@kharon-labs/browser 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kharon Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,74 @@
-# Temporary Holding Version
+# @kharon-labs/browser
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Personalize parts of any website with Kharon Labs. Mark the regions you want to personalize, keep
+your own copy as the defaults, and the package swaps in the variant Kharon picks for each visitor,
+then measures it against a holdout.
+
+```sh
+npm install @kharon-labs/browser
+```
+
+On a site without a bundler, use the script-tag build at `https://kharonlabs.com/sdk/v1.js`.
+
+## Plain HTML
+
+```html
+<head>
+  <!-- Optional: hides slots (never the page) until the swap, for at most 500 ms. -->
+  <style id="kharon-af">[data-ge-slot]{visibility:hidden!important}</style>
+  <script>window.__kharonAf=Date.now();setTimeout(function(){var s=document.getElementById("kharon-af");s&&s.parentNode.removeChild(s)},500)</script>
+  <script src="https://kharonlabs.com/sdk/v1.js" data-key="ge_pk_…" async></script>
+</head>
+<body>
+  <section data-ge-slot="hero">
+    <h1 data-ge-field="headline">Grow faster</h1>
+    <a data-ge-field="ctaLabel" data-ge-attr="href:ctaUrl" href="/demo">Book a demo</a>
+  </section>
+</body>
+```
+
+The anti-flicker snippet is also exported as `ANTI_FLICKER_SNIPPET`.
+
+## Bundlers
+
+```ts
+import { init, setConsent, conversion } from "@kharon-labs/browser";
+
+init({ key: "ge_pk_…" });
+myCmp.onChange((ok) => setConsent(ok ? "granted" : "denied"));
+conversion("demo_booked");
+```
+
+| Function | What it does |
+| --- | --- |
+| `init({ key, apiBase?, consent?, timeoutMs?, pageId?, cookieDomain? })` | Resolves the page's slots once the DOM is ready and starts measuring if allowed. |
+| `setConsent("granted" \| "denied" \| "unknown")` | Forward your consent tool's answer. Safe to call before `init`. |
+| `conversion(goal, value?)` | Records a goal. Forms with `data-ge-goal="…"` record theirs on submit. |
+| `refresh()` | Re-scans and re-resolves, e.g. after a client-side route change. |
+
+## Slots
+
+- `data-ge-slot="id"` marks a slot; the id matches a slot in the console. Repeat an id to show the
+  same decision in several places.
+- `data-ge-field="name"` writes a content field as text (`textContent`), never as HTML.
+- `data-ge-attr="href:ctaUrl, title:ctaTitle"` writes fields into attributes. URL attributes accept
+  only `http(s)` and relative links; event handlers and `style` are never written.
+- The markup's own text is the default. A field the variant doesn't set keeps it, and a slot the
+  console doesn't know yet keeps all of it.
+
+## Guarantees
+
+- **Defaults always render.** If we answer late (after `timeoutMs`, 500 ms), fail or are down, the
+  page keeps its defaults and slots are revealed. The package never retries.
+- **Consent is decided by our server**, by the visitor's country and choice (opt-in in the EEA, UK
+  and Switzerland, GPC honored). Until it allows storing the visitor, the package writes no cookie
+  or storage and sends no analytics.
+- **Holdouts.** Held-out visitors see the defaults; their impressions record the variant withheld.
+
+The visitor id is a first-party `ge_vid` cookie on your domain (one year; Safari caps script-set
+cookies at seven days, `@kharon-labs/server` avoids that). A denial deletes it.
+
+## Size and support
+
+About 4 KB gzip, no dependencies. ES2020 browsers; without `fetch` the page keeps its defaults, and
+without `IntersectionObserver` impressions aren't recorded.

package/dist/index.cjs

@@ -0,0 +1,579 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// packages/browser/src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  ANTI_FLICKER_SNIPPET: () => ANTI_FLICKER_SNIPPET,
+  DEFAULT_API_BASE: () => DEFAULT_API_BASE,
+  DEFAULT_TIMEOUT_MS: () => DEFAULT_TIMEOUT_MS,
+  VISITOR_COOKIE: () => VISITOR_COOKIE,
+  antiFlickerStart: () => antiFlickerStart,
+  applyDecision: () => applyDecision,
+  conversion: () => conversion,
+  createClient: () => createClient,
+  hashSlotDefaults: () => hashSlotDefaults,
+  init: () => init,
+  isWritable: () => isWritable,
+  pageIdFor: () => pageIdFor,
+  parseResolveResponse: () => parseResolveResponse,
+  refresh: () => refresh,
+  reveal: () => reveal,
+  scanSlots: () => scanSlots,
+  setConsent: () => setConsent
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/engine/analytics/beacon.ts
+var BEACON_VERSION = 1;
+var MAX_BEACON_EVENTS = 50;
+var SLOT_ATTRIBUTES = {
+  slot: "data-ge-slot",
+  variant: "data-ge-variant",
+  counterfactual: "data-ge-counterfactual",
+  /** Why the slot shows what it shows (matched, default, holdout). For debugging; not sent. */
+  reason: "data-ge-reason"
+};
+
+// packages/browser/src/tracker.ts
+var COLLECT_PATH = "/api/collect";
+var SESSION_KEY = "ge_sid";
+var PIN_KEY = "ge_pin";
+var VISIBLE_RATIO = 0.5;
+var FLUSH_INTERVAL_MS = 2e3;
+function startTracker({
+  pageId,
+  configVersion,
+  endpoint = COLLECT_PATH,
+  root = document,
+  match,
+  envelope = (events) => ({ v: BEACON_VERSION, events, ...match ? { m: match } : {} }),
+  crossOrigin = false
+}) {
+  const win = root.defaultView ?? window;
+  const sessionId = sessionIdFor(win);
+  const queue = [];
+  const seenSlots = /* @__PURE__ */ new Set();
+  const push = (type, body) => {
+    queue.push({ type, sessionId, ...body });
+    if (queue.length >= MAX_BEACON_EVENTS) flush();
+  };
+  const flush = () => {
+    while (queue.length) send(win, endpoint, envelope(queue.splice(0, MAX_BEACON_EVENTS)), crossOrigin);
+  };
+  push("page_view", { pageId, configVersion });
+  const slots = Array.from(root.querySelectorAll(`[${SLOT_ATTRIBUTES.slot}]`));
+  const observer = "IntersectionObserver" in win ? new win.IntersectionObserver(
+    (entries) => {
+      for (const entry of entries) {
+        if (!entry.isIntersecting || entry.intersectionRatio < VISIBLE_RATIO) continue;
+        const slot = readSlot(entry.target);
+        observer?.unobserve(entry.target);
+        if (!slot || seenSlots.has(slot.slotId)) continue;
+        seenSlots.add(slot.slotId);
+        push("slot_impression", slot);
+      }
+    },
+    { threshold: VISIBLE_RATIO }
+  ) : null;
+  for (const slot of slots) observer?.observe(slot);
+  const interaction = (action) => (event) => {
+    const slot = closestSlot(event.target);
+    if (slot) push("interaction", { slotId: slot.slotId, variantId: slot.variantId, action });
+  };
+  const onClick = interaction("click");
+  const onCopy = interaction("copy");
+  const onToggle = (event) => {
+    if (event.target.open) interaction("expand")(event);
+  };
+  const onSubmit = (event) => {
+    const goal = event.target.closest?.("form")?.getAttribute("data-ge-goal");
+    if (goal) conversion2(goal);
+  };
+  const onHide = () => {
+    if (root.visibilityState === "hidden") flush();
+  };
+  const conversion2 = (goal, value) => {
+    push("conversion", value === void 0 ? { goal } : { goal, value });
+    flush();
+  };
+  root.addEventListener("click", onClick, true);
+  root.addEventListener("copy", onCopy, true);
+  root.addEventListener("toggle", onToggle, true);
+  root.addEventListener("submit", onSubmit, true);
+  root.addEventListener("visibilitychange", onHide);
+  win.addEventListener("pagehide", flush);
+  const timer = win.setInterval(flush, FLUSH_INTERVAL_MS);
+  return {
+    conversion: conversion2,
+    flush,
+    stop({ discard = false } = {}) {
+      if (discard) queue.length = 0;
+      flush();
+      observer?.disconnect();
+      win.clearInterval(timer);
+      root.removeEventListener("click", onClick, true);
+      root.removeEventListener("copy", onCopy, true);
+      root.removeEventListener("toggle", onToggle, true);
+      root.removeEventListener("submit", onSubmit, true);
+      root.removeEventListener("visibilitychange", onHide);
+      win.removeEventListener("pagehide", flush);
+    }
+  };
+}
+function readSlot(el) {
+  const slotId = el.getAttribute(SLOT_ATTRIBUTES.slot);
+  if (!slotId) return null;
+  return {
+    slotId,
+    variantId: el.getAttribute(SLOT_ATTRIBUTES.variant) || null,
+    counterfactualVariantId: el.getAttribute(SLOT_ATTRIBUTES.counterfactual) || null
+  };
+}
+function closestSlot(target) {
+  const el = target instanceof Element ? target.closest(`[${SLOT_ATTRIBUTES.slot}]`) : null;
+  return el ? readSlot(el) : null;
+}
+function sessionIdFor(win) {
+  try {
+    const existing = win.sessionStorage.getItem(SESSION_KEY);
+    if (existing) return existing;
+    const id = uuid(win);
+    win.sessionStorage.setItem(SESSION_KEY, id);
+    return id;
+  } catch {
+    return uuid(win);
+  }
+}
+function uuid(win) {
+  if (typeof win.crypto.randomUUID === "function") return win.crypto.randomUUID();
+  const b = win.crypto.getRandomValues(new Uint8Array(16));
+  b[6] = b[6] & 15 | 64;
+  b[8] = b[8] & 63 | 128;
+  const hex = Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function send(win, endpoint, payload, crossOrigin) {
+  const body = JSON.stringify(payload);
+  const type = crossOrigin ? "text/plain" : "application/json";
+  if (win.navigator.sendBeacon?.(endpoint, new Blob([body], { type }))) return;
+  void win.fetch(endpoint, {
+    method: "POST",
+    body,
+    keepalive: true,
+    credentials: crossOrigin ? "omit" : "same-origin",
+    headers: { "content-type": type }
+  }).catch((error) => console.warn("[ge] analytics beacon failed", error));
+}
+
+// src/engine/snippet/wire.ts
+var RESOLVE_API_VERSION = 1;
+var PREVIEW_PARAM = "ge_preview";
+var BEACON_V2_VERSION = 2;
+var VISITOR_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+function isVisitorId(value) {
+  return typeof value === "string" && VISITOR_ID_PATTERN.test(value);
+}
+function hashSlotDefaults(content) {
+  const canonical = JSON.stringify(Object.keys(content).sort().map((field) => [field, content[field]]));
+  let hash = 2166136261;
+  for (let i = 0; i < canonical.length; i++) {
+    hash ^= canonical.charCodeAt(i);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16).padStart(8, "0");
+}
+
+// packages/browser/src/wire.ts
+var RESOLVE_PATH = "/api/v1/resolve";
+var COLLECT_V2_PATH = "/api/v1/collect";
+var REASONS = ["matched", "default", "holdout"];
+function parseResolveResponse(body) {
+  if (!isRecord(body) || body.v !== RESOLVE_API_VERSION || !isRecord(body.decisions)) return null;
+  if (!Number.isSafeInteger(body.configVersion) || typeof body.persist !== "boolean") return null;
+  const vid = isVisitorId(body.vid) ? body.vid : void 0;
+  const persist = body.persist && vid !== void 0;
+  const pin = persist && typeof body.pin === "string" && /^\d{1,9}\.\d{1,9}$/.test(body.pin) ? body.pin : void 0;
+  const decisions = {};
+  for (const [id, raw] of Object.entries(body.decisions)) {
+    const decision = parseDecision(raw);
+    if (decision) decisions[id] = decision;
+  }
+  const m = persist && typeof body.m === "string" && body.m.length <= 1024 ? body.m : void 0;
+  if (body.preview === true) return { v: RESOLVE_API_VERSION, configVersion: body.configVersion, persist: false, preview: true, decisions };
+  return { v: RESOLVE_API_VERSION, configVersion: body.configVersion, persist, vid, ...pin ? { pin } : {}, decisions, ...m ? { m } : {} };
+}
+function parseDecision(raw) {
+  if (!isRecord(raw) || !isRecord(raw.content)) return null;
+  if (!isOptionalString(raw.variantId) || !isOptionalString(raw.counterfactualVariantId)) return null;
+  if (!REASONS.includes(raw.reason)) return null;
+  const content = {};
+  for (const [field, value] of Object.entries(raw.content)) if (typeof value === "string") content[field] = value;
+  return {
+    variantId: raw.variantId,
+    counterfactualVariantId: raw.counterfactualVariantId,
+    reason: raw.reason,
+    content
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isOptionalString(value) {
+  return value === null || typeof value === "string";
+}
+
+// packages/browser/src/client.ts
+var DEFAULT_API_BASE = "https://kharonlabs.com";
+var DEFAULT_TIMEOUT_MS = 500;
+var BACKGROUND_TIMEOUT_MS = 5e3;
+var VISITOR_COOKIE = "ge_vid";
+var COOKIE_MAX_AGE_S = 365 * 24 * 60 * 60;
+function createClient(options) {
+  const doc = options.root ?? document;
+  const win = doc.defaultView ?? window;
+  const apiBase = (options.apiBase ?? DEFAULT_API_BASE).replace(/\/+$/, "");
+  const listeners = /* @__PURE__ */ new Set();
+  let consent = options.consent ?? "unknown";
+  let persisted = false;
+  let match;
+  let tracker = null;
+  let previewing = false;
+  const stopTracking = (discard = false) => {
+    tracker?.stop({ discard });
+    tracker = null;
+  };
+  const forget = () => {
+    persisted = false;
+    match = void 0;
+    stopTracking(true);
+    deleteCookie(doc, VISITOR_COOKIE, options.cookieDomain);
+    try {
+      win.sessionStorage.removeItem(SESSION_KEY);
+      win.sessionStorage.removeItem(PIN_KEY);
+    } catch {
+    }
+  };
+  const adopt = (response) => {
+    if (response.preview) {
+      previewing = true;
+      stopTracking(true);
+      return;
+    }
+    if (response.persist && response.vid && consent !== "denied") {
+      persisted = true;
+      match = response.m;
+      if (readCookie(doc, VISITOR_COOKIE) !== response.vid) setCookie(doc, VISITOR_COOKIE, response.vid, options.cookieDomain);
+      if (response.pin) writeSession(win, PIN_KEY, response.pin);
+    } else if (persisted || readCookie(doc, VISITOR_COOKIE)) {
+      forget();
+    }
+  };
+  return {
+    get consent() {
+      return consent;
+    },
+    async resolve(slots, deadline = Date.now() + BACKGROUND_TIMEOUT_MS) {
+      const vid = readCookie(doc, VISITOR_COOKIE);
+      const pin = readSession(win, PIN_KEY);
+      const page = previewPage(win);
+      const body = {
+        v: RESOLVE_API_VERSION,
+        key: options.key,
+        ...isVisitorId(vid) ? { vid } : {},
+        ...pin ? { pin } : {},
+        url: page.url,
+        referrer: doc.referrer,
+        slots: slots.map((slot) => ({ id: slot.id, h: hashSlotDefaults(slot.defaults) })),
+        consent,
+        gpc: win.navigator.globalPrivacyControl === true
+      };
+      const remaining = deadline - Date.now();
+      if (remaining <= 0 || typeof win.fetch !== "function") return null;
+      const controller = typeof AbortController === "function" ? new AbortController() : null;
+      let timer;
+      try {
+        const request = win.fetch(apiBase + RESOLVE_PATH, { method: "POST", body: JSON.stringify(body), credentials: "omit", signal: controller?.signal });
+        const timeout = new Promise((resolve) => {
+          timer = setTimeout(() => {
+            controller?.abort();
+            resolve(null);
+          }, remaining);
+        });
+        const res = await Promise.race([request, timeout]);
+        if (!res) return null;
+        if (!res.ok) {
+          console.warn(`[kharon] resolve answered ${res.status}; keeping defaults`);
+          return null;
+        }
+        const parsed = parseResolveResponse(await Promise.race([res.json(), timeout]));
+        if (!parsed || Date.now() > deadline) return null;
+        if (parsed.preview && page.token) writeSession(win, PREVIEW_PARAM, page.token);
+        else if (!parsed.preview && page.token) removeSession(win, PREVIEW_PARAM);
+        adopt(parsed);
+        return parsed;
+      } catch (error) {
+        if (!controller?.signal.aborted) console.warn("[kharon] resolve failed; keeping defaults", error);
+        return null;
+      } finally {
+        clearTimeout(timer);
+      }
+    },
+    adopt,
+    track(configVersion) {
+      stopTracking();
+      const vid = readCookie(doc, VISITOR_COOKIE);
+      if (previewing || !persisted || !isVisitorId(vid)) return;
+      tracker = startTracker({
+        pageId: options.pageId ?? pageIdFor(win.location.pathname),
+        configVersion,
+        endpoint: apiBase + COLLECT_V2_PATH,
+        root: doc,
+        crossOrigin: true,
+        envelope: (events) => ({ v: BEACON_V2_VERSION, key: options.key, vid, consent, events, ...match ? { m: match } : {} })
+      });
+    },
+    setConsent(next) {
+      if (next === consent) return;
+      consent = next;
+      if (next === "denied") forget();
+      for (const listener of listeners) listener(next);
+    },
+    onConsentChange(listener) {
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    },
+    conversion(goal, value) {
+      tracker?.conversion(goal, value);
+    },
+    stop: () => stopTracking()
+  };
+}
+function pageIdFor(pathname) {
+  const id = pathname.split("/").map((part) => part.replace(/[^A-Za-z0-9_:-]/g, "")).filter(Boolean).join(".").slice(0, 128);
+  return id || "home";
+}
+function readCookie(doc, name) {
+  for (const part of doc.cookie.split(";")) {
+    const [k, ...v] = part.trim().split("=");
+    if (k !== name) continue;
+    try {
+      return decodeURIComponent(v.join("="));
+    } catch {
+      return void 0;
+    }
+  }
+  return void 0;
+}
+function readSession(win, key) {
+  try {
+    return win.sessionStorage.getItem(key);
+  } catch {
+    return null;
+  }
+}
+function previewPage(win) {
+  const url = win.location.href;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return { url, token: null };
+  }
+  const inUrl = parsed.searchParams.get(PREVIEW_PARAM);
+  if (inUrl) return { url, token: inUrl };
+  const stored = readSession(win, PREVIEW_PARAM);
+  if (!stored) return { url, token: null };
+  parsed.searchParams.set(PREVIEW_PARAM, stored);
+  return { url: parsed.toString(), token: stored };
+}
+function removeSession(win, key) {
+  try {
+    win.sessionStorage.removeItem(key);
+  } catch {
+  }
+}
+function writeSession(win, key, value) {
+  try {
+    win.sessionStorage.setItem(key, value);
+  } catch {
+  }
+}
+function cookieSuffix(doc, domain) {
+  const secure = doc.location?.protocol === "https:" ? "; Secure" : "";
+  return `; Path=/; SameSite=Lax${domain ? `; Domain=${domain}` : ""}${secure}`;
+}
+function setCookie(doc, name, value, domain) {
+  doc.cookie = `${name}=${encodeURIComponent(value)}; Max-Age=${COOKIE_MAX_AGE_S}${cookieSuffix(doc, domain)}`;
+}
+function deleteCookie(doc, name, domain) {
+  doc.cookie = `${name}=; Max-Age=0${cookieSuffix(doc, domain)}`;
+}
+
+// packages/browser/src/dom.ts
+var FIELD_ATTRIBUTE = "data-ge-field";
+var ATTR_ATTRIBUTE = "data-ge-attr";
+var ANTI_FLICKER_ID = "kharon-af";
+var ANTI_FLICKER_SNIPPET = `<style id="${ANTI_FLICKER_ID}">[${SLOT_ATTRIBUTES.slot}]{visibility:hidden!important}</style><script>window.__kharonAf=Date.now();setTimeout(function(){var s=document.getElementById("${ANTI_FLICKER_ID}");s&&s.parentNode.removeChild(s)},500)<\/script>`;
+var URL_ATTRIBUTES = /* @__PURE__ */ new Set(["href", "src", "action", "formaction", "poster", "cite", "xlink:href"]);
+var FORBIDDEN_ATTRIBUTES = /^(on|style$|srcdoc$|srcset$)/;
+var originals = /* @__PURE__ */ new WeakMap();
+var TEXT = "#text";
+function currentValue(el, attr) {
+  return attr === null ? (el.textContent ?? "").trim() : el.getAttribute(attr);
+}
+function originalValue(el, attr) {
+  const saved = originals.get(el);
+  return saved?.has(attr ?? TEXT) ? saved.get(attr ?? TEXT) : currentValue(el, attr);
+}
+function write(el, attr, value) {
+  let saved = originals.get(el);
+  if (!saved) originals.set(el, saved = /* @__PURE__ */ new Map());
+  if (!saved.has(attr ?? TEXT)) saved.set(attr ?? TEXT, currentValue(el, attr));
+  if (attr === null) el.textContent = value ?? "";
+  else if (value === null) el.removeAttribute(attr);
+  else el.setAttribute(attr, value);
+}
+function scanSlots(root) {
+  const slots = /* @__PURE__ */ new Map();
+  for (const el of slotElements(root)) {
+    const id = el.getAttribute(SLOT_ATTRIBUTES.slot);
+    if (slots.has(id)) continue;
+    const defaults = {};
+    for (const binding of bindings(el)) {
+      if (binding.field in defaults) continue;
+      defaults[binding.field] = originalValue(binding.el, binding.attr) ?? "";
+    }
+    slots.set(id, { id, defaults });
+  }
+  return [...slots.values()];
+}
+function applyDecisions(root, response) {
+  for (const el of slotElements(root)) {
+    const decision = response.decisions[el.getAttribute(SLOT_ATTRIBUTES.slot)];
+    if (decision) applyDecision(el, decision, root.baseURI);
+  }
+}
+function applyDecision(el, decision, baseURI) {
+  for (const { el: target, field, attr } of bindings(el)) {
+    const value = decision.content[field];
+    if (typeof value === "string" && (attr === null || isWritable(attr, value, baseURI))) write(target, attr, value);
+    else if (originals.get(target)?.has(attr ?? TEXT)) write(target, attr, originalValue(target, attr));
+  }
+  el.setAttribute(SLOT_ATTRIBUTES.variant, decision.variantId ?? "");
+  el.setAttribute(SLOT_ATTRIBUTES.counterfactual, decision.counterfactualVariantId ?? "");
+  el.setAttribute(SLOT_ATTRIBUTES.reason, decision.reason);
+}
+function reveal(root) {
+  root.getElementById(ANTI_FLICKER_ID)?.remove();
+}
+function antiFlickerStart(root) {
+  const start = root.defaultView?.__kharonAf;
+  return typeof start === "number" ? start : void 0;
+}
+function isWritable(attr, value, baseURI) {
+  const name = attr.toLowerCase();
+  if (FORBIDDEN_ATTRIBUTES.test(name)) return false;
+  if (!URL_ATTRIBUTES.has(name)) return true;
+  try {
+    const { protocol } = new URL(value, baseURI);
+    return protocol === "http:" || protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+function slotElements(root) {
+  return Array.from(root.querySelectorAll(`[${SLOT_ATTRIBUTES.slot}]`));
+}
+function bindings(slot) {
+  const result = [];
+  const candidates = [slot, ...Array.from(slot.querySelectorAll(`[${FIELD_ATTRIBUTE}],[${ATTR_ATTRIBUTE}]`))];
+  for (const el of candidates) {
+    if (el !== slot && el.closest(`[${SLOT_ATTRIBUTES.slot}]`) !== slot) continue;
+    const field = el.getAttribute(FIELD_ATTRIBUTE);
+    if (field) result.push({ el, field, attr: null });
+    for (const pair of (el.getAttribute(ATTR_ATTRIBUTE) ?? "").split(",")) {
+      const at = pair.lastIndexOf(":");
+      const attr = pair.slice(0, at).trim();
+      const mapped = pair.slice(at + 1).trim();
+      if (at > 0 && attr && mapped) result.push({ el, field: mapped, attr });
+    }
+  }
+  return result;
+}
+
+// packages/browser/src/index.ts
+var current = null;
+var pendingConsent;
+function init(options) {
+  if (current) {
+    console.warn("[kharon] init called twice; keeping the first instance");
+    return current;
+  }
+  const doc = options.root ?? document;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const client = createClient({ ...options, consent: pendingConsent ?? options.consent });
+  const run = async (deadline) => {
+    try {
+      const response = await client.resolve(scanSlots(doc), deadline);
+      if (response) applyDecisions(doc, response);
+      reveal(doc);
+      if (response) client.track(response.configVersion);
+    } catch (error) {
+      reveal(doc);
+      console.warn("[kharon] personalization failed; keeping defaults", error);
+    }
+  };
+  const ready = new Promise((resolve) => {
+    if (doc.readyState !== "loading") resolve();
+    else doc.addEventListener("DOMContentLoaded", () => resolve(), { once: true });
+  });
+  let pending = ready.then(() => run((antiFlickerStart(doc) ?? Date.now()) + timeoutMs));
+  client.onConsentChange((consent) => {
+    if (consent === "granted") pending = pending.then(() => run());
+  });
+  const instance = {
+    client,
+    get ready() {
+      return pending;
+    },
+    setConsent: client.setConsent,
+    conversion: client.conversion,
+    refresh() {
+      pending = pending.then(() => run(Date.now() + timeoutMs));
+      return pending;
+    },
+    stop() {
+      client.stop();
+      if (current === instance) current = null;
+    }
+  };
+  current = instance;
+  return instance;
+}
+function setConsent(consent) {
+  if (current) current.setConsent(consent);
+  else pendingConsent = consent;
+}
+function conversion(goal, value) {
+  current?.conversion(goal, value);
+}
+function refresh() {
+  return current?.refresh() ?? Promise.resolve();
+}