@coframe/sdk 1.1.47 → 1.1.49

package/dist/pkg/server.cjs.js

@@ -1,5 +1,85 @@
 'use strict';
 
+const LAST_VISIT_TIME_KEY = 'coframe.lastVisitTime';
+const VISIT_COUNT_COOKIE_KEY = 'coframe.cvc';
+const LANE_COOKIE_KEY = 'coframe.lanes';
+function readCookieHeader(cookieHeader, name) {
+    if (!cookieHeader)
+        return undefined;
+    let value;
+    for (const part of cookieHeader.split(';')) {
+        const entry = part.trim();
+        const separator = entry.indexOf('=');
+        if (separator >= 0 && entry.slice(0, separator) === name) {
+            value = entry.slice(separator + 1);
+        }
+    }
+    return value;
+}
+function getGlobalScope() {
+    if (typeof globalThis !== 'undefined') {
+        return globalThis;
+    }
+    if (typeof window !== 'undefined') {
+        return window;
+    }
+    if (typeof self !== 'undefined') {
+        return self;
+    }
+}
+const generateUUID = () => {
+    var _a;
+    const cryptoObject = (_a = getGlobalScope()) === null || _a === void 0 ? void 0 : _a.crypto;
+    if (cryptoObject === null || cryptoObject === void 0 ? void 0 : cryptoObject.randomUUID)
+        return cryptoObject.randomUUID();
+    const randomByte = (cryptoObject === null || cryptoObject === void 0 ? void 0 : cryptoObject.getRandomValues)
+        ? () => cryptoObject.getRandomValues(new Uint8Array(1))[0]
+        : () => Math.floor(Math.random() * 256);
+    return `${1e7}${ -1e3}${ -4e3}${ -8e3}${ -1e11}`.replace(/[018]/g, (c) => {
+        const randomValue = randomByte();
+        return (c ^
+            (randomValue & (15 >> (c / 4)))).toString(16);
+    });
+};
+const VISIT_BOUNDARY_MS = 2 * 60 * 60 * 1000;
+function startsNewVisit(lastVisitTime, now) {
+    return !lastVisitTime || now - lastVisitTime > VISIT_BOUNDARY_MS;
+}
+function nextVisitCount(existing, lastVisitTime, now) {
+    return startsNewVisit(lastVisitTime, now) ? existing + 1 : existing;
+}
+function parseNonNegativeInt(raw) {
+    if (!raw || !/^\d+$/.test(raw))
+        return undefined;
+    const parsed = Number(raw);
+    return parsed <= 9007199254740991 ? parsed : undefined;
+}
+function parseVisitCount(raw) {
+    var _a;
+    return (_a = parseNonNegativeInt(raw)) !== null && _a !== void 0 ? _a : 0;
+}
+
+function isRecord(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+
+function inferBrowserPlatform(userAgent) {
+    const ua = userAgent !== null && userAgent !== void 0 ? userAgent : '';
+    if (/iphone/i.test(ua))
+        return 'iPhone';
+    if (/ipad/i.test(ua))
+        return 'iPad';
+    if (/android/i.test(ua))
+        return 'Linux armv8l';
+    if (/windows/i.test(ua))
+        return 'Win32';
+    if (/macintosh|mac os/i.test(ua))
+        return 'MacIntel';
+    if (/cros|linux/i.test(ua))
+        return 'Linux x86_64';
+    return '';
+}
+
 const MAX_USER_CONTEXT_JSON_BYTES = 4096;
 function userContextJsonByteLength(userContext) {
     try {
@@ -22,29 +102,152 @@ function sanitizeUserContext(userContext) {
     return userContext;
 }
 
-function getGlobalScope() {
-    if (typeof globalThis !== 'undefined') {
-        return globalThis;
-    }
-    if (typeof window !== 'undefined') {
-        return window;
+const ASSIGNMENT_FIELD_LIMITS = {
+    projectId: 200,
+    experimentId: 512,
+    userToken: 512,
+    currentUrl: 4096,
+    referrer: 4096,
+    userAgent: 2048,
+    browserPlatform: 128,
+    country: 8,
+    region: 128,
+    city: 256,
+    verifiedBotCategory: 128,
+    clientIp: 64,
+    languages: 20,
+    languageLength: 64,
+    botScoreMin: 1,
+    botScoreMax: 99,
+};
+const ASSIGNMENT_DEVICES = [
+    'desktop',
+    'mobile',
+    'tablet',
+];
+function isInvalidString(value, max) {
+    return (value !== undefined && (typeof value !== 'string' || value.length > max));
+}
+function isInvalidLanguages(value) {
+    return (value !== undefined &&
+        (!Array.isArray(value) ||
+            value.length > ASSIGNMENT_FIELD_LIMITS.languages ||
+            !value.every((language) => typeof language === 'string' &&
+                language.length <= ASSIGNMENT_FIELD_LIMITS.languageLength)));
+}
+function invalidUserContext(value) {
+    if (value === undefined)
+        return null;
+    if (!isRecord(value)) {
+        return { field: 'userContext', message: 'must be an object' };
     }
-    if (typeof self !== 'undefined') {
-        return self;
+    if (userContextJsonByteLength(value) > MAX_USER_CONTEXT_JSON_BYTES) {
+        return { field: 'userContext', message: 'is too large', tooLarge: true };
     }
+    return null;
 }
-const generateUUID = () => {
-    var _a;
-    const cryptoObject = (_a = getGlobalScope()) === null || _a === void 0 ? void 0 : _a.crypto;
-    if (cryptoObject === null || cryptoObject === void 0 ? void 0 : cryptoObject.randomUUID)
-        return cryptoObject.randomUUID();
-    return `${1e7}${ -1e3}${ -4e3}${ -8e3}${ -1e11}`.replace(/[018]/g, (c) => {
-        var _a, _b;
-        const randomValue = (_b = (_a = cryptoObject === null || cryptoObject === void 0 ? void 0 : cryptoObject.getRandomValues) === null || _a === void 0 ? void 0 : _a.call(cryptoObject, new Uint8Array(1))[0]) !== null && _b !== void 0 ? _b : 0;
-        return (c ^
-            (randomValue & (15 >> (c / 4)))).toString(16);
-    });
+const ASSIGNMENT_CONTEXT_HEADERS = {
+    userAgent: 'user-agent',
+    country: 'cf-ipcountry',
+    region: 'cf-region-code',
+    city: 'cf-ipcity',
+    device: 'cf-device-type',
+    botScore: 'cf-bot-score',
+    verifiedBotCategory: 'cf-verified-bot-category',
+    clientIp: 'cf-connecting-ip',
 };
+const HEADER_STRING_FIELDS = [
+    'userAgent',
+    'country',
+    'region',
+    'city',
+    'verifiedBotCategory',
+    'clientIp',
+];
+const CONTEXT_STRING_FIELDS = [
+    'referrer',
+    'userAgent',
+    'browserPlatform',
+    'country',
+    'region',
+    'city',
+    'verifiedBotCategory',
+    'clientIp',
+];
+function invalidAssignmentContextField(context) {
+    if (!isRecord(context)) {
+        return { field: 'context', message: 'must be an object' };
+    }
+    const { currentUrl } = context;
+    if (typeof currentUrl !== 'string' || !currentUrl) {
+        return { field: 'currentUrl', message: 'is required' };
+    }
+    if (currentUrl.length > ASSIGNMENT_FIELD_LIMITS.currentUrl) {
+        return {
+            field: 'currentUrl',
+            message: `must be at most ${ASSIGNMENT_FIELD_LIMITS.currentUrl} characters`,
+        };
+    }
+    try {
+        new URL(currentUrl);
+    }
+    catch (_a) {
+        return { field: 'currentUrl', message: 'must be an absolute URL' };
+    }
+    for (const field of CONTEXT_STRING_FIELDS) {
+        const max = ASSIGNMENT_FIELD_LIMITS[field];
+        if (isInvalidString(context[field], max)) {
+            return {
+                field,
+                message: `must be a string of at most ${max} characters`,
+            };
+        }
+    }
+    if (context.device !== undefined &&
+        !ASSIGNMENT_DEVICES.includes(context.device)) {
+        return { field: 'device', message: 'must be desktop, mobile, or tablet' };
+    }
+    const { botScore, languages, userVisitCount, userContext } = context;
+    if (botScore !== undefined &&
+        (!Number.isInteger(botScore) ||
+            botScore < ASSIGNMENT_FIELD_LIMITS.botScoreMin ||
+            botScore > ASSIGNMENT_FIELD_LIMITS.botScoreMax)) {
+        return {
+            field: 'botScore',
+            message: `must be an integer from ${ASSIGNMENT_FIELD_LIMITS.botScoreMin} to ${ASSIGNMENT_FIELD_LIMITS.botScoreMax}`,
+        };
+    }
+    if (isInvalidLanguages(languages)) {
+        return {
+            field: 'languages',
+            message: `must contain at most ${ASSIGNMENT_FIELD_LIMITS.languages} strings of ${ASSIGNMENT_FIELD_LIMITS.languageLength} characters`,
+        };
+    }
+    if (userVisitCount !== undefined &&
+        (!Number.isSafeInteger(userVisitCount) || userVisitCount < 0)) {
+        return {
+            field: 'userVisitCount',
+            message: 'must be a non-negative safe integer',
+        };
+    }
+    return invalidUserContext(userContext);
+}
+const ID_FIELDS = ['projectId', 'experimentId', 'userToken'];
+function invalidAssignmentIdField(body) {
+    for (const field of ID_FIELDS) {
+        const value = body[field];
+        if (typeof value !== 'string' || !value) {
+            return { field, message: 'is required' };
+        }
+        if (value.length > ASSIGNMENT_FIELD_LIMITS[field]) {
+            return {
+                field,
+                message: `must be at most ${ASSIGNMENT_FIELD_LIMITS[field]} characters`,
+            };
+        }
+    }
+    return null;
+}
 
 async function fetchProjectFromEdge(projectId, currentUrl, signal, userContext, previewVariantId, headers, referrer) {
     const payload = { projectId, currentUrl };
@@ -312,12 +515,189 @@ async function flushFeatureFlagEvents() {
     }
 }
 
+const DEFAULT_ASSIGNMENT_TIMEOUT_MS = 1500;
+function normalizeRequestHeaders(headers) {
+    const normalized = new Headers();
+    if (typeof (headers === null || headers === void 0 ? void 0 : headers.forEach) === 'function') {
+        headers.forEach((value, name) => {
+            normalized.set(name, value);
+        });
+        return normalized;
+    }
+    for (const [name, value] of Object.entries(headers !== null && headers !== void 0 ? headers : {})) {
+        const joined = typeof value === 'string'
+            ? value
+            : Array.isArray(value)
+                ? value.join(name.toLowerCase() === 'cookie' ? '; ' : ', ')
+                : undefined;
+        if (joined === undefined)
+            continue;
+        try {
+            normalized.set(name, joined);
+        }
+        catch (_a) { }
+    }
+    return normalized;
+}
+function createAssignmentHeaders(incoming) {
+    const headers = new Headers({ 'Content-Type': 'application/json' });
+    const laneCookie = readCookieHeader(incoming.get('cookie'), LANE_COOKIE_KEY);
+    if (laneCookie !== undefined) {
+        headers.set('cookie', `${LANE_COOKIE_KEY}=${laneCookie}`);
+    }
+    return headers;
+}
+function requestLanguages(headers) {
+    var _a;
+    const languages = ((_a = headers.get('accept-language')) !== null && _a !== void 0 ? _a : '')
+        .split(',')
+        .map((entry) => { var _a; return (_a = entry.split(';')[0]) === null || _a === void 0 ? void 0 : _a.trim(); })
+        .filter((entry) => !!entry && entry.length <= ASSIGNMENT_FIELD_LIMITS.languageLength)
+        .slice(0, ASSIGNMENT_FIELD_LIMITS.languages);
+    return languages.length > 0 ? languages : undefined;
+}
+function clampHeader(value, maxLength) {
+    if (!value)
+        return undefined;
+    return value.length > maxLength ? value.slice(0, maxLength) : value;
+}
+function headerStrings(options, incoming) {
+    var _a;
+    const values = {};
+    for (const field of HEADER_STRING_FIELDS) {
+        const value = (_a = options[field]) !== null && _a !== void 0 ? _a : clampHeader(incoming.get(ASSIGNMENT_CONTEXT_HEADERS[field]), ASSIGNMENT_FIELD_LIMITS[field]);
+        if (value)
+            values[field] = value;
+    }
+    return values;
+}
+function requestDevice(headers) {
+    var _a;
+    const device = (_a = headers.get(ASSIGNMENT_CONTEXT_HEADERS.device)) === null || _a === void 0 ? void 0 : _a.toLowerCase();
+    return ASSIGNMENT_DEVICES.includes(device)
+        ? device
+        : undefined;
+}
+function requestBotScore(headers) {
+    const score = parseNonNegativeInt(headers.get(ASSIGNMENT_CONTEXT_HEADERS.botScore));
+    return score !== undefined &&
+        score >= ASSIGNMENT_FIELD_LIMITS.botScoreMin &&
+        score <= ASSIGNMENT_FIELD_LIMITS.botScoreMax
+        ? score
+        : undefined;
+}
+function edgeBaseUrl(edgeUrl) {
+    return (edgeUrl || "https://edge.cofra.me").replace(/\/+$/, '');
+}
+function validateAssignmentContextOptions(options) {
+    const problem = invalidAssignmentContextField(options);
+    if (problem)
+        throw new Error(`${problem.field} ${problem.message}`);
+}
+function effectiveVisitCount(headers) {
+    const cookie = headers.get('cookie');
+    const existing = parseVisitCount(readCookieHeader(cookie, VISIT_COUNT_COOKIE_KEY));
+    const lastVisitTime = parseVisitCount(readCookieHeader(cookie, LAST_VISIT_TIME_KEY));
+    const next = nextVisitCount(existing, lastVisitTime, Date.now());
+    return Number.isSafeInteger(next) ? next : existing;
+}
+function isExperimentAssignmentResult(value, experimentId) {
+    if (!isRecord(value) || !isRecord(value.projectData))
+        return false;
+    const { projectData } = value;
+    const context = projectData.assignmentContext;
+    if (!isRecord(projectData.project) ||
+        !Array.isArray(projectData.project.frames) ||
+        !isRecord(projectData.personalizationHeaders) ||
+        !isRecord(context) ||
+        !Array.isArray(context.languages) ||
+        !context.languages.every((language) => typeof language === 'string') ||
+        typeof context.browserPlatform !== 'string' ||
+        !Number.isSafeInteger(context.userVisitCount) ||
+        context.userVisitCount < 0) {
+        return false;
+    }
+    if (value.variant === null) {
+        return typeof value.reason === 'string';
+    }
+    if (!isRecord(value.variant))
+        return false;
+    return (typeof value.variant.id === 'string' &&
+        typeof value.variant.slug === 'string' &&
+        value.variant.experimentId === experimentId &&
+        typeof value.variant.iterationId === 'string');
+}
+function generateUserToken() {
+    return generateUUID();
+}
+async function getExperimentAssignment(options) {
+    var _a, _b, _c, _d, _e, _f;
+    const idProblem = invalidAssignmentIdField(options);
+    if (idProblem)
+        throw new Error(`${idProblem.field} ${idProblem.message}`);
+    if (options.timeoutMs !== undefined &&
+        !(Number.isFinite(options.timeoutMs) && options.timeoutMs > 0)) {
+        throw new Error('timeoutMs must be a positive finite number');
+    }
+    validateAssignmentContextOptions(options);
+    const currentUrl = new URL(options.currentUrl);
+    if (/cf_disable/.test(currentUrl.search))
+        return undefined;
+    const incoming = normalizeRequestHeaders(options.headers);
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), (_a = options.timeoutMs) !== null && _a !== void 0 ? _a : DEFAULT_ASSIGNMENT_TIMEOUT_MS);
+    try {
+        const fromHeaders = headerStrings(options, incoming);
+        const languages = (_b = options.languages) !== null && _b !== void 0 ? _b : requestLanguages(incoming);
+        const browserPlatform = (_c = options.browserPlatform) !== null && _c !== void 0 ? _c : inferBrowserPlatform(fromHeaders.userAgent);
+        const device = (_d = options.device) !== null && _d !== void 0 ? _d : requestDevice(incoming);
+        const botScore = (_e = options.botScore) !== null && _e !== void 0 ? _e : requestBotScore(incoming);
+        const userVisitCount = (_f = options.userVisitCount) !== null && _f !== void 0 ? _f : effectiveVisitCount(incoming);
+        const referrer = options.referrer !== undefined
+            ? options.referrer
+            : clampHeader(incoming.get('referer'), ASSIGNMENT_FIELD_LIMITS.referrer);
+        const requestBody = {
+            projectId: options.projectId,
+            experimentId: options.experimentId,
+            userToken: options.userToken,
+            context: {
+                currentUrl: options.currentUrl,
+                ...(referrer !== undefined ? { referrer } : {}),
+                ...(options.userContext ? { userContext: options.userContext } : {}),
+                ...fromHeaders,
+                ...(languages !== undefined ? { languages } : {}),
+                ...(browserPlatform !== undefined ? { browserPlatform } : {}),
+                ...(device ? { device } : {}),
+                ...(botScore !== undefined ? { botScore } : {}),
+                userVisitCount,
+            },
+        };
+        const response = await fetch(`${edgeBaseUrl(options.edgeUrl)}/api/v1/assignment`, {
+            method: 'POST',
+            headers: createAssignmentHeaders(incoming),
+            signal: controller.signal,
+            body: JSON.stringify(requestBody),
+        });
+        if (!response.ok)
+            return undefined;
+        const result = await response.json();
+        return isExperimentAssignmentResult(result, options.experimentId)
+            ? result
+            : undefined;
+    }
+    catch (_g) {
+        return undefined;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
 async function requestFeatureFlags(options) {
-    var _a, _b;
+    var _a;
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), (_a = options.requestTimeoutMs) !== null && _a !== void 0 ? _a : 3000);
     try {
-        const response = await fetch(`${(_b = options.edgeUrl) !== null && _b !== void 0 ? _b : "https://edge.cofra.me"}/api/v1/flags?v=1`, {
+        const response = await fetch(`${edgeBaseUrl(options.edgeUrl)}/api/v1/flags?v=1`, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
@@ -345,7 +725,7 @@ async function requestFeatureFlags(options) {
             return undefined;
         return (await response.json());
     }
-    catch (_c) {
+    catch (_b) {
         return undefined;
     }
     finally {
@@ -389,19 +769,6 @@ async function getFeatureFlagPayload(key, options) {
     return 'payload' in result ? ((_a = result.payload) !== null && _a !== void 0 ? _a : null) : null;
 }
 const getRemoteConfig = getFeatureFlagPayload;
-function getRequestReferrer(headers) {
-    const get = headers.get;
-    if (typeof get === 'function') {
-        const value = get.call(headers, 'referer');
-        return typeof value === 'string' ? value : undefined;
-    }
-    for (const [key, value] of Object.entries(headers)) {
-        if (key.toLowerCase() === 'referer') {
-            return typeof value === 'string' ? value : undefined;
-        }
-    }
-    return undefined;
-}
 async function fetchAntiflickerFromEdge(projectId, currentUrl, referrer, userContext, antiflickerMode, headers) {
     try {
         const payload = { projectId, currentUrl };
@@ -429,23 +796,24 @@ async function fetchAntiflickerFromEdge(projectId, currentUrl, referrer, userCon
     }
 }
 async function getProjectData(options) {
-    var _a;
+    var _a, _b;
     try {
         if (/cf_disable/.test(new URL(options.currentUrl).search)) {
             return null;
         }
     }
-    catch (_b) {
+    catch (_c) {
     }
     const includeProject = options.includeProject !== false;
     const includeCSS = options.includeCSS !== false;
-    const referrer = (_a = options.referrer) !== null && _a !== void 0 ? _a : getRequestReferrer(options.headers);
+    const headers = normalizeRequestHeaders(options.headers);
+    const referrer = (_b = (_a = options.referrer) !== null && _a !== void 0 ? _a : headers.get('referer')) !== null && _b !== void 0 ? _b : undefined;
     const [projectResult, antiflickerCSS] = await Promise.all([
         includeProject
-            ? fetchProjectFromEdge(options.projectId, options.currentUrl, undefined, options.userContext, undefined, options.headers, referrer)
+            ? fetchProjectFromEdge(options.projectId, options.currentUrl, undefined, options.userContext, undefined, headers, referrer)
             : Promise.resolve(null),
         includeCSS
-            ? fetchAntiflickerFromEdge(options.projectId, options.currentUrl, referrer, options.userContext, options.antiflickerMode, options.headers)
+            ? fetchAntiflickerFromEdge(options.projectId, options.currentUrl, referrer, options.userContext, options.antiflickerMode, headers)
             : Promise.resolve(null),
     ]);
     const config = {};
@@ -467,6 +835,8 @@ async function getProjectData(options) {
 
 exports.evaluateFlags = evaluateFlags;
 exports.flushFeatureFlagEvents = flushFeatureFlagEvents;
+exports.generateUserToken = generateUserToken;
+exports.getExperimentAssignment = getExperimentAssignment;
 exports.getFeatureFlag = getFeatureFlag;
 exports.getFeatureFlagPayload = getFeatureFlagPayload;
 exports.getFeatureFlagResult = getFeatureFlagResult;