@shware/analytics 7.2.1 → 7.3.0

package/dist/setup/session.d.cts

@@ -1,22 +1,40 @@
 //#region src/setup/session.d.ts
 declare const SESSION_TIMEOUT: number;
+/** The session an event belongs to, and whether that event is the one that started it. */
+interface SessionForEvent {
+  id: string;
+  started: boolean;
+}
 declare class Session {
-  private id;
+  /**
+   * Engagement is deliberately not stored: it is the time this page has accrued and not yet
+   * reported, so it belongs to the page, not to the session. GA4 draws the same line — its cookie
+   * carries the session, while the engagement timer lives and dies with the document.
+   */
   private startTime;
-  private lastActiveTime;
   private accumulatedTime;
   private active;
   private visible;
   private focused;
   constructor();
-  getId: () => string;
+  /**
+   * The session a batch of events belongs to: read the stored one, start a new one if it has
+   * timed out or there is none, stamp it with when those events happened and write it back. Every
+   * event goes through here, exactly as GA4 rereads and rewrites its cookie per event — caching
+   * the session in memory would put the tabs back out of step with each other.
+   */
+  touch: (eventTime: number, lastEventTime?: number) => SessionForEvent;
+  /**
+   * The id for an event that must not start a session — the `pagehide` beacon, which reports what
+   * the session now ending accrued. A live session is extended, as any event extends it; one
+   * already past its timeout still owns that engagement, so its id comes back without being
+   * revived into a session no `session_start` ever announced.
+   */
+  extend: () => string;
   isActive: () => boolean;
   isVisible: () => boolean;
   isFocused: () => boolean;
-  isExpired: () => boolean;
-  updateLastActiveTime: () => void;
   updateActive: (active: boolean) => void;
-  refresh: () => void;
   updateAccumulator: () => void;
   focus: () => void;
   blur: () => void;

package/dist/setup/session.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.cts","names":[],"sources":["../../src/setup/session.ts"],"mappings":";cAEa;cAEP;UACI;UACA;UACA;UACA;UAEA;UACA;UACA;EAER;EAWA;EAEA;EACA;EACA;EACA;EAEA;EAIA,eAAY;EAIZ;EAKA;EAWA;EAMA;EAKA;EAMA;EAKA,mBAAgB,OAAW;EAQ3B;;;;;;;;;;;;;;;;;;;;;;;;;iBAiCc,cAAU"}
+{"version":3,"file":"session.d.cts","names":[],"sources":["../../src/setup/session.ts"],"mappings":";cAIa;;UAiBH;EACR;EACA;;cA8BI;;;;;;UAMI;UACA;UAEA;UACA;UACA;EAER;;;;;;;EAeA,QAAK,mBAAqB,2BAA8B;;;;;;;EA4BxD;EAWA;EACA;EACA;EAEA,eAAY;EAIZ;EAWA;EAKA;EAKA;EAKA;EAKA,mBAAgB,OAAW;EAK3B;;;;;;;;;;;;;;;;;;;;;;;;;iBAiCc,cAAU"}

package/dist/setup/session.d.mts

@@ -1,22 +1,40 @@
 //#region src/setup/session.d.ts
 declare const SESSION_TIMEOUT: number;
+/** The session an event belongs to, and whether that event is the one that started it. */
+interface SessionForEvent {
+  id: string;
+  started: boolean;
+}
 declare class Session {
-  private id;
+  /**
+   * Engagement is deliberately not stored: it is the time this page has accrued and not yet
+   * reported, so it belongs to the page, not to the session. GA4 draws the same line — its cookie
+   * carries the session, while the engagement timer lives and dies with the document.
+   */
   private startTime;
-  private lastActiveTime;
   private accumulatedTime;
   private active;
   private visible;
   private focused;
   constructor();
-  getId: () => string;
+  /**
+   * The session a batch of events belongs to: read the stored one, start a new one if it has
+   * timed out or there is none, stamp it with when those events happened and write it back. Every
+   * event goes through here, exactly as GA4 rereads and rewrites its cookie per event — caching
+   * the session in memory would put the tabs back out of step with each other.
+   */
+  touch: (eventTime: number, lastEventTime?: number) => SessionForEvent;
+  /**
+   * The id for an event that must not start a session — the `pagehide` beacon, which reports what
+   * the session now ending accrued. A live session is extended, as any event extends it; one
+   * already past its timeout still owns that engagement, so its id comes back without being
+   * revived into a session no `session_start` ever announced.
+   */
+  extend: () => string;
   isActive: () => boolean;
   isVisible: () => boolean;
   isFocused: () => boolean;
-  isExpired: () => boolean;
-  updateLastActiveTime: () => void;
   updateActive: (active: boolean) => void;
-  refresh: () => void;
   updateAccumulator: () => void;
   focus: () => void;
   blur: () => void;

package/dist/setup/session.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.mts","names":[],"sources":["../../src/setup/session.ts"],"mappings":";cAEa;cAEP;UACI;UACA;UACA;UACA;UAEA;UACA;UACA;EAER;EAWA;EAEA;EACA;EACA;EACA;EAEA;EAIA,eAAY;EAIZ;EAKA;EAWA;EAMA;EAKA;EAMA;EAKA,mBAAgB,OAAW;EAQ3B;;;;;;;;;;;;;;;;;;;;;;;;;iBAiCc,cAAU"}
+{"version":3,"file":"session.d.mts","names":[],"sources":["../../src/setup/session.ts"],"mappings":";cAIa;;UAiBH;EACR;EACA;;cA8BI;;;;;;UAMI;UACA;UAEA;UACA;UACA;EAER;;;;;;;EAeA,QAAK,mBAAqB,2BAA8B;;;;;;;EA4BxD;EAWA;EACA;EACA;EAEA,eAAY;EAIZ;EAWA;EAKA;EAKA;EAKA;EAKA,mBAAgB,OAAW;EAK3B;;;;;;;;;;;;;;;;;;;;;;;;;iBAiCc,cAAU"}

package/dist/setup/session.mjs

@@ -1,23 +1,75 @@
+import { config } from "./index.mjs";
+import { keys } from "../constants/storage.mjs";
 import { v7 } from "uuid";
 //#region src/setup/session.ts
 const SESSION_TIMEOUT = 1800 * 1e3;
+/**
+* `<version>.<id>.<lastEventTime>`, compact and cookie-safe rather than JSON: `{`, `"`
+* and `,` all have to be percent-encoded in a cookie, and a host that wants one session across
+* its subdomains will hand `setupAnalytics` a cookie-backed `storage`, where this has to survive
+* unchanged. A uuidv7 contains no dots, so the record splits cleanly.
+*
+* The version guards a change the parser could not otherwise survive. A field appended to the end
+* does not need one — a short record simply leaves it undefined.
+*/
+const VERSION = "1";
+function readSession() {
+	const raw = config.storage.getItem(keys.session);
+	if (!raw) return void 0;
+	const [version, id, lastEventTime] = raw.split(".");
+	if (version !== VERSION || !id) return void 0;
+	const parsed = {
+		id,
+		lastEventTime: Number(lastEventTime)
+	};
+	if (!Number.isFinite(parsed.lastEventTime)) return void 0;
+	return parsed;
+}
+function writeSession({ id, lastEventTime }) {
+	config.storage.setItem(keys.session, `${VERSION}.${id}.${lastEventTime}`);
+}
 var Session = class {
 	constructor() {
-		this.getId = () => this.id;
+		this.touch = (eventTime, lastEventTime = eventTime) => {
+			const stored = readSession();
+			if (stored && eventTime - stored.lastEventTime <= 18e5) {
+				writeSession({
+					...stored,
+					lastEventTime: Math.max(stored.lastEventTime, lastEventTime)
+				});
+				return {
+					id: stored.id,
+					started: false
+				};
+			}
+			this.accumulatedTime = 0;
+			this.startTime = Date.now();
+			const session = {
+				id: v7(),
+				lastEventTime
+			};
+			writeSession(session);
+			return {
+				id: session.id,
+				started: true
+			};
+		};
+		this.extend = () => {
+			const stored = readSession();
+			if (!stored) return this.touch(Date.now()).id;
+			const now = Date.now();
+			if (now - stored.lastEventTime <= 18e5) writeSession({
+				...stored,
+				lastEventTime: now
+			});
+			return stored.id;
+		};
 		this.isActive = () => this.active;
 		this.isVisible = () => this.visible;
 		this.isFocused = () => this.focused;
-		this.isExpired = () => Date.now() - this.lastActiveTime > SESSION_TIMEOUT;
-		this.updateLastActiveTime = () => {
-			this.lastActiveTime = Date.now();
-		};
 		this.updateActive = (active) => {
 			this.active = active;
 		};
-		this.refresh = () => {
-			this.id = v7();
-			this.lastActiveTime = Date.now();
-		};
 		this.updateAccumulator = () => {
 			const now = Date.now();
 			if (this.focused && this.visible && this.active) {
@@ -28,7 +80,6 @@ var Session = class {
 		};
 		this.focus = () => {
 			this.updateAccumulator();
-			this.updateLastActiveTime();
 			this.focused = true;
 		};
 		this.blur = () => {
@@ -37,7 +88,6 @@ var Session = class {
 		};
 		this.pageshow = () => {
 			this.updateAccumulator();
-			this.updateLastActiveTime();
 			this.active = true;
 		};
 		this.pagehide = () => {
@@ -46,7 +96,6 @@ var Session = class {
 		};
 		this.visibilitychange = (state) => {
 			this.updateAccumulator();
-			if (state === "visible") this.updateLastActiveTime();
 			this.visible = state === "visible";
 		};
 		this.flush = () => {
@@ -55,9 +104,7 @@ var Session = class {
 			this.accumulatedTime = 0;
 			return engagementTime;
 		};
-		this.id = v7();
 		this.startTime = Date.now();
-		this.lastActiveTime = Date.now();
 		this.accumulatedTime = 0;
 		this.active = true;
 		this.visible = typeof document !== "undefined" ? document.visibilityState === "visible" : true;

package/dist/setup/session.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"session.mjs","names":["uuidv7"],"sources":["../../src/setup/session.ts"],"sourcesContent":["import { v7 as uuidv7 } from 'uuid';\n\nexport const SESSION_TIMEOUT = 30 * 60 * 1000;\n\nclass Session {\n  private id: string;\n  private startTime: number;\n  private lastActiveTime: number;\n  private accumulatedTime: number;\n\n  private active: boolean;\n  private visible: boolean;\n  private focused: boolean;\n\n  constructor() {\n    this.id = uuidv7();\n    this.startTime = Date.now();\n    this.lastActiveTime = Date.now();\n    this.accumulatedTime = 0;\n\n    this.active = true;\n    this.visible = typeof document !== 'undefined' ? document.visibilityState === 'visible' : true;\n    this.focused = typeof document !== 'undefined' ? document.hasFocus() : true;\n  }\n\n  getId = () => this.id;\n\n  isActive = () => this.active;\n  isVisible = () => this.visible;\n  isFocused = () => this.focused;\n  isExpired = () => Date.now() - this.lastActiveTime > SESSION_TIMEOUT;\n\n  updateLastActiveTime = () => {\n    this.lastActiveTime = Date.now();\n  };\n\n  updateActive = (active: boolean) => {\n    this.active = active;\n  };\n\n  refresh = () => {\n    this.id = uuidv7();\n    this.lastActiveTime = Date.now();\n  };\n\n  updateAccumulator = () => {\n    const now = Date.now();\n    if (this.focused && this.visible && this.active) {\n      const delta = now - this.startTime;\n      if (delta > 0 && delta < SESSION_TIMEOUT) {\n        this.accumulatedTime += delta;\n      }\n    }\n    this.startTime = now;\n  };\n\n  focus = () => {\n    this.updateAccumulator();\n    this.updateLastActiveTime();\n    this.focused = true;\n  };\n\n  blur = () => {\n    this.updateAccumulator();\n    this.focused = false;\n  };\n\n  pageshow = () => {\n    this.updateAccumulator();\n    this.updateLastActiveTime();\n    this.active = true;\n  };\n\n  pagehide = () => {\n    this.updateAccumulator();\n    this.active = false;\n  };\n\n  visibilitychange = (state: DocumentVisibilityState) => {\n    this.updateAccumulator();\n    if (state === 'visible') {\n      this.updateLastActiveTime();\n    }\n    this.visible = state === 'visible';\n  };\n\n  flush = () => {\n    this.updateAccumulator();\n    const engagementTime = this.accumulatedTime;\n    this.accumulatedTime = 0;\n    return engagementTime;\n  };\n}\n\nlet session: Session | undefined;\n\n/**\n * The session, built the first time something asks for it.\n *\n * Deliberately not a module-scope `new Session()`. The constructor calls\n * `uuidv7()`, `uuid` draws its bytes from `crypto.getRandomValues`, and\n * Cloudflare Workers reject that outside a request handler:\n *\n *   Disallowed operation called within global scope. Asynchronous I/O\n *   (ex: fetch() or connect()), setting a timeout, and generating random\n *   values are not allowed within global scope.\n *\n * Module scope in a Worker is evaluated once when the isolate boots and is\n * then shared by every request that isolate serves, so a random value drawn\n * there would be the same for all of them — which is why the runtime refuses\n * to produce one. A host that server-renders on Workers reaches this module\n * through `track()` on the server as well, and the throw happened as the\n * isolate booted, taking down every route before a component rendered.\n *\n * Everything here is per-visitor browser or app state, so deferring the\n * construction costs nothing and buys two things: the server bundle can be\n * evaluated, and `startTime` marks when the session actually began rather\n * than when the isolate happened to start.\n */\nexport function getSession() {\n  return (session ??= new Session());\n}\n"],"mappings":";;AAEA,MAAa,kBAAkB,OAAU;AAEzC,IAAM,UAAN,MAAc;CAUZ,cAAc;EAWA,KAAA,cAAA,KAAK;EAEF,KAAA,iBAAA,KAAK;EACJ,KAAA,kBAAA,KAAK;EACL,KAAA,kBAAA,KAAK;EACL,KAAA,kBAAA,KAAK,IAAI,IAAI,KAAK,iBAAiB;EAExB,KAAA,6BAAA;GAC3B,KAAK,iBAAiB,KAAK,IAAI;EACjC;EAEgB,KAAA,gBAAA,WAAoB;GAClC,KAAK,SAAS;EAChB;EAEgB,KAAA,gBAAA;GACd,KAAK,KAAKA,GAAO;GACjB,KAAK,iBAAiB,KAAK,IAAI;EACjC;EAE0B,KAAA,0BAAA;GACxB,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,KAAK,WAAW,KAAK,WAAW,KAAK,QAAQ;IAC/C,MAAM,QAAQ,MAAM,KAAK;IACzB,IAAI,QAAQ,KAAK,QAAA,MACf,KAAK,mBAAmB;GAE5B;GACA,KAAK,YAAY;EACnB;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,KAAK,qBAAqB;GAC1B,KAAK,UAAU;EACjB;EAEa,KAAA,aAAA;GACX,KAAK,kBAAkB;GACvB,KAAK,UAAU;EACjB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,qBAAqB;GAC1B,KAAK,SAAS;EAChB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,SAAS;EAChB;EAEoB,KAAA,oBAAA,UAAmC;GACrD,KAAK,kBAAkB;GACvB,IAAI,UAAU,WACZ,KAAK,qBAAqB;GAE5B,KAAK,UAAU,UAAU;EAC3B;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,MAAM,iBAAiB,KAAK;GAC5B,KAAK,kBAAkB;GACvB,OAAO;EACT;EA5EE,KAAK,KAAKA,GAAO;EACjB,KAAK,YAAY,KAAK,IAAI;EAC1B,KAAK,iBAAiB,KAAK,IAAI;EAC/B,KAAK,kBAAkB;EAEvB,KAAK,SAAS;EACd,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,oBAAoB,YAAY;EAC1F,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,SAAS,IAAI;CACzE;AAqEF;AAEA,IAAI;;;;;;;;;;;;;;;;;;;;;;;;AAyBJ,SAAgB,aAAa;CAC3B,OAAQ,YAAY,IAAI,QAAQ;AAClC"}
+{"version":3,"file":"session.mjs","names":["uuidv7"],"sources":["../../src/setup/session.ts"],"sourcesContent":["import { v7 as uuidv7 } from 'uuid';\nimport { keys } from '../constants/storage';\nimport { config } from './index';\n\nexport const SESSION_TIMEOUT = 30 * 60 * 1000;\n\n/**\n * The part of a session that outlives the page: its identity, and the clock the timeout is\n * measured against. GA4 keeps these in its `_ga_<container>` cookie — alongside the engaged flag,\n * which arrives with `session_engaged` later — and rereads them for every event, which is what\n * makes a session survive a reload, span a whole multipage visit, and stay shared between two\n * tabs of the same site. Holding them in memory instead, as this did, starts a new session on\n * every full navigation and gives every tab one of its own.\n */\ninterface StoredSession {\n  id: string;\n  /** When the last event was sent. The timeout is measured from here, and only from here. */\n  lastEventTime: number;\n}\n\n/** The session an event belongs to, and whether that event is the one that started it. */\ninterface SessionForEvent {\n  id: string;\n  started: boolean;\n}\n\n/**\n * `<version>.<id>.<lastEventTime>`, compact and cookie-safe rather than JSON: `{`, `\"`\n * and `,` all have to be percent-encoded in a cookie, and a host that wants one session across\n * its subdomains will hand `setupAnalytics` a cookie-backed `storage`, where this has to survive\n * unchanged. A uuidv7 contains no dots, so the record splits cleanly.\n *\n * The version guards a change the parser could not otherwise survive. A field appended to the end\n * does not need one — a short record simply leaves it undefined.\n */\nconst VERSION = '1';\n\nfunction readSession(): StoredSession | undefined {\n  const raw = config.storage.getItem(keys.session);\n  if (!raw) return undefined;\n\n  const [version, id, lastEventTime] = raw.split('.');\n  if (version !== VERSION || !id) return undefined;\n\n  const parsed = { id, lastEventTime: Number(lastEventTime) };\n  if (!Number.isFinite(parsed.lastEventTime)) return undefined;\n  return parsed;\n}\n\nfunction writeSession({ id, lastEventTime }: StoredSession) {\n  config.storage.setItem(keys.session, `${VERSION}.${id}.${lastEventTime}`);\n}\n\nclass Session {\n  /**\n   * Engagement is deliberately not stored: it is the time this page has accrued and not yet\n   * reported, so it belongs to the page, not to the session. GA4 draws the same line — its cookie\n   * carries the session, while the engagement timer lives and dies with the document.\n   */\n  private startTime: number;\n  private accumulatedTime: number;\n\n  private active: boolean;\n  private visible: boolean;\n  private focused: boolean;\n\n  constructor() {\n    this.startTime = Date.now();\n    this.accumulatedTime = 0;\n\n    this.active = true;\n    this.visible = typeof document !== 'undefined' ? document.visibilityState === 'visible' : true;\n    this.focused = typeof document !== 'undefined' ? document.hasFocus() : true;\n  }\n\n  /**\n   * The session a batch of events belongs to: read the stored one, start a new one if it has\n   * timed out or there is none, stamp it with when those events happened and write it back. Every\n   * event goes through here, exactly as GA4 rereads and rewrites its cookie per event — caching\n   * the session in memory would put the tabs back out of step with each other.\n   */\n  touch = (eventTime: number, lastEventTime = eventTime): SessionForEvent => {\n    const stored = readSession();\n\n    if (stored && eventTime - stored.lastEventTime <= SESSION_TIMEOUT) {\n      // `Math.max`, because a batch that waited in a frozen tab can be older than what another\n      // tab has since written, and a session must never be shortened by a late arrival.\n      writeSession({ ...stored, lastEventTime: Math.max(stored.lastEventTime, lastEventTime) });\n      return { id: stored.id, started: false };\n    }\n\n    // Engagement the previous session accrued but never reported dies with it rather than being\n    // handed to its successor. GA4 does the same on `session_start`.\n    this.accumulatedTime = 0;\n    // Wall clock, not `eventTime`: this anchors the engagement timer for the page in front of the\n    // visitor now, which a batch describing something that happened an hour ago says nothing about.\n    this.startTime = Date.now();\n\n    const session: StoredSession = { id: uuidv7(), lastEventTime };\n    writeSession(session);\n    return { id: session.id, started: true };\n  };\n\n  /**\n   * The id for an event that must not start a session — the `pagehide` beacon, which reports what\n   * the session now ending accrued. A live session is extended, as any event extends it; one\n   * already past its timeout still owns that engagement, so its id comes back without being\n   * revived into a session no `session_start` ever announced.\n   */\n  extend = (): string => {\n    const stored = readSession();\n    if (!stored) return this.touch(Date.now()).id;\n\n    const now = Date.now();\n    if (now - stored.lastEventTime <= SESSION_TIMEOUT) {\n      writeSession({ ...stored, lastEventTime: now });\n    }\n    return stored.id;\n  };\n\n  isActive = () => this.active;\n  isVisible = () => this.visible;\n  isFocused = () => this.focused;\n\n  updateActive = (active: boolean) => {\n    this.active = active;\n  };\n\n  updateAccumulator = () => {\n    const now = Date.now();\n    if (this.focused && this.visible && this.active) {\n      const delta = now - this.startTime;\n      if (delta > 0 && delta < SESSION_TIMEOUT) {\n        this.accumulatedTime += delta;\n      }\n    }\n    this.startTime = now;\n  };\n\n  focus = () => {\n    this.updateAccumulator();\n    this.focused = true;\n  };\n\n  blur = () => {\n    this.updateAccumulator();\n    this.focused = false;\n  };\n\n  pageshow = () => {\n    this.updateAccumulator();\n    this.active = true;\n  };\n\n  pagehide = () => {\n    this.updateAccumulator();\n    this.active = false;\n  };\n\n  visibilitychange = (state: DocumentVisibilityState) => {\n    this.updateAccumulator();\n    this.visible = state === 'visible';\n  };\n\n  flush = () => {\n    this.updateAccumulator();\n    const engagementTime = this.accumulatedTime;\n    this.accumulatedTime = 0;\n    return engagementTime;\n  };\n}\n\nlet session: Session | undefined;\n\n/**\n * The session, built the first time something asks for it.\n *\n * Deliberately not a module-scope `new Session()`. The constructor calls\n * `uuidv7()`, `uuid` draws its bytes from `crypto.getRandomValues`, and\n * Cloudflare Workers reject that outside a request handler:\n *\n *   Disallowed operation called within global scope. Asynchronous I/O\n *   (ex: fetch() or connect()), setting a timeout, and generating random\n *   values are not allowed within global scope.\n *\n * Module scope in a Worker is evaluated once when the isolate boots and is\n * then shared by every request that isolate serves, so a random value drawn\n * there would be the same for all of them — which is why the runtime refuses\n * to produce one. A host that server-renders on Workers reaches this module\n * through `track()` on the server as well, and the throw happened as the\n * isolate booted, taking down every route before a component rendered.\n *\n * Everything here is per-visitor browser or app state, so deferring the\n * construction costs nothing and buys two things: the server bundle can be\n * evaluated, and `startTime` marks when the session actually began rather\n * than when the isolate happened to start.\n */\nexport function getSession() {\n  return (session ??= new Session());\n}\n"],"mappings":";;;;AAIA,MAAa,kBAAkB,OAAU;;;;;;;;;;AA+BzC,MAAM,UAAU;AAEhB,SAAS,cAAyC;CAChD,MAAM,MAAM,OAAO,QAAQ,QAAQ,KAAK,OAAO;CAC/C,IAAI,CAAC,KAAK,OAAO,KAAA;CAEjB,MAAM,CAAC,SAAS,IAAI,iBAAiB,IAAI,MAAM,GAAG;CAClD,IAAI,YAAY,WAAW,CAAC,IAAI,OAAO,KAAA;CAEvC,MAAM,SAAS;EAAE;EAAI,eAAe,OAAO,aAAa;CAAE;CAC1D,IAAI,CAAC,OAAO,SAAS,OAAO,aAAa,GAAG,OAAO,KAAA;CACnD,OAAO;AACT;AAEA,SAAS,aAAa,EAAE,IAAI,iBAAgC;CAC1D,OAAO,QAAQ,QAAQ,KAAK,SAAS,GAAG,QAAQ,GAAG,GAAG,GAAG,eAAe;AAC1E;AAEA,IAAM,UAAN,MAAc;CAaZ,cAAc;EAeL,KAAA,SAAA,WAAmB,gBAAgB,cAA+B;GACzE,MAAM,SAAS,YAAY;GAE3B,IAAI,UAAU,YAAY,OAAO,iBAAA,MAAkC;IAGjE,aAAa;KAAE,GAAG;KAAQ,eAAe,KAAK,IAAI,OAAO,eAAe,aAAa;IAAE,CAAC;IACxF,OAAO;KAAE,IAAI,OAAO;KAAI,SAAS;IAAM;GACzC;GAIA,KAAK,kBAAkB;GAGvB,KAAK,YAAY,KAAK,IAAI;GAE1B,MAAM,UAAyB;IAAE,IAAIA,GAAO;IAAG;GAAc;GAC7D,aAAa,OAAO;GACpB,OAAO;IAAE,IAAI,QAAQ;IAAI,SAAS;GAAK;EACzC;EAQuB,KAAA,eAAA;GACrB,MAAM,SAAS,YAAY;GAC3B,IAAI,CAAC,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC;GAE3C,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,MAAM,OAAO,iBAAA,MACf,aAAa;IAAE,GAAG;IAAQ,eAAe;GAAI,CAAC;GAEhD,OAAO,OAAO;EAChB;EAEiB,KAAA,iBAAA,KAAK;EACJ,KAAA,kBAAA,KAAK;EACL,KAAA,kBAAA,KAAK;EAEP,KAAA,gBAAA,WAAoB;GAClC,KAAK,SAAS;EAChB;EAE0B,KAAA,0BAAA;GACxB,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,KAAK,WAAW,KAAK,WAAW,KAAK,QAAQ;IAC/C,MAAM,QAAQ,MAAM,KAAK;IACzB,IAAI,QAAQ,KAAK,QAAA,MACf,KAAK,mBAAmB;GAE5B;GACA,KAAK,YAAY;EACnB;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,KAAK,UAAU;EACjB;EAEa,KAAA,aAAA;GACX,KAAK,kBAAkB;GACvB,KAAK,UAAU;EACjB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,SAAS;EAChB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,SAAS;EAChB;EAEoB,KAAA,oBAAA,UAAmC;GACrD,KAAK,kBAAkB;GACvB,KAAK,UAAU,UAAU;EAC3B;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,MAAM,iBAAiB,KAAK;GAC5B,KAAK,kBAAkB;GACvB,OAAO;EACT;EAtGE,KAAK,YAAY,KAAK,IAAI;EAC1B,KAAK,kBAAkB;EAEvB,KAAK,SAAS;EACd,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,oBAAoB,YAAY;EAC1F,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,SAAS,IAAI;CACzE;AAiGF;AAEA,IAAI;;;;;;;;;;;;;;;;;;;;;;;;AAyBJ,SAAgB,aAAa;CAC3B,OAAQ,YAAY,IAAI,QAAQ;AAClC"}

package/dist/tanstack/middleware.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.cjs","names":["resolveClickIdCookies","toSetCookieHeaders"],"sources":["../../src/tanstack/middleware.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start';\nimport { resolveClickIdCookies, toSetCookieHeaders } from '../click-id/index';\n\nexport interface ClickIdMiddlewareOptions {\n  /** `Domain` attribute for the cookies, e.g. `.edensign.io`. Omit for a host-only cookie. */\n  domain?: string;\n  /** `Secure` attribute, default true. Set false only for local http testing. */\n  secure?: boolean;\n  /** subdomainIndex for a freshly built `_fbc` (com=0, example.com=1, www.example.com=2). Default 1. */\n  subdomainIndex?: number;\n  /**\n   * Re-issue a still-valid `_fbc` on every request as an ITP self-heal (restores the long-lived\n   * HTTP cookie if the Meta Pixel's `document.cookie` write re-capped it to 24h in Safari). On by\n   * default. Note it attaches a per-user `Set-Cookie` — and thus `no-store` — to every page\n   * response carrying an `_fbc`, defeating CDN caching of those pages; set false to strictly follow\n   * Meta's conditional-write rule and keep them cacheable. See {@link resolveClickIdCookies}.\n   */\n  refresh?: boolean;\n  /**\n   * Override the `Cache-Control` of a response we attach cookies to (default `private, no-store`).\n   * A per-user `Set-Cookie` must never end up on a shared-cache entry, or one visitor's `_fbc` would\n   * be served to everyone. Only set this false if you guarantee these responses are never cached.\n   */\n  cacheControl?: string | false;\n  /**\n   * Consent gate. Return false to skip setting cookies for this request (e.g. before the visitor has\n   * granted consent where required). Runs per request with the incoming `Request`.\n   */\n  shouldPersist?: (request: Request) => boolean;\n}\n\n/**\n * TanStack Start request middleware that persists ad click-id cookies (`_fbc`, `_rdt_cid`) on the\n * document response.\n *\n * Setting `_fbc` here — on the top document via an HTTP `Set-Cookie` header, before any client JS\n * runs — is what Meta officially recommends and the only reliable way to keep the cookie alive for\n * 90 days in Safari: ITP caps JavaScript-set cookies on a fbclid-decorated landing page to 24\n * hours, and a document response is never classified as CNAME/IP cloaking (it is the reference the\n * browser measures cloaking against).\n *\n * Register it as a global request middleware:\n * ```ts\n * // start.ts\n * import { createStart } from '@tanstack/react-start'\n * import { clickIdMiddleware } from '@shware/analytics/tanstack'\n * export const startInstance = createStart(() => ({ requestMiddleware: [clickIdMiddleware] }))\n * ```\n *\n * reference: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/fbp-and-fbc\n */\nexport function createClickIdMiddleware(options: ClickIdMiddlewareOptions = {}) {\n  const { cacheControl = 'private, no-store' } = options;\n\n  return createMiddleware({ type: 'request' }).server(async ({ request, next, handlerType }) => {\n    const result = await next();\n\n    // Skip serverFn RPC responses. 'router' covers SSR document requests *and* custom server\n    // routes (API endpoints) — those also get cookies when the URL carries a click id.\n    if (handlerType !== 'router') return result;\n    if (options.shouldPersist && !options.shouldPersist(request)) return result;\n\n    const { cookies } = resolveClickIdCookies({\n      url: request.url,\n      cookieHeader: request.headers.get('cookie'),\n      domain: options.domain,\n      secure: options.secure,\n      subdomainIndex: options.subdomainIndex,\n      refresh: options.refresh ?? true,\n    });\n\n    if (cookies.length > 0) {\n      for (const header of toSetCookieHeaders(cookies)) {\n        result.response.headers.append('set-cookie', header);\n      }\n      if (cacheControl !== false) {\n        result.response.headers.set('cache-control', cacheControl);\n      }\n    }\n\n    return result;\n  });\n}\n\n/** Ready-to-register middleware with default options. */\nexport const clickIdMiddleware = createClickIdMiddleware();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,wBAAwB,UAAoC,CAAC,GAAG;CAC9E,MAAM,EAAE,eAAe,wBAAwB;CAE/C,QAAA,GAAA,sBAAA,iBAAA,CAAwB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,SAAS,MAAM,kBAAkB;EAC5F,MAAM,SAAS,MAAM,KAAK;EAI1B,IAAI,gBAAgB,UAAU,OAAO;EACrC,IAAI,QAAQ,iBAAiB,CAAC,QAAQ,cAAc,OAAO,GAAG,OAAO;EAErE,MAAM,EAAE,YAAYA,uBAAAA,sBAAsB;GACxC,KAAK,QAAQ;GACb,cAAc,QAAQ,QAAQ,IAAI,QAAQ;GAC1C,QAAQ,QAAQ;GAChB,QAAQ,QAAQ;GAChB,gBAAgB,QAAQ;GACxB,SAAS,QAAQ,WAAW;EAC9B,CAAC;EAED,IAAI,QAAQ,SAAS,GAAG;GACtB,KAAK,MAAM,UAAUC,uBAAAA,mBAAmB,OAAO,GAC7C,OAAO,SAAS,QAAQ,OAAO,cAAc,MAAM;GAErD,IAAI,iBAAiB,OACnB,OAAO,SAAS,QAAQ,IAAI,iBAAiB,YAAY;EAE7D;EAEA,OAAO;CACT,CAAC;AACH;;AAGA,MAAa,oBAAoB,wBAAwB"}
+{"version":3,"file":"middleware.cjs","names":["resolveClickIdCookies","toSetCookieHeaders"],"sources":["../../src/tanstack/middleware.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start';\nimport { resolveClickIdCookies, toSetCookieHeaders } from '../click-id/index';\n\nexport interface ClickIdMiddlewareOptions {\n  /** `Domain` attribute for the cookies, e.g. `.shware.io`. Omit for a host-only cookie. */\n  domain?: string;\n  /** `Secure` attribute, default true. Set false only for local http testing. */\n  secure?: boolean;\n  /** subdomainIndex for a freshly built `_fbc` (com=0, example.com=1, www.example.com=2). Default 1. */\n  subdomainIndex?: number;\n  /**\n   * Re-issue a still-valid `_fbc` on every request as an ITP self-heal (restores the long-lived\n   * HTTP cookie if the Meta Pixel's `document.cookie` write re-capped it to 24h in Safari). On by\n   * default. Note it attaches a per-user `Set-Cookie` — and thus `no-store` — to every page\n   * response carrying an `_fbc`, defeating CDN caching of those pages; set false to strictly follow\n   * Meta's conditional-write rule and keep them cacheable. See {@link resolveClickIdCookies}.\n   */\n  refresh?: boolean;\n  /**\n   * Override the `Cache-Control` of a response we attach cookies to (default `private, no-store`).\n   * A per-user `Set-Cookie` must never end up on a shared-cache entry, or one visitor's `_fbc` would\n   * be served to everyone. Only set this false if you guarantee these responses are never cached.\n   */\n  cacheControl?: string | false;\n  /**\n   * Consent gate. Return false to skip setting cookies for this request (e.g. before the visitor has\n   * granted consent where required). Runs per request with the incoming `Request`.\n   */\n  shouldPersist?: (request: Request) => boolean;\n}\n\n/**\n * TanStack Start request middleware that persists ad click-id cookies (`_fbc`, `_rdt_cid`) on the\n * document response.\n *\n * Setting `_fbc` here — on the top document via an HTTP `Set-Cookie` header, before any client JS\n * runs — is what Meta officially recommends and the only reliable way to keep the cookie alive for\n * 90 days in Safari: ITP caps JavaScript-set cookies on a fbclid-decorated landing page to 24\n * hours, and a document response is never classified as CNAME/IP cloaking (it is the reference the\n * browser measures cloaking against).\n *\n * Register it as a global request middleware:\n * ```ts\n * // start.ts\n * import { createStart } from '@tanstack/react-start'\n * import { clickIdMiddleware } from '@shware/analytics/tanstack'\n * export const startInstance = createStart(() => ({ requestMiddleware: [clickIdMiddleware] }))\n * ```\n *\n * reference: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/fbp-and-fbc\n */\nexport function createClickIdMiddleware(options: ClickIdMiddlewareOptions = {}) {\n  const { cacheControl = 'private, no-store' } = options;\n\n  return createMiddleware({ type: 'request' }).server(async ({ request, next, handlerType }) => {\n    const result = await next();\n\n    // Skip serverFn RPC responses. 'router' covers SSR document requests *and* custom server\n    // routes (API endpoints) — those also get cookies when the URL carries a click id.\n    if (handlerType !== 'router') return result;\n    if (options.shouldPersist && !options.shouldPersist(request)) return result;\n\n    const { cookies } = resolveClickIdCookies({\n      url: request.url,\n      cookieHeader: request.headers.get('cookie'),\n      domain: options.domain,\n      secure: options.secure,\n      subdomainIndex: options.subdomainIndex,\n      refresh: options.refresh ?? true,\n    });\n\n    if (cookies.length > 0) {\n      for (const header of toSetCookieHeaders(cookies)) {\n        result.response.headers.append('set-cookie', header);\n      }\n      if (cacheControl !== false) {\n        result.response.headers.set('cache-control', cacheControl);\n      }\n    }\n\n    return result;\n  });\n}\n\n/** Ready-to-register middleware with default options. */\nexport const clickIdMiddleware = createClickIdMiddleware();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,wBAAwB,UAAoC,CAAC,GAAG;CAC9E,MAAM,EAAE,eAAe,wBAAwB;CAE/C,QAAA,GAAA,sBAAA,iBAAA,CAAwB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,SAAS,MAAM,kBAAkB;EAC5F,MAAM,SAAS,MAAM,KAAK;EAI1B,IAAI,gBAAgB,UAAU,OAAO;EACrC,IAAI,QAAQ,iBAAiB,CAAC,QAAQ,cAAc,OAAO,GAAG,OAAO;EAErE,MAAM,EAAE,YAAYA,uBAAAA,sBAAsB;GACxC,KAAK,QAAQ;GACb,cAAc,QAAQ,QAAQ,IAAI,QAAQ;GAC1C,QAAQ,QAAQ;GAChB,QAAQ,QAAQ;GAChB,gBAAgB,QAAQ;GACxB,SAAS,QAAQ,WAAW;EAC9B,CAAC;EAED,IAAI,QAAQ,SAAS,GAAG;GACtB,KAAK,MAAM,UAAUC,uBAAAA,mBAAmB,OAAO,GAC7C,OAAO,SAAS,QAAQ,OAAO,cAAc,MAAM;GAErD,IAAI,iBAAiB,OACnB,OAAO,SAAS,QAAQ,IAAI,iBAAiB,YAAY;EAE7D;EAEA,OAAO;CACT,CAAC;AACH;;AAGA,MAAa,oBAAoB,wBAAwB"}

package/dist/tanstack/middleware.d.cts

@@ -1,6 +1,6 @@
 //#region src/tanstack/middleware.d.ts
 interface ClickIdMiddlewareOptions {
-  /** `Domain` attribute for the cookies, e.g. `.edensign.io`. Omit for a host-only cookie. */
+  /** `Domain` attribute for the cookies, e.g. `.shware.io`. Omit for a host-only cookie. */
   domain?: string;
   /** `Secure` attribute, default true. Set false only for local http testing. */
   secure?: boolean;

package/dist/tanstack/middleware.d.mts

@@ -1,6 +1,6 @@
 //#region src/tanstack/middleware.d.ts
 interface ClickIdMiddlewareOptions {
-  /** `Domain` attribute for the cookies, e.g. `.edensign.io`. Omit for a host-only cookie. */
+  /** `Domain` attribute for the cookies, e.g. `.shware.io`. Omit for a host-only cookie. */
   domain?: string;
   /** `Secure` attribute, default true. Set false only for local http testing. */
   secure?: boolean;

package/dist/tanstack/middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.mjs","names":[],"sources":["../../src/tanstack/middleware.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start';\nimport { resolveClickIdCookies, toSetCookieHeaders } from '../click-id/index';\n\nexport interface ClickIdMiddlewareOptions {\n  /** `Domain` attribute for the cookies, e.g. `.edensign.io`. Omit for a host-only cookie. */\n  domain?: string;\n  /** `Secure` attribute, default true. Set false only for local http testing. */\n  secure?: boolean;\n  /** subdomainIndex for a freshly built `_fbc` (com=0, example.com=1, www.example.com=2). Default 1. */\n  subdomainIndex?: number;\n  /**\n   * Re-issue a still-valid `_fbc` on every request as an ITP self-heal (restores the long-lived\n   * HTTP cookie if the Meta Pixel's `document.cookie` write re-capped it to 24h in Safari). On by\n   * default. Note it attaches a per-user `Set-Cookie` — and thus `no-store` — to every page\n   * response carrying an `_fbc`, defeating CDN caching of those pages; set false to strictly follow\n   * Meta's conditional-write rule and keep them cacheable. See {@link resolveClickIdCookies}.\n   */\n  refresh?: boolean;\n  /**\n   * Override the `Cache-Control` of a response we attach cookies to (default `private, no-store`).\n   * A per-user `Set-Cookie` must never end up on a shared-cache entry, or one visitor's `_fbc` would\n   * be served to everyone. Only set this false if you guarantee these responses are never cached.\n   */\n  cacheControl?: string | false;\n  /**\n   * Consent gate. Return false to skip setting cookies for this request (e.g. before the visitor has\n   * granted consent where required). Runs per request with the incoming `Request`.\n   */\n  shouldPersist?: (request: Request) => boolean;\n}\n\n/**\n * TanStack Start request middleware that persists ad click-id cookies (`_fbc`, `_rdt_cid`) on the\n * document response.\n *\n * Setting `_fbc` here — on the top document via an HTTP `Set-Cookie` header, before any client JS\n * runs — is what Meta officially recommends and the only reliable way to keep the cookie alive for\n * 90 days in Safari: ITP caps JavaScript-set cookies on a fbclid-decorated landing page to 24\n * hours, and a document response is never classified as CNAME/IP cloaking (it is the reference the\n * browser measures cloaking against).\n *\n * Register it as a global request middleware:\n * ```ts\n * // start.ts\n * import { createStart } from '@tanstack/react-start'\n * import { clickIdMiddleware } from '@shware/analytics/tanstack'\n * export const startInstance = createStart(() => ({ requestMiddleware: [clickIdMiddleware] }))\n * ```\n *\n * reference: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/fbp-and-fbc\n */\nexport function createClickIdMiddleware(options: ClickIdMiddlewareOptions = {}) {\n  const { cacheControl = 'private, no-store' } = options;\n\n  return createMiddleware({ type: 'request' }).server(async ({ request, next, handlerType }) => {\n    const result = await next();\n\n    // Skip serverFn RPC responses. 'router' covers SSR document requests *and* custom server\n    // routes (API endpoints) — those also get cookies when the URL carries a click id.\n    if (handlerType !== 'router') return result;\n    if (options.shouldPersist && !options.shouldPersist(request)) return result;\n\n    const { cookies } = resolveClickIdCookies({\n      url: request.url,\n      cookieHeader: request.headers.get('cookie'),\n      domain: options.domain,\n      secure: options.secure,\n      subdomainIndex: options.subdomainIndex,\n      refresh: options.refresh ?? true,\n    });\n\n    if (cookies.length > 0) {\n      for (const header of toSetCookieHeaders(cookies)) {\n        result.response.headers.append('set-cookie', header);\n      }\n      if (cacheControl !== false) {\n        result.response.headers.set('cache-control', cacheControl);\n      }\n    }\n\n    return result;\n  });\n}\n\n/** Ready-to-register middleware with default options. */\nexport const clickIdMiddleware = createClickIdMiddleware();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,wBAAwB,UAAoC,CAAC,GAAG;CAC9E,MAAM,EAAE,eAAe,wBAAwB;CAE/C,OAAO,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,SAAS,MAAM,kBAAkB;EAC5F,MAAM,SAAS,MAAM,KAAK;EAI1B,IAAI,gBAAgB,UAAU,OAAO;EACrC,IAAI,QAAQ,iBAAiB,CAAC,QAAQ,cAAc,OAAO,GAAG,OAAO;EAErE,MAAM,EAAE,YAAY,sBAAsB;GACxC,KAAK,QAAQ;GACb,cAAc,QAAQ,QAAQ,IAAI,QAAQ;GAC1C,QAAQ,QAAQ;GAChB,QAAQ,QAAQ;GAChB,gBAAgB,QAAQ;GACxB,SAAS,QAAQ,WAAW;EAC9B,CAAC;EAED,IAAI,QAAQ,SAAS,GAAG;GACtB,KAAK,MAAM,UAAU,mBAAmB,OAAO,GAC7C,OAAO,SAAS,QAAQ,OAAO,cAAc,MAAM;GAErD,IAAI,iBAAiB,OACnB,OAAO,SAAS,QAAQ,IAAI,iBAAiB,YAAY;EAE7D;EAEA,OAAO;CACT,CAAC;AACH;;AAGA,MAAa,oBAAoB,wBAAwB"}
+{"version":3,"file":"middleware.mjs","names":[],"sources":["../../src/tanstack/middleware.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start';\nimport { resolveClickIdCookies, toSetCookieHeaders } from '../click-id/index';\n\nexport interface ClickIdMiddlewareOptions {\n  /** `Domain` attribute for the cookies, e.g. `.shware.io`. Omit for a host-only cookie. */\n  domain?: string;\n  /** `Secure` attribute, default true. Set false only for local http testing. */\n  secure?: boolean;\n  /** subdomainIndex for a freshly built `_fbc` (com=0, example.com=1, www.example.com=2). Default 1. */\n  subdomainIndex?: number;\n  /**\n   * Re-issue a still-valid `_fbc` on every request as an ITP self-heal (restores the long-lived\n   * HTTP cookie if the Meta Pixel's `document.cookie` write re-capped it to 24h in Safari). On by\n   * default. Note it attaches a per-user `Set-Cookie` — and thus `no-store` — to every page\n   * response carrying an `_fbc`, defeating CDN caching of those pages; set false to strictly follow\n   * Meta's conditional-write rule and keep them cacheable. See {@link resolveClickIdCookies}.\n   */\n  refresh?: boolean;\n  /**\n   * Override the `Cache-Control` of a response we attach cookies to (default `private, no-store`).\n   * A per-user `Set-Cookie` must never end up on a shared-cache entry, or one visitor's `_fbc` would\n   * be served to everyone. Only set this false if you guarantee these responses are never cached.\n   */\n  cacheControl?: string | false;\n  /**\n   * Consent gate. Return false to skip setting cookies for this request (e.g. before the visitor has\n   * granted consent where required). Runs per request with the incoming `Request`.\n   */\n  shouldPersist?: (request: Request) => boolean;\n}\n\n/**\n * TanStack Start request middleware that persists ad click-id cookies (`_fbc`, `_rdt_cid`) on the\n * document response.\n *\n * Setting `_fbc` here — on the top document via an HTTP `Set-Cookie` header, before any client JS\n * runs — is what Meta officially recommends and the only reliable way to keep the cookie alive for\n * 90 days in Safari: ITP caps JavaScript-set cookies on a fbclid-decorated landing page to 24\n * hours, and a document response is never classified as CNAME/IP cloaking (it is the reference the\n * browser measures cloaking against).\n *\n * Register it as a global request middleware:\n * ```ts\n * // start.ts\n * import { createStart } from '@tanstack/react-start'\n * import { clickIdMiddleware } from '@shware/analytics/tanstack'\n * export const startInstance = createStart(() => ({ requestMiddleware: [clickIdMiddleware] }))\n * ```\n *\n * reference: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/fbp-and-fbc\n */\nexport function createClickIdMiddleware(options: ClickIdMiddlewareOptions = {}) {\n  const { cacheControl = 'private, no-store' } = options;\n\n  return createMiddleware({ type: 'request' }).server(async ({ request, next, handlerType }) => {\n    const result = await next();\n\n    // Skip serverFn RPC responses. 'router' covers SSR document requests *and* custom server\n    // routes (API endpoints) — those also get cookies when the URL carries a click id.\n    if (handlerType !== 'router') return result;\n    if (options.shouldPersist && !options.shouldPersist(request)) return result;\n\n    const { cookies } = resolveClickIdCookies({\n      url: request.url,\n      cookieHeader: request.headers.get('cookie'),\n      domain: options.domain,\n      secure: options.secure,\n      subdomainIndex: options.subdomainIndex,\n      refresh: options.refresh ?? true,\n    });\n\n    if (cookies.length > 0) {\n      for (const header of toSetCookieHeaders(cookies)) {\n        result.response.headers.append('set-cookie', header);\n      }\n      if (cacheControl !== false) {\n        result.response.headers.set('cache-control', cacheControl);\n      }\n    }\n\n    return result;\n  });\n}\n\n/** Ready-to-register middleware with default options. */\nexport const clickIdMiddleware = createClickIdMiddleware();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,wBAAwB,UAAoC,CAAC,GAAG;CAC9E,MAAM,EAAE,eAAe,wBAAwB;CAE/C,OAAO,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,SAAS,MAAM,kBAAkB;EAC5F,MAAM,SAAS,MAAM,KAAK;EAI1B,IAAI,gBAAgB,UAAU,OAAO;EACrC,IAAI,QAAQ,iBAAiB,CAAC,QAAQ,cAAc,OAAO,GAAG,OAAO;EAErE,MAAM,EAAE,YAAY,sBAAsB;GACxC,KAAK,QAAQ;GACb,cAAc,QAAQ,QAAQ,IAAI,QAAQ;GAC1C,QAAQ,QAAQ;GAChB,QAAQ,QAAQ;GAChB,gBAAgB,QAAQ;GACxB,SAAS,QAAQ,WAAW;EAC9B,CAAC;EAED,IAAI,QAAQ,SAAS,GAAG;GACtB,KAAK,MAAM,UAAU,mBAAmB,OAAO,GAC7C,OAAO,SAAS,QAAQ,OAAO,cAAc,MAAM;GAErD,IAAI,iBAAiB,OACnB,OAAO,SAAS,QAAQ,IAAI,iBAAiB,YAAY;EAE7D;EAEA,OAAO;CACT,CAAC;AACH;;AAGA,MAAa,oBAAoB,wBAAwB"}

package/dist/track/index.cjs

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_setup_index = require("../setup/index.cjs");
+const require_constants_storage = require("../constants/storage.cjs");
 const require_setup_session = require("../setup/session.cjs");
 const require_third_parties_ignored_events = require("../third-parties/ignored-events.cjs");
 const require_visitor_index = require("../visitor/index.cjs");
@@ -40,17 +41,15 @@ async function captureTags() {
 async function sendEvents(events) {
 	try {
 		if (events.length === 0) return;
-		const session = require_setup_session.getSession();
-		if (session.isExpired()) {
-			session.refresh();
-			events.unshift({
-				name: "session_start",
-				properties: {},
-				options: { enableThirdPartyTracking: false },
-				tags: captureTags(),
-				timestamp: (/* @__PURE__ */ new Date()).toISOString()
-			});
-		} else session.updateLastActiveTime();
+		const firstTimestamp = events[0].timestamp;
+		const { id: session_id, started } = require_setup_session.getSession().touch(Date.parse(firstTimestamp), Date.parse(events[events.length - 1].timestamp));
+		if (started) events.unshift({
+			name: "session_start",
+			properties: {},
+			options: { enableThirdPartyTracking: false },
+			tags: captureTags(),
+			timestamp: firstTimestamp
+		});
 		await getTokenBucket().removeTokens();
 		const visitor_id = (await require_visitor_index.getVisitor()).id;
 		const dto = await Promise.all(events.map(async (event) => ({
@@ -58,7 +57,7 @@ async function sendEvents(events) {
 			properties: event.properties,
 			tags: await event.tags,
 			visitor_id,
-			session_id: session.getId(),
+			session_id,
 			platform: require_setup_index.config.platform,
 			environment: require_setup_index.config.environment,
 			timestamp: event.timestamp
@@ -139,15 +138,15 @@ async function trackAsync(name, properties, options = defaultOptions) {
 	}]);
 }
 function sendBeacon(name, properties) {
-	if (!require_setup_index.cache.tags || !require_setup_index.cache.visitor) return;
-	const session = require_setup_session.getSession();
-	session.updateLastActiveTime();
+	const stored = require_setup_index.config.storage.getItem(require_constants_storage.keys.visitor_id);
+	const visitor_id = require_setup_index.cache.visitor?.id ?? (stored && stored !== "undefined" ? stored : void 0);
+	if (!visitor_id) return;
 	const dto = [{
 		name,
 		properties,
-		tags: require_setup_index.cache.tags,
-		visitor_id: require_setup_index.cache.visitor.id,
-		session_id: session.getId(),
+		tags: require_setup_index.cache.tags ?? {},
+		visitor_id,
+		session_id: require_setup_session.getSession().extend(),
 		platform: require_setup_index.config.platform,
 		environment: require_setup_index.config.environment,
 		timestamp: (/* @__PURE__ */ new Date()).toISOString()

package/dist/track/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["TokenBucket","config","cache","getSession","getVisitor","IGNORED_EVENTS"],"sources":["../../src/track/index.ts"],"sourcesContent":["import { TokenBucket, fetch } from '@shware/utils';\nimport type { CreateTrackEventDTO } from '../schema/index';\nimport { cache, config } from '../setup/index';\nimport { getSession } from '../setup/session';\nimport { IGNORED_EVENTS } from '../third-parties/ignored-events';\nimport { getVisitor } from '../visitor/index';\nimport type { EventName, TrackEventResponse, TrackName, TrackProperties, TrackTags } from './types';\n\nexport interface TrackOptions {\n  enableThirdPartyTracking?: boolean;\n  onSucceed?: (response?: TrackEventResponse[number]) => void;\n  onError?: (error: unknown) => void;\n}\n\nconst defaultOptions: TrackOptions = { enableThirdPartyTracking: true };\n\nlet tokenBucket: TokenBucket | undefined;\n\n/**\n * The rate limiter, built on the first send rather than at module scope: its\n * constructor starts a refill `setInterval`, and Cloudflare Workers refuse to\n * set a timer outside a request handler for the same reason they refuse to\n * generate random values there — see `setup/session.ts`.\n */\nfunction getTokenBucket() {\n  return (tokenBucket ??= new TokenBucket({ rate: 1, capacity: 20, requested: 2 }));\n}\n\ntype Item = {\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  name: TrackName<any>;\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  properties: TrackProperties<any>;\n  tags: Promise<TrackTags>;\n  timestamp: string;\n  options: TrackOptions;\n};\n\n/**\n * Tags belong to the moment the event happened, not to the moment its batch goes out: a queued\n * event waits up to `delay` ms, and a single page app can navigate in that window, which would\n * stamp every pending event with the URL of the page the user has already left.\n *\n * The promise then sits in the queue with nothing awaiting it, so a failure has to be absorbed\n * here — an unhandled rejection would surface as a global error long before `sendEvents` could\n * catch it. Falling back to the last built tags keeps the event, minus whatever changed since.\n */\nasync function captureTags(): Promise<TrackTags> {\n  try {\n    return await config.getTags();\n  } catch (e: unknown) {\n    if (e instanceof Error) console.log(e.message);\n    return cache.tags ?? {};\n  }\n}\n\nasync function sendEvents(events: Item[]) {\n  try {\n    if (events.length === 0) return;\n\n    const session = getSession();\n    if (session.isExpired()) {\n      session.refresh();\n      events.unshift({\n        name: 'session_start',\n        properties: {},\n        options: { enableThirdPartyTracking: false },\n        tags: captureTags(),\n        timestamp: new Date().toISOString(),\n      });\n    } else {\n      session.updateLastActiveTime();\n    }\n\n    await getTokenBucket().removeTokens();\n\n    const visitor_id = (await getVisitor()).id;\n\n    const dto: CreateTrackEventDTO = await Promise.all(\n      events.map(async (event) => ({\n        name: event.name,\n        properties: event.properties,\n        tags: await event.tags,\n        visitor_id,\n        session_id: session.getId(),\n        platform: config.platform,\n        environment: config.environment,\n        timestamp: event.timestamp,\n      }))\n    );\n\n    const response = await fetch(`${config.endpoint}/events`, {\n      method: 'POST',\n      credentials: 'include',\n      headers: await config.getHeaders(),\n      body: JSON.stringify(dto),\n    });\n\n    if (!response.ok) {\n      throw new Error(`Failed to send track event: ${response.status} ${await response.text()}`);\n    }\n\n    const data = (await response.json()) as TrackEventResponse;\n\n    let index = 0;\n    while (events.length > 0) {\n      const event = events.shift();\n      if (!event) {\n        index++;\n        continue;\n      }\n      const { options, name, properties } = event;\n      const eventId = data.at(index)?.id;\n      options.onSucceed?.(eventId ? { id: eventId } : undefined);\n      index++;\n      if (!options.enableThirdPartyTracking || IGNORED_EVENTS.includes(name)) {\n        continue;\n      }\n      config.thirdPartyTrackers.forEach((tracker) => {\n        try {\n          tracker(name, properties, eventId);\n        } catch (e: unknown) {\n          // A third-party script does not get to take the rest of the batch with it. This loop is\n          // still draining `events` with `shift`, so a throw would escape to the catch below and\n          // report failure to whatever is left in the queue — for events the server has already\n          // accepted, and after the ones ahead of them were told they succeeded.\n          if (e instanceof Error) console.log(e.message);\n        }\n      });\n    }\n  } catch (e: unknown) {\n    if (e instanceof Error) console.log(e.message);\n    events.forEach((event) => event.options.onError?.(e));\n  }\n}\n\nconst batch = 10;\nconst delay = 2000;\nconst list: Item[] = [];\nlet timer: ReturnType<typeof setTimeout> | null = null;\n\n/**\n * Both paths into a send go through here, so a batch that fills up cancels the timer the\n * previous push armed rather than leaving it to wake up on its own with nothing to send.\n */\nfunction flush() {\n  if (timer) {\n    clearTimeout(timer);\n    timer = null;\n  }\n  if (list.length === 0) return;\n  const copy = [...list];\n  list.length = 0;\n  void sendEvents(copy);\n}\n\nexport function track<T extends EventName = EventName>(\n  name: TrackName<T>,\n  properties?: TrackProperties<T>,\n  options: TrackOptions = defaultOptions\n) {\n  list.push({\n    name,\n    properties,\n    options,\n    tags: captureTags(),\n    timestamp: new Date().toISOString(),\n  });\n  if (list.length >= batch) {\n    flush();\n    return;\n  }\n  if (timer) clearTimeout(timer);\n  timer = setTimeout(flush, delay);\n}\n\nexport async function trackAsync<T extends EventName = EventName>(\n  name: TrackName<T>,\n  properties?: TrackProperties<T>,\n  options: TrackOptions = defaultOptions\n) {\n  await sendEvents([\n    { name, properties, options, tags: captureTags(), timestamp: new Date().toISOString() },\n  ]);\n}\n\nexport function sendBeacon<T extends EventName = EventName>(\n  name: TrackName<T>,\n  properties?: TrackProperties<T>\n) {\n  if (!cache.tags || !cache.visitor) return;\n\n  const session = getSession();\n  session.updateLastActiveTime();\n\n  const dto: CreateTrackEventDTO = [\n    {\n      name,\n      properties,\n      tags: cache.tags,\n      visitor_id: cache.visitor.id,\n      session_id: session.getId(),\n      platform: config.platform,\n      environment: config.environment,\n      timestamp: new Date().toISOString(),\n    },\n  ];\n  const blob = new Blob([JSON.stringify(dto)], { type: 'application/json' });\n  const success = navigator.sendBeacon(`${config.endpoint}/events`, blob);\n  if (success) return;\n  console.warn('Failed to send beacon', name, properties);\n}\n"],"mappings":";;;;;;;AAcA,MAAM,iBAA+B,EAAE,0BAA0B,KAAK;AAEtE,IAAI;;;;;;;AAQJ,SAAS,iBAAiB;CACxB,OAAQ,gBAAgB,IAAIA,cAAAA,YAAY;EAAE,MAAM;EAAG,UAAU;EAAI,WAAW;CAAE,CAAC;AACjF;;;;;;;;;;AAqBA,eAAe,cAAkC;CAC/C,IAAI;EACF,OAAO,MAAMC,oBAAAA,OAAO,QAAQ;CAC9B,SAAS,GAAY;EACnB,IAAI,aAAa,OAAO,QAAQ,IAAI,EAAE,OAAO;EAC7C,OAAOC,oBAAAA,MAAM,QAAQ,CAAC;CACxB;AACF;AAEA,eAAe,WAAW,QAAgB;CACxC,IAAI;EACF,IAAI,OAAO,WAAW,GAAG;EAEzB,MAAM,UAAUC,sBAAAA,WAAW;EAC3B,IAAI,QAAQ,UAAU,GAAG;GACvB,QAAQ,QAAQ;GAChB,OAAO,QAAQ;IACb,MAAM;IACN,YAAY,CAAC;IACb,SAAS,EAAE,0BAA0B,MAAM;IAC3C,MAAM,YAAY;IAClB,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;GACpC,CAAC;EACH,OACE,QAAQ,qBAAqB;EAG/B,MAAM,eAAe,CAAC,CAAC,aAAa;EAEpC,MAAM,cAAc,MAAMC,sBAAAA,WAAW,EAAA,CAAG;EAExC,MAAM,MAA2B,MAAM,QAAQ,IAC7C,OAAO,IAAI,OAAO,WAAW;GAC3B,MAAM,MAAM;GACZ,YAAY,MAAM;GAClB,MAAM,MAAM,MAAM;GAClB;GACA,YAAY,QAAQ,MAAM;GAC1B,UAAUH,oBAAAA,OAAO;GACjB,aAAaA,oBAAAA,OAAO;GACpB,WAAW,MAAM;EACnB,EAAE,CACJ;EAEA,MAAM,WAAW,OAAA,GAAA,cAAA,MAAA,CAAY,GAAGA,oBAAAA,OAAO,SAAS,UAAU;GACxD,QAAQ;GACR,aAAa;GACb,SAAS,MAAMA,oBAAAA,OAAO,WAAW;GACjC,MAAM,KAAK,UAAU,GAAG;EAC1B,CAAC;EAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,+BAA+B,SAAS,OAAO,GAAG,MAAM,SAAS,KAAK,GAAG;EAG3F,MAAM,OAAQ,MAAM,SAAS,KAAK;EAElC,IAAI,QAAQ;EACZ,OAAO,OAAO,SAAS,GAAG;GACxB,MAAM,QAAQ,OAAO,MAAM;GAC3B,IAAI,CAAC,OAAO;IACV;IACA;GACF;GACA,MAAM,EAAE,SAAS,MAAM,eAAe;GACtC,MAAM,UAAU,KAAK,GAAG,KAAK,CAAC,EAAE;GAChC,QAAQ,YAAY,UAAU,EAAE,IAAI,QAAQ,IAAI,KAAA,CAAS;GACzD;GACA,IAAI,CAAC,QAAQ,4BAA4BI,qCAAAA,eAAe,SAAS,IAAI,GACnE;GAEF,oBAAA,OAAO,mBAAmB,SAAS,YAAY;IAC7C,IAAI;KACF,QAAQ,MAAM,YAAY,OAAO;IACnC,SAAS,GAAY;KAKnB,IAAI,aAAa,OAAO,QAAQ,IAAI,EAAE,OAAO;IAC/C;GACF,CAAC;EACH;CACF,SAAS,GAAY;EACnB,IAAI,aAAa,OAAO,QAAQ,IAAI,EAAE,OAAO;EAC7C,OAAO,SAAS,UAAU,MAAM,QAAQ,UAAU,CAAC,CAAC;CACtD;AACF;AAEA,MAAM,QAAQ;AACd,MAAM,QAAQ;AACd,MAAM,OAAe,CAAC;AACtB,IAAI,QAA8C;;;;;AAMlD,SAAS,QAAQ;CACf,IAAI,OAAO;EACT,aAAa,KAAK;EAClB,QAAQ;CACV;CACA,IAAI,KAAK,WAAW,GAAG;CACvB,MAAM,OAAO,CAAC,GAAG,IAAI;CACrB,KAAK,SAAS;CACd,WAAgB,IAAI;AACtB;AAEA,SAAgB,MACd,MACA,YACA,UAAwB,gBACxB;CACA,KAAK,KAAK;EACR;EACA;EACA;EACA,MAAM,YAAY;EAClB,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;CACpC,CAAC;CACD,IAAI,KAAK,UAAU,OAAO;EACxB,MAAM;EACN;CACF;CACA,IAAI,OAAO,aAAa,KAAK;CAC7B,QAAQ,WAAW,OAAO,KAAK;AACjC;AAEA,eAAsB,WACpB,MACA,YACA,UAAwB,gBACxB;CACA,MAAM,WAAW,CACf;EAAE;EAAM;EAAY;EAAS,MAAM,YAAY;EAAG,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;CAAE,CACxF,CAAC;AACH;AAEA,SAAgB,WACd,MACA,YACA;CACA,IAAI,CAACH,oBAAAA,MAAM,QAAQ,CAACA,oBAAAA,MAAM,SAAS;CAEnC,MAAM,UAAUC,sBAAAA,WAAW;CAC3B,QAAQ,qBAAqB;CAE7B,MAAM,MAA2B,CAC/B;EACE;EACA;EACA,MAAMD,oBAAAA,MAAM;EACZ,YAAYA,oBAAAA,MAAM,QAAQ;EAC1B,YAAY,QAAQ,MAAM;EAC1B,UAAUD,oBAAAA,OAAO;EACjB,aAAaA,oBAAAA,OAAO;EACpB,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;CACpC,CACF;CACA,MAAM,OAAO,IAAI,KAAK,CAAC,KAAK,UAAU,GAAG,CAAC,GAAG,EAAE,MAAM,mBAAmB,CAAC;CAEzE,IADgB,UAAU,WAAW,GAAGA,oBAAAA,OAAO,SAAS,UAAU,IACxD,GAAG;CACb,QAAQ,KAAK,yBAAyB,MAAM,UAAU;AACxD"}
+{"version":3,"file":"index.cjs","names":["TokenBucket","config","cache","getSession","getVisitor","IGNORED_EVENTS","keys"],"sources":["../../src/track/index.ts"],"sourcesContent":["import { TokenBucket, fetch } from '@shware/utils';\nimport { keys } from '../constants/storage';\nimport type { CreateTrackEventDTO } from '../schema/index';\nimport { cache, config } from '../setup/index';\nimport { getSession } from '../setup/session';\nimport { IGNORED_EVENTS } from '../third-parties/ignored-events';\nimport { getVisitor } from '../visitor/index';\nimport type { EventName, TrackEventResponse, TrackName, TrackProperties, TrackTags } from './types';\n\nexport interface TrackOptions {\n  enableThirdPartyTracking?: boolean;\n  onSucceed?: (response?: TrackEventResponse[number]) => void;\n  onError?: (error: unknown) => void;\n}\n\nconst defaultOptions: TrackOptions = { enableThirdPartyTracking: true };\n\nlet tokenBucket: TokenBucket | undefined;\n\n/**\n * The rate limiter, built on the first send rather than at module scope: its\n * constructor starts a refill `setInterval`, and Cloudflare Workers refuse to\n * set a timer outside a request handler for the same reason they refuse to\n * generate random values there — see `setup/session.ts`.\n */\nfunction getTokenBucket() {\n  return (tokenBucket ??= new TokenBucket({ rate: 1, capacity: 20, requested: 2 }));\n}\n\ntype Item = {\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  name: TrackName<any>;\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  properties: TrackProperties<any>;\n  tags: Promise<TrackTags>;\n  timestamp: string;\n  options: TrackOptions;\n};\n\n/**\n * Tags belong to the moment the event happened, not to the moment its batch goes out: a queued\n * event waits up to `delay` ms, and a single page app can navigate in that window, which would\n * stamp every pending event with the URL of the page the user has already left.\n *\n * The promise then sits in the queue with nothing awaiting it, so a failure has to be absorbed\n * here — an unhandled rejection would surface as a global error long before `sendEvents` could\n * catch it. Falling back to the last built tags keeps the event, minus whatever changed since.\n */\nasync function captureTags(): Promise<TrackTags> {\n  try {\n    return await config.getTags();\n  } catch (e: unknown) {\n    if (e instanceof Error) console.log(e.message);\n    return cache.tags ?? {};\n  }\n}\n\nasync function sendEvents(events: Item[]) {\n  try {\n    if (events.length === 0) return;\n\n    // One read-modify-write of the stored session for the whole batch: it answers which session\n    // these events belong to and whether this batch is the one that started it. Timed by the\n    // events themselves rather than by this moment — a tab frozen in the background can hold a\n    // batch for far longer than `delay`, and those events belong to the session they happened in.\n    const firstTimestamp = events[0].timestamp;\n    const { id: session_id, started } = getSession().touch(\n      Date.parse(firstTimestamp),\n      Date.parse(events[events.length - 1].timestamp)\n    );\n    if (started) {\n      events.unshift({\n        name: 'session_start',\n        properties: {},\n        options: { enableThirdPartyTracking: false },\n        tags: captureTags(),\n        // The session began with the event that opened it, not at this moment: a batch held in a\n        // frozen tab would otherwise announce its session later than the events inside it.\n        timestamp: firstTimestamp,\n      });\n    }\n\n    await getTokenBucket().removeTokens();\n\n    const visitor_id = (await getVisitor()).id;\n\n    const dto: CreateTrackEventDTO = await Promise.all(\n      events.map(async (event) => ({\n        name: event.name,\n        properties: event.properties,\n        tags: await event.tags,\n        visitor_id,\n        session_id,\n        platform: config.platform,\n        environment: config.environment,\n        timestamp: event.timestamp,\n      }))\n    );\n\n    const response = await fetch(`${config.endpoint}/events`, {\n      method: 'POST',\n      credentials: 'include',\n      headers: await config.getHeaders(),\n      body: JSON.stringify(dto),\n    });\n\n    if (!response.ok) {\n      throw new Error(`Failed to send track event: ${response.status} ${await response.text()}`);\n    }\n\n    const data = (await response.json()) as TrackEventResponse;\n\n    let index = 0;\n    while (events.length > 0) {\n      const event = events.shift();\n      if (!event) {\n        index++;\n        continue;\n      }\n      const { options, name, properties } = event;\n      const eventId = data.at(index)?.id;\n      options.onSucceed?.(eventId ? { id: eventId } : undefined);\n      index++;\n      if (!options.enableThirdPartyTracking || IGNORED_EVENTS.includes(name)) {\n        continue;\n      }\n      config.thirdPartyTrackers.forEach((tracker) => {\n        try {\n          tracker(name, properties, eventId);\n        } catch (e: unknown) {\n          // A third-party script does not get to take the rest of the batch with it. This loop is\n          // still draining `events` with `shift`, so a throw would escape to the catch below and\n          // report failure to whatever is left in the queue — for events the server has already\n          // accepted, and after the ones ahead of them were told they succeeded.\n          if (e instanceof Error) console.log(e.message);\n        }\n      });\n    }\n  } catch (e: unknown) {\n    if (e instanceof Error) console.log(e.message);\n    events.forEach((event) => event.options.onError?.(e));\n  }\n}\n\nconst batch = 10;\nconst delay = 2000;\nconst list: Item[] = [];\nlet timer: ReturnType<typeof setTimeout> | null = null;\n\n/**\n * Both paths into a send go through here, so a batch that fills up cancels the timer the\n * previous push armed rather than leaving it to wake up on its own with nothing to send.\n */\nfunction flush() {\n  if (timer) {\n    clearTimeout(timer);\n    timer = null;\n  }\n  if (list.length === 0) return;\n  const copy = [...list];\n  list.length = 0;\n  void sendEvents(copy);\n}\n\nexport function track<T extends EventName = EventName>(\n  name: TrackName<T>,\n  properties?: TrackProperties<T>,\n  options: TrackOptions = defaultOptions\n) {\n  list.push({\n    name,\n    properties,\n    options,\n    tags: captureTags(),\n    timestamp: new Date().toISOString(),\n  });\n  if (list.length >= batch) {\n    flush();\n    return;\n  }\n  if (timer) clearTimeout(timer);\n  timer = setTimeout(flush, delay);\n}\n\nexport async function trackAsync<T extends EventName = EventName>(\n  name: TrackName<T>,\n  properties?: TrackProperties<T>,\n  options: TrackOptions = defaultOptions\n) {\n  await sendEvents([\n    { name, properties, options, tags: captureTags(), timestamp: new Date().toISOString() },\n  ]);\n}\n\nexport function sendBeacon<T extends EventName = EventName>(\n  name: TrackName<T>,\n  properties?: TrackProperties<T>\n) {\n  // The visitor id is persisted, so a returning visitor already has one before `getVisitor` has\n  // finished its round trip for this page. Requiring the in-memory copy threw away exactly the\n  // events this function exists for: everything a visit accrues before its first batch comes\n  // back, which for a short visit is the whole of it.\n  const stored = config.storage.getItem(keys.visitor_id);\n  const visitor_id = cache.visitor?.id ?? (stored && stored !== 'undefined' ? stored : undefined);\n  if (!visitor_id) return;\n\n  const dto: CreateTrackEventDTO = [\n    {\n      name,\n      properties,\n      // Tags are worth less than the event carrying them: an empty set still reports the\n      // engagement, and every field in `tagsSchema` is optional.\n      tags: cache.tags ?? {},\n      visitor_id,\n      session_id: getSession().extend(),\n      platform: config.platform,\n      environment: config.environment,\n      timestamp: new Date().toISOString(),\n    },\n  ];\n  const blob = new Blob([JSON.stringify(dto)], { type: 'application/json' });\n  const success = navigator.sendBeacon(`${config.endpoint}/events`, blob);\n  if (success) return;\n  console.warn('Failed to send beacon', name, properties);\n}\n"],"mappings":";;;;;;;;AAeA,MAAM,iBAA+B,EAAE,0BAA0B,KAAK;AAEtE,IAAI;;;;;;;AAQJ,SAAS,iBAAiB;CACxB,OAAQ,gBAAgB,IAAIA,cAAAA,YAAY;EAAE,MAAM;EAAG,UAAU;EAAI,WAAW;CAAE,CAAC;AACjF;;;;;;;;;;AAqBA,eAAe,cAAkC;CAC/C,IAAI;EACF,OAAO,MAAMC,oBAAAA,OAAO,QAAQ;CAC9B,SAAS,GAAY;EACnB,IAAI,aAAa,OAAO,QAAQ,IAAI,EAAE,OAAO;EAC7C,OAAOC,oBAAAA,MAAM,QAAQ,CAAC;CACxB;AACF;AAEA,eAAe,WAAW,QAAgB;CACxC,IAAI;EACF,IAAI,OAAO,WAAW,GAAG;EAMzB,MAAM,iBAAiB,OAAO,EAAE,CAAC;EACjC,MAAM,EAAE,IAAI,YAAY,YAAYC,sBAAAA,WAAW,CAAC,CAAC,MAC/C,KAAK,MAAM,cAAc,GACzB,KAAK,MAAM,OAAO,OAAO,SAAS,EAAE,CAAC,SAAS,CAChD;EACA,IAAI,SACF,OAAO,QAAQ;GACb,MAAM;GACN,YAAY,CAAC;GACb,SAAS,EAAE,0BAA0B,MAAM;GAC3C,MAAM,YAAY;GAGlB,WAAW;EACb,CAAC;EAGH,MAAM,eAAe,CAAC,CAAC,aAAa;EAEpC,MAAM,cAAc,MAAMC,sBAAAA,WAAW,EAAA,CAAG;EAExC,MAAM,MAA2B,MAAM,QAAQ,IAC7C,OAAO,IAAI,OAAO,WAAW;GAC3B,MAAM,MAAM;GACZ,YAAY,MAAM;GAClB,MAAM,MAAM,MAAM;GAClB;GACA;GACA,UAAUH,oBAAAA,OAAO;GACjB,aAAaA,oBAAAA,OAAO;GACpB,WAAW,MAAM;EACnB,EAAE,CACJ;EAEA,MAAM,WAAW,OAAA,GAAA,cAAA,MAAA,CAAY,GAAGA,oBAAAA,OAAO,SAAS,UAAU;GACxD,QAAQ;GACR,aAAa;GACb,SAAS,MAAMA,oBAAAA,OAAO,WAAW;GACjC,MAAM,KAAK,UAAU,GAAG;EAC1B,CAAC;EAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,+BAA+B,SAAS,OAAO,GAAG,MAAM,SAAS,KAAK,GAAG;EAG3F,MAAM,OAAQ,MAAM,SAAS,KAAK;EAElC,IAAI,QAAQ;EACZ,OAAO,OAAO,SAAS,GAAG;GACxB,MAAM,QAAQ,OAAO,MAAM;GAC3B,IAAI,CAAC,OAAO;IACV;IACA;GACF;GACA,MAAM,EAAE,SAAS,MAAM,eAAe;GACtC,MAAM,UAAU,KAAK,GAAG,KAAK,CAAC,EAAE;GAChC,QAAQ,YAAY,UAAU,EAAE,IAAI,QAAQ,IAAI,KAAA,CAAS;GACzD;GACA,IAAI,CAAC,QAAQ,4BAA4BI,qCAAAA,eAAe,SAAS,IAAI,GACnE;GAEF,oBAAA,OAAO,mBAAmB,SAAS,YAAY;IAC7C,IAAI;KACF,QAAQ,MAAM,YAAY,OAAO;IACnC,SAAS,GAAY;KAKnB,IAAI,aAAa,OAAO,QAAQ,IAAI,EAAE,OAAO;IAC/C;GACF,CAAC;EACH;CACF,SAAS,GAAY;EACnB,IAAI,aAAa,OAAO,QAAQ,IAAI,EAAE,OAAO;EAC7C,OAAO,SAAS,UAAU,MAAM,QAAQ,UAAU,CAAC,CAAC;CACtD;AACF;AAEA,MAAM,QAAQ;AACd,MAAM,QAAQ;AACd,MAAM,OAAe,CAAC;AACtB,IAAI,QAA8C;;;;;AAMlD,SAAS,QAAQ;CACf,IAAI,OAAO;EACT,aAAa,KAAK;EAClB,QAAQ;CACV;CACA,IAAI,KAAK,WAAW,GAAG;CACvB,MAAM,OAAO,CAAC,GAAG,IAAI;CACrB,KAAK,SAAS;CACd,WAAgB,IAAI;AACtB;AAEA,SAAgB,MACd,MACA,YACA,UAAwB,gBACxB;CACA,KAAK,KAAK;EACR;EACA;EACA;EACA,MAAM,YAAY;EAClB,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;CACpC,CAAC;CACD,IAAI,KAAK,UAAU,OAAO;EACxB,MAAM;EACN;CACF;CACA,IAAI,OAAO,aAAa,KAAK;CAC7B,QAAQ,WAAW,OAAO,KAAK;AACjC;AAEA,eAAsB,WACpB,MACA,YACA,UAAwB,gBACxB;CACA,MAAM,WAAW,CACf;EAAE;EAAM;EAAY;EAAS,MAAM,YAAY;EAAG,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;CAAE,CACxF,CAAC;AACH;AAEA,SAAgB,WACd,MACA,YACA;CAKA,MAAM,SAASJ,oBAAAA,OAAO,QAAQ,QAAQK,0BAAAA,KAAK,UAAU;CACrD,MAAM,aAAaJ,oBAAAA,MAAM,SAAS,OAAO,UAAU,WAAW,cAAc,SAAS,KAAA;CACrF,IAAI,CAAC,YAAY;CAEjB,MAAM,MAA2B,CAC/B;EACE;EACA;EAGA,MAAMA,oBAAAA,MAAM,QAAQ,CAAC;EACrB;EACA,YAAYC,sBAAAA,WAAW,CAAC,CAAC,OAAO;EAChC,UAAUF,oBAAAA,OAAO;EACjB,aAAaA,oBAAAA,OAAO;EACpB,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;CACpC,CACF;CACA,MAAM,OAAO,IAAI,KAAK,CAAC,KAAK,UAAU,GAAG,CAAC,GAAG,EAAE,MAAM,mBAAmB,CAAC;CAEzE,IADgB,UAAU,WAAW,GAAGA,oBAAAA,OAAO,SAAS,UAAU,IACxD,GAAG;CACb,QAAQ,KAAK,yBAAyB,MAAM,UAAU;AACxD"}

package/dist/track/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/track/index.ts"],"mappings":";;UAQiB;EACf;EACA,aAAa,WAAW;EACxB,WAAW;;iBAiJG,MAAM,UAAU,YAAY,WAC1C,MAAM,UAAU,IAChB,aAAa,gBAAgB,IAC7B,UAAS;iBAiBW,WAAW,UAAU,YAAY,WACrD,MAAM,UAAU,IAChB,aAAa,gBAAgB,IAC7B,UAAS,eAA6B;iBAOxB,WAAW,UAAU,YAAY,WAC/C,MAAM,UAAU,IAChB,aAAa,gBAAgB"}
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/track/index.ts"],"mappings":";;UASiB;EACf;EACA,aAAa,WAAW;EACxB,WAAW;;iBAwJG,MAAM,UAAU,YAAY,WAC1C,MAAM,UAAU,IAChB,aAAa,gBAAgB,IAC7B,UAAS;iBAiBW,WAAW,UAAU,YAAY,WACrD,MAAM,UAAU,IAChB,aAAa,gBAAgB,IAC7B,UAAS,eAA6B;iBAOxB,WAAW,UAAU,YAAY,WAC/C,MAAM,UAAU,IAChB,aAAa,gBAAgB"}

package/dist/track/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/track/index.ts"],"mappings":";;UAQiB;EACf;EACA,aAAa,WAAW;EACxB,WAAW;;iBAiJG,MAAM,UAAU,YAAY,WAC1C,MAAM,UAAU,IAChB,aAAa,gBAAgB,IAC7B,UAAS;iBAiBW,WAAW,UAAU,YAAY,WACrD,MAAM,UAAU,IAChB,aAAa,gBAAgB,IAC7B,UAAS,eAA6B;iBAOxB,WAAW,UAAU,YAAY,WAC/C,MAAM,UAAU,IAChB,aAAa,gBAAgB"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/track/index.ts"],"mappings":";;UASiB;EACf;EACA,aAAa,WAAW;EACxB,WAAW;;iBAwJG,MAAM,UAAU,YAAY,WAC1C,MAAM,UAAU,IAChB,aAAa,gBAAgB,IAC7B,UAAS;iBAiBW,WAAW,UAAU,YAAY,WACrD,MAAM,UAAU,IAChB,aAAa,gBAAgB,IAC7B,UAAS,eAA6B;iBAOxB,WAAW,UAAU,YAAY,WAC/C,MAAM,UAAU,IAChB,aAAa,gBAAgB"}

package/dist/track/index.mjs

@@ -1,4 +1,5 @@
 import { cache, config } from "../setup/index.mjs";
+import { keys } from "../constants/storage.mjs";
 import { getSession } from "../setup/session.mjs";
 import { IGNORED_EVENTS } from "../third-parties/ignored-events.mjs";
 import { getVisitor } from "../visitor/index.mjs";
@@ -39,17 +40,15 @@ async function captureTags() {
 async function sendEvents(events) {
 	try {
 		if (events.length === 0) return;
-		const session = getSession();
-		if (session.isExpired()) {
-			session.refresh();
-			events.unshift({
-				name: "session_start",
-				properties: {},
-				options: { enableThirdPartyTracking: false },
-				tags: captureTags(),
-				timestamp: (/* @__PURE__ */ new Date()).toISOString()
-			});
-		} else session.updateLastActiveTime();
+		const firstTimestamp = events[0].timestamp;
+		const { id: session_id, started } = getSession().touch(Date.parse(firstTimestamp), Date.parse(events[events.length - 1].timestamp));
+		if (started) events.unshift({
+			name: "session_start",
+			properties: {},
+			options: { enableThirdPartyTracking: false },
+			tags: captureTags(),
+			timestamp: firstTimestamp
+		});
 		await getTokenBucket().removeTokens();
 		const visitor_id = (await getVisitor()).id;
 		const dto = await Promise.all(events.map(async (event) => ({
@@ -57,7 +56,7 @@ async function sendEvents(events) {
 			properties: event.properties,
 			tags: await event.tags,
 			visitor_id,
-			session_id: session.getId(),
+			session_id,
 			platform: config.platform,
 			environment: config.environment,
 			timestamp: event.timestamp
@@ -138,15 +137,15 @@ async function trackAsync(name, properties, options = defaultOptions) {
 	}]);
 }
 function sendBeacon(name, properties) {
-	if (!cache.tags || !cache.visitor) return;
-	const session = getSession();
-	session.updateLastActiveTime();
+	const stored = config.storage.getItem(keys.visitor_id);
+	const visitor_id = cache.visitor?.id ?? (stored && stored !== "undefined" ? stored : void 0);
+	if (!visitor_id) return;
 	const dto = [{
 		name,
 		properties,
-		tags: cache.tags,
-		visitor_id: cache.visitor.id,
-		session_id: session.getId(),
+		tags: cache.tags ?? {},
+		visitor_id,
+		session_id: getSession().extend(),
 		platform: config.platform,
 		environment: config.environment,
 		timestamp: (/* @__PURE__ */ new Date()).toISOString()

package/dist/track/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/track/index.ts"],"sourcesContent":["import { TokenBucket, fetch } from '@shware/utils';\nimport type { CreateTrackEventDTO } from '../schema/index';\nimport { cache, config } from '../setup/index';\nimport { getSession } from '../setup/session';\nimport { IGNORED_EVENTS } from '../third-parties/ignored-events';\nimport { getVisitor } from '../visitor/index';\nimport type { EventName, TrackEventResponse, TrackName, TrackProperties, TrackTags } from './types';\n\nexport interface TrackOptions {\n  enableThirdPartyTracking?: boolean;\n  onSucceed?: (response?: TrackEventResponse[number]) => void;\n  onError?: (error: unknown) => void;\n}\n\nconst defaultOptions: TrackOptions = { enableThirdPartyTracking: true };\n\nlet tokenBucket: TokenBucket | undefined;\n\n/**\n * The rate limiter, built on the first send rather than at module scope: its\n * constructor starts a refill `setInterval`, and Cloudflare Workers refuse to\n * set a timer outside a request handler for the same reason they refuse to\n * generate random values there — see `setup/session.ts`.\n */\nfunction getTokenBucket() {\n  return (tokenBucket ??= new TokenBucket({ rate: 1, capacity: 20, requested: 2 }));\n}\n\ntype Item = {\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  name: TrackName<any>;\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  properties: TrackProperties<any>;\n  tags: Promise<TrackTags>;\n  timestamp: string;\n  options: TrackOptions;\n};\n\n/**\n * Tags belong to the moment the event happened, not to the moment its batch goes out: a queued\n * event waits up to `delay` ms, and a single page app can navigate in that window, which would\n * stamp every pending event with the URL of the page the user has already left.\n *\n * The promise then sits in the queue with nothing awaiting it, so a failure has to be absorbed\n * here — an unhandled rejection would surface as a global error long before `sendEvents` could\n * catch it. Falling back to the last built tags keeps the event, minus whatever changed since.\n */\nasync function captureTags(): Promise<TrackTags> {\n  try {\n    return await config.getTags();\n  } catch (e: unknown) {\n    if (e instanceof Error) console.log(e.message);\n    return cache.tags ?? {};\n  }\n}\n\nasync function sendEvents(events: Item[]) {\n  try {\n    if (events.length === 0) return;\n\n    const session = getSession();\n    if (session.isExpired()) {\n      session.refresh();\n      events.unshift({\n        name: 'session_start',\n        properties: {},\n        options: { enableThirdPartyTracking: false },\n        tags: captureTags(),\n        timestamp: new Date().toISOString(),\n      });\n    } else {\n      session.updateLastActiveTime();\n    }\n\n    await getTokenBucket().removeTokens();\n\n    const visitor_id = (await getVisitor()).id;\n\n    const dto: CreateTrackEventDTO = await Promise.all(\n      events.map(async (event) => ({\n        name: event.name,\n        properties: event.properties,\n        tags: await event.tags,\n        visitor_id,\n        session_id: session.getId(),\n        platform: config.platform,\n        environment: config.environment,\n        timestamp: event.timestamp,\n      }))\n    );\n\n    const response = await fetch(`${config.endpoint}/events`, {\n      method: 'POST',\n      credentials: 'include',\n      headers: await config.getHeaders(),\n      body: JSON.stringify(dto),\n    });\n\n    if (!response.ok) {\n      throw new Error(`Failed to send track event: ${response.status} ${await response.text()}`);\n    }\n\n    const data = (await response.json()) as TrackEventResponse;\n\n    let index = 0;\n    while (events.length > 0) {\n      const event = events.shift();\n      if (!event) {\n        index++;\n        continue;\n      }\n      const { options, name, properties } = event;\n      const eventId = data.at(index)?.id;\n      options.onSucceed?.(eventId ? { id: eventId } : undefined);\n      index++;\n      if (!options.enableThirdPartyTracking || IGNORED_EVENTS.includes(name)) {\n        continue;\n      }\n      config.thirdPartyTrackers.forEach((tracker) => {\n        try {\n          tracker(name, properties, eventId);\n        } catch (e: unknown) {\n          // A third-party script does not get to take the rest of the batch with it. This loop is\n          // still draining `events` with `shift`, so a throw would escape to the catch below and\n          // report failure to whatever is left in the queue — for events the server has already\n          // accepted, and after the ones ahead of them were told they succeeded.\n          if (e instanceof Error) console.log(e.message);\n        }\n      });\n    }\n  } catch (e: unknown) {\n    if (e instanceof Error) console.log(e.message);\n    events.forEach((event) => event.options.onError?.(e));\n  }\n}\n\nconst batch = 10;\nconst delay = 2000;\nconst list: Item[] = [];\nlet timer: ReturnType<typeof setTimeout> | null = null;\n\n/**\n * Both paths into a send go through here, so a batch that fills up cancels the timer the\n * previous push armed rather than leaving it to wake up on its own with nothing to send.\n */\nfunction flush() {\n  if (timer) {\n    clearTimeout(timer);\n    timer = null;\n  }\n  if (list.length === 0) return;\n  const copy = [...list];\n  list.length = 0;\n  void sendEvents(copy);\n}\n\nexport function track<T extends EventName = EventName>(\n  name: TrackName<T>,\n  properties?: TrackProperties<T>,\n  options: TrackOptions = defaultOptions\n) {\n  list.push({\n    name,\n    properties,\n    options,\n    tags: captureTags(),\n    timestamp: new Date().toISOString(),\n  });\n  if (list.length >= batch) {\n    flush();\n    return;\n  }\n  if (timer) clearTimeout(timer);\n  timer = setTimeout(flush, delay);\n}\n\nexport async function trackAsync<T extends EventName = EventName>(\n  name: TrackName<T>,\n  properties?: TrackProperties<T>,\n  options: TrackOptions = defaultOptions\n) {\n  await sendEvents([\n    { name, properties, options, tags: captureTags(), timestamp: new Date().toISOString() },\n  ]);\n}\n\nexport function sendBeacon<T extends EventName = EventName>(\n  name: TrackName<T>,\n  properties?: TrackProperties<T>\n) {\n  if (!cache.tags || !cache.visitor) return;\n\n  const session = getSession();\n  session.updateLastActiveTime();\n\n  const dto: CreateTrackEventDTO = [\n    {\n      name,\n      properties,\n      tags: cache.tags,\n      visitor_id: cache.visitor.id,\n      session_id: session.getId(),\n      platform: config.platform,\n      environment: config.environment,\n      timestamp: new Date().toISOString(),\n    },\n  ];\n  const blob = new Blob([JSON.stringify(dto)], { type: 'application/json' });\n  const success = navigator.sendBeacon(`${config.endpoint}/events`, blob);\n  if (success) return;\n  console.warn('Failed to send beacon', name, properties);\n}\n"],"mappings":";;;;;;AAcA,MAAM,iBAA+B,EAAE,0BAA0B,KAAK;AAEtE,IAAI;;;;;;;AAQJ,SAAS,iBAAiB;CACxB,OAAQ,gBAAgB,IAAI,YAAY;EAAE,MAAM;EAAG,UAAU;EAAI,WAAW;CAAE,CAAC;AACjF;;;;;;;;;;AAqBA,eAAe,cAAkC;CAC/C,IAAI;EACF,OAAO,MAAM,OAAO,QAAQ;CAC9B,SAAS,GAAY;EACnB,IAAI,aAAa,OAAO,QAAQ,IAAI,EAAE,OAAO;EAC7C,OAAO,MAAM,QAAQ,CAAC;CACxB;AACF;AAEA,eAAe,WAAW,QAAgB;CACxC,IAAI;EACF,IAAI,OAAO,WAAW,GAAG;EAEzB,MAAM,UAAU,WAAW;EAC3B,IAAI,QAAQ,UAAU,GAAG;GACvB,QAAQ,QAAQ;GAChB,OAAO,QAAQ;IACb,MAAM;IACN,YAAY,CAAC;IACb,SAAS,EAAE,0BAA0B,MAAM;IAC3C,MAAM,YAAY;IAClB,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;GACpC,CAAC;EACH,OACE,QAAQ,qBAAqB;EAG/B,MAAM,eAAe,CAAC,CAAC,aAAa;EAEpC,MAAM,cAAc,MAAM,WAAW,EAAA,CAAG;EAExC,MAAM,MAA2B,MAAM,QAAQ,IAC7C,OAAO,IAAI,OAAO,WAAW;GAC3B,MAAM,MAAM;GACZ,YAAY,MAAM;GAClB,MAAM,MAAM,MAAM;GAClB;GACA,YAAY,QAAQ,MAAM;GAC1B,UAAU,OAAO;GACjB,aAAa,OAAO;GACpB,WAAW,MAAM;EACnB,EAAE,CACJ;EAEA,MAAM,WAAW,MAAM,MAAM,GAAG,OAAO,SAAS,UAAU;GACxD,QAAQ;GACR,aAAa;GACb,SAAS,MAAM,OAAO,WAAW;GACjC,MAAM,KAAK,UAAU,GAAG;EAC1B,CAAC;EAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,+BAA+B,SAAS,OAAO,GAAG,MAAM,SAAS,KAAK,GAAG;EAG3F,MAAM,OAAQ,MAAM,SAAS,KAAK;EAElC,IAAI,QAAQ;EACZ,OAAO,OAAO,SAAS,GAAG;GACxB,MAAM,QAAQ,OAAO,MAAM;GAC3B,IAAI,CAAC,OAAO;IACV;IACA;GACF;GACA,MAAM,EAAE,SAAS,MAAM,eAAe;GACtC,MAAM,UAAU,KAAK,GAAG,KAAK,CAAC,EAAE;GAChC,QAAQ,YAAY,UAAU,EAAE,IAAI,QAAQ,IAAI,KAAA,CAAS;GACzD;GACA,IAAI,CAAC,QAAQ,4BAA4B,eAAe,SAAS,IAAI,GACnE;GAEF,OAAO,mBAAmB,SAAS,YAAY;IAC7C,IAAI;KACF,QAAQ,MAAM,YAAY,OAAO;IACnC,SAAS,GAAY;KAKnB,IAAI,aAAa,OAAO,QAAQ,IAAI,EAAE,OAAO;IAC/C;GACF,CAAC;EACH;CACF,SAAS,GAAY;EACnB,IAAI,aAAa,OAAO,QAAQ,IAAI,EAAE,OAAO;EAC7C,OAAO,SAAS,UAAU,MAAM,QAAQ,UAAU,CAAC,CAAC;CACtD;AACF;AAEA,MAAM,QAAQ;AACd,MAAM,QAAQ;AACd,MAAM,OAAe,CAAC;AACtB,IAAI,QAA8C;;;;;AAMlD,SAAS,QAAQ;CACf,IAAI,OAAO;EACT,aAAa,KAAK;EAClB,QAAQ;CACV;CACA,IAAI,KAAK,WAAW,GAAG;CACvB,MAAM,OAAO,CAAC,GAAG,IAAI;CACrB,KAAK,SAAS;CACd,WAAgB,IAAI;AACtB;AAEA,SAAgB,MACd,MACA,YACA,UAAwB,gBACxB;CACA,KAAK,KAAK;EACR;EACA;EACA;EACA,MAAM,YAAY;EAClB,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;CACpC,CAAC;CACD,IAAI,KAAK,UAAU,OAAO;EACxB,MAAM;EACN;CACF;CACA,IAAI,OAAO,aAAa,KAAK;CAC7B,QAAQ,WAAW,OAAO,KAAK;AACjC;AAEA,eAAsB,WACpB,MACA,YACA,UAAwB,gBACxB;CACA,MAAM,WAAW,CACf;EAAE;EAAM;EAAY;EAAS,MAAM,YAAY;EAAG,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;CAAE,CACxF,CAAC;AACH;AAEA,SAAgB,WACd,MACA,YACA;CACA,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,SAAS;CAEnC,MAAM,UAAU,WAAW;CAC3B,QAAQ,qBAAqB;CAE7B,MAAM,MAA2B,CAC/B;EACE;EACA;EACA,MAAM,MAAM;EACZ,YAAY,MAAM,QAAQ;EAC1B,YAAY,QAAQ,MAAM;EAC1B,UAAU,OAAO;EACjB,aAAa,OAAO;EACpB,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;CACpC,CACF;CACA,MAAM,OAAO,IAAI,KAAK,CAAC,KAAK,UAAU,GAAG,CAAC,GAAG,EAAE,MAAM,mBAAmB,CAAC;CAEzE,IADgB,UAAU,WAAW,GAAG,OAAO,SAAS,UAAU,IACxD,GAAG;CACb,QAAQ,KAAK,yBAAyB,MAAM,UAAU;AACxD"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/track/index.ts"],"sourcesContent":["import { TokenBucket, fetch } from '@shware/utils';\nimport { keys } from '../constants/storage';\nimport type { CreateTrackEventDTO } from '../schema/index';\nimport { cache, config } from '../setup/index';\nimport { getSession } from '../setup/session';\nimport { IGNORED_EVENTS } from '../third-parties/ignored-events';\nimport { getVisitor } from '../visitor/index';\nimport type { EventName, TrackEventResponse, TrackName, TrackProperties, TrackTags } from './types';\n\nexport interface TrackOptions {\n  enableThirdPartyTracking?: boolean;\n  onSucceed?: (response?: TrackEventResponse[number]) => void;\n  onError?: (error: unknown) => void;\n}\n\nconst defaultOptions: TrackOptions = { enableThirdPartyTracking: true };\n\nlet tokenBucket: TokenBucket | undefined;\n\n/**\n * The rate limiter, built on the first send rather than at module scope: its\n * constructor starts a refill `setInterval`, and Cloudflare Workers refuse to\n * set a timer outside a request handler for the same reason they refuse to\n * generate random values there — see `setup/session.ts`.\n */\nfunction getTokenBucket() {\n  return (tokenBucket ??= new TokenBucket({ rate: 1, capacity: 20, requested: 2 }));\n}\n\ntype Item = {\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  name: TrackName<any>;\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  properties: TrackProperties<any>;\n  tags: Promise<TrackTags>;\n  timestamp: string;\n  options: TrackOptions;\n};\n\n/**\n * Tags belong to the moment the event happened, not to the moment its batch goes out: a queued\n * event waits up to `delay` ms, and a single page app can navigate in that window, which would\n * stamp every pending event with the URL of the page the user has already left.\n *\n * The promise then sits in the queue with nothing awaiting it, so a failure has to be absorbed\n * here — an unhandled rejection would surface as a global error long before `sendEvents` could\n * catch it. Falling back to the last built tags keeps the event, minus whatever changed since.\n */\nasync function captureTags(): Promise<TrackTags> {\n  try {\n    return await config.getTags();\n  } catch (e: unknown) {\n    if (e instanceof Error) console.log(e.message);\n    return cache.tags ?? {};\n  }\n}\n\nasync function sendEvents(events: Item[]) {\n  try {\n    if (events.length === 0) return;\n\n    // One read-modify-write of the stored session for the whole batch: it answers which session\n    // these events belong to and whether this batch is the one that started it. Timed by the\n    // events themselves rather than by this moment — a tab frozen in the background can hold a\n    // batch for far longer than `delay`, and those events belong to the session they happened in.\n    const firstTimestamp = events[0].timestamp;\n    const { id: session_id, started } = getSession().touch(\n      Date.parse(firstTimestamp),\n      Date.parse(events[events.length - 1].timestamp)\n    );\n    if (started) {\n      events.unshift({\n        name: 'session_start',\n        properties: {},\n        options: { enableThirdPartyTracking: false },\n        tags: captureTags(),\n        // The session began with the event that opened it, not at this moment: a batch held in a\n        // frozen tab would otherwise announce its session later than the events inside it.\n        timestamp: firstTimestamp,\n      });\n    }\n\n    await getTokenBucket().removeTokens();\n\n    const visitor_id = (await getVisitor()).id;\n\n    const dto: CreateTrackEventDTO = await Promise.all(\n      events.map(async (event) => ({\n        name: event.name,\n        properties: event.properties,\n        tags: await event.tags,\n        visitor_id,\n        session_id,\n        platform: config.platform,\n        environment: config.environment,\n        timestamp: event.timestamp,\n      }))\n    );\n\n    const response = await fetch(`${config.endpoint}/events`, {\n      method: 'POST',\n      credentials: 'include',\n      headers: await config.getHeaders(),\n      body: JSON.stringify(dto),\n    });\n\n    if (!response.ok) {\n      throw new Error(`Failed to send track event: ${response.status} ${await response.text()}`);\n    }\n\n    const data = (await response.json()) as TrackEventResponse;\n\n    let index = 0;\n    while (events.length > 0) {\n      const event = events.shift();\n      if (!event) {\n        index++;\n        continue;\n      }\n      const { options, name, properties } = event;\n      const eventId = data.at(index)?.id;\n      options.onSucceed?.(eventId ? { id: eventId } : undefined);\n      index++;\n      if (!options.enableThirdPartyTracking || IGNORED_EVENTS.includes(name)) {\n        continue;\n      }\n      config.thirdPartyTrackers.forEach((tracker) => {\n        try {\n          tracker(name, properties, eventId);\n        } catch (e: unknown) {\n          // A third-party script does not get to take the rest of the batch with it. This loop is\n          // still draining `events` with `shift`, so a throw would escape to the catch below and\n          // report failure to whatever is left in the queue — for events the server has already\n          // accepted, and after the ones ahead of them were told they succeeded.\n          if (e instanceof Error) console.log(e.message);\n        }\n      });\n    }\n  } catch (e: unknown) {\n    if (e instanceof Error) console.log(e.message);\n    events.forEach((event) => event.options.onError?.(e));\n  }\n}\n\nconst batch = 10;\nconst delay = 2000;\nconst list: Item[] = [];\nlet timer: ReturnType<typeof setTimeout> | null = null;\n\n/**\n * Both paths into a send go through here, so a batch that fills up cancels the timer the\n * previous push armed rather than leaving it to wake up on its own with nothing to send.\n */\nfunction flush() {\n  if (timer) {\n    clearTimeout(timer);\n    timer = null;\n  }\n  if (list.length === 0) return;\n  const copy = [...list];\n  list.length = 0;\n  void sendEvents(copy);\n}\n\nexport function track<T extends EventName = EventName>(\n  name: TrackName<T>,\n  properties?: TrackProperties<T>,\n  options: TrackOptions = defaultOptions\n) {\n  list.push({\n    name,\n    properties,\n    options,\n    tags: captureTags(),\n    timestamp: new Date().toISOString(),\n  });\n  if (list.length >= batch) {\n    flush();\n    return;\n  }\n  if (timer) clearTimeout(timer);\n  timer = setTimeout(flush, delay);\n}\n\nexport async function trackAsync<T extends EventName = EventName>(\n  name: TrackName<T>,\n  properties?: TrackProperties<T>,\n  options: TrackOptions = defaultOptions\n) {\n  await sendEvents([\n    { name, properties, options, tags: captureTags(), timestamp: new Date().toISOString() },\n  ]);\n}\n\nexport function sendBeacon<T extends EventName = EventName>(\n  name: TrackName<T>,\n  properties?: TrackProperties<T>\n) {\n  // The visitor id is persisted, so a returning visitor already has one before `getVisitor` has\n  // finished its round trip for this page. Requiring the in-memory copy threw away exactly the\n  // events this function exists for: everything a visit accrues before its first batch comes\n  // back, which for a short visit is the whole of it.\n  const stored = config.storage.getItem(keys.visitor_id);\n  const visitor_id = cache.visitor?.id ?? (stored && stored !== 'undefined' ? stored : undefined);\n  if (!visitor_id) return;\n\n  const dto: CreateTrackEventDTO = [\n    {\n      name,\n      properties,\n      // Tags are worth less than the event carrying them: an empty set still reports the\n      // engagement, and every field in `tagsSchema` is optional.\n      tags: cache.tags ?? {},\n      visitor_id,\n      session_id: getSession().extend(),\n      platform: config.platform,\n      environment: config.environment,\n      timestamp: new Date().toISOString(),\n    },\n  ];\n  const blob = new Blob([JSON.stringify(dto)], { type: 'application/json' });\n  const success = navigator.sendBeacon(`${config.endpoint}/events`, blob);\n  if (success) return;\n  console.warn('Failed to send beacon', name, properties);\n}\n"],"mappings":";;;;;;;AAeA,MAAM,iBAA+B,EAAE,0BAA0B,KAAK;AAEtE,IAAI;;;;;;;AAQJ,SAAS,iBAAiB;CACxB,OAAQ,gBAAgB,IAAI,YAAY;EAAE,MAAM;EAAG,UAAU;EAAI,WAAW;CAAE,CAAC;AACjF;;;;;;;;;;AAqBA,eAAe,cAAkC;CAC/C,IAAI;EACF,OAAO,MAAM,OAAO,QAAQ;CAC9B,SAAS,GAAY;EACnB,IAAI,aAAa,OAAO,QAAQ,IAAI,EAAE,OAAO;EAC7C,OAAO,MAAM,QAAQ,CAAC;CACxB;AACF;AAEA,eAAe,WAAW,QAAgB;CACxC,IAAI;EACF,IAAI,OAAO,WAAW,GAAG;EAMzB,MAAM,iBAAiB,OAAO,EAAE,CAAC;EACjC,MAAM,EAAE,IAAI,YAAY,YAAY,WAAW,CAAC,CAAC,MAC/C,KAAK,MAAM,cAAc,GACzB,KAAK,MAAM,OAAO,OAAO,SAAS,EAAE,CAAC,SAAS,CAChD;EACA,IAAI,SACF,OAAO,QAAQ;GACb,MAAM;GACN,YAAY,CAAC;GACb,SAAS,EAAE,0BAA0B,MAAM;GAC3C,MAAM,YAAY;GAGlB,WAAW;EACb,CAAC;EAGH,MAAM,eAAe,CAAC,CAAC,aAAa;EAEpC,MAAM,cAAc,MAAM,WAAW,EAAA,CAAG;EAExC,MAAM,MAA2B,MAAM,QAAQ,IAC7C,OAAO,IAAI,OAAO,WAAW;GAC3B,MAAM,MAAM;GACZ,YAAY,MAAM;GAClB,MAAM,MAAM,MAAM;GAClB;GACA;GACA,UAAU,OAAO;GACjB,aAAa,OAAO;GACpB,WAAW,MAAM;EACnB,EAAE,CACJ;EAEA,MAAM,WAAW,MAAM,MAAM,GAAG,OAAO,SAAS,UAAU;GACxD,QAAQ;GACR,aAAa;GACb,SAAS,MAAM,OAAO,WAAW;GACjC,MAAM,KAAK,UAAU,GAAG;EAC1B,CAAC;EAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,+BAA+B,SAAS,OAAO,GAAG,MAAM,SAAS,KAAK,GAAG;EAG3F,MAAM,OAAQ,MAAM,SAAS,KAAK;EAElC,IAAI,QAAQ;EACZ,OAAO,OAAO,SAAS,GAAG;GACxB,MAAM,QAAQ,OAAO,MAAM;GAC3B,IAAI,CAAC,OAAO;IACV;IACA;GACF;GACA,MAAM,EAAE,SAAS,MAAM,eAAe;GACtC,MAAM,UAAU,KAAK,GAAG,KAAK,CAAC,EAAE;GAChC,QAAQ,YAAY,UAAU,EAAE,IAAI,QAAQ,IAAI,KAAA,CAAS;GACzD;GACA,IAAI,CAAC,QAAQ,4BAA4B,eAAe,SAAS,IAAI,GACnE;GAEF,OAAO,mBAAmB,SAAS,YAAY;IAC7C,IAAI;KACF,QAAQ,MAAM,YAAY,OAAO;IACnC,SAAS,GAAY;KAKnB,IAAI,aAAa,OAAO,QAAQ,IAAI,EAAE,OAAO;IAC/C;GACF,CAAC;EACH;CACF,SAAS,GAAY;EACnB,IAAI,aAAa,OAAO,QAAQ,IAAI,EAAE,OAAO;EAC7C,OAAO,SAAS,UAAU,MAAM,QAAQ,UAAU,CAAC,CAAC;CACtD;AACF;AAEA,MAAM,QAAQ;AACd,MAAM,QAAQ;AACd,MAAM,OAAe,CAAC;AACtB,IAAI,QAA8C;;;;;AAMlD,SAAS,QAAQ;CACf,IAAI,OAAO;EACT,aAAa,KAAK;EAClB,QAAQ;CACV;CACA,IAAI,KAAK,WAAW,GAAG;CACvB,MAAM,OAAO,CAAC,GAAG,IAAI;CACrB,KAAK,SAAS;CACd,WAAgB,IAAI;AACtB;AAEA,SAAgB,MACd,MACA,YACA,UAAwB,gBACxB;CACA,KAAK,KAAK;EACR;EACA;EACA;EACA,MAAM,YAAY;EAClB,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;CACpC,CAAC;CACD,IAAI,KAAK,UAAU,OAAO;EACxB,MAAM;EACN;CACF;CACA,IAAI,OAAO,aAAa,KAAK;CAC7B,QAAQ,WAAW,OAAO,KAAK;AACjC;AAEA,eAAsB,WACpB,MACA,YACA,UAAwB,gBACxB;CACA,MAAM,WAAW,CACf;EAAE;EAAM;EAAY;EAAS,MAAM,YAAY;EAAG,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;CAAE,CACxF,CAAC;AACH;AAEA,SAAgB,WACd,MACA,YACA;CAKA,MAAM,SAAS,OAAO,QAAQ,QAAQ,KAAK,UAAU;CACrD,MAAM,aAAa,MAAM,SAAS,OAAO,UAAU,WAAW,cAAc,SAAS,KAAA;CACrF,IAAI,CAAC,YAAY;CAEjB,MAAM,MAA2B,CAC/B;EACE;EACA;EAGA,MAAM,MAAM,QAAQ,CAAC;EACrB;EACA,YAAY,WAAW,CAAC,CAAC,OAAO;EAChC,UAAU,OAAO;EACjB,aAAa,OAAO;EACpB,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;CACpC,CACF;CACA,MAAM,OAAO,IAAI,KAAK,CAAC,KAAK,UAAU,GAAG,CAAC,GAAG,EAAE,MAAM,mBAAmB,CAAC;CAEzE,IADgB,UAAU,WAAW,GAAG,OAAO,SAAS,UAAU,IACxD,GAAG;CACb,QAAQ,KAAK,yBAAyB,MAAM,UAAU;AACxD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shware/analytics",
-  "version": "7.2.1",
+  "version": "7.3.0",
   "private": false,
   "repository": {
     "type": "git",