chore: sync Rokt kit with upstream v1.30.2

[rmi22186]

Summary

• Syncs kits/rokt from upstream mParticle-integrations/mparticle-javascript-integration-rokt main through v1.30.2 (dec20cd4).
• Ports upstream Rokt kit changes since v1.28.3, including active_time_on_site_ms persistence filtering and page-view capture surfaced as page_events on selectPlacements.
• Preserves monorepo adaptations: monorepo package repository URL, @mparticle/web-sdk peer/dev dependency layout, no standalone semantic-release/provenance config, Vite externalization/aliases/version define, and Node webstorage mitigation.

Upstream commits included

• 315c4f9 feat: prevent caching of active_time_on_site_ms attribute (Bump rollup from 1.32.1 to 2.40.0 #106)
• 098aabe feat: capture page views and surface as page_events in selectPlacements (Bump @babel/preset-env from 7.9.6 to 7.13.10 #109)
• e98e095 refactor: rename timeOnPage to activeTimeOnPage in selectPlacements page_events (Bump rollup from 1.32.1 to 2.41.0 #110)
• 12e179d fix: lower PAGE_VIEW_CAPTURE_FAILED severity from WARNING to INFO (Bump rollup from 1.32.1 to 2.41.1 #111)
• Release/build commits through dec20cd4 / v1.30.2 were used for package metadata and changelog only; generated dist/** was not included.

Files changed

• kits/rokt/src/Rokt-Kit.ts
• kits/rokt/src/selectPlacementsAttributePersistence.ts
• kits/rokt/test/src/tests.spec.ts
• kits/rokt/CHANGELOG.md
• kits/rokt/package.json
• kits/rokt/package-lock.json
• kits/rokt/vite.config.ts

Test plan

• npm ci in kits/rokt on Node v24.19.0
• npm run build in kits/rokt on Node v24.19.0
• npm test in kits/rokt on Node v24.19.0: 228 passed
• npm ci in kits/rokt on Node v26.5.0
• npm run build in kits/rokt on Node v26.5.0
• npm test in kits/rokt on Node v26.5.0: 228 passed

Notes: npm run build emits existing declaration-generation type diagnostics from monorepo ../../src/vault.ts, but Vite completes successfully. Vitest also warns that the root GTS base tsconfig is not installed from the kit package context.

Notes

• This refreshes/supersedes the older workstation-based Rokt sync PR feat: sync Rokt kit with upstream 1.30.1 — page-view capture as page_events #1307 by creating a fresh branch from origin/main and targeting main.

[cursor]

PR Summary

Medium Risk
Introduces client-side behavioral page-view storage and new data sent to Rokt on placements, with PII mitigations and a noTargeting opt-out; scope is limited to the Rokt integration kit with extensive new tests.

Overview
Brings kits/rokt up to v1.30.2 (changelog and package metadata) while keeping monorepo-specific package.json repository URL and Vitest --no-experimental-webstorage for Node compatibility.

The kit now records PageView events in localStorage (mpPageViews, capped at 25, query strings stripped via sanitizeUrl), clears that buffer on session end and when noTargeting is set, and attaches a JSON page_events payload on selectPlacements (including derived activeTimeOnPage from consecutive activeTimeOnSite values). Page-view work runs even when the launcher is not ready; placement mapping still requires a ready kit. PAGE_VIEW_CAPTURE_FAILED is reported at INFO severity.

active_time_on_site_ms is added to the selectPlacements persistence deny list so it is forwarded on the current call but not cached for later placements. returnLocalSessionAttributes always returns session attributes when available (no longer skipped when mapping tables are empty).

Tests add broad coverage for page-view capture, targeting opt-out, URL sanitization, and active_time_on_site_ms caching behavior.

^{Reviewed by Cursor Bugbot for commit 41cb8dc. Bugbot is set up for automated code reviews on this repo. Configure here.}

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 41cb8dc. Configure here.}

[cursor]

Page URL captured after delay

Medium Severity

capturePageView records window.location.href at process time, while other fields come from the event snapshot. When the core SDK queues events (no MPID, integration delay, or config load), navigation before flush stores the wrong pageUrl in page_events sent to Rokt. SDKEvent already carries PageUrl from event creation.

 

^{Reviewed by Cursor Bugbot for commit 41cb8dc. Configure here.}