@apex-inc/sdk 0.20.0 → 0.20.2

package/dist/esm/index.js

@@ -366,15 +366,36 @@ function getExperimentVisitorId() {
     document.cookie = `${key}=${encodeURIComponent(id)};expires=${d.toUTCString()};path=/;SameSite=Lax`;
     return id;
 }
-function getExperimentPreview() {
-    if (!isBrowser)
+function readExperimentPreview(search) {
+    if (!search)
         return null;
-    const params = new URLSearchParams(window.location.search);
+    const q = search.startsWith("?") ? search.slice(1) : search;
+    const params = new URLSearchParams(q);
     const variant = params.get("_apex_preview");
-    const expId = params.get("_apex_exp");
-    if (variant)
-        return { variant, expId };
-    return null;
+    if (!isKnownVariant(variant))
+        return null;
+    const expId = params.get("_apex_exp")?.trim() || null;
+    return { variant, expId };
+}
+function getExperimentPreview(search) {
+    const resolved = search ?? (isBrowser ? window.location.search : "");
+    return readExperimentPreview(resolved);
+}
+async function fetchExperimentLineIds(apiBase, experimentId, workspaceKey) {
+    try {
+        const res = await fetch(`${apiBase}/api/experiments/${experimentId}/line?source=sdk`, {
+            credentials: "include",
+            headers: workspaceKey ? { "x-apex-workspace": workspaceKey } : {},
+        });
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        const ids = body.data?.lineMemberIds ?? body.lineMemberIds;
+        return Array.isArray(ids) && ids.length > 0 ? ids : null;
+    }
+    catch {
+        return null;
+    }
 }
 // DBS-1 — durable browser session id (`apex_sid`), GA4-parity 30-min
 // inactivity rotation. Mirrors the snippet's cookie format
@@ -519,7 +540,8 @@ function fireExperimentExposure(experimentId, variant, apiBase, workspaceKey, bu
  *     the server cannot be reached.
  *  4. Deterministic murmur-hash of `visitorId + experimentId` (fallback).
  *
- * Returns `"control"` during SSR / non-browser contexts. Fires the
+ * Returns `"control"` during SSR / non-browser contexts — unless
+ * `opts.search` carries a matching `_apex_preview`. Fires the
  * canonical `experiment_exposure` event (deduped) only when the visitor
  * is still eligible.
  *
@@ -529,20 +551,32 @@ function fireExperimentExposure(experimentId, variant, apiBase, workspaceKey, bu
  * if (arm === "variant_a" || arm === "variant_b") renderVariant(); else renderControl();
  */
 export async function getVariant(experimentId, opts = {}) {
+    const apiBase = (opts.apiUrl ?? config?.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, "");
+    const workspaceKey = opts.workspaceKey ?? config?.workspaceKey;
+    const buildId = opts.buildId ?? config?.buildId;
+    // 1. Preview mode — author previewing, not a real exposure. Runs
+    // before the browser/consent gates so SSR and a declined cookie
+    // banner still show the URL arm. A family member's `_apex_exp`
+    // applies once we know the line.
+    const preview = getExperimentPreview(opts.search);
+    if (preview) {
+        const lineIds = opts.lineMemberIds ??
+            (isBrowser && preview.expId && preview.expId !== experimentId
+                ? await fetchExperimentLineIds(apiBase, experimentId, workspaceKey)
+                : null);
+        if (!preview.expId ||
+            preview.expId === experimentId ||
+            (lineIds && lineIds.includes(experimentId) && lineIds.includes(preview.expId))) {
+            return preview.variant;
+        }
+        return "control";
+    }
     if (!isBrowser)
         return "control";
     // Consent gate — without consent we neither persist a visitor id nor fire
     // an exposure, so everyone deterministically sees control until they opt in.
     if (!consentGranted)
         return "control";
-    const apiBase = (opts.apiUrl ?? config?.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, "");
-    const workspaceKey = opts.workspaceKey ?? config?.workspaceKey;
-    const buildId = opts.buildId ?? config?.buildId;
-    // 1. Preview mode — author previewing, not a real exposure.
-    const preview = getExperimentPreview();
-    if (preview && (!preview.expId || preview.expId === experimentId)) {
-        return preview.variant;
-    }
     const cacheKey = `apex_var_${experimentId}`;
     const cached = localStorage.getItem(cacheKey);
     const visitorId = getExperimentVisitorId();
@@ -563,18 +597,22 @@ export async function getVariant(experimentId, opts = {}) {
         if (!res.ok)
             throw new Error(`${res.status}`);
         const data = (await res.json());
+        const runId = data.experimentId || experimentId;
         if (data.eligible === false) {
             // Staging / TestFlight / localhost: serve the arm so they can QA.
             // Do not fire an exposure — that is what would move the result.
             if (data.reason === "non_production_audience") {
-                localStorage.setItem(cacheKey, data.variant);
+                localStorage.setItem(`apex_var_${runId}`, data.variant);
                 return data.variant;
             }
             localStorage.setItem(cacheKey, "control");
             return "control";
         }
-        localStorage.setItem(cacheKey, data.variant);
-        fireExperimentExposure(experimentId, data.variant, apiBase, workspaceKey, buildId);
+        if (runId !== experimentId) {
+            localStorage.removeItem(cacheKey);
+        }
+        localStorage.setItem(`apex_var_${runId}`, data.variant);
+        fireExperimentExposure(runId, data.variant, apiBase, workspaceKey, buildId);
         return data.variant;
     }
     catch {