stitchkit 0.112.1 → 0.112.2

package/CHANGELOG.md

@@ -15,6 +15,12 @@ additive**; the first breaking change landed in 0.10.0. Grep the file for
 
 ## [Unreleased]
 
+## [0.112.2] - 2026-10-25
+
+### Added
+
+- `stitchkit/tracking` — `resolveTrackedClick` and `createTrackingClient` accept `hrefPolicy: 'full'` to retain internal and outbound click query parameters and fragments before consumer `decorate` redaction. The default `path-only` policy, navigation classification, labels and listener cleanup stay unchanged; URL credentials remain excluded.
+
 ## [0.112.1] - 2026-10-25
 
 ### Fixed

package/dist/entrypoints/tracking.js

@@ -204,17 +204,18 @@ function sendUnloadBeacon(url, body, sender = typeof navigator === "undefined" ?
 function label(target) {
   return (target?.textContent ?? "").trim().slice(0, 100) || undefined;
 }
-function sanitizedHref(value, origin) {
+function trackedHref(value, origin, policy) {
   if (!value)
     return;
   try {
     const url = new URL(value, origin);
-    return url.origin === origin ? url.pathname : `${url.origin}${url.pathname}`;
+    const path = `${url.pathname}${policy === "full" ? url.search + url.hash : ""}`;
+    return url.origin === origin ? path : `${url.origin}${path}`;
   } catch {
     return;
   }
 }
-function resolveTrackedClick(target, { origin, attributes = {}, isAction = () => true }) {
+function resolveTrackedClick(target, { origin, attributes = {}, isAction = () => true, hrefPolicy }) {
   if (!target)
     return null;
   const trackAttribute = attributes.track ?? "data-track";
@@ -247,12 +248,15 @@ function resolveTrackedClick(target, { origin, attributes = {}, isAction = () =>
       result.click = {
         element,
         elementText: label(tracked),
-        href: sanitizedHref(href, origin)
+        href: trackedHref(href, origin, hrefPolicy)
       };
     }
   }
   if (outbound && href) {
-    result.outbound = { href: sanitizedHref(href, origin) ?? href, label: label(anchor) };
+    result.outbound = {
+      href: trackedHref(href, origin, hrefPolicy) ?? href,
+      label: label(anchor)
+    };
   }
   return result.interaction || result.click || result.outbound ? result : null;
 }
@@ -299,7 +303,8 @@ function wireTrackingListeners(deps) {
     const click = resolveTrackedClick(target, {
       origin: host.page().origin,
       attributes: deps.clickAttributes,
-      isAction: deps.isAction
+      isAction: deps.isAction,
+      hrefPolicy: deps.hrefPolicy
     });
     if (!click)
       return;
@@ -789,6 +794,7 @@ function createTrackingClient(config) {
           });
       },
       clickAttributes: config.clickAttributes,
+      hrefPolicy: config.hrefPolicy,
       isAction: config.isAction
     });
     return () => {

package/dist/tracking/clicks.d.ts

@@ -24,6 +24,8 @@ export interface ResolveTrackedClickOptions {
     attributes?: TrackedClickAttributes;
     /** Whether an action name is one the application knows. Default: any. */
     isAction?: (action: string) => boolean;
+    /** Click URLs omit query/fragment by default. `full` retains both for consumer redaction. */
+    hrefPolicy?: 'path-only' | 'full';
 }
 export interface TrackedClick {
     interaction?: {
@@ -42,5 +44,5 @@ export interface TrackedClick {
     /** The click navigates away — send its facts on the unload path. */
     leavesPage: boolean;
 }
-export declare function resolveTrackedClick(target: ClickTarget | null, { origin, attributes, isAction }: ResolveTrackedClickOptions): TrackedClick | null;
+export declare function resolveTrackedClick(target: ClickTarget | null, { origin, attributes, isAction, hrefPolicy }: ResolveTrackedClickOptions): TrackedClick | null;
 //# sourceMappingURL=clicks.d.ts.map

package/dist/tracking/clicks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clicks.d.ts","sourceRoot":"","sources":["../../src/tracking/clicks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,4EAA4E;AAC5E,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAAC;IAC9C,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC1C,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,4BAA4B;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,0BAA0B;IACzC,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,sBAAsB,CAAC;IACpC,yEAAyE;IACzE,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,oEAAoE;IACpE,UAAU,EAAE,OAAO,CAAC;CACrB;AAgBD,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,WAAW,GAAG,IAAI,EAC1B,EAAE,MAAM,EAAE,UAAe,EAAE,QAAqB,EAAE,EAAE,0BAA0B,GAC7E,YAAY,GAAG,IAAI,CA0CrB"}
+{"version":3,"file":"clicks.d.ts","sourceRoot":"","sources":["../../src/tracking/clicks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,4EAA4E;AAC5E,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAAC;IAC9C,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC1C,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,4BAA4B;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,0BAA0B;IACzC,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,sBAAsB,CAAC;IACpC,yEAAyE;IACzE,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,6FAA6F;IAC7F,UAAU,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,oEAAoE;IACpE,UAAU,EAAE,OAAO,CAAC;CACrB;AAqBD,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,WAAW,GAAG,IAAI,EAC1B,EAAE,MAAM,EAAE,UAAe,EAAE,QAAqB,EAAE,UAAU,EAAE,EAAE,0BAA0B,GACzF,YAAY,GAAG,IAAI,CA6CrB"}

package/dist/tracking/client-listeners.d.ts

@@ -25,6 +25,7 @@ export interface TrackingListenerDeps<TType extends string> {
     releaseLease(): void;
     readonly clickAttributes: Parameters<typeof resolveTrackedClick>[1]['attributes'];
     readonly isAction: Parameters<typeof resolveTrackedClick>[1]['isAction'];
+    readonly hrefPolicy: Parameters<typeof resolveTrackedClick>[1]['hrefPolicy'];
 }
 export declare function wireTrackingListeners<TType extends string>(deps: TrackingListenerDeps<TType>): Array<() => void>;
 //# sourceMappingURL=client-listeners.d.ts.map

package/dist/tracking/client-listeners.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-listeners.d.ts","sourceRoot":"","sources":["../../src/tracking/client-listeners.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,yBAAyB,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAE7D,MAAM,WAAW,oBAAoB,CAAC,KAAK,SAAS,MAAM;IACxD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACnD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC;IAC1D,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACrE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC;IACnC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IACxC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,WAAW,IAAI,MAAM,CAAC;IACtB,YAAY,IAAI,IAAI,CAAC;IACrB,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAClF,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;CAC1E;AAED,wBAAgB,qBAAqB,CAAC,KAAK,SAAS,MAAM,EACxD,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAC,GAChC,KAAK,CAAC,MAAM,IAAI,CAAC,CAsEnB"}
+{"version":3,"file":"client-listeners.d.ts","sourceRoot":"","sources":["../../src/tracking/client-listeners.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,yBAAyB,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAE7D,MAAM,WAAW,oBAAoB,CAAC,KAAK,SAAS,MAAM;IACxD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACnD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC;IAC1D,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACrE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC;IACnC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IACxC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,WAAW,IAAI,MAAM,CAAC;IACtB,YAAY,IAAI,IAAI,CAAC;IACrB,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAClF,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACzE,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;CAC9E;AAED,wBAAgB,qBAAqB,CAAC,KAAK,SAAS,MAAM,EACxD,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAC,GAChC,KAAK,CAAC,MAAM,IAAI,CAAC,CAuEnB"}

package/dist/tracking/client.d.ts

@@ -12,7 +12,7 @@
  * session. → ADR 0166.
  */
 import type { ReferrerRule, ResolvedAttribution } from './attribution.js';
-import type { TrackedClickAttributes } from './clicks.js';
+import type { ResolveTrackedClickOptions, TrackedClickAttributes } from './clicks.js';
 import type { TrackingHost } from './host.js';
 import type { TrackingOutbox } from './outbox.js';
 import type { TrackEventsRequest, TrackEventsResponse, TrackingEventEnvelope, VisitBootstrapResponse, VisitEntryContext } from './schemas.js';
@@ -88,6 +88,8 @@ export interface TrackingClientConfig<TMetadata extends object, TEvent extends T
     isAction?: (action: string) => boolean;
     referrerMap?: readonly ReferrerRule[];
     clickAttributes?: TrackedClickAttributes;
+    /** Click URL retention before `decorate`. Default `path-only`; `full` includes query/fragment. */
+    hrefPolicy?: ResolveTrackedClickOptions['hrefPolicy'];
     scrollMilestones?: readonly number[];
     /** Heartbeat and flush period. Default 30 s. */
     heartbeatMs?: number;

package/dist/tracking/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/tracking/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEvE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAYvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EAErB,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,WAAW,CAAC;AAInB,wFAAwF;AACxF,MAAM,WAAW,yBAAyB,CAAC,KAAK,SAAS,MAAM;IAC7D,QAAQ,EAAE,KAAK,CAAC;IAChB,SAAS,EAAE,KAAK,CAAC;IACjB,WAAW,EAAE,KAAK,CAAC;IACnB,SAAS,EAAE,KAAK,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;IACb,aAAa,EAAE,KAAK,CAAC;IACrB,WAAW,EAAE,KAAK,CAAC;CACpB;AAED,2DAA2D;AAC3D,eAAO,MAAM,iCAAiC;uBAClC,WAAW;wBACV,YAAY;0BACV,cAAc;wBAChB,mBAAmB;oBACvB,OAAO;4BACC,gBAAgB;0BAClB,aAAa;CAC0B,CAAC;AAEvD,2EAA2E;AAC3E,MAAM,MAAM,qBAAqB,CAAC,SAAS,IAAI;KAC5C,CAAC,IAAI,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,SAAS,GAAG,CAAC,GAAG,KAAK;CAC5E,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC;AAC5B,qEAAqE;AACrE,MAAM,MAAM,kBAAkB,CAAC,SAAS,IAAI;KACzC,CAAC,IAAI,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,SAAS,GAAG,KAAK,GAAG,CAAC;CAC5E,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC;AAE5B,sGAAsG;AACtG,MAAM,WAAW,OAAO,CAAC,SAAS;IAChC,CAAC,CAAC,SAAS,qBAAqB,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IAC5D,CAAC,CAAC,SAAS,kBAAkB,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;CAClF;AAED,MAAM,WAAW,oBAAoB,CACnC,SAAS,SAAS,MAAM,EACxB,MAAM,SAAS,qBAAqB,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,qBAAqB,CACpF,MAAM,SAAS,GAAG,MAAM,CACzB;IAED,IAAI,EAAE,YAAY,CAAC;IACnB,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,OAAO,EAAE,yBAAyB,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC;IAC7D,oEAAoE;IACpE,SAAS,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACzE;;;OAGG;IACH,OAAO,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC/E;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,MAAM,CAAC;IAC9E;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC;IAC1D,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IAChC,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACnD,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACtC,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAED,MAAM,WAAW,cAAc,CAAC,SAAS,SAAS,MAAM;IACtD,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1B,sFAAsF;IACtF,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACnD,yEAAyE;IACzE,KAAK,IAAI,MAAM,IAAI,CAAC;IACpB,OAAO,IAAI,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,IAAI,MAAM,GAAG,IAAI,CAAC;IACjC,8FAA8F;IAC9F,WAAW,IAAI,mBAAmB,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,MAAM,KAAK,CAAC,KAAK,SAAS,MAAM,IAAI,IAAI,CAC5C,qBAAqB,CAAC,KAAK,CAAC,EAC5B,SAAS,GAAG,SAAS,GAAG,iBAAiB,GAAG,iBAAiB,CAC9D,CAAC;AA0CF,wBAAgB,oBAAoB,CAClC,SAAS,SAAS,MAAM,EACxB,MAAM,SAAS,qBAAqB,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,qBAAqB,CACpF,MAAM,SAAS,GAAG,MAAM,CACzB,EACD,MAAM,EAAE,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,cAAc,CAAC,SAAS,CAAC,CAgM5E"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/tracking/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEvE,OAAO,KAAK,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAYnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EAErB,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,WAAW,CAAC;AAInB,wFAAwF;AACxF,MAAM,WAAW,yBAAyB,CAAC,KAAK,SAAS,MAAM;IAC7D,QAAQ,EAAE,KAAK,CAAC;IAChB,SAAS,EAAE,KAAK,CAAC;IACjB,WAAW,EAAE,KAAK,CAAC;IACnB,SAAS,EAAE,KAAK,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;IACb,aAAa,EAAE,KAAK,CAAC;IACrB,WAAW,EAAE,KAAK,CAAC;CACpB;AAED,2DAA2D;AAC3D,eAAO,MAAM,iCAAiC;uBAClC,WAAW;wBACV,YAAY;0BACV,cAAc;wBAChB,mBAAmB;oBACvB,OAAO;4BACC,gBAAgB;0BAClB,aAAa;CAC0B,CAAC;AAEvD,2EAA2E;AAC3E,MAAM,MAAM,qBAAqB,CAAC,SAAS,IAAI;KAC5C,CAAC,IAAI,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,SAAS,GAAG,CAAC,GAAG,KAAK;CAC5E,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC;AAC5B,qEAAqE;AACrE,MAAM,MAAM,kBAAkB,CAAC,SAAS,IAAI;KACzC,CAAC,IAAI,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,SAAS,GAAG,KAAK,GAAG,CAAC;CAC5E,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC;AAE5B,sGAAsG;AACtG,MAAM,WAAW,OAAO,CAAC,SAAS;IAChC,CAAC,CAAC,SAAS,qBAAqB,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IAC5D,CAAC,CAAC,SAAS,kBAAkB,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;CAClF;AAED,MAAM,WAAW,oBAAoB,CACnC,SAAS,SAAS,MAAM,EACxB,MAAM,SAAS,qBAAqB,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,qBAAqB,CACpF,MAAM,SAAS,GAAG,MAAM,CACzB;IAED,IAAI,EAAE,YAAY,CAAC;IACnB,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,OAAO,EAAE,yBAAyB,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC;IAC7D,oEAAoE;IACpE,SAAS,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACzE;;;OAGG;IACH,OAAO,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC/E;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,MAAM,CAAC;IAC9E;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC;IAC1D,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IAChC,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACnD,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACtC,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,kGAAkG;IAClG,UAAU,CAAC,EAAE,0BAA0B,CAAC,YAAY,CAAC,CAAC;IACtD,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAED,MAAM,WAAW,cAAc,CAAC,SAAS,SAAS,MAAM;IACtD,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1B,sFAAsF;IACtF,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACnD,yEAAyE;IACzE,KAAK,IAAI,MAAM,IAAI,CAAC;IACpB,OAAO,IAAI,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,IAAI,MAAM,GAAG,IAAI,CAAC;IACjC,8FAA8F;IAC9F,WAAW,IAAI,mBAAmB,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,MAAM,KAAK,CAAC,KAAK,SAAS,MAAM,IAAI,IAAI,CAC5C,qBAAqB,CAAC,KAAK,CAAC,EAC5B,SAAS,GAAG,SAAS,GAAG,iBAAiB,GAAG,iBAAiB,CAC9D,CAAC;AA0CF,wBAAgB,oBAAoB,CAClC,SAAS,SAAS,MAAM,EACxB,MAAM,SAAS,qBAAqB,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,qBAAqB,CACpF,MAAM,SAAS,GAAG,MAAM,CACzB,EACD,MAAM,EAAE,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,cAAc,CAAC,SAAS,CAAC,CAiM5E"}

package/llms/tracking.txt

@@ -100,6 +100,24 @@ createTrackingClient<BrowserEvents, TrackingEventEnvelope<keyof BrowserEvents> &
 })
 ```
 
+### Click URL retention
+
+`resolveTrackedClick(target, { origin, hrefPolicy: 'full' })` and
+`createTrackingClient({ …, hrefPolicy: 'full' })` retain the clicked URL's pathname,
+query and fragment. Internal URLs are relative (`/item?offer=one#details`);
+outbound URLs include their origin (`https://other.example/item?offer=one#details`).
+URL credentials are excluded. Omitting the option, or selecting `path-only`,
+keeps the default that omits query and fragment. Navigation classification,
+labels and subscriptions are independent of this policy.
+
+Full URLs may contain sensitive values. Supply your application's password and
+secret redactor through `decorate` before enabling `full`: it receives the retained
+`event.metadata.href` and must return the redacted metadata. The returned event is
+what the outbox, synchronous unload and normal delivery receive. The framework
+has no application-specific password policy. This option controls click and
+outbound-click metadata; it does not change attribution, page tracking or interaction
+metadata. Use the same redactor on your other ingestion paths.
+
 A `bootstrap` operation that needs extra fields of its own (a locale, a RUM
 flag) is not the factory's: build the `entry` schema with
 `createTrackingSchemas(…).entry.extend({ … })` and declare that endpoint yourself.
@@ -234,7 +252,7 @@ application's — it owns the router and the session. The server half is
 | Export | Kind | Summary |
 |--------|------|---------|
 | `createTrackingClient` | function | the client: visit lease and renewal, pending queue, synchronous identity from reserved sequences, outbox and flush lease, delivery, the string-body page-leave beacon plus a queued copy, visible time, scroll milestones, declarative clicks, heartbeats |
-| `TrackingClient` / `TrackingClientConfig` | _type_ | `track` / `onNavigate` / `start` / `visitId` / `browserStreamId` / `attribution`, and the host, `buildId`, `builtin` names, `bootstrap`, `deliver`, optional `decorate` (your `eventExtras` on every minted event), `unload` / `unloadUrl`, `outbox`, `onUnauthorized`, `onVisit`, `onFailure`, `isAction`, `referrerMap`, `clickAttributes`, `scrollMilestones`, `batchSize`, periods and limits |
+| `TrackingClient` / `TrackingClientConfig` | _type_ | `track` / `onNavigate` / `start` / `visitId` / `browserStreamId` / `attribution`, and the host, `buildId`, `builtin` names, `bootstrap`, `deliver`, optional `decorate` (your `eventExtras` on every minted event), `unload` / `unloadUrl`, `outbox`, `onUnauthorized`, `onVisit`, `onFailure`, `isAction`, `referrerMap`, `clickAttributes`, `hrefPolicy` (`path-only` by default; `full` retains click query/fragment before `decorate`), `scrollMilestones`, `batchSize`, periods and limits |
 | `TrackFn` / `EventsWithMetadata` / `EventsWithoutMetadata` | _type_ | `track(type)` / `track(type, metadata)` typed by the application's metadata map, and the two halves of that map |
 | `BuiltinTrackingEventTypes` / `CONVENTIONAL_TRACKING_EVENT_TYPES` | _type_ / const | the application's names for the events the client emits itself; the conventional `PAGE_VIEW` … `INTERACTION` set |
 | `browserTrackingHost` / `TrackingHost` / `TrackingPageContext` | function / _type_ | everything the client takes from a browser tab behind one interface — page context, visibility, scroll depth, events, intervals, clocks, storage — so a test or a non-tab host can supply its own |
@@ -258,6 +276,6 @@ application's — it owns the router and the session. The server half is
 | `createOncePerPage` / `OncePerPage` | function / _type_ | one fact per key per page within a window — the guard a twice-mounted component cannot keep itself |
 | `resolveAttribution` / `ResolveAttributionInput` / `ResolvedAttribution` / `AttributionStorage` / `ReferrerRule` | function / _type_ | first-touch once, current-touch on every new UTM; the referrer → source/medium map is the application's, there is no built-in list |
 | `parseUtmFromSearch` / `parseReferrer` | function | the two parsers `resolveAttribution` is built from |
-| `resolveTrackedClick` / `ResolveTrackedClickOptions` / `TrackedClick` / `TrackedClickAttributes` / `ClickTarget` | function / _type_ | `data-track` → click, `data-track-action` → interaction, a link to another origin → outbound; attribute names configurable; `leavesPage` says which path to send on |
+| `resolveTrackedClick` / `ResolveTrackedClickOptions` / `TrackedClick` / `TrackedClickAttributes` / `ClickTarget` | function / _type_ | `data-track` → click, `data-track-action` → interaction, a link to another origin → outbound; attribute names configurable; `hrefPolicy: 'full'` retains query/fragment (default `path-only` omits them), URL credentials excluded; `leavesPage` says which path to send on |
 
 ---

package/llms-full.txt

@@ -511,6 +511,24 @@ createTrackingClient<BrowserEvents, TrackingEventEnvelope<keyof BrowserEvents> &
 })
 ```
 
+### Click URL retention
+
+`resolveTrackedClick(target, { origin, hrefPolicy: 'full' })` and
+`createTrackingClient({ …, hrefPolicy: 'full' })` retain the clicked URL's pathname,
+query and fragment. Internal URLs are relative (`/item?offer=one#details`);
+outbound URLs include their origin (`https://other.example/item?offer=one#details`).
+URL credentials are excluded. Omitting the option, or selecting `path-only`,
+keeps the default that omits query and fragment. Navigation classification,
+labels and subscriptions are independent of this policy.
+
+Full URLs may contain sensitive values. Supply your application's password and
+secret redactor through `decorate` before enabling `full`: it receives the retained
+`event.metadata.href` and must return the redacted metadata. The returned event is
+what the outbox, synchronous unload and normal delivery receive. The framework
+has no application-specific password policy. This option controls click and
+outbound-click metadata; it does not change attribution, page tracking or interaction
+metadata. Use the same redactor on your other ingestion paths.
+
 A `bootstrap` operation that needs extra fields of its own (a locale, a RUM
 flag) is not the factory's: build the `entry` schema with
 `createTrackingSchemas(…).entry.extend({ … })` and declare that endpoint yourself.
@@ -23280,7 +23298,7 @@ application's — it owns the router and the session. The server half is
 | Export | Kind | Summary |
 |--------|------|---------|
 | `createTrackingClient` | function | the client: visit lease and renewal, pending queue, synchronous identity from reserved sequences, outbox and flush lease, delivery, the string-body page-leave beacon plus a queued copy, visible time, scroll milestones, declarative clicks, heartbeats |
-| `TrackingClient` / `TrackingClientConfig` | _type_ | `track` / `onNavigate` / `start` / `visitId` / `browserStreamId` / `attribution`, and the host, `buildId`, `builtin` names, `bootstrap`, `deliver`, optional `decorate` (your `eventExtras` on every minted event), `unload` / `unloadUrl`, `outbox`, `onUnauthorized`, `onVisit`, `onFailure`, `isAction`, `referrerMap`, `clickAttributes`, `scrollMilestones`, `batchSize`, periods and limits |
+| `TrackingClient` / `TrackingClientConfig` | _type_ | `track` / `onNavigate` / `start` / `visitId` / `browserStreamId` / `attribution`, and the host, `buildId`, `builtin` names, `bootstrap`, `deliver`, optional `decorate` (your `eventExtras` on every minted event), `unload` / `unloadUrl`, `outbox`, `onUnauthorized`, `onVisit`, `onFailure`, `isAction`, `referrerMap`, `clickAttributes`, `hrefPolicy` (`path-only` by default; `full` retains click query/fragment before `decorate`), `scrollMilestones`, `batchSize`, periods and limits |
 | `TrackFn` / `EventsWithMetadata` / `EventsWithoutMetadata` | _type_ | `track(type)` / `track(type, metadata)` typed by the application's metadata map, and the two halves of that map |
 | `BuiltinTrackingEventTypes` / `CONVENTIONAL_TRACKING_EVENT_TYPES` | _type_ / const | the application's names for the events the client emits itself; the conventional `PAGE_VIEW` … `INTERACTION` set |
 | `browserTrackingHost` / `TrackingHost` / `TrackingPageContext` | function / _type_ | everything the client takes from a browser tab behind one interface — page context, visibility, scroll depth, events, intervals, clocks, storage — so a test or a non-tab host can supply its own |
@@ -23304,7 +23322,7 @@ application's — it owns the router and the session. The server half is
 | `createOncePerPage` / `OncePerPage` | function / _type_ | one fact per key per page within a window — the guard a twice-mounted component cannot keep itself |
 | `resolveAttribution` / `ResolveAttributionInput` / `ResolvedAttribution` / `AttributionStorage` / `ReferrerRule` | function / _type_ | first-touch once, current-touch on every new UTM; the referrer → source/medium map is the application's, there is no built-in list |
 | `parseUtmFromSearch` / `parseReferrer` | function | the two parsers `resolveAttribution` is built from |
-| `resolveTrackedClick` / `ResolveTrackedClickOptions` / `TrackedClick` / `TrackedClickAttributes` / `ClickTarget` | function / _type_ | `data-track` → click, `data-track-action` → interaction, a link to another origin → outbound; attribute names configurable; `leavesPage` says which path to send on |
+| `resolveTrackedClick` / `ResolveTrackedClickOptions` / `TrackedClick` / `TrackedClickAttributes` / `ClickTarget` | function / _type_ | `data-track` → click, `data-track-action` → interaction, a link to another origin → outbound; attribute names configurable; `hrefPolicy: 'full'` retains query/fragment (default `path-only` omits them), URL credentials excluded; `leavesPage` says which path to send on |
 
 ---
 

package/llms.txt

@@ -45,7 +45,7 @@ Load the slice for each entrypoint your code imports — `import … from 'stitc
 - **stitchkit/telegram**: [llms/telegram.txt](llms/telegram.txt) 36.6 KB
 - **stitchkit/telegram/html**: [llms/telegram-html.txt](llms/telegram-html.txt) 2.7 KB
 - **stitchkit/telegram/screens**: [llms/telegram-screens.txt](llms/telegram-screens.txt) 21.2 KB
-- **stitchkit/tracking**: [llms/tracking.txt](llms/tracking.txt) 16.8 KB
+- **stitchkit/tracking**: [llms/tracking.txt](llms/tracking.txt) 18.1 KB
 - **stitchkit/release**: [llms/release.txt](llms/release.txt) 8.9 KB
 - **stitchkit/tracking/server**: [llms/tracking-server.txt](llms/tracking-server.txt) 2.5 KB
 - **stitchkit/geo**: [llms/geo.txt](llms/geo.txt) 4.1 KB

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stitchkit",
-  "version": "0.112.1",
+  "version": "0.112.2",
   "description": "Contract-first backend framework — one defineContract() into an HTTP API, MCP tools, AI-agent tools and a typed client. Bun and Node.",
   "keywords": [
     "bun",