@active-reach/web-sdk 1.41.0 → 1.43.0

package/dist/utils/canonical-identity.d.ts

@@ -1,29 +0,0 @@
-export interface CanonicalIdentity {
-    status: 'identified' | 'anonymous' | 'pseudonymous';
-    has_pii: boolean;
-    classification_reason: 'producer_pii' | 'producer_anonymous' | 'fallback';
-    evidence: {
-        email?: string;
-        phone?: string;
-        user_id?: string;
-        customer_id?: string;
-    };
-    anonymous_ids: {
-        cookie_id?: string;
-        session_id?: string;
-        device_id?: string;
-        fingerprint_id?: string;
-    };
-    resolution_source: 'producer';
-}
-export declare function buildCanonicalIdentity(params: {
-    email?: string;
-    phone?: string;
-    user_id?: string;
-    customer_id?: string;
-    cookie_id?: string;
-    session_id?: string;
-    device_id?: string;
-    fingerprint_id?: string;
-}): CanonicalIdentity;
-//# sourceMappingURL=canonical-identity.d.ts.map

package/dist/utils/canonical-identity.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"canonical-identity.d.ts","sourceRoot":"","sources":["../../src/utils/canonical-identity.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,YAAY,GAAG,WAAW,GAAG,cAAc,CAAC;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,qBAAqB,EAAE,cAAc,GAAG,oBAAoB,GAAG,UAAU,CAAC;IAC1E,QAAQ,EAAE;QACR,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,aAAa,EAAE;QACb,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,iBAAiB,EAAE,UAAU,CAAC;CAC/B;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,iBAAiB,CAiDpB"}

package/dist/utils/consent.d.ts

@@ -1,40 +0,0 @@
-import { Storage } from './storage';
-export type ConsentCategory = 'analytics' | 'marketing' | 'functional' | 'necessary';
-export interface ConsentPreferences {
-    analytics: boolean;
-    marketing: boolean;
-    functional: boolean;
-    necessary: boolean;
-}
-export type ConsentStatus = 'granted' | 'denied' | 'pending';
-export interface ConsentManagerConfig {
-    defaultConsent?: Partial<ConsentPreferences>;
-    waitForConsent?: boolean;
-    consentStorageKey?: string;
-}
-export declare class ConsentManager {
-    private storage;
-    private config;
-    private preferences;
-    private listeners;
-    constructor(storage: Storage, config?: ConsentManagerConfig);
-    private loadPreferences;
-    private getDefaultPreferences;
-    private mergeWithDefaults;
-    private savePreferences;
-    setConsent(preferences: Partial<ConsentPreferences>): void;
-    grantAll(): void;
-    denyAll(): void;
-    hasConsent(category: ConsentCategory): boolean;
-    getPreferences(): ConsentPreferences;
-    getStatus(category: ConsentCategory): ConsentStatus;
-    isAnalyticsEnabled(): boolean;
-    isMarketingEnabled(): boolean;
-    onChange(callback: (preferences: ConsentPreferences) => void): () => void;
-    private notifyListeners;
-    reset(): void;
-    integrateOneTrust(): void;
-    integrateCookiebot(): void;
-    integrateGoogleConsentMode(): void;
-}
-//# sourceMappingURL=consent.d.ts.map

package/dist/utils/consent.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"consent.d.ts","sourceRoot":"","sources":["../../src/utils/consent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,MAAM,MAAM,eAAe,GACvB,WAAW,GACX,WAAW,GACX,YAAY,GACZ,WAAW,CAAC;AAEhB,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE7D,MAAM,WAAW,oBAAoB;IACnC,cAAc,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7C,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,OAAO,CAAU;IACzB,OAAO,CAAC,MAAM,CAAiC;IAC/C,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,SAAS,CAAwD;gBAE7D,OAAO,EAAE,OAAO,EAAE,MAAM,GAAE,oBAAyB;IAW/D,OAAO,CAAC,eAAe;IAgBvB,OAAO,CAAC,qBAAqB;IAS7B,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,eAAe;IAavB,UAAU,CAAC,WAAW,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI;IAW1D,QAAQ,IAAI,IAAI;IAShB,OAAO,IAAI,IAAI;IASf,UAAU,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO;IAI9C,cAAc,IAAI,kBAAkB;IAIpC,SAAS,CAAC,QAAQ,EAAE,eAAe,GAAG,aAAa;IAanD,kBAAkB,IAAI,OAAO;IAI7B,kBAAkB,IAAI,OAAO;IAI7B,QAAQ,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,kBAAkB,KAAK,IAAI,GAAG,MAAM,IAAI;IAWzE,OAAO,CAAC,eAAe;IAUvB,KAAK,IAAI,IAAI;IAOb,iBAAiB,IAAI,IAAI;IAmCzB,kBAAkB,IAAI,IAAI;IA8B1B,0BAA0B,IAAI,IAAI;CA2CnC"}

package/dist/utils/debounce.d.ts

@@ -1,3 +0,0 @@
-export declare function debounce<T extends (...args: any[]) => any>(func: T, wait: number): (...args: Parameters<T>) => void;
-export declare function throttle<T extends (...args: any[]) => any>(func: T, limit: number): (...args: Parameters<T>) => void;
-//# sourceMappingURL=debounce.d.ts.map

package/dist/utils/debounce.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"debounce.d.ts","sourceRoot":"","sources":["../../src/utils/debounce.ts"],"names":[],"mappings":"AAAA,wBAAgB,QAAQ,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EACxD,IAAI,EAAE,CAAC,EACP,IAAI,EAAE,MAAM,GACX,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,CAalC;AAED,wBAAgB,QAAQ,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EACxD,IAAI,EAAE,CAAC,EACP,KAAK,EAAE,MAAM,GACZ,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,CAYlC"}

package/dist/utils/device.d.ts

@@ -1,6 +0,0 @@
-import { EventContext } from '../types/events';
-import { AegisConfigInternal } from '../types/config';
-import type { SessionManager } from '../core/session';
-export declare function buildContext(config: AegisConfigInternal, session?: SessionManager): EventContext;
-export declare function isBot(): boolean;
-//# sourceMappingURL=device.d.ts.map

package/dist/utils/device.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"device.d.ts","sourceRoot":"","sources":["../../src/utils/device.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAG/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,wBAAgB,YAAY,CAAC,MAAM,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,YAAY,CAwDhG;AAwGD,wBAAgB,KAAK,IAAI,OAAO,CAyB/B"}

package/dist/utils/identity.d.ts

@@ -1,27 +0,0 @@
-import { Storage } from './storage';
-export interface IdentityState {
-    anonymousId: string;
-    userId: string | null;
-    traits: Record<string, any>;
-}
-export declare class Identity {
-    private storage;
-    private anonymousId;
-    private userId;
-    private traits;
-    constructor(storage: Storage);
-    private getOrCreateAnonymousId;
-    private loadUserIdentity;
-    getAnonymousId(): string;
-    setUserId(userId: string, traits?: Record<string, any>): void;
-    getUserId(): string | null;
-    setTraits(traits: Record<string, any>): void;
-    getTraits(): Record<string, any>;
-    reset(): void;
-    alias(newUserId: string): {
-        previousId: string;
-        newUserId: string;
-    };
-    getState(): IdentityState;
-}
-//# sourceMappingURL=identity.d.ts.map

package/dist/utils/identity.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/utils/identity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC7B;AAED,qBAAa,QAAQ;IACnB,OAAO,CAAC,OAAO,CAAU;IACzB,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,MAAM,CAA2B;gBAE7B,OAAO,EAAE,OAAO;IAM5B,OAAO,CAAC,sBAAsB;IAc9B,OAAO,CAAC,gBAAgB;IAoBxB,cAAc,IAAI,MAAM;IAIxB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI;IAU7D,SAAS,IAAI,MAAM,GAAG,IAAI;IAI1B,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI;IAM5C,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IAIhC,KAAK,IAAI,IAAI;IAYb,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAUnE,QAAQ,IAAI,aAAa;CAO1B"}

package/dist/utils/index.d.ts

@@ -1,7 +0,0 @@
-export * from './uuid';
-export * from './storage';
-export * from './url-parser';
-export * from './device';
-export * from './logger';
-export * from './debounce';
-//# sourceMappingURL=index.d.ts.map

package/dist/utils/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAC;AACvB,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC"}

package/dist/utils/logger.d.ts

@@ -1,15 +0,0 @@
-export type LogLevel = 'debug' | 'info' | 'warn' | 'error';
-declare class Logger {
-    private enabled;
-    private prefix;
-    enable(): void;
-    disable(): void;
-    isEnabled(): boolean;
-    debug(message: string, ...args: any[]): void;
-    info(message: string, ...args: any[]): void;
-    warn(message: string, ...args: any[]): void;
-    error(message: string, ...args: any[]): void;
-}
-export declare const logger: Logger;
-export {};
-//# sourceMappingURL=logger.d.ts.map

package/dist/utils/logger.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/utils/logger.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3D,cAAM,MAAM;IACV,OAAO,CAAC,OAAO,CAAkB;IACjC,OAAO,CAAC,MAAM,CAAgC;IAE9C,MAAM,IAAI,IAAI;IAId,OAAO,IAAI,IAAI;IAIf,SAAS,IAAI,OAAO;IAIpB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI;IAK5C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI;IAK3C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI;IAI3C,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI;CAG7C;AAED,eAAO,MAAM,MAAM,QAAe,CAAC"}

package/dist/utils/meta-cookies.d.ts

@@ -1,65 +0,0 @@
-/**
- * Meta Pixel companion cookies (_fbp, _fbc) — B1.2 of META_CAPI_PHASE1_TRACKER.
- *
- * We do NOT fire `fbq()` browser-side. We write the cookies Meta uses to
- * identify the same browser so server-side CAPI events (forwarded from
- * `meta_conversions_api_service.py`) carry the high-EMQ match keys
- * (fbp + fbc) without the cost of running a full Meta Pixel.
- *
- * Cookie spec (Meta docs, verified May 2026):
- *   _fbp = fb.<subdomain_index>.<creation_ms>.<random>
- *   _fbc = fb.<subdomain_index>.<click_ms>.<fbclid>
- *   subdomain_index = number of dots in cookie domain
- *     (example.com → 1, sub.example.com → 2)
- *   random = 10-digit random integer
- *   Lifetime: 90 days (Meta's default; longer doesn't increase EMQ)
- *
- * Reasoning for raw document.cookie writes (instead of utils/storage.ts):
- *   The Storage helper prefixes every key with `aegis_` so writes go to
- *   `aegis__fbp` / `aegis__fbc`. Meta only honors the exact names
- *   `_fbp` and `_fbc`. We bypass the helper and write directly.
- *
- * Domain scope: written to the eTLD+1 (root domain) so a tenant who
- * later wires their own Meta Pixel via GTM sees the same cookies a
- * subdomain-rooted set would not.
- *
- * SSR-safe: every helper is no-op when `document` / `window` are
- * undefined. Callers don't need to guard.
- */
-export interface MetaCookies {
-    fbp: string | null;
-    fbc: string | null;
-    fbclid: string | null;
-}
-/**
- * Read `_fbp` from cookies, write a fresh one if absent.
- * Returns the resulting `_fbp` value or null if cookies unavailable.
- */
-export declare function ensureFbp(): string | null;
-/**
- * Read `_fbc` from cookies. If absent and the URL carries `fbclid`, write
- * a fresh `_fbc` per Meta's spec. Returns the resulting value or null.
- *
- * Note: `_fbc` has no value to write without an `fbclid` source — unlike
- * `_fbp` which is browser-identity-only and can be self-generated.
- */
-export declare function ensureFbc(): string | null;
-/** Pull `fbclid` from `?fbclid=...` query string. Null if absent or SSR. */
-export declare function readFbclidFromUrl(): string | null;
-/**
- * Single call that returns `{fbp, fbc, fbclid}` for injection into every
- * event's `properties` (which lands in ClickHouse `in_app_events.metadata`,
- * which the cell-side CAPI service reads directly).
- *
- * Side effects: ensures both cookies are present before returning. Idempotent
- * — safe to call on every event capture.
- */
-export declare function captureMetaCookies(): MetaCookies;
-/**
- * A copy of `event` safe to hand to a logger: `properties.fbc` / `properties.fbp`
- * masked. They are Meta cookie values — match keys for CAPI only, and must
- * stay out of every log line (ACS tracking tracker §V.3). The event itself is
- * never mutated; only the logged copy is.
- */
-export declare function redactMetaCookies<T>(event: T): T;
-//# sourceMappingURL=meta-cookies.d.ts.map

package/dist/utils/meta-cookies.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"meta-cookies.d.ts","sourceRoot":"","sources":["../../src/utils/meta-cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAMH,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AA8ED;;;GAGG;AACH,wBAAgB,SAAS,IAAI,MAAM,GAAG,IAAI,CAMzC;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,IAAI,MAAM,GAAG,IAAI,CAQzC;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAOjD;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,IAAI,WAAW,CAMhD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAOhD"}

package/dist/utils/redact-url.d.ts

@@ -1,56 +0,0 @@
-/**
- * URL credential redaction — the browser-SDK layer (Aman 2026-09-13).
- *
- * A landing URL can carry a credential: `k` (one order's view key), `t` (the
- * server-verified landing token), `code` / `session_code` (claim codes),
- * `aegis_pair` (a device-pairing code) and `u` (a contact token). The SDK must
- * never SEND one of those values — not in a page object, an event property, a
- * beacon or a query string to our own API. What it sends instead is the key
- * with its value replaced by `REDACTED`, so the shape of the URL (and the fact
- * that a credential was present) survives while the secret does not.
- *
- * The server twin is `libs/data-governance/data_governance/credential_params.py`
- * (`CREDENTIAL_URL_PARAMS`, `REDACTED`). The two lists MUST stay identical; a
- * parity guard compares them. Change both in the same commit or neither.
- *
- * Deliberately NOT in the list: `aegis_code`. It is the attribution join key
- * (the short link's own code), not a credential — redacting it would sever
- * the link from the order it brought in.
- *
- * Reading is untouched. The SDK's own inbound param readers (`aegis_code`,
- * gclid / fbclid, utm, `aegis_pair` for pairing) still read `location.search`
- * directly; only what leaves the browser is redacted.
- *
- * Why a targeted regex and not `new URL()`: a URL round-trip re-encodes and
- * reorders the rest of the string, so the value we send would no longer be
- * the page the visitor was on. The regex touches only the credential values.
- *
- * What it does not see: a percent-encoded key (`%6B=` for `k`), a `;`
- * separator, or a key whose case differs (`K=`). The server list has the same
- * shape, so both layers agree on what counts as a match.
- */
-export declare const CREDENTIAL_URL_PARAMS: readonly ["t", "k", "code", "session_code", "aegis_pair", "u", "carrier_token"];
-export declare const REDACTED = "REDACTED";
-/**
- * Replace the value of every credential query param with `REDACTED`.
- * Idempotent, fragment-preserving, and it never throws: input it cannot
- * handle is returned unchanged.
- */
-export declare function redactUrl(value: string): string;
-/**
- * Walk plain objects / arrays and apply `redactUrl` to every string — the TS
- * twin of the server's `redact_credentials_deep` (same depth cap, 12).
- *
- * Added for the SERVER consumers of `channel.delivery.status_{cell}` (BK-87,
- * 2026-09-13): that topic is a dual-route that never passes the governance
- * engine, and its click/receipt payloads carry URLs (`metadata.original_url`,
- * `referrer`, provider echoes). analytics-consumer and event-ingress's
- * delivery-status bridge import THIS module by relative path, so there is one
- * TS rule, not a copy. Redacting per string value (before serialisation) keeps
- * JSON valid even when a value itself holds escaped JSON.
- *
- * Only plain objects and arrays are walked; anything else (Date, Buffer, class
- * instances) is returned as is.
- */
-export declare function redactCredentialsDeep<T>(value: T, depth?: number): T;
-//# sourceMappingURL=redact-url.d.ts.map

package/dist/utils/redact-url.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"redact-url.d.ts","sourceRoot":"","sources":["../../src/utils/redact-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,eAAO,MAAM,qBAAqB,iFAWxB,CAAC;AAEX,eAAO,MAAM,QAAQ,aAAa,CAAC;AAenC;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAO/C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,SAAI,GAAG,CAAC,CAc/D"}

package/dist/utils/storage.d.ts

@@ -1,20 +0,0 @@
-export interface StorageOptions {
-    cookieDomain?: string | null;
-    secureCookie?: boolean;
-    crossDomain?: boolean;
-}
-export declare class Storage {
-    private useLocalStorage;
-    private options;
-    constructor(options?: StorageOptions);
-    private isLocalStorageAvailable;
-    set(key: string, value: string, expiryDays?: number): void;
-    get(key: string): string | null;
-    remove(key: string): void;
-    clear(): void;
-    private setCookie;
-    private getCookie;
-    private deleteCookie;
-    private getRootDomain;
-}
-//# sourceMappingURL=storage.d.ts.map

package/dist/utils/storage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/utils/storage.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,cAAc;IAC7B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,qBAAa,OAAO;IAClB,OAAO,CAAC,eAAe,CAAU;IACjC,OAAO,CAAC,OAAO,CAAiB;gBAEpB,OAAO,GAAE,cAAmB;IAKxC,OAAO,CAAC,uBAAuB;IAW/B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,GAAE,MAAY,GAAG,IAAI;IAkB/D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAsB/B,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAczB,KAAK,IAAI,IAAI;IAuBb,OAAO,CAAC,SAAS;IA6BjB,OAAO,CAAC,SAAS;IAqBjB,OAAO,CAAC,YAAY;IAmBpB,OAAO,CAAC,aAAa;CAwBtB"}

package/dist/utils/url-parser.d.ts

@@ -1,61 +0,0 @@
-export interface UTMParams {
-    source?: string;
-    medium?: string;
-    campaign?: string;
-    term?: string;
-    content?: string;
-    name?: string;
-}
-export declare function parseUTMParameters(url?: string): UTMParams;
-export declare function parseQueryParameters(url?: string): Record<string, string>;
-/**
- * The page's URL for REPORTING — so it is credential-redacted (`redactUrl`),
- * the canonical `<link>` included. No caller in the SDK today; redacted so a
- * future one cannot send a raw `?k=` / `?t=` by reaching for this helper.
- */
-export declare function getCanonicalURL(): string;
-export declare function stripQueryParameters(url: string): string;
-export interface AdClickIDs {
-    gclid?: string;
-    /** Google click id for iOS app→web traffic (Apple ATT). NOT a gclid. */
-    gbraid?: string;
-    /** Google click id for iOS web→app traffic (Apple ATT). NOT a gclid. */
-    wbraid?: string;
-    fbclid?: string;
-    msclkid?: string;
-    ctwa_clid?: string;
-    ttclid?: string;
-    li_fat_id?: string;
-}
-export declare function parseAdClickIDs(url?: string): AdClickIDs;
-export declare function hasAdClickIDs(adClickIDs: AdClickIDs): boolean;
-/**
- * Which Aegis send brought the visitor — the `aegis_*` params the short-link
- * redirect stamps from the LINK row (`link_shortener` `aegis_params`).
- *
- * `aegis_code` is the join key (the short link's own code); the send is then
- * `aegis_campaign` (campaign sends only) OR `aegis_journey` (journey sends —
- * order confirmation, delivery, win-back). Present only when the link row has
- * a value, so never assume `aegis_campaign` exists.
- *
- * Deliberately NOT read here:
- *   - `utm_*`  — the tenant's own / third-party analytics; never identifies an
- *                Aegis send (a tenant-set utm can sit on our own link).
- *   - `k`      — a credential for ONE order. Never read, copied or logged.
- *   - `t`      — server-verified landing token; never parsed client-side.
- *   - `u`      — consumed at the redirect, never forwarded.
- */
-export interface LinkAttribution {
-    aegis_code?: string;
-    aegis_campaign?: string;
-    aegis_journey?: string;
-    aegis_playbook?: string;
-    aegis_button?: string;
-}
-/**
- * Parse the landing URL's Aegis link attribution. Returns `{}` unless
- * `aegis_code` is present — the rest of the set only means something as the
- * attributes OF that code.
- */
-export declare function parseLinkAttribution(url?: string): LinkAttribution;
-//# sourceMappingURL=url-parser.d.ts.map

package/dist/utils/url-parser.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"url-parser.d.ts","sourceRoot":"","sources":["../../src/utils/url-parser.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CA6B1D;AAED,wBAAgB,oBAAoB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiBzE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAYxC;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQxD;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,UAAU,CA+BxD;AAED,wBAAgB,aAAa,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAE7D;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAUD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,eAAe,CAoBlE"}

package/dist/utils/uuid.d.ts

@@ -1,4 +0,0 @@
-export declare function generateUUID(): string;
-export declare function generateSessionId(): string;
-export declare function generateMessageId(): string;
-//# sourceMappingURL=uuid.d.ts.map

package/dist/utils/uuid.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"uuid.d.ts","sourceRoot":"","sources":["../../src/utils/uuid.ts"],"names":[],"mappings":"AAAA,wBAAgB,YAAY,IAAI,MAAM,CAUrC;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C"}

package/dist/utils/visitor.d.ts

@@ -1,43 +0,0 @@
-/**
- * New-visitor verdict — the ONE reader and writer of the returning-visitor
- * marker (2026-09-13).
- *
- * `/v1/in-app/active` and `/v1/sdk/prefetch-bundle` both take `is_new_user`,
- * and the server drops any campaign whose `display_rules.show_to_new_users_only`
- * is set when it arrives false. The SDK used to write `aegis_returning_user=1`
- * at the top of `AegisInAppManager.initialize()` and read it afterwards, inside
- * the fetch — so the read always saw its own write, every fetch said
- * `is_new_user=false`, and a new-users-only campaign could never be served.
- *
- * The rule this module enforces: the marker is read ONCE, before anything
- * writes it, and the verdict is held for the whole browsing session.
- *
- *   - `isNewVisitor()` resolves the verdict on first call and caches it in
- *     memory (this page load) and in sessionStorage (later page loads in the
- *     same tab session), so every fetch in a session sends the same value and
- *     the verdict does not flip after the marker is written.
- *   - `markReturningVisitor()` is the only writer. It resolves the verdict
- *     first, so no call order can make the read see the write.
- *
- * Storage unavailable (SSR, blocked site data, a browser that throws on
- * access): the verdict is RETURNING (`false`). "New" is a positive claim that
- * unlocks first-visit-only messages; when the SDK cannot remember a visit it
- * cannot prove one never happened, and because the marker can never be saved,
- * answering "new" would re-show a first-visit message on every page of every
- * visit forever. `false` is also what the server assumes when the parameter is
- * absent, so an unknown visitor reads the same on both sides.
- */
-/**
- * Whether this browsing session belongs to a visitor the SDK has never seen
- * before. Stable for the whole session; see the module doc for the default
- * when storage is unavailable.
- */
-export declare function isNewVisitor(): boolean;
-/**
- * Record that this visitor has now been seen, so the NEXT session reads as
- * returning. Resolves the current session's verdict before writing.
- */
-export declare function markReturningVisitor(): void;
-/** Test seam: forget the in-memory verdict, as a fresh page load would. */
-export declare function resetVisitorVerdictCacheForTests(): void;
-//# sourceMappingURL=visitor.d.ts.map

package/dist/utils/visitor.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"visitor.d.ts","sourceRoot":"","sources":["../../src/utils/visitor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAqCH;;;;GAIG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAUtC;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAQ3C;AAED,2EAA2E;AAC3E,wBAAgB,gCAAgC,IAAI,IAAI,CAEvD"}

package/dist/widgets/AegisWidgetManager.d.ts

@@ -1,209 +0,0 @@
-/**
- * AegisWidgetManager - Web SDK Widget Module
- *
- * Smart Pull architecture for persistent web widgets.
- *
- * Features:
- * - Games (spin wheel, scratch card) are in-app campaigns (AegisInAppManager), not widgets
- * - Chat bubbles (WhatsApp, support)
- * - Social proof toasts (real-time purchase notifications)
- * - Feedback forms (NPS, surveys)
- *
- * Security:
- * - XSS Protection: Uses DOM APIs instead of innerHTML
- * - Server-side prize generation prevents client manipulation
- * - URL validation prevents javascript: protocol injection
- *
- * Architecture:
- * - Fetches widget configs from /v1/widgets/config on page load
- * - Integrates with TriggerEngine for behavioral triggers
- * - Tracks widget events (show, click, dismiss, submit)
- * - Server-side prize generation for gamification
- */
-import { TriggerEngine } from '../triggers/TriggerEngine';
-export interface WidgetConfig {
-    widget_id: string;
-    widget_type: 'chat_bubble' | 'toast' | 'feedback_form' | 'exit_intent_popup';
-    name: string;
-    config: Record<string, any>;
-    position?: string;
-    priority: number;
-    trigger_rules?: {
-        type: 'exit_intent' | 'scroll_depth' | 'time_on_page' | 'immediate';
-        config?: Record<string, any>;
-    };
-}
-export interface AegisWidgetConfig {
-    writeKey: string;
-    apiHost?: string;
-    userId?: string;
-    contactId?: string;
-    /** Server-minted proof of `contactId` (C1b). Sent alongside `X-Contact-ID`
-     *  so the cell-plane will honour the id. */
-    contactToken?: string;
-    organizationId?: string;
-    debugMode?: boolean;
-    triggerEngine?: TriggerEngine;
-    /** If true, WidgetManager takes ownership of the TriggerEngine and
-     *  will call `triggerEngine.stop()` on destroy(). Leave false when
-     *  the caller shares the engine across managers (e.g. the facade). */
-    ownsTriggerEngine?: boolean;
-    enablePrefetch?: boolean;
-    cssCustomization?: WidgetCSSCustomization;
-    onEvent?: (eventType: string, data: any) => void;
-    /** Source platform passed as X-Source-Platform header so the API
-     *  can filter campaigns whose display_rules.sources restricts them
-     *  to specific integrations (e.g. 'shopify', 'woocommerce'). */
-    sourcePlatform?: 'web' | 'shopify' | 'woocommerce' | 'mobile_sdk';
-    /**
-     * Workspace cascade reader. Host SDK sets this to
-     * `() => aegis.getEffectiveWorkspaceId()` so widget interaction events
-     * (impressions, clicks, feedback submissions)
-     * arrive at the gateway with the same workspace context the main
-     * analytics SDK uses. See PLUGIN_HANDSHAKE_AUTOMATION_TRACKER.md §P1.b.
-     */
-    getWorkspaceId?: () => string | undefined;
-    /**
-     * Cart-store unification: invoked whenever the widget subsystem learns the
-     * cart — platform auto-detect (Shopify/Woo/Magento) or an explicit
-     * `setCartData(...)`. The runtime wires this to `applyCart(...)` so the ONE
-     * cart store (read by the Free-Delivery card / progress bar / rule eval) stays
-     * in sync. See CART_STORE_UNIFICATION_TRACKER.md.
-     */
-    onCartDetected?: (cart: CartData) => void;
-}
-export interface WidgetCSSCustomization {
-    exitIntent?: {
-        backgroundColor?: string;
-        textColor?: string;
-        accentColor?: string;
-        borderRadius?: string;
-        fontFamily?: string;
-        overlayOpacity?: number;
-    };
-    chatBubble?: {
-        backgroundColor?: string;
-        textColor?: string;
-        position?: 'bottom_right' | 'bottom_left' | 'top_right' | 'top_left';
-        size?: 'small' | 'medium' | 'large';
-    };
-}
-export interface PrefetchWidgetConfig {
-    exit_intent?: {
-        enabled: boolean;
-        type: 'cart_recovery' | 'lead_gen';
-        tier?: string;
-        title?: string;
-        message?: string;
-        discount_code?: string;
-        discount_percentage?: number;
-        cta_text?: string;
-        cta_url?: string;
-        background_color?: string;
-        text_color?: string;
-        accent_color?: string;
-        show_cart_items?: boolean;
-        show_timer?: boolean;
-        timer_minutes?: number;
-        priority: number;
-        mobile_triggers?: {
-            scroll_velocity?: boolean;
-            scroll_threshold?: number;
-            scroll_min_position?: number;
-            scroll_cooldown?: number;
-            idle_timer?: boolean;
-            idle_seconds?: number;
-            visibility_change?: boolean;
-            back_button?: boolean;
-        };
-    };
-}
-export interface CartData {
-    cart_id: string;
-    cart_total: number;
-    cart_currency: string;
-    cart_items: Array<{
-        product_id: string;
-        product_name?: string;
-        quantity: number;
-        price?: number;
-    }>;
-}
-export declare class AegisWidgetManager {
-    private writeKey;
-    private apiHost;
-    private userId?;
-    private contactId?;
-    private contactToken?;
-    private organizationId?;
-    private debugMode;
-    private triggerEngine?;
-    private enablePrefetch;
-    private cssCustomization;
-    private onEvent?;
-    private sourcePlatform?;
-    private getWorkspaceId?;
-    private onCartDetected?;
-    private widgets;
-    private renderedWidgets;
-    private isInitialized;
-    private isDestroyed;
-    private ownsTriggerEngine;
-    private prefetchWidgetConfigs;
-    private cartData?;
-    constructor(config: AegisWidgetConfig);
-    updateCSSCustomization(customization: WidgetCSSCustomization): void;
-    /**
-     * Swap the identity that outgoing widget requests are attributed to.
-     * Safe to call at any time; if prefetch is enabled and the manager
-     * has already initialised, this will re-fetch the per-contact widget
-     * configs so subsequent renders target the new identity. Does NOT
-     * re-render already-visible widgets — a full teardown requires destroy().
-     */
-    updateContactId(contactId: string | undefined, contactToken?: string): Promise<void>;
-    /**
-     * Tear down everything the manager installed: trigger listeners (if
-     * we own the TriggerEngine), injected style sheets, and any rendered
-     * widget roots. Further render attempts from in-flight triggers are
-     * short-circuited by the `isDestroyed` flag.
-     */
-    destroy(): void;
-    /**
-     * Fire a lifecycle event to the consumer-supplied callback. Public-API
-     * hook configured via `AegisWidgetConfig.onEvent`. Currently only used
-     * by external callers passing their own logger; internal widget lifecycle
-     * events get wired through here as they're added.
-     */
-    private emitEvent;
-    initialize(): Promise<void>;
-    setCartData(cartData: CartData): void;
-    private detectPlatformCart;
-    private normalizeShopifyCart;
-    private normalizeWooCart;
-    private normalizeMagentoCart;
-    private preloadWidgetAssets;
-    private fetchPrefetchConfigs;
-    private fetchWidgets;
-    private renderImmediateWidgets;
-    private setupTriggerListeners;
-    private setupExitIntentWithPrefetch;
-    private sendCartAbandonmentBeacon;
-    private renderWidget;
-    private renderChatBubble;
-    private getUTMParams;
-    private renderToast;
-    private renderFeedbackForm;
-    private renderExitIntentPopup;
-    private submitFeedback;
-    private trackEvent;
-    private sanitizeUrl;
-    private sanitizeColor;
-    private getDeviceType;
-    private isMobileDevice;
-    private addAnimationStyles;
-    private renderCartRecoveryPopup;
-    private renderLeadGenPopup;
-    private interpolateCartVariables;
-    private log;
-}
-//# sourceMappingURL=AegisWidgetManager.d.ts.map