@shware/analytics 8.1.0 → 8.3.0

package/dist/server/openai-conversions-api.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"openai-conversions-api.cjs","names":["resolveActionSource","getFirst","mapOAIEvent","pageLocation","IGNORED_EVENTS","NON_AD_EVENTS"],"sources":["../../src/server/openai-conversions-api.ts"],"sourcesContent":["/**\n * OpenAI Conversions API\n * https://developers.openai.com/ads/conversions-api\n * https://developers.openai.com/ads/supported-events\n */\nimport { createHash } from 'node:crypto';\nimport { fetch } from '@shware/utils';\nimport { IGNORED_EVENTS } from '../third-parties/ignored-events';\nimport { type EventData, NON_AD_EVENTS, mapOAIEvent } from '../track/oaiq';\nimport type { Platform, TrackEvent, UserProvidedData } from '../track/types';\nimport { getFirst } from '../utils/field';\nimport { type EventActionSource, resolveActionSource } from './action-source';\nimport { pageLocation } from './page-location';\n\nconst ENDPOINT = 'https://bzr.openai.com/v1/events';\n\ntype ActionSource =\n  | 'web'\n  | 'mobile_app'\n  | 'offline'\n  | 'physical_store'\n  | 'phone_call'\n  | 'email'\n  | 'other';\n\n/**\n * User/identity fields. Email and external id must be sent as lowercase 64-char SHA-256 hex\n * strings; geographic, IP, and user-agent fields are sent as raw values.\n */\nexport interface OpenAIUser {\n  email_sha256?: string;\n  external_id_sha256?: string;\n  /** Two-letter ISO 3166-1 country code (e.g. \"US\"). */\n  country?: string;\n  city?: string;\n  zip_code?: string;\n  ip_address?: string;\n  user_agent?: string;\n}\n\nexport interface OpenAIEvent {\n  /** Unique event id; combined with `type` for deduplication against pixel events. */\n  id: string;\n  /** Standard event name or `custom`. */\n  type: string;\n  /** Required when `type` is `custom`. */\n  custom_event_name?: string;\n  /** Event timestamp in ms; must be within 7 days and no more than 10 minutes in the future. */\n  timestamp_ms: number;\n  /** Required for `action_source: \"web\"`. */\n  source_url?: string;\n  action_source?: ActionSource;\n  /** OpenAI-provided privacy-preserving identifier. */\n  oppref?: string;\n  /** When true, opts the event out of personalization. */\n  opt_out?: boolean;\n  user?: OpenAIUser;\n  data: EventData;\n}\n\nexport interface CreateOpenAIEventsDTO {\n  /** When true, validates the events without persisting them. */\n  validate_only?: boolean;\n  events: OpenAIEvent[];\n}\n\nfunction sha256(value: string): string {\n  return createHash('sha256').update(value).digest('hex');\n}\n\nfunction mapActionSource(\n  platform: Platform,\n  actionSource?: EventActionSource\n): ActionSource | undefined {\n  switch (resolveActionSource(platform, actionSource)) {\n    case 'web':\n      return 'web';\n    case 'app':\n      return 'mobile_app';\n    case 'offline':\n      return 'offline';\n    default:\n      return undefined;\n  }\n}\n\nfunction getUser(data: UserProvidedData): OpenAIUser | undefined {\n  const email = getFirst(data.email)?.trim().toLowerCase();\n  const address = getFirst(data.address);\n\n  const user: OpenAIUser = {\n    email_sha256: email ? sha256(email) : undefined,\n    external_id_sha256: data.user_id ? sha256(data.user_id) : undefined,\n    country: address?.country?.trim().toUpperCase(),\n    city: address?.city?.trim().toLowerCase(),\n    zip_code: address?.postal_code,\n    ip_address: data.ip_address,\n    user_agent: data.user_agent,\n  };\n\n  return Object.values(user).some((value) => value !== undefined) ? user : undefined;\n}\n\nexport function getServerEvent(\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  event: TrackEvent<any>,\n  data: UserProvidedData,\n  actionSource?: EventActionSource\n): OpenAIEvent {\n  const { type, data: eventData } = mapOAIEvent(event.name, event.properties);\n\n  return {\n    id: event.tags.idempotency_key ?? event.id,\n    type,\n    // For custom events the original track name is the OpenAI custom_event_name; this matches\n    // the browser pixel so the two deduplicate. Standard events omit it.\n    custom_event_name: type === 'custom' ? event.name : undefined,\n    timestamp_ms: new Date(event.created_at).getTime(),\n    source_url: pageLocation(event.tags),\n    action_source: mapActionSource(event.platform, actionSource),\n    user: getUser(data),\n    data: eventData,\n  };\n}\n\nexport async function sendEvents(\n  apiKey: string,\n  pixelId: string,\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  events: TrackEvent<any>[],\n  data: UserProvidedData = {},\n  validateOnly = false,\n  actionSource?: EventActionSource\n) {\n  const dto: CreateOpenAIEventsDTO = {\n    validate_only: validateOnly,\n    events: events\n      .filter((event) => !IGNORED_EVENTS.includes(event.name))\n      .filter((event) => !NON_AD_EVENTS.includes(event.name))\n      .map((event) => getServerEvent(event, data, actionSource)),\n  };\n\n  if (dto.events.length === 0) return;\n\n  try {\n    const response = await fetch(`${ENDPOINT}?pid=${pixelId}`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Accept: 'application/json',\n        Authorization: `Bearer ${apiKey}`,\n      },\n      body: JSON.stringify(dto),\n    });\n\n    if (response.ok) return;\n    const { status } = response;\n    const message = await response.text();\n    console.error(`Failed to send OpenAI conversion, status: ${status}, body: ${message}`);\n  } catch (error) {\n    console.error('Failed to send OpenAI conversion, network error:', error);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAcA,MAAM,WAAW;AAoDjB,SAAS,OAAO,OAAuB;CACrC,QAAA,GAAA,YAAA,WAAA,CAAkB,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AACxD;AAEA,SAAS,gBACP,UACA,cAC0B;CAC1B,QAAQA,6BAAAA,oBAAoB,UAAU,YAAY,GAAlD;EACE,KAAK,OACH,OAAO;EACT,KAAK,OACH,OAAO;EACT,KAAK,WACH,OAAO;EACT,SACE;CACJ;AACF;AAEA,SAAS,QAAQ,MAAgD;CAC/D,MAAM,QAAQC,oBAAAA,SAAS,KAAK,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,YAAY;CACvD,MAAM,UAAUA,oBAAAA,SAAS,KAAK,OAAO;CAErC,MAAM,OAAmB;EACvB,cAAc,QAAQ,OAAO,KAAK,IAAI,KAAA;EACtC,oBAAoB,KAAK,UAAU,OAAO,KAAK,OAAO,IAAI,KAAA;EAC1D,SAAS,SAAS,SAAS,KAAK,CAAC,CAAC,YAAY;EAC9C,MAAM,SAAS,MAAM,KAAK,CAAC,CAAC,YAAY;EACxC,UAAU,SAAS;EACnB,YAAY,KAAK;EACjB,YAAY,KAAK;CACnB;CAEA,OAAO,OAAO,OAAO,IAAI,CAAC,CAAC,MAAM,UAAU,UAAU,KAAA,CAAS,IAAI,OAAO,KAAA;AAC3E;AAEA,SAAgB,eAEd,OACA,MACA,cACa;CACb,MAAM,EAAE,MAAM,MAAM,cAAcC,mBAAAA,YAAY,MAAM,MAAM,MAAM,UAAU;CAE1E,OAAO;EACL,IAAI,MAAM,KAAK,mBAAmB,MAAM;EACxC;EAGA,mBAAmB,SAAS,WAAW,MAAM,OAAO,KAAA;EACpD,cAAc,IAAI,KAAK,MAAM,UAAU,CAAC,CAAC,QAAQ;EACjD,YAAYC,6BAAAA,aAAa,MAAM,IAAI;EACnC,eAAe,gBAAgB,MAAM,UAAU,YAAY;EAC3D,MAAM,QAAQ,IAAI;EAClB,MAAM;CACR;AACF;AAEA,eAAsB,WACpB,QACA,SAEA,QACA,OAAyB,CAAC,GAC1B,eAAe,OACf,cACA;CACA,MAAM,MAA6B;EACjC,eAAe;EACf,QAAQ,OACL,QAAQ,UAAU,CAACC,qCAAAA,eAAe,SAAS,MAAM,IAAI,CAAC,CAAC,CACvD,QAAQ,UAAU,CAACC,mBAAAA,cAAc,SAAS,MAAM,IAAI,CAAC,CAAC,CACtD,KAAK,UAAU,eAAe,OAAO,MAAM,YAAY,CAAC;CAC7D;CAEA,IAAI,IAAI,OAAO,WAAW,GAAG;CAE7B,IAAI;EACF,MAAM,WAAW,OAAA,GAAA,cAAA,MAAA,CAAY,GAAG,SAAS,OAAO,WAAW;GACzD,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,QAAQ;IACR,eAAe,UAAU;GAC3B;GACA,MAAM,KAAK,UAAU,GAAG;EAC1B,CAAC;EAED,IAAI,SAAS,IAAI;EACjB,MAAM,EAAE,WAAW;EACnB,MAAM,UAAU,MAAM,SAAS,KAAK;EACpC,QAAQ,MAAM,6CAA6C,OAAO,UAAU,SAAS;CACvF,SAAS,OAAO;EACd,QAAQ,MAAM,oDAAoD,KAAK;CACzE;AACF"}
+{"version":3,"file":"openai-conversions-api.cjs","names":["createHash","resolveActionSource","getFirst","mapOAIEvent","pageLocation","IGNORED_EVENTS","NON_AD_EVENTS","fetch"],"sources":["../../src/server/openai-conversions-api.ts"],"sourcesContent":["/**\n * OpenAI Conversions API\n * https://developers.openai.com/ads/conversions-api\n * https://developers.openai.com/ads/supported-events\n */\nimport { createHash } from 'node:crypto';\nimport { fetch } from '@shware/utils';\nimport { IGNORED_EVENTS } from '../third-parties/ignored-events';\nimport { type EventData, NON_AD_EVENTS, mapOAIEvent } from '../track/oaiq';\nimport type { Platform, TrackEvent, UserProvidedData } from '../track/types';\nimport { getFirst } from '../utils/field';\nimport { type EventActionSource, resolveActionSource } from './action-source';\nimport { pageLocation } from './page-location';\n\nconst ENDPOINT = 'https://bzr.openai.com/v1/events';\n\ntype ActionSource =\n  | 'web'\n  | 'mobile_app'\n  | 'offline'\n  | 'physical_store'\n  | 'phone_call'\n  | 'email'\n  | 'other';\n\n/**\n * User/identity fields. Email and external id must be sent as lowercase 64-char SHA-256 hex\n * strings; geographic, IP, and user-agent fields are sent as raw values.\n */\nexport interface OpenAIUser {\n  email_sha256?: string;\n  external_id_sha256?: string;\n  /** Two-letter ISO 3166-1 country code (e.g. \"US\"). */\n  country?: string;\n  city?: string;\n  zip_code?: string;\n  ip_address?: string;\n  user_agent?: string;\n}\n\nexport interface OpenAIEvent {\n  /** Unique event id; combined with `type` for deduplication against pixel events. */\n  id: string;\n  /** Standard event name or `custom`. */\n  type: string;\n  /** Required when `type` is `custom`. */\n  custom_event_name?: string;\n  /** Event timestamp in ms; must be within 7 days and no more than 10 minutes in the future. */\n  timestamp_ms: number;\n  /** Required for `action_source: \"web\"`. */\n  source_url?: string;\n  action_source?: ActionSource;\n  /** OpenAI-provided privacy-preserving identifier. */\n  oppref?: string;\n  /** When true, opts the event out of personalization. */\n  opt_out?: boolean;\n  user?: OpenAIUser;\n  data: EventData;\n}\n\nexport interface CreateOpenAIEventsDTO {\n  /** When true, validates the events without persisting them. */\n  validate_only?: boolean;\n  events: OpenAIEvent[];\n}\n\nfunction sha256(value: string): string {\n  return createHash('sha256').update(value).digest('hex');\n}\n\nfunction mapActionSource(\n  platform: Platform,\n  actionSource?: EventActionSource\n): ActionSource | undefined {\n  switch (resolveActionSource(platform, actionSource)) {\n    case 'web':\n      return 'web';\n    case 'app':\n      return 'mobile_app';\n    case 'offline':\n      return 'offline';\n    default:\n      return undefined;\n  }\n}\n\nfunction getUser(data: UserProvidedData): OpenAIUser | undefined {\n  const email = getFirst(data.email)?.trim().toLowerCase();\n  const address = getFirst(data.address);\n\n  const user: OpenAIUser = {\n    email_sha256: email ? sha256(email) : undefined,\n    external_id_sha256: data.user_id ? sha256(data.user_id) : undefined,\n    country: address?.country?.trim().toUpperCase(),\n    city: address?.city?.trim().toLowerCase(),\n    zip_code: address?.postal_code,\n    ip_address: data.ip_address,\n    user_agent: data.user_agent,\n  };\n\n  return Object.values(user).some((value) => value !== undefined) ? user : undefined;\n}\n\nexport function getServerEvent(\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  event: TrackEvent<any>,\n  data: UserProvidedData,\n  actionSource?: EventActionSource\n): OpenAIEvent {\n  const { type, data: eventData } = mapOAIEvent(event.name, event.properties);\n\n  return {\n    id: event.tags.idempotency_key ?? event.id,\n    type,\n    // For custom events the original track name is the OpenAI custom_event_name; this matches\n    // the browser pixel so the two deduplicate. Standard events omit it.\n    custom_event_name: type === 'custom' ? event.name : undefined,\n    timestamp_ms: new Date(event.created_at).getTime(),\n    source_url: pageLocation(event.tags),\n    action_source: mapActionSource(event.platform, actionSource),\n    user: getUser(data),\n    data: eventData,\n  };\n}\n\nexport async function sendEvents(\n  apiKey: string,\n  pixelId: string,\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  events: TrackEvent<any>[],\n  data: UserProvidedData = {},\n  validateOnly = false,\n  actionSource?: EventActionSource\n) {\n  const dto: CreateOpenAIEventsDTO = {\n    validate_only: validateOnly,\n    events: events\n      .filter((event) => !IGNORED_EVENTS.includes(event.name))\n      .filter((event) => !NON_AD_EVENTS.includes(event.name))\n      .map((event) => getServerEvent(event, data, actionSource)),\n  };\n\n  if (dto.events.length === 0) return;\n\n  try {\n    const response = await fetch(`${ENDPOINT}?pid=${pixelId}`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Accept: 'application/json',\n        Authorization: `Bearer ${apiKey}`,\n      },\n      body: JSON.stringify(dto),\n    });\n\n    if (response.ok) return;\n    const { status } = response;\n    const message = await response.text();\n    console.error(`Failed to send OpenAI conversion, status: ${status}, body: ${message}`);\n  } catch (error) {\n    console.error('Failed to send OpenAI conversion, network error:', error);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAcA,MAAM,WAAW;AAoDjB,SAAS,OAAO,OAAuB;CACrC,QAAA,GAAOA,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AACxD;AAEA,SAAS,gBACP,UACA,cAC0B;CAC1B,QAAQC,6BAAAA,oBAAoB,UAAU,YAAY,GAAlD;EACE,KAAK,OACH,OAAO;EACT,KAAK,OACH,OAAO;EACT,KAAK,WACH,OAAO;EACT,SACE;CACJ;AACF;AAEA,SAAS,QAAQ,MAAgD;CAC/D,MAAM,QAAQC,oBAAAA,SAAS,KAAK,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,YAAY;CACvD,MAAM,UAAUA,oBAAAA,SAAS,KAAK,OAAO;CAErC,MAAM,OAAmB;EACvB,cAAc,QAAQ,OAAO,KAAK,IAAI,KAAA;EACtC,oBAAoB,KAAK,UAAU,OAAO,KAAK,OAAO,IAAI,KAAA;EAC1D,SAAS,SAAS,SAAS,KAAK,CAAC,CAAC,YAAY;EAC9C,MAAM,SAAS,MAAM,KAAK,CAAC,CAAC,YAAY;EACxC,UAAU,SAAS;EACnB,YAAY,KAAK;EACjB,YAAY,KAAK;CACnB;CAEA,OAAO,OAAO,OAAO,IAAI,CAAC,CAAC,MAAM,UAAU,UAAU,KAAA,CAAS,IAAI,OAAO,KAAA;AAC3E;AAEA,SAAgB,eAEd,OACA,MACA,cACa;CACb,MAAM,EAAE,MAAM,MAAM,cAAcC,mBAAAA,YAAY,MAAM,MAAM,MAAM,UAAU;CAE1E,OAAO;EACL,IAAI,MAAM,KAAK,mBAAmB,MAAM;EACxC;EAGA,mBAAmB,SAAS,WAAW,MAAM,OAAO,KAAA;EACpD,cAAc,IAAI,KAAK,MAAM,UAAU,CAAC,CAAC,QAAQ;EACjD,YAAYC,6BAAAA,aAAa,MAAM,IAAI;EACnC,eAAe,gBAAgB,MAAM,UAAU,YAAY;EAC3D,MAAM,QAAQ,IAAI;EAClB,MAAM;CACR;AACF;AAEA,eAAsB,WACpB,QACA,SAEA,QACA,OAAyB,CAAC,GAC1B,eAAe,OACf,cACA;CACA,MAAM,MAA6B;EACjC,eAAe;EACf,QAAQ,OACL,QAAQ,UAAU,CAACC,qCAAAA,eAAe,SAAS,MAAM,IAAI,CAAC,CAAC,CACvD,QAAQ,UAAU,CAACC,mBAAAA,cAAc,SAAS,MAAM,IAAI,CAAC,CAAC,CACtD,KAAK,UAAU,eAAe,OAAO,MAAM,YAAY,CAAC;CAC7D;CAEA,IAAI,IAAI,OAAO,WAAW,GAAG;CAE7B,IAAI;EACF,MAAM,WAAW,OAAA,GAAMC,cAAAA,MAAAA,CAAM,GAAG,SAAS,OAAO,WAAW;GACzD,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,QAAQ;IACR,eAAe,UAAU;GAC3B;GACA,MAAM,KAAK,UAAU,GAAG;EAC1B,CAAC;EAED,IAAI,SAAS,IAAI;EACjB,MAAM,EAAE,WAAW;EACnB,MAAM,UAAU,MAAM,SAAS,KAAK;EACpC,QAAQ,MAAM,6CAA6C,OAAO,UAAU,SAAS;CACvF,SAAS,OAAO;EACd,QAAQ,MAAM,oDAAoD,KAAK;CACzE;AACF"}

package/dist/server/reddit-conversions-api.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"reddit-conversions-api.cjs","names":["mapRDTEvent","resolveActionSource","mapServerStandardEvent","getFirst","IGNORED_EVENTS"],"sources":["../../src/server/reddit-conversions-api.ts"],"sourcesContent":["import { fetch } from '@shware/utils';\nimport { IGNORED_EVENTS } from '../third-parties/ignored-events';\nimport { type ServerStandardEvent, mapRDTEvent, mapServerStandardEvent } from '../track/rdt';\nimport type { TrackEvent, UserProvidedData } from '../track/types';\nimport { getFirst } from '../utils/field';\nimport { type EventActionSource, resolveActionSource } from './action-source';\n\n/**\n * https://ads-api.reddit.com/docs/v3/operations/Post%20Conversion%20Events\n * https://business.reddithelp.com/s/article/map-a-catalog-to-a-signal-source\n */\nexport interface RedditEvent {\n  /** Match keys: Share user identifiers to match conversions to a Reddit ad engagement. */\n  click_id?: string;\n\n  /** Unix epoch timestamp in milliseconds, event_at can't be older than seven days. */\n  event_at: number;\n\n  action_source: 'WEBSITE' | 'APP' | (string & {});\n\n  type: {\n    tracking_type: ServerStandardEvent | 'CUSTOM';\n    custom_event_name?: string;\n  };\n\n  /**\n   * Event metadata\n   * Share as much additional information about your conversion event as you'd like. If you're\n   * using the Conversions API with the pixel, conversion_id is required for deduplication.\n   */\n  metadata?: {\n    conversion_id?: string;\n    currency?: string; // ISO 4217 3-letter currency code\n    item_count?: number;\n    value?: number;\n    products?: { id: string; name?: string; category?: string }[];\n  };\n\n  user?: {\n    email?: string;\n    external_id?: string;\n    ip_address?: string;\n    phone_number?: string;\n    user_agent?: string;\n\n    /** The Identifier for Advertisers (IDFA) of the user's Apple device. */\n    idfa?: string;\n\n    /** The Android Advertising ID (AAID) of the user's Android device. */\n    aaid?: string;\n    /**\n     * The value from the first-party Pixel _rdt_uuid cookie on your domain. Note that it is in\n     * the {timestamp}.{uuid} format. You may use the full value or just the UUID portion.\n     * Example: 1684189007728.7c73f2ae-a433-4d7b-9838-f467da98f48e\n     */\n    uuid?: string;\n\n    screen_dimensions?: { width: number; height: number };\n\n    /**\n     * A structure of data processing options to specify the processing type for the event\n     * https://business.reddithelp.com/s/article/Limited-Data-Use\n     */\n    data_processing_options?: {\n      country: string;\n      region: string;\n      modes: string[] | ['LDU'];\n    };\n  };\n}\n\nexport interface CreateRedditEventDTO {\n  data: { test_id?: string; events: RedditEvent[] };\n}\n\nexport function getServerEvent(\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  event: TrackEvent<any>,\n  data: UserProvidedData,\n  actionSource?: EventActionSource\n): RedditEvent {\n  const { id, name, properties, tags, platform, created_at } = event;\n  const [type, params] = mapRDTEvent(name, properties, id);\n  // Reddit documents WEBSITE and APP only, so an offline conversion shares the fallback with an\n  // undeterminable platform rather than inventing an enum value the API may reject.\n  const source = resolveActionSource(platform, actionSource);\n\n  return {\n    click_id: tags.rdt_cid,\n    event_at: new Date(created_at).getTime(),\n    action_source: source === 'web' ? 'WEBSITE' : source === 'app' ? 'APP' : 'UNKNOWN',\n    type: {\n      tracking_type: type === 'Custom' ? 'CUSTOM' : mapServerStandardEvent(type),\n      custom_event_name: type === 'Custom' ? params.customEventName : undefined,\n    },\n    metadata: {\n      conversion_id: id,\n      currency:\n        'currency' in params && typeof params.currency === 'string'\n          ? params.currency.toUpperCase()\n          : undefined,\n      item_count:\n        'itemCount' in params && typeof params.itemCount === 'number'\n          ? params.itemCount\n          : undefined,\n      value: 'value' in params && typeof params.value === 'number' ? params.value : undefined,\n      products:\n        'products' in params && Array.isArray(params.products) && params.products.length > 0\n          ? params.products\n          : undefined,\n    },\n    user: {\n      email: getFirst(data.email),\n      external_id: data.user_id,\n      ip_address: data.ip_address,\n      phone_number: getFirst(data.phone_number),\n      user_agent: data.user_agent,\n      idfa: platform === 'ios' ? tags.advertising_id : undefined,\n      aaid: platform === 'android' ? tags.advertising_id : undefined,\n      uuid: tags.rdt_uuid,\n      screen_dimensions:\n        tags.screen_width && tags.screen_height\n          ? { width: tags.screen_width, height: tags.screen_height }\n          : undefined,\n    },\n  };\n}\n\nexport async function sendEvents(\n  accessToken: string,\n  pixelId: string,\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  events: TrackEvent<any>[],\n  data: UserProvidedData = {},\n  testId?: string,\n  actionSource?: EventActionSource\n) {\n  const dto: CreateRedditEventDTO = {\n    data: {\n      test_id: testId,\n      events: events\n        .filter((event) => !IGNORED_EVENTS.includes(event.name))\n        .map((event) => getServerEvent(event, data, actionSource)),\n    },\n  };\n\n  if (dto.data.events.length === 0) return;\n\n  try {\n    const response = await fetch(\n      `https://ads-api.reddit.com/api/v3/pixels/${pixelId}/conversion_events`,\n      {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          Accept: 'application/json',\n          Authorization: `Bearer ${accessToken}`,\n        },\n        body: JSON.stringify(dto),\n      }\n    );\n    if (response.ok) return;\n    const { status } = response;\n    const message = await response.text();\n    console.error(`Failed to send Reddit conversion, status: ${status}, body: ${message}`);\n  } catch (error) {\n    console.error('Failed to send Reddit conversion, network error:', error);\n  }\n}\n"],"mappings":";;;;;;;AA2EA,SAAgB,eAEd,OACA,MACA,cACa;CACb,MAAM,EAAE,IAAI,MAAM,YAAY,MAAM,UAAU,eAAe;CAC7D,MAAM,CAAC,MAAM,UAAUA,kBAAAA,YAAY,MAAM,YAAY,EAAE;CAGvD,MAAM,SAASC,6BAAAA,oBAAoB,UAAU,YAAY;CAEzD,OAAO;EACL,UAAU,KAAK;EACf,UAAU,IAAI,KAAK,UAAU,CAAC,CAAC,QAAQ;EACvC,eAAe,WAAW,QAAQ,YAAY,WAAW,QAAQ,QAAQ;EACzE,MAAM;GACJ,eAAe,SAAS,WAAW,WAAWC,kBAAAA,uBAAuB,IAAI;GACzE,mBAAmB,SAAS,WAAW,OAAO,kBAAkB,KAAA;EAClE;EACA,UAAU;GACR,eAAe;GACf,UACE,cAAc,UAAU,OAAO,OAAO,aAAa,WAC/C,OAAO,SAAS,YAAY,IAC5B,KAAA;GACN,YACE,eAAe,UAAU,OAAO,OAAO,cAAc,WACjD,OAAO,YACP,KAAA;GACN,OAAO,WAAW,UAAU,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ,KAAA;GAC9E,UACE,cAAc,UAAU,MAAM,QAAQ,OAAO,QAAQ,KAAK,OAAO,SAAS,SAAS,IAC/E,OAAO,WACP,KAAA;EACR;EACA,MAAM;GACJ,OAAOC,oBAAAA,SAAS,KAAK,KAAK;GAC1B,aAAa,KAAK;GAClB,YAAY,KAAK;GACjB,cAAcA,oBAAAA,SAAS,KAAK,YAAY;GACxC,YAAY,KAAK;GACjB,MAAM,aAAa,QAAQ,KAAK,iBAAiB,KAAA;GACjD,MAAM,aAAa,YAAY,KAAK,iBAAiB,KAAA;GACrD,MAAM,KAAK;GACX,mBACE,KAAK,gBAAgB,KAAK,gBACtB;IAAE,OAAO,KAAK;IAAc,QAAQ,KAAK;GAAc,IACvD,KAAA;EACR;CACF;AACF;AAEA,eAAsB,WACpB,aACA,SAEA,QACA,OAAyB,CAAC,GAC1B,QACA,cACA;CACA,MAAM,MAA4B,EAChC,MAAM;EACJ,SAAS;EACT,QAAQ,OACL,QAAQ,UAAU,CAACC,qCAAAA,eAAe,SAAS,MAAM,IAAI,CAAC,CAAC,CACvD,KAAK,UAAU,eAAe,OAAO,MAAM,YAAY,CAAC;CAC7D,EACF;CAEA,IAAI,IAAI,KAAK,OAAO,WAAW,GAAG;CAElC,IAAI;EACF,MAAM,WAAW,OAAA,GAAA,cAAA,MAAA,CACf,4CAA4C,QAAQ,qBACpD;GACE,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,QAAQ;IACR,eAAe,UAAU;GAC3B;GACA,MAAM,KAAK,UAAU,GAAG;EAC1B,CACF;EACA,IAAI,SAAS,IAAI;EACjB,MAAM,EAAE,WAAW;EACnB,MAAM,UAAU,MAAM,SAAS,KAAK;EACpC,QAAQ,MAAM,6CAA6C,OAAO,UAAU,SAAS;CACvF,SAAS,OAAO;EACd,QAAQ,MAAM,oDAAoD,KAAK;CACzE;AACF"}
+{"version":3,"file":"reddit-conversions-api.cjs","names":["mapRDTEvent","resolveActionSource","mapServerStandardEvent","getFirst","IGNORED_EVENTS","fetch"],"sources":["../../src/server/reddit-conversions-api.ts"],"sourcesContent":["import { fetch } from '@shware/utils';\nimport { IGNORED_EVENTS } from '../third-parties/ignored-events';\nimport { type ServerStandardEvent, mapRDTEvent, mapServerStandardEvent } from '../track/rdt';\nimport type { TrackEvent, UserProvidedData } from '../track/types';\nimport { getFirst } from '../utils/field';\nimport { type EventActionSource, resolveActionSource } from './action-source';\n\n/**\n * https://ads-api.reddit.com/docs/v3/operations/Post%20Conversion%20Events\n * https://business.reddithelp.com/s/article/map-a-catalog-to-a-signal-source\n */\nexport interface RedditEvent {\n  /** Match keys: Share user identifiers to match conversions to a Reddit ad engagement. */\n  click_id?: string;\n\n  /** Unix epoch timestamp in milliseconds, event_at can't be older than seven days. */\n  event_at: number;\n\n  action_source: 'WEBSITE' | 'APP' | (string & {});\n\n  type: {\n    tracking_type: ServerStandardEvent | 'CUSTOM';\n    custom_event_name?: string;\n  };\n\n  /**\n   * Event metadata\n   * Share as much additional information about your conversion event as you'd like. If you're\n   * using the Conversions API with the pixel, conversion_id is required for deduplication.\n   */\n  metadata?: {\n    conversion_id?: string;\n    currency?: string; // ISO 4217 3-letter currency code\n    item_count?: number;\n    value?: number;\n    products?: { id: string; name?: string; category?: string }[];\n  };\n\n  user?: {\n    email?: string;\n    external_id?: string;\n    ip_address?: string;\n    phone_number?: string;\n    user_agent?: string;\n\n    /** The Identifier for Advertisers (IDFA) of the user's Apple device. */\n    idfa?: string;\n\n    /** The Android Advertising ID (AAID) of the user's Android device. */\n    aaid?: string;\n    /**\n     * The value from the first-party Pixel _rdt_uuid cookie on your domain. Note that it is in\n     * the {timestamp}.{uuid} format. You may use the full value or just the UUID portion.\n     * Example: 1684189007728.7c73f2ae-a433-4d7b-9838-f467da98f48e\n     */\n    uuid?: string;\n\n    screen_dimensions?: { width: number; height: number };\n\n    /**\n     * A structure of data processing options to specify the processing type for the event\n     * https://business.reddithelp.com/s/article/Limited-Data-Use\n     */\n    data_processing_options?: {\n      country: string;\n      region: string;\n      modes: string[] | ['LDU'];\n    };\n  };\n}\n\nexport interface CreateRedditEventDTO {\n  data: { test_id?: string; events: RedditEvent[] };\n}\n\nexport function getServerEvent(\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  event: TrackEvent<any>,\n  data: UserProvidedData,\n  actionSource?: EventActionSource\n): RedditEvent {\n  const { id, name, properties, tags, platform, created_at } = event;\n  const [type, params] = mapRDTEvent(name, properties, id);\n  // Reddit documents WEBSITE and APP only, so an offline conversion shares the fallback with an\n  // undeterminable platform rather than inventing an enum value the API may reject.\n  const source = resolveActionSource(platform, actionSource);\n\n  return {\n    click_id: tags.rdt_cid,\n    event_at: new Date(created_at).getTime(),\n    action_source: source === 'web' ? 'WEBSITE' : source === 'app' ? 'APP' : 'UNKNOWN',\n    type: {\n      tracking_type: type === 'Custom' ? 'CUSTOM' : mapServerStandardEvent(type),\n      custom_event_name: type === 'Custom' ? params.customEventName : undefined,\n    },\n    metadata: {\n      conversion_id: id,\n      currency:\n        'currency' in params && typeof params.currency === 'string'\n          ? params.currency.toUpperCase()\n          : undefined,\n      item_count:\n        'itemCount' in params && typeof params.itemCount === 'number'\n          ? params.itemCount\n          : undefined,\n      value: 'value' in params && typeof params.value === 'number' ? params.value : undefined,\n      products:\n        'products' in params && Array.isArray(params.products) && params.products.length > 0\n          ? params.products\n          : undefined,\n    },\n    user: {\n      email: getFirst(data.email),\n      external_id: data.user_id,\n      ip_address: data.ip_address,\n      phone_number: getFirst(data.phone_number),\n      user_agent: data.user_agent,\n      idfa: platform === 'ios' ? tags.advertising_id : undefined,\n      aaid: platform === 'android' ? tags.advertising_id : undefined,\n      uuid: tags.rdt_uuid,\n      screen_dimensions:\n        tags.screen_width && tags.screen_height\n          ? { width: tags.screen_width, height: tags.screen_height }\n          : undefined,\n    },\n  };\n}\n\nexport async function sendEvents(\n  accessToken: string,\n  pixelId: string,\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  events: TrackEvent<any>[],\n  data: UserProvidedData = {},\n  testId?: string,\n  actionSource?: EventActionSource\n) {\n  const dto: CreateRedditEventDTO = {\n    data: {\n      test_id: testId,\n      events: events\n        .filter((event) => !IGNORED_EVENTS.includes(event.name))\n        .map((event) => getServerEvent(event, data, actionSource)),\n    },\n  };\n\n  if (dto.data.events.length === 0) return;\n\n  try {\n    const response = await fetch(\n      `https://ads-api.reddit.com/api/v3/pixels/${pixelId}/conversion_events`,\n      {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          Accept: 'application/json',\n          Authorization: `Bearer ${accessToken}`,\n        },\n        body: JSON.stringify(dto),\n      }\n    );\n    if (response.ok) return;\n    const { status } = response;\n    const message = await response.text();\n    console.error(`Failed to send Reddit conversion, status: ${status}, body: ${message}`);\n  } catch (error) {\n    console.error('Failed to send Reddit conversion, network error:', error);\n  }\n}\n"],"mappings":";;;;;;;AA2EA,SAAgB,eAEd,OACA,MACA,cACa;CACb,MAAM,EAAE,IAAI,MAAM,YAAY,MAAM,UAAU,eAAe;CAC7D,MAAM,CAAC,MAAM,UAAUA,kBAAAA,YAAY,MAAM,YAAY,EAAE;CAGvD,MAAM,SAASC,6BAAAA,oBAAoB,UAAU,YAAY;CAEzD,OAAO;EACL,UAAU,KAAK;EACf,UAAU,IAAI,KAAK,UAAU,CAAC,CAAC,QAAQ;EACvC,eAAe,WAAW,QAAQ,YAAY,WAAW,QAAQ,QAAQ;EACzE,MAAM;GACJ,eAAe,SAAS,WAAW,WAAWC,kBAAAA,uBAAuB,IAAI;GACzE,mBAAmB,SAAS,WAAW,OAAO,kBAAkB,KAAA;EAClE;EACA,UAAU;GACR,eAAe;GACf,UACE,cAAc,UAAU,OAAO,OAAO,aAAa,WAC/C,OAAO,SAAS,YAAY,IAC5B,KAAA;GACN,YACE,eAAe,UAAU,OAAO,OAAO,cAAc,WACjD,OAAO,YACP,KAAA;GACN,OAAO,WAAW,UAAU,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ,KAAA;GAC9E,UACE,cAAc,UAAU,MAAM,QAAQ,OAAO,QAAQ,KAAK,OAAO,SAAS,SAAS,IAC/E,OAAO,WACP,KAAA;EACR;EACA,MAAM;GACJ,OAAOC,oBAAAA,SAAS,KAAK,KAAK;GAC1B,aAAa,KAAK;GAClB,YAAY,KAAK;GACjB,cAAcA,oBAAAA,SAAS,KAAK,YAAY;GACxC,YAAY,KAAK;GACjB,MAAM,aAAa,QAAQ,KAAK,iBAAiB,KAAA;GACjD,MAAM,aAAa,YAAY,KAAK,iBAAiB,KAAA;GACrD,MAAM,KAAK;GACX,mBACE,KAAK,gBAAgB,KAAK,gBACtB;IAAE,OAAO,KAAK;IAAc,QAAQ,KAAK;GAAc,IACvD,KAAA;EACR;CACF;AACF;AAEA,eAAsB,WACpB,aACA,SAEA,QACA,OAAyB,CAAC,GAC1B,QACA,cACA;CACA,MAAM,MAA4B,EAChC,MAAM;EACJ,SAAS;EACT,QAAQ,OACL,QAAQ,UAAU,CAACC,qCAAAA,eAAe,SAAS,MAAM,IAAI,CAAC,CAAC,CACvD,KAAK,UAAU,eAAe,OAAO,MAAM,YAAY,CAAC;CAC7D,EACF;CAEA,IAAI,IAAI,KAAK,OAAO,WAAW,GAAG;CAElC,IAAI;EACF,MAAM,WAAW,OAAA,GAAMC,cAAAA,MAAAA,CACrB,4CAA4C,QAAQ,qBACpD;GACE,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,QAAQ;IACR,eAAe,UAAU;GAC3B;GACA,MAAM,KAAK,UAAU,GAAG;EAC1B,CACF;EACA,IAAI,SAAS,IAAI;EACjB,MAAM,EAAE,WAAW;EACnB,MAAM,UAAU,MAAM,SAAS,KAAK;EACpC,QAAQ,MAAM,6CAA6C,OAAO,UAAU,SAAS;CACvF,SAAS,OAAO;EACd,QAAQ,MAAM,oDAAoD,KAAK;CACzE;AACF"}

package/dist/setup/session.cjs

@@ -3,7 +3,7 @@ const require_setup_index = require("./index.cjs");
 const require_constants_storage = require("../constants/storage.cjs");
 let uuid = require("uuid");
 //#region src/setup/session.ts
-const SESSION_TIMEOUT = 1800 * 1e3;
+const SESSION_TIMEOUT = 18e5;
 /**
 * `<version>.<id>.<lastEventTime>`, compact and cookie-safe rather than JSON: `{`, `"`
 * and `,` all have to be percent-encoded in a cookie, and a host that wants one session across

package/dist/setup/session.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"session.cjs","names":["config","keys"],"sources":["../../src/setup/session.ts"],"sourcesContent":["import { v7 as uuidv7 } from 'uuid';\nimport { keys } from '../constants/storage';\nimport { config } from './index';\n\nexport const SESSION_TIMEOUT = 30 * 60 * 1000;\n\n/**\n * The part of a session that outlives the page: its identity, and the clock the timeout is\n * measured against. GA4 keeps these in its `_ga_<container>` cookie — alongside the engaged flag,\n * which arrives with `session_engaged` later — and rereads them for every event, which is what\n * makes a session survive a reload, span a whole multipage visit, and stay shared between two\n * tabs of the same site. Holding them in memory instead, as this did, starts a new session on\n * every full navigation and gives every tab one of its own.\n */\ninterface StoredSession {\n  id: string;\n  /** When the last event was sent. The timeout is measured from here, and only from here. */\n  lastEventTime: number;\n}\n\n/** The session an event belongs to, and whether that event is the one that started it. */\ninterface SessionForEvent {\n  id: string;\n  started: boolean;\n}\n\n/**\n * `<version>.<id>.<lastEventTime>`, compact and cookie-safe rather than JSON: `{`, `\"`\n * and `,` all have to be percent-encoded in a cookie, and a host that wants one session across\n * its subdomains will hand `setupAnalytics` a cookie-backed `storage`, where this has to survive\n * unchanged. A uuidv7 contains no dots, so the record splits cleanly.\n *\n * The version guards a change the parser could not otherwise survive. A field appended to the end\n * does not need one — a short record simply leaves it undefined.\n */\nconst VERSION = '1';\n\nfunction readSession(): StoredSession | undefined {\n  const raw = config.storage.getItem(keys.session);\n  if (!raw) return undefined;\n\n  const [version, id, lastEventTime] = raw.split('.');\n  if (version !== VERSION || !id) return undefined;\n\n  const parsed = { id, lastEventTime: Number(lastEventTime) };\n  if (!Number.isFinite(parsed.lastEventTime)) return undefined;\n  return parsed;\n}\n\nfunction writeSession({ id, lastEventTime }: StoredSession) {\n  config.storage.setItem(keys.session, `${VERSION}.${id}.${lastEventTime}`);\n}\n\nclass Session {\n  /**\n   * Engagement is deliberately not stored: it is the time this page has accrued and not yet\n   * reported, so it belongs to the page, not to the session. GA4 draws the same line — its cookie\n   * carries the session, while the engagement timer lives and dies with the document.\n   *\n   * `lastTickTime` is where the accumulator last settled up, rewritten on every tick — it is not\n   * when the session began, and nothing here needs to know that.\n   */\n  private lastTickTime: number;\n  private accumulatedTime: number;\n\n  private active: boolean;\n  private visible: boolean;\n  private focused: boolean;\n\n  constructor() {\n    this.lastTickTime = Date.now();\n    this.accumulatedTime = 0;\n\n    this.active = true;\n    this.visible = typeof document !== 'undefined' ? document.visibilityState === 'visible' : true;\n    this.focused = typeof document !== 'undefined' ? document.hasFocus() : true;\n  }\n\n  /**\n   * The session a batch of events belongs to: read the stored one, start a new one if it has\n   * timed out or there is none, stamp it with when those events happened and write it back. Every\n   * event goes through here, exactly as GA4 rereads and rewrites its cookie per event — caching\n   * the session in memory would put the tabs back out of step with each other.\n   */\n  touch = (eventTime: number, lastEventTime = eventTime): SessionForEvent => {\n    const stored = readSession();\n\n    if (stored && eventTime - stored.lastEventTime <= SESSION_TIMEOUT) {\n      // `Math.max`, because a batch that waited in a frozen tab can be older than what another\n      // tab has since written, and a session must never be shortened by a late arrival.\n      writeSession({ ...stored, lastEventTime: Math.max(stored.lastEventTime, lastEventTime) });\n      return { id: stored.id, started: false };\n    }\n\n    // Engagement the previous session accrued but never reported dies with it rather than being\n    // handed to its successor. GA4 does the same on `session_start`.\n    this.accumulatedTime = 0;\n    // Wall clock, not `eventTime`: this anchors the engagement timer for the page in front of the\n    // visitor now, which a batch describing something that happened an hour ago says nothing about.\n    this.lastTickTime = Date.now();\n\n    const session: StoredSession = { id: uuidv7(), lastEventTime };\n    writeSession(session);\n    return { id: session.id, started: true };\n  };\n\n  /**\n   * The id for an event that must not start a session — the `pagehide` beacon, which reports what\n   * the session now ending accrued. A live session is extended, as any event extends it; one\n   * already past its timeout still owns that engagement, so its id comes back without being\n   * revived into a session no `session_start` ever announced.\n   */\n  extend = (): string => {\n    const stored = readSession();\n    if (!stored) return this.touch(Date.now()).id;\n\n    const now = Date.now();\n    if (now - stored.lastEventTime <= SESSION_TIMEOUT) {\n      writeSession({ ...stored, lastEventTime: now });\n    }\n    return stored.id;\n  };\n\n  isActive = () => this.active;\n\n  updateActive = (active: boolean) => {\n    this.active = active;\n  };\n\n  updateAccumulator = () => {\n    const now = Date.now();\n    if (this.focused && this.visible && this.active) {\n      const delta = now - this.lastTickTime;\n      if (delta > 0 && delta < SESSION_TIMEOUT) {\n        this.accumulatedTime += delta;\n      }\n    }\n    this.lastTickTime = now;\n  };\n\n  focus = () => {\n    this.updateAccumulator();\n    this.focused = true;\n  };\n\n  blur = () => {\n    this.updateAccumulator();\n    this.focused = false;\n  };\n\n  pageshow = () => {\n    this.updateAccumulator();\n    this.active = true;\n  };\n\n  pagehide = () => {\n    this.updateAccumulator();\n    this.active = false;\n  };\n\n  visibilitychange = (state: DocumentVisibilityState) => {\n    this.updateAccumulator();\n    this.visible = state === 'visible';\n  };\n\n  flush = () => {\n    this.updateAccumulator();\n    const engagementTime = this.accumulatedTime;\n    this.accumulatedTime = 0;\n    return engagementTime;\n  };\n}\n\nlet session: Session | undefined;\n\n/**\n * The session, built the first time something asks for it.\n *\n * Deliberately not a module-scope `new Session()`. The constructor calls\n * `uuidv7()`, `uuid` draws its bytes from `crypto.getRandomValues`, and\n * Cloudflare Workers reject that outside a request handler:\n *\n *   Disallowed operation called within global scope. Asynchronous I/O\n *   (ex: fetch() or connect()), setting a timeout, and generating random\n *   values are not allowed within global scope.\n *\n * Module scope in a Worker is evaluated once when the isolate boots and is\n * then shared by every request that isolate serves, so a random value drawn\n * there would be the same for all of them — which is why the runtime refuses\n * to produce one. A host that server-renders on Workers reaches this module\n * through `track()` on the server as well, and the throw happened as the\n * isolate booted, taking down every route before a component rendered.\n *\n * Everything here is per-visitor browser or app state, so deferring the\n * construction costs nothing and lets the server bundle be evaluated. It does\n * not make any of it safe to use there: this instance, `cache` and `config` are\n * module singletons, so calling `track()` on a server shares one session and one\n * visitor across every request the isolate serves. Import it there; do not track.\n */\nexport function getSession() {\n  return (session ??= new Session());\n}\n"],"mappings":";;;;;AAIA,MAAa,kBAAkB,OAAU;;;;;;;;;;AA+BzC,MAAM,UAAU;AAEhB,SAAS,cAAyC;CAChD,MAAM,MAAMA,oBAAAA,OAAO,QAAQ,QAAQC,0BAAAA,KAAK,OAAO;CAC/C,IAAI,CAAC,KAAK,OAAO,KAAA;CAEjB,MAAM,CAAC,SAAS,IAAI,iBAAiB,IAAI,MAAM,GAAG;CAClD,IAAI,YAAY,WAAW,CAAC,IAAI,OAAO,KAAA;CAEvC,MAAM,SAAS;EAAE;EAAI,eAAe,OAAO,aAAa;CAAE;CAC1D,IAAI,CAAC,OAAO,SAAS,OAAO,aAAa,GAAG,OAAO,KAAA;CACnD,OAAO;AACT;AAEA,SAAS,aAAa,EAAE,IAAI,iBAAgC;CAC1D,oBAAA,OAAO,QAAQ,QAAQA,0BAAAA,KAAK,SAAS,GAAG,QAAQ,GAAG,GAAG,GAAG,eAAe;AAC1E;AAEA,IAAM,UAAN,MAAc;CAgBZ,cAAc;EAeL,KAAA,SAAA,WAAmB,gBAAgB,cAA+B;GACzE,MAAM,SAAS,YAAY;GAE3B,IAAI,UAAU,YAAY,OAAO,iBAAA,MAAkC;IAGjE,aAAa;KAAE,GAAG;KAAQ,eAAe,KAAK,IAAI,OAAO,eAAe,aAAa;IAAE,CAAC;IACxF,OAAO;KAAE,IAAI,OAAO;KAAI,SAAS;IAAM;GACzC;GAIA,KAAK,kBAAkB;GAGvB,KAAK,eAAe,KAAK,IAAI;GAE7B,MAAM,UAAyB;IAAE,KAAA,GAAA,KAAA,GAAA,CAAW;IAAG;GAAc;GAC7D,aAAa,OAAO;GACpB,OAAO;IAAE,IAAI,QAAQ;IAAI,SAAS;GAAK;EACzC;EAQuB,KAAA,eAAA;GACrB,MAAM,SAAS,YAAY;GAC3B,IAAI,CAAC,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC;GAE3C,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,MAAM,OAAO,iBAAA,MACf,aAAa;IAAE,GAAG;IAAQ,eAAe;GAAI,CAAC;GAEhD,OAAO,OAAO;EAChB;EAEiB,KAAA,iBAAA,KAAK;EAEN,KAAA,gBAAA,WAAoB;GAClC,KAAK,SAAS;EAChB;EAE0B,KAAA,0BAAA;GACxB,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,KAAK,WAAW,KAAK,WAAW,KAAK,QAAQ;IAC/C,MAAM,QAAQ,MAAM,KAAK;IACzB,IAAI,QAAQ,KAAK,QAAA,MACf,KAAK,mBAAmB;GAE5B;GACA,KAAK,eAAe;EACtB;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,KAAK,UAAU;EACjB;EAEa,KAAA,aAAA;GACX,KAAK,kBAAkB;GACvB,KAAK,UAAU;EACjB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,SAAS;EAChB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,SAAS;EAChB;EAEoB,KAAA,oBAAA,UAAmC;GACrD,KAAK,kBAAkB;GACvB,KAAK,UAAU,UAAU;EAC3B;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,MAAM,iBAAiB,KAAK;GAC5B,KAAK,kBAAkB;GACvB,OAAO;EACT;EApGE,KAAK,eAAe,KAAK,IAAI;EAC7B,KAAK,kBAAkB;EAEvB,KAAK,SAAS;EACd,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,oBAAoB,YAAY;EAC1F,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,SAAS,IAAI;CACzE;AA+FF;AAEA,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;AA0BJ,SAAgB,aAAa;CAC3B,OAAQ,YAAY,IAAI,QAAQ;AAClC"}
+{"version":3,"file":"session.cjs","names":["config","keys","uuidv7"],"sources":["../../src/setup/session.ts"],"sourcesContent":["import { v7 as uuidv7 } from 'uuid';\nimport { keys } from '../constants/storage';\nimport { config } from './index';\n\nexport const SESSION_TIMEOUT = 30 * 60 * 1000;\n\n/**\n * The part of a session that outlives the page: its identity, and the clock the timeout is\n * measured against. GA4 keeps these in its `_ga_<container>` cookie — alongside the engaged flag,\n * which arrives with `session_engaged` later — and rereads them for every event, which is what\n * makes a session survive a reload, span a whole multipage visit, and stay shared between two\n * tabs of the same site. Holding them in memory instead, as this did, starts a new session on\n * every full navigation and gives every tab one of its own.\n */\ninterface StoredSession {\n  id: string;\n  /** When the last event was sent. The timeout is measured from here, and only from here. */\n  lastEventTime: number;\n}\n\n/** The session an event belongs to, and whether that event is the one that started it. */\ninterface SessionForEvent {\n  id: string;\n  started: boolean;\n}\n\n/**\n * `<version>.<id>.<lastEventTime>`, compact and cookie-safe rather than JSON: `{`, `\"`\n * and `,` all have to be percent-encoded in a cookie, and a host that wants one session across\n * its subdomains will hand `setupAnalytics` a cookie-backed `storage`, where this has to survive\n * unchanged. A uuidv7 contains no dots, so the record splits cleanly.\n *\n * The version guards a change the parser could not otherwise survive. A field appended to the end\n * does not need one — a short record simply leaves it undefined.\n */\nconst VERSION = '1';\n\nfunction readSession(): StoredSession | undefined {\n  const raw = config.storage.getItem(keys.session);\n  if (!raw) return undefined;\n\n  const [version, id, lastEventTime] = raw.split('.');\n  if (version !== VERSION || !id) return undefined;\n\n  const parsed = { id, lastEventTime: Number(lastEventTime) };\n  if (!Number.isFinite(parsed.lastEventTime)) return undefined;\n  return parsed;\n}\n\nfunction writeSession({ id, lastEventTime }: StoredSession) {\n  config.storage.setItem(keys.session, `${VERSION}.${id}.${lastEventTime}`);\n}\n\nclass Session {\n  /**\n   * Engagement is deliberately not stored: it is the time this page has accrued and not yet\n   * reported, so it belongs to the page, not to the session. GA4 draws the same line — its cookie\n   * carries the session, while the engagement timer lives and dies with the document.\n   *\n   * `lastTickTime` is where the accumulator last settled up, rewritten on every tick — it is not\n   * when the session began, and nothing here needs to know that.\n   */\n  private lastTickTime: number;\n  private accumulatedTime: number;\n\n  private active: boolean;\n  private visible: boolean;\n  private focused: boolean;\n\n  constructor() {\n    this.lastTickTime = Date.now();\n    this.accumulatedTime = 0;\n\n    this.active = true;\n    this.visible = typeof document !== 'undefined' ? document.visibilityState === 'visible' : true;\n    this.focused = typeof document !== 'undefined' ? document.hasFocus() : true;\n  }\n\n  /**\n   * The session a batch of events belongs to: read the stored one, start a new one if it has\n   * timed out or there is none, stamp it with when those events happened and write it back. Every\n   * event goes through here, exactly as GA4 rereads and rewrites its cookie per event — caching\n   * the session in memory would put the tabs back out of step with each other.\n   */\n  touch = (eventTime: number, lastEventTime = eventTime): SessionForEvent => {\n    const stored = readSession();\n\n    if (stored && eventTime - stored.lastEventTime <= SESSION_TIMEOUT) {\n      // `Math.max`, because a batch that waited in a frozen tab can be older than what another\n      // tab has since written, and a session must never be shortened by a late arrival.\n      writeSession({ ...stored, lastEventTime: Math.max(stored.lastEventTime, lastEventTime) });\n      return { id: stored.id, started: false };\n    }\n\n    // Engagement the previous session accrued but never reported dies with it rather than being\n    // handed to its successor. GA4 does the same on `session_start`.\n    this.accumulatedTime = 0;\n    // Wall clock, not `eventTime`: this anchors the engagement timer for the page in front of the\n    // visitor now, which a batch describing something that happened an hour ago says nothing about.\n    this.lastTickTime = Date.now();\n\n    const session: StoredSession = { id: uuidv7(), lastEventTime };\n    writeSession(session);\n    return { id: session.id, started: true };\n  };\n\n  /**\n   * The id for an event that must not start a session — the `pagehide` beacon, which reports what\n   * the session now ending accrued. A live session is extended, as any event extends it; one\n   * already past its timeout still owns that engagement, so its id comes back without being\n   * revived into a session no `session_start` ever announced.\n   */\n  extend = (): string => {\n    const stored = readSession();\n    if (!stored) return this.touch(Date.now()).id;\n\n    const now = Date.now();\n    if (now - stored.lastEventTime <= SESSION_TIMEOUT) {\n      writeSession({ ...stored, lastEventTime: now });\n    }\n    return stored.id;\n  };\n\n  isActive = () => this.active;\n\n  updateActive = (active: boolean) => {\n    this.active = active;\n  };\n\n  updateAccumulator = () => {\n    const now = Date.now();\n    if (this.focused && this.visible && this.active) {\n      const delta = now - this.lastTickTime;\n      if (delta > 0 && delta < SESSION_TIMEOUT) {\n        this.accumulatedTime += delta;\n      }\n    }\n    this.lastTickTime = now;\n  };\n\n  focus = () => {\n    this.updateAccumulator();\n    this.focused = true;\n  };\n\n  blur = () => {\n    this.updateAccumulator();\n    this.focused = false;\n  };\n\n  pageshow = () => {\n    this.updateAccumulator();\n    this.active = true;\n  };\n\n  pagehide = () => {\n    this.updateAccumulator();\n    this.active = false;\n  };\n\n  visibilitychange = (state: DocumentVisibilityState) => {\n    this.updateAccumulator();\n    this.visible = state === 'visible';\n  };\n\n  flush = () => {\n    this.updateAccumulator();\n    const engagementTime = this.accumulatedTime;\n    this.accumulatedTime = 0;\n    return engagementTime;\n  };\n}\n\nlet session: Session | undefined;\n\n/**\n * The session, built the first time something asks for it.\n *\n * Deliberately not a module-scope `new Session()`. The constructor calls\n * `uuidv7()`, `uuid` draws its bytes from `crypto.getRandomValues`, and\n * Cloudflare Workers reject that outside a request handler:\n *\n *   Disallowed operation called within global scope. Asynchronous I/O\n *   (ex: fetch() or connect()), setting a timeout, and generating random\n *   values are not allowed within global scope.\n *\n * Module scope in a Worker is evaluated once when the isolate boots and is\n * then shared by every request that isolate serves, so a random value drawn\n * there would be the same for all of them — which is why the runtime refuses\n * to produce one. A host that server-renders on Workers reaches this module\n * through `track()` on the server as well, and the throw happened as the\n * isolate booted, taking down every route before a component rendered.\n *\n * Everything here is per-visitor browser or app state, so deferring the\n * construction costs nothing and lets the server bundle be evaluated. It does\n * not make any of it safe to use there: this instance, `cache` and `config` are\n * module singletons, so calling `track()` on a server shares one session and one\n * visitor across every request the isolate serves. Import it there; do not track.\n */\nexport function getSession() {\n  return (session ??= new Session());\n}\n"],"mappings":";;;;;AAIA,MAAa,kBAAkB;;;;;;;;;;AA+B/B,MAAM,UAAU;AAEhB,SAAS,cAAyC;CAChD,MAAM,MAAMA,oBAAAA,OAAO,QAAQ,QAAQC,0BAAAA,KAAK,OAAO;CAC/C,IAAI,CAAC,KAAK,OAAO,KAAA;CAEjB,MAAM,CAAC,SAAS,IAAI,iBAAiB,IAAI,MAAM,GAAG;CAClD,IAAI,YAAY,WAAW,CAAC,IAAI,OAAO,KAAA;CAEvC,MAAM,SAAS;EAAE;EAAI,eAAe,OAAO,aAAa;CAAE;CAC1D,IAAI,CAAC,OAAO,SAAS,OAAO,aAAa,GAAG,OAAO,KAAA;CACnD,OAAO;AACT;AAEA,SAAS,aAAa,EAAE,IAAI,iBAAgC;CAC1D,oBAAA,OAAO,QAAQ,QAAQA,0BAAAA,KAAK,SAAS,GAAG,QAAQ,GAAG,GAAG,GAAG,eAAe;AAC1E;AAEA,IAAM,UAAN,MAAc;CAgBZ,cAAc;EAeL,KAAA,SAAA,WAAmB,gBAAgB,cAA+B;GACzE,MAAM,SAAS,YAAY;GAE3B,IAAI,UAAU,YAAY,OAAO,iBAAA,MAAkC;IAGjE,aAAa;KAAE,GAAG;KAAQ,eAAe,KAAK,IAAI,OAAO,eAAe,aAAa;IAAE,CAAC;IACxF,OAAO;KAAE,IAAI,OAAO;KAAI,SAAS;IAAM;GACzC;GAIA,KAAK,kBAAkB;GAGvB,KAAK,eAAe,KAAK,IAAI;GAE7B,MAAM,UAAyB;IAAE,KAAA,GAAIC,KAAAA,GAAAA,CAAO;IAAG;GAAc;GAC7D,aAAa,OAAO;GACpB,OAAO;IAAE,IAAI,QAAQ;IAAI,SAAS;GAAK;EACzC;EAQuB,KAAA,eAAA;GACrB,MAAM,SAAS,YAAY;GAC3B,IAAI,CAAC,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC;GAE3C,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,MAAM,OAAO,iBAAA,MACf,aAAa;IAAE,GAAG;IAAQ,eAAe;GAAI,CAAC;GAEhD,OAAO,OAAO;EAChB;EAEiB,KAAA,iBAAA,KAAK;EAEN,KAAA,gBAAA,WAAoB;GAClC,KAAK,SAAS;EAChB;EAE0B,KAAA,0BAAA;GACxB,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,KAAK,WAAW,KAAK,WAAW,KAAK,QAAQ;IAC/C,MAAM,QAAQ,MAAM,KAAK;IACzB,IAAI,QAAQ,KAAK,QAAA,MACf,KAAK,mBAAmB;GAE5B;GACA,KAAK,eAAe;EACtB;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,KAAK,UAAU;EACjB;EAEa,KAAA,aAAA;GACX,KAAK,kBAAkB;GACvB,KAAK,UAAU;EACjB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,SAAS;EAChB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,SAAS;EAChB;EAEoB,KAAA,oBAAA,UAAmC;GACrD,KAAK,kBAAkB;GACvB,KAAK,UAAU,UAAU;EAC3B;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,MAAM,iBAAiB,KAAK;GAC5B,KAAK,kBAAkB;GACvB,OAAO;EACT;EApGE,KAAK,eAAe,KAAK,IAAI;EAC7B,KAAK,kBAAkB;EAEvB,KAAK,SAAS;EACd,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,oBAAoB,YAAY;EAC1F,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,SAAS,IAAI;CACzE;AA+FF;AAEA,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;AA0BJ,SAAgB,aAAa;CAC3B,OAAQ,YAAY,IAAI,QAAQ;AAClC"}

package/dist/setup/session.mjs

@@ -2,7 +2,7 @@ import { config } from "./index.mjs";
 import { keys } from "../constants/storage.mjs";
 import { v7 } from "uuid";
 //#region src/setup/session.ts
-const SESSION_TIMEOUT = 1800 * 1e3;
+const SESSION_TIMEOUT = 18e5;
 /**
 * `<version>.<id>.<lastEventTime>`, compact and cookie-safe rather than JSON: `{`, `"`
 * and `,` all have to be percent-encoded in a cookie, and a host that wants one session across

package/dist/setup/session.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"session.mjs","names":["uuidv7"],"sources":["../../src/setup/session.ts"],"sourcesContent":["import { v7 as uuidv7 } from 'uuid';\nimport { keys } from '../constants/storage';\nimport { config } from './index';\n\nexport const SESSION_TIMEOUT = 30 * 60 * 1000;\n\n/**\n * The part of a session that outlives the page: its identity, and the clock the timeout is\n * measured against. GA4 keeps these in its `_ga_<container>` cookie — alongside the engaged flag,\n * which arrives with `session_engaged` later — and rereads them for every event, which is what\n * makes a session survive a reload, span a whole multipage visit, and stay shared between two\n * tabs of the same site. Holding them in memory instead, as this did, starts a new session on\n * every full navigation and gives every tab one of its own.\n */\ninterface StoredSession {\n  id: string;\n  /** When the last event was sent. The timeout is measured from here, and only from here. */\n  lastEventTime: number;\n}\n\n/** The session an event belongs to, and whether that event is the one that started it. */\ninterface SessionForEvent {\n  id: string;\n  started: boolean;\n}\n\n/**\n * `<version>.<id>.<lastEventTime>`, compact and cookie-safe rather than JSON: `{`, `\"`\n * and `,` all have to be percent-encoded in a cookie, and a host that wants one session across\n * its subdomains will hand `setupAnalytics` a cookie-backed `storage`, where this has to survive\n * unchanged. A uuidv7 contains no dots, so the record splits cleanly.\n *\n * The version guards a change the parser could not otherwise survive. A field appended to the end\n * does not need one — a short record simply leaves it undefined.\n */\nconst VERSION = '1';\n\nfunction readSession(): StoredSession | undefined {\n  const raw = config.storage.getItem(keys.session);\n  if (!raw) return undefined;\n\n  const [version, id, lastEventTime] = raw.split('.');\n  if (version !== VERSION || !id) return undefined;\n\n  const parsed = { id, lastEventTime: Number(lastEventTime) };\n  if (!Number.isFinite(parsed.lastEventTime)) return undefined;\n  return parsed;\n}\n\nfunction writeSession({ id, lastEventTime }: StoredSession) {\n  config.storage.setItem(keys.session, `${VERSION}.${id}.${lastEventTime}`);\n}\n\nclass Session {\n  /**\n   * Engagement is deliberately not stored: it is the time this page has accrued and not yet\n   * reported, so it belongs to the page, not to the session. GA4 draws the same line — its cookie\n   * carries the session, while the engagement timer lives and dies with the document.\n   *\n   * `lastTickTime` is where the accumulator last settled up, rewritten on every tick — it is not\n   * when the session began, and nothing here needs to know that.\n   */\n  private lastTickTime: number;\n  private accumulatedTime: number;\n\n  private active: boolean;\n  private visible: boolean;\n  private focused: boolean;\n\n  constructor() {\n    this.lastTickTime = Date.now();\n    this.accumulatedTime = 0;\n\n    this.active = true;\n    this.visible = typeof document !== 'undefined' ? document.visibilityState === 'visible' : true;\n    this.focused = typeof document !== 'undefined' ? document.hasFocus() : true;\n  }\n\n  /**\n   * The session a batch of events belongs to: read the stored one, start a new one if it has\n   * timed out or there is none, stamp it with when those events happened and write it back. Every\n   * event goes through here, exactly as GA4 rereads and rewrites its cookie per event — caching\n   * the session in memory would put the tabs back out of step with each other.\n   */\n  touch = (eventTime: number, lastEventTime = eventTime): SessionForEvent => {\n    const stored = readSession();\n\n    if (stored && eventTime - stored.lastEventTime <= SESSION_TIMEOUT) {\n      // `Math.max`, because a batch that waited in a frozen tab can be older than what another\n      // tab has since written, and a session must never be shortened by a late arrival.\n      writeSession({ ...stored, lastEventTime: Math.max(stored.lastEventTime, lastEventTime) });\n      return { id: stored.id, started: false };\n    }\n\n    // Engagement the previous session accrued but never reported dies with it rather than being\n    // handed to its successor. GA4 does the same on `session_start`.\n    this.accumulatedTime = 0;\n    // Wall clock, not `eventTime`: this anchors the engagement timer for the page in front of the\n    // visitor now, which a batch describing something that happened an hour ago says nothing about.\n    this.lastTickTime = Date.now();\n\n    const session: StoredSession = { id: uuidv7(), lastEventTime };\n    writeSession(session);\n    return { id: session.id, started: true };\n  };\n\n  /**\n   * The id for an event that must not start a session — the `pagehide` beacon, which reports what\n   * the session now ending accrued. A live session is extended, as any event extends it; one\n   * already past its timeout still owns that engagement, so its id comes back without being\n   * revived into a session no `session_start` ever announced.\n   */\n  extend = (): string => {\n    const stored = readSession();\n    if (!stored) return this.touch(Date.now()).id;\n\n    const now = Date.now();\n    if (now - stored.lastEventTime <= SESSION_TIMEOUT) {\n      writeSession({ ...stored, lastEventTime: now });\n    }\n    return stored.id;\n  };\n\n  isActive = () => this.active;\n\n  updateActive = (active: boolean) => {\n    this.active = active;\n  };\n\n  updateAccumulator = () => {\n    const now = Date.now();\n    if (this.focused && this.visible && this.active) {\n      const delta = now - this.lastTickTime;\n      if (delta > 0 && delta < SESSION_TIMEOUT) {\n        this.accumulatedTime += delta;\n      }\n    }\n    this.lastTickTime = now;\n  };\n\n  focus = () => {\n    this.updateAccumulator();\n    this.focused = true;\n  };\n\n  blur = () => {\n    this.updateAccumulator();\n    this.focused = false;\n  };\n\n  pageshow = () => {\n    this.updateAccumulator();\n    this.active = true;\n  };\n\n  pagehide = () => {\n    this.updateAccumulator();\n    this.active = false;\n  };\n\n  visibilitychange = (state: DocumentVisibilityState) => {\n    this.updateAccumulator();\n    this.visible = state === 'visible';\n  };\n\n  flush = () => {\n    this.updateAccumulator();\n    const engagementTime = this.accumulatedTime;\n    this.accumulatedTime = 0;\n    return engagementTime;\n  };\n}\n\nlet session: Session | undefined;\n\n/**\n * The session, built the first time something asks for it.\n *\n * Deliberately not a module-scope `new Session()`. The constructor calls\n * `uuidv7()`, `uuid` draws its bytes from `crypto.getRandomValues`, and\n * Cloudflare Workers reject that outside a request handler:\n *\n *   Disallowed operation called within global scope. Asynchronous I/O\n *   (ex: fetch() or connect()), setting a timeout, and generating random\n *   values are not allowed within global scope.\n *\n * Module scope in a Worker is evaluated once when the isolate boots and is\n * then shared by every request that isolate serves, so a random value drawn\n * there would be the same for all of them — which is why the runtime refuses\n * to produce one. A host that server-renders on Workers reaches this module\n * through `track()` on the server as well, and the throw happened as the\n * isolate booted, taking down every route before a component rendered.\n *\n * Everything here is per-visitor browser or app state, so deferring the\n * construction costs nothing and lets the server bundle be evaluated. It does\n * not make any of it safe to use there: this instance, `cache` and `config` are\n * module singletons, so calling `track()` on a server shares one session and one\n * visitor across every request the isolate serves. Import it there; do not track.\n */\nexport function getSession() {\n  return (session ??= new Session());\n}\n"],"mappings":";;;;AAIA,MAAa,kBAAkB,OAAU;;;;;;;;;;AA+BzC,MAAM,UAAU;AAEhB,SAAS,cAAyC;CAChD,MAAM,MAAM,OAAO,QAAQ,QAAQ,KAAK,OAAO;CAC/C,IAAI,CAAC,KAAK,OAAO,KAAA;CAEjB,MAAM,CAAC,SAAS,IAAI,iBAAiB,IAAI,MAAM,GAAG;CAClD,IAAI,YAAY,WAAW,CAAC,IAAI,OAAO,KAAA;CAEvC,MAAM,SAAS;EAAE;EAAI,eAAe,OAAO,aAAa;CAAE;CAC1D,IAAI,CAAC,OAAO,SAAS,OAAO,aAAa,GAAG,OAAO,KAAA;CACnD,OAAO;AACT;AAEA,SAAS,aAAa,EAAE,IAAI,iBAAgC;CAC1D,OAAO,QAAQ,QAAQ,KAAK,SAAS,GAAG,QAAQ,GAAG,GAAG,GAAG,eAAe;AAC1E;AAEA,IAAM,UAAN,MAAc;CAgBZ,cAAc;EAeL,KAAA,SAAA,WAAmB,gBAAgB,cAA+B;GACzE,MAAM,SAAS,YAAY;GAE3B,IAAI,UAAU,YAAY,OAAO,iBAAA,MAAkC;IAGjE,aAAa;KAAE,GAAG;KAAQ,eAAe,KAAK,IAAI,OAAO,eAAe,aAAa;IAAE,CAAC;IACxF,OAAO;KAAE,IAAI,OAAO;KAAI,SAAS;IAAM;GACzC;GAIA,KAAK,kBAAkB;GAGvB,KAAK,eAAe,KAAK,IAAI;GAE7B,MAAM,UAAyB;IAAE,IAAIA,GAAO;IAAG;GAAc;GAC7D,aAAa,OAAO;GACpB,OAAO;IAAE,IAAI,QAAQ;IAAI,SAAS;GAAK;EACzC;EAQuB,KAAA,eAAA;GACrB,MAAM,SAAS,YAAY;GAC3B,IAAI,CAAC,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC;GAE3C,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,MAAM,OAAO,iBAAA,MACf,aAAa;IAAE,GAAG;IAAQ,eAAe;GAAI,CAAC;GAEhD,OAAO,OAAO;EAChB;EAEiB,KAAA,iBAAA,KAAK;EAEN,KAAA,gBAAA,WAAoB;GAClC,KAAK,SAAS;EAChB;EAE0B,KAAA,0BAAA;GACxB,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,KAAK,WAAW,KAAK,WAAW,KAAK,QAAQ;IAC/C,MAAM,QAAQ,MAAM,KAAK;IACzB,IAAI,QAAQ,KAAK,QAAA,MACf,KAAK,mBAAmB;GAE5B;GACA,KAAK,eAAe;EACtB;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,KAAK,UAAU;EACjB;EAEa,KAAA,aAAA;GACX,KAAK,kBAAkB;GACvB,KAAK,UAAU;EACjB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,SAAS;EAChB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,SAAS;EAChB;EAEoB,KAAA,oBAAA,UAAmC;GACrD,KAAK,kBAAkB;GACvB,KAAK,UAAU,UAAU;EAC3B;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,MAAM,iBAAiB,KAAK;GAC5B,KAAK,kBAAkB;GACvB,OAAO;EACT;EApGE,KAAK,eAAe,KAAK,IAAI;EAC7B,KAAK,kBAAkB;EAEvB,KAAK,SAAS;EACd,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,oBAAoB,YAAY;EAC1F,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,SAAS,IAAI;CACzE;AA+FF;AAEA,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;AA0BJ,SAAgB,aAAa;CAC3B,OAAQ,YAAY,IAAI,QAAQ;AAClC"}
+{"version":3,"file":"session.mjs","names":["uuidv7"],"sources":["../../src/setup/session.ts"],"sourcesContent":["import { v7 as uuidv7 } from 'uuid';\nimport { keys } from '../constants/storage';\nimport { config } from './index';\n\nexport const SESSION_TIMEOUT = 30 * 60 * 1000;\n\n/**\n * The part of a session that outlives the page: its identity, and the clock the timeout is\n * measured against. GA4 keeps these in its `_ga_<container>` cookie — alongside the engaged flag,\n * which arrives with `session_engaged` later — and rereads them for every event, which is what\n * makes a session survive a reload, span a whole multipage visit, and stay shared between two\n * tabs of the same site. Holding them in memory instead, as this did, starts a new session on\n * every full navigation and gives every tab one of its own.\n */\ninterface StoredSession {\n  id: string;\n  /** When the last event was sent. The timeout is measured from here, and only from here. */\n  lastEventTime: number;\n}\n\n/** The session an event belongs to, and whether that event is the one that started it. */\ninterface SessionForEvent {\n  id: string;\n  started: boolean;\n}\n\n/**\n * `<version>.<id>.<lastEventTime>`, compact and cookie-safe rather than JSON: `{`, `\"`\n * and `,` all have to be percent-encoded in a cookie, and a host that wants one session across\n * its subdomains will hand `setupAnalytics` a cookie-backed `storage`, where this has to survive\n * unchanged. A uuidv7 contains no dots, so the record splits cleanly.\n *\n * The version guards a change the parser could not otherwise survive. A field appended to the end\n * does not need one — a short record simply leaves it undefined.\n */\nconst VERSION = '1';\n\nfunction readSession(): StoredSession | undefined {\n  const raw = config.storage.getItem(keys.session);\n  if (!raw) return undefined;\n\n  const [version, id, lastEventTime] = raw.split('.');\n  if (version !== VERSION || !id) return undefined;\n\n  const parsed = { id, lastEventTime: Number(lastEventTime) };\n  if (!Number.isFinite(parsed.lastEventTime)) return undefined;\n  return parsed;\n}\n\nfunction writeSession({ id, lastEventTime }: StoredSession) {\n  config.storage.setItem(keys.session, `${VERSION}.${id}.${lastEventTime}`);\n}\n\nclass Session {\n  /**\n   * Engagement is deliberately not stored: it is the time this page has accrued and not yet\n   * reported, so it belongs to the page, not to the session. GA4 draws the same line — its cookie\n   * carries the session, while the engagement timer lives and dies with the document.\n   *\n   * `lastTickTime` is where the accumulator last settled up, rewritten on every tick — it is not\n   * when the session began, and nothing here needs to know that.\n   */\n  private lastTickTime: number;\n  private accumulatedTime: number;\n\n  private active: boolean;\n  private visible: boolean;\n  private focused: boolean;\n\n  constructor() {\n    this.lastTickTime = Date.now();\n    this.accumulatedTime = 0;\n\n    this.active = true;\n    this.visible = typeof document !== 'undefined' ? document.visibilityState === 'visible' : true;\n    this.focused = typeof document !== 'undefined' ? document.hasFocus() : true;\n  }\n\n  /**\n   * The session a batch of events belongs to: read the stored one, start a new one if it has\n   * timed out or there is none, stamp it with when those events happened and write it back. Every\n   * event goes through here, exactly as GA4 rereads and rewrites its cookie per event — caching\n   * the session in memory would put the tabs back out of step with each other.\n   */\n  touch = (eventTime: number, lastEventTime = eventTime): SessionForEvent => {\n    const stored = readSession();\n\n    if (stored && eventTime - stored.lastEventTime <= SESSION_TIMEOUT) {\n      // `Math.max`, because a batch that waited in a frozen tab can be older than what another\n      // tab has since written, and a session must never be shortened by a late arrival.\n      writeSession({ ...stored, lastEventTime: Math.max(stored.lastEventTime, lastEventTime) });\n      return { id: stored.id, started: false };\n    }\n\n    // Engagement the previous session accrued but never reported dies with it rather than being\n    // handed to its successor. GA4 does the same on `session_start`.\n    this.accumulatedTime = 0;\n    // Wall clock, not `eventTime`: this anchors the engagement timer for the page in front of the\n    // visitor now, which a batch describing something that happened an hour ago says nothing about.\n    this.lastTickTime = Date.now();\n\n    const session: StoredSession = { id: uuidv7(), lastEventTime };\n    writeSession(session);\n    return { id: session.id, started: true };\n  };\n\n  /**\n   * The id for an event that must not start a session — the `pagehide` beacon, which reports what\n   * the session now ending accrued. A live session is extended, as any event extends it; one\n   * already past its timeout still owns that engagement, so its id comes back without being\n   * revived into a session no `session_start` ever announced.\n   */\n  extend = (): string => {\n    const stored = readSession();\n    if (!stored) return this.touch(Date.now()).id;\n\n    const now = Date.now();\n    if (now - stored.lastEventTime <= SESSION_TIMEOUT) {\n      writeSession({ ...stored, lastEventTime: now });\n    }\n    return stored.id;\n  };\n\n  isActive = () => this.active;\n\n  updateActive = (active: boolean) => {\n    this.active = active;\n  };\n\n  updateAccumulator = () => {\n    const now = Date.now();\n    if (this.focused && this.visible && this.active) {\n      const delta = now - this.lastTickTime;\n      if (delta > 0 && delta < SESSION_TIMEOUT) {\n        this.accumulatedTime += delta;\n      }\n    }\n    this.lastTickTime = now;\n  };\n\n  focus = () => {\n    this.updateAccumulator();\n    this.focused = true;\n  };\n\n  blur = () => {\n    this.updateAccumulator();\n    this.focused = false;\n  };\n\n  pageshow = () => {\n    this.updateAccumulator();\n    this.active = true;\n  };\n\n  pagehide = () => {\n    this.updateAccumulator();\n    this.active = false;\n  };\n\n  visibilitychange = (state: DocumentVisibilityState) => {\n    this.updateAccumulator();\n    this.visible = state === 'visible';\n  };\n\n  flush = () => {\n    this.updateAccumulator();\n    const engagementTime = this.accumulatedTime;\n    this.accumulatedTime = 0;\n    return engagementTime;\n  };\n}\n\nlet session: Session | undefined;\n\n/**\n * The session, built the first time something asks for it.\n *\n * Deliberately not a module-scope `new Session()`. The constructor calls\n * `uuidv7()`, `uuid` draws its bytes from `crypto.getRandomValues`, and\n * Cloudflare Workers reject that outside a request handler:\n *\n *   Disallowed operation called within global scope. Asynchronous I/O\n *   (ex: fetch() or connect()), setting a timeout, and generating random\n *   values are not allowed within global scope.\n *\n * Module scope in a Worker is evaluated once when the isolate boots and is\n * then shared by every request that isolate serves, so a random value drawn\n * there would be the same for all of them — which is why the runtime refuses\n * to produce one. A host that server-renders on Workers reaches this module\n * through `track()` on the server as well, and the throw happened as the\n * isolate booted, taking down every route before a component rendered.\n *\n * Everything here is per-visitor browser or app state, so deferring the\n * construction costs nothing and lets the server bundle be evaluated. It does\n * not make any of it safe to use there: this instance, `cache` and `config` are\n * module singletons, so calling `track()` on a server shares one session and one\n * visitor across every request the isolate serves. Import it there; do not track.\n */\nexport function getSession() {\n  return (session ??= new Session());\n}\n"],"mappings":";;;;AAIA,MAAa,kBAAkB;;;;;;;;;;AA+B/B,MAAM,UAAU;AAEhB,SAAS,cAAyC;CAChD,MAAM,MAAM,OAAO,QAAQ,QAAQ,KAAK,OAAO;CAC/C,IAAI,CAAC,KAAK,OAAO,KAAA;CAEjB,MAAM,CAAC,SAAS,IAAI,iBAAiB,IAAI,MAAM,GAAG;CAClD,IAAI,YAAY,WAAW,CAAC,IAAI,OAAO,KAAA;CAEvC,MAAM,SAAS;EAAE;EAAI,eAAe,OAAO,aAAa;CAAE;CAC1D,IAAI,CAAC,OAAO,SAAS,OAAO,aAAa,GAAG,OAAO,KAAA;CACnD,OAAO;AACT;AAEA,SAAS,aAAa,EAAE,IAAI,iBAAgC;CAC1D,OAAO,QAAQ,QAAQ,KAAK,SAAS,GAAG,QAAQ,GAAG,GAAG,GAAG,eAAe;AAC1E;AAEA,IAAM,UAAN,MAAc;CAgBZ,cAAc;EAeL,KAAA,SAAA,WAAmB,gBAAgB,cAA+B;GACzE,MAAM,SAAS,YAAY;GAE3B,IAAI,UAAU,YAAY,OAAO,iBAAA,MAAkC;IAGjE,aAAa;KAAE,GAAG;KAAQ,eAAe,KAAK,IAAI,OAAO,eAAe,aAAa;IAAE,CAAC;IACxF,OAAO;KAAE,IAAI,OAAO;KAAI,SAAS;IAAM;GACzC;GAIA,KAAK,kBAAkB;GAGvB,KAAK,eAAe,KAAK,IAAI;GAE7B,MAAM,UAAyB;IAAE,IAAIA,GAAO;IAAG;GAAc;GAC7D,aAAa,OAAO;GACpB,OAAO;IAAE,IAAI,QAAQ;IAAI,SAAS;GAAK;EACzC;EAQuB,KAAA,eAAA;GACrB,MAAM,SAAS,YAAY;GAC3B,IAAI,CAAC,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC;GAE3C,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,MAAM,OAAO,iBAAA,MACf,aAAa;IAAE,GAAG;IAAQ,eAAe;GAAI,CAAC;GAEhD,OAAO,OAAO;EAChB;EAEiB,KAAA,iBAAA,KAAK;EAEN,KAAA,gBAAA,WAAoB;GAClC,KAAK,SAAS;EAChB;EAE0B,KAAA,0BAAA;GACxB,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,KAAK,WAAW,KAAK,WAAW,KAAK,QAAQ;IAC/C,MAAM,QAAQ,MAAM,KAAK;IACzB,IAAI,QAAQ,KAAK,QAAA,MACf,KAAK,mBAAmB;GAE5B;GACA,KAAK,eAAe;EACtB;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,KAAK,UAAU;EACjB;EAEa,KAAA,aAAA;GACX,KAAK,kBAAkB;GACvB,KAAK,UAAU;EACjB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,SAAS;EAChB;EAEiB,KAAA,iBAAA;GACf,KAAK,kBAAkB;GACvB,KAAK,SAAS;EAChB;EAEoB,KAAA,oBAAA,UAAmC;GACrD,KAAK,kBAAkB;GACvB,KAAK,UAAU,UAAU;EAC3B;EAEc,KAAA,cAAA;GACZ,KAAK,kBAAkB;GACvB,MAAM,iBAAiB,KAAK;GAC5B,KAAK,kBAAkB;GACvB,OAAO;EACT;EApGE,KAAK,eAAe,KAAK,IAAI;EAC7B,KAAK,kBAAkB;EAEvB,KAAK,SAAS;EACd,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,oBAAoB,YAAY;EAC1F,KAAK,UAAU,OAAO,aAAa,cAAc,SAAS,SAAS,IAAI;CACzE;AA+FF;AAEA,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;AA0BJ,SAAgB,aAAa;CAC3B,OAAQ,YAAY,IAAI,QAAQ;AAClC"}

package/dist/tanstack/analytics.cjs

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_track_index = require("../track/index.cjs");
 const require_hooks_use_outbound_click_analytics = require("../hooks/use-outbound-click-analytics.cjs");
-const require_hooks_use_web_analytics = require("../hooks/use-web-analytics.cjs");
 const require_hooks_use_report_web_vitals = require("../hooks/use-report-web-vitals.cjs");
+const require_hooks_use_web_analytics = require("../hooks/use-web-analytics.cjs");
 let react_jsx_runtime = require("react/jsx-runtime");
 let _tanstack_react_router = require("@tanstack/react-router");
 //#region src/tanstack/analytics.tsx

package/dist/tanstack/analytics.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"analytics.cjs","names":[],"sources":["../../src/tanstack/analytics.tsx"],"sourcesContent":["import { useLocation } from '@tanstack/react-router';\nimport { useOutboundClickAnalytics } from '../hooks/use-outbound-click-analytics';\nimport { useReportWebVitals } from '../hooks/use-report-web-vitals';\nimport { useWebAnalytics } from '../hooks/use-web-analytics';\nimport type { PixelId as MetaPixelId } from '../track/fbq';\nimport type { GaId, GtmId } from '../track/gtag';\nimport { track } from '../track/index';\nimport type { PixelId as RedditPixelId } from '../track/rdt';\n\ninterface Props {\n  gaId?: GaId;\n  gaSrc?: string;\n  gtmId?: GtmId;\n  metaPixelId?: MetaPixelId;\n  openaiPixelId?: string;\n  redditPixelId?: RedditPixelId;\n  linkedInPartnerId?: `${number}`;\n  hotjarId?: `${number}`;\n  facebookAppId?: string;\n  nonce?: string;\n  debugMode?: boolean;\n  reportWebVitals?: boolean;\n}\n\nexport function Analytics({\n  gaId,\n  gaSrc,\n  nonce,\n  debugMode,\n  metaPixelId,\n  openaiPixelId,\n  redditPixelId,\n  linkedInPartnerId,\n  hotjarId,\n  facebookAppId,\n  reportWebVitals = true,\n}: Props) {\n  const { pathname } = useLocation();\n  useWebAnalytics(pathname);\n  useOutboundClickAnalytics();\n\n  useReportWebVitals((metric) => {\n    if (!reportWebVitals) return;\n    const properties = {\n      value: metric.delta,\n      metric_id: metric.id,\n      metric_value: metric.value,\n      metric_delta: metric.delta,\n      metric_rating: metric.rating,\n      metric_navigation_type: metric.navigationType,\n      non_interaction: true, // avoids affecting bounce rate.\n    };\n    track(metric.name, properties);\n  });\n\n  return (\n    <>\n      {facebookAppId && <meta property=\"fb:app_id\" content={facebookAppId} />}\n      {gaId && (\n        <>\n          <script\n            async\n            id=\"gtag\"\n            nonce={nonce}\n            src={gaSrc ?? `https://www.googletagmanager.com/gtag/js?id=${gaId}`}\n          />\n          <script\n            async\n            nonce={nonce}\n            id=\"gtag-init\"\n            dangerouslySetInnerHTML={{\n              __html: `\n              window.dataLayer = window.dataLayer || [];\n              function gtag(){dataLayer.push(arguments);}\n              gtag('js', new Date());\n              gtag('config', '${gaId}'${debugMode ? \" ,{ 'debug_mode': true }\" : ''});\n            `,\n            }}\n          />\n        </>\n      )}\n      {metaPixelId && (\n        <script\n          async\n          id=\"meta-pixel\"\n          dangerouslySetInnerHTML={{\n            __html: `\n            !(function (f, b, e, v, n, t, s) {\n              if (f.fbq) return;\n              n = f.fbq = function () {\n                n.callMethod ? n.callMethod.apply(n, arguments) : n.queue.push(arguments);\n              };\n              if (!f._fbq) f._fbq = n;\n              n.push = n;\n              n.loaded = !0;\n              n.version = '2.0';\n              n.queue = [];\n              t = b.createElement(e);\n              t.async = !0;\n              t.src = v;\n              s = b.getElementsByTagName(e)[0];\n              s.parentNode.insertBefore(t, s);\n            })(window, document, 'script', 'https://connect.facebook.net/en_US/fbevents.js');\n            fbq('init', '${metaPixelId}');\n            fbq('track', 'PageView');`,\n          }}\n        />\n      )}\n      {openaiPixelId && (\n        <script\n          async\n          id=\"openai-pixel\"\n          dangerouslySetInnerHTML={{\n            __html: `\n              (function (w, d, s, u) {\n                  if (w.oaiq) return;\n                  var q = function () {\n                    q.q.push(arguments);\n                  };\n                  q.q = [];\n                  w.oaiq = q;\n                  var js = d.createElement(s);\n                  js.async = true;\n                  js.src = u;\n                  var f = d.getElementsByTagName(s)[0];\n                  f.parentNode.insertBefore(js, f);\n                })(window, document, \"script\", \"https://bzrcdn.openai.com/sdk/oaiq.min.js\");\n\n                oaiq(\"init\", { pixelId: \"${openaiPixelId}\" });\n                oaiq(\"measure\", \"page_viewed\", { type: \"contents\" });\n            `,\n          }}\n        />\n      )}\n      {redditPixelId && (\n        <script\n          async\n          id=\"reddit-pixel\"\n          dangerouslySetInnerHTML={{\n            __html: `\n            !function(w,d) {\n              if(!w.rdt) {\n                var p = w.rdt = function() {\n                  p.sendEvent ? p.sendEvent.apply(p,arguments) : p.callQueue.push(arguments)\n                };\n                p.callQueue = [];\n                var t = d.createElement(\"script\");\n                t.src = \"https://www.redditstatic.com/ads/pixel.js\";\n                t.async = !0;\n                var s = d.getElementsByTagName(\"script\")[0];\n                s.parentNode.insertBefore(t,s)\n              }\n            }(window, document);\n            rdt('init', '${redditPixelId}');\n            rdt('track', 'PageVisit');`,\n          }}\n        />\n      )}\n      {linkedInPartnerId && (\n        <script\n          async\n          id=\"linkedin-insight-tag\"\n          dangerouslySetInnerHTML={{\n            __html: `\n            _linkedin_partner_id = \"${linkedInPartnerId}\";\n            window._linkedin_data_partner_ids = window._linkedin_data_partner_ids || [];\n            window._linkedin_data_partner_ids.push(_linkedin_partner_id);\n\n            (function(l) {\n              if (!l){\n                window.lintrk = function(a,b){\n                  window.lintrk.q.push([a,b])\n                };\n                window.lintrk.q=[]\n              }\n              var s = document.getElementsByTagName(\"script\")[0];\n              var b = document.createElement(\"script\");\n              b.type = \"text/javascript\";b.async = true;\n              b.src = \"https://snap.licdn.com/li.lms-analytics/insight.min.js\";\n              s.parentNode.insertBefore(b, s);\n            })(window.lintrk);\n            `,\n          }}\n        />\n      )}\n      {hotjarId && (\n        <script\n          async\n          id=\"hotjar\"\n          dangerouslySetInnerHTML={{\n            __html: `\n            (function(h,o,t,j,a,r){\n              h.hj=h.hj||function(){(h.hj.q=h.hj.q||[]).push(arguments)};\n              h._hjSettings={hjid:${hotjarId},hjsv:6};\n              a=o.getElementsByTagName('head')[0];\n              r=o.createElement('script');r.async=1;\n              r.src=t+h._hjSettings.hjid+j+h._hjSettings.hjsv;\n              a.appendChild(r);\n            })(window,document,'https://static.hotjar.com/c/hotjar-','.js?sv=');\n            `,\n          }}\n        />\n      )}\n    </>\n  );\n}\n"],"mappings":";;;;;;;;AAwBA,SAAgB,UAAU,EACxB,MACA,OACA,OACA,WACA,aACA,eACA,eACA,mBACA,UACA,eACA,kBAAkB,QACV;CACR,MAAM,EAAE,cAAA,GAAA,uBAAA,YAAA,CAAyB;CACjC,gCAAA,gBAAgB,QAAQ;CACxB,2CAAA,0BAA0B;CAE1B,oCAAA,oBAAoB,WAAW;EAC7B,IAAI,CAAC,iBAAiB;EACtB,MAAM,aAAa;GACjB,OAAO,OAAO;GACd,WAAW,OAAO;GAClB,cAAc,OAAO;GACrB,cAAc,OAAO;GACrB,eAAe,OAAO;GACtB,wBAAwB,OAAO;GAC/B,iBAAiB;EACnB;EACA,oBAAA,MAAM,OAAO,MAAM,UAAU;CAC/B,CAAC;CAED,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAA,kBAAA,UAAA,EAAA,UAAA;EACG,iBAAiB,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;GAAM,UAAS;GAAY,SAAS;EAAgB,CAAA;EACrE,QACC,iBAAA,GAAA,kBAAA,KAAA,CAAA,kBAAA,UAAA,EAAA,UAAA,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;GACE,OAAA;GACA,IAAG;GACI;GACP,KAAK,SAAS,+CAA+C;EAC9D,CAAA,GACD,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;GACE,OAAA;GACO;GACP,IAAG;GACH,yBAAyB,EACvB,QAAQ;;;;gCAIU,KAAK,GAAG,YAAY,6BAA6B,GAAG;cAExE;EACD,CAAA,CACD,EAAA,CAAA;EAEH,eACC,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;GACE,OAAA;GACA,IAAG;GACH,yBAAyB,EACvB,QAAQ;;;;;;;;;;;;;;;;;2BAiBO,YAAY;uCAE7B;EACD,CAAA;EAEF,iBACC,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;GACE,OAAA;GACA,IAAG;GACH,yBAAyB,EACvB,QAAQ;;;;;;;;;;;;;;;2CAeuB,cAAc;;cAG/C;EACD,CAAA;EAEF,iBACC,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;GACE,OAAA;GACA,IAAG;GACH,yBAAyB,EACvB,QAAQ;;;;;;;;;;;;;;2BAcO,cAAc;wCAE/B;EACD,CAAA;EAEF,qBACC,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;GACE,OAAA;GACA,IAAG;GACH,yBAAyB,EACvB,QAAQ;sCACkB,kBAAkB;;;;;;;;;;;;;;;;;cAkB9C;EACD,CAAA;EAEF,YACC,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;GACE,OAAA;GACA,IAAG;GACH,yBAAyB,EACvB,QAAQ;;;oCAGgB,SAAS;;;;;;cAOnC;EACD,CAAA;CAEH,EAAA,CAAA;AAEN"}
+{"version":3,"file":"analytics.cjs","names":["useLocation"],"sources":["../../src/tanstack/analytics.tsx"],"sourcesContent":["import { useLocation } from '@tanstack/react-router';\nimport { useOutboundClickAnalytics } from '../hooks/use-outbound-click-analytics';\nimport { useReportWebVitals } from '../hooks/use-report-web-vitals';\nimport { useWebAnalytics } from '../hooks/use-web-analytics';\nimport type { PixelId as MetaPixelId } from '../track/fbq';\nimport type { GaId, GtmId } from '../track/gtag';\nimport { track } from '../track/index';\nimport type { PixelId as RedditPixelId } from '../track/rdt';\n\ninterface Props {\n  gaId?: GaId;\n  gaSrc?: string;\n  gtmId?: GtmId;\n  metaPixelId?: MetaPixelId;\n  openaiPixelId?: string;\n  redditPixelId?: RedditPixelId;\n  linkedInPartnerId?: `${number}`;\n  hotjarId?: `${number}`;\n  facebookAppId?: string;\n  nonce?: string;\n  debugMode?: boolean;\n  reportWebVitals?: boolean;\n}\n\nexport function Analytics({\n  gaId,\n  gaSrc,\n  nonce,\n  debugMode,\n  metaPixelId,\n  openaiPixelId,\n  redditPixelId,\n  linkedInPartnerId,\n  hotjarId,\n  facebookAppId,\n  reportWebVitals = true,\n}: Props) {\n  const { pathname } = useLocation();\n  useWebAnalytics(pathname);\n  useOutboundClickAnalytics();\n\n  useReportWebVitals((metric) => {\n    if (!reportWebVitals) return;\n    const properties = {\n      value: metric.delta,\n      metric_id: metric.id,\n      metric_value: metric.value,\n      metric_delta: metric.delta,\n      metric_rating: metric.rating,\n      metric_navigation_type: metric.navigationType,\n      non_interaction: true, // avoids affecting bounce rate.\n    };\n    track(metric.name, properties);\n  });\n\n  return (\n    <>\n      {facebookAppId && <meta property=\"fb:app_id\" content={facebookAppId} />}\n      {gaId && (\n        <>\n          <script\n            async\n            id=\"gtag\"\n            nonce={nonce}\n            src={gaSrc ?? `https://www.googletagmanager.com/gtag/js?id=${gaId}`}\n          />\n          <script\n            async\n            nonce={nonce}\n            id=\"gtag-init\"\n            dangerouslySetInnerHTML={{\n              __html: `\n              window.dataLayer = window.dataLayer || [];\n              function gtag(){dataLayer.push(arguments);}\n              gtag('js', new Date());\n              gtag('config', '${gaId}'${debugMode ? \" ,{ 'debug_mode': true }\" : ''});\n            `,\n            }}\n          />\n        </>\n      )}\n      {metaPixelId && (\n        <script\n          async\n          id=\"meta-pixel\"\n          dangerouslySetInnerHTML={{\n            __html: `\n            !(function (f, b, e, v, n, t, s) {\n              if (f.fbq) return;\n              n = f.fbq = function () {\n                n.callMethod ? n.callMethod.apply(n, arguments) : n.queue.push(arguments);\n              };\n              if (!f._fbq) f._fbq = n;\n              n.push = n;\n              n.loaded = !0;\n              n.version = '2.0';\n              n.queue = [];\n              t = b.createElement(e);\n              t.async = !0;\n              t.src = v;\n              s = b.getElementsByTagName(e)[0];\n              s.parentNode.insertBefore(t, s);\n            })(window, document, 'script', 'https://connect.facebook.net/en_US/fbevents.js');\n            fbq('init', '${metaPixelId}');\n            fbq('track', 'PageView');`,\n          }}\n        />\n      )}\n      {openaiPixelId && (\n        <script\n          async\n          id=\"openai-pixel\"\n          dangerouslySetInnerHTML={{\n            __html: `\n              (function (w, d, s, u) {\n                  if (w.oaiq) return;\n                  var q = function () {\n                    q.q.push(arguments);\n                  };\n                  q.q = [];\n                  w.oaiq = q;\n                  var js = d.createElement(s);\n                  js.async = true;\n                  js.src = u;\n                  var f = d.getElementsByTagName(s)[0];\n                  f.parentNode.insertBefore(js, f);\n                })(window, document, \"script\", \"https://bzrcdn.openai.com/sdk/oaiq.min.js\");\n\n                oaiq(\"init\", { pixelId: \"${openaiPixelId}\" });\n                oaiq(\"measure\", \"page_viewed\", { type: \"contents\" });\n            `,\n          }}\n        />\n      )}\n      {redditPixelId && (\n        <script\n          async\n          id=\"reddit-pixel\"\n          dangerouslySetInnerHTML={{\n            __html: `\n            !function(w,d) {\n              if(!w.rdt) {\n                var p = w.rdt = function() {\n                  p.sendEvent ? p.sendEvent.apply(p,arguments) : p.callQueue.push(arguments)\n                };\n                p.callQueue = [];\n                var t = d.createElement(\"script\");\n                t.src = \"https://www.redditstatic.com/ads/pixel.js\";\n                t.async = !0;\n                var s = d.getElementsByTagName(\"script\")[0];\n                s.parentNode.insertBefore(t,s)\n              }\n            }(window, document);\n            rdt('init', '${redditPixelId}');\n            rdt('track', 'PageVisit');`,\n          }}\n        />\n      )}\n      {linkedInPartnerId && (\n        <script\n          async\n          id=\"linkedin-insight-tag\"\n          dangerouslySetInnerHTML={{\n            __html: `\n            _linkedin_partner_id = \"${linkedInPartnerId}\";\n            window._linkedin_data_partner_ids = window._linkedin_data_partner_ids || [];\n            window._linkedin_data_partner_ids.push(_linkedin_partner_id);\n\n            (function(l) {\n              if (!l){\n                window.lintrk = function(a,b){\n                  window.lintrk.q.push([a,b])\n                };\n                window.lintrk.q=[]\n              }\n              var s = document.getElementsByTagName(\"script\")[0];\n              var b = document.createElement(\"script\");\n              b.type = \"text/javascript\";b.async = true;\n              b.src = \"https://snap.licdn.com/li.lms-analytics/insight.min.js\";\n              s.parentNode.insertBefore(b, s);\n            })(window.lintrk);\n            `,\n          }}\n        />\n      )}\n      {hotjarId && (\n        <script\n          async\n          id=\"hotjar\"\n          dangerouslySetInnerHTML={{\n            __html: `\n            (function(h,o,t,j,a,r){\n              h.hj=h.hj||function(){(h.hj.q=h.hj.q||[]).push(arguments)};\n              h._hjSettings={hjid:${hotjarId},hjsv:6};\n              a=o.getElementsByTagName('head')[0];\n              r=o.createElement('script');r.async=1;\n              r.src=t+h._hjSettings.hjid+j+h._hjSettings.hjsv;\n              a.appendChild(r);\n            })(window,document,'https://static.hotjar.com/c/hotjar-','.js?sv=');\n            `,\n          }}\n        />\n      )}\n    </>\n  );\n}\n"],"mappings":";;;;;;;;AAwBA,SAAgB,UAAU,EACxB,MACA,OACA,OACA,WACA,aACA,eACA,eACA,mBACA,UACA,eACA,kBAAkB,QACV;CACR,MAAM,EAAE,cAAA,GAAaA,uBAAAA,YAAAA,CAAY;CACjC,gCAAA,gBAAgB,QAAQ;CACxB,2CAAA,0BAA0B;CAE1B,oCAAA,oBAAoB,WAAW;EAC7B,IAAI,CAAC,iBAAiB;EACtB,MAAM,aAAa;GACjB,OAAO,OAAO;GACd,WAAW,OAAO;GAClB,cAAc,OAAO;GACrB,cAAc,OAAO;GACrB,eAAe,OAAO;GACtB,wBAAwB,OAAO;GAC/B,iBAAiB;EACnB;EACA,oBAAA,MAAM,OAAO,MAAM,UAAU;CAC/B,CAAC;CAED,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAA,kBAAA,UAAA,EAAA,UAAA;EACG,iBAAiB,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;GAAM,UAAS;GAAY,SAAS;EAAgB,CAAA;EACrE,QACC,iBAAA,GAAA,kBAAA,KAAA,CAAA,kBAAA,UAAA,EAAA,UAAA,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;GACE,OAAA;GACA,IAAG;GACI;GACP,KAAK,SAAS,+CAA+C;EAC9D,CAAA,GACD,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;GACE,OAAA;GACO;GACP,IAAG;GACH,yBAAyB,EACvB,QAAQ;;;;gCAIU,KAAK,GAAG,YAAY,6BAA6B,GAAG;cAExE;EACD,CAAA,CACD,EAAA,CAAA;EAEH,eACC,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;GACE,OAAA;GACA,IAAG;GACH,yBAAyB,EACvB,QAAQ;;;;;;;;;;;;;;;;;2BAiBO,YAAY;uCAE7B;EACD,CAAA;EAEF,iBACC,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;GACE,OAAA;GACA,IAAG;GACH,yBAAyB,EACvB,QAAQ;;;;;;;;;;;;;;;2CAeuB,cAAc;;cAG/C;EACD,CAAA;EAEF,iBACC,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;GACE,OAAA;GACA,IAAG;GACH,yBAAyB,EACvB,QAAQ;;;;;;;;;;;;;;2BAcO,cAAc;wCAE/B;EACD,CAAA;EAEF,qBACC,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;GACE,OAAA;GACA,IAAG;GACH,yBAAyB,EACvB,QAAQ;sCACkB,kBAAkB;;;;;;;;;;;;;;;;;cAkB9C;EACD,CAAA;EAEF,YACC,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;GACE,OAAA;GACA,IAAG;GACH,yBAAyB,EACvB,QAAQ;;;oCAGgB,SAAS;;;;;;cAOnC;EACD,CAAA;CAEH,EAAA,CAAA;AAEN"}

package/dist/tanstack/analytics.mjs

@@ -1,7 +1,7 @@
 import { track } from "../track/index.mjs";
 import { useOutboundClickAnalytics } from "../hooks/use-outbound-click-analytics.mjs";
-import { useWebAnalytics } from "../hooks/use-web-analytics.mjs";
 import { useReportWebVitals } from "../hooks/use-report-web-vitals.mjs";
+import { useWebAnalytics } from "../hooks/use-web-analytics.mjs";
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
 import { useLocation } from "@tanstack/react-router";
 //#region src/tanstack/analytics.tsx

package/dist/tanstack/middleware.cjs

@@ -3,7 +3,8 @@ const require_click_id_index = require("../click-id/index.cjs");
 let _tanstack_react_start = require("@tanstack/react-start");
 //#region src/tanstack/middleware.ts
 /**
-* TanStack Start request middleware that persists ad click-id cookies (`_fbc`, `_rdt_cid`) on the
+* TanStack Start request middleware that persists ad click-id cookies (`_fbc`, `_gcl_aw`/`_gcl_gb`,
+* `_rdt_cid`, `_uetmsclkid`) on the
 * document response.
 *
 * Setting `_fbc` here — on the top document via an HTTP `Set-Cookie` header, before any client JS

package/dist/tanstack/middleware.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.cjs","names":["resolveClickIdCookies","toSetCookieHeaders"],"sources":["../../src/tanstack/middleware.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start';\nimport { resolveClickIdCookies, toSetCookieHeaders } from '../click-id/index';\n\nexport interface ClickIdMiddlewareOptions {\n  /** `Domain` attribute for the cookies, e.g. `.shware.io`. Omit for a host-only cookie. */\n  domain?: string;\n  /** `Secure` attribute, default true. Set false only for local http testing. */\n  secure?: boolean;\n  /** subdomainIndex for a freshly built `_fbc` (com=0, example.com=1, www.example.com=2). Default 1. */\n  subdomainIndex?: number;\n  /**\n   * Re-issue a still-valid `_fbc` on every request as an ITP self-heal (restores the long-lived\n   * HTTP cookie if the Meta Pixel's `document.cookie` write re-capped it to 24h in Safari). On by\n   * default. Note it attaches a per-user `Set-Cookie` — and thus `no-store` — to every page\n   * response carrying an `_fbc`, defeating CDN caching of those pages; set false to strictly follow\n   * Meta's conditional-write rule and keep them cacheable. See {@link resolveClickIdCookies}.\n   */\n  refresh?: boolean;\n  /**\n   * Override the `Cache-Control` of a response we attach cookies to (default `private, no-store`).\n   * A per-user `Set-Cookie` must never end up on a shared-cache entry, or one visitor's `_fbc` would\n   * be served to everyone. Only set this false if you guarantee these responses are never cached.\n   */\n  cacheControl?: string | false;\n  /**\n   * Consent gate. Return false to skip setting cookies for this request (e.g. before the visitor has\n   * granted consent where required). Runs per request with the incoming `Request`.\n   */\n  shouldPersist?: (request: Request) => boolean;\n}\n\n/**\n * TanStack Start request middleware that persists ad click-id cookies (`_fbc`, `_rdt_cid`) on the\n * document response.\n *\n * Setting `_fbc` here — on the top document via an HTTP `Set-Cookie` header, before any client JS\n * runs — is what Meta officially recommends and the only reliable way to keep the cookie alive for\n * 90 days in Safari: ITP caps JavaScript-set cookies on a fbclid-decorated landing page to 24\n * hours, and a document response is never classified as CNAME/IP cloaking (it is the reference the\n * browser measures cloaking against).\n *\n * Register it as a global request middleware:\n * ```ts\n * // start.ts\n * import { createStart } from '@tanstack/react-start'\n * import { clickIdMiddleware } from '@shware/analytics/tanstack'\n * export const startInstance = createStart(() => ({ requestMiddleware: [clickIdMiddleware] }))\n * ```\n *\n * reference: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/fbp-and-fbc\n */\nexport function createClickIdMiddleware(options: ClickIdMiddlewareOptions = {}) {\n  const { cacheControl = 'private, no-store' } = options;\n\n  return createMiddleware({ type: 'request' }).server(async ({ request, next, handlerType }) => {\n    const result = await next();\n\n    // Skip serverFn RPC responses. 'router' covers SSR document requests *and* custom server\n    // routes (API endpoints) — those also get cookies when the URL carries a click id.\n    if (handlerType !== 'router') return result;\n    if (options.shouldPersist && !options.shouldPersist(request)) return result;\n\n    const { cookies } = resolveClickIdCookies({\n      url: request.url,\n      cookieHeader: request.headers.get('cookie'),\n      domain: options.domain,\n      secure: options.secure,\n      subdomainIndex: options.subdomainIndex,\n      refresh: options.refresh ?? true,\n    });\n\n    if (cookies.length > 0) {\n      for (const header of toSetCookieHeaders(cookies)) {\n        result.response.headers.append('set-cookie', header);\n      }\n      if (cacheControl !== false) {\n        result.response.headers.set('cache-control', cacheControl);\n      }\n    }\n\n    return result;\n  });\n}\n\n/** Ready-to-register middleware with default options. */\nexport const clickIdMiddleware = createClickIdMiddleware();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,wBAAwB,UAAoC,CAAC,GAAG;CAC9E,MAAM,EAAE,eAAe,wBAAwB;CAE/C,QAAA,GAAA,sBAAA,iBAAA,CAAwB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,SAAS,MAAM,kBAAkB;EAC5F,MAAM,SAAS,MAAM,KAAK;EAI1B,IAAI,gBAAgB,UAAU,OAAO;EACrC,IAAI,QAAQ,iBAAiB,CAAC,QAAQ,cAAc,OAAO,GAAG,OAAO;EAErE,MAAM,EAAE,YAAYA,uBAAAA,sBAAsB;GACxC,KAAK,QAAQ;GACb,cAAc,QAAQ,QAAQ,IAAI,QAAQ;GAC1C,QAAQ,QAAQ;GAChB,QAAQ,QAAQ;GAChB,gBAAgB,QAAQ;GACxB,SAAS,QAAQ,WAAW;EAC9B,CAAC;EAED,IAAI,QAAQ,SAAS,GAAG;GACtB,KAAK,MAAM,UAAUC,uBAAAA,mBAAmB,OAAO,GAC7C,OAAO,SAAS,QAAQ,OAAO,cAAc,MAAM;GAErD,IAAI,iBAAiB,OACnB,OAAO,SAAS,QAAQ,IAAI,iBAAiB,YAAY;EAE7D;EAEA,OAAO;CACT,CAAC;AACH;;AAGA,MAAa,oBAAoB,wBAAwB"}
+{"version":3,"file":"middleware.cjs","names":["createMiddleware","resolveClickIdCookies","toSetCookieHeaders"],"sources":["../../src/tanstack/middleware.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start';\nimport { resolveClickIdCookies, toSetCookieHeaders } from '../click-id/index';\n\nexport interface ClickIdMiddlewareOptions {\n  /** `Domain` attribute for the cookies, e.g. `.shware.io`. Omit for a host-only cookie. */\n  domain?: string;\n  /** `Secure` attribute, default true. Set false only for local http testing. */\n  secure?: boolean;\n  /** subdomainIndex for a freshly built `_fbc` (com=0, example.com=1, www.example.com=2). Default 1. */\n  subdomainIndex?: number;\n  /**\n   * Re-issue a still-valid `_fbc` on every request as an ITP self-heal (restores the long-lived\n   * HTTP cookie if the Meta Pixel's `document.cookie` write re-capped it to 24h in Safari). On by\n   * default. Note it attaches a per-user `Set-Cookie` — and thus `no-store` — to every page\n   * response carrying an `_fbc`, defeating CDN caching of those pages; set false to strictly follow\n   * Meta's conditional-write rule and keep them cacheable. See {@link resolveClickIdCookies}.\n   */\n  refresh?: boolean;\n  /**\n   * Override the `Cache-Control` of a response we attach cookies to (default `private, no-store`).\n   * A per-user `Set-Cookie` must never end up on a shared-cache entry, or one visitor's `_fbc` would\n   * be served to everyone. Only set this false if you guarantee these responses are never cached.\n   */\n  cacheControl?: string | false;\n  /**\n   * Consent gate. Return false to skip setting cookies for this request (e.g. before the visitor has\n   * granted consent where required). Runs per request with the incoming `Request`.\n   */\n  shouldPersist?: (request: Request) => boolean;\n}\n\n/**\n * TanStack Start request middleware that persists ad click-id cookies (`_fbc`, `_gcl_aw`/`_gcl_gb`,\n * `_rdt_cid`, `_uetmsclkid`) on the\n * document response.\n *\n * Setting `_fbc` here — on the top document via an HTTP `Set-Cookie` header, before any client JS\n * runs — is what Meta officially recommends and the only reliable way to keep the cookie alive for\n * 90 days in Safari: ITP caps JavaScript-set cookies on a fbclid-decorated landing page to 24\n * hours, and a document response is never classified as CNAME/IP cloaking (it is the reference the\n * browser measures cloaking against).\n *\n * Register it as a global request middleware:\n * ```ts\n * // start.ts\n * import { createStart } from '@tanstack/react-start'\n * import { clickIdMiddleware } from '@shware/analytics/tanstack'\n * export const startInstance = createStart(() => ({ requestMiddleware: [clickIdMiddleware] }))\n * ```\n *\n * reference: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/fbp-and-fbc\n */\nexport function createClickIdMiddleware(options: ClickIdMiddlewareOptions = {}) {\n  const { cacheControl = 'private, no-store' } = options;\n\n  return createMiddleware({ type: 'request' }).server(async ({ request, next, handlerType }) => {\n    const result = await next();\n\n    // Skip serverFn RPC responses. 'router' covers SSR document requests *and* custom server\n    // routes (API endpoints) — those also get cookies when the URL carries a click id.\n    if (handlerType !== 'router') return result;\n    if (options.shouldPersist && !options.shouldPersist(request)) return result;\n\n    const { cookies } = resolveClickIdCookies({\n      url: request.url,\n      cookieHeader: request.headers.get('cookie'),\n      domain: options.domain,\n      secure: options.secure,\n      subdomainIndex: options.subdomainIndex,\n      refresh: options.refresh ?? true,\n    });\n\n    if (cookies.length > 0) {\n      for (const header of toSetCookieHeaders(cookies)) {\n        result.response.headers.append('set-cookie', header);\n      }\n      if (cacheControl !== false) {\n        result.response.headers.set('cache-control', cacheControl);\n      }\n    }\n\n    return result;\n  });\n}\n\n/** Ready-to-register middleware with default options. */\nexport const clickIdMiddleware = createClickIdMiddleware();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAoDA,SAAgB,wBAAwB,UAAoC,CAAC,GAAG;CAC9E,MAAM,EAAE,eAAe,wBAAwB;CAE/C,QAAA,GAAOA,sBAAAA,iBAAAA,CAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,SAAS,MAAM,kBAAkB;EAC5F,MAAM,SAAS,MAAM,KAAK;EAI1B,IAAI,gBAAgB,UAAU,OAAO;EACrC,IAAI,QAAQ,iBAAiB,CAAC,QAAQ,cAAc,OAAO,GAAG,OAAO;EAErE,MAAM,EAAE,YAAYC,uBAAAA,sBAAsB;GACxC,KAAK,QAAQ;GACb,cAAc,QAAQ,QAAQ,IAAI,QAAQ;GAC1C,QAAQ,QAAQ;GAChB,QAAQ,QAAQ;GAChB,gBAAgB,QAAQ;GACxB,SAAS,QAAQ,WAAW;EAC9B,CAAC;EAED,IAAI,QAAQ,SAAS,GAAG;GACtB,KAAK,MAAM,UAAUC,uBAAAA,mBAAmB,OAAO,GAC7C,OAAO,SAAS,QAAQ,OAAO,cAAc,MAAM;GAErD,IAAI,iBAAiB,OACnB,OAAO,SAAS,QAAQ,IAAI,iBAAiB,YAAY;EAE7D;EAEA,OAAO;CACT,CAAC;AACH;;AAGA,MAAa,oBAAoB,wBAAwB"}

package/dist/tanstack/middleware.d.cts

@@ -27,7 +27,8 @@ interface ClickIdMiddlewareOptions {
   shouldPersist?: (request: Request) => boolean;
 }
 /**
- * TanStack Start request middleware that persists ad click-id cookies (`_fbc`, `_rdt_cid`) on the
+ * TanStack Start request middleware that persists ad click-id cookies (`_fbc`, `_gcl_aw`/`_gcl_gb`,
+ * `_rdt_cid`, `_uetmsclkid`) on the
  * document response.
  *
  * Setting `_fbc` here — on the top document via an HTTP `Set-Cookie` header, before any client JS

package/dist/tanstack/middleware.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.cts","names":[],"sources":["../../src/tanstack/middleware.ts"],"mappings":";UAGiB;;EAEf;;EAEA;;EAEA;;;;;;;;EAQA;;;;;;EAMA;;;;;EAKA,iBAAiB,SAAS;;;;;;;;;;;;;;;;;;;;;;iBAuBZ,wBAAwB,UAAS,2DAA6B;;cAkCjE,mDAAiB"}
+{"version":3,"file":"middleware.d.cts","names":[],"sources":["../../src/tanstack/middleware.ts"],"mappings":";UAGiB;;EAEf;;EAEA;;EAEA;;;;;;;;EAQA;;;;;;EAMA;;;;;EAKA,iBAAiB,SAAS;;;;;;;;;;;;;;;;;;;;;;;iBAwBZ,wBAAwB,UAAS,2DAA6B;;cAkCjE,mDAAiB"}

package/dist/tanstack/middleware.d.mts

@@ -27,7 +27,8 @@ interface ClickIdMiddlewareOptions {
   shouldPersist?: (request: Request) => boolean;
 }
 /**
- * TanStack Start request middleware that persists ad click-id cookies (`_fbc`, `_rdt_cid`) on the
+ * TanStack Start request middleware that persists ad click-id cookies (`_fbc`, `_gcl_aw`/`_gcl_gb`,
+ * `_rdt_cid`, `_uetmsclkid`) on the
  * document response.
  *
  * Setting `_fbc` here — on the top document via an HTTP `Set-Cookie` header, before any client JS

package/dist/tanstack/middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.mts","names":[],"sources":["../../src/tanstack/middleware.ts"],"mappings":";UAGiB;;EAEf;;EAEA;;EAEA;;;;;;;;EAQA;;;;;;EAMA;;;;;EAKA,iBAAiB,SAAS;;;;;;;;;;;;;;;;;;;;;;iBAuBZ,wBAAwB,UAAS,2DAA6B;;cAkCjE,mDAAiB"}
+{"version":3,"file":"middleware.d.mts","names":[],"sources":["../../src/tanstack/middleware.ts"],"mappings":";UAGiB;;EAEf;;EAEA;;EAEA;;;;;;;;EAQA;;;;;;EAMA;;;;;EAKA,iBAAiB,SAAS;;;;;;;;;;;;;;;;;;;;;;;iBAwBZ,wBAAwB,UAAS,2DAA6B;;cAkCjE,mDAAiB"}

package/dist/tanstack/middleware.mjs

@@ -2,7 +2,8 @@ import { resolveClickIdCookies, toSetCookieHeaders } from "../click-id/index.mjs
 import { createMiddleware } from "@tanstack/react-start";
 //#region src/tanstack/middleware.ts
 /**
-* TanStack Start request middleware that persists ad click-id cookies (`_fbc`, `_rdt_cid`) on the
+* TanStack Start request middleware that persists ad click-id cookies (`_fbc`, `_gcl_aw`/`_gcl_gb`,
+* `_rdt_cid`, `_uetmsclkid`) on the
 * document response.
 *
 * Setting `_fbc` here — on the top document via an HTTP `Set-Cookie` header, before any client JS

package/dist/tanstack/middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.mjs","names":[],"sources":["../../src/tanstack/middleware.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start';\nimport { resolveClickIdCookies, toSetCookieHeaders } from '../click-id/index';\n\nexport interface ClickIdMiddlewareOptions {\n  /** `Domain` attribute for the cookies, e.g. `.shware.io`. Omit for a host-only cookie. */\n  domain?: string;\n  /** `Secure` attribute, default true. Set false only for local http testing. */\n  secure?: boolean;\n  /** subdomainIndex for a freshly built `_fbc` (com=0, example.com=1, www.example.com=2). Default 1. */\n  subdomainIndex?: number;\n  /**\n   * Re-issue a still-valid `_fbc` on every request as an ITP self-heal (restores the long-lived\n   * HTTP cookie if the Meta Pixel's `document.cookie` write re-capped it to 24h in Safari). On by\n   * default. Note it attaches a per-user `Set-Cookie` — and thus `no-store` — to every page\n   * response carrying an `_fbc`, defeating CDN caching of those pages; set false to strictly follow\n   * Meta's conditional-write rule and keep them cacheable. See {@link resolveClickIdCookies}.\n   */\n  refresh?: boolean;\n  /**\n   * Override the `Cache-Control` of a response we attach cookies to (default `private, no-store`).\n   * A per-user `Set-Cookie` must never end up on a shared-cache entry, or one visitor's `_fbc` would\n   * be served to everyone. Only set this false if you guarantee these responses are never cached.\n   */\n  cacheControl?: string | false;\n  /**\n   * Consent gate. Return false to skip setting cookies for this request (e.g. before the visitor has\n   * granted consent where required). Runs per request with the incoming `Request`.\n   */\n  shouldPersist?: (request: Request) => boolean;\n}\n\n/**\n * TanStack Start request middleware that persists ad click-id cookies (`_fbc`, `_rdt_cid`) on the\n * document response.\n *\n * Setting `_fbc` here — on the top document via an HTTP `Set-Cookie` header, before any client JS\n * runs — is what Meta officially recommends and the only reliable way to keep the cookie alive for\n * 90 days in Safari: ITP caps JavaScript-set cookies on a fbclid-decorated landing page to 24\n * hours, and a document response is never classified as CNAME/IP cloaking (it is the reference the\n * browser measures cloaking against).\n *\n * Register it as a global request middleware:\n * ```ts\n * // start.ts\n * import { createStart } from '@tanstack/react-start'\n * import { clickIdMiddleware } from '@shware/analytics/tanstack'\n * export const startInstance = createStart(() => ({ requestMiddleware: [clickIdMiddleware] }))\n * ```\n *\n * reference: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/fbp-and-fbc\n */\nexport function createClickIdMiddleware(options: ClickIdMiddlewareOptions = {}) {\n  const { cacheControl = 'private, no-store' } = options;\n\n  return createMiddleware({ type: 'request' }).server(async ({ request, next, handlerType }) => {\n    const result = await next();\n\n    // Skip serverFn RPC responses. 'router' covers SSR document requests *and* custom server\n    // routes (API endpoints) — those also get cookies when the URL carries a click id.\n    if (handlerType !== 'router') return result;\n    if (options.shouldPersist && !options.shouldPersist(request)) return result;\n\n    const { cookies } = resolveClickIdCookies({\n      url: request.url,\n      cookieHeader: request.headers.get('cookie'),\n      domain: options.domain,\n      secure: options.secure,\n      subdomainIndex: options.subdomainIndex,\n      refresh: options.refresh ?? true,\n    });\n\n    if (cookies.length > 0) {\n      for (const header of toSetCookieHeaders(cookies)) {\n        result.response.headers.append('set-cookie', header);\n      }\n      if (cacheControl !== false) {\n        result.response.headers.set('cache-control', cacheControl);\n      }\n    }\n\n    return result;\n  });\n}\n\n/** Ready-to-register middleware with default options. */\nexport const clickIdMiddleware = createClickIdMiddleware();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,wBAAwB,UAAoC,CAAC,GAAG;CAC9E,MAAM,EAAE,eAAe,wBAAwB;CAE/C,OAAO,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,SAAS,MAAM,kBAAkB;EAC5F,MAAM,SAAS,MAAM,KAAK;EAI1B,IAAI,gBAAgB,UAAU,OAAO;EACrC,IAAI,QAAQ,iBAAiB,CAAC,QAAQ,cAAc,OAAO,GAAG,OAAO;EAErE,MAAM,EAAE,YAAY,sBAAsB;GACxC,KAAK,QAAQ;GACb,cAAc,QAAQ,QAAQ,IAAI,QAAQ;GAC1C,QAAQ,QAAQ;GAChB,QAAQ,QAAQ;GAChB,gBAAgB,QAAQ;GACxB,SAAS,QAAQ,WAAW;EAC9B,CAAC;EAED,IAAI,QAAQ,SAAS,GAAG;GACtB,KAAK,MAAM,UAAU,mBAAmB,OAAO,GAC7C,OAAO,SAAS,QAAQ,OAAO,cAAc,MAAM;GAErD,IAAI,iBAAiB,OACnB,OAAO,SAAS,QAAQ,IAAI,iBAAiB,YAAY;EAE7D;EAEA,OAAO;CACT,CAAC;AACH;;AAGA,MAAa,oBAAoB,wBAAwB"}
+{"version":3,"file":"middleware.mjs","names":[],"sources":["../../src/tanstack/middleware.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start';\nimport { resolveClickIdCookies, toSetCookieHeaders } from '../click-id/index';\n\nexport interface ClickIdMiddlewareOptions {\n  /** `Domain` attribute for the cookies, e.g. `.shware.io`. Omit for a host-only cookie. */\n  domain?: string;\n  /** `Secure` attribute, default true. Set false only for local http testing. */\n  secure?: boolean;\n  /** subdomainIndex for a freshly built `_fbc` (com=0, example.com=1, www.example.com=2). Default 1. */\n  subdomainIndex?: number;\n  /**\n   * Re-issue a still-valid `_fbc` on every request as an ITP self-heal (restores the long-lived\n   * HTTP cookie if the Meta Pixel's `document.cookie` write re-capped it to 24h in Safari). On by\n   * default. Note it attaches a per-user `Set-Cookie` — and thus `no-store` — to every page\n   * response carrying an `_fbc`, defeating CDN caching of those pages; set false to strictly follow\n   * Meta's conditional-write rule and keep them cacheable. See {@link resolveClickIdCookies}.\n   */\n  refresh?: boolean;\n  /**\n   * Override the `Cache-Control` of a response we attach cookies to (default `private, no-store`).\n   * A per-user `Set-Cookie` must never end up on a shared-cache entry, or one visitor's `_fbc` would\n   * be served to everyone. Only set this false if you guarantee these responses are never cached.\n   */\n  cacheControl?: string | false;\n  /**\n   * Consent gate. Return false to skip setting cookies for this request (e.g. before the visitor has\n   * granted consent where required). Runs per request with the incoming `Request`.\n   */\n  shouldPersist?: (request: Request) => boolean;\n}\n\n/**\n * TanStack Start request middleware that persists ad click-id cookies (`_fbc`, `_gcl_aw`/`_gcl_gb`,\n * `_rdt_cid`, `_uetmsclkid`) on the\n * document response.\n *\n * Setting `_fbc` here — on the top document via an HTTP `Set-Cookie` header, before any client JS\n * runs — is what Meta officially recommends and the only reliable way to keep the cookie alive for\n * 90 days in Safari: ITP caps JavaScript-set cookies on a fbclid-decorated landing page to 24\n * hours, and a document response is never classified as CNAME/IP cloaking (it is the reference the\n * browser measures cloaking against).\n *\n * Register it as a global request middleware:\n * ```ts\n * // start.ts\n * import { createStart } from '@tanstack/react-start'\n * import { clickIdMiddleware } from '@shware/analytics/tanstack'\n * export const startInstance = createStart(() => ({ requestMiddleware: [clickIdMiddleware] }))\n * ```\n *\n * reference: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/fbp-and-fbc\n */\nexport function createClickIdMiddleware(options: ClickIdMiddlewareOptions = {}) {\n  const { cacheControl = 'private, no-store' } = options;\n\n  return createMiddleware({ type: 'request' }).server(async ({ request, next, handlerType }) => {\n    const result = await next();\n\n    // Skip serverFn RPC responses. 'router' covers SSR document requests *and* custom server\n    // routes (API endpoints) — those also get cookies when the URL carries a click id.\n    if (handlerType !== 'router') return result;\n    if (options.shouldPersist && !options.shouldPersist(request)) return result;\n\n    const { cookies } = resolveClickIdCookies({\n      url: request.url,\n      cookieHeader: request.headers.get('cookie'),\n      domain: options.domain,\n      secure: options.secure,\n      subdomainIndex: options.subdomainIndex,\n      refresh: options.refresh ?? true,\n    });\n\n    if (cookies.length > 0) {\n      for (const header of toSetCookieHeaders(cookies)) {\n        result.response.headers.append('set-cookie', header);\n      }\n      if (cacheControl !== false) {\n        result.response.headers.set('cache-control', cacheControl);\n      }\n    }\n\n    return result;\n  });\n}\n\n/** Ready-to-register middleware with default options. */\nexport const clickIdMiddleware = createClickIdMiddleware();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAoDA,SAAgB,wBAAwB,UAAoC,CAAC,GAAG;CAC9E,MAAM,EAAE,eAAe,wBAAwB;CAE/C,OAAO,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,SAAS,MAAM,kBAAkB;EAC5F,MAAM,SAAS,MAAM,KAAK;EAI1B,IAAI,gBAAgB,UAAU,OAAO;EACrC,IAAI,QAAQ,iBAAiB,CAAC,QAAQ,cAAc,OAAO,GAAG,OAAO;EAErE,MAAM,EAAE,YAAY,sBAAsB;GACxC,KAAK,QAAQ;GACb,cAAc,QAAQ,QAAQ,IAAI,QAAQ;GAC1C,QAAQ,QAAQ;GAChB,QAAQ,QAAQ;GAChB,gBAAgB,QAAQ;GACxB,SAAS,QAAQ,WAAW;EAC9B,CAAC;EAED,IAAI,QAAQ,SAAS,GAAG;GACtB,KAAK,MAAM,UAAU,mBAAmB,OAAO,GAC7C,OAAO,SAAS,QAAQ,OAAO,cAAc,MAAM;GAErD,IAAI,iBAAiB,OACnB,OAAO,SAAS,QAAQ,IAAI,iBAAiB,YAAY;EAE7D;EAEA,OAAO;CACT,CAAC;AACH;;AAGA,MAAa,oBAAoB,wBAAwB"}

package/dist/third-parties/index.cjs

@@ -4,13 +4,18 @@ const require_third_parties_meta_pixel = require("./meta-pixel.cjs");
 const require_third_parties_linkedin_insight_tag = require("./linkedin-insight-tag.cjs");
 const require_third_parties_openai_pixel = require("./openai-pixel.cjs");
 const require_third_parties_reddit_pixel = require("./reddit-pixel.cjs");
+const require_third_parties_microsoft_uet = require("./microsoft-uet.cjs");
 exports.sendFBEvent = require_third_parties_meta_pixel.sendFBEvent;
 exports.sendGAEvent = require_third_parties_google_analytics.sendGAEvent;
 exports.sendLinkedinEvent = require_third_parties_linkedin_insight_tag.sendLinkedinEvent;
 exports.sendOpenAIEvent = require_third_parties_openai_pixel.sendOpenAIEvent;
 exports.sendRedditEvent = require_third_parties_reddit_pixel.sendRedditEvent;
+exports.sendUETEvent = require_third_parties_microsoft_uet.sendUETEvent;
+exports.sendUETIdSync = require_third_parties_microsoft_uet.sendUETIdSync;
 exports.setFBUser = require_third_parties_meta_pixel.setFBUser;
 exports.setGAUser = require_third_parties_google_analytics.setGAUser;
 exports.setLinkedinUser = require_third_parties_linkedin_insight_tag.setLinkedinUser;
 exports.setOpenAIUser = require_third_parties_openai_pixel.setOpenAIUser;
 exports.setRedditUser = require_third_parties_reddit_pixel.setRedditUser;
+exports.setUETConsent = require_third_parties_microsoft_uet.setUETConsent;
+exports.setUETUser = require_third_parties_microsoft_uet.setUETUser;

package/dist/third-parties/index.d.cts

@@ -3,4 +3,6 @@ import { sendFBEvent, setFBUser } from "./meta-pixel.cjs";
 import { LinkedinConversionConfig, sendLinkedinEvent, setLinkedinUser } from "./linkedin-insight-tag.cjs";
 import { sendOpenAIEvent, setOpenAIUser } from "./openai-pixel.cjs";
 import { sendRedditEvent, setRedditUser } from "./reddit-pixel.cjs";
-export { type LinkedinConversionConfig, sendFBEvent, sendGAEvent, sendLinkedinEvent, sendOpenAIEvent, sendRedditEvent, setFBUser, setGAUser, setLinkedinUser, setOpenAIUser, setRedditUser };
+import { UETConsent, UETEventParams, UETItem, UETPageType, UETPid } from "../track/uetq.cjs";
+import { sendUETEvent, sendUETIdSync, setUETConsent, setUETUser } from "./microsoft-uet.cjs";
+export { type LinkedinConversionConfig, type UETConsent, type UETEventParams, type UETItem, type UETPageType, type UETPid, sendFBEvent, sendGAEvent, sendLinkedinEvent, sendOpenAIEvent, sendRedditEvent, sendUETEvent, sendUETIdSync, setFBUser, setGAUser, setLinkedinUser, setOpenAIUser, setRedditUser, setUETConsent, setUETUser };

package/dist/third-parties/index.d.mts

@@ -3,4 +3,6 @@ import { sendFBEvent, setFBUser } from "./meta-pixel.mjs";
 import { LinkedinConversionConfig, sendLinkedinEvent, setLinkedinUser } from "./linkedin-insight-tag.mjs";
 import { sendOpenAIEvent, setOpenAIUser } from "./openai-pixel.mjs";
 import { sendRedditEvent, setRedditUser } from "./reddit-pixel.mjs";
-export { type LinkedinConversionConfig, sendFBEvent, sendGAEvent, sendLinkedinEvent, sendOpenAIEvent, sendRedditEvent, setFBUser, setGAUser, setLinkedinUser, setOpenAIUser, setRedditUser };
+import { UETConsent, UETEventParams, UETItem, UETPageType, UETPid } from "../track/uetq.mjs";
+import { sendUETEvent, sendUETIdSync, setUETConsent, setUETUser } from "./microsoft-uet.mjs";
+export { type LinkedinConversionConfig, type UETConsent, type UETEventParams, type UETItem, type UETPageType, type UETPid, sendFBEvent, sendGAEvent, sendLinkedinEvent, sendOpenAIEvent, sendRedditEvent, sendUETEvent, sendUETIdSync, setFBUser, setGAUser, setLinkedinUser, setOpenAIUser, setRedditUser, setUETConsent, setUETUser };

package/dist/third-parties/index.mjs

@@ -3,4 +3,5 @@ import { sendFBEvent, setFBUser } from "./meta-pixel.mjs";
 import { sendLinkedinEvent, setLinkedinUser } from "./linkedin-insight-tag.mjs";
 import { sendOpenAIEvent, setOpenAIUser } from "./openai-pixel.mjs";
 import { sendRedditEvent, setRedditUser } from "./reddit-pixel.mjs";
-export { sendFBEvent, sendGAEvent, sendLinkedinEvent, sendOpenAIEvent, sendRedditEvent, setFBUser, setGAUser, setLinkedinUser, setOpenAIUser, setRedditUser };
+import { sendUETEvent, sendUETIdSync, setUETConsent, setUETUser } from "./microsoft-uet.mjs";
+export { sendFBEvent, sendGAEvent, sendLinkedinEvent, sendOpenAIEvent, sendRedditEvent, sendUETEvent, sendUETIdSync, setFBUser, setGAUser, setLinkedinUser, setOpenAIUser, setRedditUser, setUETConsent, setUETUser };

package/dist/third-parties/microsoft-uet.cjs

@@ -0,0 +1,119 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_utils_field = require("../utils/field.cjs");
+const require_track_uetq = require("../track/uetq.cjs");
+const require_utils_sha256 = require("../utils/sha256.cjs");
+//#region src/third-parties/microsoft-uet.ts
+const metrics = [
+	"CLS",
+	"FCP",
+	"FID",
+	"INP",
+	"LCP",
+	"TTFB"
+];
+/** Drop `undefined` fields: bat.js validates every key it receives, and `undefined` is a value. */
+function clean(value) {
+	return JSON.parse(JSON.stringify(value));
+}
+function isLocal() {
+	return window.location.host.includes("127.0.0.1") || window.location.host.includes("localhost");
+}
+/**
+* Forward an internal track event to the Microsoft Advertising UET tag.
+*
+* `eventId` is reused as UET's `event_id` so the browser event deduplicates against the same
+* conversion sent through the Conversions API (`sendMicrosoftEvents`). The action name is the
+* internal name on both channels — see `mapUETEvent`.
+*
+* `page_view` is not forwarded: bat.js turns that action into its page-load beacon, which the
+* snippet already fires on load and, with `enableAutoSpaTracking: true` (the setting in
+* Microsoft's generated snippet), on every history change — forwarding the SDK's own page views
+* would report each page twice. The tag owns page loads; this tracker owns everything else.
+*/
+function sendUETEvent(name, properties, eventId) {
+	if (typeof window === "undefined" || !window.uetq) {
+		console.warn("uetq has not been initialized");
+		return;
+	}
+	if (metrics.includes(name) || name === "page_view") return;
+	if (isLocal()) return;
+	const [action, params] = require_track_uetq.mapUETEvent(name, properties, eventId);
+	window.uetq.push("event", action, clean(params));
+}
+/**
+* Enhanced conversions: hand the tag the visitor's email and phone so Microsoft can match a
+* conversion to an ad click without a third-party cookie. A `set` applies to every event fired
+* from the page afterwards, `pageLoad` included, and the tag fires a `pid` beacon on its own
+* when the page load already went out. Values are sent raw — the tag normalizes and SHA-256
+* hashes them in the browser (bat.js `validatePid`) before anything leaves the page.
+*
+* No tag id parameter: unlike the Meta/Reddit pixels, UET is bound to its tag by the snippet
+* and `set` addresses whichever tag drains `uetq`.
+*/
+function setUETUser() {
+	return ({ user_data }) => {
+		if (typeof window === "undefined" || !window.uetq) {
+			console.warn("uetq has not been initialized");
+			return;
+		}
+		const em = require_utils_field.getFirst(user_data?.email);
+		const ph = require_utils_field.getFirst(user_data?.phone_number);
+		if (!em && !ph) return;
+		window.uetq.push("set", { pid: clean({
+			em,
+			ph
+		}) });
+	};
+}
+/**
+* UET consent mode. Push `default` before the tag loads (the tag processes `consent` early, ahead
+* of the queued events) and `update` when the visitor decides. With `ad_storage: 'denied'` the
+* tag neither writes its cookies nor reads the `msclkid` from the URL.
+* https://help.ads.microsoft.com/#apex/ads/en/60119/1
+*/
+function setUETConsent(mode, consent) {
+	if (typeof window === "undefined") return;
+	window.uetq ??= [];
+	window.uetq.push("consent", mode, consent);
+}
+/**
+* The Conversions API's client-side ID Sync pixel: ties the visitor id sent server-side as
+* `anonymousId` to Microsoft's own identifier, so server events can be attributed across
+* contexts (view-through, audiences). Microsoft requires it for remarketing built from CAPI
+* events and recommends it for measurement quality; fire it at least once per session, ideally
+* on the first page view. A pixel rather than a fetch on purpose: Microsoft must observe the
+* browser context of the sync, which a server-side call cannot carry.
+*
+* `customerId` is the Microsoft Advertising customer id (`cid` in the UI's URLs) — not the UET
+* tag id. `visitorId` is the SDK visitor id (`getVisitor().id`), which is what
+* `sendMicrosoftEvents` sends as `anonymousId`; Microsoft requires the two to be equal.
+* `userId` is the raw signed-in user id: it is SHA-256 hashed here, exactly as the server sender
+* hashes it into `externalId`, so the pair matches as well. Hashing is asynchronous, so the
+* pixel fires once the digest resolves; where SubtleCrypto is unavailable (an insecure context)
+* the pixel goes out without `UID` rather than with a raw id.
+* https://learn.microsoft.com/en-us/advertising/guides/uet-conversion-api-integration#id-sync-and-why-it-matters
+*/
+function sendUETIdSync(options) {
+	if (typeof window === "undefined" || typeof Image === "undefined") return;
+	if (isLocal()) return;
+	const fire = (uid) => {
+		const params = new URLSearchParams({
+			Red3: `BACID_${options.customerId}`,
+			VID: options.visitorId
+		});
+		if (uid) params.set("UID", uid);
+		new Image().src = `https://c.bing.com/c.gif?${params.toString()}`;
+	};
+	if (!options.userId) {
+		fire();
+		return;
+	}
+	require_utils_sha256.sha256(options.userId).then(fire, () => fire());
+}
+//#endregion
+exports.sendUETEvent = sendUETEvent;
+exports.sendUETIdSync = sendUETIdSync;
+exports.setUETConsent = setUETConsent;
+exports.setUETUser = setUETUser;
+
+//# sourceMappingURL=microsoft-uet.cjs.map

package/dist/third-parties/microsoft-uet.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"microsoft-uet.cjs","names":["mapUETEvent","getFirst"],"sources":["../../src/third-parties/microsoft-uet.ts"],"sourcesContent":["import type { UpdateVisitorDTO } from '../schema/index';\nimport type { EventName, TrackName, TrackProperties } from '../track/types';\nimport { type UETConsent, type UETQ, mapUETEvent } from '../track/uetq';\nimport { getFirst } from '../utils/field';\nimport { sha256 } from '../utils/sha256';\n\ndeclare global {\n  interface Window {\n    /**\n     * Defined by the UET snippet before `bat.js` loads (as a plain array), so pushes made early\n     * are queued rather than lost. Undefined only where the snippet was never installed.\n     */\n    uetq?: UETQ;\n  }\n}\n\nconst metrics = ['CLS', 'FCP', 'FID', 'INP', 'LCP', 'TTFB'];\n\n/** Drop `undefined` fields: bat.js validates every key it receives, and `undefined` is a value. */\n// oxlint-disable-next-line @typescript-eslint/no-explicit-any\nfunction clean(value: unknown): any {\n  return JSON.parse(JSON.stringify(value));\n}\n\nfunction isLocal(): boolean {\n  return window.location.host.includes('127.0.0.1') || window.location.host.includes('localhost');\n}\n\n/**\n * Forward an internal track event to the Microsoft Advertising UET tag.\n *\n * `eventId` is reused as UET's `event_id` so the browser event deduplicates against the same\n * conversion sent through the Conversions API (`sendMicrosoftEvents`). The action name is the\n * internal name on both channels — see `mapUETEvent`.\n *\n * `page_view` is not forwarded: bat.js turns that action into its page-load beacon, which the\n * snippet already fires on load and, with `enableAutoSpaTracking: true` (the setting in\n * Microsoft's generated snippet), on every history change — forwarding the SDK's own page views\n * would report each page twice. The tag owns page loads; this tracker owns everything else.\n */\nexport function sendUETEvent<T extends EventName>(\n  name: TrackName<T>,\n  properties?: TrackProperties<T>,\n  eventId?: string\n) {\n  if (typeof window === 'undefined' || !window.uetq) {\n    console.warn('uetq has not been initialized');\n    return;\n  }\n  if (metrics.includes(name) || name === 'page_view') return;\n  if (isLocal()) return;\n\n  const [action, params] = mapUETEvent(name, properties, eventId);\n  window.uetq.push('event', action, clean(params));\n}\n\n/**\n * Enhanced conversions: hand the tag the visitor's email and phone so Microsoft can match a\n * conversion to an ad click without a third-party cookie. A `set` applies to every event fired\n * from the page afterwards, `pageLoad` included, and the tag fires a `pid` beacon on its own\n * when the page load already went out. Values are sent raw — the tag normalizes and SHA-256\n * hashes them in the browser (bat.js `validatePid`) before anything leaves the page.\n *\n * No tag id parameter: unlike the Meta/Reddit pixels, UET is bound to its tag by the snippet\n * and `set` addresses whichever tag drains `uetq`.\n */\nexport function setUETUser() {\n  return ({ user_data }: UpdateVisitorDTO) => {\n    if (typeof window === 'undefined' || !window.uetq) {\n      console.warn('uetq has not been initialized');\n      return;\n    }\n\n    const em = getFirst(user_data?.email);\n    const ph = getFirst(user_data?.phone_number);\n    if (!em && !ph) return;\n\n    window.uetq.push('set', { pid: clean({ em, ph }) });\n  };\n}\n\n/**\n * UET consent mode. Push `default` before the tag loads (the tag processes `consent` early, ahead\n * of the queued events) and `update` when the visitor decides. With `ad_storage: 'denied'` the\n * tag neither writes its cookies nor reads the `msclkid` from the URL.\n * https://help.ads.microsoft.com/#apex/ads/en/60119/1\n */\nexport function setUETConsent(mode: 'default' | 'update', consent: UETConsent) {\n  if (typeof window === 'undefined') return;\n  window.uetq ??= [] as unknown as UETQ;\n  window.uetq.push('consent', mode, consent);\n}\n\n/**\n * The Conversions API's client-side ID Sync pixel: ties the visitor id sent server-side as\n * `anonymousId` to Microsoft's own identifier, so server events can be attributed across\n * contexts (view-through, audiences). Microsoft requires it for remarketing built from CAPI\n * events and recommends it for measurement quality; fire it at least once per session, ideally\n * on the first page view. A pixel rather than a fetch on purpose: Microsoft must observe the\n * browser context of the sync, which a server-side call cannot carry.\n *\n * `customerId` is the Microsoft Advertising customer id (`cid` in the UI's URLs) — not the UET\n * tag id. `visitorId` is the SDK visitor id (`getVisitor().id`), which is what\n * `sendMicrosoftEvents` sends as `anonymousId`; Microsoft requires the two to be equal.\n * `userId` is the raw signed-in user id: it is SHA-256 hashed here, exactly as the server sender\n * hashes it into `externalId`, so the pair matches as well. Hashing is asynchronous, so the\n * pixel fires once the digest resolves; where SubtleCrypto is unavailable (an insecure context)\n * the pixel goes out without `UID` rather than with a raw id.\n * https://learn.microsoft.com/en-us/advertising/guides/uet-conversion-api-integration#id-sync-and-why-it-matters\n */\nexport function sendUETIdSync(options: {\n  customerId: string | number;\n  visitorId: string;\n  /** The signed-in user's id, raw; hashed before it leaves the page. */\n  userId?: string;\n}) {\n  if (typeof window === 'undefined' || typeof Image === 'undefined') return;\n  if (isLocal()) return;\n\n  const fire = (uid?: string) => {\n    const params = new URLSearchParams({\n      Red3: `BACID_${options.customerId}`,\n      VID: options.visitorId,\n    });\n    if (uid) params.set('UID', uid);\n    new Image().src = `https://c.bing.com/c.gif?${params.toString()}`;\n  };\n\n  if (!options.userId) {\n    fire();\n    return;\n  }\n  sha256(options.userId).then(fire, () => fire());\n}\n"],"mappings":";;;;;AAgBA,MAAM,UAAU;CAAC;CAAO;CAAO;CAAO;CAAO;CAAO;AAAM;;AAI1D,SAAS,MAAM,OAAqB;CAClC,OAAO,KAAK,MAAM,KAAK,UAAU,KAAK,CAAC;AACzC;AAEA,SAAS,UAAmB;CAC1B,OAAO,OAAO,SAAS,KAAK,SAAS,WAAW,KAAK,OAAO,SAAS,KAAK,SAAS,WAAW;AAChG;;;;;;;;;;;;;AAcA,SAAgB,aACd,MACA,YACA,SACA;CACA,IAAI,OAAO,WAAW,eAAe,CAAC,OAAO,MAAM;EACjD,QAAQ,KAAK,+BAA+B;EAC5C;CACF;CACA,IAAI,QAAQ,SAAS,IAAI,KAAK,SAAS,aAAa;CACpD,IAAI,QAAQ,GAAG;CAEf,MAAM,CAAC,QAAQ,UAAUA,mBAAAA,YAAY,MAAM,YAAY,OAAO;CAC9D,OAAO,KAAK,KAAK,SAAS,QAAQ,MAAM,MAAM,CAAC;AACjD;;;;;;;;;;;AAYA,SAAgB,aAAa;CAC3B,QAAQ,EAAE,gBAAkC;EAC1C,IAAI,OAAO,WAAW,eAAe,CAAC,OAAO,MAAM;GACjD,QAAQ,KAAK,+BAA+B;GAC5C;EACF;EAEA,MAAM,KAAKC,oBAAAA,SAAS,WAAW,KAAK;EACpC,MAAM,KAAKA,oBAAAA,SAAS,WAAW,YAAY;EAC3C,IAAI,CAAC,MAAM,CAAC,IAAI;EAEhB,OAAO,KAAK,KAAK,OAAO,EAAE,KAAK,MAAM;GAAE;GAAI;EAAG,CAAC,EAAE,CAAC;CACpD;AACF;;;;;;;AAQA,SAAgB,cAAc,MAA4B,SAAqB;CAC7E,IAAI,OAAO,WAAW,aAAa;CACnC,OAAO,SAAS,CAAC;CACjB,OAAO,KAAK,KAAK,WAAW,MAAM,OAAO;AAC3C;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,cAAc,SAK3B;CACD,IAAI,OAAO,WAAW,eAAe,OAAO,UAAU,aAAa;CACnE,IAAI,QAAQ,GAAG;CAEf,MAAM,QAAQ,QAAiB;EAC7B,MAAM,SAAS,IAAI,gBAAgB;GACjC,MAAM,SAAS,QAAQ;GACvB,KAAK,QAAQ;EACf,CAAC;EACD,IAAI,KAAK,OAAO,IAAI,OAAO,GAAG;EAC9B,IAAI,MAAM,CAAC,CAAC,MAAM,4BAA4B,OAAO,SAAS;CAChE;CAEA,IAAI,CAAC,QAAQ,QAAQ;EACnB,KAAK;EACL;CACF;CACA,qBAAA,OAAO,QAAQ,MAAM,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;AAChD"}