@gradial/aci 0.1.41 → 0.1.43

package/dist/collect/index.js

@@ -3,18 +3,19 @@
 // init(); every failure is swallowed after a debug record so the page is
 // never affected (QR-2/3).
 import { installCommandQueue } from "./api.js";
+import { createAssignments, withAssignmentContext } from "./assignments.js";
 import { Batcher } from "./batcher.js";
 import { createDebug, readTagConfig } from "./config.js";
 import { start as startC15t } from "./consent/adapters/c15t.js";
 import { start as startCookiebot } from "./consent/adapters/cookiebot.js";
 import { start as startOneTrust } from "./consent/adapters/onetrust.js";
 import { start as startTrustArc } from "./consent/adapters/trustarc.js";
-import { applyConsent, envelopeGrantsPersonalization, readConsentCookie, sanitizePurposes, } from "./consent/envelope.js";
+import { applyConsent, envelopeGrantsPersonalization, readConsentCookie, sanitizeConsentSource, sanitizePurposes, } from "./consent/envelope.js";
 import { startDeclarative } from "./declarative.js";
 import { GapBuffer, hasMintMarker, maybeFlushGapBuffer, routeEvent, } from "./gapbuffer.js";
 import { startLinkClicks } from "./linkclicks.js";
-import { startPageViews } from "./pageviews.js";
-import { send } from "./transport.js";
+import { installNavigationHook, startPageViews, } from "./pageviews.js";
+import { refreshClaims, send } from "./transport.js";
 import { ulid } from "./ulid.js";
 import { startVariationViews } from "./variationviews.js";
 import { startWebVitals } from "./webvitals.js";
@@ -94,12 +95,24 @@ export function init(win) {
             documentTarget: doc,
             windowTarget: w,
         });
+        // While an assignment is active, every emitted event carries the first
+        // active assignment's experiment context (REQ-3) unless it already has
+        // one — exposures and explicit conversions carry their own. The handle
+        // is created (without emitting) BEFORE emit so every dependency of emit
+        // exists before emit can run; exposures flow at start() below.
+        const assignments = createAssignments({ document: doc, window: w, debug });
         const emit = (event) => {
             routeEvent({
-                ...event,
+                ...withAssignmentContext(event, assignments),
                 eventId: ulid(undefined, (bytes) => w.crypto.getRandomValues(bytes)),
             }, { grants, marker, gapBuffer, batcher });
         };
+        // Started BEFORE the command-queue drain and page views: pre-load
+        // aci('track', ...) calls and the initial rum.page_view must be stamped
+        // with the active assignment context, or queued conversions can never
+        // match a goal (review-quorum finding). Consent commands drained after
+        // this stay safe — events wait in the gap buffer until grants resolve.
+        assignments.start(emit);
         installCommandQueue(w, cfg, {
             track: (name, properties) => emit({ eventName: name, properties }),
             consent: ({ p, src }) => {
@@ -108,14 +121,34 @@ export function init(win) {
                     debug("consent", { reason: "malformed_purposes" });
                     return;
                 }
-                applyConsent(purposes, typeof src === "string" && src.trim() !== "" ? src.trim() : "manual", { document: doc, gapBuffer });
+                const source = sanitizeConsentSource(src);
+                if (source === undefined) {
+                    debug("consent", { reason: "malformed_source" });
+                    return;
+                }
+                if (!applyConsent(purposes, source, { document: doc, gapBuffer })) {
+                    debug("consent", { reason: "oversized_envelope" });
+                }
             },
         }, debug);
-        startPageViews(emit, w);
+        const emitPageView = startPageViews(emit, w);
+        // The single history patch (one pushState/replaceState wrap, one dedupe
+        // state, one popstate listener). Order is load-bearing: the assignments
+        // re-arm runs BEFORE the SPA page view so rum.page_view is stamped with
+        // the new page's experiment context.
+        installNavigationHook(w, [
+            () => assignments.rearm(),
+            emitPageView,
+        ]);
         startDeclarative(emit, {
             document: doc,
             intersectionObserver: w.IntersectionObserver,
             debug,
+        }, () => {
+            void refreshClaims(transportEnv).then((refreshed) => {
+                if (refreshed)
+                    w.location.reload();
+            });
         });
         startLinkClicks(emit, { document: doc, debug });
         startWebVitals(emit, {

package/dist/collect/linkclicks.js

@@ -3,7 +3,9 @@
 // document; the closest a[href] ancestor of the click target is recorded.
 // target="_blank" links are still captured — the click event is useful RUM
 // even when the browser opens a new tab, and dropping them would lose a
-// measurable fraction of outbound intent. Errors are swallowed silently.
+// measurable fraction of outbound intent. Capture phase keeps application
+// stopPropagation handlers from suppressing telemetry. Errors are swallowed
+// silently.
 export const LINK_CLICK_EVENT = "rum.link_click";
 /**
  * startLinkClicks installs one delegated click listener on document that
@@ -31,5 +33,5 @@ export function startLinkClicks(emit, env) {
         catch (err) {
             debug?.("capture", { reason: "link_click_failed", error: String(err) });
         }
-    });
+    }, { capture: true });
 }

package/dist/collect/pageviews.d.ts

@@ -15,8 +15,20 @@ export interface PageViewWindow {
     addEventListener(type: string, fn: () => void): void;
 }
 /**
- * startPageViews emits the initial page view and hooks
- * pushState/replaceState/popstate for SPA route changes.
+ * installNavigationHook wires pushState/replaceState/popstate and invokes
+ * the subscribers, in order, once per SPA route change; hash-only changes
+ * and same-URL repeats never fire. Installed exactly ONCE by init — one
+ * history patch, one dedupe state — and shared by the assignments collector
+ * and page views so "page view" means exactly the same thing to both
+ * (REQ-2). Subscriber order is the contract: init lists the assignments
+ * re-arm BEFORE the page-view emitter so rum.page_view is stamped with the
+ * new page's experiment context.
  */
-export declare function startPageViews(emit: (event: PendingEvent) => void, win: PageViewWindow): void;
+export declare function installNavigationHook(win: PageViewWindow, subscribers: ReadonlyArray<() => void>): void;
+/**
+ * startPageViews emits the initial page view and returns the emitter for
+ * SPA route-change views — init subscribes it to the single navigation hook
+ * (after the assignments re-arm; see installNavigationHook).
+ */
+export declare function startPageViews(emit: (event: PendingEvent) => void, win: PageViewWindow): () => void;
 export {};

package/dist/collect/pageviews.js

@@ -9,34 +9,49 @@ function stripHash(href) {
     return i === -1 ? href : href.slice(0, i);
 }
 /**
- * startPageViews emits the initial page view and hooks
- * pushState/replaceState/popstate for SPA route changes.
+ * installNavigationHook wires pushState/replaceState/popstate and invokes
+ * the subscribers, in order, once per SPA route change; hash-only changes
+ * and same-URL repeats never fire. Installed exactly ONCE by init — one
+ * history patch, one dedupe state — and shared by the assignments collector
+ * and page views so "page view" means exactly the same thing to both
+ * (REQ-2). Subscriber order is the contract: init lists the assignments
+ * re-arm BEFORE the page-view emitter so rum.page_view is stamped with the
+ * new page's experiment context.
  */
-export function startPageViews(emit, win) {
-    const view = () => emit({
-        eventName: PAGE_VIEW_EVENT,
-        url: win.location.href,
-        referrer: win.document.referrer,
-    });
+export function installNavigationHook(win, subscribers) {
     let last = stripHash(win.location.href);
-    view();
-    const onNavigate = () => {
+    const handler = () => {
         const current = stripHash(win.location.href);
         if (current === last)
             return; // hash-only change or same-URL repeat
         last = current;
-        view();
+        for (const onNavigate of subscribers)
+            onNavigate();
     };
     const history = win.history;
     const wrap = (method) => {
         const original = history[method].bind(history);
         history[method] = (...args) => {
             const result = original(...args);
-            onNavigate();
+            handler();
             return result;
         };
     };
     wrap("pushState");
     wrap("replaceState");
-    win.addEventListener("popstate", onNavigate);
+    win.addEventListener("popstate", handler);
+}
+/**
+ * startPageViews emits the initial page view and returns the emitter for
+ * SPA route-change views — init subscribes it to the single navigation hook
+ * (after the assignments re-arm; see installNavigationHook).
+ */
+export function startPageViews(emit, win) {
+    const view = () => emit({
+        eventName: PAGE_VIEW_EVENT,
+        url: win.location.href,
+        referrer: win.document.referrer,
+    });
+    view();
+    return view;
 }

package/dist/collect/transport.d.ts

@@ -7,12 +7,15 @@ export type FetchLike = (input: string, init?: {
     method?: string;
     body?: Blob;
     keepalive?: boolean;
+    credentials?: "same-origin";
 }) => Promise<unknown>;
 export interface TransportEnv {
     /** Present key (even if undefined) overrides the global for tests. */
     navigator?: BeaconNavigator | undefined;
     fetch?: FetchLike | undefined;
     debug?: DebugFn;
+    /** Injectable only so refresh-envelope identity is deterministic in tests. */
+    createEnvelopeId?: () => string;
 }
 /**
  * send posts one serialized batch envelope to the relative collect path.
@@ -20,3 +23,4 @@ export interface TransportEnv {
  * never affected.
  */
 export declare function send(body: string, env?: TransportEnv): void;
+export declare function refreshClaims(env?: TransportEnv): Promise<boolean>;

package/dist/collect/transport.js

@@ -1,7 +1,9 @@
 // Transport (design/05): navigator.sendBeacon("/collect", Blob text/plain)
 // with a keepalive-fetch fallback. Fire-and-forget — no retry loop in v1;
-// eventIds make a future retry layer safe. The path is RELATIVE so requests
-// stay exactly same-origin (data-plane design/04).
+// the sealed envelopeId and bytes are the identity any future retry layer
+// must reuse. The path is RELATIVE so requests stay exactly same-origin
+// (data-plane design/04).
+import { ulid } from "./ulid.js";
 export const COLLECT_PATH = "/collect";
 /**
  * send posts one serialized batch envelope to the relative collect path.
@@ -50,3 +52,36 @@ export function send(body, env) {
         debug?.("flush", { reason: "fetch_failed", error: String(err) });
     }
 }
+// refreshClaims deliberately uses fetch rather than sendBeacon. The host's
+// response may refresh the visitor's audience state, so this explicit action
+// must make a normal same-origin request with an empty event envelope.
+export function refreshClaims(env) {
+    const fetchFn = env !== undefined && "fetch" in env
+        ? env.fetch
+        : globalThis.fetch;
+    if (!fetchFn)
+        return Promise.resolve(false);
+    try {
+        const envelopeId = (env?.createEnvelopeId ?? ulid)();
+        const body = new Blob([`{"envelopeId":"${envelopeId}","events":[]}`], { type: "text/plain" });
+        return fetchFn(COLLECT_PATH, {
+            method: "POST",
+            body,
+            keepalive: true,
+            credentials: "same-origin",
+        }).then((response) => {
+            if (typeof response === "object" && response !== null && "ok" in response && response.ok === false) {
+                env?.debug?.("flush", { reason: "refresh_failed", status: "not_ok" });
+                return false;
+            }
+            return true;
+        }).catch((err) => {
+            env?.debug?.("flush", { reason: "refresh_failed", error: String(err) });
+            return false;
+        });
+    }
+    catch (err) {
+        env?.debug?.("flush", { reason: "refresh_failed", error: String(err) });
+        return Promise.resolve(false);
+    }
+}

package/dist/consent/portable-envelope.d.ts

@@ -0,0 +1,9 @@
+export interface PortableConsentSnapshot {
+    version: number;
+    purposes: string[];
+    grantedAt: string;
+    source?: string;
+}
+export declare function parsePortableConsentEnvelope(raw: string, decodeCookieValue?: boolean): PortableConsentSnapshot | null;
+export declare function portableConsentAllowsPersonalization(snapshot: PortableConsentSnapshot | null): boolean;
+export declare function trimPortableConsentWhitespace(value: string): string;

package/dist/consent/portable-envelope.js

@@ -0,0 +1,110 @@
+const encoder = new TextEncoder();
+const MAX_CONSENT_ENVELOPE_BYTES = 2048;
+const MAX_CONSENT_PURPOSES = 32;
+const MAX_CONSENT_PURPOSE_BYTES = 128;
+const MAX_CONSENT_SOURCE_BYTES = 512;
+const MAX_CONSENT_POLICY_VERSION = 2147483647;
+const RFC3339 = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,9}))?(Z|[+-]\d{2}:\d{2})$/;
+const CONSENT_EDGE_WHITESPACE = /^[\t\n\v\f\r ]+|[\t\n\v\f\r ]+$/g;
+const LEGACY_GRANTS = new Set([
+    'true',
+    'all',
+    'granted',
+    'yes',
+    'personalization',
+    'personalized',
+]);
+export function parsePortableConsentEnvelope(raw, decodeCookieValue = true) {
+    let decoded = trimPortableConsentWhitespace(raw);
+    if (!decoded)
+        return null;
+    if (decodeCookieValue) {
+        try {
+            decoded = decodeURIComponent(decoded);
+        }
+        catch {
+            // Evaluate the original cookie value.
+        }
+    }
+    decoded = trimPortableConsentWhitespace(decoded);
+    if (!decoded
+        || encoder.encode(decoded).byteLength > MAX_CONSENT_ENVELOPE_BYTES) {
+        return null;
+    }
+    if (LEGACY_GRANTS.has(decoded.toLowerCase())) {
+        return {
+            version: 0,
+            purposes: ['personalization'],
+            grantedAt: '',
+        };
+    }
+    try {
+        const parsed = JSON.parse(decoded);
+        const grantedAt = typeof parsed.t === 'string' ? parsed.t : '';
+        if (!Number.isInteger(parsed.v)
+            || parsed.v < 0
+            || parsed.v > MAX_CONSENT_POLICY_VERSION
+            || !Array.isArray(parsed.p)
+            || parsed.p.length > MAX_CONSENT_PURPOSES
+            || !parsed.p.every((item) => typeof item === 'string')
+            || parsed.p.some((item) => encoder.encode(item).byteLength > MAX_CONSENT_PURPOSE_BYTES)
+            || (parsed.t !== undefined
+                && parsed.t !== null
+                && (typeof parsed.t !== 'string'
+                    || parsed.t === ''
+                    || !isPortableRFC3339(parsed.t)))
+            || (parsed.src !== undefined
+                && parsed.src !== null
+                && typeof parsed.src !== 'string')
+            || (typeof parsed.src === 'string'
+                && encoder.encode(parsed.src).byteLength > MAX_CONSENT_SOURCE_BYTES)) {
+            return null;
+        }
+        return {
+            version: parsed.v,
+            purposes: parsed.p,
+            grantedAt,
+            source: typeof parsed.src === 'string' ? parsed.src : undefined,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function portableConsentAllowsPersonalization(snapshot) {
+    return snapshot?.purposes.some((purpose) => trimPortableConsentWhitespace(purpose).toLowerCase()
+        === 'personalization') || false;
+}
+export function trimPortableConsentWhitespace(value) {
+    return value.replace(CONSENT_EDGE_WHITESPACE, '');
+}
+function isPortableRFC3339(value) {
+    const match = RFC3339.exec(value);
+    if (!match || Number.isNaN(Date.parse(value)))
+        return false;
+    const year = Number(match[1]);
+    const month = Number(match[2]);
+    const day = Number(match[3]);
+    const hour = Number(match[4]);
+    const minute = Number(match[5]);
+    const second = Number(match[6]);
+    if (month < 1
+        || month > 12
+        || day < 1
+        || day > daysInMonth(year, month)
+        || hour > 23
+        || minute > 59
+        || second > 59) {
+        return false;
+    }
+    const zone = match[8];
+    return zone === 'Z'
+        || (Number(zone.slice(1, 3)) <= 23
+            && Number(zone.slice(4, 6)) <= 59);
+}
+function daysInMonth(year, month) {
+    if (month === 2) {
+        return year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0) ? 29 : 28;
+    }
+    return [4, 6, 9, 11].includes(month) ? 30 : 31;
+}

package/dist/consent-banner/index.d.ts

@@ -0,0 +1,33 @@
+export interface ConsentBannerOptions {
+    /** Heading text. Default: "Privacy" */
+    heading?: string;
+    /** Body text explaining what the user is consenting to. */
+    message?: string;
+    /** Label for the accept button. Default: "Accept" */
+    acceptLabel?: string;
+    /** Label for the reject button. Default: "Reject" */
+    rejectLabel?: string;
+    /** Label for a link to the privacy policy. Optional. */
+    privacyPolicyLabel?: string;
+    /** URL to the privacy policy. Optional. */
+    privacyPolicyHref?: string;
+    /** Source identifier written to the cookie envelope. Default: "banner" */
+    source?: string;
+    /** Callback fired after a consent decision is written. */
+    onDecision?: (granted: boolean) => void;
+}
+/**
+ * hasConsentCookie returns true when the aci_consent cookie exists (the user
+ * has already made a decision, regardless of whether they granted or denied).
+ */
+export declare function hasConsentCookie(doc: {
+    cookie: string;
+}): boolean;
+/**
+ * mountConsentBanner checks for an existing consent cookie. If none exists,
+ * it injects a banner into the document body and wires up accept/reject
+ * buttons. If a cookie already exists, it does nothing (idempotent).
+ *
+ * Returns a cleanup function that removes the banner and event listeners.
+ */
+export declare function mountConsentBanner(doc: Document, opts?: ConsentBannerOptions): () => void;

package/dist/consent-banner/index.js

@@ -0,0 +1,100 @@
+// First-party consent banner (design/04, preset="manual"): a self-contained
+// client-side component for sites that don't have an external CMP (c15t,
+// OneTrust, etc.). Checks for the aci_consent cookie, shows a banner if
+// absent, and calls applyConsent() on user decision.
+//
+// The banner is framework-agnostic — it renders plain DOM and is driven by
+// CSS classes so each site can style it. The Astro wrapper component
+// (packages/sdk/src/astro/ConsentBanner.astro) imports and invokes this,
+// then applies site-specific styles.
+import { applyConsent, readConsentCookie, PERSONALIZATION_PURPOSE, } from "../collect/consent/envelope.js";
+const DEFAULTS = {
+    heading: "Privacy",
+    message: "We use cookies to personalize content and improve your experience. You can accept or reject personalization.",
+    acceptLabel: "Accept",
+    rejectLabel: "Reject",
+    source: "banner",
+};
+const BANNER_ID = "aci-consent-banner";
+const BANNER_ATTR = "data-aci-consent-banner";
+const BANNER_HIDDEN = "aci-consent-banner--hidden";
+/**
+ * hasConsentCookie returns true when the aci_consent cookie exists (the user
+ * has already made a decision, regardless of whether they granted or denied).
+ */
+export function hasConsentCookie(doc) {
+    return readConsentCookie(doc) !== undefined;
+}
+/**
+ * mountConsentBanner checks for an existing consent cookie. If none exists,
+ * it injects a banner into the document body and wires up accept/reject
+ * buttons. If a cookie already exists, it does nothing (idempotent).
+ *
+ * Returns a cleanup function that removes the banner and event listeners.
+ */
+export function mountConsentBanner(doc, opts = {}) {
+    if (hasConsentCookie(doc))
+        return () => { };
+    if (doc.getElementById(BANNER_ID))
+        return () => { };
+    const config = { ...DEFAULTS, ...opts };
+    const banner = createBannerElement(config, doc);
+    doc.body.appendChild(banner);
+    const cleanup = () => {
+        banner.remove();
+    };
+    const decide = (granted) => {
+        const purposes = granted ? [PERSONALIZATION_PURPOSE] : [];
+        if (!applyConsent(purposes, config.source, { document: doc }))
+            return;
+        banner.classList.add(BANNER_HIDDEN);
+        setTimeout(cleanup, 300);
+        opts.onDecision?.(granted);
+    };
+    banner.querySelector("[data-aci-consent-accept]")?.addEventListener("click", () => decide(true));
+    banner.querySelector("[data-aci-consent-reject]")?.addEventListener("click", () => decide(false));
+    return cleanup;
+}
+function createBannerElement(config, doc) {
+    const banner = doc.createElement("div");
+    banner.id = BANNER_ID;
+    banner.setAttribute(BANNER_ATTR, "");
+    banner.className = BANNER_ID;
+    const content = doc.createElement("div");
+    content.className = `${BANNER_ID}__content`;
+    const text = doc.createElement("div");
+    text.className = `${BANNER_ID}__text`;
+    const heading = doc.createElement("p");
+    heading.className = `${BANNER_ID}__heading`;
+    heading.textContent = config.heading;
+    text.appendChild(heading);
+    const message = doc.createElement("p");
+    message.className = `${BANNER_ID}__message`;
+    message.textContent = config.message;
+    text.appendChild(message);
+    if (config.privacyPolicyHref && config.privacyPolicyLabel) {
+        const link = doc.createElement("a");
+        link.className = `${BANNER_ID}__privacy-link`;
+        link.href = config.privacyPolicyHref;
+        link.textContent = config.privacyPolicyLabel;
+        text.appendChild(link);
+    }
+    content.appendChild(text);
+    const actions = doc.createElement("div");
+    actions.className = `${BANNER_ID}__actions`;
+    const rejectBtn = doc.createElement("button");
+    rejectBtn.type = "button";
+    rejectBtn.className = `${BANNER_ID}__btn ${BANNER_ID}__btn--reject`;
+    rejectBtn.setAttribute("data-aci-consent-reject", "");
+    rejectBtn.textContent = config.rejectLabel;
+    actions.appendChild(rejectBtn);
+    const acceptBtn = doc.createElement("button");
+    acceptBtn.type = "button";
+    acceptBtn.className = `${BANNER_ID}__btn ${BANNER_ID}__btn--accept`;
+    acceptBtn.setAttribute("data-aci-consent-accept", "");
+    acceptBtn.textContent = config.acceptLabel;
+    actions.appendChild(acceptBtn);
+    content.appendChild(actions);
+    banner.appendChild(content);
+    return banner;
+}

package/dist/content/assets.d.ts

@@ -5,6 +5,7 @@ export interface ReleaseAssetConfig {
     accessKeyId?: string;
     secretAccessKey?: string;
     sessionToken?: string;
+    roleArn?: string;
     endpoint?: string;
 }
 export declare class ReleaseAssetNotFoundError extends Error {

package/dist/content/assets.js

@@ -19,6 +19,7 @@ export async function getReleaseAssetResponse(input) {
         accessKeyId: config.accessKeyId,
         secretAccessKey: config.secretAccessKey,
         sessionToken: config.sessionToken,
+        roleArn: config.roleArn,
         endpoint: config.endpoint,
     });
     const key = joinKey(provider.config.keyPrefix, 'assets', clean);

package/dist/content/personalization.d.ts

@@ -55,3 +55,38 @@ export declare function collectTagAttributes(siteConfig: PersonalizationSiteConf
  * when personalization is disabled.
  */
 export declare function collectScriptTagHTML(siteConfig: PersonalizationSiteConfig | null | undefined): string;
+/** Version of the data-aci-assignments tag body. */
+export declare const ASSIGNMENTS_TAG_VERSION = 1;
+/**
+ * One experiment assignment carried by a variant payload's `experiments`
+ * block (wire field names match the SDK event contract).
+ */
+export interface ExperimentAssignmentContext {
+    experimentId: string;
+    armId: string;
+    allocationVersion: string;
+}
+/**
+ * The minimal page-payload surface assignments tag emission reads: the
+ * top-level `experiments` block stamped at build time onto experiment
+ * variant payloads. `KernelPage` satisfies this structurally.
+ */
+export interface AssignmentsPayloadSource {
+    experiments?: ExperimentAssignmentContext[] | null;
+}
+/**
+ * assignmentsScriptJSON derives the HTML-safe JSON body of the
+ * data-aci-assignments tag ({"v":1,"experiments":[…]}) from the page
+ * payload, or "" when the payload carries no experiment assignments.
+ * `<` / `>` / `&` are \u-escaped so the JSON can never break out of the
+ * script element (standard JSON-in-script escaping; application/json tags
+ * are data, never executed).
+ */
+export declare function assignmentsScriptJSON(page: AssignmentsPayloadSource | null | undefined): string;
+/**
+ * assignmentsScriptTagHTML renders the contract tag
+ * (`<script type="application/json" data-aci-assignments>…</script>`,
+ * design/04) as an HTML snippet for emitters without a React element seam
+ * (the Astro slug page). Returns "" when the payload carries no assignments.
+ */
+export declare function assignmentsScriptTagHTML(page: AssignmentsPayloadSource | null | undefined): string;

package/dist/content/personalization.js

@@ -52,3 +52,60 @@ function escapeAttribute(value) {
         .replace(/</g, "&lt;")
         .replace(/>/g, "&gt;");
 }
+// ---------------------------------------------------------------------------
+// Assignments tag (personalization-reporting design/04, D-PR-6): experiment
+// variant payloads carry a build-time `experiments` block; the starters
+// render it as ONE page-level JSON script tag the collect SDK reads for
+// exposure emission and context stamping. Base payloads carry no block and
+// emit no tag. Like the collect tag, both framework emitters derive the tag
+// through this module so there is exactly one derivation code path.
+// ---------------------------------------------------------------------------
+/** Version of the data-aci-assignments tag body. */
+export const ASSIGNMENTS_TAG_VERSION = 1;
+function isAssignment(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const record = value;
+    return (typeof record.experimentId === "string" &&
+        record.experimentId !== "" &&
+        typeof record.armId === "string" &&
+        record.armId !== "" &&
+        typeof record.allocationVersion === "string");
+}
+/**
+ * assignmentsScriptJSON derives the HTML-safe JSON body of the
+ * data-aci-assignments tag ({"v":1,"experiments":[…]}) from the page
+ * payload, or "" when the payload carries no experiment assignments.
+ * `<` / `>` / `&` are \u-escaped so the JSON can never break out of the
+ * script element (standard JSON-in-script escaping; application/json tags
+ * are data, never executed).
+ */
+export function assignmentsScriptJSON(page) {
+    const experiments = (page?.experiments ?? []).filter(isAssignment);
+    if (experiments.length === 0)
+        return "";
+    const body = JSON.stringify({
+        v: ASSIGNMENTS_TAG_VERSION,
+        experiments: experiments.map(({ experimentId, armId, allocationVersion }) => ({
+            experimentId,
+            armId,
+            allocationVersion,
+        })),
+    });
+    return body
+        .replace(/</g, "\\u003c")
+        .replace(/>/g, "\\u003e")
+        .replace(/&/g, "\\u0026");
+}
+/**
+ * assignmentsScriptTagHTML renders the contract tag
+ * (`<script type="application/json" data-aci-assignments>…</script>`,
+ * design/04) as an HTML snippet for emitters without a React element seam
+ * (the Astro slug page). Returns "" when the payload carries no assignments.
+ */
+export function assignmentsScriptTagHTML(page) {
+    const json = assignmentsScriptJSON(page);
+    if (!json)
+        return "";
+    return `<script type="application/json" data-aci-assignments>${json}</script>`;
+}

package/dist/content/resolve-slots.js

@@ -12,6 +12,7 @@ export async function resolveSlots(layout, pageRegions, getFragment) {
             for (const ref of defaults) {
                 const fragment = await getFragment(ref.fragmentId);
                 blocks.push({
+                    $type: 'component',
                     id: fragment.id,
                     component: fragment.component,
                     props: fragment.props || {},