@adobe/alloy 2.35.0 → 2.35.1-beta.1

package/dist/alloy.js

@@ -5828,6 +5828,8 @@
   OF ANY KIND, either express or implied. See the License for the specific language
   governing permissions and limitations under the License.
   */
+
+
   const STATE_STORE_HANDLE_TYPE = "state:store";
 
   var createCookieTransfer = ({
@@ -5842,7 +5844,7 @@
        * access first-party cookies, therefore we transfer cookies into
        * the request body so they can be read by the server.
        */
-      cookiesToPayload(payload, endpointDomain) {
+      cookiesToPayload(payload, endpointDomain, extraCookieNames = []) {
         // localhost is a special case where the apexDomain is ""
         // We want to treat localhost as a third-party domain.
         const isEndpointFirstParty =
@@ -5855,20 +5857,22 @@
         // If the endpoint is first-party, there's no need to transfer cookies
         // to the payload since they'll be automatically passed through cookie
         // headers.
-        if (!isEndpointFirstParty) {
+        if (!isEndpointFirstParty || isNonEmptyArray(extraCookieNames)) {
           const cookies = cookieJar.getAll();
-
-          const entries = Object.keys(cookies)
-            .filter(shouldTransferCookie)
-            .map((qualifyingCookieName) => {
-              return {
-                key: qualifyingCookieName,
-                value: cookies[qualifyingCookieName],
-              };
-            });
-
-          if (entries.length) {
-            state.entries = entries;
+          const entriesByKey = new Map();
+          const addEntry = (key) => {
+            if (cookies[key] !== undefined && !entriesByKey.has(key)) {
+              entriesByKey.set(key, { key, value: cookies[key] });
+            }
+          };
+          if (!isEndpointFirstParty) {
+            Object.keys(cookies).filter(shouldTransferCookie).forEach(addEntry);
+          }
+          if (isNonEmptyArray(extraCookieNames)) {
+            extraCookieNames.forEach(addEntry);
+          }
+          if (entriesByKey.size) {
+            state.entries = [...entriesByKey.values()];
           }
         }
 
@@ -5926,6 +5930,9 @@
   const MBOX_EDGE_CLUSTER = "mboxEdgeCluster";
   const AT_QA_MODE = "at_qa_mode";
   const MBOX = "mbox";
+  // The cookie that Marketo (Munchkin) JS sets. It must be forwarded so the
+  // server can resolve the visitor's Marketo identity for Marketo integrations.
+  const MUNCHKIN = "_mkto_trk";
 
   /*
   Copyright 2022 Adobe. All rights reserved.
@@ -5946,10 +5953,13 @@
       // all cookies whose names are namespaced according to the
       // logic in isNamespacedCookieName as well as any legacy
       // cookie names (so that the server can handle migrating
-      // identities on websites previously using Visitor.js)
+      // identities on websites previously using Visitor.js). The
+      // Marketo Munchkin cookie is always forwarded so the server
+      // can resolve the visitor's Marketo identity.
       return (
         isNamespacedCookieName(orgId, name) ||
         name === AT_QA_MODE ||
+        name === MUNCHKIN ||
         (targetMigrationEnabled && name === MBOX)
       );
     };
@@ -7746,10 +7756,10 @@
   governing permissions and limitations under the License.
   */
 
-  // The 2.35.0 keyword will be replace at alloy build time with the package.json version.
+  // The 2.35.1-beta.1 keyword will be replace at alloy build time with the package.json version.
   // see babel-plugin-version
 
-  var libraryVersion = "2.35.0";
+  var libraryVersion = "2.35.1-beta.1";
 
   /*
   Copyright 2019 Adobe. All rights reserved.
@@ -7835,7 +7845,11 @@
   */
 
 
-  const coreConfigValidators = createCoreConfigs();
+  // Default, shared for the lifetime of this module — matches "configured
+  // once per page load" in the browser, where module state resets on its own.
+  // Callers that don't map 1:1 to a page load (e.g. one Node process handling
+  // many requests) can pass a fresh instance per call instead.
+  const defaultCoreConfigValidators = createCoreConfigs();
 
   /**
    * @param {Object} params
@@ -7843,12 +7857,14 @@
    * @param {Array<import('./types.js').AlloyMonitor>} [params.monitors]
    * @param {Array<Function>} params.components
    * @param {() => import('../services/index.js').PlatformServices} params.createPlatformServices
+   * @param {ReturnType<typeof createCoreConfigs>} [params.coreConfigValidators]
    */
   const createExecuteCommand = ({
     instanceName,
     monitors = [],
     components,
     createPlatformServices,
+    coreConfigValidators = defaultCoreConfigValidators,
   }) => {
     const platformServices = createPlatformServices();
     const allMonitors = [...platformServices.globals.getMonitors(), ...monitors];
@@ -10210,8 +10226,8 @@
   const ID = "id";
   const IAM_EVENT_TYPE = "iam.eventType";
   const EVENT_TYPE = "eventType";
-  const TYPE = "type";
-  const VALID_EVENT_TYPES = [IAM_EVENT_TYPE, EVENT_TYPE, TYPE];
+  const TYPE$1 = "type";
+  const VALID_EVENT_TYPES = [IAM_EVENT_TYPE, EVENT_TYPE, TYPE$1];
   const VALID_EVENT_IDS = [IAM_ID, ID];
   const checkForHistoricalMatcher = (eventCount, matcherKey, value) => {
     switch (matcherKey) {
@@ -12892,6 +12908,7 @@
     sendConversationServiceRequest,
     buildEndpointUrl,
     cookieTransfer,
+    alwaysTransferCookies = [],
     createResponse,
     decodeKndctrCookie,
     lifecycle,
@@ -12972,9 +12989,11 @@
           }
 
           payload.addEvent(event);
-          if (config.conversation.stickyConversationSession === true) {
-            cookieTransfer.cookiesToPayload(payload, edgeDomain);
-          }
+          cookieTransfer.cookiesToPayload(
+            payload,
+            edgeDomain,
+            alwaysTransferCookies,
+          );
           return sendConversationServiceRequest({
             requestId: v4(),
             url,
@@ -13145,10 +13164,14 @@
         .default(STREAM_START_TIMEOUT_MS),
       collectSources: boundBoolean().default(false),
       region: boundString().matches(/^[a-z]{2,4}[0-9]{1,2}$/i),
+      // Additional first-party cookie names to always transfer into the
+      // request meta.state object (on top of the ones transferred by default).
+      transferCookies: boundArrayOf(boundString()).default([]),
     }).default({
       stickyConversationSession: false,
       streamTimeout: STREAM_START_TIMEOUT_MS,
       collectSources: false,
+      transferCookies: [],
     }),
   });
 
@@ -13176,6 +13199,8 @@
     cookieTransfer,
     createResponse,
     platformServices,
+    createSendConversationEvent:
+      createSendConversationEventFactory = createSendConversationEvent,
   }) => {
     const session = {
       id: getConciergeSessionCookie({ loggingCookieJar, config }),
@@ -13193,14 +13218,18 @@
       cookieJar: loggingCookieJar,
       logger,
     });
-    const sendConversationEvent = createSendConversationEvent({
+    const sendConversationEvent = createSendConversationEventFactory({
+      loggingCookieJar,
       logger,
       eventManager,
       consent,
+      instanceName,
+      sendEdgeNetworkRequest,
       config,
       buildEndpointUrl,
       lifecycle,
       cookieTransfer,
+      alwaysTransferCookies: config.conversation.transferCookies || [],
       createResponse,
       sendConversationServiceRequest,
       decodeKndctrCookie,
@@ -13254,6 +13283,13 @@
    * @param {Array<AlloyMonitor>} [options.monitors] - Monitors for the instance.
    * @param {Array<Function>} [options.components] - Components for the instance.
    * @param {CreatePlatformServices} createPlatformServices
+   * @param {ReturnType<typeof import('./core/config/createCoreConfigs.js').default>} [coreConfigValidators]
+   * Tracks which orgId/datastreamId values have already been configured, to
+   * catch accidentally configuring two instances with the same one. Shared by
+   * default for the module's lifetime (matches "configured once per page
+   * load," since a page load resets module state); pass a fresh instance per
+   * call if that assumption doesn't hold for your runtime (e.g. one Node
+   * process handling many requests).
    * @returns {(commandName: string, options?: Object) => Promise<any>} A callable Alloy instance.
    *
    * @see {@link https://experienceleague.adobe.com/en/docs/experience-platform/web-sdk/install/create-custom-build} for more details.
@@ -13261,6 +13297,7 @@
   const createCustomInstance$1 = (
     options = {},
     createPlatformServices = undefined,
+    coreConfigValidators = undefined,
   ) => {
     const eventOptionsValidator = boundObjectOf({
       name: boundString().default("alloy"),
@@ -13275,6 +13312,7 @@
       monitors,
       components,
       createPlatformServices,
+      coreConfigValidators,
     });
   };
 
@@ -17214,6 +17252,55 @@
   governing permissions and limitations under the License.
   */
 
+  const TYPE = "type";
+  const MODULE = "module";
+  const NONCE = "nonce";
+  const NOMODULE = "nomodule";
+
+  // Per the HTML spec, a <script> only ever executes if its type is absent/
+  // empty, "module", or one of these recognized JavaScript MIME type essences
+  // (https://mimesniff.spec.whatwg.org/#javascript-mime-type). Any other type
+  // (e.g. "importmap", "application/json", a templating library's custom type)
+  // makes the element a data block: the browser never executes it, regardless
+  // of whether it's parsed from HTML, inserted via innerHTML, or appended with
+  // appendChild. Such elements are left untouched by this module — extracting
+  // and re-inserting them would be pointless at best, and at worst (if `type`
+  // were dropped along the way) would turn inert data into code that runs.
+  const JAVASCRIPT_MIME_TYPES = new Set([
+    "application/ecmascript",
+    "application/javascript",
+    "application/x-ecmascript",
+    "application/x-javascript",
+    "text/ecmascript",
+    "text/javascript",
+    "text/javascript1.0",
+    "text/javascript1.1",
+    "text/javascript1.2",
+    "text/javascript1.3",
+    "text/javascript1.4",
+    "text/javascript1.5",
+    "text/jscript",
+    "text/livescript",
+    "text/x-ecmascript",
+    "text/x-javascript",
+  ]);
+
+  // Attributes that affect how the script executes/fetches (as opposed to
+  // identity/presentation attributes like id, class, and data-*, which are
+  // intentionally not copied — see loadScript below). `src` is handled
+  // separately since it needs different treatment for inline vs. remote
+  // scripts, and `nonce` is copied here as a fallback but then overridden
+  // below with the page's current CSP nonce when one is found.
+  const COPIED_ATTRIBUTES = [
+    TYPE,
+    NONCE,
+    "crossorigin",
+    "integrity",
+    "referrerpolicy",
+    "fetchpriority",
+    "nomodule",
+  ];
+
   const getPromise = (url, script) => {
     return new Promise((resolve, reject) => {
       script.onload = () => {
@@ -17224,24 +17311,45 @@
       };
     });
   };
+
+  // Re-creates a script in <head> so the browser executes it (scripts inserted via
+  // innerHTML never run). Handles both remote scripts (with a src) and inline
+  // module scripts: an inline `type="module"` executes asynchronously and belongs
+  // with the head-loaded scripts rather than the synchronously-run inline path.
   const loadScript = (source) => {
     const url = getAttribute(source, SRC);
     const script = document.createElement("script");
-    // Preserve all author-supplied attributes (class, type, data-*, etc.) so
-    // consumers relying on them keep working.
-    const { attributes } = source;
-    for (let i = 0; i < attributes.length; i += 1) {
-      const { name, value } = attributes[i];
-      script.setAttribute(name, value);
-    }
-    // Override invariants last so they can't be clobbered by the source element.
+    // Only carry the attributes required to execute the script correctly:
+    // `src` (below) and COPIED_ATTRIBUTES. Author attributes such as `id`,
+    // `class`, and `data-*` are intentionally NOT copied: the original offer
+    // <script> is left in the page (inert), so copying its id/class onto this
+    // executed element would create duplicate matches for
+    // document.getElementById / querySelector.
+    COPIED_ATTRIBUTES.forEach((name) => {
+      const value = getAttribute(source, name);
+      if (value !== null) {
+        script.setAttribute(name, value);
+      }
+    });
+    // The page's current CSP nonce takes priority over whatever nonce (if any)
+    // was written into the source markup, since that's the one the browser
+    // will actually check against the CSP header for this page load.
     const nonce = getNonce();
     if (nonce) {
-      script.setAttribute("nonce", nonce);
+      script.setAttribute(NONCE, nonce);
     }
+
+    if (!url) {
+      // Inline module script: carry the code across and let it execute in <head>.
+      // Inline scripts emit no load event, so completion cannot be tracked; we
+      // resolve immediately and rely on the browser's deferred module execution.
+      script.textContent = source.textContent;
+      document.head.appendChild(script);
+      return Promise.resolve(script);
+    }
+
+    script.src = url;
     script.async = true;
-    // Assign load handlers after copying attributes so a copied inline
-    // onload/onerror attribute can't break load-completion tracking.
     const promise = getPromise(url, script);
     document.head.appendChild(script);
     return promise;
@@ -17250,11 +17358,59 @@
   const is = (element, tagName) =>
     !!element && element.tagName === tagName;
 
-  const isInlineScript = (element) =>
-    is(element, SCRIPT) && !getAttribute(element, SRC);
+  // Normalizes away casing/whitespace/parameters (e.g. "TEXT/JAVASCRIPT ;
+  // charset=utf-8") so it can be compared against MODULE/JAVASCRIPT_MIME_TYPES.
+  const getNormalizedType = (element) => {
+    const type = getAttribute(element, TYPE);
+    return type ? type.split(";")[0].trim().toLowerCase() : "";
+  };
+
+  const isModule = (element) => getNormalizedType(element) === MODULE;
+
+  // An empty src (`<script src="">`) is treated as "no src" — it points nowhere,
+  // so the script is handled on the inline path rather than fetched.
+  const hasSrc = (element) => !!getAttribute(element, SRC);
 
-  const isRemoteScript = (element) =>
-    is(element, SCRIPT) && getAttribute(element, SRC);
+  // A <script> the browser would actually execute: a classic script (type is
+  // absent/empty or a recognized JavaScript MIME type) or an ES module. Any other
+  // type is a data block (e.g. "importmap", "application/json", a templating
+  // library's custom type) that never runs — see JAVASCRIPT_MIME_TYPES above.
+  // Only executable scripts are extracted and re-inserted; the rest are left
+  // untouched, since forcing them to run was never the intent.
+  const isExecutableScript = (element) => {
+    if (!is(element, SCRIPT)) {
+      return false;
+    }
+    const type = getNormalizedType(element);
+    return type === "" || type === MODULE || JAVASCRIPT_MIME_TYPES.has(type);
+  };
+
+  // How a given <script> must be re-created for the browser to run it:
+  //   HEAD_SCRIPT   – re-created in <head>: any remote script (with a src), plus
+  //                   inline ES modules. An inline `type="module"` executes
+  //                   asynchronously, so it belongs with the head scripts rather
+  //                   than the synchronous inline path.
+  //   INLINE_SCRIPT – classic inline script: re-created and run synchronously in
+  //                   the offer container.
+  const HEAD_SCRIPT = "head";
+  const INLINE_SCRIPT = "inline";
+
+  // Classifies a <script>, or returns null when there's nothing to run: either a
+  // data block the browser would never execute (left untouched), or an inline
+  // script with no code. `src`-less inline scripts need code to be worth running;
+  // a remote script's code lives at its `src`, so it always qualifies.
+  const classifyScript = (element) => {
+    if (!isExecutableScript(element)) {
+      return null;
+    }
+    if (hasSrc(element)) {
+      return HEAD_SCRIPT;
+    }
+    if (!element.textContent) {
+      return null;
+    }
+    return isModule(element) ? HEAD_SCRIPT : INLINE_SCRIPT;
+  };
 
   const getInlineScripts = (fragment) => {
     const scripts = selectNodes(SCRIPT, fragment);
@@ -17268,17 +17424,24 @@
     for (let i = 0; i < length; i += 1) {
       const element = scripts[i];
 
-      if (!isInlineScript(element)) {
+      if (classifyScript(element) !== INLINE_SCRIPT) {
         continue;
       }
 
       const { textContent } = element;
 
-      if (!textContent) {
-        continue;
-      }
-
-      result.push(createNode(SCRIPT, attributes, { textContent }));
+      // `nomodule` is preserved even though this element is force-executed via
+      // appendChild: without it, a classic script the author intended as a
+      // legacy fallback (skipped in module-supporting browsers) would run
+      // where it otherwise wouldn't have.
+      const nomodule = getAttribute(element, NOMODULE);
+      result.push(
+        createNode(
+          SCRIPT,
+          { ...attributes, ...(nomodule !== null && { nomodule }) },
+          { textContent },
+        ),
+      );
     }
 
     return result;
@@ -17292,8 +17455,7 @@
     for (let i = 0; i < length; i += 1) {
       const element = scripts[i];
 
-      // isRemoteScript already requires a non-empty src attribute.
-      if (!isRemoteScript(element)) {
+      if (classifyScript(element) !== HEAD_SCRIPT) {
         continue;
       }