@shware/analytics 9.0.1 → 10.0.0

package/dist/server/google-data-manager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"google-data-manager.cjs","names":["createHash","resolveActionSource","googleClickIds","IGNORED_EVENTS","fetch"],"sources":["../../src/server/google-data-manager.ts"],"sourcesContent":["/**\n * Google Ads conversion sender over the Data Manager API (`events:ingest`) — Google's\n * counterpart to Meta's Conversions API, and the mandated successor to the Google Ads API's\n * `UploadClickConversions`, which stopped accepting new adopters on 2026-06-15. Same shape as\n * the other senders here: a pure per-event builder, a never-throws `sendEvents`, credentials\n * in headers and never in a URL or a log line.\n *\n * Google's recommended deployment is *hybrid* (\"boost your tag with additional data sources\"):\n * this upload attaches to the SAME conversion action the gtag tag reports to, matched by\n * `transactionId` — a matched pair collapses into one conversion with the server data winning,\n * an unmatched upload is a recovered conversion. Both channels here are fed from the same\n * `track()` call, so the ids agree by construction. `transactionId` is therefore required in\n * that mode; this sender always sends one (the event id when there is no natural order id).\n *\n * Auth is a plain OAuth2 access token with the `datamanager` scope — no Google Ads developer\n * token, no API Center approval. The caller exchanges its stored refresh token for the access\n * token (one POST to oauth2.googleapis.com) and refreshes it however it likes; this module\n * stays out of the OAuth business, exactly as it stays out of Meta's.\n *\n * https://developers.google.com/data-manager/api/reference/rest/v1/events/ingest\n * https://developers.google.com/data-manager/api/devguides/events/google-ads/offline/upgrade/field-mappings\n * https://support.google.com/google-ads/answer/16542291 (hybrid: \"boost your tag with\n * additional data sources\" — the transaction-id matching contract this sender relies on)\n */\nimport { createHash } from 'node:crypto';\nimport { fetch } from '@shware/utils';\nimport { IGNORED_EVENTS } from '../third-parties/ignored-events';\nimport type { TrackEvent, UserProvidedData } from '../track/types';\nimport { resolveActionSource } from './action-source';\nimport { googleClickIds } from './click-ids';\n\nconst ENDPOINT = 'https://datamanager.googleapis.com/v1/events:ingest';\n\n/**\n * Event name → conversion action id, mirroring `LinkedinConversionConfig`: only configured\n * events upload, everything else is skipped silently. In the hybrid setup this is the id of\n * the SAME conversion action the gtag tag reports to.\n */\nexport type GoogleAdsConversionConfig = Record<Lowercase<string>, number | string>;\n\nexport interface GoogleAdsAuth {\n  /** OAuth2 access token with the `datamanager` scope. Short-lived; the caller refreshes it. */\n  accessToken: string;\n  /** The Google Ads account the conversion actions live in. Dashes are tolerated: '123-456-7890'. */\n  operatingAccountId: string;\n  /** The manager account the OAuth user accesses through, when access is delegated. */\n  loginAccountId?: string;\n}\n\n/**\n * EEA/UK/CH consent, applied request-wide. Google drops EEA conversions without granted\n * `adUserData` from bidding, so a host with consent signals should pass them.\n */\nexport interface GoogleAdsConsent {\n  adUserData?: 'CONSENT_GRANTED' | 'CONSENT_DENIED' | 'CONSENT_STATUS_UNSPECIFIED';\n  adPersonalization?: 'CONSENT_GRANTED' | 'CONSENT_DENIED' | 'CONSENT_STATUS_UNSPECIFIED';\n}\n\nexport interface GoogleAdsConversionsOptions {\n  /** Validates the payload server-side without recording conversions. */\n  validateOnly?: boolean;\n  consent?: GoogleAdsConsent;\n}\n\n/**\n * Google's email normalization is Meta's minus one wrinkle: for @gmail.com/@googlemail.com the\n * username's dots and everything from '+' on are removed; for every other domain they are kept.\n * https://developers.google.com/data-manager/api/devguides/format-data\n */\nexport function normalizeEmail(input: string): string {\n  const email = input.trim().toLowerCase();\n  const at = email.lastIndexOf('@');\n  if (at === -1) return email;\n  let username = email.slice(0, at);\n  const domain = email.slice(at + 1);\n  if (domain === 'gmail.com' || domain === 'googlemail.com') {\n    username = username.replace(/\\./g, '').split('+', 1)[0] ?? '';\n  }\n  return `${username}@${domain}`;\n}\n\nconst sha256 = (value: string) => createHash('sha256').update(value).digest('hex');\n\nfunction normalizeCurrency(input: unknown): string {\n  if (typeof input !== 'string') return 'USD';\n  const currency = input.trim().toUpperCase();\n  return /^[A-Z]{3}$/.test(currency) ? currency : 'USD';\n}\n\n/** At most 10 userIdentifiers per event, per the API's hard limit. */\nconst MAX_USER_IDENTIFIERS = 10;\n\n/** Hashes are hex strings, declared by `encoding: 'HEX'` on the request. */\nfunction getUserIdentifiers(data: UserProvidedData): Record<string, string>[] {\n  const identifiers: Record<string, string>[] = [];\n  const emails = Array.isArray(data.email) ? data.email : data.email ? [data.email] : [];\n  for (const email of emails) {\n    identifiers.push({ emailAddress: sha256(normalizeEmail(email)) });\n  }\n  const phones = Array.isArray(data.phone_number)\n    ? data.phone_number\n    : data.phone_number\n      ? [data.phone_number]\n      : [];\n  for (const phone of phones) {\n    // Phones are already E.164 by the schema ('+' then digits); hash after a defensive trim.\n    identifiers.push({ phoneNumber: sha256(phone.trim()) });\n  }\n  return identifiers.slice(0, MAX_USER_IDENTIFIERS);\n}\n\n/** One entry of the `events` array. Field names are the REST (camelCase) spellings. */\nexport interface DataManagerEvent {\n  destinationReferences: string[];\n  transactionId: string;\n  /** RFC 3339 — `created_at` as stored, unlike the legacy API's bespoke format. */\n  eventTimestamp: string;\n  eventSource: 'WEB' | 'APP' | 'OTHER';\n  conversionValue: number;\n  currency: string;\n  adIdentifiers?: { gclid?: string; gbraid?: string; wbraid?: string };\n  userData?: { userIdentifiers: Record<string, string>[] };\n}\n\n/**\n * Builds one Event, or undefined when no conversion action is configured for the event's name.\n * At most one click identifier is sent, gclid first: it is the deterministic per-click id,\n * where gbraid/wbraid are the aggregate iOS ones, and Google documents preferring it. Unlike\n * the legacy upload, an event with no click id at all is still worth sending when it carries\n * user identifiers — that is the enhanced-conversions match path.\n */\nexport function getDataManagerEvent(\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  event: TrackEvent<any>,\n  config: GoogleAdsConversionConfig,\n  data: UserProvidedData = {}\n): DataManagerEvent | undefined {\n  const action = config[event.name as Lowercase<string>];\n  if (!action) return undefined;\n\n  const source = resolveActionSource(event.platform);\n  const dmEvent: DataManagerEvent = {\n    destinationReferences: [String(action)],\n    // The hybrid-mode match key against the gtag tag's transaction_id: same track() call feeds\n    // both channels, so they agree by construction for purchase-shaped events. The event id\n    // covers conversions with no natural order id — but the gtag tracker only sends a\n    // transaction_id when the properties carry one, so on a HYBRID action a non-purchase event\n    // reported by both channels never matches and counts twice. Attach such events to a\n    // standalone (API-only) conversion action instead.\n    transactionId:\n      typeof event.properties?.transaction_id === 'string'\n        ? event.properties.transaction_id\n        : event.id,\n    eventTimestamp: new Date(event.created_at).toISOString(),\n    eventSource: source === 'app' ? 'APP' : source === 'web' ? 'WEB' : 'OTHER',\n    // Both mandatory, like the LinkedIn sender's defaults: 0 USD is Google's own convention\n    // for value-less goals. The API has no partial-failure mode, so a malformed currency would\n    // cost the whole batch — anything that isn't a 3-letter code falls back instead.\n    conversionValue: typeof event.properties?.value === 'number' ? event.properties.value : 0,\n    currency: normalizeCurrency(event.properties?.currency),\n  };\n\n  const { gclid, gbraid, wbraid } = googleClickIds(event.tags);\n  if (gclid) dmEvent.adIdentifiers = { gclid };\n  else if (gbraid) dmEvent.adIdentifiers = { gbraid };\n  else if (wbraid) dmEvent.adIdentifiers = { wbraid };\n\n  const userIdentifiers = getUserIdentifiers(data);\n  if (userIdentifiers.length > 0) dmEvent.userData = { userIdentifiers };\n\n  // With neither a click id nor an identifier Google has nothing to match on; skip.\n  if (!dmEvent.adIdentifiers && !dmEvent.userData) return undefined;\n\n  return dmEvent;\n}\n\nexport interface DataManagerResponse {\n  requestId?: string;\n}\n\n/** The API takes at most 2000 events per request. */\nconst MAX_EVENTS_PER_REQUEST = 2000;\n\n/**\n * Uploads the configured conversions from a batch of events. Never throws: an unusable event\n * is skipped and a failed request is logged and swallowed, like every other sender here. The\n * Data Manager API has no partial-failure mode — a rejected request costs the whole batch, so\n * the builder is strict about only emitting events the API can accept. A batch beyond the\n * 2000-event request cap goes out as sequential requests; the first response is returned.\n */\nexport async function sendEvents(\n  auth: GoogleAdsAuth,\n  config: GoogleAdsConversionConfig,\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  events: TrackEvent<any>[],\n  data: UserProvidedData = {},\n  options: GoogleAdsConversionsOptions = {}\n): Promise<DataManagerResponse | undefined> {\n  const dmEvents = events\n    .filter((event) => !IGNORED_EVENTS.includes(event.name))\n    .map((event) => getDataManagerEvent(event, config, data))\n    .filter((dmEvent): dmEvent is DataManagerEvent => dmEvent !== undefined);\n  if (dmEvents.length === 0) return undefined;\n\n  const operatingAccount = {\n    accountType: 'GOOGLE_ADS',\n    accountId: auth.operatingAccountId.replace(/-/g, ''),\n  };\n  // One destination per conversion action present in the batch; each event points at its own\n  // through destinationReferences, so mixed-action batches go out as one request.\n  const loginAccount = auth.loginAccountId\n    ? { accountType: 'GOOGLE_ADS', accountId: auth.loginAccountId.replace(/-/g, '') }\n    : undefined;\n  const actions = Array.from(new Set(dmEvents.flatMap((dmEvent) => dmEvent.destinationReferences)));\n  const destinations = actions.map((action) => {\n    const destination: Record<string, unknown> = {\n      reference: action,\n      operatingAccount,\n      productDestinationId: action,\n    };\n    if (loginAccount) destination.loginAccount = loginAccount;\n    return destination;\n  });\n\n  let firstResponse: DataManagerResponse | undefined;\n  for (let offset = 0; offset < dmEvents.length; offset += MAX_EVENTS_PER_REQUEST) {\n    const chunk = dmEvents.slice(offset, offset + MAX_EVENTS_PER_REQUEST);\n    const body: Record<string, unknown> = {\n      destinations,\n      events: chunk,\n      validateOnly: options.validateOnly ?? false,\n    };\n    if (chunk.some((dmEvent) => dmEvent.userData)) {\n      body.encoding = 'HEX';\n    }\n    if (options.consent) {\n      body.consent = options.consent;\n    }\n\n    try {\n      const response = await fetch(ENDPOINT, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          Accept: 'application/json',\n          Authorization: `Bearer ${auth.accessToken}`,\n        },\n        body: JSON.stringify(body),\n      });\n      if (response.ok) {\n        firstResponse ??= (await response.json()) as DataManagerResponse;\n        continue;\n      }\n      const { status } = response;\n      const message = await response.text();\n      console.error(`Failed to send Google Ads conversions, status: ${status}, body: ${message}`);\n    } catch (error) {\n      const message = error instanceof Error ? error.message : String(error);\n      console.error(`Failed to send Google Ads conversions, network error: ${message}`);\n    }\n  }\n  return firstResponse;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,MAAM,WAAW;;;;;;AAsCjB,SAAgB,eAAe,OAAuB;CACpD,MAAM,QAAQ,MAAM,KAAK,CAAC,CAAC,YAAY;CACvC,MAAM,KAAK,MAAM,YAAY,GAAG;CAChC,IAAI,OAAO,IAAI,OAAO;CACtB,IAAI,WAAW,MAAM,MAAM,GAAG,EAAE;CAChC,MAAM,SAAS,MAAM,MAAM,KAAK,CAAC;CACjC,IAAI,WAAW,eAAe,WAAW,kBACvC,WAAW,SAAS,QAAQ,OAAO,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM;CAE7D,OAAO,GAAG,SAAS,GAAG;AACxB;AAEA,MAAM,UAAU,WAAA,GAAkBA,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AAEjF,SAAS,kBAAkB,OAAwB;CACjD,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,MAAM,WAAW,MAAM,KAAK,CAAC,CAAC,YAAY;CAC1C,OAAO,aAAa,KAAK,QAAQ,IAAI,WAAW;AAClD;;AAGA,MAAM,uBAAuB;;AAG7B,SAAS,mBAAmB,MAAkD;CAC5E,MAAM,cAAwC,CAAC;CAC/C,MAAM,SAAS,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC;CACrF,KAAK,MAAM,SAAS,QAClB,YAAY,KAAK,EAAE,cAAc,OAAO,eAAe,KAAK,CAAC,EAAE,CAAC;CAElE,MAAM,SAAS,MAAM,QAAQ,KAAK,YAAY,IAC1C,KAAK,eACL,KAAK,eACH,CAAC,KAAK,YAAY,IAClB,CAAC;CACP,KAAK,MAAM,SAAS,QAElB,YAAY,KAAK,EAAE,aAAa,OAAO,MAAM,KAAK,CAAC,EAAE,CAAC;CAExD,OAAO,YAAY,MAAM,GAAG,oBAAoB;AAClD;;;;;;;;AAsBA,SAAgB,oBAEd,OACA,QACA,OAAyB,CAAC,GACI;CAC9B,MAAM,SAAS,OAAO,MAAM;CAC5B,IAAI,CAAC,QAAQ,OAAO,KAAA;CAEpB,MAAM,SAASC,6BAAAA,oBAAoB,MAAM,QAAQ;CACjD,MAAM,UAA4B;EAChC,uBAAuB,CAAC,OAAO,MAAM,CAAC;EAOtC,eACE,OAAO,MAAM,YAAY,mBAAmB,WACxC,MAAM,WAAW,iBACjB,MAAM;EACZ,gBAAgB,IAAI,KAAK,MAAM,UAAU,CAAC,CAAC,YAAY;EACvD,aAAa,WAAW,QAAQ,QAAQ,WAAW,QAAQ,QAAQ;EAInE,iBAAiB,OAAO,MAAM,YAAY,UAAU,WAAW,MAAM,WAAW,QAAQ;EACxF,UAAU,kBAAkB,MAAM,YAAY,QAAQ;CACxD;CAEA,MAAM,EAAE,OAAO,QAAQ,WAAWC,yBAAAA,eAAe,MAAM,IAAI;CAC3D,IAAI,OAAO,QAAQ,gBAAgB,EAAE,MAAM;MACtC,IAAI,QAAQ,QAAQ,gBAAgB,EAAE,OAAO;MAC7C,IAAI,QAAQ,QAAQ,gBAAgB,EAAE,OAAO;CAElD,MAAM,kBAAkB,mBAAmB,IAAI;CAC/C,IAAI,gBAAgB,SAAS,GAAG,QAAQ,WAAW,EAAE,gBAAgB;CAGrE,IAAI,CAAC,QAAQ,iBAAiB,CAAC,QAAQ,UAAU,OAAO,KAAA;CAExD,OAAO;AACT;;AAOA,MAAM,yBAAyB;;;;;;;;AAS/B,eAAsB,WACpB,MACA,QAEA,QACA,OAAyB,CAAC,GAC1B,UAAuC,CAAC,GACE;CAC1C,MAAM,WAAW,OACd,QAAQ,UAAU,CAACC,qCAAAA,eAAe,SAAS,MAAM,IAAI,CAAC,CAAC,CACvD,KAAK,UAAU,oBAAoB,OAAO,QAAQ,IAAI,CAAC,CAAC,CACxD,QAAQ,YAAyC,YAAY,KAAA,CAAS;CACzE,IAAI,SAAS,WAAW,GAAG,OAAO,KAAA;CAElC,MAAM,mBAAmB;EACvB,aAAa;EACb,WAAW,KAAK,mBAAmB,QAAQ,MAAM,EAAE;CACrD;CAGA,MAAM,eAAe,KAAK,iBACtB;EAAE,aAAa;EAAc,WAAW,KAAK,eAAe,QAAQ,MAAM,EAAE;CAAE,IAC9E,KAAA;CAEJ,MAAM,eADU,MAAM,KAAK,IAAI,IAAI,SAAS,SAAS,YAAY,QAAQ,qBAAqB,CAAC,CACpE,CAAC,CAAC,KAAK,WAAW;EAC3C,MAAM,cAAuC;GAC3C,WAAW;GACX;GACA,sBAAsB;EACxB;EACA,IAAI,cAAc,YAAY,eAAe;EAC7C,OAAO;CACT,CAAC;CAED,IAAI;CACJ,KAAK,IAAI,SAAS,GAAG,SAAS,SAAS,QAAQ,UAAU,wBAAwB;EAC/E,MAAM,QAAQ,SAAS,MAAM,QAAQ,SAAS,sBAAsB;EACpE,MAAM,OAAgC;GACpC;GACA,QAAQ;GACR,cAAc,QAAQ,gBAAgB;EACxC;EACA,IAAI,MAAM,MAAM,YAAY,QAAQ,QAAQ,GAC1C,KAAK,WAAW;EAElB,IAAI,QAAQ,SACV,KAAK,UAAU,QAAQ;EAGzB,IAAI;GACF,MAAM,WAAW,OAAA,GAAMC,cAAAA,MAAAA,CAAM,UAAU;IACrC,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,QAAQ;KACR,eAAe,UAAU,KAAK;IAChC;IACA,MAAM,KAAK,UAAU,IAAI;GAC3B,CAAC;GACD,IAAI,SAAS,IAAI;IACf,kBAAmB,MAAM,SAAS,KAAK;IACvC;GACF;GACA,MAAM,EAAE,WAAW;GACnB,MAAM,UAAU,MAAM,SAAS,KAAK;GACpC,QAAQ,MAAM,kDAAkD,OAAO,UAAU,SAAS;EAC5F,SAAS,OAAO;GACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACrE,QAAQ,MAAM,yDAAyD,SAAS;EAClF;CACF;CACA,OAAO;AACT"}
+{"version":3,"file":"google-data-manager.cjs","names":["createHash","resolveActionSource","googleClickIds","IGNORED_EVENTS","fetch"],"sources":["../../src/server/google-data-manager.ts"],"sourcesContent":["/**\n * Google Ads conversion sender over the Data Manager API (`events:ingest`) — Google's\n * counterpart to Meta's Conversions API, and the mandated successor to the Google Ads API's\n * `UploadClickConversions`, which stopped accepting new adopters on 2026-06-15. Same shape as\n * the other senders here: a pure per-event builder, a never-throws `sendEvents`, credentials\n * in headers and never in a URL or a log line.\n *\n * Google's recommended deployment is *hybrid* (\"boost your tag with additional data sources\"):\n * this upload attaches to the SAME conversion action the gtag tag reports to, matched by\n * `transactionId` — a matched pair collapses into one conversion with the server data winning,\n * an unmatched upload is a recovered conversion. Both channels here are fed from the same\n * `track()` call, so the ids agree by construction. `transactionId` is therefore required in\n * that mode; this sender always sends one (the event id when there is no natural order id).\n *\n * Auth is a plain OAuth2 access token with the `datamanager` scope — no Google Ads developer\n * token, no API Center approval. The caller exchanges its stored refresh token for the access\n * token (one POST to oauth2.googleapis.com) and refreshes it however it likes; this module\n * stays out of the OAuth business, exactly as it stays out of Meta's.\n *\n * https://developers.google.com/data-manager/api/reference/rest/v1/events/ingest\n * https://developers.google.com/data-manager/api/devguides/events/google-ads/offline/upgrade/field-mappings\n * https://support.google.com/google-ads/answer/16542291 (hybrid: \"boost your tag with\n * additional data sources\" — the transaction-id matching contract this sender relies on)\n */\nimport { createHash } from 'node:crypto';\nimport { fetch } from '@shware/utils';\nimport { IGNORED_EVENTS } from '../third-parties/ignored-events';\nimport type { TrackEvent, UserProvidedData } from '../track/types';\nimport { resolveActionSource } from './action-source';\nimport { googleClickIds } from './click-ids';\n\nconst ENDPOINT = 'https://datamanager.googleapis.com/v1/events:ingest';\n\n/**\n * Event name → conversion action id, mirroring `LinkedinConversionConfig`: only configured\n * events upload, everything else is skipped silently. In the hybrid setup this is the id of\n * the SAME conversion action the gtag tag reports to.\n */\nexport type GoogleAdsConversionConfig = Record<Lowercase<string>, number | string>;\n\nexport interface GoogleAdsAuth {\n  /** OAuth2 access token with the `datamanager` scope. Short-lived; the caller refreshes it. */\n  accessToken: string;\n  /** The Google Ads account the conversion actions live in. Dashes are tolerated: '123-456-7890'. */\n  operatingAccountId: string;\n  /** The manager account the OAuth user accesses through, when access is delegated. */\n  loginAccountId?: string;\n}\n\n/**\n * EEA/UK/CH consent, applied request-wide. Google drops EEA conversions without granted\n * `adUserData` from bidding, so a host with consent signals should pass them.\n */\nexport interface GoogleAdsConsent {\n  adUserData?: 'CONSENT_GRANTED' | 'CONSENT_DENIED' | 'CONSENT_STATUS_UNSPECIFIED';\n  adPersonalization?: 'CONSENT_GRANTED' | 'CONSENT_DENIED' | 'CONSENT_STATUS_UNSPECIFIED';\n}\n\n/**\n * The kind of conversion action the events go to, which decides `eventSource`:\n * - `webpage` (default): the action the gtag tag reports to, as in the hybrid deployment this\n *   module is built for. Its `eventSource` is optional and, when set, \"must be WEB\" — any other\n *   value fails the request, and the request with it. Web events say `WEB`, others say nothing.\n * - `offline`: an action created for uploads (`UPLOAD_CLICKS`), where `eventSource` is required\n *   and any value goes: `WEB`, `APP` or `OTHER` from the event's platform.\n * https://developers.google.com/data-manager/api/devguides/events/google-ads/online/send-events\n */\nexport type GoogleAdsActionType = 'webpage' | 'offline';\n\nexport interface GoogleAdsConversionsOptions {\n  /** Validates the payload server-side without recording conversions. */\n  validateOnly?: boolean;\n  consent?: GoogleAdsConsent;\n  /** The kind of conversion action `config` points at; `webpage` by default. */\n  actionType?: GoogleAdsActionType;\n}\n\n/**\n * Google's email normalization is Meta's minus one wrinkle: for @gmail.com/@googlemail.com the\n * username's dots and everything from '+' on are removed; for every other domain they are kept.\n * https://developers.google.com/data-manager/api/devguides/format-data\n */\nexport function normalizeEmail(input: string): string {\n  const email = input.trim().toLowerCase();\n  const at = email.lastIndexOf('@');\n  if (at === -1) return email;\n  let username = email.slice(0, at);\n  const domain = email.slice(at + 1);\n  if (domain === 'gmail.com' || domain === 'googlemail.com') {\n    username = username.replace(/\\./g, '').split('+', 1)[0] ?? '';\n  }\n  return `${username}@${domain}`;\n}\n\nconst sha256 = (value: string) => createHash('sha256').update(value).digest('hex');\n\nfunction normalizeCurrency(input: unknown): string {\n  if (typeof input !== 'string') return 'USD';\n  const currency = input.trim().toUpperCase();\n  return /^[A-Z]{3}$/.test(currency) ? currency : 'USD';\n}\n\n/** At most 10 userIdentifiers per event, per the API's hard limit. */\nconst MAX_USER_IDENTIFIERS = 10;\n\n/** Hashes are hex strings, declared by `encoding: 'HEX'` on the request. */\nfunction getUserIdentifiers(data: UserProvidedData): Record<string, string>[] {\n  const identifiers: Record<string, string>[] = [];\n  const emails = Array.isArray(data.email) ? data.email : data.email ? [data.email] : [];\n  for (const email of emails) {\n    identifiers.push({ emailAddress: sha256(normalizeEmail(email)) });\n  }\n  const phones = Array.isArray(data.phone_number)\n    ? data.phone_number\n    : data.phone_number\n      ? [data.phone_number]\n      : [];\n  for (const phone of phones) {\n    // Phones are already E.164 by the schema ('+' then digits); hash after a defensive trim.\n    identifiers.push({ phoneNumber: sha256(phone.trim()) });\n  }\n  return identifiers.slice(0, MAX_USER_IDENTIFIERS);\n}\n\n/** One entry of the `events` array. Field names are the REST (camelCase) spellings. */\nexport interface DataManagerEvent {\n  destinationReferences: string[];\n  transactionId: string;\n  /** RFC 3339 — `created_at` as stored, unlike the legacy API's bespoke format. */\n  eventTimestamp: string;\n  /** Absent for a non-web event sent to a `webpage` action, which accepts `WEB` only. */\n  eventSource?: 'WEB' | 'APP' | 'OTHER';\n  conversionValue: number;\n  currency: string;\n  adIdentifiers?: { gclid?: string; gbraid?: string; wbraid?: string };\n  userData?: { userIdentifiers: Record<string, string>[] };\n}\n\n/**\n * Builds one Event, or undefined when no conversion action is configured for the event's name.\n * At most one click identifier is sent, gclid first: it is the deterministic per-click id,\n * where gbraid/wbraid are the aggregate iOS ones, and Google documents preferring it. Unlike\n * the legacy upload, an event with no click id at all is still worth sending when it carries\n * user identifiers — that is the enhanced-conversions match path.\n */\nexport function getDataManagerEvent(\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  event: TrackEvent<any>,\n  config: GoogleAdsConversionConfig,\n  data: UserProvidedData = {},\n  actionType: GoogleAdsActionType = 'webpage'\n): DataManagerEvent | undefined {\n  const action = config[event.name as Lowercase<string>];\n  if (!action) return undefined;\n\n  const source = resolveActionSource(event.platform);\n  const dmEvent: DataManagerEvent = {\n    destinationReferences: [String(action)],\n    // The hybrid-mode match key against the gtag tag's transaction_id: same track() call feeds\n    // both channels, so they agree by construction for purchase-shaped events. The event id\n    // covers conversions with no natural order id — but the gtag tracker only sends a\n    // transaction_id when the properties carry one, so on a HYBRID action a non-purchase event\n    // reported by both channels never matches and counts twice. Attach such events to a\n    // standalone (API-only) conversion action instead.\n    transactionId:\n      typeof event.properties?.transaction_id === 'string'\n        ? event.properties.transaction_id\n        : event.id,\n    eventTimestamp: new Date(event.created_at).toISOString(),\n    eventSource:\n      source === 'web'\n        ? 'WEB'\n        : actionType === 'webpage'\n          ? undefined\n          : source === 'app'\n            ? 'APP'\n            : 'OTHER',\n    // Both mandatory, like the LinkedIn sender's defaults: 0 USD is Google's own convention\n    // for value-less goals. The API has no partial-failure mode, so a malformed currency would\n    // cost the whole batch — anything that isn't a 3-letter code falls back instead.\n    conversionValue: typeof event.properties?.value === 'number' ? event.properties.value : 0,\n    currency: normalizeCurrency(event.properties?.currency),\n  };\n\n  const { gclid, gbraid, wbraid } = googleClickIds(event.tags);\n  if (gclid) dmEvent.adIdentifiers = { gclid };\n  else if (gbraid) dmEvent.adIdentifiers = { gbraid };\n  else if (wbraid) dmEvent.adIdentifiers = { wbraid };\n\n  const userIdentifiers = getUserIdentifiers(data);\n  if (userIdentifiers.length > 0) dmEvent.userData = { userIdentifiers };\n\n  // With neither a click id nor an identifier Google has nothing to match on; skip.\n  if (!dmEvent.adIdentifiers && !dmEvent.userData) return undefined;\n\n  return dmEvent;\n}\n\nexport interface DataManagerResponse {\n  requestId?: string;\n}\n\n/** The API takes at most 2000 events per request. */\nconst MAX_EVENTS_PER_REQUEST = 2000;\n\n/**\n * Uploads the configured conversions from a batch of events. Never throws: an unusable event\n * is skipped and a failed request is logged and swallowed, like every other sender here. The\n * Data Manager API has no partial-failure mode — a rejected request costs the whole batch, so\n * the builder is strict about only emitting events the API can accept. A batch beyond the\n * 2000-event request cap goes out as sequential requests; the first response is returned.\n */\nexport async function sendEvents(\n  auth: GoogleAdsAuth,\n  config: GoogleAdsConversionConfig,\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  events: TrackEvent<any>[],\n  data: UserProvidedData = {},\n  options: GoogleAdsConversionsOptions = {}\n): Promise<DataManagerResponse | undefined> {\n  const dmEvents = events\n    .filter((event) => !IGNORED_EVENTS.includes(event.name))\n    .map((event) => getDataManagerEvent(event, config, data, options.actionType))\n    .filter((dmEvent): dmEvent is DataManagerEvent => dmEvent !== undefined);\n  if (dmEvents.length === 0) return undefined;\n\n  const operatingAccount = {\n    accountType: 'GOOGLE_ADS',\n    accountId: auth.operatingAccountId.replace(/-/g, ''),\n  };\n  // One destination per conversion action present in the batch; each event points at its own\n  // through destinationReferences, so mixed-action batches go out as one request.\n  const loginAccount = auth.loginAccountId\n    ? { accountType: 'GOOGLE_ADS', accountId: auth.loginAccountId.replace(/-/g, '') }\n    : undefined;\n  const actions = Array.from(new Set(dmEvents.flatMap((dmEvent) => dmEvent.destinationReferences)));\n  const destinations = actions.map((action) => {\n    const destination: Record<string, unknown> = {\n      reference: action,\n      operatingAccount,\n      productDestinationId: action,\n    };\n    if (loginAccount) destination.loginAccount = loginAccount;\n    return destination;\n  });\n\n  let firstResponse: DataManagerResponse | undefined;\n  for (let offset = 0; offset < dmEvents.length; offset += MAX_EVENTS_PER_REQUEST) {\n    const chunk = dmEvents.slice(offset, offset + MAX_EVENTS_PER_REQUEST);\n    const body: Record<string, unknown> = {\n      destinations,\n      events: chunk,\n      validateOnly: options.validateOnly ?? false,\n    };\n    if (chunk.some((dmEvent) => dmEvent.userData)) {\n      body.encoding = 'HEX';\n    }\n    if (options.consent) {\n      body.consent = options.consent;\n    }\n\n    try {\n      const response = await fetch(ENDPOINT, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          Accept: 'application/json',\n          Authorization: `Bearer ${auth.accessToken}`,\n        },\n        body: JSON.stringify(body),\n      });\n      if (response.ok) {\n        firstResponse ??= (await response.json()) as DataManagerResponse;\n        continue;\n      }\n      const { status } = response;\n      const message = await response.text();\n      console.error(`Failed to send Google Ads conversions, status: ${status}, body: ${message}`);\n    } catch (error) {\n      const message = error instanceof Error ? error.message : String(error);\n      console.error(`Failed to send Google Ads conversions, network error: ${message}`);\n    }\n  }\n  return firstResponse;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,MAAM,WAAW;;;;;;AAmDjB,SAAgB,eAAe,OAAuB;CACpD,MAAM,QAAQ,MAAM,KAAK,CAAC,CAAC,YAAY;CACvC,MAAM,KAAK,MAAM,YAAY,GAAG;CAChC,IAAI,OAAO,IAAI,OAAO;CACtB,IAAI,WAAW,MAAM,MAAM,GAAG,EAAE;CAChC,MAAM,SAAS,MAAM,MAAM,KAAK,CAAC;CACjC,IAAI,WAAW,eAAe,WAAW,kBACvC,WAAW,SAAS,QAAQ,OAAO,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM;CAE7D,OAAO,GAAG,SAAS,GAAG;AACxB;AAEA,MAAM,UAAU,WAAA,GAAkBA,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AAEjF,SAAS,kBAAkB,OAAwB;CACjD,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,MAAM,WAAW,MAAM,KAAK,CAAC,CAAC,YAAY;CAC1C,OAAO,aAAa,KAAK,QAAQ,IAAI,WAAW;AAClD;;AAGA,MAAM,uBAAuB;;AAG7B,SAAS,mBAAmB,MAAkD;CAC5E,MAAM,cAAwC,CAAC;CAC/C,MAAM,SAAS,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC;CACrF,KAAK,MAAM,SAAS,QAClB,YAAY,KAAK,EAAE,cAAc,OAAO,eAAe,KAAK,CAAC,EAAE,CAAC;CAElE,MAAM,SAAS,MAAM,QAAQ,KAAK,YAAY,IAC1C,KAAK,eACL,KAAK,eACH,CAAC,KAAK,YAAY,IAClB,CAAC;CACP,KAAK,MAAM,SAAS,QAElB,YAAY,KAAK,EAAE,aAAa,OAAO,MAAM,KAAK,CAAC,EAAE,CAAC;CAExD,OAAO,YAAY,MAAM,GAAG,oBAAoB;AAClD;;;;;;;;AAuBA,SAAgB,oBAEd,OACA,QACA,OAAyB,CAAC,GAC1B,aAAkC,WACJ;CAC9B,MAAM,SAAS,OAAO,MAAM;CAC5B,IAAI,CAAC,QAAQ,OAAO,KAAA;CAEpB,MAAM,SAASC,6BAAAA,oBAAoB,MAAM,QAAQ;CACjD,MAAM,UAA4B;EAChC,uBAAuB,CAAC,OAAO,MAAM,CAAC;EAOtC,eACE,OAAO,MAAM,YAAY,mBAAmB,WACxC,MAAM,WAAW,iBACjB,MAAM;EACZ,gBAAgB,IAAI,KAAK,MAAM,UAAU,CAAC,CAAC,YAAY;EACvD,aACE,WAAW,QACP,QACA,eAAe,YACb,KAAA,IACA,WAAW,QACT,QACA;EAIV,iBAAiB,OAAO,MAAM,YAAY,UAAU,WAAW,MAAM,WAAW,QAAQ;EACxF,UAAU,kBAAkB,MAAM,YAAY,QAAQ;CACxD;CAEA,MAAM,EAAE,OAAO,QAAQ,WAAWC,yBAAAA,eAAe,MAAM,IAAI;CAC3D,IAAI,OAAO,QAAQ,gBAAgB,EAAE,MAAM;MACtC,IAAI,QAAQ,QAAQ,gBAAgB,EAAE,OAAO;MAC7C,IAAI,QAAQ,QAAQ,gBAAgB,EAAE,OAAO;CAElD,MAAM,kBAAkB,mBAAmB,IAAI;CAC/C,IAAI,gBAAgB,SAAS,GAAG,QAAQ,WAAW,EAAE,gBAAgB;CAGrE,IAAI,CAAC,QAAQ,iBAAiB,CAAC,QAAQ,UAAU,OAAO,KAAA;CAExD,OAAO;AACT;;AAOA,MAAM,yBAAyB;;;;;;;;AAS/B,eAAsB,WACpB,MACA,QAEA,QACA,OAAyB,CAAC,GAC1B,UAAuC,CAAC,GACE;CAC1C,MAAM,WAAW,OACd,QAAQ,UAAU,CAACC,qCAAAA,eAAe,SAAS,MAAM,IAAI,CAAC,CAAC,CACvD,KAAK,UAAU,oBAAoB,OAAO,QAAQ,MAAM,QAAQ,UAAU,CAAC,CAAC,CAC5E,QAAQ,YAAyC,YAAY,KAAA,CAAS;CACzE,IAAI,SAAS,WAAW,GAAG,OAAO,KAAA;CAElC,MAAM,mBAAmB;EACvB,aAAa;EACb,WAAW,KAAK,mBAAmB,QAAQ,MAAM,EAAE;CACrD;CAGA,MAAM,eAAe,KAAK,iBACtB;EAAE,aAAa;EAAc,WAAW,KAAK,eAAe,QAAQ,MAAM,EAAE;CAAE,IAC9E,KAAA;CAEJ,MAAM,eADU,MAAM,KAAK,IAAI,IAAI,SAAS,SAAS,YAAY,QAAQ,qBAAqB,CAAC,CACpE,CAAC,CAAC,KAAK,WAAW;EAC3C,MAAM,cAAuC;GAC3C,WAAW;GACX;GACA,sBAAsB;EACxB;EACA,IAAI,cAAc,YAAY,eAAe;EAC7C,OAAO;CACT,CAAC;CAED,IAAI;CACJ,KAAK,IAAI,SAAS,GAAG,SAAS,SAAS,QAAQ,UAAU,wBAAwB;EAC/E,MAAM,QAAQ,SAAS,MAAM,QAAQ,SAAS,sBAAsB;EACpE,MAAM,OAAgC;GACpC;GACA,QAAQ;GACR,cAAc,QAAQ,gBAAgB;EACxC;EACA,IAAI,MAAM,MAAM,YAAY,QAAQ,QAAQ,GAC1C,KAAK,WAAW;EAElB,IAAI,QAAQ,SACV,KAAK,UAAU,QAAQ;EAGzB,IAAI;GACF,MAAM,WAAW,OAAA,GAAMC,cAAAA,MAAAA,CAAM,UAAU;IACrC,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,QAAQ;KACR,eAAe,UAAU,KAAK;IAChC;IACA,MAAM,KAAK,UAAU,IAAI;GAC3B,CAAC;GACD,IAAI,SAAS,IAAI;IACf,kBAAmB,MAAM,SAAS,KAAK;IACvC;GACF;GACA,MAAM,EAAE,WAAW;GACnB,MAAM,UAAU,MAAM,SAAS,KAAK;GACpC,QAAQ,MAAM,kDAAkD,OAAO,UAAU,SAAS;EAC5F,SAAS,OAAO;GACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACrE,QAAQ,MAAM,yDAAyD,SAAS;EAClF;CACF;CACA,OAAO;AACT"}

package/dist/server/google-data-manager.d.cts

@@ -22,10 +22,22 @@ export interface GoogleAdsConsent {
   adUserData?: 'CONSENT_GRANTED' | 'CONSENT_DENIED' | 'CONSENT_STATUS_UNSPECIFIED';
   adPersonalization?: 'CONSENT_GRANTED' | 'CONSENT_DENIED' | 'CONSENT_STATUS_UNSPECIFIED';
 }
+/**
+ * The kind of conversion action the events go to, which decides `eventSource`:
+ * - `webpage` (default): the action the gtag tag reports to, as in the hybrid deployment this
+ *   module is built for. Its `eventSource` is optional and, when set, "must be WEB" — any other
+ *   value fails the request, and the request with it. Web events say `WEB`, others say nothing.
+ * - `offline`: an action created for uploads (`UPLOAD_CLICKS`), where `eventSource` is required
+ *   and any value goes: `WEB`, `APP` or `OTHER` from the event's platform.
+ * https://developers.google.com/data-manager/api/devguides/events/google-ads/online/send-events
+ */
+export type GoogleAdsActionType = 'webpage' | 'offline';
 export interface GoogleAdsConversionsOptions {
   /** Validates the payload server-side without recording conversions. */
   validateOnly?: boolean;
   consent?: GoogleAdsConsent;
+  /** The kind of conversion action `config` points at; `webpage` by default. */
+  actionType?: GoogleAdsActionType;
 }
 /**
  * Google's email normalization is Meta's minus one wrinkle: for @gmail.com/@googlemail.com the
@@ -39,7 +51,8 @@ export interface DataManagerEvent {
   transactionId: string;
   /** RFC 3339 — `created_at` as stored, unlike the legacy API's bespoke format. */
   eventTimestamp: string;
-  eventSource: 'WEB' | 'APP' | 'OTHER';
+  /** Absent for a non-web event sent to a `webpage` action, which accepts `WEB` only. */
+  eventSource?: 'WEB' | 'APP' | 'OTHER';
   conversionValue: number;
   currency: string;
   adIdentifiers?: {
@@ -58,7 +71,7 @@ export interface DataManagerEvent {
  * the legacy upload, an event with no click id at all is still worth sending when it carries
  * user identifiers — that is the enhanced-conversions match path.
  */
-export declare function getDataManagerEvent(event: TrackEvent<any>, config: GoogleAdsConversionConfig, data?: UserProvidedData): DataManagerEvent | undefined;
+export declare function getDataManagerEvent(event: TrackEvent<any>, config: GoogleAdsConversionConfig, data?: UserProvidedData, actionType?: GoogleAdsActionType): DataManagerEvent | undefined;
 export interface DataManagerResponse {
   requestId?: string;
 }

package/dist/server/google-data-manager.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"google-data-manager.d.cts","names":[],"sources":["../../src/server/google-data-manager.ts"],"mappings":";;;;;;;YAsCY,4BAA4B,OAAO;iBAE9B;;EAEf;;EAEA;;EAEA;;;;;;iBAOe;EACf;EACA;;iBAGe;;EAEf;EACA,UAAU;;;;;;;wBAQI,eAAe;;iBA2Cd;EACf;EACA;;EAEA;EACA;EACA;EACA;EACA;IAAkB;IAAgB;IAAiB;;EACnD;IAAa,iBAAiB;;;;;;;;;;wBAUhB,oBAEd,OAAO,iBACP,QAAQ,2BACR,OAAM,mBACL;iBAwCc;EACf;;;;;;;;;wBAaoB,WACpB,MAAM,eACN,QAAQ,2BAER,QAAQ,mBACR,OAAM,kBACN,UAAS,8BACR,QAAQ"}
+{"version":3,"file":"google-data-manager.d.cts","names":[],"sources":["../../src/server/google-data-manager.ts"],"mappings":";;;;;;;YAsCY,4BAA4B,OAAO;iBAE9B;;EAEf;;EAEA;;EAEA;;;;;;iBAOe;EACf;EACA;;;;;;;;;;;YAYU;iBAEK;;EAEf;EACA,UAAU;;EAEV,aAAa;;;;;;;wBAQC,eAAe;;iBA2Cd;EACf;EACA;;EAEA;;EAEA;EACA;EACA;EACA;IAAkB;IAAgB;IAAiB;;EACnD;IAAa,iBAAiB;;;;;;;;;;wBAUhB,oBAEd,OAAO,iBACP,QAAQ,2BACR,OAAM,kBACN,aAAY,sBACX;iBA+Cc;EACf;;;;;;;;;wBAaoB,WACpB,MAAM,eACN,QAAQ,2BAER,QAAQ,mBACR,OAAM,kBACN,UAAS,8BACR,QAAQ"}

package/dist/server/google-data-manager.d.mts

@@ -22,10 +22,22 @@ export interface GoogleAdsConsent {
   adUserData?: 'CONSENT_GRANTED' | 'CONSENT_DENIED' | 'CONSENT_STATUS_UNSPECIFIED';
   adPersonalization?: 'CONSENT_GRANTED' | 'CONSENT_DENIED' | 'CONSENT_STATUS_UNSPECIFIED';
 }
+/**
+ * The kind of conversion action the events go to, which decides `eventSource`:
+ * - `webpage` (default): the action the gtag tag reports to, as in the hybrid deployment this
+ *   module is built for. Its `eventSource` is optional and, when set, "must be WEB" — any other
+ *   value fails the request, and the request with it. Web events say `WEB`, others say nothing.
+ * - `offline`: an action created for uploads (`UPLOAD_CLICKS`), where `eventSource` is required
+ *   and any value goes: `WEB`, `APP` or `OTHER` from the event's platform.
+ * https://developers.google.com/data-manager/api/devguides/events/google-ads/online/send-events
+ */
+export type GoogleAdsActionType = 'webpage' | 'offline';
 export interface GoogleAdsConversionsOptions {
   /** Validates the payload server-side without recording conversions. */
   validateOnly?: boolean;
   consent?: GoogleAdsConsent;
+  /** The kind of conversion action `config` points at; `webpage` by default. */
+  actionType?: GoogleAdsActionType;
 }
 /**
  * Google's email normalization is Meta's minus one wrinkle: for @gmail.com/@googlemail.com the
@@ -39,7 +51,8 @@ export interface DataManagerEvent {
   transactionId: string;
   /** RFC 3339 — `created_at` as stored, unlike the legacy API's bespoke format. */
   eventTimestamp: string;
-  eventSource: 'WEB' | 'APP' | 'OTHER';
+  /** Absent for a non-web event sent to a `webpage` action, which accepts `WEB` only. */
+  eventSource?: 'WEB' | 'APP' | 'OTHER';
   conversionValue: number;
   currency: string;
   adIdentifiers?: {
@@ -58,7 +71,7 @@ export interface DataManagerEvent {
  * the legacy upload, an event with no click id at all is still worth sending when it carries
  * user identifiers — that is the enhanced-conversions match path.
  */
-export declare function getDataManagerEvent(event: TrackEvent<any>, config: GoogleAdsConversionConfig, data?: UserProvidedData): DataManagerEvent | undefined;
+export declare function getDataManagerEvent(event: TrackEvent<any>, config: GoogleAdsConversionConfig, data?: UserProvidedData, actionType?: GoogleAdsActionType): DataManagerEvent | undefined;
 export interface DataManagerResponse {
   requestId?: string;
 }

package/dist/server/google-data-manager.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"google-data-manager.d.mts","names":[],"sources":["../../src/server/google-data-manager.ts"],"mappings":";;;;;;;YAsCY,4BAA4B,OAAO;iBAE9B;;EAEf;;EAEA;;EAEA;;;;;;iBAOe;EACf;EACA;;iBAGe;;EAEf;EACA,UAAU;;;;;;;wBAQI,eAAe;;iBA2Cd;EACf;EACA;;EAEA;EACA;EACA;EACA;EACA;IAAkB;IAAgB;IAAiB;;EACnD;IAAa,iBAAiB;;;;;;;;;;wBAUhB,oBAEd,OAAO,iBACP,QAAQ,2BACR,OAAM,mBACL;iBAwCc;EACf;;;;;;;;;wBAaoB,WACpB,MAAM,eACN,QAAQ,2BAER,QAAQ,mBACR,OAAM,kBACN,UAAS,8BACR,QAAQ"}
+{"version":3,"file":"google-data-manager.d.mts","names":[],"sources":["../../src/server/google-data-manager.ts"],"mappings":";;;;;;;YAsCY,4BAA4B,OAAO;iBAE9B;;EAEf;;EAEA;;EAEA;;;;;;iBAOe;EACf;EACA;;;;;;;;;;;YAYU;iBAEK;;EAEf;EACA,UAAU;;EAEV,aAAa;;;;;;;wBAQC,eAAe;;iBA2Cd;EACf;EACA;;EAEA;;EAEA;EACA;EACA;EACA;IAAkB;IAAgB;IAAiB;;EACnD;IAAa,iBAAiB;;;;;;;;;;wBAUhB,oBAEd,OAAO,iBACP,QAAQ,2BACR,OAAM,kBACN,aAAY,sBACX;iBA+Cc;EACf;;;;;;;;;wBAaoB,WACpB,MAAM,eACN,QAAQ,2BAER,QAAQ,mBACR,OAAM,kBACN,UAAS,8BACR,QAAQ"}

package/dist/server/google-data-manager.mjs

@@ -67,7 +67,7 @@ function getUserIdentifiers(data) {
 * the legacy upload, an event with no click id at all is still worth sending when it carries
 * user identifiers — that is the enhanced-conversions match path.
 */
-function getDataManagerEvent(event, config, data = {}) {
+function getDataManagerEvent(event, config, data = {}, actionType = "webpage") {
 	const action = config[event.name];
 	if (!action) return void 0;
 	const source = resolveActionSource(event.platform);
@@ -75,7 +75,7 @@ function getDataManagerEvent(event, config, data = {}) {
 		destinationReferences: [String(action)],
 		transactionId: typeof event.properties?.transaction_id === "string" ? event.properties.transaction_id : event.id,
 		eventTimestamp: new Date(event.created_at).toISOString(),
-		eventSource: source === "app" ? "APP" : source === "web" ? "WEB" : "OTHER",
+		eventSource: source === "web" ? "WEB" : actionType === "webpage" ? void 0 : source === "app" ? "APP" : "OTHER",
 		conversionValue: typeof event.properties?.value === "number" ? event.properties.value : 0,
 		currency: normalizeCurrency(event.properties?.currency)
 	};
@@ -98,7 +98,7 @@ const MAX_EVENTS_PER_REQUEST = 2e3;
 * 2000-event request cap goes out as sequential requests; the first response is returned.
 */
 async function sendEvents(auth, config, events, data = {}, options = {}) {
-	const dmEvents = events.filter((event) => !IGNORED_EVENTS.includes(event.name)).map((event) => getDataManagerEvent(event, config, data)).filter((dmEvent) => dmEvent !== void 0);
+	const dmEvents = events.filter((event) => !IGNORED_EVENTS.includes(event.name)).map((event) => getDataManagerEvent(event, config, data, options.actionType)).filter((dmEvent) => dmEvent !== void 0);
 	if (dmEvents.length === 0) return void 0;
 	const operatingAccount = {
 		accountType: "GOOGLE_ADS",

package/dist/server/google-data-manager.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"google-data-manager.mjs","names":[],"sources":["../../src/server/google-data-manager.ts"],"sourcesContent":["/**\n * Google Ads conversion sender over the Data Manager API (`events:ingest`) — Google's\n * counterpart to Meta's Conversions API, and the mandated successor to the Google Ads API's\n * `UploadClickConversions`, which stopped accepting new adopters on 2026-06-15. Same shape as\n * the other senders here: a pure per-event builder, a never-throws `sendEvents`, credentials\n * in headers and never in a URL or a log line.\n *\n * Google's recommended deployment is *hybrid* (\"boost your tag with additional data sources\"):\n * this upload attaches to the SAME conversion action the gtag tag reports to, matched by\n * `transactionId` — a matched pair collapses into one conversion with the server data winning,\n * an unmatched upload is a recovered conversion. Both channels here are fed from the same\n * `track()` call, so the ids agree by construction. `transactionId` is therefore required in\n * that mode; this sender always sends one (the event id when there is no natural order id).\n *\n * Auth is a plain OAuth2 access token with the `datamanager` scope — no Google Ads developer\n * token, no API Center approval. The caller exchanges its stored refresh token for the access\n * token (one POST to oauth2.googleapis.com) and refreshes it however it likes; this module\n * stays out of the OAuth business, exactly as it stays out of Meta's.\n *\n * https://developers.google.com/data-manager/api/reference/rest/v1/events/ingest\n * https://developers.google.com/data-manager/api/devguides/events/google-ads/offline/upgrade/field-mappings\n * https://support.google.com/google-ads/answer/16542291 (hybrid: \"boost your tag with\n * additional data sources\" — the transaction-id matching contract this sender relies on)\n */\nimport { createHash } from 'node:crypto';\nimport { fetch } from '@shware/utils';\nimport { IGNORED_EVENTS } from '../third-parties/ignored-events';\nimport type { TrackEvent, UserProvidedData } from '../track/types';\nimport { resolveActionSource } from './action-source';\nimport { googleClickIds } from './click-ids';\n\nconst ENDPOINT = 'https://datamanager.googleapis.com/v1/events:ingest';\n\n/**\n * Event name → conversion action id, mirroring `LinkedinConversionConfig`: only configured\n * events upload, everything else is skipped silently. In the hybrid setup this is the id of\n * the SAME conversion action the gtag tag reports to.\n */\nexport type GoogleAdsConversionConfig = Record<Lowercase<string>, number | string>;\n\nexport interface GoogleAdsAuth {\n  /** OAuth2 access token with the `datamanager` scope. Short-lived; the caller refreshes it. */\n  accessToken: string;\n  /** The Google Ads account the conversion actions live in. Dashes are tolerated: '123-456-7890'. */\n  operatingAccountId: string;\n  /** The manager account the OAuth user accesses through, when access is delegated. */\n  loginAccountId?: string;\n}\n\n/**\n * EEA/UK/CH consent, applied request-wide. Google drops EEA conversions without granted\n * `adUserData` from bidding, so a host with consent signals should pass them.\n */\nexport interface GoogleAdsConsent {\n  adUserData?: 'CONSENT_GRANTED' | 'CONSENT_DENIED' | 'CONSENT_STATUS_UNSPECIFIED';\n  adPersonalization?: 'CONSENT_GRANTED' | 'CONSENT_DENIED' | 'CONSENT_STATUS_UNSPECIFIED';\n}\n\nexport interface GoogleAdsConversionsOptions {\n  /** Validates the payload server-side without recording conversions. */\n  validateOnly?: boolean;\n  consent?: GoogleAdsConsent;\n}\n\n/**\n * Google's email normalization is Meta's minus one wrinkle: for @gmail.com/@googlemail.com the\n * username's dots and everything from '+' on are removed; for every other domain they are kept.\n * https://developers.google.com/data-manager/api/devguides/format-data\n */\nexport function normalizeEmail(input: string): string {\n  const email = input.trim().toLowerCase();\n  const at = email.lastIndexOf('@');\n  if (at === -1) return email;\n  let username = email.slice(0, at);\n  const domain = email.slice(at + 1);\n  if (domain === 'gmail.com' || domain === 'googlemail.com') {\n    username = username.replace(/\\./g, '').split('+', 1)[0] ?? '';\n  }\n  return `${username}@${domain}`;\n}\n\nconst sha256 = (value: string) => createHash('sha256').update(value).digest('hex');\n\nfunction normalizeCurrency(input: unknown): string {\n  if (typeof input !== 'string') return 'USD';\n  const currency = input.trim().toUpperCase();\n  return /^[A-Z]{3}$/.test(currency) ? currency : 'USD';\n}\n\n/** At most 10 userIdentifiers per event, per the API's hard limit. */\nconst MAX_USER_IDENTIFIERS = 10;\n\n/** Hashes are hex strings, declared by `encoding: 'HEX'` on the request. */\nfunction getUserIdentifiers(data: UserProvidedData): Record<string, string>[] {\n  const identifiers: Record<string, string>[] = [];\n  const emails = Array.isArray(data.email) ? data.email : data.email ? [data.email] : [];\n  for (const email of emails) {\n    identifiers.push({ emailAddress: sha256(normalizeEmail(email)) });\n  }\n  const phones = Array.isArray(data.phone_number)\n    ? data.phone_number\n    : data.phone_number\n      ? [data.phone_number]\n      : [];\n  for (const phone of phones) {\n    // Phones are already E.164 by the schema ('+' then digits); hash after a defensive trim.\n    identifiers.push({ phoneNumber: sha256(phone.trim()) });\n  }\n  return identifiers.slice(0, MAX_USER_IDENTIFIERS);\n}\n\n/** One entry of the `events` array. Field names are the REST (camelCase) spellings. */\nexport interface DataManagerEvent {\n  destinationReferences: string[];\n  transactionId: string;\n  /** RFC 3339 — `created_at` as stored, unlike the legacy API's bespoke format. */\n  eventTimestamp: string;\n  eventSource: 'WEB' | 'APP' | 'OTHER';\n  conversionValue: number;\n  currency: string;\n  adIdentifiers?: { gclid?: string; gbraid?: string; wbraid?: string };\n  userData?: { userIdentifiers: Record<string, string>[] };\n}\n\n/**\n * Builds one Event, or undefined when no conversion action is configured for the event's name.\n * At most one click identifier is sent, gclid first: it is the deterministic per-click id,\n * where gbraid/wbraid are the aggregate iOS ones, and Google documents preferring it. Unlike\n * the legacy upload, an event with no click id at all is still worth sending when it carries\n * user identifiers — that is the enhanced-conversions match path.\n */\nexport function getDataManagerEvent(\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  event: TrackEvent<any>,\n  config: GoogleAdsConversionConfig,\n  data: UserProvidedData = {}\n): DataManagerEvent | undefined {\n  const action = config[event.name as Lowercase<string>];\n  if (!action) return undefined;\n\n  const source = resolveActionSource(event.platform);\n  const dmEvent: DataManagerEvent = {\n    destinationReferences: [String(action)],\n    // The hybrid-mode match key against the gtag tag's transaction_id: same track() call feeds\n    // both channels, so they agree by construction for purchase-shaped events. The event id\n    // covers conversions with no natural order id — but the gtag tracker only sends a\n    // transaction_id when the properties carry one, so on a HYBRID action a non-purchase event\n    // reported by both channels never matches and counts twice. Attach such events to a\n    // standalone (API-only) conversion action instead.\n    transactionId:\n      typeof event.properties?.transaction_id === 'string'\n        ? event.properties.transaction_id\n        : event.id,\n    eventTimestamp: new Date(event.created_at).toISOString(),\n    eventSource: source === 'app' ? 'APP' : source === 'web' ? 'WEB' : 'OTHER',\n    // Both mandatory, like the LinkedIn sender's defaults: 0 USD is Google's own convention\n    // for value-less goals. The API has no partial-failure mode, so a malformed currency would\n    // cost the whole batch — anything that isn't a 3-letter code falls back instead.\n    conversionValue: typeof event.properties?.value === 'number' ? event.properties.value : 0,\n    currency: normalizeCurrency(event.properties?.currency),\n  };\n\n  const { gclid, gbraid, wbraid } = googleClickIds(event.tags);\n  if (gclid) dmEvent.adIdentifiers = { gclid };\n  else if (gbraid) dmEvent.adIdentifiers = { gbraid };\n  else if (wbraid) dmEvent.adIdentifiers = { wbraid };\n\n  const userIdentifiers = getUserIdentifiers(data);\n  if (userIdentifiers.length > 0) dmEvent.userData = { userIdentifiers };\n\n  // With neither a click id nor an identifier Google has nothing to match on; skip.\n  if (!dmEvent.adIdentifiers && !dmEvent.userData) return undefined;\n\n  return dmEvent;\n}\n\nexport interface DataManagerResponse {\n  requestId?: string;\n}\n\n/** The API takes at most 2000 events per request. */\nconst MAX_EVENTS_PER_REQUEST = 2000;\n\n/**\n * Uploads the configured conversions from a batch of events. Never throws: an unusable event\n * is skipped and a failed request is logged and swallowed, like every other sender here. The\n * Data Manager API has no partial-failure mode — a rejected request costs the whole batch, so\n * the builder is strict about only emitting events the API can accept. A batch beyond the\n * 2000-event request cap goes out as sequential requests; the first response is returned.\n */\nexport async function sendEvents(\n  auth: GoogleAdsAuth,\n  config: GoogleAdsConversionConfig,\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  events: TrackEvent<any>[],\n  data: UserProvidedData = {},\n  options: GoogleAdsConversionsOptions = {}\n): Promise<DataManagerResponse | undefined> {\n  const dmEvents = events\n    .filter((event) => !IGNORED_EVENTS.includes(event.name))\n    .map((event) => getDataManagerEvent(event, config, data))\n    .filter((dmEvent): dmEvent is DataManagerEvent => dmEvent !== undefined);\n  if (dmEvents.length === 0) return undefined;\n\n  const operatingAccount = {\n    accountType: 'GOOGLE_ADS',\n    accountId: auth.operatingAccountId.replace(/-/g, ''),\n  };\n  // One destination per conversion action present in the batch; each event points at its own\n  // through destinationReferences, so mixed-action batches go out as one request.\n  const loginAccount = auth.loginAccountId\n    ? { accountType: 'GOOGLE_ADS', accountId: auth.loginAccountId.replace(/-/g, '') }\n    : undefined;\n  const actions = Array.from(new Set(dmEvents.flatMap((dmEvent) => dmEvent.destinationReferences)));\n  const destinations = actions.map((action) => {\n    const destination: Record<string, unknown> = {\n      reference: action,\n      operatingAccount,\n      productDestinationId: action,\n    };\n    if (loginAccount) destination.loginAccount = loginAccount;\n    return destination;\n  });\n\n  let firstResponse: DataManagerResponse | undefined;\n  for (let offset = 0; offset < dmEvents.length; offset += MAX_EVENTS_PER_REQUEST) {\n    const chunk = dmEvents.slice(offset, offset + MAX_EVENTS_PER_REQUEST);\n    const body: Record<string, unknown> = {\n      destinations,\n      events: chunk,\n      validateOnly: options.validateOnly ?? false,\n    };\n    if (chunk.some((dmEvent) => dmEvent.userData)) {\n      body.encoding = 'HEX';\n    }\n    if (options.consent) {\n      body.consent = options.consent;\n    }\n\n    try {\n      const response = await fetch(ENDPOINT, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          Accept: 'application/json',\n          Authorization: `Bearer ${auth.accessToken}`,\n        },\n        body: JSON.stringify(body),\n      });\n      if (response.ok) {\n        firstResponse ??= (await response.json()) as DataManagerResponse;\n        continue;\n      }\n      const { status } = response;\n      const message = await response.text();\n      console.error(`Failed to send Google Ads conversions, status: ${status}, body: ${message}`);\n    } catch (error) {\n      const message = error instanceof Error ? error.message : String(error);\n      console.error(`Failed to send Google Ads conversions, network error: ${message}`);\n    }\n  }\n  return firstResponse;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,MAAM,WAAW;;;;;;AAsCjB,SAAgB,eAAe,OAAuB;CACpD,MAAM,QAAQ,MAAM,KAAK,CAAC,CAAC,YAAY;CACvC,MAAM,KAAK,MAAM,YAAY,GAAG;CAChC,IAAI,OAAO,IAAI,OAAO;CACtB,IAAI,WAAW,MAAM,MAAM,GAAG,EAAE;CAChC,MAAM,SAAS,MAAM,MAAM,KAAK,CAAC;CACjC,IAAI,WAAW,eAAe,WAAW,kBACvC,WAAW,SAAS,QAAQ,OAAO,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM;CAE7D,OAAO,GAAG,SAAS,GAAG;AACxB;AAEA,MAAM,UAAU,UAAkB,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AAEjF,SAAS,kBAAkB,OAAwB;CACjD,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,MAAM,WAAW,MAAM,KAAK,CAAC,CAAC,YAAY;CAC1C,OAAO,aAAa,KAAK,QAAQ,IAAI,WAAW;AAClD;;AAGA,MAAM,uBAAuB;;AAG7B,SAAS,mBAAmB,MAAkD;CAC5E,MAAM,cAAwC,CAAC;CAC/C,MAAM,SAAS,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC;CACrF,KAAK,MAAM,SAAS,QAClB,YAAY,KAAK,EAAE,cAAc,OAAO,eAAe,KAAK,CAAC,EAAE,CAAC;CAElE,MAAM,SAAS,MAAM,QAAQ,KAAK,YAAY,IAC1C,KAAK,eACL,KAAK,eACH,CAAC,KAAK,YAAY,IAClB,CAAC;CACP,KAAK,MAAM,SAAS,QAElB,YAAY,KAAK,EAAE,aAAa,OAAO,MAAM,KAAK,CAAC,EAAE,CAAC;CAExD,OAAO,YAAY,MAAM,GAAG,oBAAoB;AAClD;;;;;;;;AAsBA,SAAgB,oBAEd,OACA,QACA,OAAyB,CAAC,GACI;CAC9B,MAAM,SAAS,OAAO,MAAM;CAC5B,IAAI,CAAC,QAAQ,OAAO,KAAA;CAEpB,MAAM,SAAS,oBAAoB,MAAM,QAAQ;CACjD,MAAM,UAA4B;EAChC,uBAAuB,CAAC,OAAO,MAAM,CAAC;EAOtC,eACE,OAAO,MAAM,YAAY,mBAAmB,WACxC,MAAM,WAAW,iBACjB,MAAM;EACZ,gBAAgB,IAAI,KAAK,MAAM,UAAU,CAAC,CAAC,YAAY;EACvD,aAAa,WAAW,QAAQ,QAAQ,WAAW,QAAQ,QAAQ;EAInE,iBAAiB,OAAO,MAAM,YAAY,UAAU,WAAW,MAAM,WAAW,QAAQ;EACxF,UAAU,kBAAkB,MAAM,YAAY,QAAQ;CACxD;CAEA,MAAM,EAAE,OAAO,QAAQ,WAAW,eAAe,MAAM,IAAI;CAC3D,IAAI,OAAO,QAAQ,gBAAgB,EAAE,MAAM;MACtC,IAAI,QAAQ,QAAQ,gBAAgB,EAAE,OAAO;MAC7C,IAAI,QAAQ,QAAQ,gBAAgB,EAAE,OAAO;CAElD,MAAM,kBAAkB,mBAAmB,IAAI;CAC/C,IAAI,gBAAgB,SAAS,GAAG,QAAQ,WAAW,EAAE,gBAAgB;CAGrE,IAAI,CAAC,QAAQ,iBAAiB,CAAC,QAAQ,UAAU,OAAO,KAAA;CAExD,OAAO;AACT;;AAOA,MAAM,yBAAyB;;;;;;;;AAS/B,eAAsB,WACpB,MACA,QAEA,QACA,OAAyB,CAAC,GAC1B,UAAuC,CAAC,GACE;CAC1C,MAAM,WAAW,OACd,QAAQ,UAAU,CAAC,eAAe,SAAS,MAAM,IAAI,CAAC,CAAC,CACvD,KAAK,UAAU,oBAAoB,OAAO,QAAQ,IAAI,CAAC,CAAC,CACxD,QAAQ,YAAyC,YAAY,KAAA,CAAS;CACzE,IAAI,SAAS,WAAW,GAAG,OAAO,KAAA;CAElC,MAAM,mBAAmB;EACvB,aAAa;EACb,WAAW,KAAK,mBAAmB,QAAQ,MAAM,EAAE;CACrD;CAGA,MAAM,eAAe,KAAK,iBACtB;EAAE,aAAa;EAAc,WAAW,KAAK,eAAe,QAAQ,MAAM,EAAE;CAAE,IAC9E,KAAA;CAEJ,MAAM,eADU,MAAM,KAAK,IAAI,IAAI,SAAS,SAAS,YAAY,QAAQ,qBAAqB,CAAC,CACpE,CAAC,CAAC,KAAK,WAAW;EAC3C,MAAM,cAAuC;GAC3C,WAAW;GACX;GACA,sBAAsB;EACxB;EACA,IAAI,cAAc,YAAY,eAAe;EAC7C,OAAO;CACT,CAAC;CAED,IAAI;CACJ,KAAK,IAAI,SAAS,GAAG,SAAS,SAAS,QAAQ,UAAU,wBAAwB;EAC/E,MAAM,QAAQ,SAAS,MAAM,QAAQ,SAAS,sBAAsB;EACpE,MAAM,OAAgC;GACpC;GACA,QAAQ;GACR,cAAc,QAAQ,gBAAgB;EACxC;EACA,IAAI,MAAM,MAAM,YAAY,QAAQ,QAAQ,GAC1C,KAAK,WAAW;EAElB,IAAI,QAAQ,SACV,KAAK,UAAU,QAAQ;EAGzB,IAAI;GACF,MAAM,WAAW,MAAM,MAAM,UAAU;IACrC,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,QAAQ;KACR,eAAe,UAAU,KAAK;IAChC;IACA,MAAM,KAAK,UAAU,IAAI;GAC3B,CAAC;GACD,IAAI,SAAS,IAAI;IACf,kBAAmB,MAAM,SAAS,KAAK;IACvC;GACF;GACA,MAAM,EAAE,WAAW;GACnB,MAAM,UAAU,MAAM,SAAS,KAAK;GACpC,QAAQ,MAAM,kDAAkD,OAAO,UAAU,SAAS;EAC5F,SAAS,OAAO;GACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACrE,QAAQ,MAAM,yDAAyD,SAAS;EAClF;CACF;CACA,OAAO;AACT"}
+{"version":3,"file":"google-data-manager.mjs","names":[],"sources":["../../src/server/google-data-manager.ts"],"sourcesContent":["/**\n * Google Ads conversion sender over the Data Manager API (`events:ingest`) — Google's\n * counterpart to Meta's Conversions API, and the mandated successor to the Google Ads API's\n * `UploadClickConversions`, which stopped accepting new adopters on 2026-06-15. Same shape as\n * the other senders here: a pure per-event builder, a never-throws `sendEvents`, credentials\n * in headers and never in a URL or a log line.\n *\n * Google's recommended deployment is *hybrid* (\"boost your tag with additional data sources\"):\n * this upload attaches to the SAME conversion action the gtag tag reports to, matched by\n * `transactionId` — a matched pair collapses into one conversion with the server data winning,\n * an unmatched upload is a recovered conversion. Both channels here are fed from the same\n * `track()` call, so the ids agree by construction. `transactionId` is therefore required in\n * that mode; this sender always sends one (the event id when there is no natural order id).\n *\n * Auth is a plain OAuth2 access token with the `datamanager` scope — no Google Ads developer\n * token, no API Center approval. The caller exchanges its stored refresh token for the access\n * token (one POST to oauth2.googleapis.com) and refreshes it however it likes; this module\n * stays out of the OAuth business, exactly as it stays out of Meta's.\n *\n * https://developers.google.com/data-manager/api/reference/rest/v1/events/ingest\n * https://developers.google.com/data-manager/api/devguides/events/google-ads/offline/upgrade/field-mappings\n * https://support.google.com/google-ads/answer/16542291 (hybrid: \"boost your tag with\n * additional data sources\" — the transaction-id matching contract this sender relies on)\n */\nimport { createHash } from 'node:crypto';\nimport { fetch } from '@shware/utils';\nimport { IGNORED_EVENTS } from '../third-parties/ignored-events';\nimport type { TrackEvent, UserProvidedData } from '../track/types';\nimport { resolveActionSource } from './action-source';\nimport { googleClickIds } from './click-ids';\n\nconst ENDPOINT = 'https://datamanager.googleapis.com/v1/events:ingest';\n\n/**\n * Event name → conversion action id, mirroring `LinkedinConversionConfig`: only configured\n * events upload, everything else is skipped silently. In the hybrid setup this is the id of\n * the SAME conversion action the gtag tag reports to.\n */\nexport type GoogleAdsConversionConfig = Record<Lowercase<string>, number | string>;\n\nexport interface GoogleAdsAuth {\n  /** OAuth2 access token with the `datamanager` scope. Short-lived; the caller refreshes it. */\n  accessToken: string;\n  /** The Google Ads account the conversion actions live in. Dashes are tolerated: '123-456-7890'. */\n  operatingAccountId: string;\n  /** The manager account the OAuth user accesses through, when access is delegated. */\n  loginAccountId?: string;\n}\n\n/**\n * EEA/UK/CH consent, applied request-wide. Google drops EEA conversions without granted\n * `adUserData` from bidding, so a host with consent signals should pass them.\n */\nexport interface GoogleAdsConsent {\n  adUserData?: 'CONSENT_GRANTED' | 'CONSENT_DENIED' | 'CONSENT_STATUS_UNSPECIFIED';\n  adPersonalization?: 'CONSENT_GRANTED' | 'CONSENT_DENIED' | 'CONSENT_STATUS_UNSPECIFIED';\n}\n\n/**\n * The kind of conversion action the events go to, which decides `eventSource`:\n * - `webpage` (default): the action the gtag tag reports to, as in the hybrid deployment this\n *   module is built for. Its `eventSource` is optional and, when set, \"must be WEB\" — any other\n *   value fails the request, and the request with it. Web events say `WEB`, others say nothing.\n * - `offline`: an action created for uploads (`UPLOAD_CLICKS`), where `eventSource` is required\n *   and any value goes: `WEB`, `APP` or `OTHER` from the event's platform.\n * https://developers.google.com/data-manager/api/devguides/events/google-ads/online/send-events\n */\nexport type GoogleAdsActionType = 'webpage' | 'offline';\n\nexport interface GoogleAdsConversionsOptions {\n  /** Validates the payload server-side without recording conversions. */\n  validateOnly?: boolean;\n  consent?: GoogleAdsConsent;\n  /** The kind of conversion action `config` points at; `webpage` by default. */\n  actionType?: GoogleAdsActionType;\n}\n\n/**\n * Google's email normalization is Meta's minus one wrinkle: for @gmail.com/@googlemail.com the\n * username's dots and everything from '+' on are removed; for every other domain they are kept.\n * https://developers.google.com/data-manager/api/devguides/format-data\n */\nexport function normalizeEmail(input: string): string {\n  const email = input.trim().toLowerCase();\n  const at = email.lastIndexOf('@');\n  if (at === -1) return email;\n  let username = email.slice(0, at);\n  const domain = email.slice(at + 1);\n  if (domain === 'gmail.com' || domain === 'googlemail.com') {\n    username = username.replace(/\\./g, '').split('+', 1)[0] ?? '';\n  }\n  return `${username}@${domain}`;\n}\n\nconst sha256 = (value: string) => createHash('sha256').update(value).digest('hex');\n\nfunction normalizeCurrency(input: unknown): string {\n  if (typeof input !== 'string') return 'USD';\n  const currency = input.trim().toUpperCase();\n  return /^[A-Z]{3}$/.test(currency) ? currency : 'USD';\n}\n\n/** At most 10 userIdentifiers per event, per the API's hard limit. */\nconst MAX_USER_IDENTIFIERS = 10;\n\n/** Hashes are hex strings, declared by `encoding: 'HEX'` on the request. */\nfunction getUserIdentifiers(data: UserProvidedData): Record<string, string>[] {\n  const identifiers: Record<string, string>[] = [];\n  const emails = Array.isArray(data.email) ? data.email : data.email ? [data.email] : [];\n  for (const email of emails) {\n    identifiers.push({ emailAddress: sha256(normalizeEmail(email)) });\n  }\n  const phones = Array.isArray(data.phone_number)\n    ? data.phone_number\n    : data.phone_number\n      ? [data.phone_number]\n      : [];\n  for (const phone of phones) {\n    // Phones are already E.164 by the schema ('+' then digits); hash after a defensive trim.\n    identifiers.push({ phoneNumber: sha256(phone.trim()) });\n  }\n  return identifiers.slice(0, MAX_USER_IDENTIFIERS);\n}\n\n/** One entry of the `events` array. Field names are the REST (camelCase) spellings. */\nexport interface DataManagerEvent {\n  destinationReferences: string[];\n  transactionId: string;\n  /** RFC 3339 — `created_at` as stored, unlike the legacy API's bespoke format. */\n  eventTimestamp: string;\n  /** Absent for a non-web event sent to a `webpage` action, which accepts `WEB` only. */\n  eventSource?: 'WEB' | 'APP' | 'OTHER';\n  conversionValue: number;\n  currency: string;\n  adIdentifiers?: { gclid?: string; gbraid?: string; wbraid?: string };\n  userData?: { userIdentifiers: Record<string, string>[] };\n}\n\n/**\n * Builds one Event, or undefined when no conversion action is configured for the event's name.\n * At most one click identifier is sent, gclid first: it is the deterministic per-click id,\n * where gbraid/wbraid are the aggregate iOS ones, and Google documents preferring it. Unlike\n * the legacy upload, an event with no click id at all is still worth sending when it carries\n * user identifiers — that is the enhanced-conversions match path.\n */\nexport function getDataManagerEvent(\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  event: TrackEvent<any>,\n  config: GoogleAdsConversionConfig,\n  data: UserProvidedData = {},\n  actionType: GoogleAdsActionType = 'webpage'\n): DataManagerEvent | undefined {\n  const action = config[event.name as Lowercase<string>];\n  if (!action) return undefined;\n\n  const source = resolveActionSource(event.platform);\n  const dmEvent: DataManagerEvent = {\n    destinationReferences: [String(action)],\n    // The hybrid-mode match key against the gtag tag's transaction_id: same track() call feeds\n    // both channels, so they agree by construction for purchase-shaped events. The event id\n    // covers conversions with no natural order id — but the gtag tracker only sends a\n    // transaction_id when the properties carry one, so on a HYBRID action a non-purchase event\n    // reported by both channels never matches and counts twice. Attach such events to a\n    // standalone (API-only) conversion action instead.\n    transactionId:\n      typeof event.properties?.transaction_id === 'string'\n        ? event.properties.transaction_id\n        : event.id,\n    eventTimestamp: new Date(event.created_at).toISOString(),\n    eventSource:\n      source === 'web'\n        ? 'WEB'\n        : actionType === 'webpage'\n          ? undefined\n          : source === 'app'\n            ? 'APP'\n            : 'OTHER',\n    // Both mandatory, like the LinkedIn sender's defaults: 0 USD is Google's own convention\n    // for value-less goals. The API has no partial-failure mode, so a malformed currency would\n    // cost the whole batch — anything that isn't a 3-letter code falls back instead.\n    conversionValue: typeof event.properties?.value === 'number' ? event.properties.value : 0,\n    currency: normalizeCurrency(event.properties?.currency),\n  };\n\n  const { gclid, gbraid, wbraid } = googleClickIds(event.tags);\n  if (gclid) dmEvent.adIdentifiers = { gclid };\n  else if (gbraid) dmEvent.adIdentifiers = { gbraid };\n  else if (wbraid) dmEvent.adIdentifiers = { wbraid };\n\n  const userIdentifiers = getUserIdentifiers(data);\n  if (userIdentifiers.length > 0) dmEvent.userData = { userIdentifiers };\n\n  // With neither a click id nor an identifier Google has nothing to match on; skip.\n  if (!dmEvent.adIdentifiers && !dmEvent.userData) return undefined;\n\n  return dmEvent;\n}\n\nexport interface DataManagerResponse {\n  requestId?: string;\n}\n\n/** The API takes at most 2000 events per request. */\nconst MAX_EVENTS_PER_REQUEST = 2000;\n\n/**\n * Uploads the configured conversions from a batch of events. Never throws: an unusable event\n * is skipped and a failed request is logged and swallowed, like every other sender here. The\n * Data Manager API has no partial-failure mode — a rejected request costs the whole batch, so\n * the builder is strict about only emitting events the API can accept. A batch beyond the\n * 2000-event request cap goes out as sequential requests; the first response is returned.\n */\nexport async function sendEvents(\n  auth: GoogleAdsAuth,\n  config: GoogleAdsConversionConfig,\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  events: TrackEvent<any>[],\n  data: UserProvidedData = {},\n  options: GoogleAdsConversionsOptions = {}\n): Promise<DataManagerResponse | undefined> {\n  const dmEvents = events\n    .filter((event) => !IGNORED_EVENTS.includes(event.name))\n    .map((event) => getDataManagerEvent(event, config, data, options.actionType))\n    .filter((dmEvent): dmEvent is DataManagerEvent => dmEvent !== undefined);\n  if (dmEvents.length === 0) return undefined;\n\n  const operatingAccount = {\n    accountType: 'GOOGLE_ADS',\n    accountId: auth.operatingAccountId.replace(/-/g, ''),\n  };\n  // One destination per conversion action present in the batch; each event points at its own\n  // through destinationReferences, so mixed-action batches go out as one request.\n  const loginAccount = auth.loginAccountId\n    ? { accountType: 'GOOGLE_ADS', accountId: auth.loginAccountId.replace(/-/g, '') }\n    : undefined;\n  const actions = Array.from(new Set(dmEvents.flatMap((dmEvent) => dmEvent.destinationReferences)));\n  const destinations = actions.map((action) => {\n    const destination: Record<string, unknown> = {\n      reference: action,\n      operatingAccount,\n      productDestinationId: action,\n    };\n    if (loginAccount) destination.loginAccount = loginAccount;\n    return destination;\n  });\n\n  let firstResponse: DataManagerResponse | undefined;\n  for (let offset = 0; offset < dmEvents.length; offset += MAX_EVENTS_PER_REQUEST) {\n    const chunk = dmEvents.slice(offset, offset + MAX_EVENTS_PER_REQUEST);\n    const body: Record<string, unknown> = {\n      destinations,\n      events: chunk,\n      validateOnly: options.validateOnly ?? false,\n    };\n    if (chunk.some((dmEvent) => dmEvent.userData)) {\n      body.encoding = 'HEX';\n    }\n    if (options.consent) {\n      body.consent = options.consent;\n    }\n\n    try {\n      const response = await fetch(ENDPOINT, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          Accept: 'application/json',\n          Authorization: `Bearer ${auth.accessToken}`,\n        },\n        body: JSON.stringify(body),\n      });\n      if (response.ok) {\n        firstResponse ??= (await response.json()) as DataManagerResponse;\n        continue;\n      }\n      const { status } = response;\n      const message = await response.text();\n      console.error(`Failed to send Google Ads conversions, status: ${status}, body: ${message}`);\n    } catch (error) {\n      const message = error instanceof Error ? error.message : String(error);\n      console.error(`Failed to send Google Ads conversions, network error: ${message}`);\n    }\n  }\n  return firstResponse;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,MAAM,WAAW;;;;;;AAmDjB,SAAgB,eAAe,OAAuB;CACpD,MAAM,QAAQ,MAAM,KAAK,CAAC,CAAC,YAAY;CACvC,MAAM,KAAK,MAAM,YAAY,GAAG;CAChC,IAAI,OAAO,IAAI,OAAO;CACtB,IAAI,WAAW,MAAM,MAAM,GAAG,EAAE;CAChC,MAAM,SAAS,MAAM,MAAM,KAAK,CAAC;CACjC,IAAI,WAAW,eAAe,WAAW,kBACvC,WAAW,SAAS,QAAQ,OAAO,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM;CAE7D,OAAO,GAAG,SAAS,GAAG;AACxB;AAEA,MAAM,UAAU,UAAkB,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AAEjF,SAAS,kBAAkB,OAAwB;CACjD,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,MAAM,WAAW,MAAM,KAAK,CAAC,CAAC,YAAY;CAC1C,OAAO,aAAa,KAAK,QAAQ,IAAI,WAAW;AAClD;;AAGA,MAAM,uBAAuB;;AAG7B,SAAS,mBAAmB,MAAkD;CAC5E,MAAM,cAAwC,CAAC;CAC/C,MAAM,SAAS,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC;CACrF,KAAK,MAAM,SAAS,QAClB,YAAY,KAAK,EAAE,cAAc,OAAO,eAAe,KAAK,CAAC,EAAE,CAAC;CAElE,MAAM,SAAS,MAAM,QAAQ,KAAK,YAAY,IAC1C,KAAK,eACL,KAAK,eACH,CAAC,KAAK,YAAY,IAClB,CAAC;CACP,KAAK,MAAM,SAAS,QAElB,YAAY,KAAK,EAAE,aAAa,OAAO,MAAM,KAAK,CAAC,EAAE,CAAC;CAExD,OAAO,YAAY,MAAM,GAAG,oBAAoB;AAClD;;;;;;;;AAuBA,SAAgB,oBAEd,OACA,QACA,OAAyB,CAAC,GAC1B,aAAkC,WACJ;CAC9B,MAAM,SAAS,OAAO,MAAM;CAC5B,IAAI,CAAC,QAAQ,OAAO,KAAA;CAEpB,MAAM,SAAS,oBAAoB,MAAM,QAAQ;CACjD,MAAM,UAA4B;EAChC,uBAAuB,CAAC,OAAO,MAAM,CAAC;EAOtC,eACE,OAAO,MAAM,YAAY,mBAAmB,WACxC,MAAM,WAAW,iBACjB,MAAM;EACZ,gBAAgB,IAAI,KAAK,MAAM,UAAU,CAAC,CAAC,YAAY;EACvD,aACE,WAAW,QACP,QACA,eAAe,YACb,KAAA,IACA,WAAW,QACT,QACA;EAIV,iBAAiB,OAAO,MAAM,YAAY,UAAU,WAAW,MAAM,WAAW,QAAQ;EACxF,UAAU,kBAAkB,MAAM,YAAY,QAAQ;CACxD;CAEA,MAAM,EAAE,OAAO,QAAQ,WAAW,eAAe,MAAM,IAAI;CAC3D,IAAI,OAAO,QAAQ,gBAAgB,EAAE,MAAM;MACtC,IAAI,QAAQ,QAAQ,gBAAgB,EAAE,OAAO;MAC7C,IAAI,QAAQ,QAAQ,gBAAgB,EAAE,OAAO;CAElD,MAAM,kBAAkB,mBAAmB,IAAI;CAC/C,IAAI,gBAAgB,SAAS,GAAG,QAAQ,WAAW,EAAE,gBAAgB;CAGrE,IAAI,CAAC,QAAQ,iBAAiB,CAAC,QAAQ,UAAU,OAAO,KAAA;CAExD,OAAO;AACT;;AAOA,MAAM,yBAAyB;;;;;;;;AAS/B,eAAsB,WACpB,MACA,QAEA,QACA,OAAyB,CAAC,GAC1B,UAAuC,CAAC,GACE;CAC1C,MAAM,WAAW,OACd,QAAQ,UAAU,CAAC,eAAe,SAAS,MAAM,IAAI,CAAC,CAAC,CACvD,KAAK,UAAU,oBAAoB,OAAO,QAAQ,MAAM,QAAQ,UAAU,CAAC,CAAC,CAC5E,QAAQ,YAAyC,YAAY,KAAA,CAAS;CACzE,IAAI,SAAS,WAAW,GAAG,OAAO,KAAA;CAElC,MAAM,mBAAmB;EACvB,aAAa;EACb,WAAW,KAAK,mBAAmB,QAAQ,MAAM,EAAE;CACrD;CAGA,MAAM,eAAe,KAAK,iBACtB;EAAE,aAAa;EAAc,WAAW,KAAK,eAAe,QAAQ,MAAM,EAAE;CAAE,IAC9E,KAAA;CAEJ,MAAM,eADU,MAAM,KAAK,IAAI,IAAI,SAAS,SAAS,YAAY,QAAQ,qBAAqB,CAAC,CACpE,CAAC,CAAC,KAAK,WAAW;EAC3C,MAAM,cAAuC;GAC3C,WAAW;GACX;GACA,sBAAsB;EACxB;EACA,IAAI,cAAc,YAAY,eAAe;EAC7C,OAAO;CACT,CAAC;CAED,IAAI;CACJ,KAAK,IAAI,SAAS,GAAG,SAAS,SAAS,QAAQ,UAAU,wBAAwB;EAC/E,MAAM,QAAQ,SAAS,MAAM,QAAQ,SAAS,sBAAsB;EACpE,MAAM,OAAgC;GACpC;GACA,QAAQ;GACR,cAAc,QAAQ,gBAAgB;EACxC;EACA,IAAI,MAAM,MAAM,YAAY,QAAQ,QAAQ,GAC1C,KAAK,WAAW;EAElB,IAAI,QAAQ,SACV,KAAK,UAAU,QAAQ;EAGzB,IAAI;GACF,MAAM,WAAW,MAAM,MAAM,UAAU;IACrC,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,QAAQ;KACR,eAAe,UAAU,KAAK;IAChC;IACA,MAAM,KAAK,UAAU,IAAI;GAC3B,CAAC;GACD,IAAI,SAAS,IAAI;IACf,kBAAmB,MAAM,SAAS,KAAK;IACvC;GACF;GACA,MAAM,EAAE,WAAW;GACnB,MAAM,UAAU,MAAM,SAAS,KAAK;GACpC,QAAQ,MAAM,kDAAkD,OAAO,UAAU,SAAS;EAC5F,SAAS,OAAO;GACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACrE,QAAQ,MAAM,yDAAyD,SAAS;EAClF;CACF;CACA,OAAO;AACT"}

package/dist/server/index.d.cts

@@ -1,9 +1,9 @@
 import { FBC_COOKIE, GCL_AW_COOKIE, GCL_GB_COOKIE, ParsedFbc, ParsedGcl, RDT_CID_COOKIE, ResolveClickIdCookiesInput, ResolveClickIdCookiesResult, UET_MSCLKID_COOKIE, formatFbc, formatGcl, formatMsclkid, formatUetMsclkid, parseFbc, parseGcl, parseUetMsclkid, resolveClickIdCookies, toSetCookieHeaders } from "../click-id/index.cjs";
 import { EventActionSource } from "./action-source.cjs";
-import { DataManagerEvent, DataManagerResponse, GoogleAdsAuth, GoogleAdsConsent, GoogleAdsConversionConfig, GoogleAdsConversionsOptions, getDataManagerEvent, normalizeEmail, sendEvents } from "./google-data-manager.cjs";
+import { DataManagerEvent, DataManagerResponse, GoogleAdsActionType, GoogleAdsAuth, GoogleAdsConsent, GoogleAdsConversionConfig, GoogleAdsConversionsOptions, getDataManagerEvent, normalizeEmail, sendEvents } from "./google-data-manager.cjs";
 import { CapiEvent, MetaConversionsOptions, MetaConversionsResponse, getCapiEvent, sendEvents as sendEvents$2 } from "./meta-capi.cjs";
 import { sendEvents as sendEvents$5 } from "./reddit-conversions-api.cjs";
 import { LinkedinConversionConfig, sendEvents as sendEvents$1 } from "./linkedin-conversions-api.cjs";
 import { sendEvents as sendEvents$4 } from "./openai-conversions-api.cjs";
 import { MicrosoftConversionsOptions, MicrosoftConversionsResponse, MicrosoftCustomData, MicrosoftEvent, MicrosoftEventOptions, MicrosoftUserData, MicrosoftValidationDetail, getServerEvent, normalizeEmail as normalizeEmail$1, sendEvents as sendEvents$3 } from "./microsoft-conversions-api.cjs";
-export { type CapiEvent, type DataManagerEvent, type DataManagerResponse, type EventActionSource, FBC_COOKIE, GCL_AW_COOKIE, GCL_GB_COOKIE, type GoogleAdsAuth, type GoogleAdsConsent, type GoogleAdsConversionConfig, type GoogleAdsConversionsOptions, type LinkedinConversionConfig, type MetaConversionsOptions, type MetaConversionsResponse, type MicrosoftConversionsOptions, type MicrosoftConversionsResponse, type MicrosoftCustomData, type MicrosoftEvent, type MicrosoftEventOptions, type MicrosoftUserData, type MicrosoftValidationDetail, type ParsedFbc, type ParsedGcl, RDT_CID_COOKIE, type ResolveClickIdCookiesInput, type ResolveClickIdCookiesResult, UET_MSCLKID_COOKIE, formatFbc, formatGcl, formatMsclkid, formatUetMsclkid, getCapiEvent, getDataManagerEvent, getServerEvent as getMicrosoftEvent, normalizeEmail, normalizeEmail$1 as normalizeMicrosoftEmail, parseFbc, parseGcl, parseUetMsclkid, resolveClickIdCookies, sendEvents as sendGoogleAdsEvents, sendEvents$1 as sendLinkedinEvents, sendEvents$2 as sendMetaEvents, sendEvents$3 as sendMicrosoftEvents, sendEvents$4 as sendOpenAIEvents, sendEvents$5 as sendRedditEvents, toSetCookieHeaders };
+export { type CapiEvent, type DataManagerEvent, type DataManagerResponse, type EventActionSource, FBC_COOKIE, GCL_AW_COOKIE, GCL_GB_COOKIE, type GoogleAdsActionType, type GoogleAdsAuth, type GoogleAdsConsent, type GoogleAdsConversionConfig, type GoogleAdsConversionsOptions, type LinkedinConversionConfig, type MetaConversionsOptions, type MetaConversionsResponse, type MicrosoftConversionsOptions, type MicrosoftConversionsResponse, type MicrosoftCustomData, type MicrosoftEvent, type MicrosoftEventOptions, type MicrosoftUserData, type MicrosoftValidationDetail, type ParsedFbc, type ParsedGcl, RDT_CID_COOKIE, type ResolveClickIdCookiesInput, type ResolveClickIdCookiesResult, UET_MSCLKID_COOKIE, formatFbc, formatGcl, formatMsclkid, formatUetMsclkid, getCapiEvent, getDataManagerEvent, getServerEvent as getMicrosoftEvent, normalizeEmail, normalizeEmail$1 as normalizeMicrosoftEmail, parseFbc, parseGcl, parseUetMsclkid, resolveClickIdCookies, sendEvents as sendGoogleAdsEvents, sendEvents$1 as sendLinkedinEvents, sendEvents$2 as sendMetaEvents, sendEvents$3 as sendMicrosoftEvents, sendEvents$4 as sendOpenAIEvents, sendEvents$5 as sendRedditEvents, toSetCookieHeaders };

package/dist/server/index.d.mts

@@ -1,9 +1,9 @@
 import { FBC_COOKIE, GCL_AW_COOKIE, GCL_GB_COOKIE, ParsedFbc, ParsedGcl, RDT_CID_COOKIE, ResolveClickIdCookiesInput, ResolveClickIdCookiesResult, UET_MSCLKID_COOKIE, formatFbc, formatGcl, formatMsclkid, formatUetMsclkid, parseFbc, parseGcl, parseUetMsclkid, resolveClickIdCookies, toSetCookieHeaders } from "../click-id/index.mjs";
 import { EventActionSource } from "./action-source.mjs";
-import { DataManagerEvent, DataManagerResponse, GoogleAdsAuth, GoogleAdsConsent, GoogleAdsConversionConfig, GoogleAdsConversionsOptions, getDataManagerEvent, normalizeEmail, sendEvents } from "./google-data-manager.mjs";
+import { DataManagerEvent, DataManagerResponse, GoogleAdsActionType, GoogleAdsAuth, GoogleAdsConsent, GoogleAdsConversionConfig, GoogleAdsConversionsOptions, getDataManagerEvent, normalizeEmail, sendEvents } from "./google-data-manager.mjs";
 import { CapiEvent, MetaConversionsOptions, MetaConversionsResponse, getCapiEvent, sendEvents as sendEvents$2 } from "./meta-capi.mjs";
 import { sendEvents as sendEvents$5 } from "./reddit-conversions-api.mjs";
 import { LinkedinConversionConfig, sendEvents as sendEvents$1 } from "./linkedin-conversions-api.mjs";
 import { sendEvents as sendEvents$4 } from "./openai-conversions-api.mjs";
 import { MicrosoftConversionsOptions, MicrosoftConversionsResponse, MicrosoftCustomData, MicrosoftEvent, MicrosoftEventOptions, MicrosoftUserData, MicrosoftValidationDetail, getServerEvent, normalizeEmail as normalizeEmail$1, sendEvents as sendEvents$3 } from "./microsoft-conversions-api.mjs";
-export { type CapiEvent, type DataManagerEvent, type DataManagerResponse, type EventActionSource, FBC_COOKIE, GCL_AW_COOKIE, GCL_GB_COOKIE, type GoogleAdsAuth, type GoogleAdsConsent, type GoogleAdsConversionConfig, type GoogleAdsConversionsOptions, type LinkedinConversionConfig, type MetaConversionsOptions, type MetaConversionsResponse, type MicrosoftConversionsOptions, type MicrosoftConversionsResponse, type MicrosoftCustomData, type MicrosoftEvent, type MicrosoftEventOptions, type MicrosoftUserData, type MicrosoftValidationDetail, type ParsedFbc, type ParsedGcl, RDT_CID_COOKIE, type ResolveClickIdCookiesInput, type ResolveClickIdCookiesResult, UET_MSCLKID_COOKIE, formatFbc, formatGcl, formatMsclkid, formatUetMsclkid, getCapiEvent, getDataManagerEvent, getServerEvent as getMicrosoftEvent, normalizeEmail, normalizeEmail$1 as normalizeMicrosoftEmail, parseFbc, parseGcl, parseUetMsclkid, resolveClickIdCookies, sendEvents as sendGoogleAdsEvents, sendEvents$1 as sendLinkedinEvents, sendEvents$2 as sendMetaEvents, sendEvents$3 as sendMicrosoftEvents, sendEvents$4 as sendOpenAIEvents, sendEvents$5 as sendRedditEvents, toSetCookieHeaders };
+export { type CapiEvent, type DataManagerEvent, type DataManagerResponse, type EventActionSource, FBC_COOKIE, GCL_AW_COOKIE, GCL_GB_COOKIE, type GoogleAdsActionType, type GoogleAdsAuth, type GoogleAdsConsent, type GoogleAdsConversionConfig, type GoogleAdsConversionsOptions, type LinkedinConversionConfig, type MetaConversionsOptions, type MetaConversionsResponse, type MicrosoftConversionsOptions, type MicrosoftConversionsResponse, type MicrosoftCustomData, type MicrosoftEvent, type MicrosoftEventOptions, type MicrosoftUserData, type MicrosoftValidationDetail, type ParsedFbc, type ParsedGcl, RDT_CID_COOKIE, type ResolveClickIdCookiesInput, type ResolveClickIdCookiesResult, UET_MSCLKID_COOKIE, formatFbc, formatGcl, formatMsclkid, formatUetMsclkid, getCapiEvent, getDataManagerEvent, getServerEvent as getMicrosoftEvent, normalizeEmail, normalizeEmail$1 as normalizeMicrosoftEmail, parseFbc, parseGcl, parseUetMsclkid, resolveClickIdCookies, sendEvents as sendGoogleAdsEvents, sendEvents$1 as sendLinkedinEvents, sendEvents$2 as sendMetaEvents, sendEvents$3 as sendMicrosoftEvents, sendEvents$4 as sendOpenAIEvents, sendEvents$5 as sendRedditEvents, toSetCookieHeaders };

package/dist/server/linkedin-conversions-api.cjs

@@ -31,6 +31,11 @@ const hashEmail = (email) => sha256(email.toLowerCase().replace(/\s/g, ""));
 * sha256('obrien') — Mary O'Brien with the apostrophe removed, not escaped or kept.
 */
 const hashName = (name) => sha256(name.toLowerCase().replace(/[\s\p{P}]/gu, ""));
+/**
+* `conversionHappenedAt` must be "within the past 90 days", and one invalid record makes "all
+* records fail"; such an event is left out, with a minute's margin for the trip.
+*/
+const MAX_EVENT_AGE_MS = 777594e4;
 async function sendEvents(accessToken, config, events, data = {}) {
 	const eventNames = Object.keys(config);
 	const address = require_utils_field.getFirst(data.address);
@@ -55,7 +60,7 @@ async function sendEvents(accessToken, config, events, data = {}) {
 			idValue: id
 		}] : [];
 	};
-	const dto = { elements: events.filter((event) => eventNames.includes(event.name) && !require_third_parties_ignored_events.IGNORED_EVENTS.includes(event.name)).map((event) => ({
+	const dto = { elements: events.filter((event) => eventNames.includes(event.name) && !require_third_parties_ignored_events.IGNORED_EVENTS.includes(event.name)).filter((event) => Date.now() - Date.parse(event.created_at) <= MAX_EVENT_AGE_MS).map((event) => ({
 		eventId: event.id,
 		conversion: `urn:lla:llaPartnerConversion:${config[event.name]}`,
 		conversionHappenedAt: new Date(event.created_at).getTime(),

package/dist/server/linkedin-conversions-api.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"linkedin-conversions-api.cjs","names":["createHash","getFirst","linkedinFatId","IGNORED_EVENTS","fetch"],"sources":["../../src/server/linkedin-conversions-api.ts"],"sourcesContent":["/**\n * Conversions API Payload Builder: https://www.linkedin.com/developers/payload-builder\n * https://learn.microsoft.com/en-us/linkedin/marketing/conversions/conversions-overview?view=li-lms-2026-09\n */\nimport { createHash } from 'node:crypto';\nimport { fetch } from '@shware/utils';\nimport { IGNORED_EVENTS } from '../third-parties/ignored-events';\nimport type { TrackEvent, TrackTags, UserProvidedData } from '../track/types';\nimport { getFirst } from '../utils/field';\nimport { linkedinFatId } from './click-ids';\n\n/**\n * The identifier types LinkedIn matches on, as of version 202609. `ORACLE_MOAT_ID` used to be\n * here and is no longer in the schema; the IP and Android ones are.\n */\ntype UserIdType =\n  | 'SHA256_EMAIL'\n  | 'LINKEDIN_FIRST_PARTY_ADS_TRACKING_UUID'\n  | 'ACXIOM_ID'\n  | 'PLAINTEXT_IP_ADDRESS'\n  | 'SHA256_IP_ADDRESS'\n  | 'GOOGLE_AID';\n\nexport interface CreateLinkedinEventDTO {\n  /**\n   * For any conversion that you want to send through multiple methods, such as Insight Tag and\n   * Conversions API, you must create a conversion rule for each data source (browser and server).\n   * Then, you can implement a logic to pick up the eventId from the browser and send it with the\n   * corresponding event from your server. If we receive an Insight Tag event and a Conversions API\n   * event from the same account with the same eventId, we discard the Conversions API event and\n   * count only the Insight Tag event in campaign reporting.\n   */\n  eventId?: string;\n\n  /**\n   * Replace <id> with the conversion ID extracted when creating the conversion rule\n   * (e.g. urn:lla:llaPartnerConversion:<id>).\n   */\n  conversion: `urn:lla:llaPartnerConversion:${number}`;\n\n  /** Epoch timestamp in milliseconds at which the conversion event happened. */\n  conversionHappenedAt: number;\n  conversionValue: { currencyCode: string; amount: string };\n  user: {\n    userIds: { idType: UserIdType; idValue: string }[];\n    /**\n     * Probabilistic matching fields. `hashedFirstName` / `hashedLastName` arrived in 202609 and\n     * are what we send; the plaintext `firstName` / `lastName` they replace are still accepted by\n     * the API but are not listed here, because sending a name in the clear is not something this\n     * client should make easy to reach for.\n     */\n    userInfo?: {\n      hashedFirstName?: string;\n      hashedLastName?: string;\n      companyName?: string;\n      countryCode?: string;\n      title?: string;\n    };\n\n    /**\n     * The maximum supported size of the list is 1 at the moment. If the list contains multiple\n     * values, only the first value will be used.\n     */\n    externalIds?: [string, ...string[]];\n\n    /**\n     * This is generated when users submit the Linkedin Lead-gen form\n     * (e.g. urn:li:leadGenFormResponse:<id>).\n     */\n    lead?: `urn:li:leadGenFormResponse:${string}`;\n  };\n}\n\nexport interface CreateMultipleLinkedinEventsDTO {\n  elements: CreateLinkedinEventDTO[];\n}\n\n/**\n * The schema prescribes an exact normalization per field before hashing, and getting it wrong is\n * silent: LinkedIn accepts any 64-char hex digest and simply matches nobody. So these helpers are\n * the difference between attribution and nothing, not between 200 and 400.\n */\nconst sha256 = (value: string) => createHash('sha256').update(value).digest('hex');\n\n/**\n * An email is lower-cased and stripped of whitespace before hashing. Punctuation is left alone —\n * `@` and `.` are the address.\n */\nconst hashEmail = (email: string) => sha256(email.toLowerCase().replace(/\\s/g, ''));\n\n/**\n * A name is lower-cased and stripped of whitespace *and punctuation* before hashing, so that\n * `O'Brien`, `o brien` and `obrien` all land on the same digest. UTF-8 is what `update` already\n * encodes with.\n *\n * The schema's wording (\"lowercase with no spaces or punctuation\") leaves room to read the\n * apostrophe either way, so this is checked against its own worked example rather than guessed:\n * the `hashedFirstName` / `hashedLastName` digests it prints are sha256('mary') and\n * sha256('obrien') — Mary O'Brien with the apostrophe removed, not escaped or kept.\n */\nconst hashName = (name: string) => sha256(name.toLowerCase().replace(/[\\s\\p{P}]/gu, ''));\n\nexport type LinkedinConversionConfig = Record<Lowercase<string>, number>;\n\nexport async function sendEvents(\n  accessToken: string,\n  config: LinkedinConversionConfig,\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  events: TrackEvent<any>[],\n  data: UserProvidedData = {}\n) {\n  const eventNames = Object.keys(config);\n  const address = getFirst(data.address);\n  const userIds: { idType: UserIdType; idValue: string }[] = [];\n  const externalIds: [string, ...string[]] | undefined = data.user_id ? [data.user_id] : undefined;\n  const userInfo =\n    address?.first_name && address.last_name\n      ? {\n          hashedFirstName: hashName(address.first_name),\n          hashedLastName: hashName(address.last_name),\n          countryCode: address.country,\n        }\n      : undefined;\n\n  if (data.email) {\n    const email = getFirst(data.email);\n    if (email) userIds.push({ idType: 'SHA256_EMAIL', idValue: hashEmail(email) });\n  }\n\n  const fatIds = (tags: TrackTags): { idType: UserIdType; idValue: string }[] => {\n    const id = linkedinFatId(tags);\n    return id ? [{ idType: 'LINKEDIN_FIRST_PARTY_ADS_TRACKING_UUID', idValue: id }] : [];\n  };\n\n  const dto: CreateMultipleLinkedinEventsDTO = {\n    elements: events\n      .filter((event) => eventNames.includes(event.name) && !IGNORED_EVENTS.includes(event.name))\n      .map((event): CreateLinkedinEventDTO => ({\n        eventId: event.id,\n        conversion: `urn:lla:llaPartnerConversion:${config[event.name]}`,\n        conversionHappenedAt: new Date(event.created_at).getTime(),\n        conversionValue: {\n          currencyCode: event.properties?.currency?.toUpperCase() ?? 'USD',\n          amount: event.properties?.value?.toString() ?? '0',\n        },\n        user: {\n          userIds: [...fatIds(event.tags), ...userIds],\n          userInfo,\n          externalIds,\n        },\n      }))\n      // An element carrying no identifier at all fails validation, and LinkedIn fails the whole\n      // batch when one element fails — so a single anonymous event would discard every\n      // identifiable conversion sent alongside it. Dropped here instead.\n      .filter(\n        ({ user }) =>\n          user.userIds.length > 0 || !!user.userInfo || !!user.externalIds || !!user.lead\n      ),\n  };\n\n  if (dto.elements.length === 0) return;\n  try {\n    const response = await fetch('https://api.linkedin.com/rest/conversionEvents', {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'Content-Type': 'application/json',\n        'LinkedIn-Version': '202609',\n        'X-Restli-Protocol-Version': '2.0.0',\n        'X-RestLi-Method': 'BATCH_CREATE',\n      },\n      body: JSON.stringify(dto),\n    });\n\n    if (response.ok) return;\n    const { status } = response;\n    const message = await response.text();\n    console.error(`Failed to send LinkedIn conversion, status: ${status}, body: ${message}`);\n  } catch (error) {\n    console.error('Failed to send LinkedIn conversion, network error:', error);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAkFA,MAAM,UAAU,WAAA,GAAkBA,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;;;;;AAMjF,MAAM,aAAa,UAAkB,OAAO,MAAM,YAAY,CAAC,CAAC,QAAQ,OAAO,EAAE,CAAC;;;;;;;;;;;AAYlF,MAAM,YAAY,SAAiB,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,eAAe,EAAE,CAAC;AAIvF,eAAsB,WACpB,aACA,QAEA,QACA,OAAyB,CAAC,GAC1B;CACA,MAAM,aAAa,OAAO,KAAK,MAAM;CACrC,MAAM,UAAUC,oBAAAA,SAAS,KAAK,OAAO;CACrC,MAAM,UAAqD,CAAC;CAC5D,MAAM,cAAiD,KAAK,UAAU,CAAC,KAAK,OAAO,IAAI,KAAA;CACvF,MAAM,WACJ,SAAS,cAAc,QAAQ,YAC3B;EACE,iBAAiB,SAAS,QAAQ,UAAU;EAC5C,gBAAgB,SAAS,QAAQ,SAAS;EAC1C,aAAa,QAAQ;CACvB,IACA,KAAA;CAEN,IAAI,KAAK,OAAO;EACd,MAAM,QAAQA,oBAAAA,SAAS,KAAK,KAAK;EACjC,IAAI,OAAO,QAAQ,KAAK;GAAE,QAAQ;GAAgB,SAAS,UAAU,KAAK;EAAE,CAAC;CAC/E;CAEA,MAAM,UAAU,SAA+D;EAC7E,MAAM,KAAKC,yBAAAA,cAAc,IAAI;EAC7B,OAAO,KAAK,CAAC;GAAE,QAAQ;GAA0C,SAAS;EAAG,CAAC,IAAI,CAAC;CACrF;CAEA,MAAM,MAAuC,EAC3C,UAAU,OACP,QAAQ,UAAU,WAAW,SAAS,MAAM,IAAI,KAAK,CAACC,qCAAAA,eAAe,SAAS,MAAM,IAAI,CAAC,CAAC,CAC1F,KAAK,WAAmC;EACvC,SAAS,MAAM;EACf,YAAY,gCAAgC,OAAO,MAAM;EACzD,sBAAsB,IAAI,KAAK,MAAM,UAAU,CAAC,CAAC,QAAQ;EACzD,iBAAiB;GACf,cAAc,MAAM,YAAY,UAAU,YAAY,KAAK;GAC3D,QAAQ,MAAM,YAAY,OAAO,SAAS,KAAK;EACjD;EACA,MAAM;GACJ,SAAS,CAAC,GAAG,OAAO,MAAM,IAAI,GAAG,GAAG,OAAO;GAC3C;GACA;EACF;CACF,EAAE,CAAC,CAIF,QACE,EAAE,WACD,KAAK,QAAQ,SAAS,KAAK,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,KAAK,IAC/E,EACJ;CAEA,IAAI,IAAI,SAAS,WAAW,GAAG;CAC/B,IAAI;EACF,MAAM,WAAW,OAAA,GAAMC,cAAAA,MAAAA,CAAM,kDAAkD;GAC7E,QAAQ;GACR,SAAS;IACP,eAAe,UAAU;IACzB,gBAAgB;IAChB,oBAAoB;IACpB,6BAA6B;IAC7B,mBAAmB;GACrB;GACA,MAAM,KAAK,UAAU,GAAG;EAC1B,CAAC;EAED,IAAI,SAAS,IAAI;EACjB,MAAM,EAAE,WAAW;EACnB,MAAM,UAAU,MAAM,SAAS,KAAK;EACpC,QAAQ,MAAM,+CAA+C,OAAO,UAAU,SAAS;CACzF,SAAS,OAAO;EACd,QAAQ,MAAM,sDAAsD,KAAK;CAC3E;AACF"}
+{"version":3,"file":"linkedin-conversions-api.cjs","names":["createHash","getFirst","linkedinFatId","IGNORED_EVENTS","fetch"],"sources":["../../src/server/linkedin-conversions-api.ts"],"sourcesContent":["/**\n * Conversions API Payload Builder: https://www.linkedin.com/developers/payload-builder\n * https://learn.microsoft.com/en-us/linkedin/marketing/conversions/conversions-overview?view=li-lms-2026-09\n */\nimport { createHash } from 'node:crypto';\nimport { fetch } from '@shware/utils';\nimport { IGNORED_EVENTS } from '../third-parties/ignored-events';\nimport type { TrackEvent, TrackTags, UserProvidedData } from '../track/types';\nimport { getFirst } from '../utils/field';\nimport { linkedinFatId } from './click-ids';\n\n/**\n * The identifier types LinkedIn matches on, as of version 202609. `ORACLE_MOAT_ID` used to be\n * here and is no longer in the schema; the IP and Android ones are.\n */\ntype UserIdType =\n  | 'SHA256_EMAIL'\n  | 'LINKEDIN_FIRST_PARTY_ADS_TRACKING_UUID'\n  | 'ACXIOM_ID'\n  | 'PLAINTEXT_IP_ADDRESS'\n  | 'SHA256_IP_ADDRESS'\n  | 'GOOGLE_AID';\n\nexport interface CreateLinkedinEventDTO {\n  /**\n   * For any conversion that you want to send through multiple methods, such as Insight Tag and\n   * Conversions API, you must create a conversion rule for each data source (browser and server).\n   * Then, you can implement a logic to pick up the eventId from the browser and send it with the\n   * corresponding event from your server. If we receive an Insight Tag event and a Conversions API\n   * event from the same account with the same eventId, we discard the Conversions API event and\n   * count only the Insight Tag event in campaign reporting.\n   */\n  eventId?: string;\n\n  /**\n   * Replace <id> with the conversion ID extracted when creating the conversion rule\n   * (e.g. urn:lla:llaPartnerConversion:<id>).\n   */\n  conversion: `urn:lla:llaPartnerConversion:${number}`;\n\n  /** Epoch timestamp in milliseconds at which the conversion event happened. */\n  conversionHappenedAt: number;\n  conversionValue: { currencyCode: string; amount: string };\n  user: {\n    userIds: { idType: UserIdType; idValue: string }[];\n    /**\n     * Probabilistic matching fields. `hashedFirstName` / `hashedLastName` arrived in 202609 and\n     * are what we send; the plaintext `firstName` / `lastName` they replace are still accepted by\n     * the API but are not listed here, because sending a name in the clear is not something this\n     * client should make easy to reach for.\n     */\n    userInfo?: {\n      hashedFirstName?: string;\n      hashedLastName?: string;\n      companyName?: string;\n      countryCode?: string;\n      title?: string;\n    };\n\n    /**\n     * The maximum supported size of the list is 1 at the moment. If the list contains multiple\n     * values, only the first value will be used.\n     */\n    externalIds?: [string, ...string[]];\n\n    /**\n     * This is generated when users submit the Linkedin Lead-gen form\n     * (e.g. urn:li:leadGenFormResponse:<id>).\n     */\n    lead?: `urn:li:leadGenFormResponse:${string}`;\n  };\n}\n\nexport interface CreateMultipleLinkedinEventsDTO {\n  elements: CreateLinkedinEventDTO[];\n}\n\n/**\n * The schema prescribes an exact normalization per field before hashing, and getting it wrong is\n * silent: LinkedIn accepts any 64-char hex digest and simply matches nobody. So these helpers are\n * the difference between attribution and nothing, not between 200 and 400.\n */\nconst sha256 = (value: string) => createHash('sha256').update(value).digest('hex');\n\n/**\n * An email is lower-cased and stripped of whitespace before hashing. Punctuation is left alone —\n * `@` and `.` are the address.\n */\nconst hashEmail = (email: string) => sha256(email.toLowerCase().replace(/\\s/g, ''));\n\n/**\n * A name is lower-cased and stripped of whitespace *and punctuation* before hashing, so that\n * `O'Brien`, `o brien` and `obrien` all land on the same digest. UTF-8 is what `update` already\n * encodes with.\n *\n * The schema's wording (\"lowercase with no spaces or punctuation\") leaves room to read the\n * apostrophe either way, so this is checked against its own worked example rather than guessed:\n * the `hashedFirstName` / `hashedLastName` digests it prints are sha256('mary') and\n * sha256('obrien') — Mary O'Brien with the apostrophe removed, not escaped or kept.\n */\nconst hashName = (name: string) => sha256(name.toLowerCase().replace(/[\\s\\p{P}]/gu, ''));\n\nexport type LinkedinConversionConfig = Record<Lowercase<string>, number>;\n\n/**\n * `conversionHappenedAt` must be \"within the past 90 days\", and one invalid record makes \"all\n * records fail\"; such an event is left out, with a minute's margin for the trip.\n */\nconst MAX_EVENT_AGE_MS = 90 * 24 * 60 * 60 * 1000 - 60 * 1000;\n\nexport async function sendEvents(\n  accessToken: string,\n  config: LinkedinConversionConfig,\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  events: TrackEvent<any>[],\n  data: UserProvidedData = {}\n) {\n  const eventNames = Object.keys(config);\n  const address = getFirst(data.address);\n  const userIds: { idType: UserIdType; idValue: string }[] = [];\n  const externalIds: [string, ...string[]] | undefined = data.user_id ? [data.user_id] : undefined;\n  const userInfo =\n    address?.first_name && address.last_name\n      ? {\n          hashedFirstName: hashName(address.first_name),\n          hashedLastName: hashName(address.last_name),\n          countryCode: address.country,\n        }\n      : undefined;\n\n  if (data.email) {\n    const email = getFirst(data.email);\n    if (email) userIds.push({ idType: 'SHA256_EMAIL', idValue: hashEmail(email) });\n  }\n\n  const fatIds = (tags: TrackTags): { idType: UserIdType; idValue: string }[] => {\n    const id = linkedinFatId(tags);\n    return id ? [{ idType: 'LINKEDIN_FIRST_PARTY_ADS_TRACKING_UUID', idValue: id }] : [];\n  };\n\n  const dto: CreateMultipleLinkedinEventsDTO = {\n    elements: events\n      .filter((event) => eventNames.includes(event.name) && !IGNORED_EVENTS.includes(event.name))\n      .filter((event) => Date.now() - Date.parse(event.created_at) <= MAX_EVENT_AGE_MS)\n      .map((event): CreateLinkedinEventDTO => ({\n        eventId: event.id,\n        conversion: `urn:lla:llaPartnerConversion:${config[event.name]}`,\n        conversionHappenedAt: new Date(event.created_at).getTime(),\n        conversionValue: {\n          currencyCode: event.properties?.currency?.toUpperCase() ?? 'USD',\n          amount: event.properties?.value?.toString() ?? '0',\n        },\n        user: {\n          userIds: [...fatIds(event.tags), ...userIds],\n          userInfo,\n          externalIds,\n        },\n      }))\n      // An element carrying no identifier at all fails validation, and LinkedIn fails the whole\n      // batch when one element fails — so a single anonymous event would discard every\n      // identifiable conversion sent alongside it. Dropped here instead.\n      .filter(\n        ({ user }) =>\n          user.userIds.length > 0 || !!user.userInfo || !!user.externalIds || !!user.lead\n      ),\n  };\n\n  if (dto.elements.length === 0) return;\n  try {\n    const response = await fetch('https://api.linkedin.com/rest/conversionEvents', {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'Content-Type': 'application/json',\n        'LinkedIn-Version': '202609',\n        'X-Restli-Protocol-Version': '2.0.0',\n        'X-RestLi-Method': 'BATCH_CREATE',\n      },\n      body: JSON.stringify(dto),\n    });\n\n    if (response.ok) return;\n    const { status } = response;\n    const message = await response.text();\n    console.error(`Failed to send LinkedIn conversion, status: ${status}, body: ${message}`);\n  } catch (error) {\n    console.error('Failed to send LinkedIn conversion, network error:', error);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAkFA,MAAM,UAAU,WAAA,GAAkBA,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;;;;;AAMjF,MAAM,aAAa,UAAkB,OAAO,MAAM,YAAY,CAAC,CAAC,QAAQ,OAAO,EAAE,CAAC;;;;;;;;;;;AAYlF,MAAM,YAAY,SAAiB,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,eAAe,EAAE,CAAC;;;;;AAQvF,MAAM,mBAAmB;AAEzB,eAAsB,WACpB,aACA,QAEA,QACA,OAAyB,CAAC,GAC1B;CACA,MAAM,aAAa,OAAO,KAAK,MAAM;CACrC,MAAM,UAAUC,oBAAAA,SAAS,KAAK,OAAO;CACrC,MAAM,UAAqD,CAAC;CAC5D,MAAM,cAAiD,KAAK,UAAU,CAAC,KAAK,OAAO,IAAI,KAAA;CACvF,MAAM,WACJ,SAAS,cAAc,QAAQ,YAC3B;EACE,iBAAiB,SAAS,QAAQ,UAAU;EAC5C,gBAAgB,SAAS,QAAQ,SAAS;EAC1C,aAAa,QAAQ;CACvB,IACA,KAAA;CAEN,IAAI,KAAK,OAAO;EACd,MAAM,QAAQA,oBAAAA,SAAS,KAAK,KAAK;EACjC,IAAI,OAAO,QAAQ,KAAK;GAAE,QAAQ;GAAgB,SAAS,UAAU,KAAK;EAAE,CAAC;CAC/E;CAEA,MAAM,UAAU,SAA+D;EAC7E,MAAM,KAAKC,yBAAAA,cAAc,IAAI;EAC7B,OAAO,KAAK,CAAC;GAAE,QAAQ;GAA0C,SAAS;EAAG,CAAC,IAAI,CAAC;CACrF;CAEA,MAAM,MAAuC,EAC3C,UAAU,OACP,QAAQ,UAAU,WAAW,SAAS,MAAM,IAAI,KAAK,CAACC,qCAAAA,eAAe,SAAS,MAAM,IAAI,CAAC,CAAC,CAC1F,QAAQ,UAAU,KAAK,IAAI,IAAI,KAAK,MAAM,MAAM,UAAU,KAAK,gBAAgB,CAAC,CAChF,KAAK,WAAmC;EACvC,SAAS,MAAM;EACf,YAAY,gCAAgC,OAAO,MAAM;EACzD,sBAAsB,IAAI,KAAK,MAAM,UAAU,CAAC,CAAC,QAAQ;EACzD,iBAAiB;GACf,cAAc,MAAM,YAAY,UAAU,YAAY,KAAK;GAC3D,QAAQ,MAAM,YAAY,OAAO,SAAS,KAAK;EACjD;EACA,MAAM;GACJ,SAAS,CAAC,GAAG,OAAO,MAAM,IAAI,GAAG,GAAG,OAAO;GAC3C;GACA;EACF;CACF,EAAE,CAAC,CAIF,QACE,EAAE,WACD,KAAK,QAAQ,SAAS,KAAK,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,KAAK,IAC/E,EACJ;CAEA,IAAI,IAAI,SAAS,WAAW,GAAG;CAC/B,IAAI;EACF,MAAM,WAAW,OAAA,GAAMC,cAAAA,MAAAA,CAAM,kDAAkD;GAC7E,QAAQ;GACR,SAAS;IACP,eAAe,UAAU;IACzB,gBAAgB;IAChB,oBAAoB;IACpB,6BAA6B;IAC7B,mBAAmB;GACrB;GACA,MAAM,KAAK,UAAU,GAAG;EAC1B,CAAC;EAED,IAAI,SAAS,IAAI;EACjB,MAAM,EAAE,WAAW;EACnB,MAAM,UAAU,MAAM,SAAS,KAAK;EACpC,QAAQ,MAAM,+CAA+C,OAAO,UAAU,SAAS;CACzF,SAAS,OAAO;EACd,QAAQ,MAAM,sDAAsD,KAAK;CAC3E;AACF"}

package/dist/server/linkedin-conversions-api.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"linkedin-conversions-api.d.cts","names":[],"sources":["../../src/server/linkedin-conversions-api.ts"],"mappings":";;;;;;KAeK;iBAQY;;;;;;;;;EASf;;;;;EAMA;;EAGA;EACA;IAAmB;IAAsB;;EACzC;IACE;MAAW,QAAQ;MAAY;;;;;;;;IAO/B;MACE;MACA;MACA;MACA;MACA;;;;;;IAOF;;;;;IAMA;;;iBAIa;EACf,UAAU;;YA4BA,2BAA2B,OAAO;wBAExB,WACpB,qBACA,QAAQ,0BAER,QAAQ,mBACR,OAAM,mBAAqB"}
+{"version":3,"file":"linkedin-conversions-api.d.cts","names":[],"sources":["../../src/server/linkedin-conversions-api.ts"],"mappings":";;;;;;KAeK;iBAQY;;;;;;;;;EASf;;;;;EAMA;;EAGA;EACA;IAAmB;IAAsB;;EACzC;IACE;MAAW,QAAQ;MAAY;;;;;;;;IAO/B;MACE;MACA;MACA;MACA;MACA;;;;;;IAOF;;;;;IAMA;;;iBAIa;EACf,UAAU;;YA4BA,2BAA2B,OAAO;wBAQxB,WACpB,qBACA,QAAQ,0BAER,QAAQ,mBACR,OAAM,mBAAqB"}

package/dist/server/linkedin-conversions-api.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"linkedin-conversions-api.d.mts","names":[],"sources":["../../src/server/linkedin-conversions-api.ts"],"mappings":";;;;;;KAeK;iBAQY;;;;;;;;;EASf;;;;;EAMA;;EAGA;EACA;IAAmB;IAAsB;;EACzC;IACE;MAAW,QAAQ;MAAY;;;;;;;;IAO/B;MACE;MACA;MACA;MACA;MACA;;;;;;IAOF;;;;;IAMA;;;iBAIa;EACf,UAAU;;YA4BA,2BAA2B,OAAO;wBAExB,WACpB,qBACA,QAAQ,0BAER,QAAQ,mBACR,OAAM,mBAAqB"}
+{"version":3,"file":"linkedin-conversions-api.d.mts","names":[],"sources":["../../src/server/linkedin-conversions-api.ts"],"mappings":";;;;;;KAeK;iBAQY;;;;;;;;;EASf;;;;;EAMA;;EAGA;EACA;IAAmB;IAAsB;;EACzC;IACE;MAAW,QAAQ;MAAY;;;;;;;;IAO/B;MACE;MACA;MACA;MACA;MACA;;;;;;IAOF;;;;;IAMA;;;iBAIa;EACf,UAAU;;YA4BA,2BAA2B,OAAO;wBAQxB,WACpB,qBACA,QAAQ,0BAER,QAAQ,mBACR,OAAM,mBAAqB"}

package/dist/server/linkedin-conversions-api.mjs

@@ -30,6 +30,11 @@ const hashEmail = (email) => sha256(email.toLowerCase().replace(/\s/g, ""));
 * sha256('obrien') — Mary O'Brien with the apostrophe removed, not escaped or kept.
 */
 const hashName = (name) => sha256(name.toLowerCase().replace(/[\s\p{P}]/gu, ""));
+/**
+* `conversionHappenedAt` must be "within the past 90 days", and one invalid record makes "all
+* records fail"; such an event is left out, with a minute's margin for the trip.
+*/
+const MAX_EVENT_AGE_MS = 777594e4;
 async function sendEvents(accessToken, config, events, data = {}) {
 	const eventNames = Object.keys(config);
 	const address = getFirst(data.address);
@@ -54,7 +59,7 @@ async function sendEvents(accessToken, config, events, data = {}) {
 			idValue: id
 		}] : [];
 	};
-	const dto = { elements: events.filter((event) => eventNames.includes(event.name) && !IGNORED_EVENTS.includes(event.name)).map((event) => ({
+	const dto = { elements: events.filter((event) => eventNames.includes(event.name) && !IGNORED_EVENTS.includes(event.name)).filter((event) => Date.now() - Date.parse(event.created_at) <= MAX_EVENT_AGE_MS).map((event) => ({
 		eventId: event.id,
 		conversion: `urn:lla:llaPartnerConversion:${config[event.name]}`,
 		conversionHappenedAt: new Date(event.created_at).getTime(),

package/dist/server/linkedin-conversions-api.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"linkedin-conversions-api.mjs","names":[],"sources":["../../src/server/linkedin-conversions-api.ts"],"sourcesContent":["/**\n * Conversions API Payload Builder: https://www.linkedin.com/developers/payload-builder\n * https://learn.microsoft.com/en-us/linkedin/marketing/conversions/conversions-overview?view=li-lms-2026-09\n */\nimport { createHash } from 'node:crypto';\nimport { fetch } from '@shware/utils';\nimport { IGNORED_EVENTS } from '../third-parties/ignored-events';\nimport type { TrackEvent, TrackTags, UserProvidedData } from '../track/types';\nimport { getFirst } from '../utils/field';\nimport { linkedinFatId } from './click-ids';\n\n/**\n * The identifier types LinkedIn matches on, as of version 202609. `ORACLE_MOAT_ID` used to be\n * here and is no longer in the schema; the IP and Android ones are.\n */\ntype UserIdType =\n  | 'SHA256_EMAIL'\n  | 'LINKEDIN_FIRST_PARTY_ADS_TRACKING_UUID'\n  | 'ACXIOM_ID'\n  | 'PLAINTEXT_IP_ADDRESS'\n  | 'SHA256_IP_ADDRESS'\n  | 'GOOGLE_AID';\n\nexport interface CreateLinkedinEventDTO {\n  /**\n   * For any conversion that you want to send through multiple methods, such as Insight Tag and\n   * Conversions API, you must create a conversion rule for each data source (browser and server).\n   * Then, you can implement a logic to pick up the eventId from the browser and send it with the\n   * corresponding event from your server. If we receive an Insight Tag event and a Conversions API\n   * event from the same account with the same eventId, we discard the Conversions API event and\n   * count only the Insight Tag event in campaign reporting.\n   */\n  eventId?: string;\n\n  /**\n   * Replace <id> with the conversion ID extracted when creating the conversion rule\n   * (e.g. urn:lla:llaPartnerConversion:<id>).\n   */\n  conversion: `urn:lla:llaPartnerConversion:${number}`;\n\n  /** Epoch timestamp in milliseconds at which the conversion event happened. */\n  conversionHappenedAt: number;\n  conversionValue: { currencyCode: string; amount: string };\n  user: {\n    userIds: { idType: UserIdType; idValue: string }[];\n    /**\n     * Probabilistic matching fields. `hashedFirstName` / `hashedLastName` arrived in 202609 and\n     * are what we send; the plaintext `firstName` / `lastName` they replace are still accepted by\n     * the API but are not listed here, because sending a name in the clear is not something this\n     * client should make easy to reach for.\n     */\n    userInfo?: {\n      hashedFirstName?: string;\n      hashedLastName?: string;\n      companyName?: string;\n      countryCode?: string;\n      title?: string;\n    };\n\n    /**\n     * The maximum supported size of the list is 1 at the moment. If the list contains multiple\n     * values, only the first value will be used.\n     */\n    externalIds?: [string, ...string[]];\n\n    /**\n     * This is generated when users submit the Linkedin Lead-gen form\n     * (e.g. urn:li:leadGenFormResponse:<id>).\n     */\n    lead?: `urn:li:leadGenFormResponse:${string}`;\n  };\n}\n\nexport interface CreateMultipleLinkedinEventsDTO {\n  elements: CreateLinkedinEventDTO[];\n}\n\n/**\n * The schema prescribes an exact normalization per field before hashing, and getting it wrong is\n * silent: LinkedIn accepts any 64-char hex digest and simply matches nobody. So these helpers are\n * the difference between attribution and nothing, not between 200 and 400.\n */\nconst sha256 = (value: string) => createHash('sha256').update(value).digest('hex');\n\n/**\n * An email is lower-cased and stripped of whitespace before hashing. Punctuation is left alone —\n * `@` and `.` are the address.\n */\nconst hashEmail = (email: string) => sha256(email.toLowerCase().replace(/\\s/g, ''));\n\n/**\n * A name is lower-cased and stripped of whitespace *and punctuation* before hashing, so that\n * `O'Brien`, `o brien` and `obrien` all land on the same digest. UTF-8 is what `update` already\n * encodes with.\n *\n * The schema's wording (\"lowercase with no spaces or punctuation\") leaves room to read the\n * apostrophe either way, so this is checked against its own worked example rather than guessed:\n * the `hashedFirstName` / `hashedLastName` digests it prints are sha256('mary') and\n * sha256('obrien') — Mary O'Brien with the apostrophe removed, not escaped or kept.\n */\nconst hashName = (name: string) => sha256(name.toLowerCase().replace(/[\\s\\p{P}]/gu, ''));\n\nexport type LinkedinConversionConfig = Record<Lowercase<string>, number>;\n\nexport async function sendEvents(\n  accessToken: string,\n  config: LinkedinConversionConfig,\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  events: TrackEvent<any>[],\n  data: UserProvidedData = {}\n) {\n  const eventNames = Object.keys(config);\n  const address = getFirst(data.address);\n  const userIds: { idType: UserIdType; idValue: string }[] = [];\n  const externalIds: [string, ...string[]] | undefined = data.user_id ? [data.user_id] : undefined;\n  const userInfo =\n    address?.first_name && address.last_name\n      ? {\n          hashedFirstName: hashName(address.first_name),\n          hashedLastName: hashName(address.last_name),\n          countryCode: address.country,\n        }\n      : undefined;\n\n  if (data.email) {\n    const email = getFirst(data.email);\n    if (email) userIds.push({ idType: 'SHA256_EMAIL', idValue: hashEmail(email) });\n  }\n\n  const fatIds = (tags: TrackTags): { idType: UserIdType; idValue: string }[] => {\n    const id = linkedinFatId(tags);\n    return id ? [{ idType: 'LINKEDIN_FIRST_PARTY_ADS_TRACKING_UUID', idValue: id }] : [];\n  };\n\n  const dto: CreateMultipleLinkedinEventsDTO = {\n    elements: events\n      .filter((event) => eventNames.includes(event.name) && !IGNORED_EVENTS.includes(event.name))\n      .map((event): CreateLinkedinEventDTO => ({\n        eventId: event.id,\n        conversion: `urn:lla:llaPartnerConversion:${config[event.name]}`,\n        conversionHappenedAt: new Date(event.created_at).getTime(),\n        conversionValue: {\n          currencyCode: event.properties?.currency?.toUpperCase() ?? 'USD',\n          amount: event.properties?.value?.toString() ?? '0',\n        },\n        user: {\n          userIds: [...fatIds(event.tags), ...userIds],\n          userInfo,\n          externalIds,\n        },\n      }))\n      // An element carrying no identifier at all fails validation, and LinkedIn fails the whole\n      // batch when one element fails — so a single anonymous event would discard every\n      // identifiable conversion sent alongside it. Dropped here instead.\n      .filter(\n        ({ user }) =>\n          user.userIds.length > 0 || !!user.userInfo || !!user.externalIds || !!user.lead\n      ),\n  };\n\n  if (dto.elements.length === 0) return;\n  try {\n    const response = await fetch('https://api.linkedin.com/rest/conversionEvents', {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'Content-Type': 'application/json',\n        'LinkedIn-Version': '202609',\n        'X-Restli-Protocol-Version': '2.0.0',\n        'X-RestLi-Method': 'BATCH_CREATE',\n      },\n      body: JSON.stringify(dto),\n    });\n\n    if (response.ok) return;\n    const { status } = response;\n    const message = await response.text();\n    console.error(`Failed to send LinkedIn conversion, status: ${status}, body: ${message}`);\n  } catch (error) {\n    console.error('Failed to send LinkedIn conversion, network error:', error);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAkFA,MAAM,UAAU,UAAkB,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;;;;;AAMjF,MAAM,aAAa,UAAkB,OAAO,MAAM,YAAY,CAAC,CAAC,QAAQ,OAAO,EAAE,CAAC;;;;;;;;;;;AAYlF,MAAM,YAAY,SAAiB,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,eAAe,EAAE,CAAC;AAIvF,eAAsB,WACpB,aACA,QAEA,QACA,OAAyB,CAAC,GAC1B;CACA,MAAM,aAAa,OAAO,KAAK,MAAM;CACrC,MAAM,UAAU,SAAS,KAAK,OAAO;CACrC,MAAM,UAAqD,CAAC;CAC5D,MAAM,cAAiD,KAAK,UAAU,CAAC,KAAK,OAAO,IAAI,KAAA;CACvF,MAAM,WACJ,SAAS,cAAc,QAAQ,YAC3B;EACE,iBAAiB,SAAS,QAAQ,UAAU;EAC5C,gBAAgB,SAAS,QAAQ,SAAS;EAC1C,aAAa,QAAQ;CACvB,IACA,KAAA;CAEN,IAAI,KAAK,OAAO;EACd,MAAM,QAAQ,SAAS,KAAK,KAAK;EACjC,IAAI,OAAO,QAAQ,KAAK;GAAE,QAAQ;GAAgB,SAAS,UAAU,KAAK;EAAE,CAAC;CAC/E;CAEA,MAAM,UAAU,SAA+D;EAC7E,MAAM,KAAK,cAAc,IAAI;EAC7B,OAAO,KAAK,CAAC;GAAE,QAAQ;GAA0C,SAAS;EAAG,CAAC,IAAI,CAAC;CACrF;CAEA,MAAM,MAAuC,EAC3C,UAAU,OACP,QAAQ,UAAU,WAAW,SAAS,MAAM,IAAI,KAAK,CAAC,eAAe,SAAS,MAAM,IAAI,CAAC,CAAC,CAC1F,KAAK,WAAmC;EACvC,SAAS,MAAM;EACf,YAAY,gCAAgC,OAAO,MAAM;EACzD,sBAAsB,IAAI,KAAK,MAAM,UAAU,CAAC,CAAC,QAAQ;EACzD,iBAAiB;GACf,cAAc,MAAM,YAAY,UAAU,YAAY,KAAK;GAC3D,QAAQ,MAAM,YAAY,OAAO,SAAS,KAAK;EACjD;EACA,MAAM;GACJ,SAAS,CAAC,GAAG,OAAO,MAAM,IAAI,GAAG,GAAG,OAAO;GAC3C;GACA;EACF;CACF,EAAE,CAAC,CAIF,QACE,EAAE,WACD,KAAK,QAAQ,SAAS,KAAK,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,KAAK,IAC/E,EACJ;CAEA,IAAI,IAAI,SAAS,WAAW,GAAG;CAC/B,IAAI;EACF,MAAM,WAAW,MAAM,MAAM,kDAAkD;GAC7E,QAAQ;GACR,SAAS;IACP,eAAe,UAAU;IACzB,gBAAgB;IAChB,oBAAoB;IACpB,6BAA6B;IAC7B,mBAAmB;GACrB;GACA,MAAM,KAAK,UAAU,GAAG;EAC1B,CAAC;EAED,IAAI,SAAS,IAAI;EACjB,MAAM,EAAE,WAAW;EACnB,MAAM,UAAU,MAAM,SAAS,KAAK;EACpC,QAAQ,MAAM,+CAA+C,OAAO,UAAU,SAAS;CACzF,SAAS,OAAO;EACd,QAAQ,MAAM,sDAAsD,KAAK;CAC3E;AACF"}
+{"version":3,"file":"linkedin-conversions-api.mjs","names":[],"sources":["../../src/server/linkedin-conversions-api.ts"],"sourcesContent":["/**\n * Conversions API Payload Builder: https://www.linkedin.com/developers/payload-builder\n * https://learn.microsoft.com/en-us/linkedin/marketing/conversions/conversions-overview?view=li-lms-2026-09\n */\nimport { createHash } from 'node:crypto';\nimport { fetch } from '@shware/utils';\nimport { IGNORED_EVENTS } from '../third-parties/ignored-events';\nimport type { TrackEvent, TrackTags, UserProvidedData } from '../track/types';\nimport { getFirst } from '../utils/field';\nimport { linkedinFatId } from './click-ids';\n\n/**\n * The identifier types LinkedIn matches on, as of version 202609. `ORACLE_MOAT_ID` used to be\n * here and is no longer in the schema; the IP and Android ones are.\n */\ntype UserIdType =\n  | 'SHA256_EMAIL'\n  | 'LINKEDIN_FIRST_PARTY_ADS_TRACKING_UUID'\n  | 'ACXIOM_ID'\n  | 'PLAINTEXT_IP_ADDRESS'\n  | 'SHA256_IP_ADDRESS'\n  | 'GOOGLE_AID';\n\nexport interface CreateLinkedinEventDTO {\n  /**\n   * For any conversion that you want to send through multiple methods, such as Insight Tag and\n   * Conversions API, you must create a conversion rule for each data source (browser and server).\n   * Then, you can implement a logic to pick up the eventId from the browser and send it with the\n   * corresponding event from your server. If we receive an Insight Tag event and a Conversions API\n   * event from the same account with the same eventId, we discard the Conversions API event and\n   * count only the Insight Tag event in campaign reporting.\n   */\n  eventId?: string;\n\n  /**\n   * Replace <id> with the conversion ID extracted when creating the conversion rule\n   * (e.g. urn:lla:llaPartnerConversion:<id>).\n   */\n  conversion: `urn:lla:llaPartnerConversion:${number}`;\n\n  /** Epoch timestamp in milliseconds at which the conversion event happened. */\n  conversionHappenedAt: number;\n  conversionValue: { currencyCode: string; amount: string };\n  user: {\n    userIds: { idType: UserIdType; idValue: string }[];\n    /**\n     * Probabilistic matching fields. `hashedFirstName` / `hashedLastName` arrived in 202609 and\n     * are what we send; the plaintext `firstName` / `lastName` they replace are still accepted by\n     * the API but are not listed here, because sending a name in the clear is not something this\n     * client should make easy to reach for.\n     */\n    userInfo?: {\n      hashedFirstName?: string;\n      hashedLastName?: string;\n      companyName?: string;\n      countryCode?: string;\n      title?: string;\n    };\n\n    /**\n     * The maximum supported size of the list is 1 at the moment. If the list contains multiple\n     * values, only the first value will be used.\n     */\n    externalIds?: [string, ...string[]];\n\n    /**\n     * This is generated when users submit the Linkedin Lead-gen form\n     * (e.g. urn:li:leadGenFormResponse:<id>).\n     */\n    lead?: `urn:li:leadGenFormResponse:${string}`;\n  };\n}\n\nexport interface CreateMultipleLinkedinEventsDTO {\n  elements: CreateLinkedinEventDTO[];\n}\n\n/**\n * The schema prescribes an exact normalization per field before hashing, and getting it wrong is\n * silent: LinkedIn accepts any 64-char hex digest and simply matches nobody. So these helpers are\n * the difference between attribution and nothing, not between 200 and 400.\n */\nconst sha256 = (value: string) => createHash('sha256').update(value).digest('hex');\n\n/**\n * An email is lower-cased and stripped of whitespace before hashing. Punctuation is left alone —\n * `@` and `.` are the address.\n */\nconst hashEmail = (email: string) => sha256(email.toLowerCase().replace(/\\s/g, ''));\n\n/**\n * A name is lower-cased and stripped of whitespace *and punctuation* before hashing, so that\n * `O'Brien`, `o brien` and `obrien` all land on the same digest. UTF-8 is what `update` already\n * encodes with.\n *\n * The schema's wording (\"lowercase with no spaces or punctuation\") leaves room to read the\n * apostrophe either way, so this is checked against its own worked example rather than guessed:\n * the `hashedFirstName` / `hashedLastName` digests it prints are sha256('mary') and\n * sha256('obrien') — Mary O'Brien with the apostrophe removed, not escaped or kept.\n */\nconst hashName = (name: string) => sha256(name.toLowerCase().replace(/[\\s\\p{P}]/gu, ''));\n\nexport type LinkedinConversionConfig = Record<Lowercase<string>, number>;\n\n/**\n * `conversionHappenedAt` must be \"within the past 90 days\", and one invalid record makes \"all\n * records fail\"; such an event is left out, with a minute's margin for the trip.\n */\nconst MAX_EVENT_AGE_MS = 90 * 24 * 60 * 60 * 1000 - 60 * 1000;\n\nexport async function sendEvents(\n  accessToken: string,\n  config: LinkedinConversionConfig,\n  // oxlint-disable-next-line @typescript-eslint/no-explicit-any\n  events: TrackEvent<any>[],\n  data: UserProvidedData = {}\n) {\n  const eventNames = Object.keys(config);\n  const address = getFirst(data.address);\n  const userIds: { idType: UserIdType; idValue: string }[] = [];\n  const externalIds: [string, ...string[]] | undefined = data.user_id ? [data.user_id] : undefined;\n  const userInfo =\n    address?.first_name && address.last_name\n      ? {\n          hashedFirstName: hashName(address.first_name),\n          hashedLastName: hashName(address.last_name),\n          countryCode: address.country,\n        }\n      : undefined;\n\n  if (data.email) {\n    const email = getFirst(data.email);\n    if (email) userIds.push({ idType: 'SHA256_EMAIL', idValue: hashEmail(email) });\n  }\n\n  const fatIds = (tags: TrackTags): { idType: UserIdType; idValue: string }[] => {\n    const id = linkedinFatId(tags);\n    return id ? [{ idType: 'LINKEDIN_FIRST_PARTY_ADS_TRACKING_UUID', idValue: id }] : [];\n  };\n\n  const dto: CreateMultipleLinkedinEventsDTO = {\n    elements: events\n      .filter((event) => eventNames.includes(event.name) && !IGNORED_EVENTS.includes(event.name))\n      .filter((event) => Date.now() - Date.parse(event.created_at) <= MAX_EVENT_AGE_MS)\n      .map((event): CreateLinkedinEventDTO => ({\n        eventId: event.id,\n        conversion: `urn:lla:llaPartnerConversion:${config[event.name]}`,\n        conversionHappenedAt: new Date(event.created_at).getTime(),\n        conversionValue: {\n          currencyCode: event.properties?.currency?.toUpperCase() ?? 'USD',\n          amount: event.properties?.value?.toString() ?? '0',\n        },\n        user: {\n          userIds: [...fatIds(event.tags), ...userIds],\n          userInfo,\n          externalIds,\n        },\n      }))\n      // An element carrying no identifier at all fails validation, and LinkedIn fails the whole\n      // batch when one element fails — so a single anonymous event would discard every\n      // identifiable conversion sent alongside it. Dropped here instead.\n      .filter(\n        ({ user }) =>\n          user.userIds.length > 0 || !!user.userInfo || !!user.externalIds || !!user.lead\n      ),\n  };\n\n  if (dto.elements.length === 0) return;\n  try {\n    const response = await fetch('https://api.linkedin.com/rest/conversionEvents', {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'Content-Type': 'application/json',\n        'LinkedIn-Version': '202609',\n        'X-Restli-Protocol-Version': '2.0.0',\n        'X-RestLi-Method': 'BATCH_CREATE',\n      },\n      body: JSON.stringify(dto),\n    });\n\n    if (response.ok) return;\n    const { status } = response;\n    const message = await response.text();\n    console.error(`Failed to send LinkedIn conversion, status: ${status}, body: ${message}`);\n  } catch (error) {\n    console.error('Failed to send LinkedIn conversion, network error:', error);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAkFA,MAAM,UAAU,UAAkB,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;;;;;AAMjF,MAAM,aAAa,UAAkB,OAAO,MAAM,YAAY,CAAC,CAAC,QAAQ,OAAO,EAAE,CAAC;;;;;;;;;;;AAYlF,MAAM,YAAY,SAAiB,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,eAAe,EAAE,CAAC;;;;;AAQvF,MAAM,mBAAmB;AAEzB,eAAsB,WACpB,aACA,QAEA,QACA,OAAyB,CAAC,GAC1B;CACA,MAAM,aAAa,OAAO,KAAK,MAAM;CACrC,MAAM,UAAU,SAAS,KAAK,OAAO;CACrC,MAAM,UAAqD,CAAC;CAC5D,MAAM,cAAiD,KAAK,UAAU,CAAC,KAAK,OAAO,IAAI,KAAA;CACvF,MAAM,WACJ,SAAS,cAAc,QAAQ,YAC3B;EACE,iBAAiB,SAAS,QAAQ,UAAU;EAC5C,gBAAgB,SAAS,QAAQ,SAAS;EAC1C,aAAa,QAAQ;CACvB,IACA,KAAA;CAEN,IAAI,KAAK,OAAO;EACd,MAAM,QAAQ,SAAS,KAAK,KAAK;EACjC,IAAI,OAAO,QAAQ,KAAK;GAAE,QAAQ;GAAgB,SAAS,UAAU,KAAK;EAAE,CAAC;CAC/E;CAEA,MAAM,UAAU,SAA+D;EAC7E,MAAM,KAAK,cAAc,IAAI;EAC7B,OAAO,KAAK,CAAC;GAAE,QAAQ;GAA0C,SAAS;EAAG,CAAC,IAAI,CAAC;CACrF;CAEA,MAAM,MAAuC,EAC3C,UAAU,OACP,QAAQ,UAAU,WAAW,SAAS,MAAM,IAAI,KAAK,CAAC,eAAe,SAAS,MAAM,IAAI,CAAC,CAAC,CAC1F,QAAQ,UAAU,KAAK,IAAI,IAAI,KAAK,MAAM,MAAM,UAAU,KAAK,gBAAgB,CAAC,CAChF,KAAK,WAAmC;EACvC,SAAS,MAAM;EACf,YAAY,gCAAgC,OAAO,MAAM;EACzD,sBAAsB,IAAI,KAAK,MAAM,UAAU,CAAC,CAAC,QAAQ;EACzD,iBAAiB;GACf,cAAc,MAAM,YAAY,UAAU,YAAY,KAAK;GAC3D,QAAQ,MAAM,YAAY,OAAO,SAAS,KAAK;EACjD;EACA,MAAM;GACJ,SAAS,CAAC,GAAG,OAAO,MAAM,IAAI,GAAG,GAAG,OAAO;GAC3C;GACA;EACF;CACF,EAAE,CAAC,CAIF,QACE,EAAE,WACD,KAAK,QAAQ,SAAS,KAAK,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,KAAK,IAC/E,EACJ;CAEA,IAAI,IAAI,SAAS,WAAW,GAAG;CAC/B,IAAI;EACF,MAAM,WAAW,MAAM,MAAM,kDAAkD;GAC7E,QAAQ;GACR,SAAS;IACP,eAAe,UAAU;IACzB,gBAAgB;IAChB,oBAAoB;IACpB,6BAA6B;IAC7B,mBAAmB;GACrB;GACA,MAAM,KAAK,UAAU,GAAG;EAC1B,CAAC;EAED,IAAI,SAAS,IAAI;EACjB,MAAM,EAAE,WAAW;EACnB,MAAM,UAAU,MAAM,SAAS,KAAK;EACpC,QAAQ,MAAM,+CAA+C,OAAO,UAAU,SAAS;CACzF,SAAS,OAAO;EACd,QAAQ,MAAM,sDAAsD,KAAK;CAC3E;AACF"}

package/dist/server/meta-capi.cjs

@@ -223,12 +223,18 @@ function getCapiEvent(event, data, appPackageName) {
 	return capiEvent;
 }
 /**
+* An `event_time` over 7 days old fails the whole request — "we return an error for the entire
+* request and process no events" — so such an event is left out; a minute's margin for the trip.
+* https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/server-event
+*/
+const MAX_EVENT_AGE_MS = 60474e4;
+/**
 * The lightweight counterpart to the legacy SDK sender (`@shware/analytics/server/legacy`):
 * same filtering, same payload, same never-throws contract, minus the 31MB SDK. The token
 * travels in the JSON body, never in the URL, and is never logged.
 */
 async function sendEvents(accessToken, pixelId, events, data = {}, options = {}) {
-	const capiEvents = events.filter((event) => !require_third_parties_ignored_events.IGNORED_EVENTS.includes(event.name)).map((event) => getCapiEvent(event, data, options.appPackageName));
+	const capiEvents = events.filter((event) => !require_third_parties_ignored_events.IGNORED_EVENTS.includes(event.name)).filter((event) => Date.now() - Date.parse(event.created_at) <= MAX_EVENT_AGE_MS).map((event) => getCapiEvent(event, data, options.appPackageName));
 	if (capiEvents.length === 0) return void 0;
 	const version = options.apiVersion ?? API_VERSION;
 	try {