@active-reach/web-sdk 1.43.1 → 1.43.3

package/dist/utils/visitor.d.ts

@@ -0,0 +1,43 @@
+/**
+ * New-visitor verdict — the ONE reader and writer of the returning-visitor
+ * marker (2026-09-13).
+ *
+ * `/v1/in-app/active` and `/v1/sdk/prefetch-bundle` both take `is_new_user`,
+ * and the server drops any campaign whose `display_rules.show_to_new_users_only`
+ * is set when it arrives false. The SDK used to write `aegis_returning_user=1`
+ * at the top of `AegisInAppManager.initialize()` and read it afterwards, inside
+ * the fetch — so the read always saw its own write, every fetch said
+ * `is_new_user=false`, and a new-users-only campaign could never be served.
+ *
+ * The rule this module enforces: the marker is read ONCE, before anything
+ * writes it, and the verdict is held for the whole browsing session.
+ *
+ *   - `isNewVisitor()` resolves the verdict on first call and caches it in
+ *     memory (this page load) and in sessionStorage (later page loads in the
+ *     same tab session), so every fetch in a session sends the same value and
+ *     the verdict does not flip after the marker is written.
+ *   - `markReturningVisitor()` is the only writer. It resolves the verdict
+ *     first, so no call order can make the read see the write.
+ *
+ * Storage unavailable (SSR, blocked site data, a browser that throws on
+ * access): the verdict is RETURNING (`false`). "New" is a positive claim that
+ * unlocks first-visit-only messages; when the SDK cannot remember a visit it
+ * cannot prove one never happened, and because the marker can never be saved,
+ * answering "new" would re-show a first-visit message on every page of every
+ * visit forever. `false` is also what the server assumes when the parameter is
+ * absent, so an unknown visitor reads the same on both sides.
+ */
+/**
+ * Whether this browsing session belongs to a visitor the SDK has never seen
+ * before. Stable for the whole session; see the module doc for the default
+ * when storage is unavailable.
+ */
+export declare function isNewVisitor(): boolean;
+/**
+ * Record that this visitor has now been seen, so the NEXT session reads as
+ * returning. Resolves the current session's verdict before writing.
+ */
+export declare function markReturningVisitor(): void;
+/** Test seam: forget the in-memory verdict, as a fresh page load would. */
+export declare function resetVisitorVerdictCacheForTests(): void;
+//# sourceMappingURL=visitor.d.ts.map

package/dist/utils/visitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"visitor.d.ts","sourceRoot":"","sources":["../../src/utils/visitor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAqCH;;;;GAIG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAUtC;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAQ3C;AAED,2EAA2E;AAC3E,wBAAgB,gCAAgC,IAAI,IAAI,CAEvD"}

package/dist/widgets/AegisWidgetManager.d.ts

@@ -0,0 +1,209 @@
+/**
+ * AegisWidgetManager - Web SDK Widget Module
+ *
+ * Smart Pull architecture for persistent web widgets.
+ *
+ * Features:
+ * - Games (spin wheel, scratch card) are in-app campaigns (AegisInAppManager), not widgets
+ * - Chat bubbles (WhatsApp, support)
+ * - Social proof toasts (real-time purchase notifications)
+ * - Feedback forms (NPS, surveys)
+ *
+ * Security:
+ * - XSS Protection: Uses DOM APIs instead of innerHTML
+ * - Server-side prize generation prevents client manipulation
+ * - URL validation prevents javascript: protocol injection
+ *
+ * Architecture:
+ * - Fetches widget configs from /v1/widgets/config on page load
+ * - Integrates with TriggerEngine for behavioral triggers
+ * - Tracks widget events (show, click, dismiss, submit)
+ * - Server-side prize generation for gamification
+ */
+import { TriggerEngine } from '../triggers/TriggerEngine';
+export interface WidgetConfig {
+    widget_id: string;
+    widget_type: 'chat_bubble' | 'toast' | 'feedback_form' | 'exit_intent_popup';
+    name: string;
+    config: Record<string, any>;
+    position?: string;
+    priority: number;
+    trigger_rules?: {
+        type: 'exit_intent' | 'scroll_depth' | 'time_on_page' | 'immediate';
+        config?: Record<string, any>;
+    };
+}
+export interface AegisWidgetConfig {
+    writeKey: string;
+    apiHost?: string;
+    userId?: string;
+    contactId?: string;
+    /** Server-minted proof of `contactId` (C1b). Sent alongside `X-Contact-ID`
+     *  so the cell-plane will honour the id. */
+    contactToken?: string;
+    organizationId?: string;
+    debugMode?: boolean;
+    triggerEngine?: TriggerEngine;
+    /** If true, WidgetManager takes ownership of the TriggerEngine and
+     *  will call `triggerEngine.stop()` on destroy(). Leave false when
+     *  the caller shares the engine across managers (e.g. the facade). */
+    ownsTriggerEngine?: boolean;
+    enablePrefetch?: boolean;
+    cssCustomization?: WidgetCSSCustomization;
+    onEvent?: (eventType: string, data: any) => void;
+    /** Source platform passed as X-Source-Platform header so the API
+     *  can filter campaigns whose display_rules.sources restricts them
+     *  to specific integrations (e.g. 'shopify', 'woocommerce'). */
+    sourcePlatform?: 'web' | 'shopify' | 'woocommerce' | 'mobile_sdk';
+    /**
+     * Workspace cascade reader. Host SDK sets this to
+     * `() => aegis.getEffectiveWorkspaceId()` so widget interaction events
+     * (impressions, clicks, feedback submissions)
+     * arrive at the gateway with the same workspace context the main
+     * analytics SDK uses. See PLUGIN_HANDSHAKE_AUTOMATION_TRACKER.md §P1.b.
+     */
+    getWorkspaceId?: () => string | undefined;
+    /**
+     * Cart-store unification: invoked whenever the widget subsystem learns the
+     * cart — platform auto-detect (Shopify/Woo/Magento) or an explicit
+     * `setCartData(...)`. The runtime wires this to `applyCart(...)` so the ONE
+     * cart store (read by the Free-Delivery card / progress bar / rule eval) stays
+     * in sync. See CART_STORE_UNIFICATION_TRACKER.md.
+     */
+    onCartDetected?: (cart: CartData) => void;
+}
+export interface WidgetCSSCustomization {
+    exitIntent?: {
+        backgroundColor?: string;
+        textColor?: string;
+        accentColor?: string;
+        borderRadius?: string;
+        fontFamily?: string;
+        overlayOpacity?: number;
+    };
+    chatBubble?: {
+        backgroundColor?: string;
+        textColor?: string;
+        position?: 'bottom_right' | 'bottom_left' | 'top_right' | 'top_left';
+        size?: 'small' | 'medium' | 'large';
+    };
+}
+export interface PrefetchWidgetConfig {
+    exit_intent?: {
+        enabled: boolean;
+        type: 'cart_recovery' | 'lead_gen';
+        tier?: string;
+        title?: string;
+        message?: string;
+        discount_code?: string;
+        discount_percentage?: number;
+        cta_text?: string;
+        cta_url?: string;
+        background_color?: string;
+        text_color?: string;
+        accent_color?: string;
+        show_cart_items?: boolean;
+        show_timer?: boolean;
+        timer_minutes?: number;
+        priority: number;
+        mobile_triggers?: {
+            scroll_velocity?: boolean;
+            scroll_threshold?: number;
+            scroll_min_position?: number;
+            scroll_cooldown?: number;
+            idle_timer?: boolean;
+            idle_seconds?: number;
+            visibility_change?: boolean;
+            back_button?: boolean;
+        };
+    };
+}
+export interface CartData {
+    cart_id: string;
+    cart_total: number;
+    cart_currency: string;
+    cart_items: Array<{
+        product_id: string;
+        product_name?: string;
+        quantity: number;
+        price?: number;
+    }>;
+}
+export declare class AegisWidgetManager {
+    private writeKey;
+    private apiHost;
+    private userId?;
+    private contactId?;
+    private contactToken?;
+    private organizationId?;
+    private debugMode;
+    private triggerEngine?;
+    private enablePrefetch;
+    private cssCustomization;
+    private onEvent?;
+    private sourcePlatform?;
+    private getWorkspaceId?;
+    private onCartDetected?;
+    private widgets;
+    private renderedWidgets;
+    private isInitialized;
+    private isDestroyed;
+    private ownsTriggerEngine;
+    private prefetchWidgetConfigs;
+    private cartData?;
+    constructor(config: AegisWidgetConfig);
+    updateCSSCustomization(customization: WidgetCSSCustomization): void;
+    /**
+     * Swap the identity that outgoing widget requests are attributed to.
+     * Safe to call at any time; if prefetch is enabled and the manager
+     * has already initialised, this will re-fetch the per-contact widget
+     * configs so subsequent renders target the new identity. Does NOT
+     * re-render already-visible widgets — a full teardown requires destroy().
+     */
+    updateContactId(contactId: string | undefined, contactToken?: string): Promise<void>;
+    /**
+     * Tear down everything the manager installed: trigger listeners (if
+     * we own the TriggerEngine), injected style sheets, and any rendered
+     * widget roots. Further render attempts from in-flight triggers are
+     * short-circuited by the `isDestroyed` flag.
+     */
+    destroy(): void;
+    /**
+     * Fire a lifecycle event to the consumer-supplied callback. Public-API
+     * hook configured via `AegisWidgetConfig.onEvent`. Currently only used
+     * by external callers passing their own logger; internal widget lifecycle
+     * events get wired through here as they're added.
+     */
+    private emitEvent;
+    initialize(): Promise<void>;
+    setCartData(cartData: CartData): void;
+    private detectPlatformCart;
+    private normalizeShopifyCart;
+    private normalizeWooCart;
+    private normalizeMagentoCart;
+    private preloadWidgetAssets;
+    private fetchPrefetchConfigs;
+    private fetchWidgets;
+    private renderImmediateWidgets;
+    private setupTriggerListeners;
+    private setupExitIntentWithPrefetch;
+    private sendCartAbandonmentBeacon;
+    private renderWidget;
+    private renderChatBubble;
+    private getUTMParams;
+    private renderToast;
+    private renderFeedbackForm;
+    private renderExitIntentPopup;
+    private submitFeedback;
+    private trackEvent;
+    private sanitizeUrl;
+    private sanitizeColor;
+    private getDeviceType;
+    private isMobileDevice;
+    private addAnimationStyles;
+    private renderCartRecoveryPopup;
+    private renderLeadGenPopup;
+    private interpolateCartVariables;
+    private log;
+}
+//# sourceMappingURL=AegisWidgetManager.d.ts.map

package/dist/widgets/AegisWidgetManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AegisWidgetManager.d.ts","sourceRoot":"","sources":["../../src/widgets/AegisWidgetManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAmB1D,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,aAAa,GAAG,OAAO,GAAG,eAAe,GAAG,mBAAmB,CAAC;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE;QACd,IAAI,EAAE,aAAa,GAAG,cAAc,GAAG,cAAc,GAAG,WAAW,CAAC;QACpE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KAC9B,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;gDAC4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;0EAEsE;IACtE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,IAAI,CAAC;IACjD;;oEAEgE;IAChE,cAAc,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,aAAa,GAAG,YAAY,CAAC;IAClE;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC1C;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,CAAC,EAAE;QACX,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,UAAU,CAAC,EAAE;QACX,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,cAAc,GAAG,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;QACrE,IAAI,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;KACrC,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,EAAE;QACZ,OAAO,EAAE,OAAO,CAAC;QACjB,IAAI,EAAE,eAAe,GAAG,UAAU,CAAC;QACnC,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,CAAC,EAAE;YAChB,eAAe,CAAC,EAAE,OAAO,CAAC;YAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;YAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;YAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;YACzB,UAAU,CAAC,EAAE,OAAO,CAAC;YACrB,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;YAC5B,WAAW,CAAC,EAAE,OAAO,CAAC;SACvB,CAAC;KACH,CAAC;CACH;AAED,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,KAAK,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;CACJ;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,YAAY,CAAC,CAAS;IAC9B,OAAO,CAAC,cAAc,CAAC,CAAS;IAChC,OAAO,CAAC,SAAS,CAAU;IAC3B,OAAO,CAAC,aAAa,CAAC,CAAgB;IACtC,OAAO,CAAC,cAAc,CAAU;IAChC,OAAO,CAAC,gBAAgB,CAAyB;IACjD,OAAO,CAAC,OAAO,CAAC,CAAyC;IACzD,OAAO,CAAC,cAAc,CAAC,CAAS;IAChC,OAAO,CAAC,cAAc,CAAC,CAA2B;IAClD,OAAO,CAAC,cAAc,CAAC,CAA2B;IAElD,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,eAAe,CAAqB;IAC5C,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,iBAAiB,CAAU;IAEnC,OAAO,CAAC,qBAAqB,CAA4B;IACzD,OAAO,CAAC,QAAQ,CAAC,CAAW;gBAEhB,MAAM,EAAE,iBAAiB;IAsBrC,sBAAsB,CAAC,aAAa,EAAE,sBAAsB,GAAG,IAAI;IAKnE;;;;;;OAMG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAa1F;;;;;OAKG;IACH,OAAO,IAAI,IAAI;IAuBf;;;;;OAKG;IACH,OAAO,CAAC,SAAS;IAUX,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAuBjC,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI;IAOrC,OAAO,CAAC,kBAAkB;IAqB1B,OAAO,CAAC,oBAAoB;IA4C5B,OAAO,CAAC,gBAAgB;IA4BxB,OAAO,CAAC,oBAAoB;IA6B5B,OAAO,CAAC,mBAAmB;YAgBb,oBAAoB;YA6BpB,YAAY;IA+B1B,OAAO,CAAC,sBAAsB;IAQ9B,OAAO,CAAC,qBAAqB;IA4C7B,OAAO,CAAC,2BAA2B;IAoFnC,OAAO,CAAC,yBAAyB;IA8CjC,OAAO,CAAC,YAAY;IA4BpB,OAAO,CAAC,gBAAgB;IA8DxB,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,WAAW;IA0DnB,OAAO,CAAC,kBAAkB;IA4I1B,OAAO,CAAC,qBAAqB;YAuHf,cAAc;YAmCd,UAAU;IAiCxB,OAAO,CAAC,WAAW;IAgBnB,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,aAAa;IAWrB,OAAO,CAAC,cAAc;IAKtB,OAAO,CAAC,kBAAkB;IA8C1B,OAAO,CAAC,uBAAuB;IAgJ/B,OAAO,CAAC,kBAAkB;IA6I1B,OAAO,CAAC,wBAAwB;IAShC,OAAO,CAAC,GAAG;CAMZ"}

package/dist/widgets/index.d.ts

@@ -0,0 +1,3 @@
+export { AegisWidgetManager } from './AegisWidgetManager';
+export type { WidgetConfig, AegisWidgetConfig } from './AegisWidgetManager';
+//# sourceMappingURL=index.d.ts.map

package/dist/widgets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/widgets/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,YAAY,EACV,YAAY,EACZ,iBAAiB,EAClB,MAAM,sBAAsB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@active-reach/web-sdk",
-  "version": "1.43.1",
+  "version": "1.43.3",
   "description": "Web SDK for Active Reach Intelligence — event tracking, identity resolution, in-app messaging, web push, and placements",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -44,6 +44,7 @@
   ],
   "license": "MIT",
   "scripts": {
+    "prepublishOnly": "npm run build && test -f dist/aegis.min.js && test -f dist/index.js",
     "build": "vite build && node scripts/build-cdn.js && npm run build:snippet && npm run build:types && npm run sync:web",
     "sync:web": "if [ -d ../../apps/web/public ]; then mkdir -p ../../apps/web/public/sdk && cp dist/aegis.min.js dist/aegis.min.js.map dist/aegis-push.min.js dist/aegis-push.min.js.map ../../apps/web/public/sdk/; else echo 'sync:web: apps/web not in build context (e.g. turbo-pruned cashier-portal build) — skipped; committed bundle is source of truth'; fi",
     "build:snippet": "node scripts/minify-snippet.js",