tracklane 0.5.0 → 0.7.0

package/dist/index.d.ts

@@ -1,2 +1,2 @@
-import { C as ProviderDefault, S as EventItem, T as UserData, b as EventBinding, f as EventContext, g as ServerTrackingOptions, h as ServerTracking, i as TrackOptions, m as ServerProvider, n as BrowserTracking, p as ResolvedContext, r as BrowserTrackingOptions, t as BrowserProvider, v as ActionSource, w as TrackingError, x as EventData, y as ConsentState } from "./browser-CddkJdvX.js";
-export type { ActionSource, BrowserProvider, BrowserTracking, BrowserTrackingOptions, ConsentState, EventBinding, EventContext, EventData, EventItem, ProviderDefault, ResolvedContext, ServerProvider, ServerTracking, ServerTrackingOptions, TrackOptions, TrackingError, UserData };
+import { B as VendorResponseError, C as EventData, D as UserData, E as TrackingError, S as EventBinding, T as ProviderDefault, V as isVendorResponseError, _ as ServerTracking, b as ActionSource, g as ServerProvider, h as ResolvedContext, i as TrackOptions, m as EventContext, n as BrowserTracking, r as BrowserTrackingOptions, t as BrowserProvider, v as ServerTrackingOptions, w as EventItem, x as ConsentState } from "./browser-34-CHcxK.js";
+export { type ActionSource, type BrowserProvider, type BrowserTracking, type BrowserTrackingOptions, type ConsentState, type EventBinding, type EventContext, type EventData, type EventItem, type ProviderDefault, type ResolvedContext, type ServerProvider, type ServerTracking, type ServerTrackingOptions, type TrackOptions, type TrackingError, type UserData, VendorResponseError, isVendorResponseError };

package/dist/index.js

@@ -0,0 +1,2 @@
+import { n as isVendorResponseError, t as VendorResponseError } from "./src-DLRGPWMj.js";
+export { VendorResponseError, isVendorResponseError };

package/dist/server-DnP7RtEn.js

@@ -0,0 +1,647 @@
+import { t as VendorResponseError } from "./src-DLRGPWMj.js";
+import { i as resolveEvent, n as makeReporter, r as messageOf, t as assertUniqueProviders } from "./dispatch-B32jGhlh.js";
+//#region src/providers/ga4.server.ts
+const ENDPOINT = "https://www.google-analytics.com/mp/collect";
+/**
+* The visitor cookie holds `GA1.<depth>.<client_id>`, and the client id
+* itself contains a dot, so the identifier is the last two segments, which
+* is what survives Google's varying prefix depth.
+*
+* The value must be the cookie as the browser wrote it. A host passing a
+* parsed map passes cookie values, not values it took apart itself.
+*/
+function visitorId(cookies) {
+	const raw = cookies._ga;
+	if (!raw) return void 0;
+	const parts = raw.split(".");
+	if (parts.length < 4) return void 0;
+	return parts.slice(-2).join(".");
+}
+/**
+* The per-container cookie carries the session, in one of two layouts.
+*
+* Verified against Google's live tag on 2026-07-31 rather than assumed:
+*
+* - `GS2.1.s1785511401$o1$g0$t1785511401$j60$l0$h0`, the current one. The
+*   third dot-segment packs several fields joined by `$`, and the session is
+*   the first of them, prefixed with `s`.
+* - `GS1.1.1785511401.1.1.…`, the older one, where the third dot-segment is
+*   the session on its own.
+*
+* Reading the third segment blindly works for the old layout and returns the
+* whole `s…$o1$g0$…` blob for the new one, which the vendor would accept and
+* silently fail to match. Hence the two shapes, and hence `undefined` rather
+* than a guess when neither fits.
+*/
+function sessionId(cookies, measurementId) {
+	const segment = cookies[`_ga_${measurementId.replace(/^G-/, "")}`]?.split(".")[2];
+	if (!segment) return void 0;
+	const packed = /^s(\d+)/.exec(segment);
+	if (packed) return packed[1];
+	return /^\d+$/.test(segment) ? segment : void 0;
+}
+/**
+* The Measurement Protocol documents exactly two consent fields, and spells
+* their values in upper case where the browser spells them in lower, one of
+* the small asymmetries an adapter absorbs so nobody else has to.
+*/
+function consentBody(state) {
+	if (!state) return void 0;
+	const body = {};
+	if (state.ad_user_data) body.ad_user_data = state.ad_user_data.toUpperCase();
+	if (state.ad_personalization) body.ad_personalization = state.ad_personalization.toUpperCase();
+	return Object.keys(body).length > 0 ? body : void 0;
+}
+/**
+* Google Analytics 4 on the server, through the Measurement Protocol.
+*
+* @param credentials - The measurement id and API secret.
+* @param config - Rarely needed event name overrides.
+* @returns A provider for `createTracking` from `tracklane/server`.
+*
+* @example
+* ```ts
+* import { createTracking, ga4 } from 'tracklane/server';
+*
+* const { track } = createTracking({
+*   providers: [ga4({ measurementId: 'G-XXXXXXX', apiSecret: process.env.GA4_SECRET! })],
+* });
+*
+* await track('purchase', order, { cookies: request.headers.get('cookie') });
+* ```
+*/
+function ga4(credentials, config = {}) {
+	const { measurementId, apiSecret } = credentials;
+	return {
+		name: "ga4",
+		default: "passthrough",
+		...config.events ? { events: config.events } : {},
+		async track(name, data, context, report) {
+			const clientId = visitorId(context.cookies);
+			if (!clientId) throw new Error("ga4: cannot build client_id, no _ga cookie among the cookies passed in context. Ensure GA4's browser tag has set it first.");
+			const session = sessionId(context.cookies, measurementId);
+			if (!session) report("no session cookie (_ga_<container>): Google will accept this event and it will not appear in any report");
+			const params = { ...data };
+			if (session) {
+				params.session_id = session;
+				params.engagement_time_msec = 1;
+			}
+			const body = {
+				client_id: clientId,
+				timestamp_micros: context.timestamp * 1e3,
+				events: [{
+					name,
+					params
+				}]
+			};
+			if (context.user?.userId !== void 0) body.user_id = context.user.userId;
+			if (context.traits) body.user_properties = Object.fromEntries(Object.entries(context.traits).map(([name, value]) => [name, { value }]));
+			const consent = consentBody(context.consent);
+			if (consent) body.consent = consent;
+			const url = `${ENDPOINT}?measurement_id=${encodeURIComponent(measurementId)}&api_secret=${encodeURIComponent(apiSecret)}`;
+			const response = await fetch(url, {
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify(body)
+			});
+			if (!response.ok) {
+				const body = await response.text().catch(() => "");
+				throw new VendorResponseError(`ga4: the Measurement Protocol answered ${response.status}`, {
+					provider: "ga4",
+					status: response.status,
+					body
+				});
+			}
+		}
+	};
+}
+//#endregion
+//#region src/providers/linkedin.server.ts
+async function sha256$1(value) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+	return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function ipv4(value) {
+	const parts = value.split(".");
+	return parts.length === 4 && parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255);
+}
+async function userData$1(context) {
+	const user = context.user ?? {};
+	const userIds = [];
+	const built = { userIds };
+	const email = user.email?.replace(/\s/g, "").toLowerCase();
+	if (email) userIds.push({
+		idType: "SHA256_EMAIL",
+		idValue: await sha256$1(email)
+	});
+	const clickId = context.cookies.li_fat_id;
+	if (clickId) try {
+		userIds.push({
+			idType: "LINKEDIN_FIRST_PARTY_ADS_TRACKING_UUID",
+			idValue: decodeURIComponent(clickId)
+		});
+	} catch {}
+	if (context.ip && ipv4(context.ip)) userIds.push({
+		idType: "PLAINTEXT_IP_ADDRESS",
+		idValue: context.ip
+	});
+	if (user.firstName && user.lastName) built.userInfo = {
+		firstName: user.firstName,
+		lastName: user.lastName
+	};
+	if (user.userId) built.externalIds = [user.userId];
+	if (userIds.length === 0 && built.userInfo === void 0 && built.externalIds === void 0) throw new Error("linkedin: the Conversions API requires a user identifier, full name, or external ID");
+	return built;
+}
+/**
+* Sends event-specific conversions to LinkedIn's Conversions API.
+* Value and currency become conversionValue; items, transaction_id, custom
+* properties, traits and consent have no documented field on this endpoint.
+* The host's deduplication ID becomes eventId, without generating one.
+*
+* @param credentials - The ad account's Conversions API access token.
+* @param config - Canonical event to conversion ID map and API version.
+* @returns A server provider for `createTracking`.
+* @example
+* ```ts
+* import { createTracking, linkedin } from 'tracklane/server';
+* const { track } = createTracking({
+*   providers: [linkedin({ accessToken }, { events: { purchase: '12345' } })],
+* });
+* await track('purchase', { value: 15, currency: 'BRL' }, {
+*   user: { email: 'buyer@example.com' }, dedupId: 'order-1',
+* });
+* ```
+*/
+function linkedin(credentials, config) {
+	const { apiVersion = "202609" } = config;
+	return {
+		name: "linkedin",
+		default: "ignore",
+		events: config.events,
+		async track(name, data, context, report) {
+			if (!/^\d+$/.test(name) || BigInt(name) <= 0n) throw new Error("linkedin: conversion must identify a positive conversion ID from Campaign Manager");
+			const event = {
+				conversion: `urn:lla:llaPartnerConversion:${name}`,
+				conversionHappenedAt: context.timestamp,
+				user: await userData$1(context)
+			};
+			if (data.value !== void 0 && data.currency !== void 0) event.conversionValue = {
+				currencyCode: data.currency,
+				amount: String(data.value)
+			};
+			if (context.dedupId !== void 0) event.eventId = context.dedupId;
+			const response = await fetch("https://api.linkedin.com/rest/conversionEvents", {
+				method: "POST",
+				headers: {
+					Authorization: `Bearer ${credentials.accessToken}`,
+					"Content-Type": "application/json",
+					"Linkedin-Version": apiVersion,
+					"X-Restli-Protocol-Version": "2.0.0"
+				},
+				body: JSON.stringify(event)
+			});
+			if (!response.ok) {
+				const body = await response.text().catch(() => "");
+				throw new VendorResponseError(`linkedin: the Conversions API answered ${response.status}`, {
+					provider: "linkedin",
+					status: response.status,
+					body
+				});
+			}
+			if (data.value !== void 0 && data.currency === void 0) report("conversionValue omitted: a monetary value requires currency; the conversion rule value applies");
+		}
+	};
+}
+//#endregion
+//#region src/providers/meta.server.ts
+const GRAPH = "https://graph.facebook.com";
+/**
+* Pinned on purpose. A Graph URL with no version resolves to the *oldest*
+* version still available, which silently changes what the endpoint accepts
+* the day Meta drops it.
+*/
+const DEFAULT_API_VERSION = "v25.0";
+/**
+* How Meta spells the canonical vocabulary, which is GA4's. Kept in step with
+* `meta.browser.ts` by hand: the two halves are two libraries, and neither
+* imports the other.
+*/
+const CANONICAL_EVENTS = {
+	page_view: "PageView",
+	view_item: "ViewContent",
+	search: "Search",
+	add_to_cart: "AddToCart",
+	add_to_wishlist: "AddToWishlist",
+	begin_checkout: "InitiateCheckout",
+	add_payment_info: "AddPaymentInfo",
+	purchase: "Purchase",
+	sign_up: "CompleteRegistration",
+	generate_lead: "Lead"
+};
+/**
+* Web Crypto rather than `node:crypto`, so the built server bundle stays
+* platform-neutral: this adapter is called from Cloudflare Workers, Deno and
+* Vercel's edge runtime as often as from a Node process, and a `node:` import
+* would rule those out for no gain.
+*/
+async function sha256(value) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+	return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+/**
+* **Why the adapter hashes and does not ask the host to.**
+*
+* This looks like the library transforming data, and the cutting rule forbids
+* that. It is not. Meta does not define a field called "email" that happens
+* to want a hash: it defines `em` *as* the SHA-256 of the trimmed, lowercased
+* address, the same way it defines `event_time` as seconds rather than
+* milliseconds. Writing this line by hand you write
+* `sha256(email.trim().toLowerCase())`, and the adapter replicates exactly
+* that. Normalisation lives with the field it belongs to.
+*
+* The alternative is worse and is where integrations demonstrably go wrong:
+* three vendors want SHA-256 under three different normalisation rules, so a
+* host hashing on its own side has to hash the same address three ways and
+* discovers a mistake only as a quietly poor match rate.
+*/
+const normaliseEmail = (value) => value.trim().toLowerCase();
+/**
+* "Remove symbols, letters, and any leading zeros." The country code is not
+* added here: Meta wants one and the library does not know it, and guessing a
+* country onto a phone number invents an identifier for a different person.
+*/
+const normalisePhone = (value) => value.replace(/\D/g, "").replace(/^0+/, "");
+/** "Lowercase only with no punctuation." Spaces and accents survive; Meta reads UTF-8. */
+const normaliseName = (value) => value.trim().toLowerCase().replace(/[\p{P}\p{S}]/gu, "");
+/**
+* GA4's `items` become Meta's `contents`, a closed shape: `id`, `quantity`,
+* `item_price`, `delivery_category`. The rest of a GA4 item is dropped rather
+* than forwarded, because a key Meta does not read inside `contents` looks
+* mapped and arrives nowhere.
+*/
+function contents(items) {
+	if (items.some((item) => typeof item.item_id !== "string" || !item.item_id.trim())) return void 0;
+	return items.map((item) => {
+		const content = {};
+		if (item.item_id !== void 0) content.id = item.item_id;
+		if (item.quantity !== void 0) content.quantity = item.quantity;
+		if (item.price !== void 0) content.item_price = item.price;
+		return content;
+	});
+}
+/**
+* `value` and `currency` are spelled identically by both vendors. Everything
+* the host named itself passes through, because a business measures things
+* this vocabulary does not name.
+*
+* `transaction_id` becomes `order_id`, which this surface documents and the
+* pixel does not. It is one of the asymmetries between Meta's two halves an
+* adapter absorbs so nobody else has to.
+*/
+function customData(data) {
+	const { items, transaction_id: transactionId, ...rest } = data;
+	const custom = { ...rest };
+	if (transactionId !== void 0) custom.order_id = transactionId;
+	if (items) {
+		const mapped = contents(items);
+		if (mapped !== void 0) custom.contents = mapped;
+		else delete custom.contents;
+	}
+	return custom;
+}
+/**
+* The heaviest surface of the five vendors: four hashed identifiers, four raw
+* ones, and two cookies forwarded exactly as the pixel wrote them.
+*
+* Built in a fixed order, and hashed one after another rather than in
+* parallel, so that the same input produces the same JSON on every run. Two
+* identical events differing only in key order would be the library inventing
+* something, which is precisely what the conformance suite looks for.
+*/
+async function userData(context) {
+	const user = context.user ?? {};
+	const built = {};
+	const hashed = [
+		[
+			"em",
+			user.email,
+			normaliseEmail
+		],
+		[
+			"ph",
+			user.phone,
+			normalisePhone
+		],
+		[
+			"fn",
+			user.firstName,
+			normaliseName
+		],
+		[
+			"ln",
+			user.lastName,
+			normaliseName
+		]
+	];
+	for (const [field, raw, normalise] of hashed) {
+		if (raw === void 0) continue;
+		const normalised = normalise(raw);
+		if (!normalised) continue;
+		built[field] = await sha256(normalised);
+	}
+	if (user.userId !== void 0) built.external_id = user.userId;
+	if (context.ip !== void 0) built.client_ip_address = context.ip;
+	if (context.userAgent !== void 0) built.client_user_agent = context.userAgent;
+	const fbp = context.cookies._fbp;
+	if (fbp) built.fbp = fbp;
+	const fbc = context.cookies._fbc;
+	if (fbc) built.fbc = fbc;
+	return built;
+}
+/**
+* Meta's Conversions API.
+*
+* If any item lacks a nonempty `item_id`, the complete `contents` list is
+* omitted while totals and order metadata remain unchanged. This avoids
+* presenting a partial order or inventing product identifiers. The error
+* channel receives one payload-free warning after HTTP acceptance.
+*
+* @param credentials - The pixel id and an access token.
+* @param config - Event overrides, the default action source, and Meta's own
+* levers: the API version, a test event code, and Limited Data Use.
+* @returns A provider for `createTracking` from `tracklane/server`.
+*
+* @example
+* ```ts
+* import { createTracking, meta } from 'tracklane/server';
+*
+* const { track } = createTracking({
+*   providers: [meta({ pixelId: '1234567890', accessToken: process.env.META_TOKEN! })],
+* });
+*
+* await track('purchase', order, {
+*   user: { email: order.email },
+*   cookies: request.headers.get('cookie'),
+*   dedupId: order.id,
+*   ip,
+*   userAgent,
+* });
+* ```
+*/
+function meta(credentials, config = {}) {
+	const { pixelId, accessToken } = credentials;
+	const { actionSource = "website", apiVersion = DEFAULT_API_VERSION, testEventCode } = config;
+	return {
+		name: "meta",
+		default: "passthrough",
+		events: {
+			...CANONICAL_EVENTS,
+			...config.events
+		},
+		async track(name, data, context, report) {
+			const user = await userData(context);
+			if (Object.keys(user).length === 0) throw new Error("meta: cannot build user_data, the Conversions API requires at least one identifier. Pass context.user, context.ip with context.userAgent, or the _fbp/_fbc cookies.");
+			const event = {
+				event_name: name,
+				event_time: Math.floor(context.timestamp / 1e3),
+				action_source: context.source ?? actionSource,
+				user_data: user
+			};
+			if (context.dedupId !== void 0) event.event_id = context.dedupId;
+			if (context.url !== void 0) event.event_source_url = context.url;
+			const custom = customData(data);
+			if (Object.keys(custom).length > 0) event.custom_data = custom;
+			if (config.dataProcessingOptions) {
+				event.data_processing_options = config.dataProcessingOptions;
+				if (config.dataProcessingOptionsCountry !== void 0) event.data_processing_options_country = config.dataProcessingOptionsCountry;
+				if (config.dataProcessingOptionsState !== void 0) event.data_processing_options_state = config.dataProcessingOptionsState;
+			}
+			const body = new URLSearchParams({
+				data: JSON.stringify([event]),
+				access_token: accessToken
+			});
+			if (testEventCode) body.set("test_event_code", testEventCode);
+			const response = await fetch(`${GRAPH}/${apiVersion}/${encodeURIComponent(pixelId)}/events`, {
+				method: "POST",
+				headers: { "content-type": "application/x-www-form-urlencoded" },
+				body
+			});
+			if (!response.ok) {
+				const body = await response.text().catch(() => "");
+				throw new VendorResponseError(`meta: the Conversions API answered ${response.status}`, {
+					provider: "meta",
+					status: response.status,
+					body
+				});
+			}
+			if (data.items && custom.contents === void 0) report("contents omitted: every item needs a nonempty item_id; totals were preserved");
+			const result = await response.json().catch(() => null);
+			const messages = result?.messages;
+			if (Array.isArray(messages) && messages.length > 0) report(`accepted with ${messages.length} warning(s) from the Conversions API; read them under fbtrace_id ${result?.fbtrace_id ?? "unknown"} in Events Manager`);
+		}
+	};
+}
+//#endregion
+//#region src/providers/posthog.server.ts
+const DEFAULT_HOST = "https://us.i.posthog.com";
+/**
+* The distinct_id lives inside a cookie posthog-js writes by default, named
+* after this project's own api key: `ph_<api_key>_posthog`. Its value is
+* `encodeURIComponent(JSON.stringify({ distinct_id, ... }))`, so it has to be
+* decoded before it parses as JSON.
+*
+* Verified against a live project rather than read off the SDK's source: the
+* cookie was percent-encoded, held `distinct_id` alongside `$device_id` and
+* `$user_state`, and the id parsed out of it matched what the page's own
+* `posthog.get_distinct_id()` returned. A server event sent with it landed on
+* the same person the browser had created, which is the whole point.
+*
+* This is only the anonymous fallback. It is not read when the caller already
+* knows who the visitor is; see the comment in `track` for why.
+*/
+function anonymousId(cookies, apiKey) {
+	const raw = cookies[`ph_${apiKey}_posthog`];
+	if (!raw) return void 0;
+	try {
+		const parsed = JSON.parse(decodeURIComponent(raw));
+		return typeof parsed.distinct_id === "string" ? parsed.distinct_id : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* PostHog deduplicates on `uuid`, and the field holds a UUID rather than any
+* string: an invalid one is documented as dropped on ingestion, and has been
+* reported answering 400 instead. Since `dedupId` is whatever the host chose
+* — Meta's `event_id` takes anything, and this library's own example is an
+* order id — forwarding it unchecked would turn a duplicated purchase into no
+* purchase at all.
+*
+* Accepts any RFC 4122 layout rather than v4 alone, because v7 is what a
+* system minting ids today tends to produce.
+*/
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+/**
+* PostHog on the server, through the Capture API.
+*
+* **Deduplicating a retried webhook takes two things, not one.** `dedupId`
+* becomes PostHog's `uuid`, and PostHog collapses events sharing `uuid`, event
+* name, timestamp and `distinct_id` — so a `timestamp` left to default to the
+* clock differs on the retry and nothing is deduplicated. Pin it to a value
+* derived from the order, as below. The `dedupId` itself must be a UUID:
+* anything else is reported through `onError` and sent without the field,
+* because PostHog rejects other shapes rather than ignoring them.
+*
+* Deduplication is also eventual, happening during a background merge, so both
+* rows are visible for a while and a test that counts immediately will fail.
+*
+* @param credentials - The project API key, and the ingestion host for
+* anything other than PostHog's default US Cloud instance.
+* @param config - Rarely needed event name overrides.
+* @returns A provider for `createTracking` from `tracklane/server`.
+*
+* @example
+* ```ts
+* import { createTracking, posthog } from 'tracklane/server';
+*
+* const { track } = createTracking({
+*   providers: [posthog({ apiKey: process.env.POSTHOG_API_KEY! })],
+* });
+*
+* // Both fields come from the order, so the payment provider's second
+* // delivery of the same webhook produces the same event.
+* await track('purchase', order, {
+*   user: { userId: order.userId },
+*   cookies: request.headers.get('cookie'),
+*   dedupId: order.eventId, // a UUID your checkout minted with the order
+*   timestamp: order.paidAt,
+* });
+* ```
+*/
+function posthog(credentials, config = {}) {
+	const { apiKey, host = DEFAULT_HOST } = credentials;
+	return {
+		name: "posthog",
+		default: "passthrough",
+		...config.events ? { events: config.events } : {},
+		async track(name, data, context, report) {
+			const id = context.user?.userId ?? anonymousId(context.cookies, apiKey);
+			if (!id) throw new Error("posthog: cannot resolve distinct_id — no user.userId in context and no ph_<api_key>_posthog cookie among the cookies passed in context. Pass user.userId once the visitor is known, or ensure PostHog's browser tag has set its cookie first.");
+			const properties = { ...data };
+			if (context.traits) properties.$set = context.traits;
+			const dedup = {};
+			if (context.dedupId !== void 0) if (UUID.test(context.dedupId)) dedup.uuid = context.dedupId;
+			else report("dedupId is not a UUID, so it was not forwarded as uuid: PostHog deduplicates on that field and rejects other shapes, so this event can duplicate on a retry");
+			const body = {
+				api_key: apiKey,
+				event: name,
+				distinct_id: id,
+				...dedup,
+				properties,
+				timestamp: new Date(context.timestamp).toISOString()
+			};
+			const response = await fetch(`${host}/i/v0/e/`, {
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify(body)
+			});
+			if (!response.ok) {
+				const body = await response.text().catch(() => "");
+				throw new VendorResponseError(`posthog: the capture endpoint answered ${response.status}`, {
+					provider: "posthog",
+					status: response.status,
+					body
+				});
+			}
+		}
+	};
+}
+//#endregion
+//#region src/server.ts
+/** `name=value; name=value`, the shape of a `Cookie` header. */
+function parseCookies(cookies) {
+	if (!cookies) return {};
+	if (typeof cookies !== "string") return cookies;
+	const parsed = {};
+	for (const pair of cookies.split(";")) {
+		const separator = pair.indexOf("=");
+		if (separator < 1) continue;
+		const name = pair.slice(0, separator).trim();
+		if (name) parsed[name] = pair.slice(separator + 1).trim();
+	}
+	return parsed;
+}
+/**
+* Creates the server tracking surface.
+*
+* There is no `identify` here and nothing is held between calls: a server
+* instance is shared by every request, so a retained identity would attach
+* one visitor to another visitor's conversion. Identity travels with the
+* call, which is also what every conversion API expects.
+*
+* There is no `consent` call either. Consent commands are properties of a
+* vendor's on-page tag, and a server request has no tag. The one vendor that
+* accepts consent server-side reads it from the context.
+*
+* @param options - The providers to send to, and an optional error channel.
+* @returns The `track` call.
+*
+* @example
+* ```ts
+* import { createTracking, ga4 } from 'tracklane/server';
+*
+* const { track } = createTracking({
+*   providers: [ga4({ measurementId: 'G-XXXXXXX', apiSecret })],
+* });
+*
+* await track('purchase', order, { cookies: request.headers.get('cookie') });
+* ```
+*/
+function createTracking(options) {
+	const { providers } = options;
+	assertUniqueProviders(providers);
+	const report = makeReporter(options.onError);
+	return { async track(name, data = {}, context = {}) {
+		const { cookies, timestamp, ...rest } = context;
+		const resolved = {
+			...rest,
+			cookies: parseCookies(cookies),
+			timestamp: timestamp instanceof Date ? timestamp.getTime() : timestamp ?? Date.now()
+		};
+		const sends = providers.map(async (provider) => {
+			const target = resolveEvent(provider, name, (message) => {
+				report({
+					provider: provider.name,
+					event: name,
+					severity: "warning",
+					message
+				});
+			});
+			if (target === void 0) return;
+			try {
+				await provider.track(target, data, resolved, (message) => {
+					report({
+						provider: provider.name,
+						event: name,
+						severity: "warning",
+						message
+					});
+				});
+			} catch (cause) {
+				report({
+					provider: provider.name,
+					event: name,
+					severity: "error",
+					message: messageOf(cause),
+					cause
+				});
+			}
+		});
+		await Promise.all(sends);
+	} };
+}
+//#endregion
+export { ga4 as a, linkedin as i, posthog as n, meta as r, createTracking as t };
+
+//# sourceMappingURL=server-DnP7RtEn.js.map