@gradial/aci 0.1.41 → 0.1.43

package/dist/cli/verify-next-cdn-routes.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+const projectRoot = process.argv[2] || '.';
+const checks = [];
+const missing = [];
+function checkFile(label, relativePath, validate, message) {
+    const fullPath = path.join(projectRoot, relativePath);
+    if (!fs.existsSync(fullPath)) {
+        missing.push(`✗ ${label}: ${relativePath} not found`);
+        return;
+    }
+    const content = fs.readFileSync(fullPath, 'utf-8');
+    if (!validate(content)) {
+        checks.push(`✗ ${label}: ${message}`);
+        return;
+    }
+    checks.push(`✓ ${label}`);
+}
+function checkMissing(label, relativePath, message) {
+    const fullPath = path.join(projectRoot, relativePath);
+    if (fs.existsSync(fullPath)) {
+        checks.push(`✗ ${label}: ${relativePath} should be removed. ${message}`);
+        return;
+    }
+    checks.push(`✓ ${label}`);
+}
+checkFile('middleware is configured', 'src/middleware.ts', (content) => (content.includes('@gradial/aci/next/middleware') || content.includes('createGradialMiddleware'))
+    && !content.includes('|__r'), 'Expected src/middleware.ts to use @gradial/aci/next/middleware and not exclude __r; middleware blocks direct /__r requests.');
+checkFile('catch-all page route exists', 'src/app/[[...slug]]/page.tsx', (content) => content.includes('createPage') || content.includes('getRenderInput'), 'Expected catch-all page to use createPage() from the SDK.');
+checkMissing('legacy required catch-all is removed', 'src/app/[...slug]/page.tsx', 'Use src/app/[[...slug]]/page.tsx (optional catch-all). The required [...slug] form breaks file-provider local dev where "/" arrives with an empty slug.');
+checkFile('canonical asset route exists', 'src/app/gradial/assets/[...path]/route.ts', (content) => content.includes('@gradial/aci/next/asset-route'), 'Expected the canonical asset route to use @gradial/aci/next/asset-route.');
+checkMissing('legacy release-scoped asset route is removed', 'src/app/gradial/assets/[releaseId]/[...path]/route.ts', 'Release-scoped asset URLs are produced by withAci() rewrites into the canonical src/app/gradial/assets/[...path]/route.ts; do not add a [releaseId] route.');
+checkMissing('no separate __r route folder', 'src/app/__r/[releaseId]/routes/[[...slug]]/page.tsx', 'The root catch-all handles release-scoped rewrites. Do not create a separate __r route folder.');
+checkFile('next.config uses withAci', 'next.config.mjs', (content) => content.includes('withAci'), 'Expected next.config.mjs to use withAci() from @gradial/aci/next.');
+for (const line of checks) {
+    console.log(line);
+}
+for (const line of missing) {
+    console.log(line);
+}
+const failed = [...checks.filter((line) => line.startsWith('✗')), ...missing];
+if (failed.length > 0) {
+    console.error(`\n${failed.length} check(s) failed`);
+    process.exit(1);
+}
+console.log('\nAll route checks passed');

package/dist/collect/aci.js

@@ -0,0 +1 @@
+"use strict";(()=>{var Ne=Object.defineProperty;var Le=(t,e,n)=>e in t?Ne(t,e,{enumerable:!0,configurable:!0,writable:!0,value:n}):t[e]=n;var y=(t,e,n)=>Le(t,typeof e!="symbol"?e+"":e,n);var x="data-aci-event",Oe="data-aci-on",H="data-aci-prop-",De="data-aci-refresh",q="custom.";function D(t){if(typeof t!="string")return;let e=t.trim().toLowerCase();if(!(e===""||/[\s/]/.test(e)))return e.startsWith(q)?e:q+e}function Re(t){let e;for(let n of Array.from(t.attributes)){if(!n.name.startsWith(H))continue;let r=n.name.slice(H.length);r!==""&&((e!=null?e:e={})[r]=n.value)}return e}function U(t,e){let n=D(t.getAttribute(x));if(n===void 0){e==null||e("capture",{reason:"malformed_declaration",attr:x});return}return{eventName:n,properties:Re(t)}}function X(t){var e,n;return(n=(e=t.getAttribute(Oe))==null?void 0:e.trim().toLowerCase())!=null?n:"click"}function $(t,e,n){let{document:r,debug:o}=e;r.addEventListener("click",f=>{var l,p;try{let u=f.target;if((l=u==null?void 0:u.closest)==null?void 0:l.call(u,`[${De}]`)){n==null||n();return}let m=(p=u==null?void 0:u.closest)==null?void 0:p.call(u,`[${x}]`);if(!m||X(m)!=="click")return;let g=U(m,o);g&&t(g)}catch(u){o==null||o("capture",{reason:"click_handler_failed",error:String(u)})}});let i=e.intersectionObserver;if(typeof i!="function")return;let s=Array.from(r.querySelectorAll(`[${x}]`)).filter(f=>X(f)==="visible");if(s.length===0)return;let a=new WeakSet,c=new i((f,l)=>{try{for(let p of f){if(!p.isIntersecting||p.intersectionRatio<.5||a.has(p.target))continue;a.add(p.target),l.unobserve(p.target);let u=U(p.target,o);u&&t(u)}}catch(p){o==null||o("capture",{reason:"visible_handler_failed",error:String(p)})}},{threshold:.5});for(let f of s)c.observe(f)}function K(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}function Y(t,e,n,r){let o=(...a)=>{try{let[c,...f]=a;if(c==="track"){let l=D(f[0]);if(l===void 0){r==null||r("capture",{reason:"malformed_track_name",name:f[0]});return}let p=f[1];if(p!==void 0&&!K(p)){r==null||r("capture",{reason:"malformed_track_properties",name:l});return}n.track(l,p);return}if(c==="consent"){if(e.preset!=="manual"){r==null||r("consent",{reason:"preset_authoritative",preset:e.preset});return}let l=f[0];if(!K(l)){r==null||r("consent",{reason:"malformed_consent_envelope"});return}n.consent({p:l.p,src:l.src});return}r==null||r("capture",{reason:"unknown_command",command:c})}catch(c){r==null||r("capture",{reason:"command_failed",error:String(c)})}},i=t.aci,s=i==null?void 0:i.q;if(t.aci=o,s!=null)for(let a of Array.from(s)){let c=Array.from(a);o(...c)}}var Be="experiment.exposure",Fe='script[type="application/json"][data-aci-assignments]';function Ve(t){if(typeof t!="object"||t===null)return null;let e=t,n=e.experimentId,r=e.armId,o=e.allocationVersion;return typeof n!="string"||n===""||typeof r!="string"||r===""||typeof o!="string"?null:{experimentId:n,armId:r,allocationVersion:o}}function Me(t,e){try{let n=t.querySelector(Fe);if(!n)return[];let r=n.textContent;if(r==null||r.trim()==="")return[];let o=JSON.parse(r);if(typeof o!="object"||o===null)return e==null||e("capture",{reason:"assignments_malformed"}),[];let i=o;if(i.v!==1||!Array.isArray(i.experiments))return e==null||e("capture",{reason:"assignments_malformed"}),[];let s=[];for(let a of i.experiments){let c=Ve(a);c&&s.push(c)}return s}catch(n){return e==null||e("capture",{reason:"assignments_parse_failed",error:String(n)}),[]}}function J(t,e){if(!e||t.experiment!==void 0)return t;let n=e.getActiveAssignments()[0];if(!n)return t;let r={experimentId:n.experimentId,armId:n.armId,allocationVersion:n.allocationVersion};return{...t,experiment:r}}function Q(t){let e=[],n=new Set,r,o=()=>{e=Me(t.document,t.debug);for(let i of e)n.has(i.experimentId)||(n.add(i.experimentId),r==null||r({eventName:Be,url:t.window.location.href,experiment:{experimentId:i.experimentId,armId:i.armId,allocationVersion:i.allocationVersion}}))};return{getActiveAssignments:()=>e.map(i=>({...i})),start(i){r=i,o()},rearm(){n.clear(),o()}}}var Z="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function We(t){globalThis.crypto.getRandomValues(t)}function S(t,e){let n=t!=null?t:Date.now(),r="";for(let c=0;c<10;c++)r=Z[n%32]+r,n=Math.floor(n/32);let o=new Uint8Array(10);(e!=null?e:We)(o);let i="",s=0,a=0;for(let c of o)for(s=s<<8|c,a+=8;a>=5;)i+=Z[s>>>a-5&31],a-=5;return r+i}var Ge=60*1024,je=100,ze=5e3,ee='{"envelopeId":"',te='","events":[',ne="]}",He=26,A=ee.length+He+te.length+ne.length,qe=new TextEncoder,Ue=t=>qe.encode(t).length,T=class{constructor(e){y(this,"options");y(this,"maxBytes");y(this,"queue",[]);y(this,"queuedBytes",0);y(this,"flushing",!1);y(this,"intervalId");var n;this.options=e,this.maxBytes=(n=e.maxBatchBytes)!=null?n:Ge}get pending(){return this.queue.length}push(e){let n=JSON.stringify(e),r=Ue(n);this.queue.push({json:n,bytes:r,eventId:e.eventId}),this.queuedBytes+=r,!this.flushing&&this.envelopeBytes()>=this.maxBytes&&this.flush()}flush(){var e,n;if(!this.flushing){this.flushing=!0;try{(n=(e=this.options).onTick)==null||n.call(e),this.drain()}finally{this.flushing=!1}}}start(){var o,i,s,a;let e=(o=this.options.timers)!=null?o:{setInterval:(c,f)=>setInterval(c,f),clearInterval:c=>clearInterval(c)};this.intervalId=e.setInterval(()=>this.flush(),(i=this.options.flushIntervalMs)!=null?i:ze);let n=(s=this.options.documentTarget)!=null?s:typeof document!="undefined"?document:void 0;n==null||n.addEventListener("visibilitychange",()=>{n.visibilityState==="hidden"&&this.flush()});let r=(a=this.options.windowTarget)!=null?a:typeof window!="undefined"?window:void 0;r==null||r.addEventListener("pagehide",()=>this.flush()),this.flush()}stop(){if(this.intervalId!==void 0){let e=this.options.timers;e?e.clearInterval(this.intervalId):clearInterval(this.intervalId),this.intervalId=void 0}}envelopeBytes(){let e=this.queue.length>1?this.queue.length-1:0;return A+this.queuedBytes+e}drain(){var e,n,r;for(;this.queue.length>0;){let o=this.queue[0];if(A+o.bytes>this.maxBytes){this.queue.shift(),this.queuedBytes-=o.bytes,(n=(e=this.options).debug)==null||n.call(e,"flush",{reason:"oversize_event",eventId:o.eventId,bytes:o.bytes});continue}let i=[],s=A;for(;this.queue.length>0;){let c=this.queue[0];if(A+c.bytes>this.maxBytes||i.length>=je)break;let f=s+c.bytes+(i.length>0?1:0);if(f>this.maxBytes)break;i.push(c.json),s=f,this.queue.shift(),this.queuedBytes-=c.bytes}if(i.length===0)continue;let a=((r=this.options.createEnvelopeId)!=null?r:S)();this.options.send(ee+a+te+i.join(",")+ne)}}};var Xe=new Set(["c15t","onetrust","cookiebot","trustarc","manual"]);function P(t,e){var o;let n=(o=t==null?void 0:t.getAttribute)==null?void 0:o.call(t,e);if(n==null)return;let r=n.trim();return r===""?void 0:r}function re(t){var r;let e=(r=P(t,"data-aci-consent"))==null?void 0:r.toLowerCase(),n=e!==void 0&&Xe.has(e)?e:"manual";return{site:P(t,"data-aci-site"),preset:n,categories:P(t,"data-aci-consent-categories"),debug:P(t,"data-aci-debug")==="1"}}function oe(t,e,n){if(!t)return()=>{};let r=e!=null?e:(i=>console.debug("[aci]",i)),o=n!=null?n:Date.now;return(i,s)=>{try{r({t:o(),kind:i,detail:s})}catch{}}}var R=new TextEncoder,$e=2048,Ke=32,Ye=128,Je=512,Qe=2147483647,Ze=/^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,9}))?(Z|[+-]\d{2}:\d{2})$/,et=/^[\t\n\v\f\r ]+|[\t\n\v\f\r ]+$/g,tt=new Set(["true","all","granted","yes","personalization","personalized"]);function _(t,e=!0){let n=w(t);if(!n)return null;if(e)try{n=decodeURIComponent(n)}catch{}if(n=w(n),!n||R.encode(n).byteLength>$e)return null;if(tt.has(n.toLowerCase()))return{version:0,purposes:["personalization"],grantedAt:""};try{let r=JSON.parse(n),o=typeof r.t=="string"?r.t:"";return!Number.isInteger(r.v)||r.v<0||r.v>Qe||!Array.isArray(r.p)||r.p.length>Ke||!r.p.every(i=>typeof i=="string")||r.p.some(i=>R.encode(i).byteLength>Ye)||r.t!==void 0&&r.t!==null&&(typeof r.t!="string"||r.t===""||!nt(r.t))||r.src!==void 0&&r.src!==null&&typeof r.src!="string"||typeof r.src=="string"&&R.encode(r.src).byteLength>Je?null:{version:r.v,purposes:r.p,grantedAt:o,source:typeof r.src=="string"?r.src:void 0}}catch{return null}}function B(t){return(t==null?void 0:t.purposes.some(e=>w(e).toLowerCase()==="personalization"))||!1}function w(t){return t.replace(et,"")}function nt(t){let e=Ze.exec(t);if(!e||Number.isNaN(Date.parse(t)))return!1;let n=Number(e[1]),r=Number(e[2]),o=Number(e[3]),i=Number(e[4]),s=Number(e[5]),a=Number(e[6]);if(r<1||r>12||o<1||o>rt(n,r)||i>23||s>59||a>59)return!1;let c=e[8];return c==="Z"||Number(c.slice(1,3))<=23&&Number(c.slice(4,6))<=59}function rt(t,e){return e===2?t%4===0&&(t%100!==0||t%400===0)?29:28:[4,6,9,11].includes(e)?30:31}var ie="personalization",F="aci_consent",V=1,ot=365*24*60*60;function it(t,e){var r;let n=`${F}=${t.encoded}; Path=/; Max-Age=${ot}; SameSite=Lax`;((r=e.document.location)==null?void 0:r.protocol)==="https:"&&(n+="; Secure"),e.document.cookie=n}function I(t,e,n){var o;let r=st(t,e,n.now);return r===null?!1:(B(r.snapshot)||(o=n.gapBuffer)==null||o.purge(),it(r,n),!0)}function se(t){for(let e of t.cookie.split(";")){let n=w(e);if(n.startsWith(F+"="))return n.slice(F.length+1)}}function ae(t){return t===void 0||t===""?!1:B(_(t,!0))}function ce(t){var r;if(!Array.isArray(t))return;let e=[];for(let o of t){if(typeof o!="string")return;e.push(w(o))}let n=JSON.stringify({v:V,p:e});return(r=_(n,!1))==null?void 0:r.purposes}function ue(t){var o;if(t!==void 0&&typeof t!="string")return;let e=typeof t=="string"?w(t):"",r=JSON.stringify({v:V,p:[],src:e===""?"manual":e});return(o=_(r,!1))==null?void 0:o.source}function st(t,e,n){try{let r=JSON.stringify({v:V,p:t,t:new Date((n!=null?n:Date.now)()).toISOString(),src:e}),o=_(r,!1);return o===null?null:{encoded:encodeURIComponent(r),snapshot:o}}catch{return null}}var at="cmp-",ct=/^[a-z0-9._-]+$/,ut={c15t:"measurement,marketing",onetrust:"c0002,c0004",cookiebot:"statistics,marketing",trustarc:"functional,advertising"};function M(t,e){let n=e!=null?e:ut[t];if(n===void 0)return null;let r=n.split(",").map(o=>o.trim().toLowerCase()).filter(o=>o!=="");if(r.length===0)return null;for(let o of r)if(!ct.test(o))return null;return r}function ft(t,e){return e.filter(r=>r in t.categories).some(r=>t.categories[r]===!0)?[ie]:[]}function k(t,e,n){var r,o,i,s;try{let a=M(e,n.categories);if(a===null){(r=n.debug)==null||r.call(n,"consent",{reason:"unparseable_mapping",preset:e});return}if(a.filter(l=>l in t.categories).length===0){(o=n.debug)==null||o.call(n,"consent",{reason:"unmappable_cmp_state",preset:e});return}let f=ft(t,a);I(f,at+e,{document:n.document,gapBuffer:n.gapBuffer,now:n.now}),(i=n.debug)==null||i.call(n,"consent",{reason:"written",preset:e,purposes:f})}catch(a){(s=n.debug)==null||s.call(n,"consent",{reason:"consent_bridge_failed",preset:e,error:String(a)})}}var fe=250,lt=1e4;function C(t,e,n){var s;let r=(s=n==null?void 0:n.scheduler)!=null?s:{setTimeout:(a,c)=>setTimeout(a,c),clearTimeout:a=>clearTimeout(a)},o=Math.floor(lt/fe),i=()=>{var c,f;let a;try{a=t()}catch(l){(c=n==null?void 0:n.debug)==null||c.call(n,"consent",{reason:"cmp_read_failed",error:String(l)});return}if(a!==void 0){e(a);return}if(o-=1,o<=0){(f=n==null?void 0:n.debug)==null||f.call(n,"consent",{reason:"cmp_not_found"});return}r.setTimeout(i,fe)};i()}function b(t,e){try{e()}catch(n){t==null||t("consent",{reason:"adapter_failed",error:String(n)})}}var dt="c15t";function pt(t){if(typeof t!="object"||t===null)return;let e={};for(let[n,r]of Object.entries(t))typeof r=="boolean"&&(e[n.toLowerCase()]=r);return{categories:e}}function mt(t,e){return typeof t=="object"&&t!==null?"consents"in t?t.consents:t:e.consents}function le(t){C(()=>{let e=t.window.c15t;return typeof e=="object"&&e!==null?e:void 0},e=>{b(t.debug,()=>{var r;let n=o=>{let i=pt(o);i&&k(i,dt,t)};n(e.consents),(r=e.onConsentChange)==null||r.call(e,o=>b(t.debug,()=>n(mt(o,e))))})},t)}var gt="cookiebot",vt=["CookiebotOnConsentReady","CookiebotOnAccept","CookiebotOnDecline"];function de(t){let e=t.Cookiebot;return typeof e=="object"&&e!==null?e:void 0}function ht(t){if(typeof t!="object"||t===null)return;let e={};for(let[n,r]of Object.entries(t))typeof r=="boolean"&&(e[n.toLowerCase()]=r);return{categories:e}}function pe(t){let e=()=>{let r=de(t.window);if(!r||r.hasResponse!==!0)return;let o=ht(r.consent);o&&k(o,gt,t)},n=t.window;if(typeof n.addEventListener=="function")for(let r of vt)n.addEventListener(r,()=>b(t.debug,e));C(()=>de(t.window),()=>b(t.debug,e),t)}var me="onetrust",bt=/^c\d{4}$/;function yt(t,e){let n={};for(let r of t.split(",")){let o=r.trim().toLowerCase();o!==""&&(n[o]=!0)}for(let r of e!=null?e:[])!(r in n)&&bt.test(r)&&(n[r]=!1);return{categories:n}}function ge(t){let e=t.window,n=()=>{let o=e.OnetrustActiveGroups;if(typeof o!="string")return;let i=M(me,t.categories);k(yt(o,i),me,t)},r=e.OptanonWrapper;e.OptanonWrapper=()=>{if(typeof r=="function")try{r()}catch{}b(t.debug,n)},C(()=>{let o=e.OnetrustActiveGroups;return typeof o=="string"?o:void 0},()=>b(t.debug,n),t)}var Et="trustarc",kt={required:1,functional:2,advertising:3},ve="PrivacyManagerAPI";function he(t){let e=t.truste,n=e==null?void 0:e.cma,r=n==null?void 0:n.callApi;return typeof r=="function"?r.bind(n):void 0}function Ct(t){if(typeof t!="object"||t===null)return;let e=t.consentDecision;if(typeof e!="number"||!Number.isFinite(e)||e<1)return;let n={};for(let[r,o]of Object.entries(kt))n[r]=e>=o;return{categories:n}}function wt(t){return typeof t=="string"?t.includes(ve):typeof t=="object"&&t!==null&&ve in t}function St(t){let e=t.location;return typeof(e==null?void 0:e.hostname)=="string"?e.hostname:void 0}function be(t){let e=()=>{let r=he(t.window);if(!r)return;let o=Ct(r("getConsentDecision",St(t.window)));o&&k(o,Et,t)},n=t.window;typeof n.addEventListener=="function"&&n.addEventListener("message",r=>b(t.debug,()=>{wt(r==null?void 0:r.data)&&e()})),C(()=>he(t.window),()=>b(t.debug,e),t)}var N="aci:buf";var ye="aci_m",L=class{constructor(e){y(this,"events");y(this,"storage");y(this,"debug");this.debug=e==null?void 0:e.debug,this.storage=e==null?void 0:e.storage,this.events=this.restore()}push(e){var n;this.events.push(e),this.events.length>50&&(this.events.splice(0,this.events.length-50),(n=this.debug)==null||n.call(this,"buffer",{reason:"cap_drop_oldest"})),this.persist()}drain(){let e=this.events;return this.events=[],this.persist(),e}purge(){var e;this.events.length>0&&((e=this.debug)==null||e.call(this,"buffer",{reason:"purged",count:this.events.length})),this.events=[],this.persist()}size(){return this.events.length}restore(){var r;let e=this.storage;if(!e)return[];let n;try{n=e.getItem(N)}catch(o){return this.storage=void 0,(r=this.debug)==null||r.call(this,"buffer",{reason:"storage_unavailable",error:String(o)}),[]}if(n==null)return[];try{let o=JSON.parse(n);if(Array.isArray(o))return o}catch{}try{e.removeItem(N)}catch{this.storage=void 0}return[]}persist(){var n;let e=this.storage;if(e)try{this.events.length===0?e.removeItem(N):e.setItem(N,JSON.stringify(this.events))}catch(r){this.storage=void 0,(n=this.debug)==null||n.call(this,"buffer",{reason:"storage_unavailable",error:String(r)})}}};function Ee(t){for(let e of t.cookie.split(";")){let n=e.trim();if(n.startsWith(ye+"="))return n.slice(ye.length+1)!==""}return!1}function ke(t,e){if(e.grants()&&!e.marker()){e.gapBuffer.push(t);return}e.batcher.push(t)}function W(t,e,n,r){if(t.size()===0||!n())return;let o=t.drain();for(let i of o)e.push(i);r==null||r("buffer",{reason:"flushed",count:o.length})}var _t="rum.link_click";function Ce(t,e){var i;let{document:n,debug:r}=e,o=(i=n.defaultView)==null?void 0:i.location;n.addEventListener("click",s=>{var a,c,f;try{let l=s.target,p=(a=l==null?void 0:l.closest)==null?void 0:a.call(l,"a[href]");if(!p)return;let u=p;t({eventName:_t,url:o==null?void 0:o.href,properties:{linkText:(f=(c=u.textContent)==null?void 0:c.trim())!=null?f:"",linkHref:u.href}})}catch(l){r==null||r("capture",{reason:"link_click_failed",error:String(l)})}},{capture:!0})}var xt="rum.page_view";function we(t){let e=t.indexOf("#");return e===-1?t:t.slice(0,e)}function Se(t,e){let n=we(t.location.href),r=()=>{let s=we(t.location.href);if(s!==n){n=s;for(let a of e)a()}},o=t.history,i=s=>{let a=o[s].bind(o);o[s]=(...c)=>{let f=a(...c);return r(),f}};i("pushState"),i("replaceState"),t.addEventListener("popstate",r)}function _e(t,e){let n=()=>t({eventName:xt,url:e.location.href,referrer:e.document.referrer});return n(),n}var G="/collect";function xe(t,e){let n=e==null?void 0:e.debug,r=e!==void 0&&"navigator"in e?e.navigator:globalThis.navigator,o=e!==void 0&&"fetch"in e?e.fetch:globalThis.fetch,i;try{i=new Blob([t],{type:"text/plain"})}catch{n==null||n("flush",{reason:"no_blob"});return}if(r!=null&&r.sendBeacon)try{if(r.sendBeacon(G,i))return}catch{}if(!o){n==null||n("flush",{reason:"no_transport"});return}try{o(G,{method:"POST",body:i,keepalive:!0}).catch(s=>{n==null||n("flush",{reason:"fetch_failed",error:String(s)})})}catch(s){n==null||n("flush",{reason:"fetch_failed",error:String(s)})}}function Ae(t){var n,r;let e=t!==void 0&&"fetch"in t?t.fetch:globalThis.fetch;if(!e)return Promise.resolve(!1);try{let o=((n=t==null?void 0:t.createEnvelopeId)!=null?n:S)(),i=new Blob([`{"envelopeId":"${o}","events":[]}`],{type:"text/plain"});return e(G,{method:"POST",body:i,keepalive:!0,credentials:"same-origin"}).then(s=>{var a;return typeof s=="object"&&s!==null&&"ok"in s&&s.ok===!1?((a=t==null?void 0:t.debug)==null||a.call(t,"flush",{reason:"refresh_failed",status:"not_ok"}),!1):!0}).catch(s=>{var a;return(a=t==null?void 0:t.debug)==null||a.call(t,"flush",{reason:"refresh_failed",error:String(s)}),!1})}catch(o){return(r=t==null?void 0:t.debug)==null||r.call(t,"flush",{reason:"refresh_failed",error:String(o)}),Promise.resolve(!1)}}var At="rum.variation_view",j="data-aci-variation";function Te(t,e){var f,l,p;let{document:n,debug:r}=e,o=e.MutationObserver;if(typeof o!="function")return;let i=(f=n.defaultView)==null?void 0:f.location,s=new WeakSet,a=u=>{let h=u.getAttribute(j);h!=null&&(s.has(u)||(s.add(u),t({eventName:At,url:i==null?void 0:i.href,properties:{variantKey:h}})))},c=u=>{try{u.hasAttribute(j)&&a(u);for(let h of Array.from(u.querySelectorAll(`[${j}]`)))a(h)}catch(h){r==null||r("capture",{reason:"variation_scan_failed",error:String(h)})}};try{let u=(l=n.body)!=null?l:n.documentElement;u&&c(u)}catch(u){r==null||r("capture",{reason:"variation_initial_scan_failed",error:String(u)})}try{let u=(p=n.body)!=null?p:n.documentElement;if(!u)return;new o(m=>{try{for(let g of m)for(let d=0;d<g.addedNodes.length;d++){let v=g.addedNodes[d];if((v==null?void 0:v.nodeType)!==1)continue;let E=v.element;E&&c(E)}}catch(g){r==null||r("capture",{reason:"variation_observer_failed",error:String(g)})}}).observe(u,{subtree:!0,childList:!0})}catch(u){r==null||r("capture",{reason:"variation_observe_failed",error:String(u)})}}var Tt="rum.web_vital";function Pe(t,e){var h,m,g;let n=e.PerformanceObserver;if(typeof n!="function")return;let{performance:r,debug:o}=e,i=(m=(h=e.window)==null?void 0:h.location)==null?void 0:m.href,s=e.document,a=new Set,c=(d,v)=>{a.has(d)||(a.add(d),t({eventName:Tt,url:i,properties:{vitalName:d,vitalValue:v}}))};try{let d=r==null?void 0:r.getEntriesByType("navigation")[0];d&&typeof d.responseStart=="number"&&typeof d.requestStart=="number"&&c("TTFB",d.responseStart-d.requestStart)}catch(d){o==null||o("capture",{reason:"ttfb_failed",error:String(d)})}let f=0,l=0,p=(d,v)=>{try{new n(Ie=>{try{for(let O of Ie.getEntries())v(O)}catch(O){o==null||o("capture",{reason:`${d}_handler_failed`,error:String(O)})}}).observe({type:d,buffered:!0})}catch(E){o==null||o("capture",{reason:`${d}_observe_failed`,error:String(E)})}};p("largest-contentful-paint",d=>{c("LCP",d.startTime)}),p("first-input",d=>{c("FID",d.startTime)}),p("layout-shift",d=>{var v;d.hadRecentInput||(f+=(v=d.value)!=null?v:0)}),p("event",d=>{var E;let v=(E=d.value)!=null?E:0;v>l&&(l=v)}),p("paint",d=>{d.name==="first-contentful-paint"&&c("FCP",d.startTime)});let u=()=>{try{a.has("CLS")||c("CLS",f),a.has("INP")||c("INP",l)}catch(d){o==null||o("capture",{reason:"visibility_handler_failed",error:String(d)})}};s&&s.addEventListener("visibilitychange",()=>{s.visibilityState==="hidden"&&u()}),(g=e.window)==null||g.addEventListener("pagehide",u)}var z={c15t:le,onetrust:ge,cookiebot:pe,trustarc:be};function Pt(t){var e,n;return typeof((e=t.navigator)==null?void 0:e.sendBeacon)=="function"&&typeof t.IntersectionObserver=="function"&&typeof((n=t.crypto)==null?void 0:n.getRandomValues)=="function"}function It(t){try{return t.sessionStorage}catch{return}}function Nt(t){var o;let e=t!=null?t:typeof window!="undefined"?window:void 0;if(!e||e.__aci_loaded||(e.__aci_loaded=!0,!Pt(e)))return;let n=re(e.document.currentScript),r=oe(n.debug);try{let i=e.document,s=new L({storage:It(e),debug:r}),a=()=>{try{return ae(se(i))}catch{return!1}},c=()=>{try{return Ee(i)}catch{return!1}},f={navigator:e.navigator,fetch:typeof e.fetch=="function"?e.fetch.bind(e):void 0,debug:r},l;l=new T({send:m=>xe(m,f),debug:r,onTick:()=>W(s,l,c,r),timers:{setInterval:(m,g)=>e.setInterval(m,g),clearInterval:m=>e.clearInterval(m)},documentTarget:i,windowTarget:e});let p=Q({document:i,window:e,debug:r}),u=m=>{ke({...J(m,p),eventId:S(void 0,g=>e.crypto.getRandomValues(g))},{grants:a,marker:c,gapBuffer:s,batcher:l})};p.start(u),Y(e,n,{track:(m,g)=>u({eventName:m,properties:g}),consent:({p:m,src:g})=>{let d=ce(m);if(d===void 0){r("consent",{reason:"malformed_purposes"});return}let v=ue(g);if(v===void 0){r("consent",{reason:"malformed_source"});return}I(d,v,{document:i,gapBuffer:s})||r("consent",{reason:"oversized_envelope"})}},r);let h=_e(u,e);Se(e,[()=>p.rearm(),h]),$(u,{document:i,intersectionObserver:e.IntersectionObserver,debug:r},()=>{Ae(f).then(m=>{m&&e.location.reload()})}),Ce(u,{document:i,debug:r}),Pe(u,{performance:e.performance,PerformanceObserver:e.PerformanceObserver,window:e,document:i,debug:r}),Te(u,{document:i,MutationObserver:e.MutationObserver,debug:r}),n.preset!=="manual"&&((o=z[n.preset])==null||o.call(z,{window:e,document:i,categories:n.categories,gapBuffer:s,debug:r,scheduler:{setTimeout:(m,g)=>e.setTimeout(m,g),clearTimeout:m=>e.clearTimeout(m)}})),l.start(),W(s,l,c,r),r("init",{config:n})}catch(i){r("init",{error:String(i)})}}Nt();})();

package/dist/collect/aci.js.sha256

@@ -0,0 +1 @@
+46f87bbce4c938e9540939102be1094f5cd956d0f3a5836e9af5c3b0b8c582ad

package/dist/collect/assignments.d.ts

@@ -0,0 +1,65 @@
+import type { PendingEvent } from "./batcher.js";
+import type { DebugFn } from "./config.js";
+export declare const EXPERIMENT_EXPOSURE_EVENT = "experiment.exposure";
+/** One active assignment read from the page's data-aci-assignments tag. */
+export interface ExperimentAssignment {
+    experimentId: string;
+    armId: string;
+    allocationVersion: string;
+}
+interface DocumentLike {
+    querySelector(selectors: string): {
+        textContent: string | null;
+    } | null;
+}
+/**
+ * readAssignments parses the page's data-aci-assignments tag. Absence, a
+ * malformed body, or an unknown version are tolerated as "no assignments"
+ * (debug record, no throw).
+ */
+export declare function readAssignments(doc: DocumentLike, debug?: DebugFn): ExperimentAssignment[];
+export interface AssignmentsEnv {
+    document: DocumentLike;
+    /** Only location.href is read (the exposure event's url). */
+    window: {
+        location: {
+            href: string;
+        };
+    };
+    debug?: DebugFn;
+}
+export interface AssignmentsHandle {
+    /** The assignments active for the current page view (copies). */
+    getActiveAssignments(): ExperimentAssignment[];
+    /**
+     * start reads the assignments tag and emits `experiment.exposure` once per
+     * (experiment, page view) through `emit`. Called once by init AFTER the
+     * emit pipeline is fully constructed — the handle is created first so
+     * emit's withAssignmentContext dependency exists before emit can run.
+     */
+    start(emit: (event: PendingEvent) => void): void;
+    /**
+     * rearm resets the per-page-view exposure dedupe and re-reads the tag.
+     * Wired by init into the shared navigation hook, ORDERED BEFORE the SPA
+     * page-view emitter so rum.page_view is stamped with the new page's
+     * context (REQ-2/3; see the module-header stale-tag limitation).
+     */
+    rearm(): void;
+}
+/**
+ * withAssignmentContext stamps the first active assignment's experiment
+ * context onto an event that does not already carry one (REQ-3). Events with
+ * explicit context (exposures, explicit conversions) are never overwritten.
+ */
+export declare function withAssignmentContext(event: PendingEvent, handle: AssignmentsHandle | undefined): PendingEvent;
+/**
+ * createAssignments builds the assignments collector without emitting
+ * anything: creation and exposure emission are split so init can construct
+ * the emit pipeline against the handle before any event flows (no circular
+ * "emit captures a not-yet-assigned handle" wiring). start() reads the tag
+ * and emits exposures; rearm() is the SPA-navigation reset, fanned out from
+ * the single navigation hook installed by init — so an "exposure per page
+ * view" matches a "page view" exactly.
+ */
+export declare function createAssignments(env: AssignmentsEnv): AssignmentsHandle;
+export {};

package/dist/collect/assignments.js

@@ -0,0 +1,138 @@
+// Experiment assignments (personalization-reporting design/04/05): the
+// starters render the page's build-time assignment context as a
+// `<script type="application/json" data-aci-assignments>` JSON tag
+// ({"v":1,"experiments":[{experimentId,armId,allocationVersion}]}). This
+// collector parses it, emits `experiment.exposure` at most once per
+// (experiment, page view) (REQ-2), and exposes the active assignments so the
+// emit path can stamp experiment context on every event while an assignment
+// is active (REQ-3). Absent or malformed tags are a silent no-op with a
+// debug record; the page is never affected.
+//
+// KNOWN LIMITATION — SPA client-side routing reads a stale tag. The re-arm
+// (AssignmentsHandle.rearm, wired to the shared navigation hook in init)
+// runs synchronously when pushState/replaceState returns, but client
+// routers (e.g. the Next app router) swap the page's DOM — including the
+// assignments tag — AFTER pushState returns. The re-arm therefore reads the
+// PREVIOUS page's tag. The design assumption is MPA / full-SSR-first
+// navigation, where every page view is a fresh document load and the tag is
+// always current; under pure client-side transitions, exposures and context
+// stamping for the newly routed page lag one navigation behind. Accepted
+// for now — do not "fix" with a MutationObserver.
+export const EXPERIMENT_EXPOSURE_EVENT = "experiment.exposure";
+const ASSIGNMENTS_SELECTOR = 'script[type="application/json"][data-aci-assignments]';
+const ASSIGNMENTS_VERSION = 1;
+function parseAssignment(value) {
+    if (typeof value !== "object" || value === null)
+        return null;
+    const record = value;
+    const experimentId = record.experimentId;
+    const armId = record.armId;
+    const allocationVersion = record.allocationVersion;
+    if (typeof experimentId !== "string" ||
+        experimentId === "" ||
+        typeof armId !== "string" ||
+        armId === "" ||
+        typeof allocationVersion !== "string") {
+        return null;
+    }
+    return { experimentId, armId, allocationVersion };
+}
+/**
+ * readAssignments parses the page's data-aci-assignments tag. Absence, a
+ * malformed body, or an unknown version are tolerated as "no assignments"
+ * (debug record, no throw).
+ */
+export function readAssignments(doc, debug) {
+    try {
+        const tag = doc.querySelector(ASSIGNMENTS_SELECTOR);
+        if (!tag)
+            return [];
+        const raw = tag.textContent;
+        if (raw == null || raw.trim() === "")
+            return [];
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== "object" || parsed === null) {
+            debug?.("capture", { reason: "assignments_malformed" });
+            return [];
+        }
+        const body = parsed;
+        if (body.v !== ASSIGNMENTS_VERSION || !Array.isArray(body.experiments)) {
+            debug?.("capture", { reason: "assignments_malformed" });
+            return [];
+        }
+        const assignments = [];
+        for (const entry of body.experiments) {
+            const assignment = parseAssignment(entry);
+            if (assignment)
+                assignments.push(assignment);
+        }
+        return assignments;
+    }
+    catch (err) {
+        debug?.("capture", {
+            reason: "assignments_parse_failed",
+            error: String(err),
+        });
+        return [];
+    }
+}
+/**
+ * withAssignmentContext stamps the first active assignment's experiment
+ * context onto an event that does not already carry one (REQ-3). Events with
+ * explicit context (exposures, explicit conversions) are never overwritten.
+ */
+export function withAssignmentContext(event, handle) {
+    if (!handle || event.experiment !== undefined)
+        return event;
+    const first = handle.getActiveAssignments()[0];
+    if (!first)
+        return event;
+    const experiment = {
+        experimentId: first.experimentId,
+        armId: first.armId,
+        allocationVersion: first.allocationVersion,
+    };
+    return { ...event, experiment };
+}
+/**
+ * createAssignments builds the assignments collector without emitting
+ * anything: creation and exposure emission are split so init can construct
+ * the emit pipeline against the handle before any event flows (no circular
+ * "emit captures a not-yet-assigned handle" wiring). start() reads the tag
+ * and emits exposures; rearm() is the SPA-navigation reset, fanned out from
+ * the single navigation hook installed by init — so an "exposure per page
+ * view" matches a "page view" exactly.
+ */
+export function createAssignments(env) {
+    let active = [];
+    const exposed = new Set();
+    let emit;
+    const arm = () => {
+        active = readAssignments(env.document, env.debug);
+        for (const assignment of active) {
+            if (exposed.has(assignment.experimentId))
+                continue;
+            exposed.add(assignment.experimentId);
+            emit?.({
+                eventName: EXPERIMENT_EXPOSURE_EVENT,
+                url: env.window.location.href,
+                experiment: {
+                    experimentId: assignment.experimentId,
+                    armId: assignment.armId,
+                    allocationVersion: assignment.allocationVersion,
+                },
+            });
+        }
+    };
+    return {
+        getActiveAssignments: () => active.map((assignment) => ({ ...assignment })),
+        start(emitFn) {
+            emit = emitFn;
+            arm();
+        },
+        rearm() {
+            exposed.clear();
+            arm();
+        },
+    };
+}

package/dist/collect/batcher.d.ts

@@ -1,4 +1,16 @@
 import type { DebugFn } from "./config.js";
+/**
+ * Structured experiment context (personalization-reporting REQ-1/REQ-3):
+ * populated from the page's data-aci-assignments tag so conversions are
+ * attributable to (experiment, arm) at ingest. Explicit conversions may add
+ * goalId.
+ */
+export interface ExperimentContext {
+    experimentId: string;
+    armId: string;
+    allocationVersion: string;
+    goalId?: string;
+}
 /** One collect event on the wire (personalization-data-plane design/04). */
 export interface CollectEvent {
     eventId: string;
@@ -7,11 +19,20 @@ export interface CollectEvent {
     properties?: Record<string, unknown>;
     url?: string;
     referrer?: string;
+    experiment?: ExperimentContext;
 }
 /** An event at capture time, before the eventId is stamped. */
 export type PendingEvent = Omit<CollectEvent, "eventId">;
 /** Planning threshold: full serialized envelope, UTF-8 bytes. */
 export declare const MAX_BATCH_BYTES: number;
+/**
+ * Hard event-count cap per envelope. The Next collect-route imports this
+ * constant and rejects larger envelopes (the Go handler enforces only the
+ * 64KiB body cap today), so a byte-capped-only batch of small events (~400
+ * fit in 60KiB) would 400 on that host and silently lose the whole flush.
+ * The client caps at the strictest host.
+ */
+export declare const MAX_BATCH_EVENTS = 100;
 /** Flush interval (build-time constant, design/04 config table). */
 export declare const FLUSH_INTERVAL_MS = 5000;
 export interface BatcherTimers {
@@ -24,6 +45,8 @@ interface ListenerTarget {
 export interface BatcherOptions {
     /** Transport for one serialized batch envelope. */
     send: (body: string) => void;
+    /** Injectable only so tests can prove one ID is minted per sealed batch. */
+    createEnvelopeId?: () => string;
     debug?: DebugFn;
     /** Runs at the start of every flush tick (gap-buffer marker re-check). */
     onTick?: () => void;

package/dist/collect/batcher.js

@@ -1,14 +1,29 @@
 // Batcher (design/05): queue events, split so no request exceeds the 60 KiB
-// planning threshold (64 KiB wire ceiling), flush on start, size, interval,
-// visibilitychange and pagehide. Byte accounting is incremental — a running
-// per-event size computed at enqueue — so a flush stays O(n).
+// planning threshold (64 KiB wire ceiling), mint one envelope ULID per sealed
+// batch, and flush on start, size, interval, visibilitychange and pagehide.
+// Byte accounting is incremental — a running per-event size computed at
+// enqueue — so a flush stays O(n).
+import { ulid } from "./ulid.js";
 /** Planning threshold: full serialized envelope, UTF-8 bytes. */
 export const MAX_BATCH_BYTES = 60 * 1024;
+/**
+ * Hard event-count cap per envelope. The Next collect-route imports this
+ * constant and rejects larger envelopes (the Go handler enforces only the
+ * 64KiB body cap today), so a byte-capped-only batch of small events (~400
+ * fit in 60KiB) would 400 on that host and silently lose the whole flush.
+ * The client caps at the strictest host.
+ */
+export const MAX_BATCH_EVENTS = 100;
 /** Flush interval (build-time constant, design/04 config table). */
 export const FLUSH_INTERVAL_MS = 5000;
-const ENVELOPE_PREFIX = '{"events":[';
+const ENVELOPE_PREFIX = '{"envelopeId":"';
+const EVENTS_PREFIX = '","events":[';
 const ENVELOPE_SUFFIX = "]}";
-const ENVELOPE_OVERHEAD = ENVELOPE_PREFIX.length + ENVELOPE_SUFFIX.length;
+const ENVELOPE_ID_BYTES = 26;
+const ENVELOPE_OVERHEAD = ENVELOPE_PREFIX.length +
+    ENVELOPE_ID_BYTES +
+    EVENTS_PREFIX.length +
+    ENVELOPE_SUFFIX.length;
 const encoder = new TextEncoder();
 const utf8ByteLength = (s) => encoder.encode(s).length;
 export class Batcher {
@@ -111,6 +126,8 @@ export class Batcher {
                 const next = this.queue[0];
                 if (ENVELOPE_OVERHEAD + next.bytes > this.maxBytes)
                     break; // oversize: outer loop drops it
+                if (parts.length >= MAX_BATCH_EVENTS)
+                    break; // host-side envelope cap
                 const nextSize = size + next.bytes + (parts.length > 0 ? 1 : 0);
                 if (nextSize > this.maxBytes)
                     break;
@@ -121,7 +138,12 @@ export class Batcher {
             }
             if (parts.length === 0)
                 continue;
-            this.options.send(ENVELOPE_PREFIX + parts.join(",") + ENVELOPE_SUFFIX);
+            const envelopeId = (this.options.createEnvelopeId ?? ulid)();
+            this.options.send(ENVELOPE_PREFIX +
+                envelopeId +
+                EVENTS_PREFIX +
+                parts.join(",") +
+                ENVELOPE_SUFFIX);
         }
     }
 }

package/dist/collect/consent/envelope.d.ts

@@ -21,16 +21,17 @@ export interface ApplyConsentDeps extends ConsentWriteDeps {
 }
 /**
  * writeConsent builds the {v:1, p, t, src} envelope, URL-encodes it and sets
- * the aci_consent cookie (Path=/, SameSite=Lax, Secure on https).
+ * the aci_consent cookie (Path=/, SameSite=Lax, Secure on https). Inputs that
+ * cannot produce a portable envelope are ignored.
  */
-export declare function writeConsent(purposes: string[], src: string, deps: ConsentWriteDeps): void;
+export declare function writeConsent(purposes: string[], src: string, deps: ConsentWriteDeps): boolean;
 /**
  * applyConsent is the single write path for every consent decision — CMP
  * adapters and the manual JS API alike. Any decision where personalization
  * is absent purges the gap buffer (REQ-8), and the envelope is still
  * written: withdrawal must reach the server.
  */
-export declare function applyConsent(purposes: string[], src: string, deps: ApplyConsentDeps): void;
+export declare function applyConsent(purposes: string[], src: string, deps: ApplyConsentDeps): boolean;
 /** readConsentCookie returns the raw (still URL-encoded) cookie value. */
 export declare function readConsentCookie(doc: {
     cookie: string;
@@ -47,3 +48,8 @@ export declare function envelopeGrantsPersonalization(raw: string | undefined):
  * and the command is ignored.
  */
 export declare function sanitizePurposes(raw: unknown): string[] | undefined;
+/**
+ * sanitizeConsentSource preserves the manual API's default while applying the
+ * same portable whitespace and byte bounds as every envelope reader.
+ */
+export declare function sanitizeConsentSource(raw: unknown): string | undefined;

package/dist/collect/consent/envelope.js

@@ -2,33 +2,26 @@
 // carries URL-encoded JSON {v:1, p, t, src} — cookie values cannot carry
 // quotes. The collector and the edge URL-decode before parsing, with a
 // legacy bare-token fallback during the deprecation window.
+import { parsePortableConsentEnvelope, portableConsentAllowsPersonalization, trimPortableConsentWhitespace, } from "../../consent/portable-envelope.js";
 export const PERSONALIZATION_PURPOSE = "personalization";
 export const CONSENT_COOKIE = "aci_consent";
 export const CONSENT_ENVELOPE_VERSION = 1;
 /** Consent persistence horizon; the CMP remains the source of truth. */
 export const CONSENT_MAX_AGE_S = 365 * 24 * 60 * 60;
-/** Mirrors the server-side grandfathered tokens (audience collect_signals). */
-const LEGACY_GRANT_TOKENS = new Set([
-    "true",
-    "all",
-    "granted",
-    "yes",
-    "personalization",
-    "personalized",
-]);
 /**
  * writeConsent builds the {v:1, p, t, src} envelope, URL-encodes it and sets
- * the aci_consent cookie (Path=/, SameSite=Lax, Secure on https).
+ * the aci_consent cookie (Path=/, SameSite=Lax, Secure on https). Inputs that
+ * cannot produce a portable envelope are ignored.
  */
 export function writeConsent(purposes, src, deps) {
-    const envelope = {
-        v: CONSENT_ENVELOPE_VERSION,
-        p: purposes,
-        t: new Date((deps.now ?? Date.now)()).toISOString(),
-        src,
-    };
-    const value = encodeURIComponent(JSON.stringify(envelope));
-    let cookie = `${CONSENT_COOKIE}=${value}; Path=/; Max-Age=${CONSENT_MAX_AGE_S}; SameSite=Lax`;
+    const prepared = prepareConsentEnvelope(purposes, src, deps.now);
+    if (prepared === null)
+        return false;
+    writePreparedConsent(prepared, deps);
+    return true;
+}
+function writePreparedConsent(prepared, deps) {
+    let cookie = `${CONSENT_COOKIE}=${prepared.encoded}; Path=/; Max-Age=${CONSENT_MAX_AGE_S}; SameSite=Lax`;
     if (deps.document.location?.protocol === "https:") {
         cookie += "; Secure";
     }
@@ -41,15 +34,19 @@ export function writeConsent(purposes, src, deps) {
  * written: withdrawal must reach the server.
  */
 export function applyConsent(purposes, src, deps) {
-    if (!purposes.includes(PERSONALIZATION_PURPOSE)) {
+    const prepared = prepareConsentEnvelope(purposes, src, deps.now);
+    if (prepared === null)
+        return false;
+    if (!portableConsentAllowsPersonalization(prepared.snapshot)) {
         deps.gapBuffer?.purge();
     }
-    writeConsent(purposes, src, deps);
+    writePreparedConsent(prepared, deps);
+    return true;
 }
 /** readConsentCookie returns the raw (still URL-encoded) cookie value. */
 export function readConsentCookie(doc) {
     for (const part of doc.cookie.split(";")) {
-        const trimmed = part.trim();
+        const trimmed = trimPortableConsentWhitespace(part);
         if (trimmed.startsWith(CONSENT_COOKIE + "=")) {
             return trimmed.slice(CONSENT_COOKIE.length + 1);
         }
@@ -64,23 +61,7 @@ export function readConsentCookie(doc) {
 export function envelopeGrantsPersonalization(raw) {
     if (raw === undefined || raw === "")
         return false;
-    let decoded = raw;
-    try {
-        decoded = decodeURIComponent(raw);
-    }
-    catch {
-        // Not URL-encoded; evaluate as-is.
-    }
-    if (LEGACY_GRANT_TOKENS.has(decoded.trim().toLowerCase()))
-        return true;
-    try {
-        const envelope = JSON.parse(decoded);
-        return (Array.isArray(envelope.p) &&
-            envelope.p.includes(PERSONALIZATION_PURPOSE));
-    }
-    catch {
-        return false;
-    }
+    return portableConsentAllowsPersonalization(parsePortableConsentEnvelope(raw, true));
 }
 /**
  * sanitizePurposes validates a caller-supplied purposes value (the manual
@@ -94,7 +75,44 @@ export function sanitizePurposes(raw) {
     for (const item of raw) {
         if (typeof item !== "string")
             return undefined;
-        purposes.push(item.trim());
+        purposes.push(trimPortableConsentWhitespace(item));
+    }
+    const encoded = JSON.stringify({
+        v: CONSENT_ENVELOPE_VERSION,
+        p: purposes,
+    });
+    return parsePortableConsentEnvelope(encoded, false)?.purposes;
+}
+/**
+ * sanitizeConsentSource preserves the manual API's default while applying the
+ * same portable whitespace and byte bounds as every envelope reader.
+ */
+export function sanitizeConsentSource(raw) {
+    if (raw !== undefined && typeof raw !== "string")
+        return undefined;
+    const trimmed = typeof raw === "string" ? trimPortableConsentWhitespace(raw) : "";
+    const source = trimmed === "" ? "manual" : trimmed;
+    const encoded = JSON.stringify({
+        v: CONSENT_ENVELOPE_VERSION,
+        p: [],
+        src: source,
+    });
+    return parsePortableConsentEnvelope(encoded, false)?.source;
+}
+function prepareConsentEnvelope(purposes, src, now) {
+    try {
+        const serialized = JSON.stringify({
+            v: CONSENT_ENVELOPE_VERSION,
+            p: purposes,
+            t: new Date((now ?? Date.now)()).toISOString(),
+            src,
+        });
+        const snapshot = parsePortableConsentEnvelope(serialized, false);
+        return snapshot === null
+            ? null
+            : { encoded: encodeURIComponent(serialized), snapshot };
+    }
+    catch {
+        return null;
     }
-    return purposes;
 }

package/dist/collect/declarative.d.ts

@@ -31,5 +31,5 @@ export declare function toCustomEventName(raw: unknown): string | undefined;
  * environment has an IntersectionObserver, observes every visible-declared
  * element present at start.
  */
-export declare function startDeclarative(emit: (event: PendingEvent) => void, env: DeclarativeEnv): void;
+export declare function startDeclarative(emit: (event: PendingEvent) => void, env: DeclarativeEnv, refresh?: () => void): void;
 export {};

package/dist/collect/declarative.js

@@ -6,6 +6,7 @@
 const EVENT_ATTR = "data-aci-event";
 const ON_ATTR = "data-aci-on";
 const PROP_ATTR_PREFIX = "data-aci-prop-";
+const REFRESH_ATTR = "data-aci-refresh";
 const CUSTOM_PREFIX = "custom.";
 const VISIBLE_THRESHOLD = 0.5;
 /**
@@ -50,11 +51,16 @@ function trigger(el) {
  * environment has an IntersectionObserver, observes every visible-declared
  * element present at start.
  */
-export function startDeclarative(emit, env) {
+export function startDeclarative(emit, env, refresh) {
     const { document: doc, debug } = env;
     doc.addEventListener("click", (e) => {
         try {
             const target = e.target;
+            const refreshTarget = target?.closest?.(`[${REFRESH_ATTR}]`);
+            if (refreshTarget) {
+                refresh?.();
+                return;
+            }
             const el = target?.closest?.(`[${EVENT_ATTR}]`);
             if (!el)
                 return;