@shware/analytics 7.6.0 → 8.1.0

package/dist/next/index.cjs

@@ -4,11 +4,11 @@ const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
 const require_track_index = require("../track/index.cjs");
 const require_hooks_use_outbound_click_analytics = require("../hooks/use-outbound-click-analytics.cjs");
 const require_hooks_use_web_analytics = require("../hooks/use-web-analytics.cjs");
-let react_jsx_runtime = require("react/jsx-runtime");
 let next_navigation_js = require("next/navigation.js");
 let next_script_js = require("next/script.js");
 next_script_js = require_runtime.__toESM(next_script_js, 1);
 let next_web_vitals_js = require("next/web-vitals.js");
+let react_jsx_runtime = require("react/jsx-runtime");
 //#region src/next/index.tsx
 function Analytics({ gaId, gaSrc, nonce, debugMode, metaPixelId, hotjarId, redditPixelId, linkedInPartnerId, facebookAppId, reportWebVitals = true }) {
 	require_hooks_use_web_analytics.useWebAnalytics((0, next_navigation_js.usePathname)());

package/dist/next/index.mjs

@@ -2,10 +2,10 @@
 import { track } from "../track/index.mjs";
 import { useOutboundClickAnalytics } from "../hooks/use-outbound-click-analytics.mjs";
 import { useWebAnalytics } from "../hooks/use-web-analytics.mjs";
-import { Fragment, jsx, jsxs } from "react/jsx-runtime";
 import { usePathname } from "next/navigation.js";
 import Script from "next/script.js";
 import { useReportWebVitals } from "next/web-vitals.js";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
 //#region src/next/index.tsx
 function Analytics({ gaId, gaSrc, nonce, debugMode, metaPixelId, hotjarId, redditPixelId, linkedInPartnerId, facebookAppId, reportWebVitals = true }) {
 	useWebAnalytics(usePathname());

package/dist/react-router/index.cjs

@@ -1,10 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_track_index = require("../track/index.cjs");
 const require_hooks_use_outbound_click_analytics = require("../hooks/use-outbound-click-analytics.cjs");
-const require_hooks_use_report_web_vitals = require("../hooks/use-report-web-vitals.cjs");
 const require_hooks_use_web_analytics = require("../hooks/use-web-analytics.cjs");
-let react_router = require("react-router");
+const require_hooks_use_report_web_vitals = require("../hooks/use-report-web-vitals.cjs");
 let react_jsx_runtime = require("react/jsx-runtime");
+let react_router = require("react-router");
 //#region src/react-router/index.tsx
 function Analytics({ gaId, gaSrc, nonce, debugMode, metaPixelId, redditPixelId, linkedInPartnerId, hotjarId, facebookAppId, reportWebVitals = true }) {
 	const { pathname } = (0, react_router.useLocation)();

package/dist/react-router/index.mjs

@@ -1,9 +1,9 @@
 import { track } from "../track/index.mjs";
 import { useOutboundClickAnalytics } from "../hooks/use-outbound-click-analytics.mjs";
-import { useReportWebVitals } from "../hooks/use-report-web-vitals.mjs";
 import { useWebAnalytics } from "../hooks/use-web-analytics.mjs";
-import { useLocation } from "react-router";
+import { useReportWebVitals } from "../hooks/use-report-web-vitals.mjs";
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+import { useLocation } from "react-router";
 //#region src/react-router/index.tsx
 function Analytics({ gaId, gaSrc, nonce, debugMode, metaPixelId, redditPixelId, linkedInPartnerId, hotjarId, facebookAppId, reportWebVitals = true }) {
 	const { pathname } = useLocation();

package/dist/server/google-data-manager.cjs

@@ -0,0 +1,157 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_third_parties_ignored_events = require("../third-parties/ignored-events.cjs");
+const require_server_action_source = require("./action-source.cjs");
+let _shware_utils = require("@shware/utils");
+let node_crypto = require("node:crypto");
+//#region src/server/google-data-manager.ts
+/**
+* Google Ads conversion sender over the Data Manager API (`events:ingest`) — Google's
+* counterpart to Meta's Conversions API, and the mandated successor to the Google Ads API's
+* `UploadClickConversions`, which stopped accepting new adopters on 2026-06-15. Same shape as
+* the other senders here: a pure per-event builder, a never-throws `sendEvents`, credentials
+* in headers and never in a URL or a log line.
+*
+* Google's recommended deployment is *hybrid* ("boost your tag with additional data sources"):
+* this upload attaches to the SAME conversion action the gtag tag reports to, matched by
+* `transactionId` — a matched pair collapses into one conversion with the server data winning,
+* an unmatched upload is a recovered conversion. Both channels here are fed from the same
+* `track()` call, so the ids agree by construction. `transactionId` is therefore required in
+* that mode; this sender always sends one (the event id when there is no natural order id).
+*
+* Auth is a plain OAuth2 access token with the `datamanager` scope — no Google Ads developer
+* token, no API Center approval. The caller exchanges its stored refresh token for the access
+* token (one POST to oauth2.googleapis.com) and refreshes it however it likes; this module
+* stays out of the OAuth business, exactly as it stays out of Meta's.
+*
+* https://developers.google.com/data-manager/api/reference/rest/v1/events/ingest
+* https://developers.google.com/data-manager/api/devguides/events/google-ads/offline/upgrade/field-mappings
+*/
+const ENDPOINT = "https://datamanager.googleapis.com/v1/events:ingest";
+/**
+* Google's email normalization is Meta's minus one wrinkle: for @gmail.com/@googlemail.com the
+* username's dots and everything from '+' on are removed; for every other domain they are kept.
+* https://developers.google.com/data-manager/api/devguides/format-data
+*/
+function normalizeEmail(input) {
+	const email = input.trim().toLowerCase();
+	const at = email.lastIndexOf("@");
+	if (at === -1) return email;
+	let username = email.slice(0, at);
+	const domain = email.slice(at + 1);
+	if (domain === "gmail.com" || domain === "googlemail.com") username = username.replace(/\./g, "").split("+", 1)[0] ?? "";
+	return `${username}@${domain}`;
+}
+const sha256 = (value) => (0, node_crypto.createHash)("sha256").update(value).digest("hex");
+function normalizeCurrency(input) {
+	if (typeof input !== "string") return "USD";
+	const currency = input.trim().toUpperCase();
+	return /^[A-Z]{3}$/.test(currency) ? currency : "USD";
+}
+/** At most 10 userIdentifiers per event, per the API's hard limit. */
+const MAX_USER_IDENTIFIERS = 10;
+/** Hashes are hex strings, declared by `encoding: 'HEX'` on the request. */
+function getUserIdentifiers(data) {
+	const identifiers = [];
+	const emails = Array.isArray(data.email) ? data.email : data.email ? [data.email] : [];
+	for (const email of emails) identifiers.push({ emailAddress: sha256(normalizeEmail(email)) });
+	const phones = Array.isArray(data.phone_number) ? data.phone_number : data.phone_number ? [data.phone_number] : [];
+	for (const phone of phones) identifiers.push({ phoneNumber: sha256(phone.trim()) });
+	return identifiers.slice(0, MAX_USER_IDENTIFIERS);
+}
+/**
+* Builds one Event, or undefined when no conversion action is configured for the event's name.
+* At most one click identifier is sent, gclid first: it is the deterministic per-click id,
+* where gbraid/wbraid are the aggregate iOS ones, and Google documents preferring it. Unlike
+* the legacy upload, an event with no click id at all is still worth sending when it carries
+* user identifiers — that is the enhanced-conversions match path.
+*/
+function getDataManagerEvent(event, config, data = {}) {
+	const action = config[event.name];
+	if (!action) return void 0;
+	const source = require_server_action_source.resolveActionSource(event.platform);
+	const dmEvent = {
+		destinationReferences: [String(action)],
+		transactionId: typeof event.properties?.transaction_id === "string" ? event.properties.transaction_id : event.id,
+		eventTimestamp: new Date(event.created_at).toISOString(),
+		eventSource: source === "app" ? "APP" : source === "web" ? "WEB" : "OTHER",
+		conversionValue: typeof event.properties?.value === "number" ? event.properties.value : 0,
+		currency: normalizeCurrency(event.properties?.currency)
+	};
+	const { gclid, gbraid, wbraid } = event.tags;
+	if (gclid) dmEvent.adIdentifiers = { gclid };
+	else if (gbraid) dmEvent.adIdentifiers = { gbraid };
+	else if (wbraid) dmEvent.adIdentifiers = { wbraid };
+	const userIdentifiers = getUserIdentifiers(data);
+	if (userIdentifiers.length > 0) dmEvent.userData = { userIdentifiers };
+	if (!dmEvent.adIdentifiers && !dmEvent.userData) return void 0;
+	return dmEvent;
+}
+/** The API takes at most 2000 events per request. */
+const MAX_EVENTS_PER_REQUEST = 2e3;
+/**
+* Uploads the configured conversions from a batch of events. Never throws: an unusable event
+* is skipped and a failed request is logged and swallowed, like every other sender here. The
+* Data Manager API has no partial-failure mode — a rejected request costs the whole batch, so
+* the builder is strict about only emitting events the API can accept. A batch beyond the
+* 2000-event request cap goes out as sequential requests; the first response is returned.
+*/
+async function sendEvents(auth, config, events, data = {}, options = {}) {
+	const dmEvents = events.filter((event) => !require_third_parties_ignored_events.IGNORED_EVENTS.includes(event.name)).map((event) => getDataManagerEvent(event, config, data)).filter((dmEvent) => dmEvent !== void 0);
+	if (dmEvents.length === 0) return void 0;
+	const operatingAccount = {
+		accountType: "GOOGLE_ADS",
+		accountId: auth.operatingAccountId.replace(/-/g, "")
+	};
+	const loginAccount = auth.loginAccountId ? {
+		accountType: "GOOGLE_ADS",
+		accountId: auth.loginAccountId.replace(/-/g, "")
+	} : void 0;
+	const destinations = Array.from(new Set(dmEvents.flatMap((dmEvent) => dmEvent.destinationReferences))).map((action) => {
+		const destination = {
+			reference: action,
+			operatingAccount,
+			productDestinationId: action
+		};
+		if (loginAccount) destination.loginAccount = loginAccount;
+		return destination;
+	});
+	let firstResponse;
+	for (let offset = 0; offset < dmEvents.length; offset += MAX_EVENTS_PER_REQUEST) {
+		const chunk = dmEvents.slice(offset, offset + MAX_EVENTS_PER_REQUEST);
+		const body = {
+			destinations,
+			events: chunk,
+			validateOnly: options.validateOnly ?? false
+		};
+		if (chunk.some((dmEvent) => dmEvent.userData)) body.encoding = "HEX";
+		if (options.consent) body.consent = options.consent;
+		try {
+			const response = await (0, _shware_utils.fetch)(ENDPOINT, {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+					Accept: "application/json",
+					Authorization: `Bearer ${auth.accessToken}`
+				},
+				body: JSON.stringify(body)
+			});
+			if (response.ok) {
+				firstResponse ??= await response.json();
+				continue;
+			}
+			const { status } = response;
+			const message = await response.text();
+			console.error(`Failed to send Google Ads conversions, status: ${status}, body: ${message}`);
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			console.error(`Failed to send Google Ads conversions, network error: ${message}`);
+		}
+	}
+	return firstResponse;
+}
+//#endregion
+exports.getDataManagerEvent = getDataManagerEvent;
+exports.normalizeEmail = normalizeEmail;
+exports.sendEvents = sendEvents;
+
+//# sourceMappingURL=google-data-manager.cjs.map

package/dist/server/google-data-manager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-data-manager.cjs","names":["resolveActionSource","IGNORED_EVENTS"],"sources":["../../src/server/google-data-manager.ts"],"sourcesContent":["/**\n * Google Ads conversion sender over the Data Manager API (`events:ingest`) — Google's\n * counterpart to Meta's Conversions API, and the mandated successor to the Google Ads API's\n * `UploadClickConversions`, which stopped accepting new adopters on 2026-06-15. Same shape as\n * the other senders here: a pure per-event builder, a never-throws `sendEvents`, credentials\n * in headers and never in a URL or a log line.\n *\n * Google's recommended deployment is *hybrid* (\"boost your tag with additional data sources\"):\n * this upload attaches to the SAME conversion action the gtag tag reports to, matched by\n * `transactionId` — a matched pair collapses into one conversion with the server data winning,\n * an unmatched upload is a recovered conversion. Both channels here are fed from the same\n * `track()` call, so the ids agree by construction. `transactionId` is therefore required in\n * that mode; this sender always sends one (the event id when there is no natural order id).\n *\n * Auth is a plain OAuth2 access token with the `datamanager` scope — no Google Ads developer\n * token, no API Center approval. The caller exchanges its stored refresh token for the access\n * token (one POST to oauth2.googleapis.com) and refreshes it however it likes; this module\n * stays out of the OAuth business, exactly as it stays out of Meta's.\n *\n * https://developers.google.com/data-manager/api/reference/rest/v1/events/ingest\n * https://developers.google.com/data-manager/api/devguides/events/google-ads/offline/upgrade/field-mappings\n */\nimport { createHash } from 'node:crypto';\nimport { fetch } from '@shware/utils';\nimport { IGNORED_EVENTS } from '../third-parties/ignored-events';\nimport type { TrackEvent, UserProvidedData } from '../track/types';\nimport { resolveActionSource } from './action-source';\n\nconst ENDPOINT = 'https://datamanager.googleapis.com/v1/events:ingest';\n\n/**\n * Event name → conversion action id, mirroring `LinkedinConversionConfig`: only configured\n * events upload, everything else is skipped silently. In the hybrid setup this is the id of\n * the SAME conversion action the gtag tag reports to.\n */\nexport type GoogleAdsConversionConfig = Record<Lowercase<string>, number | string>;\n\nexport interface GoogleAdsAuth {\n  /** OAuth2 access token with the `datamanager` scope. Short-lived; the caller refreshes it. */\n  accessToken: string;\n  /** The Google Ads account the conversion actions live in. Dashes are tolerated: '123-456-7890'. */\n  operatingAccountId: string;\n  /** The manager account the OAuth user accesses through, when access is delegated. */\n  loginAccountId?: string;\n}\n\n/**\n * EEA/UK/CH consent, applied request-wide. Google drops EEA conversions without granted\n * `adUserData` from bidding, so a host with consent signals should pass them.\n */\nexport interface GoogleAdsConsent {\n  adUserData?: 'CONSENT_GRANTED' | 'CONSENT_DENIED' | 'CONSENT_STATUS_UNSPECIFIED';\n  adPersonalization?: 'CONSENT_GRANTED' | 'CONSENT_DENIED' | 'CONSENT_STATUS_UNSPECIFIED';\n}\n\nexport interface GoogleAdsConversionsOptions {\n  /** Validates the payload server-side without recording conversions. */\n  validateOnly?: boolean;\n  consent?: GoogleAdsConsent;\n}\n\n/**\n * Google's email normalization is Meta's minus one wrinkle: for @gmail.com/@googlemail.com the\n * username's dots and everything from '+' on are removed; for every other domain they are kept.\n * https://developers.google.com/data-manager/api/devguides/format-data\n */\nexport function normalizeEmail(input: string): string {\n  const email = input.trim().toLowerCase();\n  const at = email.lastIndexOf('@');\n  if (at === -1) return email;\n  let username = email.slice(0, at);\n  const domain = email.slice(at + 1);\n  if (domain === 'gmail.com' || domain === 'googlemail.com') {\n    username = username.replace(/\\./g, '').split('+', 1)[0] ?? '';\n  }\n  return `${username}@${domain}`;\n}\n\nconst sha256 = (value: string) => createHash('sha256').update(value).digest('hex');\n\nfunction normalizeCurrency(input: unknown): string {\n  if (typeof input !== 'string') return 'USD';\n  const currency = input.trim().toUpperCase();\n  return /^[A-Z]{3}$/.test(currency) ? currency : 'USD';\n}\n\n/** At most 10 userIdentifiers per event, per the API's hard limit. */\nconst MAX_USER_IDENTIFIERS = 10;\n\n/** Hashes are hex strings, declared by `encoding: 'HEX'` on the request. */\nfunction getUserIdentifiers(data: UserProvidedData): Record<string, string>[] {\n  const identifiers: Record<string, string>[] = [];\n  const emails = Array.isArray(data.email) ? data.email : data.email ? [data.email] : [];\n  for (const email of emails) {\n    identifiers.push({ emailAddress: sha256(normalizeEmail(email)) });\n  }\n  const phones = Array.isArray(data.phone_number)\n    ? data.phone_number\n    : data.phone_number\n      ? [data.phone_number]\n      : [];\n  for (const phone of phones) {\n    // Phones are already E.164 by the schema ('+' then digits); hash after a defensive trim.\n    identifiers.push({ phoneNumber: sha256(phone.trim()) });\n  }\n  return identifiers.slice(0, MAX_USER_IDENTIFIERS);\n}\n\n/** One entry of the `events` array. Field names are the REST (camelCase) spellings. */\nexport interface DataManagerEvent {\n  destinationReferences: string[];\n  transactionId: string;\n  /** RFC 3339 — `created_at` as stored, unlike the legacy API's bespoke format. */\n  eventTimestamp: string;\n  eventSource: 'WEB' | 'APP' | 'OTHER';\n  conversionValue: number;\n  currency: string;\n  adIdentifiers?: { gclid?: string; gbraid?: string; wbraid?: string };\n  userData?: { userIdentifiers: Record<string, string>[] };\n}\n\n/**\n * Builds one Event, or undefined when no conversion action is configured for the event's name.\n * At most one click identifier is sent, gclid first: it is the deterministic per-click id,\n * where gbraid/wbraid are the aggregate iOS ones, and Google documents preferring it. Unlike\n * the legacy upload, an event with no click id at all is still worth sending when it carries\n * user identifiers — that is the enhanced-conversions match path.\n */\nexport function getDataManagerEvent(\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  event: TrackEvent<any>,\n  config: GoogleAdsConversionConfig,\n  data: UserProvidedData = {}\n): DataManagerEvent | undefined {\n  const action = config[event.name as Lowercase<string>];\n  if (!action) return undefined;\n\n  const source = resolveActionSource(event.platform);\n  const dmEvent: DataManagerEvent = {\n    destinationReferences: [String(action)],\n    // The hybrid-mode match key against the gtag tag's transaction_id: same track() call feeds\n    // both channels, so they agree by construction for purchase-shaped events. The event id\n    // covers conversions with no natural order id — but the gtag tracker only sends a\n    // transaction_id when the properties carry one, so on a HYBRID action a non-purchase event\n    // reported by both channels never matches and counts twice. Attach such events to a\n    // standalone (API-only) conversion action instead.\n    transactionId:\n      typeof event.properties?.transaction_id === 'string'\n        ? event.properties.transaction_id\n        : event.id,\n    eventTimestamp: new Date(event.created_at).toISOString(),\n    eventSource: source === 'app' ? 'APP' : source === 'web' ? 'WEB' : 'OTHER',\n    // Both mandatory, like the LinkedIn sender's defaults: 0 USD is Google's own convention\n    // for value-less goals. The API has no partial-failure mode, so a malformed currency would\n    // cost the whole batch — anything that isn't a 3-letter code falls back instead.\n    conversionValue: typeof event.properties?.value === 'number' ? event.properties.value : 0,\n    currency: normalizeCurrency(event.properties?.currency),\n  };\n\n  const { gclid, gbraid, wbraid } = event.tags;\n  if (gclid) dmEvent.adIdentifiers = { gclid };\n  else if (gbraid) dmEvent.adIdentifiers = { gbraid };\n  else if (wbraid) dmEvent.adIdentifiers = { wbraid };\n\n  const userIdentifiers = getUserIdentifiers(data);\n  if (userIdentifiers.length > 0) dmEvent.userData = { userIdentifiers };\n\n  // With neither a click id nor an identifier Google has nothing to match on; skip.\n  if (!dmEvent.adIdentifiers && !dmEvent.userData) return undefined;\n\n  return dmEvent;\n}\n\nexport interface DataManagerResponse {\n  requestId?: string;\n}\n\n/** The API takes at most 2000 events per request. */\nconst MAX_EVENTS_PER_REQUEST = 2000;\n\n/**\n * Uploads the configured conversions from a batch of events. Never throws: an unusable event\n * is skipped and a failed request is logged and swallowed, like every other sender here. The\n * Data Manager API has no partial-failure mode — a rejected request costs the whole batch, so\n * the builder is strict about only emitting events the API can accept. A batch beyond the\n * 2000-event request cap goes out as sequential requests; the first response is returned.\n */\nexport async function sendEvents(\n  auth: GoogleAdsAuth,\n  config: GoogleAdsConversionConfig,\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  events: TrackEvent<any>[],\n  data: UserProvidedData = {},\n  options: GoogleAdsConversionsOptions = {}\n): Promise<DataManagerResponse | undefined> {\n  const dmEvents = events\n    .filter((event) => !IGNORED_EVENTS.includes(event.name))\n    .map((event) => getDataManagerEvent(event, config, data))\n    .filter((dmEvent): dmEvent is DataManagerEvent => dmEvent !== undefined);\n  if (dmEvents.length === 0) return undefined;\n\n  const operatingAccount = {\n    accountType: 'GOOGLE_ADS',\n    accountId: auth.operatingAccountId.replace(/-/g, ''),\n  };\n  // One destination per conversion action present in the batch; each event points at its own\n  // through destinationReferences, so mixed-action batches go out as one request.\n  const loginAccount = auth.loginAccountId\n    ? { accountType: 'GOOGLE_ADS', accountId: auth.loginAccountId.replace(/-/g, '') }\n    : undefined;\n  const actions = Array.from(new Set(dmEvents.flatMap((dmEvent) => dmEvent.destinationReferences)));\n  const destinations = actions.map((action) => {\n    const destination: Record<string, unknown> = {\n      reference: action,\n      operatingAccount,\n      productDestinationId: action,\n    };\n    if (loginAccount) destination.loginAccount = loginAccount;\n    return destination;\n  });\n\n  let firstResponse: DataManagerResponse | undefined;\n  for (let offset = 0; offset < dmEvents.length; offset += MAX_EVENTS_PER_REQUEST) {\n    const chunk = dmEvents.slice(offset, offset + MAX_EVENTS_PER_REQUEST);\n    const body: Record<string, unknown> = {\n      destinations,\n      events: chunk,\n      validateOnly: options.validateOnly ?? false,\n    };\n    if (chunk.some((dmEvent) => dmEvent.userData)) {\n      body.encoding = 'HEX';\n    }\n    if (options.consent) {\n      body.consent = options.consent;\n    }\n\n    try {\n      const response = await fetch(ENDPOINT, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          Accept: 'application/json',\n          Authorization: `Bearer ${auth.accessToken}`,\n        },\n        body: JSON.stringify(body),\n      });\n      if (response.ok) {\n        firstResponse ??= (await response.json()) as DataManagerResponse;\n        continue;\n      }\n      const { status } = response;\n      const message = await response.text();\n      console.error(`Failed to send Google Ads conversions, status: ${status}, body: ${message}`);\n    } catch (error) {\n      const message = error instanceof Error ? error.message : String(error);\n      console.error(`Failed to send Google Ads conversions, network error: ${message}`);\n    }\n  }\n  return firstResponse;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,MAAM,WAAW;;;;;;AAsCjB,SAAgB,eAAe,OAAuB;CACpD,MAAM,QAAQ,MAAM,KAAK,CAAC,CAAC,YAAY;CACvC,MAAM,KAAK,MAAM,YAAY,GAAG;CAChC,IAAI,OAAO,IAAI,OAAO;CACtB,IAAI,WAAW,MAAM,MAAM,GAAG,EAAE;CAChC,MAAM,SAAS,MAAM,MAAM,KAAK,CAAC;CACjC,IAAI,WAAW,eAAe,WAAW,kBACvC,WAAW,SAAS,QAAQ,OAAO,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM;CAE7D,OAAO,GAAG,SAAS,GAAG;AACxB;AAEA,MAAM,UAAU,WAAA,GAAA,YAAA,WAAA,CAA6B,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AAEjF,SAAS,kBAAkB,OAAwB;CACjD,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,MAAM,WAAW,MAAM,KAAK,CAAC,CAAC,YAAY;CAC1C,OAAO,aAAa,KAAK,QAAQ,IAAI,WAAW;AAClD;;AAGA,MAAM,uBAAuB;;AAG7B,SAAS,mBAAmB,MAAkD;CAC5E,MAAM,cAAwC,CAAC;CAC/C,MAAM,SAAS,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC;CACrF,KAAK,MAAM,SAAS,QAClB,YAAY,KAAK,EAAE,cAAc,OAAO,eAAe,KAAK,CAAC,EAAE,CAAC;CAElE,MAAM,SAAS,MAAM,QAAQ,KAAK,YAAY,IAC1C,KAAK,eACL,KAAK,eACH,CAAC,KAAK,YAAY,IAClB,CAAC;CACP,KAAK,MAAM,SAAS,QAElB,YAAY,KAAK,EAAE,aAAa,OAAO,MAAM,KAAK,CAAC,EAAE,CAAC;CAExD,OAAO,YAAY,MAAM,GAAG,oBAAoB;AAClD;;;;;;;;AAsBA,SAAgB,oBAEd,OACA,QACA,OAAyB,CAAC,GACI;CAC9B,MAAM,SAAS,OAAO,MAAM;CAC5B,IAAI,CAAC,QAAQ,OAAO,KAAA;CAEpB,MAAM,SAASA,6BAAAA,oBAAoB,MAAM,QAAQ;CACjD,MAAM,UAA4B;EAChC,uBAAuB,CAAC,OAAO,MAAM,CAAC;EAOtC,eACE,OAAO,MAAM,YAAY,mBAAmB,WACxC,MAAM,WAAW,iBACjB,MAAM;EACZ,gBAAgB,IAAI,KAAK,MAAM,UAAU,CAAC,CAAC,YAAY;EACvD,aAAa,WAAW,QAAQ,QAAQ,WAAW,QAAQ,QAAQ;EAInE,iBAAiB,OAAO,MAAM,YAAY,UAAU,WAAW,MAAM,WAAW,QAAQ;EACxF,UAAU,kBAAkB,MAAM,YAAY,QAAQ;CACxD;CAEA,MAAM,EAAE,OAAO,QAAQ,WAAW,MAAM;CACxC,IAAI,OAAO,QAAQ,gBAAgB,EAAE,MAAM;MACtC,IAAI,QAAQ,QAAQ,gBAAgB,EAAE,OAAO;MAC7C,IAAI,QAAQ,QAAQ,gBAAgB,EAAE,OAAO;CAElD,MAAM,kBAAkB,mBAAmB,IAAI;CAC/C,IAAI,gBAAgB,SAAS,GAAG,QAAQ,WAAW,EAAE,gBAAgB;CAGrE,IAAI,CAAC,QAAQ,iBAAiB,CAAC,QAAQ,UAAU,OAAO,KAAA;CAExD,OAAO;AACT;;AAOA,MAAM,yBAAyB;;;;;;;;AAS/B,eAAsB,WACpB,MACA,QAEA,QACA,OAAyB,CAAC,GAC1B,UAAuC,CAAC,GACE;CAC1C,MAAM,WAAW,OACd,QAAQ,UAAU,CAACC,qCAAAA,eAAe,SAAS,MAAM,IAAI,CAAC,CAAC,CACvD,KAAK,UAAU,oBAAoB,OAAO,QAAQ,IAAI,CAAC,CAAC,CACxD,QAAQ,YAAyC,YAAY,KAAA,CAAS;CACzE,IAAI,SAAS,WAAW,GAAG,OAAO,KAAA;CAElC,MAAM,mBAAmB;EACvB,aAAa;EACb,WAAW,KAAK,mBAAmB,QAAQ,MAAM,EAAE;CACrD;CAGA,MAAM,eAAe,KAAK,iBACtB;EAAE,aAAa;EAAc,WAAW,KAAK,eAAe,QAAQ,MAAM,EAAE;CAAE,IAC9E,KAAA;CAEJ,MAAM,eADU,MAAM,KAAK,IAAI,IAAI,SAAS,SAAS,YAAY,QAAQ,qBAAqB,CAAC,CACpE,CAAC,CAAC,KAAK,WAAW;EAC3C,MAAM,cAAuC;GAC3C,WAAW;GACX;GACA,sBAAsB;EACxB;EACA,IAAI,cAAc,YAAY,eAAe;EAC7C,OAAO;CACT,CAAC;CAED,IAAI;CACJ,KAAK,IAAI,SAAS,GAAG,SAAS,SAAS,QAAQ,UAAU,wBAAwB;EAC/E,MAAM,QAAQ,SAAS,MAAM,QAAQ,SAAS,sBAAsB;EACpE,MAAM,OAAgC;GACpC;GACA,QAAQ;GACR,cAAc,QAAQ,gBAAgB;EACxC;EACA,IAAI,MAAM,MAAM,YAAY,QAAQ,QAAQ,GAC1C,KAAK,WAAW;EAElB,IAAI,QAAQ,SACV,KAAK,UAAU,QAAQ;EAGzB,IAAI;GACF,MAAM,WAAW,OAAA,GAAA,cAAA,MAAA,CAAY,UAAU;IACrC,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,QAAQ;KACR,eAAe,UAAU,KAAK;IAChC;IACA,MAAM,KAAK,UAAU,IAAI;GAC3B,CAAC;GACD,IAAI,SAAS,IAAI;IACf,kBAAmB,MAAM,SAAS,KAAK;IACvC;GACF;GACA,MAAM,EAAE,WAAW;GACnB,MAAM,UAAU,MAAM,SAAS,KAAK;GACpC,QAAQ,MAAM,kDAAkD,OAAO,UAAU,SAAS;EAC5F,SAAS,OAAO;GACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACrE,QAAQ,MAAM,yDAAyD,SAAS;EAClF;CACF;CACA,OAAO;AACT"}

package/dist/server/google-data-manager.d.cts

@@ -0,0 +1,75 @@
+import { TrackEvent, UserProvidedData } from "../track/types.cjs";
+//#region src/server/google-data-manager.d.ts
+/**
+ * Event name → conversion action id, mirroring `LinkedinConversionConfig`: only configured
+ * events upload, everything else is skipped silently. In the hybrid setup this is the id of
+ * the SAME conversion action the gtag tag reports to.
+ */
+type GoogleAdsConversionConfig = Record<Lowercase<string>, number | string>;
+interface GoogleAdsAuth {
+  /** OAuth2 access token with the `datamanager` scope. Short-lived; the caller refreshes it. */
+  accessToken: string;
+  /** The Google Ads account the conversion actions live in. Dashes are tolerated: '123-456-7890'. */
+  operatingAccountId: string;
+  /** The manager account the OAuth user accesses through, when access is delegated. */
+  loginAccountId?: string;
+}
+/**
+ * EEA/UK/CH consent, applied request-wide. Google drops EEA conversions without granted
+ * `adUserData` from bidding, so a host with consent signals should pass them.
+ */
+interface GoogleAdsConsent {
+  adUserData?: 'CONSENT_GRANTED' | 'CONSENT_DENIED' | 'CONSENT_STATUS_UNSPECIFIED';
+  adPersonalization?: 'CONSENT_GRANTED' | 'CONSENT_DENIED' | 'CONSENT_STATUS_UNSPECIFIED';
+}
+interface GoogleAdsConversionsOptions {
+  /** Validates the payload server-side without recording conversions. */
+  validateOnly?: boolean;
+  consent?: GoogleAdsConsent;
+}
+/**
+ * Google's email normalization is Meta's minus one wrinkle: for @gmail.com/@googlemail.com the
+ * username's dots and everything from '+' on are removed; for every other domain they are kept.
+ * https://developers.google.com/data-manager/api/devguides/format-data
+ */
+declare function normalizeEmail(input: string): string;
+/** One entry of the `events` array. Field names are the REST (camelCase) spellings. */
+interface DataManagerEvent {
+  destinationReferences: string[];
+  transactionId: string;
+  /** RFC 3339 — `created_at` as stored, unlike the legacy API's bespoke format. */
+  eventTimestamp: string;
+  eventSource: 'WEB' | 'APP' | 'OTHER';
+  conversionValue: number;
+  currency: string;
+  adIdentifiers?: {
+    gclid?: string;
+    gbraid?: string;
+    wbraid?: string;
+  };
+  userData?: {
+    userIdentifiers: Record<string, string>[];
+  };
+}
+/**
+ * Builds one Event, or undefined when no conversion action is configured for the event's name.
+ * At most one click identifier is sent, gclid first: it is the deterministic per-click id,
+ * where gbraid/wbraid are the aggregate iOS ones, and Google documents preferring it. Unlike
+ * the legacy upload, an event with no click id at all is still worth sending when it carries
+ * user identifiers — that is the enhanced-conversions match path.
+ */
+declare function getDataManagerEvent(event: TrackEvent<any>, config: GoogleAdsConversionConfig, data?: UserProvidedData): DataManagerEvent | undefined;
+interface DataManagerResponse {
+  requestId?: string;
+}
+/**
+ * Uploads the configured conversions from a batch of events. Never throws: an unusable event
+ * is skipped and a failed request is logged and swallowed, like every other sender here. The
+ * Data Manager API has no partial-failure mode — a rejected request costs the whole batch, so
+ * the builder is strict about only emitting events the API can accept. A batch beyond the
+ * 2000-event request cap goes out as sequential requests; the first response is returned.
+ */
+declare function sendEvents(auth: GoogleAdsAuth, config: GoogleAdsConversionConfig, events: TrackEvent<any>[], data?: UserProvidedData, options?: GoogleAdsConversionsOptions): Promise<DataManagerResponse | undefined>;
+//#endregion
+export { DataManagerEvent, DataManagerResponse, GoogleAdsAuth, GoogleAdsConsent, GoogleAdsConversionConfig, GoogleAdsConversionsOptions, getDataManagerEvent, normalizeEmail, sendEvents };
+//# sourceMappingURL=google-data-manager.d.cts.map

package/dist/server/google-data-manager.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-data-manager.d.cts","names":[],"sources":["../../src/server/google-data-manager.ts"],"mappings":";;;;;;;KAmCY,4BAA4B,OAAO;UAE9B;;EAEf;;EAEA;;EAEA;;;;;;UAOe;EACf;EACA;;UAGe;;EAEf;EACA,UAAU;;;;;;;iBAQI,eAAe;;UA2Cd;EACf;EACA;;EAEA;EACA;EACA;EACA;EACA;IAAkB;IAAgB;IAAiB;;EACnD;IAAa,iBAAiB;;;;;;;;;;iBAUhB,oBAEd,OAAO,iBACP,QAAQ,2BACR,OAAM,mBACL;UAwCc;EACf;;;;;;;;;iBAaoB,WACpB,MAAM,eACN,QAAQ,2BAER,QAAQ,mBACR,OAAM,kBACN,UAAS,8BACR,QAAQ"}

package/dist/server/google-data-manager.d.mts

@@ -0,0 +1,75 @@
+import { TrackEvent, UserProvidedData } from "../track/types.mjs";
+//#region src/server/google-data-manager.d.ts
+/**
+ * Event name → conversion action id, mirroring `LinkedinConversionConfig`: only configured
+ * events upload, everything else is skipped silently. In the hybrid setup this is the id of
+ * the SAME conversion action the gtag tag reports to.
+ */
+type GoogleAdsConversionConfig = Record<Lowercase<string>, number | string>;
+interface GoogleAdsAuth {
+  /** OAuth2 access token with the `datamanager` scope. Short-lived; the caller refreshes it. */
+  accessToken: string;
+  /** The Google Ads account the conversion actions live in. Dashes are tolerated: '123-456-7890'. */
+  operatingAccountId: string;
+  /** The manager account the OAuth user accesses through, when access is delegated. */
+  loginAccountId?: string;
+}
+/**
+ * EEA/UK/CH consent, applied request-wide. Google drops EEA conversions without granted
+ * `adUserData` from bidding, so a host with consent signals should pass them.
+ */
+interface GoogleAdsConsent {
+  adUserData?: 'CONSENT_GRANTED' | 'CONSENT_DENIED' | 'CONSENT_STATUS_UNSPECIFIED';
+  adPersonalization?: 'CONSENT_GRANTED' | 'CONSENT_DENIED' | 'CONSENT_STATUS_UNSPECIFIED';
+}
+interface GoogleAdsConversionsOptions {
+  /** Validates the payload server-side without recording conversions. */
+  validateOnly?: boolean;
+  consent?: GoogleAdsConsent;
+}
+/**
+ * Google's email normalization is Meta's minus one wrinkle: for @gmail.com/@googlemail.com the
+ * username's dots and everything from '+' on are removed; for every other domain they are kept.
+ * https://developers.google.com/data-manager/api/devguides/format-data
+ */
+declare function normalizeEmail(input: string): string;
+/** One entry of the `events` array. Field names are the REST (camelCase) spellings. */
+interface DataManagerEvent {
+  destinationReferences: string[];
+  transactionId: string;
+  /** RFC 3339 — `created_at` as stored, unlike the legacy API's bespoke format. */
+  eventTimestamp: string;
+  eventSource: 'WEB' | 'APP' | 'OTHER';
+  conversionValue: number;
+  currency: string;
+  adIdentifiers?: {
+    gclid?: string;
+    gbraid?: string;
+    wbraid?: string;
+  };
+  userData?: {
+    userIdentifiers: Record<string, string>[];
+  };
+}
+/**
+ * Builds one Event, or undefined when no conversion action is configured for the event's name.
+ * At most one click identifier is sent, gclid first: it is the deterministic per-click id,
+ * where gbraid/wbraid are the aggregate iOS ones, and Google documents preferring it. Unlike
+ * the legacy upload, an event with no click id at all is still worth sending when it carries
+ * user identifiers — that is the enhanced-conversions match path.
+ */
+declare function getDataManagerEvent(event: TrackEvent<any>, config: GoogleAdsConversionConfig, data?: UserProvidedData): DataManagerEvent | undefined;
+interface DataManagerResponse {
+  requestId?: string;
+}
+/**
+ * Uploads the configured conversions from a batch of events. Never throws: an unusable event
+ * is skipped and a failed request is logged and swallowed, like every other sender here. The
+ * Data Manager API has no partial-failure mode — a rejected request costs the whole batch, so
+ * the builder is strict about only emitting events the API can accept. A batch beyond the
+ * 2000-event request cap goes out as sequential requests; the first response is returned.
+ */
+declare function sendEvents(auth: GoogleAdsAuth, config: GoogleAdsConversionConfig, events: TrackEvent<any>[], data?: UserProvidedData, options?: GoogleAdsConversionsOptions): Promise<DataManagerResponse | undefined>;
+//#endregion
+export { DataManagerEvent, DataManagerResponse, GoogleAdsAuth, GoogleAdsConsent, GoogleAdsConversionConfig, GoogleAdsConversionsOptions, getDataManagerEvent, normalizeEmail, sendEvents };
+//# sourceMappingURL=google-data-manager.d.mts.map

package/dist/server/google-data-manager.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-data-manager.d.mts","names":[],"sources":["../../src/server/google-data-manager.ts"],"mappings":";;;;;;;KAmCY,4BAA4B,OAAO;UAE9B;;EAEf;;EAEA;;EAEA;;;;;;UAOe;EACf;EACA;;UAGe;;EAEf;EACA,UAAU;;;;;;;iBAQI,eAAe;;UA2Cd;EACf;EACA;;EAEA;EACA;EACA;EACA;EACA;IAAkB;IAAgB;IAAiB;;EACnD;IAAa,iBAAiB;;;;;;;;;;iBAUhB,oBAEd,OAAO,iBACP,QAAQ,2BACR,OAAM,mBACL;UAwCc;EACf;;;;;;;;;iBAaoB,WACpB,MAAM,eACN,QAAQ,2BAER,QAAQ,mBACR,OAAM,kBACN,UAAS,8BACR,QAAQ"}

package/dist/server/google-data-manager.mjs

@@ -0,0 +1,154 @@
+import { IGNORED_EVENTS } from "../third-parties/ignored-events.mjs";
+import { resolveActionSource } from "./action-source.mjs";
+import { fetch } from "@shware/utils";
+import { createHash } from "node:crypto";
+//#region src/server/google-data-manager.ts
+/**
+* Google Ads conversion sender over the Data Manager API (`events:ingest`) — Google's
+* counterpart to Meta's Conversions API, and the mandated successor to the Google Ads API's
+* `UploadClickConversions`, which stopped accepting new adopters on 2026-06-15. Same shape as
+* the other senders here: a pure per-event builder, a never-throws `sendEvents`, credentials
+* in headers and never in a URL or a log line.
+*
+* Google's recommended deployment is *hybrid* ("boost your tag with additional data sources"):
+* this upload attaches to the SAME conversion action the gtag tag reports to, matched by
+* `transactionId` — a matched pair collapses into one conversion with the server data winning,
+* an unmatched upload is a recovered conversion. Both channels here are fed from the same
+* `track()` call, so the ids agree by construction. `transactionId` is therefore required in
+* that mode; this sender always sends one (the event id when there is no natural order id).
+*
+* Auth is a plain OAuth2 access token with the `datamanager` scope — no Google Ads developer
+* token, no API Center approval. The caller exchanges its stored refresh token for the access
+* token (one POST to oauth2.googleapis.com) and refreshes it however it likes; this module
+* stays out of the OAuth business, exactly as it stays out of Meta's.
+*
+* https://developers.google.com/data-manager/api/reference/rest/v1/events/ingest
+* https://developers.google.com/data-manager/api/devguides/events/google-ads/offline/upgrade/field-mappings
+*/
+const ENDPOINT = "https://datamanager.googleapis.com/v1/events:ingest";
+/**
+* Google's email normalization is Meta's minus one wrinkle: for @gmail.com/@googlemail.com the
+* username's dots and everything from '+' on are removed; for every other domain they are kept.
+* https://developers.google.com/data-manager/api/devguides/format-data
+*/
+function normalizeEmail(input) {
+	const email = input.trim().toLowerCase();
+	const at = email.lastIndexOf("@");
+	if (at === -1) return email;
+	let username = email.slice(0, at);
+	const domain = email.slice(at + 1);
+	if (domain === "gmail.com" || domain === "googlemail.com") username = username.replace(/\./g, "").split("+", 1)[0] ?? "";
+	return `${username}@${domain}`;
+}
+const sha256 = (value) => createHash("sha256").update(value).digest("hex");
+function normalizeCurrency(input) {
+	if (typeof input !== "string") return "USD";
+	const currency = input.trim().toUpperCase();
+	return /^[A-Z]{3}$/.test(currency) ? currency : "USD";
+}
+/** At most 10 userIdentifiers per event, per the API's hard limit. */
+const MAX_USER_IDENTIFIERS = 10;
+/** Hashes are hex strings, declared by `encoding: 'HEX'` on the request. */
+function getUserIdentifiers(data) {
+	const identifiers = [];
+	const emails = Array.isArray(data.email) ? data.email : data.email ? [data.email] : [];
+	for (const email of emails) identifiers.push({ emailAddress: sha256(normalizeEmail(email)) });
+	const phones = Array.isArray(data.phone_number) ? data.phone_number : data.phone_number ? [data.phone_number] : [];
+	for (const phone of phones) identifiers.push({ phoneNumber: sha256(phone.trim()) });
+	return identifiers.slice(0, MAX_USER_IDENTIFIERS);
+}
+/**
+* Builds one Event, or undefined when no conversion action is configured for the event's name.
+* At most one click identifier is sent, gclid first: it is the deterministic per-click id,
+* where gbraid/wbraid are the aggregate iOS ones, and Google documents preferring it. Unlike
+* the legacy upload, an event with no click id at all is still worth sending when it carries
+* user identifiers — that is the enhanced-conversions match path.
+*/
+function getDataManagerEvent(event, config, data = {}) {
+	const action = config[event.name];
+	if (!action) return void 0;
+	const source = resolveActionSource(event.platform);
+	const dmEvent = {
+		destinationReferences: [String(action)],
+		transactionId: typeof event.properties?.transaction_id === "string" ? event.properties.transaction_id : event.id,
+		eventTimestamp: new Date(event.created_at).toISOString(),
+		eventSource: source === "app" ? "APP" : source === "web" ? "WEB" : "OTHER",
+		conversionValue: typeof event.properties?.value === "number" ? event.properties.value : 0,
+		currency: normalizeCurrency(event.properties?.currency)
+	};
+	const { gclid, gbraid, wbraid } = event.tags;
+	if (gclid) dmEvent.adIdentifiers = { gclid };
+	else if (gbraid) dmEvent.adIdentifiers = { gbraid };
+	else if (wbraid) dmEvent.adIdentifiers = { wbraid };
+	const userIdentifiers = getUserIdentifiers(data);
+	if (userIdentifiers.length > 0) dmEvent.userData = { userIdentifiers };
+	if (!dmEvent.adIdentifiers && !dmEvent.userData) return void 0;
+	return dmEvent;
+}
+/** The API takes at most 2000 events per request. */
+const MAX_EVENTS_PER_REQUEST = 2e3;
+/**
+* Uploads the configured conversions from a batch of events. Never throws: an unusable event
+* is skipped and a failed request is logged and swallowed, like every other sender here. The
+* Data Manager API has no partial-failure mode — a rejected request costs the whole batch, so
+* the builder is strict about only emitting events the API can accept. A batch beyond the
+* 2000-event request cap goes out as sequential requests; the first response is returned.
+*/
+async function sendEvents(auth, config, events, data = {}, options = {}) {
+	const dmEvents = events.filter((event) => !IGNORED_EVENTS.includes(event.name)).map((event) => getDataManagerEvent(event, config, data)).filter((dmEvent) => dmEvent !== void 0);
+	if (dmEvents.length === 0) return void 0;
+	const operatingAccount = {
+		accountType: "GOOGLE_ADS",
+		accountId: auth.operatingAccountId.replace(/-/g, "")
+	};
+	const loginAccount = auth.loginAccountId ? {
+		accountType: "GOOGLE_ADS",
+		accountId: auth.loginAccountId.replace(/-/g, "")
+	} : void 0;
+	const destinations = Array.from(new Set(dmEvents.flatMap((dmEvent) => dmEvent.destinationReferences))).map((action) => {
+		const destination = {
+			reference: action,
+			operatingAccount,
+			productDestinationId: action
+		};
+		if (loginAccount) destination.loginAccount = loginAccount;
+		return destination;
+	});
+	let firstResponse;
+	for (let offset = 0; offset < dmEvents.length; offset += MAX_EVENTS_PER_REQUEST) {
+		const chunk = dmEvents.slice(offset, offset + MAX_EVENTS_PER_REQUEST);
+		const body = {
+			destinations,
+			events: chunk,
+			validateOnly: options.validateOnly ?? false
+		};
+		if (chunk.some((dmEvent) => dmEvent.userData)) body.encoding = "HEX";
+		if (options.consent) body.consent = options.consent;
+		try {
+			const response = await fetch(ENDPOINT, {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+					Accept: "application/json",
+					Authorization: `Bearer ${auth.accessToken}`
+				},
+				body: JSON.stringify(body)
+			});
+			if (response.ok) {
+				firstResponse ??= await response.json();
+				continue;
+			}
+			const { status } = response;
+			const message = await response.text();
+			console.error(`Failed to send Google Ads conversions, status: ${status}, body: ${message}`);
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			console.error(`Failed to send Google Ads conversions, network error: ${message}`);
+		}
+	}
+	return firstResponse;
+}
+//#endregion
+export { getDataManagerEvent, normalizeEmail, sendEvents };
+
+//# sourceMappingURL=google-data-manager.mjs.map

package/dist/server/google-data-manager.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-data-manager.mjs","names":[],"sources":["../../src/server/google-data-manager.ts"],"sourcesContent":["/**\n * Google Ads conversion sender over the Data Manager API (`events:ingest`) — Google's\n * counterpart to Meta's Conversions API, and the mandated successor to the Google Ads API's\n * `UploadClickConversions`, which stopped accepting new adopters on 2026-06-15. Same shape as\n * the other senders here: a pure per-event builder, a never-throws `sendEvents`, credentials\n * in headers and never in a URL or a log line.\n *\n * Google's recommended deployment is *hybrid* (\"boost your tag with additional data sources\"):\n * this upload attaches to the SAME conversion action the gtag tag reports to, matched by\n * `transactionId` — a matched pair collapses into one conversion with the server data winning,\n * an unmatched upload is a recovered conversion. Both channels here are fed from the same\n * `track()` call, so the ids agree by construction. `transactionId` is therefore required in\n * that mode; this sender always sends one (the event id when there is no natural order id).\n *\n * Auth is a plain OAuth2 access token with the `datamanager` scope — no Google Ads developer\n * token, no API Center approval. The caller exchanges its stored refresh token for the access\n * token (one POST to oauth2.googleapis.com) and refreshes it however it likes; this module\n * stays out of the OAuth business, exactly as it stays out of Meta's.\n *\n * https://developers.google.com/data-manager/api/reference/rest/v1/events/ingest\n * https://developers.google.com/data-manager/api/devguides/events/google-ads/offline/upgrade/field-mappings\n */\nimport { createHash } from 'node:crypto';\nimport { fetch } from '@shware/utils';\nimport { IGNORED_EVENTS } from '../third-parties/ignored-events';\nimport type { TrackEvent, UserProvidedData } from '../track/types';\nimport { resolveActionSource } from './action-source';\n\nconst ENDPOINT = 'https://datamanager.googleapis.com/v1/events:ingest';\n\n/**\n * Event name → conversion action id, mirroring `LinkedinConversionConfig`: only configured\n * events upload, everything else is skipped silently. In the hybrid setup this is the id of\n * the SAME conversion action the gtag tag reports to.\n */\nexport type GoogleAdsConversionConfig = Record<Lowercase<string>, number | string>;\n\nexport interface GoogleAdsAuth {\n  /** OAuth2 access token with the `datamanager` scope. Short-lived; the caller refreshes it. */\n  accessToken: string;\n  /** The Google Ads account the conversion actions live in. Dashes are tolerated: '123-456-7890'. */\n  operatingAccountId: string;\n  /** The manager account the OAuth user accesses through, when access is delegated. */\n  loginAccountId?: string;\n}\n\n/**\n * EEA/UK/CH consent, applied request-wide. Google drops EEA conversions without granted\n * `adUserData` from bidding, so a host with consent signals should pass them.\n */\nexport interface GoogleAdsConsent {\n  adUserData?: 'CONSENT_GRANTED' | 'CONSENT_DENIED' | 'CONSENT_STATUS_UNSPECIFIED';\n  adPersonalization?: 'CONSENT_GRANTED' | 'CONSENT_DENIED' | 'CONSENT_STATUS_UNSPECIFIED';\n}\n\nexport interface GoogleAdsConversionsOptions {\n  /** Validates the payload server-side without recording conversions. */\n  validateOnly?: boolean;\n  consent?: GoogleAdsConsent;\n}\n\n/**\n * Google's email normalization is Meta's minus one wrinkle: for @gmail.com/@googlemail.com the\n * username's dots and everything from '+' on are removed; for every other domain they are kept.\n * https://developers.google.com/data-manager/api/devguides/format-data\n */\nexport function normalizeEmail(input: string): string {\n  const email = input.trim().toLowerCase();\n  const at = email.lastIndexOf('@');\n  if (at === -1) return email;\n  let username = email.slice(0, at);\n  const domain = email.slice(at + 1);\n  if (domain === 'gmail.com' || domain === 'googlemail.com') {\n    username = username.replace(/\\./g, '').split('+', 1)[0] ?? '';\n  }\n  return `${username}@${domain}`;\n}\n\nconst sha256 = (value: string) => createHash('sha256').update(value).digest('hex');\n\nfunction normalizeCurrency(input: unknown): string {\n  if (typeof input !== 'string') return 'USD';\n  const currency = input.trim().toUpperCase();\n  return /^[A-Z]{3}$/.test(currency) ? currency : 'USD';\n}\n\n/** At most 10 userIdentifiers per event, per the API's hard limit. */\nconst MAX_USER_IDENTIFIERS = 10;\n\n/** Hashes are hex strings, declared by `encoding: 'HEX'` on the request. */\nfunction getUserIdentifiers(data: UserProvidedData): Record<string, string>[] {\n  const identifiers: Record<string, string>[] = [];\n  const emails = Array.isArray(data.email) ? data.email : data.email ? [data.email] : [];\n  for (const email of emails) {\n    identifiers.push({ emailAddress: sha256(normalizeEmail(email)) });\n  }\n  const phones = Array.isArray(data.phone_number)\n    ? data.phone_number\n    : data.phone_number\n      ? [data.phone_number]\n      : [];\n  for (const phone of phones) {\n    // Phones are already E.164 by the schema ('+' then digits); hash after a defensive trim.\n    identifiers.push({ phoneNumber: sha256(phone.trim()) });\n  }\n  return identifiers.slice(0, MAX_USER_IDENTIFIERS);\n}\n\n/** One entry of the `events` array. Field names are the REST (camelCase) spellings. */\nexport interface DataManagerEvent {\n  destinationReferences: string[];\n  transactionId: string;\n  /** RFC 3339 — `created_at` as stored, unlike the legacy API's bespoke format. */\n  eventTimestamp: string;\n  eventSource: 'WEB' | 'APP' | 'OTHER';\n  conversionValue: number;\n  currency: string;\n  adIdentifiers?: { gclid?: string; gbraid?: string; wbraid?: string };\n  userData?: { userIdentifiers: Record<string, string>[] };\n}\n\n/**\n * Builds one Event, or undefined when no conversion action is configured for the event's name.\n * At most one click identifier is sent, gclid first: it is the deterministic per-click id,\n * where gbraid/wbraid are the aggregate iOS ones, and Google documents preferring it. Unlike\n * the legacy upload, an event with no click id at all is still worth sending when it carries\n * user identifiers — that is the enhanced-conversions match path.\n */\nexport function getDataManagerEvent(\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  event: TrackEvent<any>,\n  config: GoogleAdsConversionConfig,\n  data: UserProvidedData = {}\n): DataManagerEvent | undefined {\n  const action = config[event.name as Lowercase<string>];\n  if (!action) return undefined;\n\n  const source = resolveActionSource(event.platform);\n  const dmEvent: DataManagerEvent = {\n    destinationReferences: [String(action)],\n    // The hybrid-mode match key against the gtag tag's transaction_id: same track() call feeds\n    // both channels, so they agree by construction for purchase-shaped events. The event id\n    // covers conversions with no natural order id — but the gtag tracker only sends a\n    // transaction_id when the properties carry one, so on a HYBRID action a non-purchase event\n    // reported by both channels never matches and counts twice. Attach such events to a\n    // standalone (API-only) conversion action instead.\n    transactionId:\n      typeof event.properties?.transaction_id === 'string'\n        ? event.properties.transaction_id\n        : event.id,\n    eventTimestamp: new Date(event.created_at).toISOString(),\n    eventSource: source === 'app' ? 'APP' : source === 'web' ? 'WEB' : 'OTHER',\n    // Both mandatory, like the LinkedIn sender's defaults: 0 USD is Google's own convention\n    // for value-less goals. The API has no partial-failure mode, so a malformed currency would\n    // cost the whole batch — anything that isn't a 3-letter code falls back instead.\n    conversionValue: typeof event.properties?.value === 'number' ? event.properties.value : 0,\n    currency: normalizeCurrency(event.properties?.currency),\n  };\n\n  const { gclid, gbraid, wbraid } = event.tags;\n  if (gclid) dmEvent.adIdentifiers = { gclid };\n  else if (gbraid) dmEvent.adIdentifiers = { gbraid };\n  else if (wbraid) dmEvent.adIdentifiers = { wbraid };\n\n  const userIdentifiers = getUserIdentifiers(data);\n  if (userIdentifiers.length > 0) dmEvent.userData = { userIdentifiers };\n\n  // With neither a click id nor an identifier Google has nothing to match on; skip.\n  if (!dmEvent.adIdentifiers && !dmEvent.userData) return undefined;\n\n  return dmEvent;\n}\n\nexport interface DataManagerResponse {\n  requestId?: string;\n}\n\n/** The API takes at most 2000 events per request. */\nconst MAX_EVENTS_PER_REQUEST = 2000;\n\n/**\n * Uploads the configured conversions from a batch of events. Never throws: an unusable event\n * is skipped and a failed request is logged and swallowed, like every other sender here. The\n * Data Manager API has no partial-failure mode — a rejected request costs the whole batch, so\n * the builder is strict about only emitting events the API can accept. A batch beyond the\n * 2000-event request cap goes out as sequential requests; the first response is returned.\n */\nexport async function sendEvents(\n  auth: GoogleAdsAuth,\n  config: GoogleAdsConversionConfig,\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  events: TrackEvent<any>[],\n  data: UserProvidedData = {},\n  options: GoogleAdsConversionsOptions = {}\n): Promise<DataManagerResponse | undefined> {\n  const dmEvents = events\n    .filter((event) => !IGNORED_EVENTS.includes(event.name))\n    .map((event) => getDataManagerEvent(event, config, data))\n    .filter((dmEvent): dmEvent is DataManagerEvent => dmEvent !== undefined);\n  if (dmEvents.length === 0) return undefined;\n\n  const operatingAccount = {\n    accountType: 'GOOGLE_ADS',\n    accountId: auth.operatingAccountId.replace(/-/g, ''),\n  };\n  // One destination per conversion action present in the batch; each event points at its own\n  // through destinationReferences, so mixed-action batches go out as one request.\n  const loginAccount = auth.loginAccountId\n    ? { accountType: 'GOOGLE_ADS', accountId: auth.loginAccountId.replace(/-/g, '') }\n    : undefined;\n  const actions = Array.from(new Set(dmEvents.flatMap((dmEvent) => dmEvent.destinationReferences)));\n  const destinations = actions.map((action) => {\n    const destination: Record<string, unknown> = {\n      reference: action,\n      operatingAccount,\n      productDestinationId: action,\n    };\n    if (loginAccount) destination.loginAccount = loginAccount;\n    return destination;\n  });\n\n  let firstResponse: DataManagerResponse | undefined;\n  for (let offset = 0; offset < dmEvents.length; offset += MAX_EVENTS_PER_REQUEST) {\n    const chunk = dmEvents.slice(offset, offset + MAX_EVENTS_PER_REQUEST);\n    const body: Record<string, unknown> = {\n      destinations,\n      events: chunk,\n      validateOnly: options.validateOnly ?? false,\n    };\n    if (chunk.some((dmEvent) => dmEvent.userData)) {\n      body.encoding = 'HEX';\n    }\n    if (options.consent) {\n      body.consent = options.consent;\n    }\n\n    try {\n      const response = await fetch(ENDPOINT, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          Accept: 'application/json',\n          Authorization: `Bearer ${auth.accessToken}`,\n        },\n        body: JSON.stringify(body),\n      });\n      if (response.ok) {\n        firstResponse ??= (await response.json()) as DataManagerResponse;\n        continue;\n      }\n      const { status } = response;\n      const message = await response.text();\n      console.error(`Failed to send Google Ads conversions, status: ${status}, body: ${message}`);\n    } catch (error) {\n      const message = error instanceof Error ? error.message : String(error);\n      console.error(`Failed to send Google Ads conversions, network error: ${message}`);\n    }\n  }\n  return firstResponse;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,MAAM,WAAW;;;;;;AAsCjB,SAAgB,eAAe,OAAuB;CACpD,MAAM,QAAQ,MAAM,KAAK,CAAC,CAAC,YAAY;CACvC,MAAM,KAAK,MAAM,YAAY,GAAG;CAChC,IAAI,OAAO,IAAI,OAAO;CACtB,IAAI,WAAW,MAAM,MAAM,GAAG,EAAE;CAChC,MAAM,SAAS,MAAM,MAAM,KAAK,CAAC;CACjC,IAAI,WAAW,eAAe,WAAW,kBACvC,WAAW,SAAS,QAAQ,OAAO,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM;CAE7D,OAAO,GAAG,SAAS,GAAG;AACxB;AAEA,MAAM,UAAU,UAAkB,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AAEjF,SAAS,kBAAkB,OAAwB;CACjD,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,MAAM,WAAW,MAAM,KAAK,CAAC,CAAC,YAAY;CAC1C,OAAO,aAAa,KAAK,QAAQ,IAAI,WAAW;AAClD;;AAGA,MAAM,uBAAuB;;AAG7B,SAAS,mBAAmB,MAAkD;CAC5E,MAAM,cAAwC,CAAC;CAC/C,MAAM,SAAS,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC;CACrF,KAAK,MAAM,SAAS,QAClB,YAAY,KAAK,EAAE,cAAc,OAAO,eAAe,KAAK,CAAC,EAAE,CAAC;CAElE,MAAM,SAAS,MAAM,QAAQ,KAAK,YAAY,IAC1C,KAAK,eACL,KAAK,eACH,CAAC,KAAK,YAAY,IAClB,CAAC;CACP,KAAK,MAAM,SAAS,QAElB,YAAY,KAAK,EAAE,aAAa,OAAO,MAAM,KAAK,CAAC,EAAE,CAAC;CAExD,OAAO,YAAY,MAAM,GAAG,oBAAoB;AAClD;;;;;;;;AAsBA,SAAgB,oBAEd,OACA,QACA,OAAyB,CAAC,GACI;CAC9B,MAAM,SAAS,OAAO,MAAM;CAC5B,IAAI,CAAC,QAAQ,OAAO,KAAA;CAEpB,MAAM,SAAS,oBAAoB,MAAM,QAAQ;CACjD,MAAM,UAA4B;EAChC,uBAAuB,CAAC,OAAO,MAAM,CAAC;EAOtC,eACE,OAAO,MAAM,YAAY,mBAAmB,WACxC,MAAM,WAAW,iBACjB,MAAM;EACZ,gBAAgB,IAAI,KAAK,MAAM,UAAU,CAAC,CAAC,YAAY;EACvD,aAAa,WAAW,QAAQ,QAAQ,WAAW,QAAQ,QAAQ;EAInE,iBAAiB,OAAO,MAAM,YAAY,UAAU,WAAW,MAAM,WAAW,QAAQ;EACxF,UAAU,kBAAkB,MAAM,YAAY,QAAQ;CACxD;CAEA,MAAM,EAAE,OAAO,QAAQ,WAAW,MAAM;CACxC,IAAI,OAAO,QAAQ,gBAAgB,EAAE,MAAM;MACtC,IAAI,QAAQ,QAAQ,gBAAgB,EAAE,OAAO;MAC7C,IAAI,QAAQ,QAAQ,gBAAgB,EAAE,OAAO;CAElD,MAAM,kBAAkB,mBAAmB,IAAI;CAC/C,IAAI,gBAAgB,SAAS,GAAG,QAAQ,WAAW,EAAE,gBAAgB;CAGrE,IAAI,CAAC,QAAQ,iBAAiB,CAAC,QAAQ,UAAU,OAAO,KAAA;CAExD,OAAO;AACT;;AAOA,MAAM,yBAAyB;;;;;;;;AAS/B,eAAsB,WACpB,MACA,QAEA,QACA,OAAyB,CAAC,GAC1B,UAAuC,CAAC,GACE;CAC1C,MAAM,WAAW,OACd,QAAQ,UAAU,CAAC,eAAe,SAAS,MAAM,IAAI,CAAC,CAAC,CACvD,KAAK,UAAU,oBAAoB,OAAO,QAAQ,IAAI,CAAC,CAAC,CACxD,QAAQ,YAAyC,YAAY,KAAA,CAAS;CACzE,IAAI,SAAS,WAAW,GAAG,OAAO,KAAA;CAElC,MAAM,mBAAmB;EACvB,aAAa;EACb,WAAW,KAAK,mBAAmB,QAAQ,MAAM,EAAE;CACrD;CAGA,MAAM,eAAe,KAAK,iBACtB;EAAE,aAAa;EAAc,WAAW,KAAK,eAAe,QAAQ,MAAM,EAAE;CAAE,IAC9E,KAAA;CAEJ,MAAM,eADU,MAAM,KAAK,IAAI,IAAI,SAAS,SAAS,YAAY,QAAQ,qBAAqB,CAAC,CACpE,CAAC,CAAC,KAAK,WAAW;EAC3C,MAAM,cAAuC;GAC3C,WAAW;GACX;GACA,sBAAsB;EACxB;EACA,IAAI,cAAc,YAAY,eAAe;EAC7C,OAAO;CACT,CAAC;CAED,IAAI;CACJ,KAAK,IAAI,SAAS,GAAG,SAAS,SAAS,QAAQ,UAAU,wBAAwB;EAC/E,MAAM,QAAQ,SAAS,MAAM,QAAQ,SAAS,sBAAsB;EACpE,MAAM,OAAgC;GACpC;GACA,QAAQ;GACR,cAAc,QAAQ,gBAAgB;EACxC;EACA,IAAI,MAAM,MAAM,YAAY,QAAQ,QAAQ,GAC1C,KAAK,WAAW;EAElB,IAAI,QAAQ,SACV,KAAK,UAAU,QAAQ;EAGzB,IAAI;GACF,MAAM,WAAW,MAAM,MAAM,UAAU;IACrC,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,QAAQ;KACR,eAAe,UAAU,KAAK;IAChC;IACA,MAAM,KAAK,UAAU,IAAI;GAC3B,CAAC;GACD,IAAI,SAAS,IAAI;IACf,kBAAmB,MAAM,SAAS,KAAK;IACvC;GACF;GACA,MAAM,EAAE,WAAW;GACnB,MAAM,UAAU,MAAM,SAAS,KAAK;GACpC,QAAQ,MAAM,kDAAkD,OAAO,UAAU,SAAS;EAC5F,SAAS,OAAO;GACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACrE,QAAQ,MAAM,yDAAyD,SAAS;EAClF;CACF;CACA,OAAO;AACT"}

package/dist/server/index.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_click_id_index = require("../click-id/index.cjs");
-const require_server_meta_conversions_api = require("./meta-conversions-api.cjs");
+const require_server_google_data_manager = require("./google-data-manager.cjs");
 const require_server_meta_capi = require("./meta-capi.cjs");
 const require_server_reddit_conversions_api = require("./reddit-conversions-api.cjs");
 const require_server_linkedin_conversions_api = require("./linkedin-conversions-api.cjs");
@@ -9,11 +9,13 @@ exports.FBC_COOKIE = require_click_id_index.FBC_COOKIE;
 exports.RDT_CID_COOKIE = require_click_id_index.RDT_CID_COOKIE;
 exports.formatFbc = require_click_id_index.formatFbc;
 exports.getCapiEvent = require_server_meta_capi.getCapiEvent;
+exports.getDataManagerEvent = require_server_google_data_manager.getDataManagerEvent;
+exports.normalizeEmail = require_server_google_data_manager.normalizeEmail;
 exports.parseFbc = require_click_id_index.parseFbc;
 exports.resolveClickIdCookies = require_click_id_index.resolveClickIdCookies;
+exports.sendGoogleAdsEvents = require_server_google_data_manager.sendEvents;
 exports.sendLinkedinEvents = require_server_linkedin_conversions_api.sendEvents;
-exports.sendMetaConversions = require_server_meta_capi.sendMetaConversions;
-exports.sendMetaEvents = require_server_meta_conversions_api.sendEvents;
+exports.sendMetaEvents = require_server_meta_capi.sendEvents;
 exports.sendOpenAIEvents = require_server_openai_conversions_api.sendEvents;
 exports.sendRedditEvents = require_server_reddit_conversions_api.sendEvents;
 exports.toSetCookieHeaders = require_click_id_index.toSetCookieHeaders;

package/dist/server/index.d.cts

@@ -1,8 +1,8 @@
 import { FBC_COOKIE, ParsedFbc, RDT_CID_COOKIE, ResolveClickIdCookiesInput, ResolveClickIdCookiesResult, formatFbc, parseFbc, resolveClickIdCookies, toSetCookieHeaders } from "../click-id/index.cjs";
 import { EventActionSource } from "./action-source.cjs";
-import { sendEvents as sendEvents$1 } from "./meta-conversions-api.cjs";
-import { CapiEvent, MetaConversionsOptions, MetaConversionsResponse, getCapiEvent, sendMetaConversions } from "./meta-capi.cjs";
-import { sendEvents as sendEvents$3 } from "./reddit-conversions-api.cjs";
-import { LinkedinConversionConfig, sendEvents } from "./linkedin-conversions-api.cjs";
-import { sendEvents as sendEvents$2 } from "./openai-conversions-api.cjs";
-export { type CapiEvent, type EventActionSource, FBC_COOKIE, type LinkedinConversionConfig, type MetaConversionsOptions, type MetaConversionsResponse, type ParsedFbc, RDT_CID_COOKIE, type ResolveClickIdCookiesInput, type ResolveClickIdCookiesResult, formatFbc, getCapiEvent, parseFbc, resolveClickIdCookies, sendEvents as sendLinkedinEvents, sendMetaConversions, sendEvents$1 as sendMetaEvents, sendEvents$2 as sendOpenAIEvents, sendEvents$3 as sendRedditEvents, toSetCookieHeaders };
+import { DataManagerEvent, DataManagerResponse, GoogleAdsAuth, GoogleAdsConsent, GoogleAdsConversionConfig, GoogleAdsConversionsOptions, getDataManagerEvent, normalizeEmail, sendEvents } from "./google-data-manager.cjs";
+import { CapiEvent, MetaConversionsOptions, MetaConversionsResponse, getCapiEvent, sendEvents as sendEvents$2 } from "./meta-capi.cjs";
+import { sendEvents as sendEvents$4 } from "./reddit-conversions-api.cjs";
+import { LinkedinConversionConfig, sendEvents as sendEvents$1 } from "./linkedin-conversions-api.cjs";
+import { sendEvents as sendEvents$3 } from "./openai-conversions-api.cjs";
+export { type CapiEvent, type DataManagerEvent, type DataManagerResponse, type EventActionSource, FBC_COOKIE, type GoogleAdsAuth, type GoogleAdsConsent, type GoogleAdsConversionConfig, type GoogleAdsConversionsOptions, type LinkedinConversionConfig, type MetaConversionsOptions, type MetaConversionsResponse, type ParsedFbc, RDT_CID_COOKIE, type ResolveClickIdCookiesInput, type ResolveClickIdCookiesResult, formatFbc, getCapiEvent, getDataManagerEvent, normalizeEmail, parseFbc, resolveClickIdCookies, sendEvents as sendGoogleAdsEvents, sendEvents$1 as sendLinkedinEvents, sendEvents$2 as sendMetaEvents, sendEvents$3 as sendOpenAIEvents, sendEvents$4 as sendRedditEvents, toSetCookieHeaders };

package/dist/server/index.d.mts

@@ -1,8 +1,8 @@
 import { FBC_COOKIE, ParsedFbc, RDT_CID_COOKIE, ResolveClickIdCookiesInput, ResolveClickIdCookiesResult, formatFbc, parseFbc, resolveClickIdCookies, toSetCookieHeaders } from "../click-id/index.mjs";
 import { EventActionSource } from "./action-source.mjs";
-import { sendEvents as sendEvents$1 } from "./meta-conversions-api.mjs";
-import { CapiEvent, MetaConversionsOptions, MetaConversionsResponse, getCapiEvent, sendMetaConversions } from "./meta-capi.mjs";
-import { sendEvents as sendEvents$3 } from "./reddit-conversions-api.mjs";
-import { LinkedinConversionConfig, sendEvents } from "./linkedin-conversions-api.mjs";
-import { sendEvents as sendEvents$2 } from "./openai-conversions-api.mjs";
-export { type CapiEvent, type EventActionSource, FBC_COOKIE, type LinkedinConversionConfig, type MetaConversionsOptions, type MetaConversionsResponse, type ParsedFbc, RDT_CID_COOKIE, type ResolveClickIdCookiesInput, type ResolveClickIdCookiesResult, formatFbc, getCapiEvent, parseFbc, resolveClickIdCookies, sendEvents as sendLinkedinEvents, sendMetaConversions, sendEvents$1 as sendMetaEvents, sendEvents$2 as sendOpenAIEvents, sendEvents$3 as sendRedditEvents, toSetCookieHeaders };
+import { DataManagerEvent, DataManagerResponse, GoogleAdsAuth, GoogleAdsConsent, GoogleAdsConversionConfig, GoogleAdsConversionsOptions, getDataManagerEvent, normalizeEmail, sendEvents } from "./google-data-manager.mjs";
+import { CapiEvent, MetaConversionsOptions, MetaConversionsResponse, getCapiEvent, sendEvents as sendEvents$2 } from "./meta-capi.mjs";
+import { sendEvents as sendEvents$4 } from "./reddit-conversions-api.mjs";
+import { LinkedinConversionConfig, sendEvents as sendEvents$1 } from "./linkedin-conversions-api.mjs";
+import { sendEvents as sendEvents$3 } from "./openai-conversions-api.mjs";
+export { type CapiEvent, type DataManagerEvent, type DataManagerResponse, type EventActionSource, FBC_COOKIE, type GoogleAdsAuth, type GoogleAdsConsent, type GoogleAdsConversionConfig, type GoogleAdsConversionsOptions, type LinkedinConversionConfig, type MetaConversionsOptions, type MetaConversionsResponse, type ParsedFbc, RDT_CID_COOKIE, type ResolveClickIdCookiesInput, type ResolveClickIdCookiesResult, formatFbc, getCapiEvent, getDataManagerEvent, normalizeEmail, parseFbc, resolveClickIdCookies, sendEvents as sendGoogleAdsEvents, sendEvents$1 as sendLinkedinEvents, sendEvents$2 as sendMetaEvents, sendEvents$3 as sendOpenAIEvents, sendEvents$4 as sendRedditEvents, toSetCookieHeaders };

package/dist/server/index.mjs

@@ -1,7 +1,7 @@
 import { FBC_COOKIE, RDT_CID_COOKIE, formatFbc, parseFbc, resolveClickIdCookies, toSetCookieHeaders } from "../click-id/index.mjs";
-import { sendEvents as sendEvents$1 } from "./meta-conversions-api.mjs";
-import { getCapiEvent, sendMetaConversions } from "./meta-capi.mjs";
-import { sendEvents as sendEvents$3 } from "./reddit-conversions-api.mjs";
-import { sendEvents } from "./linkedin-conversions-api.mjs";
-import { sendEvents as sendEvents$2 } from "./openai-conversions-api.mjs";
-export { FBC_COOKIE, RDT_CID_COOKIE, formatFbc, getCapiEvent, parseFbc, resolveClickIdCookies, sendEvents as sendLinkedinEvents, sendMetaConversions, sendEvents$1 as sendMetaEvents, sendEvents$2 as sendOpenAIEvents, sendEvents$3 as sendRedditEvents, toSetCookieHeaders };
+import { getDataManagerEvent, normalizeEmail, sendEvents } from "./google-data-manager.mjs";
+import { getCapiEvent, sendEvents as sendEvents$2 } from "./meta-capi.mjs";
+import { sendEvents as sendEvents$4 } from "./reddit-conversions-api.mjs";
+import { sendEvents as sendEvents$1 } from "./linkedin-conversions-api.mjs";
+import { sendEvents as sendEvents$3 } from "./openai-conversions-api.mjs";
+export { FBC_COOKIE, RDT_CID_COOKIE, formatFbc, getCapiEvent, getDataManagerEvent, normalizeEmail, parseFbc, resolveClickIdCookies, sendEvents as sendGoogleAdsEvents, sendEvents$1 as sendLinkedinEvents, sendEvents$2 as sendMetaEvents, sendEvents$3 as sendOpenAIEvents, sendEvents$4 as sendRedditEvents, toSetCookieHeaders };

package/dist/server/legacy.cjs

@@ -0,0 +1,3 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_server_meta_conversions_api = require("./meta-conversions-api.cjs");
+exports.sendMetaEvents = require_server_meta_conversions_api.sendEvents;

package/dist/server/legacy.d.cts

@@ -0,0 +1,2 @@
+import { sendEvents } from "./meta-conversions-api.cjs";
+export { sendEvents as sendMetaEvents };

package/dist/server/legacy.d.mts

@@ -0,0 +1,2 @@
+import { sendEvents } from "./meta-conversions-api.mjs";
+export { sendEvents as sendMetaEvents };

package/dist/server/legacy.mjs

@@ -0,0 +1,2 @@
+import { sendEvents } from "./meta-conversions-api.mjs";
+export { sendEvents as sendMetaEvents };

package/dist/server/meta-capi.cjs

@@ -10,8 +10,9 @@ let capi_param_builder_nodejs = require("capi-param-builder-nodejs");
 //#region src/server/meta-capi.ts
 /**
 * Meta Conversions API sender built on `capi-param-builder-nodejs` and plain `fetch`, replacing
-* the 31MB `facebook-nodejs-business-sdk` with ~0.5MB of parameter building. `sendMetaEvents`
-* stays exported and untouched; this module is the drop-in successor hosts opt into.
+* the 31MB `facebook-nodejs-business-sdk` with ~0.5MB of parameter building. The SDK-based
+* sender survives untouched at `@shware/analytics/server/legacy`; this module is its drop-in
+* successor.
 *
 * The wire payload is byte-identical to what the business SDK's `ServerEvent.normalize()`
 * produces — enforced by a differential test that runs both builders over the same events.
@@ -219,11 +220,11 @@ function getCapiEvent(event, data, appPackageName) {
 	return capiEvent;
 }
 /**
-* The lightweight counterpart to `sendMetaEvents`: same filtering, same payload, same
-* never-throws contract, minus the 31MB SDK. The token travels in the JSON body, never in the
-* URL, and is never logged.
+* The lightweight counterpart to the legacy SDK sender (`@shware/analytics/server/legacy`):
+* same filtering, same payload, same never-throws contract, minus the 31MB SDK. The token
+* travels in the JSON body, never in the URL, and is never logged.
 */
-async function sendMetaConversions(accessToken, pixelId, events, data = {}, options = {}) {
+async function sendEvents(accessToken, pixelId, events, data = {}, options = {}) {
 	const capiEvents = events.filter((event) => !require_third_parties_ignored_events.IGNORED_EVENTS.includes(event.name)).map((event) => getCapiEvent(event, data, options.appPackageName));
 	if (capiEvents.length === 0) return void 0;
 	const version = options.apiVersion ?? API_VERSION;
@@ -253,6 +254,6 @@ async function sendMetaConversions(accessToken, pixelId, events, data = {}, opti
 }
 //#endregion
 exports.getCapiEvent = getCapiEvent;
-exports.sendMetaConversions = sendMetaConversions;
+exports.sendEvents = sendEvents;
 
 //# sourceMappingURL=meta-capi.cjs.map

package/dist/server/meta-capi.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"meta-capi.cjs","names":["ParamBuilder","PII_DATA_TYPE","formatFbc","mapFBEvent","resolveActionSource","pageLocation","IGNORED_EVENTS"],"sources":["../../src/server/meta-capi.ts"],"sourcesContent":["/**\n * Meta Conversions API sender built on `capi-param-builder-nodejs` and plain `fetch`, replacing\n * the 31MB `facebook-nodejs-business-sdk` with ~0.5MB of parameter building. `sendMetaEvents`\n * stays exported and untouched; this module is the drop-in successor hosts opt into.\n *\n * The wire payload is byte-identical to what the business SDK's `ServerEvent.normalize()`\n * produces — enforced by a differential test that runs both builders over the same events.\n * Where the two libraries normalize differently (the business SDK keeps punctuation in names,\n * spaces in multi-word last names, accents in cities; the param builder strips them per the\n * current documented rules), this module follows the business SDK so that switching senders\n * cannot change a single hash Meta receives. The param builder is used where the two provably\n * agree — email, phone, gender, country — and its adoption-tracking appendix (`<hash>.<token>`)\n * is stripped for the same reason.\n *\n * Two deliberate behavior differences from the business SDK, both on invalid input only:\n * an invalid field (malformed email, non-ISO country, letters in a phone) is dropped from\n * user_data instead of throwing inside `execute()` and costing the whole batch; an invalid\n * currency is uppercased and forwarded instead of rejected. Valid input is unaffected.\n *\n * https://developers.facebook.com/docs/marketing-api/conversions-api/using-the-api\n * https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/customer-information-parameters\n */\nimport { createHash } from 'node:crypto';\nimport { fetch } from '@shware/utils';\nimport { PII_DATA_TYPE, ParamBuilder } from 'capi-param-builder-nodejs';\nimport { formatFbc } from '../click-id/index';\nimport { IGNORED_EVENTS } from '../third-parties/ignored-events';\nimport { mapFBEvent } from '../track/fbq';\nimport type { TrackEvent, TrackTags, UserProvidedData } from '../track/types';\nimport { resolveActionSource } from './action-source';\nimport { pageLocation } from './page-location';\n\n/** Matches the Graph API version the pinned business SDK speaks (`FacebookAdsApi.VERSION`). */\nconst API_VERSION = 'v24.0';\n\nconst USER_ASSIGNED_COUNTRIES: string[] = ['xk'];\nfunction normalizeCountry(input: string | undefined): string | undefined {\n  const country = input?.split(/[-_]/).at(0)?.toLowerCase();\n  if (!country) return undefined;\n  return USER_ASSIGNED_COUNTRIES.includes(country) ? undefined : country;\n}\n\n/**\n * Lazy for the same reason as the session and the token bucket (see setup/session.ts):\n * Cloudflare Workers refuse some work in module scope, and nothing here is per-request state.\n */\nlet paramBuilder: ParamBuilder | undefined;\n\n/**\n * Normalize and hash one PII value through the param builder, stripped to the bare SHA-256 the\n * business SDK sends: the builder appends a `.<language-token>` adoption marker that Meta's\n * endpoint tolerates but the business SDK never produced. Pre-hashed input passes through, as\n * it does in the business SDK.\n */\nfunction pii(value: string | undefined, dataType: string): string | undefined {\n  if (!value) return undefined;\n  const built = (paramBuilder ??= new ParamBuilder()).getNormalizedAndHashedPII(value, dataType);\n  return built?.split('.').at(0) ?? undefined;\n}\n\nconst SHA256_OR_MD5 = /^[a-f0-9]{64}$|^[a-f0-9]{32}$/;\n\n/**\n * The business SDK's `normalizeAndHash` for the fields where the param builder normalizes\n * differently (names, city, state, zip): trim + lowercase, pass a pre-hashed value through,\n * apply the field rule, SHA-256. Field rules are copied from `ServerSideUtils` verbatim so the\n * differential test can hold the outputs equal.\n */\nfunction hashed(\n  input: string | undefined,\n  rule: (lowered: string) => string | undefined\n): string | undefined {\n  if (!input) return undefined;\n  const lowered = input.trim().toLowerCase();\n  if (!lowered) return undefined;\n  if (SHA256_OR_MD5.test(lowered)) return lowered;\n  const normalized = rule(lowered);\n  if (normalized === undefined) return undefined;\n  return createHash('sha256').update(normalized).digest('hex');\n}\n\nconst nameRule = (v: string) => v;\nconst f5Rule = (v: string) => (v.length <= 5 ? v : v.slice(0, 5));\nconst cityStateRule = (v: string) => v.replace(/[0-9\\s().-]/g, '');\nconst zipRule = (v: string) => {\n  const zip = v.replace(/\\s/g, '').split('-', 1)[0];\n  return zip.length < 2 ? undefined : zip;\n};\n\n/**\n * Every multi-value field is deduplicated after hashing, order preserved — the SDK runs each\n * through `dedupArray` (a Set), `external_id` included.\n */\nconst dedupe = (hashes: (string | undefined)[]) =>\n  Array.from(new Set(hashes.filter((hash): hash is string => hash !== undefined)));\n\nconst list = (hashes: (string | undefined)[]) => {\n  const deduped = dedupe(hashes);\n  return deduped.length > 0 ? deduped : undefined;\n};\n\ninterface CapiUserData {\n  em?: string[];\n  ph?: string[];\n  ge?: string[];\n  fn?: string[];\n  ln?: string[];\n  ct?: string[];\n  st?: string[];\n  zp?: string[];\n  country?: string[];\n  external_id?: string[];\n  client_ip_address?: string;\n  client_user_agent?: string;\n  fbc?: string;\n  fbp?: string;\n  fb_login_id?: string;\n  page_id?: string;\n  f5first?: string;\n  f5last?: string;\n  dobd?: string;\n  dobm?: string;\n  doby?: string;\n  madid?: string;\n}\n\nfunction getUserData(tags: TrackTags, data: UserProvidedData, eventTimeMs: number): CapiUserData {\n  const userData: CapiUserData = {};\n\n  if (data.email) {\n    const emails = Array.isArray(data.email) ? data.email : [data.email];\n    userData.em = list(emails.map((email) => pii(email, PII_DATA_TYPE.EMAIL)));\n  }\n  if (data.phone_number) {\n    const phones = Array.isArray(data.phone_number) ? data.phone_number : [data.phone_number];\n    userData.ph = list(phones.map((phone) => pii(phone, PII_DATA_TYPE.PHONE)));\n  }\n  if (data.gender === 'female' || data.gender === 'male') {\n    userData.ge = list([pii(data.gender === 'female' ? 'f' : 'm', PII_DATA_TYPE.GENDER)]);\n  }\n  if (data.address) {\n    if (Array.isArray(data.address)) {\n      // The SDK sets these lists unconditionally in the multi-address branch, so an all-empty\n      // column still goes out as `[]` — kept for byte-equality with the current sender.\n      userData.fn = dedupe(data.address.map((a) => hashed(a.first_name, nameRule)));\n      userData.ln = dedupe(data.address.map((a) => hashed(a.last_name, nameRule)));\n      userData.ct = dedupe(data.address.map((a) => hashed(a.city, cityStateRule)));\n      userData.st = dedupe(data.address.map((a) => hashed(a.region, cityStateRule)));\n      userData.zp = dedupe(data.address.map((a) => hashed(a.postal_code, zipRule)));\n      userData.country = dedupe(\n        data.address.map((a) => pii(normalizeCountry(a.country), PII_DATA_TYPE.COUNTRY))\n      );\n    } else {\n      userData.fn = list([hashed(data.address.first_name, nameRule)]);\n      userData.ln = list([hashed(data.address.last_name, nameRule)]);\n      userData.ct = list([hashed(data.address.city, cityStateRule)]);\n      userData.st = list([hashed(data.address.region, cityStateRule)]);\n      userData.zp = list([hashed(data.address.postal_code, zipRule)]);\n      userData.country = list([pii(normalizeCountry(data.address.country), PII_DATA_TYPE.COUNTRY)]);\n      // The 5-character prefixes, exactly as the current sender builds them: sliced first, then\n      // normalized. Only the single-address branch sets them, as before.\n      userData.f5first = hashed(data.address.first_name?.slice(0, 5), f5Rule);\n      userData.f5last = hashed(data.address.last_name?.slice(0, 5), f5Rule);\n    }\n  }\n  if (data.birthday) {\n    const { year, month, day } = data.birthday;\n    if (/^\\d{4}$/.test(year.toString())) {\n      userData.doby = createHash('sha256').update(year.toString()).digest('hex');\n    }\n    if (month >= 1 && month <= 12) {\n      userData.dobm = createHash('sha256').update(month.toString().padStart(2, '0')).digest('hex');\n    }\n    if (day >= 1 && day <= 31) {\n      userData.dobd = createHash('sha256').update(day.toString().padStart(2, '0')).digest('hex');\n    }\n  }\n  if (data.user_id && data.user_id.length !== 0) {\n    // Unhashed, as the business SDK sends it. Meta documents hashing as recommended, not\n    // required; changing it here would break continuity with every event sent so far.\n    userData.external_id = [data.user_id];\n  }\n  if (data.ip_address) {\n    userData.client_ip_address = data.ip_address;\n  }\n  if (data.user_agent) {\n    userData.client_user_agent = data.user_agent;\n  }\n  if (data.fb_login_id) {\n    userData.fb_login_id = data.fb_login_id;\n  }\n  if (data.fb_page_id) {\n    userData.page_id = data.fb_page_id;\n  }\n\n  if (tags.fbc) {\n    userData.fbc = tags.fbc;\n  } else if (tags.fbclid) {\n    userData.fbc = formatFbc(tags.fbclid, eventTimeMs);\n  }\n  if (tags.fbp) {\n    userData.fbp = tags.fbp;\n  }\n  if (tags.advertising_id) {\n    userData.madid = tags.advertising_id;\n  }\n  if (tags.ip_address && typeof tags.ip_address === 'string') {\n    userData.client_ip_address = tags.ip_address;\n  }\n\n  return userData;\n}\n\nconst DELIVERY_CATEGORIES = ['in_store', 'curbside', 'home_delivery'];\n\n// oxlint-disable-next-line @typescript-eslint/no-explicit-any\nfunction getCustomData({ name, properties }: TrackEvent<any>): Record<string, unknown> {\n  const [_, _name, fbEventProperties] = mapFBEvent(name, properties);\n  const {\n    value,\n    currency,\n    content_name,\n    content_category,\n    content_ids,\n    contents,\n    content_type,\n    predicted_ltv,\n    num_items,\n    search_string,\n    status,\n    delivery_category,\n    ...custom_properties\n  } = fbEventProperties;\n\n  const customData: Record<string, unknown> = {};\n  // oxlint-disable-next-line typescript/no-unnecessary-condition -- custom event properties may carry `value: null` at runtime despite the declared type\n  if (value !== undefined && value !== null && Number.isFinite(Number.parseFloat(String(value)))) {\n    customData.value = Number.parseFloat(String(value));\n  }\n  if (currency) {\n    // The business SDK also validates against the ISO 4217 list and throws; here an unknown\n    // code is forwarded uppercased rather than costing the batch.\n    customData.currency = currency.trim().toUpperCase().replace(/[^A-Z]/g, '');\n  }\n  if (content_name) customData.content_name = content_name;\n  if (content_category) customData.content_category = content_category;\n  if (content_ids) customData.content_ids = content_ids;\n  if (contents) {\n    customData.contents = contents.map((c) => {\n      const content: Record<string, unknown> = {};\n      if (c.id) content.id = c.id;\n      if (c.quantity) content.quantity = c.quantity;\n      if (c.item_price) content.item_price = c.item_price;\n      if (c.title) content.title = c.title;\n      if (c.description) content.description = c.description;\n      if (c.brand) content.brand = c.brand;\n      if (c.category) content.category = c.category;\n      const delivery = c.delivery_category?.trim().toLowerCase();\n      if (delivery && DELIVERY_CATEGORIES.includes(delivery)) content.delivery_category = delivery;\n      return content;\n    });\n  }\n  if (content_type) customData.content_type = content_type;\n  if (predicted_ltv) customData.predicted_ltv = predicted_ltv;\n  if (num_items) customData.num_items = num_items;\n  if (search_string) customData.search_string = search_string;\n  if (status) customData.status = status.toString();\n  const delivery = delivery_category?.trim().toLowerCase();\n  if (delivery && DELIVERY_CATEGORIES.includes(delivery)) customData.delivery_category = delivery;\n\n  return { ...customData, ...custom_properties };\n}\n\n/**\n * `extinfo` is keyed by field index. The business SDK builds the same object and leaves unset\n * indexes out when it serializes; the documented 16-element array is what the Graph endpoint\n * decodes this into. Indexes: 0 version, 1 package, 2 short version, 3 long version, 4 OS\n * version, 5 device model, 6 locale, 9 screen width, 10 height, 11 density.\n */\nfunction getAppData(tags: TrackTags, appPackageName: string): Record<string, unknown> {\n  const extinfo: Record<number, string | number> = {};\n  if (tags.os_name === 'iOS' || tags.os_name === 'iPadOS') {\n    extinfo[0] = 'i2';\n  } else if (tags.os_name === 'Android') {\n    extinfo[0] = 'a2';\n  }\n  extinfo[1] = appPackageName;\n  const shortVersion = tags.release?.split('.').at(0);\n  if (shortVersion) extinfo[2] = shortVersion;\n  if (tags.release) extinfo[3] = tags.release;\n  if (tags.os_version) extinfo[4] = tags.os_version;\n  if (tags.device_model_id) extinfo[5] = tags.device_model_id;\n  if (tags.language) extinfo[6] = tags.language;\n  if (tags.screen_width) extinfo[9] = tags.screen_width;\n  if (tags.screen_height) extinfo[10] = tags.screen_height;\n  if (tags.device_pixel_ratio) extinfo[11] = tags.device_pixel_ratio.toString();\n\n  const appData: Record<string, unknown> = { extinfo };\n  if (tags.advertising_id) appData.advertiser_tracking_enabled = true;\n  if (tags.install_referrer) appData.install_referrer = tags.install_referrer;\n  return appData;\n}\n\n/** One entry of the `data` array POSTed to `/{pixel_id}/events`. */\nexport interface CapiEvent {\n  event_name: string;\n  event_time: number;\n  event_id: string;\n  event_source_url?: string;\n  action_source: 'app' | 'website' | 'other';\n  user_data: CapiUserData;\n  custom_data: Record<string, unknown>;\n  app_data?: Record<string, unknown>;\n}\n\n/**\n * `action_source` is derived from `event.platform` alone: an OS platform is an app, `web` is a\n * website, and everything else — including a backend-built offline conversion, which should\n * declare `platform: 'unknown'` — lands in Meta's `other`, exactly where the business-SDK\n * sender put an explicit `'offline'` too.\n */\nexport function getCapiEvent(\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  event: TrackEvent<any>,\n  data: UserProvidedData,\n  appPackageName?: string\n): CapiEvent {\n  const eventTimeMs = new Date(event.created_at).getTime();\n  const [_, eventName] = mapFBEvent(event.name, event.properties);\n  const source = resolveActionSource(event.platform);\n\n  const capiEvent: CapiEvent = {\n    event_name: eventName,\n    event_time: Math.round(eventTimeMs / 1000),\n    event_id: event.tags.idempotency_key ?? event.id,\n    // `action_source` is required; an offline conversion and an undeterminable platform both\n    // land in Meta's catch-all, exactly as in the business-SDK sender.\n    action_source: source === 'app' ? 'app' : source === 'web' ? 'website' : 'other',\n    user_data: getUserData(event.tags, data, eventTimeMs),\n    custom_data: getCustomData(event),\n  };\n  if (source === 'app' && appPackageName) {\n    capiEvent.app_data = getAppData(event.tags, appPackageName);\n  }\n  const eventSourceUrl = pageLocation(event.tags);\n  if (eventSourceUrl) {\n    capiEvent.event_source_url = eventSourceUrl;\n  }\n  return capiEvent;\n}\n\nexport interface MetaConversionsOptions {\n  /** Attaches `app_data`/extinfo to events whose platform resolves to an app. */\n  appPackageName?: string;\n  /** Routes the batch to Events Manager's Test Events tab instead of production. */\n  testEventCode?: string;\n  /** Graph API version, e.g. 'v24.0'. */\n  apiVersion?: string;\n}\n\nexport interface MetaConversionsResponse {\n  events_received?: number;\n  messages?: string[];\n  fbtrace_id?: string;\n}\n\n/**\n * The lightweight counterpart to `sendMetaEvents`: same filtering, same payload, same\n * never-throws contract, minus the 31MB SDK. The token travels in the JSON body, never in the\n * URL, and is never logged.\n */\nexport async function sendMetaConversions(\n  accessToken: string,\n  pixelId: string,\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  events: TrackEvent<any>[],\n  data: UserProvidedData = {},\n  options: MetaConversionsOptions = {}\n): Promise<MetaConversionsResponse | undefined> {\n  const capiEvents = events\n    .filter((event) => !IGNORED_EVENTS.includes(event.name))\n    .map((event) => getCapiEvent(event, data, options.appPackageName));\n  if (capiEvents.length === 0) return undefined;\n\n  const version = options.apiVersion ?? API_VERSION;\n  try {\n    const response = await fetch(`https://graph.facebook.com/${version}/${pixelId}/events`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json', Accept: 'application/json' },\n      body: JSON.stringify({\n        data: capiEvents,\n        test_event_code: options.testEventCode,\n        access_token: accessToken,\n      }),\n    });\n    if (response.ok) return (await response.json()) as MetaConversionsResponse;\n    const { status } = response;\n    const message = await response.text();\n    console.error(`Failed to send Meta conversion, status: ${status}, body: ${message}`);\n    return undefined;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    console.error(`Failed to send Meta conversion, network error: ${message}`);\n    return undefined;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,MAAM,cAAc;AAEpB,MAAM,0BAAoC,CAAC,IAAI;AAC/C,SAAS,iBAAiB,OAA+C;CACvE,MAAM,UAAU,OAAO,MAAM,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY;CACxD,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,OAAO,wBAAwB,SAAS,OAAO,IAAI,KAAA,IAAY;AACjE;;;;;AAMA,IAAI;;;;;;;AAQJ,SAAS,IAAI,OAA2B,UAAsC;CAC5E,IAAI,CAAC,OAAO,OAAO,KAAA;CAEnB,QADe,iBAAiB,IAAIA,0BAAAA,aAAa,EAAA,CAAG,0BAA0B,OAAO,QAC1E,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,KAAA;AACpC;AAEA,MAAM,gBAAgB;;;;;;;AAQtB,SAAS,OACP,OACA,MACoB;CACpB,IAAI,CAAC,OAAO,OAAO,KAAA;CACnB,MAAM,UAAU,MAAM,KAAK,CAAC,CAAC,YAAY;CACzC,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,IAAI,cAAc,KAAK,OAAO,GAAG,OAAO;CACxC,MAAM,aAAa,KAAK,OAAO;CAC/B,IAAI,eAAe,KAAA,GAAW,OAAO,KAAA;CACrC,QAAA,GAAA,YAAA,WAAA,CAAkB,QAAQ,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,OAAO,KAAK;AAC7D;AAEA,MAAM,YAAY,MAAc;AAChC,MAAM,UAAU,MAAe,EAAE,UAAU,IAAI,IAAI,EAAE,MAAM,GAAG,CAAC;AAC/D,MAAM,iBAAiB,MAAc,EAAE,QAAQ,gBAAgB,EAAE;AACjE,MAAM,WAAW,MAAc;CAC7B,MAAM,MAAM,EAAE,QAAQ,OAAO,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;CAC/C,OAAO,IAAI,SAAS,IAAI,KAAA,IAAY;AACtC;;;;;AAMA,MAAM,UAAU,WACd,MAAM,KAAK,IAAI,IAAI,OAAO,QAAQ,SAAyB,SAAS,KAAA,CAAS,CAAC,CAAC;AAEjF,MAAM,QAAQ,WAAmC;CAC/C,MAAM,UAAU,OAAO,MAAM;CAC7B,OAAO,QAAQ,SAAS,IAAI,UAAU,KAAA;AACxC;AA2BA,SAAS,YAAY,MAAiB,MAAwB,aAAmC;CAC/F,MAAM,WAAyB,CAAC;CAEhC,IAAI,KAAK,OAAO;EACd,MAAM,SAAS,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC,KAAK,KAAK;EACnE,SAAS,KAAK,KAAK,OAAO,KAAK,UAAU,IAAI,OAAOC,0BAAAA,cAAc,KAAK,CAAC,CAAC;CAC3E;CACA,IAAI,KAAK,cAAc;EACrB,MAAM,SAAS,MAAM,QAAQ,KAAK,YAAY,IAAI,KAAK,eAAe,CAAC,KAAK,YAAY;EACxF,SAAS,KAAK,KAAK,OAAO,KAAK,UAAU,IAAI,OAAOA,0BAAAA,cAAc,KAAK,CAAC,CAAC;CAC3E;CACA,IAAI,KAAK,WAAW,YAAY,KAAK,WAAW,QAC9C,SAAS,KAAK,KAAK,CAAC,IAAI,KAAK,WAAW,WAAW,MAAM,KAAKA,0BAAAA,cAAc,MAAM,CAAC,CAAC;CAEtF,IAAI,KAAK,SACP,IAAI,MAAM,QAAQ,KAAK,OAAO,GAAG;EAG/B,SAAS,KAAK,OAAO,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,YAAY,QAAQ,CAAC,CAAC;EAC5E,SAAS,KAAK,OAAO,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,WAAW,QAAQ,CAAC,CAAC;EAC3E,SAAS,KAAK,OAAO,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,MAAM,aAAa,CAAC,CAAC;EAC3E,SAAS,KAAK,OAAO,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,QAAQ,aAAa,CAAC,CAAC;EAC7E,SAAS,KAAK,OAAO,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,aAAa,OAAO,CAAC,CAAC;EAC5E,SAAS,UAAU,OACjB,KAAK,QAAQ,KAAK,MAAM,IAAI,iBAAiB,EAAE,OAAO,GAAGA,0BAAAA,cAAc,OAAO,CAAC,CACjF;CACF,OAAO;EACL,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,QAAQ,YAAY,QAAQ,CAAC,CAAC;EAC9D,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,QAAQ,WAAW,QAAQ,CAAC,CAAC;EAC7D,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,QAAQ,MAAM,aAAa,CAAC,CAAC;EAC7D,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,QAAQ,QAAQ,aAAa,CAAC,CAAC;EAC/D,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,QAAQ,aAAa,OAAO,CAAC,CAAC;EAC9D,SAAS,UAAU,KAAK,CAAC,IAAI,iBAAiB,KAAK,QAAQ,OAAO,GAAGA,0BAAAA,cAAc,OAAO,CAAC,CAAC;EAG5F,SAAS,UAAU,OAAO,KAAK,QAAQ,YAAY,MAAM,GAAG,CAAC,GAAG,MAAM;EACtE,SAAS,SAAS,OAAO,KAAK,QAAQ,WAAW,MAAM,GAAG,CAAC,GAAG,MAAM;CACtE;CAEF,IAAI,KAAK,UAAU;EACjB,MAAM,EAAE,MAAM,OAAO,QAAQ,KAAK;EAClC,IAAI,UAAU,KAAK,KAAK,SAAS,CAAC,GAChC,SAAS,QAAA,GAAA,YAAA,WAAA,CAAkB,QAAQ,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,KAAK;EAE3E,IAAI,SAAS,KAAK,SAAS,IACzB,SAAS,QAAA,GAAA,YAAA,WAAA,CAAkB,QAAQ,CAAC,CAAC,OAAO,MAAM,SAAS,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK;EAE7F,IAAI,OAAO,KAAK,OAAO,IACrB,SAAS,QAAA,GAAA,YAAA,WAAA,CAAkB,QAAQ,CAAC,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK;CAE7F;CACA,IAAI,KAAK,WAAW,KAAK,QAAQ,WAAW,GAG1C,SAAS,cAAc,CAAC,KAAK,OAAO;CAEtC,IAAI,KAAK,YACP,SAAS,oBAAoB,KAAK;CAEpC,IAAI,KAAK,YACP,SAAS,oBAAoB,KAAK;CAEpC,IAAI,KAAK,aACP,SAAS,cAAc,KAAK;CAE9B,IAAI,KAAK,YACP,SAAS,UAAU,KAAK;CAG1B,IAAI,KAAK,KACP,SAAS,MAAM,KAAK;MACf,IAAI,KAAK,QACd,SAAS,MAAMC,uBAAAA,UAAU,KAAK,QAAQ,WAAW;CAEnD,IAAI,KAAK,KACP,SAAS,MAAM,KAAK;CAEtB,IAAI,KAAK,gBACP,SAAS,QAAQ,KAAK;CAExB,IAAI,KAAK,cAAc,OAAO,KAAK,eAAe,UAChD,SAAS,oBAAoB,KAAK;CAGpC,OAAO;AACT;AAEA,MAAM,sBAAsB;CAAC;CAAY;CAAY;AAAe;AAGpE,SAAS,cAAc,EAAE,MAAM,cAAwD;CACrF,MAAM,CAAC,GAAG,OAAO,qBAAqBC,kBAAAA,WAAW,MAAM,UAAU;CACjE,MAAM,EACJ,OACA,UACA,cACA,kBACA,aACA,UACA,cACA,eACA,WACA,eACA,QACA,mBACA,GAAG,sBACD;CAEJ,MAAM,aAAsC,CAAC;CAE7C,IAAI,UAAU,KAAA,KAAa,UAAU,QAAQ,OAAO,SAAS,OAAO,WAAW,OAAO,KAAK,CAAC,CAAC,GAC3F,WAAW,QAAQ,OAAO,WAAW,OAAO,KAAK,CAAC;CAEpD,IAAI,UAGF,WAAW,WAAW,SAAS,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,WAAW,EAAE;CAE3E,IAAI,cAAc,WAAW,eAAe;CAC5C,IAAI,kBAAkB,WAAW,mBAAmB;CACpD,IAAI,aAAa,WAAW,cAAc;CAC1C,IAAI,UACF,WAAW,WAAW,SAAS,KAAK,MAAM;EACxC,MAAM,UAAmC,CAAC;EAC1C,IAAI,EAAE,IAAI,QAAQ,KAAK,EAAE;EACzB,IAAI,EAAE,UAAU,QAAQ,WAAW,EAAE;EACrC,IAAI,EAAE,YAAY,QAAQ,aAAa,EAAE;EACzC,IAAI,EAAE,OAAO,QAAQ,QAAQ,EAAE;EAC/B,IAAI,EAAE,aAAa,QAAQ,cAAc,EAAE;EAC3C,IAAI,EAAE,OAAO,QAAQ,QAAQ,EAAE;EAC/B,IAAI,EAAE,UAAU,QAAQ,WAAW,EAAE;EACrC,MAAM,WAAW,EAAE,mBAAmB,KAAK,CAAC,CAAC,YAAY;EACzD,IAAI,YAAY,oBAAoB,SAAS,QAAQ,GAAG,QAAQ,oBAAoB;EACpF,OAAO;CACT,CAAC;CAEH,IAAI,cAAc,WAAW,eAAe;CAC5C,IAAI,eAAe,WAAW,gBAAgB;CAC9C,IAAI,WAAW,WAAW,YAAY;CACtC,IAAI,eAAe,WAAW,gBAAgB;CAC9C,IAAI,QAAQ,WAAW,SAAS,OAAO,SAAS;CAChD,MAAM,WAAW,mBAAmB,KAAK,CAAC,CAAC,YAAY;CACvD,IAAI,YAAY,oBAAoB,SAAS,QAAQ,GAAG,WAAW,oBAAoB;CAEvF,OAAO;EAAE,GAAG;EAAY,GAAG;CAAkB;AAC/C;;;;;;;AAQA,SAAS,WAAW,MAAiB,gBAAiD;CACpF,MAAM,UAA2C,CAAC;CAClD,IAAI,KAAK,YAAY,SAAS,KAAK,YAAY,UAC7C,QAAQ,KAAK;MACR,IAAI,KAAK,YAAY,WAC1B,QAAQ,KAAK;CAEf,QAAQ,KAAK;CACb,MAAM,eAAe,KAAK,SAAS,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC;CAClD,IAAI,cAAc,QAAQ,KAAK;CAC/B,IAAI,KAAK,SAAS,QAAQ,KAAK,KAAK;CACpC,IAAI,KAAK,YAAY,QAAQ,KAAK,KAAK;CACvC,IAAI,KAAK,iBAAiB,QAAQ,KAAK,KAAK;CAC5C,IAAI,KAAK,UAAU,QAAQ,KAAK,KAAK;CACrC,IAAI,KAAK,cAAc,QAAQ,KAAK,KAAK;CACzC,IAAI,KAAK,eAAe,QAAQ,MAAM,KAAK;CAC3C,IAAI,KAAK,oBAAoB,QAAQ,MAAM,KAAK,mBAAmB,SAAS;CAE5E,MAAM,UAAmC,EAAE,QAAQ;CACnD,IAAI,KAAK,gBAAgB,QAAQ,8BAA8B;CAC/D,IAAI,KAAK,kBAAkB,QAAQ,mBAAmB,KAAK;CAC3D,OAAO;AACT;;;;;;;AAoBA,SAAgB,aAEd,OACA,MACA,gBACW;CACX,MAAM,cAAc,IAAI,KAAK,MAAM,UAAU,CAAC,CAAC,QAAQ;CACvD,MAAM,CAAC,GAAG,aAAaA,kBAAAA,WAAW,MAAM,MAAM,MAAM,UAAU;CAC9D,MAAM,SAASC,6BAAAA,oBAAoB,MAAM,QAAQ;CAEjD,MAAM,YAAuB;EAC3B,YAAY;EACZ,YAAY,KAAK,MAAM,cAAc,GAAI;EACzC,UAAU,MAAM,KAAK,mBAAmB,MAAM;EAG9C,eAAe,WAAW,QAAQ,QAAQ,WAAW,QAAQ,YAAY;EACzE,WAAW,YAAY,MAAM,MAAM,MAAM,WAAW;EACpD,aAAa,cAAc,KAAK;CAClC;CACA,IAAI,WAAW,SAAS,gBACtB,UAAU,WAAW,WAAW,MAAM,MAAM,cAAc;CAE5D,MAAM,iBAAiBC,6BAAAA,aAAa,MAAM,IAAI;CAC9C,IAAI,gBACF,UAAU,mBAAmB;CAE/B,OAAO;AACT;;;;;;AAsBA,eAAsB,oBACpB,aACA,SAEA,QACA,OAAyB,CAAC,GAC1B,UAAkC,CAAC,GACW;CAC9C,MAAM,aAAa,OAChB,QAAQ,UAAU,CAACC,qCAAAA,eAAe,SAAS,MAAM,IAAI,CAAC,CAAC,CACvD,KAAK,UAAU,aAAa,OAAO,MAAM,QAAQ,cAAc,CAAC;CACnE,IAAI,WAAW,WAAW,GAAG,OAAO,KAAA;CAEpC,MAAM,UAAU,QAAQ,cAAc;CACtC,IAAI;EACF,MAAM,WAAW,OAAA,GAAA,cAAA,MAAA,CAAY,8BAA8B,QAAQ,GAAG,QAAQ,UAAU;GACtF,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAoB,QAAQ;GAAmB;GAC1E,MAAM,KAAK,UAAU;IACnB,MAAM;IACN,iBAAiB,QAAQ;IACzB,cAAc;GAChB,CAAC;EACH,CAAC;EACD,IAAI,SAAS,IAAI,OAAQ,MAAM,SAAS,KAAK;EAC7C,MAAM,EAAE,WAAW;EACnB,MAAM,UAAU,MAAM,SAAS,KAAK;EACpC,QAAQ,MAAM,2CAA2C,OAAO,UAAU,SAAS;EACnF;CACF,SAAS,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACrE,QAAQ,MAAM,kDAAkD,SAAS;EACzE;CACF;AACF"}
+{"version":3,"file":"meta-capi.cjs","names":["ParamBuilder","PII_DATA_TYPE","formatFbc","mapFBEvent","resolveActionSource","pageLocation","IGNORED_EVENTS"],"sources":["../../src/server/meta-capi.ts"],"sourcesContent":["/**\n * Meta Conversions API sender built on `capi-param-builder-nodejs` and plain `fetch`, replacing\n * the 31MB `facebook-nodejs-business-sdk` with ~0.5MB of parameter building. The SDK-based\n * sender survives untouched at `@shware/analytics/server/legacy`; this module is its drop-in\n * successor.\n *\n * The wire payload is byte-identical to what the business SDK's `ServerEvent.normalize()`\n * produces — enforced by a differential test that runs both builders over the same events.\n * Where the two libraries normalize differently (the business SDK keeps punctuation in names,\n * spaces in multi-word last names, accents in cities; the param builder strips them per the\n * current documented rules), this module follows the business SDK so that switching senders\n * cannot change a single hash Meta receives. The param builder is used where the two provably\n * agree — email, phone, gender, country — and its adoption-tracking appendix (`<hash>.<token>`)\n * is stripped for the same reason.\n *\n * Two deliberate behavior differences from the business SDK, both on invalid input only:\n * an invalid field (malformed email, non-ISO country, letters in a phone) is dropped from\n * user_data instead of throwing inside `execute()` and costing the whole batch; an invalid\n * currency is uppercased and forwarded instead of rejected. Valid input is unaffected.\n *\n * https://developers.facebook.com/docs/marketing-api/conversions-api/using-the-api\n * https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/customer-information-parameters\n */\nimport { createHash } from 'node:crypto';\nimport { fetch } from '@shware/utils';\nimport { PII_DATA_TYPE, ParamBuilder } from 'capi-param-builder-nodejs';\nimport { formatFbc } from '../click-id/index';\nimport { IGNORED_EVENTS } from '../third-parties/ignored-events';\nimport { mapFBEvent } from '../track/fbq';\nimport type { TrackEvent, TrackTags, UserProvidedData } from '../track/types';\nimport { resolveActionSource } from './action-source';\nimport { pageLocation } from './page-location';\n\n/** Matches the Graph API version the pinned business SDK speaks (`FacebookAdsApi.VERSION`). */\nconst API_VERSION = 'v24.0';\n\nconst USER_ASSIGNED_COUNTRIES: string[] = ['xk'];\nfunction normalizeCountry(input: string | undefined): string | undefined {\n  const country = input?.split(/[-_]/).at(0)?.toLowerCase();\n  if (!country) return undefined;\n  return USER_ASSIGNED_COUNTRIES.includes(country) ? undefined : country;\n}\n\n/**\n * Lazy for the same reason as the session and the token bucket (see setup/session.ts):\n * Cloudflare Workers refuse some work in module scope, and nothing here is per-request state.\n */\nlet paramBuilder: ParamBuilder | undefined;\n\n/**\n * Normalize and hash one PII value through the param builder, stripped to the bare SHA-256 the\n * business SDK sends: the builder appends a `.<language-token>` adoption marker that Meta's\n * endpoint tolerates but the business SDK never produced. Pre-hashed input passes through, as\n * it does in the business SDK.\n */\nfunction pii(value: string | undefined, dataType: string): string | undefined {\n  if (!value) return undefined;\n  const built = (paramBuilder ??= new ParamBuilder()).getNormalizedAndHashedPII(value, dataType);\n  return built?.split('.').at(0) ?? undefined;\n}\n\nconst SHA256_OR_MD5 = /^[a-f0-9]{64}$|^[a-f0-9]{32}$/;\n\n/**\n * The business SDK's `normalizeAndHash` for the fields where the param builder normalizes\n * differently (names, city, state, zip): trim + lowercase, pass a pre-hashed value through,\n * apply the field rule, SHA-256. Field rules are copied from `ServerSideUtils` verbatim so the\n * differential test can hold the outputs equal.\n */\nfunction hashed(\n  input: string | undefined,\n  rule: (lowered: string) => string | undefined\n): string | undefined {\n  if (!input) return undefined;\n  const lowered = input.trim().toLowerCase();\n  if (!lowered) return undefined;\n  if (SHA256_OR_MD5.test(lowered)) return lowered;\n  const normalized = rule(lowered);\n  if (normalized === undefined) return undefined;\n  return createHash('sha256').update(normalized).digest('hex');\n}\n\nconst nameRule = (v: string) => v;\nconst f5Rule = (v: string) => (v.length <= 5 ? v : v.slice(0, 5));\nconst cityStateRule = (v: string) => v.replace(/[0-9\\s().-]/g, '');\nconst zipRule = (v: string) => {\n  const zip = v.replace(/\\s/g, '').split('-', 1)[0];\n  return zip.length < 2 ? undefined : zip;\n};\n\n/**\n * Every multi-value field is deduplicated after hashing, order preserved — the SDK runs each\n * through `dedupArray` (a Set), `external_id` included.\n */\nconst dedupe = (hashes: (string | undefined)[]) =>\n  Array.from(new Set(hashes.filter((hash): hash is string => hash !== undefined)));\n\nconst list = (hashes: (string | undefined)[]) => {\n  const deduped = dedupe(hashes);\n  return deduped.length > 0 ? deduped : undefined;\n};\n\ninterface CapiUserData {\n  em?: string[];\n  ph?: string[];\n  ge?: string[];\n  fn?: string[];\n  ln?: string[];\n  ct?: string[];\n  st?: string[];\n  zp?: string[];\n  country?: string[];\n  external_id?: string[];\n  client_ip_address?: string;\n  client_user_agent?: string;\n  fbc?: string;\n  fbp?: string;\n  fb_login_id?: string;\n  page_id?: string;\n  f5first?: string;\n  f5last?: string;\n  dobd?: string;\n  dobm?: string;\n  doby?: string;\n  madid?: string;\n}\n\nfunction getUserData(tags: TrackTags, data: UserProvidedData, eventTimeMs: number): CapiUserData {\n  const userData: CapiUserData = {};\n\n  if (data.email) {\n    const emails = Array.isArray(data.email) ? data.email : [data.email];\n    userData.em = list(emails.map((email) => pii(email, PII_DATA_TYPE.EMAIL)));\n  }\n  if (data.phone_number) {\n    const phones = Array.isArray(data.phone_number) ? data.phone_number : [data.phone_number];\n    userData.ph = list(phones.map((phone) => pii(phone, PII_DATA_TYPE.PHONE)));\n  }\n  if (data.gender === 'female' || data.gender === 'male') {\n    userData.ge = list([pii(data.gender === 'female' ? 'f' : 'm', PII_DATA_TYPE.GENDER)]);\n  }\n  if (data.address) {\n    if (Array.isArray(data.address)) {\n      // The SDK sets these lists unconditionally in the multi-address branch, so an all-empty\n      // column still goes out as `[]` — kept for byte-equality with the current sender.\n      userData.fn = dedupe(data.address.map((a) => hashed(a.first_name, nameRule)));\n      userData.ln = dedupe(data.address.map((a) => hashed(a.last_name, nameRule)));\n      userData.ct = dedupe(data.address.map((a) => hashed(a.city, cityStateRule)));\n      userData.st = dedupe(data.address.map((a) => hashed(a.region, cityStateRule)));\n      userData.zp = dedupe(data.address.map((a) => hashed(a.postal_code, zipRule)));\n      userData.country = dedupe(\n        data.address.map((a) => pii(normalizeCountry(a.country), PII_DATA_TYPE.COUNTRY))\n      );\n    } else {\n      userData.fn = list([hashed(data.address.first_name, nameRule)]);\n      userData.ln = list([hashed(data.address.last_name, nameRule)]);\n      userData.ct = list([hashed(data.address.city, cityStateRule)]);\n      userData.st = list([hashed(data.address.region, cityStateRule)]);\n      userData.zp = list([hashed(data.address.postal_code, zipRule)]);\n      userData.country = list([pii(normalizeCountry(data.address.country), PII_DATA_TYPE.COUNTRY)]);\n      // The 5-character prefixes, exactly as the current sender builds them: sliced first, then\n      // normalized. Only the single-address branch sets them, as before.\n      userData.f5first = hashed(data.address.first_name?.slice(0, 5), f5Rule);\n      userData.f5last = hashed(data.address.last_name?.slice(0, 5), f5Rule);\n    }\n  }\n  if (data.birthday) {\n    const { year, month, day } = data.birthday;\n    if (/^\\d{4}$/.test(year.toString())) {\n      userData.doby = createHash('sha256').update(year.toString()).digest('hex');\n    }\n    if (month >= 1 && month <= 12) {\n      userData.dobm = createHash('sha256').update(month.toString().padStart(2, '0')).digest('hex');\n    }\n    if (day >= 1 && day <= 31) {\n      userData.dobd = createHash('sha256').update(day.toString().padStart(2, '0')).digest('hex');\n    }\n  }\n  if (data.user_id && data.user_id.length !== 0) {\n    // Unhashed, as the business SDK sends it. Meta documents hashing as recommended, not\n    // required; changing it here would break continuity with every event sent so far.\n    userData.external_id = [data.user_id];\n  }\n  if (data.ip_address) {\n    userData.client_ip_address = data.ip_address;\n  }\n  if (data.user_agent) {\n    userData.client_user_agent = data.user_agent;\n  }\n  if (data.fb_login_id) {\n    userData.fb_login_id = data.fb_login_id;\n  }\n  if (data.fb_page_id) {\n    userData.page_id = data.fb_page_id;\n  }\n\n  if (tags.fbc) {\n    userData.fbc = tags.fbc;\n  } else if (tags.fbclid) {\n    userData.fbc = formatFbc(tags.fbclid, eventTimeMs);\n  }\n  if (tags.fbp) {\n    userData.fbp = tags.fbp;\n  }\n  if (tags.advertising_id) {\n    userData.madid = tags.advertising_id;\n  }\n  if (tags.ip_address && typeof tags.ip_address === 'string') {\n    userData.client_ip_address = tags.ip_address;\n  }\n\n  return userData;\n}\n\nconst DELIVERY_CATEGORIES = ['in_store', 'curbside', 'home_delivery'];\n\n// oxlint-disable-next-line @typescript-eslint/no-explicit-any\nfunction getCustomData({ name, properties }: TrackEvent<any>): Record<string, unknown> {\n  const [_, _name, fbEventProperties] = mapFBEvent(name, properties);\n  const {\n    value,\n    currency,\n    content_name,\n    content_category,\n    content_ids,\n    contents,\n    content_type,\n    predicted_ltv,\n    num_items,\n    search_string,\n    status,\n    delivery_category,\n    ...custom_properties\n  } = fbEventProperties;\n\n  const customData: Record<string, unknown> = {};\n  // oxlint-disable-next-line typescript/no-unnecessary-condition -- custom event properties may carry `value: null` at runtime despite the declared type\n  if (value !== undefined && value !== null && Number.isFinite(Number.parseFloat(String(value)))) {\n    customData.value = Number.parseFloat(String(value));\n  }\n  if (currency) {\n    // The business SDK also validates against the ISO 4217 list and throws; here an unknown\n    // code is forwarded uppercased rather than costing the batch.\n    customData.currency = currency\n      .trim()\n      .toUpperCase()\n      .replace(/[^A-Z]/g, '');\n  }\n  if (content_name) customData.content_name = content_name;\n  if (content_category) customData.content_category = content_category;\n  if (content_ids) customData.content_ids = content_ids;\n  if (contents) {\n    customData.contents = contents.map((c) => {\n      const content: Record<string, unknown> = {};\n      if (c.id) content.id = c.id;\n      if (c.quantity) content.quantity = c.quantity;\n      if (c.item_price) content.item_price = c.item_price;\n      if (c.title) content.title = c.title;\n      if (c.description) content.description = c.description;\n      if (c.brand) content.brand = c.brand;\n      if (c.category) content.category = c.category;\n      const delivery = c.delivery_category?.trim().toLowerCase();\n      if (delivery && DELIVERY_CATEGORIES.includes(delivery)) content.delivery_category = delivery;\n      return content;\n    });\n  }\n  if (content_type) customData.content_type = content_type;\n  if (predicted_ltv) customData.predicted_ltv = predicted_ltv;\n  if (num_items) customData.num_items = num_items;\n  if (search_string) customData.search_string = search_string;\n  if (status) customData.status = status.toString();\n  const delivery = delivery_category?.trim().toLowerCase();\n  if (delivery && DELIVERY_CATEGORIES.includes(delivery)) customData.delivery_category = delivery;\n\n  return { ...customData, ...custom_properties };\n}\n\n/**\n * `extinfo` is keyed by field index. The business SDK builds the same object and leaves unset\n * indexes out when it serializes; the documented 16-element array is what the Graph endpoint\n * decodes this into. Indexes: 0 version, 1 package, 2 short version, 3 long version, 4 OS\n * version, 5 device model, 6 locale, 9 screen width, 10 height, 11 density.\n */\nfunction getAppData(tags: TrackTags, appPackageName: string): Record<string, unknown> {\n  const extinfo: Record<number, string | number> = {};\n  if (tags.os_name === 'iOS' || tags.os_name === 'iPadOS') {\n    extinfo[0] = 'i2';\n  } else if (tags.os_name === 'Android') {\n    extinfo[0] = 'a2';\n  }\n  extinfo[1] = appPackageName;\n  const shortVersion = tags.release?.split('.').at(0);\n  if (shortVersion) extinfo[2] = shortVersion;\n  if (tags.release) extinfo[3] = tags.release;\n  if (tags.os_version) extinfo[4] = tags.os_version;\n  if (tags.device_model_id) extinfo[5] = tags.device_model_id;\n  if (tags.language) extinfo[6] = tags.language;\n  if (tags.screen_width) extinfo[9] = tags.screen_width;\n  if (tags.screen_height) extinfo[10] = tags.screen_height;\n  if (tags.device_pixel_ratio) extinfo[11] = tags.device_pixel_ratio.toString();\n\n  const appData: Record<string, unknown> = { extinfo };\n  if (tags.advertising_id) appData.advertiser_tracking_enabled = true;\n  if (tags.install_referrer) appData.install_referrer = tags.install_referrer;\n  return appData;\n}\n\n/** One entry of the `data` array POSTed to `/{pixel_id}/events`. */\nexport interface CapiEvent {\n  event_name: string;\n  event_time: number;\n  event_id: string;\n  event_source_url?: string;\n  action_source: 'app' | 'website' | 'other';\n  user_data: CapiUserData;\n  custom_data: Record<string, unknown>;\n  app_data?: Record<string, unknown>;\n}\n\n/**\n * `action_source` is derived from `event.platform` alone: an OS platform is an app, `web` is a\n * website, and everything else — including a backend-built offline conversion, which should\n * declare `platform: 'unknown'` — lands in Meta's `other`, exactly where the business-SDK\n * sender put an explicit `'offline'` too.\n */\nexport function getCapiEvent(\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  event: TrackEvent<any>,\n  data: UserProvidedData,\n  appPackageName?: string\n): CapiEvent {\n  const eventTimeMs = new Date(event.created_at).getTime();\n  const [_, eventName] = mapFBEvent(event.name, event.properties);\n  const source = resolveActionSource(event.platform);\n\n  const capiEvent: CapiEvent = {\n    event_name: eventName,\n    event_time: Math.round(eventTimeMs / 1000),\n    event_id: event.tags.idempotency_key ?? event.id,\n    // `action_source` is required; an offline conversion and an undeterminable platform both\n    // land in Meta's catch-all, exactly as in the business-SDK sender.\n    action_source: source === 'app' ? 'app' : source === 'web' ? 'website' : 'other',\n    user_data: getUserData(event.tags, data, eventTimeMs),\n    custom_data: getCustomData(event),\n  };\n  if (source === 'app' && appPackageName) {\n    capiEvent.app_data = getAppData(event.tags, appPackageName);\n  }\n  const eventSourceUrl = pageLocation(event.tags);\n  if (eventSourceUrl) {\n    capiEvent.event_source_url = eventSourceUrl;\n  }\n  return capiEvent;\n}\n\nexport interface MetaConversionsOptions {\n  /** Attaches `app_data`/extinfo to events whose platform resolves to an app. */\n  appPackageName?: string;\n  /** Routes the batch to Events Manager's Test Events tab instead of production. */\n  testEventCode?: string;\n  /** Graph API version, e.g. 'v24.0'. */\n  apiVersion?: string;\n}\n\nexport interface MetaConversionsResponse {\n  events_received?: number;\n  messages?: string[];\n  fbtrace_id?: string;\n}\n\n/**\n * The lightweight counterpart to the legacy SDK sender (`@shware/analytics/server/legacy`):\n * same filtering, same payload, same never-throws contract, minus the 31MB SDK. The token\n * travels in the JSON body, never in the URL, and is never logged.\n */\nexport async function sendEvents(\n  accessToken: string,\n  pixelId: string,\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  events: TrackEvent<any>[],\n  data: UserProvidedData = {},\n  options: MetaConversionsOptions = {}\n): Promise<MetaConversionsResponse | undefined> {\n  const capiEvents = events\n    .filter((event) => !IGNORED_EVENTS.includes(event.name))\n    .map((event) => getCapiEvent(event, data, options.appPackageName));\n  if (capiEvents.length === 0) return undefined;\n\n  const version = options.apiVersion ?? API_VERSION;\n  try {\n    const response = await fetch(`https://graph.facebook.com/${version}/${pixelId}/events`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json', Accept: 'application/json' },\n      body: JSON.stringify({\n        data: capiEvents,\n        test_event_code: options.testEventCode,\n        access_token: accessToken,\n      }),\n    });\n    if (response.ok) return (await response.json()) as MetaConversionsResponse;\n    const { status } = response;\n    const message = await response.text();\n    console.error(`Failed to send Meta conversion, status: ${status}, body: ${message}`);\n    return undefined;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    console.error(`Failed to send Meta conversion, network error: ${message}`);\n    return undefined;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,MAAM,cAAc;AAEpB,MAAM,0BAAoC,CAAC,IAAI;AAC/C,SAAS,iBAAiB,OAA+C;CACvE,MAAM,UAAU,OAAO,MAAM,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY;CACxD,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,OAAO,wBAAwB,SAAS,OAAO,IAAI,KAAA,IAAY;AACjE;;;;;AAMA,IAAI;;;;;;;AAQJ,SAAS,IAAI,OAA2B,UAAsC;CAC5E,IAAI,CAAC,OAAO,OAAO,KAAA;CAEnB,QADe,iBAAiB,IAAIA,0BAAAA,aAAa,EAAA,CAAG,0BAA0B,OAAO,QAC1E,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,KAAA;AACpC;AAEA,MAAM,gBAAgB;;;;;;;AAQtB,SAAS,OACP,OACA,MACoB;CACpB,IAAI,CAAC,OAAO,OAAO,KAAA;CACnB,MAAM,UAAU,MAAM,KAAK,CAAC,CAAC,YAAY;CACzC,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,IAAI,cAAc,KAAK,OAAO,GAAG,OAAO;CACxC,MAAM,aAAa,KAAK,OAAO;CAC/B,IAAI,eAAe,KAAA,GAAW,OAAO,KAAA;CACrC,QAAA,GAAA,YAAA,WAAA,CAAkB,QAAQ,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,OAAO,KAAK;AAC7D;AAEA,MAAM,YAAY,MAAc;AAChC,MAAM,UAAU,MAAe,EAAE,UAAU,IAAI,IAAI,EAAE,MAAM,GAAG,CAAC;AAC/D,MAAM,iBAAiB,MAAc,EAAE,QAAQ,gBAAgB,EAAE;AACjE,MAAM,WAAW,MAAc;CAC7B,MAAM,MAAM,EAAE,QAAQ,OAAO,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;CAC/C,OAAO,IAAI,SAAS,IAAI,KAAA,IAAY;AACtC;;;;;AAMA,MAAM,UAAU,WACd,MAAM,KAAK,IAAI,IAAI,OAAO,QAAQ,SAAyB,SAAS,KAAA,CAAS,CAAC,CAAC;AAEjF,MAAM,QAAQ,WAAmC;CAC/C,MAAM,UAAU,OAAO,MAAM;CAC7B,OAAO,QAAQ,SAAS,IAAI,UAAU,KAAA;AACxC;AA2BA,SAAS,YAAY,MAAiB,MAAwB,aAAmC;CAC/F,MAAM,WAAyB,CAAC;CAEhC,IAAI,KAAK,OAAO;EACd,MAAM,SAAS,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC,KAAK,KAAK;EACnE,SAAS,KAAK,KAAK,OAAO,KAAK,UAAU,IAAI,OAAOC,0BAAAA,cAAc,KAAK,CAAC,CAAC;CAC3E;CACA,IAAI,KAAK,cAAc;EACrB,MAAM,SAAS,MAAM,QAAQ,KAAK,YAAY,IAAI,KAAK,eAAe,CAAC,KAAK,YAAY;EACxF,SAAS,KAAK,KAAK,OAAO,KAAK,UAAU,IAAI,OAAOA,0BAAAA,cAAc,KAAK,CAAC,CAAC;CAC3E;CACA,IAAI,KAAK,WAAW,YAAY,KAAK,WAAW,QAC9C,SAAS,KAAK,KAAK,CAAC,IAAI,KAAK,WAAW,WAAW,MAAM,KAAKA,0BAAAA,cAAc,MAAM,CAAC,CAAC;CAEtF,IAAI,KAAK,SACP,IAAI,MAAM,QAAQ,KAAK,OAAO,GAAG;EAG/B,SAAS,KAAK,OAAO,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,YAAY,QAAQ,CAAC,CAAC;EAC5E,SAAS,KAAK,OAAO,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,WAAW,QAAQ,CAAC,CAAC;EAC3E,SAAS,KAAK,OAAO,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,MAAM,aAAa,CAAC,CAAC;EAC3E,SAAS,KAAK,OAAO,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,QAAQ,aAAa,CAAC,CAAC;EAC7E,SAAS,KAAK,OAAO,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,aAAa,OAAO,CAAC,CAAC;EAC5E,SAAS,UAAU,OACjB,KAAK,QAAQ,KAAK,MAAM,IAAI,iBAAiB,EAAE,OAAO,GAAGA,0BAAAA,cAAc,OAAO,CAAC,CACjF;CACF,OAAO;EACL,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,QAAQ,YAAY,QAAQ,CAAC,CAAC;EAC9D,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,QAAQ,WAAW,QAAQ,CAAC,CAAC;EAC7D,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,QAAQ,MAAM,aAAa,CAAC,CAAC;EAC7D,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,QAAQ,QAAQ,aAAa,CAAC,CAAC;EAC/D,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,QAAQ,aAAa,OAAO,CAAC,CAAC;EAC9D,SAAS,UAAU,KAAK,CAAC,IAAI,iBAAiB,KAAK,QAAQ,OAAO,GAAGA,0BAAAA,cAAc,OAAO,CAAC,CAAC;EAG5F,SAAS,UAAU,OAAO,KAAK,QAAQ,YAAY,MAAM,GAAG,CAAC,GAAG,MAAM;EACtE,SAAS,SAAS,OAAO,KAAK,QAAQ,WAAW,MAAM,GAAG,CAAC,GAAG,MAAM;CACtE;CAEF,IAAI,KAAK,UAAU;EACjB,MAAM,EAAE,MAAM,OAAO,QAAQ,KAAK;EAClC,IAAI,UAAU,KAAK,KAAK,SAAS,CAAC,GAChC,SAAS,QAAA,GAAA,YAAA,WAAA,CAAkB,QAAQ,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,KAAK;EAE3E,IAAI,SAAS,KAAK,SAAS,IACzB,SAAS,QAAA,GAAA,YAAA,WAAA,CAAkB,QAAQ,CAAC,CAAC,OAAO,MAAM,SAAS,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK;EAE7F,IAAI,OAAO,KAAK,OAAO,IACrB,SAAS,QAAA,GAAA,YAAA,WAAA,CAAkB,QAAQ,CAAC,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK;CAE7F;CACA,IAAI,KAAK,WAAW,KAAK,QAAQ,WAAW,GAG1C,SAAS,cAAc,CAAC,KAAK,OAAO;CAEtC,IAAI,KAAK,YACP,SAAS,oBAAoB,KAAK;CAEpC,IAAI,KAAK,YACP,SAAS,oBAAoB,KAAK;CAEpC,IAAI,KAAK,aACP,SAAS,cAAc,KAAK;CAE9B,IAAI,KAAK,YACP,SAAS,UAAU,KAAK;CAG1B,IAAI,KAAK,KACP,SAAS,MAAM,KAAK;MACf,IAAI,KAAK,QACd,SAAS,MAAMC,uBAAAA,UAAU,KAAK,QAAQ,WAAW;CAEnD,IAAI,KAAK,KACP,SAAS,MAAM,KAAK;CAEtB,IAAI,KAAK,gBACP,SAAS,QAAQ,KAAK;CAExB,IAAI,KAAK,cAAc,OAAO,KAAK,eAAe,UAChD,SAAS,oBAAoB,KAAK;CAGpC,OAAO;AACT;AAEA,MAAM,sBAAsB;CAAC;CAAY;CAAY;AAAe;AAGpE,SAAS,cAAc,EAAE,MAAM,cAAwD;CACrF,MAAM,CAAC,GAAG,OAAO,qBAAqBC,kBAAAA,WAAW,MAAM,UAAU;CACjE,MAAM,EACJ,OACA,UACA,cACA,kBACA,aACA,UACA,cACA,eACA,WACA,eACA,QACA,mBACA,GAAG,sBACD;CAEJ,MAAM,aAAsC,CAAC;CAE7C,IAAI,UAAU,KAAA,KAAa,UAAU,QAAQ,OAAO,SAAS,OAAO,WAAW,OAAO,KAAK,CAAC,CAAC,GAC3F,WAAW,QAAQ,OAAO,WAAW,OAAO,KAAK,CAAC;CAEpD,IAAI,UAGF,WAAW,WAAW,SACnB,KAAK,CAAC,CACN,YAAY,CAAC,CACb,QAAQ,WAAW,EAAE;CAE1B,IAAI,cAAc,WAAW,eAAe;CAC5C,IAAI,kBAAkB,WAAW,mBAAmB;CACpD,IAAI,aAAa,WAAW,cAAc;CAC1C,IAAI,UACF,WAAW,WAAW,SAAS,KAAK,MAAM;EACxC,MAAM,UAAmC,CAAC;EAC1C,IAAI,EAAE,IAAI,QAAQ,KAAK,EAAE;EACzB,IAAI,EAAE,UAAU,QAAQ,WAAW,EAAE;EACrC,IAAI,EAAE,YAAY,QAAQ,aAAa,EAAE;EACzC,IAAI,EAAE,OAAO,QAAQ,QAAQ,EAAE;EAC/B,IAAI,EAAE,aAAa,QAAQ,cAAc,EAAE;EAC3C,IAAI,EAAE,OAAO,QAAQ,QAAQ,EAAE;EAC/B,IAAI,EAAE,UAAU,QAAQ,WAAW,EAAE;EACrC,MAAM,WAAW,EAAE,mBAAmB,KAAK,CAAC,CAAC,YAAY;EACzD,IAAI,YAAY,oBAAoB,SAAS,QAAQ,GAAG,QAAQ,oBAAoB;EACpF,OAAO;CACT,CAAC;CAEH,IAAI,cAAc,WAAW,eAAe;CAC5C,IAAI,eAAe,WAAW,gBAAgB;CAC9C,IAAI,WAAW,WAAW,YAAY;CACtC,IAAI,eAAe,WAAW,gBAAgB;CAC9C,IAAI,QAAQ,WAAW,SAAS,OAAO,SAAS;CAChD,MAAM,WAAW,mBAAmB,KAAK,CAAC,CAAC,YAAY;CACvD,IAAI,YAAY,oBAAoB,SAAS,QAAQ,GAAG,WAAW,oBAAoB;CAEvF,OAAO;EAAE,GAAG;EAAY,GAAG;CAAkB;AAC/C;;;;;;;AAQA,SAAS,WAAW,MAAiB,gBAAiD;CACpF,MAAM,UAA2C,CAAC;CAClD,IAAI,KAAK,YAAY,SAAS,KAAK,YAAY,UAC7C,QAAQ,KAAK;MACR,IAAI,KAAK,YAAY,WAC1B,QAAQ,KAAK;CAEf,QAAQ,KAAK;CACb,MAAM,eAAe,KAAK,SAAS,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC;CAClD,IAAI,cAAc,QAAQ,KAAK;CAC/B,IAAI,KAAK,SAAS,QAAQ,KAAK,KAAK;CACpC,IAAI,KAAK,YAAY,QAAQ,KAAK,KAAK;CACvC,IAAI,KAAK,iBAAiB,QAAQ,KAAK,KAAK;CAC5C,IAAI,KAAK,UAAU,QAAQ,KAAK,KAAK;CACrC,IAAI,KAAK,cAAc,QAAQ,KAAK,KAAK;CACzC,IAAI,KAAK,eAAe,QAAQ,MAAM,KAAK;CAC3C,IAAI,KAAK,oBAAoB,QAAQ,MAAM,KAAK,mBAAmB,SAAS;CAE5E,MAAM,UAAmC,EAAE,QAAQ;CACnD,IAAI,KAAK,gBAAgB,QAAQ,8BAA8B;CAC/D,IAAI,KAAK,kBAAkB,QAAQ,mBAAmB,KAAK;CAC3D,OAAO;AACT;;;;;;;AAoBA,SAAgB,aAEd,OACA,MACA,gBACW;CACX,MAAM,cAAc,IAAI,KAAK,MAAM,UAAU,CAAC,CAAC,QAAQ;CACvD,MAAM,CAAC,GAAG,aAAaA,kBAAAA,WAAW,MAAM,MAAM,MAAM,UAAU;CAC9D,MAAM,SAASC,6BAAAA,oBAAoB,MAAM,QAAQ;CAEjD,MAAM,YAAuB;EAC3B,YAAY;EACZ,YAAY,KAAK,MAAM,cAAc,GAAI;EACzC,UAAU,MAAM,KAAK,mBAAmB,MAAM;EAG9C,eAAe,WAAW,QAAQ,QAAQ,WAAW,QAAQ,YAAY;EACzE,WAAW,YAAY,MAAM,MAAM,MAAM,WAAW;EACpD,aAAa,cAAc,KAAK;CAClC;CACA,IAAI,WAAW,SAAS,gBACtB,UAAU,WAAW,WAAW,MAAM,MAAM,cAAc;CAE5D,MAAM,iBAAiBC,6BAAAA,aAAa,MAAM,IAAI;CAC9C,IAAI,gBACF,UAAU,mBAAmB;CAE/B,OAAO;AACT;;;;;;AAsBA,eAAsB,WACpB,aACA,SAEA,QACA,OAAyB,CAAC,GAC1B,UAAkC,CAAC,GACW;CAC9C,MAAM,aAAa,OAChB,QAAQ,UAAU,CAACC,qCAAAA,eAAe,SAAS,MAAM,IAAI,CAAC,CAAC,CACvD,KAAK,UAAU,aAAa,OAAO,MAAM,QAAQ,cAAc,CAAC;CACnE,IAAI,WAAW,WAAW,GAAG,OAAO,KAAA;CAEpC,MAAM,UAAU,QAAQ,cAAc;CACtC,IAAI;EACF,MAAM,WAAW,OAAA,GAAA,cAAA,MAAA,CAAY,8BAA8B,QAAQ,GAAG,QAAQ,UAAU;GACtF,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAoB,QAAQ;GAAmB;GAC1E,MAAM,KAAK,UAAU;IACnB,MAAM;IACN,iBAAiB,QAAQ;IACzB,cAAc;GAChB,CAAC;EACH,CAAC;EACD,IAAI,SAAS,IAAI,OAAQ,MAAM,SAAS,KAAK;EAC7C,MAAM,EAAE,WAAW;EACnB,MAAM,UAAU,MAAM,SAAS,KAAK;EACpC,QAAQ,MAAM,2CAA2C,OAAO,UAAU,SAAS;EACnF;CACF,SAAS,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACrE,QAAQ,MAAM,kDAAkD,SAAS;EACzE;CACF;AACF"}

package/dist/server/meta-capi.d.cts

@@ -56,11 +56,11 @@ interface MetaConversionsResponse {
   fbtrace_id?: string;
 }
 /**
- * The lightweight counterpart to `sendMetaEvents`: same filtering, same payload, same
- * never-throws contract, minus the 31MB SDK. The token travels in the JSON body, never in the
- * URL, and is never logged.
+ * The lightweight counterpart to the legacy SDK sender (`@shware/analytics/server/legacy`):
+ * same filtering, same payload, same never-throws contract, minus the 31MB SDK. The token
+ * travels in the JSON body, never in the URL, and is never logged.
  */
-declare function sendMetaConversions(accessToken: string, pixelId: string, events: TrackEvent<any>[], data?: UserProvidedData, options?: MetaConversionsOptions): Promise<MetaConversionsResponse | undefined>;
+declare function sendEvents(accessToken: string, pixelId: string, events: TrackEvent<any>[], data?: UserProvidedData, options?: MetaConversionsOptions): Promise<MetaConversionsResponse | undefined>;
 //#endregion
-export { CapiEvent, MetaConversionsOptions, MetaConversionsResponse, getCapiEvent, sendMetaConversions };
+export { CapiEvent, MetaConversionsOptions, MetaConversionsResponse, getCapiEvent, sendEvents };
 //# sourceMappingURL=meta-capi.d.cts.map

package/dist/server/meta-capi.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"meta-capi.d.cts","names":[],"sources":["../../src/server/meta-capi.ts"],"mappings":";;UAqGU;EACR;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;;UAqLe;EACf;EACA;EACA;EACA;EACA;EACA,WAAW;EACX,aAAa;EACb,WAAW;;;;;;;;iBASG,aAEd,OAAO,iBACP,MAAM,kBACN,0BACC;UAyBc;;EAEf;;EAEA;;EAEA;;UAGe;EACf;EACA;EACA;;;;;;;iBAQoB,oBACpB,qBACA,iBAEA,QAAQ,mBACR,OAAM,kBACN,UAAS,yBACR,QAAQ"}
+{"version":3,"file":"meta-capi.d.cts","names":[],"sources":["../../src/server/meta-capi.ts"],"mappings":";;UAsGU;EACR;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;;UAwLe;EACf;EACA;EACA;EACA;EACA;EACA,WAAW;EACX,aAAa;EACb,WAAW;;;;;;;;iBASG,aAEd,OAAO,iBACP,MAAM,kBACN,0BACC;UAyBc;;EAEf;;EAEA;;EAEA;;UAGe;EACf;EACA;EACA;;;;;;;iBAQoB,WACpB,qBACA,iBAEA,QAAQ,mBACR,OAAM,kBACN,UAAS,yBACR,QAAQ"}

package/dist/server/meta-capi.d.mts

@@ -56,11 +56,11 @@ interface MetaConversionsResponse {
   fbtrace_id?: string;
 }
 /**
- * The lightweight counterpart to `sendMetaEvents`: same filtering, same payload, same
- * never-throws contract, minus the 31MB SDK. The token travels in the JSON body, never in the
- * URL, and is never logged.
+ * The lightweight counterpart to the legacy SDK sender (`@shware/analytics/server/legacy`):
+ * same filtering, same payload, same never-throws contract, minus the 31MB SDK. The token
+ * travels in the JSON body, never in the URL, and is never logged.
  */
-declare function sendMetaConversions(accessToken: string, pixelId: string, events: TrackEvent<any>[], data?: UserProvidedData, options?: MetaConversionsOptions): Promise<MetaConversionsResponse | undefined>;
+declare function sendEvents(accessToken: string, pixelId: string, events: TrackEvent<any>[], data?: UserProvidedData, options?: MetaConversionsOptions): Promise<MetaConversionsResponse | undefined>;
 //#endregion
-export { CapiEvent, MetaConversionsOptions, MetaConversionsResponse, getCapiEvent, sendMetaConversions };
+export { CapiEvent, MetaConversionsOptions, MetaConversionsResponse, getCapiEvent, sendEvents };
 //# sourceMappingURL=meta-capi.d.mts.map

package/dist/server/meta-capi.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"meta-capi.d.mts","names":[],"sources":["../../src/server/meta-capi.ts"],"mappings":";;UAqGU;EACR;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;;UAqLe;EACf;EACA;EACA;EACA;EACA;EACA,WAAW;EACX,aAAa;EACb,WAAW;;;;;;;;iBASG,aAEd,OAAO,iBACP,MAAM,kBACN,0BACC;UAyBc;;EAEf;;EAEA;;EAEA;;UAGe;EACf;EACA;EACA;;;;;;;iBAQoB,oBACpB,qBACA,iBAEA,QAAQ,mBACR,OAAM,kBACN,UAAS,yBACR,QAAQ"}
+{"version":3,"file":"meta-capi.d.mts","names":[],"sources":["../../src/server/meta-capi.ts"],"mappings":";;UAsGU;EACR;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;;UAwLe;EACf;EACA;EACA;EACA;EACA;EACA,WAAW;EACX,aAAa;EACb,WAAW;;;;;;;;iBASG,aAEd,OAAO,iBACP,MAAM,kBACN,0BACC;UAyBc;;EAEf;;EAEA;;EAEA;;UAGe;EACf;EACA;EACA;;;;;;;iBAQoB,WACpB,qBACA,iBAEA,QAAQ,mBACR,OAAM,kBACN,UAAS,yBACR,QAAQ"}

package/dist/server/meta-capi.mjs

@@ -9,8 +9,9 @@ import { PII_DATA_TYPE, ParamBuilder } from "capi-param-builder-nodejs";
 //#region src/server/meta-capi.ts
 /**
 * Meta Conversions API sender built on `capi-param-builder-nodejs` and plain `fetch`, replacing
-* the 31MB `facebook-nodejs-business-sdk` with ~0.5MB of parameter building. `sendMetaEvents`
-* stays exported and untouched; this module is the drop-in successor hosts opt into.
+* the 31MB `facebook-nodejs-business-sdk` with ~0.5MB of parameter building. The SDK-based
+* sender survives untouched at `@shware/analytics/server/legacy`; this module is its drop-in
+* successor.
 *
 * The wire payload is byte-identical to what the business SDK's `ServerEvent.normalize()`
 * produces — enforced by a differential test that runs both builders over the same events.
@@ -218,11 +219,11 @@ function getCapiEvent(event, data, appPackageName) {
 	return capiEvent;
 }
 /**
-* The lightweight counterpart to `sendMetaEvents`: same filtering, same payload, same
-* never-throws contract, minus the 31MB SDK. The token travels in the JSON body, never in the
-* URL, and is never logged.
+* The lightweight counterpart to the legacy SDK sender (`@shware/analytics/server/legacy`):
+* same filtering, same payload, same never-throws contract, minus the 31MB SDK. The token
+* travels in the JSON body, never in the URL, and is never logged.
 */
-async function sendMetaConversions(accessToken, pixelId, events, data = {}, options = {}) {
+async function sendEvents(accessToken, pixelId, events, data = {}, options = {}) {
 	const capiEvents = events.filter((event) => !IGNORED_EVENTS.includes(event.name)).map((event) => getCapiEvent(event, data, options.appPackageName));
 	if (capiEvents.length === 0) return void 0;
 	const version = options.apiVersion ?? API_VERSION;
@@ -251,6 +252,6 @@ async function sendMetaConversions(accessToken, pixelId, events, data = {}, opti
 	}
 }
 //#endregion
-export { getCapiEvent, sendMetaConversions };
+export { getCapiEvent, sendEvents };
 
 //# sourceMappingURL=meta-capi.mjs.map

package/dist/server/meta-capi.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"meta-capi.mjs","names":[],"sources":["../../src/server/meta-capi.ts"],"sourcesContent":["/**\n * Meta Conversions API sender built on `capi-param-builder-nodejs` and plain `fetch`, replacing\n * the 31MB `facebook-nodejs-business-sdk` with ~0.5MB of parameter building. `sendMetaEvents`\n * stays exported and untouched; this module is the drop-in successor hosts opt into.\n *\n * The wire payload is byte-identical to what the business SDK's `ServerEvent.normalize()`\n * produces — enforced by a differential test that runs both builders over the same events.\n * Where the two libraries normalize differently (the business SDK keeps punctuation in names,\n * spaces in multi-word last names, accents in cities; the param builder strips them per the\n * current documented rules), this module follows the business SDK so that switching senders\n * cannot change a single hash Meta receives. The param builder is used where the two provably\n * agree — email, phone, gender, country — and its adoption-tracking appendix (`<hash>.<token>`)\n * is stripped for the same reason.\n *\n * Two deliberate behavior differences from the business SDK, both on invalid input only:\n * an invalid field (malformed email, non-ISO country, letters in a phone) is dropped from\n * user_data instead of throwing inside `execute()` and costing the whole batch; an invalid\n * currency is uppercased and forwarded instead of rejected. Valid input is unaffected.\n *\n * https://developers.facebook.com/docs/marketing-api/conversions-api/using-the-api\n * https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/customer-information-parameters\n */\nimport { createHash } from 'node:crypto';\nimport { fetch } from '@shware/utils';\nimport { PII_DATA_TYPE, ParamBuilder } from 'capi-param-builder-nodejs';\nimport { formatFbc } from '../click-id/index';\nimport { IGNORED_EVENTS } from '../third-parties/ignored-events';\nimport { mapFBEvent } from '../track/fbq';\nimport type { TrackEvent, TrackTags, UserProvidedData } from '../track/types';\nimport { resolveActionSource } from './action-source';\nimport { pageLocation } from './page-location';\n\n/** Matches the Graph API version the pinned business SDK speaks (`FacebookAdsApi.VERSION`). */\nconst API_VERSION = 'v24.0';\n\nconst USER_ASSIGNED_COUNTRIES: string[] = ['xk'];\nfunction normalizeCountry(input: string | undefined): string | undefined {\n  const country = input?.split(/[-_]/).at(0)?.toLowerCase();\n  if (!country) return undefined;\n  return USER_ASSIGNED_COUNTRIES.includes(country) ? undefined : country;\n}\n\n/**\n * Lazy for the same reason as the session and the token bucket (see setup/session.ts):\n * Cloudflare Workers refuse some work in module scope, and nothing here is per-request state.\n */\nlet paramBuilder: ParamBuilder | undefined;\n\n/**\n * Normalize and hash one PII value through the param builder, stripped to the bare SHA-256 the\n * business SDK sends: the builder appends a `.<language-token>` adoption marker that Meta's\n * endpoint tolerates but the business SDK never produced. Pre-hashed input passes through, as\n * it does in the business SDK.\n */\nfunction pii(value: string | undefined, dataType: string): string | undefined {\n  if (!value) return undefined;\n  const built = (paramBuilder ??= new ParamBuilder()).getNormalizedAndHashedPII(value, dataType);\n  return built?.split('.').at(0) ?? undefined;\n}\n\nconst SHA256_OR_MD5 = /^[a-f0-9]{64}$|^[a-f0-9]{32}$/;\n\n/**\n * The business SDK's `normalizeAndHash` for the fields where the param builder normalizes\n * differently (names, city, state, zip): trim + lowercase, pass a pre-hashed value through,\n * apply the field rule, SHA-256. Field rules are copied from `ServerSideUtils` verbatim so the\n * differential test can hold the outputs equal.\n */\nfunction hashed(\n  input: string | undefined,\n  rule: (lowered: string) => string | undefined\n): string | undefined {\n  if (!input) return undefined;\n  const lowered = input.trim().toLowerCase();\n  if (!lowered) return undefined;\n  if (SHA256_OR_MD5.test(lowered)) return lowered;\n  const normalized = rule(lowered);\n  if (normalized === undefined) return undefined;\n  return createHash('sha256').update(normalized).digest('hex');\n}\n\nconst nameRule = (v: string) => v;\nconst f5Rule = (v: string) => (v.length <= 5 ? v : v.slice(0, 5));\nconst cityStateRule = (v: string) => v.replace(/[0-9\\s().-]/g, '');\nconst zipRule = (v: string) => {\n  const zip = v.replace(/\\s/g, '').split('-', 1)[0];\n  return zip.length < 2 ? undefined : zip;\n};\n\n/**\n * Every multi-value field is deduplicated after hashing, order preserved — the SDK runs each\n * through `dedupArray` (a Set), `external_id` included.\n */\nconst dedupe = (hashes: (string | undefined)[]) =>\n  Array.from(new Set(hashes.filter((hash): hash is string => hash !== undefined)));\n\nconst list = (hashes: (string | undefined)[]) => {\n  const deduped = dedupe(hashes);\n  return deduped.length > 0 ? deduped : undefined;\n};\n\ninterface CapiUserData {\n  em?: string[];\n  ph?: string[];\n  ge?: string[];\n  fn?: string[];\n  ln?: string[];\n  ct?: string[];\n  st?: string[];\n  zp?: string[];\n  country?: string[];\n  external_id?: string[];\n  client_ip_address?: string;\n  client_user_agent?: string;\n  fbc?: string;\n  fbp?: string;\n  fb_login_id?: string;\n  page_id?: string;\n  f5first?: string;\n  f5last?: string;\n  dobd?: string;\n  dobm?: string;\n  doby?: string;\n  madid?: string;\n}\n\nfunction getUserData(tags: TrackTags, data: UserProvidedData, eventTimeMs: number): CapiUserData {\n  const userData: CapiUserData = {};\n\n  if (data.email) {\n    const emails = Array.isArray(data.email) ? data.email : [data.email];\n    userData.em = list(emails.map((email) => pii(email, PII_DATA_TYPE.EMAIL)));\n  }\n  if (data.phone_number) {\n    const phones = Array.isArray(data.phone_number) ? data.phone_number : [data.phone_number];\n    userData.ph = list(phones.map((phone) => pii(phone, PII_DATA_TYPE.PHONE)));\n  }\n  if (data.gender === 'female' || data.gender === 'male') {\n    userData.ge = list([pii(data.gender === 'female' ? 'f' : 'm', PII_DATA_TYPE.GENDER)]);\n  }\n  if (data.address) {\n    if (Array.isArray(data.address)) {\n      // The SDK sets these lists unconditionally in the multi-address branch, so an all-empty\n      // column still goes out as `[]` — kept for byte-equality with the current sender.\n      userData.fn = dedupe(data.address.map((a) => hashed(a.first_name, nameRule)));\n      userData.ln = dedupe(data.address.map((a) => hashed(a.last_name, nameRule)));\n      userData.ct = dedupe(data.address.map((a) => hashed(a.city, cityStateRule)));\n      userData.st = dedupe(data.address.map((a) => hashed(a.region, cityStateRule)));\n      userData.zp = dedupe(data.address.map((a) => hashed(a.postal_code, zipRule)));\n      userData.country = dedupe(\n        data.address.map((a) => pii(normalizeCountry(a.country), PII_DATA_TYPE.COUNTRY))\n      );\n    } else {\n      userData.fn = list([hashed(data.address.first_name, nameRule)]);\n      userData.ln = list([hashed(data.address.last_name, nameRule)]);\n      userData.ct = list([hashed(data.address.city, cityStateRule)]);\n      userData.st = list([hashed(data.address.region, cityStateRule)]);\n      userData.zp = list([hashed(data.address.postal_code, zipRule)]);\n      userData.country = list([pii(normalizeCountry(data.address.country), PII_DATA_TYPE.COUNTRY)]);\n      // The 5-character prefixes, exactly as the current sender builds them: sliced first, then\n      // normalized. Only the single-address branch sets them, as before.\n      userData.f5first = hashed(data.address.first_name?.slice(0, 5), f5Rule);\n      userData.f5last = hashed(data.address.last_name?.slice(0, 5), f5Rule);\n    }\n  }\n  if (data.birthday) {\n    const { year, month, day } = data.birthday;\n    if (/^\\d{4}$/.test(year.toString())) {\n      userData.doby = createHash('sha256').update(year.toString()).digest('hex');\n    }\n    if (month >= 1 && month <= 12) {\n      userData.dobm = createHash('sha256').update(month.toString().padStart(2, '0')).digest('hex');\n    }\n    if (day >= 1 && day <= 31) {\n      userData.dobd = createHash('sha256').update(day.toString().padStart(2, '0')).digest('hex');\n    }\n  }\n  if (data.user_id && data.user_id.length !== 0) {\n    // Unhashed, as the business SDK sends it. Meta documents hashing as recommended, not\n    // required; changing it here would break continuity with every event sent so far.\n    userData.external_id = [data.user_id];\n  }\n  if (data.ip_address) {\n    userData.client_ip_address = data.ip_address;\n  }\n  if (data.user_agent) {\n    userData.client_user_agent = data.user_agent;\n  }\n  if (data.fb_login_id) {\n    userData.fb_login_id = data.fb_login_id;\n  }\n  if (data.fb_page_id) {\n    userData.page_id = data.fb_page_id;\n  }\n\n  if (tags.fbc) {\n    userData.fbc = tags.fbc;\n  } else if (tags.fbclid) {\n    userData.fbc = formatFbc(tags.fbclid, eventTimeMs);\n  }\n  if (tags.fbp) {\n    userData.fbp = tags.fbp;\n  }\n  if (tags.advertising_id) {\n    userData.madid = tags.advertising_id;\n  }\n  if (tags.ip_address && typeof tags.ip_address === 'string') {\n    userData.client_ip_address = tags.ip_address;\n  }\n\n  return userData;\n}\n\nconst DELIVERY_CATEGORIES = ['in_store', 'curbside', 'home_delivery'];\n\n// oxlint-disable-next-line @typescript-eslint/no-explicit-any\nfunction getCustomData({ name, properties }: TrackEvent<any>): Record<string, unknown> {\n  const [_, _name, fbEventProperties] = mapFBEvent(name, properties);\n  const {\n    value,\n    currency,\n    content_name,\n    content_category,\n    content_ids,\n    contents,\n    content_type,\n    predicted_ltv,\n    num_items,\n    search_string,\n    status,\n    delivery_category,\n    ...custom_properties\n  } = fbEventProperties;\n\n  const customData: Record<string, unknown> = {};\n  // oxlint-disable-next-line typescript/no-unnecessary-condition -- custom event properties may carry `value: null` at runtime despite the declared type\n  if (value !== undefined && value !== null && Number.isFinite(Number.parseFloat(String(value)))) {\n    customData.value = Number.parseFloat(String(value));\n  }\n  if (currency) {\n    // The business SDK also validates against the ISO 4217 list and throws; here an unknown\n    // code is forwarded uppercased rather than costing the batch.\n    customData.currency = currency.trim().toUpperCase().replace(/[^A-Z]/g, '');\n  }\n  if (content_name) customData.content_name = content_name;\n  if (content_category) customData.content_category = content_category;\n  if (content_ids) customData.content_ids = content_ids;\n  if (contents) {\n    customData.contents = contents.map((c) => {\n      const content: Record<string, unknown> = {};\n      if (c.id) content.id = c.id;\n      if (c.quantity) content.quantity = c.quantity;\n      if (c.item_price) content.item_price = c.item_price;\n      if (c.title) content.title = c.title;\n      if (c.description) content.description = c.description;\n      if (c.brand) content.brand = c.brand;\n      if (c.category) content.category = c.category;\n      const delivery = c.delivery_category?.trim().toLowerCase();\n      if (delivery && DELIVERY_CATEGORIES.includes(delivery)) content.delivery_category = delivery;\n      return content;\n    });\n  }\n  if (content_type) customData.content_type = content_type;\n  if (predicted_ltv) customData.predicted_ltv = predicted_ltv;\n  if (num_items) customData.num_items = num_items;\n  if (search_string) customData.search_string = search_string;\n  if (status) customData.status = status.toString();\n  const delivery = delivery_category?.trim().toLowerCase();\n  if (delivery && DELIVERY_CATEGORIES.includes(delivery)) customData.delivery_category = delivery;\n\n  return { ...customData, ...custom_properties };\n}\n\n/**\n * `extinfo` is keyed by field index. The business SDK builds the same object and leaves unset\n * indexes out when it serializes; the documented 16-element array is what the Graph endpoint\n * decodes this into. Indexes: 0 version, 1 package, 2 short version, 3 long version, 4 OS\n * version, 5 device model, 6 locale, 9 screen width, 10 height, 11 density.\n */\nfunction getAppData(tags: TrackTags, appPackageName: string): Record<string, unknown> {\n  const extinfo: Record<number, string | number> = {};\n  if (tags.os_name === 'iOS' || tags.os_name === 'iPadOS') {\n    extinfo[0] = 'i2';\n  } else if (tags.os_name === 'Android') {\n    extinfo[0] = 'a2';\n  }\n  extinfo[1] = appPackageName;\n  const shortVersion = tags.release?.split('.').at(0);\n  if (shortVersion) extinfo[2] = shortVersion;\n  if (tags.release) extinfo[3] = tags.release;\n  if (tags.os_version) extinfo[4] = tags.os_version;\n  if (tags.device_model_id) extinfo[5] = tags.device_model_id;\n  if (tags.language) extinfo[6] = tags.language;\n  if (tags.screen_width) extinfo[9] = tags.screen_width;\n  if (tags.screen_height) extinfo[10] = tags.screen_height;\n  if (tags.device_pixel_ratio) extinfo[11] = tags.device_pixel_ratio.toString();\n\n  const appData: Record<string, unknown> = { extinfo };\n  if (tags.advertising_id) appData.advertiser_tracking_enabled = true;\n  if (tags.install_referrer) appData.install_referrer = tags.install_referrer;\n  return appData;\n}\n\n/** One entry of the `data` array POSTed to `/{pixel_id}/events`. */\nexport interface CapiEvent {\n  event_name: string;\n  event_time: number;\n  event_id: string;\n  event_source_url?: string;\n  action_source: 'app' | 'website' | 'other';\n  user_data: CapiUserData;\n  custom_data: Record<string, unknown>;\n  app_data?: Record<string, unknown>;\n}\n\n/**\n * `action_source` is derived from `event.platform` alone: an OS platform is an app, `web` is a\n * website, and everything else — including a backend-built offline conversion, which should\n * declare `platform: 'unknown'` — lands in Meta's `other`, exactly where the business-SDK\n * sender put an explicit `'offline'` too.\n */\nexport function getCapiEvent(\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  event: TrackEvent<any>,\n  data: UserProvidedData,\n  appPackageName?: string\n): CapiEvent {\n  const eventTimeMs = new Date(event.created_at).getTime();\n  const [_, eventName] = mapFBEvent(event.name, event.properties);\n  const source = resolveActionSource(event.platform);\n\n  const capiEvent: CapiEvent = {\n    event_name: eventName,\n    event_time: Math.round(eventTimeMs / 1000),\n    event_id: event.tags.idempotency_key ?? event.id,\n    // `action_source` is required; an offline conversion and an undeterminable platform both\n    // land in Meta's catch-all, exactly as in the business-SDK sender.\n    action_source: source === 'app' ? 'app' : source === 'web' ? 'website' : 'other',\n    user_data: getUserData(event.tags, data, eventTimeMs),\n    custom_data: getCustomData(event),\n  };\n  if (source === 'app' && appPackageName) {\n    capiEvent.app_data = getAppData(event.tags, appPackageName);\n  }\n  const eventSourceUrl = pageLocation(event.tags);\n  if (eventSourceUrl) {\n    capiEvent.event_source_url = eventSourceUrl;\n  }\n  return capiEvent;\n}\n\nexport interface MetaConversionsOptions {\n  /** Attaches `app_data`/extinfo to events whose platform resolves to an app. */\n  appPackageName?: string;\n  /** Routes the batch to Events Manager's Test Events tab instead of production. */\n  testEventCode?: string;\n  /** Graph API version, e.g. 'v24.0'. */\n  apiVersion?: string;\n}\n\nexport interface MetaConversionsResponse {\n  events_received?: number;\n  messages?: string[];\n  fbtrace_id?: string;\n}\n\n/**\n * The lightweight counterpart to `sendMetaEvents`: same filtering, same payload, same\n * never-throws contract, minus the 31MB SDK. The token travels in the JSON body, never in the\n * URL, and is never logged.\n */\nexport async function sendMetaConversions(\n  accessToken: string,\n  pixelId: string,\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  events: TrackEvent<any>[],\n  data: UserProvidedData = {},\n  options: MetaConversionsOptions = {}\n): Promise<MetaConversionsResponse | undefined> {\n  const capiEvents = events\n    .filter((event) => !IGNORED_EVENTS.includes(event.name))\n    .map((event) => getCapiEvent(event, data, options.appPackageName));\n  if (capiEvents.length === 0) return undefined;\n\n  const version = options.apiVersion ?? API_VERSION;\n  try {\n    const response = await fetch(`https://graph.facebook.com/${version}/${pixelId}/events`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json', Accept: 'application/json' },\n      body: JSON.stringify({\n        data: capiEvents,\n        test_event_code: options.testEventCode,\n        access_token: accessToken,\n      }),\n    });\n    if (response.ok) return (await response.json()) as MetaConversionsResponse;\n    const { status } = response;\n    const message = await response.text();\n    console.error(`Failed to send Meta conversion, status: ${status}, body: ${message}`);\n    return undefined;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    console.error(`Failed to send Meta conversion, network error: ${message}`);\n    return undefined;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,MAAM,cAAc;AAEpB,MAAM,0BAAoC,CAAC,IAAI;AAC/C,SAAS,iBAAiB,OAA+C;CACvE,MAAM,UAAU,OAAO,MAAM,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY;CACxD,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,OAAO,wBAAwB,SAAS,OAAO,IAAI,KAAA,IAAY;AACjE;;;;;AAMA,IAAI;;;;;;;AAQJ,SAAS,IAAI,OAA2B,UAAsC;CAC5E,IAAI,CAAC,OAAO,OAAO,KAAA;CAEnB,QADe,iBAAiB,IAAI,aAAa,EAAA,CAAG,0BAA0B,OAAO,QAC1E,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,KAAA;AACpC;AAEA,MAAM,gBAAgB;;;;;;;AAQtB,SAAS,OACP,OACA,MACoB;CACpB,IAAI,CAAC,OAAO,OAAO,KAAA;CACnB,MAAM,UAAU,MAAM,KAAK,CAAC,CAAC,YAAY;CACzC,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,IAAI,cAAc,KAAK,OAAO,GAAG,OAAO;CACxC,MAAM,aAAa,KAAK,OAAO;CAC/B,IAAI,eAAe,KAAA,GAAW,OAAO,KAAA;CACrC,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,OAAO,KAAK;AAC7D;AAEA,MAAM,YAAY,MAAc;AAChC,MAAM,UAAU,MAAe,EAAE,UAAU,IAAI,IAAI,EAAE,MAAM,GAAG,CAAC;AAC/D,MAAM,iBAAiB,MAAc,EAAE,QAAQ,gBAAgB,EAAE;AACjE,MAAM,WAAW,MAAc;CAC7B,MAAM,MAAM,EAAE,QAAQ,OAAO,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;CAC/C,OAAO,IAAI,SAAS,IAAI,KAAA,IAAY;AACtC;;;;;AAMA,MAAM,UAAU,WACd,MAAM,KAAK,IAAI,IAAI,OAAO,QAAQ,SAAyB,SAAS,KAAA,CAAS,CAAC,CAAC;AAEjF,MAAM,QAAQ,WAAmC;CAC/C,MAAM,UAAU,OAAO,MAAM;CAC7B,OAAO,QAAQ,SAAS,IAAI,UAAU,KAAA;AACxC;AA2BA,SAAS,YAAY,MAAiB,MAAwB,aAAmC;CAC/F,MAAM,WAAyB,CAAC;CAEhC,IAAI,KAAK,OAAO;EACd,MAAM,SAAS,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC,KAAK,KAAK;EACnE,SAAS,KAAK,KAAK,OAAO,KAAK,UAAU,IAAI,OAAO,cAAc,KAAK,CAAC,CAAC;CAC3E;CACA,IAAI,KAAK,cAAc;EACrB,MAAM,SAAS,MAAM,QAAQ,KAAK,YAAY,IAAI,KAAK,eAAe,CAAC,KAAK,YAAY;EACxF,SAAS,KAAK,KAAK,OAAO,KAAK,UAAU,IAAI,OAAO,cAAc,KAAK,CAAC,CAAC;CAC3E;CACA,IAAI,KAAK,WAAW,YAAY,KAAK,WAAW,QAC9C,SAAS,KAAK,KAAK,CAAC,IAAI,KAAK,WAAW,WAAW,MAAM,KAAK,cAAc,MAAM,CAAC,CAAC;CAEtF,IAAI,KAAK,SACP,IAAI,MAAM,QAAQ,KAAK,OAAO,GAAG;EAG/B,SAAS,KAAK,OAAO,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,YAAY,QAAQ,CAAC,CAAC;EAC5E,SAAS,KAAK,OAAO,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,WAAW,QAAQ,CAAC,CAAC;EAC3E,SAAS,KAAK,OAAO,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,MAAM,aAAa,CAAC,CAAC;EAC3E,SAAS,KAAK,OAAO,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,QAAQ,aAAa,CAAC,CAAC;EAC7E,SAAS,KAAK,OAAO,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,aAAa,OAAO,CAAC,CAAC;EAC5E,SAAS,UAAU,OACjB,KAAK,QAAQ,KAAK,MAAM,IAAI,iBAAiB,EAAE,OAAO,GAAG,cAAc,OAAO,CAAC,CACjF;CACF,OAAO;EACL,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,QAAQ,YAAY,QAAQ,CAAC,CAAC;EAC9D,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,QAAQ,WAAW,QAAQ,CAAC,CAAC;EAC7D,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,QAAQ,MAAM,aAAa,CAAC,CAAC;EAC7D,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,QAAQ,QAAQ,aAAa,CAAC,CAAC;EAC/D,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,QAAQ,aAAa,OAAO,CAAC,CAAC;EAC9D,SAAS,UAAU,KAAK,CAAC,IAAI,iBAAiB,KAAK,QAAQ,OAAO,GAAG,cAAc,OAAO,CAAC,CAAC;EAG5F,SAAS,UAAU,OAAO,KAAK,QAAQ,YAAY,MAAM,GAAG,CAAC,GAAG,MAAM;EACtE,SAAS,SAAS,OAAO,KAAK,QAAQ,WAAW,MAAM,GAAG,CAAC,GAAG,MAAM;CACtE;CAEF,IAAI,KAAK,UAAU;EACjB,MAAM,EAAE,MAAM,OAAO,QAAQ,KAAK;EAClC,IAAI,UAAU,KAAK,KAAK,SAAS,CAAC,GAChC,SAAS,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,KAAK;EAE3E,IAAI,SAAS,KAAK,SAAS,IACzB,SAAS,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,MAAM,SAAS,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK;EAE7F,IAAI,OAAO,KAAK,OAAO,IACrB,SAAS,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK;CAE7F;CACA,IAAI,KAAK,WAAW,KAAK,QAAQ,WAAW,GAG1C,SAAS,cAAc,CAAC,KAAK,OAAO;CAEtC,IAAI,KAAK,YACP,SAAS,oBAAoB,KAAK;CAEpC,IAAI,KAAK,YACP,SAAS,oBAAoB,KAAK;CAEpC,IAAI,KAAK,aACP,SAAS,cAAc,KAAK;CAE9B,IAAI,KAAK,YACP,SAAS,UAAU,KAAK;CAG1B,IAAI,KAAK,KACP,SAAS,MAAM,KAAK;MACf,IAAI,KAAK,QACd,SAAS,MAAM,UAAU,KAAK,QAAQ,WAAW;CAEnD,IAAI,KAAK,KACP,SAAS,MAAM,KAAK;CAEtB,IAAI,KAAK,gBACP,SAAS,QAAQ,KAAK;CAExB,IAAI,KAAK,cAAc,OAAO,KAAK,eAAe,UAChD,SAAS,oBAAoB,KAAK;CAGpC,OAAO;AACT;AAEA,MAAM,sBAAsB;CAAC;CAAY;CAAY;AAAe;AAGpE,SAAS,cAAc,EAAE,MAAM,cAAwD;CACrF,MAAM,CAAC,GAAG,OAAO,qBAAqB,WAAW,MAAM,UAAU;CACjE,MAAM,EACJ,OACA,UACA,cACA,kBACA,aACA,UACA,cACA,eACA,WACA,eACA,QACA,mBACA,GAAG,sBACD;CAEJ,MAAM,aAAsC,CAAC;CAE7C,IAAI,UAAU,KAAA,KAAa,UAAU,QAAQ,OAAO,SAAS,OAAO,WAAW,OAAO,KAAK,CAAC,CAAC,GAC3F,WAAW,QAAQ,OAAO,WAAW,OAAO,KAAK,CAAC;CAEpD,IAAI,UAGF,WAAW,WAAW,SAAS,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,WAAW,EAAE;CAE3E,IAAI,cAAc,WAAW,eAAe;CAC5C,IAAI,kBAAkB,WAAW,mBAAmB;CACpD,IAAI,aAAa,WAAW,cAAc;CAC1C,IAAI,UACF,WAAW,WAAW,SAAS,KAAK,MAAM;EACxC,MAAM,UAAmC,CAAC;EAC1C,IAAI,EAAE,IAAI,QAAQ,KAAK,EAAE;EACzB,IAAI,EAAE,UAAU,QAAQ,WAAW,EAAE;EACrC,IAAI,EAAE,YAAY,QAAQ,aAAa,EAAE;EACzC,IAAI,EAAE,OAAO,QAAQ,QAAQ,EAAE;EAC/B,IAAI,EAAE,aAAa,QAAQ,cAAc,EAAE;EAC3C,IAAI,EAAE,OAAO,QAAQ,QAAQ,EAAE;EAC/B,IAAI,EAAE,UAAU,QAAQ,WAAW,EAAE;EACrC,MAAM,WAAW,EAAE,mBAAmB,KAAK,CAAC,CAAC,YAAY;EACzD,IAAI,YAAY,oBAAoB,SAAS,QAAQ,GAAG,QAAQ,oBAAoB;EACpF,OAAO;CACT,CAAC;CAEH,IAAI,cAAc,WAAW,eAAe;CAC5C,IAAI,eAAe,WAAW,gBAAgB;CAC9C,IAAI,WAAW,WAAW,YAAY;CACtC,IAAI,eAAe,WAAW,gBAAgB;CAC9C,IAAI,QAAQ,WAAW,SAAS,OAAO,SAAS;CAChD,MAAM,WAAW,mBAAmB,KAAK,CAAC,CAAC,YAAY;CACvD,IAAI,YAAY,oBAAoB,SAAS,QAAQ,GAAG,WAAW,oBAAoB;CAEvF,OAAO;EAAE,GAAG;EAAY,GAAG;CAAkB;AAC/C;;;;;;;AAQA,SAAS,WAAW,MAAiB,gBAAiD;CACpF,MAAM,UAA2C,CAAC;CAClD,IAAI,KAAK,YAAY,SAAS,KAAK,YAAY,UAC7C,QAAQ,KAAK;MACR,IAAI,KAAK,YAAY,WAC1B,QAAQ,KAAK;CAEf,QAAQ,KAAK;CACb,MAAM,eAAe,KAAK,SAAS,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC;CAClD,IAAI,cAAc,QAAQ,KAAK;CAC/B,IAAI,KAAK,SAAS,QAAQ,KAAK,KAAK;CACpC,IAAI,KAAK,YAAY,QAAQ,KAAK,KAAK;CACvC,IAAI,KAAK,iBAAiB,QAAQ,KAAK,KAAK;CAC5C,IAAI,KAAK,UAAU,QAAQ,KAAK,KAAK;CACrC,IAAI,KAAK,cAAc,QAAQ,KAAK,KAAK;CACzC,IAAI,KAAK,eAAe,QAAQ,MAAM,KAAK;CAC3C,IAAI,KAAK,oBAAoB,QAAQ,MAAM,KAAK,mBAAmB,SAAS;CAE5E,MAAM,UAAmC,EAAE,QAAQ;CACnD,IAAI,KAAK,gBAAgB,QAAQ,8BAA8B;CAC/D,IAAI,KAAK,kBAAkB,QAAQ,mBAAmB,KAAK;CAC3D,OAAO;AACT;;;;;;;AAoBA,SAAgB,aAEd,OACA,MACA,gBACW;CACX,MAAM,cAAc,IAAI,KAAK,MAAM,UAAU,CAAC,CAAC,QAAQ;CACvD,MAAM,CAAC,GAAG,aAAa,WAAW,MAAM,MAAM,MAAM,UAAU;CAC9D,MAAM,SAAS,oBAAoB,MAAM,QAAQ;CAEjD,MAAM,YAAuB;EAC3B,YAAY;EACZ,YAAY,KAAK,MAAM,cAAc,GAAI;EACzC,UAAU,MAAM,KAAK,mBAAmB,MAAM;EAG9C,eAAe,WAAW,QAAQ,QAAQ,WAAW,QAAQ,YAAY;EACzE,WAAW,YAAY,MAAM,MAAM,MAAM,WAAW;EACpD,aAAa,cAAc,KAAK;CAClC;CACA,IAAI,WAAW,SAAS,gBACtB,UAAU,WAAW,WAAW,MAAM,MAAM,cAAc;CAE5D,MAAM,iBAAiB,aAAa,MAAM,IAAI;CAC9C,IAAI,gBACF,UAAU,mBAAmB;CAE/B,OAAO;AACT;;;;;;AAsBA,eAAsB,oBACpB,aACA,SAEA,QACA,OAAyB,CAAC,GAC1B,UAAkC,CAAC,GACW;CAC9C,MAAM,aAAa,OAChB,QAAQ,UAAU,CAAC,eAAe,SAAS,MAAM,IAAI,CAAC,CAAC,CACvD,KAAK,UAAU,aAAa,OAAO,MAAM,QAAQ,cAAc,CAAC;CACnE,IAAI,WAAW,WAAW,GAAG,OAAO,KAAA;CAEpC,MAAM,UAAU,QAAQ,cAAc;CACtC,IAAI;EACF,MAAM,WAAW,MAAM,MAAM,8BAA8B,QAAQ,GAAG,QAAQ,UAAU;GACtF,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAoB,QAAQ;GAAmB;GAC1E,MAAM,KAAK,UAAU;IACnB,MAAM;IACN,iBAAiB,QAAQ;IACzB,cAAc;GAChB,CAAC;EACH,CAAC;EACD,IAAI,SAAS,IAAI,OAAQ,MAAM,SAAS,KAAK;EAC7C,MAAM,EAAE,WAAW;EACnB,MAAM,UAAU,MAAM,SAAS,KAAK;EACpC,QAAQ,MAAM,2CAA2C,OAAO,UAAU,SAAS;EACnF;CACF,SAAS,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACrE,QAAQ,MAAM,kDAAkD,SAAS;EACzE;CACF;AACF"}
+{"version":3,"file":"meta-capi.mjs","names":[],"sources":["../../src/server/meta-capi.ts"],"sourcesContent":["/**\n * Meta Conversions API sender built on `capi-param-builder-nodejs` and plain `fetch`, replacing\n * the 31MB `facebook-nodejs-business-sdk` with ~0.5MB of parameter building. The SDK-based\n * sender survives untouched at `@shware/analytics/server/legacy`; this module is its drop-in\n * successor.\n *\n * The wire payload is byte-identical to what the business SDK's `ServerEvent.normalize()`\n * produces — enforced by a differential test that runs both builders over the same events.\n * Where the two libraries normalize differently (the business SDK keeps punctuation in names,\n * spaces in multi-word last names, accents in cities; the param builder strips them per the\n * current documented rules), this module follows the business SDK so that switching senders\n * cannot change a single hash Meta receives. The param builder is used where the two provably\n * agree — email, phone, gender, country — and its adoption-tracking appendix (`<hash>.<token>`)\n * is stripped for the same reason.\n *\n * Two deliberate behavior differences from the business SDK, both on invalid input only:\n * an invalid field (malformed email, non-ISO country, letters in a phone) is dropped from\n * user_data instead of throwing inside `execute()` and costing the whole batch; an invalid\n * currency is uppercased and forwarded instead of rejected. Valid input is unaffected.\n *\n * https://developers.facebook.com/docs/marketing-api/conversions-api/using-the-api\n * https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/customer-information-parameters\n */\nimport { createHash } from 'node:crypto';\nimport { fetch } from '@shware/utils';\nimport { PII_DATA_TYPE, ParamBuilder } from 'capi-param-builder-nodejs';\nimport { formatFbc } from '../click-id/index';\nimport { IGNORED_EVENTS } from '../third-parties/ignored-events';\nimport { mapFBEvent } from '../track/fbq';\nimport type { TrackEvent, TrackTags, UserProvidedData } from '../track/types';\nimport { resolveActionSource } from './action-source';\nimport { pageLocation } from './page-location';\n\n/** Matches the Graph API version the pinned business SDK speaks (`FacebookAdsApi.VERSION`). */\nconst API_VERSION = 'v24.0';\n\nconst USER_ASSIGNED_COUNTRIES: string[] = ['xk'];\nfunction normalizeCountry(input: string | undefined): string | undefined {\n  const country = input?.split(/[-_]/).at(0)?.toLowerCase();\n  if (!country) return undefined;\n  return USER_ASSIGNED_COUNTRIES.includes(country) ? undefined : country;\n}\n\n/**\n * Lazy for the same reason as the session and the token bucket (see setup/session.ts):\n * Cloudflare Workers refuse some work in module scope, and nothing here is per-request state.\n */\nlet paramBuilder: ParamBuilder | undefined;\n\n/**\n * Normalize and hash one PII value through the param builder, stripped to the bare SHA-256 the\n * business SDK sends: the builder appends a `.<language-token>` adoption marker that Meta's\n * endpoint tolerates but the business SDK never produced. Pre-hashed input passes through, as\n * it does in the business SDK.\n */\nfunction pii(value: string | undefined, dataType: string): string | undefined {\n  if (!value) return undefined;\n  const built = (paramBuilder ??= new ParamBuilder()).getNormalizedAndHashedPII(value, dataType);\n  return built?.split('.').at(0) ?? undefined;\n}\n\nconst SHA256_OR_MD5 = /^[a-f0-9]{64}$|^[a-f0-9]{32}$/;\n\n/**\n * The business SDK's `normalizeAndHash` for the fields where the param builder normalizes\n * differently (names, city, state, zip): trim + lowercase, pass a pre-hashed value through,\n * apply the field rule, SHA-256. Field rules are copied from `ServerSideUtils` verbatim so the\n * differential test can hold the outputs equal.\n */\nfunction hashed(\n  input: string | undefined,\n  rule: (lowered: string) => string | undefined\n): string | undefined {\n  if (!input) return undefined;\n  const lowered = input.trim().toLowerCase();\n  if (!lowered) return undefined;\n  if (SHA256_OR_MD5.test(lowered)) return lowered;\n  const normalized = rule(lowered);\n  if (normalized === undefined) return undefined;\n  return createHash('sha256').update(normalized).digest('hex');\n}\n\nconst nameRule = (v: string) => v;\nconst f5Rule = (v: string) => (v.length <= 5 ? v : v.slice(0, 5));\nconst cityStateRule = (v: string) => v.replace(/[0-9\\s().-]/g, '');\nconst zipRule = (v: string) => {\n  const zip = v.replace(/\\s/g, '').split('-', 1)[0];\n  return zip.length < 2 ? undefined : zip;\n};\n\n/**\n * Every multi-value field is deduplicated after hashing, order preserved — the SDK runs each\n * through `dedupArray` (a Set), `external_id` included.\n */\nconst dedupe = (hashes: (string | undefined)[]) =>\n  Array.from(new Set(hashes.filter((hash): hash is string => hash !== undefined)));\n\nconst list = (hashes: (string | undefined)[]) => {\n  const deduped = dedupe(hashes);\n  return deduped.length > 0 ? deduped : undefined;\n};\n\ninterface CapiUserData {\n  em?: string[];\n  ph?: string[];\n  ge?: string[];\n  fn?: string[];\n  ln?: string[];\n  ct?: string[];\n  st?: string[];\n  zp?: string[];\n  country?: string[];\n  external_id?: string[];\n  client_ip_address?: string;\n  client_user_agent?: string;\n  fbc?: string;\n  fbp?: string;\n  fb_login_id?: string;\n  page_id?: string;\n  f5first?: string;\n  f5last?: string;\n  dobd?: string;\n  dobm?: string;\n  doby?: string;\n  madid?: string;\n}\n\nfunction getUserData(tags: TrackTags, data: UserProvidedData, eventTimeMs: number): CapiUserData {\n  const userData: CapiUserData = {};\n\n  if (data.email) {\n    const emails = Array.isArray(data.email) ? data.email : [data.email];\n    userData.em = list(emails.map((email) => pii(email, PII_DATA_TYPE.EMAIL)));\n  }\n  if (data.phone_number) {\n    const phones = Array.isArray(data.phone_number) ? data.phone_number : [data.phone_number];\n    userData.ph = list(phones.map((phone) => pii(phone, PII_DATA_TYPE.PHONE)));\n  }\n  if (data.gender === 'female' || data.gender === 'male') {\n    userData.ge = list([pii(data.gender === 'female' ? 'f' : 'm', PII_DATA_TYPE.GENDER)]);\n  }\n  if (data.address) {\n    if (Array.isArray(data.address)) {\n      // The SDK sets these lists unconditionally in the multi-address branch, so an all-empty\n      // column still goes out as `[]` — kept for byte-equality with the current sender.\n      userData.fn = dedupe(data.address.map((a) => hashed(a.first_name, nameRule)));\n      userData.ln = dedupe(data.address.map((a) => hashed(a.last_name, nameRule)));\n      userData.ct = dedupe(data.address.map((a) => hashed(a.city, cityStateRule)));\n      userData.st = dedupe(data.address.map((a) => hashed(a.region, cityStateRule)));\n      userData.zp = dedupe(data.address.map((a) => hashed(a.postal_code, zipRule)));\n      userData.country = dedupe(\n        data.address.map((a) => pii(normalizeCountry(a.country), PII_DATA_TYPE.COUNTRY))\n      );\n    } else {\n      userData.fn = list([hashed(data.address.first_name, nameRule)]);\n      userData.ln = list([hashed(data.address.last_name, nameRule)]);\n      userData.ct = list([hashed(data.address.city, cityStateRule)]);\n      userData.st = list([hashed(data.address.region, cityStateRule)]);\n      userData.zp = list([hashed(data.address.postal_code, zipRule)]);\n      userData.country = list([pii(normalizeCountry(data.address.country), PII_DATA_TYPE.COUNTRY)]);\n      // The 5-character prefixes, exactly as the current sender builds them: sliced first, then\n      // normalized. Only the single-address branch sets them, as before.\n      userData.f5first = hashed(data.address.first_name?.slice(0, 5), f5Rule);\n      userData.f5last = hashed(data.address.last_name?.slice(0, 5), f5Rule);\n    }\n  }\n  if (data.birthday) {\n    const { year, month, day } = data.birthday;\n    if (/^\\d{4}$/.test(year.toString())) {\n      userData.doby = createHash('sha256').update(year.toString()).digest('hex');\n    }\n    if (month >= 1 && month <= 12) {\n      userData.dobm = createHash('sha256').update(month.toString().padStart(2, '0')).digest('hex');\n    }\n    if (day >= 1 && day <= 31) {\n      userData.dobd = createHash('sha256').update(day.toString().padStart(2, '0')).digest('hex');\n    }\n  }\n  if (data.user_id && data.user_id.length !== 0) {\n    // Unhashed, as the business SDK sends it. Meta documents hashing as recommended, not\n    // required; changing it here would break continuity with every event sent so far.\n    userData.external_id = [data.user_id];\n  }\n  if (data.ip_address) {\n    userData.client_ip_address = data.ip_address;\n  }\n  if (data.user_agent) {\n    userData.client_user_agent = data.user_agent;\n  }\n  if (data.fb_login_id) {\n    userData.fb_login_id = data.fb_login_id;\n  }\n  if (data.fb_page_id) {\n    userData.page_id = data.fb_page_id;\n  }\n\n  if (tags.fbc) {\n    userData.fbc = tags.fbc;\n  } else if (tags.fbclid) {\n    userData.fbc = formatFbc(tags.fbclid, eventTimeMs);\n  }\n  if (tags.fbp) {\n    userData.fbp = tags.fbp;\n  }\n  if (tags.advertising_id) {\n    userData.madid = tags.advertising_id;\n  }\n  if (tags.ip_address && typeof tags.ip_address === 'string') {\n    userData.client_ip_address = tags.ip_address;\n  }\n\n  return userData;\n}\n\nconst DELIVERY_CATEGORIES = ['in_store', 'curbside', 'home_delivery'];\n\n// oxlint-disable-next-line @typescript-eslint/no-explicit-any\nfunction getCustomData({ name, properties }: TrackEvent<any>): Record<string, unknown> {\n  const [_, _name, fbEventProperties] = mapFBEvent(name, properties);\n  const {\n    value,\n    currency,\n    content_name,\n    content_category,\n    content_ids,\n    contents,\n    content_type,\n    predicted_ltv,\n    num_items,\n    search_string,\n    status,\n    delivery_category,\n    ...custom_properties\n  } = fbEventProperties;\n\n  const customData: Record<string, unknown> = {};\n  // oxlint-disable-next-line typescript/no-unnecessary-condition -- custom event properties may carry `value: null` at runtime despite the declared type\n  if (value !== undefined && value !== null && Number.isFinite(Number.parseFloat(String(value)))) {\n    customData.value = Number.parseFloat(String(value));\n  }\n  if (currency) {\n    // The business SDK also validates against the ISO 4217 list and throws; here an unknown\n    // code is forwarded uppercased rather than costing the batch.\n    customData.currency = currency\n      .trim()\n      .toUpperCase()\n      .replace(/[^A-Z]/g, '');\n  }\n  if (content_name) customData.content_name = content_name;\n  if (content_category) customData.content_category = content_category;\n  if (content_ids) customData.content_ids = content_ids;\n  if (contents) {\n    customData.contents = contents.map((c) => {\n      const content: Record<string, unknown> = {};\n      if (c.id) content.id = c.id;\n      if (c.quantity) content.quantity = c.quantity;\n      if (c.item_price) content.item_price = c.item_price;\n      if (c.title) content.title = c.title;\n      if (c.description) content.description = c.description;\n      if (c.brand) content.brand = c.brand;\n      if (c.category) content.category = c.category;\n      const delivery = c.delivery_category?.trim().toLowerCase();\n      if (delivery && DELIVERY_CATEGORIES.includes(delivery)) content.delivery_category = delivery;\n      return content;\n    });\n  }\n  if (content_type) customData.content_type = content_type;\n  if (predicted_ltv) customData.predicted_ltv = predicted_ltv;\n  if (num_items) customData.num_items = num_items;\n  if (search_string) customData.search_string = search_string;\n  if (status) customData.status = status.toString();\n  const delivery = delivery_category?.trim().toLowerCase();\n  if (delivery && DELIVERY_CATEGORIES.includes(delivery)) customData.delivery_category = delivery;\n\n  return { ...customData, ...custom_properties };\n}\n\n/**\n * `extinfo` is keyed by field index. The business SDK builds the same object and leaves unset\n * indexes out when it serializes; the documented 16-element array is what the Graph endpoint\n * decodes this into. Indexes: 0 version, 1 package, 2 short version, 3 long version, 4 OS\n * version, 5 device model, 6 locale, 9 screen width, 10 height, 11 density.\n */\nfunction getAppData(tags: TrackTags, appPackageName: string): Record<string, unknown> {\n  const extinfo: Record<number, string | number> = {};\n  if (tags.os_name === 'iOS' || tags.os_name === 'iPadOS') {\n    extinfo[0] = 'i2';\n  } else if (tags.os_name === 'Android') {\n    extinfo[0] = 'a2';\n  }\n  extinfo[1] = appPackageName;\n  const shortVersion = tags.release?.split('.').at(0);\n  if (shortVersion) extinfo[2] = shortVersion;\n  if (tags.release) extinfo[3] = tags.release;\n  if (tags.os_version) extinfo[4] = tags.os_version;\n  if (tags.device_model_id) extinfo[5] = tags.device_model_id;\n  if (tags.language) extinfo[6] = tags.language;\n  if (tags.screen_width) extinfo[9] = tags.screen_width;\n  if (tags.screen_height) extinfo[10] = tags.screen_height;\n  if (tags.device_pixel_ratio) extinfo[11] = tags.device_pixel_ratio.toString();\n\n  const appData: Record<string, unknown> = { extinfo };\n  if (tags.advertising_id) appData.advertiser_tracking_enabled = true;\n  if (tags.install_referrer) appData.install_referrer = tags.install_referrer;\n  return appData;\n}\n\n/** One entry of the `data` array POSTed to `/{pixel_id}/events`. */\nexport interface CapiEvent {\n  event_name: string;\n  event_time: number;\n  event_id: string;\n  event_source_url?: string;\n  action_source: 'app' | 'website' | 'other';\n  user_data: CapiUserData;\n  custom_data: Record<string, unknown>;\n  app_data?: Record<string, unknown>;\n}\n\n/**\n * `action_source` is derived from `event.platform` alone: an OS platform is an app, `web` is a\n * website, and everything else — including a backend-built offline conversion, which should\n * declare `platform: 'unknown'` — lands in Meta's `other`, exactly where the business-SDK\n * sender put an explicit `'offline'` too.\n */\nexport function getCapiEvent(\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  event: TrackEvent<any>,\n  data: UserProvidedData,\n  appPackageName?: string\n): CapiEvent {\n  const eventTimeMs = new Date(event.created_at).getTime();\n  const [_, eventName] = mapFBEvent(event.name, event.properties);\n  const source = resolveActionSource(event.platform);\n\n  const capiEvent: CapiEvent = {\n    event_name: eventName,\n    event_time: Math.round(eventTimeMs / 1000),\n    event_id: event.tags.idempotency_key ?? event.id,\n    // `action_source` is required; an offline conversion and an undeterminable platform both\n    // land in Meta's catch-all, exactly as in the business-SDK sender.\n    action_source: source === 'app' ? 'app' : source === 'web' ? 'website' : 'other',\n    user_data: getUserData(event.tags, data, eventTimeMs),\n    custom_data: getCustomData(event),\n  };\n  if (source === 'app' && appPackageName) {\n    capiEvent.app_data = getAppData(event.tags, appPackageName);\n  }\n  const eventSourceUrl = pageLocation(event.tags);\n  if (eventSourceUrl) {\n    capiEvent.event_source_url = eventSourceUrl;\n  }\n  return capiEvent;\n}\n\nexport interface MetaConversionsOptions {\n  /** Attaches `app_data`/extinfo to events whose platform resolves to an app. */\n  appPackageName?: string;\n  /** Routes the batch to Events Manager's Test Events tab instead of production. */\n  testEventCode?: string;\n  /** Graph API version, e.g. 'v24.0'. */\n  apiVersion?: string;\n}\n\nexport interface MetaConversionsResponse {\n  events_received?: number;\n  messages?: string[];\n  fbtrace_id?: string;\n}\n\n/**\n * The lightweight counterpart to the legacy SDK sender (`@shware/analytics/server/legacy`):\n * same filtering, same payload, same never-throws contract, minus the 31MB SDK. The token\n * travels in the JSON body, never in the URL, and is never logged.\n */\nexport async function sendEvents(\n  accessToken: string,\n  pixelId: string,\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  events: TrackEvent<any>[],\n  data: UserProvidedData = {},\n  options: MetaConversionsOptions = {}\n): Promise<MetaConversionsResponse | undefined> {\n  const capiEvents = events\n    .filter((event) => !IGNORED_EVENTS.includes(event.name))\n    .map((event) => getCapiEvent(event, data, options.appPackageName));\n  if (capiEvents.length === 0) return undefined;\n\n  const version = options.apiVersion ?? API_VERSION;\n  try {\n    const response = await fetch(`https://graph.facebook.com/${version}/${pixelId}/events`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json', Accept: 'application/json' },\n      body: JSON.stringify({\n        data: capiEvents,\n        test_event_code: options.testEventCode,\n        access_token: accessToken,\n      }),\n    });\n    if (response.ok) return (await response.json()) as MetaConversionsResponse;\n    const { status } = response;\n    const message = await response.text();\n    console.error(`Failed to send Meta conversion, status: ${status}, body: ${message}`);\n    return undefined;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    console.error(`Failed to send Meta conversion, network error: ${message}`);\n    return undefined;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,MAAM,cAAc;AAEpB,MAAM,0BAAoC,CAAC,IAAI;AAC/C,SAAS,iBAAiB,OAA+C;CACvE,MAAM,UAAU,OAAO,MAAM,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY;CACxD,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,OAAO,wBAAwB,SAAS,OAAO,IAAI,KAAA,IAAY;AACjE;;;;;AAMA,IAAI;;;;;;;AAQJ,SAAS,IAAI,OAA2B,UAAsC;CAC5E,IAAI,CAAC,OAAO,OAAO,KAAA;CAEnB,QADe,iBAAiB,IAAI,aAAa,EAAA,CAAG,0BAA0B,OAAO,QAC1E,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,KAAA;AACpC;AAEA,MAAM,gBAAgB;;;;;;;AAQtB,SAAS,OACP,OACA,MACoB;CACpB,IAAI,CAAC,OAAO,OAAO,KAAA;CACnB,MAAM,UAAU,MAAM,KAAK,CAAC,CAAC,YAAY;CACzC,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,IAAI,cAAc,KAAK,OAAO,GAAG,OAAO;CACxC,MAAM,aAAa,KAAK,OAAO;CAC/B,IAAI,eAAe,KAAA,GAAW,OAAO,KAAA;CACrC,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,OAAO,KAAK;AAC7D;AAEA,MAAM,YAAY,MAAc;AAChC,MAAM,UAAU,MAAe,EAAE,UAAU,IAAI,IAAI,EAAE,MAAM,GAAG,CAAC;AAC/D,MAAM,iBAAiB,MAAc,EAAE,QAAQ,gBAAgB,EAAE;AACjE,MAAM,WAAW,MAAc;CAC7B,MAAM,MAAM,EAAE,QAAQ,OAAO,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;CAC/C,OAAO,IAAI,SAAS,IAAI,KAAA,IAAY;AACtC;;;;;AAMA,MAAM,UAAU,WACd,MAAM,KAAK,IAAI,IAAI,OAAO,QAAQ,SAAyB,SAAS,KAAA,CAAS,CAAC,CAAC;AAEjF,MAAM,QAAQ,WAAmC;CAC/C,MAAM,UAAU,OAAO,MAAM;CAC7B,OAAO,QAAQ,SAAS,IAAI,UAAU,KAAA;AACxC;AA2BA,SAAS,YAAY,MAAiB,MAAwB,aAAmC;CAC/F,MAAM,WAAyB,CAAC;CAEhC,IAAI,KAAK,OAAO;EACd,MAAM,SAAS,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC,KAAK,KAAK;EACnE,SAAS,KAAK,KAAK,OAAO,KAAK,UAAU,IAAI,OAAO,cAAc,KAAK,CAAC,CAAC;CAC3E;CACA,IAAI,KAAK,cAAc;EACrB,MAAM,SAAS,MAAM,QAAQ,KAAK,YAAY,IAAI,KAAK,eAAe,CAAC,KAAK,YAAY;EACxF,SAAS,KAAK,KAAK,OAAO,KAAK,UAAU,IAAI,OAAO,cAAc,KAAK,CAAC,CAAC;CAC3E;CACA,IAAI,KAAK,WAAW,YAAY,KAAK,WAAW,QAC9C,SAAS,KAAK,KAAK,CAAC,IAAI,KAAK,WAAW,WAAW,MAAM,KAAK,cAAc,MAAM,CAAC,CAAC;CAEtF,IAAI,KAAK,SACP,IAAI,MAAM,QAAQ,KAAK,OAAO,GAAG;EAG/B,SAAS,KAAK,OAAO,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,YAAY,QAAQ,CAAC,CAAC;EAC5E,SAAS,KAAK,OAAO,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,WAAW,QAAQ,CAAC,CAAC;EAC3E,SAAS,KAAK,OAAO,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,MAAM,aAAa,CAAC,CAAC;EAC3E,SAAS,KAAK,OAAO,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,QAAQ,aAAa,CAAC,CAAC;EAC7E,SAAS,KAAK,OAAO,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,aAAa,OAAO,CAAC,CAAC;EAC5E,SAAS,UAAU,OACjB,KAAK,QAAQ,KAAK,MAAM,IAAI,iBAAiB,EAAE,OAAO,GAAG,cAAc,OAAO,CAAC,CACjF;CACF,OAAO;EACL,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,QAAQ,YAAY,QAAQ,CAAC,CAAC;EAC9D,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,QAAQ,WAAW,QAAQ,CAAC,CAAC;EAC7D,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,QAAQ,MAAM,aAAa,CAAC,CAAC;EAC7D,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,QAAQ,QAAQ,aAAa,CAAC,CAAC;EAC/D,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,QAAQ,aAAa,OAAO,CAAC,CAAC;EAC9D,SAAS,UAAU,KAAK,CAAC,IAAI,iBAAiB,KAAK,QAAQ,OAAO,GAAG,cAAc,OAAO,CAAC,CAAC;EAG5F,SAAS,UAAU,OAAO,KAAK,QAAQ,YAAY,MAAM,GAAG,CAAC,GAAG,MAAM;EACtE,SAAS,SAAS,OAAO,KAAK,QAAQ,WAAW,MAAM,GAAG,CAAC,GAAG,MAAM;CACtE;CAEF,IAAI,KAAK,UAAU;EACjB,MAAM,EAAE,MAAM,OAAO,QAAQ,KAAK;EAClC,IAAI,UAAU,KAAK,KAAK,SAAS,CAAC,GAChC,SAAS,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,KAAK;EAE3E,IAAI,SAAS,KAAK,SAAS,IACzB,SAAS,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,MAAM,SAAS,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK;EAE7F,IAAI,OAAO,KAAK,OAAO,IACrB,SAAS,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK;CAE7F;CACA,IAAI,KAAK,WAAW,KAAK,QAAQ,WAAW,GAG1C,SAAS,cAAc,CAAC,KAAK,OAAO;CAEtC,IAAI,KAAK,YACP,SAAS,oBAAoB,KAAK;CAEpC,IAAI,KAAK,YACP,SAAS,oBAAoB,KAAK;CAEpC,IAAI,KAAK,aACP,SAAS,cAAc,KAAK;CAE9B,IAAI,KAAK,YACP,SAAS,UAAU,KAAK;CAG1B,IAAI,KAAK,KACP,SAAS,MAAM,KAAK;MACf,IAAI,KAAK,QACd,SAAS,MAAM,UAAU,KAAK,QAAQ,WAAW;CAEnD,IAAI,KAAK,KACP,SAAS,MAAM,KAAK;CAEtB,IAAI,KAAK,gBACP,SAAS,QAAQ,KAAK;CAExB,IAAI,KAAK,cAAc,OAAO,KAAK,eAAe,UAChD,SAAS,oBAAoB,KAAK;CAGpC,OAAO;AACT;AAEA,MAAM,sBAAsB;CAAC;CAAY;CAAY;AAAe;AAGpE,SAAS,cAAc,EAAE,MAAM,cAAwD;CACrF,MAAM,CAAC,GAAG,OAAO,qBAAqB,WAAW,MAAM,UAAU;CACjE,MAAM,EACJ,OACA,UACA,cACA,kBACA,aACA,UACA,cACA,eACA,WACA,eACA,QACA,mBACA,GAAG,sBACD;CAEJ,MAAM,aAAsC,CAAC;CAE7C,IAAI,UAAU,KAAA,KAAa,UAAU,QAAQ,OAAO,SAAS,OAAO,WAAW,OAAO,KAAK,CAAC,CAAC,GAC3F,WAAW,QAAQ,OAAO,WAAW,OAAO,KAAK,CAAC;CAEpD,IAAI,UAGF,WAAW,WAAW,SACnB,KAAK,CAAC,CACN,YAAY,CAAC,CACb,QAAQ,WAAW,EAAE;CAE1B,IAAI,cAAc,WAAW,eAAe;CAC5C,IAAI,kBAAkB,WAAW,mBAAmB;CACpD,IAAI,aAAa,WAAW,cAAc;CAC1C,IAAI,UACF,WAAW,WAAW,SAAS,KAAK,MAAM;EACxC,MAAM,UAAmC,CAAC;EAC1C,IAAI,EAAE,IAAI,QAAQ,KAAK,EAAE;EACzB,IAAI,EAAE,UAAU,QAAQ,WAAW,EAAE;EACrC,IAAI,EAAE,YAAY,QAAQ,aAAa,EAAE;EACzC,IAAI,EAAE,OAAO,QAAQ,QAAQ,EAAE;EAC/B,IAAI,EAAE,aAAa,QAAQ,cAAc,EAAE;EAC3C,IAAI,EAAE,OAAO,QAAQ,QAAQ,EAAE;EAC/B,IAAI,EAAE,UAAU,QAAQ,WAAW,EAAE;EACrC,MAAM,WAAW,EAAE,mBAAmB,KAAK,CAAC,CAAC,YAAY;EACzD,IAAI,YAAY,oBAAoB,SAAS,QAAQ,GAAG,QAAQ,oBAAoB;EACpF,OAAO;CACT,CAAC;CAEH,IAAI,cAAc,WAAW,eAAe;CAC5C,IAAI,eAAe,WAAW,gBAAgB;CAC9C,IAAI,WAAW,WAAW,YAAY;CACtC,IAAI,eAAe,WAAW,gBAAgB;CAC9C,IAAI,QAAQ,WAAW,SAAS,OAAO,SAAS;CAChD,MAAM,WAAW,mBAAmB,KAAK,CAAC,CAAC,YAAY;CACvD,IAAI,YAAY,oBAAoB,SAAS,QAAQ,GAAG,WAAW,oBAAoB;CAEvF,OAAO;EAAE,GAAG;EAAY,GAAG;CAAkB;AAC/C;;;;;;;AAQA,SAAS,WAAW,MAAiB,gBAAiD;CACpF,MAAM,UAA2C,CAAC;CAClD,IAAI,KAAK,YAAY,SAAS,KAAK,YAAY,UAC7C,QAAQ,KAAK;MACR,IAAI,KAAK,YAAY,WAC1B,QAAQ,KAAK;CAEf,QAAQ,KAAK;CACb,MAAM,eAAe,KAAK,SAAS,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC;CAClD,IAAI,cAAc,QAAQ,KAAK;CAC/B,IAAI,KAAK,SAAS,QAAQ,KAAK,KAAK;CACpC,IAAI,KAAK,YAAY,QAAQ,KAAK,KAAK;CACvC,IAAI,KAAK,iBAAiB,QAAQ,KAAK,KAAK;CAC5C,IAAI,KAAK,UAAU,QAAQ,KAAK,KAAK;CACrC,IAAI,KAAK,cAAc,QAAQ,KAAK,KAAK;CACzC,IAAI,KAAK,eAAe,QAAQ,MAAM,KAAK;CAC3C,IAAI,KAAK,oBAAoB,QAAQ,MAAM,KAAK,mBAAmB,SAAS;CAE5E,MAAM,UAAmC,EAAE,QAAQ;CACnD,IAAI,KAAK,gBAAgB,QAAQ,8BAA8B;CAC/D,IAAI,KAAK,kBAAkB,QAAQ,mBAAmB,KAAK;CAC3D,OAAO;AACT;;;;;;;AAoBA,SAAgB,aAEd,OACA,MACA,gBACW;CACX,MAAM,cAAc,IAAI,KAAK,MAAM,UAAU,CAAC,CAAC,QAAQ;CACvD,MAAM,CAAC,GAAG,aAAa,WAAW,MAAM,MAAM,MAAM,UAAU;CAC9D,MAAM,SAAS,oBAAoB,MAAM,QAAQ;CAEjD,MAAM,YAAuB;EAC3B,YAAY;EACZ,YAAY,KAAK,MAAM,cAAc,GAAI;EACzC,UAAU,MAAM,KAAK,mBAAmB,MAAM;EAG9C,eAAe,WAAW,QAAQ,QAAQ,WAAW,QAAQ,YAAY;EACzE,WAAW,YAAY,MAAM,MAAM,MAAM,WAAW;EACpD,aAAa,cAAc,KAAK;CAClC;CACA,IAAI,WAAW,SAAS,gBACtB,UAAU,WAAW,WAAW,MAAM,MAAM,cAAc;CAE5D,MAAM,iBAAiB,aAAa,MAAM,IAAI;CAC9C,IAAI,gBACF,UAAU,mBAAmB;CAE/B,OAAO;AACT;;;;;;AAsBA,eAAsB,WACpB,aACA,SAEA,QACA,OAAyB,CAAC,GAC1B,UAAkC,CAAC,GACW;CAC9C,MAAM,aAAa,OAChB,QAAQ,UAAU,CAAC,eAAe,SAAS,MAAM,IAAI,CAAC,CAAC,CACvD,KAAK,UAAU,aAAa,OAAO,MAAM,QAAQ,cAAc,CAAC;CACnE,IAAI,WAAW,WAAW,GAAG,OAAO,KAAA;CAEpC,MAAM,UAAU,QAAQ,cAAc;CACtC,IAAI;EACF,MAAM,WAAW,MAAM,MAAM,8BAA8B,QAAQ,GAAG,QAAQ,UAAU;GACtF,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAoB,QAAQ;GAAmB;GAC1E,MAAM,KAAK,UAAU;IACnB,MAAM;IACN,iBAAiB,QAAQ;IACzB,cAAc;GAChB,CAAC;EACH,CAAC;EACD,IAAI,SAAS,IAAI,OAAQ,MAAM,SAAS,KAAK;EAC7C,MAAM,EAAE,WAAW;EACnB,MAAM,UAAU,MAAM,SAAS,KAAK;EACpC,QAAQ,MAAM,2CAA2C,OAAO,UAAU,SAAS;EACnF;CACF,SAAS,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACrE,QAAQ,MAAM,kDAAkD,SAAS;EACzE;CACF;AACF"}

package/dist/tanstack/analytics.cjs

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_track_index = require("../track/index.cjs");
 const require_hooks_use_outbound_click_analytics = require("../hooks/use-outbound-click-analytics.cjs");
-const require_hooks_use_report_web_vitals = require("../hooks/use-report-web-vitals.cjs");
 const require_hooks_use_web_analytics = require("../hooks/use-web-analytics.cjs");
+const require_hooks_use_report_web_vitals = require("../hooks/use-report-web-vitals.cjs");
 let react_jsx_runtime = require("react/jsx-runtime");
 let _tanstack_react_router = require("@tanstack/react-router");
 //#region src/tanstack/analytics.tsx

package/dist/tanstack/analytics.mjs

@@ -1,7 +1,7 @@
 import { track } from "../track/index.mjs";
 import { useOutboundClickAnalytics } from "../hooks/use-outbound-click-analytics.mjs";
-import { useReportWebVitals } from "../hooks/use-report-web-vitals.mjs";
 import { useWebAnalytics } from "../hooks/use-web-analytics.mjs";
+import { useReportWebVitals } from "../hooks/use-report-web-vitals.mjs";
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
 import { useLocation } from "@tanstack/react-router";
 //#region src/tanstack/analytics.tsx

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shware/analytics",
-  "version": "7.6.0",
+  "version": "8.1.0",
   "private": false,
   "repository": {
     "type": "git",
@@ -120,6 +120,16 @@
         "types": "./dist/server/index.d.cts",
         "default": "./dist/server/index.cjs"
       }
+    },
+    "./server/legacy": {
+      "import": {
+        "types": "./dist/server/legacy.d.mts",
+        "default": "./dist/server/legacy.mjs"
+      },
+      "require": {
+        "types": "./dist/server/legacy.d.cts",
+        "default": "./dist/server/legacy.cjs"
+      }
     }
   },
   "publishConfig": {