@adobe/alloy 2.35.1-beta.1 → 2.35.2-beta.0

package/dist/alloy.js

@@ -2000,6 +2000,43 @@
   var reactorQueryStringExports = requireReactorQueryString();
   var queryString = /*@__PURE__*/getDefaultExportFromCjs(reactorQueryStringExports);
 
+  /*
+  Copyright 2026 Adobe. All rights reserved.
+  This file is licensed to you under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License. You may obtain a copy
+  of the License at http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software distributed under
+  the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+  OF ANY KIND, either express or implied. See the License for the specific language
+  governing permissions and limitations under the License.
+  */
+
+  /**
+   * Returns `value` unchanged unless it has an `edgeCredentials.clientSecret`,
+   * in which case it returns a shallow copy with that one value replaced by
+   * `"[REDACTED]"`. Deliberately not a deep clone, so anything else on
+   * `value` (including functions like `onBeforeEventSend`) survives as the
+   * exact same reference.
+   * @param {*} value
+   * @returns {any}
+   */
+  var redactEdgeCredentials = (value) => {
+    if (
+      !value?.edgeCredentials ||
+      !Object.prototype.hasOwnProperty.call(value.edgeCredentials, "clientSecret")
+    ) {
+      return value;
+    }
+    return {
+      ...value,
+      edgeCredentials: {
+        ...value.edgeCredentials,
+        clientSecret: "[REDACTED]",
+      },
+    };
+  };
+
   /*
   Copyright 2025 Adobe. All rights reserved.
   This file is licensed to you under the Apache License, Version 2.0 (the "License");
@@ -3713,7 +3750,7 @@
     /**
      * Send a network request and returns details about the response.
      */
-    return ({ requestId, url, payload, useSendBeacon }) => {
+    return ({ requestId, url, payload, useSendBeacon, headers }) => {
       // We want to log raw payload and event data rather than
       // our fancy wrapper objects. Calling payload.toJSON() is
       // insufficient to get all the nested raw data, because it's
@@ -3731,52 +3768,56 @@
       });
 
       const executeRequest = (retriesAttempted = 0) => {
-        const requestMethod = useSendBeacon
-          ? sendBeaconRequest
-          : sendFetchRequest;
-
-        return requestMethod(url, stringifiedPayload).then((response) => {
-          const requestIsRetryable = isRequestRetryable({
-            response,
-            retriesAttempted,
-          });
-
-          if (requestIsRetryable) {
-            const requestRetryDelay = getRequestRetryDelay({
+        // navigator.sendBeacon() has no way to attach custom headers, so a
+        // request that needs any (e.g. authenticated Server API requests)
+        // must always go through fetch, regardless of useSendBeacon.
+        const requestMethod =
+          useSendBeacon && !headers ? sendBeaconRequest : sendFetchRequest;
+
+        return requestMethod(url, stringifiedPayload, headers).then(
+          (response) => {
+            const requestIsRetryable = isRequestRetryable({
               response,
               retriesAttempted,
             });
-            return new Promise((resolve) => {
-              setTimeout(() => {
-                resolve(executeRequest(retriesAttempted + 1));
-              }, requestRetryDelay);
-            });
-          }
 
-          let parsedBody;
+            if (requestIsRetryable) {
+              const requestRetryDelay = getRequestRetryDelay({
+                response,
+                retriesAttempted,
+              });
+              return new Promise((resolve) => {
+                setTimeout(() => {
+                  resolve(executeRequest(retriesAttempted + 1));
+                }, requestRetryDelay);
+              });
+            }
 
-          try {
-            parsedBody = JSON.parse(response.body);
-          } catch {
-            // Non-JSON. Something went wrong.
-          }
+            let parsedBody;
 
-          logger.logOnNetworkResponse({
-            requestId,
-            url,
-            payload: parsedPayload,
-            ...response,
-            parsedBody,
-            retriesAttempted,
-          });
+            try {
+              parsedBody = JSON.parse(response.body);
+            } catch {
+              // Non-JSON. Something went wrong.
+            }
 
-          return {
-            statusCode: response.statusCode,
-            body: response.body,
-            parsedBody,
-            getHeader: response.getHeader,
-          };
-        });
+            logger.logOnNetworkResponse({
+              requestId,
+              url,
+              payload: parsedPayload,
+              ...response,
+              parsedBody,
+              retriesAttempted,
+            });
+
+            return {
+              statusCode: response.statusCode,
+              body: response.body,
+              parsedBody,
+              getHeader: response.getHeader,
+            };
+          },
+        );
       };
 
       return executeRequest().catch((error) => {
@@ -5021,6 +5062,10 @@
 
   const EDGE = "edge.adobedc.net";
   const ID_THIRD_PARTY = "adobedc.demdex.net";
+  // The authenticated Edge Network Server API — a different domain
+  // entirely from EDGE, used only when edgeCredentials are configured.
+  const SERVER = "server.adobedc.net";
+  const DEFAULT_IMS_HOST = "ims-na1.adobelogin.com";
 
   /*
   Copyright 2023 Adobe. All rights reserved.
@@ -5057,6 +5102,14 @@
       orgId: boundString().unique().required(),
       onBeforeEventSend: boundCallback().default(noop),
       edgeConfigOverrides: validateConfigOverride,
+      // Opt-in OAuth Server-to-Server credentials — when present, requests
+      // use the authenticated Server API (v2) instead of v1.
+      edgeCredentials: boundObjectOf({
+        clientId: boundString().nonEmpty().required(),
+        clientSecret: boundString().nonEmpty().required(),
+        scopes: boundArrayOf(boundString().nonEmpty()).nonEmpty().required(),
+        imsHost: boundString().domain().default(DEFAULT_IMS_HOST),
+      }),
     }).renamed("edgeConfigId", boundString().unique(), "datastreamId");
 
   /*
@@ -5103,16 +5156,25 @@
   governing permissions and limitations under the License.
   */
 
+
   var createLogger = ({ getDebugEnabled, console, getMonitors, context }) => {
     let prefix = `[${context.instanceName}]`;
     if (context.componentName) {
       prefix += ` [${context.componentName}]`;
     }
 
+    // redactEdgeCredentials no-ops on anything without edgeCredentials, so
+    // applying it here covers every call site (config, command options, ...)
+    // without redacting each one individually.
     const notifyMonitors = (method, data) => {
       const monitors = getMonitors();
       if (monitors.length > 0) {
-        const dataWithContext = { ...context, ...data };
+        const dataWithContext = {
+          ...context,
+          ...data,
+          config: redactEdgeCredentials(data.config),
+          options: redactEdgeCredentials(data.options),
+        };
         monitors.forEach((monitor) => {
           if (monitor[method]) {
             monitor[method](dataWithContext);
@@ -5122,9 +5184,10 @@
     };
 
     const log = (level, ...rest) => {
-      notifyMonitors("onBeforeLog", { level, arguments: rest });
+      const redactedRest = rest.map(redactEdgeCredentials);
+      notifyMonitors("onBeforeLog", { level, arguments: redactedRest });
       if (getDebugEnabled()) {
-        console[level](prefix, ...rest);
+        console[level](prefix, ...redactedRest);
       }
     };
 
@@ -6129,6 +6192,25 @@
     return request.getUseIdThirdPartyDomain() && isNetworkError(error);
   };
 
+  // Confirmed against the real API: the Server API (v2) only exists for the
+  // interact action — privacy/set-consent and identity/acquire both 404
+  // under v2.
+  const isServerApiEligible = (request) => request.getAction() === "interact";
+
+  // v2 expects a singular `event` object rather than v1's `events` array,
+  // and requires an explicit primary identity in it (no browser cookie to
+  // resolve identity from) — confirmed by testing against the real
+  // endpoint; not documented anywhere we could find.
+  const toServerApiPayloadJSON = (payload) => {
+    const { events, ...rest } = payload.toJSON();
+    if (!events || events.length !== 1) {
+      throw new Error(
+        `The authenticated Server API (v2) only supports exactly one event per request; got ${events ? events.length : 0}.`,
+      );
+    }
+    return { ...rest, event: events[0] };
+  };
+
   /**
    * @function
    *
@@ -6141,7 +6223,7 @@
    * @param {function(object): void} options.processWarningsAndErrors
    * @param {function(): string|undefined} options.getLocationHint
    * @param {function(): string} options.getAssuranceValidationTokenParams
-
+   * @param {{ getAccessToken: () => Promise<string> }} [options.getImsAccessToken]
    *
    * @returns {EdgeRequestExecutor} A function that sends edge network requests with lifecycle management
    */
@@ -6154,18 +6236,26 @@
     processWarningsAndErrors,
     getLocationHint,
     getAssuranceValidationTokenParams,
+    getImsAccessToken,
   }) => {
-    const { edgeDomain, edgeBasePath, datastreamId } = config;
+    const { edgeDomain, edgeBasePath, datastreamId, orgId, edgeCredentials } =
+      config;
     let hasDemdexFailed = false;
 
-    const buildEndpointUrl = (endpointDomain, request) => {
-      const locationHint = getLocationHint();
+    // v2 differs from v1 in domain, version segment, and datastream query
+    // param name — not just an extra header.
+    const buildEndpointUrl = (endpointDomain, request, useServerApi) => {
+      // The cluster location hint is a browser/v1 CDN-routing artifact —
+      // confirmed against the real API that the Server API domain 404s if
+      // it's included, even though a v1 response can still write the cookie.
+      const locationHint = useServerApi ? undefined : getLocationHint();
       const edgeBasePathWithLocationHint = locationHint
         ? `${edgeBasePath}/${locationHint}${request.getEdgeSubPath()}`
         : `${edgeBasePath}${request.getEdgeSubPath()}`;
-      const configId = request.getDatastreamIdOverride() || datastreamId;
+      const resolvedDatastreamId =
+        request.getDatastreamIdOverride() || datastreamId;
 
-      if (configId !== datastreamId) {
+      if (resolvedDatastreamId !== datastreamId) {
         request.getPayload().mergeMeta({
           sdkConfig: {
             datastream: {
@@ -6175,7 +6265,19 @@
         });
       }
 
-      return `https://${endpointDomain}/${edgeBasePathWithLocationHint}/${apiVersion}/${request.getAction()}?configId=${configId}&requestId=${request.getId()}${getAssuranceValidationTokenParams()}`;
+      const version = useServerApi ? "v2" : apiVersion;
+      const datastreamParamName = useServerApi ? "dataStreamId" : "configId";
+
+      return `https://${endpointDomain}/${edgeBasePathWithLocationHint}/${version}/${request.getAction()}?${datastreamParamName}=${resolvedDatastreamId}&requestId=${request.getId()}${getAssuranceValidationTokenParams()}`;
+    };
+
+    const buildAuthHeaders = async () => {
+      const accessToken = await getImsAccessToken.getAccessToken();
+      return {
+        Authorization: `Bearer ${accessToken}`,
+        "x-api-key": edgeCredentials.clientId,
+        "x-gw-ims-org-id": orgId,
+      };
     };
 
     /**
@@ -6195,19 +6297,25 @@
       onRequestFailureCallbackAggregator.add(lifecycle.onRequestFailure);
       onRequestFailureCallbackAggregator.add(runOnRequestFailureCallbacks);
 
+      const useServerApi = !!edgeCredentials && isServerApiEligible(request);
+
       return lifecycle
         .onBeforeRequest({
           request,
           onResponse: onResponseCallbackAggregator.add,
           onRequestFailure: onRequestFailureCallbackAggregator.add,
         })
-        .then(() => {
-          const endpointDomain =
-            hasDemdexFailed || !request.getUseIdThirdPartyDomain()
+        .then(async () => {
+          // The demdex third-party-domain dance is a browser ITP/ad-blocker
+          // workaround, not applicable to authenticated server-to-server
+          // calls — those always go to the Server API domain instead.
+          const endpointDomain = useServerApi
+            ? SERVER
+            : hasDemdexFailed || !request.getUseIdThirdPartyDomain()
               ? edgeDomain
               : ID_THIRD_PARTY;
 
-          const url = buildEndpointUrl(endpointDomain, request);
+          const url = buildEndpointUrl(endpointDomain, request, useServerApi);
           const payload = request.getPayload();
 
           const queueTimeMillis = calculateQueueTimeMillis(payload);
@@ -6217,19 +6325,25 @@
 
           cookieTransfer.cookiesToPayload(payload, endpointDomain);
 
+          const headers = useServerApi ? await buildAuthHeaders() : undefined;
+          const outgoingPayload = useServerApi
+            ? toServerApiPayloadJSON(payload)
+            : payload;
+
           return sendNetworkRequest({
             requestId: request.getId(),
             url,
-            payload,
+            payload: outgoingPayload,
             useSendBeacon: request.getUseSendBeacon(),
+            headers,
           });
         })
         .then((networkResponse) => {
           processWarningsAndErrors(networkResponse);
           return networkResponse;
         })
-        .catch((error) => {
-          if (isDemdexBlockedError(error, request)) {
+        .catch(async (error) => {
+          if (!useServerApi && isDemdexBlockedError(error, request)) {
             hasDemdexFailed = true;
             request.setUseIdThirdPartyDomain(false);
             const url = buildEndpointUrl(edgeDomain, request);
@@ -6264,6 +6378,92 @@
     };
   };
 
+  /*
+  Copyright 2026 Adobe. All rights reserved.
+  This file is licensed to you under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License. You may obtain a copy
+  of the License at http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software distributed under
+  the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+  OF ANY KIND, either express or implied. See the License for the specific language
+  governing permissions and limitations under the License.
+  */
+
+  // Refresh this long before the real ~24h expiry (Adobe's own guidance is to
+  // rotate at 23h), so a slow request never straddles the token's actual
+  // expiration.
+  const EXPIRY_SAFETY_MARGIN_MILLIS = 5 * 60 * 1000;
+
+  /**
+   * Exchanges OAuth Server-to-Server credentials for an IMS access token,
+   * caching it for reuse until shortly before it expires. Concurrent calls
+   * while a fetch is already in flight share that same in-flight request
+   * instead of each starting their own.
+   *
+   * Deliberately not tied to a single request/instance's lifetime — callers
+   * that rebuild their core instance per request (e.g. Node's forRequest())
+   * should create one of these once and reuse it across those rebuilds, or
+   * every request would re-authenticate with IMS from scratch.
+   *
+   * @param {Object} params
+   * @param {{ clientId: string, clientSecret: string, scopes: string[], imsHost: string }} params.edgeCredentials
+   * @param {() => Date} [params.dateProvider]
+   * @returns {{ getAccessToken: () => Promise<string> }}
+   */
+  var injectGetImsAccessToken = ({ edgeCredentials, dateProvider = () => new Date() }) => {
+    /** @type {string | undefined} */
+    let cachedToken;
+    let expiresAt = 0;
+    /** @type {Promise<string> | undefined} */
+    let pendingFetch;
+
+    const fetchNewToken = async () => {
+      const { clientId, clientSecret, scopes, imsHost } = edgeCredentials;
+      const body = new URLSearchParams({
+        grant_type: "client_credentials",
+        client_id: clientId,
+        client_secret: clientSecret,
+        scope: scopes.join(","),
+      });
+
+      const response = await fetch(`https://${imsHost}/ims/token/v3`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: body.toString(),
+      });
+
+      if (!response.ok) {
+        throw new Error(
+          `Failed to acquire an IMS access token: the server responded with a status code ${response.status} and response body: ${await response.text()}`,
+        );
+      }
+
+      const { access_token: accessToken, expires_in: expiresInSeconds } =
+        await response.json();
+      cachedToken = accessToken;
+      expiresAt =
+        dateProvider().getTime() +
+        expiresInSeconds * 1000 -
+        EXPIRY_SAFETY_MARGIN_MILLIS;
+      return cachedToken;
+    };
+
+    return {
+      getAccessToken() {
+        if (cachedToken && dateProvider().getTime() < expiresAt) {
+          return Promise.resolve(cachedToken);
+        }
+        if (!pendingFetch) {
+          pendingFetch = fetchNewToken().finally(() => {
+            pendingFetch = undefined;
+          });
+        }
+        return pendingFetch;
+      },
+    };
+  };
+
   /*
   Copyright 2020 Adobe. All rights reserved.
   This file is licensed to you under the Apache License, Version 2.0 (the "License");
@@ -7756,10 +7956,10 @@
   governing permissions and limitations under the License.
   */
 
-  // The 2.35.1-beta.1 keyword will be replace at alloy build time with the package.json version.
+  // The 2.35.2-beta.0 keyword will be replace at alloy build time with the package.json version.
   // see babel-plugin-version
 
-  var libraryVersion = "2.35.1-beta.1";
+  var libraryVersion = "2.35.2-beta.0";
 
   /*
   Copyright 2019 Adobe. All rights reserved.
@@ -7774,13 +7974,13 @@
   */
 
 
-  const prepareLibraryInfo = ({ config, componentRegistry }) => {
+  const prepareLibraryInfo = ({ config, componentRegistry, libraryVersion }) => {
     const allCommands = [
       ...componentRegistry.getCommandNames(),
       CONFIGURE,
       SET_DEBUG,
     ].sort();
-    const resultConfig = { ...config };
+    const resultConfig = { ...redactEdgeCredentials(config) };
     Object.keys(config).forEach((key) => {
       const value = config[key];
       if (typeof value !== "function") {
@@ -7797,13 +7997,21 @@
     };
   };
 
-  const createLibraryInfo = ({ config, componentRegistry }) => {
+  const createLibraryInfo = ({ config, componentRegistry, platformServices }) => {
+    // defaultLibraryVersion is a build-time placeholder the browser bundler
+    // replaces; other runtimes (e.g. Node) override it via platformServices.
+    const libraryVersion$1 =
+      platformServices?.libraryVersionOverride ?? libraryVersion;
     return {
       commands: {
         getLibraryInfo: {
           run: () => {
             return {
-              libraryInfo: prepareLibraryInfo({ config, componentRegistry }),
+              libraryInfo: prepareLibraryInfo({
+                config,
+                componentRegistry,
+                libraryVersion: libraryVersion$1,
+              }),
             };
           },
         },
@@ -7858,6 +8066,9 @@
    * @param {Array<Function>} params.components
    * @param {() => import('../services/index.js').PlatformServices} params.createPlatformServices
    * @param {ReturnType<typeof createCoreConfigs>} [params.coreConfigValidators]
+   * @param {{ getAccessToken: () => Promise<string> }} [params.getImsAccessToken]
+   * Shared token cache for repeated configure() calls — see
+   * injectGetImsAccessToken.js. Defaults to a fresh one per call.
    */
   const createExecuteCommand = ({
     instanceName,
@@ -7865,6 +8076,7 @@
     components,
     createPlatformServices,
     coreConfigValidators = defaultCoreConfigValidators,
+    getImsAccessToken: sharedGetImsAccessToken,
   }) => {
     const platformServices = createPlatformServices();
     const allMonitors = [...platformServices.globals.getMonitors(), ...monitors];
@@ -7959,6 +8171,10 @@
         orgId,
         cookieJar: platformServices.cookie,
       });
+      const getImsAccessToken = config.edgeCredentials
+        ? sharedGetImsAccessToken ||
+          injectGetImsAccessToken({ edgeCredentials: config.edgeCredentials })
+        : undefined;
       const sendEdgeNetworkRequest = injectSendEdgeNetworkRequest({
         config,
         lifecycle,
@@ -7968,6 +8184,7 @@
         processWarningsAndErrors,
         getLocationHint,
         getAssuranceValidationTokenParams,
+        getImsAccessToken,
       });
 
       const applyResponse = injectApplyResponse({
@@ -13290,6 +13507,9 @@
    * load," since a page load resets module state); pass a fresh instance per
    * call if that assumption doesn't hold for your runtime (e.g. one Node
    * process handling many requests).
+   * @param {ReturnType<typeof import('./core/edgeNetwork/injectGetImsAccessToken.js').default>} [getImsAccessToken]
+   * Only relevant when `edgeCredentials` is configured — see
+   * `createGetImsAccessToken` above.
    * @returns {(commandName: string, options?: Object) => Promise<any>} A callable Alloy instance.
    *
    * @see {@link https://experienceleague.adobe.com/en/docs/experience-platform/web-sdk/install/create-custom-build} for more details.
@@ -13298,6 +13518,7 @@
     options = {},
     createPlatformServices = undefined,
     coreConfigValidators = undefined,
+    getImsAccessToken = undefined,
   ) => {
     const eventOptionsValidator = boundObjectOf({
       name: boundString().default("alloy"),
@@ -13313,6 +13534,7 @@
       components,
       createPlatformServices,
       coreConfigValidators,
+      getImsAccessToken,
     });
   };
 
@@ -21888,13 +22110,14 @@
   */
 
   var injectSendFetchRequest = ({ fetch }) => {
-    return (url, body) => {
+    return (url, body, headers) => {
       return fetch(url, {
         method: "POST",
         cache: "no-cache",
         credentials: "include", // To set the cookie header in the request.
         headers: {
           "Content-Type": "text/plain; charset=UTF-8",
+          ...headers,
         },
         referrerPolicy: "no-referrer-when-downgrade",
         body,