@gradial/aci 0.1.42 → 0.1.43

package/dist/collect/batcher.d.ts

@@ -45,6 +45,8 @@ interface ListenerTarget {
 export interface BatcherOptions {
     /** Transport for one serialized batch envelope. */
     send: (body: string) => void;
+    /** Injectable only so tests can prove one ID is minted per sealed batch. */
+    createEnvelopeId?: () => string;
     debug?: DebugFn;
     /** Runs at the start of every flush tick (gap-buffer marker re-check). */
     onTick?: () => void;

package/dist/collect/batcher.js

@@ -1,7 +1,9 @@
 // Batcher (design/05): queue events, split so no request exceeds the 60 KiB
-// planning threshold (64 KiB wire ceiling), flush on start, size, interval,
-// visibilitychange and pagehide. Byte accounting is incremental — a running
-// per-event size computed at enqueue — so a flush stays O(n).
+// planning threshold (64 KiB wire ceiling), mint one envelope ULID per sealed
+// batch, and flush on start, size, interval, visibilitychange and pagehide.
+// Byte accounting is incremental — a running per-event size computed at
+// enqueue — so a flush stays O(n).
+import { ulid } from "./ulid.js";
 /** Planning threshold: full serialized envelope, UTF-8 bytes. */
 export const MAX_BATCH_BYTES = 60 * 1024;
 /**
@@ -14,9 +16,14 @@ export const MAX_BATCH_BYTES = 60 * 1024;
 export const MAX_BATCH_EVENTS = 100;
 /** Flush interval (build-time constant, design/04 config table). */
 export const FLUSH_INTERVAL_MS = 5000;
-const ENVELOPE_PREFIX = '{"events":[';
+const ENVELOPE_PREFIX = '{"envelopeId":"';
+const EVENTS_PREFIX = '","events":[';
 const ENVELOPE_SUFFIX = "]}";
-const ENVELOPE_OVERHEAD = ENVELOPE_PREFIX.length + ENVELOPE_SUFFIX.length;
+const ENVELOPE_ID_BYTES = 26;
+const ENVELOPE_OVERHEAD = ENVELOPE_PREFIX.length +
+    ENVELOPE_ID_BYTES +
+    EVENTS_PREFIX.length +
+    ENVELOPE_SUFFIX.length;
 const encoder = new TextEncoder();
 const utf8ByteLength = (s) => encoder.encode(s).length;
 export class Batcher {
@@ -131,7 +138,12 @@ export class Batcher {
             }
             if (parts.length === 0)
                 continue;
-            this.options.send(ENVELOPE_PREFIX + parts.join(",") + ENVELOPE_SUFFIX);
+            const envelopeId = (this.options.createEnvelopeId ?? ulid)();
+            this.options.send(ENVELOPE_PREFIX +
+                envelopeId +
+                EVENTS_PREFIX +
+                parts.join(",") +
+                ENVELOPE_SUFFIX);
         }
     }
 }

package/dist/collect/consent/envelope.d.ts

@@ -21,16 +21,17 @@ export interface ApplyConsentDeps extends ConsentWriteDeps {
 }
 /**
  * writeConsent builds the {v:1, p, t, src} envelope, URL-encodes it and sets
- * the aci_consent cookie (Path=/, SameSite=Lax, Secure on https).
+ * the aci_consent cookie (Path=/, SameSite=Lax, Secure on https). Inputs that
+ * cannot produce a portable envelope are ignored.
  */
-export declare function writeConsent(purposes: string[], src: string, deps: ConsentWriteDeps): void;
+export declare function writeConsent(purposes: string[], src: string, deps: ConsentWriteDeps): boolean;
 /**
  * applyConsent is the single write path for every consent decision — CMP
  * adapters and the manual JS API alike. Any decision where personalization
  * is absent purges the gap buffer (REQ-8), and the envelope is still
  * written: withdrawal must reach the server.
  */
-export declare function applyConsent(purposes: string[], src: string, deps: ApplyConsentDeps): void;
+export declare function applyConsent(purposes: string[], src: string, deps: ApplyConsentDeps): boolean;
 /** readConsentCookie returns the raw (still URL-encoded) cookie value. */
 export declare function readConsentCookie(doc: {
     cookie: string;
@@ -47,3 +48,8 @@ export declare function envelopeGrantsPersonalization(raw: string | undefined):
  * and the command is ignored.
  */
 export declare function sanitizePurposes(raw: unknown): string[] | undefined;
+/**
+ * sanitizeConsentSource preserves the manual API's default while applying the
+ * same portable whitespace and byte bounds as every envelope reader.
+ */
+export declare function sanitizeConsentSource(raw: unknown): string | undefined;

package/dist/collect/consent/envelope.js

@@ -2,33 +2,26 @@
 // carries URL-encoded JSON {v:1, p, t, src} — cookie values cannot carry
 // quotes. The collector and the edge URL-decode before parsing, with a
 // legacy bare-token fallback during the deprecation window.
+import { parsePortableConsentEnvelope, portableConsentAllowsPersonalization, trimPortableConsentWhitespace, } from "../../consent/portable-envelope.js";
 export const PERSONALIZATION_PURPOSE = "personalization";
 export const CONSENT_COOKIE = "aci_consent";
 export const CONSENT_ENVELOPE_VERSION = 1;
 /** Consent persistence horizon; the CMP remains the source of truth. */
 export const CONSENT_MAX_AGE_S = 365 * 24 * 60 * 60;
-/** Mirrors the server-side grandfathered tokens (audience collect_signals). */
-const LEGACY_GRANT_TOKENS = new Set([
-    "true",
-    "all",
-    "granted",
-    "yes",
-    "personalization",
-    "personalized",
-]);
 /**
  * writeConsent builds the {v:1, p, t, src} envelope, URL-encodes it and sets
- * the aci_consent cookie (Path=/, SameSite=Lax, Secure on https).
+ * the aci_consent cookie (Path=/, SameSite=Lax, Secure on https). Inputs that
+ * cannot produce a portable envelope are ignored.
  */
 export function writeConsent(purposes, src, deps) {
-    const envelope = {
-        v: CONSENT_ENVELOPE_VERSION,
-        p: purposes,
-        t: new Date((deps.now ?? Date.now)()).toISOString(),
-        src,
-    };
-    const value = encodeURIComponent(JSON.stringify(envelope));
-    let cookie = `${CONSENT_COOKIE}=${value}; Path=/; Max-Age=${CONSENT_MAX_AGE_S}; SameSite=Lax`;
+    const prepared = prepareConsentEnvelope(purposes, src, deps.now);
+    if (prepared === null)
+        return false;
+    writePreparedConsent(prepared, deps);
+    return true;
+}
+function writePreparedConsent(prepared, deps) {
+    let cookie = `${CONSENT_COOKIE}=${prepared.encoded}; Path=/; Max-Age=${CONSENT_MAX_AGE_S}; SameSite=Lax`;
     if (deps.document.location?.protocol === "https:") {
         cookie += "; Secure";
     }
@@ -41,15 +34,19 @@ export function writeConsent(purposes, src, deps) {
  * written: withdrawal must reach the server.
  */
 export function applyConsent(purposes, src, deps) {
-    if (!purposes.includes(PERSONALIZATION_PURPOSE)) {
+    const prepared = prepareConsentEnvelope(purposes, src, deps.now);
+    if (prepared === null)
+        return false;
+    if (!portableConsentAllowsPersonalization(prepared.snapshot)) {
         deps.gapBuffer?.purge();
     }
-    writeConsent(purposes, src, deps);
+    writePreparedConsent(prepared, deps);
+    return true;
 }
 /** readConsentCookie returns the raw (still URL-encoded) cookie value. */
 export function readConsentCookie(doc) {
     for (const part of doc.cookie.split(";")) {
-        const trimmed = part.trim();
+        const trimmed = trimPortableConsentWhitespace(part);
         if (trimmed.startsWith(CONSENT_COOKIE + "=")) {
             return trimmed.slice(CONSENT_COOKIE.length + 1);
         }
@@ -64,23 +61,7 @@ export function readConsentCookie(doc) {
 export function envelopeGrantsPersonalization(raw) {
     if (raw === undefined || raw === "")
         return false;
-    let decoded = raw;
-    try {
-        decoded = decodeURIComponent(raw);
-    }
-    catch {
-        // Not URL-encoded; evaluate as-is.
-    }
-    if (LEGACY_GRANT_TOKENS.has(decoded.trim().toLowerCase()))
-        return true;
-    try {
-        const envelope = JSON.parse(decoded);
-        return (Array.isArray(envelope.p) &&
-            envelope.p.includes(PERSONALIZATION_PURPOSE));
-    }
-    catch {
-        return false;
-    }
+    return portableConsentAllowsPersonalization(parsePortableConsentEnvelope(raw, true));
 }
 /**
  * sanitizePurposes validates a caller-supplied purposes value (the manual
@@ -94,7 +75,44 @@ export function sanitizePurposes(raw) {
     for (const item of raw) {
         if (typeof item !== "string")
             return undefined;
-        purposes.push(item.trim());
+        purposes.push(trimPortableConsentWhitespace(item));
+    }
+    const encoded = JSON.stringify({
+        v: CONSENT_ENVELOPE_VERSION,
+        p: purposes,
+    });
+    return parsePortableConsentEnvelope(encoded, false)?.purposes;
+}
+/**
+ * sanitizeConsentSource preserves the manual API's default while applying the
+ * same portable whitespace and byte bounds as every envelope reader.
+ */
+export function sanitizeConsentSource(raw) {
+    if (raw !== undefined && typeof raw !== "string")
+        return undefined;
+    const trimmed = typeof raw === "string" ? trimPortableConsentWhitespace(raw) : "";
+    const source = trimmed === "" ? "manual" : trimmed;
+    const encoded = JSON.stringify({
+        v: CONSENT_ENVELOPE_VERSION,
+        p: [],
+        src: source,
+    });
+    return parsePortableConsentEnvelope(encoded, false)?.source;
+}
+function prepareConsentEnvelope(purposes, src, now) {
+    try {
+        const serialized = JSON.stringify({
+            v: CONSENT_ENVELOPE_VERSION,
+            p: purposes,
+            t: new Date((now ?? Date.now)()).toISOString(),
+            src,
+        });
+        const snapshot = parsePortableConsentEnvelope(serialized, false);
+        return snapshot === null
+            ? null
+            : { encoded: encodeURIComponent(serialized), snapshot };
+    }
+    catch {
+        return null;
     }
-    return purposes;
 }

package/dist/collect/index.js

@@ -10,7 +10,7 @@ import { start as startC15t } from "./consent/adapters/c15t.js";
 import { start as startCookiebot } from "./consent/adapters/cookiebot.js";
 import { start as startOneTrust } from "./consent/adapters/onetrust.js";
 import { start as startTrustArc } from "./consent/adapters/trustarc.js";
-import { applyConsent, envelopeGrantsPersonalization, readConsentCookie, sanitizePurposes, } from "./consent/envelope.js";
+import { applyConsent, envelopeGrantsPersonalization, readConsentCookie, sanitizeConsentSource, sanitizePurposes, } from "./consent/envelope.js";
 import { startDeclarative } from "./declarative.js";
 import { GapBuffer, hasMintMarker, maybeFlushGapBuffer, routeEvent, } from "./gapbuffer.js";
 import { startLinkClicks } from "./linkclicks.js";
@@ -121,7 +121,14 @@ export function init(win) {
                     debug("consent", { reason: "malformed_purposes" });
                     return;
                 }
-                applyConsent(purposes, typeof src === "string" && src.trim() !== "" ? src.trim() : "manual", { document: doc, gapBuffer });
+                const source = sanitizeConsentSource(src);
+                if (source === undefined) {
+                    debug("consent", { reason: "malformed_source" });
+                    return;
+                }
+                if (!applyConsent(purposes, source, { document: doc, gapBuffer })) {
+                    debug("consent", { reason: "oversized_envelope" });
+                }
             },
         }, debug);
         const emitPageView = startPageViews(emit, w);

package/dist/collect/linkclicks.js

@@ -3,7 +3,9 @@
 // document; the closest a[href] ancestor of the click target is recorded.
 // target="_blank" links are still captured — the click event is useful RUM
 // even when the browser opens a new tab, and dropping them would lose a
-// measurable fraction of outbound intent. Errors are swallowed silently.
+// measurable fraction of outbound intent. Capture phase keeps application
+// stopPropagation handlers from suppressing telemetry. Errors are swallowed
+// silently.
 export const LINK_CLICK_EVENT = "rum.link_click";
 /**
  * startLinkClicks installs one delegated click listener on document that
@@ -31,5 +33,5 @@ export function startLinkClicks(emit, env) {
         catch (err) {
             debug?.("capture", { reason: "link_click_failed", error: String(err) });
         }
-    });
+    }, { capture: true });
 }

package/dist/collect/transport.d.ts

@@ -14,6 +14,8 @@ export interface TransportEnv {
     navigator?: BeaconNavigator | undefined;
     fetch?: FetchLike | undefined;
     debug?: DebugFn;
+    /** Injectable only so refresh-envelope identity is deterministic in tests. */
+    createEnvelopeId?: () => string;
 }
 /**
  * send posts one serialized batch envelope to the relative collect path.

package/dist/collect/transport.js

@@ -1,7 +1,9 @@
 // Transport (design/05): navigator.sendBeacon("/collect", Blob text/plain)
 // with a keepalive-fetch fallback. Fire-and-forget — no retry loop in v1;
-// eventIds make a future retry layer safe. The path is RELATIVE so requests
-// stay exactly same-origin (data-plane design/04).
+// the sealed envelopeId and bytes are the identity any future retry layer
+// must reuse. The path is RELATIVE so requests stay exactly same-origin
+// (data-plane design/04).
+import { ulid } from "./ulid.js";
 export const COLLECT_PATH = "/collect";
 /**
  * send posts one serialized batch envelope to the relative collect path.
@@ -60,7 +62,8 @@ export function refreshClaims(env) {
     if (!fetchFn)
         return Promise.resolve(false);
     try {
-        const body = new Blob(['{"events":[]}'], { type: "text/plain" });
+        const envelopeId = (env?.createEnvelopeId ?? ulid)();
+        const body = new Blob([`{"envelopeId":"${envelopeId}","events":[]}`], { type: "text/plain" });
         return fetchFn(COLLECT_PATH, {
             method: "POST",
             body,

package/dist/consent/portable-envelope.d.ts

@@ -0,0 +1,9 @@
+export interface PortableConsentSnapshot {
+    version: number;
+    purposes: string[];
+    grantedAt: string;
+    source?: string;
+}
+export declare function parsePortableConsentEnvelope(raw: string, decodeCookieValue?: boolean): PortableConsentSnapshot | null;
+export declare function portableConsentAllowsPersonalization(snapshot: PortableConsentSnapshot | null): boolean;
+export declare function trimPortableConsentWhitespace(value: string): string;

package/dist/consent/portable-envelope.js

@@ -0,0 +1,110 @@
+const encoder = new TextEncoder();
+const MAX_CONSENT_ENVELOPE_BYTES = 2048;
+const MAX_CONSENT_PURPOSES = 32;
+const MAX_CONSENT_PURPOSE_BYTES = 128;
+const MAX_CONSENT_SOURCE_BYTES = 512;
+const MAX_CONSENT_POLICY_VERSION = 2147483647;
+const RFC3339 = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,9}))?(Z|[+-]\d{2}:\d{2})$/;
+const CONSENT_EDGE_WHITESPACE = /^[\t\n\v\f\r ]+|[\t\n\v\f\r ]+$/g;
+const LEGACY_GRANTS = new Set([
+    'true',
+    'all',
+    'granted',
+    'yes',
+    'personalization',
+    'personalized',
+]);
+export function parsePortableConsentEnvelope(raw, decodeCookieValue = true) {
+    let decoded = trimPortableConsentWhitespace(raw);
+    if (!decoded)
+        return null;
+    if (decodeCookieValue) {
+        try {
+            decoded = decodeURIComponent(decoded);
+        }
+        catch {
+            // Evaluate the original cookie value.
+        }
+    }
+    decoded = trimPortableConsentWhitespace(decoded);
+    if (!decoded
+        || encoder.encode(decoded).byteLength > MAX_CONSENT_ENVELOPE_BYTES) {
+        return null;
+    }
+    if (LEGACY_GRANTS.has(decoded.toLowerCase())) {
+        return {
+            version: 0,
+            purposes: ['personalization'],
+            grantedAt: '',
+        };
+    }
+    try {
+        const parsed = JSON.parse(decoded);
+        const grantedAt = typeof parsed.t === 'string' ? parsed.t : '';
+        if (!Number.isInteger(parsed.v)
+            || parsed.v < 0
+            || parsed.v > MAX_CONSENT_POLICY_VERSION
+            || !Array.isArray(parsed.p)
+            || parsed.p.length > MAX_CONSENT_PURPOSES
+            || !parsed.p.every((item) => typeof item === 'string')
+            || parsed.p.some((item) => encoder.encode(item).byteLength > MAX_CONSENT_PURPOSE_BYTES)
+            || (parsed.t !== undefined
+                && parsed.t !== null
+                && (typeof parsed.t !== 'string'
+                    || parsed.t === ''
+                    || !isPortableRFC3339(parsed.t)))
+            || (parsed.src !== undefined
+                && parsed.src !== null
+                && typeof parsed.src !== 'string')
+            || (typeof parsed.src === 'string'
+                && encoder.encode(parsed.src).byteLength > MAX_CONSENT_SOURCE_BYTES)) {
+            return null;
+        }
+        return {
+            version: parsed.v,
+            purposes: parsed.p,
+            grantedAt,
+            source: typeof parsed.src === 'string' ? parsed.src : undefined,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function portableConsentAllowsPersonalization(snapshot) {
+    return snapshot?.purposes.some((purpose) => trimPortableConsentWhitespace(purpose).toLowerCase()
+        === 'personalization') || false;
+}
+export function trimPortableConsentWhitespace(value) {
+    return value.replace(CONSENT_EDGE_WHITESPACE, '');
+}
+function isPortableRFC3339(value) {
+    const match = RFC3339.exec(value);
+    if (!match || Number.isNaN(Date.parse(value)))
+        return false;
+    const year = Number(match[1]);
+    const month = Number(match[2]);
+    const day = Number(match[3]);
+    const hour = Number(match[4]);
+    const minute = Number(match[5]);
+    const second = Number(match[6]);
+    if (month < 1
+        || month > 12
+        || day < 1
+        || day > daysInMonth(year, month)
+        || hour > 23
+        || minute > 59
+        || second > 59) {
+        return false;
+    }
+    const zone = match[8];
+    return zone === 'Z'
+        || (Number(zone.slice(1, 3)) <= 23
+            && Number(zone.slice(4, 6)) <= 59);
+}
+function daysInMonth(year, month) {
+    if (month === 2) {
+        return year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0) ? 29 : 28;
+    }
+    return [4, 6, 9, 11].includes(month) ? 30 : 31;
+}

package/dist/consent-banner/index.js

@@ -45,7 +45,8 @@ export function mountConsentBanner(doc, opts = {}) {
     };
     const decide = (granted) => {
         const purposes = granted ? [PERSONALIZATION_PURPOSE] : [];
-        applyConsent(purposes, config.source, { document: doc });
+        if (!applyConsent(purposes, config.source, { document: doc }))
+            return;
         banner.classList.add(BANNER_HIDDEN);
         setTimeout(cleanup, 300);
         opts.onDecision?.(granted);

package/dist/content/assets.d.ts

@@ -5,6 +5,7 @@ export interface ReleaseAssetConfig {
     accessKeyId?: string;
     secretAccessKey?: string;
     sessionToken?: string;
+    roleArn?: string;
     endpoint?: string;
 }
 export declare class ReleaseAssetNotFoundError extends Error {

package/dist/content/assets.js

@@ -19,6 +19,7 @@ export async function getReleaseAssetResponse(input) {
         accessKeyId: config.accessKeyId,
         secretAccessKey: config.secretAccessKey,
         sessionToken: config.sessionToken,
+        roleArn: config.roleArn,
         endpoint: config.endpoint,
     });
     const key = joinKey(provider.config.keyPrefix, 'assets', clean);

package/dist/content/resolve-slots.js

@@ -12,6 +12,7 @@ export async function resolveSlots(layout, pageRegions, getFragment) {
             for (const ref of defaults) {
                 const fragment = await getFragment(ref.fragmentId);
                 blocks.push({
+                    $type: 'component',
                     id: fragment.id,
                     component: fragment.component,
                     props: fragment.props || {},

package/dist/content/types.d.ts

@@ -42,11 +42,13 @@ export interface KernelPageSeo {
     canonical?: string;
 }
 export interface KernelPageBlock {
+    $type: 'component';
     id: string;
     component: string;
     props: Record<string, unknown>;
 }
 export interface KernelAtomicBlock {
+    $type: 'component';
     id: string;
     component: string;
     props: Record<string, unknown>;

package/dist/next/collect-route.d.ts

@@ -1,7 +1,7 @@
-import { type IdentitySigningKeys, type PersonalizationBlobStore } from './personalization-host.js';
+import { type IdentitySigningKeys, type PersonalizationCollectionStore } from './personalization-host.js';
 export interface PersonalizationCollectRouteConfig {
     siteId: string;
-    store: PersonalizationBlobStore;
+    store: PersonalizationCollectionStore;
     identityKeys: IdentitySigningKeys;
     /**
      * Claims verify keys (kid -> secret) for withdrawal EVIDENCE

package/dist/next/collect-route.js

@@ -1,10 +1,24 @@
 import { MAX_BATCH_EVENTS } from '../collect/batcher.js';
-import { consentSignals, identityHashHex, parseCookieHeader, verifyClaims, verifyIdentityCookie, } from './personalization-host.js';
+import { computeEnvelopeDigest } from './envelope-digest.js';
+import { consentSignals, IdentityErasureFencedError, identityHashHex, parseCookieHeader, verifyClaims, verifyIdentityCookie, } from './personalization-host.js';
 const MAX_COLLECT_BODY_BYTES = 64 * 1024;
 const DEFAULT_RETENTION_SECONDS = 13 * 30 * 24 * 60 * 60;
-const FORBIDDEN_FIELDS = new Set(['aciid', 'audienceids', 'segmentids', 'traits', 'identity']);
 const ULID = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/i;
 const UTM_KEYS = ['source', 'medium', 'campaign', 'term', 'content', 'id'];
+const ENVELOPE_FIELDS = new Set(['envelopeId', 'events']);
+const EVENT_FIELDS = new Set([
+    'eventId',
+    'eventName',
+    'occurredAt',
+    'properties',
+    'url',
+    'referrer',
+    'title',
+    'path',
+    'utm',
+    'viewport',
+    'experiment',
+]);
 function identityHashShard(identityHash) {
     const hash = identityHash.trim().toLowerCase();
     if (hash.length < 2)
@@ -20,9 +34,22 @@ export function createPersonalizationCollectRoute(config) {
         const bytes = new Uint8Array(await request.arrayBuffer());
         if (bytes.byteLength > MAX_COLLECT_BODY_BYTES)
             return new Response(null, { status: 413 });
+        let envelopeId;
         let events;
         try {
-            const envelope = bytes.byteLength === 0 ? { events: [] } : JSON.parse(new TextDecoder().decode(bytes));
+            const envelope = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+            if (!envelope || typeof envelope !== 'object' || Array.isArray(envelope)) {
+                throw new CollectValidationError('collect envelope must be an object');
+            }
+            for (const key of Object.keys(envelope)) {
+                if (!ENVELOPE_FIELDS.has(key)) {
+                    throw new CollectValidationError(`field ${key} is not allowed on the collect envelope`);
+                }
+            }
+            if (typeof envelope.envelopeId !== 'string' || !ULID.test(envelope.envelopeId.trim())) {
+                throw new CollectValidationError('envelopeId must be a valid ULID');
+            }
+            envelopeId = envelope.envelopeId.trim().toUpperCase();
             if (!Array.isArray(envelope.events))
                 throw new CollectValidationError('events must be an array');
             // The TS runtime has no cross-instance quota checker (Go's REQ-14/
@@ -32,8 +59,18 @@ export function createPersonalizationCollectRoute(config) {
             if (envelope.events.length > MAX_BATCH_EVENTS)
                 throw new CollectValidationError('too many events in one batch');
             events = envelope.events;
-            for (const event of events)
+            const eventIds = new Set();
+            for (const event of events) {
                 validateEvent(event);
+                const eventId = event.eventId.trim().toUpperCase();
+                if (eventId === envelopeId) {
+                    throw new CollectValidationError('envelopeId must be distinct from every eventId');
+                }
+                if (eventIds.has(eventId)) {
+                    throw new CollectValidationError('eventId must be unique within an envelope');
+                }
+                eventIds.add(eventId);
+            }
         }
         catch (error) {
             return validationResponse(error);
@@ -75,13 +112,21 @@ export function createPersonalizationCollectRoute(config) {
                 await putSuppression('withdrawal');
             }
             const identityHash = await identityHashHex('aci_id', rawIdentity);
-            for (const event of events) {
+            const collectedAt = now.toISOString();
+            const expiresAt = new Date(now.getTime() +
+                (config.retentionSeconds ?? DEFAULT_RETENTION_SECONDS) * 1000).toISOString();
+            const consent = signals.snapshot
+                ? {
+                    v: signals.snapshot.version,
+                    p: signals.snapshot.purposes,
+                    ...(signals.snapshot.grantedAt ? { t: signals.snapshot.grantedAt } : {}),
+                    ...(signals.snapshot.source ? { src: signals.snapshot.source } : {}),
+                }
+                : { v: 0, p: [] };
+            const records = events.map((event) => {
                 const normalized = normalizeEvent(event, now);
-                const collectedAt = now.toISOString();
-                const expiresAt = new Date(now.getTime() + (config.retentionSeconds ?? DEFAULT_RETENTION_SECONDS) * 1000).toISOString();
-                const key = `audience/first-party/${identityHashShard(identityHash)}/${config.siteId}/aci_id/${identityHash}/${normalized.eventId}.json`;
-                await config.store.appendEvent(key, {
-                    schemaVersion: 1,
+                return {
+                    schemaVersion: 2,
                     eventId: normalized.eventId,
                     eventName: normalized.eventName,
                     eventCategory: normalized.eventCategory,
@@ -91,14 +136,7 @@ export function createPersonalizationCollectRoute(config) {
                     // an empty-t record permanently poisons that identity's
                     // classification and DSAR reads. Omit t unless a real timestamp
                     // was observed (legacy bare tokens have none).
-                    consent: signals.snapshot
-                        ? {
-                            v: signals.snapshot.version,
-                            p: signals.snapshot.purposes,
-                            ...(signals.snapshot.grantedAt ? { t: signals.snapshot.grantedAt } : {}),
-                            ...(signals.snapshot.source ? { src: signals.snapshot.source } : {}),
-                        }
-                        : { v: 0, p: [] },
+                    consent,
                     ...(normalized.properties ? { properties: normalized.properties } : {}),
                     page: normalized.page,
                     ...(normalized.utm ? { utm: normalized.utm } : {}),
@@ -107,7 +145,40 @@ export function createPersonalizationCollectRoute(config) {
                     occurredAt: normalized.occurredAt,
                     collectedAt,
                     expiresAt,
+                };
+            });
+            if (records.length > 0) {
+                const key = `audience/first-party/${identityHashShard(identityHash)}/${config.siteId}/aci_id/${identityHash}/${envelopeId}.json`;
+                const digest = await computeEnvelopeDigest({
+                    siteId: config.siteId,
+                    acceptedBody: bytes,
+                    identity: { namespace: 'aci_id', hash: identityHash },
+                    consent: {
+                        version: signals.snapshot?.version ?? 0,
+                        purposes: signals.snapshot?.purposes ?? [],
+                        grantedAt: signals.snapshot?.grantedAt,
+                        source: signals.snapshot?.source,
+                    },
                 });
+                try {
+                    await config.store.appendEnvelope({
+                        key,
+                        envelopeId,
+                        siteId: config.siteId,
+                        identityNamespace: 'aci_id',
+                        identityHash,
+                        records,
+                        digest,
+                    });
+                }
+                catch (error) {
+                    if (error instanceof IdentityErasureFencedError) {
+                        if (cookies.has('aci_claims'))
+                            appendCookie(responseHeaders, expiredClaimsCookie(secure));
+                        return accepted(responseHeaders);
+                    }
+                    throw error;
+                }
             }
             if (personalization) {
                 const claims = await config.store.readClaims(config.siteId, 'aci_id', identityHash);
@@ -131,7 +202,7 @@ function validateEvent(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         throw new CollectValidationError('event must be an object');
     for (const key of Object.keys(value)) {
-        if (FORBIDDEN_FIELDS.has(key.toLowerCase()))
+        if (!EVENT_FIELDS.has(key))
             throw new CollectValidationError(`field ${key} is not allowed on the public collect route`);
     }
     if (typeof value.eventId !== 'string' || !ULID.test(value.eventId.trim()))