SDK changelog

Changed

• Heartbeats stop after 5 minutes without input, so a tab left open no longer counts as an online visitor.
• A visitor who comes back after the visit lapsed starts a new visit with a page view of the page in front of them.
• Web vitals and other end-of-page measurements are timed at the visitor's last activity, not when the tab finally closes.

Fixed

• FCP and LCP leave out paints that happen after the page was first hidden, so tabs opened in the background no longer report huge load times.
• Pages that never shift now report a CLS of 0 instead of no CLS at all.
• Referrers from Android apps (android-app://) are kept instead of being counted as direct traffic, with only the app package recorded.
• Script loads aborted by leaving the page are no longer reported as errors.

Added

• errors option in init() reports the page's uncaught errors and unhandled rejections; off unless set.
• captureError(error) export and tracker.captureError() report an error your own code caught, such as one stopped by an error boundary; needs errors: true.

Added

• Debug sessions: opening the site from a dashboard debug link shows an in-page panel listing each event and why any was refused, without the events reaching your reports.

Changed

• With debug: true, every delivery is logged to the console along with the reason the collector refused anything.

Added

• visitId() export and tracker.visitId() return the current visit's id, to pass into a checkout as invisit_visit_id metadata for revenue attribution.

Changed

• The short link click parameter ivc is removed from the address bar once the landing page view is sent.

Changed

• Events wait up to 3 seconds for the site's settings before going out, so a host the site does not allow sends nothing.

Fixed

• sdk_version and tracker.version report the npm package's own version instead of the script tag tracker's.

Added

• pageUrl option in init() rewrites each page address before it is recorded, for example turning /orders/8121 into /orders/:id.

Fixed

• Pages whose path pageUrl rewrites no longer collect click heatmap data.

Changed

• Client-side page views wait up to 2 seconds for the router to set the new page title, so they carry the right title.
• Links to the site's own subdomains, parent domain or allowed domains are no longer counted as outbound.
• Browsers driven by automation (navigator.webdriver) send nothing unless debug is on.

Fixed

• LCP, FCP and TTFB on prerendered pages are measured from when the page was shown, not from when it was prerendered.

Changed

• Packaging only: the repository field points at the public SDK repository.

Breaking

• The key option in init() is renamed to site and takes the site id.

Changed

• The package exports with the default condition, so require() resolves it.
• Option and function docs are JSDoc and show up in editors from index.d.ts.

Fixed

• The feedback widget's Send button now disables while sending, so a message is no longer sent twice.
• Storage changes in other tabs only restart the tracker when they touch invisit's own keys.

Changed

• The default baseUrl is now https://api.invisit.dev.

Changed

• Packaging only: published with npm provenance.

Changed

• Documentation only: framework guides in the README.

Added

• First release of the invisit browser tracker as an ES module, with init, track, identify, consent, feedback, sendFeedback and flush.

Added

• Sends its version with every request, so the dashboard can tell you when an update matters.

Added

• respectGpc option in createInvisit leaves out events from visitors whose browser sends Global Privacy Control.

Added

• track() accepts a visitor object (ip, userAgent, language, gpc) instead of request, for work that runs without the visitor's request, such as queue consumers.
• TrackVisitor type export.

Fixed

• Collector request timeouts work on runtimes without AbortSignal.timeout.

Changed

• Packaging only: the repository field points at the public SDK repository.

Breaking

• key must be an API key with the ingest scope (invisit_sk_); server keys (invisit_ik_) are rejected.

Changed

• Calls to the collector time out after 10 seconds.
• The proxy answers 413 to request bodies over 1 MiB.
• Crawler detection uses the isbot package, now a dependency, instead of a bundled copy.
• Both entry points export with the default condition, so require() resolves them.

Changed

• The default baseUrl is now https://api.invisit.dev.

Changed

• Packaging only: published with npm provenance.

Added

• ip option on proxy(), handle() and track() passes the visitor's address for servers with no edge proxy in front.

Changed

• createInvisit throws a clear error when key is empty, which usually means the environment variable is not set.
• onError is told once when a proxied visitor arrives without an address.
• crawlers() records only GET and HEAD page reads, skipping static assets, RSC and prefetch requests and non-document fetches.
• crawlers() never reads the hostname from X-Forwarded-Host, and the Node adapter drops X-Forwarded-Host and X-Forwarded-Proto unless the proxy is trusted.
• track() rejects with USER_AGENT_MISSING when the request has no User-Agent.

Fixed

• IPv4 visitors on dual-stack sockets (::ffff:a.b.c.d) are recognised as the same address.
• The Node middleware awaits next, so a next that returns a promise works.
• The Node middleware fails with BODY_CONSUMED when a body parser read the tracker request first, instead of silently forwarding an empty event.
• Logged errors are named InvisitError instead of a bundler-renamed class name.

Added

• First release, with createInvisit providing proxy, handle, crawlers and track, and a Node adapter at @invisitdev/server/node.