@kywi-software/js 0.24.0 → 0.26.0

package/dist/kywi.js

@@ -23,6 +23,8 @@ var Kywi = (() => {
   __export(src_exports, {
     AUDIENCE_PIN_COOKIE: () => AUDIENCE_PIN_COOKIE,
     CONSENT_COOKIE: () => CONSENT_COOKIE,
+    CONSENT_EVENT: () => CONSENT_EVENT,
+    CONSENT_REOPEN_EVENT: () => CONSENT_REOPEN_EVENT,
     COOKIE_CONSENT_CATEGORY: () => COOKIE_CONSENT_CATEGORY,
     Kywi: () => Kywi,
     NAV_BREAKPOINT: () => NAV_BREAKPOINT,
@@ -37,6 +39,7 @@ var Kywi = (() => {
     initNavMenus: () => initNavMenus,
     openTransparencyPanel: () => openTransparencyPanel,
     renderTransparencyPanel: () => renderTransparencyPanel,
+    reopenConsent: () => reopenConsent,
     setConsent: () => setConsent,
     setSelfId: () => setSelfId
   });
@@ -58,6 +61,26 @@ var Kywi = (() => {
     };
   }
 
+  // src/site-scope.ts
+  function currentSiteId() {
+    if (typeof document === "undefined") return "";
+    return document.querySelector('meta[name="kywi:site-id"]')?.getAttribute("content") || "";
+  }
+  function withSiteId(url) {
+    if (!isSameOrigin(url)) return url;
+    const siteId = currentSiteId();
+    if (!siteId || /[?&]siteId=/.test(url)) return url;
+    const [path, hash] = url.split("#", 2);
+    const joined = `${path}${path.includes("?") ? "&" : "?"}siteId=${encodeURIComponent(siteId)}`;
+    return hash === void 0 ? joined : `${joined}#${hash}`;
+  }
+  function isSameOrigin(url) {
+    if (url.startsWith("/")) return !url.startsWith("//");
+    const origin = typeof window !== "undefined" ? window.location?.origin : void 0;
+    if (!origin || origin === "null") return false;
+    return url === origin || url.startsWith(`${origin}/`);
+  }
+
   // src/entity.ts
   function createEntity(type, basePath, csrfToken, data) {
     const fields = { ...data };
@@ -77,7 +100,7 @@ var Kywi = (() => {
       async save() {
         const id = fields["id"];
         const url = id ? `${basePath}/content/${type}/${id}` : `${basePath}/content/${type}`;
-        const res = await fetch(url, { method: id ? "PUT" : "POST", headers, body: JSON.stringify(Object.fromEntries(dirty)) });
+        const res = await fetch(withSiteId(url), { method: id ? "PUT" : "POST", headers, body: JSON.stringify(Object.fromEntries(dirty)) });
         const json = await res.json();
         if (!res.ok || json.error) {
           errors.push(json.error?.message ?? "Save failed");
@@ -89,14 +112,14 @@ var Kywi = (() => {
       },
       async delete() {
         const id = fields["id"];
-        await fetch(`${basePath}/content/${type}/${id}`, { method: "DELETE", headers });
+        await fetch(withSiteId(`${basePath}/content/${type}/${id}`), { method: "DELETE", headers });
       },
       getErrors() {
         return [...errors];
       },
       async loadBy(field, value) {
         const url = field === "id" ? `${basePath}/content/${type}/${value}` : `${basePath}/content/${type}?${field}=${encodeURIComponent(value)}`;
-        const res = await fetch(url, { headers });
+        const res = await fetch(withSiteId(url), { headers });
         const json = await res.json();
         if (!res.ok || json.error) {
           errors.push(json.error?.message ?? "Load failed");
@@ -215,7 +238,7 @@ var Kywi = (() => {
       const agg = { function: fn };
       if (field) agg["field"] = field;
       body["aggregate"] = agg;
-      const res = await fetch(`${this.basePath}/feeds/aggregate`, {
+      const res = await fetch(withSiteId(`${this.basePath}/feeds/aggregate`), {
         method: "POST",
         headers: this.buildHeaders(),
         body: JSON.stringify(body)
@@ -225,7 +248,7 @@ var Kywi = (() => {
     }
     async getQuery() {
       const body = this.buildBody();
-      const res = await fetch(`${this.basePath}/feeds/query`, {
+      const res = await fetch(withSiteId(`${this.basePath}/feeds/query`), {
         method: "POST",
         headers: this.buildHeaders(),
         body: JSON.stringify(body)
@@ -514,6 +537,248 @@ var Kywi = (() => {
     };
   }
 
+  // src/cookies.ts
+  var COOKIE_NAMES = {
+    SIGNALS: "kywi_signals",
+    VISITOR: "kywi_visitor",
+    UTM: "kywi_utm",
+    AUDIENCE: "kywi_audience",
+    OPTOUT: "kywi_optout",
+    KNOWN: "kywi_known",
+    PREVIEW_INIT: "kywi_preview_init",
+    BUCKET: "kywi_bucket"
+  };
+  function readCookies() {
+    const map = /* @__PURE__ */ new Map();
+    if (typeof document === "undefined") return map;
+    for (const pair of document.cookie.split(";")) {
+      const trimmed = pair.trim();
+      const eqIdx = trimmed.indexOf("=");
+      if (eqIdx < 0) continue;
+      map.set(trimmed.slice(0, eqIdx), decodeURIComponent(trimmed.slice(eqIdx + 1)));
+    }
+    return map;
+  }
+  function setCookie(name, value, maxAge) {
+    let str = `${name}=${encodeURIComponent(value)}; Path=/; SameSite=Lax`;
+    if (maxAge !== void 0 && maxAge >= 0) str += `; Max-Age=${maxAge}`;
+    document.cookie = str;
+  }
+  function deleteCookie(name) {
+    document.cookie = `${name}=; Path=/; Max-Age=0`;
+  }
+
+  // src/consent.ts
+  var CONSENT_COOKIE = "kywi_consent";
+  var CONSENT_EVENT = "kywi:consent";
+  var CONSENT_REOPEN_EVENT = "kywi:consent-reopen";
+  function reopenConsent() {
+    if (typeof window === "undefined" || typeof CustomEvent === "undefined") return;
+    window.dispatchEvent(new CustomEvent(CONSENT_REOPEN_EVENT));
+  }
+  var AUDIENCE_PIN_COOKIE = "kywi_audience";
+  var SWITCHER_PIN_PREFIX = "switcher:";
+  var COOKIE_CONSENT_CATEGORY = {
+    kywi_consent: "essential",
+    kywi_optout: "essential",
+    kywi_preview_init: "essential",
+    kywi_bucket: "essential",
+    kywi_entry: "essential",
+    kywi_utm_visit: "essential",
+    kywi_selfid: "essential",
+    kywi_signals: "personalization",
+    kywi_visitor: "personalization",
+    kywi_utm: "personalization",
+    kywi_audience: "personalization",
+    kywi_known: "personalization"
+  };
+  function getConsentState() {
+    const cookies = readCookies();
+    const raw = cookies.get(CONSENT_COOKIE);
+    if (!raw) return null;
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      return null;
+    }
+    if (typeof parsed !== "object" || parsed === null) return null;
+    const obj = parsed;
+    return {
+      essential: true,
+      analytics: obj.analytics === true,
+      marketing: obj.marketing === true,
+      personalization: obj.personalization === true
+    };
+  }
+  function setConsent(prefs) {
+    const state = {
+      essential: true,
+      analytics: prefs.analytics ?? false,
+      marketing: prefs.marketing ?? false,
+      personalization: prefs.personalization ?? false
+    };
+    setCookie(CONSENT_COOKIE, JSON.stringify(state), 31536e3);
+    clearDeniedCookies(state);
+    announceConsent(state);
+  }
+  function announceConsent(state) {
+    if (typeof window === "undefined" || typeof CustomEvent === "undefined") return;
+    try {
+      window.dispatchEvent(new CustomEvent(CONSENT_EVENT, { detail: state }));
+    } catch {
+    }
+  }
+  function clearDeniedCookies(state) {
+    if (typeof document === "undefined") return [];
+    const cookies = readCookies();
+    const deleted = [];
+    for (const [name, category] of Object.entries(COOKIE_CONSENT_CATEGORY)) {
+      if (category === "essential") continue;
+      if (state && state[category] === true) continue;
+      if (isDeliberatePreference(name, cookies.get(name))) continue;
+      deleteCookie(name);
+      deleted.push(name);
+    }
+    return deleted;
+  }
+  function isDeliberatePreference(name, value) {
+    if (name !== AUDIENCE_PIN_COOKIE || value === void 0) return false;
+    return value.startsWith(SWITCHER_PIN_PREFIX) && value.length > SWITCHER_PIN_PREFIX.length;
+  }
+  function hasConsent(category, options = {}) {
+    if (options.requireConsent === false) return true;
+    if (category === "essential") return true;
+    const state = getConsentState();
+    if (!state) return false;
+    return state[category] === true;
+  }
+
+  // src/experiments/pending.ts
+  var PENDING_EVENTS_META = "kywi:pending-events";
+  var PENDING_STORAGE_KEY = "kywi:pending-events";
+  var EMPTY = () => ({ exposures: [], matched: [] });
+  var memory = EMPTY();
+  var consentListener = null;
+  function hasValidSiteId(o) {
+    return o.siteId === void 0 || typeof o.siteId === "string" && o.siteId.length > 0;
+  }
+  function isExposure(v) {
+    if (typeof v !== "object" || v === null) return false;
+    const o = v;
+    return typeof o.experimentId === "string" && o.experimentId.length > 0 && (typeof o.variantKey === "string" || o.variantKey === null) && typeof o.at === "number" && hasValidSiteId(o);
+  }
+  function isMatch(v) {
+    if (typeof v !== "object" || v === null) return false;
+    const o = v;
+    return typeof o.audienceId === "string" && o.audienceId.length > 0 && typeof o.at === "number" && typeof o.sig === "string" && o.sig.length > 0 && hasValidSiteId(o);
+  }
+  function parsePending(raw) {
+    if (!raw) return EMPTY();
+    try {
+      const parsed = JSON.parse(raw);
+      const exposures = Array.isArray(parsed?.exposures) ? parsed.exposures.filter(isExposure) : [];
+      const matched = Array.isArray(parsed?.matched) ? parsed.matched.filter(isMatch) : [];
+      return { exposures, matched };
+    } catch {
+      return EMPTY();
+    }
+  }
+  function readStorage() {
+    try {
+      return parsePending(sessionStorage.getItem(PENDING_STORAGE_KEY));
+    } catch {
+      return EMPTY();
+    }
+  }
+  function writeStorage(events) {
+    try {
+      if (isEmpty(events)) sessionStorage.removeItem(PENDING_STORAGE_KEY);
+      else sessionStorage.setItem(PENDING_STORAGE_KEY, JSON.stringify(events));
+    } catch {
+    }
+  }
+  function isEmpty(events) {
+    return events.exposures.length === 0 && events.matched.length === 0;
+  }
+  function merge(into, from) {
+    const expKey = (e) => `${e.siteId ?? ""}|${e.experimentId}`;
+    const audKey = (m) => `${m.siteId ?? ""}|${m.audienceId}`;
+    const byExperiment = new Map(into.exposures.map((e) => [expKey(e), e]));
+    for (const e of from.exposures) if (!byExperiment.has(expKey(e))) byExperiment.set(expKey(e), e);
+    const byAudience = new Map(into.matched.map((m) => [audKey(m), m]));
+    for (const m of from.matched) if (!byAudience.has(audKey(m))) byAudience.set(audKey(m), m);
+    return { exposures: [...byExperiment.values()], matched: [...byAudience.values()] };
+  }
+  function stampSite(events) {
+    const siteId = currentSiteId();
+    if (!siteId) return events;
+    return {
+      exposures: events.exposures.map((e) => e.siteId ? e : { ...e, siteId }),
+      matched: events.matched.map((m) => m.siteId ? m : { ...m, siteId })
+    };
+  }
+  function pendingEvents() {
+    return merge(memory, readStorage());
+  }
+  function queuePendingEvents(events) {
+    memory = merge(pendingEvents(), stampSite(events));
+    writeStorage(memory);
+  }
+  function clearQueue() {
+    memory = EMPTY();
+    writeStorage(memory);
+  }
+  function urlForSite(url, siteId) {
+    if (!siteId) return withSiteId(url);
+    const origin = typeof window !== "undefined" ? window.location?.origin : void 0;
+    const sameOrigin = url.startsWith("/") && !url.startsWith("//") || !!origin && origin !== "null" && (url === origin || url.startsWith(`${origin}/`));
+    if (!sameOrigin || /[?&]siteId=/.test(url)) return url;
+    return `${url}${url.includes("?") ? "&" : "?"}siteId=${encodeURIComponent(siteId)}`;
+  }
+  function post(url, siteId, body, csrfToken) {
+    try {
+      void fetch(urlForSite(url, siteId), {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...csrfToken ? { "X-CSRF-Token": csrfToken } : {} },
+        body: JSON.stringify(body),
+        keepalive: true
+      }).catch(() => {
+      });
+    } catch {
+    }
+  }
+  function flushPendingEvents(config) {
+    const gate = config.requireConsent === void 0 ? {} : { requireConsent: config.requireConsent };
+    const queue = pendingEvents();
+    if (isEmpty(queue)) return 0;
+    if (!hasConsent("personalization", gate) || !hasConsent("analytics", gate)) {
+      if (getConsentState() !== null) clearQueue();
+      return 0;
+    }
+    for (const e of queue.exposures) {
+      post(`${config.apiBase}/kywi/experiments/exposure`, e.siteId, { experimentId: e.experimentId, at: e.at }, config.csrfToken);
+    }
+    for (const m of queue.matched) {
+      post(`${config.apiBase}/kywi/analytics/matched`, m.siteId, { audienceId: m.audienceId, at: m.at, sig: m.sig }, config.csrfToken);
+    }
+    clearQueue();
+    return queue.exposures.length + queue.matched.length;
+  }
+  function bootPendingEvents(config) {
+    if (typeof document !== "undefined") {
+      const raw = document.querySelector(`meta[name="${PENDING_EVENTS_META}"]`)?.getAttribute("content");
+      queuePendingEvents(parsePending(raw));
+    }
+    flushPendingEvents(config);
+    if (typeof window === "undefined") return;
+    if (consentListener) window.removeEventListener(CONSENT_EVENT, consentListener);
+    consentListener = () => {
+      flushPendingEvents(config);
+    };
+    window.addEventListener(CONSENT_EVENT, consentListener);
+  }
+
   // src/experiments/index.ts
   function apiBaseFrom(ctx) {
     return ctx.basePath && ctx.basePath !== "/" ? `${ctx.basePath}/api/v1` : "/api/v1";
@@ -540,7 +805,7 @@ var Kywi = (() => {
   }
   function beacon(url, body, csrfToken) {
     try {
-      void fetch(url, {
+      void fetch(withSiteId(url), {
         method: "POST",
         headers: { "Content-Type": "application/json", ...csrfToken ? { "X-CSRF-Token": csrfToken } : {} },
         body: JSON.stringify(body),
@@ -566,6 +831,7 @@ var Kywi = (() => {
     if (experimentId) {
       beacon(`${apiBase}/kywi/experiments/exposure`, { experimentId, visitorId }, csrf);
     }
+    bootPendingEvents({ apiBase, ...csrf ? { csrfToken: csrf } : {} });
     if (config.autoPageview !== false) {
       trackConversion({ type: "pageview", url: currentPath });
     }
@@ -582,7 +848,7 @@ var Kywi = (() => {
   // src/audience/selfid-collector.ts
   var SELFID_KEY = "kywi_selfid";
   function collectSelfId() {
-    const raw = readStorage(SELFID_KEY);
+    const raw = readStorage2(SELFID_KEY);
     if (!raw) return {};
     try {
       const parsed = JSON.parse(raw);
@@ -592,7 +858,9 @@ var Kywi = (() => {
       return {};
     }
   }
-  function storeSelfId(responses) {
+  function storeSelfId(responses, gate = {}) {
+    const category = COOKIE_CONSENT_CATEGORY[SELFID_KEY] ?? "personalization";
+    if (!hasConsent(category, gate)) return;
     try {
       localStorage.setItem(SELFID_KEY, JSON.stringify(responses));
     } catch {
@@ -604,7 +872,7 @@ var Kywi = (() => {
     } catch {
     }
   }
-  function readStorage(key) {
+  function readStorage2(key) {
     try {
       return localStorage.getItem(key);
     } catch {
@@ -651,7 +919,7 @@ var Kywi = (() => {
   async function submit(fields, options) {
     const csrfToken = resolveCsrfToken(options.csrfToken);
     try {
-      const res = await fetch(`${resolveApiBase(options.apiBase)}/kywi/self-id`, {
+      const res = await fetch(withSiteId(`${resolveApiBase(options.apiBase)}/kywi/self-id`), {
         method: "POST",
         headers: { "Content-Type": "application/json", ...csrfToken ? { "X-CSRF-Token": csrfToken } : {} },
         body: JSON.stringify({
@@ -925,106 +1193,6 @@ var Kywi = (() => {
     return search ? `${currentPath}${search}` : currentPath;
   }
 
-  // src/cookies.ts
-  var COOKIE_NAMES = {
-    SIGNALS: "kywi_signals",
-    VISITOR: "kywi_visitor",
-    UTM: "kywi_utm",
-    AUDIENCE: "kywi_audience",
-    OPTOUT: "kywi_optout",
-    KNOWN: "kywi_known",
-    PREVIEW_INIT: "kywi_preview_init"
-  };
-  function readCookies() {
-    const map = /* @__PURE__ */ new Map();
-    if (typeof document === "undefined") return map;
-    for (const pair of document.cookie.split(";")) {
-      const trimmed = pair.trim();
-      const eqIdx = trimmed.indexOf("=");
-      if (eqIdx < 0) continue;
-      map.set(trimmed.slice(0, eqIdx), decodeURIComponent(trimmed.slice(eqIdx + 1)));
-    }
-    return map;
-  }
-  function setCookie(name, value, maxAge) {
-    let str = `${name}=${encodeURIComponent(value)}; Path=/; SameSite=Lax`;
-    if (maxAge !== void 0 && maxAge >= 0) str += `; Max-Age=${maxAge}`;
-    document.cookie = str;
-  }
-  function deleteCookie(name) {
-    document.cookie = `${name}=; Path=/; Max-Age=0`;
-  }
-
-  // src/consent.ts
-  var CONSENT_COOKIE = "kywi_consent";
-  var AUDIENCE_PIN_COOKIE = "kywi_audience";
-  var SWITCHER_PIN_PREFIX = "switcher:";
-  var COOKIE_CONSENT_CATEGORY = {
-    kywi_consent: "essential",
-    kywi_optout: "essential",
-    kywi_preview_init: "essential",
-    kywi_signals: "personalization",
-    kywi_visitor: "personalization",
-    kywi_utm: "personalization",
-    kywi_audience: "personalization",
-    kywi_known: "personalization",
-    kywi_entry: "personalization",
-    kywi_selfid: "personalization"
-  };
-  function getConsentState() {
-    const cookies = readCookies();
-    const raw = cookies.get(CONSENT_COOKIE);
-    if (!raw) return null;
-    let parsed;
-    try {
-      parsed = JSON.parse(raw);
-    } catch {
-      return null;
-    }
-    if (typeof parsed !== "object" || parsed === null) return null;
-    const obj = parsed;
-    return {
-      essential: true,
-      analytics: obj.analytics === true,
-      marketing: obj.marketing === true,
-      personalization: obj.personalization === true
-    };
-  }
-  function setConsent(prefs) {
-    const state = {
-      essential: true,
-      analytics: prefs.analytics ?? false,
-      marketing: prefs.marketing ?? false,
-      personalization: prefs.personalization ?? false
-    };
-    setCookie(CONSENT_COOKIE, JSON.stringify(state), 31536e3);
-    clearDeniedCookies(state);
-  }
-  function clearDeniedCookies(state) {
-    if (typeof document === "undefined") return [];
-    const cookies = readCookies();
-    const deleted = [];
-    for (const [name, category] of Object.entries(COOKIE_CONSENT_CATEGORY)) {
-      if (category === "essential") continue;
-      if (state && state[category] === true) continue;
-      if (isDeliberatePreference(name, cookies.get(name))) continue;
-      deleteCookie(name);
-      deleted.push(name);
-    }
-    return deleted;
-  }
-  function isDeliberatePreference(name, value) {
-    if (name !== AUDIENCE_PIN_COOKIE || value === void 0) return false;
-    return value.startsWith(SWITCHER_PIN_PREFIX) && value.length > SWITCHER_PIN_PREFIX.length;
-  }
-  function hasConsent(category, options = {}) {
-    if (options.requireConsent === false) return true;
-    if (category === "essential") return true;
-    const state = getConsentState();
-    if (!state) return false;
-    return state[category] === true;
-  }
-
   // src/audience/behavioral-collector.ts
   var SESSION_KEY = "kywi_session";
   var TOTAL_VIEWS_KEY = "kywi_total_views";
@@ -1079,7 +1247,7 @@ var Kywi = (() => {
   }
 
   // src/audience/evaluate.ts
-  function merge(base, partial) {
+  function merge2(base, partial) {
     return {
       utm: partial.utm ?? base.utm,
       referrer: partial.referrer ?? base.referrer,
@@ -1093,10 +1261,10 @@ var Kywi = (() => {
     };
   }
   function evaluateClientSide(audiences, serverSignals, currentPath, pageCategory, gate = {}) {
-    let signals = merge(createEmptySignals(), serverSignals);
+    let signals = merge2(createEmptySignals(), serverSignals);
     const client = collectBehavioral(currentPath, pageCategory, gate);
     const selfId = collectSelfId();
-    signals = merge(signals, { session: client.session, behavioral: client.behavioral, query: collectQuery(), selfId, meta: { ...signals.meta, resolvedAt: "client" } });
+    signals = merge2(signals, { session: client.session, behavioral: client.behavioral, query: collectQuery(), selfId, meta: { ...signals.meta, resolvedAt: "client" } });
     const { winningAudienceId, allMatchedIds } = resolveAudiences(audiences, signals);
     const isOptedOut2 = signals.meta.isOptedOut;
     return { winningAudienceId: isOptedOut2 ? null : winningAudienceId, allMatchedIds, signals, isOptedOut: isOptedOut2 };
@@ -1134,14 +1302,14 @@ var Kywi = (() => {
   var DEFAULT_API_BASE2 = "/api/v1";
   var lastState = null;
   var forcedOpen = false;
-  function readStorage2(key) {
+  function readStorage3(key) {
     try {
       return localStorage.getItem(key);
     } catch {
       return null;
     }
   }
-  function writeStorage(key, value) {
+  function writeStorage2(key, value) {
     try {
       localStorage.setItem(key, value);
     } catch {
@@ -1154,15 +1322,15 @@ var Kywi = (() => {
     }
   }
   function isCollapsed() {
-    if (readStorage2(LEGACY_DISMISSED_KEY) === "1") {
+    if (readStorage3(LEGACY_DISMISSED_KEY) === "1") {
       removeStorage(LEGACY_DISMISSED_KEY);
-      writeStorage(COLLAPSED_KEY, "1");
+      writeStorage2(COLLAPSED_KEY, "1");
       return true;
     }
-    return readStorage2(COLLAPSED_KEY) !== "0";
+    return readStorage3(COLLAPSED_KEY) !== "0";
   }
   function setCollapsed(collapsed) {
-    writeStorage(COLLAPSED_KEY, collapsed ? "1" : "0");
+    writeStorage2(COLLAPSED_KEY, collapsed ? "1" : "0");
   }
   function optOut() {
     setCookie(COOKIE_NAMES.OPTOUT, "1", 365 * 24 * 3600);
@@ -1180,7 +1348,7 @@ var Kywi = (() => {
   async function pinAudience(audienceId, opts = {}) {
     const apiBase = opts.apiBase ?? DEFAULT_API_BASE2;
     try {
-      const res = await fetch(`${apiBase}/kywi/audience`, {
+      const res = await fetch(withSiteId(`${apiBase}/kywi/audience`), {
         method: "POST",
         headers: { "Content-Type": "application/json", ...opts.csrfToken ? { "X-CSRF-Token": opts.csrfToken } : {} },
         body: JSON.stringify({ audienceId, source: "switcher" })
@@ -1393,14 +1561,18 @@ var Kywi = (() => {
   }
   function clearPreview() {
     sessionStorage.removeItem(PREVIEW_KEY);
+    deleteCookie(COOKIE_NAMES.PREVIEW_INIT);
+  }
+  function previewAudienceFromCookie(value) {
+    if (!value) return null;
+    const parts = value.split(".");
+    if (parts.length < 3) return null;
+    const id = parts[0];
+    return id.length > 0 ? id : null;
   }
   function checkPreviewInit() {
-    const cookies = readCookies();
-    const initId = cookies.get(COOKIE_NAMES.PREVIEW_INIT);
-    if (initId) {
-      setPreviewAudienceId(initId);
-      deleteCookie(COOKIE_NAMES.PREVIEW_INIT);
-    }
+    const initId = previewAudienceFromCookie(readCookies().get(COOKIE_NAMES.PREVIEW_INIT));
+    if (initId) setPreviewAudienceId(initId);
   }
   function renderPreviewBanner(audienceName2) {
     document.querySelector(".kywi-preview-banner")?.remove();
@@ -1461,7 +1633,7 @@ var Kywi = (() => {
       if (cached) return cached;
       let result;
       if (adapter.side === "server-proxy") {
-        const res = await fetch(`${apiBase}/kywi/adapters/${adapter.id}`, {
+        const res = await fetch(withSiteId(`${apiBase}/kywi/adapters/${adapter.id}`), {
           method: "POST",
           headers: { "Content-Type": "application/json" },
           body: JSON.stringify({ signals: currentSignals })
@@ -1480,16 +1652,18 @@ var Kywi = (() => {
   }
 
   // src/audience/selfid-submit.ts
-  function handleSelfIdSubmit(responses, audiences, currentPath) {
-    storeSelfId(responses);
+  function handleSelfIdSubmit(responses, audiences, currentPath, gate = {}) {
+    storeSelfId(responses, gate);
     if (audiences && currentPath) {
       const cookies = readCookies();
       const serverMeta = readServerMeta();
+      const mayPersonalize = hasConsent("personalization", gate);
+      const storedVisitorId = mayPersonalize ? cookies.get(COOKIE_NAMES.VISITOR) : void 0;
       const serverSignals = {
-        identity: { visitorId: serverMeta.visitorId || cookies.get(COOKIE_NAMES.VISITOR) || "", isKnown: cookies.has(COOKIE_NAMES.KNOWN), maLeadId: null },
+        identity: { visitorId: serverMeta.visitorId || storedVisitorId || "", isKnown: mayPersonalize && cookies.has(COOKIE_NAMES.KNOWN), maLeadId: null },
         meta: { isOptedOut: cookies.has(COOKIE_NAMES.OPTOUT), isPreview: false, previewAudienceId: null, resolvedAt: "server" }
       };
-      const result = evaluateClientSide(audiences, serverSignals, currentPath);
+      const result = evaluateClientSide(audiences, serverSignals, currentPath, void 0, gate);
       patchVariantContainers(result.winningAudienceId);
       populateDataLayer({
         visitorId: result.signals.identity.visitorId,
@@ -1561,10 +1735,28 @@ var Kywi = (() => {
     function markShown() {
       localStorage.setItem(SHOWN_KEY, String(Date.now()));
     }
+    function consentGate() {
+      return config.requireConsent === void 0 ? {} : { requireConsent: config.requireConsent };
+    }
+    function patchClientSide(responses) {
+      handleSelfIdSubmit(responses, config.audiences ?? [], config.currentPath ?? "/", consentGate());
+    }
     function handleSubmit(responses) {
-      storeSelfId(responses);
+      if (config.serverSubmit !== false) {
+        markShown();
+        const options = {
+          ...config.apiBase !== void 0 ? { apiBase: config.apiBase } : {},
+          ...config.csrfToken !== void 0 ? { csrfToken: config.csrfToken } : {}
+        };
+        void setSelfId(responses, options).then((result) => {
+          if (!result || !result.persisted) patchClientSide(responses);
+        }).catch(() => {
+        });
+        return;
+      }
+      storeSelfId(responses, consentGate());
       try {
-        handleSelfIdSubmit(responses, config.audiences ?? [], config.currentPath ?? "/");
+        patchClientSide(responses);
       } finally {
         markShown();
       }
@@ -1817,7 +2009,7 @@ var Kywi = (() => {
     populateDataLayer({ visitorId: result.signals.identity.visitorId, audienceId: effectiveAudienceId, experimentId: serverMeta.experimentId, variantId: serverMeta.variantId, isPreview: false, isOptedOut: result.isOptedOut });
     fireKywiReady();
     if (!isPinned && mayPersonalize && result.winningAudienceId && result.winningAudienceId !== serverMeta.audienceId) {
-      fetch(`${apiBase}/kywi/audience`, {
+      fetch(withSiteId(`${apiBase}/kywi/audience`), {
         method: "POST",
         headers: { "Content-Type": "application/json", ...Kywi.context?.csrfToken ? { "X-CSRF-Token": Kywi.context.csrfToken } : {} },
         // Explicitly the AUTOMATIC write, so the server applies the
@@ -1828,7 +2020,15 @@ var Kywi = (() => {
       });
     }
     if (config.selfIdWidget) {
-      const widget = createSelfIdWidget(config.selfIdWidget);
+      const widget = createSelfIdWidget({
+        // The API base and CSRF token this boot resolved, so the widget's server
+        // submit posts where the rest of the runtime does (review fix 4); a
+        // value the widget config sets itself still wins.
+        apiBase,
+        csrfToken: Kywi.context?.csrfToken ?? null,
+        ...config.selfIdWidget,
+        ...config.requireConsent === void 0 ? {} : { requireConsent: config.requireConsent }
+      });
       if (widget.shouldShow()) {
         const doRender = () => {
           const mount = resolveSelfIdMount(config.selfIdWidget.displayMode);
@@ -1914,6 +2114,11 @@ var Kywi = (() => {
     setSelfId,
     /** Forget the visitor's self-identification and un-pin their audience. */
     clearSelfId,
+    /**
+     * Re-open the cookie-consent banner so the visitor can change an earlier
+     * decision (kywi-cms#191) — for a site's own "Cookie settings" link.
+     */
+    reopenConsent,
     getEntity: null,
     getFeed: null,
     renderFeed: null,