fix(audience): address review findings in SDK

- Remove unused consentSource config field
- Remove dead transpile:cdn and demo scripts from package.json
- Add session_start/session_end lifecycle events matching Pixel behavior
- Add TODO for cookie cleanup to move to core's createConsentManager

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: ImmutableJeffrey

packages/audience/sdk/package.json

@@ -48,12 +48,10 @@
   "scripts": {
     "build": "pnpm transpile && pnpm typegen",
     "transpile": "tsup src/index.ts --config ../../../tsup.config.js",
-    "transpile:cdn": "tsup --config tsup.cdn.js",
     "typegen": "tsc --customConditions default --emitDeclarationOnly --outDir dist/types",
     "lint": "eslint ./src --ext .ts,.jsx,.tsx --max-warnings=0",
     "test": "jest --passWithNoTests",
     "test:watch": "jest --watch",
-    "demo": "pnpm build && npx serve -l 3456 --cors ..",
     "typecheck": "tsc --customConditions development --noEmit --jsx preserve"
   },
   "type": "module",

packages/audience/sdk/src/sdk.test.ts

@@ -2,6 +2,7 @@
 import {
   MessageQueue,
   createConsentManager,
+  getOrCreateSession,
   deleteCookie,
 } from '@imtbl/audience-core';
 import { ImmutableAudienceSDK } from './sdk';
@@ -41,6 +42,7 @@ jest.mock('@imtbl/audience-core', () => {
     collectAttribution: jest.fn(() => ({})),
     deleteCookie: jest.fn(),
     httpTransport: { send: jest.fn() },
+    isBrowser: jest.fn(() => true),
     generateId: actual.generateId,
     getTimestamp: actual.getTimestamp,
     getBaseUrl: actual.getBaseUrl,
@@ -171,4 +173,37 @@ describe('ImmutableAudienceSDK', () => {
     sdk.track('late-event');
     expect(queue.enqueue).not.toHaveBeenCalled();
   });
+
+  describe('session lifecycle', () => {
+    it('fires session_start on new session', () => {
+      (getOrCreateSession as jest.Mock).mockReturnValue({ sessionId: 'new-sess', isNew: true });
+
+      const sdk = createSDK({ consent: 'anonymous' });
+      const consent = (createConsentManager as jest.Mock).mock.results[0].value;
+      consent.setLevel('anonymous');
+      const queue = (MessageQueue as jest.Mock).mock.results[0].value;
+
+      sdk.page();
+
+      const enqueued = queue.enqueue.mock.calls.map((c: any[]) => c[0]);
+      const sessionStart = enqueued.find((m: any) => m.eventName === 'session_start');
+      expect(sessionStart).toBeDefined();
+      expect(sessionStart.properties.sessionId).toBe('new-sess');
+    });
+
+    it('does not fire session_start on existing session', () => {
+      (getOrCreateSession as jest.Mock).mockReturnValue({ sessionId: 'old-sess', isNew: false });
+
+      const sdk = createSDK({ consent: 'anonymous' });
+      const consent = (createConsentManager as jest.Mock).mock.results[0].value;
+      consent.setLevel('anonymous');
+      const queue = (MessageQueue as jest.Mock).mock.results[0].value;
+
+      sdk.page();
+
+      const enqueued = queue.enqueue.mock.calls.map((c: any[]) => c[0]);
+      const sessionStart = enqueued.find((m: any) => m.eventName === 'session_start');
+      expect(sessionStart).toBeUndefined();
+    });
+  });
 });

packages/audience/sdk/src/sdk.ts

@@ -21,6 +21,7 @@ import {
   deleteCookie,
   generateId,
   getTimestamp,
+  isBrowser,
   createConsentManager,
   collectAttribution,
 } from '@imtbl/audience-core';
@@ -37,12 +38,18 @@ export class ImmutableAudienceSDK {
 
   private userId: string | undefined;
 
+  private sessionId: string | undefined;
+
+  private sessionStartTime: number | undefined;
+
   private debug: DebugLogger;
 
   private config: Required<Pick<AudienceSDKConfig, 'publishableKey' | 'environment'>> & AudienceSDKConfig;
 
   private destroyed = false;
 
+  private unloadHandler?: () => void;
+
   constructor(config: AudienceSDKConfig) {
     const {
       publishableKey,
@@ -82,14 +89,16 @@ export class ImmutableAudienceSDK {
     );
 
     this.queue.start();
+    this.registerSessionEnd();
   }
 
   // -- Public API ---------------------------------------------------------
 
   page(properties?: Record<string, unknown>): void {
     if (!this.canTrack()) return;
 
-    const { sessionId } = this.touchSession();
+    const { sessionId, isNew } = this.touchSession();
+    this.refreshSession(sessionId, isNew);
     const attribution = collectAttribution();
     const context = collectContext();
 
@@ -111,7 +120,8 @@ export class ImmutableAudienceSDK {
   track(eventName: string, properties?: Record<string, unknown>): void {
     if (!this.canTrack()) return;
 
-    const { sessionId } = this.touchSession();
+    const { sessionId, isNew } = this.touchSession();
+    this.refreshSession(sessionId, isNew);
     const context = collectContext();
 
     const message: TrackMessage = {
@@ -134,7 +144,8 @@ export class ImmutableAudienceSDK {
     if (this.destroyed || this.consent.level !== 'full') return;
 
     this.userId = userId;
-    const { sessionId } = this.touchSession();
+    const { sessionId, isNew } = this.touchSession();
+    this.refreshSession(sessionId, isNew);
     const context = collectContext();
 
     const message: IdentifyMessage = {
@@ -179,7 +190,8 @@ export class ImmutableAudienceSDK {
     const previous = this.consent.level;
     this.consent.setLevel(level);
 
-    // Clear cookies on revocation (core handles queue purge)
+    // TODO: cookie cleanup should move to core's createConsentManager
+    // so all surfaces (SDK, Pixel) get consistent revocation behavior.
     if (level === 'none') {
       deleteCookie(COOKIE_NAME, this.config.cookieDomain);
       deleteCookie(SESSION_COOKIE, this.config.cookieDomain);
@@ -194,9 +206,85 @@ export class ImmutableAudienceSDK {
 
   destroy(): void {
     this.destroyed = true;
+    this.removeSessionEnd();
     this.queue.destroy();
   }
 
+  // -- Session lifecycle --------------------------------------------------
+
+  private refreshSession(sessionId: string, isNew: boolean): void {
+    this.sessionId = sessionId;
+    if (isNew) {
+      this.sessionStartTime = Date.now();
+      this.fireSessionStart(sessionId);
+    }
+  }
+
+  private fireSessionStart(sessionId: string): void {
+    if (!this.canTrack()) return;
+
+    const message: TrackMessage = {
+      type: 'track',
+      eventName: 'session_start',
+      messageId: generateId(),
+      eventTimestamp: getTimestamp(),
+      anonymousId: this.anonymousId,
+      surface: 'web',
+      context: collectContext(),
+      properties: { sessionId },
+      userId: this.consent.level === 'full' ? this.userId : undefined,
+    };
+
+    this.debug.logEvent('session_start', message);
+    this.queue.enqueue(message);
+  }
+
+  private fireSessionEnd(): void {
+    if (!this.canTrack() || !this.sessionId) return;
+
+    const duration = this.sessionStartTime
+      ? Math.round((Date.now() - this.sessionStartTime) / 1000)
+      : undefined;
+
+    const message: TrackMessage = {
+      type: 'track',
+      eventName: 'session_end',
+      messageId: generateId(),
+      eventTimestamp: getTimestamp(),
+      anonymousId: this.anonymousId,
+      surface: 'web',
+      context: collectContext(),
+      properties: {
+        sessionId: this.sessionId,
+        duration,
+      },
+      userId: this.consent.level === 'full' ? this.userId : undefined,
+    };
+
+    this.debug.logEvent('session_end', message);
+    this.queue.enqueue(message);
+  }
+
+  private registerSessionEnd(): void {
+    if (!isBrowser()) return;
+
+    this.unloadHandler = () => this.fireSessionEnd();
+
+    document.addEventListener('visibilitychange', () => {
+      if (document.visibilityState === 'hidden') {
+        this.unloadHandler?.();
+      }
+    });
+    window.addEventListener('pagehide', this.unloadHandler);
+  }
+
+  private removeSessionEnd(): void {
+    if (this.unloadHandler) {
+      window.removeEventListener('pagehide', this.unloadHandler);
+      this.unloadHandler = undefined;
+    }
+  }
+
   // -- Internals ----------------------------------------------------------
 
   private canTrack(): boolean {

packages/audience/sdk/src/types.ts

@@ -6,7 +6,6 @@ export interface AudienceSDKConfig {
   environment: Environment;
   /** Defaults to 'none' — no tracking until explicitly opted in. */
   consent?: ConsentLevel;
-  consentSource?: string;
   debug?: boolean;
   cookieDomain?: string;
   flushInterval?: number;