@gradial/aci 0.1.40 → 0.1.42

package/dist/edge/personalization-core.js

@@ -0,0 +1,265 @@
+// Runtime-neutral personalization selection. Vercel imports this module and
+// the CloudFront Terraform wrapper inlines the same source into its function.
+// Keep this file free of platform APIs and dependencies.
+export function selectPersonalizationVariant(request, route, claims, experiments, identity) {
+    return resolvePersonalizationDecision(request, route, claims, experiments, identity).variant;
+}
+export function resolvePersonalizationDecision(request, route, claims, experiments, identity) {
+    if (!route)
+        return { variant: null, experiment: null };
+    let variant = selectRuleVariant(request, route, claims);
+    let experiment = null;
+    if (identity && identity.usable && route.variants && experiments) {
+        const candidates = Object.values(experiments)
+            .filter((item) => (item.kind === 'ab' || item.kind === 'abn') && item.status === 'running')
+            .filter((item) => routeHasExperiment(route, item.id))
+            .sort((left, right) => (right.priority || 0) - (left.priority || 0)
+            || String(left.id || '').localeCompare(String(right.id || '')));
+        for (let index = 0; index < candidates.length; index++) {
+            const item = candidates[index];
+            const assignment = assignExperiment(item, identity);
+            const candidate = assignment && route.variants[assignment.variantKey];
+            if (!candidate)
+                continue;
+            if (!variant || betterVariant(candidate.priority || 0, candidate.variantKey, variant.priority || 0, variant.variantKey)) {
+                variant = candidate;
+                experiment = assignment;
+            }
+            break;
+        }
+    }
+    return { variant: variant || null, experiment };
+}
+function selectRuleVariant(request, route, claims) {
+    if (!route.variants)
+        return null;
+    const matches = [];
+    for (const key in route.variants) {
+        const variant = route.variants[key];
+        const values = variant.variantValues || variantValuesFromKey(key);
+        if (!requestDimensionsMatch(request, values))
+            continue;
+        const membershipMatch = (values.audience && claims && (claims.aud || []).includes(values.audience))
+            || (values.segment && claims && (claims.seg || []).includes(values.segment));
+        const ruleMatch = variant.rule ? evaluateRule(request, variant.rule) : false;
+        if (membershipMatch || ruleMatch)
+            matches.push(variant);
+    }
+    matches.sort((left, right) => (right.priority || 0) - (left.priority || 0)
+        || String(left.variantKey || '').localeCompare(String(right.variantKey || '')));
+    return matches[0] || null;
+}
+// CloudFront KVS values are capped at 1 KiB. The variant map key is the
+// canonical encoding of its dimensions, so compact route records omit the
+// duplicated variantValues object and recover it at the edge.
+function variantValuesFromKey(key) {
+    const values = {};
+    const parts = String(key || '').replace(/&/g, ';').split(';');
+    for (let index = 0; index < parts.length; index++) {
+        const separator = parts[index].indexOf('=');
+        if (separator > 0)
+            values[parts[index].slice(0, separator)] = parts[index].slice(separator + 1);
+    }
+    return values;
+}
+function routeHasExperiment(route, experimentID) {
+    for (const key in route.variants || {}) {
+        const values = route.variants[key].variantValues || variantValuesFromKey(key);
+        if (values.experiment === experimentID)
+            return true;
+    }
+    return false;
+}
+function assignExperiment(experiment, identity) {
+    const version = String(experiment.allocationVersion || '').trim();
+    const salt = String(experiment.salt || '').trim();
+    const siteID = String(identity.siteId || '').trim();
+    const identityKey = `${String(identity.namespace || '').trim()}:${String(identity.identityHash || '').trim()}`;
+    if (!version || !salt || !siteID || identityKey === ':')
+        return null;
+    const input = [siteID, String(experiment.id || ''), version, identityKey, salt].join('\0');
+    const bucket = sha256Bucket(input);
+    let cumulative = 0;
+    const arms = experiment.arms || [];
+    for (let index = 0; index < arms.length; index++) {
+        const arm = arms[index];
+        if ((arm.allocationBasisPoints || 0) <= 0)
+            continue;
+        cumulative += arm.allocationBasisPoints;
+        if (bucket < cumulative) {
+            return {
+                experimentId: experiment.id,
+                armId: arm.id,
+                allocationVersion: version,
+                variantKey: arm.variantKey,
+                bucket,
+            };
+        }
+    }
+    return null;
+}
+function betterVariant(candidatePriority, candidateKey, bestPriority, bestKey) {
+    if (candidatePriority !== bestPriority)
+        return candidatePriority > bestPriority;
+    return String(candidateKey || '').localeCompare(String(bestKey || '')) < 0;
+}
+function requestDimensionsMatch(request, values) {
+    for (const rawKey in values) {
+        const rawWant = values[rawKey];
+        const key = String(rawKey).trim();
+        const normalized = key.toLowerCase();
+        const want = String(rawWant).trim();
+        if (!key || !want || ['audience', 'segment', 'experiment', 'experimentarm'].includes(normalized))
+            continue;
+        const candidates = (request.query[key] || []).concat(request.query['aci_' + key] || [], request.headers['x-aci-' + normalized] || '', request.headers['x-gradial-' + normalized] || '', request.cookies[key] || '', request.cookies['aci_' + key] || '');
+        if (normalized === 'locale') {
+            const locales = String(request.headers['accept-language'] || '')
+                .split(',').map((part) => part.split(';')[0].trim()).filter(Boolean);
+            for (let localeIndex = 0; localeIndex < locales.length; localeIndex++)
+                candidates.push(locales[localeIndex]);
+        }
+        if (!candidates.some((candidate) => normalized === 'locale'
+            ? String(candidate).toLowerCase() === want.toLowerCase()
+            : String(candidate) === want))
+            return false;
+    }
+    return true;
+}
+function evaluateRule(request, rule) {
+    const all = rule.all || [];
+    const any = rule.any || [];
+    if (all.length + any.length === 0)
+        return false;
+    return all.every((condition) => evaluateCondition(request, condition))
+        && (any.length === 0 || any.some((condition) => evaluateCondition(request, condition)));
+}
+function evaluateCondition(request, condition) {
+    const values = signalValues(request, condition.field);
+    if (condition.operator === 'exists')
+        return values.length > 0;
+    if (values.length === 0 || !['string', 'number', 'boolean'].includes(typeof condition.value))
+        return false;
+    const expected = String(condition.value);
+    return values.some((value) => {
+        switch (condition.operator) {
+            case 'equals': return value === expected;
+            case 'contains': return value.includes(expected);
+            case 'startsWith': return value.startsWith(expected);
+            default: return false;
+        }
+    });
+}
+function signalValues(request, field) {
+    if (field.startsWith('query.'))
+        return request.query[field.slice(6)] || [];
+    if (field.startsWith('header.'))
+        return request.headers[field.slice(7).toLowerCase()] ? [request.headers[field.slice(7).toLowerCase()]] : [];
+    if (field.startsWith('cookie.'))
+        return request.cookies[field.slice(7)] ? [request.cookies[field.slice(7)]] : [];
+    if (field.startsWith('utm.'))
+        return request.query['utm_' + field.slice(4)] || [];
+    if (field.startsWith('geo.')) {
+        const geo = request.signals && request.signals.geo;
+        const value = geo && geo[field.slice(4).toLowerCase()];
+        return value ? [value] : [];
+    }
+    if (field === 'referrer') {
+        const value = request.headers.referer || request.headers.referrer;
+        return value ? [value] : [];
+    }
+    return [];
+}
+// SHA-256 mirrors experiment.assignment.go: the first eight digest bytes are
+// interpreted big-endian and reduced modulo 10,000 basis points.
+// CLOUDFRONT_STRIP_START — the build script removes this block for CloudFront
+// Functions (experiment bucketing moves to the hosting Lambda to stay under
+// the 10 KiB function size limit).
+function sha256Bucket(value) {
+    const bytes = utf8(value);
+    const words = new Uint32Array(64);
+    const bitLength = bytes.length * 8;
+    const paddedLength = ((bytes.length + 9 + 63) >> 6) << 6;
+    const data = new Uint8Array(paddedLength);
+    data.set(bytes);
+    data[bytes.length] = 128;
+    // The message length is a 64-bit big-endian integer across the final
+    // eight bytes. The previous code wrote a single truncated byte into each
+    // word's most significant position, corrupting every digest (caught by
+    // the assignment parity vectors, spec experiment-variant-caching REQ-9).
+    const bitsHigh = Math.floor(bitLength / 0x100000000);
+    const bitsLow = bitLength >>> 0;
+    data[paddedLength - 8] = (bitsHigh >>> 24) & 255;
+    data[paddedLength - 7] = (bitsHigh >>> 16) & 255;
+    data[paddedLength - 6] = (bitsHigh >>> 8) & 255;
+    data[paddedLength - 5] = bitsHigh & 255;
+    data[paddedLength - 4] = (bitsLow >>> 24) & 255;
+    data[paddedLength - 3] = (bitsLow >>> 16) & 255;
+    data[paddedLength - 2] = (bitsLow >>> 8) & 255;
+    data[paddedLength - 1] = bitsLow & 255;
+    let a = 0x6a09e667, b = 0xbb67ae85, c = 0x3c6ef372, d = 0xa54ff53a;
+    let e = 0x510e527f, f = 0x9b05688c, g = 0x1f83d9ab, h = 0x5be0cd19;
+    const k = [0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070, 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2];
+    for (let offset = 0; offset < paddedLength; offset += 64) {
+        for (let i = 0; i < 16; i++) {
+            const p = offset + i * 4;
+            words[i] = (data[p] << 24) | (data[p + 1] << 16) | (data[p + 2] << 8) | data[p + 3];
+        }
+        for (let i = 16; i < 64; i++) {
+            const x = words[i - 15], y = words[i - 2];
+            words[i] = (words[i - 16] + (rotr(x, 7) ^ rotr(x, 18) ^ (x >>> 3)) + words[i - 7] + (rotr(y, 17) ^ rotr(y, 19) ^ (y >>> 10))) >>> 0;
+        }
+        let aa = a, bb = b, cc = c, dd = d, ee = e, ff = f, gg = g, hh = h;
+        for (let i = 0; i < 64; i++) {
+            const s1 = rotr(ee, 6) ^ rotr(ee, 11) ^ rotr(ee, 25);
+            const ch = (ee & ff) ^ (~ee & gg);
+            const t1 = (hh + s1 + ch + k[i] + words[i]) >>> 0;
+            const s0 = rotr(aa, 2) ^ rotr(aa, 13) ^ rotr(aa, 22);
+            const maj = (aa & bb) ^ (aa & cc) ^ (bb & cc);
+            const t2 = (s0 + maj) >>> 0;
+            hh = gg;
+            gg = ff;
+            ff = ee;
+            ee = (dd + t1) >>> 0;
+            dd = cc;
+            cc = bb;
+            bb = aa;
+            aa = (t1 + t2) >>> 0;
+        }
+        a = (a + aa) >>> 0;
+        b = (b + bb) >>> 0;
+        c = (c + cc) >>> 0;
+        d = (d + dd) >>> 0;
+        e = (e + ee) >>> 0;
+        f = (f + ff) >>> 0;
+        g = (g + gg) >>> 0;
+        h = (h + hh) >>> 0;
+    }
+    // Reduce the 64-bit big-endian value modulo 10000 in 32-bit halves:
+    // (hi*2^32 + lo) % 10000 == ((hi%10000) * (2^32 % 10000) + lo%10000) % 10000,
+    // and 2^32 % 10000 = 7296. Multiplying hi by 2^32 directly exceeds
+    // Number.MAX_SAFE_INTEGER and rounds away the low bits — that float error
+    // made most JS buckets diverge from assignment.go (caught by the
+    // assignment parity vectors, spec experiment-variant-caching REQ-9).
+    return (((a >>> 0) % 10000) * 7296 + ((b >>> 0) % 10000)) % 10000;
+}
+function rotr(value, amount) { return (value >>> amount) | (value << (32 - amount)); }
+function utf8(value) {
+    const out = [];
+    for (let i = 0; i < value.length; i++) {
+        let code = value.charCodeAt(i);
+        if (code >= 0xd800 && code <= 0xdbff && i + 1 < value.length) {
+            const next = value.charCodeAt(++i);
+            code = 0x10000 + ((code - 0xd800) << 10) + (next - 0xdc00);
+        }
+        if (code < 0x80)
+            out.push(code);
+        else if (code < 0x800)
+            out.push(0xc0 | (code >> 6), 0x80 | (code & 63));
+        else if (code < 0x10000)
+            out.push(0xe0 | (code >> 12), 0x80 | ((code >> 6) & 63), 0x80 | (code & 63));
+        else
+            out.push(0xf0 | (code >> 18), 0x80 | ((code >> 12) & 63), 0x80 | ((code >> 6) & 63), 0x80 | (code & 63));
+    }
+    return new Uint8Array(out);
+}
+// CLOUDFRONT_STRIP_END

package/dist/next/assignments-script.d.ts

@@ -0,0 +1,14 @@
+import { type AssignmentsPayloadSource } from '../content/personalization.js';
+export interface AssignmentsScriptProps {
+    page: AssignmentsPayloadSource | null | undefined;
+}
+/**
+ * AssignmentsScript renders the page-level experiment assignment tag
+ * (`<script type="application/json" data-aci-assignments>` with a
+ * {"v":1,"experiments":[…]} body, personalization-reporting design/04) when
+ * the page payload carries a build-time `experiments` block, and nothing
+ * otherwise. createPage appends it to the page tree exactly once per page;
+ * sites composing their own pages can render it directly. The JSON body is
+ * HTML-safe (assignmentsScriptJSON \u-escapes angle brackets).
+ */
+export declare function AssignmentsScript({ page }: AssignmentsScriptProps): import("react").JSX.Element | null;

package/dist/next/assignments-script.js

@@ -0,0 +1,17 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { assignmentsScriptJSON, } from '../content/personalization.js';
+/**
+ * AssignmentsScript renders the page-level experiment assignment tag
+ * (`<script type="application/json" data-aci-assignments>` with a
+ * {"v":1,"experiments":[…]} body, personalization-reporting design/04) when
+ * the page payload carries a build-time `experiments` block, and nothing
+ * otherwise. createPage appends it to the page tree exactly once per page;
+ * sites composing their own pages can render it directly. The JSON body is
+ * HTML-safe (assignmentsScriptJSON \u-escapes angle brackets).
+ */
+export function AssignmentsScript({ page }) {
+    const json = assignmentsScriptJSON(page);
+    if (!json)
+        return null;
+    return (_jsx("script", { type: "application/json", "data-aci-assignments": "", dangerouslySetInnerHTML: { __html: json } }));
+}

package/dist/next/collect-route.d.ts

@@ -0,0 +1,19 @@
+import { type IdentitySigningKeys, type PersonalizationBlobStore } from './personalization-host.js';
+export interface PersonalizationCollectRouteConfig {
+    siteId: string;
+    store: PersonalizationBlobStore;
+    identityKeys: IdentitySigningKeys;
+    /**
+     * Claims verify keys (kid -> secret) for withdrawal EVIDENCE
+     * (anonymous-experiments REQ-6): suppression fires only when the request
+     * presents a signature-verified aci_claims cookie — presence alone is
+     * spoofable, and under universal minting an unverified trigger would
+     * suppress every reject-all visitor. Empty = evidence never verifies =
+     * suppression disabled (fails safe).
+     */
+    claimsKeys?: Record<string, string>;
+    retentionSeconds?: number;
+    secureCookies?: boolean;
+    now?: () => Date;
+}
+export declare function createPersonalizationCollectRoute(config: PersonalizationCollectRouteConfig): (request: Request) => Promise<Response>;

package/dist/next/collect-route.js

@@ -0,0 +1,351 @@
+import { MAX_BATCH_EVENTS } from '../collect/batcher.js';
+import { consentSignals, identityHashHex, parseCookieHeader, verifyClaims, verifyIdentityCookie, } from './personalization-host.js';
+const MAX_COLLECT_BODY_BYTES = 64 * 1024;
+const DEFAULT_RETENTION_SECONDS = 13 * 30 * 24 * 60 * 60;
+const FORBIDDEN_FIELDS = new Set(['aciid', 'audienceids', 'segmentids', 'traits', 'identity']);
+const ULID = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/i;
+const UTM_KEYS = ['source', 'medium', 'campaign', 'term', 'content', 'id'];
+function identityHashShard(identityHash) {
+    const hash = identityHash.trim().toLowerCase();
+    if (hash.length < 2)
+        throw new Error('identity hash is too short');
+    return hash.slice(0, 2);
+}
+export function createPersonalizationCollectRoute(config) {
+    return async function collect(request) {
+        if (request.method === 'OPTIONS')
+            return new Response(null, { status: 204 });
+        if (request.method !== 'POST')
+            return new Response(null, { status: 405, headers: { allow: 'POST, OPTIONS' } });
+        const bytes = new Uint8Array(await request.arrayBuffer());
+        if (bytes.byteLength > MAX_COLLECT_BODY_BYTES)
+            return new Response(null, { status: 413 });
+        let events;
+        try {
+            const envelope = bytes.byteLength === 0 ? { events: [] } : JSON.parse(new TextDecoder().decode(bytes));
+            if (!Array.isArray(envelope.events))
+                throw new CollectValidationError('events must be an array');
+            // The TS runtime has no cross-instance quota checker (Go's REQ-14/
+            // REQ-20 guard); the 64KiB body cap plus this per-batch event cap and
+            // the platform WAF are the abuse bounds. The cap is the client
+            // batcher's MAX_BATCH_EVENTS — one constant, both sides of the wire.
+            if (envelope.events.length > MAX_BATCH_EVENTS)
+                throw new CollectValidationError('too many events in one batch');
+            events = envelope.events;
+            for (const event of events)
+                validateEvent(event);
+        }
+        catch (error) {
+            return validationResponse(error);
+        }
+        const cookies = parseCookieHeader(request.headers.get('cookie'));
+        const signals = consentSignals(request, cookies);
+        const rawIdentity = await verifyIdentityCookie(cookies.get('aci_id') || '', config.identityKeys);
+        const now = (config.now ?? (() => new Date()))();
+        const secure = config.secureCookies ?? new URL(request.url).protocol === 'https:';
+        const responseHeaders = new Headers({ 'cache-control': 'no-store', 'content-type': 'application/json' });
+        try {
+            // Withdrawal EVIDENCE (anonymous-experiments REQ-6): a signature-
+            // verified aci_claims cookie proves prior identity-tier state exists
+            // to suppress. Never-consented visitors present no verifiable claims
+            // and stay measurement-only.
+            const evidence = rawIdentity
+                ? await verifyClaims(cookies.get('aci_claims') || '', config.claimsKeys || {}, now) !== null
+                : false;
+            const putSuppression = async (trigger) => {
+                const hash = await identityHashHex('aci_id', rawIdentity);
+                await config.store.putSuppression(`audience/suppression/${identityHashShard(hash)}/${config.siteId}/aci_id/${hash}/${trigger}.json`, { schemaVersion: 1, trigger, observedAt: now.toISOString() });
+            };
+            if (signals.privacyDenied) {
+                if (rawIdentity && evidence) {
+                    await putSuppression('gpc');
+                }
+                if (cookies.has('aci_claims'))
+                    appendCookie(responseHeaders, expiredClaimsCookie(secure));
+                return accepted(responseHeaders);
+            }
+            if (!rawIdentity)
+                return accepted(responseHeaders);
+            // Measurement tier (anonymous-experiments REQ-5): a verified aci_id
+            // stores events even without a personalization grant — the snapshot
+            // records what was (not) granted. An explicit denial with verified
+            // evidence is an observed withdrawal; measurement storage continues.
+            const personalization = signals.allowsIdentityTier;
+            if (!personalization && signals.hasConsent && evidence) {
+                await putSuppression('withdrawal');
+            }
+            const identityHash = await identityHashHex('aci_id', rawIdentity);
+            for (const event of events) {
+                const normalized = normalizeEvent(event, now);
+                const collectedAt = now.toISOString();
+                const expiresAt = new Date(now.getTime() + (config.retentionSeconds ?? DEFAULT_RETENTION_SECONDS) * 1000).toISOString();
+                const key = `audience/first-party/${identityHashShard(identityHash)}/${config.siteId}/aci_id/${identityHash}/${normalized.eventId}.json`;
+                await config.store.appendEvent(key, {
+                    schemaVersion: 1,
+                    eventId: normalized.eventId,
+                    eventName: normalized.eventName,
+                    eventCategory: normalized.eventCategory,
+                    siteId: config.siteId,
+                    identity: { namespace: 'aci_id', hash: identityHash },
+                    // Go decodes `t` as time.Time and CANNOT parse an empty string —
+                    // an empty-t record permanently poisons that identity's
+                    // classification and DSAR reads. Omit t unless a real timestamp
+                    // was observed (legacy bare tokens have none).
+                    consent: signals.snapshot
+                        ? {
+                            v: signals.snapshot.version,
+                            p: signals.snapshot.purposes,
+                            ...(signals.snapshot.grantedAt ? { t: signals.snapshot.grantedAt } : {}),
+                            ...(signals.snapshot.source ? { src: signals.snapshot.source } : {}),
+                        }
+                        : { v: 0, p: [] },
+                    ...(normalized.properties ? { properties: normalized.properties } : {}),
+                    page: normalized.page,
+                    ...(normalized.utm ? { utm: normalized.utm } : {}),
+                    ...(normalized.viewport ? { viewport: normalized.viewport } : {}),
+                    ...(normalized.experiment ? { experiment: normalized.experiment } : {}),
+                    occurredAt: normalized.occurredAt,
+                    collectedAt,
+                    expiresAt,
+                });
+            }
+            if (personalization) {
+                const claims = await config.store.readClaims(config.siteId, 'aci_id', identityHash);
+                if (claims)
+                    appendCookie(responseHeaders, claimsCookie(claims, secure));
+                else if (cookies.has('aci_claims'))
+                    appendCookie(responseHeaders, expiredClaimsCookie(secure));
+            }
+            else if (cookies.has('aci_claims')) {
+                // Claims are personalization; a non-granting touch expires them.
+                appendCookie(responseHeaders, expiredClaimsCookie(secure));
+            }
+            return accepted(responseHeaders);
+        }
+        catch {
+            return Response.json({ error: 'internal error', status: 500 }, { status: 500, headers: { 'cache-control': 'no-store' } });
+        }
+    };
+}
+function validateEvent(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new CollectValidationError('event must be an object');
+    for (const key of Object.keys(value)) {
+        if (FORBIDDEN_FIELDS.has(key.toLowerCase()))
+            throw new CollectValidationError(`field ${key} is not allowed on the public collect route`);
+    }
+    if (typeof value.eventId !== 'string' || !ULID.test(value.eventId.trim()))
+        throw new CollectValidationError('eventId must be a valid ULID');
+    if (typeof value.eventName !== 'string')
+        throw new CollectValidationError('event name is required');
+    normalizeEventName(value.eventName);
+    for (const field of ['url', 'referrer', 'title', 'path']) {
+        if (value[field] !== undefined && typeof value[field] !== 'string')
+            throw new CollectValidationError(`${field} must be a string`);
+    }
+    if (value.properties !== undefined && (!value.properties || typeof value.properties !== 'object' || Array.isArray(value.properties))) {
+        throw new CollectValidationError('properties must be an object');
+    }
+    if (value.properties !== undefined)
+        sanitizeProperties(value.properties, 'properties', 0);
+    if (value.occurredAt !== undefined && (typeof value.occurredAt !== 'string' || Number.isNaN(Date.parse(value.occurredAt)))) {
+        throw new CollectValidationError('occurredAt must be an RFC3339 timestamp');
+    }
+    if (value.utm !== undefined && (!value.utm || typeof value.utm !== 'object' || Array.isArray(value.utm))) {
+        throw new CollectValidationError('utm must be an object');
+    }
+    normalizeViewport(value.viewport);
+    normalizeExperiment(value.experiment);
+}
+function normalizeEvent(event, now) {
+    const [eventName, eventCategory] = normalizeEventName(String(event.eventName));
+    const rawURL = typeof event.url === 'string' ? event.url.trim() : '';
+    const pageURL = sanitizeURL(rawURL, 'url');
+    const referrer = sanitizeURL(typeof event.referrer === 'string' ? event.referrer.trim() : '', 'referrer');
+    const parsedURL = rawURL ? new URL(rawURL, 'https://aci.invalid') : null;
+    let path = typeof event.path === 'string' ? event.path.trim() : parsedURL?.pathname || '';
+    if (path && !path.startsWith('/'))
+        path = `/${path}`;
+    const utm = normalizeUTM(event.utm, parsedURL);
+    const occurredAt = typeof event.occurredAt === 'string' && !Number.isNaN(Date.parse(event.occurredAt))
+        ? new Date(event.occurredAt).toISOString()
+        : now.toISOString();
+    return {
+        eventId: String(event.eventId).trim().toUpperCase(),
+        eventName,
+        eventCategory,
+        occurredAt,
+        properties: event.properties === undefined ? undefined : sanitizeProperties(event.properties, 'properties', 0),
+        page: {
+            ...(pageURL ? { url: pageURL } : {}),
+            ...(referrer ? { referrer } : {}),
+            ...(typeof event.title === 'string' && event.title.trim() ? { title: event.title.trim() } : {}),
+            ...(path ? { path } : {}),
+        },
+        utm,
+        viewport: normalizeViewport(event.viewport),
+        experiment: normalizeExperiment(event.experiment),
+    };
+}
+function normalizeEventName(value) {
+    const name = value.trim().toLowerCase();
+    if (!name || name.length > 128 || /[\s/\\]/.test(name))
+        throw new CollectValidationError('event name must be dot-delimited');
+    const rum = new Set(['rum.page_view', 'rum.link_click', 'rum.variation_view', 'rum.web_vital']);
+    const experiment = new Set(['experiment.exposure', 'experiment.conversion', 'experiment.engagement']);
+    if (rum.has(name))
+        return [name, 'rum'];
+    if (experiment.has(name))
+        return [name, 'experiment'];
+    if (name.startsWith('custom.') && name.length > 'custom.'.length)
+        return [name, 'custom'];
+    throw new CollectValidationError('event name must be one of the supported rum.* or experiment.* events, or use the custom.* namespace');
+}
+function sanitizeURL(value, field) {
+    if (!value)
+        return '';
+    if (value.length > 2048)
+        throw new CollectValidationError(`${field} is too long`);
+    let parsed;
+    try {
+        parsed = new URL(value, 'https://aci.invalid');
+    }
+    catch {
+        throw new CollectValidationError(`${field} is invalid`);
+    }
+    if (!['http:', 'https:'].includes(parsed.protocol))
+        throw new CollectValidationError(`${field} scheme is not allowed`);
+    parsed.search = '';
+    parsed.hash = '';
+    if (parsed.origin === 'https://aci.invalid')
+        return parsed.pathname;
+    return parsed.toString().replace(/\/$/, parsed.pathname === '/' ? '/' : '');
+}
+function normalizeUTM(value, url) {
+    const source = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+    const out = {};
+    for (const key of UTM_KEYS) {
+        const raw = source[key] ?? source[`utm_${key}`] ?? url?.searchParams.get(`utm_${key}`);
+        if (typeof raw === 'string' && raw.trim())
+            out[key] = raw.trim();
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}
+function sanitizeProperties(value, field, depth) {
+    if (depth > 4)
+        throw new CollectValidationError(`${field} is nested too deeply`);
+    if (value === null || typeof value === 'boolean' || typeof value === 'number')
+        return value;
+    if (typeof value === 'string')
+        return sanitizeString(value, field, 2048);
+    if (Array.isArray(value)) {
+        if (value.length > 32)
+            throw new CollectValidationError(`${field} has too many values`);
+        return value.map((item, index) => sanitizeProperties(item, `${field}[${index}]`, depth + 1));
+    }
+    if (typeof value !== 'object')
+        throw new CollectValidationError(`${field} has unsupported value type`);
+    const entries = Object.entries(value);
+    if (entries.length > 64)
+        throw new CollectValidationError(`${field} has too many keys`);
+    const sanitized = {};
+    for (const [rawKey, item] of entries) {
+        const key = sanitizeString(rawKey, `${field} key`, 256);
+        if (!key)
+            throw new CollectValidationError(`${field} contains an empty key`);
+        if (secretLikeKey(key))
+            throw new CollectValidationError(`${field} contains a sensitive key`);
+        sanitized[key] = sanitizeProperties(item, `${field}.${key}`, depth + 1);
+    }
+    return sanitized;
+}
+function secretLikeKey(key) {
+    const normalized = key.toLowerCase().replace(/[-. ]/g, '_');
+    const compact = normalized.replace(/_/g, '');
+    const normalizedMarkers = [
+        'authorization', 'access_token', 'refresh_token', 'id_token', 'api_key',
+        'private_key', 'secret', 'password', 'passwd', 'credential', 'cookie', 'set_cookie',
+    ];
+    const compactMarkers = [
+        'authorization', 'accesstoken', 'refreshtoken', 'idtoken', 'apikey',
+        'privatekey', 'secret', 'password', 'passwd', 'credential', 'cookie', 'setcookie',
+    ];
+    return normalizedMarkers.some((marker) => normalized.includes(marker))
+        || compactMarkers.some((marker) => compact.includes(marker));
+}
+function sanitizeString(value, field, limit) {
+    const clean = value.trim();
+    if (clean.length > limit)
+        throw new CollectValidationError(`${field} is too long`);
+    if (/[\u0000-\u001F\u007F-\u009F]/u.test(clean))
+        throw new CollectValidationError(`${field} contains control characters`);
+    return clean;
+}
+function normalizeViewport(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value !== 'object' || Array.isArray(value))
+        throw new CollectValidationError('viewport is invalid');
+    const viewport = value;
+    const width = viewport.width ?? 0;
+    const height = viewport.height ?? 0;
+    if (!Number.isInteger(width) || !Number.isInteger(height) || Number(width) < 0 || Number(height) < 0 || Number(width) > 20_000 || Number(height) > 20_000) {
+        throw new CollectValidationError('viewport is invalid');
+    }
+    if (width === 0 && height === 0)
+        return undefined;
+    return { width: Number(width), height: Number(height) };
+}
+function normalizeExperiment(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value !== 'object' || Array.isArray(value))
+        throw new CollectValidationError('experiment is invalid');
+    const source = value;
+    const experimentId = shortOptionalString(source.experimentId, 'experiment.experimentId');
+    const armId = shortOptionalString(source.armId, 'experiment.armId');
+    const allocationVersion = shortOptionalString(source.allocationVersion, 'experiment.allocationVersion');
+    const goalId = shortOptionalString(source.goalId, 'experiment.goalId');
+    const bucket = source.assignmentBucket;
+    if (!experimentId && !armId && !allocationVersion && !goalId && bucket === undefined)
+        return undefined;
+    if (!experimentId)
+        throw new CollectValidationError('experiment.experimentId is required when experiment context is present');
+    if (!armId)
+        throw new CollectValidationError('experiment.armId is required when experiment context is present');
+    if (bucket !== undefined && (!Number.isInteger(bucket) || Number(bucket) < 0 || Number(bucket) > 9999)) {
+        throw new CollectValidationError('experiment.assignmentBucket must be between 0 and 9999');
+    }
+    return {
+        experimentId,
+        armId,
+        ...(allocationVersion ? { allocationVersion } : {}),
+        ...(goalId ? { goalId } : {}),
+        ...(bucket !== undefined ? { assignmentBucket: bucket } : {}),
+    };
+}
+function shortOptionalString(value, field) {
+    if (value === undefined || value === null)
+        return '';
+    if (typeof value !== 'string')
+        throw new CollectValidationError(`${field} must be a string`);
+    return sanitizeString(value, field, 128);
+}
+function accepted(headers) {
+    return new Response('{"accepted":true}', { status: 202, headers });
+}
+function validationResponse(error) {
+    const message = error instanceof CollectValidationError ? error.message : 'invalid JSON body';
+    return Response.json({ error: message, status: 400 }, { status: 400, headers: { 'cache-control': 'no-store' } });
+}
+function claimsCookie(value, secure) {
+    return `aci_claims=${value}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400${secure ? '; Secure' : ''}`;
+}
+function expiredClaimsCookie(secure) {
+    return `aci_claims=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT${secure ? '; Secure' : ''}`;
+}
+function appendCookie(headers, cookie) {
+    headers.append('set-cookie', cookie);
+}
+class CollectValidationError extends Error {
+}