@vio-live/web-sdk 0.23.1 → 0.26.0

package/dist/{chunk-BRJMT7P4.js → chunk-5KWICUME.js}

@@ -11,6 +11,261 @@ var __decorateClass = (decorators, target, key, kind) => {
   return result;
 };
 
+// src/core/slots.ts
+var SLOT_ID_MAX_LENGTH = 100;
+var SLOT_DECLARATION_TTL_MS = 24 * 60 * 60 * 1e3;
+var SLOT_DECLARATION_FAILURE_TTL_MS = 60 * 60 * 1e3;
+var MAX_LOCATIONS_PER_DECLARATION = 100;
+var MAX_DECLARATIONS_PER_LOAD = 3;
+var SLOT_KIND_MAX_LENGTH = 32;
+function componentKindOf(templateId, slot) {
+  const hint = typeof templateId === "string" ? templateId.trim().toLowerCase() : "";
+  if (hint) return hint.replace(/^(product|vev)-/, "").slice(0, SLOT_KIND_MAX_LENGTH) || void 0;
+  const id = typeof slot === "string" ? slot.toLowerCase() : "";
+  const m = id.match(/(?:^|-)(card|carousel|grid|detail|banner|list|hero|stepper)(?:-|$)/);
+  return m?.[1];
+}
+function normalizeSlotKind(value) {
+  if (typeof value !== "string") return void 0;
+  const kind = value.trim().toLowerCase().slice(0, SLOT_KIND_MAX_LENGTH).trim();
+  return kind || void 0;
+}
+function resolveSlotCampaign(boot, slot, now = Date.now(), platform, pageCampaignId, sponsorId) {
+  if (!boot) return null;
+  const page = activeCampaignEntry(boot, pageCampaignId);
+  const assignment = findSlotAssignmentDetail(boot, slot, now, platform);
+  const sponsor = toNumber(sponsorId);
+  if (assignment && assignmentApplies(assignment, page, sponsor)) return assignment.campaign;
+  return activeCampaignEntry(boot, pageCampaignId, sponsor) ?? (sponsor !== void 0 ? sponsorCampaignEntry(boot, sponsor) : null) ?? defaultCampaignEntry(boot);
+}
+function sponsorCampaignEntry(boot, sponsorId) {
+  const id = toNumber(sponsorId);
+  if (!boot || id === void 0) return null;
+  try {
+    const matches = activeCampaigns(boot).filter((c) => campaignSponsorIds(c).includes(id));
+    if (matches.length === 0) return null;
+    const defaultId = toNumber(boot.campaign?.id);
+    return matches.find((c) => toNumber(c.id) === defaultId) ?? matches[0] ?? null;
+  } catch {
+    return null;
+  }
+}
+function assignmentApplies(assignment, page, sponsorId) {
+  if (assignment.slot.source !== "page") return true;
+  if (isStalePageAssignment(assignment, page)) return false;
+  return sponsorId === void 0 || campaignSponsorIds(assignment.campaign).includes(sponsorId);
+}
+function isStalePageAssignment(assignment, page) {
+  return !!page && assignment.slot.source === "page" && toNumber(page.id) !== toNumber(assignment.campaign.id);
+}
+function toCampaignId(value) {
+  let n;
+  if (typeof value === "number") n = value;
+  else if (typeof value === "string" && /^\s*\d+\s*$/.test(value)) n = Number(value);
+  else return void 0;
+  return Number.isSafeInteger(n) && n > 0 ? n : void 0;
+}
+function campaignCandidates(hint) {
+  const raw = Array.isArray(hint) ? hint : [hint];
+  const out = [];
+  for (const v of raw) {
+    const id = toCampaignId(v);
+    if (id !== void 0 && !out.includes(id)) out.push(id);
+  }
+  return out;
+}
+function activeCampaignEntry(boot, hint, sponsorId) {
+  if (!boot) return null;
+  try {
+    const active = activeCampaigns(boot);
+    for (const id of campaignCandidates(hint)) {
+      const entry = active.find((c) => toNumber(c.id) === id);
+      if (!entry) continue;
+      if (sponsorId !== void 0 && !campaignSponsorIds(entry).includes(sponsorId)) continue;
+      return entry;
+    }
+  } catch {
+  }
+  return null;
+}
+function campaignSponsorIds(campaign) {
+  const ids = [];
+  const primary = toNumber(campaign.primarySponsor?.id);
+  if (primary !== void 0) ids.push(primary);
+  const secondaries = Array.isArray(campaign.secondarySponsors) ? campaign.secondarySponsors : [];
+  for (const s of secondaries) {
+    const id = toNumber(s?.id);
+    if (id !== void 0) ids.push(id);
+  }
+  return ids;
+}
+function findSlotAssignmentDetail(boot, slot, now = Date.now(), platform) {
+  const name = typeof slot === "string" ? slot.trim() : "";
+  if (!boot || !name) return null;
+  try {
+    const matches = [];
+    for (const campaign of activeCampaigns(boot)) {
+      const match = slotsOf(campaign).find((s) => assignmentMatches(s, name, now, platform));
+      if (match) matches.push({ campaign, slot: match });
+    }
+    if (matches.length === 0) return null;
+    const defaultId = toNumber(boot.campaign?.id);
+    return matches.find((m) => toNumber(m.campaign.id) === defaultId) ?? matches[0] ?? null;
+  } catch {
+    return null;
+  }
+}
+function defaultCampaignEntry(boot) {
+  if (!boot?.campaign || typeof boot.campaign !== "object") return null;
+  const defaultId = toNumber(boot.campaign.id);
+  if (defaultId === void 0) return null;
+  try {
+    const listed = wellFormedCampaigns(boot).find((c) => toNumber(c.id) === defaultId);
+    if (listed) return listed;
+  } catch {
+  }
+  return {
+    ...boot.campaign,
+    isDefault: true,
+    primarySponsor: boot.primarySponsor ?? null,
+    secondarySponsors: Array.isArray(boot.secondarySponsors) ? boot.secondarySponsors : [],
+    slots: []
+  };
+}
+function wellFormedCampaigns(boot) {
+  const list = Array.isArray(boot.campaigns) ? boot.campaigns : [];
+  return list.filter((c) => !!c && typeof c === "object");
+}
+function activeCampaigns(boot) {
+  return wellFormedCampaigns(boot).filter((c) => c.status === "active");
+}
+function slotsOf(campaign) {
+  const slots = Array.isArray(campaign.slots) ? campaign.slots : [];
+  return slots.filter((s) => !!s && typeof s === "object");
+}
+function assignmentMatches(s, name, now, platform) {
+  if (typeof s.name !== "string" || s.name.trim() !== name) return false;
+  if (platform && s.platform != null && s.platform !== platform) return false;
+  const start = parseTime(s.startDate);
+  if (start !== void 0 && start > now) return false;
+  const end = parseTime(s.endDate);
+  if (end !== void 0 && now >= end) return false;
+  return true;
+}
+function parseTime(value) {
+  if (value == null || value === "") return void 0;
+  const t = Date.parse(String(value));
+  return Number.isFinite(t) ? t : void 0;
+}
+function toNumber(value) {
+  if (value === void 0 || value === null || value === "") return void 0;
+  const n = Number(value);
+  return Number.isFinite(n) ? n : void 0;
+}
+function normalizeSlotId(value) {
+  if (typeof value !== "string") return "";
+  return value.trim().slice(0, SLOT_ID_MAX_LENGTH).trim();
+}
+function normalizeSlotLocations(slots) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  if (!Array.isArray(slots)) return out;
+  for (const raw of slots) {
+    const id = normalizeSlotId(typeof raw === "string" ? raw : raw?.id);
+    if (!id || seen.has(id)) continue;
+    seen.add(id);
+    const displayName = raw && typeof raw === "object" && typeof raw.displayName === "string" ? raw.displayName.trim() : "";
+    const campaignId = raw && typeof raw === "object" ? toCampaignId(raw.campaignId) : void 0;
+    const kind = raw && typeof raw === "object" ? normalizeSlotKind(raw.kind) : void 0;
+    const location2 = { id };
+    if (displayName) location2.displayName = displayName;
+    if (campaignId !== void 0) location2.campaignId = campaignId;
+    if (kind) location2.kind = kind;
+    out.push(location2);
+  }
+  return out;
+}
+function autoSlotId(kind, ordinal, scope) {
+  const tail = `${kind}-${ordinal + 1}`;
+  let prefix = normalizeScope(scope);
+  const room = SLOT_ID_MAX_LENGTH - tail.length - 1;
+  if (prefix.length > room) prefix = prefix.slice(0, Math.max(0, room)).replace(/-+$/, "");
+  return `${prefix ? `${prefix}-` : ""}${tail}`;
+}
+function autoSlotDisplayName(kind, ordinal, scopeName) {
+  const label = `${kind.charAt(0).toUpperCase()}${kind.slice(1)} ${ordinal + 1}`;
+  const name = typeof scopeName === "string" ? scopeName.trim() : "";
+  return name ? `${label} \xB7 ${name}` : label;
+}
+function normalizeScope(scope) {
+  if (typeof scope !== "string") return "";
+  return scope.trim().replace(/\s+/g, "-");
+}
+var SLOT_DECLARATION_MEMORY_CAP = 500;
+function slotDeclarationKey(location2, pageCampaignId) {
+  const campaignId = toCampaignId(location2.campaignId) ?? toCampaignId(pageCampaignId);
+  const kind = normalizeSlotKind(location2.kind);
+  return location2.id + (location2.displayName ? `${location2.displayName}` : "") + (campaignId !== void 0 ? `${campaignId}` : "") + (kind !== void 0 ? `${kind}` : "");
+}
+function pendingSlotKeys(memory, keys, now = Date.now(), ttl = SLOT_DECLARATION_TTL_MS) {
+  return keys.filter((key) => {
+    const at = memory?.[key];
+    if (typeof at !== "number" || !Number.isFinite(at)) return true;
+    return now - at >= ttl || now < at;
+  });
+}
+function slotKeyId(key) {
+  const cut4 = key.search(/[\u001f\u001e\u001d]/);
+  return cut4 >= 0 ? key.slice(0, cut4) : key;
+}
+function rememberSlotKeys(memory, keys, at, cap = SLOT_DECLARATION_MEMORY_CAP) {
+  const next = { ...memory ?? {} };
+  const ids = new Set(keys.map(slotKeyId));
+  for (const existing of Object.keys(next)) {
+    if (ids.has(slotKeyId(existing)) && !keys.includes(existing)) delete next[existing];
+  }
+  for (const key of keys) next[key] = at;
+  const entries = Object.entries(next);
+  if (entries.length <= cap) return next;
+  entries.sort((a, b) => b[1] - a[1]);
+  return Object.fromEntries(entries.slice(0, cap));
+}
+function slotDeclarationStorageKey(platform, apiKey) {
+  return `vio.slots.${platform}.${fnv1a(apiKey)}`;
+}
+function fnv1a(input) {
+  let hash = 2166136261;
+  for (let i = 0; i < input.length; i++) {
+    hash ^= input.charCodeAt(i);
+    hash = Math.imul(hash, 16777619) >>> 0;
+  }
+  return hash.toString(16).padStart(8, "0");
+}
+function readSlotDeclaration(storageKey) {
+  try {
+    if (typeof localStorage === "undefined") return {};
+    const raw = localStorage.getItem(storageKey);
+    if (!raw) return {};
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+    if (Array.isArray(parsed.keys)) return {};
+    const out = {};
+    for (const [key, at] of Object.entries(parsed)) {
+      if (typeof at === "number" && Number.isFinite(at)) out[key] = at;
+    }
+    return out;
+  } catch {
+    return {};
+  }
+}
+function writeSlotDeclaration(storageKey, memory) {
+  try {
+    if (typeof localStorage === "undefined") return;
+    localStorage.setItem(storageKey, JSON.stringify(memory));
+  } catch {
+  }
+}
+
 // src/core/configuration.ts
 var DEFAULT_URLS = {
   // The Vio Backend development environment was removed on 2026-09-16; its REST
@@ -49,6 +304,10 @@ var ConfigurationSingleton = class {
       platform: input.platform ?? "web",
       contentId: input.contentId,
       contentTitle: input.contentTitle,
+      campaignId: toCampaignId(input.campaignId),
+      debug: input.debug === true,
+      // Only the two words the backend knows; anything else is "not said".
+      privacyMode: input.privacyMode === "minimal" || input.privacyMode === "standard" ? input.privacyMode : void 0,
       apiBase: input.apiBase ?? defaults.apiBase,
       graphQLBase: input.graphQLBase ?? defaults.graphQLBase,
       eventsBase: input.eventsBase ?? defaults.eventsBase,
@@ -138,6 +397,14 @@ var VioApi = class {
   async declareManifest(body) {
     return this.post("/v2/mobile/components/manifest", body);
   }
+  /**
+   * The surface of the key (`GET /v2/mobile/surface`): its id, name, status
+   * and `privacyMode` — what decides whether the order attribution may carry
+   * the entry context (ADR-0035). A 404 means a service that predates it.
+   */
+  async surface() {
+    return this.get("/v2/mobile/surface");
+  }
   /**
    * Get placement components for a campaign. Used by the carousel auto-fetch
    * mode (`<vio-product-carousel campaign-id="36" location="news-favorites">`).
@@ -457,6 +724,214 @@ function createCommerceClient(options) {
   return new CommerceClient(options);
 }
 
+// src/core/content.ts
+var CONTENT_ID_QUERY = "vio_content";
+var CONTENT_TITLE_QUERY = "vio_content_title";
+var CONTENT_ID_MAX_LENGTH = 128;
+var CONTENT_TITLE_MAX_LENGTH = 255;
+var CONTENT_URL_MAX_LENGTH = 2048;
+function originAndPath(raw, max = CONTENT_URL_MAX_LENGTH) {
+  const value = text(raw);
+  if (!value) return void 0;
+  try {
+    const url = new URL(value);
+    return cutTo(`${url.origin}${url.pathname}`, max);
+  } catch {
+    const end = value.search(/[?#]/);
+    return cutTo(end >= 0 ? value.slice(0, end) : value, max);
+  }
+}
+function cutTo(value, max) {
+  const out = value.length > max ? value.slice(0, max) : value;
+  return out || void 0;
+}
+function capContentUrl(value) {
+  const url = text(value);
+  if (!url) return void 0;
+  if (url.length <= CONTENT_URL_MAX_LENGTH) return url;
+  const cut4 = url.search(/[?#]/);
+  const withoutQuery = cut4 >= 0 ? url.slice(0, cut4) : url;
+  return withoutQuery.length <= CONTENT_URL_MAX_LENGTH ? withoutQuery : withoutQuery.slice(0, CONTENT_URL_MAX_LENGTH);
+}
+function resolveContent(init, doc = typeof document !== "undefined" ? document : null, loc = typeof location !== "undefined" ? location : null) {
+  const out = {};
+  try {
+    const url = originAndPath(loc?.href);
+    if (url !== void 0) out.url = url;
+  } catch {
+  }
+  try {
+    const query = parseQuery(loc?.search);
+    const id = fits(text(init?.contentId)) ?? fits(text(query.get(CONTENT_ID_QUERY))) ?? fits(text(meta(doc, "name", "vio:content-id"))) ?? fits(stripQueryAndHash(text(attr(doc, 'link[rel="canonical"]', "href")))) ?? fits(stripQueryAndHash(text(meta(doc, "property", "og:url")))) ?? fits(text(loc?.pathname));
+    const title = text(init?.contentTitle) ?? text(query.get(CONTENT_TITLE_QUERY)) ?? text(meta(doc, "name", "vio:content-title")) ?? text(meta(doc, "property", "og:title")) ?? text(doc?.title);
+    if (id !== void 0) out.id = id;
+    if (title !== void 0) out.title = title.slice(0, CONTENT_TITLE_MAX_LENGTH);
+    return out;
+  } catch {
+    return out;
+  }
+}
+function fits(value) {
+  return value !== void 0 && value.length <= CONTENT_ID_MAX_LENGTH ? value : void 0;
+}
+function text(value) {
+  if (value === void 0 || value === null) return void 0;
+  const s = String(value).trim();
+  return s ? s : void 0;
+}
+function parseQuery(search) {
+  try {
+    return new URLSearchParams(typeof search === "string" ? search : "");
+  } catch {
+    return new URLSearchParams();
+  }
+}
+function meta(doc, key, value) {
+  return attr(doc, `meta[${key}="${value}"]`, "content");
+}
+function attr(doc, selector, name) {
+  try {
+    if (!doc || typeof doc.querySelector !== "function") return void 0;
+    const el = doc.querySelector(selector);
+    const v = el?.getAttribute?.(name);
+    return typeof v === "string" ? v : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function stripQueryAndHash(url) {
+  if (!url) return void 0;
+  const cut4 = url.search(/[?#]/);
+  const clean = cut4 >= 0 ? url.slice(0, cut4) : url;
+  return clean.trim() || void 0;
+}
+
+// src/core/cart/origin-wire.ts
+var GRAPHQL_INT_MAX = 2147483647;
+var LINE_ORIGIN_CAPS = Object.freeze({
+  locationId: SLOT_ID_MAX_LENGTH,
+  componentKind: SLOT_KIND_MAX_LENGTH,
+  contentUrl: 2048,
+  contentTitle: CONTENT_TITLE_MAX_LENGTH
+});
+function lineOriginWire(origin, options = {}) {
+  if (!origin || typeof origin !== "object") return void 0;
+  const page = options.page ?? {};
+  const standard = options.privacyMode === "standard";
+  const out = {};
+  const campaignId = Number(origin.campaignId);
+  if (Number.isInteger(campaignId) && campaignId > 0 && campaignId <= GRAPHQL_INT_MAX) out.campaign_id = campaignId;
+  const locationId = cut(origin.slot, LINE_ORIGIN_CAPS.locationId);
+  if (locationId && standard) out.location_id = locationId;
+  const kind = cut(origin.componentKind, LINE_ORIGIN_CAPS.componentKind) ?? componentKindOf(void 0, origin.slot);
+  if (kind) out.component_kind = kind;
+  if (!out.campaign_id && !out.location_id && !out.component_kind) return void 0;
+  if (!standard) return out;
+  const url = originAndPath(origin.contentUrl, LINE_ORIGIN_CAPS.contentUrl) ?? originAndPath(page.contentUrl, LINE_ORIGIN_CAPS.contentUrl);
+  if (url) out.content_url = url;
+  const title = cut(origin.contentTitle, LINE_ORIGIN_CAPS.contentTitle) ?? cut(page.contentTitle, LINE_ORIGIN_CAPS.contentTitle);
+  if (title) out.content_title = title;
+  return out;
+}
+function currentOriginPage() {
+  const out = {};
+  try {
+    const facade = globalThis.__VIO_FACADE__;
+    const content = typeof facade?.content === "function" ? facade.content() : resolveContent();
+    const url = originAndPath(content?.url, LINE_ORIGIN_CAPS.contentUrl);
+    if (url) out.contentUrl = url;
+    const title = cut(content?.title, LINE_ORIGIN_CAPS.contentTitle);
+    if (title) out.contentTitle = title;
+  } catch {
+  }
+  return out;
+}
+function cut(value, max) {
+  if (typeof value !== "string" && typeof value !== "number") return void 0;
+  const text3 = String(value).trim();
+  if (!text3) return void 0;
+  return text3.length > max ? text3.slice(0, max).trim() || void 0 : text3;
+}
+async function currentPrivacyMode() {
+  try {
+    const facade = globalThis.__VIO_FACADE__;
+    if (typeof facade?.privacyMode !== "function") return "unknown";
+    const mode = await facade.privacyMode();
+    return mode === "standard" || mode === "minimal" ? mode : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
+// src/core/buyer-ref.ts
+var BUYER_REF_MAX_LENGTH = 128;
+var BUYER_REF_PATTERN = /^[A-Za-z0-9._~-]+$/;
+function normalizeBuyerRef(value) {
+  if (typeof value !== "string") return void 0;
+  const ref = value.trim();
+  if (!ref || ref.length > BUYER_REF_MAX_LENGTH || !BUYER_REF_PATTERN.test(ref)) return void 0;
+  return ref;
+}
+
+// src/core/api/gateway-features.ts
+var FEATURE_TOKENS = {
+  buyer_ref: ["buyer_ref"],
+  line_origin: ["origin", "CartLineOriginInput"],
+  checkout_attribution: ["attribution", "CheckoutAttributionInput", "CheckoutAttributionEntryInput"]
+};
+var UNKNOWN_PATTERN = /cannot query field|unknown field|unknown argument|unknown type|is not defined by type|not defined by type|field "[^"]+" is not defined/i;
+var refused = /* @__PURE__ */ new Set();
+var warned = /* @__PURE__ */ new Set();
+function gatewayHas(feature) {
+  return !refused.has(feature);
+}
+function resetGatewayFeatures(feature) {
+  if (feature) {
+    refused.delete(feature);
+    warned.delete(feature);
+    return;
+  }
+  refused.clear();
+  warned.clear();
+}
+function messagesOf(err) {
+  if (!err || typeof err !== "object") return [];
+  const { message, graphql } = err;
+  return [message, ...(graphql?.errors ?? []).map((e) => e?.message)].filter(
+    (m) => typeof m === "string"
+  );
+}
+function ranSomething(err) {
+  if (!err || typeof err !== "object") return false;
+  const graphql = err.graphql;
+  if (graphql?.hasData === true) return true;
+  return (graphql?.errors ?? []).some((e) => Array.isArray(e?.path) && e.path.length > 0);
+}
+function isUnknownTokenError(err, token) {
+  if (ranSomething(err)) return false;
+  return messagesOf(err).some((m) => m.includes(`"${token}"`) && UNKNOWN_PATTERN.test(m));
+}
+function isUnknownFeatureError(err, feature) {
+  return FEATURE_TOKENS[feature].some((token) => isUnknownTokenError(err, token));
+}
+async function withGatewayFeature(feature, request) {
+  if (!gatewayHas(feature)) return request(false);
+  try {
+    return await request(true);
+  } catch (err) {
+    if (!isUnknownFeatureError(err, feature)) throw err;
+    refused.add(feature);
+    if (!warned.has(feature) && typeof console !== "undefined") {
+      warned.add(feature);
+      console.warn(
+        `[Vio] the commerce gateway does not know "${FEATURE_TOKENS[feature][0]}" (${feature}) yet \u2014 sent without it on this page load:`,
+        messagesOf(err)[0] ?? ""
+      );
+    }
+    return request(false);
+  }
+}
+
 // src/core/api/cart-queries.ts
 var CREATE_CART_MUTATION = `
 mutation CreateCart($customerSessionId: String!, $currency: String!, $shippingCountry: String) {
@@ -674,10 +1149,10 @@ mutation DeleteItem($cartId: String!, $cartItemId: String!) {
   }
 }
 `;
-var UPDATE_ITEM_MUTATION = `
-mutation UpdateItem($cartId: String!, $cartItemId: String!, $shippingId: String, $qty: Int) {
+var updateItemMutation = (withExtra) => `
+mutation UpdateItem($cartId: String!, $cartItemId: String!, $shippingId: String, $qty: Int${withExtra ? ", $origin: CartLineOriginInput" : ""}) {
   Cart {
-    UpdateItem(cart_id: $cartId, cart_item_id: $cartItemId, shipping_id: $shippingId, qty: $qty) {
+    UpdateItem(cart_id: $cartId, cart_item_id: $cartItemId, shipping_id: $shippingId, qty: $qty${withExtra ? ", origin: $origin" : ""}) {
       cart_id
       customer_session_id
       shipping_country
@@ -746,6 +1221,8 @@ mutation UpdateItem($cartId: String!, $cartItemId: String!, $shippingId: String,
   }
 }
 `;
+var UPDATE_ITEM_MUTATION = updateItemMutation(false);
+var UPDATE_ITEM_WITH_ORIGIN_MUTATION = updateItemMutation(true);
 var GET_CART_QUERY = `
 query GetCart($cartId: String!) {
   Cart {
@@ -959,10 +1436,10 @@ mutation UpdateShippingsBySupplier($cartId: String!, $data: [DataUpdateShippings
   }
 }
 `;
-var CREATE_CHECKOUT_MUTATION = `
-mutation CreateCheckout($cartId: String!) {
+var createCheckoutMutation = (withExtra) => `
+mutation CreateCheckout($cartId: String!${withExtra ? ", $attribution: CheckoutAttributionInput" : ""}) {
   Checkout {
-    CreateCheckout(cart_id: $cartId) {
+    CreateCheckout(cart_id: $cartId${withExtra ? ", attribution: $attribution" : ""}) {
       buyer_accepts_purchase_conditions
       buyer_accepts_terms_conditions
       created_at
@@ -1091,10 +1568,12 @@ mutation CreateCheckout($cartId: String!) {
   }
 }
 `;
-var UPDATE_CHECKOUT_MUTATION = `
-mutation UpdateCheckout($checkoutId: String!, $status: String, $successUrl: String, $email: String, $cancelUrl: String, $paymentMethod: String, $shippingAddress: AddressArgs, $billingAddress: AddressArgs, $buyerAcceptsPurchaseConditions: Boolean, $buyerAcceptsTermsConditions: Boolean) {
+var CREATE_CHECKOUT_MUTATION = createCheckoutMutation(false);
+var CREATE_CHECKOUT_WITH_ATTRIBUTION_MUTATION = createCheckoutMutation(true);
+var updateCheckoutMutation = (withExtra) => `
+mutation UpdateCheckout($checkoutId: String!, $status: String, $successUrl: String, $email: String, $cancelUrl: String, $paymentMethod: String, $shippingAddress: AddressArgs, $billingAddress: AddressArgs, $buyerAcceptsPurchaseConditions: Boolean, $buyerAcceptsTermsConditions: Boolean${withExtra ? ", $attribution: CheckoutAttributionInput" : ""}) {
   Checkout {
-    UpdateCheckout(checkout_id: $checkoutId, status: $status, success_url: $successUrl, email: $email, cancel_url: $cancelUrl, payment_method: $paymentMethod, shipping_address: $shippingAddress, billing_address: $billingAddress, buyer_accepts_purchase_conditions: $buyerAcceptsPurchaseConditions, buyer_accepts_terms_conditions: $buyerAcceptsTermsConditions) {
+    UpdateCheckout(checkout_id: $checkoutId, status: $status, success_url: $successUrl, email: $email, cancel_url: $cancelUrl, payment_method: $paymentMethod, shipping_address: $shippingAddress, billing_address: $billingAddress, buyer_accepts_purchase_conditions: $buyerAcceptsPurchaseConditions, buyer_accepts_terms_conditions: $buyerAcceptsTermsConditions${withExtra ? ", attribution: $attribution" : ""}) {
       buyer_accepts_purchase_conditions
       buyer_accepts_terms_conditions
       created_at
@@ -1223,6 +1702,8 @@ mutation UpdateCheckout($checkoutId: String!, $status: String, $successUrl: Stri
   }
 }
 `;
+var UPDATE_CHECKOUT_MUTATION = updateCheckoutMutation(false);
+var UPDATE_CHECKOUT_WITH_ATTRIBUTION_MUTATION = updateCheckoutMutation(true);
 var GET_CHECKOUT_QUERY = `
 query GetCheckout($checkoutId: String!) {
   Checkout {
@@ -1445,7 +1926,9 @@ async function executeCartGraphQL(query, variables, options = {}) {
     const json = await Promise.race([res.json().catch(() => ({})), timedOut]);
     if (!res.ok || json.errors) {
       const errMsg = json.errors?.[0]?.message || `GraphQL request failed (HTTP ${res.status})`;
-      throw new Error(errMsg);
+      throw Object.assign(new Error(errMsg), {
+        graphql: { hasData: json.data !== void 0 && json.data !== null, errors: json.errors ?? [] }
+      });
     }
     return json;
   } finally {
@@ -1465,19 +1948,37 @@ async function createCart(customerSessionId, currency, shippingCountry, options)
   return json?.data?.Cart?.CreateCart;
 }
 async function addItem(cartId, lineItems, options) {
-  const json = await executeCartGraphQL(ADD_ITEM_MUTATION, { cartId, lineItems }, options);
+  const attributed = lineItems.some((li) => !!li?.origin);
+  const json = attributed ? await withGatewayFeature(
+    "line_origin",
+    (supported) => executeCartGraphQL(
+      ADD_ITEM_MUTATION,
+      { cartId, lineItems: supported ? lineItems : lineItems.map(withoutOrigin) },
+      options
+    )
+  ) : await executeCartGraphQL(ADD_ITEM_MUTATION, { cartId, lineItems }, options);
   return json?.data?.Cart?.AddItem;
 }
+function withoutOrigin(lineItem) {
+  if (!lineItem || typeof lineItem !== "object") return lineItem;
+  const { origin: _origin, ...rest } = lineItem;
+  return rest;
+}
 async function deleteItem(cartId, cartItemId, options) {
   const json = await executeCartGraphQL(DELETE_ITEM_MUTATION, { cartId, cartItemId }, options);
   return json?.data?.Cart?.DeleteItem;
 }
-async function updateItem(cartId, cartItemId, shippingId, qty, options) {
-  const json = await executeCartGraphQL(
-    UPDATE_ITEM_MUTATION,
-    { cartId, cartItemId, shippingId: shippingId || null, qty: qty != null ? qty : null },
-    options
-  );
+async function updateItem(cartId, cartItemId, shippingId, qty, options, extra = {}) {
+  const variables = { cartId, cartItemId, shippingId: shippingId || null, qty: qty != null ? qty : null };
+  const origin = extra.origin;
+  const json = origin ? await withGatewayFeature(
+    "line_origin",
+    (supported) => executeCartGraphQL(
+      supported ? UPDATE_ITEM_WITH_ORIGIN_MUTATION : UPDATE_ITEM_MUTATION,
+      supported ? { ...variables, origin } : variables,
+      options
+    )
+  ) : await executeCartGraphQL(UPDATE_ITEM_MUTATION, variables, options);
   return json?.data?.Cart?.UpdateItem;
 }
 async function getCart(cartId, options) {
@@ -1496,32 +1997,68 @@ async function updateShippingsBySupplier(cartId, data, options) {
   );
   return json?.data?.Cart?.UpdateShippingsBySupplier;
 }
-async function createCheckout(cartId, options) {
-  const json = await executeCartGraphQL(CREATE_CHECKOUT_MUTATION, { cartId }, options);
+async function createCheckout(cartId, options, extra = {}) {
+  const attribution = extra.attribution;
+  const json = attribution ? await withGatewayFeature(
+    "checkout_attribution",
+    (supported) => executeCartGraphQL(
+      supported ? CREATE_CHECKOUT_WITH_ATTRIBUTION_MUTATION : CREATE_CHECKOUT_MUTATION,
+      supported ? { cartId, attribution } : { cartId },
+      options
+    )
+  ) : await executeCartGraphQL(CREATE_CHECKOUT_MUTATION, { cartId }, options);
   return json?.data?.Checkout?.CreateCheckout;
 }
 async function updateCheckout(variables, options) {
-  const json = await executeCartGraphQL(UPDATE_CHECKOUT_MUTATION, variables, options);
+  const { attribution, ...legacy } = variables;
+  const json = attribution ? await withGatewayFeature(
+    "checkout_attribution",
+    (supported) => executeCartGraphQL(
+      supported ? UPDATE_CHECKOUT_WITH_ATTRIBUTION_MUTATION : UPDATE_CHECKOUT_MUTATION,
+      supported ? variables : legacy,
+      options
+    )
+  ) : await executeCartGraphQL(UPDATE_CHECKOUT_MUTATION, legacy, options);
   return json?.data?.Checkout?.UpdateCheckout;
 }
 async function getCheckout(checkoutId, options) {
   const json = await executeCartGraphQL(GET_CHECKOUT_QUERY, { checkoutId }, options);
   return json?.data?.Checkout?.GetCheckout;
 }
-var GET_CHECKOUT_ORDER_NUMBER_QUERY = `
+var BUYER_REF_FIELD = "buyer_ref";
+function gatewayHasBuyerRef() {
+  return gatewayHas("buyer_ref");
+}
+function withBuyerRef(request) {
+  return withGatewayFeature("buyer_ref", request);
+}
+var orderNumberQuery = (withRef) => `
 query GetCheckoutOrderNumber($checkoutId: String!) {
   Checkout {
     GetCheckout(checkout_id: $checkoutId) {
       id
-      order_id
+      order_id${withRef ? `
+      ${BUYER_REF_FIELD}` : ""}
     }
   }
 }
 `;
-async function getCheckoutOrderNumber(checkoutId, options) {
-  const json = await executeCartGraphQL(GET_CHECKOUT_ORDER_NUMBER_QUERY, { checkoutId }, options);
-  const n = Number(json?.data?.Checkout?.GetCheckout?.order_id);
-  return Number.isInteger(n) && n > 0 ? n : null;
+var GET_CHECKOUT_ORDER_NUMBER_QUERY = orderNumberQuery(true);
+var GET_CHECKOUT_ORDER_NUMBER_QUERY_LEGACY = orderNumberQuery(false);
+async function getCheckoutReference(checkoutId, options) {
+  const json = await withBuyerRef(
+    (withRef) => executeCartGraphQL(
+      withRef ? GET_CHECKOUT_ORDER_NUMBER_QUERY : GET_CHECKOUT_ORDER_NUMBER_QUERY_LEGACY,
+      { checkoutId },
+      options
+    )
+  );
+  const checkout = json?.data?.Checkout?.GetCheckout;
+  const n = Number(checkout?.order_id);
+  return {
+    orderNumber: Number.isInteger(n) && n > 0 ? n : null,
+    buyerRef: normalizeBuyerRef(checkout?.[BUYER_REF_FIELD]) ?? null
+  };
 }
 async function getAvailablePaymentMethods(options) {
   const json = await executeCartGraphQL(GET_AVAILABLE_PAYMENT_METHODS_QUERY, {}, options);
@@ -1555,18 +2092,27 @@ async function createPaymentApplePay(variables, options) {
   const json = await executeCartGraphQL(CREATE_PAYMENT_APPLE_PAY_MUTATION, variables, options);
   return json?.data?.Payment?.CreatePaymentApplePay;
 }
-var CONFIRM_PAYMENT_APPLE_PAY_MUTATION = `
+var confirmApplePayMutation = (withRef) => `
 mutation ConfirmPaymentApplePay($checkoutId: String!, $applePayToken: String!, $email: String, $shippingAddress: ApplePayAddressInput) {
   Payment {
     ConfirmPaymentApplePay(checkout_id: $checkoutId, apple_pay_token: $applePayToken, email: $email, shipping_address: $shippingAddress) {
       order_id
-      status
+      status${withRef ? `
+      ${BUYER_REF_FIELD}` : ""}
     }
   }
 }
 `;
+var CONFIRM_PAYMENT_APPLE_PAY_MUTATION = confirmApplePayMutation(true);
+var CONFIRM_PAYMENT_APPLE_PAY_MUTATION_LEGACY = confirmApplePayMutation(false);
 async function confirmPaymentApplePay(variables, options) {
-  const json = await executeCartGraphQL(CONFIRM_PAYMENT_APPLE_PAY_MUTATION, variables, options);
+  const json = await withBuyerRef(
+    (withRef) => executeCartGraphQL(
+      withRef ? CONFIRM_PAYMENT_APPLE_PAY_MUTATION : CONFIRM_PAYMENT_APPLE_PAY_MUTATION_LEGACY,
+      variables,
+      options
+    )
+  );
   return json?.data?.Payment?.ConfirmPaymentApplePay;
 }
 
@@ -1604,6 +2150,33 @@ async function getVippsStatus(variables, options) {
 
 // src/core/cart/cart-manager.ts
 var STORAGE_KEY = "vio.cart.v1";
+function finalTarget(sync) {
+  return sync.steps.reduce((quantity, step) => quantity + step.delta, sync.sent);
+}
+function queueStep(sync, target, origin) {
+  const delta = target - finalTarget(sync);
+  if (delta === 0) return;
+  if (delta > 0) {
+    const last = sync.steps[sync.steps.length - 1];
+    if (last && last.delta > 0 && sameOrigin(last.origin ?? {}, origin ?? {})) last.delta += delta;
+    else sync.steps.push({ delta, origin });
+    return;
+  }
+  let left = -delta;
+  while (left > 0 && sync.steps.length > 0) {
+    const last = sync.steps[sync.steps.length - 1];
+    if (last.delta <= 0) break;
+    const take = Math.min(last.delta, left);
+    last.delta -= take;
+    left -= take;
+    if (last.delta === 0) sync.steps.pop();
+  }
+  if (left > 0) {
+    const last = sync.steps[sync.steps.length - 1];
+    if (last && last.delta < 0) last.delta -= left;
+    else sync.steps.push({ delta: -left });
+  }
+}
 function lineId() {
   return "li_" + Math.random().toString(36).slice(2, 10) + Date.now().toString(36);
 }
@@ -1695,7 +2268,7 @@ var CartManager = class extends EventTarget {
    * undefined when no quantity sync is active for it. */
   intendedQuantity(sponsorId, cartItemId) {
     const sync = this.qtySyncs.get(this.qtySyncKey(sponsorId, cartItemId));
-    return sync ? sync.pending ?? sync.sent : void 0;
+    return sync ? finalTarget(sync) : void 0;
   }
   /** Apply a backend response only if no newer response was applied already.
    * Returns false when it was discarded as stale. */
@@ -1858,7 +2431,8 @@ var CartManager = class extends EventTarget {
           currency: li.price?.currency_code || backendCart.currency || matchedLocal?.currency || "NOK",
           imageUrl,
           quantity: intended ?? li.quantity,
-          // The server knows nothing about origins: keep the local ones. They
+          // The server keeps its own copy of the origins (per request); the
+          // cart read model does not answer them, so keep the local ones. They
           // are squared with its quantity (a stock clamp) only when no OTHER
           // mutation is in flight for this sponsor — an AddItem answering
           // while another is pending reports a quantity that is already old
@@ -1973,11 +2547,16 @@ var CartManager = class extends EventTarget {
         const cartId = await this.ensureCartId(opts.sponsorId, opts.currency || void 0);
         if (cartId) {
           const gqlOpts = await getCartGraphQLOptions(opts.sponsorId);
+          const origin = opts.origin ? lineOriginWire(normalizeOrigin(opts.origin), {
+            page: currentOriginPage(),
+            privacyMode: await currentPrivacyMode()
+          }) : void 0;
           const lineItemsInput = [
             {
               product_id: Number(opts.productId || 0),
               quantity: qty,
-              variant_id: opts.variantId != null ? Number(opts.variantId) : null
+              variant_id: opts.variantId != null ? Number(opts.variantId) : null,
+              ...origin ? { origin } : {}
             }
           ];
           const resCart = await addItem(cartId, lineItemsInput, gqlOpts);
@@ -2030,8 +2609,10 @@ var CartManager = class extends EventTarget {
     if (target === item.quantity) return;
     const targetItemId = item.cartItemId;
     const removedOrigin = latestOrigin(item);
-    if (target > item.quantity) addOriginQuantity(item, opts.origin, target - item.quantity);
+    const increase = target > item.quantity;
+    if (increase) addOriginQuantity(item, opts.origin, target - item.quantity);
     else removeOriginQuantity(item, item.quantity - target);
+    const addedOrigin = increase ? latestOrigin(item) : void 0;
     if (target <= 0) {
       cart.items = cart.items.filter((i) => i !== item);
       if (typeof document !== "undefined") {
@@ -2066,37 +2647,47 @@ var CartManager = class extends EventTarget {
       this.pendingQtyIntents.set(this.intentKey(item.productId, item.variantId), target);
       return;
     }
-    this.syncQuantity(sponsorId, cart.cartId, targetItemId, target);
+    this.syncQuantity(sponsorId, cart.cartId, targetItemId, target, addedOrigin);
   }
   /** Send a line's target quantity to the backend — ONE request in flight per
-   * line. A target that arrives while one is in flight replaces any earlier
-   * waiting one and goes out when the current request settles, so the server
-   * ends on the last intent and never sees two updates racing each other.
-   * While the sync is active the line keeps its optimistic quantity through
-   * any backend response (see `updateFromBackendCart`); a rejection drops
-   * what was queued and reconciles the cart from the server. */
-  syncQuantity(sponsorId, backendCartId, cartItemId, target) {
+   * line. Targets that arrive while one is in flight queue behind it as
+   * steps (`queueStep`): reduced like the line's origins, sent in order once
+   * the current request settles — one request per queued increase from a
+   * different origin, one for a net decrease — so the server ends on the
+   * last intent, credits every increase to its own origin, and never sees two
+   * updates racing each other. While the sync is active the line keeps its
+   * optimistic quantity through any backend response (see
+   * `updateFromBackendCart`); a rejection drops what was queued and
+   * reconciles the cart from the server. */
+  syncQuantity(sponsorId, backendCartId, cartItemId, target, origin) {
     const key = this.qtySyncKey(sponsorId, cartItemId);
     const active = this.qtySyncs.get(key);
     if (active) {
-      active.pending = target;
+      queueStep(active, target, origin);
       return;
     }
-    const sync = { sent: target };
+    const sync = { sent: target, steps: [] };
     this.qtySyncs.set(key, sync);
     let settling;
     const run = (async () => {
       let next = target;
+      let nextOrigin = origin;
       let removalRetried = false;
       while (next !== void 0) {
-        sync.sent = next;
-        sync.pending = void 0;
         const seq = this.nextSeq(sponsorId);
         try {
           const gqlOpts = await getCartGraphQLOptions(sponsorId);
-          const resCart = next <= 0 ? await deleteItem(backendCartId, cartItemId, gqlOpts) : await updateItem(backendCartId, cartItemId, null, next, gqlOpts);
-          next = sync.pending;
-          if (next === sync.sent) next = void 0;
+          const originWire = next > 0 && nextOrigin ? lineOriginWire(nextOrigin, { page: currentOriginPage(), privacyMode: await currentPrivacyMode() }) : void 0;
+          const resCart = next <= 0 ? await deleteItem(backendCartId, cartItemId, gqlOpts) : originWire ? await updateItem(backendCartId, cartItemId, null, next, gqlOpts, { origin: originWire }) : await updateItem(backendCartId, cartItemId, null, next, gqlOpts);
+          const step = sync.steps.shift();
+          if (step) {
+            next = sync.sent + step.delta;
+            nextOrigin = step.delta > 0 ? step.origin : void 0;
+            sync.sent = next;
+          } else {
+            next = void 0;
+            nextOrigin = void 0;
+          }
           if (next === void 0) this.qtySyncs.delete(key);
           if (resCart && Array.isArray(resCart.line_items)) {
             const applied = this.applyBackendCart(sponsorId, resCart, seq, settling);
@@ -2105,12 +2696,13 @@ var CartManager = class extends EventTarget {
             }
           }
         } catch (err) {
-          const retryRemoval = !removalRetried && sync.pending !== void 0 && sync.pending <= 0;
+          const retryRemoval = !removalRetried && sync.steps.length > 0 && finalTarget(sync) <= 0;
+          sync.steps = [];
           next = void 0;
+          nextOrigin = void 0;
           if (retryRemoval) {
             removalRetried = true;
             sync.sent = 0;
-            sync.pending = void 0;
             next = 0;
           } else {
             this.qtySyncs.delete(key);
@@ -2247,10 +2839,17 @@ function normalizeOrigin(origin) {
   if (origin.contentId !== void 0 && origin.contentId !== null && String(origin.contentId).trim()) {
     out.contentId = String(origin.contentId).trim();
   }
+  const kind = componentKindOf(origin.componentKind ?? origin.componentTemplateId);
+  if (kind) out.componentKind = kind;
+  const contentUrl = originAndPath(origin.contentUrl);
+  if (contentUrl) out.contentUrl = contentUrl;
+  if (typeof origin.contentTitle === "string" && origin.contentTitle.trim()) {
+    out.contentTitle = origin.contentTitle.trim().slice(0, CONTENT_TITLE_MAX_LENGTH);
+  }
   return out;
 }
 function sameOrigin(a, b) {
-  return a.campaignId === b.campaignId && a.slot === b.slot && a.contentId === b.contentId;
+  return a.campaignId === b.campaignId && a.slot === b.slot && a.contentId === b.contentId && a.componentKind === b.componentKind;
 }
 function latestOrigin(line) {
   const origins = Array.isArray(line.origins) ? line.origins : [];
@@ -2514,7 +3113,7 @@ async function prepareApplePay(config) {
 }
 
 // src/core/version.ts
-var SDK_VERSION = "0.23.1";
+var SDK_VERSION = "0.25.0";
 
 // src/core/checkout/payments/stripe-embedded.ts
 var CREATE_PAYMENT_INTENT_STRIPE_MUTATION = `
@@ -3822,13 +4421,14 @@ mutation CreatePaymentKlarnaNative($checkoutId: String!, $countryCode: String, $
   }
 }
 `;
-var CONFIRM_PAYMENT_KLARNA_NATIVE_MUTATION = `
+var confirmPaymentKlarnaNativeMutation = (withRef) => `
 mutation ConfirmPaymentKlarnaNative($checkoutId: String!, $authorizationToken: String!, $autoCapture: Boolean, $billingAddress: KlarnaNativeAddressInput, $shippingAddress: KlarnaNativeAddressInput, $customer: KlarnaNativeCustomerInput) {
   Payment {
     ConfirmPaymentKlarnaNative(checkout_id: $checkoutId, authorization_token: $authorizationToken, auto_capture: $autoCapture, billing_address: $billingAddress, shipping_address: $shippingAddress, customer: $customer) {
       order_id
       checkout_id
-      fraud_status
+      fraud_status${withRef ? `
+      ${BUYER_REF_FIELD}` : ""}
       order {
         order_id
         status
@@ -4010,9 +4610,10 @@ async function executeKlarnaGraphQL(query, variables, sponsorId) {
   return executeCartGraphQL(query, variables, await getCartGraphQLOptions(sponsorId));
 }
 var CheckoutManager = class _CheckoutManager extends EventTarget {
-  constructor(cartManager) {
+  constructor(cartManager, deps = {}) {
     super();
     this.cartManager = cartManager;
+    this.deps = deps;
     this.state = null;
     /** Counts `open()` calls — see CheckoutState.session. */
     this.sessionSeq = 0;
@@ -4052,6 +4653,8 @@ var CheckoutManager = class _CheckoutManager extends EventTarget {
     this.paymentMethodsCache = /* @__PURE__ */ new Map();
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     this.paymentMethodsPromises = /* @__PURE__ */ new Map();
+    /** In-flight `getOrderReference` per checkout id (see there). */
+    this.referenceInFlight = /* @__PURE__ */ new Map();
     this.kustomController = null;
     preloadStripeJs();
   }
@@ -4079,7 +4682,20 @@ var CheckoutManager = class _CheckoutManager extends EventTarget {
   }
   // MARK: - Backend checkout (Vio Commerce GraphQL)
   /* eslint-disable @typescript-eslint/no-explicit-any */
-  /** Create the backend checkout for the sponsor's cart (auto-accepts terms). */
+  /**
+   * The attribution of the order this sponsor's cart is about to become
+   * (ADR-0035 phase B), through the facade; `undefined` when there is none
+   * to give or it fails — attribution never costs a checkout.
+   */
+  async attributionFor(sponsorId) {
+    if (!sponsorId || typeof this.deps.orderAttribution !== "function") return void 0;
+    try {
+      return await this.deps.orderAttribution(sponsorId) ?? void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  /** Create the backend checkout for the sponsor's cart (auto-accepts terms); born attributed when the facade knows the attribution. */
   async createCheckout(sponsorId) {
     await this.cartManager.waitForCartMutations(sponsorId);
     const cart = this.cartManager.getCart(sponsorId);
@@ -4091,7 +4707,8 @@ var CheckoutManager = class _CheckoutManager extends EventTarget {
       }
     }
     const opts = await getCartGraphQLOptions(sponsorId);
-    const checkout = await createCheckout(cartId, opts);
+    const attribution = await this.attributionFor(sponsorId);
+    const checkout = attribution ? await createCheckout(cartId, opts, { attribution }) : await createCheckout(cartId, opts);
     if (checkout?.id) {
       this.state = {
         ...this.state ?? { sponsorId, subtotal: 0, currency: getGlobalCurrency() },
@@ -4122,12 +4739,15 @@ var CheckoutManager = class _CheckoutManager extends EventTarget {
     }
     return checkout;
   }
-  /** Update the backend checkout (terms are re-asserted unless overridden). */
+  /** Update the backend checkout (terms are re-asserted unless overridden; the attribution rides along unless the caller gives its own). */
   async updateCheckout(variables, sponsorId) {
-    const opts = await getCartGraphQLOptions(sponsorId ?? this.state?.sponsorId);
+    const spId = sponsorId ?? this.state?.sponsorId;
+    const opts = await getCartGraphQLOptions(spId);
+    const attribution = "attribution" in variables ? void 0 : await this.attributionFor(spId);
     const fullVars = {
       buyerAcceptsPurchaseConditions: true,
       buyerAcceptsTermsConditions: true,
+      ...attribution ? { attribution } : {},
       ...variables
     };
     const updated = await updateCheckout(fullVars, opts);
@@ -4147,13 +4767,30 @@ var CheckoutManager = class _CheckoutManager extends EventTarget {
    * receipt, and a receipt does not fail for it.
    */
   async getOrderNumber(checkoutId, sponsorId) {
-    if (!checkoutId) return null;
-    try {
-      const opts = await getCartGraphQLOptions(sponsorId ?? this.state?.sponsorId);
-      return await getCheckoutOrderNumber(checkoutId, opts);
-    } catch {
-      return null;
-    }
+    return (await this.getOrderReference(checkoutId, sponsorId)).orderNumber;
+  }
+  /**
+   * What a paid checkout says of itself: the order number (as above) and the
+   * buyer reference — shopcart's keyed hash of the buyer's email, what the
+   * `vio:payment-success` detail carries as `buyerRef` and analytics sends as
+   * `buyer_id`. Never throws; `null` for whatever the API does not say.
+   */
+  async getOrderReference(checkoutId, sponsorId) {
+    if (!checkoutId) return { orderNumber: null, buyerRef: null };
+    const inFlight = this.referenceInFlight.get(checkoutId);
+    if (inFlight) return inFlight;
+    const request = (async () => {
+      try {
+        const opts = await getCartGraphQLOptions(sponsorId ?? this.state?.sponsorId);
+        return await getCheckoutReference(checkoutId, opts);
+      } catch {
+        return { orderNumber: null, buyerRef: null };
+      } finally {
+        this.referenceInFlight.delete(checkoutId);
+      }
+    })();
+    this.referenceInFlight.set(checkoutId, request);
+    return request;
   }
   /**
    * Payment methods enabled for the sponsor (backend-configured). Memoised per
@@ -4284,9 +4921,10 @@ var CheckoutManager = class _CheckoutManager extends EventTarget {
       throw new Error(`[CheckoutManager] Failed to obtain cart_id for sponsor ${spId}`);
     }
     const opts = await getCartGraphQLOptions(spId);
+    const attribution = await this.attributionFor(spId);
     let checkoutId = this.state?.checkoutId;
     if (!checkoutId) {
-      const checkoutRes = await createCheckout(cartId, opts);
+      const checkoutRes = attribution ? await createCheckout(cartId, opts, { attribution }) : await createCheckout(cartId, opts);
       checkoutId = checkoutRes?.id;
     }
     if (!checkoutId) {
@@ -4305,6 +4943,7 @@ var CheckoutManager = class _CheckoutManager extends EventTarget {
       ...hasEmail ? { email: emailVal } : {},
       buyerAcceptsPurchaseConditions: true,
       buyerAcceptsTermsConditions: true,
+      ...attribution ? { attribution } : {},
       ...extraUpdateVars
     };
     if (addressObj) {
@@ -5300,7 +5939,8 @@ var CheckoutManager = class _CheckoutManager extends EventTarget {
           `[VioCheckout] Apple Pay confirmation failed (status: ${confirmRes?.status ?? "none"})`
         );
       }
-      return { orderId: confirmRes?.order_id, status: confirmRes?.status };
+      const buyerRef = normalizeBuyerRef(confirmRes?.[BUYER_REF_FIELD]);
+      return { orderId: confirmRes?.order_id, status: confirmRes?.status, ...buyerRef ? { buyerRef } : {} };
     };
   }
   static {
@@ -5803,16 +6443,19 @@ var CheckoutManager = class _CheckoutManager extends EventTarget {
         shippingAddress: buildKlarnaAddress(address),
         customer: buildKlarnaCustomer(address)
       };
-      const json = await executeKlarnaGraphQL(
-        CONFIRM_PAYMENT_KLARNA_NATIVE_MUTATION,
-        variables,
-        ctx?.sponsorId ?? this.state?.sponsorId
+      const json = await withBuyerRef(
+        (withRef) => executeKlarnaGraphQL(
+          confirmPaymentKlarnaNativeMutation(withRef),
+          variables,
+          ctx?.sponsorId ?? this.state?.sponsorId
+        )
       );
       const confirmRes = json?.data?.Payment?.ConfirmPaymentKlarnaNative;
       if (!confirmRes) {
         throw new Error("Klarna order confirmation failed: missing response data");
       }
       const orderData = confirmRes.order || confirmRes;
+      const buyerRef = normalizeBuyerRef(confirmRes[BUYER_REF_FIELD]);
       if (typeof sessionStorage !== "undefined") {
         sessionStorage.setItem("vio.klarna.confirmed.v1", authorizationToken);
         sessionStorage.removeItem(KLARNA_PENDING_KEY);
@@ -5830,7 +6473,8 @@ var CheckoutManager = class _CheckoutManager extends EventTarget {
             result: {
               ...result,
               order: orderData,
-              chargedTotal: typeof orderData?.order_amount === "number" ? orderData.order_amount / 100 : ctx.orderAmount / 100
+              chargedTotal: typeof orderData?.order_amount === "number" ? orderData.order_amount / 100 : ctx.orderAmount / 100,
+              ...buyerRef ? { buyerRef } : {}
             }
           }
         })
@@ -5883,220 +6527,177 @@ var CheckoutManager = class _CheckoutManager extends EventTarget {
   }
 };
 function toSmallestUnit(amount, currency) {
-  const zeroDecimal = /* @__PURE__ */ new Set(["JPY", "KRW", "VND"]);
-  if (zeroDecimal.has(currency.toUpperCase())) return Math.round(amount);
-  return Math.round(amount * 100);
-}
-
-// src/core/content.ts
-var CONTENT_ID_QUERY = "vio_content";
-var CONTENT_TITLE_QUERY = "vio_content_title";
-var CONTENT_ID_MAX_LENGTH = 128;
-var CONTENT_TITLE_MAX_LENGTH = 255;
-function resolveContent(init, doc = typeof document !== "undefined" ? document : null, loc = typeof location !== "undefined" ? location : null) {
-  try {
-    const query = parseQuery(loc?.search);
-    const id = fits(text(init?.contentId)) ?? fits(text(query.get(CONTENT_ID_QUERY))) ?? fits(text(meta(doc, "name", "vio:content-id"))) ?? fits(stripQueryAndHash(text(attr(doc, 'link[rel="canonical"]', "href")))) ?? fits(stripQueryAndHash(text(meta(doc, "property", "og:url")))) ?? fits(text(loc?.pathname));
-    const title = text(init?.contentTitle) ?? text(query.get(CONTENT_TITLE_QUERY)) ?? text(meta(doc, "name", "vio:content-title")) ?? text(meta(doc, "property", "og:title")) ?? text(doc?.title);
-    const out = {};
-    if (id !== void 0) out.id = id;
-    if (title !== void 0) out.title = title.slice(0, CONTENT_TITLE_MAX_LENGTH);
-    return out;
-  } catch {
-    return {};
-  }
-}
-function fits(value) {
-  return value !== void 0 && value.length <= CONTENT_ID_MAX_LENGTH ? value : void 0;
-}
-function text(value) {
-  if (value === void 0 || value === null) return void 0;
-  const s = String(value).trim();
-  return s ? s : void 0;
-}
-function parseQuery(search) {
-  try {
-    return new URLSearchParams(typeof search === "string" ? search : "");
-  } catch {
-    return new URLSearchParams();
-  }
-}
-function meta(doc, key, value) {
-  return attr(doc, `meta[${key}="${value}"]`, "content");
-}
-function attr(doc, selector, name) {
-  try {
-    if (!doc || typeof doc.querySelector !== "function") return void 0;
-    const el = doc.querySelector(selector);
-    const v = el?.getAttribute?.(name);
-    return typeof v === "string" ? v : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function stripQueryAndHash(url) {
-  if (!url) return void 0;
-  const cut = url.search(/[?#]/);
-  const clean = cut >= 0 ? url.slice(0, cut) : url;
-  return clean.trim() || void 0;
-}
-
-// src/core/slots.ts
-var SLOT_ID_MAX_LENGTH = 100;
-var SLOT_DECLARATION_TTL_MS = 24 * 60 * 60 * 1e3;
-var SLOT_DECLARATION_FAILURE_TTL_MS = 60 * 60 * 1e3;
-var MAX_LOCATIONS_PER_DECLARATION = 100;
-var MAX_DECLARATIONS_PER_LOAD = 3;
-function resolveSlotCampaign(boot, slot, now = Date.now(), platform) {
-  if (!boot) return null;
-  return findSlotAssignment(boot, slot, now, platform) ?? defaultCampaignEntry(boot);
-}
-function findSlotAssignment(boot, slot, now = Date.now(), platform) {
-  const name = typeof slot === "string" ? slot.trim() : "";
-  if (!boot || !name) return null;
-  try {
-    const matches = activeCampaigns(boot).filter(
-      (c) => slotsOf(c).some((s) => assignmentMatches(s, name, now, platform))
-    );
-    if (matches.length === 0) return null;
-    const defaultId = toNumber(boot.campaign?.id);
-    return matches.find((c) => toNumber(c.id) === defaultId) ?? matches[0] ?? null;
-  } catch {
-    return null;
-  }
-}
-function defaultCampaignEntry(boot) {
-  if (!boot?.campaign || typeof boot.campaign !== "object") return null;
-  const defaultId = toNumber(boot.campaign.id);
-  if (defaultId === void 0) return null;
-  try {
-    const listed = wellFormedCampaigns(boot).find((c) => toNumber(c.id) === defaultId);
-    if (listed) return listed;
-  } catch {
-  }
+  const zeroDecimal = /* @__PURE__ */ new Set(["JPY", "KRW", "VND"]);
+  if (zeroDecimal.has(currency.toUpperCase())) return Math.round(amount);
+  return Math.round(amount * 100);
+}
+
+// src/core/analytics/client-context.ts
+var UTM_KEYS = ["utm_source", "utm_medium", "utm_campaign", "utm_term", "utm_content"];
+var CLIENT_LANGUAGE_MAX_LENGTH = 16;
+var CLIENT_REFERRER_MAX_LENGTH = 2048;
+var CLIENT_UTM_MAX_LENGTH = 128;
+var CLIENT_TZ_MAX_LENGTH = 64;
+var CLIENT_SCREEN_MAX = 65535;
+var CLIENT_LANDING_URL_MAX_LENGTH = 2048;
+var LANDING_KEY = "vio.landing.v1";
+function defaultClientEnvironment() {
   return {
-    ...boot.campaign,
-    isDefault: true,
-    primarySponsor: boot.primarySponsor ?? null,
-    secondarySponsors: Array.isArray(boot.secondarySponsors) ? boot.secondarySponsors : [],
-    slots: []
+    navigator: typeof navigator !== "undefined" ? navigator : null,
+    document: typeof document !== "undefined" ? document : null,
+    location: typeof location !== "undefined" ? location : null,
+    screen: typeof screen !== "undefined" ? screen : null,
+    storage: sessionStorageOrNull(),
+    timeZone: () => Intl.DateTimeFormat().resolvedOptions().timeZone
   };
 }
-function wellFormedCampaigns(boot) {
-  const list = Array.isArray(boot.campaigns) ? boot.campaigns : [];
-  return list.filter((c) => !!c && typeof c === "object");
+function resolveLanding(env = defaultClientEnvironment(), persist = true) {
+  try {
+    const utm = utmOf(env.location?.search);
+    const raw = text2(env.document?.referrer);
+    const internal = isSameHost(raw, env.location?.host);
+    const stored = readLanding(env.storage);
+    if ((utm === void 0 || internal) && stored) return stored;
+    const landing = {};
+    const referrer = internal ? void 0 : landingReferrer(raw);
+    if (referrer) landing.referrer = referrer;
+    if (utm) landing.utm = utm;
+    const url = landingUrl(env.location?.href);
+    if (url) landing.url = url;
+    if (persist) writeLanding(env.storage, landing);
+    return landing;
+  } catch {
+    return {};
+  }
 }
-function activeCampaigns(boot) {
-  return wellFormedCampaigns(boot).filter((c) => c.status === "active");
+function landingReferrer(raw) {
+  return originAndPath(raw, CLIENT_REFERRER_MAX_LENGTH);
 }
-function slotsOf(campaign) {
-  const slots = Array.isArray(campaign.slots) ? campaign.slots : [];
-  return slots.filter((s) => !!s && typeof s === "object");
+function landingUrl(raw) {
+  return originAndPath(raw, CLIENT_LANDING_URL_MAX_LENGTH);
 }
-function assignmentMatches(s, name, now, platform) {
-  if (typeof s.name !== "string" || s.name.trim() !== name) return false;
-  if (platform && s.platform != null && s.platform !== platform) return false;
-  const start = parseTime(s.startDate);
-  if (start !== void 0 && start > now) return false;
-  const end = parseTime(s.endDate);
-  if (end !== void 0 && now >= end) return false;
-  return true;
+function storedLanding(storage2 = defaultClientEnvironment().storage) {
+  return readLanding(storage2);
 }
-function parseTime(value) {
-  if (value == null || value === "") return void 0;
-  const t = Date.parse(String(value));
-  return Number.isFinite(t) ? t : void 0;
+function isSameHost(referrer, host) {
+  const value = text2(referrer);
+  const own = text2(host);
+  if (!value || !own) return false;
+  try {
+    return new URL(value).host.toLowerCase() === own.toLowerCase();
+  } catch {
+    return false;
+  }
 }
-function toNumber(value) {
-  if (value === void 0 || value === null || value === "") return void 0;
-  const n = Number(value);
-  return Number.isFinite(n) ? n : void 0;
+function persistLanding(landing, storage2 = defaultClientEnvironment().storage) {
+  writeLanding(storage2, landing);
 }
-function normalizeSlotId(value) {
-  if (typeof value !== "string") return "";
-  return value.trim().slice(0, SLOT_ID_MAX_LENGTH).trim();
+function removeLanding(storage2 = defaultClientEnvironment().storage) {
+  try {
+    storage2?.removeItem?.(LANDING_KEY);
+  } catch {
+  }
 }
-function normalizeSlotLocations(slots) {
-  const out = [];
-  const seen = /* @__PURE__ */ new Set();
-  if (!Array.isArray(slots)) return out;
-  for (const raw of slots) {
-    const id = normalizeSlotId(typeof raw === "string" ? raw : raw?.id);
-    if (!id || seen.has(id)) continue;
-    seen.add(id);
-    const displayName = raw && typeof raw === "object" && typeof raw.displayName === "string" ? raw.displayName.trim() : "";
-    out.push(displayName ? { id, displayName } : { id });
+function resolveClientContext(env = defaultClientEnvironment(), landing = resolveLanding(env)) {
+  const out = {};
+  try {
+    const language = cut2(text2(env.navigator?.language), CLIENT_LANGUAGE_MAX_LENGTH);
+    if (language) out.language = language;
+    const referrer = cut2(landing.referrer, CLIENT_REFERRER_MAX_LENGTH);
+    if (referrer) out.referrer = referrer;
+    for (const key of UTM_KEYS) {
+      const value = cut2(landing.utm?.[key], CLIENT_UTM_MAX_LENGTH);
+      if (value) out[key] = value;
+    }
+    const w = dimension(env.screen?.width);
+    const h = dimension(env.screen?.height);
+    if (w !== void 0) out.screen_w = w;
+    if (h !== void 0) out.screen_h = h;
+    const tz = cut2(text2(safeCall(env.timeZone)), CLIENT_TZ_MAX_LENGTH);
+    if (tz) out.tz = tz;
+  } catch {
   }
   return out;
 }
-function autoSlotId(kind, ordinal, scope) {
-  const tail = `${kind}-${ordinal + 1}`;
-  let prefix = normalizeScope(scope);
-  const room = SLOT_ID_MAX_LENGTH - tail.length - 1;
-  if (prefix.length > room) prefix = prefix.slice(0, Math.max(0, room)).replace(/-+$/, "");
-  return `${prefix ? `${prefix}-` : ""}${tail}`;
-}
-function autoSlotDisplayName(kind, ordinal, scopeName) {
-  const label = `${kind.charAt(0).toUpperCase()}${kind.slice(1)} ${ordinal + 1}`;
-  const name = typeof scopeName === "string" ? scopeName.trim() : "";
-  return name ? `${label} \xB7 ${name}` : label;
-}
-function normalizeScope(scope) {
-  if (typeof scope !== "string") return "";
-  return scope.trim().replace(/\s+/g, "-");
-}
-var SLOT_DECLARATION_MEMORY_CAP = 500;
-function slotDeclarationKey(location2) {
-  return location2.displayName ? `${location2.id}${location2.displayName}` : location2.id;
-}
-function pendingSlotKeys(memory, keys, now = Date.now(), ttl = SLOT_DECLARATION_TTL_MS) {
-  return keys.filter((key) => {
-    const at = memory?.[key];
-    if (typeof at !== "number" || !Number.isFinite(at)) return true;
-    return now - at >= ttl || now < at;
-  });
-}
-function rememberSlotKeys(memory, keys, at, cap = SLOT_DECLARATION_MEMORY_CAP) {
-  const next = { ...memory ?? {} };
-  for (const key of keys) next[key] = at;
-  const entries = Object.entries(next);
-  if (entries.length <= cap) return next;
-  entries.sort((a, b) => b[1] - a[1]);
-  return Object.fromEntries(entries.slice(0, cap));
-}
-function slotDeclarationStorageKey(platform, apiKey) {
-  return `vio.slots.${platform}.${fnv1a(apiKey)}`;
-}
-function fnv1a(input) {
-  let hash = 2166136261;
-  for (let i = 0; i < input.length; i++) {
-    hash ^= input.charCodeAt(i);
-    hash = Math.imul(hash, 16777619) >>> 0;
+function utmOf(search) {
+  let params;
+  try {
+    params = new URLSearchParams(typeof search === "string" ? search : "");
+  } catch {
+    return void 0;
   }
-  return hash.toString(16).padStart(8, "0");
+  const out = {};
+  let any = false;
+  for (const key of UTM_KEYS) {
+    const value = cut2(text2(params.get(key)), CLIENT_UTM_MAX_LENGTH);
+    if (value) {
+      out[key] = value;
+      any = true;
+    }
+  }
+  return any ? out : void 0;
 }
-function readSlotDeclaration(storageKey) {
+function readLanding(storage2) {
   try {
-    if (typeof localStorage === "undefined") return {};
-    const raw = localStorage.getItem(storageKey);
-    if (!raw) return {};
+    const raw = storage2?.getItem(LANDING_KEY);
+    if (!raw) return null;
     const parsed = JSON.parse(raw);
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
-    if (Array.isArray(parsed.keys)) return {};
-    const out = {};
-    for (const [key, at] of Object.entries(parsed)) {
-      if (typeof at === "number" && Number.isFinite(at)) out[key] = at;
+    if (!parsed || typeof parsed !== "object") return null;
+    const p = parsed;
+    const landing = {};
+    const referrer = cut2(text2(p.referrer), CLIENT_REFERRER_MAX_LENGTH);
+    if (referrer) landing.referrer = referrer;
+    const url = cut2(text2(p.url), CLIENT_LANDING_URL_MAX_LENGTH);
+    if (url) landing.url = url;
+    if (p.utm && typeof p.utm === "object") {
+      const utm = {};
+      let any = false;
+      for (const key of UTM_KEYS) {
+        const value = cut2(text2(p.utm[key]), CLIENT_UTM_MAX_LENGTH);
+        if (value) {
+          utm[key] = value;
+          any = true;
+        }
+      }
+      if (any) landing.utm = utm;
     }
-    return out;
+    return landing;
   } catch {
-    return {};
+    return null;
   }
 }
-function writeSlotDeclaration(storageKey, memory) {
+function writeLanding(storage2, landing) {
   try {
-    if (typeof localStorage === "undefined") return;
-    localStorage.setItem(storageKey, JSON.stringify(memory));
+    storage2?.setItem(LANDING_KEY, JSON.stringify(landing));
+  } catch {
+  }
+}
+function sessionStorageOrNull() {
+  try {
+    return typeof sessionStorage !== "undefined" && sessionStorage ? sessionStorage : null;
+  } catch {
+    return null;
+  }
+}
+function text2(value) {
+  if (value === void 0 || value === null) return void 0;
+  const s = String(value).trim();
+  return s ? s : void 0;
+}
+function cut2(value, max) {
+  if (value === void 0) return void 0;
+  return value.length > max ? value.slice(0, max) : value;
+}
+function dimension(value) {
+  const n = typeof value === "number" ? value : Number(value);
+  if (!Number.isFinite(n) || n < 0) return void 0;
+  return Math.min(Math.floor(n), CLIENT_SCREEN_MAX);
+}
+function safeCall(fn) {
+  try {
+    return fn ? fn() : void 0;
   } catch {
+    return void 0;
   }
 }
 
@@ -6198,8 +6799,16 @@ var AnalyticsManager = class extends EventTarget {
     /** Last NON-EMPTY cart snapshot — `purchase` uses it because several flows
      * (Apple Pay) clear the cart BEFORE `vio:payment-success` fires. */
     this.lastCartSnapshot = null;
+    /** The `client` block (language, landing referrer / utm, screen, tz): read once per page load, reused on every event. */
+    this.client = null;
+    /** The landing it was read from — persisted later when consent arrives after the first event. */
+    this.landing = null;
     this.teardown = [];
   }
+  /** The landing this manager resolved on this page load (the first event's), or null before it; read only — for the order's entry context when nothing is stored yet. */
+  get currentLanding() {
+    return this.landing;
+  }
   // MARK: - Public API
   /**
    * Install listeners + begin flushing. Explicit on purpose (no module
@@ -6217,10 +6826,12 @@ var AnalyticsManager = class extends EventTarget {
     if (granted) {
       if (this.anonIdCache) safeStorageSet(ANON_KEY, this.anonIdCache);
       if (this.sessionId) this.persistSession();
+      if (this.landing) persistLanding(this.landing);
       return;
     }
     safeStorageRemove(ANON_KEY);
     safeStorageRemove(SESSION_KEY);
+    removeLanding();
   }
   /** ¿Podemos escribir en el dispositivo? */
   get canPersist() {
@@ -6381,7 +6992,7 @@ var AnalyticsManager = class extends EventTarget {
       // one is usually the tracking tail, not the page. The other host-given
       // fields (broadcastId, componentTemplateId, errorCode, variant, …) are
       // the host's responsibility: the SDK does not touch them.
-      content_url: capUrl(ctx.contentUrl ?? (typeof location !== "undefined" ? location.href : void 0)),
+      content_url: capContentUrl(ctx.contentUrl ?? (typeof location !== "undefined" ? location.href : void 0)),
       // The host's own content id — its join key back onto its reporting.
       // Explicit on the event when it fits, else what the SDK resolved for
       // the page (already capped per source), else nothing.
@@ -6409,8 +7020,13 @@ var AnalyticsManager = class extends EventTarget {
       value: com.value,
       currency: com.currency,
       order_id: com.orderId,
-      payment_method: com.paymentMethod
+      payment_method: com.paymentMethod,
+      // Only a reference survives — never an email, whatever a host passes —
+      // and only with consent to persist: a visit measured with ephemeral
+      // ids does not carry a stable identifier of a person either.
+      buyer_id: this.canPersist ? normalizeBuyerRef(com.buyerId) : void 0
     }) : void 0;
+    const client = this.clientBlock();
     return {
       event_id: uuid(),
       name,
@@ -6423,9 +7039,22 @@ var AnalyticsManager = class extends EventTarget {
       ...this.externalUserId ? { external_user_id: this.externalUserId } : {},
       ...Object.keys(context).length ? { context } : {},
       ...commerce ? { commerce } : {},
+      ...client ? { client } : {},
       ...opts.props ? { props: opts.props } : {}
     };
   }
+  /**
+   * The `client` block: read once — the landing is remembered for the session
+   * only when we may persist — then the same (frozen) object on every event.
+   * `null` when there is nothing to say (no browser).
+   */
+  clientBlock() {
+    if (!this.client) {
+      this.landing = resolveLanding(void 0, this.canPersist);
+      this.client = Object.freeze(resolveClientContext(void 0, this.landing));
+    }
+    return Object.keys(this.client).length ? this.client : null;
+  }
   /** Guarda la sesión solo si podemos escribir en el dispositivo. */
   persistSession(now = Date.now()) {
     if (!this.canPersist || !this.sessionId) return;
@@ -6539,7 +7168,7 @@ var AnalyticsManager = class extends EventTarget {
       const d = ev.detail ?? {};
       const line = this.findLine(d.productId, d.variantId);
       this.track("add_to_cart", {
-        context: { sponsorId: d.sponsorId !== void 0 ? Number(d.sponsorId) : void 0, campaignId: campaignOf(d), slot: slotOf(d), ...contentOf(d) },
+        context: { sponsorId: d.sponsorId !== void 0 ? Number(d.sponsorId) : void 0, campaignId: campaignOf(d), slot: slotOf(d), componentTemplateId: templateOf(d), ...contentOf(d) },
         commerce: {
           items: [
             {
@@ -6589,7 +7218,7 @@ var AnalyticsManager = class extends EventTarget {
       if (d.productId === void 0) return;
       const price = Number(d.price);
       this.track("select_item", {
-        context: { sponsorId: d.sponsorId !== void 0 ? Number(d.sponsorId) : void 0, campaignId: campaignOf(d), slot: slotOf(d), ...contentOf(d) },
+        context: { sponsorId: d.sponsorId !== void 0 ? Number(d.sponsorId) : void 0, campaignId: campaignOf(d), slot: slotOf(d), componentTemplateId: templateOf(d), ...contentOf(d) },
         commerce: {
           items: [
             {
@@ -6608,13 +7237,15 @@ var AnalyticsManager = class extends EventTarget {
     });
     on("vio:checkout-open", (ev) => {
       const d = ev.detail ?? {};
-      const base = { sponsorId: d.sponsorId, campaignId: campaignOf(d), slot: slotOf(d), ...contentOf(d) };
+      const base = { sponsorId: d.sponsorId, campaignId: campaignOf(d), slot: slotOf(d), componentTemplateId: templateOf(d), ...contentOf(d) };
+      const buyerId = buyerRefOf(d);
+      const buyer = buyerId !== void 0 ? { buyerId } : {};
       const { slices, explicit } = this.cartSlices(d.sponsorId);
       if (slices.length > 1) {
         for (const slice of slices) {
           this.track("begin_checkout", {
             context: this.sliceContext(slice, base),
-            commerce: sliceCommerce(slice),
+            commerce: { ...sliceCommerce(slice), ...buyer },
             props: { slice: slice.slice, slices: slice.slices }
           });
         }
@@ -6623,7 +7254,7 @@ var AnalyticsManager = class extends EventTarget {
       const snap = this.cartCommerce(d.sponsorId);
       this.track("begin_checkout", {
         context: this.singleSliceContext(slices[0], explicit, base),
-        ...snap ? { commerce: snap } : {}
+        ...snap || buyerId !== void 0 ? { commerce: { ...snap ?? {}, ...buyer } } : {}
       });
     });
     on("vio:payment-success", (ev) => {
@@ -6817,27 +7448,27 @@ function vioCart() {
     return null;
   }
 }
-function resolveCampaignId(ctx, boot) {
+function resolveCampaignId(ctx, boot, opts = {}) {
   if (ctx.campaignId !== void 0) return ctx.campaignId;
   const defaultId = boot?.campaign?.id;
+  const config = Configuration.isInitialized ? Configuration.get() : void 0;
+  const sponsorId = toNumber(ctx.sponsorId);
+  const candidates = [
+    ...Array.isArray(opts.pageCampaignId) ? opts.pageCampaignId : [opts.pageCampaignId],
+    config?.campaignId
+  ];
+  const page = activeCampaignEntry(boot, candidates, sponsorId);
   if (ctx.slot) {
-    const platform = Configuration.isInitialized ? Configuration.get().platform : void 0;
-    const assigned = toNumber(findSlotAssignment(boot, ctx.slot, Date.now(), platform)?.id);
-    if (assigned !== void 0) return assigned;
+    const assignment = findSlotAssignmentDetail(boot, ctx.slot, Date.now(), config?.platform);
+    if (assignment && assignmentApplies(assignment, activeCampaignEntry(boot, candidates), sponsorId)) {
+      const assigned = toNumber(assignment.campaign.id);
+      if (assigned !== void 0) return assigned;
+    }
   }
-  const sponsorId = toNumber(ctx.sponsorId);
+  const pageId = toNumber(page?.id);
+  if (pageId !== void 0) return pageId;
   if (sponsorId === void 0) return defaultId;
-  try {
-    const campaigns = Array.isArray(boot?.campaigns) ? boot.campaigns : [];
-    const matches = campaigns.filter(
-      (c) => !!c && typeof c === "object" && c.status === "active" && campaignSponsorIds(c).includes(sponsorId)
-    );
-    const chosen = matches.find((c) => c.id === defaultId) ?? matches[0];
-    const chosenId = toNumber(chosen?.id);
-    if (chosenId !== void 0) return chosenId;
-  } catch {
-  }
-  return defaultId;
+  return toNumber(sponsorCampaignEntry(boot, sponsorId)?.id) ?? defaultId;
 }
 function campaignOf(detail) {
   return toNumber(detail.campaignId);
@@ -6851,20 +7482,16 @@ function capTitle(value) {
   if (!value) return void 0;
   return value.length > CONTENT_TITLE_MAX_LENGTH ? value.slice(0, CONTENT_TITLE_MAX_LENGTH) : value;
 }
-var CONTENT_URL_MAX_LENGTH = 2048;
-function capUrl(value) {
-  if (!value) return void 0;
-  if (value.length <= CONTENT_URL_MAX_LENGTH) return value;
-  const cut = value.search(/[?#]/);
-  const withoutQuery = cut >= 0 ? value.slice(0, cut) : value;
-  return withoutQuery.length <= CONTENT_URL_MAX_LENGTH ? withoutQuery : withoutQuery.slice(0, CONTENT_URL_MAX_LENGTH);
-}
 function sliceCommerce(slice) {
   return { items: slice.items, value: slice.value, currency: slice.currency };
 }
 function slotOf(detail) {
   return typeof detail.slot === "string" && detail.slot.trim() ? detail.slot.trim() : void 0;
 }
+function templateOf(detail) {
+  const value = typeof detail.componentTemplateId === "string" ? detail.componentTemplateId.trim() : "";
+  return fitsId(value || void 0);
+}
 function contentOf(detail) {
   const out = {};
   if (typeof detail.contentId === "number" && Number.isFinite(detail.contentId)) out.contentId = detail.contentId;
@@ -6872,21 +7499,33 @@ function contentOf(detail) {
   if (typeof detail.contentTitle === "string" && detail.contentTitle.trim()) out.contentTitle = detail.contentTitle.trim();
   return out;
 }
-function campaignSponsorIds(campaign) {
-  const ids = [];
-  const primary = toNumber(campaign.primarySponsor?.id);
-  if (primary !== void 0) ids.push(primary);
-  const secondaries = Array.isArray(campaign.secondarySponsors) ? campaign.secondarySponsors : [];
-  for (const s of secondaries) {
-    const id = toNumber(s?.id);
-    if (id !== void 0) ids.push(id);
+function buyerRefOf(d) {
+  if (!d) return void 0;
+  const r = d.result ?? {};
+  const candidates = [
+    d.buyerRef,
+    d.buyer_ref,
+    r.buyerRef,
+    r.buyer_ref,
+    r.confirmation?.buyerRef,
+    r.confirmation?.buyer_ref,
+    r.checkout?.buyerRef,
+    r.checkout?.buyer_ref
+  ];
+  for (const candidate of candidates) {
+    const ref = normalizeBuyerRef(candidate);
+    if (ref) return ref;
   }
-  return ids;
+  return void 0;
 }
 function purchaseFromPaymentSuccess(d) {
   const r = d.result ?? {};
   const orderId = firstId(d.orderId, r.confirmation?.orderId, d.checkoutId);
-  return orderId !== void 0 ? { orderId } : {};
+  const buyerId = buyerRefOf(d);
+  return {
+    ...orderId !== void 0 ? { orderId } : {},
+    ...buyerId !== void 0 ? { buyerId } : {}
+  };
 }
 function firstId(...candidates) {
   for (const c of candidates) {
@@ -6931,8 +7570,87 @@ function pushGa4(event) {
   });
 }
 
+// src/core/checkout/attribution.ts
+var CHECKOUT_ATTRIBUTION_CAPS = Object.freeze({
+  surfaceKey: 255,
+  contentUrl: 2048,
+  contentTitle: CONTENT_TITLE_MAX_LENGTH,
+  referrer: CLIENT_REFERRER_MAX_LENGTH,
+  utm: CLIENT_UTM_MAX_LENGTH,
+  landingUrl: CLIENT_LANDING_URL_MAX_LENGTH
+});
+function checkoutAttributionOf(input) {
+  const out = {};
+  const surfaceKey = cut3(input.surfaceKey, CHECKOUT_ATTRIBUTION_CAPS.surfaceKey);
+  if (surfaceKey) out.surface_key = surfaceKey;
+  const campaignId = positiveInt(input.pageCampaignId) ?? dominantCampaignOf(input.slices);
+  if (campaignId !== void 0) out.campaign_id = campaignId;
+  if (input.privacyMode === "standard") {
+    const url = originAndPath(input.content?.url, CHECKOUT_ATTRIBUTION_CAPS.contentUrl);
+    if (url) out.content_url = url;
+    const title = cut3(input.content?.title, CHECKOUT_ATTRIBUTION_CAPS.contentTitle);
+    if (title) out.content_title = title;
+    const entry = entryContextOf(input.landing);
+    if (entry) out.entry = entry;
+  }
+  return Object.keys(out).length ? out : void 0;
+}
+function entryContextOf(landing) {
+  if (!landing || typeof landing !== "object") return void 0;
+  const out = {};
+  const referrer = cut3(landing.referrer, CHECKOUT_ATTRIBUTION_CAPS.referrer);
+  if (referrer) out.referrer = referrer;
+  const source = cut3(landing.utm?.utm_source, CHECKOUT_ATTRIBUTION_CAPS.utm);
+  if (source) out.utm_source = source;
+  const medium = cut3(landing.utm?.utm_medium, CHECKOUT_ATTRIBUTION_CAPS.utm);
+  if (medium) out.utm_medium = medium;
+  const campaign = cut3(landing.utm?.utm_campaign, CHECKOUT_ATTRIBUTION_CAPS.utm);
+  if (campaign) out.utm_campaign = campaign;
+  const landingUrl2 = cut3(landing.url, CHECKOUT_ATTRIBUTION_CAPS.landingUrl);
+  if (landingUrl2) out.landing_url = landingUrl2;
+  return Object.keys(out).length ? out : void 0;
+}
+function dominantCampaignOf(slices) {
+  if (!Array.isArray(slices)) return void 0;
+  let best;
+  for (const slice of slices) {
+    const campaignId = positiveInt(slice?.campaignId);
+    if (campaignId === void 0) continue;
+    const items = Array.isArray(slice.items) ? slice.items : [];
+    const units = items.reduce((sum, item) => sum + (Number(item?.quantity) > 0 ? Number(item.quantity) : 0), 0);
+    const value = Number(slice.value) || 0;
+    if (!best || units > best.units || units === best.units && value > best.value) {
+      best = { campaignId, units, value };
+    }
+  }
+  return best?.campaignId;
+}
+function positiveInt(value) {
+  if (value === void 0 || value === null || value === "") return void 0;
+  const n = Number(value);
+  return Number.isInteger(n) && n > 0 && n <= GRAPHQL_INT_MAX ? n : void 0;
+}
+function cut3(value, max) {
+  if (typeof value !== "string" && typeof value !== "number") return void 0;
+  const text3 = String(value).trim();
+  if (!text3) return void 0;
+  return text3.length > max ? text3.slice(0, max).trim() || void 0 : text3;
+}
+
 // src/core/client.ts
 var SLOT_DECLARATION_DEBOUNCE_MS = 1e3;
+var PRIVACY_MODE_TIMEOUT_MS = 1500;
+var PRIVACY_UNKNOWN_TTL_MS = 6e4;
+function privacyModeOf(value) {
+  return value === "minimal" || value === "standard" ? value : void 0;
+}
+function privacyModeOfSurface(res) {
+  const surface = res?.surface;
+  if (!surface || typeof surface !== "object") return "unknown";
+  const raw = surface.privacyMode;
+  if (raw === void 0 || raw === null) return "standard";
+  return privacyModeOf(raw) ?? "unknown";
+}
 var VioFacade = class {
   constructor() {
     this.apiInstance = null;
@@ -6946,8 +7664,11 @@ var VioFacade = class {
      * (another key or environment) is still in flight after a re-init; its answer
      * belongs to that configuration and must not land in this one. */
     this.generation = 0;
-    /** Slot ids present on the page (`Vio.registerSlot`): how many elements hold each + its display name. */
+    /** Slot ids present on the page (`Vio.registerSlot`): how many elements hold each, its display name, its own campaign and its kind. */
     this.slotRegistry = /* @__PURE__ */ new Map();
+    /** Slots already warned about (`dashboard`: the dashboard's assignment stands; `replaced`: this page moved it). */
+    this.warnedDashboardSlots = /* @__PURE__ */ new Set();
+    this.warnedReplacedSlots = /* @__PURE__ */ new Set();
     /** Pending debounced declaration of the registry. */
     this.slotDeclareTimer = null;
     /** A name appeared (or the key changed) since the registry was last declared. */
@@ -6962,6 +7683,10 @@ var VioFacade = class {
     this.cartManager = null;
     this.checkoutManager = null;
     this.analyticsManager = null;
+    /** What the surface answered of its privacy mode (`GET /v2/mobile/surface`) and when; `unknown` expires after a minute. */
+    this.surfaceMode = null;
+    /** The request in flight for it, if any. */
+    this.surfaceRequest = null;
   }
   init(config) {
     Configuration.init(config);
@@ -6971,6 +7696,9 @@ var VioFacade = class {
     this.cachedBootstrap = null;
     this.bootstrapFailedAt = 0;
     this.generation++;
+    this.surfaceMode = null;
+    this.surfaceRequest = null;
+    this.preloadPrivacyMode();
     this.checkoutManager?.clearPaymentMethodsCache();
     if (this.slotDeclareTimer) {
       clearTimeout(this.slotDeclareTimer);
@@ -6980,6 +7708,8 @@ var VioFacade = class {
     this.declarationsThisLoad = 0;
     this.warnedLocationCap = false;
     this.warnedDeclarationCap = false;
+    this.warnedDashboardSlots.clear();
+    this.warnedReplacedSlots.clear();
   }
   /**
    * The content (article, page) this SDK instance is rendered in — what every
@@ -7010,9 +7740,13 @@ var VioFacade = class {
     if (!this.cartManager) this.cartManager = new CartManager();
     return this.cartManager;
   }
-  /** Checkout flow manager. Subscribes to cart state via the CartManager. */
+  /** Checkout flow manager. Subscribes to cart state via the CartManager; asks here for the order's attribution. */
   get checkout() {
-    if (!this.checkoutManager) this.checkoutManager = new CheckoutManager(this.cart);
+    if (!this.checkoutManager) {
+      this.checkoutManager = new CheckoutManager(this.cart, {
+        orderAttribution: (sponsorId) => this.orderAttribution(sponsorId)
+      });
+    }
     return this.checkoutManager;
   }
   /**
@@ -7054,6 +7788,7 @@ var VioFacade = class {
         this.cachedBootstrap = res;
         this.bootstrapFailedAt = 0;
         if (this.slotsDirty) this.scheduleSlotDeclaration();
+        this.preloadPrivacyMode();
         return res;
       },
       (err) => {
@@ -7117,9 +7852,14 @@ var VioFacade = class {
       const cfg = Configuration.get();
       storageKey = slotDeclarationStorageKey(cfg.platform, cfg.apiKey);
       now = Date.now();
+      const pageCampaignId = cfg.campaignId;
+      for (const l of all) {
+        if (l.campaignId !== void 0 && l.campaignId === pageCampaignId) delete l.campaignId;
+      }
       const memory = readSlotDeclaration(storageKey);
-      const pending2 = new Set(pendingSlotKeys(memory, all.map(slotDeclarationKey), now));
-      let locations = opts.force ? all : all.filter((l) => pending2.has(slotDeclarationKey(l)));
+      const keyOf = (l) => slotDeclarationKey(l, pageCampaignId);
+      const pending2 = new Set(pendingSlotKeys(memory, all.map(keyOf), now));
+      let locations = opts.force ? all : all.filter((l) => pending2.has(keyOf(l)));
       if (locations.length === 0) return null;
       if (locations.length > MAX_LOCATIONS_PER_DECLARATION) {
         if (!this.warnedLocationCap) {
@@ -7130,7 +7870,7 @@ var VioFacade = class {
         }
         locations = locations.slice(0, MAX_LOCATIONS_PER_DECLARATION);
       }
-      keys = locations.map(slotDeclarationKey);
+      keys = locations.map(keyOf);
       if (!opts.force && this.declarationsThisLoad >= MAX_DECLARATIONS_PER_LOAD) {
         if (!this.warnedDeclarationCap) {
           this.warnedDeclarationCap = true;
@@ -7144,10 +7884,16 @@ var VioFacade = class {
       const result = await this.api.declareManifest({
         platform: cfg.platform,
         mode: "merge",
-        locations
+        locations,
+        ...pageCampaignId !== void 0 ? { campaignId: pageCampaignId } : {}
       });
+      this.reportAssignments(result, locations, pageCampaignId, cfg.debug);
       if (result?.mode === "merge") {
-        writeSlotDeclaration(storageKey, rememberSlotKeys(memory, keys, now));
+        const unhandled = this.campaignNotTakenUp(result, locations, pageCampaignId);
+        const settled = keys.filter((k) => !unhandled.has(k));
+        let next = rememberSlotKeys(memory, settled, now);
+        if (unhandled.size > 0) next = rememberSlotKeys(next, [...unhandled], failedAt(now));
+        writeSlotDeclaration(storageKey, next);
       } else {
         writeSlotDeclaration(storageKey, rememberSlotKeys(memory, keys, failedAt(now)));
         warn(
@@ -7166,21 +7912,34 @@ var VioFacade = class {
   /**
    * Register a slot present on the page (the `<vio-*>` elements call it with
    * their effective id — the host's `vio-slot` or the auto-generated one —
-   * and the optional display name). The registry is declared ONCE, debounced,
-   * after the first successful bootstrap — and again whenever a new id or a
-   * new display name appears. A `displayName` given later for an id already
-   * registered replaces the one kept; `undefined` leaves it alone. The
-   * returned function unregisters; removal never re-declares.
+   * the optional display name, and the element's own campaign when it has
+   * one: `vio-campaign` or an ancestor's `data-vio-campaign`). The registry is
+   * declared ONCE, debounced, after the first successful bootstrap — and again
+   * whenever a new id, display name, campaign or kind appears. A `displayName` /
+   * `campaignId` given later for an id already registered replaces the one
+   * kept; `undefined` leaves it alone. The third argument is the campaign id
+   * (as before) or `{ campaignId?, kind? }`, and a fourth `{ kind? }` may
+   * follow a positional campaign — the elements call
+   * `registerSlot(id, name, campaignId, { kind })` so a facade from an older
+   * bundle, which reads only three arguments, still gets the campaign. `kind`
+   * is what kind of element holds the slot (`card` | `carousel` | `detail`);
+   * the FIRST kind an id gets stays (the cards a carousel renders share its
+   * id: the slot is the carousel's). The returned function unregisters;
+   * removal never re-declares.
    */
-  registerSlot(name, displayName) {
+  registerSlot(name, displayName, campaignIdOrOptions, options) {
     const id = normalizeSlotId(name);
     if (!id) return () => {
     };
     const label = typeof displayName === "string" && displayName.trim() ? displayName.trim() : void 0;
+    const positional = campaignIdOrOptions !== null && typeof campaignIdOrOptions === "object" ? campaignIdOrOptions : { campaignId: campaignIdOrOptions };
+    const merged = { ...positional, ...options ?? {} };
+    const campaign = toCampaignId(merged.campaignId);
+    const kind = normalizeSlotKind(merged.kind);
     const entry = this.slotRegistry.get(id);
     let changed = false;
     if (!entry) {
-      this.slotRegistry.set(id, { count: 1, displayName: label });
+      this.slotRegistry.set(id, { count: 1, displayName: label, campaignId: campaign, kind });
       changed = true;
     } else {
       entry.count++;
@@ -7188,6 +7947,14 @@ var VioFacade = class {
         entry.displayName = label;
         changed = true;
       }
+      if (campaign !== void 0 && campaign !== entry.campaignId) {
+        entry.campaignId = campaign;
+        changed = true;
+      }
+      if (kind !== void 0 && entry.kind === void 0) {
+        entry.kind = kind;
+        changed = true;
+      }
     }
     if (changed) {
       this.slotsDirty = true;
@@ -7208,9 +7975,30 @@ var VioFacade = class {
    * open campaign for the init platform, else the surface's default. With no
    * slot, the default. `null` before the bootstrap. See `resolveSlotCampaign`.
    */
-  campaignForSlot(slot) {
-    const platform = Configuration.isInitialized ? Configuration.get().platform : void 0;
-    return resolveSlotCampaign(this.cachedBootstrap, slot ?? null, Date.now(), platform);
+  campaignForSlot(slot, hint) {
+    const config = Configuration.isInitialized ? Configuration.get() : void 0;
+    return resolveSlotCampaign(
+      this.cachedBootstrap,
+      slot ?? null,
+      Date.now(),
+      config?.platform,
+      this.pageCampaignCandidates(hint?.campaignId),
+      toNumber(hint?.sponsorId)
+    );
+  }
+  /** The page-campaign candidates in precedence order: the element's (own, ancestor), then `Vio.init`'s. */
+  pageCampaignCandidates(hint) {
+    const config = Configuration.isInitialized ? Configuration.get() : void 0;
+    return campaignCandidates([...Array.isArray(hint) ? hint : [hint], config?.campaignId]);
+  }
+  /**
+   * The campaign the PAGE belongs to (`Vio.init({ campaignId })`, ADR-0034
+   * amendment 3), as the last bootstrap lists it — only when it is there and
+   * active; `null` otherwise (no page campaign, paused, unknown, no bootstrap).
+   */
+  pageCampaign() {
+    const config = Configuration.isInitialized ? Configuration.get() : void 0;
+    return activeCampaignEntry(this.cachedBootstrap, config?.campaignId);
   }
   /**
    * THE attribution helper — the SDK elements, Vev and Replit all use this
@@ -7222,8 +8010,12 @@ var VioFacade = class {
    *
    * `hint.sponsorId` — when the caller already knows the sponsor (a card with
    * `sponsor-id`) it is kept as `sponsorId`, and the campaign follows the same
-   * cascade analytics uses (slot assignment → the sponsor's active campaign →
-   * default), so what the cart remembers matches what the events say.
+   * cascade analytics uses (slot assignment → page campaign → the sponsor's
+   * active campaign → default), so what the cart remembers matches what the
+   * events say — the page campaign applies there only when that sponsor takes
+   * part in it. `hint.campaignId` — the element's own page campaign
+   * candidates (`vio-campaign`, an ancestor's `data-vio-campaign`), ahead of
+   * `Vio.init`'s; an unusable one falls through to the next; `0` = unset.
    */
   attribution(slot, hint) {
     const out = {};
@@ -7232,13 +8024,16 @@ var VioFacade = class {
       if (name) out.slot = name;
       const boot = this.cachedBootstrap;
       const hinted = toNumber(hint?.sponsorId);
+      const pageCampaignId = this.pageCampaignCandidates(hint?.campaignId);
       if (boot) {
         if (hinted !== void 0) {
-          const campaignId = resolveCampaignId({ slot: name || void 0, sponsorId: hinted }, boot);
+          const campaignId = resolveCampaignId({ slot: name || void 0, sponsorId: hinted }, boot, {
+            pageCampaignId
+          });
           if (campaignId !== void 0) out.campaignId = campaignId;
           out.sponsorId = hinted;
         } else {
-          const campaign = this.campaignForSlot(name || null);
+          const campaign = this.campaignForSlot(name || null, { campaignId: pageCampaignId });
           const campaignId = toNumber(campaign?.id);
           if (campaignId !== void 0) out.campaignId = campaignId;
           const sponsorId = toNumber(campaign?.primarySponsor?.id);
@@ -7250,10 +8045,155 @@ var VioFacade = class {
       const content = this.content();
       if (content.id) out.contentId = content.id;
       if (content.title) out.contentTitle = content.title;
+      if (content.url) out.contentUrl = content.url;
     } catch {
     }
     return out;
   }
+  /**
+   * What the surface answered and is still believed: `standard` / `minimal`
+   * for the configuration; `unknown` for a minute after a timeout or a
+   * failure (then it is asked again). `null` = nothing believed.
+   */
+  believedSurfaceMode() {
+    const answer = this.surfaceMode;
+    if (!answer) return null;
+    if (answer.mode !== "unknown") return answer.mode;
+    return Date.now() - answer.at < PRIVACY_UNKNOWN_TTL_MS ? "unknown" : null;
+  }
+  /**
+   * Ask the surface its privacy mode (`GET /v2/mobile/surface`), once —
+   * started at `init()` and again by `bootstrap()`, never by the payment
+   * path, which only reads what is known (`privacyModeNow`). Resolves what
+   * was learnt within 1.5 s: the mode; `standard` for a service that predates
+   * the endpoint (404) or a surface that names none; `unknown` for a word the
+   * SDK does not know, a timeout or any other failure — believed for a
+   * minute, then asked again. An answer that arrives after the cap still
+   * lands for the next step. Never throws.
+   */
+  preloadPrivacyMode() {
+    try {
+      if (this.surfaceRequest) return this.surfaceRequest;
+      const believed = this.believedSurfaceMode();
+      if (believed) return Promise.resolve(believed);
+      if (!Configuration.isInitialized) return Promise.resolve("unknown");
+      const now = Date.now();
+      if (Configuration.get().privacyMode === "minimal") {
+        this.surfaceMode = { mode: "minimal", at: now };
+        return Promise.resolve("minimal");
+      }
+      const generation = this.generation;
+      const learnt = (mode) => {
+        if (generation !== this.generation) return;
+        if (mode === "unknown" && this.surfaceMode && this.surfaceMode.mode !== "unknown") return;
+        this.surfaceMode = { mode, at: Date.now() };
+      };
+      const asked = this.api.surface().then(
+        (res) => privacyModeOfSurface(res),
+        (err) => err instanceof VioApiError && err.status === 404 ? "standard" : "unknown"
+      );
+      let timer;
+      const capped = new Promise((resolve) => {
+        timer = setTimeout(() => resolve("unknown"), PRIVACY_MODE_TIMEOUT_MS);
+      });
+      const request = Promise.race([asked, capped]).then((mode) => {
+        clearTimeout(timer);
+        learnt(mode);
+        if (this.surfaceRequest === request) this.surfaceRequest = null;
+        return mode;
+      });
+      void asked.then((mode) => {
+        clearTimeout(timer);
+        learnt(mode);
+      });
+      this.surfaceRequest = request;
+      return request;
+    } catch {
+      return Promise.resolve("unknown");
+    }
+  }
+  /**
+   * How much of the visit the order attribution may carry (ADR-0035): the
+   * surface's privacy mode, as known RIGHT NOW, without waiting —
+   * `Vio.init({ privacyMode: 'minimal' })` when the host says so, else what
+   * the bootstrap says of the surface, else what the surface answered to the
+   * ask `init()` started (`preloadPrivacyMode`), else the host's `standard`
+   * once the surface could not tell. `unknown` while nothing is known: then
+   * the page, the slot and the entry stay off what goes to Commerce, because
+   * what can reveal which screen someone was on, and why, is only sent when
+   * the surface is known to allow it. The payment path reads this one.
+   */
+  privacyModeNow() {
+    try {
+      const config = Configuration.isInitialized ? Configuration.get() : void 0;
+      if (config?.privacyMode === "minimal") return "minimal";
+      const fromBootstrap = privacyModeOf(this.cachedBootstrap?.surface?.privacyMode);
+      if (fromBootstrap) return fromBootstrap;
+      if (!config) return "unknown";
+      const believed = this.believedSurfaceMode();
+      if (believed === "standard" || believed === "minimal") return believed;
+      if (!believed) this.preloadPrivacyMode();
+      return believed === "unknown" ? config.privacyMode ?? "unknown" : "unknown";
+    } catch {
+      return "unknown";
+    }
+  }
+  /**
+   * `privacyModeNow`, but waiting for the ask in flight when there is one
+   * (at most its 1.5 s cap) — for the cart's lines, which are not the
+   * payment path. Never throws.
+   */
+  async privacyMode() {
+    try {
+      const now = this.privacyModeNow();
+      if (now !== "unknown") return now;
+      if (!this.surfaceRequest) return "unknown";
+      const asked = await this.surfaceRequest;
+      if (asked !== "unknown") return asked;
+      const config = Configuration.isInitialized ? Configuration.get() : void 0;
+      return config?.privacyMode ?? "unknown";
+    } catch {
+      return "unknown";
+    }
+  }
+  /**
+   * The attribution of the order a sponsor's cart is about to become
+   * (ADR-0035 phase B) — what `CreateCheckout` / `UpdateCheckout` send as
+   * `attribution` and shopcart writes on the order: the surface (its SDK
+   * key), the page's campaign (`pageCampaign()`; without one, the campaign
+   * that explains most units of the cart under the same rule `purchase` is
+   * split by — `cartSlices`) and, on a surface KNOWN to be `standard`
+   * (`privacyModeNow`), the page (`content()`'s url as origin + path, and
+   * title) and where the session came in: the landing the session REMEMBERS
+   * (`storedLanding`, else the one analytics resolved on this page) — never
+   * the page the shopper pays on taken for a landing. Synchronous: nothing
+   * on the way to a payment waits for it. snake_case, capped to Commerce's
+   * limits. `undefined` when there is nothing to say; never throws.
+   */
+  orderAttribution(sponsorId) {
+    try {
+      const config = Configuration.isInitialized ? Configuration.get() : void 0;
+      const content = this.content();
+      return checkoutAttributionOf({
+        surfaceKey: config?.apiKey,
+        pageCampaignId: toNumber(this.pageCampaign()?.id),
+        slices: this.cartSlices(sponsorId),
+        content: { url: content.url, title: content.title },
+        landing: this.rememberedLanding(),
+        privacyMode: this.privacyModeNow()
+      });
+    } catch {
+      return void 0;
+    }
+  }
+  /** The landing the session remembers: what the first page stored, else what analytics resolved on this page load (consent pending); null otherwise. */
+  rememberedLanding() {
+    try {
+      return storedLanding() ?? this.analyticsManager?.currentLanding ?? null;
+    } catch {
+      return null;
+    }
+  }
   /**
    * The cart split per campaign — the SAME rule `begin_checkout` / `purchase`
    * use, for hosts with their own analytics sink (Vev). Every unit of every
@@ -7283,15 +8223,63 @@ var VioFacade = class {
       return [];
     }
   }
+  /**
+   * What the micro did with the page's campaign per slot (`assignment`):
+   * `console.debug` when `Vio.init({ debug: true })`; a warning once per
+   * slot when the dashboard's own assignment stands (only for a slot this
+   * page actually sent a campaign for) and once per slot when this page moved
+   * it from an earlier page assignment (`replaced`).
+   */
+  reportAssignments(result, sent, pageCampaignId, debug) {
+    const answered = Array.isArray(result?.locations) ? result.locations : [];
+    const campaignFor = (id) => sent.find((l) => l.id === id)?.campaignId ?? pageCampaignId;
+    for (const l of answered) {
+      if (!l || typeof l !== "object" || !l.assignment) continue;
+      if (debug && typeof console !== "undefined") console.debug("[Vio] slot", l.locationId, "assignment:", l.assignment);
+      const sentCampaign = campaignFor(l.locationId);
+      if (sentCampaign === void 0) continue;
+      if (l.assignment === "dashboard" && !this.warnedDashboardSlots.has(l.locationId)) {
+        this.warnedDashboardSlots.add(l.locationId);
+        warn(`slot ${l.locationId} is assigned from the dashboard; the page's campaign is ignored there`);
+      }
+      if (l.assignment === "replaced" && !this.warnedReplacedSlots.has(l.locationId)) {
+        this.warnedReplacedSlots.add(l.locationId);
+        warn(`slot ${l.locationId} moved to campaign ${sentCampaign} by this page (it replaced an earlier page assignment)`);
+      }
+    }
+  }
+  /**
+   * The memory keys of the sent locations whose campaign the micro did not
+   * take up: every location when a campaign was sent and no answer carries
+   * `assignment` (an older micro), or the ones answered `none` for a campaign
+   * the bootstrap lists as active. They are remembered with the 1 h TTL.
+   */
+  campaignNotTakenUp(result, sent, pageCampaignId) {
+    const out = /* @__PURE__ */ new Set();
+    const withCampaign = sent.filter((l) => (l.campaignId ?? pageCampaignId) !== void 0);
+    if (withCampaign.length === 0) return out;
+    const answered = Array.isArray(result?.locations) ? result.locations : [];
+    const anyAssignment = answered.some((l) => l && typeof l === "object" && !!l.assignment);
+    for (const l of withCampaign) {
+      const answer = answered.find((a) => a && a.locationId === l.id);
+      const campaignId = l.campaignId ?? pageCampaignId;
+      const notTaken = !anyAssignment || answer?.assignment === "none" && activeCampaignEntry(this.cachedBootstrap, campaignId) !== null;
+      if (notTaken) out.add(slotDeclarationKey(l, pageCampaignId));
+    }
+    return out;
+  }
   scheduleSlotDeclaration() {
     if (this.slotDeclareTimer) clearTimeout(this.slotDeclareTimer);
     this.slotDeclareTimer = setTimeout(() => {
       this.slotDeclareTimer = null;
       this.slotsDirty = false;
       void this.declareSlots(
-        [...this.slotRegistry.entries()].map(
-          ([id, { displayName }]) => displayName ? { id, displayName } : id
-        )
+        [...this.slotRegistry.entries()].map(([id, { displayName, campaignId, kind }]) => ({
+          id,
+          ...displayName ? { displayName } : {},
+          ...campaignId !== void 0 ? { campaignId } : {},
+          ...kind ? { kind } : {}
+        }))
       );
     }, SLOT_DECLARATION_DEBOUNCE_MS);
   }
@@ -7370,6 +8358,6 @@ function vippsButtonAttributes(verb = "buy", opts = {}) {
   };
 }
 
-export { ADD_ITEM_MUTATION, ADYEN_RETURN_METHOD, ADYEN_RETURN_QUERY_KEYS, AdyenOriginError, AnalyticsManager, CREATE_CART_MUTATION, CREATE_CHECKOUT_MUTATION, CREATE_PAYMENT_STRIPE_MUTATION, CREATE_PAYMENT_VIPPS_MUTATION, CartManager, CheckoutManager, CommerceClient, Configuration, DELETE_ITEM_MUTATION, GET_AVAILABLE_PAYMENT_METHODS_QUERY, GET_CART_QUERY, GET_CHECKOUT_QUERY, GET_LINE_ITEMS_BY_SUPPLIER_QUERY, GET_VIPPS_STATUS_QUERY, KUSTOM_RETURN_QUERY_KEYS, SDK_VERSION, UPDATE_CHECKOUT_MUTATION, UPDATE_ITEM_MUTATION, UPDATE_SHIPPINGS_BY_SUPPLIER_MUTATION, VIPPS_BUTTON_SCRIPT, VIPPS_BUTTON_TAG, Vio, VioApi, VioApiError, __decorateClass, addItem, adyenReturnOutcome, adyenReturnParams, autoSlotDisplayName, autoSlotId, cartSlicesFrom, checkApplePayAvailability, createCart, createCheckout, createCommerceClient, createPaymentStripe, createPaymentVipps, createVioApi, deleteItem, displayPrice, ensureVippsButton, executeCartGraphQL, formatPrice, getAvailablePaymentMethods, getCart, getCartGraphQLOptions, getCheckout, getCustomerSessionId, getGlobalCurrency, getLineItemsBySupplier, getVippsStatus, kustomReturnOutcome, lineOrigins, nexiReturnPaymentId, normalizeOrigin, normalizeScope, normalizeSlotId, primaryImageUrl, purchaseFromPaymentSuccess, readNexiPending, resolveCampaignId, resolveContent, resolveSlotCampaign, sameOrigin, showApplePaySheet, updateCheckout, updateItem, updateShippingsBySupplier, vippsButtonAttributes };
-//# sourceMappingURL=chunk-BRJMT7P4.js.map
-//# sourceMappingURL=chunk-BRJMT7P4.js.map
+export { ADD_ITEM_MUTATION, ADYEN_RETURN_METHOD, ADYEN_RETURN_QUERY_KEYS, AdyenOriginError, AnalyticsManager, BUYER_REF_MAX_LENGTH, CHECKOUT_ATTRIBUTION_CAPS, CLIENT_LANDING_URL_MAX_LENGTH, CONTENT_URL_MAX_LENGTH, CREATE_CART_MUTATION, CREATE_CHECKOUT_MUTATION, CREATE_CHECKOUT_WITH_ATTRIBUTION_MUTATION, CREATE_PAYMENT_STRIPE_MUTATION, CREATE_PAYMENT_VIPPS_MUTATION, CartManager, CheckoutManager, CommerceClient, Configuration, DELETE_ITEM_MUTATION, GET_AVAILABLE_PAYMENT_METHODS_QUERY, GET_CART_QUERY, GET_CHECKOUT_QUERY, GET_LINE_ITEMS_BY_SUPPLIER_QUERY, GET_VIPPS_STATUS_QUERY, GRAPHQL_INT_MAX, KUSTOM_RETURN_QUERY_KEYS, LINE_ORIGIN_CAPS, SDK_VERSION, UPDATE_CHECKOUT_MUTATION, UPDATE_CHECKOUT_WITH_ATTRIBUTION_MUTATION, UPDATE_ITEM_MUTATION, UPDATE_ITEM_WITH_ORIGIN_MUTATION, UPDATE_SHIPPINGS_BY_SUPPLIER_MUTATION, VIPPS_BUTTON_SCRIPT, VIPPS_BUTTON_TAG, Vio, VioApi, VioApiError, __decorateClass, activeCampaignEntry, addItem, adyenReturnOutcome, adyenReturnParams, autoSlotDisplayName, autoSlotId, buyerRefOf, campaignCandidates, capContentUrl, cartSlicesFrom, checkApplePayAvailability, checkoutAttributionOf, componentKindOf, createCart, createCheckout, createCommerceClient, createPaymentStripe, createPaymentVipps, createVioApi, deleteItem, displayPrice, dominantCampaignOf, ensureVippsButton, entryContextOf, executeCartGraphQL, formatPrice, gatewayHas, gatewayHasBuyerRef, getAvailablePaymentMethods, getCart, getCartGraphQLOptions, getCheckout, getCheckoutReference, getCustomerSessionId, getGlobalCurrency, getLineItemsBySupplier, getVippsStatus, isUnknownFeatureError, isUnknownTokenError, kustomReturnOutcome, landingUrl, lineOriginWire, lineOrigins, nexiReturnPaymentId, normalizeBuyerRef, normalizeOrigin, normalizeScope, normalizeSlotId, normalizeSlotKind, originAndPath, primaryImageUrl, purchaseFromPaymentSuccess, readNexiPending, resetGatewayFeatures, resolveCampaignId, resolveClientContext, resolveContent, resolveLanding, resolveSlotCampaign, sameOrigin, showApplePaySheet, sponsorCampaignEntry, storedLanding, toCampaignId, updateCheckout, updateItem, updateShippingsBySupplier, vippsButtonAttributes, withGatewayFeature };
+//# sourceMappingURL=chunk-5KWICUME.js.map
+//# sourceMappingURL=chunk-5KWICUME.js.map