luchy 0.1.0 → 1.0.1

package/dist/index.js

@@ -21,9 +21,58 @@ function collectBrowserData() {
     language: navigator.language || navigator.languages?.[0] || "en"
   };
 }
+function parseProps(raw) {
+  if (!raw) return void 0;
+  try {
+    const value = JSON.parse(raw);
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      return void 0;
+    }
+    return value;
+  } catch {
+    return void 0;
+  }
+}
 function luchy(options) {
   const endpoint = options.endpoint || "https://api.luchy.app/ingest";
-  const { apiKey, trackLocalhost = false } = options;
+  const { apiKey, trackLocalhost = false, script } = options;
+  let identity = options.identity;
+  let props = options.props;
+  function currentIdentity() {
+    if (!script) return identity;
+    return script.getAttribute("data-identity") || void 0;
+  }
+  function currentProps() {
+    if (!script) return props;
+    return parseProps(script.getAttribute("data-props"));
+  }
+  function identify(token, nextProps) {
+    if (!script) {
+      identity = token;
+      props = nextProps;
+      return;
+    }
+    script.setAttribute("data-identity", token);
+    if (nextProps) {
+      script.setAttribute("data-props", JSON.stringify(nextProps));
+    } else {
+      script.removeAttribute("data-props");
+    }
+  }
+  function reset() {
+    if (!script) {
+      identity = void 0;
+      props = void 0;
+      return;
+    }
+    script.removeAttribute("data-identity");
+    script.removeAttribute("data-props");
+  }
+  function withProps(payload) {
+    const global = currentProps();
+    if (!global) return payload;
+    return { ...global, ...payload };
+  }
   const shouldTrack = () => {
     if (trackLocalhost) return true;
     return location.hostname !== "localhost" && location.hostname !== "127.0.0.1";
@@ -39,6 +88,8 @@ function luchy(options) {
       data: {
         pathname,
         referrer,
+        payload: withProps(data?.payload),
+        identity: currentIdentity(),
         ...browserData
       }
     });
@@ -57,7 +108,8 @@ function luchy(options) {
         // `payload`, NOT `props`. The ingest endpoint validates with a
         // non-passthrough zod object, so an unknown key is stripped and the
         // event is stored with no properties at all — 200, success, no data.
-        payload,
+        payload: withProps(payload),
+        identity: currentIdentity(),
         ...browserData
       }
     });
@@ -219,11 +271,9 @@ function luchy(options) {
         const key = attr.name.slice(prefix.length).replace(/-/g, "_");
         payload[key] = attr.value;
       }
-      trackEvent(
-        name,
-        Object.keys(payload).length > 0 ? payload : void 0,
-        { type: "click" }
-      );
+      trackEvent(name, Object.keys(payload).length > 0 ? payload : void 0, {
+        type: "click"
+      });
     };
     document.addEventListener("click", dataEventClickListener);
   }
@@ -268,6 +318,8 @@ function luchy(options) {
   return {
     trackPageview,
     trackEvent,
+    identify,
+    reset,
     setOptions
   };
 }
@@ -280,7 +332,8 @@ if (typeof document !== "undefined" && document.currentScript) {
     const tracker = luchy({
       apiKey,
       endpoint,
-      trackLocalhost
+      trackLocalhost,
+      script
     });
     const autoPageviewsAttr = script.getAttribute("data-auto-pageviews");
     const autoOutboundAttr = script.getAttribute("data-auto-outbound");

package/dist/react-router.d.ts

@@ -0,0 +1,232 @@
+import { ReactElement } from 'react';
+import { MiddlewareFunction, RouterContextProvider } from 'react-router';
+import { LuchyIdentity } from './identity.js';
+import { LuchyPayload, LuchyTraits } from './server.js';
+/**
+ * React Router (v7.9+) — server events derived from requests, plus the
+ * identity the browser script needs.
+ *
+ * A React Router app already says what it did, in the request: every console
+ * mutation is a form POST whose `intent` field names it (`rotate`,
+ * `invite-member`, `create-api-key`, …), every JSON API mutation is
+ * discriminated by its method, and every auth verb has a path that names the
+ * operation. So instead of sprinkling `track` calls across route modules —
+ * where a new intent is only tracked once somebody remembers to instrument it
+ * — a root middleware derives the event from the request it is already
+ * holding: normalized route + intent (or method).
+ *
+ * The same middleware resolves who the request belongs to, once, and hands a
+ * signed token to the root loader (`getLuchy`) so `<LuchyScript>` can put it
+ * on the browser script. Server events and browser pageviews then land in the
+ * same session.
+ *
+ * Only requests React Router routes are seen — anything the Worker answers
+ * before handing over to React Router is invisible here.
+ *
+ * Not Cloudflare-only: shipping goes through the injected `waitUntil`, so this
+ * module imports no runtime.
+ *
+ * @module
+ */
+export type { LuchyIdentity, LuchyTraits };
+/** A property bag. Nested objects are not supported by the ingest API. */
+export type LuchyRequestPayload = LuchyPayload;
+/**
+ * True for the methods worth an event.
+ *
+ * Reads are the browser tracker's job; only mutations describe what the app
+ * did.
+ *
+ * ```ts
+ * isMutatingMethod('post'); // true
+ * isMutatingMethod('GET'); // false
+ * ```
+ */
+export declare function isMutatingMethod(method: string): boolean;
+/**
+ * True when the request body is worth parsing for an `intent` field.
+ *
+ * Only urlencoded bodies are read: a multipart upload could be megabytes, and
+ * no route reads an intent out of one.
+ *
+ * ```ts
+ * carriesIntent(request.headers.get('content-type'));
+ * ```
+ */
+export declare function carriesIntent(contentType: string | null | undefined): boolean;
+/**
+ * Turns a pathname into a route name: `/users/aBc123.../identities` →
+ * `users/:id/identities`.
+ *
+ * Client-side submissions land on React Router's single-fetch URL
+ * (`/users/abc.data`), so the `.data` suffix is stripped — otherwise the same
+ * action would report under two names depending on whether the page was
+ * hydrated. `/` and the single-fetch root (`/_root.data`) both become `home`.
+ */
+export declare function normalizeRoute(pathname: string): string;
+/** What `serverEventName` needs to know about a finished request. */
+export type ServerEventInput = {
+    method: string;
+    /** The raw pathname, before normalization. */
+    pathname: string;
+    /** The response status. Only consulted when `trackFailures` is false. */
+    status: number;
+    /** The submitted `intent`, if the body carried one. */
+    intent?: string | null;
+};
+/** The naming and filtering knobs, shared by the middleware and the pure helper. */
+export type ServerEventNameConfig = Pick<LuchyMiddlewareOptions, 'ignorePrefixes' | 'ignoreRouteSuffixes' | 'ignoreEvents' | 'trackFailures' | 'methodSuffix'>;
+/**
+ * The event name for a mutation, or `null` when the request is not worth an
+ * event (a read, machine traffic, an ignored route, a failure the app does not
+ * track).
+ *
+ * Names are `route:intent` — an intent alone is ambiguous (`delete` and
+ * `update` appear on several routes), the pair is not. Without an intent the
+ * name is the bare route, or `route:post` / `route:delete` when
+ * `methodSuffix` is on, which keeps a REST route's methods distinct.
+ *
+ * ```ts
+ * serverEventName({ method: 'POST', pathname: '/team', status: 200, intent: 'invite' });
+ * // 'team:invite'
+ * ```
+ */
+export declare function serverEventName(input: ServerEventInput, config?: ServerEventNameConfig): string | null;
+/** What the root middleware gets from React Router. */
+export type LuchyMiddlewareArgs = Parameters<MiddlewareFunction>[0];
+/**
+ * Generic over what `next()` resolves to, so it fits both framework mode's
+ * `Route.MiddlewareFunction` (a Response) and data-mode route objects.
+ */
+export type LuchyMiddleware = <Result>(args: LuchyMiddlewareArgs, next: () => Promise<Result>) => Promise<Result>;
+/**
+ * An identity plus the props to stamp on every event of the request, and the
+ * person's profile traits (sent via identify, deduped per isolate).
+ */
+export type LuchyRequestIdentity = LuchyIdentity & {
+    props?: LuchyRequestPayload;
+    traits?: LuchyTraits;
+};
+/** Clears the identify dedupe. For tests. */
+export declare function resetIdentifyCache(): void;
+export type LuchyMiddlewareOptions = {
+    /** A Luchy API key. The public ingest key is fine — it ships in the HTML. */
+    apiKey: string;
+    /**
+     * The project's secret key (`lsk_…`). Without it no identity is sent —
+     * ingest would drop an unsigned one anyway — and traits are not identified.
+     */
+    secret?: string;
+    /** The ingest base, without a trailing slash. Defaults to the hosted API. */
+    endpoint?: string;
+    /**
+     * Defaults to `true`. When false no server event is produced — no clone, no
+     * request read, no network. `getLuchy` keeps working so the browser script
+     * still renders.
+     */
+    enabled?: boolean;
+    /**
+     * How to keep the event alive after the response is sent. Called only for
+     * requests that produce an event. On Cloudflare:
+     * `({ context }) => (p) => context.get(cfContext).ctx.waitUntil(p)`.
+     */
+    waitUntil: (args: LuchyMiddlewareArgs) => (promise: Promise<unknown>) => void;
+    /**
+     * Who the request belongs to. Resolved lazily — only when an event ships or
+     * `getLuchy` asks — and at most once per request. A rejection is reported
+     * to `onError` and the request is treated as anonymous.
+     *
+     * Return `traits` (`{ name, email }`, …) to keep the person's profile up to
+     * date: they are sent via identify through `waitUntil`, at most once per
+     * isolate per hour for the same user and traits. Requires `secret`.
+     */
+    identity?: (args: LuchyMiddlewareArgs) => LuchyRequestIdentity | undefined | Promise<LuchyRequestIdentity | undefined>;
+    /**
+     * Raw-pathname prefixes to drop, matched before normalization. Merged with
+     * the built-in defaults (`/__manifest`) rather than replacing them.
+     */
+    ignorePrefixes?: string[];
+    /**
+     * Normalized-route suffixes to drop, e.g. `/user-keys/validate`. Matched on
+     * the route so that literal app ids in the path do not each need an entry.
+     */
+    ignoreRouteSuffixes?: string[];
+    /** Fully-formed event names to drop, e.g. `notifications:markRead`. */
+    ignoreEvents?: string[];
+    /**
+     * Defaults to `false`: a 4xx/5xx produces no event. Turn it on when failed
+     * mutations are themselves product signal (the `status` payload field tells
+     * them apart).
+     */
+    trackFailures?: boolean;
+    /**
+     * Defaults to `false`: an intent-less mutation is named after its route
+     * alone. Turn it on for REST-ish routes, where `PATCH` and `DELETE` on the
+     * same path should report as `route:patch` and `route:delete`.
+     */
+    methodSuffix?: boolean;
+    /** Called when anything in the pipeline fails. Nothing else surfaces it. */
+    onError?: (error: unknown) => void;
+    /** Transport override, for tests and scoped runtimes (service bindings). */
+    fetch?: typeof globalThis.fetch;
+};
+/** What the browser script needs: spread it into `<LuchyScript>`. */
+export type LuchyClientConfig = {
+    apiKey: string;
+    /** The ingest base, as the script's `data-endpoint` takes it. */
+    endpoint: string;
+    /** The signed identity token, when the request has an identity. */
+    identity?: string;
+    props?: LuchyRequestPayload;
+};
+/**
+ * The root middleware. Every mutation React Router serves becomes an event;
+ * every request gets the state `getLuchy` reads.
+ *
+ * ```ts
+ * // app/root.tsx
+ * export const middleware: Route.MiddlewareFunction[] = [
+ *   luchyMiddleware({
+ *     apiKey: env.LUCHY_API_KEY,
+ *     secret: env.LUCHY_SECRET,
+ *     waitUntil: ({ context }) => (p) => context.get(cfContext).ctx.waitUntil(p),
+ *     identity: async ({ context }) => {
+ *       const s = await context.get(appContext).getMaybeSessionContext();
+ *       if (!s) {
+ *         return undefined;
+ *       }
+ *
+ *       return { user: s.user.id, tenant: String(s.workspaceId) };
+ *     }
+ *   })
+ * ];
+ * ```
+ */
+export declare function luchyMiddleware(options: LuchyMiddlewareOptions): LuchyMiddleware;
+/**
+ * The browser script's config for this request, for the root loader. Resolves
+ * the request's identity (once — the middleware shares it) and signs it.
+ *
+ * ```ts
+ * export async function loader({ context }: Route.LoaderArgs) {
+ *   return { luchy: await getLuchy(context) };
+ * }
+ * ```
+ */
+export declare function getLuchy(context: Readonly<RouterContextProvider>): Promise<LuchyClientConfig>;
+export type LuchyScriptProps = LuchyClientConfig & {
+    /** Defaults to the CDN build. */
+    src?: string;
+    /** For a CSP that allows scripts by nonce. */
+    nonce?: string;
+};
+/**
+ * The browser script tag. Render it in the root layout with what `getLuchy`
+ * returned. The script re-reads `data-identity` / `data-props` on every send,
+ * so a re-render after login or logout is picked up without a reload.
+ *
+ * It must be server-rendered: React does not execute `<script>` elements it
+ * creates on the client.
+ */
+export declare function LuchyScript(props: LuchyScriptProps): ReactElement;
+//# sourceMappingURL=react-router.d.ts.map

package/dist/react-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"react-router.d.ts","sourceRoot":"","sources":["../src/react-router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,OAAO,CAAC;AACzD,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC3B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAgB,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AAErB;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;AAE3C,0EAA0E;AAC1E,MAAM,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAe/C;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE7E;AAaD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQvD;AAED,qEAAqE;AACrE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,qBAAqB,GAAG,IAAI,CACtC,sBAAsB,EACpB,gBAAgB,GAChB,qBAAqB,GACrB,cAAc,GACd,eAAe,GACf,cAAc,CACjB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,gBAAgB,EACvB,MAAM,GAAE,qBAA0B,GACjC,MAAM,GAAG,IAAI,CA0Bf;AAED,uDAAuD;AACvD,MAAM,MAAM,mBAAmB,GAAG,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpE;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,MAAM,EACnC,IAAI,EAAE,mBAAmB,EACzB,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,KACxB,OAAO,CAAC,MAAM,CAAC,CAAC;AAErB;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,aAAa,GAAG;IACjD,KAAK,CAAC,EAAE,mBAAmB,CAAC;IAC5B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAkDF,6CAA6C;AAC7C,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,SAAS,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IAC9E;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,mBAAmB,KAEvB,oBAAoB,GACpB,SAAS,GACT,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IAC9C;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,uEAAuE;IACvE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACnC,4EAA4E;IAC5E,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACjC,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,mBAAmB,CAAC;CAC7B,CAAC;AAsCF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,sBAAsB,GAC9B,eAAe,CAqKjB;AAED;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAC5B,OAAO,EAAE,QAAQ,CAAC,qBAAqB,CAAC,GACvC,OAAO,CAAC,iBAAiB,CAAC,CAqB5B;AAED,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,GAAG;IACjD,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAIF;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,YAAY,CAUjE"}

package/dist/react-router.js

@@ -0,0 +1,244 @@
+import { createElement } from "react";
+import { createContext } from "react-router";
+import { DEFAULT_ENDPOINT, createLuchy, signIdentity } from "./server.js";
+const MUTATING_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+const DEFAULT_IGNORE_PREFIXES = ["/__manifest"];
+const INTENT_PATTERN = /^[A-Za-z0-9_-]{1,40}$/;
+function isMutatingMethod(method) {
+  return MUTATING_METHODS.has(method.toUpperCase());
+}
+function carriesIntent(contentType) {
+  return (contentType ?? "").includes("application/x-www-form-urlencoded");
+}
+function isIdSegment(segment) {
+  if (segment.length === 0) return false;
+  if (/^\d+$/.test(segment)) return true;
+  if (/^[0-9a-f]{8}-[0-9a-f]{4}-/i.test(segment)) return true;
+  return segment.length >= 16 && /\d/.test(segment);
+}
+function normalizeRoute(pathname) {
+  const segments = pathname.replace(/\.data$/, "").split("/").filter(Boolean);
+  if (segments.length === 0) return "home";
+  if (segments.length === 1 && segments[0] === "_root") return "home";
+  return segments.map((s) => isIdSegment(s) ? ":id" : s).join("/");
+}
+function serverEventName(input, config = {}) {
+  const method = input.method.toUpperCase();
+  if (!MUTATING_METHODS.has(method)) return null;
+  if (!config.trackFailures && input.status >= 400) return null;
+  const prefixes = [
+    ...DEFAULT_IGNORE_PREFIXES,
+    ...config.ignorePrefixes ?? []
+  ];
+  if (prefixes.some((p) => input.pathname.startsWith(p))) return null;
+  const route = normalizeRoute(input.pathname);
+  if ((config.ignoreRouteSuffixes ?? []).some((s) => route.endsWith(s))) {
+    return null;
+  }
+  const intent = input.intent && INTENT_PATTERN.test(input.intent) ? input.intent : null;
+  const name = intent ? `${route}:${intent}` : config.methodSuffix ? `${route}:${method.toLowerCase()}` : route;
+  if ((config.ignoreEvents ?? []).includes(name)) return null;
+  return name;
+}
+const IDENTIFY_TTL_MS = 60 * 60 * 1e3;
+const IDENTIFY_MAX_ENTRIES = 1e3;
+const identified = /* @__PURE__ */ new Map();
+function traitsHash(traits) {
+  const json = JSON.stringify(
+    Object.keys(traits).sort().map((key) => [key, traits[key]])
+  );
+  let hash = 2166136261;
+  for (let i = 0; i < json.length; i++) {
+    hash ^= json.charCodeAt(i);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(36);
+}
+function claimIdentify(key, traits, now) {
+  const hash = traitsHash(traits);
+  const seen = identified.get(key);
+  if (seen && seen.hash === hash && now - seen.at < IDENTIFY_TTL_MS) {
+    return false;
+  }
+  identified.delete(key);
+  if (identified.size >= IDENTIFY_MAX_ENTRIES) {
+    const oldest = identified.keys().next().value;
+    if (oldest !== void 0) identified.delete(oldest);
+  }
+  identified.set(key, { hash, at: now });
+  return true;
+}
+function resetIdentifyCache() {
+  identified.clear();
+}
+const luchyContext = createContext(null);
+function clientInfo(request) {
+  const headers = request.headers;
+  const cf = request.cf;
+  const cfCountry = typeof cf?.country === "string" ? cf.country : void 0;
+  const language = headers.get("accept-language")?.split(",")[0]?.split(";")[0]?.trim();
+  return {
+    ip: headers.get("cf-connecting-ip") ?? void 0,
+    country: cfCountry ?? headers.get("cf-ipcountry") ?? void 0,
+    language: language || void 0,
+    userAgent: headers.get("user-agent") ?? void 0
+  };
+}
+function luchyMiddleware(options) {
+  const enabled = options.enabled ?? true;
+  const endpoint = (options.endpoint || DEFAULT_ENDPOINT).replace(/\/+$/, "");
+  const prefixes = [
+    ...DEFAULT_IGNORE_PREFIXES,
+    ...options.ignorePrefixes ?? []
+  ];
+  const luchy = createLuchy({
+    apiKey: options.apiKey,
+    secret: options.secret,
+    endpoint,
+    fetch: options.fetch,
+    onError: options.onError
+  });
+  function identify(args, user, traits) {
+    if (!claimIdentify(`${options.apiKey}\0${user}`, traits, Date.now())) {
+      return;
+    }
+    try {
+      options.waitUntil(args)(luchy.identify(user, traits));
+    } catch (error) {
+      options.onError?.(error);
+    }
+  }
+  function identityResolver(args) {
+    let memo;
+    async function resolve() {
+      if (!options.identity) {
+        return void 0;
+      }
+      try {
+        const resolved = await options.identity(args);
+        if (!resolved) {
+          return void 0;
+        }
+        const { props, traits, ...identity } = resolved;
+        if (enabled && traits) {
+          identify(args, identity.user, traits);
+        }
+        const token = options.secret ? await signIdentity(identity, options.secret) : void 0;
+        return { token, props };
+      } catch (error) {
+        options.onError?.(error);
+        return void 0;
+      }
+    }
+    return () => {
+      memo ?? (memo = resolve());
+      return memo;
+    };
+  }
+  return async (args, next) => {
+    const { request } = args;
+    const resolveIdentity = identityResolver(args);
+    args.context.set(luchyContext, {
+      apiKey: options.apiKey,
+      endpoint,
+      resolveIdentity
+    });
+    if (!enabled) {
+      return next();
+    }
+    if (!isMutatingMethod(request.method)) {
+      return next();
+    }
+    const url = new URL(request.url);
+    if (prefixes.some((p) => url.pathname.startsWith(p))) {
+      return next();
+    }
+    const clone = carriesIntent(request.headers.get("content-type")) ? request.clone() : null;
+    async function ship(status) {
+      const intent = clone ? new URLSearchParams(await clone.text()).get("intent") : null;
+      const name = serverEventName(
+        { method: request.method, pathname: url.pathname, status, intent },
+        options
+      );
+      if (!name) {
+        return;
+      }
+      const who = await resolveIdentity();
+      await luchy.track(
+        {
+          name,
+          type: "server",
+          // The raw pathname, not the normalized route: the name carries the
+          // shape, the pathname keeps the detail.
+          pathname: url.pathname,
+          // `status` last: it is the tracker's own field, props cannot fake it.
+          payload: { ...who?.props, status },
+          ...clientInfo(request)
+        },
+        who?.token
+      );
+    }
+    function schedule(status) {
+      try {
+        options.waitUntil(args)(
+          ship(status).catch((error) => {
+            options.onError?.(error);
+          })
+        );
+      } catch (error) {
+        options.onError?.(error);
+      }
+    }
+    let result;
+    try {
+      result = await next();
+    } catch (thrown) {
+      schedule(thrown instanceof Response ? thrown.status : 500);
+      throw thrown;
+    }
+    schedule(result instanceof Response ? result.status : 200);
+    return result;
+  };
+}
+async function getLuchy(context) {
+  const state = context.get(luchyContext);
+  if (!state) {
+    throw new Error(
+      "getLuchy: luchyMiddleware is not installed on the root route"
+    );
+  }
+  const config = {
+    apiKey: state.apiKey,
+    endpoint: state.endpoint
+  };
+  const resolved = await state.resolveIdentity();
+  if (resolved?.token) {
+    config.identity = resolved.token;
+  }
+  if (resolved?.props) {
+    config.props = resolved.props;
+  }
+  return config;
+}
+const DEFAULT_SRC = "https://cdn.luchy.app/luchy.min.js";
+function LuchyScript(props) {
+  return createElement("script", {
+    src: props.src ?? DEFAULT_SRC,
+    defer: true,
+    nonce: props.nonce,
+    "data-api-key": props.apiKey,
+    "data-endpoint": props.endpoint,
+    "data-identity": props.identity,
+    "data-props": props.props ? JSON.stringify(props.props) : void 0
+  });
+}
+export {
+  LuchyScript,
+  carriesIntent,
+  getLuchy,
+  isMutatingMethod,
+  luchyMiddleware,
+  normalizeRoute,
+  resetIdentifyCache,
+  serverEventName
+};