@kywi-software/js 0.23.0 → 0.25.0

package/dist/kywi.esm.js

@@ -15,6 +15,26 @@ function readContext() {
   };
 }
 
+// src/site-scope.ts
+function currentSiteId() {
+  if (typeof document === "undefined") return "";
+  return document.querySelector('meta[name="kywi:site-id"]')?.getAttribute("content") || "";
+}
+function withSiteId(url) {
+  if (!isSameOrigin(url)) return url;
+  const siteId = currentSiteId();
+  if (!siteId || /[?&]siteId=/.test(url)) return url;
+  const [path, hash] = url.split("#", 2);
+  const joined = `${path}${path.includes("?") ? "&" : "?"}siteId=${encodeURIComponent(siteId)}`;
+  return hash === void 0 ? joined : `${joined}#${hash}`;
+}
+function isSameOrigin(url) {
+  if (url.startsWith("/")) return !url.startsWith("//");
+  const origin = typeof window !== "undefined" ? window.location?.origin : void 0;
+  if (!origin || origin === "null") return false;
+  return url === origin || url.startsWith(`${origin}/`);
+}
+
 // src/entity.ts
 function createEntity(type, basePath, csrfToken, data) {
   const fields = { ...data };
@@ -34,7 +54,7 @@ function createEntity(type, basePath, csrfToken, data) {
     async save() {
       const id = fields["id"];
       const url = id ? `${basePath}/content/${type}/${id}` : `${basePath}/content/${type}`;
-      const res = await fetch(url, { method: id ? "PUT" : "POST", headers, body: JSON.stringify(Object.fromEntries(dirty)) });
+      const res = await fetch(withSiteId(url), { method: id ? "PUT" : "POST", headers, body: JSON.stringify(Object.fromEntries(dirty)) });
       const json = await res.json();
       if (!res.ok || json.error) {
         errors.push(json.error?.message ?? "Save failed");
@@ -46,14 +66,14 @@ function createEntity(type, basePath, csrfToken, data) {
     },
     async delete() {
       const id = fields["id"];
-      await fetch(`${basePath}/content/${type}/${id}`, { method: "DELETE", headers });
+      await fetch(withSiteId(`${basePath}/content/${type}/${id}`), { method: "DELETE", headers });
     },
     getErrors() {
       return [...errors];
     },
     async loadBy(field, value) {
       const url = field === "id" ? `${basePath}/content/${type}/${value}` : `${basePath}/content/${type}?${field}=${encodeURIComponent(value)}`;
-      const res = await fetch(url, { headers });
+      const res = await fetch(withSiteId(url), { headers });
       const json = await res.json();
       if (!res.ok || json.error) {
         errors.push(json.error?.message ?? "Load failed");
@@ -172,7 +192,7 @@ var FeedBuilder = class {
     const agg = { function: fn };
     if (field) agg["field"] = field;
     body["aggregate"] = agg;
-    const res = await fetch(`${this.basePath}/feeds/aggregate`, {
+    const res = await fetch(withSiteId(`${this.basePath}/feeds/aggregate`), {
       method: "POST",
       headers: this.buildHeaders(),
       body: JSON.stringify(body)
@@ -182,7 +202,7 @@ var FeedBuilder = class {
   }
   async getQuery() {
     const body = this.buildBody();
-    const res = await fetch(`${this.basePath}/feeds/query`, {
+    const res = await fetch(withSiteId(`${this.basePath}/feeds/query`), {
       method: "POST",
       headers: this.buildHeaders(),
       body: JSON.stringify(body)
@@ -471,6 +491,248 @@ function initNavMenus(root = document) {
   };
 }
 
+// src/cookies.ts
+var COOKIE_NAMES = {
+  SIGNALS: "kywi_signals",
+  VISITOR: "kywi_visitor",
+  UTM: "kywi_utm",
+  AUDIENCE: "kywi_audience",
+  OPTOUT: "kywi_optout",
+  KNOWN: "kywi_known",
+  PREVIEW_INIT: "kywi_preview_init",
+  BUCKET: "kywi_bucket"
+};
+function readCookies() {
+  const map = /* @__PURE__ */ new Map();
+  if (typeof document === "undefined") return map;
+  for (const pair of document.cookie.split(";")) {
+    const trimmed = pair.trim();
+    const eqIdx = trimmed.indexOf("=");
+    if (eqIdx < 0) continue;
+    map.set(trimmed.slice(0, eqIdx), decodeURIComponent(trimmed.slice(eqIdx + 1)));
+  }
+  return map;
+}
+function setCookie(name, value, maxAge) {
+  let str = `${name}=${encodeURIComponent(value)}; Path=/; SameSite=Lax`;
+  if (maxAge !== void 0 && maxAge >= 0) str += `; Max-Age=${maxAge}`;
+  document.cookie = str;
+}
+function deleteCookie(name) {
+  document.cookie = `${name}=; Path=/; Max-Age=0`;
+}
+
+// src/consent.ts
+var CONSENT_COOKIE = "kywi_consent";
+var CONSENT_EVENT = "kywi:consent";
+var CONSENT_REOPEN_EVENT = "kywi:consent-reopen";
+function reopenConsent() {
+  if (typeof window === "undefined" || typeof CustomEvent === "undefined") return;
+  window.dispatchEvent(new CustomEvent(CONSENT_REOPEN_EVENT));
+}
+var AUDIENCE_PIN_COOKIE = "kywi_audience";
+var SWITCHER_PIN_PREFIX = "switcher:";
+var COOKIE_CONSENT_CATEGORY = {
+  kywi_consent: "essential",
+  kywi_optout: "essential",
+  kywi_preview_init: "essential",
+  kywi_bucket: "essential",
+  kywi_entry: "essential",
+  kywi_utm_visit: "essential",
+  kywi_selfid: "essential",
+  kywi_signals: "personalization",
+  kywi_visitor: "personalization",
+  kywi_utm: "personalization",
+  kywi_audience: "personalization",
+  kywi_known: "personalization"
+};
+function getConsentState() {
+  const cookies = readCookies();
+  const raw = cookies.get(CONSENT_COOKIE);
+  if (!raw) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const obj = parsed;
+  return {
+    essential: true,
+    analytics: obj.analytics === true,
+    marketing: obj.marketing === true,
+    personalization: obj.personalization === true
+  };
+}
+function setConsent(prefs) {
+  const state = {
+    essential: true,
+    analytics: prefs.analytics ?? false,
+    marketing: prefs.marketing ?? false,
+    personalization: prefs.personalization ?? false
+  };
+  setCookie(CONSENT_COOKIE, JSON.stringify(state), 31536e3);
+  clearDeniedCookies(state);
+  announceConsent(state);
+}
+function announceConsent(state) {
+  if (typeof window === "undefined" || typeof CustomEvent === "undefined") return;
+  try {
+    window.dispatchEvent(new CustomEvent(CONSENT_EVENT, { detail: state }));
+  } catch {
+  }
+}
+function clearDeniedCookies(state) {
+  if (typeof document === "undefined") return [];
+  const cookies = readCookies();
+  const deleted = [];
+  for (const [name, category] of Object.entries(COOKIE_CONSENT_CATEGORY)) {
+    if (category === "essential") continue;
+    if (state && state[category] === true) continue;
+    if (isDeliberatePreference(name, cookies.get(name))) continue;
+    deleteCookie(name);
+    deleted.push(name);
+  }
+  return deleted;
+}
+function isDeliberatePreference(name, value) {
+  if (name !== AUDIENCE_PIN_COOKIE || value === void 0) return false;
+  return value.startsWith(SWITCHER_PIN_PREFIX) && value.length > SWITCHER_PIN_PREFIX.length;
+}
+function hasConsent(category, options = {}) {
+  if (options.requireConsent === false) return true;
+  if (category === "essential") return true;
+  const state = getConsentState();
+  if (!state) return false;
+  return state[category] === true;
+}
+
+// src/experiments/pending.ts
+var PENDING_EVENTS_META = "kywi:pending-events";
+var PENDING_STORAGE_KEY = "kywi:pending-events";
+var EMPTY = () => ({ exposures: [], matched: [] });
+var memory = EMPTY();
+var consentListener = null;
+function hasValidSiteId(o) {
+  return o.siteId === void 0 || typeof o.siteId === "string" && o.siteId.length > 0;
+}
+function isExposure(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const o = v;
+  return typeof o.experimentId === "string" && o.experimentId.length > 0 && (typeof o.variantKey === "string" || o.variantKey === null) && typeof o.at === "number" && hasValidSiteId(o);
+}
+function isMatch(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const o = v;
+  return typeof o.audienceId === "string" && o.audienceId.length > 0 && typeof o.at === "number" && typeof o.sig === "string" && o.sig.length > 0 && hasValidSiteId(o);
+}
+function parsePending(raw) {
+  if (!raw) return EMPTY();
+  try {
+    const parsed = JSON.parse(raw);
+    const exposures = Array.isArray(parsed?.exposures) ? parsed.exposures.filter(isExposure) : [];
+    const matched = Array.isArray(parsed?.matched) ? parsed.matched.filter(isMatch) : [];
+    return { exposures, matched };
+  } catch {
+    return EMPTY();
+  }
+}
+function readStorage() {
+  try {
+    return parsePending(sessionStorage.getItem(PENDING_STORAGE_KEY));
+  } catch {
+    return EMPTY();
+  }
+}
+function writeStorage(events) {
+  try {
+    if (isEmpty(events)) sessionStorage.removeItem(PENDING_STORAGE_KEY);
+    else sessionStorage.setItem(PENDING_STORAGE_KEY, JSON.stringify(events));
+  } catch {
+  }
+}
+function isEmpty(events) {
+  return events.exposures.length === 0 && events.matched.length === 0;
+}
+function merge(into, from) {
+  const expKey = (e) => `${e.siteId ?? ""}|${e.experimentId}`;
+  const audKey = (m) => `${m.siteId ?? ""}|${m.audienceId}`;
+  const byExperiment = new Map(into.exposures.map((e) => [expKey(e), e]));
+  for (const e of from.exposures) if (!byExperiment.has(expKey(e))) byExperiment.set(expKey(e), e);
+  const byAudience = new Map(into.matched.map((m) => [audKey(m), m]));
+  for (const m of from.matched) if (!byAudience.has(audKey(m))) byAudience.set(audKey(m), m);
+  return { exposures: [...byExperiment.values()], matched: [...byAudience.values()] };
+}
+function stampSite(events) {
+  const siteId = currentSiteId();
+  if (!siteId) return events;
+  return {
+    exposures: events.exposures.map((e) => e.siteId ? e : { ...e, siteId }),
+    matched: events.matched.map((m) => m.siteId ? m : { ...m, siteId })
+  };
+}
+function pendingEvents() {
+  return merge(memory, readStorage());
+}
+function queuePendingEvents(events) {
+  memory = merge(pendingEvents(), stampSite(events));
+  writeStorage(memory);
+}
+function clearQueue() {
+  memory = EMPTY();
+  writeStorage(memory);
+}
+function urlForSite(url, siteId) {
+  if (!siteId) return withSiteId(url);
+  const origin = typeof window !== "undefined" ? window.location?.origin : void 0;
+  const sameOrigin = url.startsWith("/") && !url.startsWith("//") || !!origin && origin !== "null" && (url === origin || url.startsWith(`${origin}/`));
+  if (!sameOrigin || /[?&]siteId=/.test(url)) return url;
+  return `${url}${url.includes("?") ? "&" : "?"}siteId=${encodeURIComponent(siteId)}`;
+}
+function post(url, siteId, body, csrfToken) {
+  try {
+    void fetch(urlForSite(url, siteId), {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...csrfToken ? { "X-CSRF-Token": csrfToken } : {} },
+      body: JSON.stringify(body),
+      keepalive: true
+    }).catch(() => {
+    });
+  } catch {
+  }
+}
+function flushPendingEvents(config) {
+  const gate = config.requireConsent === void 0 ? {} : { requireConsent: config.requireConsent };
+  const queue = pendingEvents();
+  if (isEmpty(queue)) return 0;
+  if (!hasConsent("personalization", gate) || !hasConsent("analytics", gate)) {
+    if (getConsentState() !== null) clearQueue();
+    return 0;
+  }
+  for (const e of queue.exposures) {
+    post(`${config.apiBase}/kywi/experiments/exposure`, e.siteId, { experimentId: e.experimentId, at: e.at }, config.csrfToken);
+  }
+  for (const m of queue.matched) {
+    post(`${config.apiBase}/kywi/analytics/matched`, m.siteId, { audienceId: m.audienceId, at: m.at, sig: m.sig }, config.csrfToken);
+  }
+  clearQueue();
+  return queue.exposures.length + queue.matched.length;
+}
+function bootPendingEvents(config) {
+  if (typeof document !== "undefined") {
+    const raw = document.querySelector(`meta[name="${PENDING_EVENTS_META}"]`)?.getAttribute("content");
+    queuePendingEvents(parsePending(raw));
+  }
+  flushPendingEvents(config);
+  if (typeof window === "undefined") return;
+  if (consentListener) window.removeEventListener(CONSENT_EVENT, consentListener);
+  consentListener = () => {
+    flushPendingEvents(config);
+  };
+  window.addEventListener(CONSENT_EVENT, consentListener);
+}
+
 // src/experiments/index.ts
 function apiBaseFrom(ctx) {
   return ctx.basePath && ctx.basePath !== "/" ? `${ctx.basePath}/api/v1` : "/api/v1";
@@ -497,7 +759,7 @@ function installFormListener() {
 }
 function beacon(url, body, csrfToken) {
   try {
-    void fetch(url, {
+    void fetch(withSiteId(url), {
       method: "POST",
       headers: { "Content-Type": "application/json", ...csrfToken ? { "X-CSRF-Token": csrfToken } : {} },
       body: JSON.stringify(body),
@@ -523,6 +785,7 @@ function bootExperiments(config = {}) {
   if (experimentId) {
     beacon(`${apiBase}/kywi/experiments/exposure`, { experimentId, visitorId }, csrf);
   }
+  bootPendingEvents({ apiBase, ...csrf ? { csrfToken: csrf } : {} });
   if (config.autoPageview !== false) {
     trackConversion({ type: "pageview", url: currentPath });
   }
@@ -539,7 +802,7 @@ function bootExperiments(config = {}) {
 // src/audience/selfid-collector.ts
 var SELFID_KEY = "kywi_selfid";
 function collectSelfId() {
-  const raw = readStorage(SELFID_KEY);
+  const raw = readStorage2(SELFID_KEY);
   if (!raw) return {};
   try {
     const parsed = JSON.parse(raw);
@@ -549,7 +812,9 @@ function collectSelfId() {
     return {};
   }
 }
-function storeSelfId(responses) {
+function storeSelfId(responses, gate = {}) {
+  const category = COOKIE_CONSENT_CATEGORY[SELFID_KEY] ?? "personalization";
+  if (!hasConsent(category, gate)) return;
   try {
     localStorage.setItem(SELFID_KEY, JSON.stringify(responses));
   } catch {
@@ -561,7 +826,7 @@ function clearStoredSelfId() {
   } catch {
   }
 }
-function readStorage(key) {
+function readStorage2(key) {
   try {
     return localStorage.getItem(key);
   } catch {
@@ -608,7 +873,7 @@ async function clearSelfId(options = {}) {
 async function submit(fields, options) {
   const csrfToken = resolveCsrfToken(options.csrfToken);
   try {
-    const res = await fetch(`${resolveApiBase(options.apiBase)}/kywi/self-id`, {
+    const res = await fetch(withSiteId(`${resolveApiBase(options.apiBase)}/kywi/self-id`), {
       method: "POST",
       headers: { "Content-Type": "application/json", ...csrfToken ? { "X-CSRF-Token": csrfToken } : {} },
       body: JSON.stringify({
@@ -882,106 +1147,6 @@ function entryPageFor(currentPath) {
   return search ? `${currentPath}${search}` : currentPath;
 }
 
-// src/cookies.ts
-var COOKIE_NAMES = {
-  SIGNALS: "kywi_signals",
-  VISITOR: "kywi_visitor",
-  UTM: "kywi_utm",
-  AUDIENCE: "kywi_audience",
-  OPTOUT: "kywi_optout",
-  KNOWN: "kywi_known",
-  PREVIEW_INIT: "kywi_preview_init"
-};
-function readCookies() {
-  const map = /* @__PURE__ */ new Map();
-  if (typeof document === "undefined") return map;
-  for (const pair of document.cookie.split(";")) {
-    const trimmed = pair.trim();
-    const eqIdx = trimmed.indexOf("=");
-    if (eqIdx < 0) continue;
-    map.set(trimmed.slice(0, eqIdx), decodeURIComponent(trimmed.slice(eqIdx + 1)));
-  }
-  return map;
-}
-function setCookie(name, value, maxAge) {
-  let str = `${name}=${encodeURIComponent(value)}; Path=/; SameSite=Lax`;
-  if (maxAge !== void 0 && maxAge >= 0) str += `; Max-Age=${maxAge}`;
-  document.cookie = str;
-}
-function deleteCookie(name) {
-  document.cookie = `${name}=; Path=/; Max-Age=0`;
-}
-
-// src/consent.ts
-var CONSENT_COOKIE = "kywi_consent";
-var AUDIENCE_PIN_COOKIE = "kywi_audience";
-var SWITCHER_PIN_PREFIX = "switcher:";
-var COOKIE_CONSENT_CATEGORY = {
-  kywi_consent: "essential",
-  kywi_optout: "essential",
-  kywi_preview_init: "essential",
-  kywi_signals: "personalization",
-  kywi_visitor: "personalization",
-  kywi_utm: "personalization",
-  kywi_audience: "personalization",
-  kywi_known: "personalization",
-  kywi_entry: "personalization",
-  kywi_selfid: "personalization"
-};
-function getConsentState() {
-  const cookies = readCookies();
-  const raw = cookies.get(CONSENT_COOKIE);
-  if (!raw) return null;
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return null;
-  }
-  if (typeof parsed !== "object" || parsed === null) return null;
-  const obj = parsed;
-  return {
-    essential: true,
-    analytics: obj.analytics === true,
-    marketing: obj.marketing === true,
-    personalization: obj.personalization === true
-  };
-}
-function setConsent(prefs) {
-  const state = {
-    essential: true,
-    analytics: prefs.analytics ?? false,
-    marketing: prefs.marketing ?? false,
-    personalization: prefs.personalization ?? false
-  };
-  setCookie(CONSENT_COOKIE, JSON.stringify(state), 31536e3);
-  clearDeniedCookies(state);
-}
-function clearDeniedCookies(state) {
-  if (typeof document === "undefined") return [];
-  const cookies = readCookies();
-  const deleted = [];
-  for (const [name, category] of Object.entries(COOKIE_CONSENT_CATEGORY)) {
-    if (category === "essential") continue;
-    if (state && state[category] === true) continue;
-    if (isDeliberatePreference(name, cookies.get(name))) continue;
-    deleteCookie(name);
-    deleted.push(name);
-  }
-  return deleted;
-}
-function isDeliberatePreference(name, value) {
-  if (name !== AUDIENCE_PIN_COOKIE || value === void 0) return false;
-  return value.startsWith(SWITCHER_PIN_PREFIX) && value.length > SWITCHER_PIN_PREFIX.length;
-}
-function hasConsent(category, options = {}) {
-  if (options.requireConsent === false) return true;
-  if (category === "essential") return true;
-  const state = getConsentState();
-  if (!state) return false;
-  return state[category] === true;
-}
-
 // src/audience/behavioral-collector.ts
 var SESSION_KEY = "kywi_session";
 var TOTAL_VIEWS_KEY = "kywi_total_views";
@@ -1036,7 +1201,7 @@ function collectBehavioral(currentPath, category, gate = {}) {
 }
 
 // src/audience/evaluate.ts
-function merge(base, partial) {
+function merge2(base, partial) {
   return {
     utm: partial.utm ?? base.utm,
     referrer: partial.referrer ?? base.referrer,
@@ -1050,10 +1215,10 @@ function merge(base, partial) {
   };
 }
 function evaluateClientSide(audiences, serverSignals, currentPath, pageCategory, gate = {}) {
-  let signals = merge(createEmptySignals(), serverSignals);
+  let signals = merge2(createEmptySignals(), serverSignals);
   const client = collectBehavioral(currentPath, pageCategory, gate);
   const selfId = collectSelfId();
-  signals = merge(signals, { session: client.session, behavioral: client.behavioral, query: collectQuery(), selfId, meta: { ...signals.meta, resolvedAt: "client" } });
+  signals = merge2(signals, { session: client.session, behavioral: client.behavioral, query: collectQuery(), selfId, meta: { ...signals.meta, resolvedAt: "client" } });
   const { winningAudienceId, allMatchedIds } = resolveAudiences(audiences, signals);
   const isOptedOut2 = signals.meta.isOptedOut;
   return { winningAudienceId: isOptedOut2 ? null : winningAudienceId, allMatchedIds, signals, isOptedOut: isOptedOut2 };
@@ -1091,14 +1256,14 @@ var SWITCHER_LABEL_ID = "kywi-transparency-switcher-label";
 var DEFAULT_API_BASE2 = "/api/v1";
 var lastState = null;
 var forcedOpen = false;
-function readStorage2(key) {
+function readStorage3(key) {
   try {
     return localStorage.getItem(key);
   } catch {
     return null;
   }
 }
-function writeStorage(key, value) {
+function writeStorage2(key, value) {
   try {
     localStorage.setItem(key, value);
   } catch {
@@ -1111,15 +1276,15 @@ function removeStorage(key) {
   }
 }
 function isCollapsed() {
-  if (readStorage2(LEGACY_DISMISSED_KEY) === "1") {
+  if (readStorage3(LEGACY_DISMISSED_KEY) === "1") {
     removeStorage(LEGACY_DISMISSED_KEY);
-    writeStorage(COLLAPSED_KEY, "1");
+    writeStorage2(COLLAPSED_KEY, "1");
     return true;
   }
-  return readStorage2(COLLAPSED_KEY) !== "0";
+  return readStorage3(COLLAPSED_KEY) !== "0";
 }
 function setCollapsed(collapsed) {
-  writeStorage(COLLAPSED_KEY, collapsed ? "1" : "0");
+  writeStorage2(COLLAPSED_KEY, collapsed ? "1" : "0");
 }
 function optOut() {
   setCookie(COOKIE_NAMES.OPTOUT, "1", 365 * 24 * 3600);
@@ -1137,7 +1302,7 @@ function hasPin() {
 async function pinAudience(audienceId, opts = {}) {
   const apiBase = opts.apiBase ?? DEFAULT_API_BASE2;
   try {
-    const res = await fetch(`${apiBase}/kywi/audience`, {
+    const res = await fetch(withSiteId(`${apiBase}/kywi/audience`), {
       method: "POST",
       headers: { "Content-Type": "application/json", ...opts.csrfToken ? { "X-CSRF-Token": opts.csrfToken } : {} },
       body: JSON.stringify({ audienceId, source: "switcher" })
@@ -1350,14 +1515,18 @@ function setPreviewAudienceId(id) {
 }
 function clearPreview() {
   sessionStorage.removeItem(PREVIEW_KEY);
+  deleteCookie(COOKIE_NAMES.PREVIEW_INIT);
+}
+function previewAudienceFromCookie(value) {
+  if (!value) return null;
+  const parts = value.split(".");
+  if (parts.length < 3) return null;
+  const id = parts[0];
+  return id.length > 0 ? id : null;
 }
 function checkPreviewInit() {
-  const cookies = readCookies();
-  const initId = cookies.get(COOKIE_NAMES.PREVIEW_INIT);
-  if (initId) {
-    setPreviewAudienceId(initId);
-    deleteCookie(COOKIE_NAMES.PREVIEW_INIT);
-  }
+  const initId = previewAudienceFromCookie(readCookies().get(COOKIE_NAMES.PREVIEW_INIT));
+  if (initId) setPreviewAudienceId(initId);
 }
 function renderPreviewBanner(audienceName2) {
   document.querySelector(".kywi-preview-banner")?.remove();
@@ -1418,7 +1587,7 @@ async function runClientAdapters(adapters, currentSignals, apiBase = "/api/v1")
     if (cached) return cached;
     let result;
     if (adapter.side === "server-proxy") {
-      const res = await fetch(`${apiBase}/kywi/adapters/${adapter.id}`, {
+      const res = await fetch(withSiteId(`${apiBase}/kywi/adapters/${adapter.id}`), {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ signals: currentSignals })
@@ -1437,16 +1606,18 @@ async function runClientAdapters(adapters, currentSignals, apiBase = "/api/v1")
 }
 
 // src/audience/selfid-submit.ts
-function handleSelfIdSubmit(responses, audiences, currentPath) {
-  storeSelfId(responses);
+function handleSelfIdSubmit(responses, audiences, currentPath, gate = {}) {
+  storeSelfId(responses, gate);
   if (audiences && currentPath) {
     const cookies = readCookies();
     const serverMeta = readServerMeta();
+    const mayPersonalize = hasConsent("personalization", gate);
+    const storedVisitorId = mayPersonalize ? cookies.get(COOKIE_NAMES.VISITOR) : void 0;
     const serverSignals = {
-      identity: { visitorId: serverMeta.visitorId || cookies.get(COOKIE_NAMES.VISITOR) || "", isKnown: cookies.has(COOKIE_NAMES.KNOWN), maLeadId: null },
+      identity: { visitorId: serverMeta.visitorId || storedVisitorId || "", isKnown: mayPersonalize && cookies.has(COOKIE_NAMES.KNOWN), maLeadId: null },
       meta: { isOptedOut: cookies.has(COOKIE_NAMES.OPTOUT), isPreview: false, previewAudienceId: null, resolvedAt: "server" }
     };
-    const result = evaluateClientSide(audiences, serverSignals, currentPath);
+    const result = evaluateClientSide(audiences, serverSignals, currentPath, void 0, gate);
     patchVariantContainers(result.winningAudienceId);
     populateDataLayer({
       visitorId: result.signals.identity.visitorId,
@@ -1518,10 +1689,28 @@ function createSelfIdWidget(config) {
   function markShown() {
     localStorage.setItem(SHOWN_KEY, String(Date.now()));
   }
+  function consentGate() {
+    return config.requireConsent === void 0 ? {} : { requireConsent: config.requireConsent };
+  }
+  function patchClientSide(responses) {
+    handleSelfIdSubmit(responses, config.audiences ?? [], config.currentPath ?? "/", consentGate());
+  }
   function handleSubmit(responses) {
-    storeSelfId(responses);
+    if (config.serverSubmit !== false) {
+      markShown();
+      const options = {
+        ...config.apiBase !== void 0 ? { apiBase: config.apiBase } : {},
+        ...config.csrfToken !== void 0 ? { csrfToken: config.csrfToken } : {}
+      };
+      void setSelfId(responses, options).then((result) => {
+        if (!result || !result.persisted) patchClientSide(responses);
+      }).catch(() => {
+      });
+      return;
+    }
+    storeSelfId(responses, consentGate());
     try {
-      handleSelfIdSubmit(responses, config.audiences ?? [], config.currentPath ?? "/");
+      patchClientSide(responses);
     } finally {
       markShown();
     }
@@ -1774,7 +1963,7 @@ async function bootAudienceEngine(config) {
   populateDataLayer({ visitorId: result.signals.identity.visitorId, audienceId: effectiveAudienceId, experimentId: serverMeta.experimentId, variantId: serverMeta.variantId, isPreview: false, isOptedOut: result.isOptedOut });
   fireKywiReady();
   if (!isPinned && mayPersonalize && result.winningAudienceId && result.winningAudienceId !== serverMeta.audienceId) {
-    fetch(`${apiBase}/kywi/audience`, {
+    fetch(withSiteId(`${apiBase}/kywi/audience`), {
       method: "POST",
       headers: { "Content-Type": "application/json", ...Kywi.context?.csrfToken ? { "X-CSRF-Token": Kywi.context.csrfToken } : {} },
       // Explicitly the AUTOMATIC write, so the server applies the
@@ -1785,7 +1974,15 @@ async function bootAudienceEngine(config) {
     });
   }
   if (config.selfIdWidget) {
-    const widget = createSelfIdWidget(config.selfIdWidget);
+    const widget = createSelfIdWidget({
+      // The API base and CSRF token this boot resolved, so the widget's server
+      // submit posts where the rest of the runtime does (review fix 4); a
+      // value the widget config sets itself still wins.
+      apiBase,
+      csrfToken: Kywi.context?.csrfToken ?? null,
+      ...config.selfIdWidget,
+      ...config.requireConsent === void 0 ? {} : { requireConsent: config.requireConsent }
+    });
     if (widget.shouldShow()) {
       const doRender = () => {
         const mount = resolveSelfIdMount(config.selfIdWidget.displayMode);
@@ -1871,6 +2068,11 @@ var Kywi = {
   setSelfId,
   /** Forget the visitor's self-identification and un-pin their audience. */
   clearSelfId,
+  /**
+   * Re-open the cookie-consent banner so the visitor can change an earlier
+   * decision (kywi-cms#191) — for a site's own "Cookie settings" link.
+   */
+  reopenConsent,
   getEntity: null,
   getFeed: null,
   renderFeed: null,
@@ -1904,6 +2106,8 @@ if (typeof document !== "undefined") {
 export {
   AUDIENCE_PIN_COOKIE,
   CONSENT_COOKIE,
+  CONSENT_EVENT,
+  CONSENT_REOPEN_EVENT,
   COOKIE_CONSENT_CATEGORY,
   Kywi,
   NAV_BREAKPOINT,
@@ -1918,6 +2122,7 @@ export {
   initNavMenus,
   openTransparencyPanel,
   renderTransparencyPanel,
+  reopenConsent,
   setConsent,
   setSelfId
 };