Product Analytics

stop() discards pending time and session state rather than sending after consent revocation. A restored page must initialize a fresh collector. Server-side authentication events are a separate source: never infer logins from page views or token refreshes. The host should exclude impersonation and anonymous authentication sessions.

Exports from the root include the snapshot/session contracts, interval accounting, session expiration and server cumulative-duration bounds. The browser entry has no dependencies. Build with Bun and TypeScript; test with bun test.

Version 0.2 adds DeliveryHealth (per-document cumulative attempted/failed counts), comparePeriods, funnelSteps and retentionCell. Delivery counters are included in each snapshot; persist their MAX per document/account. Non-2xx and {accepted:false} responses count as failures, visible after a later successful delivery. Permanently offline clients remain unobservable. Hosts should return JSON {accepted:true} after ingestion.

comparePeriods(current, previous, comparable) suppresses deltas without complete coverage and suppresses percentage change for a zero baseline. funnelSteps(labels, orderedCounts) requires non-increasing nonnegative integer counts. retentionCell(cohortDay, offsetDays, asOfMs, cohortSize, returned) waits until the entire UTC return day ends; immature cells have null returns/percent and zero eligible accounts. Hosts own ordered-event queries, cohort definitions and retained-history coverage. These pure helpers do not collect business payloads or assume an application's event taxonomy.

Version 0.3 adds nextSummaryAt(afterMs, cadence) for strictly-next daily/weekly 09:00 UTC report slots (weekly Monday), accountHealth(evidence) for explicit observed-activity classifications, and trackingSignals(evidence) for sample/coverage-gated missing-collection, delivery-failure and missing-action signals. These are pure rules: the package does not deliver email or push, retain reports, authorize recipients or run a scheduler. Hosts must recheck permissions at execution, persist/deduplicate slots, expose failures, and distinguish observations from customer/churn predictions. Unknown consent or incomplete comparison coverage suppresses account-health conclusions.

Version 0.4 adds startWorkflowTracking({endpoint, resolveWorkflow}) from the browser entry. This optional, consent-scoped fetch observer reports only host-allowlisted same-origin requests, random receipt IDs, workflow labels, failure flags and duration to response headers. It does not inspect bodies or transmit URLs. Aborts are excluded; stop() suppresses pending receipts and restores fetch when it still owns the wrapper. Transport is best effort. The host must validate category/duration, authenticate the user, reject impersonation and declined consent, and distinguish HTTP observations from successful business outcomes. Header latency does not measure a streaming response's completion.

Version 0.5 adds defineTrackingCatalog, validateTrackingEvent, and trackingCoverage. Definitions describe versioned, bounded events with source, ownership, meaning, consent and retention. Validation returns a fixed rejection category without echoing submitted data. Hosts enforce authentication and authorization separately. Missing observations only imply missing collection when the host explicitly marks collection as expected. Existing records without a version are version 1; collectors now declare version 1 explicitly.

Version 0.6 adds experimentVariant, conversionInterval, and experimentEvidence. SHA-256 assignment is stable for an experiment/account pair and divides accounts 50/50. Wilson 95% conversion intervals, minimum mature samples of 100 per arm, and a 1% chi-squared allocation imbalance check provide conservative descriptive evidence. These are not sequential testing or sample-size planning. Hosts must freeze definitions, predeclare duration and outcome windows, record actual exposure, assess guardrails, exclude unfinished windows, and require human interpretation. The package neither publishes variants nor enrolls users. Dealroom's opt-in integration uses in-app help cards and never sends email or push.