@scaletrail/connector 0.0.0-stage → 0.1.0

package/src/client.js

@@ -0,0 +1,143 @@
+// HTTP client for the Connector API. One request per call; the shop keeps its own queue and decides
+// when to retry (see retryDelaySeconds). The target host is fixed: credentials never go anywhere else.
+
+import { signRequest, toBytes } from './signature.js';
+
+export const API_BASE = 'https://api.scaletrail.io/connect/v1';
+export const MAX_BODY_BYTES = 256 * 1024;
+export const DEFAULT_TIMEOUT_MS = 15_000;
+
+/** Retry schedule from the API description: 1 min, 5 min, 30 min, then hourly for up to 72 h. */
+export const RETRY_SCHEDULE_SECONDS = Object.freeze([60, 300, 1800, 3600]);
+export const RETRY_GIVE_UP_AFTER_SECONDS = 72 * 3600;
+
+const ROUTES = Object.freeze({ orders: 'orders', events: 'events', redact: 'customers/redact' });
+const REQUEST_ID_RE = /^[A-Za-z0-9_.:-]{1,100}$/;
+const PATH_RE = /^[A-Za-z0-9_.$[\]-]{1,200}$/;
+const MAX_RESPONSE_CHARS = 64 * 1024;
+const MAX_PATHS = 50;
+const MAX_RETRY_AFTER_SECONDS = 24 * 3600;
+
+/**
+ * @typedef {'accepted'|'valid'|'rejected'|'retry'} Outcome
+ * @typedef {{
+ *   outcome: Outcome,
+ *   status: number|null,
+ *   requestId?: string,
+ *   paths?: string[],
+ *   retryAfterSeconds?: number|null,
+ *   reason?: string,
+ * }} SendResult
+ */
+
+function parseRetryAfter(value) {
+  if (typeof value !== 'string' || !/^\d{1,6}$/.test(value)) return null;
+  return Math.min(Number(value), MAX_RETRY_AFTER_SECONDS);
+}
+
+async function readJson(res) {
+  try {
+    const text = await res.text();
+    if (text.length > MAX_RESPONSE_CHARS) return null;
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+}
+
+function cleanPaths(paths) {
+  if (!Array.isArray(paths)) return [];
+  return paths.filter((p) => typeof p === 'string' && PATH_RE.test(p)).slice(0, MAX_PATHS);
+}
+
+/**
+ * Maps an HTTP response to what the shop should do. Exported for tests and custom transports.
+ * @param {Response} res
+ * @param {{dryRun?: boolean}} [opts]
+ * @returns {Promise<SendResult>}
+ */
+export async function classifyResponse(res, { dryRun = false } = {}) {
+  const status = res.status;
+  if (status === 202 && !dryRun) {
+    const json = await readJson(res);
+    const requestId = json && typeof json.request_id === 'string' && REQUEST_ID_RE.test(json.request_id)
+      ? json.request_id : null;
+    // Accepted only with confirmation in the body; anything else is sent again (safe, idempotent).
+    return requestId
+      ? { outcome: 'accepted', status, requestId }
+      : { outcome: 'retry', status, retryAfterSeconds: null, reason: 'unconfirmed' };
+  }
+  if (status === 200 && dryRun) {
+    const json = await readJson(res);
+    return json && json.valid === true
+      ? { outcome: 'valid', status }
+      : { outcome: 'retry', status, retryAfterSeconds: null, reason: 'unconfirmed' };
+  }
+  if (status === 400) {
+    const json = await readJson(res);
+    return { outcome: 'rejected', status, paths: cleanPaths(json?.paths), reason: 'invalid_payload' };
+  }
+  if (status === 401) return { outcome: 'rejected', status, reason: 'unauthorized' };
+  if (status === 404) return { outcome: 'rejected', status, reason: 'not_found' };
+  if (status === 413) return { outcome: 'rejected', status, reason: 'too_large' };
+  if (status === 429 || status === 503) {
+    return { outcome: 'retry', status, retryAfterSeconds: parseRetryAfter(res.headers.get('Retry-After')) };
+  }
+  if (status >= 300 && status < 400) return { outcome: 'rejected', status, reason: 'redirect' };
+  if (status >= 500) return { outcome: 'retry', status, retryAfterSeconds: null };
+  return { outcome: 'rejected', status, reason: 'unexpected_status' };
+}
+
+/**
+ * Seconds to wait before the next attempt, or null when the shop should stop and raise an alarm.
+ * @param {number} attempt  number of attempts made so far (1 after the first failure)
+ * @param {{retryAfterSeconds?: number|null, firstAttemptAt?: number, nowMs?: number}} [opts]
+ * @returns {number|null}
+ */
+export function retryDelaySeconds(attempt, { retryAfterSeconds = null, firstAttemptAt, nowMs = Date.now() } = {}) {
+  if (!Number.isInteger(attempt) || attempt < 1) throw new TypeError('attempt must be an integer >= 1');
+  if (Number.isFinite(firstAttemptAt) && (nowMs - firstAttemptAt) / 1000 >= RETRY_GIVE_UP_AFTER_SECONDS) return null;
+  const scheduled = RETRY_SCHEDULE_SECONDS[Math.min(attempt, RETRY_SCHEDULE_SECONDS.length) - 1];
+  return Number.isInteger(retryAfterSeconds) && retryAfterSeconds > 0 ? retryAfterSeconds : scheduled;
+}
+
+/**
+ * @param {{
+ *   keyId: string,
+ *   secret: string,
+ *   connector?: string,
+ *   fetch?: typeof globalThis.fetch,
+ *   timeoutMs?: number,
+ * }} config
+ */
+export function createClient({ keyId, secret, connector, fetch: fetchImpl = globalThis.fetch, timeoutMs = DEFAULT_TIMEOUT_MS }) {
+  if (typeof fetchImpl !== 'function') throw new TypeError('fetch is not available, pass one in the config');
+
+  async function send(route, message, { dryRun = false } = {}) {
+    const body = JSON.stringify(message);
+    if (toBytes(body).length > MAX_BODY_BYTES) return { outcome: 'rejected', status: null, reason: 'too_large' };
+    const headers = await signRequest({ keyId, secret, body, connector });
+    const url = `${API_BASE}/${ROUTES[route]}${dryRun ? '?dry_run=1' : ''}`;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let res;
+    try {
+      res = await fetchImpl(url, { method: 'POST', headers, body, redirect: 'manual', signal: controller.signal });
+    } catch (err) {
+      const reason = err && err.name === 'AbortError' ? 'timeout' : 'network';
+      return { outcome: 'retry', status: null, retryAfterSeconds: null, reason };
+    } finally {
+      clearTimeout(timer);
+    }
+    return classifyResponse(res, { dryRun });
+  }
+
+  return {
+    /** @param {object} order  snapshot of the order, see OrderMessage */
+    sendOrder: (order, opts) => send('orders', { order }, opts),
+    /** @param {object} event  see EventMessage */
+    sendEvent: (event, opts) => send('events', { event }, opts),
+    /** @param {object} redact  see RedactMessage */
+    sendRedact: (redact, opts) => send('redact', { redact }, opts),
+  };
+}

package/src/cookies.js

@@ -0,0 +1,251 @@
+// Edge cookies for the shop's own server or gateway worker.
+//
+// On every response the shop sets the visitor ID mirror `_sa_uid_shop`. On a landing with click IDs
+// or UTM parameters it also sets one cookie per parameter. All cookies are first-party, set by the
+// shop's own response, Secure, SameSite=Lax, 400 days, on the shop's registrable domain.
+//
+// Cached pages: call edgeCookies() in the stage that runs on every request (before the cache), and
+// apply the cookies to the response the browser gets, never to the stored cache entry. Responses
+// with these cookies are private.
+
+import { normalizeVisitorId, uuidV7 } from './uuid.js';
+
+export const VISITOR_COOKIE = '_sa_uid';
+export const MIRROR_COOKIE = '_sa_uid_shop';
+export const COOKIE_PREFIX = '__sa_';
+export const COOKIE_MAX_AGE_SECONDS = 400 * 24 * 3600;
+
+export const CLICK_ID_PARAMS = Object.freeze(['gclid', 'gbraid', 'wbraid', 'fbclid', 'ttclid', 'msclkid', 'oppref', 'epik', 'srsltid', 'trailiq']);
+export const UTM_PARAMS = Object.freeze(['utm_source', 'utm_medium', 'utm_campaign', 'utm_content', 'utm_term', 'utm_id']);
+
+// Read by the ScaleTrail pixel in the browser, so it cannot be HttpOnly. All others are.
+const SCRIPT_READABLE = new Set([`${COOKIE_PREFIX}oppref`]);
+
+const CLICK_ID_RE = /^[A-Za-z0-9_-]{20,200}$/;
+const TRAILIQ_RE = /^[A-Za-z0-9_|:.~-]{1,256}$/;
+const UTM_MAX = 200;
+const CONTROL_RE = /[\u0000-\u001f\u007f]/;
+const MAX_COOKIE_HEADER = 16 * 1024;
+const MAX_URL = 8 * 1024;
+
+const BROWSER_ID_COOKIES = Object.freeze({ ga: ['_ga', 64], fbp: ['_fbp', 128], fbc: ['_fbc', 512], ttp: ['_ttp', 128] });
+const BROWSER_ID_RE = /^[A-Za-z0-9_.|:~-]+$/;
+
+// Public suffixes with two labels that matter in practice. A host under one of them keeps three labels.
+const MULTI_PART_TLDS = new Set([
+  'co.uk', 'org.uk', 'me.uk', 'net.uk',
+  'com.au', 'net.au', 'org.au',
+  'co.nz', 'net.nz', 'org.nz',
+  'co.jp', 'or.jp', 'ne.jp',
+  'co.za',
+  'co.kr',
+  'com.br', 'net.br', 'org.br',
+  'com.mx', 'com.tr', 'com.sg', 'com.hk',
+]);
+
+const DOMAIN_RE = /^\.?[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?)+$/;
+
+/**
+ * Registrable domain of a host with a leading dot, e.g. "shop.example.ch" -> ".example.ch".
+ * @param {string} host
+ * @returns {string|null}
+ */
+export function deriveCookieDomain(host) {
+  if (!host || typeof host !== 'string') return null;
+  const clean = host.toLowerCase().trim().split(':')[0];
+  if (!clean || !clean.includes('.')) return null;
+  const parts = clean.split('.').filter(Boolean);
+  if (parts.length < 2) return null;
+  const lastTwo = parts.slice(-2).join('.');
+  if (MULTI_PART_TLDS.has(lastTwo) && parts.length >= 3) return `.${parts.slice(-3).join('.')}`;
+  return `.${parts.slice(-2).join('.')}`;
+}
+
+/**
+ * Cookie domain for a host. Without an override this is the registrable domain. An override (for a
+ * staging host, e.g. "staging.example.ch") applies only if it is the host or one of its parents and
+ * not wider than the registrable domain; otherwise the registrable domain is used.
+ * @param {string} host
+ * @param {string} [override]
+ * @returns {string|null}
+ */
+export function cookieDomainFor(host, override) {
+  const derived = deriveCookieDomain(host);
+  if (!derived || typeof override !== 'string' || override.length > 253 || !DOMAIN_RE.test(override)) return derived;
+  const dotted = override.startsWith('.') ? override : `.${override}`;
+  const hostDotted = `.${host.toLowerCase().trim().split(':')[0]}`;
+  if (!hostDotted.endsWith(dotted)) return derived;
+  if (!dotted.endsWith(derived)) return derived;
+  return dotted;
+}
+
+/** Click ID value if valid, else null. Length is checked before the pattern. */
+export function cleanClickId(param, value) {
+  if (typeof value !== 'string') return null;
+  if (param === 'trailiq') return value.length <= 256 && TRAILIQ_RE.test(value) ? value : null;
+  return value.length <= 200 && CLICK_ID_RE.test(value) ? value : null;
+}
+
+/** UTM value if valid (1 to 200 characters, no control characters), else null. */
+export function cleanUtm(value) {
+  if (typeof value !== 'string') return null;
+  const v = value.trim();
+  return v.length > 0 && v.length <= UTM_MAX && !CONTROL_RE.test(v) ? v : null;
+}
+
+/**
+ * Parses a Cookie header. First occurrence of a name wins (the browser sends the most specific first).
+ * @param {string|null|undefined} header
+ * @returns {Map<string, string>}
+ */
+export function parseCookieHeader(header) {
+  const out = new Map();
+  if (typeof header !== 'string' || header.length === 0 || header.length > MAX_COOKIE_HEADER) return out;
+  for (const part of header.split(';')) {
+    const i = part.indexOf('=');
+    if (i <= 0) continue;
+    const name = part.slice(0, i).trim();
+    if (!name || out.has(name)) continue;
+    out.set(name, part.slice(i + 1).trim());
+  }
+  return out;
+}
+
+function decodeUtmCookie(raw) {
+  try {
+    return cleanUtm(decodeURIComponent(raw));
+  } catch {
+    return null;
+  }
+}
+
+function serialize(name, value, domain, maxAge) {
+  const attrs = [`${name}=${value}`];
+  if (domain) attrs.push(`Domain=${domain}`);
+  attrs.push('Path=/', `Max-Age=${maxAge}`, 'Secure', 'SameSite=Lax');
+  if (!SCRIPT_READABLE.has(name)) attrs.push('HttpOnly');
+  return attrs.join('; ');
+}
+
+function readRequest(input) {
+  if (input && typeof input.url === 'string' && input.headers && typeof input.headers.get === 'function') {
+    return { url: input.url, cookie: input.headers.get('Cookie') };
+  }
+  if (input && typeof input.url === 'string') return { url: input.url, cookie: input.cookie ?? null };
+  throw new TypeError('edgeCookies needs a Request or {url, cookie}');
+}
+
+/**
+ * Cookies to set on the response for one request.
+ *
+ * @param {Request|{url: string, cookie?: string|null}} input
+ * @param {{
+ *   cookieDomain?: string,
+ *   mode?: 'always'|'after_consent',
+ *   marketingConsent?: boolean|null,
+ *   nowMs?: number,
+ * }} [opts]
+ *   cookieDomain      override for staging hosts, see cookieDomainFor
+ *   mode              'always' (default): click ID and UTM cookies on every landing.
+ *                     'after_consent': only with marketingConsent === true.
+ * @returns {{setCookie: string[], visitorId: string, newVisitor: boolean, landing: boolean}}
+ */
+export function edgeCookies(input, { cookieDomain, mode = 'always', marketingConsent = null, nowMs } = {}) {
+  if (mode !== 'always' && mode !== 'after_consent') throw new TypeError("mode must be 'always' or 'after_consent'");
+  const { url, cookie } = readRequest(input);
+  const parsed = new URL(url);
+  const domain = cookieDomainFor(parsed.hostname, cookieDomain);
+  // An oversized address never breaks the page; it just does not count as a landing.
+  const params = url.length <= MAX_URL ? parsed.searchParams : new URLSearchParams();
+  const jar = parseCookieHeader(cookie);
+  const setCookie = [];
+
+  const existing = normalizeVisitorId(jar.get(VISITOR_COOKIE)) || normalizeVisitorId(jar.get(MIRROR_COOKIE));
+  const visitorId = existing || uuidV7(nowMs);
+  setCookie.push(serialize(MIRROR_COOKIE, visitorId, domain, COOKIE_MAX_AGE_SECONDS));
+
+  const clickIds = {};
+  for (const p of CLICK_ID_PARAMS) {
+    const v = cleanClickId(p, params.get(p));
+    if (v) clickIds[p] = v;
+  }
+  // Some ad setups pass the Google click ID as ggclid.
+  if (!clickIds.gclid) {
+    const g = cleanClickId('gclid', params.get('ggclid'));
+    if (g) clickIds.gclid = g;
+  }
+  const utm = {};
+  for (const p of UTM_PARAMS) {
+    const v = cleanUtm(params.get(p));
+    if (v) utm[p] = v;
+  }
+  const hasUtm = Object.keys(utm).length > 0;
+  const landing = Object.keys(clickIds).length > 0 || hasUtm;
+  const allowed = mode === 'always' || marketingConsent === true;
+
+  if (landing && allowed) {
+    for (const [p, v] of Object.entries(clickIds)) setCookie.push(serialize(`${COOKIE_PREFIX}${p}`, v, domain, COOKIE_MAX_AGE_SECONDS));
+    // UTM parameters belong together: a new campaign replaces all of them, absent ones are removed.
+    if (hasUtm) {
+      for (const p of UTM_PARAMS) {
+        const name = `${COOKIE_PREFIX}${p}`;
+        if (utm[p]) setCookie.push(serialize(name, encodeURIComponent(utm[p]), domain, COOKIE_MAX_AGE_SECONDS));
+        else if (jar.has(name)) setCookie.push(serialize(name, '', domain, 0));
+      }
+    }
+  }
+  return { setCookie, visitorId, newVisitor: !existing, landing };
+}
+
+/**
+ * Copy of a response with the cookies appended and Cache-Control set to private, so no shared cache
+ * stores it. Use on the response that goes to the browser, after any cache lookup.
+ * @param {Response} response
+ * @param {{setCookie: string[]}} cookies
+ * @returns {Response}
+ */
+export function applyEdgeCookies(response, { setCookie }) {
+  const headers = new Headers(response.headers);
+  for (const c of setCookie) headers.append('Set-Cookie', c);
+  const kept = (headers.get('Cache-Control') || '')
+    .split(',').map((d) => d.trim()).filter((d) => d && !/^(public|private|s-maxage=)/i.test(d));
+  headers.set('Cache-Control', ['private', ...kept].join(', '));
+  return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+}
+
+/**
+ * Attribution values from the request cookies, in the shape of `attribution` in an order snapshot.
+ * Every value is checked again: cookies are client input. Store the result with the cart and copy
+ * it into the order before payment. Add landing_url, referrer and captured_at yourself.
+ * @param {string|null|undefined} cookieHeader
+ * @returns {{sa_uid?: string, click_ids?: Record<string, string>, utm?: Record<string, string>, browser_ids?: Record<string, string>}}
+ */
+export function readAttribution(cookieHeader) {
+  const jar = parseCookieHeader(cookieHeader);
+  const out = {};
+  const uid = normalizeVisitorId(jar.get(VISITOR_COOKIE)) || normalizeVisitorId(jar.get(MIRROR_COOKIE));
+  if (uid) out.sa_uid = uid;
+
+  const clickIds = {};
+  for (const p of CLICK_ID_PARAMS) {
+    const v = cleanClickId(p, jar.get(`${COOKIE_PREFIX}${p}`));
+    if (v) clickIds[p] = v;
+  }
+  if (Object.keys(clickIds).length) out.click_ids = clickIds;
+
+  const utm = {};
+  for (const p of UTM_PARAMS) {
+    const raw = jar.get(`${COOKIE_PREFIX}${p}`);
+    const v = raw ? decodeUtmCookie(raw) : null;
+    if (v) utm[p.slice(4)] = v;
+  }
+  if (Object.keys(utm).length) out.utm = utm;
+
+  const browserIds = {};
+  for (const [key, [name, max]] of Object.entries(BROWSER_ID_COOKIES)) {
+    const v = jar.get(name);
+    if (typeof v === 'string' && v.length > 0 && v.length <= max && BROWSER_ID_RE.test(v)) browserIds[key] = v;
+  }
+  if (Object.keys(browserIds).length) out.browser_ids = browserIds;
+  return out;
+}

package/src/index.d.ts

@@ -0,0 +1,109 @@
+import type { Order, EventAddToCart, EventLoginIdentity, Redact, Attribution } from './types.js';
+
+export * from './types.js';
+
+export const VERSION: string;
+export const SCHEMA_VERSION: string;
+export const SCHEMA: Readonly<Record<string, unknown>>;
+
+// Visitor IDs
+export function uuidV7(nowMs?: number): string;
+export function isVisitorId(value: unknown): value is string;
+export function normalizeVisitorId(value: unknown): string | null;
+
+// Signing
+export const TIMESTAMP_TOLERANCE_SECONDS: number;
+export type Body = string | Uint8Array | ArrayBuffer;
+export function computeSignature(secret: string, timestamp: number, body: Body): Promise<string>;
+export function connectorHeader(name?: string): string;
+export function signRequest(opts: {
+  keyId: string;
+  secret: string;
+  body: Body;
+  timestamp?: number;
+  connector?: string;
+}): Promise<Record<string, string>>;
+export function verifySignature(opts: {
+  secret: string;
+  timestamp: number | string;
+  body: Body;
+  signature: string;
+  nowMs?: number;
+}): Promise<boolean>;
+
+// Client
+export const API_BASE: string;
+export const MAX_BODY_BYTES: number;
+export const DEFAULT_TIMEOUT_MS: number;
+export const RETRY_SCHEDULE_SECONDS: readonly number[];
+export const RETRY_GIVE_UP_AFTER_SECONDS: number;
+
+export type Outcome = 'accepted' | 'valid' | 'rejected' | 'retry';
+export interface SendResult {
+  outcome: Outcome;
+  status: number | null;
+  requestId?: string;
+  paths?: string[];
+  retryAfterSeconds?: number | null;
+  reason?: 'unconfirmed' | 'invalid_payload' | 'unauthorized' | 'not_found' | 'too_large' | 'redirect'
+    | 'unexpected_status' | 'timeout' | 'network';
+}
+export interface SendOptions {
+  dryRun?: boolean;
+}
+export interface ConnectorClient {
+  sendOrder(order: Order, opts?: SendOptions): Promise<SendResult>;
+  sendEvent(event: EventAddToCart | EventLoginIdentity, opts?: SendOptions): Promise<SendResult>;
+  sendRedact(redact: Redact, opts?: SendOptions): Promise<SendResult>;
+}
+export function createClient(config: {
+  keyId: string;
+  secret: string;
+  connector?: string;
+  fetch?: typeof globalThis.fetch;
+  timeoutMs?: number;
+}): ConnectorClient;
+export function classifyResponse(res: Response, opts?: SendOptions): Promise<SendResult>;
+export function retryDelaySeconds(attempt: number, opts?: {
+  retryAfterSeconds?: number | null;
+  firstAttemptAt?: number;
+  nowMs?: number;
+}): number | null;
+
+// Edge cookies
+export const VISITOR_COOKIE: string;
+export const MIRROR_COOKIE: string;
+export const COOKIE_PREFIX: string;
+export const COOKIE_MAX_AGE_SECONDS: number;
+export const CLICK_ID_PARAMS: readonly string[];
+export const UTM_PARAMS: readonly string[];
+export interface EdgeCookies {
+  setCookie: string[];
+  visitorId: string;
+  newVisitor: boolean;
+  landing: boolean;
+}
+export function edgeCookies(
+  input: Request | { url: string; cookie?: string | null },
+  opts?: {
+    cookieDomain?: string;
+    mode?: 'always' | 'after_consent';
+    marketingConsent?: boolean | null;
+    nowMs?: number;
+  },
+): EdgeCookies;
+export function applyEdgeCookies(response: Response, cookies: { setCookie: string[] }): Response;
+export function readAttribution(cookieHeader: string | null | undefined):
+  Pick<Attribution, 'sa_uid' | 'click_ids' | 'utm' | 'browser_ids'>;
+export function deriveCookieDomain(host: string): string | null;
+export function cookieDomainFor(host: string, override?: string): string | null;
+export function parseCookieHeader(header: string | null | undefined): Map<string, string>;
+export function cleanClickId(param: string, value: unknown): string | null;
+export function cleanUtm(value: unknown): string | null;
+
+// Validation
+export type Route = 'orders' | 'events' | 'redact';
+export function validateMessage(route: Route, message: unknown, opts?: { strict?: boolean }): string[];
+export function validateOrderMessage(message: unknown, opts?: { strict?: boolean }): string[];
+export function validateEventMessage(message: unknown, opts?: { strict?: boolean }): string[];
+export function validateRedactMessage(message: unknown, opts?: { strict?: boolean }): string[];

package/src/index.js

@@ -0,0 +1,18 @@
+export { VERSION } from './version.js';
+export { uuidV7, isVisitorId, normalizeVisitorId } from './uuid.js';
+export {
+  computeSignature, signRequest, verifySignature, connectorHeader, TIMESTAMP_TOLERANCE_SECONDS,
+} from './signature.js';
+export {
+  createClient, classifyResponse, retryDelaySeconds,
+  API_BASE, MAX_BODY_BYTES, DEFAULT_TIMEOUT_MS, RETRY_SCHEDULE_SECONDS, RETRY_GIVE_UP_AFTER_SECONDS,
+} from './client.js';
+export {
+  edgeCookies, applyEdgeCookies, readAttribution, deriveCookieDomain, cookieDomainFor,
+  parseCookieHeader, cleanClickId, cleanUtm,
+  VISITOR_COOKIE, MIRROR_COOKIE, COOKIE_PREFIX, COOKIE_MAX_AGE_SECONDS, CLICK_ID_PARAMS, UTM_PARAMS,
+} from './cookies.js';
+export {
+  validateMessage, validateOrderMessage, validateEventMessage, validateRedactMessage, SCHEMA_VERSION,
+} from './validate.js';
+export { SCHEMA } from './schema.js';