@shware/analytics 7.2.1 → 7.3.2

package/dist/setup/session.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"session.cjs","names":[],"sources":["../../src/setup/session.ts"],"sourcesContent":["import { v7 as uuidv7 } from 'uuid';\n\nexport const SESSION_TIMEOUT = 30 * 60 * 1000;\n\nclass Session {\n  private id: string;\n  private startTime: number;\n  private lastActiveTime: number;\n  private accumulatedTime: number;\n\n  private active: boolean;\n  private visible: boolean;\n  private focused: boolean;\n\n  constructor() {\n    this.id = uuidv7();\n    this.startTime = Date.now();\n    this.lastActiveTime = Date.now();\n    this.accumulatedTime = 0;\n\n    this.active = true;\n    this.visible = typeof document !== 'undefined' ? document.visibilityState === 'visible' : true;\n    this.focused = typeof document !== 'undefined' ? document.hasFocus() : true;\n  }\n\n  getId = () => this.id;\n\n  isActive = () => this.active;\n  isVisible = () => this.visible;\n  isFocused = () => this.focused;\n  isExpired = () => Date.now() - this.lastActiveTime > SESSION_TIMEOUT;\n\n  updateLastActiveTime = () => {\n    this.lastActiveTime = Date.now();\n  };\n\n  updateActive = (active: boolean) => {\n    this.active = active;\n  };\n\n  refresh = () => {\n    this.id = uuidv7();\n    this.lastActiveTime = Date.now();\n  };\n\n  updateAccumulator = () => {\n    const now = Date.now();\n    if (this.focused && this.visible && this.active) {\n      const delta = now - this.startTime;\n      if (delta > 0 && delta < SESSION_TIMEOUT) {\n        this.accumulatedTime += delta;\n      }\n    }\n    this.startTime = now;\n  };\n\n  focus = () => {\n    this.updateAccumulator();\n    this.updateLastActiveTime();\n    this.focused = true;\n  };\n\n  blur = () => {\n    this.updateAccumulator();\n    this.focused = false;\n  };\n\n  pageshow = () => {\n    this.updateAccumulator();\n    this.updateLastActiveTime();\n    this.active = true;\n  };\n\n  pagehide = () => {\n    this.updateAccumulator();\n    this.active = false;\n  };\n\n  visibilitychange = (state: DocumentVisibilityState) => {\n    this.updateAccumulator();\n    if (state === 'visible') {\n      this.updateLastActiveTime();\n    }\n    this.visible = state === 'visible';\n  };\n\n  flush = () => {\n    this.updateAccumulator();\n    const engagementTime = this.accumulatedTime;\n    this.accumulatedTime = 0;\n    return engagementTime;\n  };\n}\n\nlet session: Session | undefined;\n\n/**\n * The session, built the first time something asks for it.\n *\n * Deliberately not a module-scope `new Session()`. The constructor calls\n * `uuidv7()`, `uuid` draws its bytes from `crypto.getRandomValues`, and\n * Cloudflare Workers reject that outside a request handler:\n *\n *   Disallowed operation called within global scope. Asynchronous I/O\n *   (ex: fetch() or connect()), setting a timeout, and generating random\n *   values are not allowed within global scope.\n *\n * Module scope in a Worker is evaluated once when the isolate boots and is\n * then shared by every request that isolate serves, so a random value drawn\n * there would be the same for all of them — which is why the runtime refuses\n * to produce one. A host that server-renders on Workers reaches this module\n * through `track()` on the server as well, and the throw happened as the\n * isolate booted, taking down every route before a component rendered.\n *\n * Everything here is per-visitor browser or app state, so deferring the\n * construction costs nothing and buys two things: the server bundle can be\n * evaluated, and `startTime` marks when the session actually began rather\n * than when the isolate happened to start.\n */\nexport function getSession() {\n  return (session ??= new Session());\n}\n"],"mappings":";;;AAEA,MAAa,kBAAkB,OAAU;AAEzC,IAAM,UAAN,MAAc;CAUZ,cAAc;EAWA,KAAA,cAAA,KAAK;EAEF,KAAA,iBAAA,KAAK;EACJ,KAAA,kBAAA,KAAK;EACL,KAAA,kBAAA,KAAK;EACL,KAAA,kBAAA,KAAK,IAAI,IAAI,KAAK,iBAAiB;EAExB,KAAA,6BAAA;GAC3B,KAAK,iBAAiB,KAAK,IAAI;EACjC;EAEgB,KAAA,gBAAA,WAAoB;GAClC,KAAK,SAAS;EAChB;EAEgB,KAAA,gBAAA;GACd,KAAK,MAAA,GAAA,KAAA,GAAA,CAAY;GACjB,KAAK,iBAAiB,KAAK,IAAI;EACjC;EAE0B,KAAA,0BAAA;GACxB,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,KAAK,WAAW,KAAK,WAAW,KAAK,QAAQ;IAC/C,MAAM,QAAQ,MAAM,KAAK;IACzB,IAAI,QAAQ,KAAK,QAAA,MACf,KAAK,mBAAmB;GAE5B;GACA,KAAK,YAAY;EACnB;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,KAAK,qBAAqB;GAC1B,KAAK,UAAU;EACjB;EAEa,KAAA,aAAA;GACX,KAAK,kBAAkB;GACvB,KAAK,UAAU;EACjB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,qBAAqB;GAC1B,KAAK,SAAS;EAChB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,SAAS;EAChB;EAEoB,KAAA,oBAAA,UAAmC;GACrD,KAAK,kBAAkB;GACvB,IAAI,UAAU,WACZ,KAAK,qBAAqB;GAE5B,KAAK,UAAU,UAAU;EAC3B;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,MAAM,iBAAiB,KAAK;GAC5B,KAAK,kBAAkB;GACvB,OAAO;EACT;EA5EE,KAAK,MAAA,GAAA,KAAA,GAAA,CAAY;EACjB,KAAK,YAAY,KAAK,IAAI;EAC1B,KAAK,iBAAiB,KAAK,IAAI;EAC/B,KAAK,kBAAkB;EAEvB,KAAK,SAAS;EACd,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,oBAAoB,YAAY;EAC1F,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,SAAS,IAAI;CACzE;AAqEF;AAEA,IAAI;;;;;;;;;;;;;;;;;;;;;;;;AAyBJ,SAAgB,aAAa;CAC3B,OAAQ,YAAY,IAAI,QAAQ;AAClC"}
+{"version":3,"file":"session.cjs","names":["config","keys"],"sources":["../../src/setup/session.ts"],"sourcesContent":["import { v7 as uuidv7 } from 'uuid';\nimport { keys } from '../constants/storage';\nimport { config } from './index';\n\nexport const SESSION_TIMEOUT = 30 * 60 * 1000;\n\n/**\n * The part of a session that outlives the page: its identity, and the clock the timeout is\n * measured against. GA4 keeps these in its `_ga_<container>` cookie — alongside the engaged flag,\n * which arrives with `session_engaged` later — and rereads them for every event, which is what\n * makes a session survive a reload, span a whole multipage visit, and stay shared between two\n * tabs of the same site. Holding them in memory instead, as this did, starts a new session on\n * every full navigation and gives every tab one of its own.\n */\ninterface StoredSession {\n  id: string;\n  /** When the last event was sent. The timeout is measured from here, and only from here. */\n  lastEventTime: number;\n}\n\n/** The session an event belongs to, and whether that event is the one that started it. */\ninterface SessionForEvent {\n  id: string;\n  started: boolean;\n}\n\n/**\n * `<version>.<id>.<lastEventTime>`, compact and cookie-safe rather than JSON: `{`, `\"`\n * and `,` all have to be percent-encoded in a cookie, and a host that wants one session across\n * its subdomains will hand `setupAnalytics` a cookie-backed `storage`, where this has to survive\n * unchanged. A uuidv7 contains no dots, so the record splits cleanly.\n *\n * The version guards a change the parser could not otherwise survive. A field appended to the end\n * does not need one — a short record simply leaves it undefined.\n */\nconst VERSION = '1';\n\nfunction readSession(): StoredSession | undefined {\n  const raw = config.storage.getItem(keys.session);\n  if (!raw) return undefined;\n\n  const [version, id, lastEventTime] = raw.split('.');\n  if (version !== VERSION || !id) return undefined;\n\n  const parsed = { id, lastEventTime: Number(lastEventTime) };\n  if (!Number.isFinite(parsed.lastEventTime)) return undefined;\n  return parsed;\n}\n\nfunction writeSession({ id, lastEventTime }: StoredSession) {\n  config.storage.setItem(keys.session, `${VERSION}.${id}.${lastEventTime}`);\n}\n\nclass Session {\n  /**\n   * Engagement is deliberately not stored: it is the time this page has accrued and not yet\n   * reported, so it belongs to the page, not to the session. GA4 draws the same line — its cookie\n   * carries the session, while the engagement timer lives and dies with the document.\n   *\n   * `lastTickTime` is where the accumulator last settled up, rewritten on every tick — it is not\n   * when the session began, and nothing here needs to know that.\n   */\n  private lastTickTime: number;\n  private accumulatedTime: number;\n\n  private active: boolean;\n  private visible: boolean;\n  private focused: boolean;\n\n  constructor() {\n    this.lastTickTime = Date.now();\n    this.accumulatedTime = 0;\n\n    this.active = true;\n    this.visible = typeof document !== 'undefined' ? document.visibilityState === 'visible' : true;\n    this.focused = typeof document !== 'undefined' ? document.hasFocus() : true;\n  }\n\n  /**\n   * The session a batch of events belongs to: read the stored one, start a new one if it has\n   * timed out or there is none, stamp it with when those events happened and write it back. Every\n   * event goes through here, exactly as GA4 rereads and rewrites its cookie per event — caching\n   * the session in memory would put the tabs back out of step with each other.\n   */\n  touch = (eventTime: number, lastEventTime = eventTime): SessionForEvent => {\n    const stored = readSession();\n\n    if (stored && eventTime - stored.lastEventTime <= SESSION_TIMEOUT) {\n      // `Math.max`, because a batch that waited in a frozen tab can be older than what another\n      // tab has since written, and a session must never be shortened by a late arrival.\n      writeSession({ ...stored, lastEventTime: Math.max(stored.lastEventTime, lastEventTime) });\n      return { id: stored.id, started: false };\n    }\n\n    // Engagement the previous session accrued but never reported dies with it rather than being\n    // handed to its successor. GA4 does the same on `session_start`.\n    this.accumulatedTime = 0;\n    // Wall clock, not `eventTime`: this anchors the engagement timer for the page in front of the\n    // visitor now, which a batch describing something that happened an hour ago says nothing about.\n    this.lastTickTime = Date.now();\n\n    const session: StoredSession = { id: uuidv7(), lastEventTime };\n    writeSession(session);\n    return { id: session.id, started: true };\n  };\n\n  /**\n   * The id for an event that must not start a session — the `pagehide` beacon, which reports what\n   * the session now ending accrued. A live session is extended, as any event extends it; one\n   * already past its timeout still owns that engagement, so its id comes back without being\n   * revived into a session no `session_start` ever announced.\n   */\n  extend = (): string => {\n    const stored = readSession();\n    if (!stored) return this.touch(Date.now()).id;\n\n    const now = Date.now();\n    if (now - stored.lastEventTime <= SESSION_TIMEOUT) {\n      writeSession({ ...stored, lastEventTime: now });\n    }\n    return stored.id;\n  };\n\n  isActive = () => this.active;\n\n  updateActive = (active: boolean) => {\n    this.active = active;\n  };\n\n  updateAccumulator = () => {\n    const now = Date.now();\n    if (this.focused && this.visible && this.active) {\n      const delta = now - this.lastTickTime;\n      if (delta > 0 && delta < SESSION_TIMEOUT) {\n        this.accumulatedTime += delta;\n      }\n    }\n    this.lastTickTime = now;\n  };\n\n  focus = () => {\n    this.updateAccumulator();\n    this.focused = true;\n  };\n\n  blur = () => {\n    this.updateAccumulator();\n    this.focused = false;\n  };\n\n  pageshow = () => {\n    this.updateAccumulator();\n    this.active = true;\n  };\n\n  pagehide = () => {\n    this.updateAccumulator();\n    this.active = false;\n  };\n\n  visibilitychange = (state: DocumentVisibilityState) => {\n    this.updateAccumulator();\n    this.visible = state === 'visible';\n  };\n\n  flush = () => {\n    this.updateAccumulator();\n    const engagementTime = this.accumulatedTime;\n    this.accumulatedTime = 0;\n    return engagementTime;\n  };\n}\n\nlet session: Session | undefined;\n\n/**\n * The session, built the first time something asks for it.\n *\n * Deliberately not a module-scope `new Session()`. The constructor calls\n * `uuidv7()`, `uuid` draws its bytes from `crypto.getRandomValues`, and\n * Cloudflare Workers reject that outside a request handler:\n *\n *   Disallowed operation called within global scope. Asynchronous I/O\n *   (ex: fetch() or connect()), setting a timeout, and generating random\n *   values are not allowed within global scope.\n *\n * Module scope in a Worker is evaluated once when the isolate boots and is\n * then shared by every request that isolate serves, so a random value drawn\n * there would be the same for all of them — which is why the runtime refuses\n * to produce one. A host that server-renders on Workers reaches this module\n * through `track()` on the server as well, and the throw happened as the\n * isolate booted, taking down every route before a component rendered.\n *\n * Everything here is per-visitor browser or app state, so deferring the\n * construction costs nothing and lets the server bundle be evaluated. It does\n * not make any of it safe to use there: this instance, `cache` and `config` are\n * module singletons, so calling `track()` on a server shares one session and one\n * visitor across every request the isolate serves. Import it there; do not track.\n */\nexport function getSession() {\n  return (session ??= new Session());\n}\n"],"mappings":";;;;;AAIA,MAAa,kBAAkB,OAAU;;;;;;;;;;AA+BzC,MAAM,UAAU;AAEhB,SAAS,cAAyC;CAChD,MAAM,MAAMA,oBAAAA,OAAO,QAAQ,QAAQC,0BAAAA,KAAK,OAAO;CAC/C,IAAI,CAAC,KAAK,OAAO,KAAA;CAEjB,MAAM,CAAC,SAAS,IAAI,iBAAiB,IAAI,MAAM,GAAG;CAClD,IAAI,YAAY,WAAW,CAAC,IAAI,OAAO,KAAA;CAEvC,MAAM,SAAS;EAAE;EAAI,eAAe,OAAO,aAAa;CAAE;CAC1D,IAAI,CAAC,OAAO,SAAS,OAAO,aAAa,GAAG,OAAO,KAAA;CACnD,OAAO;AACT;AAEA,SAAS,aAAa,EAAE,IAAI,iBAAgC;CAC1D,oBAAA,OAAO,QAAQ,QAAQA,0BAAAA,KAAK,SAAS,GAAG,QAAQ,GAAG,GAAG,GAAG,eAAe;AAC1E;AAEA,IAAM,UAAN,MAAc;CAgBZ,cAAc;EAeL,KAAA,SAAA,WAAmB,gBAAgB,cAA+B;GACzE,MAAM,SAAS,YAAY;GAE3B,IAAI,UAAU,YAAY,OAAO,iBAAA,MAAkC;IAGjE,aAAa;KAAE,GAAG;KAAQ,eAAe,KAAK,IAAI,OAAO,eAAe,aAAa;IAAE,CAAC;IACxF,OAAO;KAAE,IAAI,OAAO;KAAI,SAAS;IAAM;GACzC;GAIA,KAAK,kBAAkB;GAGvB,KAAK,eAAe,KAAK,IAAI;GAE7B,MAAM,UAAyB;IAAE,KAAA,GAAA,KAAA,GAAA,CAAW;IAAG;GAAc;GAC7D,aAAa,OAAO;GACpB,OAAO;IAAE,IAAI,QAAQ;IAAI,SAAS;GAAK;EACzC;EAQuB,KAAA,eAAA;GACrB,MAAM,SAAS,YAAY;GAC3B,IAAI,CAAC,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC;GAE3C,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,MAAM,OAAO,iBAAA,MACf,aAAa;IAAE,GAAG;IAAQ,eAAe;GAAI,CAAC;GAEhD,OAAO,OAAO;EAChB;EAEiB,KAAA,iBAAA,KAAK;EAEN,KAAA,gBAAA,WAAoB;GAClC,KAAK,SAAS;EAChB;EAE0B,KAAA,0BAAA;GACxB,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,KAAK,WAAW,KAAK,WAAW,KAAK,QAAQ;IAC/C,MAAM,QAAQ,MAAM,KAAK;IACzB,IAAI,QAAQ,KAAK,QAAA,MACf,KAAK,mBAAmB;GAE5B;GACA,KAAK,eAAe;EACtB;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,KAAK,UAAU;EACjB;EAEa,KAAA,aAAA;GACX,KAAK,kBAAkB;GACvB,KAAK,UAAU;EACjB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,SAAS;EAChB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,SAAS;EAChB;EAEoB,KAAA,oBAAA,UAAmC;GACrD,KAAK,kBAAkB;GACvB,KAAK,UAAU,UAAU;EAC3B;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,MAAM,iBAAiB,KAAK;GAC5B,KAAK,kBAAkB;GACvB,OAAO;EACT;EApGE,KAAK,eAAe,KAAK,IAAI;EAC7B,KAAK,kBAAkB;EAEvB,KAAK,SAAS;EACd,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,oBAAoB,YAAY;EAC1F,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,SAAS,IAAI;CACzE;AA+FF;AAEA,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;AA0BJ,SAAgB,aAAa;CAC3B,OAAQ,YAAY,IAAI,QAAQ;AAClC"}

package/dist/setup/session.d.cts

@@ -1,22 +1,41 @@
 //#region src/setup/session.d.ts
 declare const SESSION_TIMEOUT: number;
+/** The session an event belongs to, and whether that event is the one that started it. */
+interface SessionForEvent {
+  id: string;
+  started: boolean;
+}
 declare class Session {
-  private id;
-  private startTime;
-  private lastActiveTime;
+  /**
+   * Engagement is deliberately not stored: it is the time this page has accrued and not yet
+   * reported, so it belongs to the page, not to the session. GA4 draws the same line — its cookie
+   * carries the session, while the engagement timer lives and dies with the document.
+   *
+   * `lastTickTime` is where the accumulator last settled up, rewritten on every tick — it is not
+   * when the session began, and nothing here needs to know that.
+   */
+  private lastTickTime;
   private accumulatedTime;
   private active;
   private visible;
   private focused;
   constructor();
-  getId: () => string;
+  /**
+   * The session a batch of events belongs to: read the stored one, start a new one if it has
+   * timed out or there is none, stamp it with when those events happened and write it back. Every
+   * event goes through here, exactly as GA4 rereads and rewrites its cookie per event — caching
+   * the session in memory would put the tabs back out of step with each other.
+   */
+  touch: (eventTime: number, lastEventTime?: number) => SessionForEvent;
+  /**
+   * The id for an event that must not start a session — the `pagehide` beacon, which reports what
+   * the session now ending accrued. A live session is extended, as any event extends it; one
+   * already past its timeout still owns that engagement, so its id comes back without being
+   * revived into a session no `session_start` ever announced.
+   */
+  extend: () => string;
   isActive: () => boolean;
-  isVisible: () => boolean;
-  isFocused: () => boolean;
-  isExpired: () => boolean;
-  updateLastActiveTime: () => void;
   updateActive: (active: boolean) => void;
-  refresh: () => void;
   updateAccumulator: () => void;
   focus: () => void;
   blur: () => void;
@@ -44,9 +63,10 @@ declare class Session {
  * isolate booted, taking down every route before a component rendered.
  *
  * Everything here is per-visitor browser or app state, so deferring the
- * construction costs nothing and buys two things: the server bundle can be
- * evaluated, and `startTime` marks when the session actually began rather
- * than when the isolate happened to start.
+ * construction costs nothing and lets the server bundle be evaluated. It does
+ * not make any of it safe to use there: this instance, `cache` and `config` are
+ * module singletons, so calling `track()` on a server shares one session and one
+ * visitor across every request the isolate serves. Import it there; do not track.
  */
 declare function getSession(): Session;
 //#endregion

package/dist/setup/session.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.cts","names":[],"sources":["../../src/setup/session.ts"],"mappings":";cAEa;cAEP;UACI;UACA;UACA;UACA;UAEA;UACA;UACA;EAER;EAWA;EAEA;EACA;EACA;EACA;EAEA;EAIA,eAAY;EAIZ;EAKA;EAWA;EAMA;EAKA;EAMA;EAKA,mBAAgB,OAAW;EAQ3B;;;;;;;;;;;;;;;;;;;;;;;;;iBAiCc,cAAU"}
+{"version":3,"file":"session.d.cts","names":[],"sources":["../../src/setup/session.ts"],"mappings":";cAIa;;UAiBH;EACR;EACA;;cA8BI;;;;;;;;;UASI;UACA;UAEA;UACA;UACA;EAER;;;;;;;EAeA,QAAK,mBAAqB,2BAA8B;;;;;;;EA4BxD;EAWA;EAEA,eAAY;EAIZ;EAWA;EAKA;EAKA;EAKA;EAKA,mBAAgB,OAAW;EAK3B;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkCc,cAAU"}

package/dist/setup/session.d.mts

@@ -1,22 +1,41 @@
 //#region src/setup/session.d.ts
 declare const SESSION_TIMEOUT: number;
+/** The session an event belongs to, and whether that event is the one that started it. */
+interface SessionForEvent {
+  id: string;
+  started: boolean;
+}
 declare class Session {
-  private id;
-  private startTime;
-  private lastActiveTime;
+  /**
+   * Engagement is deliberately not stored: it is the time this page has accrued and not yet
+   * reported, so it belongs to the page, not to the session. GA4 draws the same line — its cookie
+   * carries the session, while the engagement timer lives and dies with the document.
+   *
+   * `lastTickTime` is where the accumulator last settled up, rewritten on every tick — it is not
+   * when the session began, and nothing here needs to know that.
+   */
+  private lastTickTime;
   private accumulatedTime;
   private active;
   private visible;
   private focused;
   constructor();
-  getId: () => string;
+  /**
+   * The session a batch of events belongs to: read the stored one, start a new one if it has
+   * timed out or there is none, stamp it with when those events happened and write it back. Every
+   * event goes through here, exactly as GA4 rereads and rewrites its cookie per event — caching
+   * the session in memory would put the tabs back out of step with each other.
+   */
+  touch: (eventTime: number, lastEventTime?: number) => SessionForEvent;
+  /**
+   * The id for an event that must not start a session — the `pagehide` beacon, which reports what
+   * the session now ending accrued. A live session is extended, as any event extends it; one
+   * already past its timeout still owns that engagement, so its id comes back without being
+   * revived into a session no `session_start` ever announced.
+   */
+  extend: () => string;
   isActive: () => boolean;
-  isVisible: () => boolean;
-  isFocused: () => boolean;
-  isExpired: () => boolean;
-  updateLastActiveTime: () => void;
   updateActive: (active: boolean) => void;
-  refresh: () => void;
   updateAccumulator: () => void;
   focus: () => void;
   blur: () => void;
@@ -44,9 +63,10 @@ declare class Session {
  * isolate booted, taking down every route before a component rendered.
  *
  * Everything here is per-visitor browser or app state, so deferring the
- * construction costs nothing and buys two things: the server bundle can be
- * evaluated, and `startTime` marks when the session actually began rather
- * than when the isolate happened to start.
+ * construction costs nothing and lets the server bundle be evaluated. It does
+ * not make any of it safe to use there: this instance, `cache` and `config` are
+ * module singletons, so calling `track()` on a server shares one session and one
+ * visitor across every request the isolate serves. Import it there; do not track.
  */
 declare function getSession(): Session;
 //#endregion

package/dist/setup/session.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.mts","names":[],"sources":["../../src/setup/session.ts"],"mappings":";cAEa;cAEP;UACI;UACA;UACA;UACA;UAEA;UACA;UACA;EAER;EAWA;EAEA;EACA;EACA;EACA;EAEA;EAIA,eAAY;EAIZ;EAKA;EAWA;EAMA;EAKA;EAMA;EAKA,mBAAgB,OAAW;EAQ3B;;;;;;;;;;;;;;;;;;;;;;;;;iBAiCc,cAAU"}
+{"version":3,"file":"session.d.mts","names":[],"sources":["../../src/setup/session.ts"],"mappings":";cAIa;;UAiBH;EACR;EACA;;cA8BI;;;;;;;;;UASI;UACA;UAEA;UACA;UACA;EAER;;;;;;;EAeA,QAAK,mBAAqB,2BAA8B;;;;;;;EA4BxD;EAWA;EAEA,eAAY;EAIZ;EAWA;EAKA;EAKA;EAKA;EAKA,mBAAgB,OAAW;EAK3B;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkCc,cAAU"}

package/dist/setup/session.mjs

@@ -1,34 +1,83 @@
+import { config } from "./index.mjs";
+import { keys } from "../constants/storage.mjs";
 import { v7 } from "uuid";
 //#region src/setup/session.ts
 const SESSION_TIMEOUT = 1800 * 1e3;
+/**
+* `<version>.<id>.<lastEventTime>`, compact and cookie-safe rather than JSON: `{`, `"`
+* and `,` all have to be percent-encoded in a cookie, and a host that wants one session across
+* its subdomains will hand `setupAnalytics` a cookie-backed `storage`, where this has to survive
+* unchanged. A uuidv7 contains no dots, so the record splits cleanly.
+*
+* The version guards a change the parser could not otherwise survive. A field appended to the end
+* does not need one — a short record simply leaves it undefined.
+*/
+const VERSION = "1";
+function readSession() {
+	const raw = config.storage.getItem(keys.session);
+	if (!raw) return void 0;
+	const [version, id, lastEventTime] = raw.split(".");
+	if (version !== VERSION || !id) return void 0;
+	const parsed = {
+		id,
+		lastEventTime: Number(lastEventTime)
+	};
+	if (!Number.isFinite(parsed.lastEventTime)) return void 0;
+	return parsed;
+}
+function writeSession({ id, lastEventTime }) {
+	config.storage.setItem(keys.session, `${VERSION}.${id}.${lastEventTime}`);
+}
 var Session = class {
 	constructor() {
-		this.getId = () => this.id;
-		this.isActive = () => this.active;
-		this.isVisible = () => this.visible;
-		this.isFocused = () => this.focused;
-		this.isExpired = () => Date.now() - this.lastActiveTime > SESSION_TIMEOUT;
-		this.updateLastActiveTime = () => {
-			this.lastActiveTime = Date.now();
+		this.touch = (eventTime, lastEventTime = eventTime) => {
+			const stored = readSession();
+			if (stored && eventTime - stored.lastEventTime <= 18e5) {
+				writeSession({
+					...stored,
+					lastEventTime: Math.max(stored.lastEventTime, lastEventTime)
+				});
+				return {
+					id: stored.id,
+					started: false
+				};
+			}
+			this.accumulatedTime = 0;
+			this.lastTickTime = Date.now();
+			const session = {
+				id: v7(),
+				lastEventTime
+			};
+			writeSession(session);
+			return {
+				id: session.id,
+				started: true
+			};
+		};
+		this.extend = () => {
+			const stored = readSession();
+			if (!stored) return this.touch(Date.now()).id;
+			const now = Date.now();
+			if (now - stored.lastEventTime <= 18e5) writeSession({
+				...stored,
+				lastEventTime: now
+			});
+			return stored.id;
 		};
+		this.isActive = () => this.active;
 		this.updateActive = (active) => {
 			this.active = active;
 		};
-		this.refresh = () => {
-			this.id = v7();
-			this.lastActiveTime = Date.now();
-		};
 		this.updateAccumulator = () => {
 			const now = Date.now();
 			if (this.focused && this.visible && this.active) {
-				const delta = now - this.startTime;
+				const delta = now - this.lastTickTime;
 				if (delta > 0 && delta < 18e5) this.accumulatedTime += delta;
 			}
-			this.startTime = now;
+			this.lastTickTime = now;
 		};
 		this.focus = () => {
 			this.updateAccumulator();
-			this.updateLastActiveTime();
 			this.focused = true;
 		};
 		this.blur = () => {
@@ -37,7 +86,6 @@ var Session = class {
 		};
 		this.pageshow = () => {
 			this.updateAccumulator();
-			this.updateLastActiveTime();
 			this.active = true;
 		};
 		this.pagehide = () => {
@@ -46,7 +94,6 @@ var Session = class {
 		};
 		this.visibilitychange = (state) => {
 			this.updateAccumulator();
-			if (state === "visible") this.updateLastActiveTime();
 			this.visible = state === "visible";
 		};
 		this.flush = () => {
@@ -55,9 +102,7 @@ var Session = class {
 			this.accumulatedTime = 0;
 			return engagementTime;
 		};
-		this.id = v7();
-		this.startTime = Date.now();
-		this.lastActiveTime = Date.now();
+		this.lastTickTime = Date.now();
 		this.accumulatedTime = 0;
 		this.active = true;
 		this.visible = typeof document !== "undefined" ? document.visibilityState === "visible" : true;
@@ -84,9 +129,10 @@ let session;
 * isolate booted, taking down every route before a component rendered.
 *
 * Everything here is per-visitor browser or app state, so deferring the
-* construction costs nothing and buys two things: the server bundle can be
-* evaluated, and `startTime` marks when the session actually began rather
-* than when the isolate happened to start.
+* construction costs nothing and lets the server bundle be evaluated. It does
+* not make any of it safe to use there: this instance, `cache` and `config` are
+* module singletons, so calling `track()` on a server shares one session and one
+* visitor across every request the isolate serves. Import it there; do not track.
 */
 function getSession() {
 	return session ??= new Session();

package/dist/setup/session.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"session.mjs","names":["uuidv7"],"sources":["../../src/setup/session.ts"],"sourcesContent":["import { v7 as uuidv7 } from 'uuid';\n\nexport const SESSION_TIMEOUT = 30 * 60 * 1000;\n\nclass Session {\n  private id: string;\n  private startTime: number;\n  private lastActiveTime: number;\n  private accumulatedTime: number;\n\n  private active: boolean;\n  private visible: boolean;\n  private focused: boolean;\n\n  constructor() {\n    this.id = uuidv7();\n    this.startTime = Date.now();\n    this.lastActiveTime = Date.now();\n    this.accumulatedTime = 0;\n\n    this.active = true;\n    this.visible = typeof document !== 'undefined' ? document.visibilityState === 'visible' : true;\n    this.focused = typeof document !== 'undefined' ? document.hasFocus() : true;\n  }\n\n  getId = () => this.id;\n\n  isActive = () => this.active;\n  isVisible = () => this.visible;\n  isFocused = () => this.focused;\n  isExpired = () => Date.now() - this.lastActiveTime > SESSION_TIMEOUT;\n\n  updateLastActiveTime = () => {\n    this.lastActiveTime = Date.now();\n  };\n\n  updateActive = (active: boolean) => {\n    this.active = active;\n  };\n\n  refresh = () => {\n    this.id = uuidv7();\n    this.lastActiveTime = Date.now();\n  };\n\n  updateAccumulator = () => {\n    const now = Date.now();\n    if (this.focused && this.visible && this.active) {\n      const delta = now - this.startTime;\n      if (delta > 0 && delta < SESSION_TIMEOUT) {\n        this.accumulatedTime += delta;\n      }\n    }\n    this.startTime = now;\n  };\n\n  focus = () => {\n    this.updateAccumulator();\n    this.updateLastActiveTime();\n    this.focused = true;\n  };\n\n  blur = () => {\n    this.updateAccumulator();\n    this.focused = false;\n  };\n\n  pageshow = () => {\n    this.updateAccumulator();\n    this.updateLastActiveTime();\n    this.active = true;\n  };\n\n  pagehide = () => {\n    this.updateAccumulator();\n    this.active = false;\n  };\n\n  visibilitychange = (state: DocumentVisibilityState) => {\n    this.updateAccumulator();\n    if (state === 'visible') {\n      this.updateLastActiveTime();\n    }\n    this.visible = state === 'visible';\n  };\n\n  flush = () => {\n    this.updateAccumulator();\n    const engagementTime = this.accumulatedTime;\n    this.accumulatedTime = 0;\n    return engagementTime;\n  };\n}\n\nlet session: Session | undefined;\n\n/**\n * The session, built the first time something asks for it.\n *\n * Deliberately not a module-scope `new Session()`. The constructor calls\n * `uuidv7()`, `uuid` draws its bytes from `crypto.getRandomValues`, and\n * Cloudflare Workers reject that outside a request handler:\n *\n *   Disallowed operation called within global scope. Asynchronous I/O\n *   (ex: fetch() or connect()), setting a timeout, and generating random\n *   values are not allowed within global scope.\n *\n * Module scope in a Worker is evaluated once when the isolate boots and is\n * then shared by every request that isolate serves, so a random value drawn\n * there would be the same for all of them — which is why the runtime refuses\n * to produce one. A host that server-renders on Workers reaches this module\n * through `track()` on the server as well, and the throw happened as the\n * isolate booted, taking down every route before a component rendered.\n *\n * Everything here is per-visitor browser or app state, so deferring the\n * construction costs nothing and buys two things: the server bundle can be\n * evaluated, and `startTime` marks when the session actually began rather\n * than when the isolate happened to start.\n */\nexport function getSession() {\n  return (session ??= new Session());\n}\n"],"mappings":";;AAEA,MAAa,kBAAkB,OAAU;AAEzC,IAAM,UAAN,MAAc;CAUZ,cAAc;EAWA,KAAA,cAAA,KAAK;EAEF,KAAA,iBAAA,KAAK;EACJ,KAAA,kBAAA,KAAK;EACL,KAAA,kBAAA,KAAK;EACL,KAAA,kBAAA,KAAK,IAAI,IAAI,KAAK,iBAAiB;EAExB,KAAA,6BAAA;GAC3B,KAAK,iBAAiB,KAAK,IAAI;EACjC;EAEgB,KAAA,gBAAA,WAAoB;GAClC,KAAK,SAAS;EAChB;EAEgB,KAAA,gBAAA;GACd,KAAK,KAAKA,GAAO;GACjB,KAAK,iBAAiB,KAAK,IAAI;EACjC;EAE0B,KAAA,0BAAA;GACxB,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,KAAK,WAAW,KAAK,WAAW,KAAK,QAAQ;IAC/C,MAAM,QAAQ,MAAM,KAAK;IACzB,IAAI,QAAQ,KAAK,QAAA,MACf,KAAK,mBAAmB;GAE5B;GACA,KAAK,YAAY;EACnB;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,KAAK,qBAAqB;GAC1B,KAAK,UAAU;EACjB;EAEa,KAAA,aAAA;GACX,KAAK,kBAAkB;GACvB,KAAK,UAAU;EACjB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,qBAAqB;GAC1B,KAAK,SAAS;EAChB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,SAAS;EAChB;EAEoB,KAAA,oBAAA,UAAmC;GACrD,KAAK,kBAAkB;GACvB,IAAI,UAAU,WACZ,KAAK,qBAAqB;GAE5B,KAAK,UAAU,UAAU;EAC3B;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,MAAM,iBAAiB,KAAK;GAC5B,KAAK,kBAAkB;GACvB,OAAO;EACT;EA5EE,KAAK,KAAKA,GAAO;EACjB,KAAK,YAAY,KAAK,IAAI;EAC1B,KAAK,iBAAiB,KAAK,IAAI;EAC/B,KAAK,kBAAkB;EAEvB,KAAK,SAAS;EACd,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,oBAAoB,YAAY;EAC1F,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,SAAS,IAAI;CACzE;AAqEF;AAEA,IAAI;;;;;;;;;;;;;;;;;;;;;;;;AAyBJ,SAAgB,aAAa;CAC3B,OAAQ,YAAY,IAAI,QAAQ;AAClC"}
+{"version":3,"file":"session.mjs","names":["uuidv7"],"sources":["../../src/setup/session.ts"],"sourcesContent":["import { v7 as uuidv7 } from 'uuid';\nimport { keys } from '../constants/storage';\nimport { config } from './index';\n\nexport const SESSION_TIMEOUT = 30 * 60 * 1000;\n\n/**\n * The part of a session that outlives the page: its identity, and the clock the timeout is\n * measured against. GA4 keeps these in its `_ga_<container>` cookie — alongside the engaged flag,\n * which arrives with `session_engaged` later — and rereads them for every event, which is what\n * makes a session survive a reload, span a whole multipage visit, and stay shared between two\n * tabs of the same site. Holding them in memory instead, as this did, starts a new session on\n * every full navigation and gives every tab one of its own.\n */\ninterface StoredSession {\n  id: string;\n  /** When the last event was sent. The timeout is measured from here, and only from here. */\n  lastEventTime: number;\n}\n\n/** The session an event belongs to, and whether that event is the one that started it. */\ninterface SessionForEvent {\n  id: string;\n  started: boolean;\n}\n\n/**\n * `<version>.<id>.<lastEventTime>`, compact and cookie-safe rather than JSON: `{`, `\"`\n * and `,` all have to be percent-encoded in a cookie, and a host that wants one session across\n * its subdomains will hand `setupAnalytics` a cookie-backed `storage`, where this has to survive\n * unchanged. A uuidv7 contains no dots, so the record splits cleanly.\n *\n * The version guards a change the parser could not otherwise survive. A field appended to the end\n * does not need one — a short record simply leaves it undefined.\n */\nconst VERSION = '1';\n\nfunction readSession(): StoredSession | undefined {\n  const raw = config.storage.getItem(keys.session);\n  if (!raw) return undefined;\n\n  const [version, id, lastEventTime] = raw.split('.');\n  if (version !== VERSION || !id) return undefined;\n\n  const parsed = { id, lastEventTime: Number(lastEventTime) };\n  if (!Number.isFinite(parsed.lastEventTime)) return undefined;\n  return parsed;\n}\n\nfunction writeSession({ id, lastEventTime }: StoredSession) {\n  config.storage.setItem(keys.session, `${VERSION}.${id}.${lastEventTime}`);\n}\n\nclass Session {\n  /**\n   * Engagement is deliberately not stored: it is the time this page has accrued and not yet\n   * reported, so it belongs to the page, not to the session. GA4 draws the same line — its cookie\n   * carries the session, while the engagement timer lives and dies with the document.\n   *\n   * `lastTickTime` is where the accumulator last settled up, rewritten on every tick — it is not\n   * when the session began, and nothing here needs to know that.\n   */\n  private lastTickTime: number;\n  private accumulatedTime: number;\n\n  private active: boolean;\n  private visible: boolean;\n  private focused: boolean;\n\n  constructor() {\n    this.lastTickTime = Date.now();\n    this.accumulatedTime = 0;\n\n    this.active = true;\n    this.visible = typeof document !== 'undefined' ? document.visibilityState === 'visible' : true;\n    this.focused = typeof document !== 'undefined' ? document.hasFocus() : true;\n  }\n\n  /**\n   * The session a batch of events belongs to: read the stored one, start a new one if it has\n   * timed out or there is none, stamp it with when those events happened and write it back. Every\n   * event goes through here, exactly as GA4 rereads and rewrites its cookie per event — caching\n   * the session in memory would put the tabs back out of step with each other.\n   */\n  touch = (eventTime: number, lastEventTime = eventTime): SessionForEvent => {\n    const stored = readSession();\n\n    if (stored && eventTime - stored.lastEventTime <= SESSION_TIMEOUT) {\n      // `Math.max`, because a batch that waited in a frozen tab can be older than what another\n      // tab has since written, and a session must never be shortened by a late arrival.\n      writeSession({ ...stored, lastEventTime: Math.max(stored.lastEventTime, lastEventTime) });\n      return { id: stored.id, started: false };\n    }\n\n    // Engagement the previous session accrued but never reported dies with it rather than being\n    // handed to its successor. GA4 does the same on `session_start`.\n    this.accumulatedTime = 0;\n    // Wall clock, not `eventTime`: this anchors the engagement timer for the page in front of the\n    // visitor now, which a batch describing something that happened an hour ago says nothing about.\n    this.lastTickTime = Date.now();\n\n    const session: StoredSession = { id: uuidv7(), lastEventTime };\n    writeSession(session);\n    return { id: session.id, started: true };\n  };\n\n  /**\n   * The id for an event that must not start a session — the `pagehide` beacon, which reports what\n   * the session now ending accrued. A live session is extended, as any event extends it; one\n   * already past its timeout still owns that engagement, so its id comes back without being\n   * revived into a session no `session_start` ever announced.\n   */\n  extend = (): string => {\n    const stored = readSession();\n    if (!stored) return this.touch(Date.now()).id;\n\n    const now = Date.now();\n    if (now - stored.lastEventTime <= SESSION_TIMEOUT) {\n      writeSession({ ...stored, lastEventTime: now });\n    }\n    return stored.id;\n  };\n\n  isActive = () => this.active;\n\n  updateActive = (active: boolean) => {\n    this.active = active;\n  };\n\n  updateAccumulator = () => {\n    const now = Date.now();\n    if (this.focused && this.visible && this.active) {\n      const delta = now - this.lastTickTime;\n      if (delta > 0 && delta < SESSION_TIMEOUT) {\n        this.accumulatedTime += delta;\n      }\n    }\n    this.lastTickTime = now;\n  };\n\n  focus = () => {\n    this.updateAccumulator();\n    this.focused = true;\n  };\n\n  blur = () => {\n    this.updateAccumulator();\n    this.focused = false;\n  };\n\n  pageshow = () => {\n    this.updateAccumulator();\n    this.active = true;\n  };\n\n  pagehide = () => {\n    this.updateAccumulator();\n    this.active = false;\n  };\n\n  visibilitychange = (state: DocumentVisibilityState) => {\n    this.updateAccumulator();\n    this.visible = state === 'visible';\n  };\n\n  flush = () => {\n    this.updateAccumulator();\n    const engagementTime = this.accumulatedTime;\n    this.accumulatedTime = 0;\n    return engagementTime;\n  };\n}\n\nlet session: Session | undefined;\n\n/**\n * The session, built the first time something asks for it.\n *\n * Deliberately not a module-scope `new Session()`. The constructor calls\n * `uuidv7()`, `uuid` draws its bytes from `crypto.getRandomValues`, and\n * Cloudflare Workers reject that outside a request handler:\n *\n *   Disallowed operation called within global scope. Asynchronous I/O\n *   (ex: fetch() or connect()), setting a timeout, and generating random\n *   values are not allowed within global scope.\n *\n * Module scope in a Worker is evaluated once when the isolate boots and is\n * then shared by every request that isolate serves, so a random value drawn\n * there would be the same for all of them — which is why the runtime refuses\n * to produce one. A host that server-renders on Workers reaches this module\n * through `track()` on the server as well, and the throw happened as the\n * isolate booted, taking down every route before a component rendered.\n *\n * Everything here is per-visitor browser or app state, so deferring the\n * construction costs nothing and lets the server bundle be evaluated. It does\n * not make any of it safe to use there: this instance, `cache` and `config` are\n * module singletons, so calling `track()` on a server shares one session and one\n * visitor across every request the isolate serves. Import it there; do not track.\n */\nexport function getSession() {\n  return (session ??= new Session());\n}\n"],"mappings":";;;;AAIA,MAAa,kBAAkB,OAAU;;;;;;;;;;AA+BzC,MAAM,UAAU;AAEhB,SAAS,cAAyC;CAChD,MAAM,MAAM,OAAO,QAAQ,QAAQ,KAAK,OAAO;CAC/C,IAAI,CAAC,KAAK,OAAO,KAAA;CAEjB,MAAM,CAAC,SAAS,IAAI,iBAAiB,IAAI,MAAM,GAAG;CAClD,IAAI,YAAY,WAAW,CAAC,IAAI,OAAO,KAAA;CAEvC,MAAM,SAAS;EAAE;EAAI,eAAe,OAAO,aAAa;CAAE;CAC1D,IAAI,CAAC,OAAO,SAAS,OAAO,aAAa,GAAG,OAAO,KAAA;CACnD,OAAO;AACT;AAEA,SAAS,aAAa,EAAE,IAAI,iBAAgC;CAC1D,OAAO,QAAQ,QAAQ,KAAK,SAAS,GAAG,QAAQ,GAAG,GAAG,GAAG,eAAe;AAC1E;AAEA,IAAM,UAAN,MAAc;CAgBZ,cAAc;EAeL,KAAA,SAAA,WAAmB,gBAAgB,cAA+B;GACzE,MAAM,SAAS,YAAY;GAE3B,IAAI,UAAU,YAAY,OAAO,iBAAA,MAAkC;IAGjE,aAAa;KAAE,GAAG;KAAQ,eAAe,KAAK,IAAI,OAAO,eAAe,aAAa;IAAE,CAAC;IACxF,OAAO;KAAE,IAAI,OAAO;KAAI,SAAS;IAAM;GACzC;GAIA,KAAK,kBAAkB;GAGvB,KAAK,eAAe,KAAK,IAAI;GAE7B,MAAM,UAAyB;IAAE,IAAIA,GAAO;IAAG;GAAc;GAC7D,aAAa,OAAO;GACpB,OAAO;IAAE,IAAI,QAAQ;IAAI,SAAS;GAAK;EACzC;EAQuB,KAAA,eAAA;GACrB,MAAM,SAAS,YAAY;GAC3B,IAAI,CAAC,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC;GAE3C,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,MAAM,OAAO,iBAAA,MACf,aAAa;IAAE,GAAG;IAAQ,eAAe;GAAI,CAAC;GAEhD,OAAO,OAAO;EAChB;EAEiB,KAAA,iBAAA,KAAK;EAEN,KAAA,gBAAA,WAAoB;GAClC,KAAK,SAAS;EAChB;EAE0B,KAAA,0BAAA;GACxB,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,KAAK,WAAW,KAAK,WAAW,KAAK,QAAQ;IAC/C,MAAM,QAAQ,MAAM,KAAK;IACzB,IAAI,QAAQ,KAAK,QAAA,MACf,KAAK,mBAAmB;GAE5B;GACA,KAAK,eAAe;EACtB;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,KAAK,UAAU;EACjB;EAEa,KAAA,aAAA;GACX,KAAK,kBAAkB;GACvB,KAAK,UAAU;EACjB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,SAAS;EAChB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,SAAS;EAChB;EAEoB,KAAA,oBAAA,UAAmC;GACrD,KAAK,kBAAkB;GACvB,KAAK,UAAU,UAAU;EAC3B;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,MAAM,iBAAiB,KAAK;GAC5B,KAAK,kBAAkB;GACvB,OAAO;EACT;EApGE,KAAK,eAAe,KAAK,IAAI;EAC7B,KAAK,kBAAkB;EAEvB,KAAK,SAAS;EACd,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,oBAAoB,YAAY;EAC1F,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,SAAS,IAAI;CACzE;AA+FF;AAEA,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;AA0BJ,SAAgB,aAAa;CAC3B,OAAQ,YAAY,IAAI,QAAQ;AAClC"}

package/dist/tanstack/middleware.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.cjs","names":["resolveClickIdCookies","toSetCookieHeaders"],"sources":["../../src/tanstack/middleware.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start';\nimport { resolveClickIdCookies, toSetCookieHeaders } from '../click-id/index';\n\nexport interface ClickIdMiddlewareOptions {\n  /** `Domain` attribute for the cookies, e.g. `.edensign.io`. Omit for a host-only cookie. */\n  domain?: string;\n  /** `Secure` attribute, default true. Set false only for local http testing. */\n  secure?: boolean;\n  /** subdomainIndex for a freshly built `_fbc` (com=0, example.com=1, www.example.com=2). Default 1. */\n  subdomainIndex?: number;\n  /**\n   * Re-issue a still-valid `_fbc` on every request as an ITP self-heal (restores the long-lived\n   * HTTP cookie if the Meta Pixel's `document.cookie` write re-capped it to 24h in Safari). On by\n   * default. Note it attaches a per-user `Set-Cookie` — and thus `no-store` — to every page\n   * response carrying an `_fbc`, defeating CDN caching of those pages; set false to strictly follow\n   * Meta's conditional-write rule and keep them cacheable. See {@link resolveClickIdCookies}.\n   */\n  refresh?: boolean;\n  /**\n   * Override the `Cache-Control` of a response we attach cookies to (default `private, no-store`).\n   * A per-user `Set-Cookie` must never end up on a shared-cache entry, or one visitor's `_fbc` would\n   * be served to everyone. Only set this false if you guarantee these responses are never cached.\n   */\n  cacheControl?: string | false;\n  /**\n   * Consent gate. Return false to skip setting cookies for this request (e.g. before the visitor has\n   * granted consent where required). Runs per request with the incoming `Request`.\n   */\n  shouldPersist?: (request: Request) => boolean;\n}\n\n/**\n * TanStack Start request middleware that persists ad click-id cookies (`_fbc`, `_rdt_cid`) on the\n * document response.\n *\n * Setting `_fbc` here — on the top document via an HTTP `Set-Cookie` header, before any client JS\n * runs — is what Meta officially recommends and the only reliable way to keep the cookie alive for\n * 90 days in Safari: ITP caps JavaScript-set cookies on a fbclid-decorated landing page to 24\n * hours, and a document response is never classified as CNAME/IP cloaking (it is the reference the\n * browser measures cloaking against).\n *\n * Register it as a global request middleware:\n * ```ts\n * // start.ts\n * import { createStart } from '@tanstack/react-start'\n * import { clickIdMiddleware } from '@shware/analytics/tanstack'\n * export const startInstance = createStart(() => ({ requestMiddleware: [clickIdMiddleware] }))\n * ```\n *\n * reference: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/fbp-and-fbc\n */\nexport function createClickIdMiddleware(options: ClickIdMiddlewareOptions = {}) {\n  const { cacheControl = 'private, no-store' } = options;\n\n  return createMiddleware({ type: 'request' }).server(async ({ request, next, handlerType }) => {\n    const result = await next();\n\n    // Skip serverFn RPC responses. 'router' covers SSR document requests *and* custom server\n    // routes (API endpoints) — those also get cookies when the URL carries a click id.\n    if (handlerType !== 'router') return result;\n    if (options.shouldPersist && !options.shouldPersist(request)) return result;\n\n    const { cookies } = resolveClickIdCookies({\n      url: request.url,\n      cookieHeader: request.headers.get('cookie'),\n      domain: options.domain,\n      secure: options.secure,\n      subdomainIndex: options.subdomainIndex,\n      refresh: options.refresh ?? true,\n    });\n\n    if (cookies.length > 0) {\n      for (const header of toSetCookieHeaders(cookies)) {\n        result.response.headers.append('set-cookie', header);\n      }\n      if (cacheControl !== false) {\n        result.response.headers.set('cache-control', cacheControl);\n      }\n    }\n\n    return result;\n  });\n}\n\n/** Ready-to-register middleware with default options. */\nexport const clickIdMiddleware = createClickIdMiddleware();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,wBAAwB,UAAoC,CAAC,GAAG;CAC9E,MAAM,EAAE,eAAe,wBAAwB;CAE/C,QAAA,GAAA,sBAAA,iBAAA,CAAwB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,SAAS,MAAM,kBAAkB;EAC5F,MAAM,SAAS,MAAM,KAAK;EAI1B,IAAI,gBAAgB,UAAU,OAAO;EACrC,IAAI,QAAQ,iBAAiB,CAAC,QAAQ,cAAc,OAAO,GAAG,OAAO;EAErE,MAAM,EAAE,YAAYA,uBAAAA,sBAAsB;GACxC,KAAK,QAAQ;GACb,cAAc,QAAQ,QAAQ,IAAI,QAAQ;GAC1C,QAAQ,QAAQ;GAChB,QAAQ,QAAQ;GAChB,gBAAgB,QAAQ;GACxB,SAAS,QAAQ,WAAW;EAC9B,CAAC;EAED,IAAI,QAAQ,SAAS,GAAG;GACtB,KAAK,MAAM,UAAUC,uBAAAA,mBAAmB,OAAO,GAC7C,OAAO,SAAS,QAAQ,OAAO,cAAc,MAAM;GAErD,IAAI,iBAAiB,OACnB,OAAO,SAAS,QAAQ,IAAI,iBAAiB,YAAY;EAE7D;EAEA,OAAO;CACT,CAAC;AACH;;AAGA,MAAa,oBAAoB,wBAAwB"}
+{"version":3,"file":"middleware.cjs","names":["resolveClickIdCookies","toSetCookieHeaders"],"sources":["../../src/tanstack/middleware.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start';\nimport { resolveClickIdCookies, toSetCookieHeaders } from '../click-id/index';\n\nexport interface ClickIdMiddlewareOptions {\n  /** `Domain` attribute for the cookies, e.g. `.shware.io`. Omit for a host-only cookie. */\n  domain?: string;\n  /** `Secure` attribute, default true. Set false only for local http testing. */\n  secure?: boolean;\n  /** subdomainIndex for a freshly built `_fbc` (com=0, example.com=1, www.example.com=2). Default 1. */\n  subdomainIndex?: number;\n  /**\n   * Re-issue a still-valid `_fbc` on every request as an ITP self-heal (restores the long-lived\n   * HTTP cookie if the Meta Pixel's `document.cookie` write re-capped it to 24h in Safari). On by\n   * default. Note it attaches a per-user `Set-Cookie` — and thus `no-store` — to every page\n   * response carrying an `_fbc`, defeating CDN caching of those pages; set false to strictly follow\n   * Meta's conditional-write rule and keep them cacheable. See {@link resolveClickIdCookies}.\n   */\n  refresh?: boolean;\n  /**\n   * Override the `Cache-Control` of a response we attach cookies to (default `private, no-store`).\n   * A per-user `Set-Cookie` must never end up on a shared-cache entry, or one visitor's `_fbc` would\n   * be served to everyone. Only set this false if you guarantee these responses are never cached.\n   */\n  cacheControl?: string | false;\n  /**\n   * Consent gate. Return false to skip setting cookies for this request (e.g. before the visitor has\n   * granted consent where required). Runs per request with the incoming `Request`.\n   */\n  shouldPersist?: (request: Request) => boolean;\n}\n\n/**\n * TanStack Start request middleware that persists ad click-id cookies (`_fbc`, `_rdt_cid`) on the\n * document response.\n *\n * Setting `_fbc` here — on the top document via an HTTP `Set-Cookie` header, before any client JS\n * runs — is what Meta officially recommends and the only reliable way to keep the cookie alive for\n * 90 days in Safari: ITP caps JavaScript-set cookies on a fbclid-decorated landing page to 24\n * hours, and a document response is never classified as CNAME/IP cloaking (it is the reference the\n * browser measures cloaking against).\n *\n * Register it as a global request middleware:\n * ```ts\n * // start.ts\n * import { createStart } from '@tanstack/react-start'\n * import { clickIdMiddleware } from '@shware/analytics/tanstack'\n * export const startInstance = createStart(() => ({ requestMiddleware: [clickIdMiddleware] }))\n * ```\n *\n * reference: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/fbp-and-fbc\n */\nexport function createClickIdMiddleware(options: ClickIdMiddlewareOptions = {}) {\n  const { cacheControl = 'private, no-store' } = options;\n\n  return createMiddleware({ type: 'request' }).server(async ({ request, next, handlerType }) => {\n    const result = await next();\n\n    // Skip serverFn RPC responses. 'router' covers SSR document requests *and* custom server\n    // routes (API endpoints) — those also get cookies when the URL carries a click id.\n    if (handlerType !== 'router') return result;\n    if (options.shouldPersist && !options.shouldPersist(request)) return result;\n\n    const { cookies } = resolveClickIdCookies({\n      url: request.url,\n      cookieHeader: request.headers.get('cookie'),\n      domain: options.domain,\n      secure: options.secure,\n      subdomainIndex: options.subdomainIndex,\n      refresh: options.refresh ?? true,\n    });\n\n    if (cookies.length > 0) {\n      for (const header of toSetCookieHeaders(cookies)) {\n        result.response.headers.append('set-cookie', header);\n      }\n      if (cacheControl !== false) {\n        result.response.headers.set('cache-control', cacheControl);\n      }\n    }\n\n    return result;\n  });\n}\n\n/** Ready-to-register middleware with default options. */\nexport const clickIdMiddleware = createClickIdMiddleware();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,wBAAwB,UAAoC,CAAC,GAAG;CAC9E,MAAM,EAAE,eAAe,wBAAwB;CAE/C,QAAA,GAAA,sBAAA,iBAAA,CAAwB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,SAAS,MAAM,kBAAkB;EAC5F,MAAM,SAAS,MAAM,KAAK;EAI1B,IAAI,gBAAgB,UAAU,OAAO;EACrC,IAAI,QAAQ,iBAAiB,CAAC,QAAQ,cAAc,OAAO,GAAG,OAAO;EAErE,MAAM,EAAE,YAAYA,uBAAAA,sBAAsB;GACxC,KAAK,QAAQ;GACb,cAAc,QAAQ,QAAQ,IAAI,QAAQ;GAC1C,QAAQ,QAAQ;GAChB,QAAQ,QAAQ;GAChB,gBAAgB,QAAQ;GACxB,SAAS,QAAQ,WAAW;EAC9B,CAAC;EAED,IAAI,QAAQ,SAAS,GAAG;GACtB,KAAK,MAAM,UAAUC,uBAAAA,mBAAmB,OAAO,GAC7C,OAAO,SAAS,QAAQ,OAAO,cAAc,MAAM;GAErD,IAAI,iBAAiB,OACnB,OAAO,SAAS,QAAQ,IAAI,iBAAiB,YAAY;EAE7D;EAEA,OAAO;CACT,CAAC;AACH;;AAGA,MAAa,oBAAoB,wBAAwB"}

package/dist/tanstack/middleware.d.cts

@@ -1,6 +1,6 @@
 //#region src/tanstack/middleware.d.ts
 interface ClickIdMiddlewareOptions {
-  /** `Domain` attribute for the cookies, e.g. `.edensign.io`. Omit for a host-only cookie. */
+  /** `Domain` attribute for the cookies, e.g. `.shware.io`. Omit for a host-only cookie. */
   domain?: string;
   /** `Secure` attribute, default true. Set false only for local http testing. */
   secure?: boolean;

package/dist/tanstack/middleware.d.mts

@@ -1,6 +1,6 @@
 //#region src/tanstack/middleware.d.ts
 interface ClickIdMiddlewareOptions {
-  /** `Domain` attribute for the cookies, e.g. `.edensign.io`. Omit for a host-only cookie. */
+  /** `Domain` attribute for the cookies, e.g. `.shware.io`. Omit for a host-only cookie. */
   domain?: string;
   /** `Secure` attribute, default true. Set false only for local http testing. */
   secure?: boolean;

package/dist/tanstack/middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.mjs","names":[],"sources":["../../src/tanstack/middleware.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start';\nimport { resolveClickIdCookies, toSetCookieHeaders } from '../click-id/index';\n\nexport interface ClickIdMiddlewareOptions {\n  /** `Domain` attribute for the cookies, e.g. `.edensign.io`. Omit for a host-only cookie. */\n  domain?: string;\n  /** `Secure` attribute, default true. Set false only for local http testing. */\n  secure?: boolean;\n  /** subdomainIndex for a freshly built `_fbc` (com=0, example.com=1, www.example.com=2). Default 1. */\n  subdomainIndex?: number;\n  /**\n   * Re-issue a still-valid `_fbc` on every request as an ITP self-heal (restores the long-lived\n   * HTTP cookie if the Meta Pixel's `document.cookie` write re-capped it to 24h in Safari). On by\n   * default. Note it attaches a per-user `Set-Cookie` — and thus `no-store` — to every page\n   * response carrying an `_fbc`, defeating CDN caching of those pages; set false to strictly follow\n   * Meta's conditional-write rule and keep them cacheable. See {@link resolveClickIdCookies}.\n   */\n  refresh?: boolean;\n  /**\n   * Override the `Cache-Control` of a response we attach cookies to (default `private, no-store`).\n   * A per-user `Set-Cookie` must never end up on a shared-cache entry, or one visitor's `_fbc` would\n   * be served to everyone. Only set this false if you guarantee these responses are never cached.\n   */\n  cacheControl?: string | false;\n  /**\n   * Consent gate. Return false to skip setting cookies for this request (e.g. before the visitor has\n   * granted consent where required). Runs per request with the incoming `Request`.\n   */\n  shouldPersist?: (request: Request) => boolean;\n}\n\n/**\n * TanStack Start request middleware that persists ad click-id cookies (`_fbc`, `_rdt_cid`) on the\n * document response.\n *\n * Setting `_fbc` here — on the top document via an HTTP `Set-Cookie` header, before any client JS\n * runs — is what Meta officially recommends and the only reliable way to keep the cookie alive for\n * 90 days in Safari: ITP caps JavaScript-set cookies on a fbclid-decorated landing page to 24\n * hours, and a document response is never classified as CNAME/IP cloaking (it is the reference the\n * browser measures cloaking against).\n *\n * Register it as a global request middleware:\n * ```ts\n * // start.ts\n * import { createStart } from '@tanstack/react-start'\n * import { clickIdMiddleware } from '@shware/analytics/tanstack'\n * export const startInstance = createStart(() => ({ requestMiddleware: [clickIdMiddleware] }))\n * ```\n *\n * reference: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/fbp-and-fbc\n */\nexport function createClickIdMiddleware(options: ClickIdMiddlewareOptions = {}) {\n  const { cacheControl = 'private, no-store' } = options;\n\n  return createMiddleware({ type: 'request' }).server(async ({ request, next, handlerType }) => {\n    const result = await next();\n\n    // Skip serverFn RPC responses. 'router' covers SSR document requests *and* custom server\n    // routes (API endpoints) — those also get cookies when the URL carries a click id.\n    if (handlerType !== 'router') return result;\n    if (options.shouldPersist && !options.shouldPersist(request)) return result;\n\n    const { cookies } = resolveClickIdCookies({\n      url: request.url,\n      cookieHeader: request.headers.get('cookie'),\n      domain: options.domain,\n      secure: options.secure,\n      subdomainIndex: options.subdomainIndex,\n      refresh: options.refresh ?? true,\n    });\n\n    if (cookies.length > 0) {\n      for (const header of toSetCookieHeaders(cookies)) {\n        result.response.headers.append('set-cookie', header);\n      }\n      if (cacheControl !== false) {\n        result.response.headers.set('cache-control', cacheControl);\n      }\n    }\n\n    return result;\n  });\n}\n\n/** Ready-to-register middleware with default options. */\nexport const clickIdMiddleware = createClickIdMiddleware();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,wBAAwB,UAAoC,CAAC,GAAG;CAC9E,MAAM,EAAE,eAAe,wBAAwB;CAE/C,OAAO,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,SAAS,MAAM,kBAAkB;EAC5F,MAAM,SAAS,MAAM,KAAK;EAI1B,IAAI,gBAAgB,UAAU,OAAO;EACrC,IAAI,QAAQ,iBAAiB,CAAC,QAAQ,cAAc,OAAO,GAAG,OAAO;EAErE,MAAM,EAAE,YAAY,sBAAsB;GACxC,KAAK,QAAQ;GACb,cAAc,QAAQ,QAAQ,IAAI,QAAQ;GAC1C,QAAQ,QAAQ;GAChB,QAAQ,QAAQ;GAChB,gBAAgB,QAAQ;GACxB,SAAS,QAAQ,WAAW;EAC9B,CAAC;EAED,IAAI,QAAQ,SAAS,GAAG;GACtB,KAAK,MAAM,UAAU,mBAAmB,OAAO,GAC7C,OAAO,SAAS,QAAQ,OAAO,cAAc,MAAM;GAErD,IAAI,iBAAiB,OACnB,OAAO,SAAS,QAAQ,IAAI,iBAAiB,YAAY;EAE7D;EAEA,OAAO;CACT,CAAC;AACH;;AAGA,MAAa,oBAAoB,wBAAwB"}
+{"version":3,"file":"middleware.mjs","names":[],"sources":["../../src/tanstack/middleware.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start';\nimport { resolveClickIdCookies, toSetCookieHeaders } from '../click-id/index';\n\nexport interface ClickIdMiddlewareOptions {\n  /** `Domain` attribute for the cookies, e.g. `.shware.io`. Omit for a host-only cookie. */\n  domain?: string;\n  /** `Secure` attribute, default true. Set false only for local http testing. */\n  secure?: boolean;\n  /** subdomainIndex for a freshly built `_fbc` (com=0, example.com=1, www.example.com=2). Default 1. */\n  subdomainIndex?: number;\n  /**\n   * Re-issue a still-valid `_fbc` on every request as an ITP self-heal (restores the long-lived\n   * HTTP cookie if the Meta Pixel's `document.cookie` write re-capped it to 24h in Safari). On by\n   * default. Note it attaches a per-user `Set-Cookie` — and thus `no-store` — to every page\n   * response carrying an `_fbc`, defeating CDN caching of those pages; set false to strictly follow\n   * Meta's conditional-write rule and keep them cacheable. See {@link resolveClickIdCookies}.\n   */\n  refresh?: boolean;\n  /**\n   * Override the `Cache-Control` of a response we attach cookies to (default `private, no-store`).\n   * A per-user `Set-Cookie` must never end up on a shared-cache entry, or one visitor's `_fbc` would\n   * be served to everyone. Only set this false if you guarantee these responses are never cached.\n   */\n  cacheControl?: string | false;\n  /**\n   * Consent gate. Return false to skip setting cookies for this request (e.g. before the visitor has\n   * granted consent where required). Runs per request with the incoming `Request`.\n   */\n  shouldPersist?: (request: Request) => boolean;\n}\n\n/**\n * TanStack Start request middleware that persists ad click-id cookies (`_fbc`, `_rdt_cid`) on the\n * document response.\n *\n * Setting `_fbc` here — on the top document via an HTTP `Set-Cookie` header, before any client JS\n * runs — is what Meta officially recommends and the only reliable way to keep the cookie alive for\n * 90 days in Safari: ITP caps JavaScript-set cookies on a fbclid-decorated landing page to 24\n * hours, and a document response is never classified as CNAME/IP cloaking (it is the reference the\n * browser measures cloaking against).\n *\n * Register it as a global request middleware:\n * ```ts\n * // start.ts\n * import { createStart } from '@tanstack/react-start'\n * import { clickIdMiddleware } from '@shware/analytics/tanstack'\n * export const startInstance = createStart(() => ({ requestMiddleware: [clickIdMiddleware] }))\n * ```\n *\n * reference: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/fbp-and-fbc\n */\nexport function createClickIdMiddleware(options: ClickIdMiddlewareOptions = {}) {\n  const { cacheControl = 'private, no-store' } = options;\n\n  return createMiddleware({ type: 'request' }).server(async ({ request, next, handlerType }) => {\n    const result = await next();\n\n    // Skip serverFn RPC responses. 'router' covers SSR document requests *and* custom server\n    // routes (API endpoints) — those also get cookies when the URL carries a click id.\n    if (handlerType !== 'router') return result;\n    if (options.shouldPersist && !options.shouldPersist(request)) return result;\n\n    const { cookies } = resolveClickIdCookies({\n      url: request.url,\n      cookieHeader: request.headers.get('cookie'),\n      domain: options.domain,\n      secure: options.secure,\n      subdomainIndex: options.subdomainIndex,\n      refresh: options.refresh ?? true,\n    });\n\n    if (cookies.length > 0) {\n      for (const header of toSetCookieHeaders(cookies)) {\n        result.response.headers.append('set-cookie', header);\n      }\n      if (cacheControl !== false) {\n        result.response.headers.set('cache-control', cacheControl);\n      }\n    }\n\n    return result;\n  });\n}\n\n/** Ready-to-register middleware with default options. */\nexport const clickIdMiddleware = createClickIdMiddleware();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,wBAAwB,UAAoC,CAAC,GAAG;CAC9E,MAAM,EAAE,eAAe,wBAAwB;CAE/C,OAAO,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,SAAS,MAAM,kBAAkB;EAC5F,MAAM,SAAS,MAAM,KAAK;EAI1B,IAAI,gBAAgB,UAAU,OAAO;EACrC,IAAI,QAAQ,iBAAiB,CAAC,QAAQ,cAAc,OAAO,GAAG,OAAO;EAErE,MAAM,EAAE,YAAY,sBAAsB;GACxC,KAAK,QAAQ;GACb,cAAc,QAAQ,QAAQ,IAAI,QAAQ;GAC1C,QAAQ,QAAQ;GAChB,QAAQ,QAAQ;GAChB,gBAAgB,QAAQ;GACxB,SAAS,QAAQ,WAAW;EAC9B,CAAC;EAED,IAAI,QAAQ,SAAS,GAAG;GACtB,KAAK,MAAM,UAAU,mBAAmB,OAAO,GAC7C,OAAO,SAAS,QAAQ,OAAO,cAAc,MAAM;GAErD,IAAI,iBAAiB,OACnB,OAAO,SAAS,QAAQ,IAAI,iBAAiB,YAAY;EAE7D;EAEA,OAAO;CACT,CAAC;AACH;;AAGA,MAAa,oBAAoB,wBAAwB"}

package/dist/test/setup.cjs

@@ -0,0 +1,43 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/test/setup.ts
+/**
+* The SDK's state — `config`, `cache`, the session singleton, the track queue — lives in module
+* scope, exactly as it does in a browser. Tests therefore load the modules fresh per test with
+* `vi.resetModules()` and dynamic imports; this file only provides the pieces every test hands to
+* `setupAnalytics`, and is itself imported dynamically so it joins the same module graph.
+*/
+function memoryStorage(seed = {}) {
+	const map = new Map(Object.entries(seed));
+	return {
+		map,
+		getItem: (key) => map.get(key) ?? null,
+		setItem: (key, value) => {
+			map.set(key, value);
+		}
+	};
+}
+function baseOptions(overrides = {}) {
+	return {
+		release: "1.0.0",
+		storage: memoryStorage(),
+		endpoint: "https://api.test",
+		platform: "web",
+		environment: "production",
+		getTags: () => ({}),
+		getDeviceId: () => "device-1",
+		...overrides
+	};
+}
+/** A minimal ok Response whose json body is `data`. */
+function jsonResponse(data, status = 200) {
+	return new Response(JSON.stringify(data), {
+		status,
+		headers: { "Content-Type": "application/json" }
+	});
+}
+//#endregion
+exports.baseOptions = baseOptions;
+exports.jsonResponse = jsonResponse;
+exports.memoryStorage = memoryStorage;
+
+//# sourceMappingURL=setup.cjs.map

package/dist/test/setup.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.cjs","names":[],"sources":["../../src/test/setup.ts"],"sourcesContent":["import type { Options } from '../setup/index';\nimport type { TrackTags } from '../track/types';\n\n/**\n * The SDK's state — `config`, `cache`, the session singleton, the track queue — lives in module\n * scope, exactly as it does in a browser. Tests therefore load the modules fresh per test with\n * `vi.resetModules()` and dynamic imports; this file only provides the pieces every test hands to\n * `setupAnalytics`, and is itself imported dynamically so it joins the same module graph.\n */\nexport function memoryStorage(seed: Record<string, string> = {}) {\n  const map = new Map(Object.entries(seed));\n  return {\n    map,\n    getItem: (key: string) => map.get(key) ?? null,\n    setItem: (key: string, value: string) => {\n      map.set(key, value);\n    },\n  };\n}\n\nexport function baseOptions(overrides: Partial<Options> = {}): Options {\n  return {\n    release: '1.0.0',\n    storage: memoryStorage(),\n    endpoint: 'https://api.test',\n    platform: 'web',\n    environment: 'production',\n    getTags: (): TrackTags => ({}),\n    getDeviceId: () => 'device-1',\n    ...overrides,\n  };\n}\n\n/** A minimal ok Response whose json body is `data`. */\nexport function jsonResponse(data: unknown, status = 200) {\n  return new Response(JSON.stringify(data), {\n    status,\n    headers: { 'Content-Type': 'application/json' },\n  });\n}\n"],"mappings":";;;;;;;;AASA,SAAgB,cAAc,OAA+B,CAAC,GAAG;CAC/D,MAAM,MAAM,IAAI,IAAI,OAAO,QAAQ,IAAI,CAAC;CACxC,OAAO;EACL;EACA,UAAU,QAAgB,IAAI,IAAI,GAAG,KAAK;EAC1C,UAAU,KAAa,UAAkB;GACvC,IAAI,IAAI,KAAK,KAAK;EACpB;CACF;AACF;AAEA,SAAgB,YAAY,YAA8B,CAAC,GAAY;CACrE,OAAO;EACL,SAAS;EACT,SAAS,cAAc;EACvB,UAAU;EACV,UAAU;EACV,aAAa;EACb,gBAA2B,CAAC;EAC5B,mBAAmB;EACnB,GAAG;CACL;AACF;;AAGA,SAAgB,aAAa,MAAe,SAAS,KAAK;CACxD,OAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;EACxC;EACA,SAAS,EAAE,gBAAgB,mBAAmB;CAChD,CAAC;AACH"}

package/dist/test/setup.d.cts

@@ -0,0 +1,19 @@
+import { Options } from "../setup/index.cjs";
+//#region src/test/setup.d.ts
+/**
+ * The SDK's state — `config`, `cache`, the session singleton, the track queue — lives in module
+ * scope, exactly as it does in a browser. Tests therefore load the modules fresh per test with
+ * `vi.resetModules()` and dynamic imports; this file only provides the pieces every test hands to
+ * `setupAnalytics`, and is itself imported dynamically so it joins the same module graph.
+ */
+declare function memoryStorage(seed?: Record<string, string>): {
+  map: Map<string, string>;
+  getItem: (key: string) => string | null;
+  setItem: (key: string, value: string) => void;
+};
+declare function baseOptions(overrides?: Partial<Options>): Options;
+/** A minimal ok Response whose json body is `data`. */
+declare function jsonResponse(data: unknown, status?: number): Response;
+//#endregion
+export { baseOptions, jsonResponse, memoryStorage };
+//# sourceMappingURL=setup.d.cts.map

package/dist/test/setup.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.d.cts","names":[],"sources":["../../src/test/setup.ts"],"mappings":";;;;;;;;iBASgB,cAAc,OAAM;OAAA;EAIjB,UAAA;EACA,UAAA,aAAM;;iBAMT,YAAY,YAAW,QAAQ,WAAgB;;iBAc/C,aAAa,eAAe,kBAAY"}

package/dist/test/setup.d.mts

@@ -0,0 +1,19 @@
+import { Options } from "../setup/index.mjs";
+//#region src/test/setup.d.ts
+/**
+ * The SDK's state — `config`, `cache`, the session singleton, the track queue — lives in module
+ * scope, exactly as it does in a browser. Tests therefore load the modules fresh per test with
+ * `vi.resetModules()` and dynamic imports; this file only provides the pieces every test hands to
+ * `setupAnalytics`, and is itself imported dynamically so it joins the same module graph.
+ */
+declare function memoryStorage(seed?: Record<string, string>): {
+  map: Map<string, string>;
+  getItem: (key: string) => string | null;
+  setItem: (key: string, value: string) => void;
+};
+declare function baseOptions(overrides?: Partial<Options>): Options;
+/** A minimal ok Response whose json body is `data`. */
+declare function jsonResponse(data: unknown, status?: number): Response;
+//#endregion
+export { baseOptions, jsonResponse, memoryStorage };
+//# sourceMappingURL=setup.d.mts.map

package/dist/test/setup.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.d.mts","names":[],"sources":["../../src/test/setup.ts"],"mappings":";;;;;;;;iBASgB,cAAc,OAAM;OAAA;EAIjB,UAAA;EACA,UAAA,aAAM;;iBAMT,YAAY,YAAW,QAAQ,WAAgB;;iBAc/C,aAAa,eAAe,kBAAY"}

package/dist/test/setup.mjs

@@ -0,0 +1,40 @@
+//#region src/test/setup.ts
+/**
+* The SDK's state — `config`, `cache`, the session singleton, the track queue — lives in module
+* scope, exactly as it does in a browser. Tests therefore load the modules fresh per test with
+* `vi.resetModules()` and dynamic imports; this file only provides the pieces every test hands to
+* `setupAnalytics`, and is itself imported dynamically so it joins the same module graph.
+*/
+function memoryStorage(seed = {}) {
+	const map = new Map(Object.entries(seed));
+	return {
+		map,
+		getItem: (key) => map.get(key) ?? null,
+		setItem: (key, value) => {
+			map.set(key, value);
+		}
+	};
+}
+function baseOptions(overrides = {}) {
+	return {
+		release: "1.0.0",
+		storage: memoryStorage(),
+		endpoint: "https://api.test",
+		platform: "web",
+		environment: "production",
+		getTags: () => ({}),
+		getDeviceId: () => "device-1",
+		...overrides
+	};
+}
+/** A minimal ok Response whose json body is `data`. */
+function jsonResponse(data, status = 200) {
+	return new Response(JSON.stringify(data), {
+		status,
+		headers: { "Content-Type": "application/json" }
+	});
+}
+//#endregion
+export { baseOptions, jsonResponse, memoryStorage };
+
+//# sourceMappingURL=setup.mjs.map

package/dist/test/setup.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.mjs","names":[],"sources":["../../src/test/setup.ts"],"sourcesContent":["import type { Options } from '../setup/index';\nimport type { TrackTags } from '../track/types';\n\n/**\n * The SDK's state — `config`, `cache`, the session singleton, the track queue — lives in module\n * scope, exactly as it does in a browser. Tests therefore load the modules fresh per test with\n * `vi.resetModules()` and dynamic imports; this file only provides the pieces every test hands to\n * `setupAnalytics`, and is itself imported dynamically so it joins the same module graph.\n */\nexport function memoryStorage(seed: Record<string, string> = {}) {\n  const map = new Map(Object.entries(seed));\n  return {\n    map,\n    getItem: (key: string) => map.get(key) ?? null,\n    setItem: (key: string, value: string) => {\n      map.set(key, value);\n    },\n  };\n}\n\nexport function baseOptions(overrides: Partial<Options> = {}): Options {\n  return {\n    release: '1.0.0',\n    storage: memoryStorage(),\n    endpoint: 'https://api.test',\n    platform: 'web',\n    environment: 'production',\n    getTags: (): TrackTags => ({}),\n    getDeviceId: () => 'device-1',\n    ...overrides,\n  };\n}\n\n/** A minimal ok Response whose json body is `data`. */\nexport function jsonResponse(data: unknown, status = 200) {\n  return new Response(JSON.stringify(data), {\n    status,\n    headers: { 'Content-Type': 'application/json' },\n  });\n}\n"],"mappings":";;;;;;;AASA,SAAgB,cAAc,OAA+B,CAAC,GAAG;CAC/D,MAAM,MAAM,IAAI,IAAI,OAAO,QAAQ,IAAI,CAAC;CACxC,OAAO;EACL;EACA,UAAU,QAAgB,IAAI,IAAI,GAAG,KAAK;EAC1C,UAAU,KAAa,UAAkB;GACvC,IAAI,IAAI,KAAK,KAAK;EACpB;CACF;AACF;AAEA,SAAgB,YAAY,YAA8B,CAAC,GAAY;CACrE,OAAO;EACL,SAAS;EACT,SAAS,cAAc;EACvB,UAAU;EACV,UAAU;EACV,aAAa;EACb,gBAA2B,CAAC;EAC5B,mBAAmB;EACnB,GAAG;CACL;AACF;;AAGA,SAAgB,aAAa,MAAe,SAAS,KAAK;CACxD,OAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;EACxC;EACA,SAAS,EAAE,gBAAgB,mBAAmB;CAChD,CAAC;AACH"}

package/dist/third-parties/meta-pixel.cjs

@@ -37,7 +37,7 @@ function setFBUser(pixelId) {
 			ph: require_utils_field.getFirst(user_data?.phone_number),
 			external_id: user_id,
 			ct: address?.city,
-			st: address?.street,
+			st: address?.region,
 			zp: address?.postal_code,
 			country: address?.country
 		});

package/dist/third-parties/meta-pixel.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"meta-pixel.cjs","names":["mapFBEvent","getFirst"],"sources":["../../src/third-parties/meta-pixel.ts"],"sourcesContent":["import type { UpdateVisitorDTO } from '../schema/index';\nimport { type FBQ, type PixelId, mapFBEvent } from '../track/fbq';\nimport type { EventName, TrackName, TrackProperties } from '../track/types';\nimport { getFirst } from '../utils/field';\n\ndeclare global {\n  interface Window {\n    /** Undefined until the Meta Pixel script has loaded. */\n    fbq?: FBQ['fbq'];\n  }\n}\n\nconst metrics = ['CLS', 'FCP', 'FID', 'INP', 'LCP', 'TTFB'];\n\nexport function sendFBEvent<T extends EventName>(\n  name: TrackName<T>,\n  properties?: TrackProperties<T>,\n  event_id?: string\n) {\n  if (typeof window === 'undefined' || !window.fbq) {\n    console.warn('fbq has not been initialized');\n    return;\n  }\n  if (metrics.includes(name)) return;\n  if (window.location.host.includes('127.0.0.1')) return;\n  if (window.location.host.includes('localhost')) return;\n\n  const options = { eventID: event_id };\n  const [type, fbEventName, fbEventProperties] = mapFBEvent(name, properties);\n  // The two branches are identical on purpose. `fbq` is overloaded per `type` — 'track' takes a\n  // standard event name with its typed properties, 'trackCustom' an arbitrary string — and what\n  // `mapFBEvent` returns is a union of both shapes. Narrowing `type` is what picks a single\n  // overload; collapsing the branches leaves the call matching none of them.\n  if (type === 'track') {\n    window.fbq(type, fbEventName, fbEventProperties, options);\n  } else {\n    window.fbq(type, fbEventName, fbEventProperties, options);\n  }\n}\n\nexport function setFBUser(pixelId: PixelId) {\n  return ({ user_id, user_data }: UpdateVisitorDTO) => {\n    if (typeof window === 'undefined' || !window.fbq) {\n      console.warn('fbq has not been initialized');\n      return;\n    }\n\n    const address = getFirst(user_data?.address);\n\n    window.fbq('init', pixelId, {\n      em: getFirst(user_data?.email),\n      fn: address?.first_name,\n      ln: address?.last_name,\n      ph: getFirst(user_data?.phone_number),\n      external_id: user_id,\n      ct: address?.city,\n      st: address?.street,\n      zp: address?.postal_code,\n      country: address?.country,\n    });\n  };\n}\n"],"mappings":";;;;AAYA,MAAM,UAAU;CAAC;CAAO;CAAO;CAAO;CAAO;CAAO;AAAM;AAE1D,SAAgB,YACd,MACA,YACA,UACA;CACA,IAAI,OAAO,WAAW,eAAe,CAAC,OAAO,KAAK;EAChD,QAAQ,KAAK,8BAA8B;EAC3C;CACF;CACA,IAAI,QAAQ,SAAS,IAAI,GAAG;CAC5B,IAAI,OAAO,SAAS,KAAK,SAAS,WAAW,GAAG;CAChD,IAAI,OAAO,SAAS,KAAK,SAAS,WAAW,GAAG;CAEhD,MAAM,UAAU,EAAE,SAAS,SAAS;CACpC,MAAM,CAAC,MAAM,aAAa,qBAAqBA,kBAAAA,WAAW,MAAM,UAAU;CAK1E,IAAI,SAAS,SACX,OAAO,IAAI,MAAM,aAAa,mBAAmB,OAAO;MAExD,OAAO,IAAI,MAAM,aAAa,mBAAmB,OAAO;AAE5D;AAEA,SAAgB,UAAU,SAAkB;CAC1C,QAAQ,EAAE,SAAS,gBAAkC;EACnD,IAAI,OAAO,WAAW,eAAe,CAAC,OAAO,KAAK;GAChD,QAAQ,KAAK,8BAA8B;GAC3C;EACF;EAEA,MAAM,UAAUC,oBAAAA,SAAS,WAAW,OAAO;EAE3C,OAAO,IAAI,QAAQ,SAAS;GAC1B,IAAIA,oBAAAA,SAAS,WAAW,KAAK;GAC7B,IAAI,SAAS;GACb,IAAI,SAAS;GACb,IAAIA,oBAAAA,SAAS,WAAW,YAAY;GACpC,aAAa;GACb,IAAI,SAAS;GACb,IAAI,SAAS;GACb,IAAI,SAAS;GACb,SAAS,SAAS;EACpB,CAAC;CACH;AACF"}
+{"version":3,"file":"meta-pixel.cjs","names":["mapFBEvent","getFirst"],"sources":["../../src/third-parties/meta-pixel.ts"],"sourcesContent":["import type { UpdateVisitorDTO } from '../schema/index';\nimport { type FBQ, type PixelId, mapFBEvent } from '../track/fbq';\nimport type { EventName, TrackName, TrackProperties } from '../track/types';\nimport { getFirst } from '../utils/field';\n\ndeclare global {\n  interface Window {\n    /** Undefined until the Meta Pixel script has loaded. */\n    fbq?: FBQ['fbq'];\n  }\n}\n\nconst metrics = ['CLS', 'FCP', 'FID', 'INP', 'LCP', 'TTFB'];\n\nexport function sendFBEvent<T extends EventName>(\n  name: TrackName<T>,\n  properties?: TrackProperties<T>,\n  event_id?: string\n) {\n  if (typeof window === 'undefined' || !window.fbq) {\n    console.warn('fbq has not been initialized');\n    return;\n  }\n  if (metrics.includes(name)) return;\n  if (window.location.host.includes('127.0.0.1')) return;\n  if (window.location.host.includes('localhost')) return;\n\n  const options = { eventID: event_id };\n  const [type, fbEventName, fbEventProperties] = mapFBEvent(name, properties);\n  // The two branches are identical on purpose. `fbq` is overloaded per `type` — 'track' takes a\n  // standard event name with its typed properties, 'trackCustom' an arbitrary string — and what\n  // `mapFBEvent` returns is a union of both shapes. Narrowing `type` is what picks a single\n  // overload; collapsing the branches leaves the call matching none of them.\n  if (type === 'track') {\n    window.fbq(type, fbEventName, fbEventProperties, options);\n  } else {\n    window.fbq(type, fbEventName, fbEventProperties, options);\n  }\n}\n\nexport function setFBUser(pixelId: PixelId) {\n  return ({ user_id, user_data }: UpdateVisitorDTO) => {\n    if (typeof window === 'undefined' || !window.fbq) {\n      console.warn('fbq has not been initialized');\n      return;\n    }\n\n    const address = getFirst(user_data?.address);\n\n    window.fbq('init', pixelId, {\n      em: getFirst(user_data?.email),\n      fn: address?.first_name,\n      ln: address?.last_name,\n      ph: getFirst(user_data?.phone_number),\n      external_id: user_id,\n      ct: address?.city,\n      // `st` is Meta's state/province field, not the street address.\n      st: address?.region,\n      zp: address?.postal_code,\n      country: address?.country,\n    });\n  };\n}\n"],"mappings":";;;;AAYA,MAAM,UAAU;CAAC;CAAO;CAAO;CAAO;CAAO;CAAO;AAAM;AAE1D,SAAgB,YACd,MACA,YACA,UACA;CACA,IAAI,OAAO,WAAW,eAAe,CAAC,OAAO,KAAK;EAChD,QAAQ,KAAK,8BAA8B;EAC3C;CACF;CACA,IAAI,QAAQ,SAAS,IAAI,GAAG;CAC5B,IAAI,OAAO,SAAS,KAAK,SAAS,WAAW,GAAG;CAChD,IAAI,OAAO,SAAS,KAAK,SAAS,WAAW,GAAG;CAEhD,MAAM,UAAU,EAAE,SAAS,SAAS;CACpC,MAAM,CAAC,MAAM,aAAa,qBAAqBA,kBAAAA,WAAW,MAAM,UAAU;CAK1E,IAAI,SAAS,SACX,OAAO,IAAI,MAAM,aAAa,mBAAmB,OAAO;MAExD,OAAO,IAAI,MAAM,aAAa,mBAAmB,OAAO;AAE5D;AAEA,SAAgB,UAAU,SAAkB;CAC1C,QAAQ,EAAE,SAAS,gBAAkC;EACnD,IAAI,OAAO,WAAW,eAAe,CAAC,OAAO,KAAK;GAChD,QAAQ,KAAK,8BAA8B;GAC3C;EACF;EAEA,MAAM,UAAUC,oBAAAA,SAAS,WAAW,OAAO;EAE3C,OAAO,IAAI,QAAQ,SAAS;GAC1B,IAAIA,oBAAAA,SAAS,WAAW,KAAK;GAC7B,IAAI,SAAS;GACb,IAAI,SAAS;GACb,IAAIA,oBAAAA,SAAS,WAAW,YAAY;GACpC,aAAa;GACb,IAAI,SAAS;GAEb,IAAI,SAAS;GACb,IAAI,SAAS;GACb,SAAS,SAAS;EACpB,CAAC;CACH;AACF"}

package/dist/third-parties/meta-pixel.mjs

@@ -36,7 +36,7 @@ function setFBUser(pixelId) {
 			ph: getFirst(user_data?.phone_number),
 			external_id: user_id,
 			ct: address?.city,
-			st: address?.street,
+			st: address?.region,
 			zp: address?.postal_code,
 			country: address?.country
 		});