@blotoutio/edgetag-sdk-js 1.58.0 → 1.59.0

package/index.cjs.js

@@ -507,74 +507,6 @@ const usStates = new Map([
     ['US-VI', 'Virgin Islands, U.S.'],
 ]);
 new Set([...isoCountries.keys(), ...usStates.keys()]);
-/**
- * ISO 3166-1 alpha-2 codes for EU member states (as of 2024)
- */
-const EU_COUNTRY_CODES = new Set([
-    'AT', // Austria
-    'BE', // Belgium
-    'BG', // Bulgaria
-    'CY', // Cyprus
-    'CZ', // Czech Republic
-    'DE', // Germany
-    'DK', // Denmark
-    'EE', // Estonia
-    'ES', // Spain
-    'FI', // Finland
-    'FR', // France
-    'GR', // Greece
-    'HR', // Croatia
-    'HU', // Hungary
-    'IE', // Ireland
-    'IT', // Italy
-    'LT', // Lithuania
-    'LU', // Luxembourg
-    'LV', // Latvia
-    'MT', // Malta
-    'NL', // Netherlands
-    'PL', // Poland
-    'PT', // Portugal
-    'RO', // Romania
-    'SE', // Sweden
-    'SI', // Slovenia
-    'SK', // Slovakia
-]);
-/**
- * Returns true if the request originates from the EU or the UK (GB).
- * Cloudflare's isEUCountry flag excludes the UK post-Brexit, so GB is
- * checked explicitly alongside the EU member set.
- *
- * Fails closed: when the country cannot be resolved, the request is treated
- * as EU/UK. This is the safe default for the compliance-sensitive Grey Switch
- * (an unknown visitor may be in the EU/UK, so it must not slip through when
- * the EU/UK toggle is off).
- */
-const isEuUkRegion = (country, isEURequest) => {
-    if (isEURequest) {
-        return true;
-    }
-    if (!country) {
-        return true;
-    }
-    const upper = country.toUpperCase();
-    return upper === 'GB' || EU_COUNTRY_CODES.has(upper);
-};
-/**
- * Grey Switch fire rule, shared by the SDK and the CDN worker so both stay in
- * sync. When Grey Switch is on, EdgeTag fires server-side events for
- * non-consented users. The EU/UK toggle is off by default, which keeps EU/UK
- * visitors on normal consent unless the merchant explicitly opts those regions
- * in. Returns whether a server-side event should fire for a non-consented user.
- */
-const greySwitchAllowsServerEvent = ({ greySwitch, greySwitchEuUk, country, isEURequest, }) => {
-    if (!greySwitch) {
-        return false;
-    }
-    if (greySwitchEuUk) {
-        return true;
-    }
-    return !isEuUkRegion(country, isEURequest);
-};
 const parseCache = new Map();
 const parseRegions = (regionString) => {
     const include = new Set();
@@ -1538,7 +1470,7 @@ const getStandardPayload = (destination, payload) => {
         referrer: getReferrer(destination),
         search: getSearch(destination),
         locale: getLocale(),
-        sdkVersion: "1.58.0" ,
+        sdkVersion: "1.59.0" ,
         ...(payload || {}),
     };
     let storage = {};
@@ -1726,6 +1658,72 @@ const sendTag = (destination, { eventName, eventId, data, providerData, provider
     }
     postRequest(getTagURL(destination, eventName, options), payload, options).catch(logger.error);
 };
+// Scope (scripts/providers allow-lists) is delivered per plugin via /init, keyed
+// by the plugin's identity `${providerId}||${name}` (which is carried in the
+// plugin object's `name`). A missing scope means the plugin is global.
+//
+// Mirrors the edge getAllowedPlugins per-item logic: at instance level the
+// scripts allow-list wins, otherwise fall back to the providers allow-list.
+const isPluginAllowed = (scope, providerId, instanceName) => {
+    if (!scope) {
+        return true;
+    }
+    if (instanceName && scope.scripts.length > 0) {
+        return scope.scripts.includes(`${providerId}||${instanceName}`);
+    }
+    return scope.providers.length === 0 || scope.providers.includes(providerId);
+};
+// Mirrors the edge processPluginsRoot skip scope: a global plugin (no scope)
+// skips every browser instance (null), a scoped plugin skips only the instances
+// its scripts/providers allow-lists resolve to.
+const getScopedPluginSkipKeys = (scope, configuredTags) => {
+    if (!scope || (scope.scripts.length === 0 && scope.providers.length === 0)) {
+        return null;
+    }
+    const result = new Set();
+    for (const script of scope.scripts) {
+        result.add(script);
+    }
+    for (const providerId of scope.providers) {
+        const instances = configuredTags.get(providerId);
+        if (!instances)
+            continue;
+        for (const instanceName of instances) {
+            result.add(`${providerId}||${instanceName}`);
+        }
+    }
+    return result;
+};
+// Mirrors the edge getProviderLimits: an additional event emitted by a scoped
+// plugin is restricted to that plugin's channels/instances; a global plugin
+// imposes no restriction (undefined).
+const getPluginProviderLimits = (scope) => {
+    if (!scope || (scope.scripts.length === 0 && scope.providers.length === 0)) {
+        return undefined;
+    }
+    const limited = {};
+    for (const script of scope.scripts) {
+        const separator = script.indexOf('||');
+        if (separator === -1) {
+            continue;
+        }
+        const provider = script.slice(0, separator);
+        const instance = script.slice(separator + 2);
+        const existing = limited[provider];
+        if (existing && existing !== true) {
+            existing[instance] = true;
+        }
+        else {
+            limited[provider] = { [instance]: true };
+        }
+    }
+    for (const provider of scope.providers) {
+        if (!(provider in limited)) {
+            limited[provider] = true;
+        }
+    }
+    return limited;
+};
 const getPlugins = (destination) => {
     var _a, _b, _c;
     try {
@@ -1736,7 +1734,19 @@ const getPlugins = (destination) => {
         return [];
     }
 };
-const runPluginHook = async (plugins, hookName, baseParams) => {
+// Dispatches a plugin's additional events. Mirrors the edge: each event is
+// stamped with the emitting plugin (so it cannot reprocess itself) and limited
+// to that plugin's scope.
+const dispatchAdditionalEvents = (plugin, pluginScopes, events) => {
+    const providerLimits = getPluginProviderLimits(pluginScopes === null || pluginScopes === void 0 ? void 0 : pluginScopes[plugin.name]);
+    for (const evt of events) {
+        handleTag(evt.eventName, evt.data, providerLimits, undefined, plugin.name);
+    }
+};
+// Runs a channel/instance hook chain. The emitting plugin is excluded by the
+// caller's allow-list filter; additional events fire before any skip is applied
+// (matching the edge), and a skip is reported without mutating the final tag.
+const runPluginHook = async (plugins, hookName, pluginScopes, baseParams) => {
     var _a, _b;
     const payload = baseParams['payload'];
     let currentEventName = payload['eventName'];
@@ -1757,6 +1767,9 @@ const runPluginHook = async (plugins, hookName, baseParams) => {
                 },
                 variables: plugin.variables || {},
             });
+            if (result === null || result === void 0 ? void 0 : result.additionalEvents) {
+                dispatchAdditionalEvents(plugin, pluginScopes, result.additionalEvents);
+            }
             if (result === null || result === void 0 ? void 0 : result.skipEvent) {
                 skip = true;
                 break;
@@ -1770,24 +1783,87 @@ const runPluginHook = async (plugins, hookName, baseParams) => {
             if ((result === null || result === void 0 ? void 0 : result.providers) !== undefined) {
                 currentProviders = result.providers;
             }
+        }
+        catch (e) {
+            logger.error(`Plugin ${plugin.name} ${hookName} error: ${e}`);
+        }
+    }
+    return {
+        eventName: currentEventName,
+        data: currentData,
+        providers: currentProviders,
+        skip,
+    };
+};
+// Root hooks mirror the edge processPluginsRoot: every plugin runs (except the
+// one that emitted this event), additional events are dispatched before any
+// skip is applied, and skips are scoped — a global plugin marks every browser
+// instance, a scoped one only its resolved instances. The skip is a marker:
+// channel/instance hooks still run and only the final tag is suppressed.
+const runRootPluginHooks = async (plugins, baseParams, pluginScopes, configuredTags, pluginSource) => {
+    var _a, _b;
+    const payload = baseParams['payload'];
+    let currentEventName = payload['eventName'];
+    let currentData = payload['data'];
+    let currentProviders = baseParams['providers'];
+    const skippedInstances = new Set();
+    for (const plugin of plugins) {
+        if (plugin.name === pluginSource)
+            continue;
+        const hook = plugin.rules.tagRoot;
+        if (!hook)
+            continue;
+        try {
+            const result = await hook({
+                ...baseParams,
+                payload: {
+                    ...payload,
+                    eventName: currentEventName,
+                    data: jsonClone(currentData),
+                },
+                variables: plugin.variables || {},
+            });
             if (result === null || result === void 0 ? void 0 : result.additionalEvents) {
-                for (const evt of result.additionalEvents) {
-                    handleTag(evt.eventName, evt.data, undefined, undefined);
+                dispatchAdditionalEvents(plugin, pluginScopes, result.additionalEvents);
+            }
+            if (result === null || result === void 0 ? void 0 : result.skipEvent) {
+                const scopeSkipKeys = getScopedPluginSkipKeys(pluginScopes === null || pluginScopes === void 0 ? void 0 : pluginScopes[plugin.name], configuredTags);
+                if (scopeSkipKeys === null) {
+                    // Global plugin: skip every configured browser instance.
+                    for (const [provider, instances] of configuredTags) {
+                        for (const instanceName of instances) {
+                            skippedInstances.add(`${provider}||${instanceName}`);
+                        }
+                    }
                 }
+                else {
+                    for (const key of scopeSkipKeys) {
+                        skippedInstances.add(key);
+                    }
+                }
+            }
+            if ((_a = result === null || result === void 0 ? void 0 : result.payload) === null || _a === void 0 ? void 0 : _a.eventName) {
+                currentEventName = result.payload.eventName;
+            }
+            if ((_b = result === null || result === void 0 ? void 0 : result.payload) === null || _b === void 0 ? void 0 : _b.data) {
+                currentData = result.payload.data;
+            }
+            if ((result === null || result === void 0 ? void 0 : result.providers) !== undefined) {
+                currentProviders = result.providers;
             }
         }
         catch (e) {
-            logger.error(`Plugin ${plugin.name} ${hookName} error: ${e}`);
+            logger.error(`Plugin ${plugin.name} tagRoot error: ${e}`);
         }
     }
     return {
         eventName: currentEventName,
         data: currentData,
         providers: currentProviders,
-        skip,
+        skippedInstances,
     };
 };
-const processTag = async (destination, eventName, data = {}, providers, options) => {
+const processTag = async (destination, eventName, data = {}, providers, options, pluginSource) => {
     var _a, _b;
     let currentEventName = eventName;
     if (!getSetting(destination, 'initialized')) {
@@ -1814,15 +1890,6 @@ const processTag = async (destination, eventName, data = {}, providers, options)
     const consentCategory = getConsentCategories(destination);
     const consentSettings = getSetting(destination, 'consentSetting');
     const userConsent = { consentChannel, consentCategory, consentSettings };
-    // Grey Switch: when enabled, still send the event to the server for
-    // non-consented users. Browser pixels remain gated by hasUserConsent below,
-    // so nothing fires client-side.
-    const greySwitchAllows = greySwitchAllowsServerEvent({
-        greySwitch: getSetting(destination, 'greySwitch') || false,
-        greySwitchEuUk: getSetting(destination, 'greySwitchEuUk') || false,
-        country: requestCountry,
-        isEURequest,
-    });
     const ip = getSetting(destination, 'ip') || null;
     const userProperties = getSetting(destination, 'userProperties');
     if (skipZeroPurchaseEvent && isZeroPurchaseEvent({ eventName, data })) {
@@ -1843,6 +1910,7 @@ const processTag = async (destination, eventName, data = {}, providers, options)
             providers = rulesResult.updatedProviders;
         }
         const plugins = getPlugins(destination);
+        const pluginScopes = getSetting(destination, 'pluginScopes');
         const pluginSettings = {
             userId,
             sessionId,
@@ -1858,26 +1926,15 @@ const processTag = async (destination, eventName, data = {}, providers, options)
         const pluginUtilities = {
             getIsNewCustomerFlag: () => getIsNewCustomerFlag(processGetData.bind(null, destination)),
         };
+        let rootSkippedInstances = new Set();
         if (plugins.length > 0) {
-            const rootResult = await runPluginHook(plugins, 'tagRoot', {
+            const rootResult = await runRootPluginHooks(plugins, {
                 payload: { eventName: currentEventName, data, eventId },
                 context: pluginContext,
                 providers,
                 settings: pluginSettings,
                 utilities: pluginUtilities,
-            });
-            if (rootResult.skip) {
-                sendTag(destination, {
-                    configuratorProcessed: true,
-                    eventName: currentEventName,
-                    eventId,
-                    data,
-                    providerData: {},
-                    providers,
-                    options,
-                });
-                return;
-            }
+            }, pluginScopes, configuredTags, pluginSource);
             if (rootResult.providers !== undefined) {
                 // eslint-disable-next-line no-param-reassign
                 providers = rootResult.providers;
@@ -1885,6 +1942,7 @@ const processTag = async (destination, eventName, data = {}, providers, options)
             currentEventName = rootResult.eventName;
             // eslint-disable-next-line no-param-reassign
             data = rootResult.data;
+            rootSkippedInstances = rootResult.skippedInstances;
         }
         if (!rulesResult.skipBrowserEvent) {
             const currencySettings = getSetting(destination, 'currency');
@@ -1896,69 +1954,96 @@ const processTag = async (destination, eventName, data = {}, providers, options)
                     logger.log(`Provider ${pkg.name} is not in allow list`);
                     continue;
                 }
-                let providerEventName = currentEventName;
-                let channelData = data;
-                if (plugins.length > 0) {
-                    const channelResult = await runPluginHook(plugins, 'tagChannel', {
-                        payload: {
-                            eventName: providerEventName,
-                            data: channelData,
-                            eventId,
-                        },
-                        context: pluginContext,
-                        settings: pluginSettings,
-                        providerId: pkg.name,
-                        utilities: pluginUtilities,
+                const providerId = pkg.name;
+                const variables = getProviderVariables(destination, pkg.name);
+                // Per-instance state, mirroring the edge PluginData array: each instance
+                // carries its own payload and skip marker (seeded from the root skip
+                // scope). A skip never short-circuits the hooks — only the final tag.
+                const instanceStates = new Map();
+                for (const variable of variables) {
+                    instanceStates.set(variable.tagName, {
+                        eventName: currentEventName,
+                        data,
+                        skipped: rootSkippedInstances.has(`${providerId}||${variable.tagName}`),
                     });
-                    if (channelResult.skip)
-                        continue;
-                    providerEventName = channelResult.eventName;
-                    channelData = channelResult.data;
                 }
-                const variables = getProviderVariables(destination, pkg.name);
+                // Channel phase (processPluginsChannel): tagChannel runs once per
+                // instance, regardless of skip/consent/geo, so its side effects and
+                // additional events still fire on skipped instances.
+                const channelPlugins = plugins.filter((plugin) => plugin.name !== pluginSource &&
+                    isPluginAllowed(pluginScopes === null || pluginScopes === void 0 ? void 0 : pluginScopes[plugin.name], providerId, null));
+                if (channelPlugins.length > 0) {
+                    for (const variable of variables) {
+                        const state = instanceStates.get(variable.tagName);
+                        const channelResult = await runPluginHook(channelPlugins, 'tagChannel', pluginScopes, {
+                            payload: {
+                                eventName: state.eventName,
+                                data: state.data,
+                                eventId,
+                            },
+                            context: pluginContext,
+                            settings: pluginSettings,
+                            providerId,
+                            utilities: pluginUtilities,
+                        });
+                        if (channelResult.skip) {
+                            state.skipped = true;
+                        }
+                        state.eventName = channelResult.eventName;
+                        state.data = channelResult.data;
+                    }
+                }
+                // Instance phase (processPluginsInstance + tag send): consent/geo gate,
+                // run tagInstance, then suppress only the final tag when skipped.
                 const result = {};
                 const executionContext = new Map();
                 for (const variable of variables) {
-                    if (!isProviderInstanceAllowed(providers, pkg.name, variable.tagName)) {
-                        logger.log(`Provider instance is not allowed (${pkg.name}: ${variable.tagName})`);
+                    const state = instanceStates.get(variable.tagName);
+                    if (!isProviderInstanceAllowed(providers, providerId, variable.tagName)) {
+                        logger.log(`Provider instance is not allowed (${providerId}: ${variable.tagName})`);
                         continue;
                     }
-                    if (!hasUserConsent(userConsent, pkg.name, variable.tagName)) {
-                        logger.log(`Consent is missing (${pkg.name}: ${variable.tagName})`);
+                    if (!hasUserConsent(userConsent, providerId, variable.tagName)) {
+                        logger.log(`Consent is missing (${providerId}: ${variable.tagName})`);
                         continue;
                     }
                     if (!doesGeoRequestMatchList(requestCountry, requestRegion, isEURequest, variable.geoRegions)) {
                         logger.log('GEO request region does not match the filter, skipping');
                         continue;
                     }
-                    let instanceEventName = providerEventName;
-                    let instanceData = channelData;
-                    if (plugins.length > 0) {
-                        const instanceResult = await runPluginHook(plugins, 'tagInstance', {
+                    const instancePlugins = plugins.filter((plugin) => plugin.name !== pluginSource &&
+                        isPluginAllowed(pluginScopes === null || pluginScopes === void 0 ? void 0 : pluginScopes[plugin.name], providerId, variable.tagName));
+                    if (instancePlugins.length > 0) {
+                        const instanceResult = await runPluginHook(instancePlugins, 'tagInstance', pluginScopes, {
                             payload: {
-                                eventName: instanceEventName,
-                                data: instanceData,
+                                eventName: state.eventName,
+                                data: state.data,
                                 eventId,
                             },
                             context: pluginContext,
                             settings: pluginSettings,
-                            providerId: pkg.name,
+                            providerId,
                             utilities: pluginUtilities,
                         });
-                        if (instanceResult.skip)
-                            continue;
-                        instanceEventName = instanceResult.eventName;
-                        instanceData = instanceResult.data;
+                        if (instanceResult.skip) {
+                            state.skipped = true;
+                        }
+                        state.eventName = instanceResult.eventName;
+                        state.data = instanceResult.data;
+                    }
+                    if (state.skipped) {
+                        logger.log(`Skipping event due to plugin condition (${providerId}: ${variable.tagName})`);
+                        continue;
                     }
-                    const conversion = preparePayloadWithConversion(jsonClone(instanceData), currencySettings);
+                    const conversion = preparePayloadWithConversion(jsonClone(state.data), currencySettings);
                     const payload = ((_a = conversion === null || conversion === void 0 ? void 0 : conversion.providers) === null || _a === void 0 ? void 0 : _a.length) === 0 ||
-                        ((_b = conversion === null || conversion === void 0 ? void 0 : conversion.providers) === null || _b === void 0 ? void 0 : _b.includes(pkg.name))
+                        ((_b = conversion === null || conversion === void 0 ? void 0 : conversion.providers) === null || _b === void 0 ? void 0 : _b.includes(providerId))
                         ? conversion.payload
-                        : instanceData;
+                        : state.data;
                     result[variable.tagName] = pkg.tag({
                         userId,
                         sessionId,
-                        eventName: instanceEventName,
+                        eventName: state.eventName,
                         eventId,
                         data: jsonClone(payload),
                         sendTag: sendTag.bind(null, destination),
@@ -1973,16 +2058,17 @@ const processTag = async (destination, eventName, data = {}, providers, options)
                         pageUrl: getPageUrl(destination),
                     });
                 }
-                providerData[pkg.name] = result;
+                if (Object.keys(result).length > 0) {
+                    providerData[providerId] = result;
+                }
             }
         }
         else {
             logger.log('Browser events skipped by event rules, sending tag to server only');
         }
-        if (!hasAllowedManifestTags(configuredTags, userConsent, providers) &&
-            !greySwitchAllows) {
-            return;
-        }
+        // The server event is always forwarded to EdgeTag regardless of consent or
+        // provider config; the CDN re-runs this logic server-side. Browser tags are
+        // still individually gated by consent/geo/provider above.
         sendTag(destination, {
             configuratorProcessed: true,
             eventName: currentEventName,
@@ -2001,26 +2087,15 @@ const processTag = async (destination, eventName, data = {}, providers, options)
         handleTag(additionalEventName, jsonClone(originalData || {}), originalProviders, options);
     }
 };
-const handleTag = (eventName, data = {}, providers, options) => {
+const handleTag = (eventName, data = {}, providers, options, pluginSource) => {
     if (options === null || options === void 0 ? void 0 : options.destination) {
-        processTag(options.destination, eventName, data, providers, options).catch(logger.error);
+        processTag(options.destination, eventName, data, providers, options, pluginSource).catch(logger.error);
         return;
     }
     getInstances().forEach((instance) => {
-        processTag(instance, eventName, data, providers, options).catch(logger.error);
+        processTag(instance, eventName, data, providers, options, pluginSource).catch(logger.error);
     });
 };
-const hasAllowedManifestTags = (tags, consent, providersConfig) => {
-    for (const [pkg, tagNames] of tags) {
-        for (const tagName of tagNames) {
-            if (hasUserConsent(consent, pkg, tagName) &&
-                isProviderInstanceAllowed(providersConfig, pkg, tagName)) {
-                return true;
-            }
-        }
-    }
-    return false;
-};
 
 const processData = (destination, data, providers, options) => {
     saveKV(destination, data);
@@ -2560,6 +2635,7 @@ const handleInit = (preferences) => {
             configuratorSetting: result.configuratorSetting,
             userProperties: result.userProperties,
             ip: result.ip,
+            pluginScopes: result.pluginScopes,
         });
         if (result.storageId != null) {
             savePerKey(preferences.edgeURL, 'local', tagStorage, result.storageId, storageIdKey);

package/index.mjs

@@ -505,74 +505,6 @@ const usStates = new Map([
     ['US-VI', 'Virgin Islands, U.S.'],
 ]);
 new Set([...isoCountries.keys(), ...usStates.keys()]);
-/**
- * ISO 3166-1 alpha-2 codes for EU member states (as of 2024)
- */
-const EU_COUNTRY_CODES = new Set([
-    'AT', // Austria
-    'BE', // Belgium
-    'BG', // Bulgaria
-    'CY', // Cyprus
-    'CZ', // Czech Republic
-    'DE', // Germany
-    'DK', // Denmark
-    'EE', // Estonia
-    'ES', // Spain
-    'FI', // Finland
-    'FR', // France
-    'GR', // Greece
-    'HR', // Croatia
-    'HU', // Hungary
-    'IE', // Ireland
-    'IT', // Italy
-    'LT', // Lithuania
-    'LU', // Luxembourg
-    'LV', // Latvia
-    'MT', // Malta
-    'NL', // Netherlands
-    'PL', // Poland
-    'PT', // Portugal
-    'RO', // Romania
-    'SE', // Sweden
-    'SI', // Slovenia
-    'SK', // Slovakia
-]);
-/**
- * Returns true if the request originates from the EU or the UK (GB).
- * Cloudflare's isEUCountry flag excludes the UK post-Brexit, so GB is
- * checked explicitly alongside the EU member set.
- *
- * Fails closed: when the country cannot be resolved, the request is treated
- * as EU/UK. This is the safe default for the compliance-sensitive Grey Switch
- * (an unknown visitor may be in the EU/UK, so it must not slip through when
- * the EU/UK toggle is off).
- */
-const isEuUkRegion = (country, isEURequest) => {
-    if (isEURequest) {
-        return true;
-    }
-    if (!country) {
-        return true;
-    }
-    const upper = country.toUpperCase();
-    return upper === 'GB' || EU_COUNTRY_CODES.has(upper);
-};
-/**
- * Grey Switch fire rule, shared by the SDK and the CDN worker so both stay in
- * sync. When Grey Switch is on, EdgeTag fires server-side events for
- * non-consented users. The EU/UK toggle is off by default, which keeps EU/UK
- * visitors on normal consent unless the merchant explicitly opts those regions
- * in. Returns whether a server-side event should fire for a non-consented user.
- */
-const greySwitchAllowsServerEvent = ({ greySwitch, greySwitchEuUk, country, isEURequest, }) => {
-    if (!greySwitch) {
-        return false;
-    }
-    if (greySwitchEuUk) {
-        return true;
-    }
-    return !isEuUkRegion(country, isEURequest);
-};
 const parseCache = new Map();
 const parseRegions = (regionString) => {
     const include = new Set();
@@ -1536,7 +1468,7 @@ const getStandardPayload = (destination, payload) => {
         referrer: getReferrer(destination),
         search: getSearch(destination),
         locale: getLocale(),
-        sdkVersion: "1.58.0" ,
+        sdkVersion: "1.59.0" ,
         ...(payload || {}),
     };
     let storage = {};
@@ -1724,6 +1656,72 @@ const sendTag = (destination, { eventName, eventId, data, providerData, provider
     }
     postRequest(getTagURL(destination, eventName, options), payload, options).catch(logger.error);
 };
+// Scope (scripts/providers allow-lists) is delivered per plugin via /init, keyed
+// by the plugin's identity `${providerId}||${name}` (which is carried in the
+// plugin object's `name`). A missing scope means the plugin is global.
+//
+// Mirrors the edge getAllowedPlugins per-item logic: at instance level the
+// scripts allow-list wins, otherwise fall back to the providers allow-list.
+const isPluginAllowed = (scope, providerId, instanceName) => {
+    if (!scope) {
+        return true;
+    }
+    if (instanceName && scope.scripts.length > 0) {
+        return scope.scripts.includes(`${providerId}||${instanceName}`);
+    }
+    return scope.providers.length === 0 || scope.providers.includes(providerId);
+};
+// Mirrors the edge processPluginsRoot skip scope: a global plugin (no scope)
+// skips every browser instance (null), a scoped plugin skips only the instances
+// its scripts/providers allow-lists resolve to.
+const getScopedPluginSkipKeys = (scope, configuredTags) => {
+    if (!scope || (scope.scripts.length === 0 && scope.providers.length === 0)) {
+        return null;
+    }
+    const result = new Set();
+    for (const script of scope.scripts) {
+        result.add(script);
+    }
+    for (const providerId of scope.providers) {
+        const instances = configuredTags.get(providerId);
+        if (!instances)
+            continue;
+        for (const instanceName of instances) {
+            result.add(`${providerId}||${instanceName}`);
+        }
+    }
+    return result;
+};
+// Mirrors the edge getProviderLimits: an additional event emitted by a scoped
+// plugin is restricted to that plugin's channels/instances; a global plugin
+// imposes no restriction (undefined).
+const getPluginProviderLimits = (scope) => {
+    if (!scope || (scope.scripts.length === 0 && scope.providers.length === 0)) {
+        return undefined;
+    }
+    const limited = {};
+    for (const script of scope.scripts) {
+        const separator = script.indexOf('||');
+        if (separator === -1) {
+            continue;
+        }
+        const provider = script.slice(0, separator);
+        const instance = script.slice(separator + 2);
+        const existing = limited[provider];
+        if (existing && existing !== true) {
+            existing[instance] = true;
+        }
+        else {
+            limited[provider] = { [instance]: true };
+        }
+    }
+    for (const provider of scope.providers) {
+        if (!(provider in limited)) {
+            limited[provider] = true;
+        }
+    }
+    return limited;
+};
 const getPlugins = (destination) => {
     var _a, _b, _c;
     try {
@@ -1734,7 +1732,19 @@ const getPlugins = (destination) => {
         return [];
     }
 };
-const runPluginHook = async (plugins, hookName, baseParams) => {
+// Dispatches a plugin's additional events. Mirrors the edge: each event is
+// stamped with the emitting plugin (so it cannot reprocess itself) and limited
+// to that plugin's scope.
+const dispatchAdditionalEvents = (plugin, pluginScopes, events) => {
+    const providerLimits = getPluginProviderLimits(pluginScopes === null || pluginScopes === void 0 ? void 0 : pluginScopes[plugin.name]);
+    for (const evt of events) {
+        handleTag(evt.eventName, evt.data, providerLimits, undefined, plugin.name);
+    }
+};
+// Runs a channel/instance hook chain. The emitting plugin is excluded by the
+// caller's allow-list filter; additional events fire before any skip is applied
+// (matching the edge), and a skip is reported without mutating the final tag.
+const runPluginHook = async (plugins, hookName, pluginScopes, baseParams) => {
     var _a, _b;
     const payload = baseParams['payload'];
     let currentEventName = payload['eventName'];
@@ -1755,6 +1765,9 @@ const runPluginHook = async (plugins, hookName, baseParams) => {
                 },
                 variables: plugin.variables || {},
             });
+            if (result === null || result === void 0 ? void 0 : result.additionalEvents) {
+                dispatchAdditionalEvents(plugin, pluginScopes, result.additionalEvents);
+            }
             if (result === null || result === void 0 ? void 0 : result.skipEvent) {
                 skip = true;
                 break;
@@ -1768,24 +1781,87 @@ const runPluginHook = async (plugins, hookName, baseParams) => {
             if ((result === null || result === void 0 ? void 0 : result.providers) !== undefined) {
                 currentProviders = result.providers;
             }
+        }
+        catch (e) {
+            logger.error(`Plugin ${plugin.name} ${hookName} error: ${e}`);
+        }
+    }
+    return {
+        eventName: currentEventName,
+        data: currentData,
+        providers: currentProviders,
+        skip,
+    };
+};
+// Root hooks mirror the edge processPluginsRoot: every plugin runs (except the
+// one that emitted this event), additional events are dispatched before any
+// skip is applied, and skips are scoped — a global plugin marks every browser
+// instance, a scoped one only its resolved instances. The skip is a marker:
+// channel/instance hooks still run and only the final tag is suppressed.
+const runRootPluginHooks = async (plugins, baseParams, pluginScopes, configuredTags, pluginSource) => {
+    var _a, _b;
+    const payload = baseParams['payload'];
+    let currentEventName = payload['eventName'];
+    let currentData = payload['data'];
+    let currentProviders = baseParams['providers'];
+    const skippedInstances = new Set();
+    for (const plugin of plugins) {
+        if (plugin.name === pluginSource)
+            continue;
+        const hook = plugin.rules.tagRoot;
+        if (!hook)
+            continue;
+        try {
+            const result = await hook({
+                ...baseParams,
+                payload: {
+                    ...payload,
+                    eventName: currentEventName,
+                    data: jsonClone(currentData),
+                },
+                variables: plugin.variables || {},
+            });
             if (result === null || result === void 0 ? void 0 : result.additionalEvents) {
-                for (const evt of result.additionalEvents) {
-                    handleTag(evt.eventName, evt.data, undefined, undefined);
+                dispatchAdditionalEvents(plugin, pluginScopes, result.additionalEvents);
+            }
+            if (result === null || result === void 0 ? void 0 : result.skipEvent) {
+                const scopeSkipKeys = getScopedPluginSkipKeys(pluginScopes === null || pluginScopes === void 0 ? void 0 : pluginScopes[plugin.name], configuredTags);
+                if (scopeSkipKeys === null) {
+                    // Global plugin: skip every configured browser instance.
+                    for (const [provider, instances] of configuredTags) {
+                        for (const instanceName of instances) {
+                            skippedInstances.add(`${provider}||${instanceName}`);
+                        }
+                    }
                 }
+                else {
+                    for (const key of scopeSkipKeys) {
+                        skippedInstances.add(key);
+                    }
+                }
+            }
+            if ((_a = result === null || result === void 0 ? void 0 : result.payload) === null || _a === void 0 ? void 0 : _a.eventName) {
+                currentEventName = result.payload.eventName;
+            }
+            if ((_b = result === null || result === void 0 ? void 0 : result.payload) === null || _b === void 0 ? void 0 : _b.data) {
+                currentData = result.payload.data;
+            }
+            if ((result === null || result === void 0 ? void 0 : result.providers) !== undefined) {
+                currentProviders = result.providers;
             }
         }
         catch (e) {
-            logger.error(`Plugin ${plugin.name} ${hookName} error: ${e}`);
+            logger.error(`Plugin ${plugin.name} tagRoot error: ${e}`);
         }
     }
     return {
         eventName: currentEventName,
         data: currentData,
         providers: currentProviders,
-        skip,
+        skippedInstances,
     };
 };
-const processTag = async (destination, eventName, data = {}, providers, options) => {
+const processTag = async (destination, eventName, data = {}, providers, options, pluginSource) => {
     var _a, _b;
     let currentEventName = eventName;
     if (!getSetting(destination, 'initialized')) {
@@ -1812,15 +1888,6 @@ const processTag = async (destination, eventName, data = {}, providers, options)
     const consentCategory = getConsentCategories(destination);
     const consentSettings = getSetting(destination, 'consentSetting');
     const userConsent = { consentChannel, consentCategory, consentSettings };
-    // Grey Switch: when enabled, still send the event to the server for
-    // non-consented users. Browser pixels remain gated by hasUserConsent below,
-    // so nothing fires client-side.
-    const greySwitchAllows = greySwitchAllowsServerEvent({
-        greySwitch: getSetting(destination, 'greySwitch') || false,
-        greySwitchEuUk: getSetting(destination, 'greySwitchEuUk') || false,
-        country: requestCountry,
-        isEURequest,
-    });
     const ip = getSetting(destination, 'ip') || null;
     const userProperties = getSetting(destination, 'userProperties');
     if (skipZeroPurchaseEvent && isZeroPurchaseEvent({ eventName, data })) {
@@ -1841,6 +1908,7 @@ const processTag = async (destination, eventName, data = {}, providers, options)
             providers = rulesResult.updatedProviders;
         }
         const plugins = getPlugins(destination);
+        const pluginScopes = getSetting(destination, 'pluginScopes');
         const pluginSettings = {
             userId,
             sessionId,
@@ -1856,26 +1924,15 @@ const processTag = async (destination, eventName, data = {}, providers, options)
         const pluginUtilities = {
             getIsNewCustomerFlag: () => getIsNewCustomerFlag(processGetData.bind(null, destination)),
         };
+        let rootSkippedInstances = new Set();
         if (plugins.length > 0) {
-            const rootResult = await runPluginHook(plugins, 'tagRoot', {
+            const rootResult = await runRootPluginHooks(plugins, {
                 payload: { eventName: currentEventName, data, eventId },
                 context: pluginContext,
                 providers,
                 settings: pluginSettings,
                 utilities: pluginUtilities,
-            });
-            if (rootResult.skip) {
-                sendTag(destination, {
-                    configuratorProcessed: true,
-                    eventName: currentEventName,
-                    eventId,
-                    data,
-                    providerData: {},
-                    providers,
-                    options,
-                });
-                return;
-            }
+            }, pluginScopes, configuredTags, pluginSource);
             if (rootResult.providers !== undefined) {
                 // eslint-disable-next-line no-param-reassign
                 providers = rootResult.providers;
@@ -1883,6 +1940,7 @@ const processTag = async (destination, eventName, data = {}, providers, options)
             currentEventName = rootResult.eventName;
             // eslint-disable-next-line no-param-reassign
             data = rootResult.data;
+            rootSkippedInstances = rootResult.skippedInstances;
         }
         if (!rulesResult.skipBrowserEvent) {
             const currencySettings = getSetting(destination, 'currency');
@@ -1894,69 +1952,96 @@ const processTag = async (destination, eventName, data = {}, providers, options)
                     logger.log(`Provider ${pkg.name} is not in allow list`);
                     continue;
                 }
-                let providerEventName = currentEventName;
-                let channelData = data;
-                if (plugins.length > 0) {
-                    const channelResult = await runPluginHook(plugins, 'tagChannel', {
-                        payload: {
-                            eventName: providerEventName,
-                            data: channelData,
-                            eventId,
-                        },
-                        context: pluginContext,
-                        settings: pluginSettings,
-                        providerId: pkg.name,
-                        utilities: pluginUtilities,
+                const providerId = pkg.name;
+                const variables = getProviderVariables(destination, pkg.name);
+                // Per-instance state, mirroring the edge PluginData array: each instance
+                // carries its own payload and skip marker (seeded from the root skip
+                // scope). A skip never short-circuits the hooks — only the final tag.
+                const instanceStates = new Map();
+                for (const variable of variables) {
+                    instanceStates.set(variable.tagName, {
+                        eventName: currentEventName,
+                        data,
+                        skipped: rootSkippedInstances.has(`${providerId}||${variable.tagName}`),
                     });
-                    if (channelResult.skip)
-                        continue;
-                    providerEventName = channelResult.eventName;
-                    channelData = channelResult.data;
                 }
-                const variables = getProviderVariables(destination, pkg.name);
+                // Channel phase (processPluginsChannel): tagChannel runs once per
+                // instance, regardless of skip/consent/geo, so its side effects and
+                // additional events still fire on skipped instances.
+                const channelPlugins = plugins.filter((plugin) => plugin.name !== pluginSource &&
+                    isPluginAllowed(pluginScopes === null || pluginScopes === void 0 ? void 0 : pluginScopes[plugin.name], providerId, null));
+                if (channelPlugins.length > 0) {
+                    for (const variable of variables) {
+                        const state = instanceStates.get(variable.tagName);
+                        const channelResult = await runPluginHook(channelPlugins, 'tagChannel', pluginScopes, {
+                            payload: {
+                                eventName: state.eventName,
+                                data: state.data,
+                                eventId,
+                            },
+                            context: pluginContext,
+                            settings: pluginSettings,
+                            providerId,
+                            utilities: pluginUtilities,
+                        });
+                        if (channelResult.skip) {
+                            state.skipped = true;
+                        }
+                        state.eventName = channelResult.eventName;
+                        state.data = channelResult.data;
+                    }
+                }
+                // Instance phase (processPluginsInstance + tag send): consent/geo gate,
+                // run tagInstance, then suppress only the final tag when skipped.
                 const result = {};
                 const executionContext = new Map();
                 for (const variable of variables) {
-                    if (!isProviderInstanceAllowed(providers, pkg.name, variable.tagName)) {
-                        logger.log(`Provider instance is not allowed (${pkg.name}: ${variable.tagName})`);
+                    const state = instanceStates.get(variable.tagName);
+                    if (!isProviderInstanceAllowed(providers, providerId, variable.tagName)) {
+                        logger.log(`Provider instance is not allowed (${providerId}: ${variable.tagName})`);
                         continue;
                     }
-                    if (!hasUserConsent(userConsent, pkg.name, variable.tagName)) {
-                        logger.log(`Consent is missing (${pkg.name}: ${variable.tagName})`);
+                    if (!hasUserConsent(userConsent, providerId, variable.tagName)) {
+                        logger.log(`Consent is missing (${providerId}: ${variable.tagName})`);
                         continue;
                     }
                     if (!doesGeoRequestMatchList(requestCountry, requestRegion, isEURequest, variable.geoRegions)) {
                         logger.log('GEO request region does not match the filter, skipping');
                         continue;
                     }
-                    let instanceEventName = providerEventName;
-                    let instanceData = channelData;
-                    if (plugins.length > 0) {
-                        const instanceResult = await runPluginHook(plugins, 'tagInstance', {
+                    const instancePlugins = plugins.filter((plugin) => plugin.name !== pluginSource &&
+                        isPluginAllowed(pluginScopes === null || pluginScopes === void 0 ? void 0 : pluginScopes[plugin.name], providerId, variable.tagName));
+                    if (instancePlugins.length > 0) {
+                        const instanceResult = await runPluginHook(instancePlugins, 'tagInstance', pluginScopes, {
                             payload: {
-                                eventName: instanceEventName,
-                                data: instanceData,
+                                eventName: state.eventName,
+                                data: state.data,
                                 eventId,
                             },
                             context: pluginContext,
                             settings: pluginSettings,
-                            providerId: pkg.name,
+                            providerId,
                             utilities: pluginUtilities,
                         });
-                        if (instanceResult.skip)
-                            continue;
-                        instanceEventName = instanceResult.eventName;
-                        instanceData = instanceResult.data;
+                        if (instanceResult.skip) {
+                            state.skipped = true;
+                        }
+                        state.eventName = instanceResult.eventName;
+                        state.data = instanceResult.data;
+                    }
+                    if (state.skipped) {
+                        logger.log(`Skipping event due to plugin condition (${providerId}: ${variable.tagName})`);
+                        continue;
                     }
-                    const conversion = preparePayloadWithConversion(jsonClone(instanceData), currencySettings);
+                    const conversion = preparePayloadWithConversion(jsonClone(state.data), currencySettings);
                     const payload = ((_a = conversion === null || conversion === void 0 ? void 0 : conversion.providers) === null || _a === void 0 ? void 0 : _a.length) === 0 ||
-                        ((_b = conversion === null || conversion === void 0 ? void 0 : conversion.providers) === null || _b === void 0 ? void 0 : _b.includes(pkg.name))
+                        ((_b = conversion === null || conversion === void 0 ? void 0 : conversion.providers) === null || _b === void 0 ? void 0 : _b.includes(providerId))
                         ? conversion.payload
-                        : instanceData;
+                        : state.data;
                     result[variable.tagName] = pkg.tag({
                         userId,
                         sessionId,
-                        eventName: instanceEventName,
+                        eventName: state.eventName,
                         eventId,
                         data: jsonClone(payload),
                         sendTag: sendTag.bind(null, destination),
@@ -1971,16 +2056,17 @@ const processTag = async (destination, eventName, data = {}, providers, options)
                         pageUrl: getPageUrl(destination),
                     });
                 }
-                providerData[pkg.name] = result;
+                if (Object.keys(result).length > 0) {
+                    providerData[providerId] = result;
+                }
             }
         }
         else {
             logger.log('Browser events skipped by event rules, sending tag to server only');
         }
-        if (!hasAllowedManifestTags(configuredTags, userConsent, providers) &&
-            !greySwitchAllows) {
-            return;
-        }
+        // The server event is always forwarded to EdgeTag regardless of consent or
+        // provider config; the CDN re-runs this logic server-side. Browser tags are
+        // still individually gated by consent/geo/provider above.
         sendTag(destination, {
             configuratorProcessed: true,
             eventName: currentEventName,
@@ -1999,26 +2085,15 @@ const processTag = async (destination, eventName, data = {}, providers, options)
         handleTag(additionalEventName, jsonClone(originalData || {}), originalProviders, options);
     }
 };
-const handleTag = (eventName, data = {}, providers, options) => {
+const handleTag = (eventName, data = {}, providers, options, pluginSource) => {
     if (options === null || options === void 0 ? void 0 : options.destination) {
-        processTag(options.destination, eventName, data, providers, options).catch(logger.error);
+        processTag(options.destination, eventName, data, providers, options, pluginSource).catch(logger.error);
         return;
     }
     getInstances().forEach((instance) => {
-        processTag(instance, eventName, data, providers, options).catch(logger.error);
+        processTag(instance, eventName, data, providers, options, pluginSource).catch(logger.error);
     });
 };
-const hasAllowedManifestTags = (tags, consent, providersConfig) => {
-    for (const [pkg, tagNames] of tags) {
-        for (const tagName of tagNames) {
-            if (hasUserConsent(consent, pkg, tagName) &&
-                isProviderInstanceAllowed(providersConfig, pkg, tagName)) {
-                return true;
-            }
-        }
-    }
-    return false;
-};
 
 const processData = (destination, data, providers, options) => {
     saveKV(destination, data);
@@ -2558,6 +2633,7 @@ const handleInit = (preferences) => {
             configuratorSetting: result.configuratorSetting,
             userProperties: result.userProperties,
             ip: result.ip,
+            pluginScopes: result.pluginScopes,
         });
         if (result.storageId != null) {
             savePerKey(preferences.edgeURL, 'local', tagStorage, result.storageId, storageIdKey);

package/internal.d.ts

@@ -79,4 +79,5 @@ type InitResponse = {
     isNewCustomer: boolean | undefined
   }
   ip: string | null
+  pluginScopes?: Record<string, { scripts: string[]; providers: string[] }>
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blotoutio/edgetag-sdk-js",
-  "version": "1.58.0",
+  "version": "1.59.0",
   "description": "JS SDK for EdgeTag",
   "author": "Blotout",
   "license": "MIT",