickIdMiddleware = createClickIdMiddleware();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,wBAAwB,UAAoC,CAAC,GAAG;CAC9E,MAAM,EAAE,eAAe,wBAAwB;CAE/C,OAAO,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,SAAS,MAAM,kBAAkB;EAC5F,MAAM,SAAS,MAAM,KAAK;EAI1B,IAAI,gBAAgB,UAAU,OAAO;EACrC,IAAI,QAAQ,iBAAiB,CAAC,QAAQ,cAAc,OAAO,GAAG,OAAO;EAErE,MAAM,EAAE,YAAY,sBAAsB;GACxC,KAAK,QAAQ;GACb,cAAc,QAAQ,QAAQ,IAAI,QAAQ;GAC1C,QAAQ,QAAQ;GAChB,QAAQ,QAAQ;GAChB,gBAAgB,QAAQ;GACxB,SAAS,QAAQ,WAAW;EAC9B,CAAC;EAED,IAAI,QAAQ,SAAS,GAAG;GACtB,KAAK,MAAM,UAAU,mBAAmB,OAAO,GAC7C,OAAO,SAAS,QAAQ,OAAO,cAAc,MAAM;GAErD,IAAI,iBAAiB,OACnB,OAAO,SAAS,QAAQ,IAAI,iBAAiB,YAAY;EAE7D;EAEA,OAAO;CACT,CAAC;AACH;;AAGA,MAAa,oBAAoB,wBAAwB"}