@pack/hydrogen 3.2.8 → 3.3.1

package/dist/index.js

@@ -32,6 +32,172 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// node_modules/cookie/index.js
+var require_cookie = __commonJS({
+  "node_modules/cookie/index.js"(exports) {
+    "use strict";
+    exports.parse = parse3;
+    exports.serialize = serialize3;
+    var __toString = Object.prototype.toString;
+    var __hasOwnProperty = Object.prototype.hasOwnProperty;
+    var cookieNameRegExp = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+    var cookieValueRegExp = /^("?)[\u0021\u0023-\u002B\u002D-\u003A\u003C-\u005B\u005D-\u007E]*\1$/;
+    var domainValueRegExp = /^([.]?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
+    var pathValueRegExp = /^[\u0020-\u003A\u003D-\u007E]*$/;
+    function parse3(str, opt) {
+      if (typeof str !== "string") {
+        throw new TypeError("argument str must be a string");
+      }
+      var obj = {};
+      var len = str.length;
+      if (len < 2) return obj;
+      var dec = opt && opt.decode || decode;
+      var index = 0;
+      var eqIdx = 0;
+      var endIdx = 0;
+      do {
+        eqIdx = str.indexOf("=", index);
+        if (eqIdx === -1) break;
+        endIdx = str.indexOf(";", index);
+        if (endIdx === -1) {
+          endIdx = len;
+        } else if (eqIdx > endIdx) {
+          index = str.lastIndexOf(";", eqIdx - 1) + 1;
+          continue;
+        }
+        var keyStartIdx = startIndex(str, index, eqIdx);
+        var keyEndIdx = endIndex(str, eqIdx, keyStartIdx);
+        var key = str.slice(keyStartIdx, keyEndIdx);
+        if (!__hasOwnProperty.call(obj, key)) {
+          var valStartIdx = startIndex(str, eqIdx + 1, endIdx);
+          var valEndIdx = endIndex(str, endIdx, valStartIdx);
+          if (str.charCodeAt(valStartIdx) === 34 && str.charCodeAt(valEndIdx - 1) === 34) {
+            valStartIdx++;
+            valEndIdx--;
+          }
+          var val = str.slice(valStartIdx, valEndIdx);
+          obj[key] = tryDecode(val, dec);
+        }
+        index = endIdx + 1;
+      } while (index < len);
+      return obj;
+    }
+    function startIndex(str, index, max) {
+      do {
+        var code = str.charCodeAt(index);
+        if (code !== 32 && code !== 9) return index;
+      } while (++index < max);
+      return max;
+    }
+    function endIndex(str, index, min) {
+      while (index > min) {
+        var code = str.charCodeAt(--index);
+        if (code !== 32 && code !== 9) return index + 1;
+      }
+      return min;
+    }
+    function serialize3(name, val, opt) {
+      var enc = opt && opt.encode || encodeURIComponent;
+      if (typeof enc !== "function") {
+        throw new TypeError("option encode is invalid");
+      }
+      if (!cookieNameRegExp.test(name)) {
+        throw new TypeError("argument name is invalid");
+      }
+      var value = enc(val);
+      if (!cookieValueRegExp.test(value)) {
+        throw new TypeError("argument val is invalid");
+      }
+      var str = name + "=" + value;
+      if (!opt) return str;
+      if (null != opt.maxAge) {
+        var maxAge = Math.floor(opt.maxAge);
+        if (!isFinite(maxAge)) {
+          throw new TypeError("option maxAge is invalid");
+        }
+        str += "; Max-Age=" + maxAge;
+      }
+      if (opt.domain) {
+        if (!domainValueRegExp.test(opt.domain)) {
+          throw new TypeError("option domain is invalid");
+        }
+        str += "; Domain=" + opt.domain;
+      }
+      if (opt.path) {
+        if (!pathValueRegExp.test(opt.path)) {
+          throw new TypeError("option path is invalid");
+        }
+        str += "; Path=" + opt.path;
+      }
+      if (opt.expires) {
+        var expires = opt.expires;
+        if (!isDate(expires) || isNaN(expires.valueOf())) {
+          throw new TypeError("option expires is invalid");
+        }
+        str += "; Expires=" + expires.toUTCString();
+      }
+      if (opt.httpOnly) {
+        str += "; HttpOnly";
+      }
+      if (opt.secure) {
+        str += "; Secure";
+      }
+      if (opt.partitioned) {
+        str += "; Partitioned";
+      }
+      if (opt.priority) {
+        var priority = typeof opt.priority === "string" ? opt.priority.toLowerCase() : opt.priority;
+        switch (priority) {
+          case "low":
+            str += "; Priority=Low";
+            break;
+          case "medium":
+            str += "; Priority=Medium";
+            break;
+          case "high":
+            str += "; Priority=High";
+            break;
+          default:
+            throw new TypeError("option priority is invalid");
+        }
+      }
+      if (opt.sameSite) {
+        var sameSite = typeof opt.sameSite === "string" ? opt.sameSite.toLowerCase() : opt.sameSite;
+        switch (sameSite) {
+          case true:
+            str += "; SameSite=Strict";
+            break;
+          case "lax":
+            str += "; SameSite=Lax";
+            break;
+          case "strict":
+            str += "; SameSite=Strict";
+            break;
+          case "none":
+            str += "; SameSite=None";
+            break;
+          default:
+            throw new TypeError("option sameSite is invalid");
+        }
+      }
+      return str;
+    }
+    function decode(str) {
+      return str.indexOf("%") !== -1 ? decodeURIComponent(str) : str;
+    }
+    function isDate(val) {
+      return __toString.call(val) === "[object Date]";
+    }
+    function tryDecode(str, decode2) {
+      try {
+        return decode2(str);
+      } catch (e) {
+        return str;
+      }
+    }
+  }
+});
+
 // ../../node_modules/ua-parser-js/src/ua-parser.js
 var require_ua_parser = __commonJS({
   "../../node_modules/ua-parser-js/src/ua-parser.js"(exports, module) {
@@ -1283,203 +1449,37 @@ var require_ua_parser = __commonJS({
       UAParser.BROWSER = enumerize([NAME, VERSION, MAJOR]);
       UAParser.CPU = enumerize([ARCHITECTURE]);
       UAParser.DEVICE = enumerize([MODEL, VENDOR, TYPE, CONSOLE, MOBILE, SMARTTV, TABLET, WEARABLE, EMBEDDED]);
-      UAParser.ENGINE = UAParser.OS = enumerize([NAME, VERSION]);
-      if (typeof exports !== UNDEF_TYPE) {
-        if (typeof module !== UNDEF_TYPE && module.exports) {
-          exports = module.exports = UAParser;
-        }
-        exports.UAParser = UAParser;
-      } else {
-        if (typeof define === FUNC_TYPE && define.amd) {
-          define(function() {
-            return UAParser;
-          });
-        } else if (typeof window2 !== UNDEF_TYPE) {
-          window2.UAParser = UAParser;
-        }
-      }
-      var $ = typeof window2 !== UNDEF_TYPE && (window2.jQuery || window2.Zepto);
-      if ($ && !$.ua) {
-        var parser2 = new UAParser();
-        $.ua = parser2.getResult();
-        $.ua.get = function() {
-          return parser2.getUA();
-        };
-        $.ua.set = function(ua) {
-          parser2.setUA(ua);
-          var result = parser2.getResult();
-          for (var prop in result) {
-            $.ua[prop] = result[prop];
-          }
-        };
-      }
-    })(typeof window === "object" ? window : exports);
-  }
-});
-
-// node_modules/cookie/index.js
-var require_cookie = __commonJS({
-  "node_modules/cookie/index.js"(exports) {
-    "use strict";
-    exports.parse = parse2;
-    exports.serialize = serialize3;
-    var __toString = Object.prototype.toString;
-    var __hasOwnProperty = Object.prototype.hasOwnProperty;
-    var cookieNameRegExp = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
-    var cookieValueRegExp = /^("?)[\u0021\u0023-\u002B\u002D-\u003A\u003C-\u005B\u005D-\u007E]*\1$/;
-    var domainValueRegExp = /^([.]?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
-    var pathValueRegExp = /^[\u0020-\u003A\u003D-\u007E]*$/;
-    function parse2(str, opt) {
-      if (typeof str !== "string") {
-        throw new TypeError("argument str must be a string");
-      }
-      var obj = {};
-      var len = str.length;
-      if (len < 2) return obj;
-      var dec = opt && opt.decode || decode;
-      var index = 0;
-      var eqIdx = 0;
-      var endIdx = 0;
-      do {
-        eqIdx = str.indexOf("=", index);
-        if (eqIdx === -1) break;
-        endIdx = str.indexOf(";", index);
-        if (endIdx === -1) {
-          endIdx = len;
-        } else if (eqIdx > endIdx) {
-          index = str.lastIndexOf(";", eqIdx - 1) + 1;
-          continue;
-        }
-        var keyStartIdx = startIndex(str, index, eqIdx);
-        var keyEndIdx = endIndex(str, eqIdx, keyStartIdx);
-        var key = str.slice(keyStartIdx, keyEndIdx);
-        if (!__hasOwnProperty.call(obj, key)) {
-          var valStartIdx = startIndex(str, eqIdx + 1, endIdx);
-          var valEndIdx = endIndex(str, endIdx, valStartIdx);
-          if (str.charCodeAt(valStartIdx) === 34 && str.charCodeAt(valEndIdx - 1) === 34) {
-            valStartIdx++;
-            valEndIdx--;
-          }
-          var val = str.slice(valStartIdx, valEndIdx);
-          obj[key] = tryDecode(val, dec);
-        }
-        index = endIdx + 1;
-      } while (index < len);
-      return obj;
-    }
-    function startIndex(str, index, max) {
-      do {
-        var code = str.charCodeAt(index);
-        if (code !== 32 && code !== 9) return index;
-      } while (++index < max);
-      return max;
-    }
-    function endIndex(str, index, min) {
-      while (index > min) {
-        var code = str.charCodeAt(--index);
-        if (code !== 32 && code !== 9) return index + 1;
-      }
-      return min;
-    }
-    function serialize3(name, val, opt) {
-      var enc = opt && opt.encode || encodeURIComponent;
-      if (typeof enc !== "function") {
-        throw new TypeError("option encode is invalid");
-      }
-      if (!cookieNameRegExp.test(name)) {
-        throw new TypeError("argument name is invalid");
-      }
-      var value = enc(val);
-      if (!cookieValueRegExp.test(value)) {
-        throw new TypeError("argument val is invalid");
-      }
-      var str = name + "=" + value;
-      if (!opt) return str;
-      if (null != opt.maxAge) {
-        var maxAge = Math.floor(opt.maxAge);
-        if (!isFinite(maxAge)) {
-          throw new TypeError("option maxAge is invalid");
-        }
-        str += "; Max-Age=" + maxAge;
-      }
-      if (opt.domain) {
-        if (!domainValueRegExp.test(opt.domain)) {
-          throw new TypeError("option domain is invalid");
-        }
-        str += "; Domain=" + opt.domain;
-      }
-      if (opt.path) {
-        if (!pathValueRegExp.test(opt.path)) {
-          throw new TypeError("option path is invalid");
-        }
-        str += "; Path=" + opt.path;
-      }
-      if (opt.expires) {
-        var expires = opt.expires;
-        if (!isDate(expires) || isNaN(expires.valueOf())) {
-          throw new TypeError("option expires is invalid");
-        }
-        str += "; Expires=" + expires.toUTCString();
-      }
-      if (opt.httpOnly) {
-        str += "; HttpOnly";
-      }
-      if (opt.secure) {
-        str += "; Secure";
-      }
-      if (opt.partitioned) {
-        str += "; Partitioned";
-      }
-      if (opt.priority) {
-        var priority = typeof opt.priority === "string" ? opt.priority.toLowerCase() : opt.priority;
-        switch (priority) {
-          case "low":
-            str += "; Priority=Low";
-            break;
-          case "medium":
-            str += "; Priority=Medium";
-            break;
-          case "high":
-            str += "; Priority=High";
-            break;
-          default:
-            throw new TypeError("option priority is invalid");
+      UAParser.ENGINE = UAParser.OS = enumerize([NAME, VERSION]);
+      if (typeof exports !== UNDEF_TYPE) {
+        if (typeof module !== UNDEF_TYPE && module.exports) {
+          exports = module.exports = UAParser;
         }
-      }
-      if (opt.sameSite) {
-        var sameSite = typeof opt.sameSite === "string" ? opt.sameSite.toLowerCase() : opt.sameSite;
-        switch (sameSite) {
-          case true:
-            str += "; SameSite=Strict";
-            break;
-          case "lax":
-            str += "; SameSite=Lax";
-            break;
-          case "strict":
-            str += "; SameSite=Strict";
-            break;
-          case "none":
-            str += "; SameSite=None";
-            break;
-          default:
-            throw new TypeError("option sameSite is invalid");
+        exports.UAParser = UAParser;
+      } else {
+        if (typeof define === FUNC_TYPE && define.amd) {
+          define(function() {
+            return UAParser;
+          });
+        } else if (typeof window2 !== UNDEF_TYPE) {
+          window2.UAParser = UAParser;
         }
       }
-      return str;
-    }
-    function decode(str) {
-      return str.indexOf("%") !== -1 ? decodeURIComponent(str) : str;
-    }
-    function isDate(val) {
-      return __toString.call(val) === "[object Date]";
-    }
-    function tryDecode(str, decode2) {
-      try {
-        return decode2(str);
-      } catch (e) {
-        return str;
+      var $ = typeof window2 !== UNDEF_TYPE && (window2.jQuery || window2.Zepto);
+      if ($ && !$.ua) {
+        var parser2 = new UAParser();
+        $.ua = parser2.getResult();
+        $.ua.get = function() {
+          return parser2.getUA();
+        };
+        $.ua.set = function(ua) {
+          parser2.setUA(ua);
+          var result = parser2.getResult();
+          for (var prop in result) {
+            $.ua[prop] = result[prop];
+          }
+        };
       }
-    }
+    })(typeof window === "object" ? window : exports);
   }
 });
 
@@ -1497,7 +1497,7 @@ var require_ms = __commonJS({
       options = options || {};
       var type = typeof val;
       if (type === "string" && val.length > 0) {
-        return parse2(val);
+        return parse3(val);
       } else if (type === "number" && isFinite(val)) {
         return options.long ? fmtLong(val) : fmtShort(val);
       }
@@ -1505,7 +1505,7 @@ var require_ms = __commonJS({
         "val is not a non-empty string or a valid number. val=" + JSON.stringify(val)
       );
     };
-    function parse2(str) {
+    function parse3(str) {
       str = String(str);
       if (str.length > 100) {
         return;
@@ -4356,6 +4356,9 @@ var require_dist = __commonJS({
   }
 });
 
+// src/handle-request.ts
+var import_cookie2 = __toESM(require_cookie(), 1);
+
 // ../packlytics/dist/utils/get-packlytics-id.js
 function sha256(ascii) {
   function rightRotate(value, amount) {
@@ -4667,64 +4670,23 @@ async function packlytics(pack, request, next) {
   return next();
 }
 
-// src/handle-request.ts
-async function handleRequest(pack, request, handleRequest2) {
-  const packHandleResponse = await pack.handleRequest(request);
-  let response;
-  response = await packlytics(pack, request, () => {
-    return handleRequest2(request);
-  });
-  packHandleResponse(response);
-  response.headers.append("powered-by", "Shopify, Hydrogen + Pack Digital");
-  response.headers.append("Set-Cookie", await pack.session.commit());
-  if (pack.testSession && pack.testSession.hasChanges()) {
-    response.headers.append("Set-Cookie", await pack.testSession.commit());
-  }
-  return response;
-}
-
-// src/session/usePackCookies.ts
-var import_cookie = __toESM(require_cookie(), 1);
-import { useEffect } from "react";
-
 // src/constants.ts
 var PACK_COOKIE_ID = "__pack";
 var PACK_USER_CONSENT_COOKIE_ID = "__pack_user_consent";
 var PACK_TEST_COOKIE_ID = "__pack_test";
 var PACK_COOKIE_MAX_AGE = 60 * 60 * 24 * 360;
-
-// src/session/usePackCookies.ts
-function usePackCookies(options) {
-  const { hasUserConsent: hasUserConsent2 = true, domain = "" } = options || {};
-  useEffect(() => {
-    setCookie(
-      PACK_USER_CONSENT_COOKIE_ID,
-      hasUserConsent2 ? "true" : "false",
-      PACK_COOKIE_MAX_AGE,
-      domain
-    );
-  }, [hasUserConsent2]);
-}
-function setCookie(name, value, maxage, domain) {
-  document.cookie = (0, import_cookie.serialize)(name, value, {
-    maxAge: maxage,
-    domain,
-    sameSite: "lax",
-    path: "/"
-  });
-}
-
-// src/session/session.ts
-import {
-  createCookie,
-  createCookieSessionStorage
-} from "react-router";
+var PACK_SESSION_COOKIE_ID = "__pack_s";
+var PACK_SESSION_MAX_AGE = 30 * 60;
 
 // src/session/cookies-utils.tsx
-var import_cookie2 = __toESM(require_cookie(), 1);
+var import_cookie = __toESM(require_cookie(), 1);
 var tokenHash = "xxxx-4xxx-xxxx-xxxxxxxxxxxx";
+function isSafari(userAgent) {
+  if (!userAgent) return false;
+  return /Safari\//.test(userAgent) && !/Chrome\//.test(userAgent) && !/Chromium\//.test(userAgent) && !/Edg\//.test(userAgent) && !/Firefox\//.test(userAgent);
+}
 function hasUserConsent(request) {
-  const cookies = import_cookie2.default.parse(request.headers.get("Cookie"));
+  const cookies = import_cookie.default.parse(request.headers.get("Cookie") || "");
   return cookies[PACK_USER_CONSENT_COOKIE_ID] ? cookies[PACK_USER_CONSENT_COOKIE_ID] === "true" : true;
 }
 function buildRandomUUID() {
@@ -4762,11 +4724,72 @@ function hexTime() {
   return output?.substring(0, 8).padStart(8, "0");
 }
 
-// src/session/session.ts
-function isSafari(userAgent) {
-  if (!userAgent) return false;
-  return /Safari\//.test(userAgent) && !/Chrome\//.test(userAgent) && !/Chromium\//.test(userAgent) && !/Edg\//.test(userAgent) && !/Firefox\//.test(userAgent);
+// src/audiences/visitor-recency.ts
+var PRIOR_VISIT_COOKIES = [
+  PACK_COOKIE_ID,
+  PACK_TEST_COOKIE_ID,
+  "_ga",
+  "_shopify_y"
+];
+function sessionVerdict(incoming) {
+  const stored = incoming[PACK_SESSION_COOKIE_ID];
+  if (stored === "r" || stored === "n") return stored;
+  return PRIOR_VISIT_COOKIES.some((name) => incoming[name]) ? "r" : "n";
+}
+function sessionMarkerSetCookie(verdict, omitSecure) {
+  return `${PACK_SESSION_COOKIE_ID}=${verdict}; Path=/; Max-Age=${PACK_SESSION_MAX_AGE}; SameSite=None${omitSecure ? "" : "; Secure"}`;
+}
+
+// src/handle-request.ts
+async function handleRequest(pack, request, handleRequest2) {
+  const packHandleResponse = await pack.handleRequest(request);
+  let response;
+  response = await packlytics(pack, request, () => {
+    return handleRequest2(request);
+  });
+  packHandleResponse(response);
+  response.headers.append("powered-by", "Shopify, Hydrogen + Pack Digital");
+  response.headers.append("Set-Cookie", await pack.session.commit());
+  const incoming = import_cookie2.default.parse(request.headers.get("Cookie") || "");
+  const omitSecure = isSafari(request.headers.get("User-Agent")) && process.env.NODE_ENV === "development";
+  response.headers.append(
+    "Set-Cookie",
+    sessionMarkerSetCookie(sessionVerdict(incoming), omitSecure)
+  );
+  if (pack.testSession && pack.testSession.hasChanges()) {
+    response.headers.append("Set-Cookie", await pack.testSession.commit());
+  }
+  return response;
+}
+
+// src/session/usePackCookies.ts
+var import_cookie3 = __toESM(require_cookie(), 1);
+import { useEffect } from "react";
+function usePackCookies(options) {
+  const { hasUserConsent: hasUserConsent2 = true, domain = "" } = options || {};
+  useEffect(() => {
+    setCookie(
+      PACK_USER_CONSENT_COOKIE_ID,
+      hasUserConsent2 ? "true" : "false",
+      PACK_COOKIE_MAX_AGE,
+      domain
+    );
+  }, [hasUserConsent2]);
+}
+function setCookie(name, value, maxage, domain) {
+  document.cookie = (0, import_cookie3.serialize)(name, value, {
+    maxAge: maxage,
+    domain,
+    sameSite: "lax",
+    path: "/"
+  });
 }
+
+// src/session/session.ts
+import {
+  createCookie,
+  createCookieSessionStorage
+} from "react-router";
 var PackSession = class {
   id;
   secret;
@@ -4823,10 +4846,6 @@ import {
 } from "react-router";
 var import_debug = __toESM(require_browser(), 1);
 var debug = (0, import_debug.default)("pack:ab-testing:test-session");
-function isSafari2(userAgent) {
-  if (!userAgent) return false;
-  return /Safari\//.test(userAgent) && !/Chrome\//.test(userAgent) && !/Chromium\//.test(userAgent) && !/Edg\//.test(userAgent) && !/Firefox\//.test(userAgent);
-}
 var PackTestSession = class {
   id;
   #session;
@@ -4852,7 +4871,7 @@ var PackTestSession = class {
     });
     const storage = createCookieSessionStorage2({
       cookie: createCookie2(PACK_TEST_COOKIE_ID, {
-        secure: isSafari2(userAgent) && process.env.NODE_ENV === "development" ? false : true,
+        secure: isSafari(userAgent) && process.env.NODE_ENV === "development" ? false : true,
         secrets,
         sameSite: "lax",
         maxAge: PACK_COOKIE_MAX_AGE,
@@ -5017,12 +5036,12 @@ var PackTestSession = class {
 };
 
 // src/create-pack-client.ts
-var cookie3 = __toESM(require_cookie(), 1);
+var cookie5 = __toESM(require_cookie(), 1);
 import { PackClient } from "@pack/client";
 import { CacheCustom, createWithCache } from "@shopify/hydrogen";
 
 // src/tests/test.ts
-var cookie2 = __toESM(require_cookie(), 1);
+var cookie4 = __toESM(require_cookie(), 1);
 
 // src/tests/local-test-resolver.ts
 var import_json_rules_engine = __toESM(require_dist(), 1);
@@ -5045,6 +5064,379 @@ function getImpressionSectionIdsForVariant(test, testVariant) {
   return [...new Set(fallbackSectionIds)];
 }
 
+// src/audiences/identity-bundle.ts
+var cookie3 = __toESM(require_cookie(), 1);
+function detectDeviceType(userAgent) {
+  const ua = userAgent.toLowerCase();
+  if (/ipad|tablet|(android(?!.*mobile))/.test(ua)) return "tablet";
+  if (/mobi|iphone|android|ipod|phone/.test(ua)) return "mobile";
+  return "desktop";
+}
+function extractGa4ClientId(cookies) {
+  const ga = cookies["_ga"];
+  if (!ga) return void 0;
+  const parts = ga.split(".");
+  return parts.length >= 4 ? parts.slice(-2).join(".") : void 0;
+}
+function firstHeader(request, ...names) {
+  for (const name of names) {
+    const value = request.headers.get(name);
+    if (value) return value;
+  }
+  return void 0;
+}
+function buildIdentityBundle(request, options = {}) {
+  const parsedCookies = cookie3.parse(request.headers.get("cookie") || "");
+  const cookies = {};
+  for (const [name, value] of Object.entries(parsedCookies)) {
+    if (typeof value === "string") cookies[name] = value;
+  }
+  const userAgent = request.headers.get("user-agent") || void 0;
+  const consentCookie = cookies[PACK_USER_CONSENT_COOKIE_ID];
+  const hasConsent = consentCookie ? consentCookie === "true" : true;
+  const requestUrl = new URL(request.url);
+  const query = {};
+  requestUrl.searchParams.forEach((value, key) => {
+    query[key] = value;
+  });
+  return {
+    shopifyCustomerId: options.shopifyCustomerId,
+    // Only GA4 is populated today; other provider ids are filled in by the
+    // condition tasks that own them (see the type declaration).
+    ga4ClientId: extractGa4ClientId(cookies),
+    cookies,
+    hasConsent,
+    userAgent,
+    deviceType: userAgent ? detectDeviceType(userAgent) : "desktop",
+    // Host-provided geo-IP, first header present wins. Every name here is one
+    // the host defines, and they must carry the same FORMAT across hosts:
+    // country as ISO 3166-1 alpha-2, region as an ISO 3166-2 subdivision code.
+    //
+    // Defined is not the same as delivered. Only `oxygen-buyer-*` and
+    // `cf-ipcountry` arrive unconditionally; `cf-region-code` needs
+    // Cloudflare's "Add visitor location headers" managed transform, which is
+    // off by default, so a Workers deployment behind plain Cloudflare has no
+    // region and its region audiences match nobody. That is fine while
+    // storefronts are on Oxygen (which sets it from request.cf) — revisit if a
+    // storefront ever fronts an origin with Cloudflare directly.
+    // Oxygen also exposes `oxygen-buyer-region`, but that is the full name
+    // ("California") — mixing it in would make an audience configured as "CA"
+    // match on Cloudflare/Vercel and never on Oxygen, since matchGeo compares
+    // the whole string.
+    geo: {
+      country: firstHeader(
+        request,
+        "oxygen-buyer-country",
+        "cf-ipcountry",
+        "x-vercel-ip-country"
+      ),
+      region: firstHeader(
+        request,
+        "oxygen-buyer-region-code",
+        "cf-region-code",
+        "x-vercel-ip-country-region"
+      )
+    },
+    url: {
+      path: requestUrl.pathname,
+      query,
+      // Public host — prefer the forwarded host over the received one so
+      // self-referral detection works behind a proxy / preview domain, where
+      // request.url carries the internal host (e.g. *.vercel.app) while the
+      // browser typed the storefront domain. x-forwarded-host may be a comma
+      // list and may carry a port.
+      host: (firstHeader(request, "x-forwarded-host", "host") ?? requestUrl.hostname).split(",")[0].trim().split(":")[0].toLowerCase()
+    },
+    referrer: request.headers.get("referer") || void 0
+  };
+}
+
+// src/audiences/safe-regex.ts
+var MAX_REGEX_PATTERN_LENGTH = 200;
+var MAX_REGEX_INPUT_LENGTH = 4096;
+function safeRegexMatch(pattern, input) {
+  if (!pattern || input === void 0) return false;
+  if (pattern.length > MAX_REGEX_PATTERN_LENGTH || input.length > MAX_REGEX_INPUT_LENGTH) {
+    return false;
+  }
+  try {
+    return new RegExp(pattern).test(input);
+  } catch {
+    return false;
+  }
+}
+
+// src/audiences/conditions/cookie.ts
+function evaluateCookie(config, identity) {
+  const name = config?.name;
+  const op = config?.op;
+  if (!name || !op) return false;
+  if (config?.requireConsent && !identity.hasConsent) return false;
+  const value = identity.cookies?.[name];
+  const target = config?.value ?? "";
+  switch (op) {
+    case "exists":
+      return value !== void 0 && value !== "";
+    case "equals":
+      return value === target;
+    case "contains":
+      return value !== void 0 && value.includes(target);
+    case "starts_with":
+      return value !== void 0 && value.startsWith(target);
+    case "ends_with":
+      return value !== void 0 && value.endsWith(target);
+    case "matches_regex":
+      return safeRegexMatch(target, value);
+    default:
+      return false;
+  }
+}
+
+// src/audiences/conditions/builtin.ts
+var PAID_MEDIUM = /^(.*cp.*|ppc|retargeting|paid.*)$/;
+var DISPLAY_MEDIUM = ["display", "banner", "expandable", "interstitial", "cpm"];
+var SOCIAL_MEDIUM = ["social", "social-network", "social-media", "sm", "social network", "social media"];
+var ORGANIC_VIDEO_MEDIUM = /^.*video.*$/;
+var EMAIL_MEDIUM = /^(email|e-mail|e_mail|e mail)$/;
+var REFERRAL_MEDIUM = ["referral", "app", "link"];
+var SEARCH_SOURCES = [
+  "google",
+  "bing",
+  "yahoo",
+  "duckduckgo",
+  "baidu",
+  "yandex",
+  "ecosia",
+  "ask.",
+  "aol.",
+  "naver",
+  "daum",
+  "brave",
+  "startpage",
+  "qwant",
+  "sogou",
+  "seznam"
+];
+var SOCIAL_SOURCES = [
+  "facebook",
+  "fb.",
+  "instagram",
+  "tiktok",
+  "pinterest",
+  "pin.it",
+  "linkedin",
+  "lnkd.in",
+  "reddit",
+  "snapchat",
+  "twitter",
+  "x.com",
+  "t.co",
+  "tumblr",
+  "threads",
+  "whatsapp",
+  "wechat",
+  "weibo",
+  "vk.",
+  "quora"
+];
+function hostFromReferrer(referrer) {
+  if (!referrer) return "";
+  try {
+    return new URL(referrer).hostname.toLowerCase();
+  } catch {
+    return "";
+  }
+}
+var parseList = (value) => (value ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+function matchGeo(code, op, value) {
+  if (!code) return false;
+  const c = code.toUpperCase();
+  const list = parseList(value).map((s) => s.toUpperCase());
+  switch (op) {
+    case "equals":
+      return c === (value ?? "").trim().toUpperCase();
+    case "in_list":
+      return list.includes(c);
+    case "not_in_list":
+      return list.length > 0 && !list.includes(c);
+    default:
+      return false;
+  }
+}
+function classifyReferrerSource(query, referrer, currentHost) {
+  const medium = (query?.["utm_medium"] ?? "").toLowerCase();
+  const source = (query?.["utm_source"] ?? "").toLowerCase();
+  const stripWww = (h) => h.replace(/^www\./, "");
+  let host = hostFromReferrer(referrer);
+  if (host && currentHost) {
+    const a = stripWww(host);
+    const b = stripWww(currentHost.toLowerCase());
+    if (a === b || a.endsWith("." + b) || b.endsWith("." + a)) host = "";
+  }
+  const bareHost = stripWww(host);
+  const bareKey = (k) => k.endsWith(".") ? k.slice(0, -1) : k;
+  const hostInList = (list) => !!bareHost && list.some((k) => {
+    const key = bareKey(k);
+    return key.includes(".") ? bareHost === key || bareHost.endsWith("." + key) : bareHost.split(".").includes(key);
+  });
+  const sourceInList = (list) => {
+    if (!source) return false;
+    const tokens = source.split(/[.\-_ ]/);
+    return list.some((k) => {
+      const key = bareKey(k);
+      return key.includes(".") ? source === key || source.endsWith("." + key) : tokens.includes(key);
+    });
+  };
+  const inCategory = (list) => sourceInList(list) || hostInList(list);
+  if (PAID_MEDIUM.test(medium) || DISPLAY_MEDIUM.includes(medium)) return "paid";
+  if (SOCIAL_MEDIUM.includes(medium) || inCategory(SOCIAL_SOURCES)) return "social";
+  if (medium === "organic" || ORGANIC_VIDEO_MEDIUM.test(medium) || inCategory(SEARCH_SOURCES)) return "organic";
+  if (EMAIL_MEDIUM.test(medium) || EMAIL_MEDIUM.test(source)) return "email";
+  if (medium === "affiliate" || REFERRAL_MEDIUM.includes(medium) || host || medium || source)
+    return "referral";
+  return "direct";
+}
+var BUILTINS = {
+  // Logged in vs. guest — Shopify customer session presence.
+  auth_status: (config, identity) => {
+    const loggedIn = !!identity.shopifyCustomerId;
+    if (config?.value === "logged_in") return loggedIn;
+    if (config?.value === "anonymous") return !loggedIn;
+    return false;
+  },
+  // Device type from the User-Agent; unknown falls back to desktop.
+  device: (config, identity) => (identity.deviceType ?? "desktop") === config?.value,
+  // New vs. returning. The persistent prior-visit cookies say the visitor has
+  // been here at some point, not whether THIS session is their first. The
+  // rolling __pack_s marker carries that verdict ("r"/"n"), decided once at
+  // session start in handle-request (see sessionVerdict in ../visitor-recency).
+  // Mirror that writer's tri-state: "r"/"n" are authoritative; anything else (a
+  // new session with no marker, or a tampered value) falls back to prior visits.
+  // Missing signal → new.
+  //
+  // Consent note: this is the only built-in that reads cookies, and it does NOT
+  // enforce a consent gate. _ga / _shopify_y only exist when analytics consent
+  // was given, but Pack's own __pack / __pack_s are written on every response
+  // regardless of consent (see handle-request), so a visitor who declined can
+  // still be classified from them. Whether that is acceptable is a system-wide
+  // consent-posture decision for the resolver/identity layer — flagged, not
+  // enforced.
+  visitor_recency: (config, identity) => {
+    const cookies = identity.cookies ?? {};
+    const priorVisit = PRIOR_VISIT_COOKIES.some((name) => !!cookies[name]);
+    const session = cookies[PACK_SESSION_COOKIE_ID];
+    const returning = session === "r" ? true : session === "n" ? false : priorVisit;
+    if (config?.value === "returning") return returning;
+    if (config?.value === "new") return !returning;
+    return false;
+  },
+  // Country / region from the CDN geo signal; missing → no match.
+  geo_country: (config, identity) => matchGeo(identity.geo?.country, config?.op, config?.value),
+  geo_region: (config, identity) => matchGeo(identity.geo?.region, config?.op, config?.value),
+  // Traffic source from utm_medium, then Referer host; else direct.
+  referrer_source: (config, identity) => classifyReferrerSource(
+    identity.url?.query,
+    identity.referrer,
+    identity.url?.host
+  ) === config?.value,
+  // A specific UTM parameter on the current URL.
+  utm_param: (config, identity) => {
+    if (!config?.param) return false;
+    const name = config.param.replace(/^utm_/, "");
+    const v = identity.url?.query?.[`utm_${name}`]?.toLowerCase();
+    switch (config?.op) {
+      case "exists":
+        return v !== void 0 && v !== "";
+      case "equals":
+        return v !== void 0 && v === config?.value?.toLowerCase();
+      case "in_list":
+        return v !== void 0 && parseList(config?.value).map((s) => s.toLowerCase()).includes(v);
+      default:
+        return false;
+    }
+  }
+};
+function evaluateBuiltin(config, identity) {
+  const evaluator = config?.key ? BUILTINS[config.key] : void 0;
+  return evaluator ? evaluator(config ?? {}, identity) : false;
+}
+
+// src/audiences/condition-registry.ts
+var evaluators = /* @__PURE__ */ new Map();
+function registerConditionEvaluator(type, evaluate) {
+  if (evaluators.has(type)) {
+    throw new Error(`Condition evaluator "${type}" is already registered.`);
+  }
+  evaluators.set(type, evaluate);
+}
+function getConditionEvaluator(type) {
+  return evaluators.get(type);
+}
+function isConditionRegistered(type) {
+  return evaluators.has(type);
+}
+registerConditionEvaluator("cookie", evaluateCookie);
+registerConditionEvaluator("builtin", evaluateBuiltin);
+
+// src/audiences/audience-resolver.ts
+function isEmptyRules(rules) {
+  return rules == null || typeof rules === "object" && !Array.isArray(rules) && Object.keys(rules).length === 0;
+}
+function isGroupNode(node) {
+  return !!node && typeof node === "object" && typeof node.op === "string";
+}
+async function resolveRulesTree(rules, identity) {
+  const matchedConditions = [];
+  if (isEmptyRules(rules)) {
+    return { matches: true, matchedConditions };
+  }
+  const matches = await evaluateNode(rules, identity, matchedConditions);
+  return { matches, matchedConditions: matches ? matchedConditions : [] };
+}
+async function evaluateNode(node, identity, matched) {
+  if (isGroupNode(node)) {
+    const { op, children } = node;
+    if (op === "AND") {
+      for (const child of children) {
+        if (!await evaluateNode(child, identity, matched)) return false;
+      }
+      return true;
+    }
+    if (op === "OR") {
+      for (const child of children) {
+        if (await evaluateNode(child, identity, matched)) return true;
+      }
+      return false;
+    }
+    if (!children?.length) return false;
+    for (const child of children) {
+      if (await evaluateNode(child, identity, matched)) return false;
+    }
+    return true;
+  }
+  return evaluateLeaf(node, identity, matched);
+}
+async function evaluateLeaf(leaf, identity, matched) {
+  const evaluate = getConditionEvaluator(leaf.type);
+  if (!evaluate) return false;
+  let result;
+  try {
+    result = await evaluate(leaf.config ?? {}, identity);
+  } catch {
+    result = false;
+  }
+  if (leaf.negate) result = !result;
+  if (result) {
+    matched.push({
+      type: leaf.type,
+      provider: leaf.provider ?? null,
+      config: leaf.config ?? null,
+      negate: leaf.negate ?? null
+    });
+  }
+  return result;
+}
+
 // src/tests/local-test-resolver.ts
 var debug2 = (0, import_debug2.default)("pack:ab-testing:local-resolver");
 var LocalTestResolver = class {
@@ -5084,7 +5476,7 @@ var LocalTestResolver = class {
   /**
    * Evaluate test rules and assign a variant
    */
-  async assignTest(attributes, _sessionId) {
+  async assignTest(attributes, _sessionId, identity) {
     debug2(
       "[Pack Test LocalResolver] Starting test assignment:",
       JSON.stringify({
@@ -5096,7 +5488,11 @@ var LocalTestResolver = class {
       debug2("[Pack Test LocalResolver] No test rules available");
       return null;
     }
-    const eligibleTests = await this.evaluateRules(this.testRules, attributes);
+    const eligibleTests = await this.evaluateRules(
+      this.testRules,
+      attributes,
+      identity
+    );
     debug2(
       "[Pack Test LocalResolver] Rule evaluation result:",
       JSON.stringify({
@@ -5177,7 +5573,7 @@ var LocalTestResolver = class {
   /**
    * Evaluate rules using json-rules-engine (same as tests-service)
    */
-  async evaluateRules(tests, attributes) {
+  async evaluateRules(tests, attributes, identity) {
     debug2(
       "[Pack Test LocalResolver] Starting rule evaluation:",
       JSON.stringify({
@@ -5298,7 +5694,7 @@ var LocalTestResolver = class {
       return hasTargetedEvent;
     });
     debug2(
-      "[Pack Test LocalResolver] Final eligible tests:",
+      "[Pack Test LocalResolver] Inline-eligible tests:",
       JSON.stringify({
         eligibleCount: eligibleTests.length,
         eligibleTests: eligibleTests.map((t) => ({
@@ -5307,7 +5703,47 @@ var LocalTestResolver = class {
         }))
       })
     );
-    return eligibleTests;
+    return this.applyAudienceGating(eligibleTests, identity);
+  }
+  /**
+   * Audience gating (XOR with inline rules): a test attached to an audience is
+   * only eligible when the visitor matches the pinned audience snapshot. Tests
+   * without an audience pass through unchanged. Fails closed (excludes the test)
+   * when the audience can't be evaluated — no identity, or an evaluator error —
+   * so audience-targeted tests never leak to unintended traffic.
+   */
+  async applyAudienceGating(eligibleTests, identity) {
+    const hasAudience = eligibleTests.some(
+      (test) => test.experimentAudience?.pinnedRules
+    );
+    if (!hasAudience) return eligibleTests;
+    const gated = await Promise.all(
+      eligibleTests.map(async (test) => {
+        const pinnedRules = test.experimentAudience?.pinnedRules;
+        if (!pinnedRules) return test;
+        if (!identity) {
+          debug2(
+            `[Pack Test LocalResolver] Test ${test.handle} has an audience but no identity \u2014 excluding`
+          );
+          return null;
+        }
+        try {
+          const { matches } = await resolveRulesTree(pinnedRules, identity);
+          debug2(
+            `[Pack Test LocalResolver] Test ${test.handle} audience match:`,
+            JSON.stringify({ matches })
+          );
+          return matches ? test : null;
+        } catch (err) {
+          debug2(
+            `[Pack Test LocalResolver] Test ${test.handle} audience eval error \u2014 excluding:`,
+            String(err)
+          );
+          return null;
+        }
+      })
+    );
+    return gated.filter((test) => test !== null);
   }
   /**
    * Resolve test and variant IDs from their handles
@@ -5350,6 +5786,10 @@ var QUERY_TESTS_BY_RULES = `#graphql
             value
           }
           impressionTrigger
+          experimentAudience {
+            pinnedVersion
+            pinnedRules
+          }
           testVariants {
             id
             handle
@@ -5688,9 +6128,11 @@ async function packClientFetchTestByRules(packClient, testTargetAudienceAttribut
     }
     const sessionId = packClient.storeId;
     debug3("[Pack Test] Assigning test with session ID:", sessionId);
+    const identity = buildIdentityBundle(request);
     const assignedTest = await localTestResolver.assignTest(
       testTargetAudienceAttributes || {},
-      sessionId
+      sessionId,
+      identity
     );
     debug3(
       "[Pack Test] Test assignment result:",
@@ -5781,7 +6223,7 @@ async function getTestInfo({
       isExpired: testSessionExpireAt ? new Date(testSessionExpireAt) < /* @__PURE__ */ new Date() : false
     })
   );
-  const exposedTestCookieString = cookie2.parse(
+  const exposedTestCookieString = cookie4.parse(
     request.headers.get("cookie") || ""
   )?.exposedTest;
   debug3(
@@ -6232,7 +6674,7 @@ function createPackClient(options) {
       if (hasExposedTestCookie) {
         response.headers.append(
           "Set-Cookie",
-          cookie3.serialize("exposedTest", "", {
+          cookie5.serialize("exposedTest", "", {
             maxAge: 0,
             expires: /* @__PURE__ */ new Date(0),
             path: "/"
@@ -6994,10 +7436,15 @@ export {
   PackTestProvider,
   PackTestRoute,
   PackTestSession,
+  buildIdentityBundle,
   createPackClient,
+  getConditionEvaluator,
   handleRequest,
+  isConditionRegistered,
   action as previewModeAction,
   loader as previewModeLoader,
+  registerConditionEvaluator,
+  resolveRulesTree,
   useAbTest,
   useAbTestHandle,
   useAbTestId,