@thg-agentic/hyper-personalisation-web 3.18.0 → 3.22.0

package/src/bootstrap.js

@@ -41,11 +41,14 @@ import {
 import { getCookie } from './context.js';
 import { connectDataLayer } from './datalayer.js';
 import { sessionDebug } from './debug.js';
+import { guard } from './guard.js';
+import { IDENTITY_OPTION } from './identity-option.js';
 import { createAnalytics, normaliseSha256, PAGE_TYPES } from './index.js';
 import {
 	cachedSettings,
 	cacheSettings,
 	DISABLED,
+	eventsHost,
 	fetchSettings,
 	forgetSettings,
 	readSettings,
@@ -229,7 +232,8 @@ async function resolveSettings({ writeKey, apiHost }, options) {
  * @param {import('../types/bootstrap').BootstrapOptions} options See types/bootstrap.d.ts.
  * @returns {Promise<object|null>} the client, or null when it is off.
  */
-export function bootstrap(config, options = {}) {
+export function bootstrap(config, maybeOptions) {
+	const options = maybeOptions ?? {};
 	const host = typeof window !== 'undefined' ? window : null;
 	if (host?.[INSTANCE]) return host[INSTANCE];
 	// What `hp` queued on an earlier page that navigated before its client started. Carried only as
@@ -355,8 +359,8 @@ async function start(config, options, carry) {
 				);
 			return off(carry);
 		}
-		// A source scoped to one property names it; a source scoped to several leaves it to the page.
-		const propertyId = settings.propertyId ?? options.propertyId;
+		// The page's own property, else the source's default; a source with several and no default needs the page's.
+		const propertyId = options.propertyId ?? settings.propertyId;
 		if (!propertyId) {
 			console.warn(
 				'[hp] not started: this write key covers several properties, so propertyId is required',
@@ -374,7 +378,7 @@ async function start(config, options, carry) {
 		const userId = realId(identity?.userId);
 
 		const client = createAnalytics({
-			apiHost: settings.apiHost ?? resolveApiHost(config.apiHost),
+			apiHost: eventsHost(config.apiHost, settings.apiHost),
 			writeKey,
 			propertyId,
 			// Known before the first page view, so an event the client sends while starting (the consent
@@ -472,12 +476,12 @@ async function start(config, options, carry) {
 		let stopAutocapture = startAutocapture(client, options.autocapture);
 		// Impressions count once per page view, so a single-page app's next route reports afresh.
 		const page = client.page;
-		client.page = (...args) => {
+		client.page = guard('page', (...args) => {
 			const event = page(...args);
 			stopAutocapture();
 			stopAutocapture = startAutocapture(client, options.autocapture);
 			return event;
-		};
+		});
 
 		const host = typeof window !== 'undefined' ? window : null;
 		if (options.dataLayer && host) {
@@ -495,7 +499,7 @@ async function start(config, options, carry) {
 			});
 		}
 
-		if (identified) client.identify(identified);
+		if (identified) client.identify(identified, undefined, IDENTITY_OPTION);
 		return client;
 	} catch (err) {
 		console.warn('[hp] not started:', err?.message ?? err);

package/src/consent-gate.js

@@ -92,7 +92,7 @@ function previousFromCookie(name) {
  * @param {string} [options.cookieName] Defaults to storageName('consent'), `thg_hp_consent`.
  * @param {(item: any) => void} options.release   A held item may now be sent.
  * @param {(item: any) => void} [options.discard] A held item will never be sent.
- * @param {(update: { action: string, state: object, withdrawal: boolean }) => void} options.announce
+ * @param {(update: { action: string, state: object, previous: object|null, withdrawal: boolean }) => void} options.announce
  *   Record a Consent Updated. Called only when analytics is granted, or for the withdrawal itself.
  * @param {(status: string) => void} [options.onStatus]
  * @param {boolean} [options.debug]
@@ -201,6 +201,7 @@ export function createConsentGate(options) {
 				announce({
 					action: consentAction(next, previous),
 					state: next,
+					previous,
 					withdrawal: false,
 				});
 			return;
@@ -210,7 +211,12 @@ export function createConsentGate(options) {
 		// A withdrawal is recorded, then nothing more: the raw table is where a refusal is proven to
 		// have been received, and the warehouse's consent filter keeps it out of every model.
 		if (previous?.analytics === true)
-			announce({ action: 'withdrawn', state: next, withdrawal: true });
+			announce({
+				action: 'withdrawn',
+				state: next,
+				previous,
+				withdrawal: true,
+			});
 		setStatus('denied');
 	}
 

package/src/context.js

@@ -304,7 +304,6 @@ export const CONTEXT_KEYS = [
 	'library',
 	'source',
 	'session_id',
-	'render_id',
 	'identity_trust',
 	'page',
 	'campaign',
@@ -366,7 +365,6 @@ export function buildContext(cfg, overrides = {}) {
 		spec: { version: SPEC_VERSION },
 		source: sourceContext(cfg),
 		session_id: perRequest(cfg.getSessionId, null),
-		render_id: perRequest(cfg.getRenderId, null),
 		// The browser is always a real device. Only a cacheable server render is not.
 		identity_trust: realId(perRequest(cfg.getAnonymousId, null))
 			? 'device'

package/src/device-storage.js

@@ -154,8 +154,9 @@ export function createDeviceCookie({
 		/** Consent was granted: write what was minted before it. */
 		persist,
 		/**
-		 * Consent was refused or withdrawn: the id must not outlive the permission it was kept under,
-		 * so a later grant starts a new device, as `analytics.reset()` does.
+		 * Consent was refused or withdrawn, or the user signed out: the id must not outlive the
+		 * permission or the person it was kept under, so the next event starts a new device, as
+		 * Segment's `analytics.reset()` does.
 		 */
 		forget() {
 			writeCookie(name, '', 0, domain);

package/src/guard.js

@@ -0,0 +1,46 @@
+/**
+ * Tracking never throws into the host. Every public method runs behind `guard`: a failure is logged
+ * and the method answers what a client that could not decide answers. That fails closed, as the CDN
+ * stub does before the client starts: no personalisation, no consent headers, nothing sent.
+ */
+
+/** `throwOnInvalid`: the one failure a caller asked to have thrown at them. */
+export class InvalidEventError extends Error {}
+
+const FALLBACKS = {
+	inHoldout: () => true,
+	personalisationGroup: () => 'excluded',
+	servingHeaders: () => ({}),
+	recommendationContext: () => ({}),
+	flush: () => Promise.resolve(),
+	reset: () => undefined,
+};
+
+/** `method` behind the guard, answering `name`'s fallback when it throws. */
+export function guard(name, method) {
+	const fallback = FALLBACKS[name] ?? (() => null);
+	const failed = (err) => {
+		console.warn(`[hp] ${String(name)} failed; nothing was sent`, err);
+		return fallback();
+	};
+	return function guarded(...args) {
+		try {
+			const result = method.apply(this, args);
+			return typeof result?.then === 'function'
+				? Promise.resolve(result).catch(failed)
+				: result;
+		} catch (err) {
+			if (err instanceof InvalidEventError) throw err;
+			return failed(err);
+		}
+	};
+}
+
+/** Every method of `client` behind the guard, in place. Getters are left as they are. */
+export function guardMethods(client) {
+	for (const key of Reflect.ownKeys(client)) {
+		const { value } = Object.getOwnPropertyDescriptor(client, key) ?? {};
+		if (typeof value === 'function') client[key] = guard(key, value);
+	}
+	return client;
+}

package/src/identity-option.js

@@ -0,0 +1,6 @@
+/**
+ * Marks bootstrap's own identify, from its `identity` option, so it never counts as the earlier
+ * user a later host `identify` would be switching away from: the host may name the same person
+ * in another form.
+ */
+export const IDENTITY_OPTION = Symbol('hp.identityOption');

package/src/index.js

@@ -53,7 +53,9 @@ import {
 	holdoutAssignment,
 	holdoutShares,
 } from './experiments.js';
+import { guardMethods, InvalidEventError } from './guard.js';
 import { emailSha256, sha256Hex } from './hash.js';
+import { IDENTITY_OPTION } from './identity-option.js';
 import { applyPreview } from './preview.js';
 import {
 	forgetVisit,
@@ -82,7 +84,11 @@ import {
 	storageKey,
 	storageName,
 } from './storage-scope.js';
-import { Transport } from './transport.js';
+import {
+	MAX_EVENT_BYTES,
+	Transport,
+	byteLength as utf8Bytes,
+} from './transport.js';
 import { LIB, VERSION } from './version.js';
 
 /** The surfaces a `Personalisation Exposed` names, as the public API's exposures do. */
@@ -104,9 +110,6 @@ export { emailSha256, getCookie };
 /** How a call made before the SDK started is replayed with the messageId and time it was made at. */
 const REPLAY = Symbol.for('@thg-agentic/hyper-personalisation-web.replay');
 
-/** `throwOnInvalid`: the one failure a caller asked to have thrown at them. */
-class InvalidEventError extends Error {}
-
 /** SHA-256 of a string as lowercase hex. Synchronous since 3.9 (sha256Hex); kept async for callers. */
 export async function sha256(value) {
 	return sha256Hex(String(value));
@@ -180,6 +183,64 @@ export function normaliseSha256(value) {
 	return hex === EMPTY_SHA256 ? null : hex;
 }
 
+/** The identify traits the spec defines (core/identify, `additionalProperties: false`), by type. */
+export const IDENTIFY_TRAITS = Object.freeze({
+	email_sha256: 'sha256',
+	phone_sha256: 'sha256',
+	accepts_marketing: 'boolean',
+	gender: 'string',
+	created_at: 'date-time',
+});
+
+const RFC3339 =
+	/^\d{4}-\d{2}-\d{2}T([01]\d|2[0-3]):[0-5]\d:[0-5]\d(\.\d+)?(Z|[+-]([01]\d|2[0-3]):[0-5]\d)$/i;
+
+/** An RFC 3339 date-time naming a real day: 2026-02-30 is not one, though Date.parse rolls it on. */
+function isDateTime(value) {
+	if (typeof value !== 'string' || !RFC3339.test(value)) return false;
+	const [year, month, day] = value.slice(0, 10).split('-').map(Number);
+	const date = new Date(Date.UTC(year, month - 1, day));
+	return (
+		date.getUTCMonth() === month - 1 &&
+		date.getUTCDate() === day &&
+		!Number.isNaN(Date.parse(value))
+	);
+}
+
+/** One trait as the spec takes it, or undefined when it is not one: then it is not sent. */
+function identifyTrait(kind, value) {
+	if (value === null) return null;
+	if (kind === 'sha256') return normaliseSha256(value) ?? undefined;
+	if (kind === 'date-time') {
+		if (value instanceof Date)
+			return Number.isNaN(value.getTime()) ? undefined : value.toISOString();
+		return isDateTime(value) ? value : undefined;
+	}
+	return typeof value === kind ? value : undefined;
+}
+
+/**
+ * Only the traits the spec defines, each of its type: a raw email or phone never leaves the page, and
+ * an identify is never quarantined for an extra key. Digests in hex or base64 are sent as hex.
+ */
+function identifyTraits(traits, debug) {
+	const kept = {};
+	const dropped = [];
+	for (const [key, value] of Object.entries(traits)) {
+		const kind = Object.hasOwn(IDENTIFY_TRAITS, key)
+			? IDENTIFY_TRAITS[key]
+			: null;
+		const trait = kind ? identifyTrait(kind, value) : undefined;
+		if (trait === undefined) dropped.push(key);
+		else kept[key] = trait;
+	}
+	if (debug && dropped.length)
+		console.warn(
+			`[hp] identify: not sent, not spec traits: ${dropped.join(', ')}`,
+		);
+	return kept;
+}
+
 // On the main entry so integrators find them: without an assigned variant a rail is unmeasurable.
 export {
 	assignRecommendationVariant,
@@ -195,6 +256,19 @@ export { createSocialProof } from './social-proof.js';
 export { VERSION };
 
 let warnedMintAnonymousId = false;
+let warnedHostBasis = false;
+
+/**
+ * Without a consent adapter the SDK sends under the host's lawful basis: fail-open, so say it once.
+ * Requiring `consent` is a breaking change, planned for 4.0.
+ */
+function warnHostBasis() {
+	if (warnedHostBasis) return;
+	warnedHostBasis = true;
+	console.warn(
+		"[hp] no consent adapter: events are sent under the host's lawful basis (basis 'host'). Pass `consent` to send only once the visitor allows analytics.",
+	);
+}
 
 /** 3.5's `mintAnonymousId` does nothing since 3.6: where device ids come from is the source's. */
 function warnMintAnonymousId(debug) {
@@ -205,6 +279,15 @@ function warnMintAnonymousId(debug) {
 	);
 }
 
+/** UTF-8 bytes of the event as sent; 0 for one JSON cannot serialise, which delivery drops itself. */
+function serialisedBytes(event) {
+	try {
+		return utf8Bytes(JSON.stringify(event));
+	} catch {
+		return 0;
+	}
+}
+
 /** Per-call context overrides, given directly or analytics-next style as `{ context }`. */
 function contextOverrides(options) {
 	if (
@@ -243,6 +326,7 @@ export function createAnalytics(options) {
 	// A consent adapter makes the SDK strict: nothing is sent or stored until analytics is granted.
 	// Without one the host has decided the lawful basis itself, and every event says so (spec 1.5).
 	const strict = Boolean(cfg.consent);
+	if (!strict) warnHostBasis();
 	let gate = null;
 	cfg.getConsent = () => (gate ? gate.stamp() : hostConsent());
 	const granted = () => !strict || gate?.status === 'granted';
@@ -276,6 +360,10 @@ export function createAnalytics(options) {
 		cfg.consentCookieDomain ?? null,
 	);
 
+	/** Delivery problems, logged with `debug`. */
+	const reportError = (message, err) =>
+		cfg.debug && console.warn('[hp]', message, err ?? '');
+
 	const transport =
 		cfg.transport ??
 		new Transport({
@@ -288,7 +376,7 @@ export function createAnalytics(options) {
 			// grant (see onStatus below, which replays on a grant and clears on a refusal).
 			mayPersist: strict ? () => gate?.status === 'granted' : undefined,
 			deferReplay: strict,
-			onError: (m, e) => cfg.debug && console.warn('[hp]', m, e ?? ''),
+			onError: reportError,
 		});
 
 	// The previous page view's messageId, carried across navigations in sessionStorage, per tenant.
@@ -323,6 +411,10 @@ export function createAnalytics(options) {
 	cfg.getDecisions ??= decisions.current;
 
 	let userId = realId(perRequest(cfg.getUserId, null));
+	/** The user the host's last `identify` named: a different one later on this page is a switch. */
+	let identifiedUserId = null;
+	/** The user bootstrap's `identity` option named, only to warn when the host names another form. */
+	let optionsUserId = null;
 
 	/** The call being replayed: its first event keeps the messageId and time it was made with. */
 	let replaying = null;
@@ -341,6 +433,10 @@ export function createAnalytics(options) {
 	function compose(partial, ctxOverrides, force) {
 		const made = replaying;
 		replaying = null;
+		// The plan is keyed as the gateway keys it: a track's name, otherwise the call's type. A
+		// withdrawal is the record of the refusal, so no plan drops it.
+		const key = partial.type === 'track' ? partial.event : partial.type;
+		if (!force && !planAllows(cfg.plan, key)) return null;
 		let event = {
 			messageId: made?.messageId ?? uuid(),
 			timestamp: made?.timestamp ?? new Date().toISOString(),
@@ -391,6 +487,16 @@ export function createAnalytics(options) {
 
 		if (cfg.debug) console.debug('[hp]', event.event ?? event.type, event);
 
+		// Too big to travel in a keepalive request on its own: it could never go at unload, and once
+		// persisted it would push every other batch out of the retry buffer.
+		const bytes = serialisedBytes(event);
+		if (bytes > MAX_EVENT_BYTES) {
+			reportError(
+				`${event.event ?? event.type} not sent: ${bytes} bytes, over the ${MAX_EVENT_BYTES}-byte limit for one event`,
+			);
+			return null;
+		}
+
 		deliver(event, force);
 		return event;
 	}
@@ -429,15 +535,36 @@ export function createAnalytics(options) {
 				visitKept = true;
 			} else {
 				// Not allowed, or withdrawn: what was kept under the permission goes with it.
-				forgetVisit();
-				if (visitKept) clearSessionSignals();
-				visitKept = false;
+				forgetKeptVisit();
 			}
 		} catch (err) {
 			if (cfg.debug) console.warn('[hp] the visit was not recorded', err);
 		}
 	}
 
+	/**
+	 * What the visit built up for recommendations, kept only under personalisation consent. The
+	 * session signals are cleared only when this SDK built them, unless `all`: a refusal or a sign-out.
+	 */
+	function forgetKeptVisit(all = false) {
+		forgetVisit();
+		if (all || visitKept) clearSessionSignals();
+		visitKept = false;
+	}
+
+	/**
+	 * A sign-out, or another user signing in: the SDK's session, the decisions in force, the visit
+	 * and the SDK's own device id go with the user, as Segment's `reset()` starts a new anonymousId.
+	 * A device id read from the site's own cookie stays: the SDK does not own it.
+	 */
+	function forgetVisitor() {
+		session.forget();
+		decisions.forget();
+		exposedTokens.clear();
+		device?.forget();
+		forgetKeptVisit(true);
+	}
+
 	function deliver(event, force) {
 		// The observer only sees what will be sent, never an event the visitor has not allowed.
 		if (!strict || force || gate.admits()) {
@@ -449,9 +576,7 @@ export function createAnalytics(options) {
 	}
 
 	const track = (name, properties, ctx) =>
-		planAllows(cfg.plan, name)
-			? emit({ type: 'track', event: name, properties: properties ?? {} }, ctx)
-			: null;
+		emit({ type: 'track', event: name, properties: properties ?? {} }, ctx);
 
 	// One exposure event per serving response, however often the page reuses it.
 	const exposedTokens = new Set();
@@ -509,6 +634,7 @@ export function createAnalytics(options) {
 						/* nothing was stored */
 					}
 					decisions.forget();
+					forgetKeptVisit(true);
 				}
 				try {
 					cfg.onConsentStatus?.(status);
@@ -516,7 +642,14 @@ export function createAnalytics(options) {
 					console.warn('[hp] onConsentStatus observer failed', err);
 				}
 			},
-			announce({ action, state, withdrawal }) {
+			announce({ action, state, previous, withdrawal }) {
+				// Withdrawn here, not only when the next event reaches recordVisit: a beforeSend that drops
+				// it must not keep the visit. A withdrawal on a later page, before it recorded anything,
+				// forgets the signals an earlier page kept under the permission.
+				if (state?.personalisation !== true)
+					forgetKeptVisit(previous?.personalisation === true);
+				// Events collected under the grant are not sent after it is withdrawn: only the withdrawal.
+				if (withdrawal) transport.discardQueued?.();
 				emit(
 					{
 						type: 'track',
@@ -611,11 +744,22 @@ export function createAnalytics(options) {
 		);
 	}
 
-	return {
+	/** After a sign-out is sent under the signed-in identity: clear it for whoever uses the device next. */
+	function signOut(event) {
+		if (userId) forgetVisitor();
+		userId = null;
+		identifiedUserId = null;
+		optionsUserId = null;
+		return event;
+	}
+
+	return guardMethods({
 		/** Escape hatch for events not yet in the core spec. Prefer a named method. */
-		track,
+		track: (event, p, c) =>
+			event === 'Signed Out' ? signOut(track(event, p, c)) : track(event, p, c),
 
-		page(props = {}, ctx) {
+		page(props, ctx) {
+			props ??= {};
 			// page.type is inherited by every later event on the page, so an unknown value would get
 			// them all rejected. Keep the last good type instead: stale beats invalid.
 			let pageType = cfg.pageType ?? null;
@@ -647,22 +791,47 @@ export function createAnalytics(options) {
 			return ev;
 		},
 
-		identify(traits, ctx) {
+		identify(traits, ctx, source) {
 			const { userId: id, ...rest } =
 				traits && typeof traits === 'object' ? traits : {};
-			if (id !== undefined) userId = realId(id);
-			// A digest in hex or base64 is sent as hex; anything that is not one is not sent.
-			if (typeof rest.email_sha256 === 'string') {
-				const email = normaliseSha256(rest.email_sha256);
-				if (email) rest.email_sha256 = email;
-				else delete rest.email_sha256;
+			if (id !== undefined) {
+				const next = realId(id);
+				if (source === IDENTITY_OPTION) {
+					optionsUserId = next;
+				} else if (identifiedUserId && next && next !== identifiedUserId) {
+					// The host named another user after an earlier one on this page: nothing the last one
+					// built up carries over. A host cookie or bootstrap's identity option never counts as
+					// the earlier user: either may name the same person in another form.
+					forgetVisitor();
+				} else if (
+					cfg.debug &&
+					optionsUserId &&
+					next &&
+					next !== optionsUserId
+				) {
+					console.warn(
+						'[hp] identify names another userId than the identity option; using the new one',
+					);
+				}
+				userId = next;
+				if (next && source !== IDENTITY_OPTION) identifiedUserId = next;
 			}
-			return emit({ type: 'identify', traits: rest }, ctx);
+			return emit(
+				{ type: 'identify', traits: identifyTraits(rest, cfg.debug) },
+				ctx,
+			);
 		},
 
-		/** Clear identity on sign-out so the next events are not attributed to the old user. */
+		/**
+		 * Clear the signed-in user. At a real sign-out (a user was signed in), also forget what the visit
+		 * built up and the SDK's own device id, so the next person on a shared device inherits none of
+		 * it. A device id from the site's own cookie stays: the site owns it.
+		 */
 		reset() {
+			if (userId) forgetVisitor();
 			userId = null;
+			identifiedUserId = null;
+			optionsUserId = null;
 			writeLastPageMessageId('');
 		},
 
@@ -728,7 +897,14 @@ export function createAnalytics(options) {
 		personalisationGroup,
 		productClicked: (p, c) => track('Product Clicked', p, c),
 		productListFiltered: (p, c) => track('Product List Filtered', p, c),
+		/** A submitted search and the results page it produced: the query, its results and `pagination`. */
 		productsSearched: (p, c) => track('Products Searched', p, c),
+		/**
+		 * The search box's suggested products for a partly typed query, once seen: never
+		 * productsSearched, which is a submitted search's results page. A click on one carries this
+		 * set's `search_request_id`.
+		 */
+		searchSuggestionsViewed: (p, c) => track('Search Suggestions Viewed', p, c),
 		productAdded: (p, c) => track('Product Added', p, c),
 		productRemoved: (p, c) => track('Product Removed', p, c),
 		/**
@@ -778,11 +954,7 @@ export function createAnalytics(options) {
 		signedIn: (p, c) => track('Signed In', p, c),
 		signedUp: (p, c) => track('Signed Up', p, c),
 		/** Sent under the signed-in identity, which is then cleared for whoever uses the device next. */
-		signedOut(c) {
-			const event = track('Signed Out', {}, c);
-			userId = null;
-			return event;
-		},
+		signedOut: (c) => signOut(track('Signed Out', {}, c)),
 		newsletterSubscribed: (p, c) => track('Newsletter Subscribed', p, c),
 		/** An on-site opt-out. The ESP reports its own as Email Unsubscribed. */
 		newsletterUnsubscribed: (p, c) => track('Newsletter Unsubscribed', p, c),
@@ -836,5 +1008,5 @@ export function createAnalytics(options) {
 				replaying = null;
 			}
 		},
-	};
+	});
 }

package/src/recommendation-context.js

@@ -7,6 +7,8 @@
  * `new URLSearchParams(context)` is the query string to append, and an empty visit appends nothing.
  */
 
+import { parseConsentCookie } from './consent.js';
+import { getCookie } from './context.js';
 import { storageName } from './storage-scope.js';
 
 /** packages/cdp/src/recommendations/request.ts: MAX_IDS, MAX_ID_LENGTH, five queries, 60 pairs. */
@@ -86,9 +88,16 @@ export function forgetVisit() {
 	}
 }
 
-/** The visit an earlier page kept, or `{}` once it has lapsed. */
+/**
+ * The visit an earlier page kept, or `{}` once it has lapsed, or when the consent cookie does not
+ * grant personalisation: a withdrawal on a page this SDK never ran on still stops it being read.
+ */
 export function keptVisit(now = Date.now()) {
 	try {
+		const { personalisation } = parseConsentCookie(
+			getCookie(storageName('consent')),
+		);
+		if (personalisation !== true) return {};
 		const kept = JSON.parse(
 			localStorage.getItem(storageName('recommendationContext')) ?? 'null',
 		);

package/src/segment.js

@@ -33,7 +33,7 @@ import { hostConsent, reportingPurposes } from './consent.js';
 import { createConsentGate } from './consent-gate.js';
 import { buildContext, CONTEXT_KEYS } from './context.js';
 import { deviceIdFrom } from './device-storage.js';
-import { planAllows, readSettings, resolveApiHost } from './settings.js';
+import { eventsHost, planAllows, readSettings } from './settings.js';
 
 export { DEFAULT_API_HOST } from './settings.js';
 
@@ -134,12 +134,20 @@ export function hpLoadOptions({ writeKey, apiHost }) {
 		disableClientPersistence: true,
 		updateCDNSettings(cdnSettings) {
 			const integrations = { ...cdnSettings.integrations };
-			if (!integrations['Segment.io']?.apiHost) {
-				const origin =
-					readSettings(cdnSettings).apiHost ?? resolveApiHost(apiHost);
+			const block = integrations['Segment.io'];
+			// The settings' block is kept only where the settings' host would be: no apiHost set, and https.
+			const configured =
+				apiHost !== undefined && apiHost !== null && apiHost !== '';
+			if (
+				configured ||
+				!block?.apiHost ||
+				(block.protocol ?? 'https') !== 'https'
+			) {
+				const origin = eventsHost(apiHost, readSettings(cdnSettings).apiHost);
 				if (!origin) return cdnSettings;
 				const { protocol, host } = new URL(origin);
 				integrations['Segment.io'] = {
+					...block,
 					apiKey: writeKey,
 					apiHost: `${host}/v1`,
 					protocol: protocol.replace(':', ''),
@@ -156,8 +164,8 @@ export function hpLoadOptions({ writeKey, apiHost }) {
 
 /**
  * @param {object} options Same names and meanings as createAnalytics().
- * @param {string} [options.propertyId] For a key scoped to several properties, or without settings:
- *   the `hp` block's propertyId wins when it has one.
+ * @param {string} [options.propertyId] The page's property. It wins over the `hp` block's, which is
+ *   the source's default property, as on Android, iOS and React Native.
  * @param {string} [options.channel]
  * @param {string} [options.market]
  * @param {string} [options.environment]
@@ -181,7 +189,6 @@ export function hpLoadOptions({ writeKey, apiHost }) {
  * @param {object} [options.anonymousIdSource] Only without settings: the `hp` block's wins.
  * @param {() => string|null} [options.getPageType]
  * @param {() => string|null} [options.getSessionId]
- * @param {() => string|null} [options.getRenderId]
  * @param {() => object|null} [options.getExtensions]
  * @param {() => object[]|null} [options.getExperiments]
  * @param {() => object[]|null} [options.getAudiences]
@@ -211,7 +218,7 @@ export function cdpPlugins(options = {}) {
 		if (cdnSettings?.hp !== undefined) {
 			const settings = readSettings(cdnSettings);
 			if (settings.enabled) {
-				cfg.propertyId = settings.propertyId ?? cfg.propertyId;
+				cfg.propertyId = cfg.propertyId ?? settings.propertyId;
 				cfg.environment = settings.environment;
 				if (settings.queryParamAllowlist)
 					cfg.queryParamAllowlist = settings.queryParamAllowlist;
@@ -244,7 +251,8 @@ export function cdpPlugins(options = {}) {
 		delete context[WITHDRAWN_AS];
 
 		if (off) throw cancellation(ctx, 'not enabled for this write key');
-		if (ctx.event.type === 'track' && !planAllows(cfg.plan, ctx.event.event)) {
+		const key = ctx.event.type === 'track' ? ctx.event.event : ctx.event.type;
+		if (!forced && !planAllows(cfg.plan, key)) {
 			throw cancellation(ctx, 'disabled by the tracking plan');
 		}