Server-side capture worker

export default {
  async fetch(request, env, ctx) {
    // 1. NEVER BLOCK THE VISITOR. Forward to your site immediately.
    //    Everything below runs in the background; the page never waits.
    const response = fetch(request);

    try {
      const url = new URL(request.url);

      // Skip static assets. Only real page views carry ad attribution.
      if (/\.(js|css|png|jpg|jpeg|svg|ico|woff|woff2|gif|webp)$/.test(url.pathname)) {
        return response;
      }

      // 2. COLLECT click IDs + UTMs from the URL, at the edge, before
      //    iOS / Safari can strip them. This is the data your pixel loses.
      //    Every major ad platform's click ID, so nothing is missed no
      //    matter where the traffic comes from.
      const clickIds = {
        fbclid:    url.searchParams.get('fbclid'),    // Meta (Facebook/Instagram)
        gclid:     url.searchParams.get('gclid'),     // Google Ads
        wbraid:    url.searchParams.get('wbraid'),    // Google Ads (web-to-app)
        gbraid:    url.searchParams.get('gbraid'),    // Google Ads (app-to-web)
        dclid:     url.searchParams.get('dclid'),     // Google Display / Campaign Manager
        msclkid:   url.searchParams.get('msclkid'),   // Microsoft/Bing Ads
        ttclid:    url.searchParams.get('ttclid'),    // TikTok Ads
        li_fat_id: url.searchParams.get('li_fat_id'), // LinkedIn Ads
        twclid:    url.searchParams.get('twclid'),    // Twitter/X Ads
        epik:      url.searchParams.get('epik'),      // Pinterest Ads
        rdt_cid:   url.searchParams.get('rdt_cid'),   // Reddit Ads
        sccid:     url.searchParams.get('sccid'),     // Snapchat Ads
        ScCid:     url.searchParams.get('ScCid'),     // Snapchat Ads (alt casing)
        obclid:    url.searchParams.get('obclid'),    // Outbrain
        ttp:       url.searchParams.get('ttp'),       // TikTok pixel cookie param
        irclickid: url.searchParams.get('irclickid'), // Impact / affiliate
      };
      const utms = {
        source:   url.searchParams.get('utm_source'),
        medium:   url.searchParams.get('utm_medium'),
        campaign: url.searchParams.get('utm_campaign'),
      };

      // Only send when there is real attribution to recover. A plain
      // visit with no click ID / UTM is left alone. No data collected.
      const hasAttribution = Object.values(clickIds).some(Boolean)
                          || Object.values(utms).some(Boolean);
      if (!hasAttribution) return response;

      // 3. SEND to DataCops, after the response, never blocking the page.
      //    Authenticated with your account key. The isEU flag lets
      //    DataCops apply the consent gate instantly, with no IP lookup:
      //    EU visitors' marketing events are held until consent is given.
      ctx.waitUntil(fetch(env.DATACOPS_COLLECT_URL, {
        method: 'POST',
        headers: {
          'Content-Type': 'application/json',
          'x-cop-key': env.DATACOPS_COP_KEY,
        },
        body: JSON.stringify({
          eventType: 'network_capture',
          source: 'cloudflare_worker',
          ip: request.headers.get('cf-connecting-ip'),
          ua: request.headers.get('user-agent'),
          data: {
            clickIds,
            utms,
            cf: {
              country:     request.cf?.country ?? null,
              asOrg:       request.cf?.asOrganization ?? null,
              isEU:        request.cf?.isEUCountry ?? false, // consent signal
              botScore:    request.cf?.botManagement?.score ?? null,
              verifiedBot: request.cf?.botManagement?.verifiedBot ?? false,
            },
            referrer: request.headers.get('referer'),
            pageUrl:  url.href,
            ts: Date.now(),
          },
        }),
      }).catch(() => {}));
    } catch (_) {}

    return response;
  },
};